All checks
Low
CloudTrail Lake event data stores should be encrypted with customer managed AWS KMS keys
Confirms that CloudTrail Lake event data stores are encrypted at rest with a customer managed KMS key.
- service
- CloudTrail
- severity
- Low
- scope
- evaluated in every region
How to fix it
Configure your CloudTrail Lake event data store to use a customer managed KMS key for encryption instead of the default S3 managed keys.
- Navigate to the CloudTrail console
- Go to the CloudTrail Lake section
- Select the event data store that needs KMS encryption
- Edit the event data store configuration
- In the encryption settings, select 'Customer managed key'
- Choose or create a customer managed KMS key
- Save the configuration changes
- Verify that the event data store is now encrypted with the customer managed KMS key
See which of your accounts this check is failing on.
Book a demo