Service logs are not encrypted, resulting in increased exposure should sensitive fields appear in logs
Open
@LDiazN is already working on this.
Since Jul 2, 2025.
funder/otffoss2025
security
- Dominant language
- HCL
- Stars
- 4
- Forks
- 15
- Avg merge
- 1h 50m
- Merged PRs (30d)
- 4
Description
Logs should be encrypted to reduce exposure in case sensitive information leaks into them, for example from a crash.
Encryption in CloudWatch log groups is not enabled by default, and must be provided with a key from AWS KMS in order
to begin encrypting log entries.
We should create a KMS key for logs and provide it to the log groups to start encrypting logs. Review any existing logs for sensitive
information disclosure and delete as required.
Contributor guide
No contributing guide indexed for this repository
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Assessment
This issue has not been assessed yet.