AWS CloudTrail logs are not encrypted using Customer Master Keys (CMKs) misconfiguration detected in

Rule Details

Cortex AppSec Rule ID	APPSEC_AWS_35
Category - Subcategory	Storage - Encryption
Provider	AWS
Severity	LOW
Framework	CloudFormation, Serverless, Terraform, Terraform Plan
Mapped CSPM/KSPM Rule	c2b84f89-7ec8-473e-a6af-404feeeb96c5

Impact

Checks to ensure that CloudTrail logs are encrypted. AWS CloudTrail is a service that enables governance, compliance, operational & risk auditing of the AWS account. It is a compliance and security best practice to encrypt the CloudTrail data since it may contain sensitive information.

How to Fix

To fix this issue, ensure that the KMSKeyId property in the AWS::CloudTrail::Trail resource is set to a valid KMS key ID or ARN. [source,go]

Resources: myTrail: Type: AWS::CloudTrail::Trail Properties: ...

• KMSKeyId: alias/MyAliasName

---