aws-cb-contains-secret-env
CodeBuild project env vars of type SECRETS_MANAGER or PARAMETER_STORE reference secret material injected into every build's environment.
match (record)
{
"field": "environment.environmentVariables[].type",
"resource_type": "AWS::CodeBuild::Project"
}
where
environmentVariable.type in [SECRETS_MANAGER, PARAMETER_STORE]
emit
| source type | BuildWorker |
|---|---|
| target type | Secret |
| source | <CodeBuild Project (BuildWorker)> |
| target | <Secret / SSM Parameter referenced by environmentVariable.value ARN> |
Narrative
{project.name} injects the value of {secret.name} into every build as an environment variable; code running in the build can read the secret from the process environment.
Raw rule rules/derived/aws/codebuild.yaml
id: aws-cb-contains-secret-env
emits: ContainsSecret
description: CodeBuild project env vars of type SECRETS_MANAGER or PARAMETER_STORE reference secret material
injected into every build's environment.
match_record:
resource_type: AWS::CodeBuild::Project
field: environment.environmentVariables[].type
where:
- environmentVariable.type in [SECRETS_MANAGER, PARAMETER_STORE]
emit:
source_type: BuildWorker
target_type: Secret
source: <CodeBuild Project (BuildWorker)>
target: <Secret / SSM Parameter referenced by environmentVariable.value ARN>
state: ACTIVE
permissions: []
derived_from:
- AWS::CodeBuild::Project.environment.environmentVariables (BatchGetProjects)
false_positive_note: 'The secret is resolved at build start by CodeBuild (using the service role''s
permissions: secretsmanager:GetSecretValue or ssm:GetParameter). The ContainsSecret edge asserts that
build code CAN read the secret via the process environment. Credential-chains will then link this
to the secret''s CredentialsFor target if the secret authenticates an identity.'
narrative: '{project.name} injects the value of {secret.name} into every build as an environment variable;
code running in the build can read the secret from the process environment.'