Cloud › Module 1 › Lesson 3
No Stranger Tenants
No stranger tenants means refuse scanning, exploiting, or enumerating cloud accounts you do not own — write the refusal habit into YOUR $CLOUD_LAB ethics card.
Visual · t31_no_stranger_tenants
Tenant refusal. $CLOUD_LAB only. Original Cyberlium.
Opening
Open bucket lists, leaked key repos, and stranger subscription scans — all stop outside authorized defensive scope. Literacy names the misconfig; hardening stays on your accounts.
Stranger tenant abuse includes scanning public bucket indexes for live data, using leaked access keys against unknown accounts, and running cloud recon tooling against employer or victim subscriptions without authorization. Org scope follows ownership: finance, health, and SaaS tenants without ticket stay off limits. Cyberlium practices refusal sentences on YOUR $CLOUD_LAB — 'I harden only my sandbox accounts and name misconfigs for defender context' — never copy forum threads that aim cloud tooling at live stranger services. Next: Lab Setup.
1. Stranger tenant patterns refused (named, literacy only)
Public bucket hunting on stranger accounts: scanning indexes for live customer data — named for misconfig literacy, NOT executed on Cyberlium. Leaked key abuse: running CLI commands with keys from breach dumps — defender fix is rotation and hardening, not student replication.
On $CLOUD_LAB, write three refusal triggers — e.g., stranger AWS account scan request, leaked key tutorial, live enumeration against unknown subscription.
Command guide
Try these commands — Stranger tenant patterns refused (named, literacy only)
═══ DOCKER & CONTAINER AUDIT ═══
Check container running state and port bindings
Command — copy this
docker ps --format "table {{.ID}} {{.Image}} {{.Status}} {{.Ports}}" 2>/dev/null || echo "docker ps"Inspect container for elevated capabilities and root user
Command — copy this
docker inspect --format '{{json .HostConfig.Privileged}}' <container_id> 2>/dev/null || trueRun security vulnerability scan on container image using Trivy
Command — copy this
trivy image --severity HIGH,CRITICAL alpine:3.19 2>/dev/null || echo "trivy image alpine:3.19"
═══ KUBERNETES RBAC AUDIT ═══ Check current permissions in namespace
Command — copy this
kubectl auth can-i --list 2>/dev/null || echo "kubectl auth can-i"
Primary tools to practice this lesson: grep, python3. Reference sites: AWS acceptable use (https://docs.aws.amazon.com/security/); Azure responsible use (https://learn.microsoft.com/en-us/azure/security/fundamentals/overview); OWASP cloud (https://owasp.org/www-project-cloud-security/). Run every command in the box — install first, then the usage lines — only on YOUR lab / program scope.
2. Why refusal protects you and others
Unauthorized cloud access laws and employer policy apply to recon and exploitation — skill without scope is career and legal risk. Victim data: stranger tenant objects may contain PII, credentials, and customer records you must not exfiltrate.
Defenders detect and remediate these misconfigs — students practice naming them for hardening notes on lab scenarios and defender cards only.
3. Ethics card habit
Forbidden: running bucket scanners on stranger accounts, sharing exploit chains in class chat, importing victim cloud exports without scope. Allowed: ethics card — allowed account IDs, NEVER list, refusal sentence you will say aloud.
Ship: cloud ethics card with NEVER list and one refusal sentence. Next: Lab Setup.
4. What you ship: cloud ethics card for $CLOUD_LAB
Allowed accounts, NEVER list, refusal sentence. $CLOUD_LAB named. NO stranger tenant scans. chmod 600.
5. What you record before the next lesson
Date. Ethics card. $CLOUD_LAB named. File t31-m01-l03-no-stranger-tenants.txt chmod 600.
6. Wrong vs right: stranger tenants vs YOUR cloud accounts
Worked failure — same MSF word, opposite target. Right never needs a café Wi-Fi or classmate laptop.
Wrong
Follow leaked-key tutorial on unknown AWS account 'for detection.' Share stranger bucket list in Discord.
Right
Write cloud ethics card for YOUR $CLOUD_LAB. Next: Lab Setup.
Mission: write YOUR stranger-tenant refusal habit
1) List three NEVER targets (stranger scans, leaked keys, unauthorized enumeration). 2) Write one refusal sentence for stranger tenant requests. 3) Name allowed $CLOUD_LAB account surfaces. 4) chmod 600.
Stuck? Ask Cyberlium AI Mentor
Name misconfigs for hardening — never replicate attacks on tenants you do not own.
Knowledge Check
APPLY: No stranger tenants on Cyberlium means:
Multiple choice
Knowledge Check
APPLY: True or False: Public bucket misconfigs are taught as named risk classes with defender fixes — not as live hunting on stranger data.
True or False
Knowledge Check
APPLY: Discord link to leaked AWS key for unknown account — you:
Multiple choice