Project: KICS (Provisioning / Security & Compliance)
File: 5b48c507-0d1f-41b0-a630-76817c6b4189.md

title: RefreshToken Is Exposed hide: toc: true navigation: true <style> .highlight .hll { background-color: #ff171742; } .md-content { max-width: 1100px; margin: 0 auto; } </style> Query id: 5b48c507-0d1f-41b0-a630-76817c6b4189 Query name: RefreshToken Is Exposed Platform: CloudFormation Severity: <span style="color:#bb2124">High</span> Category: Secret Management URL: Alexa ASK Skill AuthenticationConfiguration RefreshToken should not be a plaintext string<br> ```yaml title="Positive test num. 1 - yaml file" hl_lines="18" Resources: MySkill: Type: "Alexa::ASK::Skill" Properties: SkillPackage: S3Bucket: "my-skill-packages" S3Key: "skillpackage.zip" S3BucketRole: !GetAtt S3BucketReadRole.Arn Overrides: Manifest: apis: custom: endpoint: uri: !GetAtt SkillFunction.Arn AuthenticationConfiguration: ClientId: "amzn1.application-oa2-client.1234" ClientSecret: "1234" RefreshToken: "Atzr|1234" VendorId: "1234" ``` ```json title="Positive test num. 2 - json file" hl_lines="26" { "Resources": { "MySkill": { "Type": "Alexa::ASK::Skill", "Properties": { "VendorId": "1234", "SkillPackage": { "S3Bucket": "my-skill-packages", "S3Key": "skillpackage.zip", "S3BucketRole": "S3BucketReadRole.Arn", "Overrides": { "Manifest": { "apis": { "custom": { "endpoint": { "uri": "SkillFunction.Arn" } } } } } }, "AuthenticationConfiguration": { "ClientId": "amzn1.application-oa2-client.1234", "ClientSecret": "1234", "RefreshToken": "Atzr|1234" } } } } } ``` ```yaml title="Negative test num. 1 - yaml file" Resources: MySkill: Type: "Alexa::ASK::Skill" Properties: SkillPackage: S3Bucket: "my-skill-packages" S3Key: "skillpackage.zip" S3BucketRole: !GetAtt S3BucketReadRole.Arn Overrides: Manifest: apis: custom: endpoint: uri: !GetAtt SkillFunction.Arn AuthenticationConfiguration: ClientId: "amzn1.application-oa2-client.1234" ClientSecret: "1234" RefreshToken: "{{resolve:secretsmanager:Atzr|IQEBLzAtAhRPpMJxdwVz2Nn6f2y-tpJX2DeX}}" VendorId: "1234" MySkill2: Type: "Alexa::ASK::Skill" Properties: SkillPackage: S3Bucket: "my-skill-packages" S3Key: "skillpackage.zip" S3BucketRole: !GetAtt S3BucketReadRole.Arn Overrides: Manifest: apis: custom: endpoint: uri: !GetAtt SkillFunction.Arn AuthenticationConfiguration: ClientId: "amzn1.application-oa2-client.1234" ClientSecret: "1234" RefreshToken: "{{resolve:ssm-secure:Atzr|IQEBLzAtAhRPpMJxdwVz2Nn6f2y-tpJX2DeX}}" VendorId: "1234" ``` ```json title="Negative test num. 2 - json file" { "Resources": { "MySkill": { "Type": "Alexa::ASK::Skill", "Properties": { "SkillPackage": { "S3Bucket": "my-skill-packages", "S3Key": "skillpackage.zip", "S3BucketRole": "S3BucketReadRole.Arn", "Overrides": { "Manifest": { "apis": { "custom": { "endpoint": { "uri": "SkillFunction.Arn" } } } } } }, "AuthenticationConfiguration": { "ClientId": "amzn1.application-oa2-client.1234", "ClientSecret": "1234", "RefreshToken": "{{resolve:secretsmanager:Atzr|IQEBLzAtAhRPpMJxdwVz2Nn6f2y-tpJX2DeX}}" }, "VendorId": "1234" } }, "MySkill2": { "Type": "Alexa::ASK::Skill", "Properties": { "SkillPackage": { "S3Bucket": "my-skill-packages", "S3Key": "skillpackage.zip", "S3BucketRole": "S3BucketReadRole.Arn", "Overrides": { "Manifest": { "apis": { "custom": { "endpoint": { "uri": "SkillFunction.Arn" } } } } } }, "AuthenticationConfiguration": { "ClientId": "amzn1.application-oa2-client.1234", "ClientSecret": "1234", "RefreshToken": "{{resolve:ssm-secure:Atzr|IQEBLzAtAhRPpMJxdwVz2Nn6f2y-tpJX2DeX}}" }, "VendorId": "1234" } } } } ```