AccessKeys are long term credentials designed to authenticate and authorize requests to Alibaba Cloud.
If your application interacts with Alibaba Cloud then it requires AccessKeys to access all the resources it needs to function properly. Resources that can be accessed depend on the permissions granted to the Alibaba Cloud account. These credentials may authenticate to the account root user who has unrestricted access to all resources in your Alibaba Cloud account, including billing information.
This rule flags instances of:
Only administrators should have access to the AccessKeys used by your application.
As a consequence, AccessKeys should not be stored along with the application code as they would grant special privilege to anyone who has access to the application source code.
AccessKeys should be stored outside of the code in a file that is never committed to your application code repository.
If possible, a better alternative is to use your cloud provider’s service for managing secrets. On AlibabaCloud this service is called Secrets Manager.
When credentials are disclosed in the application code, consider them as compromised and revoke them immediately.