🛡️ AWS CodeBuild Project uses a deprecated managed image🟢

• Contextual name: 🛡️ Project uses a deprecated managed image🟢
• ID: /ce/ca/aws/codebuild/project-deprecated-image
• Tags:
  • 🟢 Policy with categories
  • 🟢 Policy with type
  • 🟢 Production policy
• Policy Type: COMPLIANCE_POLICY
• Policy Categories: RELIABILITY

Stats

not available

Logic

• 🧠 prod.logic.yaml🟢
  • 📗 AWS CodeBuild Project
  • 🔌 AWS CodeBuild Project - object.extracts.yaml
  • 🧪 test-data.json

Description

Open File

Description

This policy checks whether an AWS CodeBuild project's Environment Image exactly matches an AWS-managed image in the published deprecated-image list.

Rationale

Deprecated managed images no longer receive minor or patch updates from CodeBuild and are no longer cached on build hosts. Continuing to use them can expose build environments to unpatched vulnerabilities and increase provisioning time. Deprecation does not mean that AWS prevents builds from running.

Impact

Moving to a current image can change runtimes, tools, operating-system packages, and default behavior. Test the project's buildspec and dependencies before updating production builds.

Audit

This policy marks an AWS CodeBuild Project as INCOMPLIANT if its Environment Image exactly matches one of the following identifiers:

Image identifier	Deprecation date
aws/codebuild/standard:3.0	June 30, 2022
aws/codebuild/amazonlinux2-x86_64-standard:2.0	June 30, 2022
aws/codebuild/standard:4.0	March 31, 2023

... see more

Remediation

Open File

Remediation

From the AWS Console

1. Record the existing environment settings and buildspec in version control. Open AWS CodeBuild in the project's Region, choose Build projects, select the affected project, and open Build details.
2. In Environment, choose Edit.
3. Choose Override image, then Managed image, and select a current operating system, runtime, and image version compatible with the project's architecture and compute type. AWS recommends Always use the latest image for this runtime version to receive image updates and benefit from caching. Confirm that the target image includes the runtimes your buildspec selects; runtime version numbers do not map directly to image tag numbers.
4. Review changes to bundled runtimes and tools. Update the buildspec, runtime selections, package dependencies, and tests as needed.
5. Preserve the remaining environment settings, choose Update configuration, and run a representative build without an image override. Verify its resolved image, tests, and artifacts before relying on the updated project for production delivery. Confirm that pipeline or runner overrides do not continue selecting a deprecated image.

... see more

policy.yaml

Open File

Linked Framework Sections

Section	Sub Sections	Internal Rules	Policies	Flags	Compliance
💼 Cloudaware Framework → 💼 Infrastructure Modernization			39		no data