Attack in progressA leaked CI key of ‹ci-deploy-bot› is being used to break in: 6 accounts and machines created.Open the case
S3 public exposure V-015
Finds buckets that anyone can read, whose public access block is off, or whose policy trusts a Referer header.
Checks
| Checks | Needs |
|---|---|
| Checks that each bucket blocks all public access. | s3 bucket, s3 account pab |
| Finds buckets that anyone can read. | s3 bucket, s3 account pab |
| Finds bucket policies that admit anyone who sends a chosen Referer header. | s3 bucket, s3 account pab |
| Says when a bucket's public exposure could not be read. | s3 bucket |
Coverage
Could not read anything this run
| global | |
|---|---|
| 234567890123 | Not read |
Run history
No run has recorded this rule yet.
Findings
No open findings.
What it fed
No case has used a finding of this rule in the last 30 days.
Techniques
None mapped.
How to fix
DescribeCluster(publicAccessCidrs) / GetPublicAccessBlock / ListFunctionUrlConfigs(AuthType) → restrict by IaC; reversible