Attack in progressA leaked CI key of ‹ci-deploy-bot› is being used to break in: 6 accounts and machines created.Open the case
Resource-policy and organization perimeter V-011
Finds resource policies and shared documents that admit principals outside your organization.
Checks
| Checks | Needs |
|---|---|
| Checks that no function policy admits callers from outside your organization. | lambda function |
| Checks that no queue policy admits callers from outside your organization. | sqs queue |
| Checks that no topic policy admits callers from outside your organization. | sns topic |
| Checks that no repository policy admits callers from outside your organization. | ecr repository |
| Checks that no backup vault policy admits callers from outside your organization. | backup vault |
| Checks that no secret policy admits callers from outside your organization. | secretsmanager secret |
| Checks that no key policy admits accounts from outside your organization. | kms key |
| Checks that no bucket policy admits accounts from outside your organization. | s3 bucket |
Coverage
Could not read anything this run
| global | |
|---|---|
| 234567890123 | Not read |
Run history
No run has recorded this rule yet.
Findings
No open findings.
What it fed
No case has used a finding of this rule in the last 30 days.
Techniques
None mapped.
How to fix
DescribePolicy / GetInstanceMetadataDefaults / DescribeInstances(MetadataOptions) → set the org policy or IMDS defaults by IaC; reversible