diff --git a/README.md b/README.md index 1a08f131c..4a5df5071 100644 --- a/README.md +++ b/README.md @@ -91,6 +91,7 @@ $ git ls-files -z | xargs -0 detect-secrets-hook --baseline .secrets.baseline ```bash $ detect-secrets scan --list-all-plugins +AmazonBedrockApiKeyDetector ArtifactoryDetector AWSKeyDetector AzureStorageKeyDetector diff --git a/detect_secrets/plugins/amazon_bedrock.py b/detect_secrets/plugins/amazon_bedrock.py new file mode 100644 index 000000000..f06ea035c --- /dev/null +++ b/detect_secrets/plugins/amazon_bedrock.py @@ -0,0 +1,18 @@ +""" +This plugin searches for Amazon Bedrock API keys +""" +import re + +from detect_secrets.plugins.base import RegexBasedDetector + +class AmazonBedrockApiKeyDetector(RegexBasedDetector): + """Scans for Amazon Bedrock API keys.""" + secret_type = 'Amazon Bedrock API key' + + denylist = [ + # refs https://docs.aws.amazon.com/bedrock/latest/userguide/api-keys.html + # Long-lived keys begin with ABSK + re.compile(r'(?