CodeBuild project environment variables should not contain plaintext secrets

What it checks

CodeBuild project: environment variable with a secret-like name uses type PLAINTEXT.

Where it applies

Terraform: aws_codebuild_project

CloudFormation: AWS::CodeBuild::Project

How to fix it

1. Move plaintext secret environment variables to Secrets Manager or SSM Parameter Store (SecureString). Change type from PLAINTEXT to SECRETS_MANAGER or PARAMETER_STORE.
2. Rotate any secrets that were stored as PLAINTEXT — they may have been captured in build logs or the project configuration.

Frameworks

• AWS FSBP CodeBuild.2
• SOC 2 CC6.1
• PCI-DSS v4.0.1/8.3.2

These mappings are advisory, not an attestation of compliance.

Vendor documentation

All rules