I am looking at our CI (Bamboo) Server initiating an outbound connection to setup a SSL tunnel to an agent running on an AWS ec2 instance. As per the documentation:
All traffic sent between the agents located in EC2 and the Bamboo server is tunnelled through an SSL-encrypted tunnel. The tunnel will be initiated from the Bamboo Server to the EC2 instance, which means that you don't need to allow any inbound connections to your server. You will need to permit outbound traffic from the server on the tunnel port.
Now I understand what a SSL tunnel is and this may sound like a naive question, but what are some ways a SSL tunnel can be exploited to send malicious data to the CI server if the ec2 instance is compromised?