Attack in progressA leaked CI key of ‹ci-deploy-bot› is being used to break in: 6 accounts and machines created.Open the case
LOW hygiene pack V-100
Checks low-severity hygiene: password policy, database encryption and zones, bucket versioning, CloudShell access and a security contact, without alerting.
Checks
| Checks | Needs |
|---|---|
| Checks that the account has a password policy with a long minimum and a long memory. | iam password policy |
| Checks that database instances are encrypted at rest. | rds instance |
| Checks that standalone database instances run in more than one zone. | rds instance |
| Checks that buckets keep object versions. | s3 bucket |
| Checks that no user, role or group holds full CloudShell access. | iam user, iam role, iam group |
| Checks that the account has registered a security contact. | account contact |
Coverage
Could not read 1 of 2 places
| global | |
|---|---|
‹prod-acct› 123456789012 | Read |
| 234567890123 | Not read |
Run history
No run has recorded this rule yet.
Findings
No open findings.
What it fed
No case has used a finding of this rule in the last 30 days.
Techniques
None mapped.
How to fix
DescribeCluster(publicAccessCidrs) / GetPublicAccessBlock / ListFunctionUrlConfigs(AuthType) → restrict by IaC; reversible