awslabs / awslabs/git-secrets

--register-aws does not detect AWS Bedrock API credentials — users get false sense of security

Open
#278 0 comments 0 reactions 0 assignees View on GitHub
Dominant language
Shell
Stars
13.4k
Forks
1.3k
PR merge metrics
No merged PRs in 30d

Description

## Bug description

`git-secrets --register-aws` registers patterns for classic AWS credential types (AKIA, ASIA, AGPA, etc.) but does not cover **AWS Bedrock API keys**, which use a distinct short-lived credential format.

A developer using Bedrock who runs `git-secrets --register-aws` will see no warnings when committing Bedrock credentials, creating a false sense of security.

PR #271 (open since October 2025) attempts to add a Bedrock pattern but has not been merged. This issue documents the gap so it is tracked independently of that PR.

## To reproduce

1. Install git-secrets and run `git-secrets --register-aws`
2. Create a file containing a Bedrock short-lived credential
3. Attempt to commit — git-secrets does not block it

## Expected behavior

`--register-aws` should cover all active AWS credential types, including Bedrock API keys, or the documentation should explicitly state which credential types are **not** covered so users know to add patterns manually.

## Environment

- git-secrets version: latest (master)
- OS: Linux / macOS

## References

- PR #271 adds a partial fix but has been awaiting review since October 2025

Contributor guide

Open the contributing guide

Research direction

Start at the --register-aws entry point and inspect PR #271 to understand the existing Bedrock pattern attempt. Reproduce the missing warning with a Bedrock short-lived credential, then verify that the chosen fix detects it or that the documentation clearly states the unsupported credential types.

Written by the indexing model from the issue text.

Assessment

Tech stack
aws, shell
Domain
cli, security
Issue type
Bug
Difficulty
3/5
Estimated time
1-2 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
35/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.