Check ID: codebuild_project_no_secrets_in_variables
Provider: AWS
Service: codebuild
Severity: CRITICAL
Categories: secrets, ci-cd
Resource type: AwsCodeBuildProject

​
What this check verifies

AWS CodeBuild projects are inspected for plaintext environment variables (PLAINTEXT) that resemble secrets (keys, tokens, passwords). Such values indicate sensitive data is stored directly in environment variables instead of being sourced securely.

​
Risk

Plaintext secrets in environment variables reduce confidentiality: values can be viewed in consoles/CLI and may leak into build logs or public outputs. Compromised credentials enable unauthorized AWS actions, artifact tampering, and lateral movement, causing data exfiltration and CI/CD supply-chain compromise.

​
Recommendation

Store secrets outside the build and reference them via AWS Secrets Manager or AWS Systems Manager Parameter Store instead of PLAINTEXT variables.
  • Enforce least privilege on the build role
  • Rotate secrets; prefer short-lived credentials
  • Avoid logging or exporting secret values and never embed them in artifacts

​
Remediation

resource "aws_codebuild_project" "<example_resource_name>" {
  name         = "<example_resource_name>"
  service_role = "<example_resource_arn>"

  source {
    type = "NO_SOURCE"
  }

  artifacts {
    type = "NO_ARTIFACTS"
  }

  environment {
    compute_type = "BUILD_GENERAL1_SMALL"
    image        = "aws/codebuild/standard:5.0"
    type         = "LINUX_CONTAINER"

    environment_variable {
      name  = "<SENSITIVE_VAR_NAME>"
      type  = "SECRETS_MANAGER"  # CRITICAL: use Secrets Manager so value isn't plaintext
      value = "<example_secret_name>"
    }
  }
}

​
References

​
Where this check fires

This check runs on every scheduled scan against your AWS account. Findings appear at Cloud Security → Findings filterable by Check ID = codebuild_project_no_secrets_in_variables. To re-evaluate after a fix, hit Run now on the account’s schedule under Cloud Security → Schedules — the next scan re-checks this control and marks the finding fixed or keeps it persistent.
← Back to AWS checks