--register-aws does not detect AWS Bedrock API credentials — users get false sense of security
- Dominant language
- Shell
- Stars
- 13.4k
- Forks
- 1.3k
- PR merge metrics
- No merged PRs in 30d
Description
## Bug description
`git-secrets --register-aws` registers patterns for classic AWS credential types (AKIA, ASIA, AGPA, etc.) but does not cover **AWS Bedrock API keys**, which use a distinct short-lived credential format.
A developer using Bedrock who runs `git-secrets --register-aws` will see no warnings when committing Bedrock credentials, creating a false sense of security.
PR #271 (open since October 2025) attempts to add a Bedrock pattern but has not been merged. This issue documents the gap so it is tracked independently of that PR.
## To reproduce
1. Install git-secrets and run `git-secrets --register-aws`
2. Create a file containing a Bedrock short-lived credential
3. Attempt to commit — git-secrets does not block it
## Expected behavior
`--register-aws` should cover all active AWS credential types, including Bedrock API keys, or the documentation should explicitly state which credential types are **not** covered so users know to add patterns manually.
## Environment
- git-secrets version: latest (master)
- OS: Linux / macOS
## References
- PR #271 adds a partial fix but has been awaiting review since October 2025
Contributor guide
Research direction
Start at the --register-aws entry point and inspect PR #271 to understand the existing Bedrock pattern attempt. Reproduce the missing warning with a Bedrock short-lived credential, then verify that the chosen fix detects it or that the documentation clearly states the unsupported credential types.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- aws, shell
- Domain
- cli, security
- Issue type
- Bug
- Difficulty
- 3/5
- Estimated time
- 1-2 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 35/100