Ensure CloudTrail logs are encrypted at rest using KMS CMKs

AWS CloudTrail is a web service that records AWS API calls for an account and makes those logs available to users and resources in accordance with IAM policies. AWS Key Management Service (KMS) is a managed service that helps create and control the encryption keys used to encrypt account data, and uses Hardware Security Modules (HSMs) to protect the security of encryption keys. CloudTrail logs can be configured to leverage server side encryption (SSE) and KMS customer created master keys (CMK) to further protect CloudTrail logs. It is recommended that CloudTrail be configured to use SSE-KMS.

Suggest Edits

Risk Level: High
Cloud Entity: CloudTrail
CloudGuard Rule ID: D9.TF.AWS.CRY.02
Covered by Spectral: No
Category: Management Tools

GSL LOGIC

aws_cloudtrail should have kms_key_id

REMEDIATION

Run aws cloudtrail describe-trails 2. For each trail listed, SSE-KMS is enabled if the trail has a KmsKeyId property defined.

CloudTrail

AWS CloudTrail is a service that enables governance, compliance, operational auditing, and risk auditing of your AWS account. With CloudTrail, you can log, continuously monitor, and retain account activity related to actions across your AWS infrastructure. CloudTrail provides event history of your AWS account activity, including actions taken through the AWS Management Console, AWS SDKs, command line tools, and other AWS services. This event history simplifies security analysis, resource change tracking, and troubleshooting.

Compliance Frameworks

Terraform AWS CIS Foundations

Updated over 1 year ago