Description

Unlike in the past, the role deleted an unusual amount of ec2 instances. Those calls were made with an unusual user agent. Those findings might indicate on a malicious usage of the role permissions.

• 

  Recommended Mitigation

  It is recommended to review the relevant CloudTrail events and principals that issued this API calls. In addition, the change in the user-agent field might help to understand the cause of the anomaly.