[INS-335] Added AWS Appsync Detector

[MuneebUllahKhan222]

Description

This PR adds the AWS AppSync API Key Detector for TruffleHog.
It scans for AWS AppSync GraphQL API keys (prefix da2- followed by 26 lowercase alphanumeric characters) and associated AppSync GraphQL endpoints, and optionally verifies them via the AppSync GraphQL API.

API Key Regex: \b(da2-[a-z0-9]{26})\b
Endpoint Regex: https:\/\/[a-z0-9]{26}\.appsync-api\.[a-z0-9-]+\.amazonaws\.com\/graphql

Verification

For verification, we send a POST request to the detected AppSync GraphQL endpoint using the API key in the x-api-key: <key> header. The request executes a minimal read-only GraphQL query:

query { __typename }

A response code of 200 OK indicates the API key is valid for the endpoint.
A response code of 401 Unauthorized or 403 Forbidden indicates the key is invalid, expired, or does not have permission to access the API.

This verification request is safe because it only executes a read-only GraphQL query and does not perform any mutations or state-changing operations.

Corpora Test

The detector does not appear in the list.

Checklist:

• Tests passing (make test-community)?
• Lint passing (make lint this requires golangci-lint)?

---

Note

Medium Risk
Introduces new network verification behavior (HTTP POST to discovered endpoints) and expands the detector enum/list; risk is mainly around false positives/verification edge cases and added outbound calls.

Overview
Adds a new AWSAppSync detector that matches AppSync API keys (da2-…) and AppSync GraphQL endpoints, emits findings as endpoint:key (RawV2), and optionally verifies candidates by POSTing a minimal __typename query with x-api-key.

Wires the detector into the default detector list and extends detectorspb.DetectorType/proto/detectors.proto with AWSAppSync (1043). Includes unit, integration (build-tagged), and benchmark coverage for matching and verification outcomes.

^{Written by Cursor Bugbot for commit c55c1e1. This will update automatically on new commits. Configure here.}

[cursor]

Cursor Bugbot has reviewed your changes and found 1 potential issue.

^{Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.}