Data protectionEnsure CloudTrail logs are encrypted at rest using KMS CMKs
Platform(s)
Compliance Frameworks
- AWS CIS ,
- AWS Foundational Security Best Practices Controls ,
- Brazilian General Data Protection (LGPD) ,
- CCM-CSA ,
- CCPA ,
- cis_8 ,
- coppa ,
- CPRA ,
- CSA CCM ,
- Data Security Posture Management (DSPM) Best Practices ,
- essential_8_au ,
- GDPR ,
- hdh ,
- HITRUST ,
- ISO 27701 ,
- iso_27001_2022 ,
- iso_27002_2022 ,
- Mitre ATT&CK ,
- mpa ,
- New Zealand Information Security Manual ,
- NIST 800-171 ,
- NIST 800-53 ,
- Orca Best Practices ,
- PDPA ,
- pipeda ,
- UK Cyber Essentials
Description
AWS CloudTrail is a web service that records AWS API calls for an account and makes those logs available to users and resources in accordance with IAM policies. AWS Key Management Service (KMS) is a managed service that helps create and control the encryption keys used to encrypt account data, and uses Hardware Security Modules (HSMs) to protect the security of encryption keys. CloudTrail logs can be configured to leverage server side encryption (SSE) and KMS customer created master keys (CMK) to further protect CloudTrail logs. It is recommended that CloudTrail be configured to use SSE-KMS.
Personalized Demo
See Orca Security in Action
Gain visibility, achieve compliance, and prioritize risks with the Orca Cloud Security Platform.