Codebuild project environment privileged remediation

Using Console

To enable privileged mode for an AWS CodeBuild project using the AWS Management Console:

Sign in to the AWS Console
- Go to: https://console.aws.amazon.com/
- Make sure you are in the correct Region where the CodeBuild project exists.
Open CodeBuild
- In the top search bar, type CodeBuild and select CodeBuild from the results.
Select the Project
- In the left menu, click Build projects.
- Find your project in the list and click the project name.
Edit the Project
- On the project details page, in the top right, click Edit.
Go to Environment Settings
- Scroll to the Environment section.
- Look for the Additional configuration or directly visible environment options (AWS occasionally shifts the layout).
Enable Privileged Mode
- Find the checkbox Privileged (sometimes labeled “Enable this flag if you want to build Docker images or use the Docker daemon”).
- Check Privileged to enable privileged mode.
Save Changes
- Scroll to the bottom of the page.
- Click Update build project (or Save changes, depending on UI).
Verify
- After saving, reopen the project’s details page.
- Confirm under Environment that Privileged mode is shown as Enabled.

You can now run builds that require Docker-in-Docker or access to the Docker daemon inside the build container.

Using CLI

To enable privileged mode on an existing AWS CodeBuild project via AWS CLI, you must update the project’s environment configuration and set privilegedMode to true.

1. Get the existing project configuration

PROJECT_NAME="my-codebuild-project"

aws codebuild batch-get-projects \
  --names "$PROJECT_NAME" \
  > project.json

The file project.json will contain all current settings.

2. Extract the current environment block

ENVIRONMENT_JSON=$(jq -r '.projects[0].environment' project.json)
echo "$ENVIRONMENT_JSON" | jq

You’ll see fields like type, image, computeType, environmentVariables, etc.

3. Modify environment to enable privilegedMode

Use jq to add/set "privilegedMode": true:

UPDATED_ENVIRONMENT=$(echo "$ENVIRONMENT_JSON" \
  | jq '.privilegedMode = true')

4. Update the project with the modified environment

You must pass all required environment fields back, not just privilegedMode.

aws codebuild update-project \
  --name "$PROJECT_NAME" \
  --environment "$UPDATED_ENVIRONMENT"

If you also need to preserve/update other fields (e.g., serviceRole, source, artifacts, etc.), you can supply them too, for example:

SERVICE_ROLE=$(jq -r '.projects[0].serviceRole' project.json)
DESCRIPTION=$(jq -r '.projects[0].description // empty' project.json)
SOURCE=$(jq -r '.projects[0].source' project.json)
ARTIFACTS=$(jq -r '.projects[0].artifacts' project.json)
CACHE=$(jq -r '.projects[0].cache' project.json)
TAGS=$(jq -r '.projects[0].tags' project.json)
VPC_CONFIG=$(jq -r '.projects[0].vpcConfig' project.json)

aws codebuild update-project \
  --name "$PROJECT_NAME" \
  --description "$DESCRIPTION" \
  --service-role "$SERVICE_ROLE" \
  --source "$SOURCE" \
  --artifacts "$ARTIFACTS" \
  --cache "$CACHE" \
  --environment "$UPDATED_ENVIRONMENT" \
  --vpc-config "$VPC_CONFIG" \
  --tags "$TAGS"

(Include only the parameters relevant to your project; some optional fields may be omitted if not in use.)

5. Verify privileged mode is enabled

aws codebuild batch-get-projects \
  --names "$PROJECT_NAME" \
  | jq '.projects[0].environment.privilegedMode'

The output should be true.

Using Python

To remediate this, you need to update each affected CodeBuild project and set environment.privilegedMode = True using the CodeBuild API (via boto3 in Python).Below is a minimal, complete example.

1. Install and configure `boto3` (if not already)

pip install boto3
aws configure   # configure credentials & region

2. Python script to enable privileged mode on one project

import boto3

codebuild = boto3.client("codebuild")

PROJECT_NAME = "your-project-name"  # <-- change this

def enable_privileged_mode(project_name: str):
    # 1. Get existing project configuration
    resp = codebuild.batch_get_projects(names=[project_name])
    if not resp["projects"]:
        raise ValueError(f"Project '{project_name}' not found")

    project = resp["projects"][0]

    # 2. Prepare updated fields
    # Most fields are required when calling update_project,
    # so we copy the existing config and modify environment.privilegedMode.
    updated_environment = project["environment"].copy()
    updated_environment["privilegedMode"] = True

    # 3. Call update_project with all required parameters
    codebuild.update_project(
        name=project["name"],
        description=project.get("description"),
        source=project["source"],
        secondarySources=project.get("secondarySources", []),
        artifacts=project["artifacts"],
        secondaryArtifacts=project.get("secondaryArtifacts", []),
        cache=project.get("cache"),
        environment=updated_environment,
        serviceRole=project["serviceRole"],
        timeoutInMinutes=project.get("timeoutInMinutes"),
        queuedTimeoutInMinutes=project.get("queuedTimeoutInMinutes"),
        encryptionKey=project.get("encryptionKey"),
        tags=project.get("tags", []),
        vpcConfig=project.get("vpcConfig"),
        badgeEnabled=project.get("badge"]["badgeEnabled"] if "badge" in project else None,
        logsConfig=project.get("logsConfig"),
        fileSystemLocations=project.get("fileSystemLocations", []),
        buildBatchConfig=project.get("buildBatchConfig"),
        concurrentBuildLimit=project.get("concurrentBuildLimit"),
        visibility=project.get("visibility"),
        resourceAccessRole=project.get("resourceAccessRole"),
        buildTimeoutInMinutes=project.get("buildTimeoutInMinutes"),
        queuedTimeoutInMinutesOverride=project.get("queuedTimeoutInMinutesOverride")
    )

    print(f"Privileged mode enabled for project: {project_name}")

if __name__ == "__main__":
    enable_privileged_mode(PROJECT_NAME)

Note: Some optional parameters vary by SDK version; if any key is invalid in your environment, remove it from update_project. At minimum, you must pass name, source, artifacts, environment, and serviceRole.

3. Script to enable privileged mode for all projects that don’t have it

import boto3

codebuild = boto3.client("codebuild")

def list_all_projects():
    names = []
    token = None
    while True:
        kwargs = {}
        if token:
            kwargs["nextToken"] = token
        resp = codebuild.list_projects(**kwargs)
        names.extend(resp.get("projects", []))
        token = resp.get("nextToken")
        if not token:
            break
    return names

def enable_privileged_on_all():
    project_names = list_all_projects()
    for chunk_start in range(0, len(project_names), 100):
        chunk = project_names[chunk_start:chunk_start + 100]
        projects_resp = codebuild.batch_get_projects(names=chunk)
        for project in projects_resp["projects"]:
            env = project["environment"]
            if env.get("privilegedMode"):
                continue  # already enabled

            env_updated = env.copy()
            env_updated["privilegedMode"] = True

            codebuild.update_project(
                name=project["name"],
                source=project["source"],
                artifacts=project["artifacts"],
                environment=env_updated,
                serviceRole=project["serviceRole"],
            )
            print(f"Enabled privilegedMode for {project['name']}")

if __name__ == "__main__":
    enable_privileged_on_all()

(Here we only use the minimum required fields to keep the example simple; add other fields as needed, following the first script.)

This will remediate the “Privileged Mode Should Be Enabled” finding by programmatically turning on privilegedMode for the CodeBuild project environment via Python.

Using Terraform

resource "aws_codebuild_project" "THIS_PROJECT" {
  name         = "CODEBUILD_PROJECT_NAME" # replace with your project name
  service_role = "CODEBUILD_SERVICE_ROLE_ARN" # replace with an IAM role ARN

  environment {
    compute_type                = "BUILD_GENERAL1_SMALL"
    image                       = "aws/codebuild/standard:7.0"
    type                        = "LINUX_CONTAINER"
    privileged_mode             = true          # enable privileged mode
    image_pull_credentials_type = "CODEBUILD"
  }

  source {
    type            = "GITHUB"
    location        = "REPO_CLONE_URL" # replace with your repo
    git_clone_depth = 1
  }

  artifacts {
    type = "NO_ARTIFACTS"
  }

  # ...any other arguments you already use...
}

This change updates the existing CodeBuild project in place; it does not force resource replacement. After editing, terraform plan should show an in-place update with privileged_mode changing from false (or omitted) to true for the environment block of aws_codebuild_project.THIS_PROJECT.

AWS Introduction

AWS Pricing

AWS Threats

AWS Misconfigurations

Codebuild project environment privileged remediation

Triage and Remediation

Remediation

1. Get the existing project configuration

2. Extract the current environment block

3. Modify environment to enable privilegedMode

4. Update the project with the modified environment

5. Verify privileged mode is enabled

1. Install and configure `boto3` (if not already)

2. Python script to enable privileged mode on one project

3. Script to enable privileged mode for all projects that don’t have it

​Triage and Remediation

​Remediation

​1. Get the existing project configuration

​2. Extract the current environment block

​3. Modify environment to enable privilegedMode

​4. Update the project with the modified environment

​5. Verify privileged mode is enabled

​1. Install and configure boto3 (if not already)

​2. Python script to enable privileged mode on one project

​3. Script to enable privileged mode for all projects that don’t have it

Triage and Remediation

Remediation

1. Get the existing project configuration

2. Extract the current environment block

3. Modify environment to enable privilegedMode

4. Update the project with the modified environment

5. Verify privileged mode is enabled

1. Install and configure `boto3` (if not already)

2. Python script to enable privileged mode on one project

3. Script to enable privileged mode for all projects that don’t have it