Policy: AWS > Logs > Log Group > Encryption at Rest

Define the Encryption at Rest settings required for AWS > Logs > Log Group.

Encryption at Rest refers specifically to the encryption of data when written to an underlying storage system. This control determines whether the resource is encrypted at rest, and sets encryption to your desired level.

The Encryption at Rest control compares the encryption settings against the encryption policies for the resource (AWS > Logs > Log Group > Encryption at Rest > *), raises an alarm, and takes the defined enforcement action

Resource Types

This policy targets the following resource types:

AWS > Logs > Log Group

Customer Managed Key

Controls

AWS > Logs > Log Group > Encryption at Rest

Policy Packs

This policy setting is used by the following policy packs:

Enforce Encryption at Rest Is Enabled for AWS Log Groups

Policy Specification

Schema Type	`string`
Default	`Skip`
Valid Values [YAML]	`Skip` `Check: AWS SSE` `Check: AWS SSE or higher` `Check: Customer managed key` `Check: Encryption at Rest > Customer Managed Key` `Enforce: AWS SSE` `Enforce: AWS SSE or higher` `Enforce: Customer managed key` `Enforce: Encryption at Rest > Customer Managed Key`
Examples [YAML]	`Check: None or higher`

In Your Workspace

Policy Settings by Type report

Developers

Category URI

tmod:@turbot/turbot#/control/categories/resourceEncryptionAtRest

Policy Type URI

tmod:@turbot/aws-logs#/policy/types/logGroupEncryptionAtRest

GraphQL

query policyType(id: "tmod:@turbot/aws-logs#/policy/types/logGroupEncryptionAtRest") { … }

query policySettings(filter: "policyTypeId:'tmod:@turbot/aws-logs#/policy/types/logGroupEncryptionAtRest'") { … }

query policyValues(filter: "policyTypeId:'tmod:@turbot/aws-logs#/policy/types/logGroupEncryptionAtRest'") { … }

CLI

Get Policy Type

turbot graphql policy-type --id "tmod:@turbot/aws-logs#/policy/types/logGroupEncryptionAtRest"

Get Policy Settings

turbot graphql policy-settings --filter "policyTypeId:tmod:@turbot/aws-logs#/policy/types/logGroupEncryptionAtRest"