AWS Toolkit

AI Security Review

Evidence context: threat category none; evidence quality strong.

What the extension is and what it can reach

AWS Toolkit for JetBrains is published by AWS, ships as version 4.8.261, and sits at roughly ten million installs. Its job is to put AWS services inside the IDE: browsing S3, running Lambda functions locally, deploying with CloudFormation, authenticating against IAM. That work needs two capabilities the threat model flags by default. It reads and writes project files, and it starts processes for local Lambda and SAM runs. Neither is unusual for a tool that manages deployments from the editor.

The findings themselves

Every one of the 83 entries is an info-severity metadata record. There are no IoC hits, no malware signatures, no obfuscation results, no secret findings, and nothing classified as a code smell. The entries are file hashes for the bundled JARs under aws-toolkit-jetbrains-standalone/lib/, for example sdk-core-2.26.25.jar, netty-nio-client-2.26.25.jar, jackson-datatype-jsr310-2.17.2.jar, zjsonpatch-0.4.16.jar, and checksums-2.26.25.jar. A hash per library is a build inventory, the kind of output a scanner produces when it walks a plugin's lib directory and records what is present.

Credential access

The filename that draws the eye is secretsmanager-2.26.25.jar. That is the AWS SDK client library for the Secrets Manager service, bundled so the IDE can list or fetch secrets a developer already has permission to read through their AWS account. It sits beside sdk-core-2.26.25.jar, crt-core-2.26.25.jar, and arns-2.26.25.jar, all standard members of the AWS SDK for Java v2. Nothing in the scan shows the extension reading .env files, SSH keys, or ~/.aws/credentials outside the credential chain the toolkit documents, and the secret category is empty.

The strongest counterargument

Bundling dozens of third-party JARs is real supply chain surface. jackson-datatype-jsr310-2.17.2.jar and zjsonpatch-0.4.16.jar come from outside AWS, and a poisoned dependency inside a plugin with this install base would be a serious event. That argument supports tracking dependency versions over time, not reading this scan as an attack. There is no payload, no unexpected network host, and no code touching credentials the tool was not granted. The bundle also declares no special permissions and no network endpoints, which fits a plugin whose access runs through the IDE and the AWS credential chain.

Key Reasons

• All 83 findings are info-severity metadata file hashes for bundled JARs under aws-toolkit-jetbrains-standalone/lib/, with zero ioc, malware-signature, obfuscation, secret, or code-smell detections
• Published by AWS with roughly ten million installs and a recognizable identity, matching the official AWS Toolkit for JetBrains plugin
• secretsmanager-2.26.25.jar is the AWS SDK Secrets Manager client library, consistent with the toolkit's documented job of working with AWS credentials
• Filesystem and process access map directly to stated functionality: local Lambda and SAM execution, project file editing, and deployment from the IDE

False Positive Considerations

• Metadata hash extraction over bundled dependency JARs reported as individual findings
• AWS SDK library filenames such as secretsmanager-2.26.25.jar read as credential access when they are ordinary SDK clients
• Dozens of third-party JARs in aws-toolkit-jetbrains-standalone/lib/ inflate the raw finding count without any behavioral signal

Reviewed 2026-10-11; recommended action: no action; model confidence 95%.