Skip to main content

Non-encrypted confidential information - AWS

Description

AWS credentials are stored in plain text within the source code.

Impact

  • Expose resources, processes and sensitive information that could be compromised.
  • Copy sensitive information from S3 Buckets.
  • Remove sensitive information from S3 Buckets.

Recommendation

Encrypt all sensitive information that is transported or stored within the application according to the organizations policies.

Threat

Attacker with access to the code from the Internet.

Expected Remediation Time

⌚ 120 minutes.

Score

Default score using CVSS 3.1. It may change depending on the context of the vulnerability.

Base

  • Attack vector: N
  • Attack complexity: L
  • Privileges required: L
  • User interaction: N
  • Scope: C
  • Confidentiality: H
  • Integrity: H
  • Availability: H

Temporal

  • Exploit code madurity: X
  • Remediation level: X
  • Report confidence: X

Result

  • Vector string: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H/E:X/RL:X/RC:X
  • Score:
    • Base: 9.9
    • Temporal: 9.9
  • Severity:
    • Base: Critical
    • Temporal: Critical

Code Examples

Compliant code

Sensitive resources should have access credentials stored as encrypted values

provider "aws" {
region = "us-west-2"
access_key = encrypted_key
secret_key = secret_key
}
resource "aws_lb" "test" {
name = ""test-lb-tf""
internal = false
load_balancer_type = ""application""
security_groups = [aws_security_group.lb_sg.id]
enable_deletion_protection = true
}
Resources:
NewVolume1:
Type: AWS::EC2::Volume
Properties:
Size: 100
Encrypted: true
AvailabilityZone: us-east-1
DeletionPolicy: Snapshot

Non compliant code

Some sensitive resources have their access credentials exposed in the source code

provider "aws" {
region = "us-west-2"
access_key = "plain_access_key"
secret_key = "my-secret-key"
}
resource "aws_lb" "test" {
name = ""test-lb-tf""
internal = false
load_balancer_type = ""application""
security_groups = [aws_security_group.lb_sg.id]
enable_deletion_protection = false
}
Resources:
NewVolume1:
Type: AWS::EC2::Volume
Properties:
Size: 100
Encrypted: false
AvailabilityZone: us-east-1
DeletionPolicy: Snapshot

Requirements