# CloudWatchEncryption

CloudWatch Logs encryption configuration for a `SecurityConfiguration`.

CloudWatch Logs support only server-side encryption with a KMS key.

- Source: [`lib/security-configuration.ts`](https://github.com/aws/aws-cdk/blob/v2.274.0-alpha.0/packages/@aws-cdk/aws-glue-alpha/lib/security-configuration.ts#L89)
- Type last changed: v2.270.0-alpha.0 · 18 Sep 2026

## Example

```ts
new glue.SecurityConfiguration(this, 'MySecurityConfiguration', {
  cloudWatchEncryption: glue.CloudWatchEncryption.kms(),
  jobBookmarksEncryption: glue.JobBookmarksEncryption.clientSideKms(),
  s3Encryption: glue.S3Encryption.kms(),
});
```

## Methods

- `kms(kmsKey?: IKeyRef): CloudWatchEncryption // chainable` (static) — Server-side encryption (SSE) with an AWS KMS key managed by the account owner.

  **Parameters**

  - `kmsKey` — the KMS key used to encrypt the data.