Attack in progressA leaked CI key of ‹ci-deploy-bot› is being used to break in: 6 accounts and machines created.Open the case
Organization perimeter slice V-011a
Checks that organization policies keep outside principals and tampering out, and that the management account runs no workloads.
Checks
| Checks | Needs |
|---|---|
| Checks that organization policies keep outside principals and tampering out, and that the management account runs no workloads. | orgs organization, orgs policy, ec2 instance, eks cluster, rds instance, rds cluster |
Coverage
Read everywhere
‹payments-prod-cluster› | |
|---|---|
‹prod-acct› 123456789012 | Read |
Run history
No run has recorded this rule yet.
Findings
No open findings.
What it fed
No case has used a finding of this rule in the last 30 days.
Techniques
None mapped.
How to fix
DescribePolicy / GetInstanceMetadataDefaults / DescribeInstances(MetadataOptions) → set the org policy or IMDS defaults by IaC; reversible