Project: KICS (Provisioning / Security & Compliance)
File: 050a9ba8-d1cb-4c61-a5e8-8805a70d3b85.md

title: CloudTrail Log Files Not Encrypted With KMS hide: toc: true navigation: true <style> .highlight .hll { background-color: #ff171742; } .md-content { max-width: 1100px; margin: 0 auto; } </style> Query id: 050a9ba8-d1cb-4c61-a5e8-8805a70d3b85 Query name: CloudTrail Log Files Not Encrypted With KMS Platform: CloudFormation Severity: <span style="color:#edd57e">Low</span> Category: Encryption URL: Logs delivered by CloudTrail should be encrypted using KMS to increase security of your CloudTrail<br> ```yaml title="Positive test num. 1 - yaml file" hl_lines="62" AWSTemplateFormatVersion: "2010-09-09" Parameters: OperatorEmail: Description: "Email address to notify when new logs are published." Type: String Resources: S3Bucket: DeletionPolicy: Retain Type: AWS::S3::Bucket Properties: {} BucketPolicy: Type: AWS::S3::BucketPolicy Properties: Bucket: Ref: S3Bucket PolicyDocument: Version: "2012-10-17" Statement: Sid: "AWSCloudTrailAclCheck" Effect: "Allow" Principal: Service: "cloudtrail.amazonaws.com" Action: "s3:GetBucketAcl" Resource: !Sub |- arn:aws:s3:::${S3Bucket} Sid: "AWSCloudTrailWrite" Effect: "Allow" Principal: Service: "cloudtrail.amazonaws.com" Action: "s3:PutObject" Resource: !Sub |- arn:aws:s3:::${S3Bucket}/AWSLogs/${AWS::AccountId}/* Condition: StringEquals: s3:x-amz-acl: "bucket-owner-full-control" Topic: Type: AWS::SNS::Topic Properties: Subscription: Endpoint: Ref: OperatorEmail Protocol: email TopicPolicy: Type: AWS::SNS::TopicPolicy Properties: Topics: Ref: "Topic" PolicyDocument: Version: "2008-10-17" Statement: Sid: "AWSCloudTrailSNSPolicy" Effect: "Allow" Principal: Service: "cloudtrail.amazonaws.com" Resource: "*" Action: "SNS:Publish" myTrail: DependsOn: BucketPolicy TopicPolicy Type: AWS::CloudTrail::Trail Properties: S3BucketName: Ref: S3Bucket SnsTopicName: Fn::GetAtt: Topic TopicName IsLogging: true IsMultiRegionTrail: true ``` ```json title="Positive test num. 2 - json file" hl_lines="53" { "AWSTemplateFormatVersion": "2010-09-09", "Parameters": { "OperatorEmail": { "Description": "Email address to notify when new logs are published.", "Type": "String" } }, "Resources": { "Topic": { "Type": "AWS::SNS::Topic", "Properties": { "Subscription": [ { "Endpoint": { "Ref": "OperatorEmail" }, "Protocol": "email" } ] } }, "TopicPolicy": { "Type": "AWS::SNS::TopicPolicy", "Properties": { "Topics": [ { "Ref": "Topic" } ], "PolicyDocument": { "Version": "2008-10-17", "Statement": [ { "Sid": "AWSCloudTrailSNSPolicy", "Effect": "Allow", "Principal": { "Service": "cloudtrail.amazonaws.com" }, "Resource": "*", "Action": "SNS:Publish" } ] } } }, "myTrail": { "DependsOn": [ "BucketPolicy", "TopicPolicy" ], "Type": "AWS::CloudTrail::Trail", "Properties": { "S3BucketName": { "Ref": "S3Bucket" }, "SnsTopicName": { "Fn::GetAtt": [ "Topic", "TopicName" ] }, "IsLogging": true, "IsMultiRegionTrail": true } }, "S3Bucket": { "DeletionPolicy": "Retain", "Type": "AWS::S3::Bucket", "Properties": {} }, "BucketPolicy": { "Type": "AWS::S3::BucketPolicy", "Properties": { "Bucket": { "Ref": "S3Bucket" }, "PolicyDocument": { "Version": "2012-10-17", "Statement": [ { "Sid": "AWSCloudTrailAclCheck", "Effect": "Allow", "Principal": { "Service": "cloudtrail.amazonaws.com" }, "Action": "s3:GetBucketAcl", "Resource": "arn:aws:s3:::${S3Bucket}" }, { "Sid": "AWSCloudTrailWrite", "Effect": "Allow", "Principal": { "Service":

}, "Action": "s3:PutObject", "Resource": "arn:aws:s3:::${S3Bucket}/AWSLogs/${AWS::AccountId}/*", "Condition": { "StringEquals": { "s3:x-amz-acl": "bucket-owner-full-control" } } } ] } } } } } ``` ```json title="Positive test num. 3 - json file" hl_lines="6" { "AWSTemplateFormatVersion": "2010-09-09", "Resources": { "myTrail": { "Type": "AWS::CloudTrail::Trail", "Properties": { "SnsTopicName": "", "IsLogging": false, "IsMultiRegionTrail": false, "KMSKeyId": "", "EnableLogFileValidation": false } } } } ``` ```yaml title="Negative test num. 1 - yaml file" AWSTemplateFormatVersion: "2010-09-09" Parameters: OperatorEmail: Description: "Email address to notify when new logs are published." Type: String Resources: S3Bucket: DeletionPolicy: Retain Type: AWS::S3::Bucket Properties: {} BucketPolicy: Type: AWS::S3::BucketPolicy Properties: Bucket: Ref: S3Bucket PolicyDocument: Version: "2012-10-17" Statement: Sid: "AWSCloudTrailAclCheck" Effect: "Allow" Principal: Service: "cloudtrail.amazonaws.com" Action: "s3:GetBucketAcl" Resource: !Sub |- arn:aws:s3:::${S3Bucket} Sid: "AWSCloudTrailWrite" Effect: "Allow" Principal: Service: "cloudtrail.amazonaws.com" Action: "s3:PutObject" Resource: !Sub |- arn:aws:s3:::${S3Bucket}/AWSLogs/${AWS::AccountId}/* Condition: StringEquals: s3:x-amz-acl: "bucket-owner-full-control" Topic: Type: AWS::SNS::Topic Properties: Subscription: Endpoint: Ref: OperatorEmail Protocol: email TopicPolicy: Type: AWS::SNS::TopicPolicy Properties: Topics: Ref: "Topic" PolicyDocument: Version: "2008-10-17" Statement: Sid: "AWSCloudTrailSNSPolicy" Effect: "Allow" Principal: Service: "cloudtrail.amazonaws.com" Resource: "*" Action: "SNS:Publish" myTrail: DependsOn: BucketPolicy TopicPolicy Type: AWS::CloudTrail::Trail Properties: KMSKeyId: arn:aws:kms:us-east-2:123456789012:key/12345678-1234-1234-1234-123456789012 S3BucketName: Ref: S3Bucket SnsTopicName: Fn::GetAtt: Topic TopicName IsLogging: true IsMultiRegionTrail: true ``` ```json title="Negative test num. 2 - json file" { "AWSTemplateFormatVersion": "2010-09-09", "Parameters": { "OperatorEmail": { "Description": "Email address to notify when new logs are published.", "Type": "String" } }, "Resources": { "TopicPolicy": { "Properties": { "Topics": [ { "Ref": "Topic" } ], "PolicyDocument": { "Version": "2008-10-17", "Statement": [ { "Sid": "AWSCloudTrailSNSPolicy", "Effect": "Allow", "Principal": { "Service": "cloudtrail.amazonaws.com" }, "Resource": "*", "Action": "SNS:Publish" } ] } }, "Type": "AWS::SNS::TopicPolicy" }, "myTrail": { "DependsOn": [ "BucketPolicy", "TopicPolicy" ], "Type": "AWS::CloudTrail::Trail", "Properties": { "KMSKeyId": "arn:aws:kms:us-east-2:123456789012:key/12345678-1234-1234-1234-123456789012", "S3BucketName": { "Ref": "S3Bucket" }, "SnsTopicName": { "Fn::GetAtt": [ "Topic", "TopicName" ] }, "IsLogging": true, "IsMultiRegionTrail": true } }, "S3Bucket": { "DeletionPolicy": "Retain", "Type": "AWS::S3::Bucket", "Properties": {} }, "BucketPolicy": { "Type": "AWS::S3::BucketPolicy", "Properties": { "Bucket": { "Ref": "S3Bucket" }, "PolicyDocument": { "Version": "2012-10-17", "Statement": [ { "Sid": "AWSCloudTrailAclCheck", "Effect": "Allow", "Principal": { "Service": "cloudtrail.amazonaws.com" }, "Action": "s3:GetBucketAcl", "Resource": "arn:aws:s3:::${S3Bucket}" }, { "Action": "s3:PutObject", "Resource": "arn:aws:s3:::${S3Bucket}/AWSLogs/${AWS::AccountId}/*", "Condition": { "StringEquals": { "s3:x-amz-acl": "bucket-owner-full-control" } }, "Sid": "AWSCloudTrailWrite", "Effect": "Allow", "Principal": { "Service": "cloudtrail.amazonaws.com" } } ] } } }, "Topic": { "Type": "AWS::SNS::Topic", "Properties": { "Subscription": [ { "Endpoint": { "Ref": "OperatorEmail" }, "Protocol": "email" } ] } } } } ```