Description

Ensure that every AWS CloudTrail trail encrypts the log files it delivers to Amazon S3 with server-side encryption using a customer managed AWS KMS key (SSE-KMS). This applies to both single-region and multi-region trails.

Rationale

Without a customer managed KMS key, CloudTrail log files are protected only by the permissions on the S3 bucket. A bucket misconfiguration or stolen credentials could then expose the audit history of the account, helping an attacker to avoid detection and move to other resources. With SSE-KMS, reading the logs also requires permission to decrypt with the KMS key, which adds a separate access control, allows separation of duties between key administrators and log readers, and records every use of the key.

Impact

  • Adds a second layer of access control to CloudTrail log files

  • Allows key usage to be audited and access to the logs to be revoked by changing the key policy

  • Users, roles and tools that read the log files (for example SIEM integrations) need kms:Decrypt permission on the key

  • AWS KMS request charges apply

Default Value

Trails created with the API or AWS CLI encrypt log files with SSE-S3 (Amazon S3 managed keys) unless a KMS key is specified. The CloudTrail console enables SSE-KMS by default when a new trail is created.

Pre-Requisites

  • IAM permissions: cloudtrail:DescribeTrails, cloudtrail:UpdateTrail, kms:CreateKey and kms:PutKeyPolicy (if a new key is needed)

  • A symmetric customer managed KMS key in the same region as the S3 bucket, whose key policy allows CloudTrail to encrypt log files and allows log readers to decrypt them (the console can create such a key during the change)

Remediation

Test Plan

Console:

  1. Sign in to the AWS Management Console at https://console.aws.amazon.com.

  2. Open the CloudTrail console and select Trails in the left menu.

  3. Select each trail and, in the General details section, check that Log file SSE-KMS encryption is Enabled and shows a KMS key.

  4. Repeat for each region in use.

  5. If encryption is disabled for any trail, follow the implementation steps.

CLI:

List the trails with their KMS key:

aws cloudtrail describe-trails --region <REGION> --query "trailList[].[Name,HomeRegion,IsMultiRegionTrail,KmsKeyId]" --output table

A trail fails if KmsKeyId is empty (None).

Implementation Steps

Console:

  1. Sign in to the AWS Management Console at https://console.aws.amazon.com.

  2. Open the CloudTrail console and select Trails in the left menu.

  3. Select the trail and, in the General details section, choose Edit.

  4. Select Log file SSE-KMS encryption (Enabled).

  5. Choose New to create a key with a policy that allows CloudTrail to use it, or Existing and select a key whose policy already allows CloudTrail.

  6. Choose Save changes.

  7. Repeat for each affected trail in each region in use.

CLI:

Configure the trail to encrypt log files with an existing KMS key (its key policy must already allow CloudTrail to use it):

aws cloudtrail update-trail --name <TRAIL_NAME> --region <HOME_REGION> --kms-key-id <KMS_KEY_ARN>

Backout Plan

Before making changes, save the current trail configuration:

aws cloudtrail get-trail --name <TRAIL_NAME> --region <HOME_REGION> > trail-backup.json

To roll back:

  1. Sign in to the AWS Management Console at https://console.aws.amazon.com.

  2. Open the CloudTrail console and select the trail.

  3. In the General details section, choose Edit.

  4. Clear Log file SSE-KMS encryption.

  5. Choose Save changes.

Note: log files already delivered remain encrypted with the KMS key, so do not delete or disable the key while those logs are retained. Rolling back removes the extra access control on new log files.

Reference