Attack in progressA leaked CI key of ‹ci-deploy-bot› is being used to break in: 6 accounts and machines created.Open the case
Frontend asset integrity V-037
Finds writes to CDN origin buckets by principals other than CI, distribution and edge function changes, and missing origin access control.
Checks
| Checks | Needs |
|---|---|
| Checks that a bucket policy that lets CloudFront read names the distributions it allows. | s3 bucket |
| Checks that a CDN origin bucket is not also public. | s3 bucket |
| Checks that no one outside your accounts can write to a CDN origin bucket. | s3 bucket |
| Checks that only the deployer writes to or deletes from a CDN origin bucket. | Live events: object_data, s3 bucket |
| Checks that S3 data events were read, so that writes to a CDN origin bucket are seen or ruled out. | Live events: object_data, s3 bucket |
| Checks that only the deployer changes a CDN distribution, edge function or origin access control. | Live events: frontend |
Coverage
Could not read anything this run
| global | |
|---|---|
| 234567890123 | Not read |
Run history
No run has recorded this rule yet.
Findings
No open findings.
What it fed
No case has used a finding of this rule in the last 30 days.
Techniques
None mapped.
How to fix
LookupEvents replay for the scope, warden show (receipt) → raise the budget, fix delegation or the spoke trust by PR; read-only