How to Encrypt an Existing CloudWatch Log Group with KMS?

A developer is publishing critical log data to a log group in Amazon CloudWatch Logs. The log group was created 2 months ago. The developer must encrypt the log data by using an AWS Key Management Service (AWS KMS) key so that future data can be encrypted to comply with the company's security policy. Which solution will meet this requirement with the LEAST effort?

Use the AWS Encryption SDK for encryption and decryption of the data before writing to the log group.
Use the AWS KMS console to associate the KMS key with the log group.
Use the AWS CLI aws logs create-log-group command, and specify the key Amazon Resource Name (ARN).
Use the AWS CLI aws logs associate-kms-key command, and specify the key Amazon Resource Name (ARN). Source Reference Answer

Community Votes

100%

100% of anonymous learners picked answer D. Votes are pick records left by other test-takers — they are not the verified answer.

Community Insight

The exam tests recognition of the specific CLI command for attaching KMS keys to pre-existing log groups, while the trap lies in overcomplicating the solution with client-side encryption or unnecessary resource recreation.

This scenario tests server-side encryption configuration for CloudWatch Logs using AWS KMS. The community unanimously agrees that leveraging the dedicated AWS CLI command provides the most efficient path to compliance.

Community Discussion (4 comments)

albert_kuo 👍 2 Selected: D

aws logs associate-kms-key --log-group-name <LogGroupName> --kms-key-id <KMSKeyARN>

cachac 👍 3 Selected: D

associate-kms-key command. This command specifically associates a KMS key with an existing log group, which is exactly what the developer needs to do.

65703c1 👍 1 Selected: D

D is the correct answer.

KarBiswa 👍 3 Selected: D

https://docs.aws.amazon.com/cli/latest/reference/logs/associate-kms-key.html

Comments & Corrections

No comments yet — spotted an error or have a note? Share it below.

Expert Analysis

Why the Answer Is Correct

The aws logs associate-kms-key command is specifically designed to attach an AWS KMS customer master key to an existing CloudWatch log group. This operation enables server-side encryption for all future ingested log data without requiring developers to modify application code or recreate the log group. Because it executes a single API call via the CLI, it perfectly satisfies the LEAST effort requirement outlined in the scenario.

Why the Other Options Are Wrong

Option A introduces client-side encryption, which forces significant code refactoring and key management overhead within the application layer. Option B is invalid because the AWS KMS console does not provide a native interface to associate keys directly with CloudWatch log groups. Option C incorrectly suggests using the create-log-group command, which would establish a completely new resource rather than securing the existing two-month-old log group mentioned in the prompt.

Community Comment Notes

Contributors consistently validated option D by referencing the exact AWS CLI syntax and official documentation. Comment [2] provides the authoritative reference link confirming the command structure, while comment [3] reinforces the correct parameter mapping for the association. The unanimous voting pattern demonstrates strong alignment on this straightforward CLI integration task.

Official Reference

Exam Strategy

Always prioritize built-in service integrations and dedicated CLI commands over manual workarounds or code-level modifications when questions emphasize efficiency. Carefully distinguish between configuring existing resources versus provisioning new ones to avoid falling for recreation-based distractors.

Related Analysis

Practice All DVA-C02 Questions

Access 100 questions with complete answers and detailed explanations.

View Full DVA-C02 Practice Test →

← Back to DVA-C02 Study Guide