Attack in progressA leaked CI key of ‹ci-deploy-bot› is being used to break in: 6 accounts and machines created.Open the case
Coverage
Firekeeper read 3 accounts, 17 regions and 1 cluster; 2 reads did not complete, and silence from those scopes means nothing.
2 findings could not be re-checked; they stay as they were.
3 of 3
accounts read
16 of 17
regions read
1 of 1
clusters Firekeeper runs inside
28 of 30
collectors complete
Controls: 8 pass, 1 fail, 0 not applicable.
Clusters
This run wrote no per-cluster rows. A run on the current build writes one for every cluster discovery returns.
The clusters screen says the same thing in full.
Reads that did not complete
2 reads did not complete. Nothing can be said about the scopes below until they do.
| Collector | Account | Region | Cluster | Status | Reason |
|---|---|---|---|---|---|
guardduty | sandbox 345678901234 | eu-west-1 | none | FAILED | AccessDenied |
s3 | 234567890123 | all | none | PARTIAL | Throttled |
Not measured by this build
- s3-control — 1 of 3 reads declared not made (public access block, account level).
Config changes that would widen coverage
- Set trail_bucket_region for prod-acct so the trail bucket can be read (R-14).
- Redeploy the spoke stack in sandbox (R-14).
Findings not re-checked
- 11 findings: this build does not make the read; the finding stays in the bundle and is a limitation of the build, not a fact about your accounts.