diff --git a/buildspec.yml b/buildspec.yml
index e31d4f845..cdda2a550 100644
--- a/buildspec.yml
+++ b/buildspec.yml
@@ -57,3 +57,6 @@ batch:
       buildspec: codebuild/py38/awses_2.0.0.yml
     - identifier: py38_awses_latest
       buildspec: codebuild/py38/awses_latest.yml
+
+    - identifier: code_coverage
+      buildspec: codebuild/coverage/coverage.yml
diff --git a/codebuild/coverage/coverage.yml b/codebuild/coverage/coverage.yml
new file mode 100644
index 000000000..f82a3a982
--- /dev/null
+++ b/codebuild/coverage/coverage.yml
@@ -0,0 +1,14 @@
+version: 0.2
+
+env:
+  variables:
+    TOXENV: "coverage"
+
+phases:
+  install:
+    runtime-versions:
+      python: latest
+  build:
+    commands:
+      - pip install tox
+      - tox
diff --git a/setup.cfg b/setup.cfg
index 038fc5924..1f83b2654 100644
--- a/setup.cfg
+++ b/setup.cfg
@@ -9,6 +9,7 @@ branch = True
 
 [coverage:report]
 show_missing = True
+fail_under = 95
 
 [tool:pytest]
 log_level = DEBUG
diff --git a/tox.ini b/tox.ini
index f0908d5d4..40f50bd04 100644
--- a/tox.ini
+++ b/tox.ini
@@ -35,8 +35,12 @@ envlist =
 # test-release :: Builds dist files and uploads to testpypi pypirc profile.
 # release :: Builds dist files and uploads to pypi pypirc profile.
 
+# Reporting environments:
+#
+# coverage :: Runs code coverage, failing the build if coverage is below the configured threshold
+
 [testenv:base-command]
-commands = pytest --basetemp={envtmpdir} -l --cov aws_encryption_sdk {posargs}
+commands = pytest --basetemp={envtmpdir} -l {posargs}
 
 [testenv]
 passenv =
@@ -62,6 +66,10 @@ commands =
     all: {[testenv:base-command]commands} test/ examples/test/
     manual: {[testenv:base-command]commands}
 
+# Run code coverage on the unit tests
+[testenv:coverage]
+commands = {[testenv:base-command]commands} --cov aws_encryption_sdk test/ -m local
+
 # Verify that local tests work without environment variables present
 [testenv:nocmk]
 basepython = python3