generic.secrets.security.detected-aws-account-id.detected-aws-account-id

Community Favorite
profile photo of semgrepsemgrep
Author
37,965
Download Count*
LGPL Commons Clause
License

AWS Account ID detected. While not considered sensitive information, it is important to use them and share them carefully. For that reason it would be preferrable avoiding to hardcoded it here. Instead, read the value from an environment variable or keep the value in a separate, private file.

Run Locally

Run in CI

Semgrep CI docs

Defintion

Edit RuleView Source
Open in Playground 
rules:
  - id: detected-aws-account-id
    patterns:
      - pattern-either:
          - pattern: |
              $ACCOUNT_ID = $SECRET
          - pattern: |
              $ACCOUNT_ID : $SECRET
          - pattern: |
              $ACCOUNT_ID => $SECRET
          - pattern: |
              $ACCOUNT_ID = "$SECRET"
          - pattern: |
              $ACCOUNT_ID : "$SECRET"
          - pattern: |
              $ACCOUNT_ID => "$SECRET"
          - pattern: |
              "$ACCOUNT_ID" = "$SECRET"
          - pattern: |
              "$ACCOUNT_ID" : "$SECRET"
          - pattern: |
              "$ACCOUNT_ID" => "$SECRET"
      - metavariable-analysis:
          metavariable: $SECRET
          analyzer: entropy
      - metavariable-regex:
          metavariable: $SECRET
          regex: ^((?!(12345|0000).*)[0-9]{12})$
      - metavariable-regex:
          metavariable: $ACCOUNT_ID
          regex: (AWS|aws|Aws)?_?(ACCOUNT|account|Account)_?(ID|id|Id)?("|')?
    languages:
      - generic
    message: AWS Account ID detected. While not considered sensitive information, it
      is important to use them and share them carefully. For that reason it
      would be preferrable avoiding to hardcoded it here. Instead, read the
      value from an environment variable or keep the value in a separate,
      private file.
    severity: ERROR
    metadata:
      cwe:
        - "CWE-798: Use of Hard-coded Credentials"
      source-rule-url: https://github.com/grab/secret-scanner/blob/master/scanner/signatures/pattern.go
      category: security
      technology:
        - secrets
        - aws
      confidence: LOW
      owasp:
        - A07:2021 - Identification and Authentication Failures
      references:
        - https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures
      cwe2022-top25: true
      cwe2021-top25: true
      subcategory:
        - audit
      likelihood: LOW
      impact: HIGH
      license: Commons Clause License Condition v1.0[LGPL-2.1-only]
      vulnerability_class:
        - Hard-coded Secrets

Examples

detected-aws-account-id.txt

# ruleid: detected-aws-account-id
aws_account_id = 287139315271

# ruleid: detected-aws-account-id
aws_account_id:287139315271

{
    "version": "0",
    "id": "a76750eb-b69f-ae47-b183-4d3cb0700618",
    "detail-type": "AWS API Call via CloudTrail",
    "source": "aws.s3",
    # ruleid: detected-aws-account-id
    "account": "287139315271",
    "time": "2018-05-22T12:44:24Z",
    "region": "us-east-1",
    "resources": [],
    "detail": {
       "eventVersion": "1.05",
       "userIdentity": {},
       "eventTime": "2018-05-22T12:44:24Z",
       "eventSource": "s3.amazonaws.com",
       "eventName": "DeleteBucket",
       "awsRegion": "us-east-1",
       "sourceIPAddress": "209.6.231.175",
       "userAgent": "[S3Console/0.4, aws-internal/3]",
       "requestParameters": {},
       "responseElements": null,
       "additionalEventData": {
          "vpcEndpointId": "vpce-6d72a204"
       },
       "requestID": "51A7870C114C931C",
       "eventID": "d687e2af-5a29-4acb-bc41-6892b36420bf",
       "eventType": "AwsApiCall",
       "vpcEndpointId": "vpce-6d72a204"
    }
}

Mappings:
  ElbService:
    # https://docs.aws.amazon.com/elasticloadbalancing/latest/application/load-balancer-access-logs.html#access-logging-bucket-permissions
    us-east-1:
      # ruleid: detected-aws-account-id
      AccountId: "287139315271"

# ruleid: detected-aws-account-id
aws_account_id = "287139315271"

aws s3api put-bucket-inventory-configuration \
              --bucket my-bucket \
              --id 2 \
# ruleid: detected-aws-account-id
              --inventory-configuration '{"Destination": { "S3BucketDestination": { "AccountId": "287139315271", "Bucket": "arn:aws:s3:::my-bucket", "Format": "CSV" }}, "IsEnabled": true, "Id": "2", "IncludedObjectVersions": "Current", "Schedule": { "Frequency": "Daily" }}'


# ok: detected-aws-account-id
aws_account_id_fake:123456789012123