Key access logs audited quarterly

NIST SC-12 requires key management procedures, which include auditability of key access — knowing who accessed which key and when is the mechanism for detecting insider threats and key compromise. NIST AU-2 requires auditable events to include security-relevant actions; key decryption operations are among the highest-value events in a financial system. PCI-DSS 4.0 Req-10.2 requires logging of all individual user access to cardholder data. Without quarterly review of key access logs, a compromised service account silently decrypting all stored cardholder data goes undetected for months. The FFIEC IT Handbook Audit section explicitly requires periodic review of access to cryptographic systems.

Enable KMS audit logging and create a quarterly review cadence documented in docs/key-access-audit.md. For AWS CloudTrail (which logs all KMS API calls by default):

# Query CloudTrail for KMS decrypt events in the past 90 days
aws cloudtrail lookup-events \
  --lookup-attributes AttributeKey=EventName,AttributeValue=Decrypt \
  --start-time $(date -u -d '-90 days' +%Y-%m-%dT%H:%M:%SZ) \
  --query 'Events[*].{Time:EventTime,User:Username,Key:Resources[0].ResourceName}'

Document each review with findings:

## Q1 2026 Review — 2026-01-15
- Tool: AWS CloudTrail
- Period: 2025-10-15 to 2026-01-15
- Total decrypt calls: 14,823
- Principals: app-service-role (14,819), admin@company.com (4)
- Anomalies: None
- Sign-off: [Name]

Set up a CloudWatch alert for unexpected principals calling kms:Decrypt to catch anomalies between quarterly reviews.