CodeBuild S3 logs should be encrypted

How to fix it

In the console

CodeBuild → Build projects → the project → Edit → Logs → S3 logs

Disable S3 log encryption

Not selected

With the AWS CLI

• Overwrites existing settings: The command sends logsConfig as one structure, so add the project's current cloudWatchLogs settings from batch-get-projects to it as well.

aws codebuild update-project --name <project-name> --logs-config 's3Logs={status=ENABLED,location=<bucket-name>/<prefix>,encryptionDisabled=false}' --region <region>

With Terraform

resource "aws_codebuild_project" "this" {
  name         = var.project_name
  service_role = var.service_role_arn

  artifacts {
    type = var.artifacts_type
  }

  source {
    type = var.source_type
  }

  environment {
    compute_type = var.compute_type
    image        = var.build_image
    type         = var.environment_type
  }

  logs_config {
    s3_logs {
      status              = "ENABLED"
      location            = var.s3_logs_location
      encryption_disabled = false
    }
  }
}