Login

Cloud Defense Logo

Products

Solutions

Company

Book A Live Demo

Rule: CodeBuild GitHub or Bitbucket Source Repository URLs Should Use OAuth

This rule ensures that CodeBuild projects use OAuth for GitHub or Bitbucket source repository URLs.

RuleCodeBuild GitHub or Bitbucket source repository URLs should use OAuth
FrameworkSOC 2
Severity
✔
Critical

CodeBuild GitHub or Bitbucket Source Repository URLs Should Use OAuth

Overview

For AWS CodeBuild projects that use GitHub or Bitbucket as a source repository, it's essential to use OAuth tokens for secure authentication. This is particularly important when aiming to comply with SOC 2 standards. Using OAuth tokens in place of traditional user credentials helps in providing a more secure and controlled way of accessing repositories, ensuring that access is only granted to necessary personnel or services and is auditable for security compliance.

Troubleshooting Steps

If AWS CodeBuild is not using OAuth tokens for GitHub or Bitbucket repositories, you should take the following actions:

Verify OAuth Token Usage

  2. 1.
    Go to the AWS Management Console.
  4. 2.
    Open the AWS CodeBuild console at https://console.aws.amazon.com/codebuild/.
  6. 3.
    Choose 
    Build projects
    and select the project you want to verify.
  8. 4.
    Look for the 
    Source
    section.
  10. 5.
    Under 
    Repository
    , check to see if you are using a repository URL that starts with 
    https://
    and if you've connected using an OAuth token.

Check IAM Policies

Make sure that the IAM role used by your CodeBuild project has the necessary policies attached to interact with OAuth tokens.

  2. 1.
    Go to the AWS IAM Console.
  4. 2.
    Look for the IAM role associated with your CodeBuild project.
  6. 3.
    Verify that the role has the required permissions to access CodeBuild and associated source repositories with an OAuth token.

Inspect CodeBuild Logs

  2. 1.
    In the AWS CodeBuild console, select your build project.
  4. 2.
    Go to the 
    Build history
    tab and click on the specific build run.
  6. 3.
    Inspect the logs for errors related to source control access.

Remediation Steps

To remediate this, set up OAuth integration for GitHub or Bitbucket within AWS CodeBuild:

GitHub OAuth Integration

  2. 1.
    Log into the AWS Management Console.
  4. 2.
    Go to the CodeBuild console and select your build project.
  6. 3.
    Click on 
    Edit
    and navigate to the 
    Source
    section.
  8. 4.
    Choose 
    GitHub
    or 
    GitHub Enterprise Cloud
    as the source provider.
  10. 5.
    Click 
    Connect to GitHub
    to authorize AWS CodeBuild to access your GitHub repositories using OAuth.

Bitbucket OAuth Integration

  2. 1.
    In the AWS Console, navigate to the CodeBuild service.
  4. 2.
    Select your build project, click 
    Edit
    , then go to the 
    Source
    section.
  6. 3.
    Set the source provider as 
    Bitbucket
    .
  8. 4.
    Connect with Bitbucket by clicking on 
    Connect to Bitbucket
    .

Necessary CLI Commands

To perform these steps using the AWS CLI:

Update CodeBuild Project for GitHub Source

aws codebuild update-project \
  --name "project-name" \
  --source type=GITHUB,location=oauth-token@github.com/owner/repo-name.git,authType=OAUTH

Replace 

project-name
, 
oauth-token
, 
owner
, and 
repo-name
with the appropriate values.

Update CodeBuild Project for Bitbucket Source

aws codebuild update-project \
  --name "project-name" \
  --source type=BITBUCKET,location=oauth-token@bitbucket.org/owner/repo-name.git,authType=OAUTH

Replace 

project-name
, 
oauth-token
, 
owner
, and 
repo-name
with the appropriate values.

After updating your build projects to use OAuth, monitor your builds to ensure they can successfully access your repositories.

Remember to secure your OAuth tokens and rotate them regularly according to your organization's security policy. This is key to maintaining ongoing SOC 2 compliance and ensuring the continued security of your builds and code repositories.

Is your System Free of Underlying Vulnerabilities?
Find Out Now