High-confidence secret in Elastic Beanstalk environment variable
- Severity
- Critical
- Service
- Secrets exposure
- Check ID
- SECRETS_EB_ENV_HIGH
What this check finds
An Elastic Beanstalk environment variable matches a high-confidence credential pattern. Environment configuration is visible to any principal with elasticbeanstalk:DescribeConfigurationSettings.
Passing looks like: No secrets in Elastic Beanstalk variables.
How to fix it
Remove the secret from the Elastic Beanstalk environment properties. Fetch it at application startup from Secrets Manager or SSM Parameter Store SecureString.
Compliance controls it is evidence for
A failing result counts against these controls in KloudLytics; a passing one is evidence towards them. How compliance mapping works
| Framework | Controls |
|---|---|
| NIST SP 800-53 Rev5 (Moderate) |
|
| NIST Cybersecurity Framework 2.0 |
|
| ISO/IEC 27001:2022 Annex A |
|
Checked on every scan
KloudLytics runs this check each time it scans a connected AWS account, through a read-only role, and lists every affected resource with its region. On Pro and Business a fix is written for the specific resource rather than the general case above. The exact access it needs
More Secrets exposure checks
- CriticalHigh-confidence secret in API Gateway stage variable
- CriticalHigh-confidence secret in CloudFormation stack parameter (NoEcho disabled)
- CriticalHigh-confidence secret in CodeBuild PLAINTEXT environment variable
- CriticalHigh-confidence secret in EC2 user-data
- CriticalHigh-confidence secret in ECS running task environment variable
- CriticalHigh-confidence secret in ECS task definition environment variable
- CriticalHigh-confidence secret in Lambda environment variable
- CriticalHigh-confidence secret in SSM String parameter (unencrypted)