Attack in progressA leaked CI key of ‹ci-deploy-bot› is being used to break in: 6 accounts and machines created.Open the case
Idle and dangling identity V-041
Finds roles, users, keys and identity providers that nobody has used for 90 days or that point at something gone.
Checks
| Checks | Needs |
|---|---|
| Finds roles, users, keys and identity providers that nobody has used for 90 days or that point at something gone. | iam role, iam user, iam group, iam access key, iam credential report, iam saml provider, iam oidc provider, iam instance profile, iam policy |
Coverage
Read everywhere
| global | |
|---|---|
‹prod-acct› 123456789012 | Read |
Run history
No run has recorded this rule yet.
Findings
No open findings.
What it fed
No case has used a finding of this rule in the last 30 days.
Techniques
T1078.004
How to fix
GetRole / GetSAMLProvider / GetOpenIDConnectProvider / GetInstanceProfile with the attached and inline policies, exported to a backup kept with the change → remove the trust statement, or quarantine the role with a deny-all inline policy by IaC and watch 14 d; reversible from the backup. The delete that follows is a second pull request and is not reversible: runbook R-16