💼 3.7 Ensure CloudTrail logs are encrypted at rest using KMS CMKs

• Contextual name: 💼 3.7 Ensure CloudTrail logs are encrypted at rest using KMS CMKs
• ID: /frameworks/cis-aws-v1.4.0/03/07
• Located in: 💼 3 Logging

Description

AWS CloudTrail is a web service that records AWS API calls for an account and makes those logs available to users and resources in accordance with IAM policies. AWS Key Management Service (KMS) is a managed service that helps create and control the encryption keys used to encrypt account data, and uses Hardware Security Modules (HSMs) to protect the security of encryption keys. CloudTrail logs can be configured to leverage server side encryption (SSE) and KMS customer created master keys (CMK) to further protect CloudTrail logs. It is recommended that CloudTrail be configured to use SSE-KMS.

Similar

• Sections
  • /frameworks/cis-aws-v1.5.0/03/07
  • /frameworks/cis-aws-v1.3.0/03/07
• Internal
  • ID: dec-c-0fa91e0f

Similar Sections (Take Policies From)

Section	Sub Sections	Internal Rules	Policies	Flags
💼 CIS AWS v1.3.0 → 💼 3.7 Ensure CloudTrail logs are encrypted at rest using KMS CMKs			1
💼 CIS AWS v1.5.0 → 💼 3.7 Ensure CloudTrail logs are encrypted at rest using KMS CMKs - Level 2 (Automated)			1

Similar Sections (Give Policies To)

Section	Sub Sections	Internal Rules	Policies	Flags
💼 CIS AWS v1.3.0 → 💼 3.7 Ensure CloudTrail logs are encrypted at rest using KMS CMKs			1
💼 CIS AWS v1.5.0 → 💼 3.7 Ensure CloudTrail logs are encrypted at rest using KMS CMKs - Level 2 (Automated)			1

Sub Sections

Section	Sub Sections	Internal Rules	Policies	Flags

Policies (1)

Policy	Logic Count	Flags
📝 AWS CloudTrail is not encrypted with KMS CMK 🟢	1	🟢 x6