CodeFactoryTokenService-API

This repository provides code to call the undocumented AWS API operations used during the run of a CodeBuild project. The API is available at codebuild-builds.{region}.amazonaws.com and uses operations that are prefixed with CoFaTokenService_Agent. For those wondering, CoFa is a shortening of the old name for CodeBuild - CodeFactory.

This code was used in the research that is detailed in the following blog posts:

• https://thomaspreece.com/2026/03/23/part-2-aws-codebuild-escalating-privileges-via-aws-codeconnections/

Use

To use, run python ./GetBuildInfo.py from within a CodeBuild project. E.g.

version: 0.2

phases:
  build:
    commands:
     - python -m pip install botocore boto3 requests
     - wget https://raw.githubusercontent.com/thomaspreece/AWS-CodeFactoryTokenService-API/refs/heads/main/GetBuildInfo.py
     - python ./GetBuildInfo.py