Skip to content

Draft: Add rules for additional AWS secrets

Lizzie Morattirequested to merge
add-additional-aws-secrets-detection-lmoratti into main

What does this MR do?

The merge request updates the rules for identifying AWS credentials and sensitive IDs.

It adds three new rules to detect AWS Secrets and modifies the existing rule description.

  1. AWS Temporary Access Keys
  2. AWS Service Bearer Token
  3. AWS Cognito Identity Pool IDs

There is public offensive security research and automated tooling in which an attacker who finds an identity pool id for an identity pool that allows self-registration or unauthenticated access can obtain valid AWS credentials. An attacker who is searching through public code and repositories might use this as a foothold. The prerequisites to do so are:

  1. the Cognito Identity Pool ID
  2. the AWS Account ID (considered by AWS to not be sensitive, and can be reverse engineered with AWS access keys)

Additionally, this MR updates the description of the existing rule for AWS Access Tokens to "AWS Longterm Access Key" which uses the AWS terminology of "key" rather than "token" but stresses the difference between temporary and longterm credentials.

These changes enhance the tool's ability to identify sensitive AWS secrets for users who might accidentally commit them.

What are the relevant issue numbers?

gitlab-org/security-products/tests/secrets!58 (merged) - Adds necessary secrets for pipeline success

Does this MR meet the acceptance criteria?

Edited by Lizzie Moratti

Merge request reports