Class: Rules::StaticAwsCredentials

Inherits:
Base
  • Object
show all
Defined in:
lib/rules/static_aws_credentials.rb

Instance Method Summary collapse

Instance Method Details

#check(workflow) ⇒ Object 



7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
 
# File 'lib/rules/static_aws_credentials.rb', line 7

def check(workflow)
  findings = []

  workflow.jobs.each do |_job_id, job|
    workflow.steps(job).each do |step|
      next unless step["uses"]&.include?("configure-aws-credentials")

      with = step["with"] || {}
      has_static = with.key?("aws-access-key-id")
      has_oidc = with.key?("role-to-assume")

      if has_static && !has_oidc
        line = workflow.line_of(/aws-access-key-id/)
        findings << finding(workflow,
          line: line || 0,
          code: "aws-access-key-id: ${{ secrets.AWS_ACCESS_KEY_ID }}",
          message: "Static AWS access keys — long-lived credentials that don't auto-expire",
          fix: "Use OIDC federation: role-to-assume with id-token: write permission"
        )
      end
    end
  end

  findings
end

#description ⇒ Object 



4
 
# File 'lib/rules/static_aws_credentials.rb', line 4

def description = "AWS credentials using static keys instead of OIDC"

#name ⇒ Object 



3
 
# File 'lib/rules/static_aws_credentials.rb', line 3

def name = "static-aws-credentials"

#severity ⇒ Object 



5
 
# File 'lib/rules/static_aws_credentials.rb', line 5

def severity = :high