Log Group Customer Key | Vulnerability Database

CloudWatch log groups should be encrypted using CMK

CloudWatch log groups are encrypted by default, however, to get the full benefit of controlling key rotation and other KMS aspects a KMS CMK should be used.

Impact

Recommended Actions

Follow the appropriate remediation steps below to resolve the issue.

Enable CMK encryption of CloudWatch Log Groups

1
2
3
4
5
6
7


Resources:
  GoodExample:
    Type: AWS::Logs::LogGroup
    Properties:
      KmsKeyId: arn:aws:kms:us-west-2:111122223333:key/lambdalogging
      LogGroupName: aws/lambda/goodExample
      RetentionInDays: 30

Enable CMK encryption of CloudWatch Log Groups

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13


resource "aws_kms_key" "cloudwatch" {
  enable_key_rotation = true
}

resource "aws_kms_alias" "cloudwatch" {
  name          = "alias/cloudwatch"
  target_key_id = aws_kms_key.cloudwatch.key_id
}
resource "aws_cloudwatch_log_group" "good_example" {
  name = "good_example"

  kms_key_id = aws_kms_alias.cloudwatch.arn
}

Remediation Links

https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/cloudwatch_log_group#kms_key_id