CHECK_ID_check27="" 
CHECK_TITLE_check27="" 
CHECK_SCORED_check27="" 
CHECK_TYPE_check27="" 
CHECK_ALTERNATE_check27="check27" 
 
check27(){
  # "Ensure CloudTrail logs are encrypted at rest using KMS CMKs (Scored)"
  textTitle "$ID27" "$TITLE27" "SCORED" "LEVEL2"
  CLOUDTRAILNAME=$($AWSCLI cloudtrail describe-trails --query 'trailList[*].Name' --output text $PROFILE_OPT --region $REGION)
    if [[ $CLOUDTRAILNAME ]];then
      for trail in $CLOUDTRAILNAME;do
        CLOUDTRAILENC_ENABLED=$($AWSCLI cloudtrail describe-trails $PROFILE_OPT --region $REGION --trail $trail --query 'trailList[*].KmsKeyId' --output text)
        if [[ $CLOUDTRAILENC_ENABLED ]];then
          textOK "KMS key found for $trail"
        else
          textWarn "encryption is not enabled in your CloudTrail trail $trail (KMS key not found)!"
        fi
      done
    else
      textWarn "CloudTrail bucket doesn't exist!"
    fi
}