Ajinkya aws codebuild prevention by ajinkya1986 · Pull Request #123 · Cloudanix/docs

ajinkya1986 · 2024-07-29T09:38:58Z

No description provided.

mpurusottamc · 2024-07-29T09:39:28Z

docs/aws/audit/codebuildmonitoring/rules/codebuild_project_artifact_encryption.mdx

+   ```
+
+3. **Create a Python script to get project details:**
+   Use the `batch_get_projects` method to get details of the projects. Here's a sample script:


Secret: Secret Keyword

Click here for more details

mpurusottamc · 2024-07-29T09:39:30Z

docs/aws/audit/codebuildmonitoring/rules/codebuild_project_artifact_encryption_remediation.mdx

+   pip install boto3
+   ```
+   Then, configure your AWS credentials. You can do this by setting the following environment variables:
+   ```


Secret: Secret Keyword

Click here for more details

mpurusottamc · 2024-07-29T09:39:32Z

docs/aws/audit/codebuildmonitoring/rules/codebuild_project_environment_privileged.mdx

+
+   ```python
+   projects = codebuild.list_projects()['projects']
+   ```


Secret: Secret Keyword

Click here for more details

mpurusottamc · 2024-07-29T09:39:34Z

...aws/audit/codebuildmonitoring/rules/codebuild_project_environment_privileged_remediation.mdx

+
+   ```python
+   import boto3
+   session = boto3.Session(


Secret: Secret Keyword

Click here for more details

mpurusottamc · 2024-07-29T09:39:36Z

docs/aws/audit/codebuildmonitoring/rules/codebuild_project_logging_enabled.mdx

+
+response = codebuild.list_projects()
+
+projects = response['projects']


Secret: Secret Keyword

Click here for more details

mpurusottamc · 2024-07-29T09:39:38Z

docs/aws/audit/codebuildmonitoring/rules/codebuild_project_logging_enabled_remediation.mdx

+
+```python
+import boto3
+


Secret: Secret Keyword

Click here for more details

mpurusottamc · 2024-07-29T09:39:40Z

docs/aws/audit/codebuildmonitoring/rules/codebuild_project_restrict_cred_in_environment.mdx

+
+By following these steps, you can prevent the use of plaintext AWS credentials in environment variables for your CodeBuild projects.
+</Accordion>
+


Secret: Secret Keyword

Click here for more details

mpurusottamc · 2024-07-29T09:39:41Z

...dit/codebuildmonitoring/rules/codebuild_project_restrict_cred_in_environment_remediation.mdx

+
+4. **Use AWS Secrets Manager or Parameter Store for Sensitive Data:**
+   If you need to use sensitive data, store it in AWS Secrets Manager or AWS Systems Manager Parameter Store and reference it in your buildspec file.
+


Secret: Secret Keyword

Click here for more details

mpurusottamc · 2024-07-29T09:39:43Z

docs/aws/audit/codebuildmonitoring/rules/codebuild_project_source_repo_url.mdx

+   Enable CloudWatch Logs and AWS Config to monitor and log any changes or access to your CodeBuild projects and secrets.
+
+   ```sh
+   aws logs create-log-group --log-group-name /aws/codebuild/MyProject


Secret: Secret Keyword

Click here for more details

mpurusottamc · 2024-07-29T09:39:45Z

docs/aws/audit/codebuildmonitoring/rules/codebuild_project_source_repo_url.mdx

+       if 'auth' in source:
+           auth = source['auth']
+           if auth['type'] == 'OAUTH' and 'resource' in auth:
+               print(f"Sign-in credentials found in source repository URL: {auth['resource']}")


Secret: Secret Keyword

Click here for more details

mpurusottamc · 2024-07-29T09:39:47Z

docs/aws/audit/codebuildmonitoring/rules/codebuild_project_source_repo_url_remediation.mdx

+
+2. **Use AWS Secrets Manager for Storing Credentials**:
+   Store your Bitbucket credentials in AWS Secrets Manager instead of hardcoding them in your source repository URL.
+


Secret: Secret Keyword

Click here for more details

mpurusottamc · 2024-07-29T09:39:49Z

docs/aws/audit/codebuildmonitoring/rules/codebuild_project_source_repo_url_remediation.mdx

+   ```python
+   import boto3
+
+   session = boto3.Session(


Secret: Secret Keyword

Click here for more details

mpurusottamc · 2024-07-29T09:39:51Z

docs/aws/audit/codebuildmonitoring/rules/codedeploy_auto_rollback_monitor_enabled.mdx

+   ```
+
+3. **Get project details:**
+   For each project, use the `batch_get_projects` method to get the project details. This will include information about the build configuration, including whether CodeDeploy is enabled. Here is a sample script:


Secret: Secret Keyword

Click here for more details

mpurusottamc · 2024-07-29T09:39:52Z

...aws/audit/codebuildmonitoring/rules/codedeploy_auto_rollback_monitor_enabled_remediation.mdx

+   pip install boto3
+   ```
+   Then, configure your AWS credentials. You can do this by setting the following environment variables:
+   ```


Secret: Secret Keyword

Click here for more details

mpurusottamc · 2024-07-29T09:39:54Z

docs/aws/audit/codebuildmonitoring/rules/codedeploy_ec2_minimum_healthy_hosts_configured.mdx

+response = client.list_projects()
+
+for project in response['projects']:
+    project_details = client.batch_get_projects(names=[project])


Secret: Secret Keyword

Click here for more details

mpurusottamc · 2024-07-29T09:39:56Z

...it/codebuildmonitoring/rules/codedeploy_ec2_minimum_healthy_hosts_configured_remediation.mdx

+```python
+import boto3
+
+session = boto3.Session(


Secret: Secret Keyword

Click here for more details

mpurusottamc · 2024-07-29T09:39:58Z

docs/aws/audit/codebuildmonitoring/rules/codepipeline_region_fanout.mdx

+projects = codebuild.list_projects()['projects']
+for project in projects:
+    project_details = codebuild.batch_get_projects(names=[project])['projects'][0]
+    project_region = project_details['arn'].split(':')[3]


Secret: Secret Keyword

Click here for more details

mpurusottamc · 2024-07-29T09:40:00Z

docs/aws/audit/codebuildmonitoring/rules/codepipeline_region_fanout_remediation.mdx

+2. Create a session using your AWS credentials. Replace 'aws_access_key_id', 'aws_secret_access_key', and 'aws_session_token' with your actual AWS credentials.
+
+```python
+session = boto3.Session(


Secret: Secret Keyword

Click here for more details

ajinkyajawalkar added 2 commits May 7, 2024 16:54

Added cause for codebuild

a2f4505

Added prevention for codebuild

547313b

ajinkya1986 requested a review from mpurusottamc July 29, 2024 09:38

mpurusottamc reviewed Jul 29, 2024

View reviewed changes


		response = codebuild.list_projects()

		projects = response['projects']


		By following these steps, you can prevent the use of plaintext AWS credentials in environment variables for your CodeBuild projects.
		</Accordion>


		4. Use AWS Secrets Manager or Parameter Store for Sensitive Data:
		If you need to use sensitive data, store it in AWS Secrets Manager or AWS Systems Manager Parameter Store and reference it in your buildspec file.


		2. Use AWS Secrets Manager for Storing Credentials:
		Store your Bitbucket credentials in AWS Secrets Manager instead of hardcoding them in your source repository URL.

Conversation

ajinkya1986 commented Jul 29, 2024

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants