CodeBuild report group exports should be encrypted at rest¶

This control checks whether the test results of an AWS CodeBuild report group that are exported to an Amazon Simple Storage Service (Amazon S3) bucket are encrypted at rest. The control fails if the report group export isn't encrypted at rest.

How to fix¶

Attribute export_config[0].s3_destination[0].encryption_disabled of aws_codebuild_report_group must be false.

Implementation options¶

Choose the option that matches how you manage Terraform. All options satisfy this control.

Option 1: Terraform AWS provider resources¶

If you manage resources directly, configure the relevant Terraform AWS provider resources to meet this control. See docs for the resources involved: aws_codebuild_report_group.

resource "aws_codebuild_report_group" "this" {
  name = "pofix-example-report-group"
  type = "TEST"

  export_config {
    s3_destination {
      bucket              = "example-bucket-abc123"
      encryption_disabled = false
      encryption_key      = "arn:aws:kms:us-east-1:123456789012:key/12345678-1234-1234-1234-123456789012"
    }
    type = "S3"
  }
}

Tool mappings¶

Use these identifiers to cross-reference this control across tools, reports, and evidence.

• Compliance.tf (CTF) Control: codebuild_report_group_export_encryption_at_rest_enabled

• AWS Config Managed Rule: CODEBUILD_REPORT_GROUP_ENCRYPTED_AT_REST

• Powerpipe Control: aws_compliance.control.codebuild_report_group_export_encryption_at_rest_enabled