Cloudwatch Log Groups Not Encrypted Remediation

Triage and Remediation

Remediation

Remediation

Using Console

Cloudwatch Log groups are by default encrypted with AWS KMS Keys

Using CLI

Cloudwatch Log groups are by default encrypted with AWS KMS Keys

Using Python

Cloudwatch Log groups are by default encrypted with AWS KMS Keys

Using Terraform

# KMS key used to encrypt the CloudWatch Log Group
resource "aws_kms_key" "cloudwatch_logs" {
  description             = "KMS key for encrypting CloudWatch Logs"
  enable_key_rotation     = true

  policy = jsonencode({
    Version = "2012-10-17"
    Statement = [
      # Root account full access
      {
        Sid       = "EnableRootPermissions"
        Effect    = "Allow"
        Principal = {
          AWS = "arn:aws:iam::${DATA_OR_ACCOUNT_ID}:root" # replace DATA_OR_ACCOUNT_ID with your AWS account ID
        }
        Action   = "kms:*"
        Resource = "*"
      },
      # Allow CloudWatch Logs service to use the key
      {
        Sid    = "AllowCloudWatchLogsUseOfTheKey"
        Effect = "Allow"
        Principal = {
          Service = "logs.${AWS_REGION}.amazonaws.com" # replace AWS_REGION with the region (e.g. us-east-1)
        }
        Action = [
          "kms:Encrypt",
          "kms:Decrypt",
          "kms:ReEncrypt*",
          "kms:GenerateDataKey*",
          "kms:DescribeKey"
        ]
        Resource = "*"
      }
    ]
  })
}

# Encrypted CloudWatch Log Group
resource "aws_cloudwatch_log_group" "this" {
  name              = "/aws/your/log/group/name" # replace with your log group name
  retention_in_days = 30                         # optional, adjust as desired

  kms_key_id = aws_kms_key.cloudwatch_logs.arn
}

This change does not replace the existing log group; Terraform will update it in place and only new log events will be encrypted (existing stored data remains unencrypted, matching the CLI behavior).

To verify, terraform plan should show an in-place update to the aws_cloudwatch_log_group resource adding kms_key_id = arn:aws:kms:... and the creation of the new aws_kms_key if you didn't already have one.