01 Define the key policy that enables Amazon CloudTrail to encrypt log files using the KMS API. Create a new policy document (JSON format), name the file sse-kms-cmk-policy.json, and paste the following content (replace the highlighted details with your own AWS account details):
{
"Version": "2012-10-17",
"Id": "sse-kms-key-policy",
"Statement": [
{
"Sid": "Enable IAM User Permissions",
"Effect": "Allow",
"Principal": {
"AWS": "arn:aws:iam::<aws-account-id>:root"
},
"Action": "kms:*",
"Resource": "*"
},
{
"Sid": "Allow CloudTrail to encrypt logs",
"Effect": "Allow",
"Principal": {
"Service": "cloudtrail.amazonaws.com"
},
"Action": "kms:GenerateDataKey*",
"Resource": "*",
"Condition": {
"StringLike": {
"kms:EncryptionContext:aws:cloudtrail:arn": "arn:aws:cloudtrail:*:<aws-account-id>:trail/*"
}
}
},
{
"Sid": "Allow CloudTrail to describe key",
"Effect": "Allow",
"Principal": {
"Service": "cloudtrail.amazonaws.com"
},
"Action": "kms:DescribeKey",
"Resource": "*"
},
{
"Sid": "Allow principals in the account to decrypt log files",
"Effect": "Allow",
"Principal": {
"AWS": "*"
},
"Action": [
"kms:Decrypt",
"kms:ReEncryptFrom"
],
"Resource": "*",
"Condition": {
"StringEquals": {
"kms:CallerAccount": "<aws-account-id>"
},
"StringLike": {
"kms:EncryptionContext:aws:cloudtrail:arn": "arn:aws:cloudtrail:*:<aws-account-id>:trail/*"
}
}
},
{
"Sid": "Enable cross account log decryption",
"Effect": "Allow",
"Principal": {
"AWS": "*"
},
"Action": [
"kms:Decrypt",
"kms:ReEncryptFrom"
],
"Resource": "*",
"Condition": {
"StringEquals": {
"kms:CallerAccount": "<aws-account-id>"
},
"StringLike": {
"kms:EncryptionContext:aws:cloudtrail:arn": "arn:aws:cloudtrail:*:<aws-account-id>:trail/*"
}
}
}
]
}
02 Run create-key command (OSX/Linux/UNIX) using the policy document created at the previous step (i.e. sse-kms-cmk-policy.json) as value for the --policy parameter, to create your new Amazon KMS Customer Master Key (CMK). The new CMK must be in the same AWS region as the S3 bucket that receives your CloudTrail log files:
aws kms create-key
--region us-east-1
--description 'Customer Master Key for CloudTrail Log File Encryption'
--policy file://sse-kms-cmk-policy.json
--query 'KeyMetadata.Arn'
03 The command output should return the ARN of the new Customer Master Key (CMK):
"arn:aws:kms:us-east-1:123456789012:key/abcd1234-abcd-1234-abcd-1234abcd1234"
04 Run create-alias command (OSX/Linux/UNIX) using the key ARN returned at the previous step to attach an alias to the new CMK. The alias must start with the prefix "alias/" (the command should not produce an output):
aws kms create-alias
--region us-east-1
--alias-name alias/TrailLogCMK
--target-key-id arn:aws:kms:us-east-1:123456789012:key/abcd1234-abcd-1234-abcd-1234abcd1234
05 Run update-trail command (OSX/Linux/UNIX) using the name of the Amazon CloudTrail trail that you want to reconfigure as the identifier parameter, to enable SSE-KMS encryption for the selected trail using your new Amazon KMS Customer Master Key (CMK):
aws cloudtrail update-trail
--region us-east-1
--name cc-project5-api-trail
--kms-key-id arn:aws:kms:us-east-1:123456789012:key/abcd1234-abcd-1234-abcd-1234abcd1234
06 The command output should return the metadata available for the reconfigured trail:
{
"IncludeGlobalServiceEvents": true,
"IsOrganizationTrail": false,
"Name": "cc-project5-api-trail",
"TrailARN": "arn:aws:cloudtrail:us-east-1:123456789012:trail/cc-project5-api-trail",
"LogFileValidationEnabled": false,
"IsMultiRegionTrail": true,
"S3BucketName": "cc-main-cloudtrail-logs",
"KmsKeyId": "arn:aws:kms:us-east-1:123456789012:key/abcd1234-abcd-1234-abcd-1234abcd1234"
}
07 Repeat steps no. 1 – 6 for each Amazon CloudTrail trail that you want to reconfigure, available in your AWS cloud account.
Security