Credential Access
CodeBuild project environment secret harvest
An attacker with CodeBuild read permissions reads every project's plaintext environment variables and extracts credentials.
Required Permissions
Description
CodeBuild projects define environment variables for the build container. Variables of type PLAINTEXT appear in the project configuration in cleartext to any caller with codebuild:BatchGetProjects. PARAMETER_STORE and SECRETS_MANAGER type variables are references and are not reachable directly through this path.
The hackaws agent lists every project with codebuild:ListProjects, reads them in batches with codebuild:BatchGetProjects, and scans the plaintext environment values for credentials.
Credentials in CodeBuild environments are usually service-to-service tokens: Docker Hub credentials, package registry tokens, deployment keys for other AWS accounts.
Impact
Harvest of credentials used by CI pipelines. These credentials often grant push access to artifact registries and deploy access to other environments.
Detection
Alert on bulk ListProjects and BatchGetProjects calls. Flag projects with PLAINTEXT environment variables in CI; require PARAMETER_STORE or SECRETS_MANAGER type for anything secret.
Mitigation
Never set a secret as a PLAINTEXT environment variable in a CodeBuild project. Use PARAMETER_STORE or SECRETS_MANAGER type and scope read access on the referenced value. Rotate any credential that has ever been stored plaintext.