Skip to main content

Artifact Encryption Should Be Enabled CodeBuild Project

More Info:​

This rule verifies whether encryption is enabled for all artifacts of an AWS CodeBuild project. Enabling encryption for artifacts helps protect sensitive data stored in the artifacts from unauthorized access or tampering. It ensures that artifacts are encrypted while stored, providing an additional layer of security.

Risk Level​

Medium

Address​

Security

Compliance Standards​

  • APRA CPS 234 (Australia)
  • BSI C5 (Germany)
  • Brazil LGPD
  • CCPA / CPRA (California)
  • CIS Critical Security Controls v8
  • CMMC 2.0
  • CSA Cloud Controls Matrix v4
  • Cloudanix Best Practice
  • DPDPA
  • Digital Operational Resilience Act (EU)
  • ISO/IEC 27017
  • ISO/IEC 27018
  • ISO/IEC 27701
  • KSA PDPL
  • MAS Technology Risk Management (Singapore)
  • MITRE ATT&CK (Cloud)
  • NIS2 Directive
  • NIST SP 800-171
  • NYDFS 23 NYCRR 500
  • Reserve Bank of India (RBI) Cyber Security Framework
  • SWIFT Customer Security Controls Framework
  • Sarbanes-Oxley IT General Controls
  • Securities and Exchange Board of India (SEBI) - Cloud Security Adoption Framework
  • UK NCSC Cyber Assessment Framework

Triage and Remediation​

Remediation​

Using Console

Here’s how to enable artifact encryption for an AWS CodeBuild project using the AWS Management Console:

1. Identify the CodeBuild project​

  1. Sign in to the AWS Management Console.
  2. Go to CodeBuild:
    Services → CodeBuild.
  3. In the left menu, click Build projects.
  4. Click the name of the project you need to fix.

2. Edit the project​

  1. On the project details page, click Edit in the upper-right corner.
  2. Scroll down to the Artifacts section.

3. Ensure artifact type and location are set​

  1. Under Artifacts, make sure:
    • Type is Amazon S3 (or another artifact type that supports encryption).
    • Bucket name is set to the S3 bucket where artifacts are stored.

If you don’t have a bucket yet, create one in S3 first, then return and select it.

4. Configure encryption​

In the Artifacts section:

  1. Find Encryption key (sometimes labeled KMS key or similar).
  2. Choose one of:
    • Default AWS managed key for S3:
      Select aws/s3 or the default option shown, or
    • Customer managed key (CMK):
      • From the dropdown, select your KMS key ARN,
      • or paste the full key ARN from AWS KMS.

Make sure the KMS key policy allows CodeBuild and the IAM role used by the project to use the key (kms:Encrypt, kms:Decrypt, kms:GenerateDataKey at minimum for the project role).

5. Save changes​

  1. Scroll to the bottom of the page.
  2. Click Update artifacts (if present) and/or Update / Save to apply the changes to the project.

6. (Optional) Verify in S3​

  1. Go to S3 → select the bucket used for artifacts.
  2. Open Properties → Default encryption:
    • Ensure it is set to AWS KMS (or at least SSE-S3), and
    • Confirm it matches your expected encryption settings.

Note: The CodeBuild artifact encryption control is generally satisfied when an encryption key is configured for artifacts (and the bucket is not left unencrypted).

If you share the exact scanner/tool (e.g., Security Hub, Checkov, etc.), I can tailor the final check to what that tool expects.

Using CLI

Below are the minimal steps to turn on artifact encryption for an AWS CodeBuild project using the AWS CLI.

1. Identify the project and KMS key​

Pick the project name and the KMS key you want to use (either an alias or key ARN):

PROJECT_NAME="my-codebuild-project"
KMS_KEY_ARN="arn:aws:kms:us-east-1:111122223333:key/xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx"
# or: KMS_KEY_ARN="alias/aws/s3" (or your own alias)

2. Get the current project configuration​

aws codebuild batch-get-projects \
  --names "$PROJECT_NAME" \
  --query 'projects[0]' \
  --output json > project.json

This file will be used as a base for the update.

3. Edit project.json to enable artifact encryption​

Open project.json in an editor and construct an update-project payload.
You must supply the full configuration blocks required by update-project, not just the changed fields.

Create a new file update-project.json with content like:

{
  "name": "my-codebuild-project",
  "description": "My project",
  "serviceRole": "arn:aws:iam::111122223333:role/codebuild-service-role",
  "artifacts": {
    "type": "S3",
    "location": "my-artifacts-bucket",
    "path": "codebuild-output",
    "packaging": "ZIP",
    "name": "build-artifact",
    "encryptionDisabled": false,
    "overrideArtifactName": false,
    "artifactIdentifier": "Artifact1",
    "encryptionKey": "arn:aws:kms:us-east-1:111122223333:key/xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx"
  },
  "environment": {
    "type": "LINUX_CONTAINER",
    "image": "aws/codebuild/standard:7.0",
    "computeType": "BUILD_GENERAL1_SMALL",
    "environmentVariables": [],
    "privilegedMode": false
  },
  "source": {
    "type": "GITHUB",
    "location": "https://github.com/org/repo",
    "buildspec": "buildspec.yml"
  },
  "sourceVersion": "main",
  "timeoutInMinutes": 60,
  "queuedTimeoutInMinutes": 480,
  "cache": {
    "type": "NO_CACHE"
  },
  "badgeEnabled": false,
  "logsConfig": {
    "cloudWatchLogs": {
      "status": "ENABLED",
      "groupName": "/aws/codebuild/my-codebuild-project",
      "streamName": "build"
    },
    "s3Logs": {
      "status": "DISABLED"
    }
  }
}

Key parts for encryption:

  • "encryptionDisabled": false
  • "encryptionKey": "YOUR_KMS_KEY_ARN_OR_ALIAS"

Adjust all values (role, image, source, bucket, etc.) to match what you saw in project.json.

If you previously had multiple artifacts (secondaryArtifacts), repeat the same properties for each artifact that should be encrypted.

4. Apply the update​

aws codebuild update-project \
  --cli-input-json file://update-project.json

5. Verify configuration​

aws codebuild batch-get-projects \
  --names "$PROJECT_NAME" \
  --query 'projects[0].artifacts.[encryptionDisabled,encryptionKey]'

You should see:

  • encryptionDisabled = false
  • encryptionKey = your KMS key ARN/alias
Using Python

To remediate “Artifact Encryption Should Be Enabled” for an AWS CodeBuild project using Python, you need to:

  1. Have (or create) a KMS key.
  2. Update the CodeBuild project’s artifacts (and any secondaryArtifacts) to:
    • encryptionDisabled = False (or omit it)
    • encryptionKey = <KMS key ARN or alias>

Below is a minimal, step‑by‑step guide with Python/boto3.

1. Prerequisites​

  • boto3 installed: 
    pip install boto3
  • AWS credentials configured (via aws configure, environment variables, or IAM role).

2. (Optional) Create a KMS Key in Python​

If you don’t already have a KMS key you want to use:

import boto3

kms = boto3.client("kms")

response = kms.create_key(
    Description="KMS key for CodeBuild artifact encryption",
    KeyUsage="ENCRYPT_DECRYPT",
    Origin="AWS_KMS"
)

kms_key_id = response["KeyMetadata"]["KeyId"]
print("KMS KeyId:", kms_key_id)

# Optional: create alias for easier reference
kms.create_alias(
    AliasName="alias/codebuild-artifacts",
    TargetKeyId=kms_key_id
)

You can then use either:

  • ARN of the key, or
  • alias/codebuild-artifacts as the encryption key value.

3. Update an Existing CodeBuild Project to Enable Artifact Encryption​

This script:

  • Gets the current project configuration.
  • Reuses all existing fields.
  • Updates artifacts to enable encryption and set a KMS key.
  • Does the same for any secondaryArtifacts if present.
import boto3
import copy

codebuild = boto3.client("codebuild")

PROJECT_NAME = "your-codebuild-project-name"
KMS_KEY_ARN_OR_ALIAS = "alias/codebuild-artifacts"  # or full KMS key ARN

# 1) Get current project config
resp = codebuild.batch_get_projects(names=[PROJECT_NAME])
projects = resp.get("projects", [])
if not projects:
    raise ValueError(f"Project {PROJECT_NAME} not found")

project = projects[0]

# 2) Build update payload: start from existing fields
update_params = {
    "name": project["name"],
    "description": project.get("description"),
    "serviceRole": project["serviceRole"],
    "timeoutInMinutes": project.get("timeoutInMinutes"),
    "queuedTimeoutInMinutes": project.get("queuedTimeoutInMinutes"),
    "encryptionKey": project.get("encryptionKey"),
    "tags": project.get("tags"),
    "badgeEnabled": project.get("badge", {}).get("badgeEnabled"),
    "logsConfig": project.get("logsConfig"),
    "fileSystemLocations": project.get("fileSystemLocations"),
    "buildBatchConfig": project.get("buildBatchConfig"),
    "concurrentBuildLimit": project.get("concurrentBuildLimit"),
    "cache": project.get("cache"),
    "environment": project.get("environment"),
    "source": project.get("source"),
    "vpcConfig": project.get("vpcConfig"),
    "secondarySources": project.get("secondarySources"),
    "secondarySourceVersions": project.get("secondarySourceVersions"),
}

# Remove None values (CodeBuild API doesn’t like explicit None)
update_params = {k: v for k, v in update_params.items() if v is not None}

# 3) Update primary artifacts
artifacts = copy.deepcopy(project["artifacts"])
# For S3 or other external outputs, force encryption via KMS key
artifacts["encryptionDisabled"] = False
artifacts["encryptionKey"] = KMS_KEY_ARN_OR_ALIAS
update_params["artifacts"] = artifacts

# 4) Update any secondaryArtifacts if present
secondary_artifacts = project.get("secondaryArtifacts", [])
if secondary_artifacts:
    new_secondary = []
    for a in secondary_artifacts:
        a = copy.deepcopy(a)
        a["encryptionDisabled"] = False
        a["encryptionKey"] = KMS_KEY_ARN_OR_ALIAS
        new_secondary.append(a)
    update_params["secondaryArtifacts"] = new_secondary

# 5) Call update_project
result = codebuild.update_project(**update_params)
print("Updated project:", result["project"]["name"])
print("Artifact encryption key:", result["project"]["artifacts"].get("encryptionKey"))

4. Notes / Checks​

  • Ensure the CodeBuild service role has permission to use the KMS key:
    • KMS key policy should allow codebuild.amazonaws.com or the specific role ARN kms:Encrypt, kms:Decrypt, kms:GenerateDataKey*, kms:DescribeKey.
  • Verify encryption is enabled:
    • In the console: CodeBuild → Project → Artifacts → check KMS key configured.
    • Or via batch_get_projects and inspect artifacts["encryptionKey"] and artifacts["encryptionDisabled"].

This will remediate the “Artifact Encryption Should Be Enabled” finding programmatically for the project.

Using Terraform
resource "aws_codebuild_project" "THIS_PROJECT" {
  name = "CODEBUILD_PROJECT_NAME" # replace with your project name

  # ... other required arguments like service_role, environment, source, etc.

  artifacts {
    type                = "S3"                 # or the type you actually use
    location            = "S3_BUCKET_NAME"     # replace with your S3 bucket
    encryption_disabled = false                # ensure artifact encryption is ENABLED
    # ... any other existing artifact settings (path, packaging, etc.)
  }

  # If you use secondary artifacts, each must also have encryption_disabled = false
  secondary_artifacts {
    artifact_identifier = "SECONDARY_ARTIFACT_ID" # replace with your identifier
    type                = "S3"
    location            = "SECONDARY_S3_BUCKET"
    encryption_disabled = false
    # ... other existing secondary artifact settings
  }
}

This matches the CLI fix by ensuring encryption_disabled is set to false on the primary artifacts block (and any secondary_artifacts blocks) in Terraform instead of via aws codebuild update-project. This change is in-place and does not force replacement of the CodeBuild project.

For verification, terraform plan should show the aws_codebuild_project update changing artifacts[*].encryption_disabled (and any secondary_artifacts[*].encryption_disabled) from true (or omitted) to false.

Additional Reading:​