extract AWS account number from ID without verification

pkg/detectors/aws/aws.go

@@ -4,6 +4,8 @@ import (
 	"context"
 	"crypto/hmac"
 	"crypto/sha256"
+	"encoding/base32"
+	"encoding/binary"
 	"encoding/hex"
 	"encoding/json"
 	"fmt"
@@ -101,6 +103,34 @@ func GetHMAC(key []byte, data []byte) []byte {
 	return hasher.Sum(nil)
 }
 
+func GetAccountNumFromAWSID(AWSID string) (string, error) {
+	// Function to get the account number from an AWS ID (no verification required)
+	// Source: https://medium.com/@TalBeerySec/a-short-note-on-aws-key-id-f88cc4317489
+	if len(AWSID) < 4 {
+		return "", fmt.Errorf("AWSID is too short")
+	}
+	trimmed_AWSID := AWSID[4:]
+	x, err := base32.StdEncoding.WithPadding(base32.NoPadding).DecodeString(strings.ToUpper(trimmed_AWSID))
+	if err != nil {
+		return "", err
+	}
+
+	if len(x) < 6 {
+		return "", fmt.Errorf("Decoded AWSID is too short")
+	}
+	y := x[0:6]
+
+	var z uint64 = binary.BigEndian.Uint64(append(make([]byte, 8-len(y)), y...))
+	maskBytes, err := hex.DecodeString("7fffffffff80")
+	if err != nil {
+		return "", err
+	}
+
+	var mask uint64 = binary.BigEndian.Uint64(append(make([]byte, 8-len(maskBytes)), maskBytes...))
+	account_num := (z & mask) >> 7
+	return fmt.Sprintf("%012d", account_num), nil
+}
+
 // FromData will find and optionally verify AWS secrets in a given set of bytes.
 func (s scanner) FromData(ctx context.Context, verify bool, data []byte) (results []detectors.Result, err error) {
 	dataStr := string(data)
@@ -136,9 +166,18 @@ func (s scanner) FromData(ctx context.Context, verify bool, data []byte) (result
 				},
 			}
 
+			account, err := GetAccountNumFromAWSID(resIDMatch)
+			if err == nil {
+				s1.ExtraData["account"] = account
+			}
+
 			if verify {
 				verified, extraData, verificationErr := s.verifyMatch(ctx, resIDMatch, resSecretMatch, true)
 				s1.Verified = verified
+				//It'd be good to log when calculated account value does not match
+				//the account value from verification. Should only be edge cases at most.
+				//if extraData["account"] != s1.ExtraData["account"] && extraData["account"] != "" {//log here}
+
 				//Append the extraData to the existing ExtraData map.
 				// This will overwrite with the new verified values.
 				for k, v := range extraData {

pkg/detectors/aws/aws_test.go

@@ -84,7 +84,10 @@ func TestAWS_FromChunk(t *testing.T) {
 					DetectorType: detectorspb.DetectorType_AWS,
 					Verified:     false,
 					Redacted:     "AKIASP2TPHJSQH3FJRUX",
-					ExtraData:    map[string]string{"resource_type": "Access key"},
+					ExtraData: map[string]string{
+						"resource_type": "Access key",
+						"account":       "171436882533",
+					},
 				},
 			},
 			wantErr: false,
@@ -115,6 +118,7 @@ func TestAWS_FromChunk(t *testing.T) {
 					Redacted:     "AKIASP2TPHJSQH3FJXYZ",
 					ExtraData: map[string]string{
 						"resource_type": "Access key",
+						"account":       "171436882533",
 					},
 				},
 				{
@@ -187,6 +191,7 @@ func TestAWS_FromChunk(t *testing.T) {
 					Redacted:     "AKIASP2TPHJSQH3FJRUX",
 					ExtraData: map[string]string{
 						"resource_type": "Access key",
+						"account":       "171436882533",
 					},
 				},
 			},
@@ -221,6 +226,7 @@ func TestAWS_FromChunk(t *testing.T) {
 					Redacted:     "AKIASP2TPHJSQH3FJRUX",
 					ExtraData: map[string]string{
 						"resource_type": "Access key",
+						"account":       "171436882533",
 					},
 				},
 			},
@@ -242,6 +248,7 @@ func TestAWS_FromChunk(t *testing.T) {
 					Redacted:     "AKIASP2TPHJSQH3FJRUX",
 					ExtraData: map[string]string{
 						"resource_type": "Access key",
+						"account":       "171436882533",
 					},
 				},
 			},
@@ -263,6 +270,7 @@ func TestAWS_FromChunk(t *testing.T) {
 					Redacted:     "AKIASP2TPHJSQH3FJRUX",
 					ExtraData: map[string]string{
 						"resource_type": "Access key",
+						"account":       "171436882533",
 					},
 				},
 			},