VIEW RULE IN DATADOG VIEW MISCONFIGURATIONS

Description

AWS CloudTrail records AWS API calls, and configuring it to use AWS Key Management Service (KMS) for server-side encryption (SSE) enhances log security. KMS uses Hardware Security Modules (HSMs) for key protection, adding confidentiality controls. Setting up CloudTrail with SSE-KMS ensures only authorized users with S3 read and CMK decrypt permissions can access the logs.

Remediation

For instructions on configuring CloudTrail to use SSE-KMS, refer to the CloudTrail Log File Encryption Guide.