feat(codebuild): make artifact encryption configurable (#3230)

Author: nmussy

packages/@aws-cdk/aws-codebuild/lib/artifacts.ts

@@ -113,6 +113,14 @@ export interface S3ArtifactsProps extends ArtifactsProps {
    * @default true - files will be archived
    */
   readonly packageZip?: boolean;
+
+  /**
+   * If this is false, build output will not be encrypted.
+   * This is useful if the artifact to publish a static website or sharing content with others
+   *
+   * @default true - output will be encrypted
+   */
+  readonly encryption?: boolean;
 }
 
 /**
@@ -136,6 +144,7 @@ class S3Artifacts extends Artifacts {
         namespaceType: this.props.includeBuildId === false ? 'NONE' : 'BUILD_ID',
         name: this.props.name,
         packaging: this.props.packageZip === false ? 'NONE' : 'ZIP',
+        encryptionDisabled: this.props.encryption === false ? true : undefined,
       }
     };
   }

packages/@aws-cdk/aws-codebuild/test/test.codebuild.ts

@@ -933,6 +933,36 @@ export = {
 
       test.done();
     },
+
+    'disabledEncryption is set'(test: Test) {
+      const stack = new cdk.Stack();
+      const bucket = new s3.Bucket(stack, 'MyBucket');
+      const project = new codebuild.Project(stack, 'MyProject', {
+        source: codebuild.Source.s3({
+          bucket,
+          path: 'some/path',
+        }),
+      });
+
+      project.addSecondaryArtifact(codebuild.Artifacts.s3({
+        bucket,
+        path: 'another/path',
+        name: 'name',
+        identifier: 'artifact1',
+        encryption: false,
+      }));
+
+      expect(stack).to(haveResourceLike('AWS::CodeBuild::Project', {
+        "SecondaryArtifacts": [
+          {
+            "ArtifactIdentifier": "artifact1",
+            "EncryptionDisabled": true,
+          },
+        ],
+      }));
+
+      test.done();
+    },
   },
 
   'artifacts': {