How do you encrypt cloudwatch logs?

I want to see, if i can enable some sort of encryption in cloudwatch logs. my application running in ecs writes to cloudwatch . how can i enable encryption , such that if logs were read by someone not authorized or hacked, it wouldn't pose any security compromise. once encrypted , how would authorize users view the logs , meaning how would i decrpty it for viewing via console or download it , when needed.