Attack in progressA leaked CI key of ‹ci-deploy-bot› is being used to break in: 6 accounts and machines created.Open the case
Wildcard signing grants V-007
Finds key policies and grants that let any principal sign with a key.
Checks
| Checks | Needs |
|---|---|
| Finds a role or user whose own policy lets it sign with any key. | iam role, iam user, kms key |
| Finds a signing key whose policy lets every principal sign with it. | kms key |
| Finds a grant to sign with a signing key that names a principal outside your inventory. | kms key, kms grant, iam role, iam user |
| Finds a role or user that may create or move any key alias. | iam role, iam user, kms key |
Coverage
Read everywhere
| global | |
|---|---|
‹prod-acct› 123456789012 | Read |
Run history
No run has recorded this rule yet.
Findings
No open findings.
What it fed
No case has used a finding of this rule in the last 30 days.
Techniques
None mapped.
How to fix
GetPolicyVersion of the offending document → scope down by PR; reversible