AWS CodeBuild

Integrate Cortex Cloud Application Security with your AWS CodeBuild instance to allow dynamic, automated, and context-specific scans within your development workflow. This includes continuous scanning of your workflow whenever changes are pushed or triggered, integrating security checks, and catching issues as soon as they are introduced. Additionally, it automates shift-left actions such as notifying developers or creating tickets, based on scan results.

Prerequisite

Before you begin:

• User permissions: Ensure the user performing the integration has permissions to edit pipeline configurations (such as YAML files) and manage secrets/credentials within the CI platform to store the Cortex Cloud API key securely

Onboarding steps

1. On the Cortex Cloud console:

   1. Navigate to Settings → Data Sources & Integrations → + Add New.
   2. Search for and hover over AWS CodeBuild, and click Add, or Add Another Instance if an instance is already onboarded.
   3. On the Add Environment Variables step of the AWS CodeBuild integration wizard.

      1. Select Generate API key.

         The API key secret and API key ID values are generated and populate their respective fields.
      2. Select the system architecture that your tool runs on.
      3. Click Next.
2. Store your generated Cortex Cloud API key and API key ID in AWS Secrets Manager.

I have an API key

1. Copy the CORTEX_API_KEY and CORTEX_API_KEY_ID variable names from their respective fields in the wizard.
2. Add the CORTEX_API_KEY and CORTEX_API_KEY_ID and their corresponding values as separate environment variables (secrets) to AWS Secrets Manager.

I don't have an API key

1. Select Generate API key, then copy the CORTEX_API_KEY and CORTEX_API_KEY_ID values from their respective fields.
2. Add the CORTEX_API_KEY and CORTEX_API_KEY_ID and their corresponding values as separate environment variables (secrets) to AWS Secrets Manager.

Do not change the environment variable names provided by Cortex Cloud.

For more information on storing secrets in AWS Secrets Manager, refer to AWS Secrets Manager Documentation.

1. Grant the IAM service role associated with your AWS CodeBuild project the necessary permissions to read the Cortex Cloud API key and Cortex Cloud API key ID from AWS Secrets Manager.
2. Copy and paste the pre-populated sample code from the Configure Subscription step of the integration wizard into your buildspec.yaml configuration.

The code is a reference. Replace placeholder values with build-specific values.

1. Select Save in the wizard.
2. Ensure the Connector Created Successfully message appears in the final wizard step, then select Close.

Verify integration

1. On Data Sources & Integrations, search for AWS CodeBuild.
2. Select the resulting data source.
3. Locate your AWS CodeBuild instance and confirm the instance status is Connected.

Next steps

View scan results and mitigate issues.

AWS CodeBuild code scan workflow template

Use the AWS CodeBuild code scan workflow template to configure Cortex CLI code scanning in your buildspec.yaml file.

Manage the integration

Instance-level actions

1. Navigate to Settings → Data Sources & Integrations and search for AWS CodeBuild.
2. Select the matching result.
3. Locate your instance from the displayed list. Right-click it, then select an option:

   • Edit instance: Opens the onboarding wizard, where you can change the instance configuration.
   • Delete instance: Deletes the instance and previous scan data.
   • Copy entire row: Copies all row values to the clipboard.

Repository-level actions

Right-click a connected repository to Set Scanned Branches, run a manual scan through Scan Repository, modify the Scan Configuration, or Remove Repository. In Scan Configuration, you can toggle scanners and manage pull request behavior.

1. Locate your instance. See Instance-level actions.
2. Select the instance. A list of connected repositories appears.
3. Right-click a repository, select the required action, then select Save.