Check ID:
Provider: AWS
Service:
Severity: MEDIUM
Categories:
Resource type:
cloudtrail_kms_encryption_enabledProvider: AWS
Service:
cloudtrailSeverity: MEDIUM
Categories:
encryptionResource type:
AwsCloudTrailTrailWhat this check verifies
AWS CloudTrail trails are evaluated for use of SSE-KMS with a customer-managed KMS key to encrypt delivered log files at rest in S3. Trails without a configured KMS key are identified. Applies to single-Region and multi-Region trails.Risk
Absent a customer-managed KMS key, log protection relies only on storage permissions. Bucket misconfigurations or stolen credentials can expose audit data, aiding evasion and lateral movement. Missing key-level controls, rotation, and usage audit weaken confidentiality and forensic integrity.Recommendation
Enable SSE-KMS on every trail using a customer-managed KMS key. Apply least privilege so only authorized roles canDecrypt, and enforce separation of duties between key admins and log readers. Rotate keys and monitor key usage to provide defense in depth for CloudTrail data.
Remediation
- CLI
- Terraform
- Native IaC
- Dashboard steps
aws cloudtrail update-trail —name <trail_name> —kms-key-id <kms_key_arn_or_id>
References
- https://docs.aws.amazon.com/awscloudtrail/latest/userguide/encrypting-cloudtrail-log-files-with-aws-kms.html
- https://trendmicro.com/trendaivisiononecloudriskmanagement/knowledge-base/aws/CloudTrail/cloudtrail-logs-encrypted.html
- https://www.stream.security/rules/ensure-cloudtrail-logs-are-encrypted-at-rest
- https://www.clouddefense.ai/compliance-rules/cis-v130/logging/cis-v130-3-7
Where this check fires
This check runs on every scheduled scan against your AWS account. Findings appear at Cloud Security → Findings filterable byCheck ID = cloudtrail_kms_encryption_enabled. To re-evaluate after a fix, hit Run now on the account’s schedule under Cloud Security → Schedules — the next scan re-checks this control and marks the finding fixed or keeps it persistent.
← Back to AWS checks