‫So, one short lecture on the CloudWatch Logs encryption.
‫So, you can encrypt your CloudWatch Logs with KMS keys.
‫And the encryption happens at the log group level.
‫So, not with log streams but the log group level.
‫And that you can either associate a CMK
‫with an existing log group,
‫or you can create a new log group with a CMK.
‫But you cannot associate a CMK with a log group
‫using the CloudWatch console;
‫you have to use the CloudWatch Logs API for the CLI
‫and the SDK, so we'll be using the CLI in this lecture.
‫And we have two comments to note.
‫The first one is called associate KMS key.
‫To associate a KMS key with an existing log group
‫or create-log-group to create a log group
‫that doesn't exist yet
‫and directly associate it with a KMS key.
‫So, let's go into the hands on to see how that works.
‫So, here I am in CloudWatch Logs.
‫And I'm going to go to my log groups
‫and I have 23 of them right now.
‫And, so, if we take any of those,
‫for example, the aws/lambda/hello-world log group,
‫we can see that there is no KMS key ID associated
‫with that log group yet.
‫And we can not do any of that through the UI,
‫so the UI does not allow us to associate a KMS key ID
‫with this log group.
‫So, what we want to do is to take this key
‫that we've encrypted from before, the tutorial key,
‫and associate it with this log group.
‫For this we have to use the CLI.
‫So let's go ahead and play it out.
‫So, I'm going to go into my CloudWatch Logs code directory
‫and open this command.
‫And, so, this first command is to associate a KMS key
‫with an existing log group.
‫So, there is simply, I copy this command,
‫and I paste it here, and this takes my KMS key.
‫I paste in the log group name as an argument,
‫as well as my KMS key ID.
‫And finally, I paste in the region.
‫I press enter,
‫and I'm getting an access denied exception saying
‫that this associate KNM key operation did not work.
‫Either the key does not exist,
‫but I know it exists for sure,
‫or it's not allowed to be used with this log group,
‫and this is the second options that's right.
‫So, indeed, the key has not been authorized
‫to be used with this log group.
‫So, we need to apply a certain key policy.
‫So, if we go here, there is a key policy that Jason filed.
‫And we need to apply it to my specific key.
‫So, I'm gonna get the second part here,
‫that's what's interesting.
‫So, I'm gonna get the second part and the comma,
‫and I'm gonna go into my KMS key consul,
‫and in here I have a key policy.
‫I'm going to switch to policy view
‫and I'm going to edit this key policy.
‫So, this key policy right now is the default key policy
‫which allows any user or role within my account
‫to use my KMS key, but doesn't allow any service.
‫So, we need to allow the service
‫of CloudWatch Logs to access this key.
‫So, I'm going to paste this here,
‫and so there's a comma that has been added
‫in this statement.
‫And, so, here we allow logs dot,
‫and we need to paste in the region, so EU-west-2.
‫So, logs.EU-west-2.amamazonaws.com is allowed
‫to do encrypt, decrypt, re-encrypt,
‫generate data key, and describe on this key.
‫So, I'll save these changes.
‫And, now I have applied a key policy
‫which should allow more things
‫to access including CloudWatch Log.
‫So, we should try again our command,
‫and, hopefully, this time it will work.
‫So, I will run this command again,
‫and this time it has worked.
‫So, we get the end and it is applied.
‫So, how do I know this?
‫Well, we could refresh this UI
‫and now we can see that out KNS key ID,
‫right here, is associated with out CloudWatch Logs,
‫and so that mean that this log group
‫is going to be fully encrypted with this KMS key ID.
‫And I could try the second command,
‫which is to create a new log group
‫with this example I called, example encrypted,
‫directly passing in the KMS key ID.
‫So, I paste this in and press enter,
‫and it says end.
‫So, if I go back to my log groups and then refresh,
‫I can find at the very bottom
‫my example encrypted log group.
‫And this one is also associated with out KMS key ID.
‫So, this is the two ways to create an associate KMS key ID
‫with the log groups in CloudWatch Log.
‫So, it cannot be done through the consul.
‫And I really like the fact that we had
‫to modify a key policy to allow CloudWatch Logs
‫to access out KMS key,
‫which I think is a tremendous example in security.
‫So, that's it for this lecture.
‫I hope you liked it,
‫and I will see you in the next lecture.