aws-datapipeline-definition-contains-secret
Explicit extraction: pipeline definition contains plaintext credential material in activity fields.
match (record)
{
"field": "pipelineObjects[type=ShellCommandActivity].fields[id=command or id=scriptArgument or id=env]",
"resource_type": "AWS::DataPipeline::Pipeline"
}
emit
| source type | Messaging |
|---|---|
| target type | Secret |
| source | <pipeline Workflow node> |
| target | <Secret or Credential node> |
Narrative
Pipeline {pipeline.name}'s definition contains plaintext credential material in activity command/argument fields, visible to any principal with datapipeline:GetPipelineDefinition.
Raw rule rules/explicit/aws-datapipeline.yaml
id: aws-datapipeline-definition-contains-secret
emits: ContainsSecret
description: 'Explicit extraction: pipeline definition contains plaintext credential material in activity
fields.'
match_record:
resource_type: AWS::DataPipeline::Pipeline
field: pipelineObjects[type=ShellCommandActivity].fields[id=command or id=scriptArgument or id=env]
emit:
source_type: Messaging
target_type: Secret
source: <pipeline Workflow node>
target: <Secret or Credential node>
api_source: datapipeline:GetPipelineDefinition
evidence_field: pipelineObjects[type=ShellCommandActivity].fields[id=command|scriptArgument|env].stringValue
note: Emit when a plaintext environment variable, command argument, or script argument pattern-matches
credential material (AWS access key ID pattern, password regex, API key token pattern). Visible to
any principal with datapipeline:GetPipelineDefinition.
narrative: Pipeline {pipeline.name}'s definition contains plaintext credential material in activity
command/argument fields, visible to any principal with datapipeline:GetPipelineDefinition.