Codebuild project artifact encryption remediation

Using Console

Here’s how to enable artifact encryption for an AWS CodeBuild project using the AWS Management Console:

1. Identify the CodeBuild project

Sign in to the AWS Management Console.
Go to CodeBuild:
Services → CodeBuild.
In the left menu, click Build projects.
Click the name of the project you need to fix.

2. Edit the project

On the project details page, click Edit in the upper-right corner.
Scroll down to the Artifacts section.

3. Ensure artifact type and location are set

Under Artifacts, make sure:
- Type is Amazon S3 (or another artifact type that supports encryption).
- Bucket name is set to the S3 bucket where artifacts are stored.

If you don’t have a bucket yet, create one in S3 first, then return and select it.

4. Configure encryption

In the Artifacts section:

Find Encryption key (sometimes labeled KMS key or similar).
Choose one of:
- Default AWS managed key for S3:
  Select aws/s3 or the default option shown, or
- Customer managed key (CMK):
  - From the dropdown, select your KMS key ARN,
  - or paste the full key ARN from AWS KMS.

Make sure the KMS key policy allows CodeBuild and the IAM role used by the project to use the key (kms:Encrypt, kms:Decrypt, kms:GenerateDataKey at minimum for the project role).

5. Save changes

Scroll to the bottom of the page.
Click Update artifacts (if present) and/or Update / Save to apply the changes to the project.

6. (Optional) Verify in S3

Go to S3 → select the bucket used for artifacts.
Open Properties → Default encryption:
- Ensure it is set to AWS KMS (or at least SSE-S3), and
- Confirm it matches your expected encryption settings.

Note: The CodeBuild artifact encryption control is generally satisfied when an encryption key is configured for artifacts (and the bucket is not left unencrypted).

If you share the exact scanner/tool (e.g., Security Hub, Checkov, etc.), I can tailor the final check to what that tool expects.

Using CLI

Below are the minimal steps to turn on artifact encryption for an AWS CodeBuild project using the AWS CLI.

1. Identify the project and KMS key

Pick the project name and the KMS key you want to use (either an alias or key ARN):

PROJECT_NAME="my-codebuild-project"
KMS_KEY_ARN="arn:aws:kms:us-east-1:111122223333:key/xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx"
# or: KMS_KEY_ARN="alias/aws/s3" (or your own alias)

2. Get the current project configuration

aws codebuild batch-get-projects \
  --names "$PROJECT_NAME" \
  --query 'projects[0]' \
  --output json > project.json

This file will be used as a base for the update.

3. Edit `project.json` to enable artifact encryption

Open project.json in an editor and construct an update-project payload.
You must supply the full configuration blocks required by update-project, not just the changed fields.Create a new file update-project.json with content like:

{
  "name": "my-codebuild-project",
  "description": "My project",
  "serviceRole": "arn:aws:iam::111122223333:role/codebuild-service-role",
  "artifacts": {
    "type": "S3",
    "location": "my-artifacts-bucket",
    "path": "codebuild-output",
    "packaging": "ZIP",
    "name": "build-artifact",
    "encryptionDisabled": false,
    "overrideArtifactName": false,
    "artifactIdentifier": "Artifact1",
    "encryptionKey": "arn:aws:kms:us-east-1:111122223333:key/xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx"
  },
  "environment": {
    "type": "LINUX_CONTAINER",
    "image": "aws/codebuild/standard:7.0",
    "computeType": "BUILD_GENERAL1_SMALL",
    "environmentVariables": [],
    "privilegedMode": false
  },
  "source": {
    "type": "GITHUB",
    "location": "https://github.com/org/repo",
    "buildspec": "buildspec.yml"
  },
  "sourceVersion": "main",
  "timeoutInMinutes": 60,
  "queuedTimeoutInMinutes": 480,
  "cache": {
    "type": "NO_CACHE"
  },
  "badgeEnabled": false,
  "logsConfig": {
    "cloudWatchLogs": {
      "status": "ENABLED",
      "groupName": "/aws/codebuild/my-codebuild-project",
      "streamName": "build"
    },
    "s3Logs": {
      "status": "DISABLED"
    }
  }
}

Key parts for encryption:

"encryptionDisabled": false
"encryptionKey": "YOUR_KMS_KEY_ARN_OR_ALIAS"

Adjust all values (role, image, source, bucket, etc.) to match what you saw in project.json.If you previously had multiple artifacts (secondaryArtifacts), repeat the same properties for each artifact that should be encrypted.

4. Apply the update

aws codebuild update-project \
  --cli-input-json file://update-project.json

5. Verify configuration

aws codebuild batch-get-projects \
  --names "$PROJECT_NAME" \
  --query 'projects[0].artifacts.[encryptionDisabled,encryptionKey]'

You should see:

encryptionDisabled = false
encryptionKey = your KMS key ARN/alias

Using Python

To remediate “Artifact Encryption Should Be Enabled” for an AWS CodeBuild project using Python, you need to:

Have (or create) a KMS key.
Update the CodeBuild project’s artifacts (and any secondaryArtifacts) to:
- encryptionDisabled = False (or omit it)
- encryptionKey = <KMS key ARN or alias>

Below is a minimal, step‑by‑step guide with Python/boto3.

1. Prerequisites

boto3 installed:
pip install boto3
AWS credentials configured (via aws configure, environment variables, or IAM role).

2. (Optional) Create a KMS Key in Python

If you don’t already have a KMS key you want to use:

import boto3

kms = boto3.client("kms")

response = kms.create_key(
    Description="KMS key for CodeBuild artifact encryption",
    KeyUsage="ENCRYPT_DECRYPT",
    Origin="AWS_KMS"
)

kms_key_id = response["KeyMetadata"]["KeyId"]
print("KMS KeyId:", kms_key_id)

# Optional: create alias for easier reference
kms.create_alias(
    AliasName="alias/codebuild-artifacts",
    TargetKeyId=kms_key_id
)

You can then use either:

ARN of the key, or
alias/codebuild-artifacts as the encryption key value.

3. Update an Existing CodeBuild Project to Enable Artifact Encryption

This script:

Gets the current project configuration.
Reuses all existing fields.
Updates artifacts to enable encryption and set a KMS key.
Does the same for any secondaryArtifacts if present.

import boto3
import copy

codebuild = boto3.client("codebuild")

PROJECT_NAME = "your-codebuild-project-name"
KMS_KEY_ARN_OR_ALIAS = "alias/codebuild-artifacts"  # or full KMS key ARN

# 1) Get current project config
resp = codebuild.batch_get_projects(names=[PROJECT_NAME])
projects = resp.get("projects", [])
if not projects:
    raise ValueError(f"Project {PROJECT_NAME} not found")

project = projects[0]

# 2) Build update payload: start from existing fields
update_params = {
    "name": project["name"],
    "description": project.get("description"),
    "serviceRole": project["serviceRole"],
    "timeoutInMinutes": project.get("timeoutInMinutes"),
    "queuedTimeoutInMinutes": project.get("queuedTimeoutInMinutes"),
    "encryptionKey": project.get("encryptionKey"),
    "tags": project.get("tags"),
    "badgeEnabled": project.get("badge", {}).get("badgeEnabled"),
    "logsConfig": project.get("logsConfig"),
    "fileSystemLocations": project.get("fileSystemLocations"),
    "buildBatchConfig": project.get("buildBatchConfig"),
    "concurrentBuildLimit": project.get("concurrentBuildLimit"),
    "cache": project.get("cache"),
    "environment": project.get("environment"),
    "source": project.get("source"),
    "vpcConfig": project.get("vpcConfig"),
    "secondarySources": project.get("secondarySources"),
    "secondarySourceVersions": project.get("secondarySourceVersions"),
}

# Remove None values (CodeBuild API doesn’t like explicit None)
update_params = {k: v for k, v in update_params.items() if v is not None}

# 3) Update primary artifacts
artifacts = copy.deepcopy(project["artifacts"])
# For S3 or other external outputs, force encryption via KMS key
artifacts["encryptionDisabled"] = False
artifacts["encryptionKey"] = KMS_KEY_ARN_OR_ALIAS
update_params["artifacts"] = artifacts

# 4) Update any secondaryArtifacts if present
secondary_artifacts = project.get("secondaryArtifacts", [])
if secondary_artifacts:
    new_secondary = []
    for a in secondary_artifacts:
        a = copy.deepcopy(a)
        a["encryptionDisabled"] = False
        a["encryptionKey"] = KMS_KEY_ARN_OR_ALIAS
        new_secondary.append(a)
    update_params["secondaryArtifacts"] = new_secondary

# 5) Call update_project
result = codebuild.update_project(**update_params)
print("Updated project:", result["project"]["name"])
print("Artifact encryption key:", result["project"]["artifacts"].get("encryptionKey"))

4. Notes / Checks

Ensure the CodeBuild service role has permission to use the KMS key:
- KMS key policy should allow codebuild.amazonaws.com or the specific role ARN kms:Encrypt, kms:Decrypt, kms:GenerateDataKey*, kms:DescribeKey.
Verify encryption is enabled:
- In the console: CodeBuild → Project → Artifacts → check KMS key configured.
- Or via batch_get_projects and inspect artifacts["encryptionKey"] and artifacts["encryptionDisabled"].

This will remediate the “Artifact Encryption Should Be Enabled” finding programmatically for the project.

Using Terraform

resource "aws_codebuild_project" "THIS_PROJECT" {
  name = "CODEBUILD_PROJECT_NAME" # replace with your project name

  # ... other required arguments like service_role, environment, source, etc.

  artifacts {
    type                = "S3"                 # or the type you actually use
    location            = "S3_BUCKET_NAME"     # replace with your S3 bucket
    encryption_disabled = false                # ensure artifact encryption is ENABLED
    # ... any other existing artifact settings (path, packaging, etc.)
  }

  # If you use secondary artifacts, each must also have encryption_disabled = false
  secondary_artifacts {
    artifact_identifier = "SECONDARY_ARTIFACT_ID" # replace with your identifier
    type                = "S3"
    location            = "SECONDARY_S3_BUCKET"
    encryption_disabled = false
    # ... other existing secondary artifact settings
  }
}

This matches the CLI fix by ensuring encryption_disabled is set to false on the primary artifacts block (and any secondary_artifacts blocks) in Terraform instead of via aws codebuild update-project. This change is in-place and does not force replacement of the CodeBuild project.For verification, terraform plan should show the aws_codebuild_project update changing artifacts[*].encryption_disabled (and any secondary_artifacts[*].encryption_disabled) from true (or omitted) to false.

AWS Introduction

AWS Pricing

AWS Threats

AWS Misconfigurations

Codebuild project artifact encryption remediation

Triage and Remediation

Remediation

1. Identify the CodeBuild project

2. Edit the project

3. Ensure artifact type and location are set

4. Configure encryption

5. Save changes

6. (Optional) Verify in S3

1. Identify the project and KMS key

2. Get the current project configuration

3. Edit `project.json` to enable artifact encryption

4. Apply the update

5. Verify configuration

1. Prerequisites

2. (Optional) Create a KMS Key in Python

3. Update an Existing CodeBuild Project to Enable Artifact Encryption

4. Notes / Checks

​Triage and Remediation

​Remediation

​1. Identify the CodeBuild project

​2. Edit the project

​3. Ensure artifact type and location are set

​4. Configure encryption

​5. Save changes

​6. (Optional) Verify in S3

​1. Identify the project and KMS key

​2. Get the current project configuration

​3. Edit project.json to enable artifact encryption

​4. Apply the update

​5. Verify configuration

​1. Prerequisites

​2. (Optional) Create a KMS Key in Python

​3. Update an Existing CodeBuild Project to Enable Artifact Encryption

​4. Notes / Checks

Triage and Remediation

Remediation

1. Identify the CodeBuild project

2. Edit the project

3. Ensure artifact type and location are set

4. Configure encryption

5. Save changes

6. (Optional) Verify in S3

1. Identify the project and KMS key

2. Get the current project configuration

3. Edit `project.json` to enable artifact encryption

4. Apply the update

5. Verify configuration

1. Prerequisites

2. (Optional) Create a KMS Key in Python

3. Update an Existing CodeBuild Project to Enable Artifact Encryption

4. Notes / Checks