Skip to main content

🛡️ AWS CloudTrail is not encrypted with KMS CMK🟢

Logic​

Similar Policies​

Similar Internal Rules​

RulePoliciesFlags
✉️ dec-x-d896d1721

Description​

Open File

Description​

AWS CloudTrail is a web service that records AWS API calls for an account and makes those logs available to users and resources in accordance with IAM policies. AWS Key Management Service (KMS) is a managed service that helps create and control the encryption keys used to encrypt account data, and uses Hardware Security Modules (HSMs) to protect the security of encryption keys. CloudTrail logs can be configured to leverage server side encryption (SSE) and KMS customer created master keys (CMK) to further protect CloudTrail logs. It is recommended that CloudTrail be configured to use SSE-KMS.

Rationale​

Configuring CloudTrail to use SSE-KMS provides additional confidentiality controls on log data as a given user must have S3 read permission on the corresponding log bucket and must be granted decrypt permission by the CMK policy.

Impact​

Customer created keys incur an additional cost. See https://aws.amazon.com/kms/pricing/ for more information.

Audit​

To determine if CloudTrail is configured to use SSE-KMS, run the following command:

... see more

Remediation​

Open File

Remediation​

Perform the following to configure CloudTrail to use SSE-KMS:

From Console​

  1. Sign in to the AWS Management Console and open the CloudTrail console at https://console.aws.amazon.com/cloudtrail.

  2. In the left navigation pane, choose Trails.

  3. Click on a Trail.

  4. Under the S3 section click on the edit button (pencil icon).

  5. Click Advanced.

  6. Select an existing CMK from the KMS key Id drop-down menu.

    • Note: Ensure the CMK is located in the same region as the S3 bucket.
    • Note: You will need to apply a KMS Key policy on the selected CMK in order for CloudTrail as a service to encrypt and decrypt log files using the CMK provided. Steps are provided here for editing the selected CMK Key policy.

  7. Click Save.

  8. You will see a notification message stating that you need to have decrypt permissions on the specified KMS key to decrypt log files.

  9. Click Yes.

From Command Line​

... see more

policy.yaml​

Open File

Linked Framework Sections​

SectionSub SectionsInternal RulesPoliciesFlagsCompliance
💼 AWS Foundational Security Best Practices v1.0.0 → 💼 [CloudTrail.2] CloudTrail should have encryption at-rest enabled1no data
💼 AWS Well-Architected → 💼 SEC08-BP02 Enforce encryption at rest20no data
💼 CIS AWS v1.2.0 → 💼 2.7 Ensure CloudTrail logs are encrypted at rest using KMS CMKs1no data
💼 CIS AWS v1.3.0 → 💼 3.7 Ensure CloudTrail logs are encrypted at rest using KMS CMKs1no data
💼 CIS AWS v1.4.0 → 💼 3.7 Ensure CloudTrail logs are encrypted at rest using KMS CMKs1no data
💼 CIS AWS v1.5.0 → 💼 3.7 Ensure CloudTrail logs are encrypted at rest using KMS CMKs - Level 2 (Automated)1no data
💼 CIS AWS v2.0.0 → 💼 3.7 Ensure CloudTrail logs are encrypted at rest using KMS CMKs - Level 2 (Automated)1no data
💼 CIS AWS v3.0.0 → 💼 3.5 Ensure CloudTrail logs are encrypted at rest using KMS CMKs - Level 2 (Automated)1no data
💼 CIS AWS v4.0.0 → 💼 3.5 Ensure CloudTrail logs are encrypted at rest using KMS CMKs (Automated)1no data
💼 CIS AWS v4.0.1 → 💼 3.5 Ensure CloudTrail logs are encrypted at rest using KMS CMKs (Automated)1no data
💼 CIS AWS v5.0.0 → 💼 3.5 Ensure CloudTrail logs are encrypted at rest using KMS CMKs (Automated)1no data
💼 CIS AWS v6.0.0 → 💼 4.5 Ensure CloudTrail logs are encrypted at rest using KMS CMKs (Automated)1no data
💼 Cloudaware Framework → 💼 Data Encryption70no data
💼 FedRAMP High Security Controls → 💼 AU-9 Protection of Audit Information (L)(M)(H)3812no data
💼 FedRAMP High Security Controls → 💼 CM-3(6) Cryptography Management (H)17no data
💼 FedRAMP High Security Controls → 💼 SC-7(10) Prevent Exfiltration (H)18no data
💼 FedRAMP High Security Controls → 💼 SC-13 Cryptographic Protection (L)(M)(H)1643no data
💼 FedRAMP High Security Controls → 💼 SC-28 Protection of Information at Rest (L)(M)(H)1736no data
💼 FedRAMP High Security Controls → 💼 SC-28(1) Cryptographic Protection (L)(M)(H)525no data
💼 FedRAMP Low Security Controls → 💼 AU-9 Protection of Audit Information (L)(M)(H)11no data
💼 FedRAMP Low Security Controls → 💼 SC-13 Cryptographic Protection (L)(M)(H)43no data
💼 FedRAMP Low Security Controls → 💼 SC-28 Protection of Information at Rest (L)(M)(H)136no data
💼 FedRAMP Low Security Controls → 💼 SC-28(1) Cryptographic Protection (L)(M)(H)25no data
💼 FedRAMP Moderate Security Controls → 💼 AU-9 Protection of Audit Information (L)(M)(H)111no data
💼 FedRAMP Moderate Security Controls → 💼 SC-13 Cryptographic Protection (L)(M)(H)43no data
💼 FedRAMP Moderate Security Controls → 💼 SC-28 Protection of Information at Rest (L)(M)(H)136no data
💼 FedRAMP Moderate Security Controls → 💼 SC-28(1) Cryptographic Protection (L)(M)(H)25no data
💼 NIST CSF v2.0 → 💼 PR.DS-01: The confidentiality, integrity, and availability of data-at-rest are protected187no data
💼 NIST CSF v2.0 → 💼 PR.DS-02: The confidentiality, integrity, and availability of data-in-transit are protected160no data
💼 NIST CSF v2.0 → 💼 PR.DS-10: The confidentiality, integrity, and availability of data-in-use are protected184no data
💼 NIST SP 800-53 Revision 5 → 💼 AU-9 Protection of Audit Information728no data
💼 NIST SP 800-53 Revision 5 → 💼 CA-9(1) Internal System Connections _ Compliance Checks54no data
💼 NIST SP 800-53 Revision 5 → 💼 CM-3(6) Configuration Change Control _ Cryptography Management17no data
💼 NIST SP 800-53 Revision 5 → 💼 SC-7(10) Boundary Protection _ Prevent Exfiltration18no data
💼 NIST SP 800-53 Revision 5 → 💼 SC-13 Cryptographic Protection432no data
💼 NIST SP 800-53 Revision 5 → 💼 SC-28 Protection of Information at Rest31737no data
💼 NIST SP 800-53 Revision 5 → 💼 SC-28(1) Protection of Information at Rest _ Cryptographic Protection1025no data
💼 NIST SP 800-53 Revision 5 → 💼 SI-7(6) Software, Firmware, and Information Integrity _ Cryptographic Protection27no data
💼 PCI DSS v3.2.1 → 💼 10.5.2 Protect audit trail files from unauthorized modifications.14no data
💼 PCI DSS v4.0.1 → 💼 10.3.2 Audit log files are protected to prevent modifications by individuals.4no data
💼 PCI DSS v4.0 → 💼 10.3.2 Audit log files are protected to prevent modifications by individuals.24no data