Back to Checks
aws

CodeBuild project using GitHub uses an allowed GitHub organization

codebuild_project_uses_allowed_github_organizations
Service: codebuildSeverity: high
OfficialBuilt-inVerified
Categories:software-supply-chainci-cd
Resource Type:AwsCodeBuildProject

CodeBuild projects sourcing from GitHub/GitHub Enterprise with a service role that trusts CodeBuild are evaluated by deriving the repository's organization from its URL and comparing it to an allowed organizations list.

Prowler logoProwlerprowler-provider-aws

Risk

Using repos from untrusted GitHub orgs can let external workflows assume the project role and obtain AWS credentials.

  • Confidentiality: data/secrets exfiltration
  • Integrity: unauthorized changes
  • Availability: build abuse or service disruption

Run this check with Prowler

Run in Prowler Cloud
Run
prowler aws --checks codebuild_project_uses_allowed_github_organizations

Recommendation

Limit sources to approved GitHub organizations via an explicit allowlist. Enforce least privilege on the CodeBuild service role and avoid admin rights. Apply separation of duties for allowlist changes and add defense in depth (branch protections, reviews, monitoring) to prevent workflow abuse.

Remediation

CLI

aws codebuild update-project --name <example_resource_name> --source type=GITHUB,location=https://github.com/<ALLOWED_GITHUB_ORG>/<REPO>

Terraform

# Terraform: set CodeBuild source to a repo under an allowed GitHub org
resource "aws_codebuild_project" "<example_resource_name>" {
  name         = "<example_resource_name>"
  service_role = "<example_resource_arn>"

  artifacts { type = "NO_ARTIFACTS" }

  environment {
    compute_type = "BUILD_GENERAL1_SMALL"
    image        = "aws/codebuild/standard:7.0"
    type         = "LINUX_CONTAINER"
  }

  source {
    type     = "GITHUB"
    location = "https://github.com/<ALLOWED_GITHUB_ORG>/<REPO>" # FIX: use an allowed GitHub org
  }
}

NativeIaC

# CloudFormation: point CodeBuild project to a repo in an allowed GitHub org
Resources:
  <example_resource_name>:
    Type: AWS::CodeBuild::Project
    Properties:
      ServiceRole: <example_resource_arn>
      Artifacts:
        Type: NO_ARTIFACTS
      Environment:
        Type: LINUX_CONTAINER
        ComputeType: BUILD_GENERAL1_SMALL
        Image: aws/codebuild/standard:7.0
      Source:
        Type: GITHUB
        Location: https://github.com/<ALLOWED_GITHUB_ORG>/<REPO>  # FIX: repo org must be in the allowed list

Other

1Open the AWS Console and go to CodeBuild > Build projects
2Select the project and click Edit
3In Source, set Repository URL to https://github.com/<ALLOWED_GITHUB_ORG>/<REPO>
4Click Update to save

Check Code

from prowler.lib.check.models import Check, Check_Report_AWS
from prowler.providers.aws.services.codebuild.codebuild_client import codebuild_client
from prowler.providers.aws.services.iam.iam_client import iam_client
from prowler.providers.aws.services.iam.lib.policy import (
    has_codebuild_trusted_principal,
    is_codebuild_using_allowed_github_org,
)


class codebuild_project_uses_allowed_github_organizations(Check):
    def execute(self):
        findings = []
        allowed_organizations = codebuild_client.audit_config.get(
            "codebuild_github_allowed_organizations", []
        )

        for project in codebuild_client.projects.values():
            if project.source and project.source.type in (
                "GITHUB",
                "GITHUB_ENTERPRISE",
            ):
                project_github_repo_url = project.source.location
                project_role = next(
                    (
                        role
                        for role in iam_client.roles or []
                        if role.arn == project.service_role_arn
                    ),
                    None,
                )
                project_iam_trust_policy = (
                    project_role.assume_role_policy if project_role else None
                )

                if not project_iam_trust_policy or not has_codebuild_trusted_principal(
                    project_iam_trust_policy
                ):
                    continue

                report = Check_Report_AWS(metadata=self.metadata(), resource=project)
                report.status = "PASS"

                is_allowed, org_name = is_codebuild_using_allowed_github_org(
                    project_iam_trust_policy,
                    project_github_repo_url,
                    allowed_organizations,
                )
                if org_name is not None:
                    if is_allowed:
                        report.status_extended = f"CodeBuild project {project.name} uses GitHub organization '{org_name}', which is in the allowed organizations."
                    else:
                        report.status = "FAIL"
                        report.status_extended = f"CodeBuild project {project.name} uses GitHub organization '{org_name}', which is not in the allowed organizations."

                    findings.append(report)

        return findings

References