Support encrypted CW log groups

[HyperBrain]

This is a Feature Proposal

Description

AWS just announced encrypted CW logstreams (by using KMS) on a log group basis. As soon as this is supported in CloudFormation it would be great to have the functionality available in Serverless, i.e. that you can select encryption per function and reference a KMS key.

Reference: https://aws.amazon.com/about-aws/whats-new/2017/12/amazon-cloudwatch-logs-now-supports-kms-encryption/

[MichaelMitchellM]

Is there any update on this?

[et304383]

Damn, nearly 2 years later and not supported. :(

Edit: I suspect the reason it isn't present yet is because CloudFormation doesn't support this (STILL) and thus serverless cannot directly support it.

[medikoo]

Features that are not supported in CloudFormation can still be handled via Custom resources. It should not longer be considered as blocker.

PR is welcome

[mascah]

Features that are not supported in CloudFormation can still be handled via Custom resources. It should not longer be considered as blocker.

PR is welcome

FWIW, there is an open PR to add this to the CF provider, so ideally should be coming soon.

aws-cloudformation/aws-cloudformation-resource-providers-logs#27

Drives me a little nuts that Terraform has supported this 2017...

[isaacl]

FYI this is now live

[medikoo]

In light of that, we're open for PR. Still first let's specify how it should be implemented (solved internally)

[rafaljanicki]

Hi,

This issue is becoming more important with any kind of external policies enforced on the account. If we're not able to enable KMS on the log groups created by Serverless.com, we have to create the log groups manually or inherit them e.g. Terraform. That makes the whole setup much more complex, so adding a kmsKeyArn for logs would be a great improvement

[pgrzesik]

Hello @rafaljanicki - thanks for reporting. At the moment there are no immediate plans for pushing this initiative forward as we're focusing on different priorities.

[rafaljanicki]

Hey @pgrzesik , any news here? Or an idea of a workaround that is semi-automatic i.e. doesn't involve writing separate policies for each log group?

[rafaljanicki]

If one wants to tackle that issue, I've created a module for that: https://github.com/Kult-io/serverless-plugin-log-key-id