[feat] support Cloudwatch Loggroup encryption at REST using KmsKey

.chloggen/feat_cloudwatch-encryption-at-rest.yaml

@@ -0,0 +1,27 @@
+# Use this changelog template to create an entry for release notes.
+
+# One of 'breaking', 'deprecation', 'new_component', 'enhancement', 'bug_fix'
+change_type: "enhancement"
+
+# The name of the component, or a single word describing the area of concern, (e.g. filelogreceiver)
+component: "internal/aws/cwlogs"
+
+# A brief description of the change.  Surround your text with quotes ("") if it needs to start with a backtick (`).
+note: added support to encryption at rest using KmsKey
+
+# Mandatory: One or more tracking issues related to the change. You can use the PR number here if no issue exists.
+issues: [31788]
+
+# (Optional) One or more lines of additional information to render under the primary note.
+# These lines will be padded with 2 spaces and then inserted directly into the document.
+# Use pipe (|) for multiline entries.
+subtext:
+
+# If your change doesn't affect end users or the exported elements of any package,
+# you should instead start your pull request title with [chore] or use the "Skip Changelog" label.
+# Optional: The change log or logs in which this entry should be included.
+# e.g. '[user]' or '[user, api]'
+# Include 'user' if the change is relevant to end users.
+# Include 'api' if there is a change to a library API.
+# Default: '[user]'
+change_logs: [api]

internal/aws/cwlogs/cwlog_client.go

@@ -33,6 +33,14 @@ type Client struct {
 	logRetention int64
 	tags         map[string]*string
 	logger       *zap.Logger
+	kmsKeyId     *string
+}
+
+// WithEncryptionAtRestUsingKmsKey enables the creation of a CloudWatch LogGroup with encryption at rest using KmsKey.
+func WithEncryptionAtRestUsingKmsKey(kmsKeyID *string) func(cloudwatch *Client) {
+	return func(cloudWatchClient *Client) {
+		cloudWatchClient.kmsKeyId = kmsKeyID
+	}
 }
 
 // Create a log client based on the actual cloudwatch logs client.
@@ -45,11 +53,15 @@ func newCloudWatchLogClient(svc cloudwatchlogsiface.CloudWatchLogsAPI, logRetent
 }
 
 // NewClient create Client
-func NewClient(logger *zap.Logger, awsConfig *aws.Config, buildInfo component.BuildInfo, logGroupName string, logRetention int64, tags map[string]*string, sess *session.Session, componentName string) *Client {
+func NewClient(logger *zap.Logger, awsConfig *aws.Config, buildInfo component.BuildInfo, logGroupName string, logRetention int64, tags map[string]*string, sess *session.Session, componentName string, opts ...func(client *Client)) *Client {
 	client := cloudwatchlogs.New(sess, awsConfig)
 	client.Handlers.Build.PushBackNamed(handler.RequestStructuredLogHandler)
 	client.Handlers.Build.PushFrontNamed(newCollectorUserAgentHandler(buildInfo, logGroupName, componentName))
-	return newCloudWatchLogClient(client, logRetention, tags, logger)
+	cloudWatchLogClient := newCloudWatchLogClient(client, logRetention, tags, logger)
+	for _, opt := range opts {
+		opt(cloudWatchLogClient)
+	}
+	return cloudWatchLogClient
 }
 
 // PutLogEvents mainly handles different possible error could be returned from server side, and retries them
@@ -140,6 +152,7 @@ func (client *Client) CreateStream(logGroup, streamName *string) error {
 			// Create Log Group with tags if they exist and were specified in the config
 			_, err = client.svc.CreateLogGroup(&cloudwatchlogs.CreateLogGroupInput{
 				LogGroupName: logGroup,
+				KmsKeyId:     client.kmsKeyId,
 				Tags:         client.tags,
 			})
 			if err == nil {

internal/aws/cwlogs/cwlog_client_test.go

@@ -501,6 +501,32 @@ func TestCreateStream_CreateLogStream_ResourceNotFound(t *testing.T) {
 	svc.AssertExpectations(t)
 	assert.NoError(t, err)
 }
+func TestCreateStream_CreateLogStream_ResourceNotFound_WithEncryptionAtRest(t *testing.T) {
+	logger := zap.NewNop()
+	kmsKeyID := "arn:aws:kms:us-west-2:111122223333:key/1234abcd-12ab-34cd-56ef-1234567890ab"
+	svc := new(mockCloudWatchLogsClient)
+
+	resourceNotFoundException := &cloudwatchlogs.ResourceNotFoundException{}
+	svc.On("CreateLogStream",
+		&cloudwatchlogs.CreateLogStreamInput{LogGroupName: &logGroup, LogStreamName: &logStreamName}).Return(
+		new(cloudwatchlogs.CreateLogStreamOutput), resourceNotFoundException).Once()
+
+	svc.On("CreateLogGroup",
+		&cloudwatchlogs.CreateLogGroupInput{LogGroupName: &logGroup, KmsKeyId: &kmsKeyID}).Return(
+		new(cloudwatchlogs.CreateLogGroupOutput), nil)
+
+	svc.On("CreateLogStream",
+		&cloudwatchlogs.CreateLogStreamInput{LogGroupName: &logGroup, LogStreamName: &logStreamName}).Return(
+		new(cloudwatchlogs.CreateLogStreamOutput), nil).Once()
+
+	client := newCloudWatchLogClient(svc, 0, nil, logger)
+	client.kmsKeyId = &kmsKeyID
+
+	err := client.CreateStream(&logGroup, &logStreamName)
+
+	svc.AssertExpectations(t)
+	assert.NoError(t, err)
+}
 
 type UnknownError struct {
 	otherField string