Attack in progressA leaked CI key of ‹ci-deploy-bot› is being used to break in: 6 accounts and machines created.Open the case
Identity Center principals and assignments V-028
Compares Identity Center users, groups, permission-set assignments and MFA settings, and flags assignments by a non-deployer.
Checks
| Checks | Needs |
|---|---|
| Checks that administrator access is held through groups, not assigned to individual users. | identitycenter assignment, identitycenter permission policies |
| Checks that no administrator permission set is assigned in the Identity Center management account. | identitycenter assignment, identitycenter permission policies, identitycenter instance |
| Checks that administrator permission sets keep sessions open for at most eight hours. | identitycenter permission set, identitycenter permission policies |
Coverage
Could not read anything this run
Run history
No run has recorded this rule yet.
Findings
No open findings.
What it fed
No case has used a finding of this rule in the last 30 days.
Techniques
None mapped.
How to fix
GetUser/GetRole + attached and inline policies → detach the admin grant; reversible