Detection: CodeBuild Project Source Repository Updated
Overview
Detect when the source repository configuration of an AWS CodeBuild project was updated. Unauthorized or unintended changes can lead to builds using untrusted or malicious code, disrupting workflows and compromising downstream systems. Monitoring these updates ensures the security and integrity of the build process.
References:
Usage
Run the detection in your terminal:
powerpipe detection run aws_cloudtrail_log_detections.detection.codebuild_project_source_repository_updatedSnapshot and share results via Turbot Pipes:
powerpipe loginpowerpipe detection run aws_cloudtrail_log_detections.detection.codebuild_project_source_repository_updated --shareSQL
This detection uses a named query:
select tp_timestamp as timestamp,string_split(event_source, '.')[1] || ':' || event_name as operation,request_parameters ->> 'name' as resource,user_identity.arn as actor,tp_source_ip as source_ip,tp_index as account_id,aws_region as region,tp_id as source_id,*
from aws_cloudtrail_logwhere event_source = 'codebuild.amazonaws.com' and event_name = 'UpdateProject' and (request_parameters -> 'source' ->> 'location') is not null and error_code is null
order by event_time desc;