CloudTrail logs should be encrypted at rest using KMS CMKs

cloudtrail
This page is not yet available in Spanish. We are working on its translation.
If you have any questions or feedback about our current translation project, feel free to reach out to us!

Description

AWS CloudTrail records AWS API calls, and configuring it to use AWS Key Management Service (KMS) for server-side encryption (SSE) enhances log security. KMS uses Hardware Security Modules (HSMs) for key protection, adding confidentiality controls. Setting up CloudTrail with SSE-KMS ensures only authorized users with S3 read and CMK decrypt permissions can access the logs.

Remediation

For instructions on configuring CloudTrail to use SSE-KMS, refer to the CloudTrail Log File Encryption Guide.