Possible false positives with aws-access-token rule

[weineran]

Describe the bug
The aws-access-token rule detects IAM resource IDs.

The regex contains these prefixes: AKIA|AGPA|AIDA|AROA|AIPA|ANPA|ANVA|ASIA

Those prefixes are associated with IAM resource IDs, which I believe are not actually sensitive info.

https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_identifiers.html#:~:text=Understanding%20unique%20ID%20prefixes

To Reproduce
Steps to reproduce the behavior:

• In AWS, go to IAM and create a new Role
• Copy the name of your role.
• Use the aws CLI to get your role:

aws iam get-role --role-name TestRole

{
    "Role": {
        "Path": "/",
        "RoleName": "TestRole",
        "RoleId": "AROAWORVRXQ5NC76T7223",
        "CreateDate": "2022-12-01T12:59:06+00:00",
        "AssumeRolePolicyDocument": {
            "Version": "2012-10-17",
            "Statement": [
                {
                    "Effect": "Allow",
                    "Principal": {
                    },
                    "Action": "sts:AssumeRole",
                    "Condition": {}
                }
            ]
        },
        "Description": "Delete this after testing",
        "MaxSessionDuration": 3600,
        "RoleLastUsed": {}
    }
}

• Copy the RoleId and add it to a file in your repo
• Run gitleaks. e.g. gitleaks protect --verbose --staged

Expected behavior
I believe Gitleaks should not detect the RoleId as a secret, but it does.

Finding:     "RoleId": "AROAWORVRXQ5NC76T7223",
Secret:      AROAWORVRXQ5NC76T722
RuleID:      aws-access-token
Entropy:     3.684184
...

Also, interestingly, the RoleId is 17 characters after the "AROA" prefix. The aws-access-token regex only detects the first 16 characters. Is that intentional?

Screenshots

Basic Info (please complete the following information):

• OS: Windows 10 Home (19044.2251)
• Gitleaks Version: 8.15.1

Additional context
N/A

cc @zricethezav

[maltemorgenstern]

We are also facing this issue in our repositories. There are some IAM Instance Profile and IAM Role definitions that (as far as I know) are not sensitive information after all.

We suppressed these findings globally by adjusting the aws-access-token rule using a custom gitleaks.toml:

title = "Custom gitleaks config"

[extend]
useDefault = true

[allowlist]
description = "Custom global allow lists"
paths = [
    '''gitleaks.toml''',
    '''(.*?)(jpg|gif|doc|docx|zip|xls|pdf|bin|svg|socket)$''',
    '''(go.mod|go.sum)$''',
    '''node_modules''',
    '''package-lock.json''',
    '''vendor''',
    '''gitleaks-allow''',
]

#######################
# Customized rules, based on https://github.com/zricethezav/gitleaks/blob/v8.16.0/config/gitleaks.toml
#######################

# Customizations:
# - Remove 'AGPA|AIDA|AROA|AIPA|ANPA|ANVA' to reduce false-positive findings
[[rules]]
description = "AWS"
id = "aws-access-token"
regex = '''(A3T[A-Z0-9]|AKIA|ASIA)[A-Z0-9]{16}'''
keywords = [
    "akia","asia",
]

This way we only get findings for Access Keys and STS Tokens.

If you think that this should be changed, I can create an pull request for that.

Regards
Malte

[zricethezav]

should be fixed with #1307