Description

Detects hardcoded AWS secret access keys in Go code that uses the AWS SDK. This vulnerability exposes sensitive credentials directly in source code, making them visible to anyone with access to the codebase and potentially leading to unauthorized AWS resource access.

Detection Strategy

• Code imports the AWS SDK for Go (github.com/aws/aws-sdk-go)

• Function calls are made to AWS SDK methods that accept secret access keys as parameters

• The secret access key parameter contains a hardcoded string value instead of being retrieved from environment variables, configuration files, or secure credential stores

• For positional parameter methods: both the access key ID (first parameter) and secret access key (second parameter) are hardcoded strings

• For struct-based methods: the secret access key field within the configuration struct contains a hardcoded string value

Vulnerable code example

package main

import (
	"github.com/aws/aws-sdk-go/aws/credentials"
	"github.com/aws/aws-sdk-go-v2/credentials"
)

func vulnerableStaticCredentials() *credentials.Credentials {...

✅ Secure code example

package main

import (
	"os"
	"github.com/aws/aws-sdk-go/aws/credentials"
	credentialsv2 "github.com/aws/aws-sdk-go-v2/credentials"
)
...