Sign-in Credentials Should Not Be In Bitbucket Source Repository URL CodeBuild

​

1. Identify the misconfigured CodeBuild project

1. Sign in to the AWS Management Console.
2. Go to CodeBuild:
   Services → search for CodeBuild → open CodeBuild.
3. In the left menu, select Build projects.
4. Click the project name that is using Bitbucket and has a URL like:
   https://username:password@bitbucket.org/workspace/repo.git.

​

2. Edit the project source configuration

1. In the project details page, click Edit (top right).
2. In the Source section, verify:
   • Source provider: should be Bitbucket (not “Git” with a raw HTTPS URL).
3. If Source provider is currently set to Git:
   • Change Source provider to Bitbucket.
   • In the Repository field, specify the repo using a clean URL (no credentials), e.g.:
     https://bitbucket.org/workspace/repo.git
     or, if it’s an option in the UI, just select the repository from the Bitbucket connection (recommended).

​

3. Connect CodeBuild to Bitbucket without embedding credentials in URL

​

A. If Bitbucket OAuth / integration is available

1. In the Source section (with provider = Bitbucket), look for an option like:
   • Connect to Bitbucket, Connect using OAuth, or Connect to source provider.
2. Click that and follow the prompts:
   • You will be redirected to Bitbucket to authorize AWS CodeBuild.
   • Approve the permissions so AWS can clone the repo.
3. Back in CodeBuild, select the Bitbucket repository from the list (if presented).
4. Ensure the repository URL now shows without credentials.

​

B. If you must use HTTPS with an app password/personal token

1. In Bitbucket:
   • Create an App Password or personal access token with minimally required scopes.
2. In AWS:
   • Go to AWS Secrets Manager.
   • Store the username and app password in a secret (e.g., bitbucket/codebuild/creds).
3. Back in CodeBuild project → Edit:
   • Scroll to Environment section.
   • Add environment variables like:
     • BITBUCKET_USERNAME = (value from Secrets Manager, as a secrets-managed variable)
     • BITBUCKET_APP_PASSWORD = (also from Secrets Manager)
   • Use the “Secrets Manager” option for value type, and select your secret/JSON key.
4. In your buildspec.yml, replace any direct git clone https://user:pass@... with something like:
   git clone https://$BITBUCKET_USERNAME:$BITBUCKET_APP_PASSWORD@bitbucket.org/workspace/repo.git
   
   This way, the URL never contains literal credentials in the CodeBuild configuration.

​

4. Save the project

1. After updating the source and/or environment configuration, scroll down and click Update build project (or Save).

​

5. Remove leaked credentials from Bitbucket URL and rotate them

1. In Bitbucket, revoke or delete:
   • Any username/password or app password that was embedded in the URL.
2. If that password is used elsewhere, change/rotate it.
3. If the credential was committed into any repository:
   • Remove it from the code (commit a change that removes it).
   • Consider history rewriting and rotating the credential, depending on your security policy.

​

6. Verify

1. In CodeBuild, start a new build of the edited project.
2. Confirm:
   • The build successfully pulls from Bitbucket.
   • No credentials appear in the repository URL shown in the project settings.
   • Logs don’t print credentials (check any echo/print commands).

​

0. Understand the problem

https://username:password@bitbucket.org/org/repo.git

1. Remove username:password@ from the URL.
2. Use a proper auth mechanism (CodeStar Connection or OAuth/source credentials).
3. Rotate/revoke the exposed credentials.

​

1. Rotate/revoke exposed Bitbucket credentials

• Revoke the username/password (or app password) that was embedded in the URL.
• Create a new, properly scoped credential if still needed (e.g., app password or OAuth token).

​

2. Get current CodeBuild project config

PROJECT_NAME="your-codebuild-project-name"

aws codebuild batch-get-projects \
  --names "$PROJECT_NAME" \
  --query 'projects[0]' \
  --output json > current-project.json

​

3. Decide on proper auth mechanism

​

Option A (recommended): Use CodeStar Connections

1. In the AWS Console:
   Developer Tools → Connections → Create connection → Bitbucket
   Get the connection ARN, e.g.:
   arn:aws:codestar-connections:us-east-1:123456789012:connection/abcdef12-3456-7890-abcd-ef1234567890
   
2. In CodeBuild, you then use GIT as source and specify sourceIdentifier as this connection. However, with CLI, this is done via source configuration using sourceType=BITBUCKET + auth OR through “Git repository in CodeStar Connections” (varies by region/console). The more universal approach is to use GIT + CodeStar connection via environment variable for CODEBUILD_SOURCE_REPO_URL and connection in CodePipeline; but for direct CodeBuild project, you can do: Use BITBUCKET with auth.type=OAUTH or use CodePipeline + CodeStar connection as the frontend. If you already have a working CodePipeline+Connection, you can just change CodeBuild project to CODEPIPELINE source and let the pipeline handle Bitbucket auth.

• Use CodePipeline + CodeStar Connections, with CodeBuild’s source.type=CODEPIPELINE.

​

Option B: Use CodeBuild source credentials (OAUTH / personal token)

aws codebuild import-source-credentials \
  --server-type BITBUCKET \
  --auth-type PERSONAL_ACCESS_TOKEN \
  --token "YOUR_BITBUCKET_APP_PASSWORD_OR_TOKEN"

• source.type = BITBUCKET
• source.location = https://bitbucket.org/org/repo.git (no credentials)
• source.auth.type = PERSONAL_ACCESS_TOKEN (or OAUTH)
• source.auth.resource = <source-credential-ARN>

​

4. Edit the project JSON (remove credentials from URL and add auth)

"source": {
  "type": "BITBUCKET",
  "location": "https://username:password@bitbucket.org/org/repo.git",
  "gitCloneDepth": 1,
  ...
}

"source": {
  "type": "BITBUCKET",
  "location": "https://bitbucket.org/org/repo.git",
  "auth": {
    "type": "PERSONAL_ACCESS_TOKEN",
    "resource": "arn:aws:codebuild:us-east-1:123456789012:sourceCredential/abcd1234-ef56-..."
  },
  "gitCloneDepth": 1,
  "insecureSsl": false
}

Note: If you prefer OAuth, use "type": "OAUTH" in auth and set "resource" to the appropriate credential ARN returned by import-source-credentials.

​

5. Update the CodeBuild project via CLI

aws codebuild update-project \
  --name "$PROJECT_NAME" \
  --source "file://<(jq '.source' updated-project.json)" \
  >/dev/null

jq '.source' updated-project.json > source-only.json

aws codebuild update-project \
  --name "$PROJECT_NAME" \
  --source file://source-only.json

​

6. Confirm the URL no longer contains credentials

aws codebuild batch-get-projects \
  --names "$PROJECT_NAME" \
  --query 'projects[0].source' \
  --output json

• location is https://bitbucket.org/org/repo.git (no username:password@).
• auth is present and correctly set.

​

7. (Optional) Clean up any stored plaintext credentials in configs

• Check buildspecs and environment variables for embedded Bitbucket usernames/passwords.
• Rotate any other secrets that may have been exposed the same way.

​

1. What’s wrong now

"source": {
  "type": "BITBUCKET",
  "location": "https://username:password@bitbucket.org/workspace/repo.git",
  ...
}

​

2. Immediate security actions

1. Rotate/revoke the exposed Bitbucket credentials
   • Log in to Bitbucket.
   • Go to Personal settings → App passwords (or wherever those credentials were created).
   • Revoke the exposed password/token.
   • Create a new app password / token with minimum required scopes.
2. Search for other leaks
   • Search your CodeBuild buildspecs, environment variables, and parameter store for the same username/password or token and remove/rotate them too.

​

3. Fix the CodeBuild project configuration

​

Option A (recommended when possible): Use CodeStar Connections via CodePipeline

1. Create a CodeStar Connection to Bitbucket in the AWS Console (Developer Tools → Connections).
2. Use that connection in CodePipeline as the source.
3. Have CodePipeline trigger your CodeBuild project; then your CodeBuild source type is CODEPIPELINE (no URL, no credentials).

​

Option B: Use a clean URL and managed auth for BITBUCKET source

• The location must not contain credentials.
• Configure authentication using source.auth and store any tokens/credentials in a secure store (e.g., Secrets Manager), not in the URL.

https://bitbucket.org/workspace/repo.git

​

4. Python (boto3) remediation script

• Finds CodeBuild projects whose source URL contains @ with credentials.
• Rewrites location to remove the credential portion.
• Leaves all other settings intact.
• (You still must handle token/OAuth setup separately as above.)

import re
import boto3

codebuild = boto3.client('codebuild')

def strip_credentials_from_url(url: str) -> str:
    """
    Remove any 'user:pass@' or 'token@' portion from a Git URL.
    Example:
      https://user:pass@bitbucket.org/work/repo.git
      -> https://bitbucket.org/work/repo.git
    """
    # matches scheme://anything@rest
    return re.sub(r'^(https?://)[^/@]+@', r'\1', url)

def remediate_project(project_name: str):
    proj = codebuild.batch_get_projects(names=[project_name])['projects'][0]
    src = proj['source']

    old_location = src.get('location', '')
    if '@' not in old_location:
        print(f"[SKIP] {project_name}: no credentials in location")
        return

    new_location = strip_credentials_from_url(old_location)
    if new_location == old_location:
        print(f"[SKIP] {project_name}: could not simplify URL safely")
        return

    src['location'] = new_location

    # Build the update payload. Use existing values for everything else.
    update_params = {
        'name': proj['name'],
        'source': src,
        'environment': proj['environment'],
        'serviceRole': proj['serviceRole'],
        'artifacts': proj['artifacts'],
    }

    # Optional fields if present
    for key in [
        'description', 'timeoutInMinutes', 'queuedTimeoutInMinutes',
        'encryptionKey', 'tags', 'logsConfig', 'vpcConfig',
        'badgeEnabled', 'buildTimeoutInMinutes', 'secondarySources',
        'secondaryArtifacts', 'fileSystemLocations', 'sourceVersion',
        'concurrentBuildLimit', 'projectVisibility'
    ]:
        if key in proj:
            update_params[key] = proj[key]

    codebuild.update_project(**update_params)
    print(f"[FIXED] {project_name}: {old_location} -> {new_location}")

def main():
    # 1. List all projects
    paginator = codebuild.get_paginator('list_projects')
    for page in paginator.paginate():
        for name in page['projects']:
            try:
                remediate_project(name)
            except Exception as e:
                print(f"[ERROR] {name}: {e}")

if __name__ == "__main__":
    main()

• Ensures source.location no longer contains username:password@ or token@.
• Does not put any new secret into the URL.
• Leaves room for you to configure proper Bitbucket auth via:
  • CodeStar Connections + CodePipeline (preferred), or
  • Console-based OAuth setup for BITBUCKET source and/or use of secrets (never hard-coded).

​

5. Final checklist

1. Revoke old Bitbucket credentials and create new ones.
2. Remove credentials from:
   • CodeBuild source.location
   • buildspec files
   • environment variables / Parameter Store values (if plaintext)
3. Configure secure auth:
   • Prefer CodeStar Connections via CodePipeline, or
   • Use Bitbucket OAuth / tokens stored in Secrets Manager, never in URLs.
4. Run the Python/boto3 script to clean all affected CodeBuild projects.