aws-cb-exposes-plaintext-cred-env

id: aws-cb-exposes-plaintext-cred-env
emits: ExposesCredential
description: A CodeBuild project environment variable with type PLAINTEXT whose value pattern-matches
  credential material exposes that credential to build code.
match_record:
  resource_type: AWS::CodeBuild::Project
  field: environment.environmentVariables[].type
where:
- environmentVariable.type == PLAINTEXT
- environmentVariable.value matches credential pattern (access key ID, secret key, password, token, bearer
  prefix)
emit:
  source_type: BuildWorker
  target_type: Credential
  source: <CodeBuild Project (BuildWorker)>
  target: <Credential inferred from env var value pattern>
  state: ACTIVE
  permissions: []
  derived_from:
  - AWS::CodeBuild::Project.environment.environmentVariables (BatchGetProjects)
  false_positive_note: "Only emit when the value clearly matches a credential pattern (e.g. AKIA\u2026\
    \ AWS access key ID, a long random string with SECRET or TOKEN in the name, a password-prefix pattern).\
    \ Low-confidence matches should be emitted with confidence 0.5 and reviewed by analysts. Plaintext\
    \ env vars are also visible in codebuild:BatchGetBuilds output \u2014 they leak at the control-plane\
    \ level without needing code execution."
  narrative: '{project.name} stores a credential as a plaintext environment variable; any code in the
    build (or anyone who can call BatchGetProjects/BatchGetBuilds) can read the credential value.'