---
title: >-
  EC2 instance with high/critical vulnerabilities is publicly accessible and can
  read sensitive data
description: Datadog, the leading service for cloud-scale monitoring.
breadcrumbs: >-
  Docs > Datadog Security > OOTB Rules > EC2 instance with high/critical
  vulnerabilities is publicly accessible and can read sensitive data
---

> For the complete documentation index, see [llms.txt](https://docs.datadoghq.com/llms.txt).

# EC2 instance with high/critical vulnerabilities is publicly accessible and can read sensitive data

## Description{% #description %}

An EC2 instance has high or critical severity vulnerabilities, is publicly accessible, and has IAM permissions to read an S3 bucket containing sensitive data. If the instance is compromised, an attacker could leverage its IAM permissions to read the sensitive data. Sensitive data could include personally identifiable information (PII), credentials, financial information, and network or device information. For more details on how sensitive data is detected, see the [official documentation](https://docs.datadoghq.com/security/cloud_security_management/agentless_scanning.md#data-security).

## Remediation{% #remediation %}

1. Review and apply security patches for the high and critical severity vulnerabilities. If no patch is available, apply compensating controls such as disabling or removal of the vulnerable component.
1. Assess whether this instance needs to be accessible from the internet. If not, restrict access to the instance by updating the security group or network ACL to only allow access from trusted sources.
1. Restrict access to the S3 bucket containing sensitive data to only the necessary users or roles by reviewing IAM policies and bucket resource policies. For more information on restricting access to an S3 bucket, see the [official documentation](https://docs.aws.amazon.com/AmazonS3/latest/userguide/security_iam_service-with-iam.html).