Overview
golemsec is a fully AWS-hosted simulation of a real ~200-employee Israeli finance company (insurance + stock brokerage). It exists to be a realistic, stable, long-lived scan target for Binary Networks' asset-discovery and security-architecture product — the kind of environment a real customer would point the scanner at.
Organization Architecture
golemsec is modeled as GolemSec Ltd., an Israeli financial-services firm operating two lines of business:
AWS Architecture
golemsec runs entirely in AWS, provisioned via Terraform (D:\golemsec\terraform) and configured via AWS SSM Run Command (no RDP/SSH exposure required).
Systems Inventory
The full instance fleet (21 EC2 instances) and the services running on each. All in VPC vpc-018f15d8bc3e88255, region us-east-1.
Identity & SSO
The identity fabric is what turns golemsec from "a pile of running apps" into "a company people can actually log into." Active Directory is the source of truth; Keycloak federates it; apps authenticate employees via OIDC SSO.
Data Model
The crown-jewel dataset. A single PostgreSQL database on db-pgmy (10.50.30.12:5432, database golemsec_corp) that models the whole finance business with realistic, interconnected data — the high-value target a real scanner/DLP engine should discover.
Credentials & Break-Glass
This page lists every administrative and service credential for the golemsec lab. These are lab/demo credentials for a private, non-internet-exposed environment — they are documented here deliberately so the operator can recover access. Do not reuse these passwords anywhere outside the golemsec lab.
Build Status
Living status of the golemsec build. Updated at every stage.
Operational Walkthrough
A hands-on exercise: operate the company as its own users, each persona using only their own AD account (no admin bypass), to see whether real business workflows actually work end-to-end — and where they break.
Cost Control (On/Off Switch)
golemsec is a lab. The biggest cost lever is simply stopping compute when you're not using it. EC2 charges for compute only while instances run; stopped instances keep their disks (EBS), private IPs, EIP, and all configuration — nothing rebuilds.
Disaster Recovery & Runbook
How to recover golemsec if something breaks — a single host, the data, or the whole environment.