HIGH
Source
Trivy
ID
AWS-0018

CodeBuild Project artifacts encryption should not be disabled

All artifacts produced by your CodeBuild project pipeline should always be encrypted

Impact

Follow the appropriate remediation steps below to resolve the issue.

Enable encryption for CodeBuild project artifacts

1
2
3
4
5
6
7
8
Resources:
  GoodProject:
    Type: AWS::CodeBuild::Project
    Properties:
      Artifacts:
        EncryptionDisabled: false
      SecondaryArtifacts:
        - EncryptionDisabled: false

Enable encryption for CodeBuild project artifacts

1
2
3
resource "aws_codebuild_project" "good_example" {
  artifacts {}
}
1
2
3
4
5
resource "aws_codebuild_project" "good_example" {
  artifacts {
    encryption_disabled = false
  }
}
1
2
3
4
5
resource "aws_codebuild_project" "codebuild" {
  secondary_artifacts {
    encryption_disabled = false
  }
}