All checks
Low
CodeBuild S3 logs should be encrypted
Flags CodeBuild projects that write build logs to S3 with encryption turned off, so the logs are written with the bucket's own default rather than the KMS key CodeBuild would otherwise use. Projects that do not write S3 logs are out of scope.
- service
- CodeBuild
- severity
- Low
- scope
- evaluated in every region
How to fix it
To ensure the encryption of CodeBuild project S3 logs, enable encryption in the S3 logs configuration.
- Open the AWS CodeBuild console.
- Select the build project to modify.
- Navigate to the 'Logs' section in the project settings.
- Ensure that 'S3 logs' is enabled and 'Encryption disabled' is not checked.
- Save the changes to the project configuration.
See which of your accounts this check is failing on.
Book a demo