Skip to content
v2.275.0

LogsEncryptionConfigurationProperty Struct ​

Configuration for encrypting centralized log groups.

This configuration is only applied to destination log groups for which the corresponding source log groups are encrypted using Customer Managed KMS Keys.

Example ​

ts
// The code below shows an example of how to instantiate this type.
// The values are placeholders you should change.
import { aws_observabilityadmin as observabilityadmin } from 'aws-cdk-lib';
const logsEncryptionConfigurationProperty: observabilityadmin.CfnOrganizationCentralizationRule.LogsEncryptionConfigurationProperty = {
  encryptionStrategy: 'encryptionStrategy',

  // the properties below are optional
  encryptionConflictResolutionStrategy: 'encryptionConflictResolutionStrategy',
  encryptionScope: 'encryptionScope',
  kmsKeyArn: 'kmsKeyArn',
};

Properties ​

encryptionConflictResolutionStrategyoptionalstringencryption_conflict_resolution_strategyoptionalstrencryptionConflictResolutionStrategyoptionalStringEncryptionConflictResolutionStrategyoptionalstringEncryptionConflictResolutionStrategyoptional*string#
Conflict resolution strategy for centralization if the encryption strategy is set to CUSTOMER_MANAGED and the destination log group is encrypted with an AWS_OWNED KMS Key.

ALLOW lets centralization go through while SKIP prevents centralization into the destination log group.

encryptionScopeoptionalstringencryption_scopeoptionalstrencryptionScopeoptionalStringEncryptionScopeoptionalstringEncryptionScopeoptional*string#
encryptionStrategystringencryption_strategystrencryptionStrategyStringEncryptionStrategystringEncryptionStrategy*stringrequired#
Configuration that determines the encryption strategy of the destination log groups.

CUSTOMER_MANAGED uses the configured KmsKeyArn to encrypt newly created destination log groups.

kmsKeyArnoptionalstringkms_key_arnoptionalstrkmsKeyArnoptionalStringKmsKeyArnoptionalstringKmsKeyArnoptional*string#
KMS Key ARN belonging to the primary destination account and region, to encrypt newly created central log groups in the primary destination.