Attack in progressA leaked CI key of ‹ci-deploy-bot› is being used to break in: 6 accounts and machines created.Open the case
Internet exposure slice V-014b
Finds public instances whose security groups open all ports, database ports or admin ports to the internet.
Checks
| Checks | Needs |
|---|---|
| Finds public instances whose security groups open all ports, database ports or admin ports to the internet. | ec2 instance, ec2 security group |
Coverage
Could not read anything this run
Run history
No run has recorded this rule yet.
Findings
No open findings.
What it fed
No case has used a finding of this rule in the last 30 days.
Techniques
None mapped.
How to fix
DescribeInstances(PublicIpAddress) + DescribeSecurityGroups(IpPermissions) → narrow the world-open rule to the ranges that need it, or take the public address away, by IaC; an Ingress gets its TLS block by GitOps; reversible