4 ms·

Accounts and actions like this are easily managed in AWS GuardDuty since they were so foreign from the user benchmarks. Outside of the normal security standards

Accounts and actions like this are easily managed in AWS GuardDuty since they were so foreign from the user benchmarks. Outside of the normal security standards you'd expect of next level monitoring from companies such as CrowdStrike. It took Ubiquiti weeks to notice these issues and he used the AWS root account, this account should be actively secured and alerted for abuse using AWS GuardDuty or similar. I've made my own top level comment raising where I have more questions than answers from this announcement.

gruez 5y ago
But who configures AWS GuardDuty and who does it report to? Presumably the root account owner? In that case, wouldn't that be the cloud lead?
- LilBytes 5y ago
  It reports to anyone you want, typically though you would point it to an SNS topic which is ingested by any other service, group or end point you wish.
- aahortwwy 5y ago
  Smart cloud leads refuse AWS root access.