4

I am using AWS KMS to encrypt and decrypt some data. I want to track all KMS accesses using AWS cloudtrail. When I open my cloudtrail events page, I can't see KMS related events. On KMS documentation page, it is mentioned that kms events are logged in cloudtrail.

Is there a setting to enable it?

Naveen
  • 77
  • 1
  • 10

2 Answers2

1

KMS is not supported by CloudTrail Event History.

However, you can see the KMS logs if you setup a trail:

If you're looking for a specific API call that doesn't appear in the event history, create a trail and check the log files in your S3 bucket.

spg
  • 9,309
  • 4
  • 36
  • 41
0

The previous answer is no longer correct->

When a KMS key gets deleted, it goes through a scheduled key deletion period (7-30 days) and then gets deleted.

You can track the calls made on the ScheduleKeyDeletion and CancelKeyDeletion APIs through CloudTrail. After the waiting period ends, search in CloudTrail for DeleteKey .

Illusionist
  • 5,204
  • 11
  • 46
  • 76