Lacework API Keys detected in code

Rule Details

Cortex AppSec Rule ID	APPSEC_SECRET_135
Category	API Keys
Severity	LOW
Framework	Git

Impact

The Lacework API Key (KeyID) is the identifier component used for server-to-server interaction with the Cloud Security Posture Management (CSPM) platform.

Its exposure provides an attacker with a critical component for identity validation, significantly aiding attempts to compromise the paired Secret and gain unauthorized insight into your cloud security posture.

How to Fix

To remediate exposed Cloud & Infrastructure credentials:

1. Log in to your cloud provider's console.
2. Locate the identity or service account associated with the compromised credentials.
3. Revoke or deactivate the compromised keys immediately.
4. Generate a new set of credentials.
5. Update your environment variables, secrets manager, or pipelines with the new values.

Next, remove the secret from your codebase:

1. Locate the exposed secret in your codebase.
2. Replace the hardcoded value with a secure variable or reference.

Finally, clean your version control history:

1. Permanently remove the sensitive data from your version control history to ensure it cannot be retrieved.

Warning: Revoking infrastructure keys may cause immediate downtime. Ensure you have identified all dependent services before revoking.