Al usar AWS re:Post, aceptas las AWS re:Post Términos de uso
AWS re:Postre:Post

Encrypt CloudTrail logs via Control Tower

0

Hi,

Currently I would like to encrypt CloudTrail logs in my Root account via a KMS key managed by me.

This trail exists in all my environments due to the use of Control Tower, through the Root account I have the possibility of adding the KMS key to the existing Landing Zone, but I would like to know if when applying this configuration, the other accounts will also be requesting this KMS key, and if so, how can I share this key with other accounts.

Temas
Seguridad, identidad y cumplimientoGestión y gobierno
Etiquetas
AWS Key Management ServiceSeguridad, identidad y cumplimientoAWS Control TowerGestión y gobiernoAWS CloudTrail
Idioma
English
Carlos Alexandre
preguntada hace 3 meses763 visualizaciones
1 Respuesta
1

Hi THere

You dont need to share the key with other accounts. To use a KMS key with AWS Control Tower, you must update the default KMS key policy by adding the minimum required permissions for AWS Config and AWS CloudTrail.

See https://docs.aws.amazon.com/controltower/latest/userguide/configure-kms-keys.html

profile pictureAWS
EXPERTO
Matt-B
respondido hace 3 meses

No has iniciado sesión. Iniciar sesión para publicar una respuesta.

Una buena respuesta responde claramente a la pregunta, proporciona comentarios constructivos y fomenta el crecimiento profesional en la persona que hace la pregunta.

Pautas para responder preguntas

Contenido relevante