# Docs: https://docs.aws.amazon.com/lambda/latest/dg/urls-configuration.html
# Format: Lambda function URL auth token in query string (?token=...)
# Verify: GET request to function URL with token returns 200 if valid
# Prefix: none (requires URL context)
[detector]
id = "aws-lambda-function-url-secret"
name = "AWS Lambda Function URL Secret"
service = "aws"
severity = "critical"
ml = { match_mode = "lift", entropy_mode = "disabled", weight = 1.0, context_radius_lines = 5 }
match_confidence = { literal_prefix_weight = 0.35, context_anchor_weight = 0.20, entropy_weight = 0.20, high_entropy_partial_weight = 0.12, moderate_entropy_threshold = 3.0, moderate_entropy_weight = 0.05, low_entropy_penalty_floor = 2.0, low_entropy_min_match_length = 10, low_entropy_penalty_multiplier = 0.60, keyword_nearby_weight = 0.10, sensitive_file_weight = 0.10, companion_weight = 0.05, very_high_entropy_margin = 1.2999999999999998, named_anchor_floor = 0.55, assignment_context_multiplier = 1.0, string_literal_context_multiplier = 0.9, unknown_context_multiplier = 0.8, documentation_context_multiplier = 0.3, comment_context_multiplier = 0.4, test_context_multiplier = 0.3, encrypted_context_multiplier = 0.05, soft_context_suppression_threshold = 0.5, encrypted_context_suppression_threshold = 0.8, post_match = { placeholder_multiplier = 0.05, minimum_byte_diversity = 0.1, low_diversity_multiplier = 0.1, maximum_repeat_ratio = 0.8, degenerate_run_min_length = 10, degenerate_repeat_multiplier = 0.1, fixture_path_multiplier = 0.5, ml_context_reapply_below = 0.95 } }
keywords = ["lambda-url", "lambda", "token"]
[[detector.patterns]]
regex = "https://[a-z0-9]{12,}\\.lambda-url\\.[a-z0-9-]+\\.on\\.aws/\\?.*token=([a-zA-Z0-9_-]{20,})"
description = "AWS Lambda function URL with auth token in query string"
group = 1
[[detector.patterns]]
# Path class includes `/` so multi-segment paths like `/api/v1?token=...`
# match (real Lambda URLs commonly route through a path prefix).
regex = "https://[a-z0-9]{12,}\\.lambda-url\\.[a-z0-9-]+\\.on\\.aws/[a-zA-Z0-9_/-]*\\?.*token=([a-zA-Z0-9_-]{20,})"
description = "AWS Lambda function URL with path and auth token"
group = 1
[[detector.patterns]]
regex = "(?:LAMBDA|lambda)[_\\-\\s]*(?:URL|url)[_\\-\\s]*(?:TOKEN|token)[=:\\s\"'\\']+([a-zA-Z0-9_-]{20,})"
description = "AWS Lambda function URL token with context anchor"
group = 1
# Verification removed: every pattern above captures just the token portion
# of the Lambda URL (group 1 = `[a-zA-Z0-9_-]{20,}`), so `{{match}}` is the
# bare token rather than a usable URL. A safe verifier would need a separate
# companion capturing the full `https://...lambda-url.../...?token=` URL,
# but the access pattern is already inert: a leaked token without its
# accompanying function URL can't be exercised. Reporting it as
# `Unverifiable` is the correct outcome here.
[[detector.tests]]
test_positive = "https://abcdef123456.lambda-url.us-east-1.on.aws/?token=Kp4Qx7Rm2Sn5Tb8Vw3YzKp4Q"
test_negative = "https://example.com/?token=short"