Free Assessment

AWS_KMS_1

Ensure CloudTrail logs are encrypted at rest using KMS CMKs

Description

AWS CloudTrail is a web service that records AWS API calls for an account and makes those logs available to users and resources in accordance with IAM policies. AWS Key Management Service (KMS) is a managed service that helps create and control the encryption keys used to encrypt account data, and uses Hardware Security Modules (HSMs) to protect the security of encryption keys. CloudTrail logs can be configured to leverage server side encryption (SSE) and KMS customer created master keys (CMK) to further protect CloudTrail logs. It is recommended that CloudTrail be configured to use SSE-KMS.

Remediation

Perform the following to configure CloudTrail to use SSE-KMS:

Via the Management Console

  1. Sign in to the AWS Management Console and open the CloudTrail console
    at https://console.aws.amazon.com/cloudtrail
  2. In the left navigation pane, choose Trails .
  3. Click on a Trail
  4. Under the S3 section click on the edit button (pencil icon)
  5. Click Advanced
  6. Select an existing CMK from the KMS key Id drop-down menu
    1. Note: Ensure the CMK is located in the same region as the S3 bucket
    2. Note: You will need to apply a KMS Key policy on the selected CMK in order for CloudTrail as a service to encrypt and decrypt log files using the CMK provided. Steps are provided here for editing the selected CMK Key policy
  7. Click Save
  8. You will see a notification message stating that you need to have decrypt
    permissions on the specified KMS key to decrypt log files.
  9. Click Yes

Via CLI

aws cloudtrail update-trail –name &lt

Service

KMS

Severity

High

Compliance

Mapping

Want to Know More?

Learn how our partners are managing their cloud security and compliance with Cloudlytics.

I hereby accept the GDPR and Privacy Policy, by subscribing to the newsletters.

Cloudlytics

Solutions

Resources

Company

Legal

Facebook Twitter Linkedin Youtube
Start Free Trial
Login

CLOSE

We are now live on AWS Marketplace.
The integrated view of your cloud infrastructure is now easier than ever!

Learn More