False Positive: AWS Access Key for aws:cdk:path

[AjkayAlan]

Background

I have been using detect-secrets and absolutely love it! Particularly, I use it via checkov, which scans AWS CloudFormation templates (among other things). I am using the AWS CDK to generate my CloudFormation, which adds some metadata

The Problem

Some CDK metadata in CloudFormation can trigger a false positive on AWSKeyDetector. The offending regex is at

detect-secrets/detect_secrets/plugins/aws.py

Line 31 in 3c8ee74

re.compile(r'aws.{0,20}?[\'\"]([0-9a-zA-Z/+]{40})[\'\"]'),

Two examples I have that were from valid generated CloudFormation (from cdk) are:

• "aws:cdk:path": "VaDataVaultCdkPoc/rBucketKeyCdk/Resource"
• "aws:cdk:path": "AuroraRdsStack/DbCluster/Subnets/Default"

The Solution

I am not quite sure - in part that I don't have all the context behind the validity of this regex when it was originally introduced/sourced from a third party.

Final Thoughts

I am willing to make a contribution if someone has a good idea on how to change this to be effective, but still not alert on the scenarios I have put above. Otherwise if someone has a good idea, go for it!

[lorenzodb1]

Hi @AjkayAlan! Thank you for your kind words and for reporting this issue. I believe one solution could be to change the regex to look for specific keywords on the left-hand side of the value-assignment statement (such as key, I think we already do this in other plugins). This should avoid that metadata to be flagged as sensitive.

@jpdakran do you have any thoughts about this?

[jpdakran]

Yes this seems like a good candidate for a regex refactor. Let me see what I can come up with.