Project: KICS (Provisioning / Security & Compliance)
File: 3c3b7a58-b018-4d07-9444-d9ee7156e111.md

title: Alexa Skill Plaintext Client Secret Exposed hide: toc: true navigation: true <style> .highlight .hll { background-color: #ff171742; } .md-content { max-width: 1100px; margin: 0 auto; } </style> Query id: 3c3b7a58-b018-4d07-9444-d9ee7156e111 Query name: Alexa Skill Plaintext Client Secret Exposed Platform: CloudFormation Severity: <span style="color:#ff7213">Medium</span> Category: Encryption URL: Alexa skills' client secrets should not be defined as a plaintext string. It should either use 'AWS Systems Manager Parameter Store' or 'AWS Secrets Manager' to retrieve sensitive information<br> ```yaml title="Positive test num. 1 - yaml file" hl_lines="17" Resources: MySkill: Type: "Alexa::ASK::Skill" Properties: SkillPackage: S3Bucket: "my-skill-packages" S3Key: "skillpackage.zip" S3BucketRole: arn:aws:lambda:us-east-1:377024778620:function:aws-node-alexa-skill Overrides: Manifest: apis: custom: endpoint: uri: arn:aws:lambda:us-east-1:377024778620:function:aws-node-alexa-skill AuthenticationConfiguration: ClientId: "amzn1.application-oa2-client.1234" ClientSecret: "1234" RefreshToken: "Atzr|1234" VendorId: "1234" ``` ```json title="Positive test num. 2 - json file" hl_lines="24" { "Resources": { "MySkill": { "Type": "Alexa::ASK::Skill", "Properties": { "SkillPackage": { "S3BucketRole": "arn:aws:lambda:us-east-1:377024778620:function:aws-node-alexa-skill", "Overrides": { "Manifest": { "apis": { "custom": { "endpoint": { "uri": "arn:aws:lambda:us-east-1:377024778620:function:aws-node-alexa-skill" } } } } }, "S3Bucket": "my-skill-packages", "S3Key": "skillpackage.zip" }, "AuthenticationConfiguration": { "ClientId": "amzn1.application-oa2-client.1234", "ClientSecret": "1234", "RefreshToken": "Atzr|1234" }, "VendorId": "1234" } } } } ``` ```yaml title="Negative test num. 1 - yaml file" Resources: MySkill: Type: "Alexa::ASK::Skill" Properties: SkillPackage: S3Bucket: "my-skill-packages" S3Key: "skillpackage.zip" S3BucketRole: arn:aws:lambda:us-east-1:377024778620:function:aws-node-alexa-skill Overrides: Manifest: apis: custom: endpoint: uri: arn:aws:lambda:us-east-1:377024778620:function:aws-node-alexa-skill AuthenticationConfiguration: ClientId: "amzn1.application-oa2-client.1234" ClientSecret: "{{resolve:secretsmanager:123456}}" RefreshToken: "Atzr|1234" VendorId: "1234" MySkill2: Type: "Alexa::ASK::Skill" Properties: SkillPackage: S3Bucket: "my-skill-packages" S3Key: "skillpackage.zip" S3BucketRole: arn:aws:lambda:us-east-1:377024778620:function:aws-node-alexa-skill Overrides: Manifest: apis: custom: endpoint: uri: arn:aws:lambda:us-east-1:377024778620:function:aws-node-alexa-skill AuthenticationConfiguration: ClientId: "amzn1.application-oa2-client.1234" ClientSecret: "{{resolve:ssm-secure:123456}}" RefreshToken: "Atzr|1234" VendorId: "1234" ``` ```json title="Negative test num. 2 - json file" { "Resources": { "MySkill": { "Type": "Alexa::ASK::Skill", "Properties": { "SkillPackage": { "S3Bucket": "my-skill-packages", "S3Key": "skillpackage.zip", "S3BucketRole": "arn:aws:lambda:us-east-1:377024778620:function:aws-node-alexa-skill", "Overrides": { "Manifest": { "apis": { "custom": { "endpoint": { "uri": "arn:aws:lambda:us-east-1:377024778620:function:aws-node-alexa-skill" } } } } } }, "AuthenticationConfiguration": { "ClientId": "amzn1.application-oa2-client.1234", "ClientSecret": "{{resolve:secretsmanager:123456}}", "RefreshToken": "Atzr|1234" }, "VendorId": "1234" } }, "MySkill2": { "Type": "Alexa::ASK::Skill", "Properties": { "SkillPackage": { "S3Bucket": "my-skill-packages", "S3Key": "skillpackage.zip", "S3BucketRole": "arn:aws:lambda:us-east-1:377024778620:function:aws-node-alexa-skill", "Overrides": { "Manifest": { "apis": { "custom": { "endpoint": { "uri": "arn:aws:lambda:us-east-1:377024778620:function:aws-node-alexa-skill" } } } } } }, "AuthenticationConfiguration": { "ClientId": "amzn1.application-oa2-client.1234", "ClientSecret": "{{resolve:ssm-secure:123456}}", "RefreshToken": "Atzr|1234" }, "VendorId": "1234" } } } } ```