Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Add support for Cloudwatch logs encryption with custom KMS key #189

Open
Nihisil opened this issue Apr 25, 2023 · 0 comments
Open

Add support for Cloudwatch logs encryption with custom KMS key #189

Nihisil opened this issue Apr 25, 2023 · 0 comments
Labels
type : feature New feature or request

Comments

@Nihisil
Copy link
Contributor

Nihisil commented Apr 25, 2023 •
edited
Loading

Why

Encrypting logs is a great way to enhance the security of a project. It's important to get logs encrypted as a best practice.

Currently, the code line tfsec:ignore:aws-cloudwatch-log-group-customer-key present in cloudwatch/main.tf has silenced the tfsec warning related to this.

IMPORTANT note: You cannot encrypt ALB logs using a separate KMS key. Therefore, this ticket applies only to CloudWatch logs from other services. To force encryption for ALB, you can use a custom Lambda, but this is not within the scope of this ticket.

Who Benefits?

Everyone.
@Nihisil Nihisil added the type : feature New feature or request label Apr 25, 2023
@Nihisil Nihisil mentioned this issue Apr 25, 2023
Merged
2 tasks
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees
No one assigned
Labels
type : feature New feature or request
Projects
None yet
Milestone
No milestone
Development

No branches or pull requests
1 participant
@Nihisil