aws-kms-encryption-context-cloudtrail
KMS encryption context is not secret and is logged in plaintext to CloudTrail; applications must not put confidential values in it.
Where it sits
| location | CloudTrail event requestParameters.encryptionContext for KMS Encrypt/Decrypt/GenerateDataKey |
|---|
| location kind | log_field |
|---|
| data kinds | credential sensitive_data pii |
|---|
| emits edge | ContainsSecret |
|---|
| service | KMS (aws:kms) |
|---|
Collection recipe
| access mode | indirect_destination |
|---|
| operation | cloudtrail:LookupEvents |
|---|
| response path | Events[].CloudTrailEvent.requestParameters.encryptionContext |
|---|
| encoding | json |
|---|
| params | {"LookupAttributes": [{"AttributeKey": "EventSource", "AttributeValue": "kms.amazonaws.com"}]} |
|---|
Required permissions
cloudtrail:LookupEvents
References