> ## Documentation Index > Fetch the complete documentation index at: https://cloudanix.com/docs/llms.txt > Use this file to discover all available pages before exploring further. # Codebuild project restrict cred in environment remediation ### Triage and Remediation ### Remediation To remediate “Plaintext AWS Credentials In Environment Variables” for an AWS CodeBuild project using the AWS Console: 1. **Open the CodeBuild project** * Sign in to the **AWS Management Console**. * Go to **CodeBuild**. * In **Build projects**, click the relevant **project name**. 2. **Edit environment settings** * On the project detail page, choose **Edit** (top right). * Scroll to the **Environment** section. * Under **Environment variables**, identify any variables that contain: * `AWS_ACCESS_KEY_ID` * `AWS_SECRET_ACCESS_KEY` * `AWS_SESSION_TOKEN` * Or any other credentials / secrets in plain text. 3. **Remove plaintext AWS credentials** * For each environment variable that contains an AWS key or secret in **Plaintext**: * Click the **trash bin** icon to delete it **or** * If you must keep a variable name, clear the plaintext value and plan to replace it with a secure reference (Secrets Manager/Parameter Store). 4. **Use IAM roles instead of access keys (preferred)** * In the same **Environment** section, under **Service role**, ensure that: * The CodeBuild project has an appropriate **service role** (e.g., `codebuild-your-project-service-role`) with required permissions attached. * If needed, open the role in **IAM** (link next to role name) and: * Attach or adjust IAM policies to grant the build the permissions it needs. * With a correctly configured service role, you no longer need `AWS_ACCESS_KEY_ID` / `AWS_SECRET_ACCESS_KEY` in environment variables. 5. **(Optional) Use secure environment variables via Secrets Manager or Parameter Store** If you must keep non-AWS secrets (e.g., API keys, passwords): * **Create secret/parameter first**: * For **Secrets Manager**: * Go to **AWS Secrets Manager** → **Store a new secret**. * Add your secret value. * Note the **Secret name**. * For **Systems Manager Parameter Store**: * Go to **Systems Manager** → **Parameter Store** → **Create parameter**. * Type: **SecureString**, put your secret value. * Note the **Parameter name** (e.g. `/myapp/DB_PASSWORD`). * **Reference it in CodeBuild**: * Back in the CodeBuild project **Edit** page → **Environment** → **Environment variables**. * Click **Add environment variable**. * Set: * **Name**: the variable name (e.g., `DB_PASSWORD`). * **Type**: * **Parameter** (for Parameter Store) or * **Secrets Manager** (for Secrets Manager). * **Value**: * For Parameter Store: the **parameter name** (e.g., `/myapp/DB_PASSWORD`). * For Secrets Manager: the **secret name** or ARN. * Ensure the CodeBuild **service role** has permissions to access: * `ssm:GetParameter` (and `Decrypt`) for Parameter Store, or * `secretsmanager:GetSecretValue` for Secrets Manager. 6. **Save the changes** * Scroll down and click **Update environment** (if shown), then **Save** or **Update** at the bottom of the page. 7. **Verify** * Start a **new build** of the project. * Check **Build logs** to confirm: * No credentials are being echoed or logged. * The build still has the required access via IAM role or secure secrets references. This removes plaintext AWS credentials from CodeBuild environment variables and replaces them with the proper, least-privilege IAM role and secure secret storage. Below are concise, CLI-focused steps to remediate plaintext AWS credentials in AWS CodeBuild project environment variables. *** ## 1. Identify Projects With Plaintext Credentials Check your CodeBuild projects’ environment variables for `AWS_ACCESS_KEY_ID`, `AWS_SECRET_ACCESS_KEY`, etc. ```bash theme={null} # List all projects aws codebuild list-projects # For each project, inspect environment variables aws codebuild batch-get-projects \ --names MyProjectName ``` Look in `.projects[0].environment.environmentVariables` for any plaintext AWS creds or other secrets. *** ## 2. Decide the Correct Remediation Pattern Prefer **IAM role** over environment credentials: * Let the CodeBuild **service role** or an attached **instance role** have the necessary permissions. * For non-AWS secrets, use **SSM Parameter Store** or **Secrets Manager** with `type=PARAMETER_STORE` or `SECRETS_MANAGER`. You must first: * Create/identify an IAM role with proper permissions, and ensure CodeBuild uses it (`serviceRole`). * Or store secrets in SSM/Secrets Manager and grant CodeBuild role permission to read them. *** ## 3. Remove Plaintext AWS Credentials From Environment 1. Get the existing project configuration: ```bash theme={null} aws codebuild batch-get-projects \ --names MyProjectName \ --query 'projects[0]' > project.json ``` 2. Edit `project.json`: * Remove any environment variables like: * `AWS_ACCESS_KEY_ID` * `AWS_SECRET_ACCESS_KEY` * `AWS_SESSION_TOKEN` * Any other hardcoded credentials. * Keep the structure under `"environment"` the same. * Do **not** touch required fields (name, source, artifacts, serviceRole, etc.) other than editing/removing env vars. Example environment section **before**: ```json theme={null} "environment": { "type": "LINUX_CONTAINER", "image": "aws/codebuild/standard:7.0", "computeType": "BUILD_GENERAL1_SMALL", "environmentVariables": [ { "name": "AWS_ACCESS_KEY_ID", "value": "AKIA..." }, { "name": "AWS_SECRET_ACCESS_KEY", "value": "abc123..." }, { "name": "OTHER_VAR", "value": "some-value" } ], "privilegedMode": false } ``` Example **after** (remove the credential vars): ```json theme={null} "environment": { "type": "LINUX_CONTAINER", "image": "aws/codebuild/standard:7.0", "computeType": "BUILD_GENERAL1_SMALL", "environmentVariables": [ { "name": "OTHER_VAR", "value": "some-value" } ], "privilegedMode": false } ``` 3. Update the project using the modified JSON: ```bash theme={null} aws codebuild update-project \ --name MyProjectName \ --source "$(jq '.source' project.json)" \ --artifacts "$(jq '.artifacts' project.json)" \ --environment "$(jq '.environment' project.json)" \ --service-role "$(jq -r '.serviceRole' project.json)" \ --description "$(jq -r '.description // empty' project.json)" \ --timeout-in-minutes "$(jq -r '.timeoutInMinutes // 60' project.json)" \ --queued-timeout-in-minutes "$(jq -r '.queuedTimeoutInMinutes // 480' project.json)" \ --cache "$(jq '.cache // {}' project.json)" \ --encryption-key "$(jq -r '.encryptionKey // empty' project.json)" \ --badge-enabled "$(jq -r '.badge.badgeEnabled // false' project.json)" \ --logs-config "$(jq '.logsConfig // {}' project.json)" \ --vpc-config "$(jq '.vpcConfig // {}' project.json)" ``` Adjust fields to match what exists in `project.json`; omit any args your project doesn’t use. *** ## 4. (Optional) Replace With Secure References If you still need to pass non-AWS secrets to the build: ### Using SSM Parameter Store 1. Store secret: ```bash theme={null} aws ssm put-parameter \ --name "/MyApp/DbPassword" \ --value "SuperSecretPassword" \ --type "SecureString" ``` 2. Grant CodeBuild role access (`ssm:GetParameter` on that parameter). 3. Add a parameter store env var (edit `project.json` again): ```json theme={null} "environmentVariables": [ { "name": "DB_PASSWORD", "value": "/MyApp/DbPassword", "type": "PARAMETER_STORE" } ] ``` 4. Re-run `aws codebuild update-project` as above. ### Using Secrets Manager 1. Create secret: ```bash theme={null} aws secretsmanager create-secret \ --name "MyApp/DbCredentials" \ --secret-string '{"username":"dbuser","password":"SuperSecretPassword"}' ``` 2. Grant CodeBuild role `secretsmanager:GetSecretValue` on that secret. 3. Add env var with `type=SECRETS_MANAGER`. *** ## 5. Verify Run a build and confirm: * No plaintext AWS credentials appear in: * Project configuration * Build logs * CloudTrail `StartBuild` events’ environment variables. * Build still succeeds, and IAM role/secret references are functioning. To remediate this, you must **remove plaintext credentials from the CodeBuild environment** and instead **pull them securely at runtime** (e.g., from IAM role, Secrets Manager, or SSM Parameter Store). Below are step-by-step instructions, including Python (boto3) examples. *** ## 1. Understand what “plaintext credentials” means in CodeBuild In CodeBuild, this is **bad**: * Environment variable type: `PLAINTEXT` * Name: `AWS_ACCESS_KEY_ID`, `AWS_SECRET_ACCESS_KEY`, etc. * Value: literal credential string You want **no static AWS keys in environment variables** at all. *** ## 2. Prefer IAM role over any stored credentials First choice: let CodeBuild’s **service role** have permissions to what the build needs.\ Then your build just uses the normal AWS SDK with no keys in env vars. 1. Go to **IAM → Roles**. 2. Find the role used by your CodeBuild project (shown under the project’s **Service role**). 3. Attach or adjust a policy to allow the resources/actions it needs (e.g., S3, ECR, etc.). 4. In your buildspec/code, do not set any AWS credentials. Just use the SDK normally. No Python code change needed other than removing explicit credential usage. *** ## 3. If you must store secrets: use Secrets Manager or SSM If (for some reason) you need non-IAM secrets (API keys, passwords, etc.): ### 3.1 Store the secret Example with Secrets Manager: ```bash theme={null} aws secretsmanager create-secret \ --name my/api/secret \ --secret-string '{"api_key":"YOUR_API_KEY"}' ``` Give the CodeBuild role permission to read this secret: ```json theme={null} { "Effect": "Allow", "Action": ["secretsmanager:GetSecretValue"], "Resource": "arn:aws:secretsmanager:REGION:ACCOUNT_ID:secret:my/api/secret-*" } ``` *** ## 4. Remove plaintext environment variables from the CodeBuild project ### 4.1 Using the AWS Console 1. Go to **CodeBuild → Build projects → Your project**. 2. Click **Edit**. 3. Under **Environment → Additional configuration → Environment variables**: * Delete any variables like `AWS_ACCESS_KEY_ID`, `AWS_SECRET_ACCESS_KEY`, etc. of type `Plaintext`. 4. Save. *** ### 4.2 Using Python (boto3) to remove/redesign env vars This example: * Fetches the project config * Filters out sensitive plaintext variables * Optionally replaces them with references to SSM/Secrets Manager (type `PARAMETER_STORE` or `SECRETS_MANAGER`) ```python theme={null} import boto3 codebuild = boto3.client("codebuild") project_name = "your-project-name" # 1. Get current project configuration resp = codebuild.batch_get_projects(names=[project_name]) project = resp["projects"][0] env = project["environment"] current_env_vars = env.get("environmentVariables", []) # 2. Filter out plaintext AWS credentials SENSITIVE_NAMES = { "AWS_ACCESS_KEY_ID", "AWS_SECRET_ACCESS_KEY", "AWS_SESSION_TOKEN", "AWS_SECURITY_TOKEN", } new_env_vars = [ v for v in current_env_vars if not (v["type"] == "PLAINTEXT" and v["name"] in SENSITIVE_NAMES) ] # OPTIONAL: add secure references instead of plaintext values # Example: pulling an API key from Secrets Manager # new_env_vars.append({ # "name": "MY_API_SECRET", # "value": "arn:aws:secretsmanager:REGION:ACCOUNT_ID:secret:my/api/secret-XXXX", # "type": "SECRETS_MANAGER" # }) env["environmentVariables"] = new_env_vars # 3. Call update_project with modified environment update_args = { "name": project_name, "description": project.get("description"), "source": project["source"], "artifacts": project["artifacts"], "environment": env, "serviceRole": project["serviceRole"], } # Preserve optional keys if present optional_keys = [ "vpcConfig", "timeoutInMinutes", "queuedTimeoutInMinutes", "badgeEnabled", "logsConfig", "cache", "fileSystemLocations", "buildBatchConfig", "concurrentBuildLimit", "encryptionKey", "secondarySources", "secondaryArtifacts", "sourceVersion" ] for k in optional_keys: if k in project: update_args[k] = project[k] codebuild.update_project(**update_args) print("Updated project; plaintext AWS credentials removed from environment variables.") ``` *** ## 5. Accessing secrets or AWS from your build (Python example) ### 5.1 Using IAM role (no env vars) `buildspec.yml` example: ```yaml theme={null} version: 0.2 phases: install: commands: - pip install boto3 build: commands: - python build_script.py ``` `build_script.py`: ```python theme={null} import boto3 s3 = boto3.client("s3") # uses CodeBuild role automatically for b in s3.list_buckets()["Buckets"]: print(b["Name"]) ``` No credentials set anywhere. *** ### 5.2 Using Secrets Manager at runtime (if needed) `buildspec.yml`: ```yaml theme={null} version: 0.2 phases: install: commands: - pip install boto3 build: commands: - python build_script.py ``` `build_script.py`: ```python theme={null} import boto3 import json import os secret_arn = os.getenv("MY_API_SECRET") # set as SECRETS_MANAGER env var if needed secrets_client = boto3.client("secretsmanager") secret_value = secrets_client.get_secret_value(SecretId=secret_arn) secret_dict = json.loads(secret_value["SecretString"]) api_key = secret_dict["api_key"] print("Using API key (not printed here in real code).") ``` *** **Summary** 1. Remove all plaintext AWS credentials from CodeBuild environment variables (console or boto3). 2. Grant needed permissions via the CodeBuild IAM role. 3. For non-IAM secrets, use Secrets Manager or SSM and fetch them at runtime in your Python build code. ```hcl theme={null} resource "aws_codebuild_project" "THIS_PROJECT" { name = "REPLACE_WITH_PROJECT_NAME" service_role = aws_iam_role.codebuild_role.arn # Other existing configuration for the project goes here: # description = "..." # source { ... } # artifacts { ... } # vpc_config { ... } # logs_config { ... } # etc. environment { compute_type = "REPLACE_WITH_COMPUTE_TYPE" # e.g. BUILD_GENERAL1_SMALL image = "REPLACE_WITH_BUILD_IMAGE" # e.g. aws/codebuild/standard:7.0 type = "LINUX_CONTAINER" privileged_mode = false image_pull_credentials_type = "CODEBUILD" # KEEP ONLY NON-SENSITIVE ENV VARS HERE. # Any existing environment_variable blocks whose name was # "AWS_ACCESS_KEY_ID" or "AWS_SECRET_ACCESS_KEY" must be removed # from Terraform instead of being set to plaintext values. environment_variable { name = "EXAMPLE_NON_SENSITIVE_VAR" value = "EXAMPLE_VALUE" type = "PLAINTEXT" } # For secrets, prefer: # environment_variable { # name = "SECRET_FROM_SSM" # value = "REPLACE_WITH_SSM_PARAMETER_NAME" # type = "PARAMETER_STORE" # } # # or: # environment_variable { # name = "SECRET_FROM_SECRETS_MANAGER" # value = "REPLACE_WITH_SECRETS_MANAGER_SECRET_ID_OR_ARN" # type = "SECRETS_MANAGER" # } } } resource "aws_iam_role" "codebuild_role" { name = "REPLACE_WITH_CODEBUILD_ROLE_NAME" assume_role_policy = data.aws_iam_policy_document.codebuild_assume_role.json } data "aws_iam_policy_document" "codebuild_assume_role" { statement { actions = ["sts:AssumeRole"] principals { type = "Service" identifiers = ["codebuild.amazonaws.com"] } } } ``` This change does not force replacement of the `aws_codebuild_project` resource; it updates the existing project’s environment to remove any `environment_variable` blocks named `AWS_ACCESS_KEY_ID` or `AWS_SECRET_ACCESS_KEY`. Be careful to preserve all other needed environment variables when editing. Verification with `terraform plan` should show the `aws_codebuild_project` resource being updated, with the `environment[0].environment_variable` entries for `AWS_ACCESS_KEY_ID` and `AWS_SECRET_ACCESS_KEY` being removed and no other unintended changes.