rspec/rules/S6336/secrets/rule.adoc

34 lines
1.9 KiB
Plaintext
Raw Normal View History

== Why is this an issue?
AccessKeys are long term credentials designed to authenticate and authorize requests to Alibaba Cloud.
If your application interacts with Alibaba Cloud then it requires AccessKeys to access all the resources it needs to function properly. Resources that can be accessed depend on the permissions granted to the Alibaba Cloud account. These credentials may authenticate to the account root user who has unrestricted access to all resources in your Alibaba Cloud account, including billing information.
This rule flags instances of:
* Alibaba Cloud AccessKey ID
* Alibaba Cloud AccessKey secret
== Recommended Secure Coding Practices
Only administrators should have access to the AccessKeys used by your application.
As a consequence, AccessKeys should not be stored along with the application code as they would grant special privilege to anyone who has access to the application source code.
AccessKeys should be stored outside of the code in a file that is never committed to your application code repository.
If possible, a better alternative is to use your cloud provider's service for managing secrets. On AlibabaCloud this service is called https://www.alibabacloud.com/help/doc-detail/152001.htm[Secrets Manager].
When credentials are disclosed in the application code, consider them as compromised and revoke them immediately.
== Resources
* https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures/[OWASP Top 10 2021 Category A7] - Identification and Authentication Failures
* https://www.owasp.org/www-project-top-ten/2017/A3_2017-Sensitive_Data_Exposure[OWASP Top 10 2017 Category A3] - Sensitive Data Exposure
* https://cwe.mitre.org/data/definitions/798[MITRE, CWE-798] - Use of Hard-coded Credentials
* https://cwe.mitre.org/data/definitions/259[MITRE, CWE-259] - Use of Hard-coded Password
* https://www.sans.org/top25-software-errors/#cat3[SANS Top 25] - Porous Defenses