I'm about to embark on an AWS security journey... Gonna find out who has global ssh access open, who hasnt been rotating their master keys, who has lambda connected to an IGW, who has VPC's with a VPN that also have an open SSH machine to the world.

Anything else i should look for?

You dont have to mek the journey alone you know 😄

S3 without access control.

@sbiewald to be fair static websites are a thing... Maybe you mean like public write?

@arcsector Read and write. Some people (cough... US Pentagon... cough) store secret data on S3 as it can easily used as shared object storage.
S3 is also commonly used for Terraform state files, thus it may contain passwords or other secrets of resources.

---
Source for Pentagon leaving data on public S3 bucket: https://upguard.com/breaches/...

@sbiewald yeah, if that data is on there publicly it should have clearance

Yes. Cops