Skip to main content

Privileged Mode Should Be Enabled CodeBuild Project

More Info:​

This rule verifies whether privileged mode is enabled for the environment of an AWS CodeBuild project. Enabling privileged mode allows the build container to access resources that are not accessible to non-privileged containers. Its important to carefully evaluate the need for privileged mode to prevent potential security vulnerabilities.

Risk Level​

Medium

Address​

Security

Compliance Standards​

  • APRA CPS 234 (Australia)
  • BSI C5 (Germany)
  • Brazil LGPD
  • CCPA / CPRA (California)
  • CIS Critical Security Controls v8
  • CMMC 2.0
  • CSA Cloud Controls Matrix v4
  • Cloudanix Best Practice
  • DPDPA
  • Digital Operational Resilience Act (EU)
  • Essential 8
  • ISO/IEC 27017
  • ISO/IEC 27018
  • ISO/IEC 27701
  • KSA PDPL
  • MAS Technology Risk Management (Singapore)
  • MITRE ATT&CK (Cloud)
  • NIST SP 800-171
  • NYDFS 23 NYCRR 500
  • SWIFT Customer Security Controls Framework
  • Sarbanes-Oxley IT General Controls
  • UK NCSC Cyber Assessment Framework

Triage and Remediation​

Remediation​

Using Console

To enable privileged mode for an AWS CodeBuild project using the AWS Management Console:

  1. Sign in to the AWS Console

  2. Open CodeBuild

    • In the top search bar, type CodeBuild and select CodeBuild from the results.

  3. Select the Project

    • In the left menu, click Build projects.
    • Find your project in the list and click the project name.

  4. Edit the Project

    • On the project details page, in the top right, click Edit.

  5. Go to Environment Settings

    • Scroll to the Environment section.
    • Look for the Additional configuration or directly visible environment options (AWS occasionally shifts the layout).

  6. Enable Privileged Mode

    • Find the checkbox Privileged (sometimes labeled “Enable this flag if you want to build Docker images or use the Docker daemon”).
    • Check Privileged to enable privileged mode.

  7. Save Changes

    • Scroll to the bottom of the page.
    • Click Update build project (or Save changes, depending on UI).

  8. Verify

    • After saving, reopen the project’s details page.
    • Confirm under Environment that Privileged mode is shown as Enabled.

You can now run builds that require Docker-in-Docker or access to the Docker daemon inside the build container.

Using CLI

To enable privileged mode on an existing AWS CodeBuild project via AWS CLI, you must update the project’s environment configuration and set privilegedMode to true.

1. Get the existing project configuration​

PROJECT_NAME="my-codebuild-project"

aws codebuild batch-get-projects \
  --names "$PROJECT_NAME" \
  > project.json

The file project.json will contain all current settings.

2. Extract the current environment block​

ENVIRONMENT_JSON=$(jq -r '.projects[0].environment' project.json)
echo "$ENVIRONMENT_JSON" | jq

You’ll see fields like type, image, computeType, environmentVariables, etc.

3. Modify environment to enable privilegedMode​

Use jq to add/set "privilegedMode": true:

UPDATED_ENVIRONMENT=$(echo "$ENVIRONMENT_JSON" \
  | jq '.privilegedMode = true')

4. Update the project with the modified environment​

You must pass all required environment fields back, not just privilegedMode.

aws codebuild update-project \
  --name "$PROJECT_NAME" \
  --environment "$UPDATED_ENVIRONMENT"

If you also need to preserve/update other fields (e.g., serviceRole, source, artifacts, etc.), you can supply them too, for example:

SERVICE_ROLE=$(jq -r '.projects[0].serviceRole' project.json)
DESCRIPTION=$(jq -r '.projects[0].description // empty' project.json)
SOURCE=$(jq -r '.projects[0].source' project.json)
ARTIFACTS=$(jq -r '.projects[0].artifacts' project.json)
CACHE=$(jq -r '.projects[0].cache' project.json)
TAGS=$(jq -r '.projects[0].tags' project.json)
VPC_CONFIG=$(jq -r '.projects[0].vpcConfig' project.json)

aws codebuild update-project \
  --name "$PROJECT_NAME" \
  --description "$DESCRIPTION" \
  --service-role "$SERVICE_ROLE" \
  --source "$SOURCE" \
  --artifacts "$ARTIFACTS" \
  --cache "$CACHE" \
  --environment "$UPDATED_ENVIRONMENT" \
  --vpc-config "$VPC_CONFIG" \
  --tags "$TAGS"

(Include only the parameters relevant to your project; some optional fields may be omitted if not in use.)

5. Verify privileged mode is enabled​

aws codebuild batch-get-projects \
  --names "$PROJECT_NAME" \
  | jq '.projects[0].environment.privilegedMode'

The output should be true.

Using Python

To remediate this, you need to update each affected CodeBuild project and set environment.privilegedMode = True using the CodeBuild API (via boto3 in Python).

Below is a minimal, complete example.

1. Install and configure boto3 (if not already)​

pip install boto3
aws configure   # configure credentials & region

2. Python script to enable privileged mode on one project​

import boto3

codebuild = boto3.client("codebuild")

PROJECT_NAME = "your-project-name"  # <-- change this

def enable_privileged_mode(project_name: str):
    # 1. Get existing project configuration
    resp = codebuild.batch_get_projects(names=[project_name])
    if not resp["projects"]:
        raise ValueError(f"Project '{project_name}' not found")

    project = resp["projects"][0]

    # 2. Prepare updated fields
    # Most fields are required when calling update_project,
    # so we copy the existing config and modify environment.privilegedMode.
    updated_environment = project["environment"].copy()
    updated_environment["privilegedMode"] = True

    # 3. Call update_project with all required parameters
    codebuild.update_project(
        name=project["name"],
        description=project.get("description"),
        source=project["source"],
        secondarySources=project.get("secondarySources", []),
        artifacts=project["artifacts"],
        secondaryArtifacts=project.get("secondaryArtifacts", []),
        cache=project.get("cache"),
        environment=updated_environment,
        serviceRole=project["serviceRole"],
        timeoutInMinutes=project.get("timeoutInMinutes"),
        queuedTimeoutInMinutes=project.get("queuedTimeoutInMinutes"),
        encryptionKey=project.get("encryptionKey"),
        tags=project.get("tags", []),
        vpcConfig=project.get("vpcConfig"),
        badgeEnabled=project.get("badge"]["badgeEnabled"] if "badge" in project else None,
        logsConfig=project.get("logsConfig"),
        fileSystemLocations=project.get("fileSystemLocations", []),
        buildBatchConfig=project.get("buildBatchConfig"),
        concurrentBuildLimit=project.get("concurrentBuildLimit"),
        visibility=project.get("visibility"),
        resourceAccessRole=project.get("resourceAccessRole"),
        buildTimeoutInMinutes=project.get("buildTimeoutInMinutes"),
        queuedTimeoutInMinutesOverride=project.get("queuedTimeoutInMinutesOverride")
    )

    print(f"Privileged mode enabled for project: {project_name}")

if __name__ == "__main__":
    enable_privileged_mode(PROJECT_NAME)

Note: Some optional parameters vary by SDK version; if any key is invalid in your environment, remove it from update_project. At minimum, you must pass name, source, artifacts, environment, and serviceRole.

3. Script to enable privileged mode for all projects that don’t have it​

import boto3

codebuild = boto3.client("codebuild")

def list_all_projects():
    names = []
    token = None
    while True:
        kwargs = {}
        if token:
            kwargs["nextToken"] = token
        resp = codebuild.list_projects(**kwargs)
        names.extend(resp.get("projects", []))
        token = resp.get("nextToken")
        if not token:
            break
    return names

def enable_privileged_on_all():
    project_names = list_all_projects()
    for chunk_start in range(0, len(project_names), 100):
        chunk = project_names[chunk_start:chunk_start + 100]
        projects_resp = codebuild.batch_get_projects(names=chunk)
        for project in projects_resp["projects"]:
            env = project["environment"]
            if env.get("privilegedMode"):
                continue  # already enabled

            env_updated = env.copy()
            env_updated["privilegedMode"] = True

            codebuild.update_project(
                name=project["name"],
                source=project["source"],
                artifacts=project["artifacts"],
                environment=env_updated,
                serviceRole=project["serviceRole"],
            )
            print(f"Enabled privilegedMode for {project['name']}")

if __name__ == "__main__":
    enable_privileged_on_all()

(Here we only use the minimum required fields to keep the example simple; add other fields as needed, following the first script.)

This will remediate the “Privileged Mode Should Be Enabled” finding by programmatically turning on privilegedMode for the CodeBuild project environment via Python.

Using Terraform
resource "aws_codebuild_project" "THIS_PROJECT" {
  name         = "CODEBUILD_PROJECT_NAME" # replace with your project name
  service_role = "CODEBUILD_SERVICE_ROLE_ARN" # replace with an IAM role ARN

  environment {
    compute_type                = "BUILD_GENERAL1_SMALL"
    image                       = "aws/codebuild/standard:7.0"
    type                        = "LINUX_CONTAINER"
    privileged_mode             = true          # enable privileged mode
    image_pull_credentials_type = "CODEBUILD"
  }

  source {
    type            = "GITHUB"
    location        = "REPO_CLONE_URL" # replace with your repo
    git_clone_depth = 1
  }

  artifacts {
    type = "NO_ARTIFACTS"
  }

  # ...any other arguments you already use...
}

This change updates the existing CodeBuild project in place; it does not force resource replacement. After editing, terraform plan should show an in-place update with privileged_mode changing from false (or omitted) to true for the environment block of aws_codebuild_project.THIS_PROJECT.

Additional Reading:​