Support encrypted CW log groups

[HyperBrain]

This is a Feature Proposal

Description

AWS just announced encrypted CW logstreams (by using KMS) on a log group basis. As soon as this is supported in CloudFormation it would be great to have the functionality available in Serverless, i.e. that you can select encryption per function and reference a KMS key.

Reference: https://aws.amazon.com/about-aws/whats-new/2017/12/amazon-cloudwatch-logs-now-supports-kms-encryption/

[MichaelMitchellM]

Is there any update on this?

[et304383]

Damn, nearly 2 years later and not supported. :(

Edit: I suspect the reason it isn't present yet is because CloudFormation doesn't support this (STILL) and thus serverless cannot directly support it.

[medikoo]

Features that are not supported in CloudFormation can still be handled via Custom resources. It should not longer be considered as blocker.

PR is welcome

[mascah]

Features that are not supported in CloudFormation can still be handled via Custom resources. It should not longer be considered as blocker.

PR is welcome

FWIW, there is an open PR to add this to the CF provider, so ideally should be coming soon.

aws-cloudformation/aws-cloudformation-resource-providers-logs#27

Drives me a little nuts that Terraform has supported this 2017...

[isaacl]

FYI this is now live

[medikoo]

In light of that, we're open for PR. Still first let's specify how it should be implemented (solved internally)