detecting-aws-credential-exposure-with-trufflehog

name	detecting-aws-credential-exposure-with-trufflehog
description	Scan source code repositories, CI/CD pipelines, and configuration files for exposed AWS credentials using TruffleHog, git-secrets, and AWS-native detection. Use when integrating secrets scanning into CI/CD, auditing repositories (including git history) for historically committed AWS keys, responding to a GuardDuty alert about credential use from an unexpected location, or verifying credential rotation removed all exposed keys.
domain	cybersecurity
subdomain	cloud-security
tags	["cloud-security","aws","credential-exposure","trufflehog","secrets-detection","devsecops"]
version	1.0
author	mahipal
license	Apache-2.0
nist_csf	["PR.IR-01","ID.AM-08","GV.SC-06","DE.CM-01"]
mitre_attack	["T1552.001","T1552","T1078.004","T1589.001"]
mitre_f3	{"version":"1.1","tactics":["reconnaissance","initial-access"],"techniques":[{"id":"T1593","name":"Search Open Websites/Domains","tactic":"reconnaissance","source":"attack"},{"id":"F1006","name":"Account Takeover","tactic":"initial-access","source":"f3"},{"id":"F1006.001","name":"Account Takeover: Exposed API Key","tactic":"initial-access","source":"f3"},{"id":"F1006.002","name":"Account Takeover: Exposed Login Credential","tactic":"initial-access","source":"f3"},{"id":"T1550.001","name":"Use Alternate Authentication Material: Application Access Token","tactic":"initial-access","source":"attack"}]}

Detecting AWS Credential Exposure with TruffleHog

When to Use

• When integrating secrets detection into CI/CD pipelines to prevent credential commits reaching production
• When performing a security audit of existing repositories for historically committed AWS credentials
• When responding to an AWS GuardDuty alert about credential usage from an unexpected IP or region
• When onboarding repositories from acquired companies or third-party vendors
• When validating that credential rotation processes have removed all references to old access keys

Do not use for real-time credential monitoring (use AWS GuardDuty or Amazon Macie), for managing secrets (use AWS Secrets Manager or HashiCorp Vault), or for detecting non-credential sensitive data like PII (use Amazon Macie or DLP tools).

Prerequisites

• TruffleHog v3 installed (brew install trufflehog or pip install trufflehog)
• git-secrets installed for pre-commit hook integration (brew install git-secrets)
• Access to source code repositories (GitHub, GitLab, Bitbucket, or local git repos)
• AWS CLI configured with permissions to check key status (iam:ListAccessKeys, iam:GetAccessKeyLastUsed)
• GitHub or GitLab API token for scanning organization-wide repositories

Workflow

Step 1: Install and Configure TruffleHog

Install TruffleHog v3 and verify it can detect the AWS credential patterns.

# Install TruffleHog v3
pip install trufflehog

# Or install from binary release
curl -sSfL https://raw.githubusercontent.com/trufflesecurity/trufflehog/main/scripts/install.sh | sh -s -- -b /usr/local/bin

# Verify installation
trufflehog --version

# Test with a known test repository
trufflehog git https://github.com/trufflesecurity/test_keys --only-verified

Step 2: Scan Git Repositories for Exposed Credentials

Scan entire git history including all branches and commits for AWS access keys, secret keys, and session tokens.

# Scan a local git repository (full history)
trufflehog git file:///path/to/repo --only-verified --json > trufflehog-results.json

# Scan a GitHub organization's repositories
trufflehog github --org=your-organization --token=$GITHUB_TOKEN --only-verified


trufflehog git https://github.com/org/repo.git --only-verified --branch=main


trufflehog gitlab --group=your-group --token= --only-verified


trufflehog filesystem /path/to/project --only-verified