CodeBuild.1: A CodeBuild Bitbucket URL contains embedded credentials

What does AWS Security Hub CodeBuild.1 check?

CodeBuild.1 fails any CodeBuild project — primary source or any secondary source — whose Bitbucket source URL contains a username and password or a personal access token in the userinfo component (the username:password@ that precedes the host).

Why does CodeBuild.1 matter?

That URL is readable by anyone with codebuild:BatchGetProjects or console access, gets copied into CloudFormation templates and Terraform state, and echoes into CloudTrail and build logs. The location field is not a secret store — it has no encryption-at-rest boundary. A leaked repo token is a foothold into every branch and commit history, where the next set of hardcoded secrets usually lives.

How do I fix CodeBuild.1?

1. Enumerate all projects across accounts and regions and inspect both source.location and every secondarySources[].location for a user:secret@host shape.
2. Reconnect the source using OAuth in the console — Disconnect from Bitbucket, then Connect using OAuth — so location carries only the repo path.
3. Revoke the exposed credential at Bitbucket, since copies already exist in IaC, CloudTrail, and build logs.
4. Enable the AWS Config rule codebuild-project-source-repo-url-check and scope down BatchGetProjects so the standard holds.

# Find active credentials idle past 45 days and disable them (review before deleting).
CUTOFF=$(date -u -d '45 days ago' +%Y-%m-%d)
aws iam generate-credential-report >/dev/null
aws iam get-credential-report --query Content --output text | base64 -d \
  | awk -F, -v c="$CUTOFF" 'NR>1 && $9=="true" && $11<c {print $1, $10}'
aws iam update-access-key --user-name old-contractor \
  --access-key-id AKIAIOSFODNN7EXAMPLE --status Inactive

# Apply the CIS-aligned IAM password policy in one idempotent call.
aws iam update-account-password-policy --minimum-password-length 14 \
  --require-uppercase-characters --require-lowercase-characters \
  --require-numbers --require-symbols --password-reuse-prevention 24

# A clear-text key in a build project is compromised: rotate and delete, never just relocate.
aws iam delete-access-key --user-name ci-deploy --access-key-id AKIAIOSFODNN7EXAMPLE