/AWS1/CL_CWOLOGSENCRYPTIONCONF

Configuration for encrypting centralized destination log groups. By default, this configuration applies only to destination log groups whose corresponding source log groups are encrypted using customer managed KMS keys. To encrypt all destination log groups created by the rule, set EncryptionScope to NEW_DESTINATION_LOG_GROUPS.

CONSTRUCTOR

IMPORTING

Required arguments:

iv_encryptionstrategy TYPE /AWS1/CWOENCRYPTIONSTRATEGY /AWS1/CWOENCRYPTIONSTRATEGY

Configuration that determines the encryption strategy of the destination log groups. CUSTOMER_MANAGED uses the configured KmsKeyArn to encrypt newly created destination log groups.

Optional arguments:

iv_kmskeyarn TYPE /AWS1/CWORESOURCEARN /AWS1/CWORESOURCEARN

KMS Key ARN belonging to the primary destination account and region, to encrypt newly created central log groups in the primary destination.

iv_encconflictresolstrategy TYPE /AWS1/CWOENCCONFLICTRESOLSTRAG /AWS1/CWOENCCONFLICTRESOLSTRAG

Conflict resolution strategy for centralization if the encryption strategy is set to CUSTOMER_MANAGED and the destination log group is encrypted with an AWS_OWNED KMS Key. ALLOW lets centralization go through while SKIP prevents centralization into the destination log group.

iv_encryptionscope TYPE /AWS1/CWOENCRYPTIONSCOPE /AWS1/CWOENCRYPTIONSCOPE

Determines which newly created destination log groups are encrypted with the configured KmsKeyArn when EncryptionStrategy is CUSTOMER_MANAGED.

If you set this to ENCRYPTED_SOURCE_ONLY (the default), only destination log groups whose source log group is encrypted with a customer managed KMS key use the configured KmsKeyArn. Destination log groups derived from Amazon Web Services owned encrypted source log groups remain Amazon Web Services owned encrypted.

If you set this to NEW_DESTINATION_LOG_GROUPS, every new destination log group created by this rule uses the configured KmsKeyArn, regardless of the source log group's encryption posture.

This field is not valid when EncryptionStrategy is AWS_OWNED.

---

Queryable Attributes

EncryptionStrategy

Configuration that determines the encryption strategy of the destination log groups. CUSTOMER_MANAGED uses the configured KmsKeyArn to encrypt newly created destination log groups.

Accessible with the following methods

Method	Description
GET_ENCRYPTIONSTRATEGY()	Getter for ENCRYPTIONSTRATEGY, with configurable default
ASK_ENCRYPTIONSTRATEGY()	Getter for ENCRYPTIONSTRATEGY w/ exceptions if field has no
HAS_ENCRYPTIONSTRATEGY()	Determine if ENCRYPTIONSTRATEGY has a value

KmsKeyArn

KMS Key ARN belonging to the primary destination account and region, to encrypt newly created central log groups in the primary destination.

Accessible with the following methods

Method	Description
GET_KMSKEYARN()	Getter for KMSKEYARN, with configurable default
ASK_KMSKEYARN()	Getter for KMSKEYARN w/ exceptions if field has no value
HAS_KMSKEYARN()	Determine if KMSKEYARN has a value

EncryptionConflictResolutionStrategy

Conflict resolution strategy for centralization if the encryption strategy is set to CUSTOMER_MANAGED and the destination log group is encrypted with an AWS_OWNED KMS Key. ALLOW lets centralization go through while SKIP prevents centralization into the destination log group.

Accessible with the following methods

Method	Description
GET_ENCCONFLICTRESOLSTRATEGY()	Getter for ENCCONFLICTRESOLSTRATEGY, with configurable defau
ASK_ENCCONFLICTRESOLSTRATEGY()	Getter for ENCCONFLICTRESOLSTRATEGY w/ exceptions if field h
HAS_ENCCONFLICTRESOLSTRATEGY()	Determine if ENCCONFLICTRESOLSTRATEGY has a value

EncryptionScope

Determines which newly created destination log groups are encrypted with the configured KmsKeyArn when EncryptionStrategy is CUSTOMER_MANAGED.

If you set this to ENCRYPTED_SOURCE_ONLY (the default), only destination log groups whose source log group is encrypted with a customer managed KMS key use the configured KmsKeyArn. Destination log groups derived from Amazon Web Services owned encrypted source log groups remain Amazon Web Services owned encrypted.

If you set this to NEW_DESTINATION_LOG_GROUPS, every new destination log group created by this rule uses the configured KmsKeyArn, regardless of the source log group's encryption posture.

This field is not valid when EncryptionStrategy is AWS_OWNED.

Accessible with the following methods

Method	Description
GET_ENCRYPTIONSCOPE()	Getter for ENCRYPTIONSCOPE, with configurable default
ASK_ENCRYPTIONSCOPE()	Getter for ENCRYPTIONSCOPE w/ exceptions if field has no val
HAS_ENCRYPTIONSCOPE()	Determine if ENCRYPTIONSCOPE has a value