CodeBuild S3 logs are not encrypted misconfiguration detected in code

Rule Details

Cortex AppSec Rule ID	APPSEC_AWS_311
Category - Subcategory	Storage - Encryption
Provider	AWS
Severity	HIGH
Framework	Terraform, Terraform Plan

Impact

This rule verifies that AWS CodeBuild S3 logs are encrypted. If not properly encrypted, these logs, which might contain sensitive information, can be exploited by attackers for malicious activities, posing a significant security risk.

How to Fix

Resource: aws_codebuild_project

• Arguments: logs_config.s3_logs.encryption_disabled

You need to ensure that the CodeBuild project is using an S3 bucket for logging that is configured with server-side encryption. In the below code sample, the encryption_disabled argument in the s3_logs block is set to false. [source,go]

resource "aws_codebuild_project" "example" { name = "test-project"

artifacts { type = "NO_ARTIFACTS" }

environment { compute_type = "BUILD_GENERAL1_SMALL" image = "aws/codebuild/standard:4.0" type = "LINUX_CONTAINER" }

logs_config { cloudwatch_logs { group_name = "log-group" stream_name = "log-stream" }

s3_logs { status = "ENABLED" location = "aws_s3_bucket.default.id/codebuild-logs"

• encryption_disabled = false } }

source { type = "GITHUB" location = "https://github.com/my-account/my-repo.git" }

tags = { Environment = "Test" } }