Skip to main content

🛡️ AWS CloudTrail is not encrypted with KMS CMK🟢

Logic​

Similar Policies​

Similar Internal Rules​

RulePoliciesFlags
✉️ dec-x-d896d1721

Description​

Open File

Description​

AWS CloudTrail is a web service that records AWS API calls for an account and makes those logs available to users and resources in accordance with IAM policies. AWS Key Management Service (KMS) is a managed service that helps create and control the encryption keys used to encrypt account data, and uses Hardware Security Modules (HSMs) to protect the security of encryption keys. CloudTrail logs can be configured to leverage server side encryption (SSE) and KMS customer created master keys (CMK) to further protect CloudTrail logs. It is recommended that CloudTrail be configured to use SSE-KMS.

Rationale​

Configuring CloudTrail to use SSE-KMS provides additional confidentiality controls on log data as a given user must have S3 read permission on the corresponding log bucket and must be granted decrypt permission by the CMK policy.

Impact​

Customer created keys incur an additional cost. See https://aws.amazon.com/kms/pricing/ for more information.

Audit​

Perform the following to determine if CloudTrail is configured to use SSE-KMS:

... see more

Remediation​

Open File

Remediation​

Perform the following to configure CloudTrail to use SSE-KMS:

From Console​

  1. Sign in to the AWS Management Console and open the CloudTrail console at https://console.aws.amazon.com/cloudtrail.

  2. In the left navigation pane, choose Trails.

  3. Click on a Trail.

  4. Under the S3 section click on the edit button (pencil icon).

  5. Click Advanced.

  6. Select an existing CMK from the KMS key Id drop-down menu.

  • Note: Ensure the CMK is located in the same region as the S3 bucket.

  • Note: You will need to apply a KMS Key policy on the selected CMK in order for CloudTrail as a service to encrypt and decrypt log files using the CMK provided. Steps are provided here for editing the selected CMK Key policy.

  1. Click Save.
  2. You will see a notification message stating that you need to have decrypt permissions on the specified KMS key to decrypt log files.
  3. Click Yes.

From Command Line​

Run the following command to specify a KMS key ID to use with a trail:

... see more

policy.yaml​

Open File

Linked Framework Sections​

SectionSub SectionsInternal RulesPoliciesFlagsCompliance
💼 AWS Foundational Security Best Practices v1.0.0 → 💼 [CloudTrail.2] CloudTrail should have encryption at-rest enabled1no data
💼 AWS Well-Architected → 💼 SEC08-BP02 Enforce encryption at rest17no data
💼 CIS AWS v1.2.0 → 💼 2.7 Ensure CloudTrail logs are encrypted at rest using KMS CMKs1no data
💼 CIS AWS v1.3.0 → 💼 3.7 Ensure CloudTrail logs are encrypted at rest using KMS CMKs1no data
💼 CIS AWS v1.4.0 → 💼 3.7 Ensure CloudTrail logs are encrypted at rest using KMS CMKs1no data
💼 CIS AWS v1.5.0 → 💼 3.7 Ensure CloudTrail logs are encrypted at rest using KMS CMKs - Level 2 (Automated)1no data
💼 CIS AWS v2.0.0 → 💼 3.7 Ensure CloudTrail logs are encrypted at rest using KMS CMKs - Level 2 (Automated)1no data
💼 CIS AWS v3.0.0 → 💼 3.5 Ensure CloudTrail logs are encrypted at rest using KMS CMKs - Level 2 (Automated)1no data
💼 CIS AWS v4.0.0 → 💼 3.5 Ensure CloudTrail logs are encrypted at rest using KMS CMKs (Automated)1no data
💼 CIS AWS v4.0.1 → 💼 3.5 Ensure CloudTrail logs are encrypted at rest using KMS CMKs (Automated)1no data
💼 CIS AWS v5.0.0 → 💼 3.5 Ensure CloudTrail logs are encrypted at rest using KMS CMKs (Automated)1no data
💼 CIS AWS v6.0.0 → 💼 4.5 Ensure CloudTrail logs are encrypted at rest using KMS CMKs (Automated)1no data
💼 Cloudaware Framework → 💼 Data Encryption57no data
💼 FedRAMP High Security Controls → 💼 AU-9 Protection of Audit Information (L)(M)(H)3812no data
💼 FedRAMP High Security Controls → 💼 CM-3(6) Cryptography Management (H)13no data
💼 FedRAMP High Security Controls → 💼 SC-7(10) Prevent Exfiltration (H)13no data
💼 FedRAMP High Security Controls → 💼 SC-13 Cryptographic Protection (L)(M)(H)1634no data
💼 FedRAMP High Security Controls → 💼 SC-28 Protection of Information at Rest (L)(M)(H)1732no data
💼 FedRAMP High Security Controls → 💼 SC-28(1) Cryptographic Protection (L)(M)(H)521no data
💼 FedRAMP Low Security Controls → 💼 AU-9 Protection of Audit Information (L)(M)(H)11no data
💼 FedRAMP Low Security Controls → 💼 SC-13 Cryptographic Protection (L)(M)(H)34no data
💼 FedRAMP Low Security Controls → 💼 SC-28 Protection of Information at Rest (L)(M)(H)132no data
💼 FedRAMP Low Security Controls → 💼 SC-28(1) Cryptographic Protection (L)(M)(H)21no data
💼 FedRAMP Moderate Security Controls → 💼 AU-9 Protection of Audit Information (L)(M)(H)111no data
💼 FedRAMP Moderate Security Controls → 💼 SC-13 Cryptographic Protection (L)(M)(H)34no data
💼 FedRAMP Moderate Security Controls → 💼 SC-28 Protection of Information at Rest (L)(M)(H)132no data
💼 FedRAMP Moderate Security Controls → 💼 SC-28(1) Cryptographic Protection (L)(M)(H)21no data
💼 NIST CSF v2.0 → 💼 PR.DS-01: The confidentiality, integrity, and availability of data-at-rest are protected164no data
💼 NIST CSF v2.0 → 💼 PR.DS-02: The confidentiality, integrity, and availability of data-in-transit are protected140no data
💼 NIST CSF v2.0 → 💼 PR.DS-10: The confidentiality, integrity, and availability of data-in-use are protected156no data
💼 NIST SP 800-53 Revision 5 → 💼 AU-9 Protection of Audit Information726no data
💼 NIST SP 800-53 Revision 5 → 💼 CA-9(1) Internal System Connections _ Compliance Checks32no data
💼 NIST SP 800-53 Revision 5 → 💼 CM-3(6) Configuration Change Control _ Cryptography Management13no data
💼 NIST SP 800-53 Revision 5 → 💼 SC-7(10) Boundary Protection _ Prevent Exfiltration13no data
💼 NIST SP 800-53 Revision 5 → 💼 SC-13 Cryptographic Protection423no data
💼 NIST SP 800-53 Revision 5 → 💼 SC-28 Protection of Information at Rest31733no data
💼 NIST SP 800-53 Revision 5 → 💼 SC-28(1) Protection of Information at Rest _ Cryptographic Protection1021no data
💼 NIST SP 800-53 Revision 5 → 💼 SI-7(6) Software, Firmware, and Information Integrity _ Cryptographic Protection20no data
💼 PCI DSS v3.2.1 → 💼 10.5.2 Protect audit trail files from unauthorized modifications.14no data
💼 PCI DSS v4.0.1 → 💼 10.3.2 Audit log files are protected to prevent modifications by individuals.4no data
💼 PCI DSS v4.0 → 💼 10.3.2 Audit log files are protected to prevent modifications by individuals.24no data