AWS patterns seem to match everything

[frankinspace]

I've installed git-secrets using Homebrew as in the instructions.

Also have run the following to setup:

git secrets --register-aws --global
git secrets --install ~/.git-templates/git-secrets
git config --global init.templateDir ~/.git-templates/git-secrets

If I create a brand new git repo and try to commit using any message, I get an error that the commit message matches a pattern:

mkdir test-secrets
cd test-secrets 
git init
git commit --allow-empty -m 'test'
.git/COMMIT_EDITMSG:1:test

[ERROR] Matched one or more prohibited patterns

Possible mitigations:
- Mark false positives as allowed using: git config --add secrets.allowed ...
- Mark false positives as allowed by adding regular expressions to .gitallowed at repository's root directory
- List your configured patterns: git config --get-all secrets.patterns
- List your configured allowed patterns: git config --get-all secrets.allowed
- List your configured allowed patterns in .gitallowed at repository's root directory
- Use --no-verify if this is a one-time false positive

Output of my secrets.patterns:

git config --get-all secrets.patterns
(A3T[A-Z0-9]|AKIA|AGPA|AIDA|AROA|AIPA|ANPA|ANVA|ASIA)[A-Z0-9]{16}
("|')?(AWS|aws|Aws)?_?(SECRET|secret|Secret)?_?(ACCESS|access|Access)?_?(KEY|key|Key)("|')?\s*(:|=>|=)\s*("|')?[A-Za-z0-9/\+=]{40}("|')?
("|')?(AWS|aws|Aws)?_?(ACCOUNT|account|Account)_?(ID|id|Id)?("|')?\s*(:|=>|=)\s*("|')?[0-9]{4}\-?[0-9]{4}\-?[0-9]{4}("|')?

What am I missing?

[raymondjacobson]

+1 this seems to be a real problem....

[cbarreholm]

I get the same issue and have identified what triggers it for me.

Assume that I have a ~/.aws/credentials that looks like this:

[default]
aws_secret_access_key=
aws_session_token=

[123456789012_RandomPermission]
aws_access_key_id=SOMERANDOMID

then any scan results in [ERROR] Matched one or more prohibited patterns

If I change the default aws_secret_access_key to anything but a blank value:

[default]
aws_secret_access_key=QWERTY
aws_session_token=

[123456789012_RandomPermission]
aws_access_key_id=SOMERANDOMID

then the issue disappears. Looks like the empty string is extracted and used to match, which basically is anything.

Side note on how I got credentials like that. Running awsp2 first with profile and then without a profile results in a file like that.

awsp2 123456789012_RandomPermission
awsp2

[cbarreholm]

My case appear to be #196