Attack in progressA leaked CI key of ‹ci-deploy-bot› is being used to break in: 6 accounts and machines created.Open the case
Credential-consumer inventory V-035
Maps every active access key to an owner and a consumer, and flags keys that are unmapped or shared.
Checks
| Checks | Needs |
|---|---|
| Checks that every active access key belongs to a user that carries an owner or consumer tag. | iam access key, iam user |
| Checks that no user has two active access keys in use that were made weeks apart. | iam access key, iam user |
Coverage
Read everywhere
| global | |
|---|---|
‹prod-acct› 123456789012 | Read |
Run history
No run has recorded this rule yet.
Findings
No open findings.
What it fed
No case has used a finding of this rule in the last 30 days.
Techniques
None mapped.
How to fix
GetAccessKeyLastUsed per key (read-only) → unknown owner: deactivate (not delete), watch 14 d