Description

Ensure that Amazon CloudWatch Logs log groups are encrypted at rest using an AWS KMS customer-managed key, rather than relying solely on CloudWatch Logs' default server-side encryption.

Rationale

CloudWatch Logs encrypts data at rest by default, but this default encryption does not provide the organization with control over the encryption key, its rotation, or its access policy. Log groups frequently contain sensitive details, such as application errors that may include partial credentials, request payloads, or internal system information, so applying a customer-managed KMS key allows the organization to control who can decrypt log data and to audit key usage independently of CloudWatch Logs access.

Impact

  • Provides organizational control over the key protecting potentially sensitive log data at rest

  • Enables detailed key usage auditing via CloudTrail

  • Requires the log-writing services (Lambda, EC2, etc.) and any log-reading principals to have appropriate KMS key permissions

Default Value

CloudWatch Logs log groups are encrypted using CloudWatch Logs' own default encryption; a customer-managed KMS key must be explicitly associated with the log group to change this.

Pre-Requisites

  • An AWS KMS customer-managed key with a key policy granting CloudWatch Logs (via a service principal condition) and relevant log-writing/reading principals the required permissions

  • IAM permissions to associate a KMS key with a log group (logs:AssociateKmsKey)

Test Plan

  1. Sign in to the AWS Management Console at https://console.aws.amazon.com.

  2. Navigate to Amazon CloudWatch > Log groups.

  3. Select the log group to review.

  4. Review the KMS Key ID field in the log group's details.

  5. Verify that a customer-managed KMS key ARN is shown, rather than the field being empty (default encryption).

  6. If no customer-managed key is associated, follow the implementation steps.

Implementation Steps

  1. Sign in to the AWS Management Console at https://console.aws.amazon.com.

  2. Navigate to AWS KMS and create (or identify) a customer-managed key with a key policy that grants the logs.<region>.amazonaws.com service principal the necessary encrypt/decrypt permissions, scoped to the target log group's ARN via a condition if desired.

  3. Navigate to Amazon CloudWatch > Log groups and select the log group to update.

  4. Select Actions, then Associate KMS key (or edit the log group's encryption settings).

  5. Select the KMS key created above and confirm.

  6. Verify the log group's details now show the associated KMS key.

Backout Plan

  1. Sign in to the AWS Management Console at https://console.aws.amazon.com.

  2. Navigate to Amazon CloudWatch > Log groups and select the affected log group.

  3. Select Actions, then Disassociate KMS key (note: CloudWatch Logs does not support reverting to a previous key directly; this removes customer-managed key encryption and returns to CloudWatch Logs' default encryption).

  4. Confirm the change.

Reference