3 ms·
I wrote a tool that scans all the new commits to our Org for passwords/secrets. Webhook > AWS API Gateway > Lambda The Lambda uses the new(ish) Layers feature
by 7ewis 8y ago
I wrote a tool that scans all the new commits to our Org for passwords/secrets.
Webhook > AWS API Gateway > Lambda
The Lambda uses the new(ish) Layers feature so it can use Git. I then use the truffleHog[0] library to scan for entropy/regexes inside the commit.
If something is detected, it posts to an SNS topic, which is currently subscribed to by another Lambda that posts an alert to my team and the Security team's Slack channel.
It then calls the GitHub API to make the repo private to limit the exposure.
[0] - https://github.com/dxa4481/truffleHog https://github.com/dxa4481/truffleHog
- semi-extrinsic 8y agoWhy not have a pre-commit hook clientside that runs truffleHog AND if successful generates some form of file indicating it was run, then have a serverside hook checking for that file? This should be doable even with plain Github/etc, no?
- waffleguy 8y agoThat was too simple to think of ;)
- ithkuil 8y agoHow do you install serverside hooks in GitHub?
- waffleguy 8y agoI’m sorry! I didn’t realize my screen name said google
- ithkuil 8y agoI'm sorry! I realized my question sounded as if I was asking instructions about how to do something that was possible but I didn't know how to do it. Rephrasing: What if you use a git server like GitHub that doesn't allow you to install server side hooks?
- pry_or 8y agoI assume you saw the note on truffleHog in the article? The paper found it to be rather inaccurate outside of the basics (mainly AWS keys). Hopefully the authors open source their stuff.