CloudTrail trail should encrypt logs with a KMS key (SSE-KMS)

What it checks

CloudTrail trail should encrypt logs with a KMS key (SSE-KMS)

Where it applies

Terraform: aws_cloudtrail

CloudFormation: AWS::CloudTrail::Trail

How to fix it

1. Create a KMS key with a policy allowing CloudTrail to encrypt and the appropriate principals to decrypt, then set kms_key_id on the trail.

Frameworks

• AWS FSBP CloudTrail.2
• SOC 2 CC6.1
• PCI-DSS v4.0.1/10.3.2
• HIPAA 164.312(a)(2)(iv)

These mappings are advisory, not an attestation of compliance.

Vendor documentation

All rules