kmsKeyId

Specifies the KMS key ID to use to encrypt the logs delivered by CloudTrail. The value can be an alias name prefixed by "alias/", a fully specified ARN to an alias, a fully specified ARN to a key, or a globally unique identifier.

CloudTrail also supports KMS multi-Region keys. For more information about multi-Region keys, see Using multi-Region keys in the Key Management Service Developer Guide.

Examples:

• alias/MyAliasName

• arn:aws:kms:us-east-2:123456789012:alias/MyAliasName

• arn:aws:kms:us-east-2:123456789012:key/12345678-1234-1234-1234-123456789012

• 12345678-1234-1234-1234-123456789012