rules:
- id: aws-lambda-environment-credentials
  patterns:
  - pattern-inside: |
      resource "$ANYTING" $ANYTHING {
        ...
        environment {
          variables = {
            ...
          }
        }
        ...
      }
  - pattern-either:
    - pattern-inside: |
        AWS_ACCESS_KEY_ID = "$Y"
    - pattern-regex: |
        (?<![A-Z0-9])[A-Z0-9]{20}(?![A-Z0-9])
    - pattern-inside: |
        AWS_SECRET_ACCESS_KEY = "$Y"
    - pattern-regex: |
        (?<![A-Za-z0-9/+=])[A-Za-z0-9/+=]{40}(?![A-Za-z0-9/+=])
  - focus-metavariable: $Y
  message: >-
    A hard-coded credential was detected. It is not recommended to store credentials in source-code,
    as this risks secrets
    being leaked and used by either an internal or external malicious adversary. It is recommended to
    use environment variables to securely provide credentials or retrieve credentials from a secure
    vault or HSM (Hardware Security Module).
  metadata:
    category: security
    references:
    - https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html
    owasp:
    - A03:2017 - Sensitive Data Exposure
    - A02:2021 - Cryptographic Failures
    cwe:
    - 'CWE-326: Inadequate Encryption Strength'
    technology:
    - aws
    - terraform
    - secrets
    subcategory:
    - vuln
    likelihood: LOW
    impact: HIGH
    confidence: MEDIUM
  languages: [hcl]
  severity: ERROR