Strange HTTP calls to ec2 endpoints on all regions

0

Hi there, I’m looking at the egress traffic generated from my AWS account and I noticed several calls to all region ec2 endpoints. It seems to be a kind of health check, however I’m not sure. In particular, what wonders me more are calls to Chinese ec2 endpoints. The calls are generated from fargate, and from ec2 kubernetes worker nodes apparently. I have already checked and there isn’t any container making such calls.

Do you have any explanation? Why such calls? Any chance I can block or limit calls to specific ec2 endpoint regions only?

Thank you

profile picture
질문됨 한 달 전227회 조회
1개 답변
1

If you're seeing unexpected HTTP calls to EC2 endpoints across all regions, it could be due to a variety of reasons. Here are a few possibilities:

Misconfigured Application: Check if your application code or scripts are making unintended HTTP calls to EC2 endpoints. This could happen if there's a bug or misconfiguration in your application logic.

Third-party Dependencies: Review any third-party dependencies or libraries used in your application. Sometimes, these dependencies may make network requests to external services, including EC2 endpoints.

Determine if there are any automated processes, scripts, or scheduled tasks running in your environment that may be making these HTTP calls. These could be part of maintenance tasks, monitoring systems, or other background processes.

Some security tools or vulnerability scanners may perform HTTP requests to EC2 endpoints as part of their scanning process. Check if any security scans or assessments are running in your environment.

In rare cases, unexpected HTTP calls to EC2 endpoints could be a sign of malicious activity, such as a compromised system or unauthorized access to your infrastructure. Make sure to monitor your environment for any suspicious behavior.

To troubleshoot further, you can use network monitoring tools, such as packet sniffers or logging frameworks, to track the source and nature of these HTTP calls. Additionally, reviewing access logs and audit trails can help identify the root cause of the issue. If you suspect malicious activity, it's important to investigate and take appropriate security measures to protect your infrastructure.

profile picture
전문가
답변함 한 달 전

로그인하지 않았습니다. 로그인해야 답변을 게시할 수 있습니다.

좋은 답변은 질문에 명확하게 답하고 건설적인 피드백을 제공하며 질문자의 전문적인 성장을 장려합니다.

질문 답변하기에 대한 가이드라인

관련 콘텐츠