log-group-customer-key
Explanation
CloudWatch log groups are encrypted by default, however, to get the full benefit of controlling key rotation and other KMS aspects a KMS CMK should be used.
Possible Impact
Log data may be leaked if the logs are compromised. No auditing of who have viewed the logs.
Suggested Resolution
Enable CMK encryption of CloudWatch Log Groups
Insecure Example
The following example will fail the aws-cloudwatch-log-group-customer-key check.
resource "aws_cloudwatch_log_group" "bad_example" {
name = "bad_example"
}
Secure Example
The following example will pass the aws-cloudwatch-log-group-customer-key check.
resource "aws_cloudwatch_log_group" "good_example" {
name = "good_example"
kms_key_id = aws_kms_key.log_key.arn
}