Back to Checks
aws

CodeBuild project does not use a user-controlled buildspec file

codebuild_project_user_controlled_buildspec
Service: codebuildSeverity: medium
OfficialBuilt-inVerified
Categories:software-supply-chainci-cd
Resource Type:AwsCodeBuildProject

AWS CodeBuild projects are evaluated for use of a user-controlled buildspec, identified when the project references a repository file like *.yml or *.yaml. Projects using non file-based build instructions are treated as centrally managed.

Prowler logoProwlerprowler-provider-aws

Risk

Repository-controlled buildspecs let unreviewed changes run in CI, endangering integrity (tampered artifacts), confidentiality (secret leakage), and availability (resource abuse). Attackers can weaponize PRs to execute code and pivot via the build role.

Run this check with Prowler

Run in Prowler Cloud
Run
prowler aws --checks codebuild_project_user_controlled_buildspec

Recommendation

Adopt a centrally managed buildspec that contributors cannot modify.

  • Enforce protected branches and required reviews for build instructions
  • Apply least privilege to the build role and minimize secrets
  • Separate duties for pipeline admins vs code authors

Use vetted, versioned templates for defense in depth.

Remediation

Terraform

resource "aws_codebuild_project" "<example_resource_name>" {
  name         = "<example_resource_name>"
  service_role = "<example_role_arn>"

  artifacts {
    type = "NO_ARTIFACTS"
  }

  environment {
    compute_type = "BUILD_GENERAL1_SMALL"
    image        = "<IMAGE>"
    type         = "LINUX_CONTAINER"
  }

  source {
    type      = "CODEPIPELINE"
    buildspec = <<EOT
version: 0.2
EOT
    # Critical: Inline buildspec avoids using a user-controlled buildspec file
  }
}

NativeIaC

Resources:
  <example_resource_name>:
    Type: AWS::CodeBuild::Project
    Properties:
      ServiceRole: <example_role_arn>
      Artifacts:
        Type: NO_ARTIFACTS
      Environment:
        Type: LINUX_CONTAINER
        ComputeType: BUILD_GENERAL1_SMALL
        Image: <IMAGE>
      Source:
        Type: CODEPIPELINE
        BuildSpec: |  # Critical: Inline buildspec avoids using a user-controlled file path
          version: 0.2

Other

1In the AWS Console, go to CodeBuild > Projects and open the target project
2Click Edit
3In Source, under Buildspec, select Insert build commands (not Use a buildspec file)
4Paste minimal inline YAML:
5```
6version: 0.2
7```
8Save

Check Code

from re import search

from prowler.lib.check.models import Check, Check_Report_AWS
from prowler.providers.aws.services.codebuild.codebuild_client import codebuild_client


class codebuild_project_user_controlled_buildspec(Check):
    def execute(self):
        findings = []
        for project in codebuild_client.projects.values():
            report = Check_Report_AWS(metadata=self.metadata(), resource=project)
            report.status = "PASS"
            report.status_extended = f"CodeBuild project {project.name} does not use an user controlled buildspec."
            if project.buildspec:
                if search(r".*\.yaml$", project.buildspec) or search(
                    r".*\.yml$", project.buildspec
                ):
                    report.status = "FAIL"
                    report.status_extended = f"CodeBuild project {project.name} uses an user controlled buildspec."

            findings.append(report)

        return findings

References