Documentation
¶
Overview ¶
Package aws is the AWS credential provider: the access keys of IAM users and the temporary access keys STS hands out.
A key id carries no checksum, but its base32 body encodes the account it belongs to, which patty decodes offline. A key id is useless without its secret access key, so Find looks for that next to the id, and for the session token of a temporary key. Only a complete pair can be verified, with one sts:GetCallerIdentity call, or deactivated, with iam:UpdateAccessKey on its own user. Both calls are signed with the key itself and are recorded in the owner's CloudTrail, which is intended: the owner sees that the key was checked.
Index ¶
- Constants
- func Account(keyID string) string
- type Provider
- func (*Provider) Find(content []byte) []detect.Token
- func (*Provider) Kinds() []detect.KindInfo
- func (*Provider) LocalSources() detect.LocalSources
- func (*Provider) Name() string
- func (p *Provider) Revoke(ctx context.Context, tokens []detect.Token) error
- func (p *Provider) Verify(ctx context.Context, tok detect.Token) detect.Verification
Constants ¶
const ( // KindAccessKey is the long-lived access key of an IAM user (AKIA, and // the older ABIA, ACCA and A3T prefixes). KindAccessKey detect.Kind = "aws-access-key" // KindTemporaryKey is a temporary access key issued by STS (ASIA), valid // only together with its session token and for a few hours. KindTemporaryKey detect.Kind = "aws-temporary-access-key" )
Variables ¶
This section is empty.
Functions ¶
Types ¶
type Provider ¶
type Provider struct {
// STSURL and IAMURL are the service endpoints, the global ones by
// default; tests point them at a local server.
STSURL string
IAMURL string
Client *http.Client
}
Provider implements detect.Provider for AWS.
func (*Provider) Find ¶
Find implements detect.Provider. Five substring passes cover the key id prefixes; each candidate is checked for the exact shape (twenty characters of the base32 alphabet, not part of a longer word). Every key id found is then paired with the secret, and for a temporary key the session token, that appears closest to it in the same object.
func (*Provider) Kinds ¶
Kinds implements detect.Provider. An access key is revocable in the sense that patty can deactivate a key pair through the key's own user, when the user may manage its own keys; Revoke says so clearly when it may not.
func (*Provider) LocalSources ¶
func (*Provider) LocalSources() detect.LocalSources
LocalSources implements detect.Provider: the environment variables every AWS SDK reads, the shared credentials and config files, and the configuration of s3cmd and rclone. Only the key id can match; the secret and session token are listed because that is where a pair lives.
func (*Provider) Revoke ¶
Revoke implements detect.Revoker by deactivating each key through iam:UpdateAccessKey, signed with the key itself. AWS has no endpoint for reporting a leaked key, so this is best effort: it works for the key of an IAM user who may manage their own access keys, and says clearly when it does not. A deactivated key can be re-enabled by its owner; deleting it for good is left to them. There is no dry run, IAM has none.
func (*Provider) Verify ¶
Verify implements detect.Provider with one sts:GetCallerIdentity call signed with the key pair; the call needs no permission and every key can make it. It is recorded in the owner's CloudTrail, which is intended. A key id without its secret, or a temporary key without its session token, cannot be checked at all.
Source Files