Check provider logo

CodeBuild project has CloudWatch Logs or S3 logging enabled

codebuild_project_logging_enabled

Severitymedium
Servicecodebuild
by Prowler
logging

CodeBuild projects are assessed for logging configuration to Amazon CloudWatch Logs or S3, identifying when at least one destination is enabled for build logs and events.

Risk

Absence of build logging creates blind spots for integrity and accountability. Attackers or misconfigurations can alter artifacts, exfiltrate data, or misuse credentials with little trace, hindering forensics and incident response. Missing telemetry impedes correlation with other alerts, risking source code and secret confidentiality.

Run this check with Prowler CLI

prowler aws --checks codebuild_project_logging_enabled

Run in Prowler Cloud

Recommendation

Enable a log destination for every project-CloudWatch Logs or S3 (preferably both). Enforce defense in depth: encrypt logs, set retention, and restrict access on a least-privilege basis. Centralize and monitor logs, alert on anomalies, and avoid sensitive data in output. Use immutable retention to preserve auditability.

Remediation

CLI

aws codebuild update-project --name <project-name> --logs-config "cloudWatchLogs={status=ENABLED}"

Native IaC
Terraform
Other
  1. In the AWS Console, go to CodeBuild > Build projects and open your project
  2. Under Logs, click Edit
  3. Check CloudWatch logs and save (or enable S3 logs instead)
  4. Confirm the project now shows logging enabled

Source Code

Resource Type

AwsCodeBuildProject

References