Preventing unauth'd credential access on GitHub using AWS services
summary
GitHub and AWS build a pre-commit scanning service that uses a tuned regex to detect leaked AWS keys and blocks commits before they reach the backend; the platform finds millions of tokens yearly and one live demo showed a leaked token picked up by 17 actors within 10 minutes costing about $150. The flow uses AWS Secrets Manager with KMS and rotation (Lambda/RDS), OIDC-based GitHub Actions to assume IAM roles, CloudTrail auditing, and secret push protections that quarantine and trigger remediation.
AI-written summary · about
chapters (6)
- 0:00Introduction to secrets management
- 3:39AWS and GitHub collaboration
- 8:01AWS Secrets Manager overview
- 10:08Secret push protections
- 11:33Live demo walkthrough
- 15:46Key takeaways and closing
related talks
56mHow to use GitHub Actions with Security in mind
39mApisecure, 14 & 15 March 2023 - Jose Palafox, Director of Business Development at GitHub.
33mGaining initial access by exploiting leaked credentials
01h 02mDeveloping secure software with GitHub
49mProtect Your Code with GitHub Security Features
24mHow to Find if Your Developers are Leaking Secrets?
20mApplication Secret Management with AWS KMS
42mProtecting CI/CD from malicious deploys