English | 中文

Terraform Goat is HuoXian research team' "Vulnerable by Design" multi cloud deployment tool.

Currently supported cloud vendors include Alibaba Cloud, Tencent Cloud, Huawei Cloud, Amazon Web Services, Google Cloud Platform, Microsoft Azure.

Terraform Goat is built using Dockerfile, so you need to install the Docker environment first. For the Docker installation method, please refer to: https://docs.docker.com/get-docker/

git clone https://github.com/HuoCorp/TerraformGoat.git
cd terraformgoat
docker build -t terraformgoat:v0.1 .

After docker build is complete, start and enter the container

docker run -itd --name terraformgoat terraformgoat:v0.1
docker exec -it terraformgoat /bin/bash

When entering the container, you need to select the cloud service to run

After selecting the cloud service you want to use, the relevant dependencies will be installed. After the relevant dependencies are installed, you can use terraformgoat.

docker stop terraformgoat
docker rm terraformgoat
docker rmi terraformgoat:v0.1

1. The README of each vulnerable environment is executed within the terraformgoat container environment, so the terraformgoat container environment needs to be deployed first.
2. Due to the horizontal risk of intranet horizontal on the cloud in some ranges, it is strongly recommended that users use their own test accounts to configure the ranges, avoid using the cloud account of the production environment, and install Terraform Goat using Dockerfile to isolate the user's local cloud vendor token and the test account token.