​
More Info:

This rule ensures that logging is enabled for the environment of an AWS CodeBuild project by checking if at least one log option is enabled. Logging provides valuable insights into build execution, errors, and debugging information. Failing to enable logging can hinder troubleshooting efforts and impact the visibility of build activities.

​
Risk Level

Medium

​
Address

Security

​
Compliance Standards

CBP

​
Remediation

​
Using Console

To remediate the misconfiguration of logging not being enabled in an AWS CodeBuild project environment, you can follow these steps using the AWS Management Console:

  1. Sign in to the AWS Management Console: Go to https://aws.amazon.com/ and sign in to your AWS account.

  2. Navigate to CodeBuild: In the AWS Management Console, search for “CodeBuild” in the services search bar and click on “CodeBuild” to open the CodeBuild dashboard.

  3. Select the Project: Locate and select the CodeBuild project for which you want to enable logging.

  4. Edit Project Settings: Click on the project name to open the project settings.

  5. Enable CloudWatch Logs: In the project settings, scroll down to the “Logs” section.

  6. Enable CloudWatch Logs: Toggle the switch to enable CloudWatch Logs for the project. This will ensure that build logs are stored in CloudWatch Logs for future reference and troubleshooting.

  7. Configure Log Group: You can optionally configure the log group name and stream name for the CloudWatch Logs. If you leave it blank, CodeBuild will create a default log group for the project.

  8. Save Changes: Click on the “Update Project” button to save the changes and enable logging for the CodeBuild project environment.

  9. Verify Logging: Trigger a build in the CodeBuild project to verify that logging is now enabled and logs are being sent to CloudWatch Logs.

By following these steps, you will successfully remediate the misconfiguration of logging not being enabled in the AWS CodeBuild project environment.

​
Using CLI

To remediate the misconfiguration of logging not being enabled for an AWS CodeBuild project environment, you can follow these steps using the AWS CLI:

Step 1: Get the current settings for the CodeBuild project environment:

aws codebuild batch-get-projects --names YOUR_PROJECT_NAME

Step 2: Update the CodeBuild project environment to enable logging:

aws codebuild update-project --name YOUR_PROJECT_NAME --environment "type=LINUX_CONTAINER,environmentVariables=[{name=CODEBUILD_LOG_CONFIG, value='{\"cloudwatch\": {\"status\":\"ENABLED\"}}'}]"

Replace YOUR_PROJECT_NAME with the actual name of your CodeBuild project.

Step 3: Verify that the logging configuration has been updated successfully:

aws codebuild batch-get-projects --names YOUR_PROJECT_NAME

After following these steps, the logging should be enabled for your AWS CodeBuild project environment.

​
Using Python

To remediate the misconfiguration of logging not being enabled for an AWS CodeBuild project environment using Python, you can follow these steps:

Step 1: Import the necessary Python libraries (boto3) to interact with AWS services.

import boto3

Step 2: Define the AWS region and the CodeBuild client.

region = 'your_aws_region'
codebuild_client = boto3.client('codebuild', region_name=region)

Step 3: Get the current settings of the CodeBuild project environment to check if logging is enabled.

project_name = 'your_codebuild_project_name'

response = codebuild_client.batch_get_projects(names=[project_name])

environment = response['projects'][0]['environment']

Step 4: Check if logging is already enabled. If not, update the project environment to enable logging.

if not environment.get('logsConfig'):
    environment['logsConfig'] = {
        'cloudWatchLogs': {
            'status': 'ENABLED'
        }
    }

    codebuild_client.update_project(
        name=project_name,
        environment=environment
    )

    print(f'Logging has been enabled for the CodeBuild project: {project_name}')
else:
    print(f'Logging is already enabled for the CodeBuild project: {project_name}')

Step 5: Run the Python script to remediate the misconfiguration by enabling logging for the specified AWS CodeBuild project environment.

Make sure to replace ‘your_aws_region’ and ‘your_codebuild_project_name’ with your actual AWS region and CodeBuild project name.

By following these steps and running the Python script, you can successfully remediate the misconfiguration of logging not being enabled for an AWS CodeBuild project environment.