Problem:

• The AWS plugin is producing false positives for example:
  "aws:cdk:path": "VaDataVaultCdkPoc/rBucketKeyCdk/Resource"
• The regex for the real secret is correct since all aws secret access keys follow the format wJalrXUtnFEMI/K7MDENG/bPxRfiCYEXAMPLEKEY
• However, there is no restriction on the variable name other than that it must prefix with aws followed by any characters

Solution:

• The solution here is to add another restriction in addition to the aws prefix which is adding that there must be some form of secret keyword like key|pwd|pw|password|pass|token in the variable name
• This will allow us to constrain the subset of results filtering out some false postiives ensuring the variable name is prefixed with aws, must contain a secret keyword, and the secret regex must match the standard aws format.
• Please Note: I also increased the allowed variable name length. The reasoning behind this is a user can potentially set this to something longer than the original 20 characters. Also multiple other aws resource identifier names are longer than 20 characters.
• Some tests needed to be updated since one test case aws_secret_access_key = 'wJalrXUtnFEMI/K7MDENG/bPxRfiCYEXAMPLEKEY' was not picked up by the AWS detector since the variable name was too long. This in my opinion should be detected. It is detected as an AWS Access Key and detected as a Base64 High Entropy String