> ## Documentation Index > Fetch the complete documentation index at: https://cloudanix.com/docs/llms.txt > Use this file to discover all available pages before exploring further. # Codebuild project artifact encryption remediation ### Triage and Remediation ### Remediation Here’s how to enable artifact encryption for an AWS CodeBuild project using the AWS Management Console: *** ### 1. Identify the CodeBuild project 1. Sign in to the **AWS Management Console**. 2. Go to **CodeBuild**:\ Services → **CodeBuild**. 3. In the left menu, click **Build projects**. 4. Click the name of the project you need to fix. *** ### 2. Edit the project 1. On the project details page, click **Edit** in the upper-right corner. 2. Scroll down to the **Artifacts** section. *** ### 3. Ensure artifact type and location are set 1. Under **Artifacts**, make sure: * **Type** is **Amazon S3** (or another artifact type that supports encryption). * **Bucket name** is set to the S3 bucket where artifacts are stored. If you don’t have a bucket yet, create one in **S3** first, then return and select it. *** ### 4. Configure encryption In the **Artifacts** section: 1. Find **Encryption key** (sometimes labeled **KMS key** or similar). 2. Choose one of: * **Default AWS managed key for S3**:\ Select `aws/s3` or the default option shown, *or* * **Customer managed key (CMK)**: * From the dropdown, select your KMS key ARN, * or paste the full key ARN from **AWS KMS**. Make sure the KMS key policy allows CodeBuild and the IAM role used by the project to use the key (`kms:Encrypt`, `kms:Decrypt`, `kms:GenerateDataKey` at minimum for the project role). *** ### 5. Save changes 1. Scroll to the bottom of the page. 2. Click **Update artifacts** (if present) and/or **Update** / **Save** to apply the changes to the project. *** ### 6. (Optional) Verify in S3 1. Go to **S3** → select the bucket used for artifacts. 2. Open **Properties** → **Default encryption**: * Ensure it is set to **AWS KMS** (or at least SSE-S3), and * Confirm it matches your expected encryption settings. Note: The CodeBuild artifact encryption control is generally satisfied when an encryption key is configured for artifacts (and the bucket is not left unencrypted). *** If you share the exact scanner/tool (e.g., Security Hub, Checkov, etc.), I can tailor the final check to what that tool expects. Below are the minimal steps to turn on artifact encryption for an AWS CodeBuild project using the AWS CLI. ### 1. Identify the project and KMS key Pick the project name and the KMS key you want to use (either an alias or key ARN): ```bash theme={null} PROJECT_NAME="my-codebuild-project" KMS_KEY_ARN="arn:aws:kms:us-east-1:111122223333:key/xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx" # or: KMS_KEY_ARN="alias/aws/s3" (or your own alias) ``` *** ### 2. Get the current project configuration ```bash theme={null} aws codebuild batch-get-projects \ --names "$PROJECT_NAME" \ --query 'projects[0]' \ --output json > project.json ``` This file will be used as a base for the update. *** ### 3. Edit `project.json` to enable artifact encryption Open `project.json` in an editor and construct an `update-project` payload.\ You must supply the full configuration blocks required by `update-project`, not just the changed fields. Create a new file `update-project.json` with content like: ```json theme={null} { "name": "my-codebuild-project", "description": "My project", "serviceRole": "arn:aws:iam::111122223333:role/codebuild-service-role", "artifacts": { "type": "S3", "location": "my-artifacts-bucket", "path": "codebuild-output", "packaging": "ZIP", "name": "build-artifact", "encryptionDisabled": false, "overrideArtifactName": false, "artifactIdentifier": "Artifact1", "encryptionKey": "arn:aws:kms:us-east-1:111122223333:key/xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx" }, "environment": { "type": "LINUX_CONTAINER", "image": "aws/codebuild/standard:7.0", "computeType": "BUILD_GENERAL1_SMALL", "environmentVariables": [], "privilegedMode": false }, "source": { "type": "GITHUB", "location": "https://github.com/org/repo", "buildspec": "buildspec.yml" }, "sourceVersion": "main", "timeoutInMinutes": 60, "queuedTimeoutInMinutes": 480, "cache": { "type": "NO_CACHE" }, "badgeEnabled": false, "logsConfig": { "cloudWatchLogs": { "status": "ENABLED", "groupName": "/aws/codebuild/my-codebuild-project", "streamName": "build" }, "s3Logs": { "status": "DISABLED" } } } ``` Key parts for encryption: * `"encryptionDisabled": false` * `"encryptionKey": "YOUR_KMS_KEY_ARN_OR_ALIAS"` Adjust all values (role, image, source, bucket, etc.) to match what you saw in `project.json`. If you previously had multiple artifacts (`secondaryArtifacts`), repeat the same properties for each artifact that should be encrypted. *** ### 4. Apply the update ```bash theme={null} aws codebuild update-project \ --cli-input-json file://update-project.json ``` *** ### 5. Verify configuration ```bash theme={null} aws codebuild batch-get-projects \ --names "$PROJECT_NAME" \ --query 'projects[0].artifacts.[encryptionDisabled,encryptionKey]' ``` You should see: * `encryptionDisabled` = `false` * `encryptionKey` = your KMS key ARN/alias To remediate “Artifact Encryption Should Be Enabled” for an AWS CodeBuild project using Python, you need to: 1. Have (or create) a KMS key. 2. Update the CodeBuild project’s `artifacts` (and any `secondaryArtifacts`) to: * `encryptionDisabled = False` (or omit it) * `encryptionKey = ` Below is a minimal, step‑by‑step guide with Python/boto3. *** ### 1. Prerequisites * `boto3` installed: ```bash theme={null} pip install boto3 ``` * AWS credentials configured (via `aws configure`, environment variables, or IAM role). *** ### 2. (Optional) Create a KMS Key in Python If you don’t already have a KMS key you want to use: ```python theme={null} import boto3 kms = boto3.client("kms") response = kms.create_key( Description="KMS key for CodeBuild artifact encryption", KeyUsage="ENCRYPT_DECRYPT", Origin="AWS_KMS" ) kms_key_id = response["KeyMetadata"]["KeyId"] print("KMS KeyId:", kms_key_id) # Optional: create alias for easier reference kms.create_alias( AliasName="alias/codebuild-artifacts", TargetKeyId=kms_key_id ) ``` You can then use either: * ARN of the key, or * `alias/codebuild-artifacts` as the encryption key value. *** ### 3. Update an Existing CodeBuild Project to Enable Artifact Encryption This script: * Gets the current project configuration. * Reuses all existing fields. * Updates `artifacts` to enable encryption and set a KMS key. * Does the same for any `secondaryArtifacts` if present. ```python theme={null} import boto3 import copy codebuild = boto3.client("codebuild") PROJECT_NAME = "your-codebuild-project-name" KMS_KEY_ARN_OR_ALIAS = "alias/codebuild-artifacts" # or full KMS key ARN # 1) Get current project config resp = codebuild.batch_get_projects(names=[PROJECT_NAME]) projects = resp.get("projects", []) if not projects: raise ValueError(f"Project {PROJECT_NAME} not found") project = projects[0] # 2) Build update payload: start from existing fields update_params = { "name": project["name"], "description": project.get("description"), "serviceRole": project["serviceRole"], "timeoutInMinutes": project.get("timeoutInMinutes"), "queuedTimeoutInMinutes": project.get("queuedTimeoutInMinutes"), "encryptionKey": project.get("encryptionKey"), "tags": project.get("tags"), "badgeEnabled": project.get("badge", {}).get("badgeEnabled"), "logsConfig": project.get("logsConfig"), "fileSystemLocations": project.get("fileSystemLocations"), "buildBatchConfig": project.get("buildBatchConfig"), "concurrentBuildLimit": project.get("concurrentBuildLimit"), "cache": project.get("cache"), "environment": project.get("environment"), "source": project.get("source"), "vpcConfig": project.get("vpcConfig"), "secondarySources": project.get("secondarySources"), "secondarySourceVersions": project.get("secondarySourceVersions"), } # Remove None values (CodeBuild API doesn’t like explicit None) update_params = {k: v for k, v in update_params.items() if v is not None} # 3) Update primary artifacts artifacts = copy.deepcopy(project["artifacts"]) # For S3 or other external outputs, force encryption via KMS key artifacts["encryptionDisabled"] = False artifacts["encryptionKey"] = KMS_KEY_ARN_OR_ALIAS update_params["artifacts"] = artifacts # 4) Update any secondaryArtifacts if present secondary_artifacts = project.get("secondaryArtifacts", []) if secondary_artifacts: new_secondary = [] for a in secondary_artifacts: a = copy.deepcopy(a) a["encryptionDisabled"] = False a["encryptionKey"] = KMS_KEY_ARN_OR_ALIAS new_secondary.append(a) update_params["secondaryArtifacts"] = new_secondary # 5) Call update_project result = codebuild.update_project(**update_params) print("Updated project:", result["project"]["name"]) print("Artifact encryption key:", result["project"]["artifacts"].get("encryptionKey")) ``` *** ### 4. Notes / Checks * Ensure the CodeBuild service role has permission to use the KMS key: * KMS key policy should allow `codebuild.amazonaws.com` or the specific role ARN `kms:Encrypt`, `kms:Decrypt`, `kms:GenerateDataKey*`, `kms:DescribeKey`. * Verify encryption is enabled: * In the console: CodeBuild → Project → Artifacts → check KMS key configured. * Or via `batch_get_projects` and inspect `artifacts["encryptionKey"]` and `artifacts["encryptionDisabled"]`. This will remediate the “Artifact Encryption Should Be Enabled” finding programmatically for the project. ```hcl theme={null} resource "aws_codebuild_project" "THIS_PROJECT" { name = "CODEBUILD_PROJECT_NAME" # replace with your project name # ... other required arguments like service_role, environment, source, etc. artifacts { type = "S3" # or the type you actually use location = "S3_BUCKET_NAME" # replace with your S3 bucket encryption_disabled = false # ensure artifact encryption is ENABLED # ... any other existing artifact settings (path, packaging, etc.) } # If you use secondary artifacts, each must also have encryption_disabled = false secondary_artifacts { artifact_identifier = "SECONDARY_ARTIFACT_ID" # replace with your identifier type = "S3" location = "SECONDARY_S3_BUCKET" encryption_disabled = false # ... other existing secondary artifact settings } } ``` This matches the CLI fix by ensuring `encryption_disabled` is set to `false` on the primary `artifacts` block (and any `secondary_artifacts` blocks) in Terraform instead of via `aws codebuild update-project`. This change is in-place and does not force replacement of the CodeBuild project. For verification, `terraform plan` should show the `aws_codebuild_project` update changing `artifacts[*].encryption_disabled` (and any `secondary_artifacts[*].encryption_disabled`) from `true` (or omitted) to `false`.