Attack in progressA leaked CI key of ‹ci-deploy-bot› is being used to break in: 6 accounts and machines created.Open the case
Application token stores and plaintext recovery secrets V-040
Finds application tokens with no expiry or owner, tokens issued after a revocation, and recovery secrets stored in plain text.
Checks
| Checks | Needs |
|---|---|
| Checks that no recovery phrase, private key or backup code is kept as a plain-text parameter. | ssm parameter |
| Checks that no secret-named parameter is kept as plain text. | ssm parameter |
| Checks that token parameters have an expiration policy or have changed within the year. | ssm parameter |
| Checks that token secrets are rotated or have changed within the year. | secretsmanager secret |
Coverage
Could not read anything this run
Run history
No run has recorded this rule yet.
Findings
No open findings.
What it fed
No case has used a finding of this rule in the last 30 days.
Techniques
None mapped.
How to fix
GetAccessKeyLastUsed per key (read-only) → unknown owner: deactivate (not delete), watch 14 d