add plugin to look for AWS key IDs

[calvinli]

AWS key IDs are not strictly speaking secrets, although we've found that files containing one almost always contain the corresponding private key. (The only notable false positives I could find in an internal search are AWS S3 pre-signed URLs, which include the signing key's ID in the URL. These are arguably potentially secret anyway.)

This was implemented by adding a new plugin base class (RegexBasedDetector) and adding the AKIA regex as a subclass; this is a bit verbose, but necessary if we want the ability to turn individual regex-based checks on and off. It looks like potentially KeywordDetector, PrivateKeyDetector, and BasicAuthDetector could also be implemented usingRegexBasedDetector too, if we wanted to consolidate code a bit.

Change is test-coverage neutral.

[KevinHock]

Looks great so far

[domanchi]

Mostly LGTM. We can keep things DRYer by refactoring plugins/basic_auth.py and plugins/private_key.py too! I'd probably stay away from touching plugins/keyword.py though, because of the improvements still sitting in queue.

[calvinli]

Mostly LGTM. We can keep things DRYer by refactoring plugins/basic_auth.py and plugins/private_key.py too! I'd probably stay away from touching plugins/keyword.py though, because of the improvements still sitting in queue.

let's do that in a different PR...

[KevinHock]

🚢
🏯
🛥