CodeBuild Project Plaintext Environment Variables Rule
This rule ensures sensitive AWS values are not in plaintext environment variables for CodeBuild projects.
| Rule | CodeBuild project plaintext environment variables should not contain sensitive AWS values |
| Framework | FedRAMP Low Revision 4 |
| Severity | ✔ Critical |
Rule Description:
This rule ensures that CodeBuild project environment variables do not contain sensitive AWS values. It is specifically applicable to CodeBuild projects within an environment that adheres to the FedRAMP Low framework, Revision 4.
Troubleshooting Steps:
- 1.Identify the CodeBuild project which violates the policy.
- 2.Review the project's environment variables to determine if any contain sensitive AWS values.
- 3.Check if the CodeBuild project is within an environment that follows the FedRAMP Low framework, Revision 4.
- 4.Determine the specific AWS values that are considered sensitive.
- 5.Assess the impact of the violation to understand the potential risks involved.
Remediation:
To remediate the issue and comply with the policy, follow these steps:
- 1.Open the AWS Management Console and navigate to the CodeBuild service.
- 2.Identify the CodeBuild project that violates the policy.
- 3.Edit the project's environment variables configuration.
- 4.Locate any environment variable that contains sensitive AWS values.
- 5.Remove or replace the sensitive values with appropriate alternatives.
- If the variable must be removed, ensure it does not impact the functionality of the build process.
- If the variable needs replacement, consider using AWS Secrets Manager or Parameter Store to store and retrieve the value securely.
- 6.Save the updated environment variables configuration.
CLI Command:
You can also remediate the issue using the AWS Command Line Interface (CLI) by following the steps below:
- 1.Open the command-line interface or terminal.
- 2.Run the following command to update the CodeBuild project's environment variables:
aws codebuild update-project --name <project-name> --environment-variables-override <variable-name>=<new-value> ...
Replace
<project-name><variable-name><new-value>- 1.Repeat the above command for each environment variable that needs remediation.
Compliance:
To ensure ongoing compliance with the policy, it is recommended to periodically review CodeBuild project configurations and environment variables for any sensitive AWS values. Additionally, consider implementing automated checks or scripting to enforce compliance during CI/CD pipelines. Regular auditing and monitoring can help maintain a secure and compliant CodeBuild environment.