CloudTrail trail logs are encrypted at rest with a KMS key
cloudtrail_kms_encryption_enabled
AWS CloudTrail trails are evaluated for use of SSE-KMS with a customer-managed KMS key to encrypt delivered log files at rest in S3. Trails without a configured KMS key are identified. Applies to single-Region and multi-Region trails.
Risk
Absent a customer-managed KMS key, log protection relies only on storage permissions. Bucket misconfigurations or stolen credentials can expose audit data, aiding evasion and lateral movement. Missing key-level controls, rotation, and usage audit weaken confidentiality and forensic integrity.
prowler aws --checks cloudtrail_kms_encryption_enabled
Recommendation
Enable SSE-KMS on every trail using a customer-managed KMS key. Apply least privilege so only authorized roles can Decrypt, and enforce separation of duties between key admins and log readers. Rotate keys and monitor key usage to provide defense in depth for CloudTrail data.
Remediation
aws cloudtrail update-trail --name <trail_name> --kms-key-id <kms_key_arn_or_id>
- In the AWS Console, go to CloudTrail > Trails
- Select the trail <trail_name>, click Edit
- Under Log file encryption, choose Use a KMS key and select <cloudtrail_kms_key>
- Click Save changes
Source Code
Resource Type
AwsCloudTrailTrail
References
- https://docs.aws.amazon.com/awscloudtrail/latest/userguide/encrypting-cloudtrail-log-files-with-aws-kms.html
- https://trendmicro.com/trendaivisiononecloudriskmanagement/knowledge-base/aws/CloudTrail/cloudtrail-logs-encrypted.html
- https://www.stream.security/rules/ensure-cloudtrail-logs-are-encrypted-at-rest
- https://www.clouddefense.ai/compliance-rules/cis-v130/logging/cis-v130-3-7