Findings

Disabling the key makes the existing log files unreadable now. A deletion that runs its course makes them unreadable permanently, without a single log file being touched. Default policy version changed on an attached policy by a non-deployer on generated-workload-92 in eu-west-1 (account 345678901234): first seen 104 days ago and still present on the run that wrote this board; the weak set grew from 0 to 2 between the two runs, and none of the new members is covered by an allowlist entry.V-003 · f/2VG3MsB7GC · e/DEFGHJKLMNPQ e/LMNPQRSTUVWX e/TUVWXYZabcde +3

Disabling the key makes the existing log files unreadable now. A deletion that runs its course makes them unreadable permanently, without a single log file being touched. Default policy version changed on an attached policy by a non-deployer on generated-workload-12 in eu-west-1 (account 123456789012): first seen 84 days ago and still present on the run that wrote this board; the weak set grew from 0 to 2 between the two runs, and none of the new members is covered by an allowlist entry.V-003 · f/H2nPpcxPT7 · e/DEFGHJKLMNPQ e/LMNPQRSTUVWX e/TUVWXYZabcde +4

Disabling the key makes the existing log files unreadable now. A deletion that runs its course makes them unreadable permanently, without a single log file being touched. Default policy version changed on an attached policy by a non-deployer on generated-workload-52 in eu-west-1 (account 234567890123): first seen 4 days ago and still present on the run that wrote this board; the weak set grew from 0 to 2 between the two runs, and none of the new members is covered by an allowlist entry.V-003 · f/2LRiP945Ug · e/DEFGHJKLMNPQ e/LMNPQRSTUVWX e/TUVWXYZabcde +8

Disabling the key makes the existing log files unreadable now. A deletion that runs its course makes them unreadable permanently, without a single log file being touched. Root account used on generated-workload-100 in us-east-1 (account 234567890123): first seen 160 days ago and still present on the run that wrote this board; the weak set grew from 0 to 2 between the two runs, and none of the new members is covered by an allowlist entry.V-001 · f/9zRn53YkWH · e/MNPQRSTUVWXY e/UVWXYZabcdef e/bcdefghijkmn +2

Disabling the key makes the existing log files unreadable now. A deletion that runs its course makes them unreadable permanently, without a single log file being touched. Root account used on generated-workload-20 in us-east-1 (account 345678901234): first seen 140 days ago and still present on the run that wrote this board; the weak set grew from 0 to 2 between the two runs, and none of the new members is covered by an allowlist entry.V-001 · f/BvuA23pvFc · e/MNPQRSTUVWXY e/UVWXYZabcdef e/bcdefghijkmn +3

Disabling the key makes the existing log files unreadable now. A deletion that runs its course makes them unreadable permanently, without a single log file being touched. Root account used on generated-workload-60 in us-east-1 (account 123456789012): first seen 60 days ago and still present on the run that wrote this board; the weak set grew from 0 to 2 between the two runs, and none of the new members is covered by an allowlist entry.V-001 · f/EZaYZ4FN6u · e/MNPQRSTUVWXY e/UVWXYZabcdef e/bcdefghijkmn +7

Disabling the key makes the existing log files unreadable now. A deletion that runs its course makes them unreadable permanently, without a single log file being touched. Trail KMS key disabled or scheduled for deletion on generated-workload-71 in us-west-2 (account 345678901234): first seen 137 days ago and still present on the run that wrote this board; the weak set grew from 3 to 5 between the two runs, and none of the new members is covered by an allowlist entry.V-002 · f/HEvE2Er7r8 · e/YZabcdefghij e/fghijkmnopqr e/6789ABCDEFGH +9

Disabling the key makes the existing log files unreadable now. A deletion that runs its course makes them unreadable permanently, without a single log file being touched. Trail KMS key disabled or scheduled for deletion on generated-workload-41 in us-west-2 (account 345678901234): first seen 107 days ago and still present on the run that wrote this board; the weak set grew from 1 to 3 between the two runs, and none of the new members is covered by an allowlist entry.V-002 · f/Hs3wrok7Jh · e/23456789ABCD e/9ABCDEFGHJKL e/GHJKLMNPQRST +6

Disabling the key makes the existing log files unreadable now. A deletion that runs its course makes them unreadable permanently, without a single log file being touched. Trail KMS key disabled or scheduled for deletion on generated-workload-111 in us-west-2 (account 123456789012): first seen 57 days ago and still present on the run that wrote this board; the weak set grew from 3 to 5 between the two runs, and none of the new members is covered by an allowlist entry.V-002 · f/6LzBR2nYDk · e/YZabcdefghij e/fghijkmnopqr e/6789ABCDEFGH +4

Disabling the key makes the existing log files unreadable now. A deletion that runs its course makes them unreadable permanently, without a single log file being touched. Trail KMS key disabled or scheduled for deletion on generated-workload-31 in us-west-2 (account 234567890123): first seen 37 days ago and still present on the run that wrote this board; the weak set grew from 3 to 5 between the two runs, and none of the new members is covered by an allowlist entry.V-002 · f/2yuhos65Lw · e/YZabcdefghij e/fghijkmnopqr e/6789ABCDEFGH +5

Disabling the key makes the existing log files unreadable now. A deletion that runs its course makes them unreadable permanently, without a single log file being touched. Trail KMS key disabled or scheduled for deletion on generated-workload-81 in us-west-2 (account 123456789012): first seen 27 days ago and still present on the run that wrote this board; the weak set grew from 1 to 3 between the two runs, and none of the new members is covered by an allowlist entry.V-002 · f/DB71Lsa9gz · e/23456789ABCD e/9ABCDEFGHJKL e/GHJKLMNPQRST +1

Disabling the key makes the existing log files unreadable now. A deletion that runs its course makes them unreadable permanently, without a single log file being touched. Trail KMS key disabled or scheduled for deletion on generated-workload-1 in us-west-2 (account 234567890123): first seen 7 days ago and still present on the run that wrote this board; the weak set grew from 1 to 3 between the two runs, and none of the new members is covered by an allowlist entry.V-002 · f/2y2apsmrLL · e/23456789ABCD e/9ABCDEFGHJKL e/GHJKLMNPQRST +2

Disabling the key makes the existing log files unreadable now. A deletion that runs its course makes them unreadable permanently, without a single log file being touched. OIDC provider client id added on generated-workload-25 in us-east-1 (account 234567890123): first seen 175 days ago and still present on the run that wrote this board; the weak set grew from 1 to 3 between the two runs, and none of the new members is covered by an allowlist entry.V-009 · f/AhcbpHrrdB · e/STUVWXYZabcd e/Zabcdefghijk e/ghijkmnopqrs +8

Disabling the key makes the existing log files unreadable now. A deletion that runs its course makes them unreadable permanently, without a single log file being touched. OIDC provider client id added on generated-workload-95 in us-east-1 (account 345678901234): first seen 125 days ago and still present on the run that wrote this board; the weak set grew from 3 to 5 between the two runs, and none of the new members is covered by an allowlist entry.V-009 · f/E3vVZkXgLQ · e/GHJKLMNPQRST e/PQRSTUVWXYZa e/WXYZabcdefgh +6

Disabling the key makes the existing log files unreadable now. A deletion that runs its course makes them unreadable permanently, without a single log file being touched. OIDC provider client id added on generated-workload-15 in us-east-1 (account 123456789012): first seen 105 days ago and still present on the run that wrote this board; the weak set grew from 3 to 5 between the two runs, and none of the new members is covered by an allowlist entry.V-009 · f/Cu9RdzrAkZ · e/GHJKLMNPQRST e/PQRSTUVWXYZa e/WXYZabcdefgh +7

Disabling the key makes the existing log files unreadable now. A deletion that runs its course makes them unreadable permanently, without a single log file being touched. OIDC provider client id added on generated-workload-65 in us-east-1 (account 345678901234): first seen 95 days ago and still present on the run that wrote this board; the weak set grew from 1 to 3 between the two runs, and none of the new members is covered by an allowlist entry.V-009 · f/G2VqgQkQoe · e/STUVWXYZabcd e/Zabcdefghijk e/ghijkmnopqrs +3

Disabling the key makes the existing log files unreadable now. A deletion that runs its course makes them unreadable permanently, without a single log file being touched. OIDC provider client id added on generated-workload-55 in us-east-1 (account 234567890123): first seen 25 days ago and still present on the run that wrote this board; the weak set grew from 3 to 5 between the two runs, and none of the new members is covered by an allowlist entry.V-009 · f/4HAboUoZ4W · e/GHJKLMNPQRST e/PQRSTUVWXYZa e/WXYZabcdefgh +2

Disabling the key makes the existing log files unreadable now. A deletion that runs its course makes them unreadable permanently, without a single log file being touched. OIDC provider client id added on generated-workload-105 in us-east-1 (account 123456789012): first seen 15 days ago and still present on the run that wrote this board; the weak set grew from 1 to 3 between the two runs, and none of the new members is covered by an allowlist entry.V-009 · f/C23sHYSv3z · e/STUVWXYZabcd e/Zabcdefghijk e/ghijkmnopqrs +7

Disabling the key makes the existing log files unreadable now. A deletion that runs its course makes them unreadable permanently, without a single log file being touched. Administrator-equivalent AWS-managed policy on a service principal on generated-workload-76 in us-west-2 (account 234567890123): first seen 172 days ago and still present on the run that wrote this board; the weak set grew from 0 to 2 between the two runs, and none of the new members is covered by an allowlist entry.V-010 · f/BaGGY9vEX4 · e/defghijkmnop e/456789ABCDEF e/BCDEFGHJKLMN +5

Disabling the key makes the existing log files unreadable now. A deletion that runs its course makes them unreadable permanently, without a single log file being touched. Administrator-equivalent AWS-managed policy on a service principal on generated-workload-116 in us-west-2 (account 345678901234): first seen 92 days ago and still present on the run that wrote this board; the weak set grew from 0 to 2 between the two runs, and none of the new members is covered by an allowlist entry.V-010 · f/FZdwXvfs3R · e/defghijkmnop e/456789ABCDEF e/BCDEFGHJKLMN +9

Disabling the key makes the existing log files unreadable now. A deletion that runs its course makes them unreadable permanently, without a single log file being touched. Administrator-equivalent AWS-managed policy on a service principal on generated-workload-36 in us-west-2 (account 123456789012): first seen 72 days ago and still present on the run that wrote this board; the weak set grew from 0 to 2 between the two runs, and none of the new members is covered by an allowlist entry.V-010 · f/F7qU6gjwsT · e/defghijkmnop e/456789ABCDEF e/BCDEFGHJKLMN +1

Disabling the key makes the existing log files unreadable now. A deletion that runs its course makes them unreadable permanently, without a single log file being touched. Access key minted on another user on generated-workload-23 in eu-central-1 (account 345678901234): first seen 161 days ago and still present on the run that wrote this board; the weak set grew from 3 to 5 between the two runs, and none of the new members is covered by an allowlist entry.V-004 · f/95WftKfNAF · e/QRSTUVWXYZab e/XYZabcdefghi e/efghijkmnopq +6

Disabling the key makes the existing log files unreadable now. A deletion that runs its course makes them unreadable permanently, without a single log file being touched. Access key minted on another user on generated-workload-73 in eu-central-1 (account 234567890123): first seen 151 days ago and still present on the run that wrote this board; the weak set grew from 1 to 3 between the two runs, and none of the new members is covered by an allowlist entry.V-004 · f/CFXkn5tQvF · e/abcdefghijkm e/123456789ABC e/89ABCDEFGHJK +2

Disabling the key makes the existing log files unreadable now. A deletion that runs its course makes them unreadable permanently, without a single log file being touched. Access key minted on another user on generated-workload-63 in eu-central-1 (account 123456789012): first seen 81 days ago and still present on the run that wrote this board; the weak set grew from 3 to 5 between the two runs, and none of the new members is covered by an allowlist entry.V-004 · f/AgFoTMag59 · e/QRSTUVWXYZab e/XYZabcdefghi e/efghijkmnopq +1

Disabling the key makes the existing log files unreadable now. A deletion that runs its course makes them unreadable permanently, without a single log file being touched. Access key minted on another user on generated-workload-113 in eu-central-1 (account 345678901234): first seen 71 days ago and still present on the run that wrote this board; the weak set grew from 1 to 3 between the two runs, and none of the new members is covered by an allowlist entry.V-004 · f/F4sHUGvTHN · e/abcdefghijkm e/123456789ABC e/89ABCDEFGHJK +6

Disabling the key makes the existing log files unreadable now. A deletion that runs its course makes them unreadable permanently, without a single log file being touched. Access key minted on another user on generated-workload-33 in eu-central-1 (account 123456789012): first seen 51 days ago and still present on the run that wrote this board; the weak set grew from 1 to 3 between the two runs, and none of the new members is covered by an allowlist entry.V-004 · f/GfmbB7AHbU · e/abcdefghijkm e/123456789ABC e/89ABCDEFGHJK +7

Disabling the key makes the existing log files unreadable now. A deletion that runs its course makes them unreadable permanently, without a single log file being touched. Access key minted on another user on generated-workload-103 in eu-central-1 (account 234567890123): first seen 1 days ago and still present on the run that wrote this board; the weak set grew from 3 to 5 between the two runs, and none of the new members is covered by an allowlist entry.V-004 · f/7rNaK68Eqg · e/QRSTUVWXYZab e/XYZabcdefghi e/efghijkmnopq +5

Disabling the key makes the existing log files unreadable now. A deletion that runs its course makes them unreadable permanently, without a single log file being touched. AMI shared publicly on generated-workload-44 in ap-southeast-1 (account 345678901234): first seen 128 days ago and still present on the run that wrote this board; the weak set grew from 0 to 2 between the two runs, and none of the new members is covered by an allowlist entry.V-008 · f/5aaW9ER6hH · e/56789ABCDEFG e/CDEFGHJKLMNP e/KLMNPQRSTUVW +9

Disabling the key makes the existing log files unreadable now. A deletion that runs its course makes them unreadable permanently, without a single log file being touched. AMI shared publicly on generated-workload-84 in ap-southeast-1 (account 123456789012): first seen 48 days ago and still present on the run that wrote this board; the weak set grew from 0 to 2 between the two runs, and none of the new members is covered by an allowlist entry.V-008 · f/5mr1sAbQ9K · e/56789ABCDEFG e/CDEFGHJKLMNP e/KLMNPQRSTUVW +4

Disabling the key makes the existing log files unreadable now. A deletion that runs its course makes them unreadable permanently, without a single log file being touched. AMI shared publicly on generated-workload-4 in ap-southeast-1 (account 234567890123): first seen 28 days ago and still present on the run that wrote this board; the weak set grew from 0 to 2 between the two runs, and none of the new members is covered by an allowlist entry.V-008 · f/3BBJZUDogz · e/56789ABCDEFG e/CDEFGHJKLMNP e/KLMNPQRSTUVW +5

Disabling the key makes the existing log files unreadable now. A deletion that runs its course makes them unreadable permanently, without a single log file being touched. Access entry created or widened by a deployer identity on generated-workload-47 in eu-west-1 (account 345678901234): first seen 149 days ago and still present on the run that wrote this board; the weak set grew from 3 to 5 between the two runs, and none of the new members is covered by an allowlist entry.V-012 · f/G8Rr7JPart · e/89ABCDEFGHJK e/FGHJKLMNPQRS e/NPQRSTUVWXYZ +3

Disabling the key makes the existing log files unreadable now. A deletion that runs its course makes them unreadable permanently, without a single log file being touched. Access entry created or widened by a deployer identity on generated-workload-97 in eu-west-1 (account 234567890123): first seen 139 days ago and still present on the run that wrote this board; the weak set grew from 1 to 3 between the two runs, and none of the new members is covered by an allowlist entry.V-012 · f/93wYzpmu7V · e/JKLMNPQRSTUV e/RSTUVWXYZabc e/YZabcdefghij +8

Disabling the key makes the existing log files unreadable now. A deletion that runs its course makes them unreadable permanently, without a single log file being touched. Access entry created or widened by a deployer identity on generated-workload-17 in eu-west-1 (account 345678901234): first seen 119 days ago and still present on the run that wrote this board; the weak set grew from 1 to 3 between the two runs, and none of the new members is covered by an allowlist entry.V-012 · f/9486vuk5d1 · e/JKLMNPQRSTUV e/RSTUVWXYZabc e/YZabcdefghij +9

Disabling the key makes the existing log files unreadable now. A deletion that runs its course makes them unreadable permanently, without a single log file being touched. Access entry created or widened by a deployer identity on generated-workload-87 in eu-west-1 (account 123456789012): first seen 69 days ago and still present on the run that wrote this board; the weak set grew from 3 to 5 between the two runs, and none of the new members is covered by an allowlist entry.V-012 · f/477WMbwwNb · e/89ABCDEFGHJK e/FGHJKLMNPQRS e/NPQRSTUVWXYZ +7

Disabling the key makes the existing log files unreadable now. A deletion that runs its course makes them unreadable permanently, without a single log file being touched. Access entry created or widened by a deployer identity on generated-workload-7 in eu-west-1 (account 234567890123): first seen 49 days ago and still present on the run that wrote this board; the weak set grew from 3 to 5 between the two runs, and none of the new members is covered by an allowlist entry.V-012 · f/HqrpEhqATW · e/89ABCDEFGHJK e/FGHJKLMNPQRS e/NPQRSTUVWXYZ +8

Disabling the key makes the existing log files unreadable now. A deletion that runs its course makes them unreadable permanently, without a single log file being touched. Access entry created or widened by a deployer identity on generated-workload-57 in eu-west-1 (account 123456789012): first seen 39 days ago and still present on the run that wrote this board; the weak set grew from 1 to 3 between the two runs, and none of the new members is covered by an allowlist entry.V-012 · f/GNR4TaNDwM · e/JKLMNPQRSTUV e/RSTUVWXYZabc e/YZabcdefghij +4

Disabling the key makes the existing log files unreadable now. A deletion that runs its course makes them unreadable permanently, without a single log file being touched. EC2 instance accepts IMDSv1 on generated-workload-68 in eu-central-1 (account 345678901234): first seen 116 days ago and still present on the run that wrote this board; the weak set grew from 0 to 2 between the two runs, and none of the new members is covered by an allowlist entry.V-013a · f/PzHuBi8RGP · e/VWXYZabcdefg e/cdefghijkmno e/3456789ABCDE +6

Disabling the key makes the existing log files unreadable now. A deletion that runs its course makes them unreadable permanently, without a single log file being touched. EC2 instance accepts IMDSv1 on generated-workload-108 in eu-central-1 (account 123456789012): first seen 36 days ago and still present on the run that wrote this board; the weak set grew from 0 to 2 between the two runs, and none of the new members is covered by an allowlist entry.V-013a · f/Hfz9XK3P2R · e/VWXYZabcdefg e/cdefghijkmno e/3456789ABCDE +1

Disabling the key makes the existing log files unreadable now. A deletion that runs its course makes them unreadable permanently, without a single log file being touched. EC2 instance accepts IMDSv1 on generated-workload-28 in eu-central-1 (account 234567890123): first seen 16 days ago and still present on the run that wrote this board; the weak set grew from 0 to 2 between the two runs, and none of the new members is covered by an allowlist entry.V-013a · f/5J86YzUpUa · e/VWXYZabcdefg e/cdefghijkmno e/3456789ABCDE +2

Disabling the key makes the existing log files unreadable now. A deletion that runs its course makes them unreadable permanently, without a single log file being touched. Console login without MFA on generated-workload-49 in ap-southeast-1 (account 234567890123): first seen 163 days ago and still present on the run that wrote this board; the weak set grew from 1 to 3 between the two runs, and none of the new members is covered by an allowlist entry.V-022 · f/5j1pTRrfKk · e/ABCDEFGHJKLM e/HJKLMNPQRSTU e/QRSTUVWXYZab +5

Disabling the key makes the existing log files unreadable now. A deletion that runs its course makes them unreadable permanently, without a single log file being touched. Console login without MFA on generated-workload-39 in ap-southeast-1 (account 123456789012): first seen 93 days ago and still present on the run that wrote this board; the weak set grew from 3 to 5 between the two runs, and none of the new members is covered by an allowlist entry.V-022 · f/A2fuTxUG7u · e/ghijkmnopqrs e/789ABCDEFGHJ e/EFGHJKLMNPQR +4

Disabling the key makes the existing log files unreadable now. A deletion that runs its course makes them unreadable permanently, without a single log file being touched. Console login without MFA on generated-workload-89 in ap-southeast-1 (account 345678901234): first seen 83 days ago and still present on the run that wrote this board; the weak set grew from 1 to 3 between the two runs, and none of the new members is covered by an allowlist entry.V-022 · f/5nuZAvQeaE · e/ABCDEFGHJKLM e/HJKLMNPQRSTU e/QRSTUVWXYZab +9

Disabling the key makes the existing log files unreadable now. A deletion that runs its course makes them unreadable permanently, without a single log file being touched. Console login without MFA on generated-workload-9 in ap-southeast-1 (account 123456789012): first seen 63 days ago and still present on the run that wrote this board; the weak set grew from 1 to 3 between the two runs, and none of the new members is covered by an allowlist entry.V-022 · f/4zt61QNTzM · e/ABCDEFGHJKLM e/HJKLMNPQRSTU e/QRSTUVWXYZab +1

Disabling the key makes the existing log files unreadable now. A deletion that runs its course makes them unreadable permanently, without a single log file being touched. Console login without MFA on generated-workload-79 in ap-southeast-1 (account 234567890123): first seen 13 days ago and still present on the run that wrote this board; the weak set grew from 3 to 5 between the two runs, and none of the new members is covered by an allowlist entry.V-022 · f/FJmKonjviW · e/ghijkmnopqrs e/789ABCDEFGHJ e/EFGHJKLMNPQR +8