High-confidence secret in API Gateway stage variable

Severity: Critical
Service: Secrets exposure
Check ID: SECRETS_APIGW_STAGEVAR_HIGH

What this check finds

An API Gateway stage variable matches a high-confidence credential pattern. Stage variables are visible in the console and via API to any principal with apigateway:GET on the stage.

Passing looks like: No secrets in API Gateway stage variables.

How to fix it

Remove the secret from the stage variable. Store it in Secrets Manager or SSM Parameter Store SecureString and reference it at runtime via Lambda environment injection or application startup.

Compliance controls it is evidence for

A failing result counts against these controls in KloudLytics; a passing one is evidence towards them. How compliance mapping works

Compliance controls mapped to High-confidence secret in API Gateway stage variable
Framework	Controls
NIST SP 800-53 Rev5 (Moderate)	IA-5 Authenticator Management
NIST Cybersecurity Framework 2.0	PR.AA-01 Identities and credentials are managed
ISO/IEC 27001:2022 Annex A	A.5.17 Authentication information

Checked on every scan

KloudLytics runs this check each time it scans a connected AWS account, through a read-only role, and lists every affected resource with its region. On Pro and Business a fix is written for the specific resource rather than the general case above. The exact access it needs

More Secrets exposure checks

All Secrets exposure checks