[8pt] Address AWS Security Notices (Critical and High status)

[RobHanna-NOAA]

Note: Now part of 1377 EPIC: FIM Sys Admin Tasks (and a few related FIM tasks)

This story started on Oct 24th with a meeting of various folks including Jason Whitehead, Gautam, Fernando, Matt Luck, Diwalker and a number of other folks.

The NWS 24x7 team, which is also addressing security holes based on logs in the AWS Security Hub page found a number of issues ranging from severity of Critical to Low.

By Dec 31, we need to find all for fim-dev and ras2fim that are severity of "Critical" or "High" and fix them.

A separate card, 1372, was made for medium and lower severities which should be addressed by Feb 28th, 2025 (ish).

Details on how to find the list, fix them are not in this card. This card is just a placeholder for the task.

As of Dec 10th, their appears to be 0 critical and appx 6 High severity.

We will also to keep an eye on this security page periodically moving forward. Maybe monthly at the first of the month data cleanup?

[RobHanna-NOAA]

When I reviewed today, there were no "critical"s and six "high".

• Two were fixed.
• Three can not be fixed at this time. They need a note added as to why we need to keep it as is (task definitions)
• One can not be fixed at this time as it relates to FIM-dev team members remote access to our EC2.