Rule: CloudTrail Trail Logs Encrypted with KMS CMK
This rule ensures that CloudTrail trail logs are encrypted with KMS CMK for enhanced security measures.
| Rule | CloudTrail trail logs should be encrypted with KMS CMK |
| Framework | GxP EU Annex 11 |
| Severity | ✔ Critical |
Ensure CloudTrail Trail Logs are Encrypted with KMS CMK in Compliance with GxP EU Annex 11
Overview
GxP EU Annex 11 compliance requires that electronic records are protected. Encrypting AWS CloudTrail logs with a KMS Customer Master Key (CMK) ensures the integrity and confidentiality of log data. Enforcing encryption of CloudTrail logs is a step towards meeting regulatory requirements.
Importance of Encryption for Compliance
- Protects sensitive data in transit and at rest.
- Ensures the integrity and confidentiality of audit logs.
- Mitigates the risk of unauthorized data access.
Configuring CloudTrail Log Encryption with KMS CMK
Step 1: Verify Existing Trails
CLI Command
aws cloudtrail describe-trails
- Check if any trails exist. If not, create one before proceeding.
Step 2: Create a KMS CMK
CLI Command
aws kms create-key --description "CloudTrail/GxP Annex 11 key"
- This will generate a CMK that you can use to encrypt CloudTrail logs.
Step 3: Assign Alias to KMS CMK
CLI Command
aws kms create-alias --alias-name alias/CloudTrailGxPKey --target-key-id <Key ID from previous step>
- Replace
with the generated Key ID.<Key ID from previous step>
Step 4: Enable Log File Validation
CLI Command
aws cloudtrail update-trail --name <Your Trail Name> --enable-log-file-validation
- Replace
with your CloudTrail name.<Your Trail Name>
Step 5: Apply KMS CMK Encryption to CloudTrail
CLI Command
aws cloudtrail update-trail --name <Your Trail Name> --kms-key-id <Key ID>
- Replace
with your CloudTrail name and<Your Trail Name>
with the Key ID from step 2.<Key ID>
Troubleshooting
Trail Not Logging Events
- Validate that your trail is properly configured and set to an active state.
- Ensure the S3 bucket policy allows CloudTrail to write logs.
CloudTrail Logs Not Encrypted
- Check if KMS CMK is associated with CloudTrail.
- Ensure no policy is preventing CloudTrail from using KMS.
Access Denied Errors with KMS
- Ensure that the IAM policy includes permissions to use the KMS CMK.
- Review the KMS key policy to confirm proper permissions are in place.
Remediation
- Reapply the correct KMS CMK encryption using the update-trail CLI command if any errors are encountered.
- If CloudTrail or KMS permissions are misconfigured, review and adjust the policies accordingly.
Final Steps
- Regularly monitor CloudTrail and KMS CMK to ensure ongoing compliance.
- Run compliance auditing tools or scripts to check the encryption status of CloudTrail logs periodically.
Conclusion
Encrypting CloudTrail logs with a KMS CMK is essential for GxP EU Annex 11 compliance. By following the steps provided, you can secure your trail logs in accordance with regulatory standards, enhancing the security posture of your AWS environment.