specify encryption procotol

widdix · Feb 12, 2024 · 4df0477 · 4df0477
1 parent 4c755b3
commit 4df0477
Showing 1 changed file with 4 additions and 1 deletion.
diff --git a/security/cloudtrail.yaml b/security/cloudtrail.yaml
@@ -224,7 +224,10 @@ Resources:
             Resource: !If [HasLogFilePrefix, !Sub 'arn:aws:s3:::${TrailBucket}/${LogFilePrefix}/AWSLogs/${AWS::AccountId}/*', !Sub 'arn:aws:s3:::${TrailBucket}/AWSLogs/${AWS::AccountId}/*']
             Condition:
               StringNotEquals:
-                's3:x-amz-server-side-encryption': ''
+                's3:x-amz-server-side-encryption': [
+                  'AES256',
+                  'aws:kms'
+                ],
                 's3:x-amz-server-side-encryption-aws-kms-key-id': {'Fn::ImportValue': !Sub '${ParentKmsKeyStack}-KeyArn'}
           - !Ref 'AWS::NoValue'
   TrailLogGroup: