AWS CloudWatch Log groups encrypted using default encryption key instead of KMS CMK misconfiguration

Rule Details

Cortex AppSec Rule ID	APPSEC_AWS_158
Category - Subcategory	Logging - Encryption
Provider	AWS
Severity	LOW
Framework	CloudFormation, Serverless, Terraform, Terraform Plan

Impact

Log group data requires mandatory encryption settings in CloudWatch Logs. Developers can optionally use AWS Key Management Service for this encryption.

This approach has several limitations:

• If you revoke CloudWatch Logs access to an associated CMK or delete an associated CMK, your encrypted data in CloudWatch Logs can no longer be retrieved.
• You cannot associate a CMK with a log group using the CloudWatch console.

How to Fix

Resource: AWS::Logs::LogGroup

• Arguments: Properties.KmsKeyId [source,go]

---

Type: AWS::Logs::LogGroup Properties: ...

• KmsKeyId: "someKey"

---