CloudTrail logs should be encrypted at rest using KMS CMKs

문서 > Datadog 보안 > OOTB Rules > CloudTrail logs should be encrypted at rest using KMS CMKs

이 페이지는 아직 영어로 제공되지 않습니다. 번역 작업 중입니다.
현재 번역 프로젝트에 대한 질문이나 피드백이 있으신 경우 언제든지 연락주시기 바랍니다.

Description

AWS CloudTrail records AWS API calls, and configuring it to use AWS Key Management Service (KMS) for server-side encryption (SSE) enhances log security. KMS uses Hardware Security Modules (HSMs) for key protection, adding confidentiality controls. Setting up CloudTrail with SSE-KMS ensures only authorized users with S3 read and CMK decrypt permissions can access the logs.

Remediation

For instructions on configuring CloudTrail to use SSE-KMS, refer to the CloudTrail Log File Encryption Guide.