CloudWatch log group is encrypted with an AWS KMS key
cloudwatch_log_group_kms_encryption_enabled
Severitymedium
Servicecloudwatch
CloudWatch log groups are assessed for at-rest encryption by checking if an AWS KMS key is associated with the log group via kmsKeyId.
Risk
Without a customer-managed KMS key, logs rely on service-managed encryption, limiting control and auditability.
- Confidentiality: weaker key-policy barriers against unauthorized reads
- Integrity/availability: no custom rotation or rapid revoke, hindering incident response and compliance
Run this check with Prowler CLI
prowler aws --checks cloudwatch_log_group_kms_encryption_enabled
Recommendation
Associate each log group with a customer-managed KMS key via kmsKeyId.
- Enforce least privilege in key and IAM policies, granting
kms:Decryptonly to required principals - Enable rotation and monitor key usage
- Separate keys by app/tenant to support defense in depth and rapid revocation
Remediation
CLI
aws logs associate-kms-key --log-group-name <LOG_GROUP_NAME> --kms-key-id arn:aws:kms:<REGION>:<ACCOUNT_ID>:key/<KEY_ID>
Native IaC
Terraform
Other
- In the AWS Console, go to CloudWatch > Log groups
- Click Create log group and enter a name
- Under Encryption, select KMS key and provide the key ARN
- Click Create log group
- For existing log groups, the console cannot attach a KMS key; use the CLI command provided
Source Code
Resource Type
Other
References
- https://docs.aws.amazon.com/cli/latest/reference/logs/associate-kms-key.html
- https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/cloudwatch_log_group
- https://boto3.amazonaws.com/v1/documentation/api/latest/reference/services/logs/client/associate_kms_key.html
- https://support.icompaas.com/support/solutions/articles/62000233436-ensure-cloudwatch-log-groups-are-protected-by-aws-kms
- https://varunmanik1.medium.com/proactively-mitigating-a-medium-severity-prowler-issue-enabling-kms-encryption-for-cloudwatch-logs-51d43416c7fc