Back to Checks
aws

CodeBuild project S3 logs are encrypted at rest

codebuild_project_s3_logs_encrypted
Service: codebuildSeverity: low
OfficialBuilt-inVerified
Categories:encryptionlogging
Resource Type:AwsCodeBuildProject

CodeBuild projects with S3 log delivery are evaluated for encryption at rest on their S3 log objects. Only projects that write logs to S3 are in scope.

Prowler logoProwlerprowler-provider-aws

Risk

Unencrypted build logs jeopardize confidentiality. Logs can include secrets, environment data, and error traces. If the bucket is misconfigured or storage is accessed, attackers can harvest credentials and map the pipeline, enabling lateral movement and build tampering that impacts integrity.

Run this check with Prowler

Run in Prowler Cloud
Run
prowler aws --checks codebuild_project_s3_logs_encrypted

Recommendation

Enable encryption at rest for S3 logs on CodeBuild projects. Prefer SSE-KMS with customer-managed keys to control access and rotation. Enforce encryption via bucket policy, apply least privilege to log access, and monitor access patterns. If needed, segregate logs and keep them private.

Remediation

CLI

aws codebuild update-project --name <project-name> --logs-config s3Logs={status=ENABLED,location=<bucket-name>/<path>,encryptionDisabled=false}

Terraform

resource "aws_codebuild_project" "<example_resource_name>" {
  name         = "<example_resource_name>"
  service_role = "<example_role_arn>"

  artifacts { type = "NO_ARTIFACTS" }

  environment {
    compute_type = "BUILD_GENERAL1_SMALL"
    image        = "aws/codebuild/amazonlinux2-x86_64-standard:5.0"
    type         = "LINUX_CONTAINER"
  }

  source { type = "NO_SOURCE" }

  logs_config {
    s3_logs {
      status              = "ENABLED"
      location            = "<bucket-name>/<path>"
      encryption_disabled = false  # Critical: enables encryption for S3 logs
    }
  }
}

NativeIaC

Resources:
  <example_resource_name>:
    Type: AWS::CodeBuild::Project
    Properties:
      Name: <example_resource_name>
      ServiceRole: <example_role_arn>
      Artifacts:
        Type: NO_ARTIFACTS
      Environment:
        Type: LINUX_CONTAINER
        ComputeType: BUILD_GENERAL1_SMALL
        Image: aws/codebuild/amazonlinux2-x86_64-standard:5.0
      Source:
        Type: NO_SOURCE
      LogsConfig:
        S3Logs:
          Status: ENABLED
          Location: <bucket-name>/<path>
          EncryptionDisabled: false  # Critical: ensures S3 logs are encrypted at rest

Other

1Open the AWS CodeBuild console and select your project
2Choose Edit, then open the Logs section
3Under S3 logs, select Enabled and choose the Bucket/Path
4Ensure Disable S3 log encryption is unchecked (encryption enabled)
5Save changes

Check Code

from prowler.lib.check.models import Check, Check_Report_AWS
from prowler.providers.aws.services.codebuild.codebuild_client import codebuild_client


class codebuild_project_s3_logs_encrypted(Check):
    def execute(self):
        findings = []
        for project in codebuild_client.projects.values():
            if project.s3_logs and project.s3_logs.enabled:
                report = Check_Report_AWS(metadata=self.metadata(), resource=project)
                report.status = "PASS"
                report.status_extended = f"CodeBuild project {project.name} has encrypted S3 logs stored in {project.s3_logs.bucket_location}."
                if not project.s3_logs.encrypted:
                    report.status = "FAIL"
                    report.status_extended = f"CodeBuild project {project.name} does not have encrypted S3 logs stored in {project.s3_logs.bucket_location}."

                findings.append(report)

        return findings

References