CodeBuild webhook filters use anchored regex patterns

Check ID: codebuild_project_webhook_filters_use_anchored_patterns
Provider: AWS
Service: codebuild
Severity: HIGH
Categories: software-supply-chain, ci-cd
Resource type: AwsCodeBuildProject

What this check verifies

AWS CodeBuild webhook filters using ACTOR_ACCOUNT_ID, HEAD_REF, or BASE_REF have regex patterns anchored with ^ (start) and $ (end) to enforce exact matching and prevent substring bypass attacks.

Risk

Unanchored patterns expose CI/CD pipelines to CodeBreach attacks. Attackers can bypass ACTOR_ACCOUNT_ID filters by creating GitHub accounts with IDs containing trusted values as substrings. Confidentiality: Credentials leaked via build logs. Integrity: Malicious code injected into builds. Availability: Resource exhaustion through unauthorized builds.

Recommendation

Anchor all webhook filter patterns with ^ (start) and $ (end) to enforce exact matching. For multiple values use: ^value1$|^value2$. This prevents attackers from bypassing filters using substring matches.

Remediation

CLI
Terraform
Native IaC
Dashboard steps

aws codebuild update-webhook --project-name <PROJECT_NAME> --filter-groups '[[{"type":"ACTOR_ACCOUNT_ID","pattern":"^123456$|^234567$"}]]'

resource "aws_codebuild_webhook" "example" {
  project_name = aws_codebuild_project.example.name
  filter_group {
    filter {
      type    = "ACTOR_ACCOUNT_ID"
      pattern = "^123456$|^234567$"  # Anchored pattern
    }
  }
}

AWSTemplateFormatVersion: '2010-09-09'
Resources:
  CodeBuildWebhook:
    Type: AWS::CodeBuild::Project
    Properties:
      Triggers:
        Webhook: true
        FilterGroups:
          - - Type: ACTOR_ACCOUNT_ID
              Pattern: '^123456$|^234567$'  # Anchored pattern

References

Where this check fires

This check runs on every scheduled scan against your AWS account. Findings appear at Cloud Security → Findings filterable by Check ID = codebuild_project_webhook_filters_use_anchored_patterns. To re-evaluate after a fix, hit Run now on the account’s schedule under Cloud Security → Schedules — the next scan re-checks this control and marks the finding fixed or keeps it persistent.

← Back to AWS checks

CodeBuild project uses an allowed GitHub organization CodeBuild report group exports to S3 are encrypted at rest

​What this check verifies

​Risk

​Recommendation

​Remediation

​References

​Where this check fires

What this check verifies

Risk

Recommendation

Remediation

References

Where this check fires