AWS CLI CodeBuild update-project --environment-variable does not work.

Hello.

The command "aws codebuild describe-project" does not exist.
https://awscli.amazonaws.com/v2/documentation/api/latest/reference/codebuild/index.html

You must use "batch-get-projects" to retrieve CodeBuild project settings.
This is just a guess, but I think you are running a non-existent command called "aws codebuild describe-project" and the correct environment variables are not recorded in "sample.json".
You can execute the following commands.

aws codebuild batch-get-projects --names kobayashi --query "projects"[]."environment" | jq .[] > sample.json
aws codebuild update-project --name kobayashi --environment file://sample.json

By the way, the contents of "sample.json" are as follows.

{
  "type": "LINUX_CONTAINER",
  "image": "aws/codebuild/amazonlinux2-x86_64-standard:5.0",
  "computeType": "BUILD_GENERAL1_SMALL",
  "environmentVariables": [
    {
      "name": "test",
      "value": "test-kobayashi-test-kobayashi",
      "type": "PLAINTEXT"
    },
    {
      "name": "abc",
      "value": "test-kobayashi-test-kobayashi",
      "type": "PLAINTEXT"
    }
  ],
  "privilegedMode": false,
  "imagePullCredentialsType": "CODEBUILD"
}

--environment-variable is not an option for aws codebuild update-project. In CodeBuild, environmentVariables is a nested member of the --environment structure, so it cannot be appended with a separate top-level switch.

The existing batch-get-projects approach is the right starting point. Fetch the current environment, preserve its required fields and existing variables, add the new entry to the environmentVariables array, and then send that environment object back:

aws codebuild batch-get-projects \
  --names PROJECT_NAME \
  --query 'projects[0].environment' \
  --output json > environment.json

# Edit environment.json, retaining the current type, image,
# computeType, optional settings, and existing variables.

aws codebuild update-project \
  --name PROJECT_NAME \
  --environment file://environment.json

For a secret, do not put the secret value in that file. Store it in Secrets Manager or Parameter Store and add only its identifier. For example, an entry in environmentVariables can be:

{
  "name": "DB_PASSWORD",
  "value": "/CodeBuild/prod/db-password",
  "type": "SECRETS_MANAGER"
}

For Parameter Store, use "type": "PARAMETER_STORE" and set value to the parameter name. CodeBuild resolves the value when the build runs. The CodeBuild service role must have secretsmanager:GetSecretValue or ssm:GetParameters for the referenced resource, plus kms:Decrypt when a customer-managed KMS key requires it.

Before updating, make sure the output file contains every existing project-level variable you intend to keep; treat the array in the request as the desired list rather than assuming an append operation. Also avoid printing the resolved value in build commands. CodeBuild masks exact values retrieved from Secrets Manager and Parameter Store, but a transformed value can still appear in logs.

Official references:

• AWS CLI codebuild update-project
• Change build project settings
• CodeBuild EnvironmentVariable types
• Buildspec environment variables and secret masking