CloudFormation Guard Rules: Cloudformation Guard Rules for Cloudwatch Logs

My Saved Presets

CloudFormation guard rules template for CloudWatch Log groups

The following rules are included:

Retention Policy Configured
KMS Encrypted for at-rest encryption

let logGroups = Resources.*[
	Type == "AWS::Logs::LogGroup"
]

rule cloudwatchlogs_retention when %logGroups !empty {
	%logGroups {
		Properties {
			RetentionInDays exists <<Retention policy is not configured.>>
		}
	}
}

rule cloudwatchlogs_kms_encrypted when %logGroups !empty {
	%logGroups {
		Properties {
			KmsKeyId exists <<KMS encryption is not configured.>>
		}
	}
}

* Required field

Loading Library ...

Cloudformation Guard Rules for Cloudwatch Logs

Actions

Customize Template