feat(aws): Add new CodeBuild check to validate environment variables #4632

danibarranqueroo · 2024-08-05T09:49:49Z

Context

To enhance security and follow best practices for handling sensitive information, we are adding a new check within the CodeBuild framework. This check ensures that sensitive environment variables (AWS_ACCESS_KEY_ID and AWS_SECRET_ACCESS_KEY) in CodeBuild projects are not stored as clear text credentials.

To facilitate this check, modifications were necessary in the CodeBuild service because the batch_get_projects method previously did not utilize this parameter. Additionally, I have renamed all the methods according to the Python naming convention.

In addition, I did not use Moto for testing because the way it creates a new CodeBuild project seems not to accept environment variables, or something similar, because when I debug, they are always empty. I have tested the check using the AWS CLI and it seems to be working great, so for the test file, I had use MagicMock instead of Moto.

Description

I have added this new check called codebuild_project_no_plaintext_credentials with his respective test to prove that it works.

License

By submitting this pull request, I confirm that my contribution is made under the terms of the Apache 2.0 license.

…xt credentials

jfagoagas · 2024-08-05T10:01:21Z

...ild/codebuild_project_no_plaintext_credentials/codebuild_project_no_plaintext_credentials.py

+            report.resource_arn = project.arn
+            report.status = "PASS"
+            report.status_extended = f"CodeBuild project {project.name} does not have sensitive environment plaintext credentials."
+            sensitive_vars = ["AWS_ACCESS_KEY_ID", "AWS_SECRET_ACCESS_KEY"]


What do you think about using the audit_config to allow users to add/remove sensitive environment variables? It'd be a great addition!

https://docs.prowler.com/projects/prowler-open-source/en/latest/developer-guide/checks/#using-the-audit-config

Good point! I've just added it.

codecov · 2024-08-06T10:58:11Z

Codecov Report

All modified and coverable lines are covered by tests ✅

Project coverage is 89.11%. Comparing base (6c029a9) to head (2e17ccc).
Report is 20 commits behind head on master.

Additional details and impacted files

@@            Coverage Diff             @@
##           master    #4632      +/-   ##
==========================================
+ Coverage   89.06%   89.11%   +0.04%     
==========================================
  Files         912      915       +3     
  Lines       27783    28016     +233     
==========================================
+ Hits        24745    24966     +221     
- Misses       3038     3050      +12

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

sergargar · 2024-08-06T13:14:12Z

Please use the detect secrets library for this check like in awslambda_function_no_secrets_in_variables.

jfagoagas · 2024-08-06T13:44:20Z

Please use the detect secrets library for this check like in awslambda_function_no_secrets_in_variables.

But what is the point of the check? I think is not to have these sensitive environment variables, as per https://docs.aws.amazon.com/securityhub/latest/userguide/codebuild-controls.html#codebuild-2

sergargar · 2024-08-06T14:21:54Z

Please use the detect secrets library for this check like in awslambda_function_no_secrets_in_variables.

But what is the point of the check? I think is not to have these sensitive environment variables, as per https://docs.aws.amazon.com/securityhub/latest/userguide/codebuild-controls.html#codebuild-2

We don't have to limit Prowler checks to CIS or SecurityHub controls, if we detect all type of secrets, the check would be more advance and we are also covering the SecurityHub check.

It makes no sense to make the user setting in the config.yaml the env variables that he wants to check...

sergargar · 2024-08-06T14:35:28Z

...ld_project_no_plaintext_credentials/codebuild_project_no_plaintext_credentials.metadata.json

@@ -0,0 +1,32 @@
+{
+  "Provider": "aws",
+  "CheckID": "codebuild_project_no_plaintext_credentials",


Suggested change

"CheckID": "codebuild_project_no_plaintext_credentials",

"CheckID": "codebuild_project_no_secrets_in_variables",

jfagoagas · 2024-08-06T14:38:19Z

the user setting in the config.yaml the env variables that he wants to check

@danibarranqueroo I apologise because I explained my point just the opposite as I wanted. What I wanted to say is that it could be helpful for our users to be able to exclude some environment variables via audit_config since the Mutelist does not work for this kind of checks since the resource is not the environment variable analysed, you can read more about this here #3905

…idate-environment-variables

danibarranqueroo · 2024-08-08T09:28:19Z

Finally, after following all your advises, I've completed this check using Detect Secrets to find credentials/secrets in the value of the environmental variables, but only when they are stored as plaintext. Additionally, I've used Audit Config to allow users to exclude specific environment variables from the check by adding their names to the config.yaml.

Take a look at it when you can! 😄 🚀

sergargar · 2024-08-12T12:04:52Z

...uild_project_no_secrets_in_variables/codebuild_project_no_secrets_in_variables.metadata.json

+    "Code": {
+      "CLI": "",
+      "NativeIaC": "",
+      "Other": "https://docs.aws.amazon.com/securityhub/latest/userguide/codebuild-controls.html",


Suggested change

"Other": "https://docs.aws.amazon.com/securityhub/latest/userguide/codebuild-controls.html",

"Other": "https://docs.aws.amazon.com/securityhub/latest/userguide/codebuild-controls.html#codebuild-2",

sergargar · 2024-08-12T12:05:19Z

...uild_project_no_secrets_in_variables/codebuild_project_no_secrets_in_variables.metadata.json

+  "Description": "This check ensures that AWS CodeBuild projects do not use plaintext AWS_ACCESS_KEY_ID and AWS_SECRET_ACCESS_KEY as environment variables.",
+  "Risk": "Using plaintext AWS credentials in CodeBuild project environment variables can expose these sensitive keys, leading to unauthorized access and potential security breaches.",


Do this description generic, this check is not only flagging AWS credentials.

sergargar · 2024-08-12T12:05:25Z

...uild_project_no_secrets_in_variables/codebuild_project_no_secrets_in_variables.metadata.json

+{
+  "Provider": "aws",
+  "CheckID": "codebuild_project_no_secrets_in_variables",
+  "CheckTitle": "Ensure CodeBuild projects do not contain plaintext AWS credentials",


Do this title generic, this check is not only flagging AWS credentials.

sergargar

Great work @danibarranqueroo ! Please, update the metadata of the check according to the new changes.

sergargar

👏🏼

danibarranqueroo added 5 commits August 1, 2024 11:47

feat(aws): Modify CodeBuild service to add environment variables

59d214d

feat(aws): Add check and metadata for codebuild projects with plainte…

2b413f2

…xt credentials

feat(aws): Change methods names from __x__ to _x

5906bf9

feat(aws): Rewrite method name threadincall and added check test

4014f38

feat(aws): Changed test from moto to magicmock

9934343

danibarranqueroo requested review from a team as code owners August 5, 2024 09:49

github-actions bot added the provider/aws Issues/PRs related with the AWS provider label Aug 5, 2024

jfagoagas reviewed Aug 5, 2024

View reviewed changes

danibarranqueroo added 3 commits August 5, 2024 13:28

feat(aws): Add audit_config support

88e2c82

feat(aws): Change test_no_project because it fails on github tests

e6bb287

feat(aws): Change mock test

92d46d5

sergargar reviewed Aug 6, 2024

View reviewed changes

danibarranqueroo added 3 commits August 7, 2024 11:55

feat(aws): Adapt detect secrets to this check

2af890e

feat(aws): Adapt detect secrets to this check

cd2f742

feat(aws): Add audit config to exclude custom env vars scanning

b447a8c

github-actions bot added the documentation label Aug 7, 2024

danibarranqueroo and others added 4 commits August 7, 2024 18:13

feat(aws): Fix config file format

2439807

Merge branch 'master' into PRWLR-4246-add-new-code-build-check-to-val…

fcb72e0

…idate-environment-variables

fix flake8

ee2988a

feat(aws): Fix config test fail

6b56783

sergargar reviewed Aug 12, 2024

View reviewed changes

sergargar requested changes Aug 12, 2024

View reviewed changes

feat(aws): Check metadata modified

2e17ccc

sergargar approved these changes Aug 13, 2024

View reviewed changes

sergargar merged commit 62a1d91 into prowler-cloud:master Aug 13, 2024
11 of 12 checks passed

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

feat(aws): Add new CodeBuild check to validate environment variables #4632

feat(aws): Add new CodeBuild check to validate environment variables #4632

danibarranqueroo commented Aug 5, 2024

jfagoagas Aug 5, 2024 •

edited

Loading

danibarranqueroo Aug 5, 2024

codecov bot commented Aug 6, 2024 •

edited

Loading

sergargar commented Aug 6, 2024

jfagoagas commented Aug 6, 2024

sergargar commented Aug 6, 2024

sergargar Aug 6, 2024

jfagoagas commented Aug 6, 2024

danibarranqueroo commented Aug 8, 2024

sergargar Aug 12, 2024

sergargar Aug 12, 2024

sergargar Aug 12, 2024

sergargar left a comment

sergargar left a comment

	"CheckID": "codebuild_project_no_plaintext_credentials",
	"CheckID": "codebuild_project_no_secrets_in_variables",

	"Other": "https://docs.aws.amazon.com/securityhub/latest/userguide/codebuild-controls.html",
	"Other": "https://docs.aws.amazon.com/securityhub/latest/userguide/codebuild-controls.html#codebuild-2",

		"Description": "This check ensures that AWS CodeBuild projects do not use plaintext AWS_ACCESS_KEY_ID and AWS_SECRET_ACCESS_KEY as environment variables.",
		"Risk": "Using plaintext AWS credentials in CodeBuild project environment variables can expose these sensitive keys, leading to unauthorized access and potential security breaches.",

feat(aws): Add new CodeBuild check to validate environment variables #4632

feat(aws): Add new CodeBuild check to validate environment variables #4632

Conversation

danibarranqueroo commented Aug 5, 2024

Context

Description

License

jfagoagas Aug 5, 2024 • edited Loading

Choose a reason for hiding this comment

danibarranqueroo Aug 5, 2024

Choose a reason for hiding this comment

codecov bot commented Aug 6, 2024 • edited Loading

Codecov Report

sergargar commented Aug 6, 2024

jfagoagas commented Aug 6, 2024

sergargar commented Aug 6, 2024

sergargar Aug 6, 2024

Choose a reason for hiding this comment

jfagoagas commented Aug 6, 2024

danibarranqueroo commented Aug 8, 2024

sergargar Aug 12, 2024

Choose a reason for hiding this comment

sergargar Aug 12, 2024

Choose a reason for hiding this comment

sergargar Aug 12, 2024

Choose a reason for hiding this comment

sergargar left a comment

Choose a reason for hiding this comment

sergargar left a comment

Choose a reason for hiding this comment

jfagoagas Aug 5, 2024 •

edited

Loading

codecov bot commented Aug 6, 2024 •

edited

Loading