A security engineer is setting up an AWS CloudTrail trail for all regions in an...

Understanding the Problem:

Logs are encrypted with a KMS-managed key (SSE-KMS), and the security engineer can read digest files but not the log files.

This indicates that the issue lies in permissions related to decryption.

KMS Key Policy:

The key policy for the KMS-managed key must explicitly allow the security engineer’s IAM user or role thekms:Decryptpermission.

Example Key Policy:

{

"Version": "2012-10-17",

"Statement": [

{

"Effect": "Allow",

"Principal": {

"AWS": "arn:aws:iam:::user/"

},

"Action": "kms:Decrypt",

"Resource": "*"

}

]

}

Verify the IAM Role/Policy:

Ensure that no conflicting IAM policy denies thekms:Decryptaction for the security engineer’s user or role.

Enable Access to Encrypted Logs:

Update the KMS key policy to include permissions for reading and decrypting CloudTrail logs.

AWS KMS Key Policy Documentation

Server-Side Encryption with KMS for CloudTrail