# CloudWatchEncryption

CloudWatch Logs encryption configuration for a `SecurityConfiguration`.

CloudWatch Logs support only server-side encryption with a KMS key.

- Source: [`aws-glue/lib/security-configuration.ts`](https://github.com/aws/aws-cdk/blob/v2.275.0/packages/aws-cdk-lib/aws-glue/lib/security-configuration.ts#L89)
- Type last changed: v2.270.0 · 17 Sep 2026

## Example

```ts
new glue.SecurityConfiguration(this, 'MySecurityConfiguration', {
  cloudWatchEncryption: glue.CloudWatchEncryption.kms(),
  jobBookmarksEncryption: glue.JobBookmarksEncryption.clientSideKms(),
  s3Encryption: glue.S3Encryption.kms(),
});
```

## Methods

- `kms(kmsKey?: IKeyRef): CloudWatchEncryption // chainable` (static) — Server-side encryption (SSE) with an AWS KMS key managed by the account owner.

  **Parameters**

  - `kmsKey` — the KMS key used to encrypt the data.