A CloudWatch Logs log group (created 2 months ago) must have future log data encrypted with a customer-managed AWS KMS key to meet a security requirement. Which option meets this need with the least effort?
Choose an answer
Tap an option to check your answer.
Correct answer: Use the AWS CLI aws logs associate-kms-key command to associate the log group with the KMS key ARN..
Why this is the answer
The aws logs associate-kms-key command is the correct and most efficient way to encrypt an existing CloudWatch Logs log group with a customer-managed AWS KMS key. This command directly links the specified KMS key to the log group, ensuring all future ingested logs are encrypted at rest using that key. Encrypting and decrypting data before writing with the AWS Encryption SDK is unnecessary and adds complexity, as CloudWatch Logs handles encryption natively. Attaching a KMS key directly to a log group via the KMS console is not a supported operation. The aws logs create-log-group command is used for new log groups; it cannot modify an existing one to add KMS encryption.
Pass your exam — without the endless answer hunt
Get every verified question and explanation for this exam in one place, and save hours of prep. 1,000+ certifications · 20+ languages · free to start.
Pass your exam faster → No card needed