AWS credentials are designed to authenticate and authorize requests to AWS.
If your application interacts with AWS then it requires AWS credentials to access all the resources it needs to function properly. Resources that can be accessed depend on the permission granted to the AWS account. These credentials may authenticate to the AWS account root user who has unrestricted access to all resources in your AWS account, including billing information.
This rule flags instances of:
Only administrators should have access to the AWS credentials used by your application.
As a consequence, AWS credentials should not be stored along with the application code as they would grant special privilege to anyone who has access to the application source code.
Credentials should be stored outside of the code in a file that is never committed to your application code repository.
If possible, a better alternative is to use your cloud provider’s service for managing secrets. On AWS this service is called Secrets Manager.
When credentials are disclosed in the application code, consider them as compromised and revoke them immediately.