rules:
- id: detected-aws-access-key-id-value
  patterns:
  - pattern-regex: \b(A3T[A-Z0-9]|AKIA|AGPA|AROA|AIPA|ANPA|ANVA|ASIA)[A-Z0-9]{16}\b
  - pattern-not-regex: (?i)example|sample|test|fake
  languages: [regex]
  message: AWS Access Key ID Value detected. This is a sensitive credential and should not be hardcoded
    here. Instead, read this value from an environment variable or keep it in a separate, private file.
  severity: ERROR
  metadata:
    cwe:
    - 'CWE-798: Use of Hard-coded Credentials'
    source-rule-url: https://github.com/grab/secret-scanner/blob/master/scanner/signatures/pattern.go
    category: security
    technology:
    - secrets
    - aws
    confidence: LOW
    owasp:
    - A07:2021 - Identification and Authentication Failures
    - A07:2025 - Authentication Failures
    references:
    - https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures
    cwe2022-top25: true
    cwe2021-top25: true
    subcategory:
    - audit
    likelihood: LOW
    impact: HIGH