Probable secret in Elastic Beanstalk environment variable
- Severity
- High
- Service
- Secrets exposure
- Check ID
- SECRETS_EB_ENV_CONTEXTUAL
What this check finds
An Elastic Beanstalk environment variable matches a password or API-key pattern with high entropy.
Passing looks like: No probable secrets in Elastic Beanstalk variables.
How to fix it
Move the value to Secrets Manager or SSM Parameter Store SecureString and fetch it at application startup.
Compliance controls it is evidence for
A failing result counts against these controls in KloudLytics; a passing one is evidence towards them. How compliance mapping works
| Framework | Controls |
|---|---|
| NIST SP 800-53 Rev5 (Moderate) |
|
| NIST Cybersecurity Framework 2.0 |
|
| ISO/IEC 27001:2022 Annex A |
|
Checked on every scan
KloudLytics runs this check each time it scans a connected AWS account, through a read-only role, and lists every affected resource with its region. On Pro and Business a fix is written for the specific resource rather than the general case above. The exact access it needs
More Secrets exposure checks
- CriticalHigh-confidence secret in API Gateway stage variable
- CriticalHigh-confidence secret in CloudFormation stack parameter (NoEcho disabled)
- CriticalHigh-confidence secret in CodeBuild PLAINTEXT environment variable
- CriticalHigh-confidence secret in EC2 user-data
- CriticalHigh-confidence secret in ECS running task environment variable
- CriticalHigh-confidence secret in ECS task definition environment variable
- CriticalHigh-confidence secret in Elastic Beanstalk environment variable
- CriticalHigh-confidence secret in Lambda environment variable