aws-vpc-traffic-mirror-packet-payload
Mirrored packets can contain plaintext application credentials and sensitive payloads whenever the source traffic is not end-to-end encrypted.
Where it sits
| location | Traffic Mirror target packet capture |
|---|
| location kind | payload |
|---|
| data kinds | credential password api_key bearer_token session_token customer_data pii |
|---|
| emits edge | CanReadData |
|---|
| service | VPC (aws:vpc) |
|---|
Collection recipe
| access mode | indirect_destination |
|---|
| operation | Packet capture at Traffic Mirror target |
|---|
| response path | captured packet payload |
|---|
| encoding | binary |
|---|
| params | {"Target": "\u003ceni-or-nlb\u003e", "TrafficMirrorSessionId": "\u003csession-id\u003e"} |
|---|
Required permissions
ec2:DescribeTrafficMirrorSessions
References