# AWS - CodeBuild Unauthenticated Access

{{#include ../../../../banners/hacktricks-training.md}}

## CodeBuild

For more info check this page:

{{#ref}}
../../aws-services/aws-codebuild-enum.md
{{#endref}}

### buildspec.yml

If you compromise write access over a repository containing a file named **`buildspec.yml`**, you could **backdoor** this file, which specifies the **commands that are going to be executed** inside a CodeBuild project and exfiltrate the secrets, compromise what is done and also compromise the **CodeBuild IAM role credentials**.

Note that even if there isn't any **`buildspec.yml`** file but you know Codebuild is being used (or a different CI/CD) **modifying some legit code** that is going to be executed can also get you a reverse shell for example.

For some related information you could check the page about how to attack Github Actions (similar to this):

{{#ref}}
../../../../pentesting-ci-cd/github-security/abusing-github-actions/
{{#endref}}

## Self-hosted GitHub Actions runners in AWS CodeBuild <a href="#action-runner" id="action-runner"></a>

As [**indicated in the docs**](https://docs.aws.amazon.com/codebuild/latest/userguide/action-runner.html), It's possible to configure **CodeBuild** to run **self-hosted Github actions** when a workflow is triggered inside a Github repo configured. This can be detected checking the CodeBuild project configuration because the **`Event type`** needs to contain: **`WORKFLOW_JOB_QUEUED`** and in a Github Workflow because it will select a **self-hosted** runner like this:

```bash
runs-on: codebuild-<project-name>-${{ github.run_id }}-${{ github.run_attempt }}
```

This new relationship between Github Actions and AWS creates another way to compromise AWS from Github as the code in Github will be running in a CodeBuild project with an IAM role attached.

{{#include ../../../../banners/hacktricks-training.md}}




