Skip to main content

lacework-global-77

3.7 Encrypt CloudTrail logs at rest using Customer-Managed Key Management Service (KMS) Keys (Automated)​

Profile Applicability​

• Level 2

Description​

AWS CloudTrail is a web service that records AWS API calls for an account and makes those logs available to users and resources in accordance with Identity and Access Management (IAM) policies. AWS Key Management Service (KMS) is a managed service that helps create and control the encryption keys used to encrypt account data, and uses Hardware Security Modules (HSMs) to protect the security of encryption keys. It is possible to configure CloudTrail logs to leverage Server-Side Encryption (SSE) and customer-managed KMS keys to further protect CloudTrail logs. Best practices recommended configuring CloudTrail to use SSE-KMS.

Rationale​

Configuring CloudTrail to use SSE-KMS provides additional confidentiality controls on log data as a given user must have S3 read permission on the corresponding log bucket and must be granted decrypt permission by the CMK policy.

Impact​

Customer created keys incur an additional cost. See https://aws.amazon.com/kms/pricing/ for more information.

Audit​

Perform the following to determine if CloudTrail is configured to use SSE-KMS:

From Console​

  1. Sign in to the AWS Management Console and open the CloudTrail console at https://console.aws.amazon.com/cloudtrail
  2. In the left navigation pane, choose Trails .
  3. Select a Trail
  4. Under the S3 section, ensure Encrypt log files is set to Yes and a KMS key ID is specified in the KMS Key Id field.

From Command Line​

  1. Run the following command:

    aws cloudtrail describe-trails

  2. For each trail listed, SSE-KMS is enabled if the trail has a KmsKeyId property defined.

Remediation​

Perform the following to configure CloudTrail to use SSE-KMS:

From Console​

  1. Sign in to the AWS Management Console and open the CloudTrail console at https://console.aws.amazon.com/cloudtrail.
  2. In the left navigation pane, choose Trails.
  3. Click a Trail.
  4. Under the S3 section click the edit button (pencil icon).
  5. Click Advanced.
  6. Select an existing KMS key from the KMS key Id drop-down menu:
  7. Click Save.
  8. At the notification message stating that you need to have decrypt permissions on the specified KMS key to decrypt log files, click Yes.

From Command Line​

aws cloudtrail update-trail --name <trail_name> --kms-id <cloudtrail_kms_key>
aws kms put-key-policy --key-id <cloudtrail_kms_key> --policy <cloudtrail_kms_key_policy>

References​

CCE-78919-8
https://docs.aws.amazon.com/awscloudtrail/latest/userguide/encrypting-cloudtrail-log-files-with-aws-kms.html
https://docs.aws.amazon.com/kms/latest/developerguide/create-keys.html

Additional Information​

3 statements the KMS key policy must have:

  1. Enable Cloudtrail to describe KMS key properties:

    {
     "Sid": "Allow CloudTrail access",
     "Effect": "Allow",
     "Principal": {
     "Service": "cloudtrail.amazonaws.com"
     },
     "Action": "kms:DescribeKey",
     "Resource": "*"
    }

  2. Granting encrypt permissions:

    {
     "Sid": "Allow CloudTrail to encrypt logs",
     "Effect": "Allow",
     "Principal": {
     "Service": "cloudtrail.amazonaws.com"
     },
     "Action": "kms:GenerateDataKey*",
     "Resource": "*",
     "Condition": {
     "StringLike": {
     "kms:EncryptionContext:aws:cloudtrail:arn": [
     "arn:aws:cloudtrail:*:aws-account-id:trail/*"
     ]
     }
     }
    }

  3. Granting decrypt permissions:

    {
     "Sid": "Enable CloudTrail log decrypt permissions",
     "Effect": "Allow",
     "Principal": {
     "AWS": "arn:aws:iam::aws-account-id:user/username"
     },
     "Action": "kms:Decrypt",
     "Resource": "*",
     "Condition": {
     "Null": {
     "kms:EncryptionContext:aws:cloudtrail:arn": "false"
     }
     }
    }
Last updated on