Control: AWS > CIS v1.4 > 3 - Logging > 3.07 - Ensure CloudTrail logs are encrypted at rest using KMS CMKs (Automated)

Configures auditing against a CIS Benchmark item.

Level: 2 (Scored)

AWS CloudTrail is a web service that records AWS API calls for an account and makes those logs available to users and resources in accordance with IAM policies. AWS Key Management Service (KMS) is a managed service that helps create and control the encryption keys used to encrypt account data, and uses Hardware Security Modules (HSMs) to protect the security of encryption keys. CloudTrail logs can be configured to leverage server side encryption (SSE) and KMS customer created master keys (CMK) to further protect CloudTrail logs. It is recommended that CloudTrail be configured to use SSE-KMS.

Resource Types

This control targets the following resource types:

AWS > CloudTrail > Trail

Policies

This control type relies on these other policies when running actions:

In Your Workspace

Developers

Control Type URI

tmod:@turbot/aws-cisv1-4#/control/types/r0307

Category URI

tmod:@turbot/cis#/control/categories/v071408

GraphQL

query controlType(id: "tmod:@turbot/aws-cisv1-4#/control/types/r0307") { … }

query controls(filter: "controlTypeId:'tmod:@turbot/aws-cisv1-4#/control/types/r0307'") { … }

CLI

Get Controls

turbot graphql controls --filter "controlTypeId:tmod:@turbot/aws-cisv1-4#/control/types/r0307"