💼 3.5 Ensure CloudTrail logs are encrypted at rest using KMS CMKs - Level 2 (Automated)
- ID:
/frameworks/cis-aws-v3.0.0/03/05
Description
AWS CloudTrail is a web service that records AWS API calls for an account and makes those logs available to users and resources in accordance with IAM policies. AWS Key Management Service (KMS) is a managed service that helps create and control the encryption keys used to encrypt account data, and uses Hardware Security Modules (HSMs) to protect the security of encryption keys. CloudTrail logs can be configured to leverage server side encryption (SSE) and KMS customer created master keys (CMK) to further protect CloudTrail logs. It is recommended that CloudTrail be configured to use SSE-KMS.
Similar
- Sections
/frameworks/cis-aws-v4.0.0/03/05/frameworks/cis-aws-v2.0.0/03/07
- Internal
Similar Sections (Take Policies From)
Similar Sections (Give Policies To)
Sub Sections
| Section | Sub Sections | Internal Rules | Policies | Flags | Compliance |
|---|
Policies (1)