CloudTrail logs are not encrypted with KMS

Severity: Medium
Service: CloudTrail
Check ID: CLOUDTRAIL_ENCRYPTION_DISABLED

What this check finds

CloudTrail logs written to S3 are unencrypted by default. Encrypting with a customer-managed KMS key ensures that only principals with explicit kms:Decrypt permission can read audit logs, adding a critical layer of access control on top of S3 bucket policies. CIS v5.0 §3.5.

Passing looks like: CloudTrail logs encrypted with KMS.

How to fix it

Enable KMS encryption on the CloudTrail trail.

AWS CLI

aws cloudtrail update-trail --name TRAIL_NAME --kms-key-id KEY_ARN

Names in capitals are placeholders for your own resource. Review a command before you run it.

AWS console

CloudTrail → Trails → select trail → Edit → Log file SSE-KMS encryption → Enabled → select or create a CMK.

Compliance controls it is evidence for

A failing result counts against these controls in KloudLytics; a passing one is evidence towards them. How compliance mapping works

Compliance controls mapped to CloudTrail logs are not encrypted with KMS
Framework	Controls
CIS AWS Foundations Benchmark v5.0.0	3.5 Ensure CloudTrail logs are encrypted at rest using KMS CMKs
PCI-DSS v4.0.1	10.3 Audit logs are protected from destruction and unauthorized modifications
HIPAA Security Rule	164.312(c)(1) Implement policies to protect ePHI from improper alteration or destruction
SOC 2 — Trust Services Criteria	CC6.7 Encryption and Secret Management
NIST SP 800-53 Rev5 (Moderate)	AU-9 Protection of Audit Information SC-13 Cryptographic Protection SC-28 Protection of Information at Rest
NIST Cybersecurity Framework 2.0	PR.DS-01 Data-at-rest is protected PR.PS-04 Log records are generated for monitoring
ISO/IEC 27001:2022 Annex A	A.5.28 Collection of evidence A.8.15 Logging A.8.24 Use of cryptography

Checked on every scan

KloudLytics runs this check each time it scans a connected AWS account, through a read-only role, and lists every affected resource with its region. On Pro and Business a fix is written for the specific resource rather than the general case above. The exact access it needs

More CloudTrail checks

All CloudTrail checks