AWS codebuild high security documentation change
Summary
Added a note explaining that secret masking in logs requires exact value matching and recommends storing transformed secrets directly
Security assessment
The change explicitly addresses secret exposure risks by documenting that transformed secrets (e.g., Base64-encoded) appear unmasked in logs. This prevents accidental credential leaks by recommending storing secrets in their final transformed state.
Diff
diff --git a/codebuild/latest/userguide/build-spec-ref.md b/codebuild/latest/userguide/build-spec-ref.md index a19eaed52..7e4a968fd 100644 --- a//codebuild/latest/userguide/build-spec-ref.md +++ b//codebuild/latest/userguide/build-spec-ref.md @@ -213,0 +214,6 @@ To protect sensitive information, the following are hidden in CodeBuild logs: +###### Note + +Masking matches the exact value stored in Amazon EC2 Systems Manager Parameter Store or AWS Secrets Manager. If a build command transforms a secret before it appears in the logs, the result is a different string that is not masked. For example, encoding it with Base64, reversing it, changing case, or concatenating it with other text creates a different value that can appear in the build logs. + +To keep a value masked, store it in the form your build uses. For example, if your build requires a Base64-encoded value, store the Base64-encoded string directly in AWS Secrets Manager or Amazon EC2 Systems Manager Parameter Store. This way, the logged value matches the stored value. +