Check ID: codebuild_project_source_repo_url_no_sensitive_credentials
Provider: AWS
Service: codebuild
Severity: CRITICAL
Categories: secrets
Resource type: AwsCodeBuildProject

​
What this check verifies

AWS CodeBuild projects with Bitbucket sources are assessed to confirm repository URLs do not embed credentials (for example, x-token-auth:<token>@ or user:password@). The assessment includes both the primary source and all secondary sources.

​
Risk

Credentials in URLs are plainly exposed in configs and logs, enabling unauthorized repo access. This can lead to:
  • Source code theft (C)
  • Malicious commits/CI changes (I)
  • Supply-chain compromise and lateral movement via token reuse

​
Recommendation

Use OAuth/CodeStar Connections or store tokens in Secrets Manager/SSM, never in the URL. Enforce least privilege, scope to needed repos, set short lifetimes, and rotate regularly. Audit configs and logs to remove leaked secrets. Apply to primary and secondary sources.

​
Remediation

resource "aws_codebuild_project" "<example_resource_name>" {
  name         = "<example_resource_name>"
  service_role = "<example_role_arn>"

  artifacts {
    type = "NO_ARTIFACTS"
  }

  environment {
    compute_type = "BUILD_GENERAL1_SMALL"
    image        = "aws/codebuild/standard:5.0"
    type         = "LINUX_CONTAINER"
  }

  source {
    type     = "BITBUCKET"
    location = "https://bitbucket.org/<example_owner>/<example_repo>.git" # FIX: sanitized URL without credentials
    # Removing credentials from the URL prevents sensitive data exposure
  }
}

​
References

​
Where this check fires

This check runs on every scheduled scan against your AWS account. Findings appear at Cloud Security → Findings filterable by Check ID = codebuild_project_source_repo_url_no_sensitive_credentials. To re-evaluate after a fix, hit Run now on the account’s schedule under Cloud Security → Schedules — the next scan re-checks this control and marks the finding fixed or keeps it persistent.
← Back to AWS checks