[feat] support Cloudwatch Loggroup encryption at REST using KmsKey

internal/aws/cwlogs/cwlog_client.go

@@ -33,6 +33,14 @@ type Client struct {
 	logRetention int64
 	tags         map[string]*string
 	logger       *zap.Logger
+	kmsKeyId     *string
+}
+
+// WithEncryptionAtRestUsingKmsKey enables the creation of a CloudWatch LogGroup with encryption at rest using KmsKey.
+func WithEncryptionAtRestUsingKmsKey(kmsKeyID *string) func(cloudwatch *Client) {
+	return func(cloudWatchClient *Client) {
+		cloudWatchClient.kmsKeyId = kmsKeyID
+	}
 }
 
 // Create a log client based on the actual cloudwatch logs client.
@@ -45,11 +53,15 @@ func newCloudWatchLogClient(svc cloudwatchlogsiface.CloudWatchLogsAPI, logRetent
 }
 
 // NewClient create Client
-func NewClient(logger *zap.Logger, awsConfig *aws.Config, buildInfo component.BuildInfo, logGroupName string, logRetention int64, tags map[string]*string, sess *session.Session, componentName string) *Client {
+func NewClient(logger *zap.Logger, awsConfig *aws.Config, buildInfo component.BuildInfo, logGroupName string, logRetention int64, tags map[string]*string, sess *session.Session, componentName string, opts ...func(client *Client)) *Client {
 	client := cloudwatchlogs.New(sess, awsConfig)
 	client.Handlers.Build.PushBackNamed(handler.RequestStructuredLogHandler)
 	client.Handlers.Build.PushFrontNamed(newCollectorUserAgentHandler(buildInfo, logGroupName, componentName))
-	return newCloudWatchLogClient(client, logRetention, tags, logger)
+	cloudWatchLogClient := newCloudWatchLogClient(client, logRetention, tags, logger)
+	for _, opt := range opts {
+		opt(cloudWatchLogClient)
+	}
+	return cloudWatchLogClient
 }
 
 // PutLogEvents mainly handles different possible error could be returned from server side, and retries them
@@ -140,6 +152,7 @@ func (client *Client) CreateStream(logGroup, streamName *string) error {
 			// Create Log Group with tags if they exist and were specified in the config
 			_, err = client.svc.CreateLogGroup(&cloudwatchlogs.CreateLogGroupInput{
 				LogGroupName: logGroup,
+				KmsKeyId:     client.kmsKeyId,
 				Tags:         client.tags,
 			})
 			if err == nil {

internal/aws/cwlogs/cwlog_client_test.go

@@ -501,6 +501,32 @@ func TestCreateStream_CreateLogStream_ResourceNotFound(t *testing.T) {
 	svc.AssertExpectations(t)
 	assert.NoError(t, err)
 }
+func TestCreateStream_CreateLogStream_ResourceNotFound_WithEncryptionAtRest(t *testing.T) {
+	logger := zap.NewNop()
+	kmsKeyID := "arn:aws:kms:us-west-2:111122223333:key/1234abcd-12ab-34cd-56ef-1234567890ab"
+	svc := new(mockCloudWatchLogsClient)
+
+	resourceNotFoundException := &cloudwatchlogs.ResourceNotFoundException{}
+	svc.On("CreateLogStream",
+		&cloudwatchlogs.CreateLogStreamInput{LogGroupName: &logGroup, LogStreamName: &logStreamName}).Return(
+		new(cloudwatchlogs.CreateLogStreamOutput), resourceNotFoundException).Once()
+
+	svc.On("CreateLogGroup",
+		&cloudwatchlogs.CreateLogGroupInput{LogGroupName: &logGroup, KmsKeyId: &kmsKeyID}).Return(
+		new(cloudwatchlogs.CreateLogGroupOutput), nil)
+
+	svc.On("CreateLogStream",
+		&cloudwatchlogs.CreateLogStreamInput{LogGroupName: &logGroup, LogStreamName: &logStreamName}).Return(
+		new(cloudwatchlogs.CreateLogStreamOutput), nil).Once()
+
+	client := newCloudWatchLogClient(svc, 0, nil, logger)
+	client.kmsKeyId = &kmsKeyID
+
+	err := client.CreateStream(&logGroup, &logStreamName)
+
+	svc.AssertExpectations(t)
+	assert.NoError(t, err)
+}
 
 type UnknownError struct {
 	otherField string