Allow disabling of ACCESS_KEY_IDs from aws-provider
- Dominant language
- Shell
- Stars
- 13.4k
- Forks
- 1.3k
- PR merge metrics
- No merged PRs in 30d
Description
This is a bit of a philosophical issue, and I'd like to hear feedback from the maintainers about this.
I'd like to add an option to disable reporting ACCESS_KEY_IDs in the output of `git secrets --aws-provider`, and `git secrets --register-aws`. Something like `--ignore-access-keys`.
The argument for this is that access ids aren't secret information in the AWS control panel; they're available to anyone with the `iam:ListAccessKeys`, they're used as a parameter for API various API calls, and they're able to be searched for in the IAM dashboard. This leads me to think of them more like usernames than secrets. It's also very useful to have them available when debugging access issues.
What're your thoughts on this? Are we doing something horribly wrong by allowing plaintext access keys, or should git-secrets support only searching for secret access keys? Would it be reasonable to consider making this a default behavior?
Contributor guide
Assessment
This issue has not been assessed yet.