> ## Documentation Index
> Fetch the complete documentation index at: https://cloudanix.com/docs/llms.txt
> Use this file to discover all available pages before exploring further.

# Plaintext AWS Credentials In Environment Variables CodeBuild Project Should Not Be Set

### More Info:

This rule checks AWS CodeBuild projects for environment variables that contain plaintext AWS credentials (AWS\_ACCESS\_KEY\_ID and AWS\_SECRET\_ACCESS\_KEY). Storing AWS credentials in plaintext within environment variables poses a significant security risk, as it can lead to unauthorized access if the credentials are exposed. It is recommended to use IAM roles or encrypted secrets management services like AWS Secrets Manager to handle credentials securely.

### Risk Level

High

### Address

Security

### Compliance Standards

* APRA CPS 234 (Australia)
* BSI C5 (Germany)
* Brazil LGPD
* CCPA / CPRA (California)
* CIS Critical Security Controls v8
* CMMC 2.0
* CSA Cloud Controls Matrix v4
* Cloudanix Best Practice
* DPDPA
* Digital Operational Resilience Act (EU)
* Essential 8
* ISO/IEC 27017
* ISO/IEC 27018
* ISO/IEC 27701
* KSA PDPL
* MAS Technology Risk Management (Singapore)
* MITRE ATT\&CK (Cloud)
* NIST SP 800-171
* NYDFS 23 NYCRR 500
* SWIFT Customer Security Controls Framework
* Sarbanes-Oxley IT General Controls
* UK NCSC Cyber Assessment Framework

### Triage and Remediation

<Tabs>
  <Tab title="Remediation">
    ### Remediation

    <AccordionGroup>
      <Accordion title="Using Console" defaultOpen="true">
        To remediate “Plaintext AWS Credentials In Environment Variables” for an AWS CodeBuild project using the AWS Console:

        1. **Open the CodeBuild project**
           * Sign in to the **AWS Management Console**.
           * Go to **CodeBuild**.
           * In **Build projects**, click the relevant **project name**.

        2. **Edit environment settings**
           * On the project detail page, choose **Edit** (top right).
           * Scroll to the **Environment** section.
           * Under **Environment variables**, identify any variables that contain:
             * `AWS_ACCESS_KEY_ID`
             * `AWS_SECRET_ACCESS_KEY`
             * `AWS_SESSION_TOKEN`
             * Or any other credentials / secrets in plain text.

        3. **Remove plaintext AWS credentials**
           * For each environment variable that contains an AWS key or secret in **Plaintext**:
             * Click the **trash bin** icon to delete it **or**
             * If you must keep a variable name, clear the plaintext value and plan to replace it with a secure reference (Secrets Manager/Parameter Store).

        4. **Use IAM roles instead of access keys (preferred)**
           * In the same **Environment** section, under **Service role**, ensure that:
             * The CodeBuild project has an appropriate **service role** (e.g., `codebuild-your-project-service-role`) with required permissions attached.
           * If needed, open the role in **IAM** (link next to role name) and:
             * Attach or adjust IAM policies to grant the build the permissions it needs.
           * With a correctly configured service role, you no longer need `AWS_ACCESS_KEY_ID` / `AWS_SECRET_ACCESS_KEY` in environment variables.

        5. **(Optional) Use secure environment variables via Secrets Manager or Parameter Store**
           If you must keep non-AWS secrets (e.g., API keys, passwords):

           * **Create secret/parameter first**:
             * For **Secrets Manager**:
               * Go to **AWS Secrets Manager** → **Store a new secret**.
               * Add your secret value.
               * Note the **Secret name**.
             * For **Systems Manager Parameter Store**:
               * Go to **Systems Manager** → **Parameter Store** → **Create parameter**.
               * Type: **SecureString**, put your secret value.
               * Note the **Parameter name** (e.g. `/myapp/DB_PASSWORD`).

           * **Reference it in CodeBuild**:
             * Back in the CodeBuild project **Edit** page → **Environment** → **Environment variables**.
             * Click **Add environment variable**.
             * Set:
               * **Name**: the variable name (e.g., `DB_PASSWORD`).
               * **Type**:
                 * **Parameter** (for Parameter Store) or
                 * **Secrets Manager** (for Secrets Manager).
               * **Value**:
                 * For Parameter Store: the **parameter name** (e.g., `/myapp/DB_PASSWORD`).
                 * For Secrets Manager: the **secret name** or ARN.
             * Ensure the CodeBuild **service role** has permissions to access:
               * `ssm:GetParameter` (and `Decrypt`) for Parameter Store, or
               * `secretsmanager:GetSecretValue` for Secrets Manager.

        6. **Save the changes**
           * Scroll down and click **Update environment** (if shown), then **Save** or **Update** at the bottom of the page.

        7. **Verify**
           * Start a **new build** of the project.
           * Check **Build logs** to confirm:
             * No credentials are being echoed or logged.
             * The build still has the required access via IAM role or secure secrets references.

        This removes plaintext AWS credentials from CodeBuild environment variables and replaces them with the proper, least-privilege IAM role and secure secret storage.
      </Accordion>

      <Accordion title="Using CLI">
        Below are concise, CLI-focused steps to remediate plaintext AWS credentials in AWS CodeBuild project environment variables.

        ***

        ## 1. Identify Projects With Plaintext Credentials

        Check your CodeBuild projects’ environment variables for `AWS_ACCESS_KEY_ID`, `AWS_SECRET_ACCESS_KEY`, etc.

        ```bash theme={null}
        # List all projects
        aws codebuild list-projects

        # For each project, inspect environment variables
        aws codebuild batch-get-projects \
          --names MyProjectName
        ```

        Look in `.projects[0].environment.environmentVariables` for any plaintext AWS creds or other secrets.

        ***

        ## 2. Decide the Correct Remediation Pattern

        Prefer **IAM role** over environment credentials:

        * Let the CodeBuild **service role** or an attached **instance role** have the necessary permissions.
        * For non-AWS secrets, use **SSM Parameter Store** or **Secrets Manager** with `type=PARAMETER_STORE` or `SECRETS_MANAGER`.

        You must first:

        * Create/identify an IAM role with proper permissions, and ensure CodeBuild uses it (`serviceRole`).
        * Or store secrets in SSM/Secrets Manager and grant CodeBuild role permission to read them.

        ***

        ## 3. Remove Plaintext AWS Credentials From Environment

        1. Get the existing project configuration:

        ```bash theme={null}
        aws codebuild batch-get-projects \
          --names MyProjectName \
          --query 'projects[0]' > project.json
        ```

        2. Edit `project.json`:
           * Remove any environment variables like:
             * `AWS_ACCESS_KEY_ID`
             * `AWS_SECRET_ACCESS_KEY`
             * `AWS_SESSION_TOKEN`
             * Any other hardcoded credentials.
           * Keep the structure under `"environment"` the same.
           * Do **not** touch required fields (name, source, artifacts, serviceRole, etc.) other than editing/removing env vars.

        Example environment section **before**:

        ```json theme={null}
        "environment": {
          "type": "LINUX_CONTAINER",
          "image": "aws/codebuild/standard:7.0",
          "computeType": "BUILD_GENERAL1_SMALL",
          "environmentVariables": [
            { "name": "AWS_ACCESS_KEY_ID", "value": "AKIA..." },
            { "name": "AWS_SECRET_ACCESS_KEY", "value": "abc123..." },
            { "name": "OTHER_VAR", "value": "some-value" }
          ],
          "privilegedMode": false
        }
        ```

        Example **after** (remove the credential vars):

        ```json theme={null}
        "environment": {
          "type": "LINUX_CONTAINER",
          "image": "aws/codebuild/standard:7.0",
          "computeType": "BUILD_GENERAL1_SMALL",
          "environmentVariables": [
            { "name": "OTHER_VAR", "value": "some-value" }
          ],
          "privilegedMode": false
        }
        ```

        3. Update the project using the modified JSON:

        ```bash theme={null}
        aws codebuild update-project \
          --name MyProjectName \
          --source "$(jq '.source' project.json)" \
          --artifacts "$(jq '.artifacts' project.json)" \
          --environment "$(jq '.environment' project.json)" \
          --service-role "$(jq -r '.serviceRole' project.json)" \
          --description "$(jq -r '.description // empty' project.json)" \
          --timeout-in-minutes "$(jq -r '.timeoutInMinutes // 60' project.json)" \
          --queued-timeout-in-minutes "$(jq -r '.queuedTimeoutInMinutes // 480' project.json)" \
          --cache "$(jq '.cache // {}' project.json)" \
          --encryption-key "$(jq -r '.encryptionKey // empty' project.json)" \
          --badge-enabled "$(jq -r '.badge.badgeEnabled // false' project.json)" \
          --logs-config "$(jq '.logsConfig // {}' project.json)" \
          --vpc-config "$(jq '.vpcConfig // {}' project.json)"
        ```

        Adjust fields to match what exists in `project.json`; omit any args your project doesn’t use.

        ***

        ## 4. (Optional) Replace With Secure References

        If you still need to pass non-AWS secrets to the build:

        ### Using SSM Parameter Store

        1. Store secret:

        ```bash theme={null}
        aws ssm put-parameter \
          --name "/MyApp/DbPassword" \
          --value "SuperSecretPassword" \
          --type "SecureString"
        ```

        2. Grant CodeBuild role access (`ssm:GetParameter` on that parameter).

        3. Add a parameter store env var (edit `project.json` again):

        ```json theme={null}
        "environmentVariables": [
          {
            "name": "DB_PASSWORD",
            "value": "/MyApp/DbPassword",
            "type": "PARAMETER_STORE"
          }
        ]
        ```

        4. Re-run `aws codebuild update-project` as above.

        ### Using Secrets Manager

        1. Create secret:

        ```bash theme={null}
        aws secretsmanager create-secret \
          --name "MyApp/DbCredentials" \
          --secret-string '{"username":"dbuser","password":"SuperSecretPassword"}'
        ```

        2. Grant CodeBuild role `secretsmanager:GetSecretValue` on that secret.

        3. Add env var with `type=SECRETS_MANAGER`.

        ***

        ## 5. Verify

        Run a build and confirm:

        * No plaintext AWS credentials appear in:
          * Project configuration
          * Build logs
          * CloudTrail `StartBuild` events’ environment variables.
        * Build still succeeds, and IAM role/secret references are functioning.
      </Accordion>

      <Accordion title="Using Python">
        To remediate this, you must **remove plaintext credentials from the CodeBuild environment** and instead **pull them securely at runtime** (e.g., from IAM role, Secrets Manager, or SSM Parameter Store). Below are step-by-step instructions, including Python (boto3) examples.

        ***

        ## 1. Understand what “plaintext credentials” means in CodeBuild

        In CodeBuild, this is **bad**:

        * Environment variable type: `PLAINTEXT`
        * Name: `AWS_ACCESS_KEY_ID`, `AWS_SECRET_ACCESS_KEY`, etc.
        * Value: literal credential string

        You want **no static AWS keys in environment variables** at all.

        ***

        ## 2. Prefer IAM role over any stored credentials

        First choice: let CodeBuild’s **service role** have permissions to what the build needs.\
        Then your build just uses the normal AWS SDK with no keys in env vars.

        1. Go to **IAM → Roles**.
        2. Find the role used by your CodeBuild project (shown under the project’s **Service role**).
        3. Attach or adjust a policy to allow the resources/actions it needs (e.g., S3, ECR, etc.).
        4. In your buildspec/code, do not set any AWS credentials. Just use the SDK normally.

        No Python code change needed other than removing explicit credential usage.

        ***

        ## 3. If you must store secrets: use Secrets Manager or SSM

        If (for some reason) you need non-IAM secrets (API keys, passwords, etc.):

        ### 3.1 Store the secret

        Example with Secrets Manager:

        ```bash theme={null}
        aws secretsmanager create-secret \
          --name my/api/secret \
          --secret-string '{"api_key":"YOUR_API_KEY"}'
        ```

        Give the CodeBuild role permission to read this secret:

        ```json theme={null}
        {
          "Effect": "Allow",
          "Action": ["secretsmanager:GetSecretValue"],
          "Resource": "arn:aws:secretsmanager:REGION:ACCOUNT_ID:secret:my/api/secret-*"
        }
        ```

        ***

        ## 4. Remove plaintext environment variables from the CodeBuild project

        ### 4.1 Using the AWS Console

        1. Go to **CodeBuild → Build projects → Your project**.
        2. Click **Edit**.
        3. Under **Environment → Additional configuration → Environment variables**:
           * Delete any variables like `AWS_ACCESS_KEY_ID`, `AWS_SECRET_ACCESS_KEY`, etc. of type `Plaintext`.
        4. Save.

        ***

        ### 4.2 Using Python (boto3) to remove/redesign env vars

        This example:

        * Fetches the project config
        * Filters out sensitive plaintext variables
        * Optionally replaces them with references to SSM/Secrets Manager (type `PARAMETER_STORE` or `SECRETS_MANAGER`)

        ```python theme={null}
        import boto3

        codebuild = boto3.client("codebuild")
        project_name = "your-project-name"

        # 1. Get current project configuration
        resp = codebuild.batch_get_projects(names=[project_name])
        project = resp["projects"][0]

        env = project["environment"]
        current_env_vars = env.get("environmentVariables", [])

        # 2. Filter out plaintext AWS credentials
        SENSITIVE_NAMES = {
            "AWS_ACCESS_KEY_ID",
            "AWS_SECRET_ACCESS_KEY",
            "AWS_SESSION_TOKEN",
            "AWS_SECURITY_TOKEN",
        }

        new_env_vars = [
            v for v in current_env_vars
            if not (v["type"] == "PLAINTEXT" and v["name"] in SENSITIVE_NAMES)
        ]

        # OPTIONAL: add secure references instead of plaintext values
        # Example: pulling an API key from Secrets Manager
        # new_env_vars.append({
        #     "name": "MY_API_SECRET",
        #     "value": "arn:aws:secretsmanager:REGION:ACCOUNT_ID:secret:my/api/secret-XXXX",
        #     "type": "SECRETS_MANAGER"
        # })

        env["environmentVariables"] = new_env_vars

        # 3. Call update_project with modified environment
        update_args = {
            "name": project_name,
            "description": project.get("description"),
            "source": project["source"],
            "artifacts": project["artifacts"],
            "environment": env,
            "serviceRole": project["serviceRole"],
        }

        # Preserve optional keys if present
        optional_keys = [
            "vpcConfig", "timeoutInMinutes", "queuedTimeoutInMinutes", "badgeEnabled",
            "logsConfig", "cache", "fileSystemLocations", "buildBatchConfig",
            "concurrentBuildLimit", "encryptionKey", "secondarySources",
            "secondaryArtifacts", "sourceVersion"
        ]
        for k in optional_keys:
            if k in project:
                update_args[k] = project[k]

        codebuild.update_project(**update_args)
        print("Updated project; plaintext AWS credentials removed from environment variables.")
        ```

        ***

        ## 5. Accessing secrets or AWS from your build (Python example)

        ### 5.1 Using IAM role (no env vars)

        `buildspec.yml` example:

        ```yaml theme={null}
        version: 0.2
        phases:
          install:
            commands:
              - pip install boto3
          build:
            commands:
              - python build_script.py
        ```

        `build_script.py`:

        ```python theme={null}
        import boto3

        s3 = boto3.client("s3")  # uses CodeBuild role automatically
        for b in s3.list_buckets()["Buckets"]:
            print(b["Name"])
        ```

        No credentials set anywhere.

        ***

        ### 5.2 Using Secrets Manager at runtime (if needed)

        `buildspec.yml`:

        ```yaml theme={null}
        version: 0.2
        phases:
          install:
            commands:
              - pip install boto3
          build:
            commands:
              - python build_script.py
        ```

        `build_script.py`:

        ```python theme={null}
        import boto3
        import json
        import os

        secret_arn = os.getenv("MY_API_SECRET")  # set as SECRETS_MANAGER env var if needed

        secrets_client = boto3.client("secretsmanager")
        secret_value = secrets_client.get_secret_value(SecretId=secret_arn)
        secret_dict = json.loads(secret_value["SecretString"])

        api_key = secret_dict["api_key"]
        print("Using API key (not printed here in real code).")
        ```

        ***

        **Summary**

        1. Remove all plaintext AWS credentials from CodeBuild environment variables (console or boto3).
        2. Grant needed permissions via the CodeBuild IAM role.
        3. For non-IAM secrets, use Secrets Manager or SSM and fetch them at runtime in your Python build code.
      </Accordion>

      <Accordion title="Using Terraform">
        ```hcl theme={null}
        resource "aws_codebuild_project" "THIS_PROJECT" {
          name         = "REPLACE_WITH_PROJECT_NAME"
          service_role = aws_iam_role.codebuild_role.arn

          # Other existing configuration for the project goes here:
          # description  = "..."
          # source       { ... }
          # artifacts    { ... }
          # vpc_config   { ... }
          # logs_config  { ... }
          # etc.

          environment {
            compute_type                = "REPLACE_WITH_COMPUTE_TYPE"        # e.g. BUILD_GENERAL1_SMALL
            image                       = "REPLACE_WITH_BUILD_IMAGE"         # e.g. aws/codebuild/standard:7.0
            type                        = "LINUX_CONTAINER"
            privileged_mode             = false
            image_pull_credentials_type = "CODEBUILD"

            # KEEP ONLY NON-SENSITIVE ENV VARS HERE.
            # Any existing environment_variable blocks whose name was
            # "AWS_ACCESS_KEY_ID" or "AWS_SECRET_ACCESS_KEY" must be removed
            # from Terraform instead of being set to plaintext values.

            environment_variable {
              name  = "EXAMPLE_NON_SENSITIVE_VAR"
              value = "EXAMPLE_VALUE"
              type  = "PLAINTEXT"
            }

            # For secrets, prefer:
            # environment_variable {
            #   name  = "SECRET_FROM_SSM"
            #   value = "REPLACE_WITH_SSM_PARAMETER_NAME"
            #   type  = "PARAMETER_STORE"
            # }
            #
            # or:
            # environment_variable {
            #   name  = "SECRET_FROM_SECRETS_MANAGER"
            #   value = "REPLACE_WITH_SECRETS_MANAGER_SECRET_ID_OR_ARN"
            #   type  = "SECRETS_MANAGER"
            # }
          }
        }

        resource "aws_iam_role" "codebuild_role" {
          name = "REPLACE_WITH_CODEBUILD_ROLE_NAME"

          assume_role_policy = data.aws_iam_policy_document.codebuild_assume_role.json
        }

        data "aws_iam_policy_document" "codebuild_assume_role" {
          statement {
            actions = ["sts:AssumeRole"]

            principals {
              type        = "Service"
              identifiers = ["codebuild.amazonaws.com"]
            }
          }
        }
        ```

        This change does not force replacement of the `aws_codebuild_project` resource; it updates the existing project’s environment to remove any `environment_variable` blocks named `AWS_ACCESS_KEY_ID` or `AWS_SECRET_ACCESS_KEY`. Be careful to preserve all other needed environment variables when editing.

        Verification with `terraform plan` should show the `aws_codebuild_project` resource being updated, with the `environment[0].environment_variable` entries for `AWS_ACCESS_KEY_ID` and `AWS_SECRET_ACCESS_KEY` being removed and no other unintended changes.
      </Accordion>
    </AccordionGroup>
  </Tab>
</Tabs>

### Additional Reading:

* [https://docs.aws.amazon.com/config/latest/developerguide/codebuild-project-envvar-awscred-check.html](https://docs.aws.amazon.com/config/latest/developerguide/codebuild-project-envvar-awscred-check.html)