Added ability to detect direct write to global AWS.config

javascript/ql/lib/semmle/javascript/frameworks/AWS.qll

@@ -41,6 +41,19 @@ module AWS {
       getAWSImport().getMember(getAWSServiceName()).getAnInstantiation().getReturn().asSource()
   }
 
+  /**
+   * Gets a node representing the AWS global config object.
+   */
+  private API::Node getAWSConfig() { result = getAWSImport().getMember("config") }
+
+  /**
+   * Gets a property write to the AWS config object.
+   * This captures assignments to AWS.config properties.
+   */
+  private DataFlow::PropWrite configAssigment() {
+    result = getAWSConfig().asSource().getAPropertyWrite()
+  }
+
   /**
    * Holds if the `i`th argument of `invk` is an object hash for `AWS.Config`.
    */
@@ -82,6 +95,20 @@ module AWS {
         or
         prop = "secretAccessKey" and kind = "password"
       )
+      or
+      // `AWS.config.accessKeyId = <user>` or `AWS.config.secretAccessKey = <password>`
+      exists(string prop, DataFlow::PropWrite propWrite |
+        propWrite = configAssigment() and
+        this = propWrite.getRhs() and
+        prop = propWrite.getPropertyName() and
+        (
+          kind = "user name" and
+          prop = "accessKeyId"
+          or
+          kind = "password" and
+          prop = "secretAccessKey"
+        )
+      )
     }
 
     override string getCredentialsKind() { result = kind }