CodePipeline source uses an authenticated private repo

Check ID: codepipeline_project_repo_private
Provider: AWS
Service: codepipeline
Severity: MEDIUM
Categories: software-supply-chain, secrets
Resource type: AwsCodePipelinePipeline

What this check verifies

CodePipeline pipeline should configure its source stage to use a private repository with authenticated connection rather than a public GitHub or GitLab repository. This ensures deployment configurations, build artifacts, and CI/CD logic remain protected from unauthorized access.

Risk

Using public repositories as pipeline sources exposes deployment configurations and CI/CD workflows to the internet, increasing risk of supply chain attacks, credential exposure, and intellectual property theft. Adversaries can inject malicious code or leverage exposed secrets to compromise production systems.

Recommendation

Configure CodePipeline source stages to use private repositories with AWS CodeStar Connections for GitHub or GitLab. Apply least privilege to connection permissions, enable branch protection, require code review, use signed commits, and monitor pipeline execution logs. Consider AWS CodeCommit for fully managed private Git hosting with native IAM integration.

Remediation

CLI
Terraform
Native IaC
Dashboard steps

aws codestar-connections create-connection —provider-type GitHub —connection-name my-github-connection aws codepipeline update-pipeline —pipeline file://pipeline-config.json

# Terraform: Configure pipeline with private repository via CodeStar Connection
resource "aws_codestarconnections_connection" "github" {
  name          = "my-github-connection"
  provider_type = "GitHub"  # or "GitLab"
}

resource "aws_codepipeline" "example" {
  name     = "my-pipeline"
  role_arn = aws_iam_role.codepipeline.arn

  stage {
    name = "Source"

    action {
      name             = "Source"
      category         = "Source"
      owner            = "AWS"
      provider         = "CodeStarSourceConnection"
      version          = "1"
      output_artifacts = ["source_output"]

      configuration = {
        ConnectionArn    = aws_codestarconnections_connection.github.arn
        FullRepositoryId = "myorg/myrepo"  # Private repository
        BranchName       = "main"
      }
    }
  }
}

# CloudFormation: Configure pipeline with private repository via CodeStar Connection
Resources:
  MyConnection:
    Type: AWS::CodeStarConnections::Connection
    Properties:
      ConnectionName: my-github-connection
      ProviderType: GitHub  # or GitLab

  MyPipeline:
    Type: AWS::CodePipeline::Pipeline
    Properties:
      Stages:
        - Name: Source
          Actions:
            - Name: SourceAction
              ActionTypeId:
                Category: Source
                Owner: AWS
                Provider: CodeStarSourceConnection
                Version: 1
              Configuration:
                ConnectionArn: !GetAtt MyConnection.ConnectionArn
                FullRepositoryId: myorg/myrepo  # Private repository
                BranchName: main

References

Where this check fires

This check runs on every scheduled scan against your AWS account. Findings appear at Cloud Security → Findings filterable by Check ID = codepipeline_project_repo_private. To re-evaluate after a fix, hit Run now on the account’s schedule under Cloud Security → Schedules — the next scan re-checks this control and marks the finding fixed or keeps it persistent.

← Back to AWS checks

CodeBuild report group exports to S3 are encrypted at rest Cognito identity pool has guest access disabled

​What this check verifies

​Risk

​Recommendation

​Remediation

​References

​Where this check fires

What this check verifies

Risk

Recommendation

Remediation

References

Where this check fires