CodeBuild project S3 logs are encrypted at rest

Check ID: codebuild_project_s3_logs_encrypted
Provider: AWS
Service: codebuild
Severity: LOW
Categories: encryption, logging
Resource type: AwsCodeBuildProject

What this check verifies

CodeBuild projects with S3 log delivery are evaluated for encryption at rest on their S3 log objects. Only projects that write logs to S3 are in scope.

Risk

Unencrypted build logs jeopardize confidentiality. Logs can include secrets, environment data, and error traces. If the bucket is misconfigured or storage is accessed, attackers can harvest credentials and map the pipeline, enabling lateral movement and build tampering that impacts integrity.

Recommendation

Enable encryption at rest for S3 logs on CodeBuild projects. Prefer SSE-KMS with customer-managed keys to control access and rotation. Enforce encryption via bucket policy, apply least privilege to log access, and monitor access patterns. If needed, segregate logs and keep them private.

Remediation

CLI
Terraform
Native IaC
Dashboard steps

aws codebuild update-project --name <project-name> --logs-config s3Logs={status=ENABLED,location=<bucket-name>/<path>,encryptionDisabled=false}

resource "aws_codebuild_project" "<example_resource_name>" {
  name         = "<example_resource_name>"
  service_role = "<example_role_arn>"

  artifacts { type = "NO_ARTIFACTS" }

  environment {
    compute_type = "BUILD_GENERAL1_SMALL"
    image        = "aws/codebuild/amazonlinux2-x86_64-standard:5.0"
    type         = "LINUX_CONTAINER"
  }

  source { type = "NO_SOURCE" }

  logs_config {
    s3_logs {
      status              = "ENABLED"
      location            = "<bucket-name>/<path>"
      encryption_disabled = false  # Critical: enables encryption for S3 logs
    }
  }
}

Resources:
  <example_resource_name>:
    Type: AWS::CodeBuild::Project
    Properties:
      Name: <example_resource_name>
      ServiceRole: <example_role_arn>
      Artifacts:
        Type: NO_ARTIFACTS
      Environment:
        Type: LINUX_CONTAINER
        ComputeType: BUILD_GENERAL1_SMALL
        Image: aws/codebuild/amazonlinux2-x86_64-standard:5.0
      Source:
        Type: NO_SOURCE
      LogsConfig:
        S3Logs:
          Status: ENABLED
          Location: <bucket-name>/<path>
          EncryptionDisabled: false  # Critical: ensures S3 logs are encrypted at rest

References

Where this check fires

This check runs on every scheduled scan against your AWS account. Findings appear at Cloud Security → Findings filterable by Check ID = codebuild_project_s3_logs_encrypted. To re-evaluate after a fix, hit Run now on the account’s schedule under Cloud Security → Schedules — the next scan re-checks this control and marks the finding fixed or keeps it persistent.

← Back to AWS checks

CodeBuild project has been invoked in the last 90 days CodeBuild source repository URLs hold no credentials

​What this check verifies

​Risk

​Recommendation

​Remediation

​References

​Where this check fires

What this check verifies

Risk

Recommendation

Remediation

References

Where this check fires