AWS NHI Credential Discovery

AWS AUTHENTICATION

AWS_ACCESS_KEY_ID

AWS_SECRET_ACCESS_KEY

SESSION TOKEN (optional — for STS temp creds)

PROFILE NAME (label only)

SOURCE ACCESS KEY ID

SOURCE SECRET ACCESS KEY

TARGET ROLE ARN

SESSION NAME

SESSION DURATION (seconds)

EXTERNAL ID (optional)

AUTO-DETECT MODE

Credentials will be resolved from the AWS default provider chain:
1. AWS_ACCESS_KEY_ID / AWS_SECRET_ACCESS_KEY env vars
2. ~/.aws/credentials named profile
3. EC2 / ECS instance metadata (IMDS)
4. IAM Identity Center / SSO

SCAN SCOPE

TARGET ACCOUNT IDs (comma-separated)

CROSS-ACCOUNT ROLE NAME

API RATE LIMIT (calls/sec per service)

IAM KEY AGE THRESHOLD (days to flag)

SERVICE MODULES

IAM

Users & Keys

Secrets Mgr

Secrets

SSM

Param Store

Cognito

Client IDs

API GW

API Keys

Lambda

Env vars

ECS

Task defs

EC2

IMDS / roles

CodeBuild

Env vars

CloudTrail

Audit log

TARGET REGIONS

DISCOVERY OPTIONS

RETRIEVE SECRET VALUES (high sensitivity)

ROTATION STATUS FILTER

SCAN LABEL

OUTPUT OPTIONS

S3 BUCKET ARN (optional push)

SIEM / WEBHOOK ENDPOINT (optional)

SNS TOPIC ARN (completion notification)

Idle — ready to scan

Configure credentials and click Run Discovery

CRITICAL

HIGH

MEDIUM

LOW / INFO

TOTAL FINDINGS

DISCOVERY LOG 0 events

SERVICE PROGRESS

SEVERITY ↕	TYPE ↕	CREDENTIAL / RESOURCE	SERVICE ↕	REGION ↕	ACCOUNT ↕	OWNER / CREATOR ↕	AGE ↕	STATUS

SCAN HISTORY Stored locally in browser • scoped to this file

No saved scans yet.
Complete a scan and save it to build history.