Description

Orca has detected that the privileged role {AwsIamRole} was used from an IP outside your internal network. This role is usually associated with the EC2 Instance Profile(s) {AwsIamRole.InstanceProfileArnList}. Use of this role outside of this context might mean an instance was compromised and its credentials are being used for malicious activity.

• 

  Recommended Mitigation

  Review the relevant CloudTrail event and ensure this use was authorized.