Description

Detects AWS EC2 instances that have more than one network interface attached. Multiple network interfaces on a single instance can increase security risks by potentially exposing the instance to different networks and complicating network security controls.

Detection Strategy

• Identifies EC2 instances that are in a running or pending state (not terminated or shutting down)

• Checks if the instance has more than one network interface attached

• Reports a vulnerability unless the instance is explicitly excluded via a 'f333' tag

• Includes details about the network interface IDs and instance configuration in the vulnerability report