> ## Documentation Index
> Fetch the complete documentation index at: https://cloudanix.com/docs/llms.txt
> Use this file to discover all available pages before exploring further.

# Cloudwatch log groups not encrypted remediation

### Triage and Remediation

<Tabs>
  <Tab title="Remediation">
    ### Remediation

    <AccordionGroup>
      <Accordion title="Using Console" defaultOpen="true">
        Cloudwatch Log groups are by default encrypted with AWS KMS Keys
      </Accordion>

      <Accordion title="Using CLI">
        Cloudwatch Log groups are by default encrypted with AWS KMS Keys
      </Accordion>

      <Accordion title="Using Python">
        Cloudwatch Log groups are by default encrypted with AWS KMS Keys
      </Accordion>

      <Accordion title="Using Terraform">
        ```hcl theme={null}
        # KMS key used to encrypt the CloudWatch Log Group
        resource "aws_kms_key" "cloudwatch_logs" {
          description             = "KMS key for encrypting CloudWatch Logs"
          enable_key_rotation     = true

          policy = jsonencode({
            Version = "2012-10-17"
            Statement = [
              # Root account full access
              {
                Sid       = "EnableRootPermissions"
                Effect    = "Allow"
                Principal = {
                  AWS = "arn:aws:iam::${DATA_OR_ACCOUNT_ID}:root" # replace DATA_OR_ACCOUNT_ID with your AWS account ID
                }
                Action   = "kms:*"
                Resource = "*"
              },
              # Allow CloudWatch Logs service to use the key
              {
                Sid    = "AllowCloudWatchLogsUseOfTheKey"
                Effect = "Allow"
                Principal = {
                  Service = "logs.${AWS_REGION}.amazonaws.com" # replace AWS_REGION with the region (e.g. us-east-1)
                }
                Action = [
                  "kms:Encrypt",
                  "kms:Decrypt",
                  "kms:ReEncrypt*",
                  "kms:GenerateDataKey*",
                  "kms:DescribeKey"
                ]
                Resource = "*"
              }
            ]
          })
        }

        # Encrypted CloudWatch Log Group
        resource "aws_cloudwatch_log_group" "this" {
          name              = "/aws/your/log/group/name" # replace with your log group name
          retention_in_days = 30                         # optional, adjust as desired

          kms_key_id = aws_kms_key.cloudwatch_logs.arn
        }
        ```

        This change does not replace the existing log group; Terraform will update it in place and only new log events will be encrypted (existing stored data remains unencrypted, matching the CLI behavior).

        To verify, `terraform plan` should show an in-place `update` to the `aws_cloudwatch_log_group` resource adding `kms_key_id = arn:aws:kms:...` and the creation of the new `aws_kms_key` if you didn't already have one.
      </Accordion>
    </AccordionGroup>
  </Tab>
</Tabs>