feat(codepipeline): add codepipeline_pipeline_no_secrets_in_definitio…

prowler/CHANGELOG.md

@@ -22,6 +22,7 @@ All notable changes to the **Prowler SDK** are documented in this file.
 - `exchange_mailbox_primary_smtp_uses_custom_domain` check for M365 provider [(#11215)](https://github.com/prowler-cloud/prowler/pull/11215)
 - `bedrock_agent_role_least_privilege` check for AWS provider, flagging Bedrock Agent execution roles with full-access managed policies, broad `Resource:*` inline statements, or missing permissions boundaries [(#11335)](https://github.com/prowler-cloud/prowler/pull/11335)
 - STACKIT ObjectStorage service with Object Lock, default retention policy, and access key expiration checks [(#11397)](https://github.com/prowler-cloud/prowler/pull/11397)
+- `codepipeline_pipeline_no_secrets_in_definition` check for AWS provider, scanning all stage action configurations for hardcoded secrets using the detect-secrets library [(#11842)](https://github.com/prowler-cloud/prowler/pull/11842)
 
 ### 🐞 Fixed
 

prowler/providers/aws/services/codepipeline/codepipeline_pipeline_no_secrets_in_definition/codepipeline_pipeline_no_secrets_in_definition.metadata.json

@@ -0,0 +1,48 @@
+{
+  "Provider": "aws",
+  "CheckID": "codepipeline_pipeline_no_secrets_in_definition",
+  "CheckTitle": "CodePipeline pipeline has no secrets in its definition",
+  "CheckType": [
+    "Software and Configuration Checks/AWS Security Best Practices",
+    "TTPs/Credential Access",
+    "Effects/Data Exposure",
+    "Sensitive Data Identifications/Security"
+  ],
+  "ServiceName": "codepipeline",
+  "SubServiceName": "",
+  "ResourceIdTemplate": "arn:partition:codepipeline:region:account-id:pipeline-name",
+  "Severity": "high",
+  "ResourceType": "AwsCodePipelinePipeline",
+  "ResourceGroup": "devops",
+  "Description": "**AWS CodePipeline pipeline definitions** (stage action configurations) are scanned for **hardcoded secrets** such as API keys, tokens, and passwords. Pipeline definitions are readable by many CI/CD roles and embedded credentials enable lateral movement across AWS accounts and third-party services.",
+  "Risk": "Hardcoded secrets in pipeline action configurations can be read by any principal with `codepipeline:GetPipeline` permission. Exposed credentials enable unauthorized access to downstream systems, artifact stores, and deployment targets, leading to data exfiltration and supply-chain compromise.",
+  "RelatedUrl": "",
+  "AdditionalURLs": [
+    "https://docs.aws.amazon.com/codepipeline/latest/userguide/action-reference.html",
+    "https://docs.aws.amazon.com/secretsmanager/latest/userguide/integrating_how-services-use-secrets_codepipeline.html",
+    "https://docs.aws.amazon.com/systems-manager/latest/userguide/integration-ps-secretsmanager.html",
+    "https://github.com/prowler-cloud/prowler/issues/3085"
+  ],
+  "Remediation": {
+    "Code": {
+      "CLI": "aws codepipeline get-pipeline --name <pipeline-name>\naws codepipeline update-pipeline --pipeline file://updated-pipeline.json",
+      "NativeIaC": "```yaml\nResources:\n  MyPipeline:\n    Type: AWS::CodePipeline::Pipeline\n    Properties:\n      Stages:\n        - Name: Deploy\n          Actions:\n            - Name: DeployAction\n              ActionTypeId:\n                Category: Deploy\n                Owner: AWS\n                Provider: CloudFormation\n                Version: 1\n              Configuration:\n                # CRITICAL: reference secrets from Parameter Store or Secrets Manager\n                # never embed raw credentials here\n                ParameterOverrides: |\n                  {\"ApiKey\": \"{{resolve:secretsmanager:my-secret:SecretString:api_key}}\"}\n```",
+      "Other": "1. In the AWS Console, navigate to CodePipeline and open the affected pipeline.\n2. Click Edit and locate the stage/action that contains the hardcoded secret.\n3. Remove the plaintext credential from the action configuration.\n4. Store the secret in AWS Secrets Manager or AWS Systems Manager Parameter Store.\n5. Reference the secret using dynamic references (e.g. `{{resolve:secretsmanager:secret-name}}`), or pass it via a Lambda invoke or environment variable backed by a secure store.\n6. Save the pipeline and verify the action still functions correctly.",
+      "Terraform": "```hcl\nresource \"aws_codepipeline\" \"example\" {\n  name     = \"my-pipeline\"\n  role_arn = aws_iam_role.codepipeline.arn\n\n  stage {\n    name = \"Deploy\"\n    action {\n      name     = \"DeployAction\"\n      category = \"Deploy\"\n      owner    = \"AWS\"\n      provider = \"CloudFormation\"\n      version  = \"1\"\n      configuration = {\n        # CRITICAL: never embed raw credentials; use dynamic references instead\n        ParameterOverrides = jsonencode({\n          ApiKey = \"{{resolve:secretsmanager:my-secret:SecretString:api_key}}\"\n        })\n      }\n    }\n  }\n}\n```"
+    },
+    "Recommendation": {
+      "Text": "Remove hardcoded credentials from all CodePipeline action configurations. Store secrets in **AWS Secrets Manager** or **AWS Systems Manager Parameter Store** and reference them via dynamic references or secure environment injection. Apply least-privilege IAM policies to the pipeline execution role and audit pipeline definitions regularly.",
+      "Url": "https://hub.prowler.com/check/codepipeline_pipeline_no_secrets_in_definition"
+    }
+  },
+  "Categories": [
+    "secrets",
+    "ci-cd"
+  ],
+  "DependsOn": [],
+  "RelatedTo": [
+    "codebuild_project_no_secrets_in_variables",
+    "codepipeline_project_repo_private"
+  ],
+  "Notes": "Severity is High by default. It may be treated as Critical if the detected secret is validated as active. This check scans all stage action configurations using the detect-secrets library. False positives can be suppressed via the secrets_ignore_patterns audit config."
+}

prowler/providers/aws/services/codepipeline/codepipeline_pipeline_no_secrets_in_definition/codepipeline_pipeline_no_secrets_in_definition.py

@@ -0,0 +1,68 @@
+import json
+from typing import List
+
+from prowler.lib.check.models import Check, Check_Report_AWS
+from prowler.lib.utils.utils import detect_secrets_scan
+from prowler.providers.aws.services.codepipeline.codepipeline_client import (
+    codepipeline_client,
+)
+
+
+class codepipeline_pipeline_no_secrets_in_definition(Check):
+    """Ensure CodePipeline pipeline definitions do not contain hardcoded secrets.
+
+    Scans all stage action configurations for embedded credentials such as API keys,
+    tokens, or passwords. Pipeline definitions are readable by many CI/CD roles and
+    embedded credentials enable lateral movement.
+
+    - PASS: No secrets are detected in any stage action configuration.
+    - FAIL: A secret is detected in one or more stage action configurations.
+    """
+
+    def execute(self) -> List[Check_Report_AWS]:
+        """Execute the CodePipeline pipeline secrets check.
+
+        Iterates over all discovered pipelines, scans each stage action
+        configuration with detect-secrets, and reports any findings.
+
+        Returns:
+            List[Check_Report_AWS]: A list of report objects with check results.
+        """
+        findings = []
+        secrets_ignore_patterns = codepipeline_client.audit_config.get(
+            "secrets_ignore_patterns", []
+        )
+        for pipeline in codepipeline_client.pipelines.values():
+            report = Check_Report_AWS(metadata=self.metadata(), resource=pipeline)
+            report.status = "PASS"
+            report.status_extended = f"CodePipeline pipeline {pipeline.name} does not have secrets in its definition."
+            secrets_found = []
+            has_verified_secret = False
+
+            for stage in pipeline.stages:
+                for action in stage.actions:
+                    if action.configuration:
+                        detect_secrets_output = detect_secrets_scan(
+                            data=json.dumps(action.configuration),
+                            excluded_secrets=secrets_ignore_patterns,
+                            detect_secrets_plugins=codepipeline_client.audit_config.get(
+                                "detect_secrets_plugins"
+                            ),
+                        )
+                        if detect_secrets_output:
+                            for secret in detect_secrets_output:
+                                secrets_found.append(
+                                    f"{secret['type']} in stage {stage.name} action {action.name}"
+                                )
+                                if secret.get("is_verified"):
+                                    has_verified_secret = True
+
+            if secrets_found:
+                report.status = "FAIL"
+                report.status_extended = f"CodePipeline pipeline {pipeline.name} has secrets in its definition: {', '.join(secrets_found)}."
+                if has_verified_secret:
+                    report.check_metadata.Severity = "critical"
+
+            findings.append(report)
+
+        return findings

prowler/providers/aws/services/codepipeline/codepipeline_service.py

@@ -1,7 +1,7 @@
-from typing import Optional
+from typing import List, Optional
 
 from botocore.exceptions import ClientError
-from pydantic import BaseModel
+from pydantic import BaseModel, Field
 
 from prowler.lib.logger import logger
 from prowler.providers.aws.lib.service.service import AWSService
@@ -89,13 +89,29 @@ def _get_pipeline_state(self, pipeline):
         try:
             regional_client = self.regional_clients[pipeline.region]
             pipeline_info = regional_client.get_pipeline(name=pipeline.name)
-            source_info = pipeline_info["pipeline"]["stages"][0]["actions"][0]
+            all_stages = pipeline_info["pipeline"]["stages"]
+
+            # Capture all stages and their action configurations for secret scanning
+            for stage in all_stages:
+                stage_obj = PipelineStage(name=stage["name"])
+                for action in stage.get("actions", []):
+                    stage_obj.actions.append(
+                        PipelineAction(
+                            name=action["name"],
+                            configuration=action.get("configuration"),
+                        )
+                    )
+                pipeline.stages.append(stage_obj)
+
+            # Capture source info from the first stage/action (existing behaviour)
+            source_info = all_stages[0]["actions"][0]
             repository_id = source_info["configuration"].get("FullRepositoryId", "")
             pipeline.source = Source(
                 type=source_info["actionTypeId"]["provider"],
                 repository_id=repository_id,
                 configuration=source_info["configuration"],
             )
+
         except ClientError as error:
             logger.error(
                 f"{pipeline.region} -- {error.__class__.__name__}[{error.__traceback__.tb_lineno}]: {error}"
@@ -137,7 +153,7 @@ class Source(BaseModel):
 
     Attributes:
         type: The type of source provider.
-        location: The location/path of the source repository.
+        repository_id: The repository identifier.
         configuration: Optional dictionary containing additional source configuration.
     """
 
@@ -146,6 +162,30 @@ class Source(BaseModel):
     configuration: Optional[dict]
 
 
+class PipelineAction(BaseModel):
+    """Model representing a single action within a pipeline stage.
+
+    Attributes:
+        name: The name of the action.
+        configuration: Optional dictionary of action configuration key/value pairs.
+    """
+
+    name: str
+    configuration: Optional[dict] = None
+
+
+class PipelineStage(BaseModel):
+    """Model representing a stage within a CodePipeline pipeline.
+
+    Attributes:
+        name: The name of the stage.
+        actions: List of actions defined in this stage.
+    """
+
+    name: str
+    actions: List[PipelineAction] = Field(default_factory=list)
+
+
 class Pipeline(BaseModel):
     """Model representing an AWS CodePipeline pipeline.
 
@@ -154,11 +194,13 @@ class Pipeline(BaseModel):
         arn: The ARN (Amazon Resource Name) of the pipeline.
         region: The AWS region where the pipeline exists.
         source: Optional Source object containing source configuration.
+        stages: List of all pipeline stages with their action configurations.
         tags: Optional list of pipeline tags.
     """
 
     name: str
     arn: str
     region: str
     source: Optional[Source] = None
+    stages: List[PipelineStage] = Field(default_factory=list)
     tags: Optional[list] = []