Back to Checks
aws

CodeBuild project source repository URLs do not contain sensitive credentials

codebuild_project_source_repo_url_no_sensitive_credentials
Service: codebuildSeverity: critical
OfficialBuilt-inVerified
Categories:secrets
Resource Type:AwsCodeBuildProject

AWS CodeBuild projects with Bitbucket sources are assessed to confirm repository URLs do not embed credentials (for example, x-token-auth:<token>@ or user:password@). The assessment includes both the primary source and all secondary sources.

Prowler logoProwlerprowler-provider-aws

Risk

Credentials in URLs are plainly exposed in configs and logs, enabling unauthorized repo access. This can lead to:

  • Source code theft (C)
  • Malicious commits/CI changes (I)
  • Supply-chain compromise and lateral movement via token reuse

Run this check with Prowler

Run in Prowler Cloud
Run
prowler aws --checks codebuild_project_source_repo_url_no_sensitive_credentials

Recommendation

Use OAuth/CodeStar Connections or store tokens in Secrets Manager/SSM, never in the URL. Enforce least privilege, scope to needed repos, set short lifetimes, and rotate regularly. Audit configs and logs to remove leaked secrets. Apply to primary and secondary sources.

Remediation

Terraform

resource "aws_codebuild_project" "<example_resource_name>" {
  name         = "<example_resource_name>"
  service_role = "<example_role_arn>"

  artifacts {
    type = "NO_ARTIFACTS"
  }

  environment {
    compute_type = "BUILD_GENERAL1_SMALL"
    image        = "aws/codebuild/standard:5.0"
    type         = "LINUX_CONTAINER"
  }

  source {
    type     = "BITBUCKET"
    location = "https://bitbucket.org/<example_owner>/<example_repo>.git" # FIX: sanitized URL without credentials
    # Removing credentials from the URL prevents sensitive data exposure
  }
}

NativeIaC

Resources:
  <example_resource_name>:
    Type: AWS::CodeBuild::Project
    Properties:
      Name: <example_resource_name>
      ServiceRole: <example_role_arn>
      Artifacts:
        Type: NO_ARTIFACTS
      Environment:
        Type: LINUX_CONTAINER
        Image: aws/codebuild/standard:5.0
        ComputeType: BUILD_GENERAL1_SMALL
      Source:
        Type: BITBUCKET
        Location: https://bitbucket.org/<example_owner>/<example_repo>.git  # FIX: remove embedded credentials; keep only the repo URL
        # This removes tokens/user:pass from the URL, eliminating exposed secrets

Other

1In the AWS Console, go to CodeBuild and open your project
2Click Edit > Source
3Replace the repository URL with only the Bitbucket path (no credentials):
4- https://bitbucket.org/<workspace>/<repo>.git
5If prompted for access, choose Connect using OAuth and authorize Bitbucket
6Save changes
7If you use Secondary sources, edit each one and remove any embedded credentials from their URLs

Check Code

import re

from prowler.lib.check.models import Check, Check_Report_AWS
from prowler.providers.aws.services.codebuild.codebuild_client import codebuild_client


class codebuild_project_source_repo_url_no_sensitive_credentials(Check):
    def execute(self):
        findings = []
        token_pattern = re.compile(r"https://x-token-auth:[^@]+@bitbucket\.org/.+\.git")
        user_pass_pattern = re.compile(r"https://[^:]+:[^@]+@bitbucket\.org/.+\.git")
        for project in codebuild_client.projects.values():
            report = Check_Report_AWS(metadata=self.metadata(), resource=project)
            report.status = "PASS"
            report.status_extended = f"CodeBuild project {project.name} does not contain sensitive credentials in any source repository URLs."
            secrets_found = []

            if project.source and project.source.type == "BITBUCKET":
                if token_pattern.match(project.source.location):
                    secrets_found.append(
                        f"Token in {project.source.type} URL {project.source.location}"
                    )
                elif user_pass_pattern.match(project.source.location):
                    secrets_found.append(
                        f"Basic Auth Credentials in {project.source.type} URL {project.source.location}"
                    )
            for url in project.secondary_sources:
                if url.type == "BITBUCKET":
                    if token_pattern.match(url.location):
                        secrets_found.append(f"Token in {url.type} URL {url.location}")
                    elif user_pass_pattern.match(url.location):
                        secrets_found.append(
                            f"Basic Auth Credentials in {url.type} URL {url.location}"
                        )
            if secrets_found:
                report.status = "FAIL"
                report.status_extended = f"CodeBuild project {project.name} has sensitive credentials in source repository URLs: {', '.join(secrets_found)}."

            findings.append(report)

        return findings

References