Back to Checks
aws

CodeBuild project has been invoked in the last 90 days

codebuild_project_older_90_days
Service: codebuildSeverity: medium
OfficialBuilt-inVerified
Categories:ci-cd
Resource Type:AwsCodeBuildProject

AWS CodeBuild projects are assessed for recent activity using the last build invocation timestamp. Projects not invoked within 90 days or never built are treated as inactive.

Prowler logoProwlerprowler-provider-aws

Risk

Inactive projects increase attack surface. Dormant webhooks or source credentials can be abused, and attached IAM roles may retain excessive permissions. Stale configs can expose secrets in env vars or logs, threatening build integrity and data confidentiality, while adding avoidable cost and operational sprawl.

Run this check with Prowler

Run in Prowler Cloud
Run
prowler aws --checks codebuild_project_older_90_days

Recommendation

Implement lifecycle management: review projects idle over 90 days, confirm ownership and need, then delete or archive. Revoke unused webhooks, tokens, and service roles; rotate any secrets. Enforce least privilege, tagging, and periodic audits to reduce attack surface and keep the build environment tidy and defensible.

Remediation

Other

1Open the AWS Console and go to CodeBuild
2In Build projects, select the project
3Click Start build, then confirm Start build
4Wait for the build to start to update the last invoked time

Check Code

from datetime import datetime, timezone

from prowler.lib.check.models import Check, Check_Report_AWS
from prowler.providers.aws.services.codebuild.codebuild_client import codebuild_client


class codebuild_project_older_90_days(Check):
    def execute(self):
        findings = []
        for project in codebuild_client.projects.values():
            report = Check_Report_AWS(metadata=self.metadata(), resource=project)
            report.status = "PASS"
            report.status_extended = f"CodeBuild project {project.name} has been invoked in the last 90 days."
            if project.last_invoked_time:
                if (datetime.now(timezone.utc) - project.last_invoked_time).days > 90:
                    report.status = "FAIL"
                    report.status_extended = f"CodeBuild project {project.name} has not been invoked in the last 90 days."
            else:
                report.status = "FAIL"
                report.status_extended = (
                    f"CodeBuild project {project.name} has never been built."
                )

            findings.append(report)

        return findings

References