Back to Checks
aws

CodeBuild project has CloudWatch Logs or S3 logging enabled

codebuild_project_logging_enabled
Service: codebuildSeverity: medium
OfficialBuilt-inVerified
Categories:logging
Resource Type:AwsCodeBuildProject

CodeBuild projects are assessed for logging configuration to Amazon CloudWatch Logs or S3, identifying when at least one destination is enabled for build logs and events.

Prowler logoProwlerprowler-provider-aws

Risk

Absence of build logging creates blind spots for integrity and accountability. Attackers or misconfigurations can alter artifacts, exfiltrate data, or misuse credentials with little trace, hindering forensics and incident response. Missing telemetry impedes correlation with other alerts, risking source code and secret confidentiality.

Run this check with Prowler

Run in Prowler Cloud
Run
prowler aws --checks codebuild_project_logging_enabled

Recommendation

Enable a log destination for every project-CloudWatch Logs or S3 (preferably both). Enforce defense in depth: encrypt logs, set retention, and restrict access on a least-privilege basis. Centralize and monitor logs, alert on anomalies, and avoid sensitive data in output. Use immutable retention to preserve auditability.

Remediation

CLI

aws codebuild update-project --name <project-name> --logs-config "cloudWatchLogs={status=ENABLED}"

Terraform

# Terraform: Enable logging on a CodeBuild project
resource "aws_codebuild_project" "<example_resource_name>" {
  name         = "<example_resource_name>"
  service_role = "<example_resource_id>"

  artifacts { type = "NO_ARTIFACTS" }

  environment {
    compute_type = "BUILD_GENERAL1_SMALL"
    image        = "aws/codebuild/standard:5.0"
    type         = "LINUX_CONTAINER"
  }

  source { type = "NO_SOURCE" }

  logs_config {
    cloudwatch_logs {
      status = "ENABLED"  # Critical: Enables CloudWatch logging to pass the check
    }
  }
}

NativeIaC

# CloudFormation: Enable logging on a CodeBuild project
Resources:
  <example_resource_name>:
    Type: AWS::CodeBuild::Project
    Properties:
      Name: <example_resource_name>
      ServiceRole: <example_resource_id>
      Artifacts:
        Type: NO_ARTIFACTS
      Environment:
        Type: LINUX_CONTAINER
        ComputeType: BUILD_GENERAL1_SMALL
        Image: aws/codebuild/standard:5.0
      Source:
        Type: NO_SOURCE
      LogsConfig:
        CloudWatchLogs:
          Status: ENABLED  # Critical: Enables CloudWatch logging to pass the check

Other

1In the AWS Console, go to CodeBuild > Build projects and open your project
2Under Logs, click Edit
3Check CloudWatch logs and save (or enable S3 logs instead)
4Confirm the project now shows logging enabled

Check Code

from prowler.lib.check.models import Check, Check_Report_AWS
from prowler.providers.aws.services.codebuild.codebuild_client import codebuild_client


class codebuild_project_logging_enabled(Check):
    def execute(self):
        findings = []
        for project in codebuild_client.projects.values():
            report = Check_Report_AWS(metadata=self.metadata(), resource=project)
            report.status = "PASS"

            cw_logs_enabled = (
                project.cloudwatch_logs and project.cloudwatch_logs.enabled
            )
            s3_logs_enabled = project.s3_logs and project.s3_logs.enabled

            if cw_logs_enabled and s3_logs_enabled:
                report.status_extended = f"CodeBuild project {project.name} has enabled CloudWatch logs in log group {project.cloudwatch_logs.group_name} and S3 logs in bucket {project.s3_logs.bucket_location}."
            elif cw_logs_enabled:
                report.status_extended = f"CodeBuild project {project.name} has CloudWatch logging enabled in log group {project.cloudwatch_logs.group_name}."
            elif s3_logs_enabled:
                report.status_extended = f"CodeBuild project {project.name} has S3 logging enabled in bucket {project.s3_logs.bucket_location}."
            else:
                report.status = "FAIL"
                report.status_extended = (
                    f"CodeBuild project {project.name} does not have logging enabled."
                )

            findings.append(report)

        return findings

References