Ensure CloudTrail logs are encrypted at rest using KMS CMKs

Perform the following to configure CloudTrail to use SSE-KMS:

Via the Management Console

1. Sign in to the AWS Management Console and open the CloudTrail console at https://console.aws.amazon.com/cloudtrail
2. In the left navigation pane, choose Trails .
3. Click on a Trail
4. Under the S3 section click on the edit button (pencil icon)
5. Click Advanced
6. Select an existing CMK from the KMS key Id drop-down menu

• Note: Ensure the CMK is located in the same region as the S3 bucket
• Note: You will need to apply a KMS Key policy on the selected CMK in order for CloudTrail as a service to encrypt and decrypt log files using the CMK provided. Steps are provided here for editing the selected CMK Key policy

1. Click Save
2. You will see a notification message stating that you need to have decrypt permissions on the specified KMS key to decrypt log files.
3. Click Yes

Via CLI

aws cloudtrail update-trail --name <trail_name> --kms-id <cloudtrail_kms_key>
aws kms put-key-policy --key-id <cloudtrail_kms_key> --policy <cloudtrail_kms_key_policy>

Impact

Customer created keys incur an additional cost. See https://aws.amazon.com/kms/pricing/ for more information.

References

1. CIS CSC v6.0 #13.1: Perform an assessment of data to identify sensitive information.
2. https://docs.aws.amazon.com/awscloudtrail/latest/userguide/encrypting-cloudtrail-log-files-with-aws-kms.html
3. http://docs.aws.amazon.com/kms/latest/developerguide/create-keys.html
4. CIS CSC v6.0 #6: Maintenance, Monitoring, and Analysis of Audit Logs
5. CCE-78919-8

Notes

3 statements which need to be added to the CMK policy:

1. Enable Cloudtrail to describe CMK properties

json```json { "Sid": "Allow CloudTrail access", "Effect": "Allow", "Principal": { "Service": "cloudtrail.amazonaws.com" }, "Action": "kms:DescribeKey", "Resource": "*" }

2. Granting encrypt permissions

```json
{ "Sid": "Allow CloudTrail to encrypt logs",
"Effect": "Allow",
"Principal": {
"Service": "cloudtrail.amazonaws.com" },
  "Action": "kms:GenerateDataKey*",
  "Resource": "*",
  "Condition": {
"StringLike": { "kms:EncryptionContext:aws:cloudtrail:arn": [
"arn:aws:cloudtrail:*:aws-account-id:trail/*" ]
} }
}

1. Granting decrypt permissions

{ "Sid": "Enable CloudTrail log decrypt permissions", "Effect": "Allow",
"Principal": {
"AWS": "arn:aws:iam::aws-account-id:user/username" },
"Action": "kms:Decrypt",
  "Resource": "*",
  "Condition": {
"Null": {
"kms:EncryptionContext:aws:cloudtrail:arn": "false"
} }
}

Multiple Remediation Paths

AWS

SERVICE-WIDE (RECOMMENDED when many resources are affected): Deploy centralized guardrails and remediation using AWS Config Conformance Packs and (if applicable) AWS Organizations SCPs.

aws configservice put-organization-conformance-pack --organization-conformance-pack-name <pack-name> --template-s3-uri s3://<bucket>/<template>.yaml

ASSET-LEVEL: Apply the resource-specific remediation steps above to only the affected assets.

PREVENTIVE: Add CI/CD policy checks (CloudFormation/Terraform validation) before deployment to prevent recurrence.

References for Service-Wide Patterns

• AWS Config Conformance Packs: https://docs.aws.amazon.com/config/latest/developerguide/conformance-packs.html
• AWS Organizations SCP examples: https://docs.aws.amazon.com/organizations/latest/userguide/orgs_manage_policies_scps_examples.html

Operational Rollout Workflow

Use this sequence to reduce risk and avoid repeated drift.

1. Contain at Service-Wide Scope First (Recommended)

• AWS: deploy/adjust organization conformance packs and policy guardrails.

aws configservice put-organization-conformance-pack --organization-conformance-pack-name <pack-name> --template-s3-uri s3://<bucket>/<template>.yaml

2. Remediate Existing Affected Assets

• Execute the control-specific Console/CLI steps documented above for each flagged resource.
• Prioritize internet-exposed and production assets first.

3. Validate and Prevent Recurrence

• Re-scan after each remediation batch.
• Track exceptions with owner and expiry date.
• Add preventive checks in IaC/CI pipelines.