AWS API Gateway Keys Accessed
This rule detects when AWS API Gateway keys are accessed with the 'includeValue' or 'includeValues' parameter set to 'true'. This indicates an attempt to retrieve the actual API key values, which could be a credential access attempt. The rule specifically looks for 'GetApiKey' and 'GetApiKeys' events in AWS CloudTrail logs where the request explicitly asks for the key's value.
YARA-L
