generic.secrets.security.detected-aws-access-key-id-value.detected-aws-access-key-id-value

rules:
  - id: detected-aws-access-key-id-value
    patterns:
      - pattern-regex: \b(A3T[A-Z0-9]|AKIA|AGPA|AROA|AIPA|ANPA|ANVA|ASIA)[A-Z0-9]{16}\b
      - pattern-not-regex: (?i)example|sample|test|fake
    languages:
      - regex
    message: AWS Access Key ID Value detected. This is a sensitive credential and
      should not be hardcoded here. Instead, read this value from an environment
      variable or keep it in a separate, private file.
    severity: ERROR
    metadata:
      cwe:
        - "CWE-798: Use of Hard-coded Credentials"
      source-rule-url: https://github.com/grab/secret-scanner/blob/master/scanner/signatures/pattern.go
      category: security
      technology:
        - secrets
        - aws
      confidence: LOW
      owasp:
        - A07:2021 - Identification and Authentication Failures
      references:
        - https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures
      cwe2022-top25: true
      cwe2021-top25: true
      subcategory:
        - audit
      likelihood: LOW
      impact: HIGH
      license: Commons Clause License Condition v1.0[LGPL-2.1-only]
      vulnerability_class:
        - Hard-coded Secrets