HighSecrets & credentialsBLWK-CRED-001

A long-lived AWS access key is stored on disk

What this means

Your AWS access key is saved in a plain file (‹path›, ‹long lived keys› key(s)). These keys never expire, so whoever copies the file can use your AWS account, and run up your bill, until you notice. That is exactly what a poisoned Python package did in October 2026: LiteLLM 1.107.0 read these files on every developer machine that installed it.

How to fix it

Sign in to AWS with sessions that expire on their own, instead of a key that works forever.

1. Run aws configure sso once to connect the AWS CLI to IAM Identity Center.
2. Start each work session with aws sso login. The session expires after a few hours.
3. In the AWS console, deactivate and delete the old access key.
4. Remove the key from ‹path›.

Can't use Identity Center? Keep the key in a password manager (1Password, Bitwarden or KeePassXC) and let the AWS CLI fetch it when needed with credential_process.

Check it yourself

Run a scan and look for BLWK-CRED-001 in the results:

bulwark scan

Installed the standalone CLI package instead of the app? The command is bulwarkctl.

How Bulwark decides

Bulwark reads credential_stores and reports this check when:

kind == "aws_credentials" and long_lived_keys > 0

If a value can't be read, Bulwark reports the check as undetermined rather than passing it. View the rule source.

References

• MITRE ATT&CK T1552.001
• MITRE ATT&CK T1078.004

Related checks

• Git stores passwords and tokens in plain text · BLWK-CRED-002
• Docker registry logins are stored in the config file · BLWK-CRED-003
• A credential file can be read by other users · BLWK-CRED-004
• SSH private key is not passphrase-protected · BLWK-SSH-012
• SSH private key passphrase status could not be determined · BLWK-SSH-013
• A secret is exposed in AI assistant context · BLWK-AI-001