aws-beanstalk-config-secrets
Environment option settings / environment properties often store plaintext secrets readable via DescribeConfigurationSettings.
match (effective permission)
{
"action": "elasticbeanstalk:DescribeConfigurationSettings",
"resource_type": "AWS::ElasticBeanstalk::Environment"
}
where
environment properties / option settings contain plaintext credential material (DB passwords,
API keys)
emit
| source | <Elastic Beanstalk environment> |
|---|---|
| target | <credential material in environment properties> |
| conditions | iam_permission |
| state logic | CONDITIONAL(iam_permission) -- becomes ACTIVE only when environment properties actually contain credential material; low confidence recon-grade edge. |
Narrative
{environment.name} may expose plaintext credentials stored in its environment properties (elasticbeanstalk:DescribeConfigurationSettings).
Raw rule rules/derived/aws/beanstalk.yaml
id: aws-beanstalk-config-secrets
emits: ExposesCredential
description: Environment option settings / environment properties often store plaintext secrets readable
via DescribeConfigurationSettings.
match_effective_permission:
action: elasticbeanstalk:DescribeConfigurationSettings
resource_type: AWS::ElasticBeanstalk::Environment
where:
- environment properties / option settings contain plaintext credential material (DB passwords, API keys)
emit:
source: <Elastic Beanstalk environment>
target: <credential material in environment properties>
state_logic: CONDITIONAL(iam_permission) -- becomes ACTIVE only when environment properties actually
contain credential material; low confidence recon-grade edge.
conditions:
- iam_permission
false_positive_note: DescribeConfigurationSettings is recon; most environment properties are not secrets.
Only emit when a value pattern-matches credential material. RequestEnvironmentInfo/RetrieveEnvironmentInfo
log bundling is a related recon-grade exposure path.
narrative: '{environment.name} may expose plaintext credentials stored in its environment properties
(elasticbeanstalk:DescribeConfigurationSettings).'