redact-secret · Report
STS service bearer token
AWS STS service-issued bearer credential, prefixed ABIA.
Documented in the same IAM unique-identifier prefix table as AKIA/ASIA; not matched by the AKIA-only pattern.
Research record
From credential-evidence snapshot-2026.10.06.4 · records at 77ce761 · schema 1.8.0. It describes the research on the format, not what any scanner or the product does, and not a support status.
2 events in the review history: 1 observed, 1 reviewed. Latest: observed on 2026-09-29 by automation, project maintainer. Project-maintained review is not independent validation. The family record at this release.
Format
Provider format research from credential-evidence snapshot-2026.10.06.4 · records at 77ce761 · schema 1.8.0.
What it looks like
Shape not recorded.
Format facts
Unresolved ·
dossier-research· current · observed 2026-09-29Legacy dossier research (verdict rejected, tier none) cited 9 sources; the dossier does not attribute sources to individual properties.
- docs.aws.amazon.com/IAM/latest/UserGuide/reference_identifiers.htmlprovider-documentation · last read 2026-10-04 · latest outcome unchanged · supports Cited by the legacy dossier research for this family · #identifiers-prefixes
- docs.aws.amazon.com/codeartifact/latest/APIReference/API_GetAuthorizationToken.htmlprovider-documentation · last read 2026-09-29 · latest outcome read · supports Cited by the legacy dossier research for this family
- docs.aws.amazon.com/IAM/latest/UserGuide/id_credentials_bearer.htmlprovider-documentation · last read 2026-09-29 · latest outcome read · supports Cited by the legacy dossier research for this family
- docs.aws.amazon.com/codeartifact/latest/ug/tokens-authentication.htmlprovider-documentation · last read 2026-09-29 · latest outcome read · supports Cited by the legacy dossier research for this family
- BishopFox/jsluice @ 0ddfab153e060a9eeaded4d8669233f7c071e7e4: secret-aws.goother · last read 2026-09-29 · latest outcome read · supports Cited by the legacy dossier research for this family
- gitleaks/gitleaks @ b58d3f102cf3a2c84cb7f923d05c25c9b1aed84b: cmd/generate/config/rules/aws.goscanner-rule-source · last read 2026-09-29 · latest outcome read · supports Cited by the legacy dossier research for this family
- hashicorp/aws-sdk-go-base @ 41fc7e1b09a140821eb9cbe6889bb53072a0da2e: logging/aws.goother · last read 2026-09-29 · latest outcome read · supports Cited by the legacy dossier research for this family
- redact-secret/redact-secret @ 378581770a87751d72e27529796c4f790649fd00: docs/audits/evidence/1012/aws-other-iam-prefixes.mdproject-research-note · last read 2026-09-29 · latest outcome read · supports Final research evidence recorded by the legacy dossier
- trufflesecurity/trufflehog @ 48b58d3bf3f02ba17bf23b87f095499bc80c6fd7: pkg/detectors/aws/access_keys/accesskey.goother · last read 2026-09-29 · latest outcome read · supports Cited by the legacy dossier research for this family
Unresolved ·
taxonomy-sources· current · observed 2026-09-29The legacy taxonomy lists 1 source for this family. The taxonomy records no date; the dossier researchedAt is used as the observed-at date.
- docs.aws.amazon.com/IAM/latest/UserGuide/reference_identifiers.htmlprovider-documentation · last read 2026-10-04 · latest outcome unchanged · supports Listed as a source for this family in the legacy taxonomy · #identifiers-prefixes
Open questions
No open question is recorded for this revision.
Benchmark dossier notes
From the provider dossier, as written. The evidence level above says how well the format is backed; a fact the dossier does not record is not shown.
- Shape
- AWS documents that the access key ID inside an STS service bearer token starts with ABIA. It says nothing about the bearer token string itself.
- Contract in core
- none;
ABIAandACCAare identifiers and stay unclaimed (detector-families.md).
In this benchmark
Fixture rows on the current run. Counts are for redact-secret in published · redact-secret 0.1.0-beta.14 mode.
No fixtures in this family yet
Nothing in the corpus targets it, so nothing is measured and no coverage is claimed.
Not measured
Scanner rules for this family
Mapped by hand (reviewed 2026-09-30) from each scanner's pinned rule file, never from what a scanner found on the fixtures.
| Scanner | Rule | What the rule matches |
|---|---|---|
| gitleaks · rules 8.30.1 | aws-access-token | AKIA, ASIA, ABIA or ACCA + 16 characters |
| trufflehog · rules 3.97.4 | aws/access_keys | AKIA, ABIA or ACCA id, reported with its paired secret |
No rule maps to this family in flare-redact, openredaction.
No fixtures in this family yet
Nothing in the corpus targets it, so nothing is measured and no coverage is claimed.
Not measured
Sources
Researched 2026-09-29.
Documentation and code
- docs.aws.amazon.com/IAM/latest/UserGuide/reference_identifiers.html#identifiers-prefixes
- docs.aws.amazon.com/IAM/latest/UserGuide/id_credentials_bearer.html
- docs.aws.amazon.com/codeartifact/latest/ug/tokens-authentication.html
- docs.aws.amazon.com/codeartifact/latest/APIReference/API_GetAuthorizationToken.html
- github.com/gitleaks/gitleaks/blob/b58d3f102cf3a2c84cb7f923d05c25c9b1aed84b/cmd/generate/config/rules/aws.go
- github.com/trufflesecurity/trufflehog/blob/48b58d3bf3f02ba17bf23b87f095499bc80c6fd7/pkg/detectors/aws/access_keys/accesskey.go
- github.com/hashicorp/aws-sdk-go-base/blob/41fc7e1b09a140821eb9cbe6889bb53072a0da2e/logging/aws.go
- github.com/BishopFox/jsluice/blob/0ddfab153e060a9eeaded4d8669233f7c071e7e4/secret-aws.go
Research log
- redact-secret/redact-secret-benchmarks#473Research issue
- redact-secret/redact-secret#1012Research issue
- Final evidence, pinned to a commit/redact-secret/redact-secret/blob/378581770a87751d72e27529796c4f790649fd00/docs/audits/evidence/1012/aws-other-iam-prefixes.md