Encrypt Amazon OpenSearch CloudWatch Logs using KMS key after setup?

Question

Hi all

I configured Amazon OpenSearch and could see four CloudWatch Logs log groups as follows:

```
/aws/opensearch/my-os/AUDIT_LOGS
/aws/opensearch/my-os/ES_APPLICATION_LOGS
/aws/opensearch/my-os/INDEX_SLOW_LOGS
/aws/opensearch/my-os/SEARCH_SLOW_LOGS
```
Now I want to encrypt them using a KMS key. How can I do this?

Thanks.

Mikel Del Tio · Answer

Hi,

Cloudwatch log groups are encrypted at rest by default using a 256-bit AES-GCM server side encryption, but you can also employ a KMS key to encrypt them, either when you create the log group or after it exists.

The following [AWS documentation page](https://docs.aws.amazon.com/AmazonCloudWatch/latest/logs/encrypt-log-data-kms.html) and [Knowledge Center article](https://repost.aws/knowledge-center/cloudwatch-encrypt-log-data) describes step by step how to implement it.

Encrypt Amazon OpenSearch CloudWatch Logs using KMS key after setup?

Relevant content