Policy: AWS > Turbot > Audit Trail > CloudTrail > Trail > Encryption Key

The KMS key ID that encrypts the logs delivered by CloudTrail. The value is a fully specified ARN to a KMS key in the format: arn:aws:kms:us-east-2:123456789012:key/12345678-1234-1234-1234-123456789012

If a key is specified in this policy, SSE-KMS encryption will be enabled with this key. If the Encryption Key policy is blank, the default (SSE-S3) encryption will be used.

The key will not be created in this stack - it must already exist and CloudTrail must have the correct permissions to use the key. Guardrails will not modify the key policy.

Resource Types

This policy targets the following resource types:

AWS > Region

Primary Policy

This policy is used with the following primary policy:

AWS > Turbot > Audit Trail > CloudTrail > Trail

Controls

Policy Packs

This policy setting is used by the following policy packs:

AWS CIS v3.0.0 - Section 3 - Logging

Policy Specification

Schema Type	`string`

In Your Workspace

Policy Settings by Type report

Developers

Category URI

tmod:@turbot/turbot#/control/categories/resourceLogging

Policy Type URI

tmod:@turbot/aws#/policy/types/trailEncryptionKey

GraphQL

query policyType(id: "tmod:@turbot/aws#/policy/types/trailEncryptionKey") { … }

query policySettings(filter: "policyTypeId:'tmod:@turbot/aws#/policy/types/trailEncryptionKey'") { … }

query policyValues(filter: "policyTypeId:'tmod:@turbot/aws#/policy/types/trailEncryptionKey'") { … }

CLI

Get Policy Type

turbot graphql policy-type --id "tmod:@turbot/aws#/policy/types/trailEncryptionKey"

Get Policy Settings

turbot graphql policy-settings --filter "policyTypeId:tmod:@turbot/aws#/policy/types/trailEncryptionKey"