CodeBuild project encryption is disabled misconfiguration detected in code

Rule Details

Cortex AppSec Rule ID	APPSEC_AWS_78
Category - Subcategory	Storage - Encryption
Provider	AWS
Severity	MEDIUM
Framework	CloudFormation, Serverless, Terraform, Terraform Plan

Impact

AWS CodeBuild is a fully managed build service in the cloud, that compiles source code, runs unit tests, and produces artifacts that are ready to deploy.

We recommend enabling CodeBuild project encryption to protect sensitive information such as passwords and other credentials required to access external services during the build process, from security breaches.

NOTE: Build artifacts, such as a cache, logs, exported raw test report data files, and build results are encrypted by default using CMKs for Amazon S3 that are managed by the AWS Key Management Service.

If you do not want to use these CMKs, you must create and configure a customer-managed CMK.

How to Fix

[source,go]

Resources: CodeBuildProject: Type: AWS::CodeBuild::Project Properties: ... Artifacts: ... Type: S3

• EncryptionDisabled: True
• EncryptionDisabled: False

---