Skip to main content

CloudTrail Logs Should Be Encrypted

More Info:​

Your CloudTrail logs should be encrypted at rest using server-side encryption provided by AWS KMS–Managed Keys (SSE-KMS) to enhance the security of your CloudTrail bucket

Risk Level​

Medium

Address​

Security

Compliance Standards​

  • APRA CPS 234 (Australia)
  • AWS Startup Security Baseline
  • AWS Well Architected Framework
  • BSI C5 (Germany)
  • Brazil LGPD
  • CCPA / CPRA (California)
  • CIS AWS
  • CIS Critical Security Controls v8
  • CMMC 2.0
  • CSA Cloud Controls Matrix v4
  • Cloudanix Best Practice
  • DPDPA
  • Digital Operational Resilience Act (EU)
  • GDPR
  • HIPAA
  • ISO/IEC 27017
  • ISO/IEC 27018
  • ISO/IEC 27701
  • KSA PDPL
  • MAS Technology Risk Management (Singapore)
  • MITRE ATT&CK (Cloud)
  • NIS2 Directive
  • NIST
  • NIST SP 800-171
  • NYDFS 23 NYCRR 500
  • PCI
  • Reserve Bank of India (RBI) Cyber Security Framework
  • SOC2
  • SWIFT Customer Security Controls Framework
  • Sarbanes-Oxley IT General Controls
  • Securities and Exchange Board of India (SEBI) - Cloud Security Adoption Framework
  • StateRAMP
  • UK NCSC Cyber Assessment Framework

Triage and Remediation​

Remediation​

Using Console

To remediate the misconfiguration of unencrypted CloudTrail logs in AWS, follow these steps:

  1. Login to the AWS Management Console.
  2. Navigate to the CloudTrail service page.
  3. Select the trail that you want to modify, and click on "Edit" button.
  4. In the "Advanced" section, enable the "Enable log file encryption" option.
  5. Choose the AWS KMS key that you want to use for encryption.
  6. Click on "Save" button to save the changes.

Once the above steps are completed, the CloudTrail logs will be encrypted with the specified AWS KMS key. This will ensure that the logs are secure and protected from unauthorized access.

Using CLI

To remediate the misconfiguration of unencrypted AWS CloudTrail logs using AWS CLI, follow the below steps:

  1. Open the AWS CLI on your local machine and run the following command to enable CloudTrail log encryption:
aws cloudtrail update-trail --name <trail_name> --kms-id <kms_key_id> --enable-log-file-encryption

Replace <trail_name> with the name of the CloudTrail trail that you want to encrypt, and <kms_key_id> with the ID of the KMS key that you want to use for encryption.

  1. Verify that CloudTrail log encryption is enabled by running the following command:
aws cloudtrail describe-trails --trail-name-list <trail_name> --query "trailList[*].{Name:Name, KmsKeyId:KmsKeyId, IsLogFileEncryptionEnabled:IsLogFileEncryptionEnabled}"

Replace <trail_name> with the name of the CloudTrail trail that you want to verify.

  1. Check the AWS CloudTrail console to ensure that the CloudTrail logs are being encrypted.

By following these steps, you can remediate the misconfiguration of unencrypted AWS CloudTrail logs using AWS CLI.

Using Python

To remediate the misconfiguration of unencrypted CloudTrail logs in AWS using Python, you can follow these steps:

  1. First, you need to check if CloudTrail logs are encrypted or not. For this, you can use the AWS SDK for Python (Boto3) and run the following code:
import boto3

# Create a CloudTrail client
cloudtrail = boto3.client('cloudtrail')

# Get the current CloudTrail configuration
response = cloudtrail.describe_trails()

# Check if CloudTrail logs are encrypted
for trail in response['trailList']:
    if not trail['KmsKeyId']:
        print(f"CloudTrail logs for trail {trail['Name']} are not encrypted.")
    else:
        print(f"CloudTrail logs for trail {trail['Name']} are encrypted with KMS key {trail['KmsKeyId']}.")
  1. If the CloudTrail logs are not encrypted, you need to create a KMS key and enable encryption for CloudTrail. You can use the following code to create a KMS key and enable encryption for CloudTrail:
import boto3

# Create a KMS client
kms = boto3.client('kms')

# Create a KMS key
response = kms.create_key()

# Enable CloudTrail encryption with the KMS key
cloudtrail = boto3.client('cloudtrail')
cloudtrail.update_trail(
    Name='my-trail',
    KmsKeyId=response['KeyMetadata']['KeyId'],
    KmsKeyRegion=response['KeyMetadata']['AWSRegion']
)
  1. Once CloudTrail encryption is enabled, you can verify that the logs are encrypted by running the first code snippet again.

Note: Make sure that you have the necessary IAM permissions to create KMS keys and update CloudTrail configurations.

Using Terraform
# KMS key for encrypting CloudTrail logs
resource "aws_kms_key" "cloudtrail_logs" {
  description             = "Key for CloudTrail log encryption"
  enable_key_rotation     = true

  policy = jsonencode({
    Version = "2012-10-17"
    Statement = [
      # Allow the account root to administer the key
      {
        Sid      = "Enable IAM User Permissions"
        Effect   = "Allow"
        Principal = {
          AWS = "arn:aws:iam::${data.aws_caller_identity.current.account_id}:root"
        }
        Action   = "kms:*"
        Resource = "*"
      },
      # Allow CloudTrail to use the key for log encryption/decryption
      {
        Sid    = "Allow CloudTrail to encrypt logs"
        Effect = "Allow"
        Principal = {
          Service = "cloudtrail.amazonaws.com"
        }
        Action = [
          "kms:Encrypt",
          "kms:Decrypt",
          "kms:ReEncrypt*",
          "kms:GenerateDataKey*",
          "kms:DescribeKey"
        ]
        Resource = "*"
        Condition = {
          StringLike = {
            "kms:EncryptionContext:aws:cloudtrail:arn" = "arn:aws:cloudtrail:*:${data.aws_caller_identity.current.account_id}:trail/*"
          }
        }
      }
    ]
  })
}

data "aws_caller_identity" "current" {}

# CloudTrail trail with SSE-KMS encryption enabled
resource "aws_cloudtrail" "this" {
  name                          = "CLOUDTRAIL_TRAIL_NAME"            # replace with your trail name
  s3_bucket_name                = "CLOUDTRAIL_LOG_BUCKET_NAME"       # replace with your log bucket
  is_multi_region_trail         = true
  enable_log_file_validation    = true
  include_global_service_events = true

  kms_key_id = aws_kms_key.cloudtrail_logs.arn
}

Updating an existing aws_cloudtrail to set kms_key_id is an in-place change and should not replace the trail, but it will cause new log files to be written encrypted with this KMS key; ensure no conflicting encryption settings exist on the S3 bucket policy.

To verify, terraform plan should show:

  • aws_kms_key.cloudtrail_logs being created, and
  • aws_cloudtrail.this updated in-place with kms_key_id changing from null (or a different key) to the ARN of aws_kms_key.cloudtrail_logs.

Additional Reading:​