Back to Checks
aws

CloudWatch log group is encrypted with an AWS KMS key

cloudwatch_log_group_kms_encryption_enabled
Service: cloudwatchSeverity: medium
OfficialBuilt-inVerified
Categories:encryption
Resource Type:Other

CloudWatch log groups are assessed for at-rest encryption by checking if an AWS KMS key is associated with the log group via kmsKeyId.

Prowler logoProwlerprowler-provider-aws

Risk

Without a customer-managed KMS key, logs rely on service-managed encryption, limiting control and auditability.

  • Confidentiality: weaker key-policy barriers against unauthorized reads
  • Integrity/availability: no custom rotation or rapid revoke, hindering incident response and compliance

Run this check with Prowler

Run in Prowler Cloud
Run
prowler aws --checks cloudwatch_log_group_kms_encryption_enabled

Recommendation

Associate each log group with a customer-managed KMS key via kmsKeyId.

  • Enforce least privilege in key and IAM policies, granting kms:Decrypt only to required principals
  • Enable rotation and monitor key usage
  • Separate keys by app/tenant to support defense in depth and rapid revocation

Remediation

CLI

aws logs associate-kms-key --log-group-name <LOG_GROUP_NAME> --kms-key-id arn:aws:kms:<REGION>:<ACCOUNT_ID>:key/<KEY_ID>

Terraform

# Encrypt a CloudWatch Log Group with KMS
resource "aws_cloudwatch_log_group" "<example_resource_name>" {
  name       = "<example_resource_name>"
  kms_key_id = "arn:aws:kms:<REGION>:<ACCOUNT_ID>:key/<KEY_ID>" # Critical: associates a CMK to encrypt the log group
}

NativeIaC

# CloudFormation: Encrypt a CloudWatch Log Group with KMS
Resources:
  <example_resource_name>:
    Type: AWS::Logs::LogGroup
    Properties:
      KmsKeyId: arn:aws:kms:<REGION>:<ACCOUNT_ID>:key/<KEY_ID>  # Critical: associates a CMK to encrypt the log group

Other

1In the AWS Console, go to CloudWatch > Log groups
2Click Create log group and enter a name
3Under Encryption, select KMS key and provide the key ARN
4Click Create log group
5For existing log groups, the console cannot attach a KMS key; use the CLI command provided

Check Code

from prowler.lib.check.models import Check, Check_Report_AWS
from prowler.providers.aws.services.cloudwatch.logs_client import logs_client


class cloudwatch_log_group_kms_encryption_enabled(Check):
    def execute(self):
        findings = []
        if logs_client.log_groups:
            for log_group in logs_client.log_groups.values():
                report = Check_Report_AWS(metadata=self.metadata(), resource=log_group)
                if log_group.kms_id:
                    report.status = "PASS"
                    report.status_extended = f"Log Group {log_group.name} does have AWS KMS key {log_group.kms_id} associated."
                else:
                    report.status = "FAIL"
                    report.status_extended = f"Log Group {log_group.name} does not have AWS KMS keys associated."
                findings.append(report)
        return findings

References