Attack in progressA leaked CI key of ‹ci-deploy-bot› is being used to break in: 6 accounts and machines created.Open the case

Default policy version changed on an attached policy by a non-deployer

Mediumback

Rule: V-003
Account: prod-acct 123456789012
Where: eu-west-1 / payments-prod-cluster-0
First seen: 2026-08-13
Last seen: 2026-09-12 (84 days)
Verdict: not rated
Runbook: R-03 in the runbooks

What Firekeeper saw

on generated-workload-12 in eu-west-1 (account 123456789012): first seen 84 days ago and still present on the run that wrote this board; the weak set grew from 0 to 2 between the two runs, and none of the new members is covered by an allowlist entry.

Resources

iam_role: ‹arn:aws:iam::123456789012:role/service-role/generated…(65 chars)› (res-1012)
ec2_instance: ‹i-0000000000000000c› (res-2012)
s3_bucket: ‹logs-archive-12[.]example-org[.]invalid› (res-3012)
iam_policy: ‹arn:aws:iam::123456789012:policy/generated/workload-1…(70 chars)› (res-4012)
launch_template: ‹arn:aws:ec2:eu-west-1:123456789012:launch-template/lt…(75 chars)› (res-5012)

Evidence

e/DEFGHJKLMNPQ e/LMNPQRSTUVWX e/TUVWXYZabcde t/4b1c9e0a-1234-4abc-8def-0123456789ab

Guidance

What this is. Disabling the key makes the existing log files unreadable now. A deletion that runs its course makes them unreadable permanently, without a single log file being touched.

Why it matters. Every detection in the account, this one included, reads those logs. Turning them off is the first move of someone who does not want to be seen, and it also blinds the investigation that comes after.

How to fix it. Restore the trail or detector to the state the account baseline defines, in the infrastructure code that owns it.

Fix it with an agent

A brief for a coding agent on your own machine: what was measured, how this kind of finding goes wrong, and the rules it works under. It investigates first and proposes a pull request; nothing here changes your estate.

Restore the trail or detector in the infrastructure code that owns it: the multi-region setting, log-file validation and the destination the template names. Do not re-create the resource by hand, and do not delete or rename the existing one. Deliver the change as a pull request against infrastructure code; do not touch the live estate.

Across the last 30 runs

From	To	Runs	State
2026-09-12	2026-09-12	1	back
2026-08-14	2026-09-11	29	no board input for that run

Decisions on this finding

No decision names this finding.

See every decision

Not a problem?

Signing one of these quiets this finding. Nothing changes until you sign with your passkey, and it ends on its own date unless someone renews it.