- 필수 기능
- 앱 내
- 서비스 관리
- 인프라스트럭처
- 애플리케이션 성능
- 디지털 경험
- 소프트웨어 제공
- 보안
- 로그 관리
- 관리
- 인프라스트럭처
- ci
- containers
- csm
- ndm
- otel_guides
- overview
- slos
- synthetics
- tests
- 워크플로
Detect a user attempting to exfiltrate an Amazon EC2 AMI Snapshot.
This rule lets you monitor the ModifyImageAttribute CloudTrail API calls to detect when an Amazon EC2 AMI snapshot is made public or shared with an AWS account.
This rule also inspects:
@requestParameters.launchPermission.add.items.group
array to determine if the string all
is contained. This is the indicator which means the RDS snapshot is made public.@requestParameters.launchPermission.add.items.userId
array to determine if the string *
is contained. This is the indicator which means the RDS snapshot was shared with a new or unknown AWS account.{{@userIdentity.arn}}
intended to make the RDS snaphsot public.