Sensitive Data: AWS Access Key Leak in JavaScript Bundle¶

Identifier: js_data_leak_aws_key

Scanner(s) Support¶

Description¶

AWS access key identifiers embedded in JavaScript bundles can grant attackers programmatic access to cloud resources. AWS explicitly warns against placing access keys in application files because anyone who can read the bundle can extract and abuse them.

How we test: We statically analyze first-party JavaScript bundles for patterns matching AWS access key IDs (AKIA/ASIA prefixes).

References:

• CWE-200: Exposure of Sensitive Information to an Unauthorized Actor
• CWE-798: Use of Hard-coded Credentials
• AWS IAM: Manage access keys for IAM users

Configuration¶

Example¶

Example configuration:

---
security_tests:
  js_data_leak_aws_key:
    issues_count_limit: 20
    skip: false

Reference¶

issues_count_limit¶

Type : integer

The maximum number of issues to report. Use 0 to report all issues.

skip¶

Type : boolean

Skip the test if true.