terraform-aws-control_tower_account_factory
terraform-aws-control_tower_account_factory copied to clipboard
aws-ia
CloudWatch log groups encrypted using KMS
Describe the outcome you'd like Currently none of the CloudWatch log groups which are created by AFT are encrypted by a customer managed key stored in KMS. We would like to have a variable to enable this encryption by a KMS CMK which should also be created as part of this solution.
Is your feature request related to a problem you are currently experiencing? If so, please describe.
We are using the Operational-Best-Practices-for-CloudWatch conformance pack in conjunction with Security Hub which checks if log groups are encrypted by a CMK. As this is not the case for all the log groups created by AFT, we receive a lot of high severity findings in Security Hub.
Additional context
N/A
Hi @jo-koe , we've noted this and created a backlog item for us to look at. Thanks!
