Back to Checks
iac

CloudTrail should use Customer managed keys to encrypt the logs

AWS-0015
Service: cloudtrailSeverity: high
OfficialBuilt-inVerified

Using AWS managed keys does not allow for fine grained control. Using Customer managed keys provides comprehensive control over cryptographic keys, enabling management of policies, permissions, and rotation, thus enhancing security and compliance measures for sensitive data and systems.

Prowler logoProwlerprowler-provider-iac

Run this check with Prowler

Run in Prowler Cloud
Run
prowler iac --checks AWS-0015

Recommendation

Use Customer managed key

Check Code

# METADATA
# title: CloudTrail should use Customer managed keys to encrypt the logs
# description: |
#  Using AWS managed keys does not allow for fine grained control.  Using Customer managed keys provides comprehensive control over cryptographic keys, enabling management of policies, permissions, and rotation, thus enhancing security and compliance measures for sensitive data and systems.
# scope: package
# schemas:
#   - input: schema["cloud"]
# related_resources:
#   - https://docs.aws.amazon.com/awscloudtrail/latest/userguide/encrypting-cloudtrail-log-files-with-aws-kms.html
#   - https://docs.aws.amazon.com/kms/latest/developerguide/concepts.html#key-mgmt
# custom:
#   id: AWS-0015
#   long_id: aws-cloudtrail-encryption-customer-managed-key
#   aliases:
#     - AVD-AWS-0015
#     - encryption-customer-managed-key
#     - aws-cloudtrail-encryption-customer-managed-key
#   provider: aws
#   service: cloudtrail
#   severity: HIGH
#   recommended_action: Use Customer managed key
#   input:
#     selector:
#       - type: cloud
#         subtypes:
#           - service: cloudtrail
#             provider: aws
#   examples: checks/cloud/aws/cloudtrail/encryption_customer_key.yaml
package builtin.aws.cloudtrail.aws0015

import rego.v1

import data.lib.cloud.metadata
import data.lib.cloud.value

deny contains res if {
	some trail in input.aws.cloudtrail.trails
	without_cmk(trail)
	res := result.new(
		"CloudTrail does not use a customer managed key to encrypt the logs.",
		metadata.obj_by_path(trail, ["kmskeyid"]),
	)
}

without_cmk(trail) if value.is_empty(trail.kmskeyid)

without_cmk(trail) if not trail.kmskeyid

References