Check ID:
Provider: AWS
Service:
Severity: HIGH
Categories:
Resource type:
codebuild_project_uses_allowed_github_organizationsProvider: AWS
Service:
codebuildSeverity: HIGH
Categories:
software-supply-chain, ci-cdResource type:
AwsCodeBuildProjectWhat this check verifies
CodeBuild projects sourcing from GitHub/GitHub Enterprise with a service role that trusts CodeBuild are evaluated by deriving the repository’s organization from its URL and comparing it to an allowed organizations list.Risk
Using repos from untrusted GitHub orgs can let external workflows assume the project role and obtain AWS credentials.- Confidentiality: data/secrets exfiltration
- Integrity: unauthorized changes
- Availability: build abuse or service disruption
Recommendation
Limit sources to approved GitHub organizations via an explicit allowlist. Enforce least privilege on the CodeBuild service role and avoid admin rights. Apply separation of duties for allowlist changes and add defense in depth (branch protections, reviews, monitoring) to prevent workflow abuse.Remediation
- CLI
- Terraform
- Native IaC
- Dashboard steps
References
- https://medium.com/@adan.alvarez/gaining-long-term-aws-access-with-codebuild-and-github-873324638784
- https://paul-hands-phd.medium.com/using-aws-codebuild-to-set-up-github-continuous-integration-19b92efbd094
- https://docs.aws.amazon.com/codebuild/latest/userguide/connections-github-app.html
- https://docs.aws.amazon.com/codebuild/latest/userguide/auth-and-access-control-iam-identity-based-access-control.html
Where this check fires
This check runs on every scheduled scan against your AWS account. Findings appear at Cloud Security → Findings filterable byCheck ID = codebuild_project_uses_allowed_github_organizations. To re-evaluate after a fix, hit Run now on the account’s schedule under Cloud Security → Schedules — the next scan re-checks this control and marks the finding fixed or keeps it persistent.
← Back to AWS checks