CloudTrail logs should be encrypted at rest using KMS CMKs

Docs > Datadog Security > OOTB Rules > CloudTrail logs should be encrypted at rest using KMS CMKs

This page is not yet available in Spanish. We are working on its translation.
If you have any questions or feedback about our current translation project, feel free to reach out to us!

Description

AWS CloudTrail is a web service that records AWS API calls for an account and makes those logs available to users and resources per IAM policies. AWS Key Management Service (KMS) is a managed service that helps create and control the encryption keys used to encrypt account data. It uses Hardware Security Modules (HSMs) to protect the security of encryption keys. Configure your CloudTrail logs to leverage server-side encryption (SSE), and KMS customer-created master keys (CMK) to further protect CloudTrail logs. You should set up CloudTrail to use SSE-KMS.

Rationale

Configuring CloudTrail to use SSE-KMS provides additional confidentiality controls on log data. A given user must have S3 read permission on the corresponding log bucket and have decrypt permission by the CMK policy.

Impact

Customer created keys incur an additional cost. See https://aws.amazon.com/kms/pricing/ for more information.

Remediation

From the console

Sign into the AWS Management Console and open the CloudTrail console.
In the left navigation pane, choose Trails and select the trail you’d like to update.
Under the S3 section, click on the edit button (pencil icon).
Click Advanced.
Select an existing CMK from the KMS key ID drop-down menu.
- Ensure the CMK is located in the same region as the S3 bucket.
- You need to apply a KMS key policy on the selected CMK in order for CloudTrail as a service to encrypt and decrypt log files using the CMK provided. See create KMS key policy for steps to edit the selected CMK Key policy.
Click Save.
A notification message appears stating that you need to have decrypt permissions on the specified KMS key to decrypt log files.
Click Yes.

From the command line

aws cloudtrail update-trail --name <trail_name> --kms-id <cloudtrail_kms_key>
aws kms put-key-policy --key-id <cloudtrail_kms_key> --policy <cloudtrail_kms_key_policy>

Additional information

CMK policy configuration

Add the following three statements to the CMK policy:

Enable Cloudtrail to describe CMK properties:

{ 
  "Sid": "Allow CloudTrail access",
  "Effect": "Allow",
  "Principal": {
    "Service": "cloudtrail.amazonaws.com" 
   },
   "Action": "kms:DescribeKey",
   "Resource": "*"
}

Granting encrypt permissions:

{ 
  "Sid": "Allow CloudTrail to encrypt logs",
  "Effect": "Allow",
  "Principal": {
    "Service": "cloudtrail.amazonaws.com" 
   },
   "Action": "kms:GenerateDataKey*",
   "Resource": "*",
   "Condition": {
     "StringLike": { 
       "kms:EncryptionContext:aws:cloudtrail:arn": [
         "arn:aws:cloudtrail:*:aws-account-id:trail/*"
       ]
     }
   }
}

Granting decrypt permissions:

{ 
  "Sid": "Enable CloudTrail log decrypt permissions",
  "Effect": "Allow",
  "Principal": {
    "AWS": "arn:aws:iam::aws-account-id:user/username"
   },
   "Action": "kms:Decrypt",
   "Resource": "*",
   "Condition": {
     "Null": { 
       "kms:EncryptionContext:aws:cloudtrail:arn": "false"
     }
   }
}