Back to Checks
aws

CodeBuild report group exports to S3 are encrypted at rest

codebuild_report_group_export_encrypted
Service: codebuildSeverity: medium
OfficialBuilt-inVerified
Categories:encryption
Resource Type:AwsCodeBuildProject

CodeBuild report groups with export type S3 are evaluated to confirm their exported test results are encrypted at rest with a KMS key.

Report groups configured with NO_EXPORT are out of scope.

Prowler logoProwlerprowler-provider-aws

Risk

Unencrypted S3 exports leave report data in plaintext, weakening confidentiality.

If a bucket is misconfigured, compromised, or accessed by insiders, attackers can harvest test outputs for secrets, tokens, build paths, and system details, enabling credential theft and lateral movement.

Run this check with Prowler

Run in Prowler Cloud
Run
prowler aws --checks codebuild_report_group_export_encrypted

Recommendation

Enable at-rest encryption for report exports using KMS (prefer customer managed keys).

Apply least privilege: restrict key usage to the CodeBuild role and required principals, enable rotation, and audit key usage. Combine with S3 bucket policies for defense in depth.

Remediation

CLI

aws codebuild update-report-group --arn <report-group-arn> --export-config "exportConfigType=S3,s3Destination={bucket=<bucket-name>,encryptionDisabled=false}"

Terraform

# Enable encryption for CodeBuild report group S3 exports
resource "aws_codebuild_report_group" "<example_resource_name>" {
  name = "<example_resource_name>"
  type = "TEST"

  export_config {
    type = "S3"
    s3_destination {
      bucket              = "<example_resource_name>"
      encryption_disabled = false  # Critical: ensures S3 exports are encrypted at rest
      # Uses AWS managed key by default
    }
  }
}

NativeIaC

# CloudFormation: Enable encryption for CodeBuild report group S3 exports
Resources:
  <example_resource_name>:
    Type: AWS::CodeBuild::ReportGroup
    Properties:
      Name: <example_resource_name>
      Type: TEST
      ExportConfig:
        ExportConfigType: S3
        S3Destination:
          Bucket: <example_resource_name>
          EncryptionDisabled: false  # Critical: ensures S3 exports are encrypted at rest
          # Uses AWS managed key by default

Other

1Open the AWS Console and go to CodeBuild > Report groups
2Select the report group and click Edit
3Ensure Export to Amazon S3 is enabled and a bucket is set
4Expand Additional configuration and enable encryption by choosing Default AWS managed key (or select a KMS key)
5Ensure Disable artifact encryption is NOT selected
6Save changes

Check Code

from prowler.lib.check.models import Check, Check_Report_AWS
from prowler.providers.aws.services.codebuild.codebuild_client import codebuild_client


class codebuild_report_group_export_encrypted(Check):
    def execute(self):
        findings = []
        for report_group in codebuild_client.report_groups.values():
            if report_group.export_config and report_group.export_config.type == "S3":
                report = Check_Report_AWS(
                    metadata=self.metadata(), resource=report_group
                )
                report.status = "PASS"
                report.status_extended = f"CodeBuild report group {report_group.name} exports are encrypted at {report_group.export_config.bucket_location} with KMS key {report_group.export_config.encryption_key}."

                if not report_group.export_config.encrypted:
                    report.status = "FAIL"
                    report.status_extended = f"CodeBuild report group {report_group.name} exports are not encrypted at {report_group.export_config.bucket_location}."

                findings.append(report)

        return findings

References