Azure Security, Cloud Security, Cloudsecurity, Downloads, GCP Security, Hacking Tools, Kubernetes Security, TerraformGoat

TerraformGoat – “Vulnerable By Design” Multi Cloud Deployment Tool

TerraformGoat is selefra research lab’s “Vulnerable by Design” multi cloud deployment tool.

Currently supported cloud vendors include Alibaba Cloud, Tencent Cloud, Huawei Cloud, Amazon Web Services, Google Cloud Platform, Microsoft Azure.



TerraformGoat is deployed using Docker images and therefore requires Docker Engine environment support, Docker Engine installation can be found in

Depending on the cloud service provider you are using, choose the corresponding installation command.

Alibaba Cloud

docker pull
docker run -itd --name terraformgoat_aliyun_0.0.4
docker exec -it terraformgoat_aliyun_0.0.4 /bin/bash

Tencent Cloud

docker pull
docker run -itd --name terraformgoat_tencentcloud_0.0.4
docker exec -it terraformgoat_tencentcloud_0.0.4 /bin/bash

Huawei Cloud

docker pull
docker run -itd --name terraformgoat_huaweicloud_0.0.4
docker exec -it terraformgoat_huaweicloud_0.0.4 /bin/bash

Amazon Web Services

docker pull
docker run -itd --name terraformgoat_aws_0.0.4
docker exec -it terraformgoat_aws_0.0.4 /bin/bash

Google Cloud Platform

docker pull
docker run -itd --name terraformgoat_gcp_0.0.4
docker exec -it terraformgoat_gcp_0.0.4 /bin/bash

Microsoft Azure

docker pull
docker run -itd --name terraformgoat_azure_0.0.4
docker exec -it terraformgoat_azure_0.0.4 /bin/bash


After entering the container, cd to the corresponding scenario directory and you can start deploying the scenario.

Here is a demonstration of the Alibaba Cloud Bucket Object Traversal scenario build.

docker pull
docker run -itd --name terraformgoat_aliyun_0.0.4
docker exec -it terraformgoat_aliyun_0.0.4 /bin/bash


cd /TerraformGoat/aliyun/oss/bucket_object_traversal/
aliyun configure
terraform init
terraform apply

The program prompts Enter a value:, type yes and enter, use curl to access the bucket, you can see the object traversed.

To avoid the cloud service from continuing to incur charges, remember to destroy the scenario in time after using it.

terraform destroy


If you are in a container, first execute the exit command to exit the container, and then execute the following command under the host.

docker stop $(docker ps -a -q -f "name=terraformgoat*")
docker rm $(docker ps -a -q -f "name=terraformgoat*")
docker rmi $(docker images -a -q -f "*")

  1. The README of each vulnerable environment is executed within the TerraformGoat container environment, so the TerraformGoat container environment needs to be deployed first.
  2. Due to the horizontal risk of intranet horizontal on the cloud in some scenarios, it is strongly recommended that users use their own test accounts to configure the scenarios, avoid using the cloud account of the production environment, and install TerraformGoat using Dockerfile to isolate the user’s local cloud vendor token and the test account token.
  3. TerraformGoat is used for educational purposes only, It is not allowed to use it for illegal and criminal purposes, any consequences arising from TerraformGoat are the responsibility of the person using it, and not the selefra organization.


Contributions are welcomed and greatly appreciated. Further reading — for details on contribution workflow.


TerraformGoat is under the Apache 2.0 license. See the LICENSE file for details.

Source : KitPloit – PenTest Tools!

Previous ArticleNext Article
Send this to a friend