sirwart/ripsecrets

AWS AKIA vs Secret Key

Helithumper opened this issue · 2 comments

Was Looking at https://github.com/sirwart/secrets/blob/main/src/find_secrets.rs#L24= and found reference to the AKIA-like set of access key IDs. I don't think these are secrets, however the regex could be replaced for the true format of AWS Secrets which would be tied to these identifiers (as listed under "Secret keys"): https://summitroute.com/blog/2018/06/20/aws_security_credential_formats/

realized this is covered elsewhere

@Helithumper You're right that there's already coverage for the actual AWS secret, but you're also right that AKIA prefixed keys are not secrets. I updated the regex list to not include those keys explicitly.