CloudWatch Log Groups Should Be Encrypted With CMK

1. Create an AWS KMS Key:

   aws kms create-key
   

2. Set Permissions on the KMS Key:

   • Retrieve the default policy for the key:

     aws kms get-key-policy --key-id <key-id> --policy-name default --output text > ./policy.json
     

   • Edit policy.json to include the necessary permissions as described in the documentation.
   • Apply the updated policy to the key:

     aws kms put-key-policy --key-id <key-id> --policy-name default --policy file://policy.json
     

3. Associate the KMS Key with a Log Group:

   • To associate the key during log group creation:

     aws logs create-log-group --log-group-name <log-group-name> --kms-key-id <key-arn>
     

   • To associate the key with an existing log group:

     aws logs associate-kms-key --log-group-name <log-group-name> --kms-key-id <key-arn>
     

4. Disassociate Key from a Log Group (if needed):

   aws logs disassociate-kms-key --log-group-name <log-group-name>
   

You can use the boto3 library in Python to achieve the same tasks programmatically.

1. Create an AWS KMS Key:

   import boto3
   
   kms = boto3.client('kms')
   response = kms.create_key()
   

2. Set Permissions on the KMS Key:

   • Retrieve, edit, and apply the policy similar to the AWS CLI method.

3. Associate the KMS Key with a Log Group:

   import boto3
   
   logs = boto3.client('logs')
   logs.create_log_group(logGroupName='<log-group-name>', kmsKeyId='<key-arn>')
   

4. Disassociate Key from a Log Group (if needed):

   import boto3
   
   logs = boto3.client('logs')
   logs.disassociate_kms_key(logGroupName='<log-group-name>')
   

Ensure you replace placeholders such as <key-id>, <key-arn>, and <log-group-name> with actual values in the commands or code snippets. Also, review and adjust the permissions and conditions according to your specific requirements.