AWS secret access key. On its own the value is forty characters of letters, digits, slash and plus, indistinguishable from any base64 blob or forty-character hash, so the pattern is anchored on the aws secret key assignment that precedes it. The match span therefore covers that assignment as well as the value, because a Python lookbehind must be fixed width and this prefix is not: redaction removes the whole fragment, keyword included. A secret key written with no keyword nearby is missed by design, an unanchored forty-character rule is unusable at its false-positive rate. No collision: the existing aws-access-key covers the AKIA identifier, which is the public half of the pair.
Label: AWS_SECRET_ACCESS_KEY
(?i:aws)[_-]?(?i:secret)[_-]?(?:(?i:access)[_-]?)?(?i:key)[A-Za-z0-9_]{0,8}["\x27\]\[ ]{0,4}[:=][ "\x27]{0,4}[A-Za-z0-9/+]{40}(?![A-Za-z0-9/+])export AWS_SECRET_ACCESS_KEY=wJalrXUtnFEMI/K7MDENG/bPxRfiCYEXAMPLEKEY → AWS_SECRET_ACCESS_KEY=wJalrXUtnFEMI/K7MDENG/bPxRfiCYEXAMPLEKEYaws_secret_key: "je7MtGbClwBF/2Zp9Utk/h3yCo8nvbEXAMPLEKEY" → aws_secret_key: "je7MtGbClwBF/2Zp9Utk/h3yCo8nvbEXAMPLEKEYAWS_ACCESS_KEY_ID=AKIAIOSFODNN7EXAMPLEaws_secret_access_key=tooshortTags: international, secrets, software-dev