Rule: CodeBuild Project Plaintext Environment Variables

Compliance Rule: AWS CodeBuild Environment Variables Security

Description

Troubleshooting

Steps for Identifying Non-Compliant Resources

2. 1.
   Log into the AWS Management Console.
4. 2.
   Navigate to the AWS CodeBuild service.
6. 3.
   Review the environment variables for each CodeBuild project to identify any containing sensitive AWS credentials.
8. 4.
   Verify whether AWS Key Management Service (KMS) is used for variable encryption.

Remediation Steps

Manual Remediation

2. 1.
   Access the AWS CodeBuild Console.
4. 2.
   Select the non-compliant CodeBuild project.
6. 3.
   Click on "Edit" for the project's environment.
8. 4.
   Remove or secure sensitive AWS credentials from the plaintext environment variables.

   • Replace plaintext credentials with references to parameter store or AWS Secrets Manager.
10. 5.
    Save the updated environment configuration.

Automated Remediation

2. 1.

   Use AWS CLI to list all CodeBuild projects:

   aws codebuild list-projects
   

4. 2.

   Describe the environment variables for each project:

   aws codebuild batch-get-projects --names "project-name"
   

6. 3.

   Write a script to check each environment variable for sensitive data patterns:

   #!/bin/bash
   PROJECTS=$(aws codebuild list-projects --output text --query 'projects')
   
   for project in $PROJECTS; do
     ENV_VARS=$(aws codebuild batch-get-projects --names "$project" --query 'projects[*].environment.environmentVariables' --output text)
     # Pattern check for sensitive data like access keys, secret keys, etc.
     # Handle detection and rewrite the environment variables accordingly 
   done
   

8. 4.

   Update the environment variables using AWS CLI:

   aws codebuild update-project --name "project-name" --environment "type=ENVIRONMENT_TYPE,environmentVariables=[{name=VARIABLE_NAME,value=NEW_VALUE, type=PLAINTEXT}]"
   

Automation Code

import boto3
import json

def lambda_handler(event, context):
    codebuild = boto3.client('codebuild')
    projects_response = codebuild.list_projects()
    projects = projects_response['projects']
    
    for project in projects:
        project_info = codebuild.batch_get_projects(names=[project])
        env_variables = project_info['projects'][0]['environment']['environmentVariables']
        
        for variable in env_variables:
            # Check if the variable value looks like a sensitive AWS value and take necessary action
            if 'aws_access_key_id' in variable['value'] or 'aws_secret_access_key' in variable['value']:
                # Logic to handle sensitive data exposure
                pass
        
    return {'statusCode': 200, 'body': json.dumps('Check Complete')}

Conclusion