Description

Detects hardcoded AWS credentials (like access keys, secret keys) exposed in configuration files or source code. Exposed cloud credentials create significant security risks as they could allow attackers to gain unauthorized access to cloud resources and services.

Detection Strategy

• Scans configuration files and source code for AWS credential patterns

• Looks for string literals containing AWS access key formats (20 character strings starting with 'AKIA')

• Identifies AWS secret key patterns (40 character base64-encoded strings)

• Reports a vulnerability when credentials are found hardcoded in files rather than stored securely in environment variables or secret management systems

Vulnerable code example

{
  "scripts": {
    "sonar": "sonar-scanner -Dsonar.host.url=http://localhost:9000 -Dsonar.token=sqp_x2y3z4k5q6l7m8n9a0b1c2d3e4f5g6h7i8j9o0p1" // Security risk: Hardcoded sensitive token in configuration file
  },
  "name": "example-project",
  "version": "1.0.0"
}

✅ Secure code example

{
  "scripts": {
    "sonar": "sonar-scanner -Dsonar.host.url=http://localhost:9000 -Dsonar.token=${SONAR_TOKEN}" // Safe: Token loaded from environment variable
  },
  "name": "example-project",
  "version": "1.0.0"
}