Policy Setting: AWS > CloudTrail > Trail > Encryption at Rest

resource "turbot_policy_setting" "aws_cloudtrail_trail_encryption_at_rest" {
  resource = turbot_policy_pack.main.id
  type     = "tmod:@turbot/aws-cloudtrail#/policy/types/trailEncryptionAtRest"
  note     = "AWS CIS v3.0.0 - Controls: 3.5"
  value    = "Check: Encryption at Rest > Customer Managed Key"
  # value    = "Enforce: Encryption at Rest > Customer Managed Key"
}