Cloud Secrets — AWS - TealTiger Docs

Detect AWS-specific credentials in agent input and output with high-confidence pattern matching. This policy targets the three primary AWS credential types and blocks them at critical and high severity.

Policy JSON

{
  "secrets": {
    "enabled": true,
    "categories": ["cloud_secrets"],
    "patterns": ["aws_access_key", "aws_secret_key", "aws_session_token"],
    "confidence_threshold": 0.9,
    "actions": { "critical": "DENY", "high": "DENY" }
  }
}

policy = {
    "secrets": {
        "enabled": True,
        "categories": ["cloud_secrets"],
        "patterns": ["aws_access_key", "aws_secret_key", "aws_session_token"],
        "confidence_threshold": 0.9,
        "actions": {"critical": "DENY", "high": "DENY"},
    }
}

What It Does

Detects AWS Access Key IDs matching the AKIA* and ASIA* patterns
Detects AWS Secret Access Keys (40-character base64 strings in AWS context)
Detects AWS Session Tokens from STS temporary credentials
High confidence threshold (0.9) reduces false positives on strings that resemble but aren’t AWS credentials
Denies requests containing confirmed AWS credentials

Example

User input:

Here's my AWS config:
aws_access_key_id = AKIAIOSFODNN7EXAMPLE
aws_secret_access_key = wJalrXUtnFEMI/K7MDENG/bPxRfiCYEXAMPLEKEY

Decision object:

{
  "action": "DENY",
  "risk_score": 0.98,
  "reasons": ["cloud_secret_detected"],
  "evidence": {
    "findings": [
      {
        "type": "aws_access_key",
        "confidence": 0.99,
        "severity": "critical",
        "action_taken": "DENY"
      },
      {
        "type": "aws_secret_key",
        "confidence": 0.97,
        "severity": "critical",
        "action_taken": "DENY"
      }
    ]
  }
}

Install

# Install via CLI
tealtiger policy install cloud-secrets-aws

# Or copy the JSON above into your tealtiger.config.json

Customize

Setting	Default	Description
`patterns`	`["aws_access_key", "aws_secret_key", "aws_session_token"]`	AWS credential types to detect. Also available: `aws_mfa_serial`, `aws_account_id`
`confidence_threshold`	`0.9`	Minimum confidence to trigger. Lower for broader detection
`actions.critical`	`DENY`	Action for critical findings
`actions.high`	`DENY`	Action for high findings

For GCP and Azure credential detection, combine this policy with additional patterns: gcp_service_account_key, azure_client_secret, azure_storage_key. A multi-cloud secrets policy is on the roadmap.

API Key Detection — Broader secret detection across all providers
Credential Rotation — 90 Day — Enforce credential freshness
Code Assistant Starter — Full policy set for code-facing agents
TealSecrets Documentation — Full API reference

Getting Started

Core Concepts

Governance Domains

Policy Authoring

Architecture

Integrations

Deployment

API Reference

Cookbook

Compliance & GRC

Guides

Reference

Versions

Playground

Dashboard

Blog

Cloud Secrets — AWS

Policy JSON

What It Does

Example

Install

Customize

​Policy JSON

​What It Does

​Example

​Install

​Customize

​Related

Policy JSON

What It Does

Example

Install

Customize

Related