Skip to content

CloudTrail KMS Policies

  1. Enable CloudTrail log encrypt permissions. See Granting encrypt permissions.
  2. Enable CloudTrail log decrypt permissions. See Grantind decrypt permissions.
  3. Enable CloudTrail to describe KMS key properties. See Enable CloudTrail to describe KMS key properties.

AWS Documentation

Granting encrypt permissions

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
{
    "Sid": "Allow CloudTrail to encrypt logs",
    "Effect": "Allow",
    "Principal": {
        "Service": "cloudtrail.amazonaws.com"
    },
    "Action": "kms:GenerateDataKey*",
    "Resource": "arn:aws:kms:<region code>:<account id>:key/<kms key id>",
    "Condition": {
        "StringLike": {
            "kms:EncryptionContext:aws:cloudtrail:arn": [
                "arn:aws:cloudtrail:*:<account id>:trail/*"
            ]
        },
        "StringEquals": {
            "aws:SourceArn": "arn:aws:cloudtrail:<region code>:<account id>:trail/<trail name>"
        }
    }
}

AWS Documentation

Granting decrypt permissions

Before you add your KMS key to your CloudTrail configuration, it is important to give decrypt permissions to all users who require them. Users who have encrypt permissions but no decrypt permissions will not be able to read encrypted logs. If you are using an existing S3 bucket with an S3 Bucket Key, kms:Decrypt permissions are required to create or update a trail with SSE-KMS encryption enabled.

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
{
    "Sid": "Enable CloudTrail log decrypt permissions",
    "Effect": "Allow",
    "Principal": {
        "AWS": "arn:aws:iam::<account id>:user/<user name>"
    },
    "Action": "kms:Decrypt",
    "Resource": "*",
    "Condition": {
        "Null": {
            "kms:EncryptionContext:aws:cloudtrail:arn": "false"
        }
    }
}

AWS Documentation

Enable CloudTrail to describe KMS key properties

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
{
    "Sid": "Allow CloudTrail access",
    "Effect": "Allow",
    "Principal": {
        "Service": "cloudtrail.amazonaws.com"
    },
    "Action": "kms:DescribeKey",
    "Resource": "arn:aws:kms:<region code>:<account id>:key/<key id>",
    "Condition": {
        "StringEquals": {
            "aws:SourceArn": "arn:aws:cloudtrail:<region code>:<account id>:trail/<trail name>"
        }
    }
}

AWS Documentation