# LogsEncryptionConfigurationProperty

Configuration for encrypting centralized log groups.

This configuration is only applied to destination log groups for which the corresponding source log groups are encrypted using Customer Managed KMS Keys.

- Source: Generated code
- Type last changed: v2.268.0 · 2 Sep 2026

## Example

```ts
// The code below shows an example of how to instantiate this type.
// The values are placeholders you should change.
import { aws_observabilityadmin as observabilityadmin } from 'aws-cdk-lib';
const logsEncryptionConfigurationProperty: observabilityadmin.CfnOrganizationCentralizationRule.LogsEncryptionConfigurationProperty = {
  encryptionStrategy: 'encryptionStrategy',

  // the properties below are optional
  encryptionConflictResolutionStrategy: 'encryptionConflictResolutionStrategy',
  encryptionScope: 'encryptionScope',
  kmsKeyArn: 'kmsKeyArn',
};
```

## Properties

- `encryptionConflictResolutionStrategy`: string — Conflict resolution strategy for centralization if the encryption strategy is set to CUSTOMER_MANAGED and the destination log group is encrypted with an AWS_OWNED KMS Key.

  ALLOW lets centralization go through while SKIP prevents centralization into the destination log group.

- `encryptionScope`: string

- `encryptionStrategy`: string (required) — Configuration that determines the encryption strategy of the destination log groups.

  CUSTOMER_MANAGED uses the configured KmsKeyArn to encrypt newly created destination log groups.

- `kmsKeyArn`: string — KMS Key ARN belonging to the primary destination account and region, to encrypt newly created central log groups in the primary destination.