Rule: CodeBuild Project Environments Logging Configuration
This rule ensures CodeBuild project environments have a proper logging configuration.
| Rule | CodeBuild project environments should have a logging configuration |
| Framework | AWS Foundational Security Best Practices |
| Severity | ✔ Medium |
Rule Description
The CodeBuild project environments should have a logging configuration in place to adhere to the AWS Foundational Security Best Practices. Logging is crucial for monitoring and analyzing system activities, identifying security incidents, and troubleshooting issues in the environment.
Troubleshooting Steps
- 1.Review the CodeBuild project environment's logging configuration to ensure it is set up properly.
- 2.If the logging is not configured, follow the remediation steps to enable logging.
Remediation Steps
Enable Logging for CodeBuild Project Environment
- 1.Open the AWS Management Console and navigate to the CodeBuild service.
- 2.Select the CodeBuild project environment for which you want to enable logging.
- 3.Click on the "Edit" button at the top-right corner of the environment details page.
- 4.Scroll down to the "Logs" section.
- 5.Click on the "Enable CloudWatch Logs" checkbox to enable logging for the CodeBuild project.
- 6.Optionally, you can specify a log group name and log stream name.
- Log Group Name: Enter a name for the log group where the CodeBuild logs will be stored. If left blank, a default name will be generated.
- Log Stream Name: Enter a name for the log stream that will hold the CodeBuild logs. If left blank, a default name will be generated.
- 7.Click on the "Save" button to enable the logging configuration for the CodeBuild project.
CLI Command
If you prefer to use the AWS Command Line Interface (CLI) for enabling logging, you can use the following command:
aws codebuild update-project --name <project-name> --logs-config cloudWatchLogsEnabled=true [--logs-config cloudWatchLogsGroupName=<group-name> --logs-config cloudWatchLogsStreamName=<stream-name>]
Replace
<project-name><group-name><stream-name>Note: Make sure you have the necessary permissions to modify the CodeBuild project and access the AWS CLI.
By following these steps, you will enable logging for the CodeBuild project environment as recommended by the AWS Foundational Security Best Practices. This will help you to monitor and protect your environment effectively.