CodeBuild project environment variables should not contain clear text credentials

How to fix it

Have the named project hold no credential as a plain-text environment variable: delete the variable, or change its type so the value names a secret in Secrets Manager or a parameter in Parameter Store instead of containing it. Either way rotate the value, because a credential stored in plain text has been readable by anyone able to read the project and by anything that printed the environment into a build log. If you move it to a secret, give the project's service role permission to read and decrypt it, or every build fails at start-up instead.

In the console

CodeBuild → Build projects → the project → Edit → Environment → Additional configuration → Environment variables

With Terraform

resource "aws_codebuild_project" "this" {
  name         = var.project_name
  service_role = var.service_role_arn

  artifacts {
    type = var.artifacts_type
  }

  source {
    type = var.source_type
  }

  environment {
    compute_type = var.compute_type
    image        = var.build_image
    type         = var.environment_type

    environment_variable {
      name  = var.credential_variable_name
      value = var.secret_id
      type  = "SECRETS_MANAGER"
    }
  }
}