Uploaded image for project: 'Rules Repository'
  1. Rules Repository
  2. RSPEC-6290

Amazon Web Services credentials should not be disclosed

    XMLWordPrintable

    Details

    • Message:
      Hide
      "xxxxx" detected here. Remove this cedential from your code.
      - AWS Secret Access Key
      - AWS Access Key ID
      - AWS Session Token
      Show
      "xxxxx" detected here. Remove this cedential from your code. - AWS Secret Access Key - AWS Access Key ID - AWS Session Token
    • Default Severity:
      Blocker
    • Impact:
      High
    • Likelihood:
      High
    • Default Quality Profiles:
      Sonar way
    • Targeted languages:
      ABAP, APEX, C#, C, C++, Cobol, CSS, Flex, Go, HTML, Java, JavaScript, Kotlin, Objective-C, PHP, PL/I, PL/SQL, Python, RPG, Ruby, Rust, Scala, Solidity, Swift, T-SQL, TypeScript, VB.Net, VB6, XML
    • Remediation Function:
      Constant/Issue
    • Constant Cost:
      30min
    • Analysis Scope:
      Main Sources, Test Sources
    • CERT:
      MSC03-J.
    • CWE:
      CWE-798, CWE-259
    • OWASP:
      A2
    • SANS Top 25:
      Porous Defenses

      Description

      AWS credentials are designed to authenticate and authorize requests to AWS.

      If your application interacts with AWS then it requires AWS credentials to access all the resources it needs to function properly. Resources that can be accessed depend on the permission granted to the AWS account. Worst case scenario: the credential authenticates to the AWS account root user who has unrestricted access to all resources in your AWS account, including billing information.
      Therefore only administrators should have access to the AWS credentials used by your application.

      As a consequence, AWS credentials should not be stored along with the application code as they would grant special privilege to anyone who has access to the application source code.

      Credentials should be stored outside of the code in a file that is never committed to your application code repository.
      If possible, a better alternative is to use your cloud provider's service for managing secrets. On AWS this service is called Secret Manager.
      When credentials are disclosed in the application code, consider them as compromised and revoke them immediately.

      This rule flags instances of:

      • AWS Secret Access Key
      • AWS Access ID
      • AWS Session Token

      See

        Attachments

          Activity

            People

            Assignee:
            Unassigned Unassigned
            Reporter:
            pierre-loup.tristant Pierre-Loup Tristant
            Votes:
            0 Vote for this issue
            Watchers:
            1 Start watching this issue

              Dates

              Created:
              Updated: