> ## Documentation Index > Fetch the complete documentation index at: https://cloudanix.com/docs/llms.txt > Use this file to discover all available pages before exploring further. # Artifact Encryption Should Be Enabled CodeBuild Project ### More Info: This rule verifies whether encryption is enabled for all artifacts of an AWS CodeBuild project. Enabling encryption for artifacts helps protect sensitive data stored in the artifacts from unauthorized access or tampering. It ensures that artifacts are encrypted while stored, providing an additional layer of security. ### Risk Level Medium ### Address Security ### Compliance Standards * APRA CPS 234 (Australia) * BSI C5 (Germany) * Brazil LGPD * CCPA / CPRA (California) * CIS Critical Security Controls v8 * CMMC 2.0 * CSA Cloud Controls Matrix v4 * Cloudanix Best Practice * DPDPA * Digital Operational Resilience Act (EU) * ISO/IEC 27017 * ISO/IEC 27018 * ISO/IEC 27701 * KSA PDPL * MAS Technology Risk Management (Singapore) * MITRE ATT\&CK (Cloud) * NIS2 Directive * NIST SP 800-171 * NYDFS 23 NYCRR 500 * Reserve Bank of India (RBI) Cyber Security Framework * SWIFT Customer Security Controls Framework * Sarbanes-Oxley IT General Controls * Securities and Exchange Board of India (SEBI) - Cloud Security Adoption Framework * UK NCSC Cyber Assessment Framework ### Triage and Remediation ### Remediation Here’s how to enable artifact encryption for an AWS CodeBuild project using the AWS Management Console: *** ### 1. Identify the CodeBuild project 1. Sign in to the **AWS Management Console**. 2. Go to **CodeBuild**:\ Services → **CodeBuild**. 3. In the left menu, click **Build projects**. 4. Click the name of the project you need to fix. *** ### 2. Edit the project 1. On the project details page, click **Edit** in the upper-right corner. 2. Scroll down to the **Artifacts** section. *** ### 3. Ensure artifact type and location are set 1. Under **Artifacts**, make sure: * **Type** is **Amazon S3** (or another artifact type that supports encryption). * **Bucket name** is set to the S3 bucket where artifacts are stored. If you don’t have a bucket yet, create one in **S3** first, then return and select it. *** ### 4. Configure encryption In the **Artifacts** section: 1. Find **Encryption key** (sometimes labeled **KMS key** or similar). 2. Choose one of: * **Default AWS managed key for S3**:\ Select `aws/s3` or the default option shown, *or* * **Customer managed key (CMK)**: * From the dropdown, select your KMS key ARN, * or paste the full key ARN from **AWS KMS**. Make sure the KMS key policy allows CodeBuild and the IAM role used by the project to use the key (`kms:Encrypt`, `kms:Decrypt`, `kms:GenerateDataKey` at minimum for the project role). *** ### 5. Save changes 1. Scroll to the bottom of the page. 2. Click **Update artifacts** (if present) and/or **Update** / **Save** to apply the changes to the project. *** ### 6. (Optional) Verify in S3 1. Go to **S3** → select the bucket used for artifacts. 2. Open **Properties** → **Default encryption**: * Ensure it is set to **AWS KMS** (or at least SSE-S3), and * Confirm it matches your expected encryption settings. Note: The CodeBuild artifact encryption control is generally satisfied when an encryption key is configured for artifacts (and the bucket is not left unencrypted). *** If you share the exact scanner/tool (e.g., Security Hub, Checkov, etc.), I can tailor the final check to what that tool expects. Below are the minimal steps to turn on artifact encryption for an AWS CodeBuild project using the AWS CLI. ### 1. Identify the project and KMS key Pick the project name and the KMS key you want to use (either an alias or key ARN): ```bash theme={null} PROJECT_NAME="my-codebuild-project" KMS_KEY_ARN="arn:aws:kms:us-east-1:111122223333:key/xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx" # or: KMS_KEY_ARN="alias/aws/s3" (or your own alias) ``` *** ### 2. Get the current project configuration ```bash theme={null} aws codebuild batch-get-projects \ --names "$PROJECT_NAME" \ --query 'projects[0]' \ --output json > project.json ``` This file will be used as a base for the update. *** ### 3. Edit `project.json` to enable artifact encryption Open `project.json` in an editor and construct an `update-project` payload.\ You must supply the full configuration blocks required by `update-project`, not just the changed fields. Create a new file `update-project.json` with content like: ```json theme={null} { "name": "my-codebuild-project", "description": "My project", "serviceRole": "arn:aws:iam::111122223333:role/codebuild-service-role", "artifacts": { "type": "S3", "location": "my-artifacts-bucket", "path": "codebuild-output", "packaging": "ZIP", "name": "build-artifact", "encryptionDisabled": false, "overrideArtifactName": false, "artifactIdentifier": "Artifact1", "encryptionKey": "arn:aws:kms:us-east-1:111122223333:key/xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx" }, "environment": { "type": "LINUX_CONTAINER", "image": "aws/codebuild/standard:7.0", "computeType": "BUILD_GENERAL1_SMALL", "environmentVariables": [], "privilegedMode": false }, "source": { "type": "GITHUB", "location": "https://github.com/org/repo", "buildspec": "buildspec.yml" }, "sourceVersion": "main", "timeoutInMinutes": 60, "queuedTimeoutInMinutes": 480, "cache": { "type": "NO_CACHE" }, "badgeEnabled": false, "logsConfig": { "cloudWatchLogs": { "status": "ENABLED", "groupName": "/aws/codebuild/my-codebuild-project", "streamName": "build" }, "s3Logs": { "status": "DISABLED" } } } ``` Key parts for encryption: * `"encryptionDisabled": false` * `"encryptionKey": "YOUR_KMS_KEY_ARN_OR_ALIAS"` Adjust all values (role, image, source, bucket, etc.) to match what you saw in `project.json`. If you previously had multiple artifacts (`secondaryArtifacts`), repeat the same properties for each artifact that should be encrypted. *** ### 4. Apply the update ```bash theme={null} aws codebuild update-project \ --cli-input-json file://update-project.json ``` *** ### 5. Verify configuration ```bash theme={null} aws codebuild batch-get-projects \ --names "$PROJECT_NAME" \ --query 'projects[0].artifacts.[encryptionDisabled,encryptionKey]' ``` You should see: * `encryptionDisabled` = `false` * `encryptionKey` = your KMS key ARN/alias To remediate “Artifact Encryption Should Be Enabled” for an AWS CodeBuild project using Python, you need to: 1. Have (or create) a KMS key. 2. Update the CodeBuild project’s `artifacts` (and any `secondaryArtifacts`) to: * `encryptionDisabled = False` (or omit it) * `encryptionKey = ` Below is a minimal, step‑by‑step guide with Python/boto3. *** ### 1. Prerequisites * `boto3` installed: ```bash theme={null} pip install boto3 ``` * AWS credentials configured (via `aws configure`, environment variables, or IAM role). *** ### 2. (Optional) Create a KMS Key in Python If you don’t already have a KMS key you want to use: ```python theme={null} import boto3 kms = boto3.client("kms") response = kms.create_key( Description="KMS key for CodeBuild artifact encryption", KeyUsage="ENCRYPT_DECRYPT", Origin="AWS_KMS" ) kms_key_id = response["KeyMetadata"]["KeyId"] print("KMS KeyId:", kms_key_id) # Optional: create alias for easier reference kms.create_alias( AliasName="alias/codebuild-artifacts", TargetKeyId=kms_key_id ) ``` You can then use either: * ARN of the key, or * `alias/codebuild-artifacts` as the encryption key value. *** ### 3. Update an Existing CodeBuild Project to Enable Artifact Encryption This script: * Gets the current project configuration. * Reuses all existing fields. * Updates `artifacts` to enable encryption and set a KMS key. * Does the same for any `secondaryArtifacts` if present. ```python theme={null} import boto3 import copy codebuild = boto3.client("codebuild") PROJECT_NAME = "your-codebuild-project-name" KMS_KEY_ARN_OR_ALIAS = "alias/codebuild-artifacts" # or full KMS key ARN # 1) Get current project config resp = codebuild.batch_get_projects(names=[PROJECT_NAME]) projects = resp.get("projects", []) if not projects: raise ValueError(f"Project {PROJECT_NAME} not found") project = projects[0] # 2) Build update payload: start from existing fields update_params = { "name": project["name"], "description": project.get("description"), "serviceRole": project["serviceRole"], "timeoutInMinutes": project.get("timeoutInMinutes"), "queuedTimeoutInMinutes": project.get("queuedTimeoutInMinutes"), "encryptionKey": project.get("encryptionKey"), "tags": project.get("tags"), "badgeEnabled": project.get("badge", {}).get("badgeEnabled"), "logsConfig": project.get("logsConfig"), "fileSystemLocations": project.get("fileSystemLocations"), "buildBatchConfig": project.get("buildBatchConfig"), "concurrentBuildLimit": project.get("concurrentBuildLimit"), "cache": project.get("cache"), "environment": project.get("environment"), "source": project.get("source"), "vpcConfig": project.get("vpcConfig"), "secondarySources": project.get("secondarySources"), "secondarySourceVersions": project.get("secondarySourceVersions"), } # Remove None values (CodeBuild API doesn’t like explicit None) update_params = {k: v for k, v in update_params.items() if v is not None} # 3) Update primary artifacts artifacts = copy.deepcopy(project["artifacts"]) # For S3 or other external outputs, force encryption via KMS key artifacts["encryptionDisabled"] = False artifacts["encryptionKey"] = KMS_KEY_ARN_OR_ALIAS update_params["artifacts"] = artifacts # 4) Update any secondaryArtifacts if present secondary_artifacts = project.get("secondaryArtifacts", []) if secondary_artifacts: new_secondary = [] for a in secondary_artifacts: a = copy.deepcopy(a) a["encryptionDisabled"] = False a["encryptionKey"] = KMS_KEY_ARN_OR_ALIAS new_secondary.append(a) update_params["secondaryArtifacts"] = new_secondary # 5) Call update_project result = codebuild.update_project(**update_params) print("Updated project:", result["project"]["name"]) print("Artifact encryption key:", result["project"]["artifacts"].get("encryptionKey")) ``` *** ### 4. Notes / Checks * Ensure the CodeBuild service role has permission to use the KMS key: * KMS key policy should allow `codebuild.amazonaws.com` or the specific role ARN `kms:Encrypt`, `kms:Decrypt`, `kms:GenerateDataKey*`, `kms:DescribeKey`. * Verify encryption is enabled: * In the console: CodeBuild → Project → Artifacts → check KMS key configured. * Or via `batch_get_projects` and inspect `artifacts["encryptionKey"]` and `artifacts["encryptionDisabled"]`. This will remediate the “Artifact Encryption Should Be Enabled” finding programmatically for the project. ```hcl theme={null} resource "aws_codebuild_project" "THIS_PROJECT" { name = "CODEBUILD_PROJECT_NAME" # replace with your project name # ... other required arguments like service_role, environment, source, etc. artifacts { type = "S3" # or the type you actually use location = "S3_BUCKET_NAME" # replace with your S3 bucket encryption_disabled = false # ensure artifact encryption is ENABLED # ... any other existing artifact settings (path, packaging, etc.) } # If you use secondary artifacts, each must also have encryption_disabled = false secondary_artifacts { artifact_identifier = "SECONDARY_ARTIFACT_ID" # replace with your identifier type = "S3" location = "SECONDARY_S3_BUCKET" encryption_disabled = false # ... other existing secondary artifact settings } } ``` This matches the CLI fix by ensuring `encryption_disabled` is set to `false` on the primary `artifacts` block (and any `secondary_artifacts` blocks) in Terraform instead of via `aws codebuild update-project`. This change is in-place and does not force replacement of the CodeBuild project. For verification, `terraform plan` should show the `aws_codebuild_project` update changing `artifacts[*].encryption_disabled` (and any `secondary_artifacts[*].encryption_disabled`) from `true` (or omitted) to `false`. ### Additional Reading: * [https://docs.aws.amazon.com/config/latest/developerguide/codebuild-project-artifact-encryption.html](https://docs.aws.amazon.com/config/latest/developerguide/codebuild-project-artifact-encryption.html)