# 3.5 Ensure CloudTrail logs are encrypted at rest using KMS CMKs (Automated) - Source: https://support.icompaas.com/support/solutions/articles/62000234248-3-5-ensure-cloudtrail-logs-are-encrypted-at-rest-using-kms-cmks-automated- - Section: [Solutions](https://support.icompaas.com/support/solutions) › [CIS Amazon Web Services Foundations Benchmark v5.0.0](https://support.icompaas.com/support/solutions/62000112684) › [CIS AWS Benchmarks](https://support.icompaas.com/support/solutions/folders/62000169233) - Last updated: 2026-05-29 - Publisher: iCompaas, Inc. (https://www.icompaas.com) #### Profile Applicability - **Level 1** #### Description: AWS CloudTrail captures and logs all API calls made in an AWS account, providing crucial audit trails and security monitoring. Encrypting CloudTrail logs at rest using AWS Key Management Service (KMS) Customer Managed Keys (CMKs) ensures that the logs are securely stored and protected from unauthorized access. By using KMS CMKs, organizations can control and manage the encryption of their CloudTrail logs and ensure compliance with regulatory requirements. Enabling this feature ensures that all CloudTrail logs are automatically encrypted with the specified CMKs and that access to these logs is restricted to authorized users. #### Rationale: Encrypting CloudTrail logs with KMS CMKs provides: - Enhanced security: Protects sensitive CloudTrail logs from unauthorized access. - Compliance: Ensures that logs meet regulatory and security standards (e.g., HIPAA, SOC 2, PCI DSS) requiring encrypted log storage. - Auditability: Allows for control over key access policies, ensuring only authorized entities can decrypt and access logs. Without encryption, CloudTrail logs could be vulnerable to unauthorized access, exposing critical operational and security-related information. #### Impact: Failure to encrypt CloudTrail logs with KMS CMKs can result in: - Unauthorized access to critical security audit logs. - Violations of compliance requirements related to the encryption of logs. - Increased risk of exposure or tampering with CloudTrail logs, which could hinder incident detection and response. Encrypting logs ensures that sensitive data in the logs is protected, thereby improving the security posture of your AWS environment. #### Default Value: By default, CloudTrail logs are stored unencrypted in S3. You must explicitly configure CloudTrail to use KMS CMKs for log encryption. #### Pre-Requisites: - AWS CLI installed and configured - IAM permissions: - cloudtrail:DescribeTrails - cloudtrail:UpdateTrail - kms:CreateKey - kms:PutKeyPolicy - KMS CMK must exist, or you need permissions to create one for CloudTrail log encryption #### Remediation: ##### Test Plan: Using AWS Console: 1. Go to the [CloudTrail Console](https://console.aws.amazon.com/cloudtrail/). 2. Verify that CloudTrail is configured to encrypt logs using a KMS CMK. 3. Go to the [KMS Console](https://console.aws.amazon.com/kms/) and confirm that the specified CMK is available and properly configured. Using AWS CLI: aws cloudtrail describe-trails --query "TrailList\[?KmsKeyId!=null\].{TrailName:Name, KmsKeyId:KmsKeyId}" --output table To check if the specified KMS CMK is available: aws kms describe-key --key-id --query "KeyMetadata.KeyId" --output table ##### Implementation Plan: Using AWS Console: 1. Enable encryption for CloudTrail logs using KMS CMKs: - Go to the [CloudTrail Console](https://console.aws.amazon.com/cloudtrail/). - Select the trail for which you want to enable encryption. - In the KMS Key section, select the KMS CMK you want to use for log encryption. If no CMK exists, create a new one in the [KMS Console](https://console.aws.amazon.com/kms/). - Save the changes to apply encryption. 2. Verify encryption settings in KMS Console: - Go to the [KMS Console](https://console.aws.amazon.com/kms/). - Ensure that the KMS CMK is configured correctly, and check access policies to ensure that only authorized users and roles can decrypt the logs. Using AWS CLI: 1. Enable encryption for CloudTrail logs using a KMS CMK: aws cloudtrail update-trail --name --kms-key-id 2. Verify encryption settings: aws cloudtrail describe-trails --query "TrailList\[?KmsKeyId!=null\].{TrailName:Name, KmsKeyId:KmsKeyId}" --output table #### Backout Plan: Using AWS Console: 1. If encryption causes performance issues or unnecessary overhead: - Go to the [CloudTrail Console](https://console.aws.amazon.com/cloudtrail/). - Select the trail and choose Edit. - Disable KMS encryption or switch to a different CMK if performance issues arise. 2. Modify KMS settings to reduce the scope of access control if access issues arise or modify key policies. Using AWS CLI: 1. Temporarily disable encryption: aws cloudtrail update-trail --name --kms-key-id "" 2. Stop CloudTrail logging if encryption causes issues: aws cloudtrail stop-logging --name 3. Re-enable monitoring once issues are resolved: aws cloudtrail start-logging --name aws cloudtrail update-trail --name --kms-key-id #### References: - [AWS CloudTrail Documentation ](https://docs.aws.amazon.com/awscloudtrail/latest/userguide/cloudtrail-user-guide.html) - [AWS KMS Documentation ](https://docs.aws.amazon.com/kms/latest/developerguide/) - [AWS CloudWatch Documentation ](https://docs.aws.amazon.com/cloudwatch/latest/monitoring/) #### CIS Controls Mapping:

CIS Control Version

Control ID

Control Description

CIS v8

4.9

Perform Continuous Security Monitoring and Incident Detection

CIS v7

6.3

Monitor Security Configurations for Compliance

CIS v7

5.2

Securely Manage and Monitor Cloud Accounts and Services

## Related compliance guidance - [SOC 2 compliance: a practical implementation guide for cloud-native SaaS teams](https://support.icompaas.com/compliance/soc-2-trust-services-criteria): Configuration checks like this one are the technical half of a SOC 2 / ISO 27001 programme — the guide shows where they fit, what else an auditor expects, and how to evidence them. - [ISO/IEC 27001:2022 compliance: a practical implementation guide](https://support.icompaas.com/compliance/iso-27001-2022): ISO 27001 Annex A.8 (technological controls) is where cloud hardening evidence lands; the guide shows how to run the ISMS around it.