mirror of
https://github.com/prowler-cloud/prowler.git
synced 2026-07-24 13:01:56 +00:00
chore(aws): enhance metadata for codebuild service (#8851)
Co-authored-by: HugoPBrito <hugopbrit@gmail.com> Co-authored-by: Hugo Pereira Brito <101209179+HugoPBrito@users.noreply.github.com>
This commit is contained in:
Rubén De la Torre Vico
committed by
GitHub
GitHub
parent
7e7f160b9a
commit
c441423d6a
@@ -21,6 +21,7 @@ All notable changes to the **Prowler SDK** are documented in this file.
|
||||
- Update AWS EKS service metadata to new format [(#8890)](https://github.com/prowler-cloud/prowler/pull/8890)
|
||||
- Update AWS Elastic Beanstalk service metadata to new format [(#8934)](https://github.com/prowler-cloud/prowler/pull/8934)
|
||||
- Update AWS ElastiCache service metadata to new format [(#8933)](https://github.com/prowler-cloud/prowler/pull/8933)
|
||||
- Update AWS CodeBuild service metadata to new format [(#8851)](https://github.com/prowler-cloud/prowler/pull/8851)
|
||||
- Update GCP Artifact Registry service metadata to new format [(#9088)](https://github.com/prowler-cloud/prowler/pull/9088)
|
||||
- Update AWS EFS service metadata to new format [(#8889)](https://github.com/prowler-cloud/prowler/pull/8889)
|
||||
- Update AWS EventBridge service metadata to new format [(#9003)](https://github.com/prowler-cloud/prowler/pull/9003)
|
||||
@@ -84,7 +85,6 @@ All notable changes to the **Prowler SDK** are documented in this file.
|
||||
- Update AWS CloudFront service metadata to new format [(#8829)](https://github.com/prowler-cloud/prowler/pull/8829)
|
||||
- Deprecate user authentication for M365 provider [(#8865)](https://github.com/prowler-cloud/prowler/pull/8865)
|
||||
|
||||
|
||||
### Fixed
|
||||
- Fix SNS topics showing empty AWS_ResourceID in Quick Inventory output [(#8762)](https://github.com/prowler-cloud/prowler/issues/8762)
|
||||
- Fix HTML Markdown output for long strings [(#8803)](https://github.com/prowler-cloud/prowler/pull/8803)
|
||||
|
||||
+22
-12
@@ -1,26 +1,36 @@
|
||||
{
|
||||
"Provider": "aws",
|
||||
"CheckID": "codebuild_project_logging_enabled",
|
||||
"CheckTitle": "Ensure that CodeBuild projects have S3 or CloudWatch logging enabled",
|
||||
"CheckType": [],
|
||||
"CheckTitle": "CodeBuild project has CloudWatch Logs or S3 logging enabled",
|
||||
"CheckType": [
|
||||
"Software and Configuration Checks/AWS Security Best Practices",
|
||||
"Software and Configuration Checks/Industry and Regulatory Standards/AWS Foundational Security Best Practices"
|
||||
],
|
||||
"ServiceName": "codebuild",
|
||||
"SubServiceName": "",
|
||||
"ResourceIdTemplate": "arn:partition:service:region:account-id:resource-id",
|
||||
"ResourceIdTemplate": "",
|
||||
"Severity": "medium",
|
||||
"ResourceType": "AwsCodeBuildProject",
|
||||
"Description": "Ensure that CodeBuild projects have S3 or CloudWatch logging enabled.",
|
||||
"Risk": "Without logging, tracking and investigating security incidents in CodeBuild projects becomes challenging, reducing confidence in threat detections.",
|
||||
"RelatedUrl": "https://docs.aws.amazon.com/codebuild/latest/userguide/change-project.html#change-project-console-logs",
|
||||
"Description": "**CodeBuild projects** are assessed for **logging configuration** to Amazon **CloudWatch Logs** or **S3**, identifying when at least one destination is `enabled` for build logs and events.",
|
||||
"Risk": "Absence of **build logging** creates blind spots for **integrity** and **accountability**. Attackers or misconfigurations can alter artifacts, exfiltrate data, or misuse credentials with little trace, hindering **forensics** and **incident response**. Missing telemetry impedes correlation with other alerts, risking source code and secret **confidentiality**.",
|
||||
"RelatedUrl": "",
|
||||
"AdditionalURLs": [
|
||||
"https://docs.aws.amazon.com/codebuild/latest/userguide/change-project.html#change-project-console-logs",
|
||||
"https://codefresh.io/learn/devops-tools/aws-codebuild-the-basics-and-a-quick-tutorial/",
|
||||
"https://asecure.cloud/a/cfgrule_codebuild-project-logging-enabled/",
|
||||
"https://support.icompaas.com/support/solutions/articles/62000233680-ensure-that-codebuild-projects-have-s3-or-cloudwatch-logging-enabled",
|
||||
"https://docs.aws.amazon.com/securityhub/latest/userguide/codebuild-controls.html#codebuild-4"
|
||||
],
|
||||
"Remediation": {
|
||||
"Code": {
|
||||
"CLI": "aws codebuild update-project --name <project-name> --logs-config \"cloudWatchLogs={status=ENABLED},s3Logs={status=ENABLED\"}",
|
||||
"NativeIaC": "",
|
||||
"Other": "https://docs.aws.amazon.com/securityhub/latest/userguide/codebuild-controls.html#codebuild-4",
|
||||
"Terraform": ""
|
||||
"CLI": "aws codebuild update-project --name <project-name> --logs-config \"cloudWatchLogs={status=ENABLED}\"",
|
||||
"NativeIaC": "```yaml\n# CloudFormation: Enable logging on a CodeBuild project\nResources:\n <example_resource_name>:\n Type: AWS::CodeBuild::Project\n Properties:\n Name: <example_resource_name>\n ServiceRole: <example_resource_id>\n Artifacts:\n Type: NO_ARTIFACTS\n Environment:\n Type: LINUX_CONTAINER\n ComputeType: BUILD_GENERAL1_SMALL\n Image: aws/codebuild/standard:5.0\n Source:\n Type: NO_SOURCE\n LogsConfig:\n CloudWatchLogs:\n Status: ENABLED # Critical: Enables CloudWatch logging to pass the check\n```",
|
||||
"Other": "1. In the AWS Console, go to CodeBuild > Build projects and open your project\n2. Under Logs, click Edit\n3. Check CloudWatch logs and save (or enable S3 logs instead)\n4. Confirm the project now shows logging enabled",
|
||||
"Terraform": "```hcl\n# Terraform: Enable logging on a CodeBuild project\nresource \"aws_codebuild_project\" \"<example_resource_name>\" {\n name = \"<example_resource_name>\"\n service_role = \"<example_resource_id>\"\n\n artifacts { type = \"NO_ARTIFACTS\" }\n\n environment {\n compute_type = \"BUILD_GENERAL1_SMALL\"\n image = \"aws/codebuild/standard:5.0\"\n type = \"LINUX_CONTAINER\"\n }\n\n source { type = \"NO_SOURCE\" }\n\n logs_config {\n cloudwatch_logs {\n status = \"ENABLED\" # Critical: Enables CloudWatch logging to pass the check\n }\n }\n}\n```"
|
||||
},
|
||||
"Recommendation": {
|
||||
"Text": "Enable logging for CodeBuild projects to capture build events and logs for future analysis and incident response.",
|
||||
"Url": "https://docs.aws.amazon.com/codebuild/latest/userguide/change-project.html#change-project-console-logs"
|
||||
"Text": "Enable a log destination for every project-**CloudWatch Logs** or **S3** (preferably both). Enforce **defense in depth**: encrypt logs, set retention, and restrict access on a least-privilege basis. Centralize and monitor logs, alert on anomalies, and avoid sensitive data in output. Use immutable retention to preserve **auditability**.",
|
||||
"Url": "https://hub.prowler.com/check/codebuild_project_logging_enabled"
|
||||
}
|
||||
},
|
||||
"Categories": [
|
||||
|
||||
+28
-12
@@ -1,31 +1,47 @@
|
||||
{
|
||||
"Provider": "aws",
|
||||
"CheckID": "codebuild_project_no_secrets_in_variables",
|
||||
"CheckTitle": "Ensure CodeBuild projects do not contain secrets on plaintext environment variables",
|
||||
"CheckTitle": "CodeBuild project has no sensitive credentials in plaintext environment variables",
|
||||
"CheckType": [
|
||||
"Security Best Practices"
|
||||
"Software and Configuration Checks/AWS Security Best Practices",
|
||||
"TTPs/Credential Access",
|
||||
"Effects/Data Exposure",
|
||||
"Sensitive Data Identifications/Security"
|
||||
],
|
||||
"ServiceName": "codebuild",
|
||||
"SubServiceName": "",
|
||||
"ResourceIdTemplate": "arn:partition:service:region:account-id:resource-id",
|
||||
"ResourceIdTemplate": "",
|
||||
"Severity": "critical",
|
||||
"ResourceType": "AwsCodeBuildProject",
|
||||
"Description": "This check ensures that AWS CodeBuild projects do not contain secrets in environment variables.",
|
||||
"Risk": "Using plaintext AWS credentials in CodeBuild project environment variables can expose these sensitive keys, leading to unauthorized access and potential security breaches.",
|
||||
"RelatedUrl": "https://docs.aws.amazon.com/codebuild/latest/userguide/how-to-create-project-console.html",
|
||||
"Description": "**AWS CodeBuild projects** are inspected for **plaintext environment variables** (`PLAINTEXT`) that resemble **secrets** (keys, tokens, passwords).\n\nSuch values indicate sensitive data is stored directly in environment variables instead of being sourced securely.",
|
||||
"Risk": "Plaintext secrets in environment variables reduce confidentiality: values can be viewed in consoles/CLI and may leak into build logs or public outputs. Compromised credentials enable unauthorized AWS actions, artifact tampering, and lateral movement, causing data exfiltration and CI/CD supply-chain compromise.",
|
||||
"RelatedUrl": "",
|
||||
"AdditionalURLs": [
|
||||
"https://docs.aws.amazon.com/codebuild/latest/userguide/build-spec-ref.html",
|
||||
"https://www.learnaws.org/2022/11/18/aws-codebuild-secrets-manager/",
|
||||
"https://www.learnaws.org/2023/08/23/codebuild-env-vars/",
|
||||
"https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-codebuild-project-environmentvariable.html",
|
||||
"https://docs.aws.amazon.com/codebuild/latest/userguide/change-project.html",
|
||||
"https://docs.aws.amazon.com/securityhub/latest/userguide/codebuild-controls.html#codebuild-2",
|
||||
"https://pasmichal.medium.com/how-to-handle-secrets-in-aws-codebuild-6e1b96013712",
|
||||
"https://medium.com/@odofing/aws-codepipeline-how-to-securely-store-environment-variables-in-ssm-paramater-store-and-aws-9a96d7083b3c"
|
||||
],
|
||||
"Remediation": {
|
||||
"Code": {
|
||||
"CLI": "",
|
||||
"NativeIaC": "",
|
||||
"Other": "https://docs.aws.amazon.com/securityhub/latest/userguide/codebuild-controls.html#codebuild-2",
|
||||
"Terraform": ""
|
||||
"NativeIaC": "```yaml\nResources:\n <example_resource_name>:\n Type: AWS::CodeBuild::Project\n Properties:\n Name: <example_resource_name>\n ServiceRole: <example_resource_arn>\n Source:\n Type: NO_SOURCE\n Artifacts:\n Type: NO_ARTIFACTS\n Environment:\n Type: LINUX_CONTAINER\n ComputeType: BUILD_GENERAL1_SMALL\n Image: aws/codebuild/standard:5.0\n EnvironmentVariables:\n - Name: <SENSITIVE_VAR_NAME>\n Type: SECRETS_MANAGER # CRITICAL: store secret in Secrets Manager to avoid PLAINTEXT\n Value: <example_secret_name> # Secret name or ARN (optionally include json-key)\n```",
|
||||
"Other": "1. In AWS Console, go to CodeBuild > Build projects and open your project\n2. Click Edit in the Environment section\n3. Under Environment variables, for each sensitive variable with Type = Plaintext, change Type to Secrets Manager (or Parameter store)\n4. Select the secret (or parameter) that holds the value, then Save\n5. If the secret/parameter does not exist, create it in Secrets Manager or Systems Manager Parameter Store first, then repeat steps 3-4",
|
||||
"Terraform": "```hcl\nresource \"aws_codebuild_project\" \"<example_resource_name>\" {\n name = \"<example_resource_name>\"\n service_role = \"<example_resource_arn>\"\n\n source {\n type = \"NO_SOURCE\"\n }\n\n artifacts {\n type = \"NO_ARTIFACTS\"\n }\n\n environment {\n compute_type = \"BUILD_GENERAL1_SMALL\"\n image = \"aws/codebuild/standard:5.0\"\n type = \"LINUX_CONTAINER\"\n\n environment_variable {\n name = \"<SENSITIVE_VAR_NAME>\"\n type = \"SECRETS_MANAGER\" # CRITICAL: use Secrets Manager so value isn't plaintext\n value = \"<example_secret_name>\"\n }\n }\n}\n```"
|
||||
},
|
||||
"Recommendation": {
|
||||
"Text": "Do not store secrets in plaintext environment variables. Use AWS Secrets Manager or AWS Systems Manager Parameter Store to securely store and retrieve sensitive information.",
|
||||
"Url": "https://docs.aws.amazon.com/codebuild/latest/userguide/change-project.html"
|
||||
"Text": "Store secrets outside the build and reference them via **AWS Secrets Manager** or **AWS Systems Manager Parameter Store** instead of `PLAINTEXT` variables.\n- Enforce **least privilege** on the build role\n- Rotate secrets; prefer short-lived credentials\n- Avoid logging or exporting secret values and never embed them in artifacts",
|
||||
"Url": "https://hub.prowler.com/check/codebuild_project_no_secrets_in_variables"
|
||||
}
|
||||
},
|
||||
"Categories": [],
|
||||
"Categories": [
|
||||
"secrets",
|
||||
"ci-cd"
|
||||
],
|
||||
"DependsOn": [],
|
||||
"RelatedTo": [],
|
||||
"Notes": ""
|
||||
|
||||
+22
-12
@@ -1,29 +1,39 @@
|
||||
{
|
||||
"Provider": "aws",
|
||||
"CheckID": "codebuild_project_not_publicly_accessible",
|
||||
"CheckTitle": "Ensure AWS CodeBuild projects are not public",
|
||||
"CheckType": [],
|
||||
"CheckTitle": "CodeBuild project visibility is private",
|
||||
"CheckType": [
|
||||
"Software and Configuration Checks/AWS Security Best Practices",
|
||||
"Effects/Data Exposure"
|
||||
],
|
||||
"ServiceName": "codebuild",
|
||||
"SubServiceName": "",
|
||||
"ResourceIdTemplate": "arn:aws:codebuild:region:account-id:project:project-name",
|
||||
"ResourceIdTemplate": "",
|
||||
"Severity": "high",
|
||||
"ResourceType": "AwsCodeBuildProject",
|
||||
"Description": "Check for CodeBuild projects ensuring that the project visibility is appropriate",
|
||||
"Risk": "Public CodeBuild Project ensures all build logs and artifacts are available to the public. Environment variables, source code, and other sensitive information may have been output to the build logs and artifacts. You must be careful about what information is output to the build logs.",
|
||||
"Description": "**AWS CodeBuild project visibility** is assessed to identify projects exposed to the public. Projects with `project_visibility` set to `PUBLIC_READ` (or not `PRIVATE`) allow anyone to access build results, logs, and artifacts.",
|
||||
"Risk": "Public visibility degrades CIA:\n- Logs may leak secrets, tokens, and source details\n- Artifacts are downloadable, enabling tampering and supply-chain malware\n- Adversaries gain CI/CD insights for reconnaissance and lateral movement",
|
||||
"RelatedUrl": "",
|
||||
"AdditionalURLs": [
|
||||
"https://docs.aws.amazon.com/codebuild/latest/userguide/public-builds.html",
|
||||
"https://docs.aws.amazon.com/cli/latest/reference/codebuild/update-project-visibility.html"
|
||||
],
|
||||
"Remediation": {
|
||||
"Code": {
|
||||
"NativeIaC": "",
|
||||
"Terraform": "",
|
||||
"CLI": "aws codebuild update-project --name <project-name> --project-visibility PRIVATE",
|
||||
"Other": ""
|
||||
"CLI": "aws codebuild update-project-visibility --project-arn <PROJECT_ARN> --project-visibility PRIVATE",
|
||||
"NativeIaC": "```yaml\nResources:\n <example_resource_name>:\n Type: AWS::CodeBuild::Project\n Properties:\n Name: <example_resource_name>\n ServiceRole: <example_role_arn>\n Artifacts:\n Type: NO_ARTIFACTS\n Environment:\n Type: LINUX_CONTAINER\n Image: aws/codebuild/standard:5.0\n ComputeType: BUILD_GENERAL1_SMALL\n Source:\n Type: NO_SOURCE\n Visibility: PRIVATE # Critical: makes the project private so builds aren't publicly accessible\n```",
|
||||
"Other": "1. Open the AWS Console and go to CodeBuild\n2. Select your build project\n3. Click Edit\n4. Set Project visibility to Private\n5. Save changes",
|
||||
"Terraform": "```hcl\nresource \"aws_codebuild_project\" \"<example_resource_name>\" {\n name = \"<example_resource_name>\"\n service_role = \"<example_role_arn>\"\n\n artifacts { type = \"NO_ARTIFACTS\" }\n\n environment {\n compute_type = \"BUILD_GENERAL1_SMALL\"\n image = \"aws/codebuild/standard:5.0\"\n type = \"LINUX_CONTAINER\"\n }\n\n source { type = \"NO_SOURCE\" }\n\n project_visibility = \"PRIVATE\" # Critical: ensures the project is not publicly accessible\n}\n```"
|
||||
},
|
||||
"Recommendation": {
|
||||
"Text": "Ensure that all CodeBuild projects are private to avoid fact gathering about builds from an Attacker.",
|
||||
"Url": "https://docs.aws.amazon.com/codebuild/latest/userguide/public-builds.html"
|
||||
"Text": "Set visibility to `PRIVATE` and share only with trusted principals using narrowly scoped policies. Apply **least privilege** to logs and artifacts, keeping them private. Manage secrets via **Secrets Manager** or **Parameter Store**, avoid printing them, and validate artifacts (e.g., checksums).",
|
||||
"Url": "https://hub.prowler.com/check/codebuild_project_not_publicly_accessible"
|
||||
}
|
||||
},
|
||||
"Categories": [],
|
||||
"Categories": [
|
||||
"internet-exposed",
|
||||
"ci-cd"
|
||||
],
|
||||
"DependsOn": [],
|
||||
"RelatedTo": [],
|
||||
"Notes": ""
|
||||
|
||||
+15
-10
@@ -1,32 +1,37 @@
|
||||
{
|
||||
"Provider": "aws",
|
||||
"CheckID": "codebuild_project_older_90_days",
|
||||
"CheckTitle": "Ensure CodeBuild Project has been invoked in the last 90 days",
|
||||
"CheckTitle": "CodeBuild project has been invoked in the last 90 days",
|
||||
"CheckType": [
|
||||
"Software and Configuration Checks",
|
||||
"Industry and Regulatory Standards"
|
||||
"Software and Configuration Checks/AWS Security Best Practices"
|
||||
],
|
||||
"ServiceName": "codebuild",
|
||||
"SubServiceName": "",
|
||||
"ResourceIdTemplate": "arn:partition:service:region:account-id:resource-id",
|
||||
"ResourceIdTemplate": "",
|
||||
"Severity": "medium",
|
||||
"ResourceType": "AwsCodeBuildProject",
|
||||
"Description": "Ensure CodeBuild Project has been invoked in the last 90 days",
|
||||
"Risk": "Older CodeBuild projects can be checked to see if they are currently in use.",
|
||||
"Description": "**AWS CodeBuild projects** are assessed for recent activity using the last build invocation timestamp. Projects not invoked within `90 days` or never built are treated as **inactive**.",
|
||||
"Risk": "**Inactive projects** increase **attack surface**. Dormant webhooks or **source credentials** can be abused, and attached **IAM roles** may retain excessive permissions. Stale configs can expose **secrets** in env vars or logs, threatening build **integrity** and data **confidentiality**, while adding avoidable cost and operational sprawl.",
|
||||
"RelatedUrl": "",
|
||||
"AdditionalURLs": [
|
||||
"https://docs.aws.amazon.com/codebuild/latest/userguide/delete-project.html",
|
||||
"https://support.icompaas.com/support/solutions/articles/62000233684-ensure-codebuild-project-has-been-invoked-in-the-last-90-days"
|
||||
],
|
||||
"Remediation": {
|
||||
"Code": {
|
||||
"CLI": "",
|
||||
"NativeIaC": "",
|
||||
"Other": "",
|
||||
"Other": "1. Open the AWS Console and go to CodeBuild\n2. In Build projects, select the project\n3. Click Start build, then confirm Start build\n4. Wait for the build to start to update the last invoked time",
|
||||
"Terraform": ""
|
||||
},
|
||||
"Recommendation": {
|
||||
"Text": "Check if CodeBuild project are really in use and remove the stale ones",
|
||||
"Url": "https://docs.aws.amazon.com/codebuild/latest/userguide/delete-project.html"
|
||||
"Text": "Implement lifecycle management: review projects idle over `90 days`, confirm ownership and need, then delete or archive. Revoke unused webhooks, tokens, and service roles; rotate any secrets. Enforce **least privilege**, tagging, and periodic audits to reduce **attack surface** and keep the build environment tidy and defensible.",
|
||||
"Url": "https://hub.prowler.com/check/codebuild_project_older_90_days"
|
||||
}
|
||||
},
|
||||
"Categories": [],
|
||||
"Categories": [
|
||||
"ci-cd"
|
||||
],
|
||||
"DependsOn": [],
|
||||
"RelatedTo": [],
|
||||
"Notes": ""
|
||||
|
||||
+19
-11
@@ -1,28 +1,36 @@
|
||||
{
|
||||
"Provider": "aws",
|
||||
"CheckID": "codebuild_project_s3_logs_encrypted",
|
||||
"CheckTitle": "Ensure S3 Logs for CodeBuild Projects are encrypted at rest.",
|
||||
"CheckTitle": "CodeBuild project S3 logs are encrypted at rest",
|
||||
"CheckType": [
|
||||
"Software and Configuration Checks/AWS Security Best Practices",
|
||||
"Software and Configuration Checks/Industry and Regulatory Standards/AWS Foundational Security Best Practices",
|
||||
"Effects/Data Exposure"
|
||||
],
|
||||
"ServiceName": "codebuild",
|
||||
"SubServiceName": "",
|
||||
"ResourceIdTemplate": "arn:partition:service:region:account-id:resource-id",
|
||||
"ResourceIdTemplate": "",
|
||||
"Severity": "low",
|
||||
"ResourceType": "AwsCodeBuildProject",
|
||||
"Description": "Ensure that the S3 logs for CodeBuild projects are encrypted at rest.",
|
||||
"Risk": "If the logs are not encrypted, sensitive information could be exposed to unauthorized users.",
|
||||
"RelatedUrl": "https://docs.aws.amazon.com/codebuild/latest/userguide/change-project.html#change-project-console-logs",
|
||||
"Description": "**CodeBuild projects** with **S3 log delivery** are evaluated for **encryption at rest** on their S3 log objects. Only projects that write logs to S3 are in scope.",
|
||||
"Risk": "Unencrypted build logs jeopardize **confidentiality**. Logs can include secrets, environment data, and error traces. If the bucket is misconfigured or storage is accessed, attackers can harvest credentials and map the pipeline, enabling **lateral movement** and build tampering that impacts **integrity**.",
|
||||
"RelatedUrl": "",
|
||||
"AdditionalURLs": [
|
||||
"https://docs.aws.amazon.com/codebuild/latest/userguide/change-project.html#change-project-console-logs",
|
||||
"https://docs.aws.amazon.com/securityhub/latest/userguide/codebuild-controls.html#codebuild-3",
|
||||
"https://support.icompaas.com/support/solutions/articles/62000233685-ensure-s3-logs-for-codebuild-projects-are-encrypted-at-rest",
|
||||
"https://hub.powerpipe.io/mods/turbot/steampipe-mod-aws-compliance/benchmarks/control.codebuild_project_s3_logs_encryption_enabled"
|
||||
],
|
||||
"Remediation": {
|
||||
"Code": {
|
||||
"CLI": "aws codebuild update-project --name <project-name> --logs-config \"s3Logs={status=ENABLED, location=<bucket-name>/<path>, encryptionDisabled=false\"}",
|
||||
"NativeIaC": "",
|
||||
"Other": "https://docs.aws.amazon.com/securityhub/latest/userguide/codebuild-controls.html#codebuild-3",
|
||||
"Terraform": ""
|
||||
"CLI": "aws codebuild update-project --name <project-name> --logs-config s3Logs={status=ENABLED,location=<bucket-name>/<path>,encryptionDisabled=false}",
|
||||
"NativeIaC": "```yaml\nResources:\n <example_resource_name>:\n Type: AWS::CodeBuild::Project\n Properties:\n Name: <example_resource_name>\n ServiceRole: <example_role_arn>\n Artifacts:\n Type: NO_ARTIFACTS\n Environment:\n Type: LINUX_CONTAINER\n ComputeType: BUILD_GENERAL1_SMALL\n Image: aws/codebuild/amazonlinux2-x86_64-standard:5.0\n Source:\n Type: NO_SOURCE\n LogsConfig:\n S3Logs:\n Status: ENABLED\n Location: <bucket-name>/<path>\n EncryptionDisabled: false # Critical: ensures S3 logs are encrypted at rest\n```",
|
||||
"Other": "1. Open the AWS CodeBuild console and select your project\n2. Choose Edit, then open the Logs section\n3. Under S3 logs, select Enabled and choose the Bucket/Path\n4. Ensure Disable S3 log encryption is unchecked (encryption enabled)\n5. Save changes",
|
||||
"Terraform": "```hcl\nresource \"aws_codebuild_project\" \"<example_resource_name>\" {\n name = \"<example_resource_name>\"\n service_role = \"<example_role_arn>\"\n\n artifacts { type = \"NO_ARTIFACTS\" }\n\n environment {\n compute_type = \"BUILD_GENERAL1_SMALL\"\n image = \"aws/codebuild/amazonlinux2-x86_64-standard:5.0\"\n type = \"LINUX_CONTAINER\"\n }\n\n source { type = \"NO_SOURCE\" }\n\n logs_config {\n s3_logs {\n status = \"ENABLED\"\n location = \"<bucket-name>/<path>\"\n encryption_disabled = false # Critical: enables encryption for S3 logs\n }\n }\n}\n```"
|
||||
},
|
||||
"Recommendation": {
|
||||
"Text": "Ensure that the CodeBuild project's S3 logs are encrypted at rest by setting the `encryptionDisabled` parameter to `false` in the `s3Logs` configuration.",
|
||||
"Url": "https://docs.aws.amazon.com/codebuild/latest/userguide/change-project.html#change-project-console-logs"
|
||||
"Text": "Enable encryption at rest for S3 logs on CodeBuild projects. Prefer `SSE-KMS` with customer-managed keys to control access and rotation. Enforce encryption via bucket policy, apply **least privilege** to log access, and monitor access patterns. *If needed*, segregate logs and keep them private.",
|
||||
"Url": "https://hub.prowler.com/check/codebuild_project_s3_logs_encrypted"
|
||||
}
|
||||
},
|
||||
"Categories": [
|
||||
|
||||
+21
-12
@@ -1,31 +1,40 @@
|
||||
{
|
||||
"Provider": "aws",
|
||||
"CheckID": "codebuild_project_source_repo_url_no_sensitive_credentials",
|
||||
"CheckTitle": "Ensure CodeBuild project source repository URLs do not contain sensitive credentials",
|
||||
"CheckTitle": "CodeBuild project source repository URLs do not contain sensitive credentials",
|
||||
"CheckType": [
|
||||
"Security Best Practices"
|
||||
"Software and Configuration Checks/AWS Security Best Practices",
|
||||
"Sensitive Data Identifications/Passwords",
|
||||
"Sensitive Data Identifications/Security",
|
||||
"Effects/Data Exposure"
|
||||
],
|
||||
"ServiceName": "codebuild",
|
||||
"SubServiceName": "",
|
||||
"ResourceIdTemplate": "arn:partition:service:region:account-id:resource-id",
|
||||
"ResourceIdTemplate": "",
|
||||
"Severity": "critical",
|
||||
"ResourceType": "AwsCodeBuildProject",
|
||||
"Description": "This check ensures an AWS CodeBuild project source repository URL doesn't contain personal access tokens or a user name and password. The check fails if the source repository URL contains personal access tokens or a user name and password.",
|
||||
"Risk": "Storing or transmitting sign-in credentials in clear text or including them in the source repository URL can lead to unintended data exposure or unauthorized access, potentially compromising the security of the system.",
|
||||
"RelatedUrl": "https://docs.aws.amazon.com/config/latest/developerguide/codebuild-project-source-repo-url-check.html",
|
||||
"Description": "**AWS CodeBuild projects** with **Bitbucket sources** are assessed to confirm repository URLs do not embed credentials (for example, `x-token-auth:<token>@` or `user:password@`). The assessment includes both the primary source and all secondary sources.",
|
||||
"Risk": "Credentials in URLs are **plainly exposed** in configs and logs, enabling unauthorized repo access. This can lead to:\n- **Source code theft** (C)\n- **Malicious commits/CI changes** (I)\n- **Supply-chain compromise** and lateral movement via token reuse",
|
||||
"RelatedUrl": "",
|
||||
"AdditionalURLs": [
|
||||
"https://docs.aws.amazon.com/securityhub/latest/userguide/codebuild-controls.html#codebuild-1",
|
||||
"https://docs.aws.amazon.com/config/latest/developerguide/codebuild-project-source-repo-url-check.html"
|
||||
],
|
||||
"Remediation": {
|
||||
"Code": {
|
||||
"CLI": "",
|
||||
"NativeIaC": "",
|
||||
"Other": "https://docs.aws.amazon.com/securityhub/latest/userguide/codebuild-controls.html#codebuild-1",
|
||||
"Terraform": ""
|
||||
"NativeIaC": "```yaml\nResources:\n <example_resource_name>:\n Type: AWS::CodeBuild::Project\n Properties:\n Name: <example_resource_name>\n ServiceRole: <example_role_arn>\n Artifacts:\n Type: NO_ARTIFACTS\n Environment:\n Type: LINUX_CONTAINER\n Image: aws/codebuild/standard:5.0\n ComputeType: BUILD_GENERAL1_SMALL\n Source:\n Type: BITBUCKET\n Location: https://bitbucket.org/<example_owner>/<example_repo>.git # FIX: remove embedded credentials; keep only the repo URL\n # This removes tokens/user:pass from the URL, eliminating exposed secrets\n```",
|
||||
"Other": "1. In the AWS Console, go to CodeBuild and open your project\n2. Click Edit > Source\n3. Replace the repository URL with only the Bitbucket path (no credentials):\n - https://bitbucket.org/<workspace>/<repo>.git\n4. If prompted for access, choose Connect using OAuth and authorize Bitbucket\n5. Save changes\n6. If you use Secondary sources, edit each one and remove any embedded credentials from their URLs",
|
||||
"Terraform": "```hcl\nresource \"aws_codebuild_project\" \"<example_resource_name>\" {\n name = \"<example_resource_name>\"\n service_role = \"<example_role_arn>\"\n\n artifacts {\n type = \"NO_ARTIFACTS\"\n }\n\n environment {\n compute_type = \"BUILD_GENERAL1_SMALL\"\n image = \"aws/codebuild/standard:5.0\"\n type = \"LINUX_CONTAINER\"\n }\n\n source {\n type = \"BITBUCKET\"\n location = \"https://bitbucket.org/<example_owner>/<example_repo>.git\" # FIX: sanitized URL without credentials\n # Removing credentials from the URL prevents sensitive data exposure\n }\n}\n```"
|
||||
},
|
||||
"Recommendation": {
|
||||
"Text": "Update your CodeBuild project to use OAuth instead of personal access tokens or basic authentication in your repository URLs.",
|
||||
"Url": "https://docs.aws.amazon.com/codebuild/latest/userguide/use-case-based-samples.html"
|
||||
"Text": "Use **OAuth/CodeStar Connections** or store tokens in **Secrets Manager/SSM**, never in the URL. Enforce **least privilege**, scope to needed repos, set short lifetimes, and rotate regularly. Audit configs and logs to remove leaked secrets. *Apply to primary and secondary sources.*",
|
||||
"Url": "https://hub.prowler.com/check/codebuild_project_source_repo_url_no_sensitive_credentials"
|
||||
}
|
||||
},
|
||||
"Categories": [],
|
||||
"Categories": [
|
||||
"secrets"
|
||||
],
|
||||
"DependsOn": [],
|
||||
"RelatedTo": [],
|
||||
"Notes": ""
|
||||
|
||||
+19
-12
@@ -1,32 +1,39 @@
|
||||
{
|
||||
"Provider": "aws",
|
||||
"CheckID": "codebuild_project_user_controlled_buildspec",
|
||||
"CheckTitle": "Ensure CodeBuild Project uses a controlled buildspec",
|
||||
"CheckTitle": "CodeBuild project does not use a user-controlled buildspec file",
|
||||
"CheckType": [
|
||||
"Software and Configuration Checks",
|
||||
"Industry and Regulatory Standards"
|
||||
"Software and Configuration Checks/AWS Security Best Practices"
|
||||
],
|
||||
"ServiceName": "codebuild",
|
||||
"SubServiceName": "",
|
||||
"ResourceIdTemplate": "arn:partition:service:region:account-id:resource-id",
|
||||
"ResourceIdTemplate": "",
|
||||
"Severity": "medium",
|
||||
"ResourceType": "AwsCodeBuildProject",
|
||||
"Description": "Ensure CodeBuild Project uses a controlled buildspec",
|
||||
"Risk": "The CodeBuild projects with user controlled buildspec",
|
||||
"Description": "AWS CodeBuild projects are evaluated for use of a **user-controlled buildspec**, identified when the project references a repository file like `*.yml` or `*.yaml`. Projects using non file-based build instructions are treated as centrally managed.",
|
||||
"Risk": "Repository-controlled buildspecs let unreviewed changes run in CI, endangering **integrity** (tampered artifacts), **confidentiality** (secret leakage), and **availability** (resource abuse). Attackers can weaponize PRs to execute code and pivot via the build role.",
|
||||
"RelatedUrl": "",
|
||||
"AdditionalURLs": [
|
||||
"https://docs.aws.amazon.com/codebuild/latest/userguide/security.html",
|
||||
"https://support.icompaas.com/support/solutions/articles/62000229579-ensure-codebuild-project-with-an-user-controlled-buildspec",
|
||||
"https://docs.aws.amazon.com/codebuild/latest/userguide/change-project.html"
|
||||
],
|
||||
"Remediation": {
|
||||
"Code": {
|
||||
"CLI": "",
|
||||
"NativeIaC": "",
|
||||
"Other": "",
|
||||
"Terraform": ""
|
||||
"NativeIaC": "```yaml\nResources:\n <example_resource_name>:\n Type: AWS::CodeBuild::Project\n Properties:\n ServiceRole: <example_role_arn>\n Artifacts:\n Type: NO_ARTIFACTS\n Environment:\n Type: LINUX_CONTAINER\n ComputeType: BUILD_GENERAL1_SMALL\n Image: <IMAGE>\n Source:\n Type: CODEPIPELINE\n BuildSpec: | # Critical: Inline buildspec avoids using a user-controlled file path\n version: 0.2\n```",
|
||||
"Other": "1. In the AWS Console, go to CodeBuild > Projects and open the target project\n2. Click Edit\n3. In Source, under Buildspec, select Insert build commands (not Use a buildspec file)\n4. Paste minimal inline YAML:\n ```\n version: 0.2\n ```\n5. Save",
|
||||
"Terraform": "```hcl\nresource \"aws_codebuild_project\" \"<example_resource_name>\" {\n name = \"<example_resource_name>\"\n service_role = \"<example_role_arn>\"\n\n artifacts {\n type = \"NO_ARTIFACTS\"\n }\n\n environment {\n compute_type = \"BUILD_GENERAL1_SMALL\"\n image = \"<IMAGE>\"\n type = \"LINUX_CONTAINER\"\n }\n\n source {\n type = \"CODEPIPELINE\"\n buildspec = <<EOT\nversion: 0.2\nEOT\n # Critical: Inline buildspec avoids using a user-controlled buildspec file\n }\n}\n```"
|
||||
},
|
||||
"Recommendation": {
|
||||
"Text": "Use buildspec.yml from a trusted source which user cant interfere with",
|
||||
"Url": "https://docs.aws.amazon.com/codebuild/latest/userguide/security.html"
|
||||
"Text": "Adopt a **centrally managed buildspec** that contributors cannot modify.\n- Enforce protected branches and required reviews for build instructions\n- Apply **least privilege** to the build role and minimize secrets\n- Separate duties for pipeline admins vs code authors\n\nUse vetted, versioned templates for defense in depth.",
|
||||
"Url": "https://hub.prowler.com/check/codebuild_project_user_controlled_buildspec"
|
||||
}
|
||||
},
|
||||
"Categories": [],
|
||||
"Categories": [
|
||||
"software-supply-chain",
|
||||
"ci-cd"
|
||||
],
|
||||
"DependsOn": [],
|
||||
"RelatedTo": [],
|
||||
"Notes": ""
|
||||
|
||||
+24
-13
@@ -1,29 +1,40 @@
|
||||
{
|
||||
"Provider": "aws",
|
||||
"CheckID": "codebuild_project_uses_allowed_github_organizations",
|
||||
"CheckTitle": "Ensure AWS CodeBuild projects using GitHub connect only to allowed organizations",
|
||||
"CheckType": [],
|
||||
"CheckTitle": "CodeBuild project using GitHub uses an allowed GitHub organization",
|
||||
"CheckType": [
|
||||
"Software and Configuration Checks/AWS Security Best Practices"
|
||||
],
|
||||
"ServiceName": "codebuild",
|
||||
"SubServiceName": "",
|
||||
"ResourceIdTemplate": "arn:aws:codebuild:region:account-id:project:project-name",
|
||||
"ResourceIdTemplate": "",
|
||||
"Severity": "high",
|
||||
"ResourceType": "AwsCodeBuildProject",
|
||||
"Description": "Check for CodeBuild projects using GitHub repositories from untrusted organizations that could lead to backdoored IAM roles",
|
||||
"Risk": "Attackers can use GitHub Actions in untrusted repositories to backdoor IAM roles used by CodeBuild projects, gaining persistent access to AWS accounts.",
|
||||
"RelatedUrl": "https://medium.com/@adan.alvarez/gaining-long-term-aws-access-with-codebuild-and-github-873324638784",
|
||||
"Description": "**CodeBuild projects** sourcing from **GitHub/GitHub Enterprise** with a service role that trusts CodeBuild are evaluated by deriving the repository's organization from its URL and comparing it to an **allowed organizations** list.",
|
||||
"Risk": "Using repos from **untrusted GitHub orgs** can let external workflows assume the project role and obtain AWS credentials.\n- Confidentiality: data/secrets exfiltration\n- Integrity: unauthorized changes\n- Availability: build abuse or service disruption",
|
||||
"RelatedUrl": "",
|
||||
"AdditionalURLs": [
|
||||
"https://medium.com/@adan.alvarez/gaining-long-term-aws-access-with-codebuild-and-github-873324638784",
|
||||
"https://paul-hands-phd.medium.com/using-aws-codebuild-to-set-up-github-continuous-integration-19b92efbd094",
|
||||
"https://docs.aws.amazon.com/codebuild/latest/userguide/connections-github-app.html",
|
||||
"https://docs.aws.amazon.com/codebuild/latest/userguide/auth-and-access-control-iam-identity-based-access-control.html"
|
||||
],
|
||||
"Remediation": {
|
||||
"Code": {
|
||||
"NativeIaC": "",
|
||||
"Terraform": "",
|
||||
"CLI": "",
|
||||
"Other": ""
|
||||
"CLI": "aws codebuild update-project --name <example_resource_name> --source type=GITHUB,location=https://github.com/<ALLOWED_GITHUB_ORG>/<REPO>",
|
||||
"NativeIaC": "```yaml\n# CloudFormation: point CodeBuild project to a repo in an allowed GitHub org\nResources:\n <example_resource_name>:\n Type: AWS::CodeBuild::Project\n Properties:\n ServiceRole: <example_resource_arn>\n Artifacts:\n Type: NO_ARTIFACTS\n Environment:\n Type: LINUX_CONTAINER\n ComputeType: BUILD_GENERAL1_SMALL\n Image: aws/codebuild/standard:7.0\n Source:\n Type: GITHUB\n Location: https://github.com/<ALLOWED_GITHUB_ORG>/<REPO> # FIX: repo org must be in the allowed list\n```",
|
||||
"Other": "1. Open the AWS Console and go to CodeBuild > Build projects\n2. Select the project and click Edit\n3. In Source, set Repository URL to https://github.com/<ALLOWED_GITHUB_ORG>/<REPO>\n4. Click Update to save",
|
||||
"Terraform": "```hcl\n# Terraform: set CodeBuild source to a repo under an allowed GitHub org\nresource \"aws_codebuild_project\" \"<example_resource_name>\" {\n name = \"<example_resource_name>\"\n service_role = \"<example_resource_arn>\"\n\n artifacts { type = \"NO_ARTIFACTS\" }\n\n environment {\n compute_type = \"BUILD_GENERAL1_SMALL\"\n image = \"aws/codebuild/standard:7.0\"\n type = \"LINUX_CONTAINER\"\n }\n\n source {\n type = \"GITHUB\"\n location = \"https://github.com/<ALLOWED_GITHUB_ORG>/<REPO>\" # FIX: use an allowed GitHub org\n }\n}\n```"
|
||||
},
|
||||
"Recommendation": {
|
||||
"Text": "Only use GitHub repositories from trusted organizations with CodeBuild projects. Configure the allowed GitHub organizations in your Prowler configuration.",
|
||||
"Url": "https://docs.aws.amazon.com/codebuild/latest/userguide/auth-and-access-control-iam-identity-based-access-control.html"
|
||||
"Text": "Limit sources to **approved GitHub organizations** via an explicit allowlist. Enforce **least privilege** on the CodeBuild service role and avoid admin rights. Apply **separation of duties** for allowlist changes and add **defense in depth** (branch protections, reviews, monitoring) to prevent workflow abuse.",
|
||||
"Url": "https://hub.prowler.com/check/codebuild_project_uses_allowed_github_organizations"
|
||||
}
|
||||
},
|
||||
"Categories": [],
|
||||
"Categories": [
|
||||
"software-supply-chain",
|
||||
"ci-cd"
|
||||
],
|
||||
"DependsOn": [],
|
||||
"RelatedTo": [],
|
||||
"Notes": ""
|
||||
|
||||
+35
-13
@@ -1,26 +1,48 @@
|
||||
{
|
||||
"Provider": "aws",
|
||||
"CheckID": "codebuild_report_group_export_encrypted",
|
||||
"CheckTitle": "CodeBuild report group exports are encrypted at rest",
|
||||
"CheckType": [],
|
||||
"CheckTitle": "CodeBuild report group exports to S3 are encrypted at rest",
|
||||
"CheckType": [
|
||||
"Software and Configuration Checks/AWS Security Best Practices",
|
||||
"Software and Configuration Checks/Industry and Regulatory Standards/AWS Foundational Security Best Practices",
|
||||
"Software and Configuration Checks/Industry and Regulatory Standards/CIS AWS Foundations Benchmark",
|
||||
"Software and Configuration Checks/Industry and Regulatory Standards/NIST 800-53 Controls (USA)",
|
||||
"Software and Configuration Checks/Industry and Regulatory Standards/NIST CSF Controls (USA)",
|
||||
"Software and Configuration Checks/Industry and Regulatory Standards/PCI-DSS",
|
||||
"Software and Configuration Checks/Industry and Regulatory Standards/HIPAA Controls (USA)",
|
||||
"Software and Configuration Checks/Industry and Regulatory Standards/ISO 27001 Controls",
|
||||
"Software and Configuration Checks/Industry and Regulatory Standards/SOC 2"
|
||||
],
|
||||
"ServiceName": "codebuild",
|
||||
"SubServiceName": "",
|
||||
"ResourceIdTemplate": "arn:partition:service:region:account-id:resource-id",
|
||||
"ResourceIdTemplate": "",
|
||||
"Severity": "medium",
|
||||
"ResourceType": "Other",
|
||||
"Description": "Ensure that CodeBuild report group exports are encrypted at rest.",
|
||||
"Risk": "If CodeBuild report group exports are not encrypted, sensitive data could be exposed to unauthorized access.",
|
||||
"RelatedUrl": "https://docs.aws.amazon.com/codebuild/latest/userguide/report-group-export-settings.html",
|
||||
"ResourceType": "AwsCodeBuildProject",
|
||||
"Description": "**CodeBuild report groups** with export type `S3` are evaluated to confirm their exported test results are encrypted at rest with a **KMS key**.\n\nReport groups configured with `NO_EXPORT` are out of scope.",
|
||||
"Risk": "**Unencrypted S3 exports** leave report data in plaintext, weakening confidentiality.\n\nIf a bucket is misconfigured, compromised, or accessed by insiders, attackers can harvest test outputs for secrets, tokens, build paths, and system details, enabling credential theft and lateral movement.",
|
||||
"RelatedUrl": "",
|
||||
"AdditionalURLs": [
|
||||
"https://docs.aws.amazon.com/securityhub/latest/userguide/codebuild-controls.html#codebuild-7",
|
||||
"https://www.pulumi.com/registry/packages/aws/api-docs/codebuild/reportgroup/",
|
||||
"https://docs.aws.amazon.com/codebuild/latest/userguide/report-group-export-settings.html",
|
||||
"https://docs.aws.amazon.com/codebuild/latest/userguide/security-encryption.html",
|
||||
"https://docs.aws.amazon.com/securityhub/latest/userguide/codebuild-controls.html",
|
||||
"https://docs.amazonaws.cn/en_us/codebuild/latest/userguide/report-group-export-settings.html",
|
||||
"https://docs.aws.amazon.com/codebuild/latest/userguide/test-report-group-create-console.html",
|
||||
"https://docs.aws.amazon.com/codebuild/latest/userguide/update-report-group-console.html",
|
||||
"https://docs.aws.amazon.com/codebuild/latest/userguide/report-group-create.html",
|
||||
"https://docs.amazonaws.cn/en_us/codebuild/latest/userguide/test-report-group-create-console.html"
|
||||
],
|
||||
"Remediation": {
|
||||
"Code": {
|
||||
"CLI": "aws codebuild update-report-group --arn <report-group-arn> --export-config \"exportConfigType=S3, s3Destination={bucket=, encryptionDisabled=true}\"",
|
||||
"NativeIaC": "",
|
||||
"Other": "https://docs.aws.amazon.com/securityhub/latest/userguide/codebuild-controls.html#codebuild-7",
|
||||
"Terraform": ""
|
||||
"CLI": "aws codebuild update-report-group --arn <report-group-arn> --export-config \"exportConfigType=S3,s3Destination={bucket=<bucket-name>,encryptionDisabled=false}\"",
|
||||
"NativeIaC": "```yaml\n# CloudFormation: Enable encryption for CodeBuild report group S3 exports\nResources:\n <example_resource_name>:\n Type: AWS::CodeBuild::ReportGroup\n Properties:\n Name: <example_resource_name>\n Type: TEST\n ExportConfig:\n ExportConfigType: S3\n S3Destination:\n Bucket: <example_resource_name>\n EncryptionDisabled: false # Critical: ensures S3 exports are encrypted at rest\n # Uses AWS managed key by default\n```",
|
||||
"Other": "1. Open the AWS Console and go to CodeBuild > Report groups\n2. Select the report group and click Edit\n3. Ensure Export to Amazon S3 is enabled and a bucket is set\n4. Expand Additional configuration and enable encryption by choosing Default AWS managed key (or select a KMS key)\n5. Ensure Disable artifact encryption is NOT selected\n6. Save changes",
|
||||
"Terraform": "```hcl\n# Enable encryption for CodeBuild report group S3 exports\nresource \"aws_codebuild_report_group\" \"<example_resource_name>\" {\n name = \"<example_resource_name>\"\n type = \"TEST\"\n\n export_config {\n type = \"S3\"\n s3_destination {\n bucket = \"<example_resource_name>\"\n encryption_disabled = false # Critical: ensures S3 exports are encrypted at rest\n # Uses AWS managed key by default\n }\n }\n}\n```"
|
||||
},
|
||||
"Recommendation": {
|
||||
"Text": "Configure CodeBuild report group exports to use encryption at rest. This can be done by specifying a KMS key ID when creating or updating the report group.",
|
||||
"Url": "https://docs.aws.amazon.com/codebuild/latest/userguide/report-group-export-settings.html"
|
||||
"Text": "Enable at-rest encryption for report exports using **KMS** (prefer **customer managed keys**).\n\nApply least privilege: restrict key usage to the CodeBuild role and required principals, enable rotation, and audit key usage. Combine with S3 bucket policies for **defense in depth**.",
|
||||
"Url": "https://hub.prowler.com/check/codebuild_report_group_export_encrypted"
|
||||
}
|
||||
},
|
||||
"Categories": [
|
||||
|
||||
Reference in New Issue
Block a user