Skip to content
Awake docs

A secret was stopped from leaving the box

Code: egress.secret_detected

What happened

Section titled “What happened”

The org’s policy found a known kind of credential in the request and stopped it.

Awake’s answer says:

Your organization's policy stops requests that carry this kind of credential from leaving the box.

Why Awake does this

Section titled “Why Awake does this”

Every request a box sends leaves through the Egress Proxy, outside the box, which allows only what your org’s policy names and refuses the rest. The Egress Proxy says more.

What you can do

Section titled “What you can do”

Take the credential out of the request. Keep credentials your tools need in Secrets.

In the console: Secrets.

The request carried something shaped like a credential, such as an access key or a token, toward a destination that shouldn’t get it. Take it out of the request. If a tool needs the credential, keep it in Secrets: the box then holds a placeholder, which the proxy swaps for the value on the hosts the secret is added on alone.

What your admin can do

Section titled “What your admin can do”

Your org’s policy sets what happens when a request carries a credential’s shape. Your Awake admin can tell you what it allows.

For agents

Section titled “For agents”

Tell the person what was refused and why, with this code, and don’t retry in a loop. Don’t try another host, encoding or route to get around a control.

Where Awake records it

Section titled “Where Awake records it”

The Egress Proxy records each refusal, never the request’s data. Org admins and security auditors read the records in the Audit log.

The record names the kind of credential and the destination, never the value.

Section titled “Related codes”

Still stuck

Section titled “Still stuck”

Ask your Awake admin. Give them the code, egress.secret_detected, and when it happened.