---
title: >-
  EC2 instance with high/critical vulnerabilities is publicly accessible and can
  read sensitive data
description: Datadog, the leading service for cloud-scale monitoring.
breadcrumbs: >-
  Docs > Datadog Security > OOTB Rules > EC2 instance with high/critical
  vulnerabilities is publicly accessible and can read sensitive data
---

> For the complete documentation index, see [llms.txt](https://docs.datadoghq.com/llms.txt).

# EC2 instance with high/critical vulnerabilities is publicly accessible and can read sensitive data

## Description{% #description %}

This rule evaluates only EC2 instances in the `running` state that have high or critical severity vulnerabilities, are publicly accessible, and have IAM permissions to read an S3 bucket containing sensitive data. If an instance is compromised, an attacker could use its IAM permissions to exfiltrate sensitive data such as personally identifiable information (PII), credentials, financial information, or network and device information. For details about sensitive data detection, see [Agentless Scanning](https://docs.datadoghq.com/security/cloud_security_management/agentless_scanning.md#data-security).

## Remediation{% #remediation %}

1. Review and apply security patches for the high and critical severity vulnerabilities. If no patch is available, apply compensating controls such as disabling or removal of the vulnerable component.
1. Assess whether this instance needs to be accessible from the internet. If not, restrict access to the instance by updating the security group or network ACL to only allow access from trusted sources.
1. Restrict access to the S3 bucket containing sensitive data to only the necessary users or roles by reviewing IAM policies and bucket resource policies. For guidance, see [Identity and access management for Amazon S3](https://docs.aws.amazon.com/AmazonS3/latest/userguide/security_iam_service-with-iam.html).