Vulnerabilities
Misconfiguration
Runtime Security
Compliance
AWS > Cloudwatch >

Log Group Customer Key

LOW
Source
Trivy
ID
AVD-AWS-0017
cloudformation terraform

CloudWatch log groups should be encrypted using CMK

CloudWatch log groups are encrypted by default, however, to get the full benefit of controlling key rotation and other KMS aspects a KMS CMK should be used.

Impact

Log data may be leaked if the logs are compromised. No auditing of who have viewed the logs.

Follow the appropriate remediation steps below to resolve the issue.

Enable CMK encryption of CloudWatch Log Groups

1
2
3
4
5
6
7
8

Resources:
  GoodExample:
    Type: AWS::Logs::LogGroup
    Properties:
      KmsKeyId: "arn:aws:kms:us-west-2:111122223333:key/lambdalogging"
      LogGroupName: "aws/lambda/goodExample"
      RetentionInDays: 30

Enable CMK encryption of CloudWatch Log Groups

1
2
3
4
5
6

 resource "aws_cloudwatch_log_group" "good_example" {
 	name = "good_example"
 
 	kms_key_id = aws_kms_key.log_key.arn
 }
Aqua Security is the largest pure-play cloud native security company, providing customers the freedom to innovate and run their businesses with minimal friction. The Aqua Cloud Native Security Platform provides prevention, detection, and response automation across the entire application lifecycle to secure the build, secure cloud infrastructure and secure running workloads wherever they are deployed.
Copyright © 2023 Aqua Security Software Ltd.   Privacy Policy | Terms of Use