CodeBuild report group exports should be encrypted at rest

How to fix it

In the console

CodeBuild → Report groups → the report group → Edit → Additional configuration

Disable artifact encryption

Not selected: use the Default AWS managed key or a custom key

AWS KMS encryption key

For a custom key, the key's ARN

With the AWS CLI

• Overwrites existing settings: The command replaces the export configuration, and leaving out packaging means NONE, so add packaging=ZIP if the group zips its results.

aws codebuild update-report-group --arn <report-group-arn> --export-config 'exportConfigType=S3,s3Destination={bucket=<bucket-name>,path=<path>,encryptionKey=<kms-key-arn>,encryptionDisabled=false}' --region <region>

With Terraform

resource "aws_codebuild_report_group" "this" {
  name = var.report_group_name
  type = var.report_group_type

  export_config {
    type = "S3"

    s3_destination {
      bucket              = var.bucket_name
      encryption_key      = var.kms_key_arn
      encryption_disabled = false
    }
  }
}