AWS codebuild high security documentation change
Summary
Added identical note about secret masking requirements and transformed secret storage recommendations
Security assessment
Reinforces data protection guidance by documenting how secret transformations bypass log masking, directly addressing credential exposure risks in build logs through proper secret storage practices.
Diff
diff --git a/codebuild/latest/userguide/data-protection.md b/codebuild/latest/userguide/data-protection.md index c861bb95a..b2639fac2 100644 --- a//codebuild/latest/userguide/data-protection.md +++ b//codebuild/latest/userguide/data-protection.md @@ -38,0 +39,6 @@ To protect sensitive information, the following are hidden in CodeBuild logs: +###### Note + +Masking matches the exact value stored in Amazon EC2 Systems Manager Parameter Store or AWS Secrets Manager. If a build command transforms a secret before it appears in the logs, the result is a different string that is not masked. For example, encoding it with Base64, reversing it, changing case, or concatenating it with other text creates a different value that can appear in the build logs. + +To keep a value masked, store it in the form your build uses. For example, if your build requires a Base64-encoded value, store the Base64-encoded string directly in AWS Secrets Manager or Amazon EC2 Systems Manager Parameter Store. This way, the logged value matches the stored value. +