CloudWatch log group is encrypted with an AWS KMS key

Check ID: cloudwatch_log_group_kms_encryption_enabled
Provider: AWS
Service: cloudwatch
Severity: MEDIUM
Categories: encryption
Resource type: Other

What this check verifies

CloudWatch log groups are assessed for at-rest encryption by checking if an AWS KMS key is associated with the log group via kmsKeyId.

Risk

Without a customer-managed KMS key, logs rely on service-managed encryption, limiting control and auditability.

Confidentiality: weaker key-policy barriers against unauthorized reads
Integrity/availability: no custom rotation or rapid revoke, hindering incident response and compliance

Recommendation

Associate each log group with a customer-managed KMS key via kmsKeyId.

Enforce least privilege in key and IAM policies, granting kms:Decrypt only to required principals
Enable rotation and monitor key usage
Separate keys by app/tenant to support defense in depth and rapid revocation

Remediation

CLI
Terraform
Native IaC
Dashboard steps

aws logs associate-kms-key —log-group-name <LOG_GROUP_NAME> —kms-key-id arn:aws:kms:<REGION>:<ACCOUNT_ID>:key/<KEY_ID>

# Encrypt a CloudWatch Log Group with KMS
resource "aws_cloudwatch_log_group" "<example_resource_name>" {
  name       = "<example_resource_name>"
  kms_key_id = "arn:aws:kms:<REGION>:<ACCOUNT_ID>:key/<KEY_ID>" # Critical: associates a CMK to encrypt the log group
}

# CloudFormation: Encrypt a CloudWatch Log Group with KMS
Resources:
  <example_resource_name>:
    Type: AWS::Logs::LogGroup
    Properties:
      KmsKeyId: arn:aws:kms:<REGION>:<ACCOUNT_ID>:key/<KEY_ID>  # Critical: associates a CMK to encrypt the log group

References

Where this check fires

This check runs on every scheduled scan against your AWS account. Findings appear at Cloud Security → Findings filterable by Check ID = cloudwatch_log_group_kms_encryption_enabled. To re-evaluate after a fix, hit Run now on the account’s schedule under Cloud Security → Schedules — the next scan re-checks this control and marks the finding fixed or keeps it persistent.

← Back to AWS checks

CloudWatch does not allow cross-account sharing CloudWatch log group contains no secrets in its log events

​What this check verifies

​Risk

​Recommendation

​Remediation

​References

​Where this check fires

What this check verifies

Risk

Recommendation

Remediation

References

Where this check fires