Is there a reason this isn't a regex

[LurkAndLoiter]

git-secrets/git-secrets

Line 241 in 7d6b970

add_config 'secrets.patterns' 'bedrock-api-key-YmVkcm9jay5hbWF6b25hd3MuY29t' #Bedrock short-lived - https://docs.aws.amazon.com/bedrock/latest/userguide/api-keys-generate.html

Expected:

add config 'secrets.patterns' = 'bedrock-api-key-[A-Za-z0-9]{32}'

Does anyone know any reason for this being hard coded?

[varo0000000]

add config 'secrets.patterns' = 'bedrock-api-key-[A-Za-z0-9]{32}'add config 'secrets.patterns' = 'bedrock-api-key-[A-Za-z0-9]{32}'add config 'secrets.patterns' = 'bedrock-api-key-[A-Za-z0-9]{32}'

[LurkAndLoiter]

add config 'secrets.patterns' = 'bedrock-api-key-[A-Za-z0-9]{32}'add config 'secrets.patterns' = 'bedrock-api-key-[A-Za-z0-9]{32}'add config 'secrets.patterns' = 'bedrock-api-key-[A-Za-z0-9]{32}'

Are you asking me to do something here?

The PR has a length {28} to match the original length should it be {32}

[scottschreckengaust]

It is because a short-term API key is bedrock-api-key-<base64-encoded-presigned-url> and the pattern bedrock-api-key-YmVkcm9jay5hbWF6b25hd3MuY29t decodes to bedrock.amazonaws.com (in the first 28 base64 encoded characters):

% echo "YmVkcm9jay5hbWF6b25hd3MuY29t" | base64 -d
bedrock.amazonaws.com

I suggested in #271 to update the pattern for the short-term API key pattern with a valid base64 regular expression:

bedrock-api-key-YmVkcm9jay5hbWF6b25hd3MuY29t(?:[A-Za-z0-9+/]{4})*(?:[A-Za-z0-9+/]{2}[AEIMQUYcgkosw048]=|[A-Za-z0-9+/][AQgw]==)?