CodeBuild project environment variables should not contain clear text credentials

How to fix it

• Can break clients: Grant the service role secretsmanager:GetSecretValue or ssm:GetParameters on the secret or parameter first (and kms:Decrypt for a customer managed key), or every build fails.

In the console

CodeBuild → Build projects → the project → Edit → Environment → Additional configuration → Environment variables

Type

Secrets Manager or Parameter, with Value naming the secret or parameter instead of holding the credential

Environment variables

Remove AWS_ACCESS_KEY_ID and AWS_SECRET_ACCESS_KEY where you can: builds already get the service role's credentials

With Terraform

resource "aws_codebuild_project" "this" {
  name         = var.project_name
  service_role = var.service_role_arn

  artifacts {
    type = var.artifacts_type
  }

  source {
    type = var.source_type
  }

  environment {
    compute_type = var.compute_type
    image        = var.build_image
    type         = var.environment_type

    environment_variable {
      name  = var.credential_variable_name
      value = var.secret_id
      type  = "SECRETS_MANAGER"
    }
  }
}