logs:AssociateKmsKey

Write

logs:AssociateKmsKey is a Write access-level action in the logs service. Grants permission to associate the specified AWS Key Management Service (AWS KMS) customer master key (CMK) with the specified log group

Resource types

ARNs that logs:AssociateKmsKey can be scoped to in an IAM policy.

arn:${Partition}:logs:${Region}:${Account}:log-group:${LogGroupName}

log-group

Condition keys

Keys you can use in the Condition block of a policy that grants logs:AssociateKmsKey.

aws:ResourceTag/${TagKey} String

Filters access by the tags associated with the resource

Example IAM policy

A minimal policy that allows logs:AssociateKmsKey. Replace "Resource": "*" with a specific ARN to follow least privilege.

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Sid": "AllowLogsAssociateKmsKey",
      "Effect": "Allow",
      "Action": "logs:AssociateKmsKey",
      "Resource": "*"
    }
  ]
}

Related actions in logs

logs:AssociateSourceToS3TableIntegration Write logs:CallWithBearerToken Write logs:CancelExportTask Write logs:CancelImportTask Write logs:CreateDelivery Write logs:CreateExportTask Write logs:CreateImportTask Write logs:CreateLogAnomalyDetector Write logs:CreateLogDelivery Write logs:CreateLogGroup Write logs:CreateLogStream Write logs:CreateLookupTable Write

View all logs actions →