> ## Documentation Index
> Fetch the complete documentation index at: https://cloudanix.com/docs/llms.txt
> Use this file to discover all available pages before exploring further.

# CloudWatch Log Groups Should Be Encrypted

### More Info:

Cloudwatch loggroups should be encrypted

### Risk Level

High

### Address

Security

### Compliance Standards

* APRA CPS 234 (Australia)
* AWS Startup Security Baseline
* AWS Well Architected Framework
* BSI C5 (Germany)
* Brazil LGPD
* CCPA / CPRA (California)
* CIS AWS
* CIS Critical Security Controls v8
* CMMC 2.0
* CSA Cloud Controls Matrix v4
* Cloudanix Best Practice
* DPDPA
* Digital Operational Resilience Act (EU)
* GDPR
* HIPAA
* ISO/IEC 27017
* ISO/IEC 27018
* ISO/IEC 27701
* KSA PDPL
* MAS Technology Risk Management (Singapore)
* MITRE ATT\&CK (Cloud)
* NIS2 Directive
* NIST
* NIST SP 800-171
* NYDFS 23 NYCRR 500
* PCI
* Reserve Bank of India (RBI) Cyber Security Framework
* SOC2
* SWIFT Customer Security Controls Framework
* Sarbanes-Oxley IT General Controls
* Securities and Exchange Board of India (SEBI) - Cloud Security Adoption Framework
* UK NCSC Cyber Assessment Framework

### Triage and Remediation

<Tabs>
  <Tab title="Remediation">
    ### Remediation

    <AccordionGroup>
      <Accordion title="Using Console" defaultOpen="true">
        Cloudwatch Log groups are by default encrypted with AWS KMS Keys
      </Accordion>

      <Accordion title="Using CLI">
        Cloudwatch Log groups are by default encrypted with AWS KMS Keys
      </Accordion>

      <Accordion title="Using Python">
        Cloudwatch Log groups are by default encrypted with AWS KMS Keys
      </Accordion>

      <Accordion title="Using Terraform">
        ```hcl theme={null}
        # KMS key used to encrypt the CloudWatch Log Group
        resource "aws_kms_key" "cloudwatch_logs" {
          description             = "KMS key for encrypting CloudWatch Logs"
          enable_key_rotation     = true

          policy = jsonencode({
            Version = "2012-10-17"
            Statement = [
              # Root account full access
              {
                Sid       = "EnableRootPermissions"
                Effect    = "Allow"
                Principal = {
                  AWS = "arn:aws:iam::${DATA_OR_ACCOUNT_ID}:root" # replace DATA_OR_ACCOUNT_ID with your AWS account ID
                }
                Action   = "kms:*"
                Resource = "*"
              },
              # Allow CloudWatch Logs service to use the key
              {
                Sid    = "AllowCloudWatchLogsUseOfTheKey"
                Effect = "Allow"
                Principal = {
                  Service = "logs.${AWS_REGION}.amazonaws.com" # replace AWS_REGION with the region (e.g. us-east-1)
                }
                Action = [
                  "kms:Encrypt",
                  "kms:Decrypt",
                  "kms:ReEncrypt*",
                  "kms:GenerateDataKey*",
                  "kms:DescribeKey"
                ]
                Resource = "*"
              }
            ]
          })
        }

        # Encrypted CloudWatch Log Group
        resource "aws_cloudwatch_log_group" "this" {
          name              = "/aws/your/log/group/name" # replace with your log group name
          retention_in_days = 30                         # optional, adjust as desired

          kms_key_id = aws_kms_key.cloudwatch_logs.arn
        }
        ```

        This change does not replace the existing log group; Terraform will update it in place and only new log events will be encrypted (existing stored data remains unencrypted, matching the CLI behavior).

        To verify, `terraform plan` should show an in-place `update` to the `aws_cloudwatch_log_group` resource adding `kms_key_id = arn:aws:kms:...` and the creation of the new `aws_kms_key` if you didn't already have one.
      </Accordion>
    </AccordionGroup>
  </Tab>
</Tabs>

### Additional Reading:

* [https://docs.aws.amazon.com/AmazonCloudWatch/latest/logs/encrypt-log-data-kms.html](https://docs.aws.amazon.com/AmazonCloudWatch/latest/logs/encrypt-log-data-kms.html)