critical
aws-secret-access-key· AWSAWS secret access key
The half of an AWS credential pair that actually authenticates. Grants the IAM principal’s permissions.
How it is detected
Forty characters of base64 is far too common a shape in minified JavaScript to report on its own, so this rule only fires when an access key ID or an AWS-specific variable name appears alongside it. On its own it is discarded.
If you find one
- 1Deactivate the access key in IAM, then delete it once nothing is broken.
- 2Read CloudTrail for the period the key was public. This is the one provider where you can find out exactly what was done.
- 3Replace long-lived keys with a role, and issue presigned URLs from a server route instead of shipping credentials.
Where it turns up
Most often in client bundles built by AI coding tools.