Down below is my original query to check non_compliance
for codebuild-project-s3-logs-encrypted
It returning 0 results. Well, I observed for some buckets, key s3Logs
only not there, so that would be default, non_compliant
. same with encryptionDisabled
key.
SELECT
resourceId,
accountId,
resourceType,
configuration.logsConfig.s3Logs.encryptionDisabled,
configuration.encryptionKey,
tags
WHERE
resourceType = 'AWS::CodeBuild::Project'
AND configuration.logsConfig.s3Logs.encryptionDisabled = 'true'