Description
CloudTrail encrypts logs with S3-managed keys by default. Specifying a KMS key adds separate key-policy and usage-audit controls; omitting it does not mean logs are stored in plaintext.
Potential impact
An environment requiring customer-managed keys may lack the required key-access or audit controls.
Remediation
Set kms_key_id when a customer-managed KMS key is required. Check CloudTrail’s encryption permissions, readers’ decryption permissions, and the bucket policy together.
Examples
The configured example specifies a KMS key. The alias must identify an actual key; configure the log bucket and related role permissions separately.
Before
yaml
- name: Create CloudTrail
community.aws.cloudtrail:
state: present
name: default
s3_bucket_name: mylogbucket
s3_key_prefix: cloudtrail
region: us-east-1
After
yaml
- name: Create CloudTrail
community.aws.cloudtrail:
state: present
name: default
s3_bucket_name: mylogbucket
region: us-east-1
is_multi_region_trail: true
enable_log_file_validation: true
cloudwatch_logs_role_arn: arn:aws:iam::123456789012:role/CloudTrail_CloudWatchLogs_Role
cloudwatch_logs_log_group_arn: arn:aws:logs:us-east-1:123456789012:log-group:CloudTrail/DefaultLogGroup:*
kms_key_id: alias/MyAliasName