Findings

Disabling the key makes the existing log files unreadable now. A deletion that runs its course makes them unreadable permanently, without a single log file being touched. Root account used on generated-workload-0 in us-east-1 (account 123456789012): first seen 0 days ago and still present on the run that wrote this board; the weak set grew from 0 to 2 between the two runs, and none of the new members is covered by an allowlist entry.V-001 · f/A4kqZHhQXj · e/123456789ABC e/89ABCDEFGHJK e/FGHJKLMNPQRS +1

observed on synthetic accountsV-004 · f/5VA7vrDB4E · t/4b1c9e0a-1234-4abc-8def-0123456789ab

Disabling the key makes the existing log files unreadable now. A deletion that runs its course makes them unreadable permanently, without a single log file being touched. Administrator-equivalent AWS-managed policy on a service principal on generated-workload-16 in us-west-2 (account 234567890123): first seen 112 days ago and still present on the run that wrote this board; the weak set grew from 0 to 2 between the two runs, and none of the new members is covered by an allowlist entry.V-010 · f/5zDhYAh8zQ · e/HJKLMNPQRSTU e/QRSTUVWXYZab e/XYZabcdefghi +8

Disabling the key makes the existing log files unreadable now. A deletion that runs its course makes them unreadable permanently, without a single log file being touched. EC2 instance accepts IMDSv1 on generated-workload-8 in eu-central-1 (account 345678901234): first seen 56 days ago and still present on the run that wrote this board; the weak set grew from 0 to 2 between the two runs, and none of the new members is covered by an allowlist entry.V-013a · f/2dTniNd4qd · e/9ABCDEFGHJKL e/GHJKLMNPQRST e/PQRSTUVWXYZa +9