Security Test: AWS access token exposed¶

Scanner(s) Support¶

Description¶

Default Severity: high

AWS access tokens (including access keys, secret keys, and session tokens) should never be exposed in API responses, logs, or client-side code. These credentials provide direct access to AWS services and resources, and their exposure can lead to unauthorized access, data breaches, and significant financial impact from resource abuse.

Configuration¶

Identifier: information_disclosure/aws_access_token

Examples¶

All configuration available:

checks:
  information_disclosure/aws_access_token:
    skip: false # default

Compliance and Standards¶