Check ID:
Provider: AWS
Service:
Severity: HIGH
Categories:
Resource type:
codebuild_project_not_publicly_accessibleProvider: AWS
Service:
codebuildSeverity: HIGH
Categories:
internet-exposed, ci-cdResource type:
AwsCodeBuildProjectWhat this check verifies
AWS CodeBuild project visibility is assessed to identify projects exposed to the public. Projects withproject_visibility set to PUBLIC_READ (or not PRIVATE) allow anyone to access build results, logs, and artifacts.
Risk
Public visibility degrades CIA:- Logs may leak secrets, tokens, and source details
- Artifacts are downloadable, enabling tampering and supply-chain malware
- Adversaries gain CI/CD insights for reconnaissance and lateral movement
Recommendation
Set visibility toPRIVATE and share only with trusted principals using narrowly scoped policies. Apply least privilege to logs and artifacts, keeping them private. Manage secrets via Secrets Manager or Parameter Store, avoid printing them, and validate artifacts (e.g., checksums).
Remediation
- CLI
- Terraform
- Native IaC
- Dashboard steps
aws codebuild update-project-visibility —project-arn <PROJECT_ARN> —project-visibility PRIVATE
References
- https://docs.aws.amazon.com/codebuild/latest/userguide/public-builds.html
- https://docs.aws.amazon.com/cli/latest/reference/codebuild/update-project-visibility.html
Where this check fires
This check runs on every scheduled scan against your AWS account. Findings appear at Cloud Security → Findings filterable byCheck ID = codebuild_project_not_publicly_accessible. To re-evaluate after a fix, hit Run now on the account’s schedule under Cloud Security → Schedules — the next scan re-checks this control and marks the finding fixed or keeps it persistent.
← Back to AWS checks