View a markdown version of this page

WKLD.05 Detect and remediate exposed secrets - AWS Prescriptive Guidance

WKLD.05 Detect and remediate exposed secrets

In WKLD.03 Use ephemeral secrets or a secrets-management service and WKLD.04 Prevent application secrets from being exposed, you put measures in place to protect secrets. In this control, you set up tooling to detect secrets that were accidentally committed or exposed, and take action to revoke or rotate them.

An exposed secret can be exploited and risks unauthorized access to your AWS resources and data. Rotate or revoke it immediately after detection.

Scan code repositories regularly for accidentally committed secrets. Use Kiro CLI or the open-source tools listed in WKLD.04 and integrate the tool into your local development or CI/CD pipeline. If you identify an exposed secret, remediate it immediately. Rotate or revoke the exposed credential to prevent further use, and remove it from source control history.

To detect exposed secrets using Kiro CLI

  1. Install Kiro CLI in your development environment. For more information, see Kiro CLI in the Kiro documentation.

  2. Configure Kiro CLI to scan your code repositories, focusing on high-risk repositories such as production or public-facing code.

  3. Schedule regular scans. Consider daily scans for production repositories and weekly scans for development repositories.

  4. Review scan results and identify any exposed secrets.

To remediate exposed secrets

  1. Rotate or revoke the exposed secret immediately in the originating service (for example, regenerate an API key or reset a password).

  2. Create a new secret in AWS Secrets Manager or AWS Systems Manager Parameter Store.

  3. Update your applications to retrieve the new secret from the secure storage service.

  4. Remove the exposed secret from your code repository history by using git filter-repo.

The open-source tools listed in WKLD.04 can also detect secrets that are already present in your repository.

Note

Kiro CLI is available at no charge under the Free tier. For more information, see Kiro pricing.