Ensure an AWS Key Management Service (KMS) Customer Managed Key (CMK) is used to encrypt AWS CloudWatch Log Group

Using customer managed keys will give administrators control over how data is encrypted to better meet compliance regulations, as well as allow for a more specific key rotation period. Using system-generated keys can sometimes lead to expired or exposed keys remaining in use, leading to insecure data. It is often recommended to use a customer managed key when the service is available.

In AWS Console -

1. Create an AWS KMS customer managed key.
2. Set the necessary permissions on the customer managed key.
3. Associate a log group with a customer managed key.

In Terraform -

1. In the aws_cloudwatch_log_group resource, set the kms_key_id field to a customer managed key ID.

References:
https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/cloudwatch_log_group