aws

Purpose

Detects AWS Access Key IDs within arbitrary string input. AWS Access Key IDs are 20-character alphanumeric identifiers that always begin with the prefix AKIA. Detecting these in log lines, source code, or configuration strings prevents inadvertent credential exposure.

Features

Regex-based detection using the canonical AKIA[0-9A-Z]{16} pattern.
Word-boundary anchors (\b) reduce false positives from longer strings.
Returns a confidence score of 0.95 — the fixed prefix makes false positives very unlikely.
Resets lastIndex before each scan so the exported function is safe for repeated calls on different inputs.

Usage: Basic Example

import { detect } from '@suaveplan/security-codes/patterns/aws';

const matches = detect('Key: AKIAIOSFODNN7EXAMPLE');
// matches[0].type === 'aws-access-key'
// matches[0].confidence === 0.95

Usage: Advanced Example

import { detect } from '@suaveplan/security-codes/patterns/aws';

const log = 'aws_access_key_id=AKIAIOSFODNN7EXAMPLE aws_secret=abc123';
const matches = detect(log);
console.log(matches[0].start, matches[0].end);
// 20, 40  (covers just the key ID)

API Reference

`detect(input: string): SecurityCodeMatch[]`

Scans input for AWS Access Key IDs.

Parameter	Type	Description
`input`	`string`	The string to scan

Returns an array of SecurityCodeMatch objects. Each match records the matched value, its [start, end) position, and a confidence of 0.95. Returns an empty array when no keys are found.

Implementation Notes

The pattern /\bAKIA[0-9A-Z]{16}\b/g is the standard detection heuristic recommended by AWS and used by tools such as truffleHog and git-secrets. Secret Access Keys (the companion credential) are not detected here because they have no fixed prefix and are better covered by the entropy detector.

1.9 KiB Raw Blame History

aws