Back to Checks
aws

CodeBuild project has no sensitive credentials in plaintext environment variables

codebuild_project_no_secrets_in_variables
Service: codebuildSeverity: critical
OfficialBuilt-inVerified
Categories:secretsci-cd
Resource Type:AwsCodeBuildProject

AWS CodeBuild projects are inspected for plaintext environment variables (PLAINTEXT) that resemble secrets (keys, tokens, passwords).

Such values indicate sensitive data is stored directly in environment variables instead of being sourced securely.

Prowler logoProwlerprowler-provider-aws

Risk

Plaintext secrets in environment variables reduce confidentiality: values can be viewed in consoles/CLI and may leak into build logs or public outputs. Compromised credentials enable unauthorized AWS actions, artifact tampering, and lateral movement, causing data exfiltration and CI/CD supply-chain compromise.

Run this check with Prowler

Run in Prowler Cloud
Run
prowler aws --checks codebuild_project_no_secrets_in_variables

Recommendation

Store secrets outside the build and reference them via AWS Secrets Manager or AWS Systems Manager Parameter Store instead of PLAINTEXT variables.

  • Enforce least privilege on the build role
  • Rotate secrets; prefer short-lived credentials
  • Avoid logging or exporting secret values and never embed them in artifacts

Remediation

Terraform

resource "aws_codebuild_project" "<example_resource_name>" {
  name         = "<example_resource_name>"
  service_role = "<example_resource_arn>"

  source {
    type = "NO_SOURCE"
  }

  artifacts {
    type = "NO_ARTIFACTS"
  }

  environment {
    compute_type = "BUILD_GENERAL1_SMALL"
    image        = "aws/codebuild/standard:5.0"
    type         = "LINUX_CONTAINER"

    environment_variable {
      name  = "<SENSITIVE_VAR_NAME>"
      type  = "SECRETS_MANAGER"  # CRITICAL: use Secrets Manager so value isn't plaintext
      value = "<example_secret_name>"
    }
  }
}

NativeIaC

Resources:
  <example_resource_name>:
    Type: AWS::CodeBuild::Project
    Properties:
      Name: <example_resource_name>
      ServiceRole: <example_resource_arn>
      Source:
        Type: NO_SOURCE
      Artifacts:
        Type: NO_ARTIFACTS
      Environment:
        Type: LINUX_CONTAINER
        ComputeType: BUILD_GENERAL1_SMALL
        Image: aws/codebuild/standard:5.0
        EnvironmentVariables:
          - Name: <SENSITIVE_VAR_NAME>
            Type: SECRETS_MANAGER  # CRITICAL: store secret in Secrets Manager to avoid PLAINTEXT
            Value: <example_secret_name>  # Secret name or ARN (optionally include json-key)

Other

1In AWS Console, go to CodeBuild > Build projects and open your project
2Click Edit in the Environment section
3Under Environment variables, for each sensitive variable with Type = Plaintext, change Type to Secrets Manager (or Parameter store)
4Select the secret (or parameter) that holds the value, then Save
5If the secret/parameter does not exist, create it in Secrets Manager or Systems Manager Parameter Store first, then repeat steps 3-4

Check Code

import json

from prowler.lib.check.models import Check, Check_Report_AWS
from prowler.lib.utils.utils import (
    SecretsScanError,
    annotate_verified_secrets,
    detect_secrets_scan_batch,
)
from prowler.providers.aws.services.codebuild.codebuild_client import codebuild_client


class codebuild_project_no_secrets_in_variables(Check):
    def execute(self):
        findings = []
        sensitive_vars_excluded = codebuild_client.audit_config.get(
            "excluded_sensitive_environment_variables", []
        )
        secrets_ignore_patterns = codebuild_client.audit_config.get(
            "secrets_ignore_patterns", []
        )
        validate = codebuild_client.audit_config.get("secrets_validate", False)
        projects = list(codebuild_client.projects.values())

        # Collect every scannable plaintext variable across all projects and scan
        # them in batched Kingfisher invocations instead of one subprocess per
        # variable. Findings are keyed by (project index, variable index).
        def payloads():
            for project_index, project in enumerate(projects):
                if project.environment_variables:
                    for var_index, env_var in enumerate(project.environment_variables):
                        if (
                            env_var.type == "PLAINTEXT"
                            and env_var.name not in sensitive_vars_excluded
                        ):
                            yield (project_index, var_index), json.dumps(
                                {env_var.name: env_var.value}
                            )

        scan_error = None
        try:
            batch_results = detect_secrets_scan_batch(
                payloads(), excluded_secrets=secrets_ignore_patterns, validate=validate
            )
        except SecretsScanError as error:
            batch_results = {}
            scan_error = error

        for project_index, project in enumerate(projects):
            report = Check_Report_AWS(metadata=self.metadata(), resource=project)
            report.status = "PASS"
            report.status_extended = f"CodeBuild project {project.name} does not have sensitive environment plaintext credentials."
            secrets_found = []
            all_secrets = []

            if scan_error and any(
                env_var.type == "PLAINTEXT"
                and env_var.name not in sensitive_vars_excluded
                for env_var in project.environment_variables or []
            ):
                report.status = "MANUAL"
                report.status_extended = (
                    f"Could not scan CodeBuild project {project.name} environment "
                    f"variables for secrets: {scan_error}; manual review is required."
                )
                findings.append(report)
                continue

            if project.environment_variables:
                for var_index, env_var in enumerate(project.environment_variables):
                    detect_secrets_output = batch_results.get(
                        (project_index, var_index)
                    )
                    if detect_secrets_output:
                        all_secrets.extend(detect_secrets_output)
                        secrets_found.extend(
                            [
                                f"{secret['type']} in variable {env_var.name}"
                                for secret in detect_secrets_output
                            ]
                        )

            if secrets_found:
                report.status = "FAIL"
                report.status_extended = f"CodeBuild project {project.name} has sensitive environment plaintext credentials in variables: {', '.join(secrets_found)}."
                annotate_verified_secrets(report, all_secrets)

            findings.append(report)

        return findings

References