lacework-global-77
Encrypt CloudTrail logs at rest using Customer-Managed Key Management Service (KMS) Keys (Automated)
Profile Applicability
• Level 2
Description
AWS CloudTrail is a web service that records AWS API calls for an account and makes those logs available to users and resources in accordance with Identity and Access Management (IAM) policies. AWS Key Management Service (KMS) is a managed service that helps create and control the encryption keys used to encrypt account data, and uses Hardware Security Modules (HSMs) to protect the security of encryption keys. It is possible to configure CloudTrail logs to leverage Server-Side Encryption (SSE) and customer-managed KMS keys to further protect CloudTrail logs. Best practices recommended configuring CloudTrail to use SSE-KMS.
Rationale
Configuring CloudTrail to use SSE-KMS provides additional confidentiality controls on log data as a given user must have S3 read permission on the corresponding log bucket and must be granted decrypt permission by the CMK policy.
Impact
Customer created keys incur an additional cost. See https://aws.amazon.com/kms/pricing/ for more information.
Audit
Perform the following to determine if CloudTrail is configured to use SSE-KMS:
From Console
- Sign in to the AWS Management Console and open the CloudTrail console at https://console.aws.amazon.com/cloudtrail
- In the left navigation pane, choose
Trails
. - Select a Trail
- Under the
S3
section, ensureEncrypt log files
is set toYes
and a KMS key ID is specified in theKMS Key Id
field.
From Command Line
Run the following command:
aws cloudtrail describe-trails
For each trail listed, SSE-KMS is enabled if the trail has a
KmsKeyId
property defined.
Remediation
Perform the following to configure CloudTrail to use SSE-KMS:
From Console
- Sign in to the AWS Management Console and open the CloudTrail console at https://console.aws.amazon.com/cloudtrail.
- In the left navigation pane, choose
Trails
. - Click a Trail.
- Under the
S3
section click the edit button (pencil icon). - Click
Advanced
. - Select an existing KMS key from the
KMS key Id
drop-down menu:- Ensure the KMS key is in the same region as the S3 bucket
- You need to apply a KMS Key policy on the selected KMS key in order for CloudTrail as a service to encrypt and decrypt log files using the KMS key provided. Steps are here (https://docs.aws.amazon.com/awscloudtrail/latest/userguide/create-kms-key-policy-for-cloudtrail.html) for editing the selected KMS Key policy
- Click
Save
. - At the notification message stating that you need to have decrypt permissions on the specified KMS key to decrypt log files, click
Yes
.
From Command Line
aws cloudtrail update-trail --name <trail_name> --kms-id <cloudtrail_kms_key>
aws kms put-key-policy --key-id <cloudtrail_kms_key> --policy <cloudtrail_kms_key_policy>
References
CCE-78919-8
https://docs.aws.amazon.com/awscloudtrail/latest/userguide/encrypting-cloudtrail-log-files-with-aws-kms.html
https://docs.aws.amazon.com/kms/latest/developerguide/create-keys.html
Additional Information
3 statements the KMS key policy must have:
Enable Cloudtrail to describe KMS key properties:
{
"Sid": "Allow CloudTrail access",
"Effect": "Allow",
"Principal": {
"Service": "cloudtrail.amazonaws.com"
},
"Action": "kms:DescribeKey",
"Resource": "*"
}Granting encrypt permissions:
{
"Sid": "Allow CloudTrail to encrypt logs",
"Effect": "Allow",
"Principal": {
"Service": "cloudtrail.amazonaws.com"
},
"Action": "kms:GenerateDataKey*",
"Resource": "*",
"Condition": {
"StringLike": {
"kms:EncryptionContext:aws:cloudtrail:arn": [
"arn:aws:cloudtrail:*:aws-account-id:trail/*"
]
}
}
}Granting decrypt permissions:
{
"Sid": "Enable CloudTrail log decrypt permissions",
"Effect": "Allow",
"Principal": {
"AWS": "arn:aws:iam::aws-account-id:user/username"
},
"Action": "kms:Decrypt",
"Resource": "*",
"Condition": {
"Null": {
"kms:EncryptionContext:aws:cloudtrail:arn": "false"
}
}
}