Question

A CloudOps engineer configures an S3 bucket to store CloudTrail logs and enables SSE-KMS encryption using a customer managed KMS key. After enabling the trail, CloudTrail fails to deliver logs and reports an insufficient permissions error when writing to the bucket. The bucket policy already grants the CloudTrail service principal s3:PutObject. What is the MOST likely cause and correct fix?

Accepted Answer

The KMS key policy does not allow the CloudTrail service principal (cloudtrail.amazonaws.com) to call kms:GenerateDataKey; add a statement granting that permission to the service principal.

Answer

S3 buckets cannot use customer managed KMS keys for CloudTrail logs; switch the bucket to SSE-S3 (Amazon S3-managed keys) instead.

Answer

The IAM user who created the trail lacks kms:Decrypt on the key; attach a policy granting kms:Decrypt to that user.

Answer

Automatic key rotation must be disabled for CloudTrail delivery to succeed; turn off annual rotation on the KMS key.