Attack in progressA leaked CI key of ‹ci-deploy-bot› is being used to break in: 6 accounts and machines created.Open the case
Key control plane V-006
Finds signing keys, their policies, grants and aliases changed outside the deployment pipeline.
Checks
| Checks | Needs |
|---|---|
| Finds a key disabled or scheduled for deletion that was used in the last thirty days, or whose use is not known. | Live events: tamper, ScheduleKeyDeletion, Live events: tamper, DisableKey |
| Finds a key alias moved to a different key outside the deployment pipeline. | Live events: key_control, UpdateAlias |
| Finds a key replicated to another region outside the deployment pipeline. | Live events: key_control, ReplicateKey |
| Finds key material imported into a key outside the deployment pipeline. | Live events: key_control, ImportKeyMaterial |
| Finds a key policy replaced outside the deployment pipeline. | Live events: exposure, PutKeyPolicy |
| Finds a grant that lets its holder sign with a key, created outside the deployment pipeline. | Live events: exposure, CreateGrant |
| Finds a signing key that was not in the previous run's inventory. | kms key |
| Finds a signing key whose settings, policy or state differ from the previous run's inventory. | kms key |
Coverage
Could not read anything this run
Run history
No run has recorded this rule yet.
Findings
No open findings.
What it fed
No case has used a finding of this rule in the last 30 days.
Techniques
None mapped.
How to fix
DescribeKey → CancelKeyDeletion decision within the waiting period; reversible