# Ensure CloudTrail logs are encrypted at rest using KMS CMKs

- Source: https://support.icompaas.com/support/solutions/articles/62000086113-ensure-cloudtrail-logs-are-encrypted-at-rest-using-kms-cmks
- Section: [Solutions](https://support.icompaas.com/support/solutions) › [HIPAA Readiness](https://support.icompaas.com/support/solutions/62000039493) › [CIS Control 6](https://support.icompaas.com/support/solutions/folders/62000067251)
- Last updated: 2026-05-29
- Publisher: iCompaas, Inc. (https://www.icompaas.com)

**Profile Applicability:** Level 2

  

**Description:** 

AWS CloudTrail is a web service that records AWS API calls for an account and makes those logs available to users and resources in accordance with IAM policies. AWS Key Management Service (KMS) is a managed service that helps create and control the encryption keys used to encrypt account data, and uses Hardware Security Modules (HSMs) to protect the security of encryption keys. CloudTrail logs can be configured to leverage server-side encryption (SSE) and KMS customer created master keys (CMK) to further protect CloudTrail logs. It is recommended that CloudTrail be configured to use SSE-KMS.

  

**Rationale:** 

Configuring CloudTrail to use SSE-KMS provides additional confidentiality controls on log data, as a given user must have S3 read permission on the corresponding log bucket and must be granted decryption permission by the CMK policy.

  

### Impact:

If you create a CMK in the CloudTrail console, CloudTrail adds the required CMK policy for you. You do not need to manually add the policy statements.

Customer-created keys incur an additional cost. See [https://aws.amazon.com/kms/pricing/](https://aws.amazon.com/kms/pricing/ "https://aws.amazon.com/kms/pricing/") for more information. 

  

**Audit:** 

Perform the following to determine if CloudTrail is configured to use SSE-KMS: Via the Management Console 

1.  Sign in to the AWS Management Console
    
2.  Open the CloudTrail console at [https://console.aws.amazon.com/cloudtrail](https://console.aws.amazon.com/cloudtrail "https://console.aws.amazon.com/cloudtrail")
    
3.  In the left navigation pane, choose Trails. 
    
4.  Select a Trail you want to examine
    
5.  In **General, details** check **Logfile SSE-KMS encryption** is enabled or disabled.![](https://support.icompaas.com/assets/kb/28bd1dfac45ab45c.png)
    
6.  If the encryption is not enabled follow the implementation steps to enable it.
    

  

**Remediation:**

#### Pre-Requisite: 

1.  Sign in as an admin or IAM user with the required permissions.
    
2.  Need AWS KMS key.
    

  

#### Implementation Steps:

-   Perform the following to configure CloudTrail to use SSE-KMS: Via the Management Console 
    

1.  Sign in to the AWS Management Console
    
2.  Open the CloudTrail console at [https://console.aws.amazon.com/cloudtrail](https://console.aws.amazon.com/cloudtrail "https://console.aws.amazon.com/cloudtrail")
    
3.  In the left navigation pane, choose Trails.![](https://support.icompaas.com/assets/kb/a52386a07ee63876.png)
    
4.  Select the trail you want to modify and click on **edit** .![](https://support.icompaas.com/assets/kb/04a09214c8cfa474.png)
    
5.  Check the **Enabled** CheckBox under **Log file SSE-KMS encryption,** use existing key or you can create New Key. ![](https://support.icompaas.com/assets/kb/bd6db12808bfb2d1.png) 
    
6.  Click on **save changes.**
    

  

**Note:** Ensure the CMK is located in the same region as the S3 bucket 

#### Backout Plan:

To disable the encryption follow the implementation steps and uncheck the Enabled checkbox under Log file SSE-KMS encryption. 

### Reference: 

[![](https://support.icompaas.com/assets/kb/48a5faeffeb914d0.png)What Is AWS CloudTrail? - AWS CloudTrail](https://docs.aws.amazon.com/awscloudtrail/latest/userguide/cloudtrail-user-guide.html) 

[![](https://support.icompaas.com/assets/kb/ba85d4f039d5d67b.png)Creating keys - AWS Key Management Service](https://docs.aws.amazon.com/kms/latest/developerguide/create-keys.html) 

  

**CIS Controls:**

6 Maintenance, Monitoring and Analysis of Audit Logs 

Maintenance, Monitoring and Analysis of Audit Logs

## Related compliance guidance

- [HIPAA compliance for SaaS: a practical implementation guide](https://support.icompaas.com/compliance/hipaa): The Security Rule safeguards this readiness item belongs to, with a phased implementation roadmap and the evidence OCR expects.
- [SOC 2 compliance: a practical implementation guide for cloud-native SaaS teams](https://support.icompaas.com/compliance/soc-2-trust-services-criteria): Most healthcare customers ask for a SOC 2 report alongside HIPAA assurances; the two share most technical controls.