CodeBuild report group exports to S3 are encrypted at rest

Check ID: codebuild_report_group_export_encrypted
Provider: AWS
Service: codebuild
Severity: MEDIUM
Categories: encryption
Resource type: AwsCodeBuildProject

What this check verifies

CodeBuild report groups with export type S3 are evaluated to confirm their exported test results are encrypted at rest with a KMS key. Report groups configured with NO_EXPORT are out of scope.

Risk

Unencrypted S3 exports leave report data in plaintext, weakening confidentiality. If a bucket is misconfigured, compromised, or accessed by insiders, attackers can harvest test outputs for secrets, tokens, build paths, and system details, enabling credential theft and lateral movement.

Recommendation

Enable at-rest encryption for report exports using KMS (prefer customer managed keys). Apply least privilege: restrict key usage to the CodeBuild role and required principals, enable rotation, and audit key usage. Combine with S3 bucket policies for defense in depth.

Remediation

CLI
Terraform
Native IaC
Dashboard steps

aws codebuild update-report-group --arn <report-group-arn> --export-config "exportConfigType=S3,s3Destination={bucket=<bucket-name>,encryptionDisabled=false}"

# Enable encryption for CodeBuild report group S3 exports
resource "aws_codebuild_report_group" "<example_resource_name>" {
  name = "<example_resource_name>"
  type = "TEST"

  export_config {
    type = "S3"
    s3_destination {
      bucket              = "<example_resource_name>"
      encryption_disabled = false  # Critical: ensures S3 exports are encrypted at rest
      # Uses AWS managed key by default
    }
  }
}

# CloudFormation: Enable encryption for CodeBuild report group S3 exports
Resources:
  <example_resource_name>:
    Type: AWS::CodeBuild::ReportGroup
    Properties:
      Name: <example_resource_name>
      Type: TEST
      ExportConfig:
        ExportConfigType: S3
        S3Destination:
          Bucket: <example_resource_name>
          EncryptionDisabled: false  # Critical: ensures S3 exports are encrypted at rest
          # Uses AWS managed key by default

References

Where this check fires

This check runs on every scheduled scan against your AWS account. Findings appear at Cloud Security → Findings filterable by Check ID = codebuild_report_group_export_encrypted. To re-evaluate after a fix, hit Run now on the account’s schedule under Cloud Security → Schedules — the next scan re-checks this control and marks the finding fixed or keeps it persistent.

← Back to AWS checks

CodeBuild webhook filters use anchored regex patterns CodePipeline source uses an authenticated private repo

​What this check verifies

​Risk

​Recommendation

​Remediation

​References

​Where this check fires

What this check verifies

Risk

Recommendation

Remediation

References

Where this check fires