let logGroups = Resources.*[
	Type == "AWS::Logs::LogGroup"
]

rule cloudwatchlogs_retention when %logGroups !empty {
	%logGroups {
		Properties {
			RetentionInDays exists <<Retention policy is not configured.>>
		}
	}
}

rule cloudwatchlogs_kms_encrypted when %logGroups !empty {
	%logGroups {
		Properties {
			KmsKeyId exists <<KMS encryption is not configured.>>
		}
	}
}