diff --git a/config/buildspec.yml b/config/buildspec.yml
index 6af463e8a..7120401db 100755
--- a/config/buildspec.yml
+++ b/config/buildspec.yml
@@ -10,7 +10,7 @@ env:
 phases:
   install:
     commands:
-        -  . config/change_branch.sh
+        -  . config/clone_source.sh
         - su && apt-get update
         - apt-get install sudo -qq -o=Dpkg::Use-Pty=0 # silence output: https://askubuntu.com/a/668859/724247
         - sudo apt-get update -qq -o=Dpkg::Use-Pty=0
diff --git a/config/change_branch.sh b/config/clone_source.sh
similarity index 88%
rename from config/change_branch.sh
rename to config/clone_source.sh
index 50bb6e83c..29c0766ae 100755
--- a/config/change_branch.sh
+++ b/config/clone_source.sh
@@ -1,10 +1,12 @@
+git clone https://github.com/awslabs/git-secrets.git && cd git-secrets && make install
+
 export CODEBUILD_GIT_BRANCH="$(git symbolic-ref HEAD --short 2>/dev/null)"
 if [ "$CODEBUILD_GIT_BRANCH" = "" ] ; then
   CODEBUILD_GIT_BRANCH="$(git branch -a --contains HEAD | sed -n 2p | awk '{ printf $1 }')";
   export CODEBUILD_GIT_BRANCH=${CODEBUILD_GIT_BRANCH#remotes/origin/};
 fi
 
-cd $CODEBUILD_SRC_DIR && git checkout $CODEBUILD_GIT_BRANCH
+cd $CODEBUILD_SRC_DIR && git secrets --install && git secrets --register-aws && git checkout $CODEBUILD_GIT_BRANCH
 export CURRENT_COMMIT_HASH=$(git log -1 --pretty=%h);
 #export CURRENT_COMMIT_DATE="$(git show -s --format=%ci | cut -d' ' -f 1)$(git show -s --format=%ci | cut -d' ' -f 2)";
 export CURRENT_DATETIME=$(date +'%Y%m%d_%H%M%S')
diff --git a/test.txt b/test.txt
new file mode 100644
index 000000000..5cb6afeb9
--- /dev/null
+++ b/test.txt
@@ -0,0 +1 @@
+AWS_ACCESS_KEY_ID=AKIAIOSFODNN7RXAMPLE