Check Details

• Resource: General
• Check: Encrypt CloudTrail logs
• Risk: Unencrypted logs can be read by unauthorized users

Remediation via AWS Console

1. Log in to the AWS Management Console and open the CloudTrail console.

   
2. In the left navigation panel, select Trails.
3. Click on the trail to encrypt, then click Edit.

4. Under KMS Key Id, select an existing CMK (Customer Managed Key).

   
5. Click Save. A notification will appear stating that you must have decryption permissions on the KMS key to decrypt log files. Click Yes.

Remediation via AWS CLI

1. Log in to the AWS Management Console and click the CloudShell icon (>_) in the top-right corner.

   

2. Run the following command to specify a KMS key for your trail:

   

   aws cloudtrail update-trail --name <trail-name> --kms-key-id <cloudtrail-kms-key>
   

3. Create a key policy JSON file:

   

   nano /tmp/cloudtrail-kms-key-policy.json
   

   Paste the following policy (replace aws-account-id, username, and region accordingly):

   

   {
   "Version": "2012-10-17",
   "Statement": [
   {
   "Sid": "Allow CloudTrail access",
   "Effect": "Allow",
   "Principal": { "Service": "cloudtrail.amazonaws.com" },
   "Action": "kms:DescribeKey",
   "Resource": "_"
   },
   {
   "Sid": "Allow CloudTrail to encrypt logs",
   "Effect": "Allow",
   "Principal": { "Service": "cloudtrail.amazonaws.com" },
   "Action": "kms:GenerateDataKey_",
   "Resource": "_",
   "Condition": {
   "StringLike": {
   "kms:EncryptionContext:aws:cloudtrail:arn": [
   "arn:aws:cloudtrail:_:aws-account-id:trail/_"
   ]
   }
   }
   },
   {
   "Sid": "Enable CloudTrail log decrypt permissions",
   "Effect": "Allow",
   "Principal": { "AWS": "arn:aws:iam::aws-account-id:user/username" },
   "Action": "kms:Decrypt",
   "Resource": "_",
   "Condition": { "Null": { "kms:EncryptionContext:aws:cloudtrail:arn": "false" } }
   }
   ]
   }
   

   Save and exit (Ctrl+O → Enter, Ctrl+X)

4. Attach the key policy to the specified KMS key:

   

   aws kms put-key-policy --key-id <cloudtrail-kms-key> --policy-name default --policy file:///tmp/cloudtrail-kms-key-policy.json