Attack in progressA leaked CI key of ‹ci-deploy-bot› is being used to break in: 6 accounts and machines created.Open the case
Credential-shaped inline value in workload configuration V-001
Finds access keys, tokens and other secrets written in plain text into workload definitions and pod configuration.
Checks
| Checks | Needs |
|---|---|
| Finds access keys, tokens and other secrets written in plain text into workload definitions and pod configuration. | k8s workload, k8s pod, k8s configmap, iam access key |
Coverage
Read everywhere
| global | |
|---|---|
‹prod-acct› 123456789012 | Read |
Run history
No run has recorded this rule yet.
Findings
12 open findings See them grouped
What it fed
Techniques
None mapped.
How to fix
GetAccessKeyLastUsed on the matched key id → deactivate (not delete) the key; move the workload to a valueFrom/Pod Identity source; reversible