{"id":"INC-aquasec-7pbbsbkwknnl","kind":"incident","aliases":[],"related":[],"title":"Aqua Security: CyberCenter Service Disruption","description":"On August 21st, 2023, at approximately 8:30 PM UTC, our Container Image Scanning service experienced a major disruption due to a lambda function exceeding its ephemeral storage limit. The lambda, responsible for downloading and extracting a critical database for image scanning, was configured with 3GB of ephemeral storage. However, the extracted database size of 2.5GB, combined with the 500MB zip archive, exhausted the available storage, causing the lambda to enter a panic state.\n\nThis resulted in a service outage, impacting container image scanning capabilities. Although monitoring was in place for various components, an alert specifically based on lambda panics was missing, delaying proactive identification and remediation.\n\nThe Aqua Fields team promptly identified the issue and engaged the on-call channel. However, due to the unavailability of the US team and the late hour in India, response time was impacted. The India team resolved the incident at 10:52 PM UTC on August 21st by increasing the lambda's ephemeral storage.\n\nWe apologize for any inconvenience caused by this disruption. We are taking steps to improve our monitoring and alerting capabilities, including implementing automated remediation where possible, to prevent similar incidents in the future.","summary":null,"severity":"high","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"Aqua Security","fixed":[],"affected":"","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["aquasec","incident","ops","vendor"],"not_affected_if":[],"how_to_check":null,"fix":null,"status":"resolved","published_at":"2024-08-21T20:30:00+00:00","first_seen_at":"2026-11-08T17:00:34+00:00","triaged_at":"2026-11-08T17:05:20+00:00","updated_at":"2026-11-08T17:05:20+00:00","category":"vendor","confidence":null,"triage":null,"analyst_status":null,"analyst_note":null,"search":"'10':165C '2.5':71C '2023':19C '21st':18C,171C '30':23C '3gb':61C '500mb':76C '52':166C '7pbbsbkwknnl':9A '8':22C 'alert':111C,197C 'although':102C 'apolog':180C 'approxim':21C 'aqua':1A,10A,125C 'aquasec':8A,12B 'archiv':78C 'august':17C,170C 'autom':201C 'avail':81C 'base':113C 'call':137C 'capabl':101C,198C 'caus':83C,184C 'channel':138C 'combin':73C 'compon':109C 'configur':59C 'contain':27C,98C 'critic':53C 'cybercent':3A 'databas':54C,68C 'delay':119C 'disrupt':5A,34C,187C 'download':49C 'due':35C,140C 'engag':133C 'enter':87C 'ephemer':42C,63C,177C 'exceed':40C 'exhaust':79C 'experienc':31C 'extract':51C,67C 'field':126C 'function':39C 'futur':211C 'gb':72C 'hour':151C 'howev':65C,139C 'identif':121C 'identifi':129C 'imag':28C,56C,99C 'impact':97C,157C 'implement':200C 'improv':193C 'inc':7A 'inc-aquasec-7pbbsbkwknnl':6A 'incid':13B,163C,208C 'includ':199C 'inconveni':183C 'increas':173C 'india':153C,159C 'issu':131C 'lambda':38C,46C,85C,115C,175C 'late':150C 'limit':44C 'major':33C 'miss':118C 'monitor':103C,195C 'on-cal':135C 'op':14B 'outag':96C 'panic':89C,116C 'place':106C 'pm':24C,167C 'possibl':204C 'prevent':206C 'proactiv':120C 'prompt':128C 'remedi':123C,202C 'resolv':161C 'respons':47C,154C 'result':92C 'scan':29C,57C,100C 'secur':2A 'security':11A 'servic':4A,30C,95C 'similar':207C 'size':69C 'specif':112C 'state':90C 'step':191C 'storag':43C,64C,82C,178C 'take':190C 'team':127C,147C,160C 'time':155C 'unavail':143C 'us':146C 'utc':25C,168C 'various':108C 'vendor':15B 'zip':77C","nicknames":[],"mitigations":[],"who_affected":null,"tier":null,"verified":{},"analyst_revisit_at":null,"fix_status":null,"audience":null,"plain_action":null,"pkeys":["aquasecurity","security"],"ptokens":["aqua","security"],"labels":["aquasec","high","incident","ops","vendor"],"campaign_type":null,"search_a":"'7pbbsbkwknnl':9A 'aqua':1A,10A 'aquasec':8A 'cybercent':3A 'disrupt':5A 'inc':7A 'inc-aquasec-7pbbsbkwknnl':6A 'secur':2A 'security':11A 'servic':4A","search_b":"'aquasec':12B 'incid':13B 'op':14B 'vendor':15B","search_c":"'10':165C '2.5':71C '2023':19C '21st':18C,171C '30':23C '3gb':61C '500mb':76C '52':166C '8':22C 'alert':111C,197C 'although':102C 'apolog':180C 'approxim':21C 'aqua':125C 'archiv':78C 'august':17C,170C 'autom':201C 'avail':81C 'base':113C 'call':137C 'capabl':101C,198C 'caus':83C,184C 'channel':138C 'combin':73C 'compon':109C 'configur':59C 'contain':27C,98C 'critic':53C 'databas':54C,68C 'delay':119C 'disrupt':34C,187C 'download':49C 'due':35C,140C 'engag':133C 'enter':87C 'ephemer':42C,63C,177C 'exceed':40C 'exhaust':79C 'experienc':31C 'extract':51C,67C 'field':126C 'function':39C 'futur':211C 'gb':72C 'hour':151C 'howev':65C,139C 'identif':121C 'identifi':129C 'imag':28C,56C,99C 'impact':97C,157C 'implement':200C 'improv':193C 'incid':163C,208C 'includ':199C 'inconveni':183C 'increas':173C 'india':153C,159C 'issu':131C 'lambda':38C,46C,85C,115C,175C 'late':150C 'limit':44C 'major':33C 'miss':118C 'monitor':103C,195C 'on-cal':135C 'outag':96C 'panic':89C,116C 'place':106C 'pm':24C,167C 'possibl':204C 'prevent':206C 'proactiv':120C 'prompt':128C 'remedi':123C,202C 'resolv':161C 'respons':47C,154C 'result':92C 'scan':29C,57C,100C 'servic':30C,95C 'similar':207C 'size':69C 'specif':112C 'state':90C 'step':191C 'storag':43C,64C,82C,178C 'take':190C 'team':127C,147C,160C 'time':155C 'unavail':143C 'us':146C 'utc':25C,168C 'various':108C 'zip':77C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2024-08-21T20:30:00+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"statuspage","external_id":"aquasec:7pbbsbkwknnl","url":"https://stspg.io/1cgxqqq2qmq1","severity":"high","published_at":"2024-08-21T20:30:00+00:00","modified_at":"2024-08-27T18:30:59+00:00","first_seen_at":"2026-11-08T17:00:34+00:00","fetched_at":"2026-11-09T02:40:05+00:00","note":null}],"documents":[],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}