Tag confusion in AWS Load Balancer Controller can expose databases to the internet

A researcher demonstrated in HackerOne #1238482 that a developer with standard EKS namespace access and ec2:CreateTags permission can tag any security group with the controller's expected tags, create a matching Ingress, and make the AWS Load Balancer Controller open port 22 to 0.0.0.0/0. The controller relies solely on tags to determine ownership, and tags are not a security boundary.

• Attack needs namespace access, ec2:CreateTags permission and the victim SG ID
• Controller applies Ingress annotations as inbound rules to the tagged SG
• Example opens port 22 to 0.0.0.0/0 on all instances using that SG
• Mitigations: scope controller IAM role by aws:ResourceTag and deny CreateTags via SCP