CloudTrail Logs Should Be Encrypted

More Info:

Your CloudTrail logs should be encrypted at rest using server-side encryption provided by AWS KMS–Managed Keys (SSE-KMS) to enhance the security of your CloudTrail bucket

Risk Level

Medium

Address

Security

Compliance Standards

HIPAA, PCIDSS, GDPR, CISAWS, CBP, NIST, SOC2, AWSWAF

Triage and Remediation

Remediation

Using Console

Using CLI

To remediate the misconfiguration of unencrypted AWS CloudTrail logs using AWS CLI, follow the below steps:

Open the AWS CLI on your local machine and run the following command to enable CloudTrail log encryption:

aws cloudtrail update-trail --name <trail_name> --kms-id <kms_key_id> --enable-log-file-encryption

Replace <trail_name> with the name of the CloudTrail trail that you want to encrypt, and <kms_key_id> with the ID of the KMS key that you want to use for encryption.

Verify that CloudTrail log encryption is enabled by running the following command:

aws cloudtrail describe-trails --trail-name-list <trail_name> --query "trailList[*].{Name:Name, KmsKeyId:KmsKeyId, IsLogFileEncryptionEnabled:IsLogFileEncryptionEnabled}"

Replace <trail_name> with the name of the CloudTrail trail that you want to verify.

Check the AWS CloudTrail console to ensure that the CloudTrail logs are being encrypted.

By following these steps, you can remediate the misconfiguration of unencrypted AWS CloudTrail logs using AWS CLI.

Using Python

To remediate the misconfiguration of unencrypted CloudTrail logs in AWS using Python, you can follow these steps:

First, you need to check if CloudTrail logs are encrypted or not. For this, you can use the AWS SDK for Python (Boto3) and run the following code:

import boto3

# Create a CloudTrail client
cloudtrail = boto3.client('cloudtrail')

# Get the current CloudTrail configuration
response = cloudtrail.describe_trails()

# Check if CloudTrail logs are encrypted
for trail in response['trailList']:
    if not trail['KmsKeyId']:
        print(f"CloudTrail logs for trail {trail['Name']} are not encrypted.")
    else:
        print(f"CloudTrail logs for trail {trail['Name']} are encrypted with KMS key {trail['KmsKeyId']}.")

If the CloudTrail logs are not encrypted, you need to create a KMS key and enable encryption for CloudTrail. You can use the following code to create a KMS key and enable encryption for CloudTrail:

import boto3

# Create a KMS client
kms = boto3.client('kms')

# Create a KMS key
response = kms.create_key()

# Enable CloudTrail encryption with the KMS key
cloudtrail = boto3.client('cloudtrail')
cloudtrail.update_trail(
    Name='my-trail',
    KmsKeyId=response['KeyMetadata']['KeyId'],
    KmsKeyRegion=response['KeyMetadata']['AWSRegion']
)

Once CloudTrail encryption is enabled, you can verify that the logs are encrypted by running the first code snippet again.

Note: Make sure that you have the necessary IAM permissions to create KMS keys and update CloudTrail configurations.

Additional Reading:

https://docs.aws.amazon.com/awscloudtrail/latest/userguide/cloudtrail-log-file-encryption-cli.html

AWS Introduction

AWS Pricing

AWS Threats

AWS Misconfigurations

CloudTrail Logs Should Be Encrypted

More Info:

Risk Level

Address

Compliance Standards

Triage and Remediation

Remediation

Additional Reading:

AWS Introduction

AWS Pricing

AWS Threats

AWS Misconfigurations

​More Info:

​Risk Level

​Address

​Compliance Standards

​Triage and Remediation

​Remediation

​Additional Reading:

More Info:

Risk Level

Address

Compliance Standards

Triage and Remediation

Remediation

Additional Reading: