📝 AWS CodeBuild Project Bitbucket Source Location URL contains credentials 🟢

• Contextual name: 📝 Project Bitbucket Source Location URL contains credentials 🟢
• ID: /ce/ca/aws/codebuild/project-bitbucket-source-url-contains-creds
• Located in: 📁 AWS CodeBuild

Flags

• 🟢 Policy with categories
• 🟢 Policy with type
• 🟢 Production policy

Our Metadata

• Policy Type: COMPLIANCE_POLICY
• Policy Category:
  • SECURITY

Similar Policies

• AWS Security Hub
  • [[CodeBuild.1] CodeBuild Bitbucket source repository URLs should not contain sensitive credentials]([CodeBuild.1] CodeBuild Bitbucket source repository URLs should not contain sensitive credentials (https://docs.aws.amazon.com/securityhub/latest/userguide/codebuild-controls.html#codebuild-1)]
• Internal
  • dec-x-cc74149f

Similar Internal Rules

Rule	Policies	Flags
✉️ dec-x-cc74149f	1

Logic

• 🧠 prod.logic.yaml 🟢
  • 📗 AWS CodeBuild Project
  • 🔌 AWS CodeBuild Project - object.extracts.yaml
  • 🧪 test-data.json

Description

Open File

Description

This policy checks that AWS CodeBuild projects that use Bitbucket as a source repository do not embed credentials within the repository URL.

Rationale

Storing credentials directly in repository URLs is a critical security risk. These credentials can be inadvertently captured in build logs, command line history, or intercepted in transit, leading to unauthorized access to the source code repository. The recommended and more secure method for granting CodeBuild access to Bitbucket repositories is using OAuth.

Audit

This policy marks an AWS CodeBuild Project as INCOMPLIANT if the project's Source Type is set to BITBUCKET and the Source Location URL has an @ character embedded credentials in the URL.

Projects with any other Source Type are flagged as INAPPLICABLE.

Remediation

Open File

Remediation

From Console

To eliminate embedded credentials and configure OAuth authentication for your AWS CodeBuild Project:

1. Locate and select the build project that currently references credentials in its source URL.
2. Edit Source Configuration Under Source, choose Disconnect from Bitbucket to remove the existing basic‑auth or Personal Access Token linkage.
3. Click Connect using OAuth. Select Connect to Bitbucket. When prompted, grant the required OAuth permissions to allow CodeBuild secure, token‑based access.
4. Enter or confirm your repository URL (omit any embedded credentials).
5. Adjust any additional source‑configuration parameters (e.g., build – spec path, webhook triggers).
6. Click Update source to apply the new OAuth‑based authentication and complete remediation.

policy.yaml

Open File

Linked Framework Sections

Section	Sub Sections	Internal Rules	Policies	Flags
💼 AWS Foundational Security Best Practices v1.0.0 → 💼 [CodeBuild.1] CodeBuild Bitbucket source repository URLs should not contain sensitive credentials		1	1
💼 Cloudaware Framework → 💼 Secure Access			53
💼 FedRAMP High Security Controls → 💼 SA-3 System Development Life Cycle (L)(M)(H)			4
💼 FedRAMP Low Security Controls → 💼 SA-3 System Development Life Cycle (L)(M)(H)			4
💼 FedRAMP Moderate Security Controls → 💼 SA-3 System Development Life Cycle (L)(M)(H)			4
💼 NIST CSF v2.0 → 💼 ID.AM-08: Systems, hardware, software, services, and data are managed throughout their life cycles			21
💼 NIST SP 800-53 Revision 5 → 💼 SA-3 System Development Life Cycle	3		4
💼 PCI DSS v3.2.1 → 💼 8.2.1 Using strong cryptography, render all authentication credentials unreadable during transmission and storage on all system components.			14
💼 PCI DSS v4.0.1 → 💼 8.3.2 Strong cryptography is used to render all authentication factors unreadable during transmission and storage on all system components.			14
💼 PCI DSS v4.0 → 💼 8.3.2 Strong cryptography is used to render all authentication factors unreadable during transmission and storage on all system components.		6	14