AWS Config: Add Support During Log Delivery for KMS Keys

[ScottFinlaysonGMSL]

Community Note

• Please vote on this issue by adding a 👍 reaction to the original issue to help the community and maintainers prioritize this request
• Please do not leave "+1" or other comments that do not add relevant new information or questions, they generate extra noise for issue followers and do not help prioritize the request
• If you are interested in working on this issue or have submitted a pull request, please leave a comment

Description

AWS config has added support for using KMS keys to encrypt logs delivered to S3 Currently terraform doesn't support use of a KMS key meaning that all logs are encrypted using SSE-S3.

New or Affected Resource(s)

• aws_config_delivery_channel

Potential Terraform Configuration

resource aws_config_delivery_channel delivery {
  ...
  s3_key_arn = "key_arn"
  ...
}

References

• https://aws.amazon.com/about-aws/whats-new/2021/02/support-for-kms-encryption-on-s3-buckets-used-by-aws-config/
• https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/config_delivery_channel

[ewbankkit]

@ScottFinlaysonGMSL Thanks for raising this issue.
It has already been noticed in #20600. I'm going to close this one as a duplicate so that we can concentrate discussion in the linked issue.
Please add any additional comments there.

[ScottFinlaysonGMSL]

Ah apologies. I had searched for an existing issue but somehow didn't come across that one, thanks!

[github-actions]

I'm going to lock this issue because it has been closed for 30 days ⏳. This helps our maintainers find and focus on the active issues.
If you have found a problem that seems similar to this, please open a new issue and complete the issue template so we can capture all the details necessary to investigate further.