CodeBuild Project is not encrypted

ID

aws_codebuild_not_encrypted

Severity

high

Vendor

AWS

Resource

Encryption

Tags

reachable

Description

CodeBuild Project is not encrypted. Encryption is an important part of CodeBuild security. Some encryption, such as for data in-transit, is provided by default and does not require you to do anything. Other encryption, such as for data at-rest, you can configure when you create your project or build.

To fix it you must configure encryption_key property.

Learn more about this topic at AWS CodeBuild encryption.

Examples

---
- name: Example playbook
  hosts: localhost
  tasks:
    - community.aws.codebuild_project:
        name: my_project
        description: My nice little project
        service_role: "arn:aws:iam::123123:role/service-role/code-build-service-role"
        source:
            # Possible values: BITBUCKET, CODECOMMIT, CODEPIPELINE, GITHUB, S3
            type: CODEPIPELINE
            buildspec: ''
        artifacts:
            namespaceType: NONE
            packaging: NONE
            type: CODEPIPELINE
            name: my_project
        environment:
            computeType: BUILD_GENERAL1_SMALL
            privilegedMode: "true"
            image: "aws/codebuild/docker:17.09.0"
            type: LINUX_CONTAINER
            environmentVariables:
                - { name: 'PROFILE', value: 'staging' }
        region: us-east-1
        state: present

Mitigation / Fix

---
- name: Example playbook
  hosts: localhost
  tasks:
    - community.aws.codebuild_project:
        name: my_project
        description: My nice little project
        service_role: "arn:aws:iam::123123:role/service-role/code-build-service-role"
        source:
            # Possible values: BITBUCKET, CODECOMMIT, CODEPIPELINE, GITHUB, S3
            type: CODEPIPELINE
            buildspec: ''
        artifacts:
            namespaceType: NONE
            packaging: NONE
            type: CODEPIPELINE
            name: my_project
        environment:
            computeType: BUILD_GENERAL1_SMALL
            privilegedMode: "true"
            image: "aws/codebuild/docker:17.09.0"
            type: LINUX_CONTAINER
            environmentVariables:
                - { name: 'PROFILE', value: 'staging' }
        encryption_key: "arn:aws:kms:us-east-1:123123:alias/aws/s3"
        region: us-east-1
        state: present