How to Encrypt an Existing CloudWatch Log Group with KMS?

DVA-C02 By islever Editorial Last updated

Short answer

D Use the AWS CLI aws logs associate-kms-key command, and specify the key Amazon Resource Name (ARN).

Question

A developer is publishing critical log data to a log group in Amazon CloudWatch Logs. The log group was created 2 months ago. The developer must encrypt the log data by using an AWS Key Management Service (AWS KMS) key so that future data can be encrypted to comply with the company's security policy. Which solution will meet this requirement with the LEAST effort?
  1. Use the AWS Encryption SDK for encryption and decryption of the data before writing to the log group.
  2. Use the AWS KMS console to associate the KMS key with the log group.
  3. Use the AWS CLI aws logs create-log-group command, and specify the key Amazon Resource Name (ARN).
  4. Use the AWS CLI aws logs associate-kms-key command, and specify the key Amazon Resource Name (ARN). Correct Answer

Key Takeaways

The exam tests recognition of the specific CLI command for attaching KMS keys to pre-existing log groups, while the trap lies in overcomplicating the solution with client-side encryption or unnecessary resource recreation.

This scenario tests server-side encryption configuration for CloudWatch Logs using AWS KMS. The community unanimously agrees that leveraging the dedicated AWS CLI command provides the most efficient path to compliance.

Expert Analysis

Why the Answer Is Correct

The aws logs associate-kms-key command is specifically designed to attach an AWS KMS customer master key to an existing CloudWatch log group. This operation enables server-side encryption for all future ingested log data without requiring developers to modify application code or recreate the log group. Because it executes a single API call via the CLI, it perfectly satisfies the LEAST effort requirement outlined in the scenario.

Why the Other Options Are Wrong

Option A introduces client-side encryption, which forces significant code refactoring and key management overhead within the application layer. Option B is invalid because the AWS KMS console does not provide a native interface to associate keys directly with CloudWatch log groups. Option C incorrectly suggests using the create-log-group command, which would establish a completely new resource rather than securing the existing two-month-old log group mentioned in the prompt.

Community Comment Notes

Contributors consistently validated option D by referencing the exact AWS CLI syntax and official documentation. Comment [2] provides the authoritative reference link confirming the command structure, while comment [3] reinforces the correct parameter mapping for the association. The unanimous voting pattern demonstrates strong alignment on this straightforward CLI integration task.

Official Reference

These links open the official vendor documentation in a new tab.

Exam Strategy

Always prioritize built-in service integrations and dedicated CLI commands over manual workarounds or code-level modifications when questions emphasize efficiency. Carefully distinguish between configuring existing resources versus provisioning new ones to avoid falling for recreation-based distractors.

Community Votes

D
100%

100% of anonymous learners picked answer D. Votes are pick records left by other test-takers — they are not the verified answer.

Discussion 4 contributions

Compiled from public community threads and reader submissions, lightly edited for clarity. Handles and vote tallies are shown as recorded, and comments reflect the views of individual contributors.

From public community threads 4

  1. cachac 👍 3 Answered D
    associate-kms-key command. This command specifically associates a KMS key with an existing log group, which is exactly what the developer needs to do.
  2. KarBiswa 👍 3 Answered D
    https://docs.aws.amazon.com/cli/latest/reference/logs/associate-kms-key.html
  3. albert_kuo 👍 2 Answered D
    aws logs associate-kms-key --log-group-name <LogGroupName> --kms-key-id <KMSKeyARN>
  4. 65703c1 👍 1 Answered D
    D is the correct answer.

Reader comments & corrections

No reader corrections yet — spotted an error or have a note? Share it below.

Log in to comment, report an error, or add a note about this question.

Submitted for moderation before publishing. Keep it helpful and respectful.

How to Log Every Lambda Invocation to an SQS Queue?

S-grade

How to Test Updated Lambda Functions with a Subset of Users Using API Gateway?

S-grade

How to automate S3 object tagging after delayed third-party content audit?

S-grade

How to automatically rotate encryption keys for API keys in serverless apps with no development effort?

S-grade

Practice All DVA-C02 Questions

Access 100 questions with complete answers and detailed explanations.

View Full DVA-C02 Practice Test →

← Back to DVA-C02 Study Guide