Security: AWS access key + secret pair committed to Terraform/modules/main.tf — rotate immediately

[Raffa-jarrl]

Hi — quick security note.

Terraform/modules/main.tf (commit bb041ffa0315d58d6ae10828d1d9184ca17d2c28) contains an AWS access key starting with AKIAXEFU… together with its paired secret access key. Both are currently visible in the public main branch.

Action items (in order):

1. Rotate the key NOW at https://console.aws.amazon.com/iam → Users → your user → Security credentials → make the old key Inactive, create a new one. AWS support article: https://repost.aws/knowledge-center/rotate-access-keys-iam-user
2. Check CloudTrail for any unauthorized API calls under that access key — crypto-mining bots scrape GitHub for AKIA… keys within seconds of push. Look for unexpected EC2 instance launches, S3 bucket creations, or IAM user creations.
3. Rewrite git history to remove the key from past commits too: git filter-repo --invert-paths --path Terraform/modules/main.tf (or use BFG Repo-Cleaner). Even after a force-push, the GitHub-archived commit will keep the key visible until you do this.
4. Switch to env vars going forward: pass AWS credentials via AWS_ACCESS_KEY_ID / AWS_SECRET_ACCESS_KEY env vars or via the AWS CLI's ~/.aws/credentials file. NEVER commit them.

The leak was detected by Lictor (https://lictor-ai.com), an open-source security scanner under Apache 2.0. No data was accessed using the key. This is a one-time courtesy notification.