Skip to content

Files

Latest commit

 

History

History
30 lines (19 loc) · 614 Bytes

AWS089.md

File metadata and controls

30 lines (19 loc) · 614 Bytes

Pattern: CloudWatch log groups should be encrypted using CMK

Issue: -

Description

CloudWatch log groups are encrypted by default, however, to get the full benefit of controlling key rotation and other KMS aspects a KMS CMK should be used.

Resolution: Enable CMK encryption of CloudWatch Log Groups.

Examples

Example of incorrect code:

resource "aws_cloudwatch_log_group" "bad_example" {
	name = "bad_example"

}

Example of correct code:

resource "aws_cloudwatch_log_group" "good_example" {
	name = "good_example"

	kms_key_id = aws_kms_key.log_key.arn
}