Back to Checks
aws

CodeBuild project visibility is private

codebuild_project_not_publicly_accessible
Service: codebuildSeverity: high
OfficialBuilt-inVerified
Categories:internet-exposedci-cd
Resource Type:AwsCodeBuildProject

AWS CodeBuild project visibility is assessed to identify projects exposed to the public. Projects with project_visibility set to PUBLIC_READ (or not PRIVATE) allow anyone to access build results, logs, and artifacts.

Prowler logoProwlerprowler-provider-aws

Risk

Public visibility degrades CIA:

  • Logs may leak secrets, tokens, and source details
  • Artifacts are downloadable, enabling tampering and supply-chain malware
  • Adversaries gain CI/CD insights for reconnaissance and lateral movement

Run this check with Prowler

Run in Prowler Cloud
Run
prowler aws --checks codebuild_project_not_publicly_accessible

Recommendation

Set visibility to PRIVATE and share only with trusted principals using narrowly scoped policies. Apply least privilege to logs and artifacts, keeping them private. Manage secrets via Secrets Manager or Parameter Store, avoid printing them, and validate artifacts (e.g., checksums).

Remediation

CLI

aws codebuild update-project-visibility --project-arn <PROJECT_ARN> --project-visibility PRIVATE

Terraform

resource "aws_codebuild_project" "<example_resource_name>" {
  name         = "<example_resource_name>"
  service_role = "<example_role_arn>"

  artifacts { type = "NO_ARTIFACTS" }

  environment {
    compute_type = "BUILD_GENERAL1_SMALL"
    image        = "aws/codebuild/standard:5.0"
    type         = "LINUX_CONTAINER"
  }

  source { type = "NO_SOURCE" }

  project_visibility = "PRIVATE" # Critical: ensures the project is not publicly accessible
}

NativeIaC

Resources:
  <example_resource_name>:
    Type: AWS::CodeBuild::Project
    Properties:
      Name: <example_resource_name>
      ServiceRole: <example_role_arn>
      Artifacts:
        Type: NO_ARTIFACTS
      Environment:
        Type: LINUX_CONTAINER
        Image: aws/codebuild/standard:5.0
        ComputeType: BUILD_GENERAL1_SMALL
      Source:
        Type: NO_SOURCE
      Visibility: PRIVATE  # Critical: makes the project private so builds aren't publicly accessible

Other

1Open the AWS Console and go to CodeBuild
2Select your build project
3Click Edit
4Set Project visibility to Private
5Save changes

Check Code

from typing import List

from prowler.lib.check.models import Check, Check_Report_AWS
from prowler.providers.aws.services.codebuild.codebuild_client import codebuild_client


class codebuild_project_not_publicly_accessible(Check):
    def execute(self) -> List[Check_Report_AWS]:
        findings = []

        projects = codebuild_client.projects
        for arn, project in projects.items():
            report = Check_Report_AWS(self.metadata(), resource=project)
            report.resource_id = project.name
            report.resource_arn = arn
            report.region = project.region
            report.status = "FAIL"
            report.status_extended = f"CodeBuild project {project.name} is public."

            if project.project_visibility == "PRIVATE":
                report.status = "PASS"
                report.status_extended = f"CodeBuild project {project.name} is private."

            findings.append(report)

        return findings

References