rules:
  - id: missing-cloudwatch-log-group-kms-key
    patterns:
      - patterns:
          - pattern: resource "aws_cloudwatch_log_group" $ANYTHING {...}
          - pattern-not-inside: |
              resource "aws_cloudwatch_log_group" $ANYTHING {
                ...
                kms_key_id = ...
                ...
              }
    message: >-
      The AWS CloudWatch Log group is missing a KMS key. While Log group data is always encrypted, you can optionally use a KMS key instead. Add `kms_key_id = "yourKey"` to your resource block.
    languages: [hcl]
    severity: WARNING
    metadata:
      technology:
        - aws
        - terraform
      category: best-practice