Skip to main content

CloudWatch Log Groups Should Be Encrypted

More Info:​

Cloudwatch loggroups should be encrypted

Risk Level​

High

Address​

Security

Compliance Standards​

  • APRA CPS 234 (Australia)
  • AWS Startup Security Baseline
  • AWS Well Architected Framework
  • BSI C5 (Germany)
  • Brazil LGPD
  • CCPA / CPRA (California)
  • CIS AWS
  • CIS Critical Security Controls v8
  • CMMC 2.0
  • CSA Cloud Controls Matrix v4
  • Cloudanix Best Practice
  • DPDPA
  • Digital Operational Resilience Act (EU)
  • GDPR
  • HIPAA
  • ISO/IEC 27017
  • ISO/IEC 27018
  • ISO/IEC 27701
  • KSA PDPL
  • MAS Technology Risk Management (Singapore)
  • MITRE ATT&CK (Cloud)
  • NIS2 Directive
  • NIST
  • NIST SP 800-171
  • NYDFS 23 NYCRR 500
  • PCI
  • Reserve Bank of India (RBI) Cyber Security Framework
  • SOC2
  • SWIFT Customer Security Controls Framework
  • Sarbanes-Oxley IT General Controls
  • Securities and Exchange Board of India (SEBI) - Cloud Security Adoption Framework
  • UK NCSC Cyber Assessment Framework

Triage and Remediation​

Remediation​

Using Console

Cloudwatch Log groups are by default encrypted with AWS KMS Keys

Using CLI

Cloudwatch Log groups are by default encrypted with AWS KMS Keys

Using Python

Cloudwatch Log groups are by default encrypted with AWS KMS Keys

Using Terraform
# KMS key used to encrypt the CloudWatch Log Group
resource "aws_kms_key" "cloudwatch_logs" {
  description             = "KMS key for encrypting CloudWatch Logs"
  enable_key_rotation     = true

  policy = jsonencode({
    Version = "2012-10-17"
    Statement = [
      # Root account full access
      {
        Sid       = "EnableRootPermissions"
        Effect    = "Allow"
        Principal = {
          AWS = "arn:aws:iam::${DATA_OR_ACCOUNT_ID}:root" # replace DATA_OR_ACCOUNT_ID with your AWS account ID
        }
        Action   = "kms:*"
        Resource = "*"
      },
      # Allow CloudWatch Logs service to use the key
      {
        Sid    = "AllowCloudWatchLogsUseOfTheKey"
        Effect = "Allow"
        Principal = {
          Service = "logs.${AWS_REGION}.amazonaws.com" # replace AWS_REGION with the region (e.g. us-east-1)
        }
        Action = [
          "kms:Encrypt",
          "kms:Decrypt",
          "kms:ReEncrypt*",
          "kms:GenerateDataKey*",
          "kms:DescribeKey"
        ]
        Resource = "*"
      }
    ]
  })
}

# Encrypted CloudWatch Log Group
resource "aws_cloudwatch_log_group" "this" {
  name              = "/aws/your/log/group/name" # replace with your log group name
  retention_in_days = 30                         # optional, adjust as desired

  kms_key_id = aws_kms_key.cloudwatch_logs.arn
}

This change does not replace the existing log group; Terraform will update it in place and only new log events will be encrypted (existing stored data remains unencrypted, matching the CLI behavior).

To verify, terraform plan should show an in-place update to the aws_cloudwatch_log_group resource adding kms_key_id = arn:aws:kms:... and the creation of the new aws_kms_key if you didn't already have one.

Additional Reading:​