Credentials exposure actions return credentials in an API response misconfiguration detected in code

Rule Details

Cortex AppSec Rule ID	APPSEC_AWS_107
Category - Subcategory	IAM - Credential Exposure
Provider	AWS
Severity	LOW
Framework	CloudFormation, Serverless, Terraform, Terraform Plan

Impact

AWS IAM users access AWS resources using different types of credentials, such as passwords or access keys. Credentials Exposure actions return credentials as part of the API response, such as ecr:GetAuthorizationToken, iam:UpdateAccessKey, and others. For more info, visit cloudsplaning documentation https://cloudsplaining.readthedocs.io/en/latest/glossary/credentials-exposure/

How to Fix

Resource: AWS::IAM::Policy / AWS::IAM::ManagedPolicy / AWS::IAM::Group / AWS::IAM::Role / AWS::IAM::User

• Arguments: Effect + Actions [source,go]

---

Resources: AdminDeny: Type: 'AWS::IAM::ManagedPolicy' Properties: ... PolicyDocument: ... Statement:

• Effect: Allow Action:
• 'lambda:CreateFunction'
• 'lambda:CreateEventSourceMapping'
• 'dynamodb:CreateTable' Resource: '*'

---