[New Check]: Detect secrets in AWS Data Pipeline definitions

[danibarranqueroo]

Existing check search

• I have searched existing issues, Prowler Hub, and the public roadmap, and this check does not already exist.

Provider

AWS

New provider name

No response

Service or product area

datapipeline

Suggested check name

datapipeline_pipeline_no_secrets_in_definition

Context and goal

AWS Data Pipeline definitions with custom scripts / SQL commands commonly embed database credentials in plaintext.

Expected behavior

• Resource or scope to evaluate: Each Data Pipeline definition.
• PASS when: No secrets are detected.
• FAIL when: A secret is detected (report the pipeline/object, not the value).

References

• Umbrella issue: Implement more secrets checks #3085
• Secret scanning checks (developer guide): https://docs.prowler.com/developer-guide/secret-scanning-checks
• API/SDK reference: datapipeline list_pipelines / get_pipeline_definition
• Reference code: awslambda_function_no_secrets_in_code

Suggested severity

High

Additional implementation notes

Requires adding a new datapipeline service to Prowler (does not exist yet). Scan the pipeline definition (pipelineObjects/parameter values) with the shared detect-secrets helper. Severity is High by default and becomes Critical if the secret is validated.

[YinkaMetrics]

I can take this one. I will add the AWS Data Pipeline service, implement datapipeline_pipeline_no_secrets_in_definition, and cover PASS/FAIL/no-resource behavior with focused tests.

[danibarranqueroo]

Thanks for going ahead and opening the PR @YinkaMetrics! I'm assigning the issue to you 🙌