mcp-server-semgrep/semgrep-rules/generic/secrets/security/detected-aws-account-id.yaml

MCP Server for Semgrep Integration - static code analysis with AI

rules:
  - id: detected-aws-account-id
    patterns:
      - pattern-either:
          - pattern: |
              $ACCOUNT_ID = $SECRET
          - pattern: |
              $ACCOUNT_ID : $SECRET
          - pattern: |
              $ACCOUNT_ID => $SECRET
          - pattern: |
              $ACCOUNT_ID = "$SECRET"
          - pattern: |
              $ACCOUNT_ID : "$SECRET"
          - pattern: |
              $ACCOUNT_ID => "$SECRET"
          - pattern: |
              "$ACCOUNT_ID" = "$SECRET"
          - pattern: |
              "$ACCOUNT_ID" : "$SECRET"
          - pattern: |
              "$ACCOUNT_ID" => "$SECRET"
      - metavariable-analysis:
          metavariable: $SECRET
          analyzer: entropy
      - metavariable-regex:
          metavariable: $SECRET
          regex: ^((?!(12345|0000).*)[0-9]{12})$
      - metavariable-regex:
          metavariable: $ACCOUNT_ID
          regex: (AWS|aws|Aws)?_?(ACCOUNT|account|Account)_?(ID|id|Id)?("|')?
    languages:
      - generic
    message: AWS Account ID detected. While not considered sensitive information, it is important
      to use them and share them carefully. For that reason it would be preferrable avoiding to
      hardcoded it here. Instead, read the value from an environment variable or
      keep the value in a separate, private file.
    severity: ERROR
    metadata:
      cwe:
        - "CWE-798: Use of Hard-coded Credentials"
      source-rule-url: https://github.com/grab/secret-scanner/blob/master/scanner/signatures/pattern.go
      category: security
      technology:
        - secrets
        - aws
      confidence: LOW
      owasp:
        - A07:2021 - Identification and Authentication Failures
      references:
        - https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures
      cwe2022-top25: true
      cwe2021-top25: true
      subcategory:
        - audit
      likelihood: LOW
      impact: HIGH