detecting-aws-credential-exposure-with-trufflehog

name	detecting-aws-credential-exposure-with-trufflehog
description	Detecting exposed AWS credentials in source code repositories, CI/CD pipelines, and configuration files using TruffleHog, git-secrets, and AWS-native detection mechanisms to prevent credential theft and unauthorized account access. . Use when working with detecting aws credential exposure with trufflehog.
domain	cybersecurity
tags	["cloud-security","aws","credential-exposure","trufflehog","secrets-detection","devsecops"]
subdomain	cloud-security
version	1.0
author	oyi77
license	Apache-2.0
nist_csf	["PR.IR-01","ID.AM-08","GV.SC-06","DE.CM-01"]

Detecting Aws Credential Exposure With Trufflehog

Overview

Cybersecurity skill for detecting aws credential exposure with trufflehog. Follows industry best practices and security standards.

When to Use

Trigger phrases:

• "detecting aws credential exposure with trufflehog"

• "Detecting exposed AWS credentials in source code repositories, CI/CD pipelines, "

• When integrating secrets detection into CI/CD pipelines to prevent credential commits reaching production

• When performing a security audit of existing repositories for historically committed AWS credentials

• When responding to an AWS GuardDuty alert about credential usage from an unexpected IP or region

• When onboarding repositories from acquired companies or third-party vendors

• When validating that credential rotation processes have removed all references to old access keys

Do not use for real-time credential monitoring (use AWS GuardDuty or Amazon Macie), for managing secrets (use AWS Secrets Manager or HashiCorp Vault), or for detecting non-credential sensitive data like PII (use Amazon Macie or DLP tools).

When NOT to Use

• When you lack proper authorization for testing
• For production systems without change management
• When the task requires legal or compliance expertise beyond technical scope

Prerequisites

• TruffleHog v3 installed (brew install trufflehog or pip install trufflehog)
• git-secrets installed for pre-commit hook integration (brew install git-secrets)
• Access to source code repositories (GitHub, GitLab, Bitbucket, or local git repos)
• AWS CLI configured with permissions to check key status (iam:ListAccessKeys, iam:GetAccessKeyLastUsed)
• GitHub or GitLab API token for scanning organization-wide repositories

Workflow

# Example: IOC detection
import re

IOC_PATTERNS = {
    "ip": r"\b(?:\d{1,3}\.){3}\d{1,3}\b",
    "domain": r"\b[a-z0-9-]+\.[a-z]{2,}\b",
    "hash_md5": r"\b[a-f0-9]{32}\b",
    : ,
}

 () -> :
     {k: re.findall(v, text)  k, v  IOC_PATTERNS.items()}