AccessKeys are long term credentials designed to authenticate and authorize requests to Alibaba Cloud.
If your application interacts with Alibaba Cloud then it requires AccessKeys to access all the resources it needs to function properly. Resourcesthat can be accessed depend on the permissions granted to the Alibaba Cloud account. These credentials may authenticate to the account root user whohas unrestricted access to all resources in your Alibaba Cloud account, including billing information.
This rule flags instances of:
- Alibaba Cloud AccessKey ID
- Alibaba Cloud AccessKey secret
Recommended Secure Coding Practices
Only administrators should have access to the AccessKeys used by your application.
As a consequence, AccessKeys should not be stored along with the application code as they would grant special privilege to anyone who has access tothe application source code.
AccessKeys should be stored outside of the code in a file that is never committed to your application code repository.
If possible, a better alternative is to use your cloud provider’s service for managing secrets. On AlibabaCloud this service is called Secrets Manager.
When credentials are disclosed in the application code, consider them as compromised and revoke them immediately.
See
