# Ensure CloudTrail logs are encrypted at rest using KMS CMKs

- Source: https://support.icompaas.com/support/solutions/articles/a_1793292191392339-ensure-cloudtrail-logs-are-encrypted-at-rest-using-kms-cmks
- Section: [Solutions](https://support.icompaas.com/support/solutions) › [AWS_Checks_v5.39.1](https://support.icompaas.com/support/solutions/c_1793285913477877) › [AWS Checks](https://support.icompaas.com/support/solutions/folders/f_1793287194371224)
- Last updated: 2026-10-29
- Publisher: iCompaas, Inc. (https://www.icompaas.com)

**Description**

Ensure that every AWS CloudTrail trail encrypts the log files it delivers to Amazon S3 with server-side encryption using a customer managed AWS KMS key (SSE-KMS). This applies to both single-region and multi-region trails.

**Rationale**

Without a customer managed KMS key, CloudTrail log files are protected only by the permissions on the S3 bucket. A bucket misconfiguration or stolen credentials could then expose the audit history of the account, helping an attacker to avoid detection and move to other resources. With SSE-KMS, reading the logs also requires permission to decrypt with the KMS key, which adds a separate access control, allows separation of duties between key administrators and log readers, and records every use of the key.

**Impact**

-   Adds a second layer of access control to CloudTrail log files
    
-   Allows key usage to be audited and access to the logs to be revoked by changing the key policy
    
-   Users, roles and tools that read the log files (for example SIEM integrations) need kms:Decrypt permission on the key
    
-   AWS KMS request charges apply
    

**Default Value**

Trails created with the API or AWS CLI encrypt log files with SSE-S3 (Amazon S3 managed keys) unless a KMS key is specified. The CloudTrail console enables SSE-KMS by default when a new trail is created.

**Pre-Requisites**

-   IAM permissions: cloudtrail:DescribeTrails, cloudtrail:UpdateTrail, kms:CreateKey and kms:PutKeyPolicy (if a new key is needed)
    
-   A symmetric customer managed KMS key in the same region as the S3 bucket, whose key policy allows CloudTrail to encrypt log files and allows log readers to decrypt them (the console can create such a key during the change)
    

**Remediation**

**Test Plan**

**Console:**

1.  Sign in to the AWS Management Console at [https://console.aws.amazon.com](https://console.aws.amazon.com/).
    
2.  Open the CloudTrail console and select **Trails** in the left menu.
    
3.  Select each trail and, in the **General details** section, check that **Log file SSE-KMS encryption** is **Enabled** and shows a KMS key.
    
4.  Repeat for each region in use.
    
5.  If encryption is disabled for any trail, follow the implementation steps.
    

**CLI:**

List the trails with their KMS key:

aws cloudtrail describe-trails --region <REGION> --query "trailList\[\].\[Name,HomeRegion,IsMultiRegionTrail,KmsKeyId\]" --output table

A trail fails if KmsKeyId is empty (None).

**Implementation Steps**

**Console:**

1.  Sign in to the AWS Management Console at [https://console.aws.amazon.com](https://console.aws.amazon.com/).
    
2.  Open the CloudTrail console and select **Trails** in the left menu.
    
3.  Select the trail and, in the **General details** section, choose **Edit**.
    
4.  Select **Log file SSE-KMS encryption** (**Enabled**).
    
5.  Choose **New** to create a key with a policy that allows CloudTrail to use it, or **Existing** and select a key whose policy already allows CloudTrail.
    
6.  Choose **Save changes**.
    
7.  Repeat for each affected trail in each region in use.
    

**CLI:**

Configure the trail to encrypt log files with an existing KMS key (its key policy must already allow CloudTrail to use it):

aws cloudtrail update-trail --name <TRAIL\_NAME> --region <HOME\_REGION> --kms-key-id <KMS\_KEY\_ARN>

**Backout Plan**

Before making changes, save the current trail configuration:

aws cloudtrail get-trail --name <TRAIL\_NAME> --region <HOME\_REGION> > trail-backup.json

To roll back:

1.  Sign in to the AWS Management Console at [https://console.aws.amazon.com](https://console.aws.amazon.com/).
    
2.  Open the CloudTrail console and select the trail.
    
3.  In the **General details** section, choose **Edit**.
    
4.  Clear **Log file SSE-KMS encryption**.
    
5.  Choose **Save changes**.
    

Note: log files already delivered remain encrypted with the KMS key, so do not delete or disable the key while those logs are retained. Rolling back removes the extra access control on new log files.

**Reference**

-   [https://docs.aws.amazon.com/awscloudtrail/latest/userguide/encrypting-cloudtrail-log-files-with-aws-kms.html](https://docs.aws.amazon.com/awscloudtrail/latest/userguide/encrypting-cloudtrail-log-files-with-aws-kms.html)
    
-   [https://docs.aws.amazon.com/awscloudtrail/latest/userguide/create-kms-key-policy-for-cloudtrail.html](https://docs.aws.amazon.com/awscloudtrail/latest/userguide/create-kms-key-policy-for-cloudtrail.html)
    
-   [https://docs.aws.amazon.com/cli/latest/reference/cloudtrail/update-trail.html](https://docs.aws.amazon.com/cli/latest/reference/cloudtrail/update-trail.html)

## Related compliance guidance

- [SOC 2 compliance: a practical implementation guide for cloud-native SaaS teams](https://support.icompaas.com/compliance/soc-2-trust-services-criteria): Configuration checks like this one are the technical half of a SOC 2 / ISO 27001 programme — the guide shows where they fit, what else an auditor expects, and how to evidence them.
- [ISO/IEC 27001:2022 compliance: a practical implementation guide](https://support.icompaas.com/compliance/iso-27001-2022): ISO 27001 Annex A.8 (technological controls) is where cloud hardening evidence lands; the guide shows how to run the ISMS around it.