CodeBuild project has CloudWatch Logs or S3 logging enabled

Check ID: codebuild_project_logging_enabled
Provider: AWS
Service: codebuild
Severity: MEDIUM
Categories: logging
Resource type: AwsCodeBuildProject

What this check verifies

CodeBuild projects are assessed for logging configuration to Amazon CloudWatch Logs or S3, identifying when at least one destination is enabled for build logs and events.

Risk

Absence of build logging creates blind spots for integrity and accountability. Attackers or misconfigurations can alter artifacts, exfiltrate data, or misuse credentials with little trace, hindering forensics and incident response. Missing telemetry impedes correlation with other alerts, risking source code and secret confidentiality.

Recommendation

Enable a log destination for every project-CloudWatch Logs or S3 (preferably both). Enforce defense in depth: encrypt logs, set retention, and restrict access on a least-privilege basis. Centralize and monitor logs, alert on anomalies, and avoid sensitive data in output. Use immutable retention to preserve auditability.

Remediation

CLI
Terraform
Native IaC
Dashboard steps

aws codebuild update-project --name <project-name> --logs-config "cloudWatchLogs={status=ENABLED}"

# Terraform: Enable logging on a CodeBuild project
resource "aws_codebuild_project" "<example_resource_name>" {
  name         = "<example_resource_name>"
  service_role = "<example_resource_id>"

  artifacts { type = "NO_ARTIFACTS" }

  environment {
    compute_type = "BUILD_GENERAL1_SMALL"
    image        = "aws/codebuild/standard:5.0"
    type         = "LINUX_CONTAINER"
  }

  source { type = "NO_SOURCE" }

  logs_config {
    cloudwatch_logs {
      status = "ENABLED"  # Critical: Enables CloudWatch logging to pass the check
    }
  }
}

# CloudFormation: Enable logging on a CodeBuild project
Resources:
  <example_resource_name>:
    Type: AWS::CodeBuild::Project
    Properties:
      Name: <example_resource_name>
      ServiceRole: <example_resource_id>
      Artifacts:
        Type: NO_ARTIFACTS
      Environment:
        Type: LINUX_CONTAINER
        ComputeType: BUILD_GENERAL1_SMALL
        Image: aws/codebuild/standard:5.0
      Source:
        Type: NO_SOURCE
      LogsConfig:
        CloudWatchLogs:
          Status: ENABLED  # Critical: Enables CloudWatch logging to pass the check

References

Where this check fires

This check runs on every scheduled scan against your AWS account. Findings appear at Cloud Security → Findings filterable by Check ID = codebuild_project_logging_enabled. To re-evaluate after a fix, hit Run now on the account’s schedule under Cloud Security → Schedules — the next scan re-checks this control and marks the finding fixed or keeps it persistent.

← Back to AWS checks

CodeArtifact blocks publishing external public versions CodeBuild project has no secrets in plaintext env vars

​What this check verifies

​Risk

​Recommendation

​Remediation

​References

​Where this check fires

What this check verifies

Risk

Recommendation

Remediation

References

Where this check fires