Probable secret in API Gateway stage variable

Severity: High
Service: Secrets exposure
Check ID: SECRETS_APIGW_STAGEVAR_CONTEXTUAL

What this check finds

An API Gateway stage variable matches a password or API-key pattern with high entropy. Stage variables are visible to any principal with apigateway:GET on the stage.

Passing looks like: No probable secrets in API Gateway stage variables.

How to fix it

Move the value to Secrets Manager or SSM Parameter Store SecureString and inject it at runtime.

Compliance controls it is evidence for

A failing result counts against these controls in KloudLytics; a passing one is evidence towards them. How compliance mapping works

Compliance controls mapped to Probable secret in API Gateway stage variable
Framework	Controls
NIST SP 800-53 Rev5 (Moderate)	IA-5 Authenticator Management
NIST Cybersecurity Framework 2.0	PR.AA-01 Identities and credentials are managed
ISO/IEC 27001:2022 Annex A	A.5.17 Authentication information

Checked on every scan

KloudLytics runs this check each time it scans a connected AWS account, through a read-only role, and lists every affected resource with its region. On Pro and Business a fix is written for the specific resource rather than the general case above. The exact access it needs

More Secrets exposure checks

All Secrets exposure checks