Encryption at rest for OpenTelemetry metrics

What is a CloudWatch Dataset

OpenTelemetry (OTel) metrics that you send to Amazon CloudWatch are stored in a resource called a Dataset. Every Amazon Web Services account has a default dataset in each Region where all OTel metrics reside. The default dataset is the only supported dataset — you cannot create additional datasets.

Datasets can be encrypted and tagged like other Amazon resources. The dataset ARN has the following format:

arn:{partition}:cloudwatch:{region}:{account-id}:dataset/default

To view the current encryption configuration of your dataset, use the GetDataset API:

aws cloudwatch get-dataset \
    --dataset-identifier default

If a customer managed key is associated with the dataset, the response includes the key ARN. If no customer managed key is associated, the dataset is encrypted with an Amazon owned key.

Options for encryption at rest

CloudWatch always encrypts Dataset data at rest. By default, CloudWatch encrypts all data at rest using Amazon owned keys. You don't need to take any action to protect your data using Amazon owned keys. For more information, see Amazon owned keys in the Amazon Key Management Service Developer Guide.

If you want to manage the keys that are used to encrypt your Dataset data, you can use a customer managed key in Amazon Key Management Service (Amazon KMS). For more information, see Customer managed keys in the Amazon Key Management Service Developer Guide.

When you use a customer managed key, Amazon KMS charges apply. For more information about pricing, see Amazon Key Management Service pricing.

How CloudWatch uses a customer managed key for Dataset encryption

When you associate a customer managed key with the default dataset, CloudWatch uses the key to encrypt all OTel metric data stored in that dataset.

CloudWatch uses the service principal (cloudwatch.amazonaws.com) directly with key policy permissions. CloudWatch does not use grants or IAM roles to access your Amazon KMS key.

CloudWatch does not cache data keys. However, CloudWatch caches kms:Decrypt responses for up to 15 minutes. Changes to a key policy might take up to 15 minutes to take effect.

CloudWatch uses the following encryption context for all Amazon KMS cryptographic operations:

Configuring a customer managed key for Dataset

The Amazon KMS key that you use with CloudWatch Dataset must meet the following requirements:

Configuring key policy permissions

To use a customer managed key with CloudWatch Dataset, the key policy must grant CloudWatch permission to use the key. The following example key policy grants CloudWatch the necessary permissions and includes confused deputy protection.

The caller who associates or uses the Dataset must have kms:Decrypt permission, scoped to the CloudWatch ViaService and encryption context as shown in the AllowCallerDecrypt statement below. Replace YourApplicationRole with the IAM role used to call CloudWatch Dataset APIs.

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Sid": "AllowCloudWatchDatasetDescribeKey",
            "Effect": "Allow",
            "Principal": {
                "Service": "cloudwatch.amazonaws.com"
            },
            "Action": "kms:DescribeKey",
            "Resource": "*",
            "Condition": {
                "StringEquals": {
                    "aws:SourceAccount": "account-id"
                },
                "ArnLike": {
                    "aws:SourceArn": "arn:aws:cloudwatch:region:account-id:dataset/default"
                }
            }
        },
        {
            "Sid": "AllowCloudWatchDatasetEncryption",
            "Effect": "Allow",
            "Principal": {
                "Service": "cloudwatch.amazonaws.com"
            },
            "Action": [
                "kms:GenerateDataKey",
                "kms:Encrypt",
                "kms:Decrypt",
                "kms:ReEncrypt*"
            ],
            "Resource": "*",
            "Condition": {
                "StringEquals": {
                    "aws:SourceAccount": "account-id",
                    "kms:EncryptionContext:aws:cloudwatch:arn": "arn:aws:cloudwatch:region:account-id:dataset/default"
                },
                "ArnLike": {
                    "aws:SourceArn": "arn:aws:cloudwatch:region:account-id:dataset/default"
                }
            }
        },
        {
            "Sid": "AllowCallerDecrypt",
            "Effect": "Allow",
            "Principal": {
                "AWS": "arn:aws:iam::account-id:role/YourApplicationRole"
            },
            "Action": "kms:Decrypt",
            "Resource": "*",
            "Condition": {
                "StringEquals": {
                    "kms:ViaService": "cloudwatch.region.amazonaws.com",
                    "kms:EncryptionContext:aws:cloudwatch:arn": "arn:aws:cloudwatch:region:account-id:dataset/default"
                }
            }
        }
    ]
}

Replace account-id and region with your own values.

For more information about key policies, see Key policies in Amazon KMS in the Amazon Key Management Service Developer Guide.

To associate a customer managed key with a Dataset

Use the AssociateDatasetKmsKey API to associate a customer managed key with a Dataset. You must specify default as the dataset identifier.

To associate a customer managed key by using the Amazon CLI, run the following command:

aws cloudwatch associate-dataset-kms-key \
    --dataset-name default \
    --kms-key-arn arn:aws:kms:region:account-id:key/key-id

Changing or removing encryption configuration

You can change or remove the customer managed key that encrypts your Dataset data.

To change the customer managed key

To replace the customer managed key, call AssociateDatasetKmsKey again with a new key ARN. The caller must have kms:Decrypt permission on both the current key and the new key. CloudWatch begins using the new key for subsequent encryption operations.

To remove the customer managed key

To remove the customer managed key and revert to Amazon owned key encryption, call DisassociateDatasetKmsKey. The caller must have kms:Decrypt permission on the currently associated key.

aws cloudwatch disassociate-dataset-kms-key \
    --dataset-name default

If your key is in a disabled state, you must re-enable the key before you can disassociate it from the Dataset.

Scoping down key policy access

You can use conditions in the key policy to limit access to your Amazon KMS key.

Monitoring CloudWatch interaction with Amazon KMS

You can use Amazon CloudTrail to track the requests that CloudWatch sends to Amazon KMS on your behalf. The Amazon CloudTrail log entries use the service principal cloudwatch.amazonaws.com and a ViaService value of cloudwatch.{region}.amazonaws.com.

The following CloudTrail event names appear in log entries for CloudWatch Dataset encryption operations:

Each log entry includes the encryption context, which you can use to identify the specific Dataset that the operation applies to.

For more information about monitoring Amazon KMS key usage, see Monitoring Amazon Key Management Service in the Amazon Key Management Service Developer Guide.