AWS codebuild: Update OAuth docs for token rotation & migration

Service: codebuild · 2026-07-20 · Security-related medium

File: codebuild/latest/userguide/oauth-app-bitbucket.md · Type: iam

Summary

Added warnings about Bitbucket's rotating tokens and guidance to migrate to CodeConnections or update IAM permissions.

Security assessment

Ensures proper secret management by documenting required permissions for token rotation, mitigating credential staleness risks.

Evidence

add the `secretsmanager:PutSecretValue` permission to your CodeBuild service role

Diff

diff --git a/codebuild/latest/userguide/oauth-app-bitbucket.md b/codebuild/latest/userguide/oauth-app-bitbucket.md
index 9757a4657..210fc20d3 100644
--- a//codebuild/latest/userguide/oauth-app-bitbucket.md
+++ b//codebuild/latest/userguide/oauth-app-bitbucket.md
@@ -10,0 +11,8 @@ Connect Bitbucket using OAuth (console)
+###### Required action for Bitbucket OAuth token rotation
+
+Atlassian now enforces single-use rotating refresh tokens for Bitbucket OAuth. We recommend migrating to [Bitbucket App connections](./connections-bitbucket-app.html), which eliminates token management entirely. For instructions on migrating, see [Migrate to AWS CodeConnections (recommended)](./connections-bitbucket-app.html#connections-bitbucket-migrate-to-codeconnections).
+
+If you prefer to continue using OAuth with Secrets Manager, add the `secretsmanager:PutSecretValue` permission to your CodeBuild service role. For more information, see [Required action for Secrets Manager-stored credentials](./connections-bitbucket-app.html#connections-bitbucket-oauth-sm-action).
+
+If you use the CodeBuild-managed option, no changes are needed. CodeBuild handles token rotation automatically.
+
@@ -27 +35 @@ To use the console to connect your project to Bitbucket using an OAuth app, do t
-       1. If you choose to use **Secrets Manager** , you can choose to use an existing secret connection or create a new secret, and then choose **Save**. For more information how to create a new secret, see [Create and store a token in a Secrets Manager secret](./asm-create-secret.html).
+       1. If you choose to use **Secrets Manager** , you can choose to use an existing secret connection or create a new secret, and then choose **Save**. For more information about creating a new secret, see [Create and store a token in a Secrets Manager secret](./asm-create-secret.html).