critical
aws-access-key-id· AWSAWS access key ID
Identifies an IAM principal. Paired with its secret, it grants that principal’s permissions.
How it is detected
Matches the `AKIA` and `ASIA` prefixes. `ASIA` is a temporary STS credential and expires on its own, so it is reported one level lower. The documented example key from the AWS guides is excluded by name.
If you find one
- 1Deactivate the access key in IAM, then delete it once nothing is broken.
- 2Read CloudTrail for the period the key was public. This is the one provider where you can find out exactly what was done.
- 3Replace long-lived keys with a role, and issue presigned URLs from a server route instead of shipping credentials.
Where it turns up
Most often in S3 upload widgets built without a presigned-URL endpoint.