AWS Load Balancer Controller Managed Security Groups can be replaced by an unprivileged attacker

Summary: When creating an Ingress of class `alb`, by default, AWS Load Balancer Controller creates a managed SG and attaches it to the created ALB. This SG limits which ports of the ALB are accessible by whom.

kubectl apply -f https://raw.githubusercontent.com/kubernetes-sigs/aws-alb-ingress-controller/v1.1.9/docs/examples/echoservice/echoserver-namespace.yaml
kubectl apply -f …