Check ID: codebuild_project_user_controlled_buildspec
Provider: AWS
Service: codebuild
Severity: MEDIUM
Categories: software-supply-chain, ci-cd
Resource type: AwsCodeBuildProject

​
What this check verifies

AWS CodeBuild projects are evaluated for use of a user-controlled buildspec, identified when the project references a repository file like *.yml or *.yaml. Projects using non file-based build instructions are treated as centrally managed.

​
Risk

Repository-controlled buildspecs let unreviewed changes run in CI, endangering integrity (tampered artifacts), confidentiality (secret leakage), and availability (resource abuse). Attackers can weaponize PRs to execute code and pivot via the build role.

​
Recommendation

Adopt a centrally managed buildspec that contributors cannot modify.
  • Enforce protected branches and required reviews for build instructions
  • Apply least privilege to the build role and minimize secrets
  • Separate duties for pipeline admins vs code authors
Use vetted, versioned templates for defense in depth.

​
Remediation

resource "aws_codebuild_project" "<example_resource_name>" {
  name         = "<example_resource_name>"
  service_role = "<example_role_arn>"

  artifacts {
    type = "NO_ARTIFACTS"
  }

  environment {
    compute_type = "BUILD_GENERAL1_SMALL"
    image        = "<IMAGE>"
    type         = "LINUX_CONTAINER"
  }

  source {
    type      = "CODEPIPELINE"
    buildspec = <<EOT
version: 0.2
EOT
    # Critical: Inline buildspec avoids using a user-controlled buildspec file
  }
}

​
References

​
Where this check fires

This check runs on every scheduled scan against your AWS account. Findings appear at Cloud Security → Findings filterable by Check ID = codebuild_project_user_controlled_buildspec. To re-evaluate after a fix, hit Run now on the account’s schedule under Cloud Security → Schedules — the next scan re-checks this control and marks the finding fixed or keeps it persistent.
← Back to AWS checks