A Build Project that Is Not Root on Its Host

aws-codebuild

A CodeBuild project - where your source meets your credentials. Works with Terraform and OpenTofu (>= 1.6), AWS provider >= 6.0, < 7.0.

privileged_mode hands the build the Docker socket, which is root on the build host. Anything the build runs - a dependency's install script, a test that pulls a container, a compromised action - can then read every environment variable in the job, reach the instance metadata service, and assume this project's service role. It gets switched on routinely because "the build needs to build an image". It is off here, and a precondition makes turning it on an explicit statement; a separate minimal project for the image build is usually the better answer.

A PLAINTEXT environment variable is stored, not passed. Its value lives in the project definition and the build history, and reaches the log the moment anything echoes it - a log usually readable by more people than the secret is. PARAMETER_STORE and SECRETS_MANAGER pass a reference and let CodeBuild fetch the value at build time. A precondition refuses a PLAINTEXT variable whose name looks like a secret (password, token, api_key, private_key, and so on), and plaintext_environment_variables lists the ones that are stored.

Without vpc, the build runs on AWS's network with unrestricted egress - which is not the same thing as isolated, and is how a poisoned dependency gets its payload out.

Two settings are deliberately not configurable:

• artifacts.encryption_disabled is always false. Build output is usually the thing worth stealing
• source.insecure_ssl is always false. Turning it on disables certificate verification on the clone, which is a machine-in-the-middle against your own source

Smaller defaults that differ from AWS's: build_timeout_minutes is 30 rather than 60, because the default is an hour of billing for a build that has already hung; and the example pins a commit SHA rather than a branch, because a branch means the same build number can produce different bytes.

Verification

Static validation runs tofu fmt, init, validate, tflint and checkov. This module has not yet had a live test, so it is published as statically validated with its live test pending and does not carry the live-tested mark.