AWS CloudTrail | CloudTrail Log File Encryption using AWS Key Management Service (KMS)

Question 1

What charges do I incur once I turn on CloudTrail integration with CloudWatch Logs?

CloudTrail Log File Encryption using AWS Key Management Service (KMS)

AWS CloudTrail | Management Tools

Answer 1

After you turn on CloudTrail integration with CloudWatch Logs, you incur standard CloudWatch Logs and CloudWatch charges. For details, go to CloudWatch pricing page.

Question 2

What is the benefit of CloudTrail log file encryption using Server-side Encryption with KMS?

CloudTrail Log File Encryption using AWS Key Management Service (KMS)

AWS CloudTrail | Management Tools

Answer 2

CloudTrail log file encryption using SSE-KMS allows you to add an additional layer of security to CloudTrail log files delivered to an Amazon S3 bucket by encrypting the log files with a KMS key. By default, CloudTrail will encrypt log files delivered to your Amazon S3 bucket using Amazon S3 server-side encryption.

Question 3

I have an application that ingests and processes CloudTrail log files. Do I need to make any changes to my application?

CloudTrail Log File Encryption using AWS Key Management Service (KMS)

AWS CloudTrail | Management Tools

Answer 3

With SSE-KMS, Amazon S3 will automatically decrypt the log files so that you do not need to make any changes your application. As always, you need to make sure that your application has appropriate permissions, i.e. Amazon S3 GetObject and KMS Decrypt permissions.

Question 4

How do I configure CloudTrail log file encryption?

CloudTrail Log File Encryption using AWS Key Management Service (KMS)

AWS CloudTrail | Management Tools

Answer 4

You can use the AWS Management Console, or AWS CLI or the AWS SDKs to configure log file encryption. For detailed instructions, refer to the documentation.