Demo on recorded data — get early access
FindingsCritical2High7Medium3Sign out

Findings

12 findings · run finished 2026-09-12 06:04Z · worst first

CriticalAdministrator-equivalent AWS-managed policy on a service principalpart of case k/cbfca6f4bf85234567890123 · us-west-2‹generated-workload-16› +5112d
Disabling the key makes the existing log files unreadable now. A deletion that runs its course makes them unreadable permanently, without a single log file being touched. Administrator-equivalent AWS-managed policy on a service principal on generated-workload-16 in us-west-2 (account 234567890123): first seen 112 days ago and still present on the run that wrote this board; the weak set grew from 0 to 2 between the two runs, and none of the new members is covered by an allowlist entry.V-010 · f/5zDhYAh8zQ · e/HJKLMNPQRSTU e/QRSTUVWXYZab e/XYZabcdefghi +8
CriticalAdministrator-equivalent AWS-managed policy on a service principalsandbox · us-west-2‹generated-workload-56› +332d
Disabling the key makes the existing log files unreadable now. A deletion that runs its course makes them unreadable permanently, without a single log file being touched. Administrator-equivalent AWS-managed policy on a service principal on generated-workload-56 in us-west-2 (account 345678901234): first seen 32 days ago and still present on the run that wrote this board; the weak set grew from 0 to 2 between the two runs, and none of the new members is covered by an allowlist entry.V-010 · f/DSTWvQYDBY · e/HJKLMNPQRSTU e/QRSTUVWXYZab e/XYZabcdefghi +3
HighAdministrator-equivalent AWS-managed policy on a service principal234567890123 · us-west-2‹generated-workload-46› +7142d
Disabling the key makes the existing log files unreadable now. A deletion that runs its course makes them unreadable permanently, without a single log file being touched. Administrator-equivalent AWS-managed policy on a service principal on generated-workload-46 in us-west-2 (account 234567890123): first seen 142 days ago and still present on the run that wrote this board; the weak set grew from 2 to 4 between the two runs, and none of the new members is covered by an allowlist entry.V-010 · f/HvuWDYyCrp · e/789ABCDEFGHJ e/EFGHJKLMNPQR e/MNPQRSTUVWXY +2
HighAdministrator-equivalent AWS-managed policy on a service principalprod-acct · us-west-2 / payments-prod-cluster-0‹generated-workload-96› +8132d
Disabling the key makes the existing log files unreadable now. A deletion that runs its course makes them unreadable permanently, without a single log file being touched. Administrator-equivalent AWS-managed policy on a service principal on generated-workload-96 in us-west-2 (account 123456789012): first seen 132 days ago and still present on the run that wrote this board; the weak set grew from 0 to 2 between the two runs, and none of the new members is covered by an allowlist entry.V-010 · f/3oPt823ZaP · e/HJKLMNPQRSTU e/QRSTUVWXYZab e/XYZabcdefghi +7
HighAdministrator-equivalent AWS-managed policy on a service principalprod-acct · us-west-2 / payments-prod-cluster-2‹generated-workload-66› +6102d
Disabling the key makes the existing log files unreadable now. A deletion that runs its course makes them unreadable permanently, without a single log file being touched. Administrator-equivalent AWS-managed policy on a service principal on generated-workload-66 in us-west-2 (account 123456789012): first seen 102 days ago and still present on the run that wrote this board; the weak set grew from 2 to 4 between the two runs, and none of the new members is covered by an allowlist entry.V-010 · f/8cyu4rwePo · e/TUVWXYZabcde e/abcdefghijkm e/123456789ABC +4
HighAdministrator-equivalent AWS-managed policy on a service principalsandbox · us-west-2‹generated-workload-86› +562d
Disabling the key makes the existing log files unreadable now. A deletion that runs its course makes them unreadable permanently, without a single log file being touched. Administrator-equivalent AWS-managed policy on a service principal on generated-workload-86 in us-west-2 (account 345678901234): first seen 62 days ago and still present on the run that wrote this board; the weak set grew from 2 to 4 between the two runs, and none of the new members is covered by an allowlist entry.V-010 · f/31uQZehnMk · e/789ABCDEFGHJ e/EFGHJKLMNPQR e/MNPQRSTUVWXY +6
HighAdministrator-equivalent AWS-managed policy on a service principalprod-acct · us-west-2 / payments-prod-cluster-2‹generated-workload-6› +942d
Disabling the key makes the existing log files unreadable now. A deletion that runs its course makes them unreadable permanently, without a single log file being touched. Administrator-equivalent AWS-managed policy on a service principal on generated-workload-6 in us-west-2 (account 123456789012): first seen 42 days ago and still present on the run that wrote this board; the weak set grew from 2 to 4 between the two runs, and none of the new members is covered by an allowlist entry.V-010 · f/A8GGP4kTWS · e/789ABCDEFGHJ e/EFGHJKLMNPQR e/MNPQRSTUVWXY +7
HighAdministrator-equivalent AWS-managed policy on a service principal234567890123 · us-west-2‹generated-workload-106› +422d
Disabling the key makes the existing log files unreadable now. A deletion that runs its course makes them unreadable permanently, without a single log file being touched. Administrator-equivalent AWS-managed policy on a service principal on generated-workload-106 in us-west-2 (account 234567890123): first seen 22 days ago and still present on the run that wrote this board; the weak set grew from 2 to 4 between the two runs, and none of the new members is covered by an allowlist entry.V-010 · f/HmdFSucgoD · e/TUVWXYZabcde e/abcdefghijkm e/123456789ABC +8
HighAdministrator-equivalent AWS-managed policy on a service principalsandbox · us-west-2‹generated-workload-26› +82d
Disabling the key makes the existing log files unreadable now. A deletion that runs its course makes them unreadable permanently, without a single log file being touched. Administrator-equivalent AWS-managed policy on a service principal on generated-workload-26 in us-west-2 (account 345678901234): first seen 2 days ago and still present on the run that wrote this board; the weak set grew from 2 to 4 between the two runs, and none of the new members is covered by an allowlist entry.V-010 · f/HskYzEnvuA · e/TUVWXYZabcde e/abcdefghijkm e/123456789ABC +9
MediumAdministrator-equivalent AWS-managed policy on a service principal234567890123 · us-west-2‹generated-workload-76› +9172d
Disabling the key makes the existing log files unreadable now. A deletion that runs its course makes them unreadable permanently, without a single log file being touched. Administrator-equivalent AWS-managed policy on a service principal on generated-workload-76 in us-west-2 (account 234567890123): first seen 172 days ago and still present on the run that wrote this board; the weak set grew from 0 to 2 between the two runs, and none of the new members is covered by an allowlist entry.V-010 · f/BaGGY9vEX4 · e/defghijkmnop e/456789ABCDEF e/BCDEFGHJKLMN +5
MediumAdministrator-equivalent AWS-managed policy on a service principalsandbox · us-west-2‹generated-workload-116› +792d
Disabling the key makes the existing log files unreadable now. A deletion that runs its course makes them unreadable permanently, without a single log file being touched. Administrator-equivalent AWS-managed policy on a service principal on generated-workload-116 in us-west-2 (account 345678901234): first seen 92 days ago and still present on the run that wrote this board; the weak set grew from 0 to 2 between the two runs, and none of the new members is covered by an allowlist entry.V-010 · f/FZdwXvfs3R · e/defghijkmnop e/456789ABCDEF e/BCDEFGHJKLMN +9
MediumAdministrator-equivalent AWS-managed policy on a service principalprod-acct · us-west-2 / payments-prod-cluster-0‹generated-workload-36› +472d
Disabling the key makes the existing log files unreadable now. A deletion that runs its course makes them unreadable permanently, without a single log file being touched. Administrator-equivalent AWS-managed policy on a service principal on generated-workload-36 in us-west-2 (account 123456789012): first seen 72 days ago and still present on the run that wrote this board; the weak set grew from 0 to 2 between the two runs, and none of the new members is covered by an allowlist entry.V-010 · f/F7qU6gjwsT · e/defghijkmnop e/456789ABCDEF e/BCDEFGHJKLMN +1