CodeBuild project environments should have a logging configuration

How to fix it

• Affects another check: Turning on S3 logs brings the project into CodeBuild.3, which fails it if Disable S3 log encryption is selected.

In the console

CodeBuild → Build projects → the project → Edit → Logs

CloudWatch logs

Selected, or select S3 logs instead

S3 logs

Selected, with a Bucket and Path prefix, if the logs go to S3

With the AWS CLI

aws codebuild update-project --name <project-name> --logs-config 'cloudWatchLogs={status=ENABLED}' --region <region>

With Terraform

resource "aws_codebuild_project" "this" {
  name         = var.project_name
  service_role = var.service_role_arn

  artifacts {
    type = var.artifacts_type
  }

  source {
    type = var.source_type
  }

  environment {
    compute_type = var.compute_type
    image        = var.build_image
    type         = var.environment_type
  }

  logs_config {
    cloudwatch_logs {
      status = "ENABLED"
    }
  }
}