High-confidence secret in Secrets Manager description field

Severity: High
Service: Secrets exposure
Check ID: SECRETS_SECRETSMANAGER_DESC_HIGH

What this check finds

A Secrets Manager secret description field contains a high-confidence credential pattern. The description field is not encrypted — it is stored in plaintext and returned by ListSecrets to any principal with secretsmanager:ListSecrets.

Passing looks like: No secrets in Secrets Manager descriptions.

How to fix it

Remove the credential value from the description field. Store it as the secret value (which is encrypted) and update the description to non-sensitive text.

Compliance controls it is evidence for

A failing result counts against these controls in KloudLytics; a passing one is evidence towards them. How compliance mapping works

Compliance controls mapped to High-confidence secret in Secrets Manager description field
Framework	Controls
NIST SP 800-53 Rev5 (Moderate)	IA-5 Authenticator Management
NIST Cybersecurity Framework 2.0	PR.AA-01 Identities and credentials are managed
ISO/IEC 27001:2022 Annex A	A.5.17 Authentication information

Checked on every scan

KloudLytics runs this check each time it scans a connected AWS account, through a read-only role, and lists every affected resource with its region. On Pro and Business a fix is written for the specific resource rather than the general case above. The exact access it needs

More Secrets exposure checks

All Secrets exposure checks