CloudWatch Log Groups Should Be Encrypted

# KMS key used to encrypt the CloudWatch Log Group
resource "aws_kms_key" "cloudwatch_logs" {
  description             = "KMS key for encrypting CloudWatch Logs"
  enable_key_rotation     = true

  policy = jsonencode({
    Version = "2012-10-17"
    Statement = [
      # Root account full access
      {
        Sid       = "EnableRootPermissions"
        Effect    = "Allow"
        Principal = {
          AWS = "arn:aws:iam::${DATA_OR_ACCOUNT_ID}:root" # replace DATA_OR_ACCOUNT_ID with your AWS account ID
        }
        Action   = "kms:*"
        Resource = "*"
      },
      # Allow CloudWatch Logs service to use the key
      {
        Sid    = "AllowCloudWatchLogsUseOfTheKey"
        Effect = "Allow"
        Principal = {
          Service = "logs.${AWS_REGION}.amazonaws.com" # replace AWS_REGION with the region (e.g. us-east-1)
        }
        Action = [
          "kms:Encrypt",
          "kms:Decrypt",
          "kms:ReEncrypt*",
          "kms:GenerateDataKey*",
          "kms:DescribeKey"
        ]
        Resource = "*"
      }
    ]
  })
}

# Encrypted CloudWatch Log Group
resource "aws_cloudwatch_log_group" "this" {
  name              = "/aws/your/log/group/name" # replace with your log group name
  retention_in_days = 30                         # optional, adjust as desired

  kms_key_id = aws_kms_key.cloudwatch_logs.arn
}