redact-secret · Report
Long-term API key (ABSK)
ABSK-prefixed standard-Base64 key for an IAM service-specific credential; its decoded form is BedrockAPIKey-<user>-at-<account>:<secret>.
Registry detector aws-bedrock-long-term-api-key since redact-secret#864 (registry pinned at cfe2aec); graduated from a Beta.10 arrival family (#384, research #778), contract in benchmarks/lib/beta8/384b.ts. T1 by maintainer ruling of 2026-09-27 (redact-secret#778): the ABSK prefix and standard-Base64 alphabet, from the AWS Security Blog scan pattern; lengths stay T2. Not the short-term key, the public IAM alias or an access key id.
Research record
From credential-evidence snapshot-2026.10.06.4 · records at 77ce761 · schema 1.8.0. It describes the research on the format, not what any scanner or the product does, and not a support status.
3 events in the review history: 2 observed, 1 reviewed. Latest: observed on 2026-09-27 by automation, project maintainer. Project-maintained review is not independent validation. The family record at this release.
Format
Provider format research from credential-evidence snapshot-2026.10.06.4 · records at 77ce761 · schema 1.8.0.
What it looks like
- Descriptive pattern
^ABSKQmVkcm9ja0FQSUtleS[A-Za-z0-9+/]+={0,2}$
Parts are shown as recorded. Evidence classes belong to the facts below; no class is assigned to a part.
Format facts
Provider documented ·
provider-source· current · observed 2026-09-26AWS Security Blog detection pattern for long-term keys (ABSKQmVkcm9ja0FQSUtleS[A-Za-z0-9+/]+={0,2}): AWS's own security blog prints a scan pattern for the long-term key: the ABSK prefix, a fixed head that is the Base64 of BedrockAPIKey-, and a standard-Base64 body with up to two = pad characters. A provider blog is not a format specification; the maintainer ruling of 2026-09-27 (redact-secret#778) accepts it as T1 evidence for the ABSK prefix and the standard-Base64 alphabet only. Lengths and IAM user-name variants stay T2
- aws.amazon.com/blogs/security/securing-amazon-bedrock-api-keys-best-practices-for-implementation-and-management/provider-documentation · last read 2026-09-29 · latest outcome read · supports AWS's own security blog prints a scan pattern for the long-term key: the ABSK prefix, a fixed head that is the Base64 of BedrockAPIKey-, and a standard-Base64 body with up to two = pad characters. A provider blog is not a format specification; the maintainer ruling of 2026-09-27 (redact-secret#778) accepts it as T1 evidence for the ABSK prefix and the standard-Base64 alphabet only. Lengths and IAM user-name variants stay T2
Tool corroborated ·
tool-corroboration· current · observed 2026-09-26Pinned scanner rules are consistent with the contract grammar (3 artifacts: Wiz measurement; awslabs/git-secrets; gitleaks 8.30.1).
- github.com/awslabs/git-secrets/pull/264provider-documentation · last read 2026-09-26 · latest outcome read · supports awslabs/git-secrets: ABSK[A-Za-z0-9+/]{109,}=*
- gitleaks/gitleaks @ v8.30.1: config/gitleaks.tomlscanner-rule-source · last read 2026-10-04 · latest outcome read · supports gitleaks 8.30.1: gitleaks.toml
- www.wiz.io/blog/a-new-type-of-long-lived-key-on-aws-bedrock-api-keysprovider-documentation · last read 2026-09-26 · latest outcome read · supports Wiz measurement: 132 characters, ABSK + Base64
Provider documented ·
field-prefix· current · observed 2026-09-26prefix: ABSK (Provider blog, not a specification page; accepted as T1 evidence for this field by the maintainer ruling of 2026-09-27 (redact-secret#778).)
- aws.amazon.com/blogs/security/securing-amazon-bedrock-api-keys-best-practices-for-implementation-and-management/provider-documentation · last read 2026-09-29 · latest outcome read · supports detection pattern for long-term keys
Provider documented ·
field-console-head· current · observed 2026-09-26console-head: QmVkcm9ja0FQSUtleS (Base64 of BedrockAPIKey-) follows ABSK for console-created keys (Holds only when the IAM user name starts BedrockAPIKey-. Positives carry it; nothing asserts silence on its absence.)
- aws.amazon.com/blogs/security/securing-amazon-bedrock-api-keys-best-practices-for-implementation-and-management/provider-documentation · last read 2026-09-29 · latest outcome read · supports console-head: QmVkcm9ja0FQSUtleS (Base64 of BedrockAPIKey-) follows ABSK for console-created keys
- www.wiz.io/blog/a-new-type-of-long-lived-key-on-aws-bedrock-api-keysprovider-documentation · last read 2026-09-26 · latest outcome read · supports decodes to BedrockAPIKey-<4 chars>[+1]-at-<12-digit account>:<secret>
Provider documented ·
field-body-alphabet· current · observed 2026-09-26body-alphabet: standard Base64 ([A-Za-z0-9+/], up to two trailing =) (No source documents a URL-safe variant.)
- aws.amazon.com/blogs/security/securing-amazon-bedrock-api-keys-best-practices-for-implementation-and-management/provider-documentation · last read 2026-09-29 · latest outcome read · supports body-alphabet: standard Base64 ([A-Za-z0-9+/], up to two trailing =)
- github.com/awslabs/git-secrets/pull/264provider-documentation · last read 2026-09-26 · latest outcome read · supports body-alphabet: standard Base64 ([A-Za-z0-9+/], up to two trailing =)
Tool corroborated ·
field-total-length· current · observed 2026-09-26total-length: 132 characters for a console key, and 136 by layout arithmetic for a +1 secondary key; tools tolerate 113..273 (No length or ceiling twin is authored; positives use 132 and 136.)
- github.com/awslabs/git-secrets/pull/264provider-documentation · last read 2026-09-26 · latest outcome read · supports {109,}
- gitleaks/gitleaks @ v8.30.1: config/gitleaks.tomlscanner-rule-source · last read 2026-10-04 · latest outcome read · supports {109,269} after ABSK
- www.wiz.io/blog/a-new-type-of-long-lived-key-on-aws-bedrock-api-keysprovider-documentation · last read 2026-09-26 · latest outcome read · supports 132
Unresolved ·
field-decoded-structure· current · observed 2026-09-26decoded-structure: BedrockAPIKey-<user>[+1]-at-<12-digit account>:<44 random bytes as Base64> (Wiz notes the structure is subject to change; positives are built from this layout with a zero account and synthetic bytes.)
- docs.aws.amazon.com/IAM/latest/APIReference/API_ServiceSpecificCredential.htmlprovider-documentation · last read 2026-09-29 · latest outcome read · supports ServiceCredentialAlias is the public portion: the IAM user name plus a version and creation suffix
- www.wiz.io/blog/a-new-type-of-long-lived-key-on-aws-bedrock-api-keysprovider-documentation · last read 2026-09-26 · latest outcome read · supports decoded-structure: BedrockAPIKey-<user>[+1]-at-<12-digit account>:<44 random bytes as Base64>
Provider documented ·
field-transport· current · observed 2026-09-26transport: AWS_BEARER_TOKEN_BEDROCK environment variable or Authorization: Bearer
- docs.aws.amazon.com/bedrock/latest/userguide/api-keys-use.htmlprovider-documentation · last read 2026-09-26 · latest outcome read · supports transport: AWS_BEARER_TOKEN_BEDROCK environment variable or Authorization: Bearer
Provider documented ·
field-public-alias· current · observed 2026-09-26public-alias: the decoded BedrockAPIKey-<user>-at-<account> alias is a public identifier (Backs the alias controls; the secret part after the colon is never a control.)
- docs.aws.amazon.com/IAM/latest/APIReference/API_ServiceSpecificCredential.htmlprovider-documentation · last read 2026-09-29 · latest outcome read · supports public-alias: the decoded BedrockAPIKey-<user>-at-<account> alias is a public identifier
Unresolved ·
listed-references· current · observed 2026-09-26The legacy contract lists 6 references without stating which property each supports.
- docs.aws.amazon.com/IAM/latest/APIReference/API_ServiceSpecificCredential.htmlprovider-documentation · last read 2026-09-29 · latest outcome read · supports Listed as a reference by the legacy contract
- docs.aws.amazon.com/bedrock/latest/userguide/api-keys-reference.htmlprovider-documentation · last read 2026-09-27 · latest outcome read · supports Listed as a reference by the legacy contract
- docs.aws.amazon.com/bedrock/latest/userguide/api-keys-use.htmlprovider-documentation · last read 2026-09-26 · latest outcome read · supports Listed as a reference by the legacy contract
- github.com/gitleaks/gitleaks/pull/1935issue-or-discussion · last read 2026-09-26 · latest outcome read · supports Listed as a reference by the legacy contract
- github.com/redact-secret/redact-secret/issues/778issue-or-discussion · last read 2026-09-26 · latest outcome read · supports Listed as a reference by the legacy contract
- github.com/redact-secret/redact-secret/issues/864issue-or-discussion · last read 2026-09-26 · latest outcome read · supports Listed as a reference by the legacy contract
Provider documented ·
dossier-research· current · observed 2026-09-27Legacy dossier research (verdict ready, tier T1) cited 4 sources; the dossier does not attribute sources to individual properties.
- aws.amazon.com/blogs/security/securing-amazon-bedrock-api-keys-best-practices-for-implementation-and-management/provider-documentation · last read 2026-09-29 · latest outcome read · supports Cited by the legacy dossier research for this family
- docs.aws.amazon.com/IAM/latest/APIReference/API_ServiceSpecificCredential.htmlprovider-documentation · last read 2026-09-29 · latest outcome read · supports Cited by the legacy dossier research for this family
- docs.aws.amazon.com/bedrock/latest/userguide/api-keys-reference.htmlprovider-documentation · last read 2026-09-27 · latest outcome read · supports Cited by the legacy dossier research for this family
- redact-secret/redact-secret @ 8b6a5fde52ecb4dfce13f09c7a947062d21483c7: docs/audits/evidence/864/README.mdproject-research-note · last read 2026-09-27 · latest outcome read · supports Final research evidence recorded by the legacy dossier
Provider documented ·
taxonomy-sources· current · observed 2026-09-27The legacy taxonomy lists 2 sources for this family. The taxonomy records no date; the dossier researchedAt is used as the observed-at date.
- aws.amazon.com/blogs/security/securing-amazon-bedrock-api-keys-best-practices-for-implementation-and-management/provider-documentation · last read 2026-09-29 · latest outcome read · supports Listed as a source for this family in the legacy taxonomy
- docs.aws.amazon.com/bedrock/latest/userguide/api-keys-reference.htmlprovider-documentation · last read 2026-09-27 · latest outcome read · supports Listed as a source for this family in the legacy taxonomy
Open questions
No open question is recorded for this revision.
Benchmark dossier notes
From the provider dossier, as written. The evidence level above says how well the format is backed; a fact the dossier does not record is not shown.
- Shape
- prefix
ABSKfollowed by standard Base64 (+,/, up to two=), not URL-safe. The decoded form isBedrockAPIKey-<user>-at-<account>:<secret>. Wiz measured 132 characters for a primary key; a+1secondary key or a longer user name gives more. The 109 to 269 band in the git-secrets and gitleaks rules is the scanner authors' tolerance, not provider-stated. - Basis
- T1 for prefix and alphabet, from the AWS Security Blog (2025-10-17) scan pattern, accepted by ruling. The IAM API reference supports the public alias versus secret split only. Length is T2 (Wiz measurement, scanner tolerance). Only betterleaks, a gitleaks port, was found to carry the shape among the other scanners checked.
- Issuance
- not attempted. Console (Bedrock, API keys, long-term) or
aws iam create-service-specific-credential; shown once; maximum two keys per IAM user. The #778 checklist covers length, padding and decoded head. - Contract in core
- detector-families.md; final evidence in the #864 record linked in the frontmatter.
In this benchmark
Fixture rows on the current run. Counts are for redact-secret in published · redact-secret 0.1.0-beta.14 mode.
- Fixtures
- 44
- Left readable
- 0
- Redacted too much
- 0
- False alarms
- 0
44 fixtures: 18 expect a redaction, 26 must stay quiet. See every row
| Evidence level | Fixtures | Left readable | Too much | False alarms |
|---|---|---|---|---|
| T1Provider-documented | 18 | 0 | 0 | 0 |
| T2Tool-corroborated | 17 | 0 | 0 | 0 |
| T3Project policy | 9 | 0 | 0 | 0 |
Every scanner on the same fixtures
In run order. Counts are what each scanner recorded on this family's fixtures, whichever rules it has; a scanner with no rule for the family has nothing to report on it.
| Scanner | Fixtures | Left readable | Too much | False alarms |
|---|---|---|---|---|
| flare-redactRuntime library · 1.6.1 · Published npm package · secrets-only (pii, generic_assignment disabled) · JavaScript engineNo rule maps to it | 44 | 15 | 3 | 0 |
| gitleaksRepository scanner · 8.30.1 · Directory scan · default rules1 rule targets it | 44 | 0 | 0 | 4 |
| redact-secretProduct measured here · 0.1.0-beta.14 · Published npm package · default detectors1 detector mapped | 44 | 0 | 0 | 0 |
| trufflehogRepository scanner · 3.97.4 · Filesystem scan · verification disabledNo rule maps to it | 44 | 18 | 0 | 0 |
Benchmark dossier questions
Things the sources do not settle. They are listed so nobody reads them as settled.
- Open caveat
- T1 covers the ABSK prefix and Base64 alphabet only; total length (132, or 136 for a secondary key) and non-default IAM user names are T2. Needs issued keys (checklist in #778).
Looks like it, but isn't
Values the dossier records as resembling this credential without being one.
- Collisions
- distinct from
AKIA/ASIAaccess key ids and from the public credential alias. GitGuardian's page says "Not prefixed", which contradicts the blog. A scanner-author claim that GitHub secret scanning covers it is contradicted by GitHub's own pattern page.
Scanner rules for this family
Mapped by hand (reviewed 2026-09-30) from each scanner's pinned rule file, never from what a scanner found on the fixtures.
| Scanner | Rule | What the rule matches |
|---|---|---|
| gitleaks · rules 8.30.1 | aws-amazon-bedrock-api-key-long-lived | ABSK + 109-269 Base64 characters |
No rule maps to this family in flare-redact, openredaction, trufflehog.
Fixtures in this family
44 rows, redact-secret's outcome on each. Rows that need a look come first (0), then the rest in corpus order. Choose "Every scanner" to see each scanner's outcome for the same rows.
| Fixture | Kind and evidence | redact-secret |
|---|---|---|
aws-bedrock-long-term-api-key-access-log-authorizationaws-bedrock · documented-format-literal | Must redactT1 · Provider-documented | Redacted |
aws-bedrock-long-term-api-key-actions-envaws-bedrock · documented-format-literal | Must redactT1 · Provider-documented | Redacted |
aws-bedrock-long-term-api-key-agent-settingsaws-bedrock · documented-format-literal | Must redactT1 · Provider-documented | Redacted |
aws-bedrock-long-term-api-key-alias-base64-encoded-valueaws-bedrock · benign-encoded-value | Must not flagT2 · Tool-corroborated | Quiet |
aws-bedrock-long-term-api-key-curl-beareraws-bedrock · documented-format-literal | Must redactT1 · Provider-documented | Redacted |
aws-bedrock-long-term-api-key-dotenvaws-bedrock · documented-format-literal | Must redactT1 · Provider-documented | Redacted |
aws-bedrock-long-term-api-key-export-136aws-bedrock · documented-format-literal | Must redactT1 · Provider-documented | Redacted |
aws-bedrock-long-term-api-key-inline-assignmentaws-bedrock · documented-format-literal | Must redactT1 · Provider-documented | Redacted |
aws-bedrock-long-term-api-key-java-httpclientaws-bedrock · documented-format-literal | Must redactT1 · Provider-documented | Redacted |
aws-bedrock-long-term-api-key-k8s-secret-beareraws-bedrock · documented-format-literal | Must redactT1 · Provider-documented | Redacted |
aws-bedrock-long-term-api-key-key-shape-bareaws-bedrock · documented-format-literal | Must redactT1 · Provider-documented | Redacted |
aws-bedrock-long-term-api-key-key-shape-quotedaws-bedrock · documented-format-literal | Must redactT1 · Provider-documented | Redacted |
aws-bedrock-long-term-api-key-key-shape-unicode-crlfaws-bedrock · documented-format-literal | Must redactT1 · Provider-documented | Redacted |
aws-bedrock-long-term-api-key-litellm-model-listaws-bedrock · documented-format-literal | Must redactT1 · Provider-documented | Redacted |
aws-bedrock-long-term-api-key-lowercase-prefix-twinaws-bedrock · prefix-near-miss | Must not flagT2 · Tool-corroborated · twin | Quiet |
aws-bedrock-long-term-api-key-openai-sdkaws-bedrock · documented-format-literal | Must redactT1 · Provider-documented | Redacted |
aws-bedrock-long-term-api-key-pasted-keyaws-bedrock · documented-format-literal | Must redactT1 · Provider-documented | Redacted |
aws-bedrock-long-term-api-key-proxy-logaws-bedrock · documented-format-literal | Must redactT1 · Provider-documented | Redacted |
aws-bedrock-long-term-api-key-python-environaws-bedrock · documented-format-literal | Must redactT1 · Provider-documented | Redacted |
aws-bedrock-long-term-api-key-short-bodyaws-bedrock · benign-lookalike | Must not flagT2 · Tool-corroborated | Quiet |
aws-bedrock-long-term-api-key-tool-callaws-bedrock · documented-format-literal | Must redactT1 · Provider-documented | Redacted |
aws-bedrock-long-term-api-key-truncated-head-near-missaws-bedrock · format-near-miss | Must not flagT2 · Tool-corroborated | Quiet |
aws-bedrock-long-term-api-key-actions-secret-referenceaws-bedrock · templated-reference | Must not flagT3 · Project policy | Quiet |
aws-bedrock-long-term-api-key-devcontainer-paste-placeholderaws-bedrock · documentation-placeholder | Must not flagT3 · Project policy | Quiet |
aws-bedrock-long-term-api-key-docs-ellipsis-placeholderaws-bedrock · documentation-placeholder | Must not flagT3 · Project policy | Quiet |
aws-bedrock-long-term-api-key-embedded-leading-twinaws-bedrock · boundary-violation | Must not flagT2 · Tool-corroborated · twin | Quiet |
aws-bedrock-long-term-api-key-env-reference-referenceaws-bedrock · templated-reference | Must not flagT3 · Project policy | Quiet |
aws-bedrock-long-term-api-key-iam-alias-public-idaws-bedrock · public-identifier | Must not flagT2 · Tool-corroborated | Quiet |
aws-bedrock-long-term-api-key-inference-profile-output-public-idaws-bedrock · public-identifier | Must not flagT2 · Tool-corroborated | Quiet |
aws-bedrock-long-term-api-key-key-guidance-proseaws-bedrock · prose-mention | Must not flagT3 · Project policy | Quiet |
aws-bedrock-long-term-api-key-kubeconfig-ca-data-encoded-valueaws-bedrock · benign-encoded-value | Must not flagT2 · Tool-corroborated | Quiet |
aws-bedrock-long-term-api-key-label-proseaws-bedrock · benign-lookalike | Must not flagT3 · Project policy | Quiet |
aws-bedrock-long-term-api-key-leading-equals-twinaws-bedrock · wrong-alphabet | Must not flagT2 · Tool-corroborated · twin | Quiet |
aws-bedrock-long-term-api-key-long-base64-blob-encoded-valueaws-bedrock · benign-encoded-value | Must not flagT2 · Tool-corroborated | Quiet |
aws-bedrock-long-term-api-key-maskaws-bedrock · benign-lookalike | Must not flagT3 · Project policy | Quiet |
aws-bedrock-long-term-api-key-model-and-endpoint-public-idaws-bedrock · public-identifier | Must not flagT2 · Tool-corroborated | Quiet |
aws-bedrock-long-term-api-key-prefix-onlyaws-bedrock · benign-lookalike | Must not flagT2 · Tool-corroborated | Quiet |
aws-bedrock-long-term-api-key-prefix-only-near-missaws-bedrock · format-near-miss | Must not flagT2 · Tool-corroborated | Quiet |
aws-bedrock-long-term-api-key-referenceaws-bedrock · benign-lookalike | Must not flagT3 · Project policy | Quiet |
aws-bedrock-long-term-api-key-service-credential-listing-public-idaws-bedrock · public-identifier | Must not flagT2 · Tool-corroborated | Quiet |
aws-bedrock-long-term-api-key-short-prefix-twinaws-bedrock · prefix-near-miss | Must not flagT2 · Tool-corroborated · twin | Quiet |
aws-bedrock-long-term-api-key-urlsafe-body-twinaws-bedrock · wrong-alphabet | Must not flagT2 · Tool-corroborated · twin | Quiet |
aws-bedrock-long-term-api-key-wrong-prefix-twinaws-bedrock · prefix-near-miss | Must not flagT2 · Tool-corroborated · twin | Quiet |
aws-bedrock-long-term-api-key-your-key-placeholderaws-bedrock · documentation-placeholder | Must not flagT3 · Project policy | Quiet |
Sources
Researched 2026-09-27.
Documentation and code
- aws.amazon.com/blogs/security/securing-amazon-bedrock-api-keys-best-practices-for-implementation-and-management/
- docs.aws.amazon.com/bedrock/latest/userguide/api-keys-reference.html
- docs.aws.amazon.com/IAM/latest/APIReference/API_ServiceSpecificCredential.html
Research log
- redact-secret/redact-secret#778Research issue
- redact-secret/redact-secret#774Research issue
- redact-secret/redact-secret#864Research issue
- redact-secret/redact-secret-benchmarks#384Research issue
- Final evidence, pinned to a commit/redact-secret/redact-secret/blob/8b6a5fde52ecb4dfce13f09c7a947062d21483c7/docs/audits/evidence/864/README.md