Strange HTTP calls to ec2 endpoints on all regions

0

Hi there, I’m looking at the egress traffic generated from my AWS account and I noticed several calls to all region ec2 endpoints. It seems to be a kind of health check, however I’m not sure. In particular, what wonders me more are calls to Chinese ec2 endpoints. The calls are generated from fargate, and from ec2 kubernetes worker nodes apparently. I have already checked and there isn’t any container making such calls.

Do you have any explanation? Why such calls? Any chance I can block or limit calls to specific ec2 endpoint regions only?

Thank you

profile picture
asked 19 days ago214 views
1 Answer
1

If you're seeing unexpected HTTP calls to EC2 endpoints across all regions, it could be due to a variety of reasons. Here are a few possibilities:

Misconfigured Application: Check if your application code or scripts are making unintended HTTP calls to EC2 endpoints. This could happen if there's a bug or misconfiguration in your application logic.

Third-party Dependencies: Review any third-party dependencies or libraries used in your application. Sometimes, these dependencies may make network requests to external services, including EC2 endpoints.

Determine if there are any automated processes, scripts, or scheduled tasks running in your environment that may be making these HTTP calls. These could be part of maintenance tasks, monitoring systems, or other background processes.

Some security tools or vulnerability scanners may perform HTTP requests to EC2 endpoints as part of their scanning process. Check if any security scans or assessments are running in your environment.

In rare cases, unexpected HTTP calls to EC2 endpoints could be a sign of malicious activity, such as a compromised system or unauthorized access to your infrastructure. Make sure to monitor your environment for any suspicious behavior.

To troubleshoot further, you can use network monitoring tools, such as packet sniffers or logging frameworks, to track the source and nature of these HTTP calls. Additionally, reviewing access logs and audit trails can help identify the root cause of the issue. If you suspect malicious activity, it's important to investigate and take appropriate security measures to protect your infrastructure.

profile picture
EXPERT
answered 12 days ago

You are not logged in. Log in to post an answer.

A good answer clearly answers the question and provides constructive feedback and encourages professional growth in the question asker.

Guidelines for Answering Questions