AWS access keys and secrets are hard coded in infrastructure misconfiguration detected in code

Rule Details

Cortex AppSec Rule ID	APPSEC_AWS_41
Category - Subcategory	Public Exposure - Encryption And Protocols
Provider	AWS
Severity	HIGH
Framework	Serverless, Terraform, Terraform Plan

Impact

When accessing AWS programmatically users can select to use an access key to verify their identity, and the identity of their applications. An access key consists of an access key ID and a secret access key. Anyone with an access key has the same level of access to AWS resources. We recommend you protect access keys and keep them private. Specifically, do not store hard coded keys and secrets in infrastructure such as code, or other version-controlled configuration settings.

How to Fix

You really should not add your secrets to your Infrastructure code, obtain AWS through the keychain e.g. via Environmental variables. Remove any reference to access_key and secret_key. [source,go]

provider "aws" { region = var.region

• access_key = "NOTEXACTLYAKEY"
• secret_key = "NOTACTUALLYASECRET" }

---