Check ID: codebuild_project_not_publicly_accessible
Provider: AWS
Service: codebuild
Severity: HIGH
Categories: internet-exposed, ci-cd
Resource type: AwsCodeBuildProject

What this check verifies

AWS CodeBuild project visibility is assessed to identify projects exposed to the public. Projects with project_visibility set to PUBLIC_READ (or not PRIVATE) allow anyone to access build results, logs, and artifacts.

Risk

Public visibility degrades CIA:
  • Logs may leak secrets, tokens, and source details
  • Artifacts are downloadable, enabling tampering and supply-chain malware
  • Adversaries gain CI/CD insights for reconnaissance and lateral movement

Recommendation

Set visibility to PRIVATE and share only with trusted principals using narrowly scoped policies. Apply least privilege to logs and artifacts, keeping them private. Manage secrets via Secrets Manager or Parameter Store, avoid printing them, and validate artifacts (e.g., checksums).

Remediation

aws codebuild update-project-visibility —project-arn <PROJECT_ARN> —project-visibility PRIVATE

References

Where this check fires

This check runs on every scheduled scan against your AWS account. Findings appear at Cloud Security → Findings filterable by Check ID = codebuild_project_not_publicly_accessible. To re-evaluate after a fix, hit Run now on the account’s schedule under Cloud Security → Schedules — the next scan re-checks this control and marks the finding fixed or keeps it persistent.
← Back to AWS checks