git-secrets "prohibited pattern" match blocks the commit in CI

By Daniel Zoghalchali·Latchkey

awslabs git-secrets scans the staged diff against registered patterns. A match, most often an AWS access key, prints "matches one or more prohibited patterns" and exits 1 to reject the commit.

What this error means

git-secrets prints the file, line, and matched value followed by "[ERROR] Matched one or more prohibited patterns" and returns a non-zero exit.

config/deploy.sh:4:AWS_SECRET_ACCESS_KEY=wJalrXUtnFEMI...redacted...

[ERROR] Matched one or more prohibited patterns

Possible mitigations:
- Mark false positives as allowed using: git config --add secrets.allowed ...

Common causes

A staged line matched a registered pattern

git-secrets matched a configured regex, for example the built-in AWS patterns added by git secrets --register-aws, against the staged content.

A false positive on an example or placeholder

A documented example AWS key or placeholder can match the AWS regex even though it is not a live credential.

How to fix it

Remove the secret or allow a verified false positive

1. Open the file and line git-secrets reports.
2. If it is a real key, remove and rotate it and read it from the environment.
3. For a documented example, register it as an allowed pattern rather than disabling the check.

git secrets --add --allowed 'AKIAIOSFODNN7EXAMPLE'

Scan the whole history in CI

Register the AWS provider and scan all history so pre-existing keys are caught, not just the current commit.

git secrets --register-aws
git secrets --scan-history

How to prevent it

• Register the AWS patterns and any org-specific ones.
• Allow only documented example values, never real keys.
• Install git-secrets hooks so commits are checked before CI.

Frequently asked questions

Related guides

References

• Git reference manual
• GitHub Actions documentation