| Severity | Finding | Resource | Region |
|---|
| CRITICAL | Root account has active access keys | root | global |
| CRITICAL | Security group 'launch-wizard-1' (sg-0ecd86192446b766c) allows 0.0.0.0/0 on port 22 (SSH) | sg-0ecd86192446b766c | eu-north-1 |
| CRITICAL | Security group 'wefoundit-prod' (sg-0a5464bdc15449f8f) allows 0.0.0.0/0 on port 22 (SSH) | sg-0a5464bdc15449f8f | eu-west-1 |
| CRITICAL | Security group 'nyianga-api-sg' (sg-058cdb65433b47797) allows 0.0.0.0/0 on port 22 (SSH) | sg-058cdb65433b47797 | us-east-1 |
| CRITICAL | Security group 'launch-wizard-1' (sg-005119d9a27dd4c83) allows 0.0.0.0/0 on port 22 (SSH) | sg-005119d9a27dd4c83 | us-east-1 |
| CRITICAL | No CloudTrail trails configured | none | global |
| HIGH | No IAM password policy configured | password-policy | global |
| HIGH | IAM user 'blandine' has console access without MFA | blandine | global |
| HIGH | IAM user 'pilot' has console access without MFA | pilot | global |
| HIGH | IAM user 'pilot' access key is 127 days old | pilot/AKIASWMZRG3SMY6IEFHL | global |
| HIGH | Security group 'nyianga-api-sg' (sg-058cdb65433b47797) allows 0.0.0.0/0 on port 8080 (HTTP Alt) | sg-058cdb65433b47797 | us-east-1 |
| HIGH | EC2 instance 'helm' (i-074b940a638a9ccd4) allows IMDSv1 | i-074b940a638a9ccd4 | eu-west-1 |
| HIGH | EC2 instance 'wefoundit-prod' (i-05d2778970da12fb1) allows IMDSv1 | i-05d2778970da12fb1 | eu-west-1 |
| HIGH | S3 bucket 'wefoundit-media-eu' does not have full public access block | wefoundit-media-eu | global |
| HIGH | GuardDuty is not enabled | none | global |
| MEDIUM | IAM user 'wefoundit-ses-smtp' has inline policies | wefoundit-ses-smtp | global |
| MEDIUM | Resources running in default VPC (vpc-0618011eab0332ae3) in eu-north-1 | vpc-0618011eab0332ae3 | eu-north-1 |
| MEDIUM | VPC 'vpc-0618011eab0332ae3' (vpc-0618011eab0332ae3) has no flow logs enabled | vpc-0618011eab0332ae3 | eu-north-1 |
| MEDIUM | NACL acl-0da9bf4ad7c849f29 allows all inbound traffic from 0.0.0.0/0 | acl-0da9bf4ad7c849f29 | eu-north-1 |
| MEDIUM | Resources running in default VPC (vpc-04d8f9176dc741dec) in eu-west-1 | vpc-04d8f9176dc741dec | eu-west-1 |
| MEDIUM | VPC 'vpc-04d8f9176dc741dec' (vpc-04d8f9176dc741dec) has no flow logs enabled | vpc-04d8f9176dc741dec | eu-west-1 |
| MEDIUM | NACL acl-0b6bbe48cf9917d9e allows all inbound traffic from 0.0.0.0/0 | acl-0b6bbe48cf9917d9e | eu-west-1 |
| MEDIUM | VPC 'vpc-0daa1cac15b3baaf6' (vpc-0daa1cac15b3baaf6) has no flow logs enabled | vpc-0daa1cac15b3baaf6 | us-east-1 |
| MEDIUM | NACL acl-06f17b77a709de436 allows all inbound traffic from 0.0.0.0/0 | acl-06f17b77a709de436 | us-east-1 |
| MEDIUM | EC2 instance 'vm_vm' (i-0b78e4a1af1e4382f) has a public IP | i-0b78e4a1af1e4382f | eu-north-1 |
| MEDIUM | EC2 instance 'vm_vm' (i-0b78e4a1af1e4382f) has no IAM role | i-0b78e4a1af1e4382f | eu-north-1 |
| MEDIUM | EC2 instance 'master' (i-0e78201b87f8df6a9) has no IAM role | i-0e78201b87f8df6a9 | eu-north-1 |
| MEDIUM | EC2 instance 'worker' (i-0ad3d997953329219) has no IAM role | i-0ad3d997953329219 | eu-north-1 |
| MEDIUM | EC2 instance 'wefoundit-prod' (i-05d2778970da12fb1) has a public IP | i-05d2778970da12fb1 | eu-west-1 |
| MEDIUM | DynamoDB table 'cloudsentry-history' has no point-in-time recovery | cloudsentry-history | us-east-1 |
| MEDIUM | DynamoDB table 'nyianga-tf-locks' has no point-in-time recovery | nyianga-tf-locks | us-east-1 |
| MEDIUM | KMS key a47d0494-607e-4111-9c6d-9f71226cb541 is pending deletion | a47d0494-607e-4111-9c6d-9f71226cb541 | us-east-1 |
| LOW | IAM user 'blandine' is not in any group | blandine | global |
| LOW | IAM user 'pilot' is not in any group | pilot | global |
| LOW | IAM user 'wefoundit-ses-smtp' is not in any group | wefoundit-ses-smtp | global |
| LOW | EC2 instance 'helm' (i-074b940a638a9ccd4) has been stopped for 31+ days | i-074b940a638a9ccd4 | eu-west-1 |
| LOW | S3 bucket 'cloudsentry-dashboard-185542457060' has no access logging | cloudsentry-dashboard-185542457060 | global |
| LOW | S3 bucket 'helm-backups-185542457060' has no access logging | helm-backups-185542457060 | global |
| LOW | S3 bucket 'wefoundit-backups-185542457060' has no access logging | wefoundit-backups-185542457060 | global |
| LOW | S3 bucket 'wefoundit-media-eu' does not have versioning enabled | wefoundit-media-eu | global |
| LOW | S3 bucket 'wefoundit-media-eu' has no access logging | wefoundit-media-eu | global |
| LOW | EC2 instance 'vm_vm' (i-0b78e4a1af1e4382f) appears to be created outside IaC | i-0b78e4a1af1e4382f | eu-north-1 |
| LOW | EC2 instance 'master' (i-0e78201b87f8df6a9) appears to be created outside IaC | i-0e78201b87f8df6a9 | eu-north-1 |
| LOW | EC2 instance 'worker' (i-0ad3d997953329219) appears to be created outside IaC | i-0ad3d997953329219 | eu-north-1 |
| LOW | Security group 'launch-wizard-1' (sg-0ecd86192446b766c) created outside IaC | sg-0ecd86192446b766c | eu-north-1 |
| LOW | EC2 instance 'wefoundit-prod' (i-05d2778970da12fb1) appears to be created outside IaC | i-05d2778970da12fb1 | eu-west-1 |
| LOW | Security group 'wefoundit-prod' (sg-0a5464bdc15449f8f) created outside IaC | sg-0a5464bdc15449f8f | eu-west-1 |
| LOW | Security group 'launch-wizard-1' (sg-005119d9a27dd4c83) created outside IaC | sg-005119d9a27dd4c83 | us-east-1 |