Control: 4 CodeBuild project environments should have a logging configuration
Description
This control checks whether a CodeBuild project environment has at least one log option, either to S3 or CloudWatch logs enabled. This control fails if a CodeBuild project environment does not have at least one log option enabled.
From a security perspective, logging is an important feature to enable for future forensics efforts in the case of any security incidents. Correlating anomalies in CodeBuild projects with threat detections can increase confidence in the accuracy of those threat detections.
Remediation
For more information on how to configure CodeBuild project log settings, see Create a build project (console) in the CodeBuild User Guide.
Usage
Run the control in your terminal:
powerpipe control run aws_compliance.control.foundational_security_codebuild_4Snapshot and share results via Turbot Pipes:
powerpipe loginpowerpipe control run aws_compliance.control.foundational_security_codebuild_4 --shareSQL
This control uses a named query:
codebuild_project_logging_enabled