Repository: Checkmarx/kics (language: python)

Issue:
AWS SecretsManager Query Exclusion Regex Patterns do not align to vendor (Wildcard Characters and Restrictive Name Length Constraint)
## Background:
The wildcard characters `*` and `?` are permissible in AWS ARN fields however this KICS scan fails to exclude valid SecretsManager ARN's utilising these character and therefore generate a false-positive alert for legitimate ARNs which contain no secret data

## Proposal:
Simply modify the regex to allow these permissible characters within the ARN path as defined by vendor specification: [Using wildcards in resource ARNs](https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_resource.html#reference_policies_elements_resource_wildcards)

## Source: https://github.com/Checkmarx/kics/blob/ce683b8aee940c078c59dacf386ff930c03bdb27/assets/queries/common/passwords_and_secrets/regex_rules.json#L39-L42


Discussion / hints:

Fix patch:
diff --git a/assets/queries/common/passwords_and_secrets/regex_rules.json b/assets/queries/common/passwords_and_secrets/regex_rules.json
index 5d8d42729c5..9570e36d84f 100644
--- a/assets/queries/common/passwords_and_secrets/regex_rules.json
+++ b/assets/queries/common/passwords_and_secrets/regex_rules.json
@@ -38,7 +38,7 @@
         },
         {
           "description": "Avoiding Secrets Manager arn",
-          "regex": ":secretsmanager:[a-z0-9-]+:[0-9]+:(?i)['\"]?secret[_]?(key)?['\"]?\\s*(:|=)\\s*['\"]?([A-Za-z0-9/~^_!@&%()=?*+-]{10,})['\"]?"
+          "regex": ":secretsmanager:[a-z0-9-*?]+:[0-9*?]+:(?i)['\"]?secret[_]?(key)?['\"]?\\s*(:|=)\\s*['\"]?([A-Za-z0-9/~^_!@&%()=?*+-]+)['\"]?"
         },
         {
           "description": "Avoiding CloudFormation Parameters Descriptions",


Test patch:
diff --git a/assets/queries/common/passwords_and_secrets/test/negative53.yaml b/assets/queries/common/passwords_and_secrets/test/negative53.yaml
new file mode 100644
index 00000000000..17b6a0c2ff9
--- /dev/null
+++ b/assets/queries/common/passwords_and_secrets/test/negative53.yaml
@@ -0,0 +1,25 @@
+Type: AWS::Glue::Connection
+Properties:
+    CatalogId: "1111111111111"
+    ConnectionInput:
+      ConnectionProperties:
+          CONNECTION_URL:
+            Fn::Join:
+              - ""
+              - - "mongodb://{{resolve:secretsmanager:arn:"
+                - Ref: AWS::Partition
+                - :secretsmanager:*:1111111111111:secret:/test/resources/docdb-test:SecretString:endpoint::}}/test
+          USERNAME:
+            Fn::Join:
+              - ""
+              - - "{{resolve:secretsmanager:arn:"
+                - Ref: AWS::Partition
+                - :secretsmanager:eu-west-1:*:secret:/test/resources/docdb-test:SecretString:username::}}
+          PASSWORD:
+            Fn::Join:
+              - ""
+              - - "{{resolve:secretsmanager:arn:"
+                - Ref: AWS::Partition
+                - :secretsmanager:us-east-?:*:secret:tiny::}}
+          JDBC_ENFORCE_SSL: true
+      ConnectionType: MONGODB