All checks
Medium
CloudTrail should have encryption at-rest enabled
Verifies that CloudTrail trails use server-side encryption with an AWS KMS key.
- service
- CloudTrail
- severity
- Medium
- scope
- evaluated in every region
How to fix it
Update a trail to use a KMS key.
- Sign in to the AWS Management Console and open the CloudTrail console.
- Choose Trails and select a trail name.
- In General details, choose Edit.
- Enable Log file SSE-KMS encryption and select or specify a KMS key.
- Update the trail.
See which of your accounts this check is failing on.
Book a demo