All checks
Low
CloudTrail should have encryption at-rest enabled
Checks that the trail encrypts the log and digest files it delivers with an AWS KMS key (SSE-KMS) rather than S3's default SSE-S3, so reading the logs also takes permission to use that key. An organization trail can be changed only from the management account or a delegated administrator account.
- service
- CloudTrail
- severity
- Low
- scope
- evaluated in every region
How to fix it
- Can break clients: Anyone who reads these log files, including log analysis tools, then needs kms:Decrypt on the key, or the files delivered after the change are unreadable to them.
- Affects another check: The customer managed key is in scope for KMS.4, which fails it until automatic key rotation is turned on.
In the console
CloudTrail → Trails → the trail → General details
- Log file SSE-KMS encryption
- Enabled
- AWS KMS key
- New, or an existing key in the log bucket's Region whose key policy lets CloudTrail use it
With the AWS CLI
aws cloudtrail update-trail --name <trail-name> --kms-key-id <kms-key-arn> --region <region>With Terraform
resource "aws_cloudtrail" "this" {
name = var.trail_name
s3_bucket_name = var.log_bucket_name
kms_key_id = var.kms_key_arn
}See which of your accounts this check is failing on.
Book a live scan