CodeBuild project has been invoked in the last 90 days

​

What this check verifies

AWS CodeBuild projects are assessed for recent activity using the last build invocation timestamp. Projects not invoked within 90 days or never built are treated as inactive.

​

Risk

Inactive projects increase attack surface. Dormant webhooks or source credentials can be abused, and attached IAM roles may retain excessive permissions. Stale configs can expose secrets in env vars or logs, threatening build integrity and data confidentiality, while adding avoidable cost and operational sprawl.

​

Recommendation

Implement lifecycle management: review projects idle over 90 days, confirm ownership and need, then delete or archive. Revoke unused webhooks, tokens, and service roles; rotate any secrets. Enforce least privilege, tagging, and periodic audits to reduce attack surface and keep the build environment tidy and defensible.

​

Remediation

Dashboard steps

1. Open the AWS Console and go to CodeBuild
2. In Build projects, select the project
3. Click Start build, then confirm Start build
4. Wait for the build to start to update the last invoked time

​

References

• https://docs.aws.amazon.com/codebuild/latest/userguide/delete-project.html
• https://support.icompaas.com/support/solutions/articles/62000233684-ensure-codebuild-project-has-been-invoked-in-the-last-90-days

​

Where this check fires

This check runs on every scheduled scan against your AWS account. Findings appear at Cloud Security → Findings filterable by Check ID = codebuild_project_older_90_days. To re-evaluate after a fix, hit Run now on the account’s schedule under Cloud Security → Schedules — the next scan re-checks this control and marks the finding fixed or keeps it persistent.

---

← Back to AWS checks