Fix kms security issue (#9)

* (fix): cloudwatch log kms_id optional

* (update): rename the log retention

* (update): naming variable

* (update): README.md

* (update): usage in README

Author: xshot9011

README.md

@@ -57,8 +57,9 @@ module "lambda_from_bucket" {
   }
 
   # Logging
-  is_create_cloudwatch_log_group = true # Default is `true`
-  retention_in_days              = 30   # Default is `30`
+  is_create_cloudwatch_log_group   = true # Default is `true`
+  cloudwatch_log_retention_in_days = 90   # Default is 90 days
+  cloudwatch_log_kms_key_id        = null # Specify the kms to encrypt cloudwatch log
 
   # Secret for lambda function
   ssm_params = {}
@@ -189,6 +190,8 @@ module "lambda_from_local" {
 |--------------------------------------------------------------------------------------------------------------------------------------------------|----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|-------------------------------------------------------------------------------------------------------------------------|-------------------------------------------------------------------------------------|:--------:|
 | <a name="input_additional_lambda_role_policy_arns"></a> [additional\_lambda\_role\_policy\_arns](#input\_additional\_lambda\_role\_policy\_arns) | List of policies ARNs to attach to the lambda                                                                                                                                                                                                                                                                                                                                                                                                                                                                              | `list(string)`                                                                                                          | `[]`                                                                                |    no    |
 | <a name="input_bucket_name"></a> [bucket\_name](#input\_bucket\_name)                                                                            | Name of the bucket to put the file in. Alternatively, an S3 access point ARN can be specified.                                                                                                                                                                                                                                                                                                                                                                                                                             | `string`                                                                                                                | `""`                                                                                |    no    |
+| <a name="input_cloudwatch_log_kms_key_id"></a> [cloudwatch\_log\_kms\_key\_id](#input\_cloudwatch\_log\_kms\_key\_id)                            | The ARN for the KMS encryption key.                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        | `string`                                                                                                                | `null`                                                                              |    no    |
+| <a name="input_cloudwatch_log_retention_in_days"></a> [cloudwatch\_log\_retention\_in\_days](#input\_cloudwatch\_log\_retention\_in\_days)       | Retention day for cloudwatch log group                                                                                                                                                                                                                                                                                                                                                                                                                                                                                     | `number`                                                                                                                | `90`                                                                                |    no    |
 | <a name="input_compressed_local_file_dir"></a> [compressed\_local\_file\_dir](#input\_compressed\_local\_file\_dir)                              | A path to the directory to store plan time generated local files                                                                                                                                                                                                                                                                                                                                                                                                                                                           | `string`                                                                                                                | `""`                                                                                |    no    |
 | <a name="input_config_file_name"></a> [config\_file\_name](#input\_config\_file\_name)                                                           | The name of the file var.plaintext\_params will be written to as json                                                                                                                                                                                                                                                                                                                                                                                                                                                      | `string`                                                                                                                | `"config.json"`                                                                     |    no    |
 | <a name="input_dead_letter_target_arn"></a> [dead\_letter\_target\_arn](#input\_dead\_letter\_target\_arn)                                       | Dead letter queue configuration that specifies the queue or topic where Lambda sends asynchronous events when they fail processing.                                                                                                                                                                                                                                                                                                                                                                                        | `string`                                                                                                                | `null`                                                                              |    no    |
@@ -208,7 +211,6 @@ module "lambda_from_local" {
 | <a name="input_plaintext_params"></a> [plaintext\_params](#input\_plaintext\_params)                                                             | Lambda@Edge does not support env vars, so it is a common pattern to exchange Env vars for values read from a config file.<br>  ! PLAINTEXT<pre>const config = JSON.parse(readFileSync('./config.json'))<br>  const someConfigValue = config.SomeKey</pre>                                                                                                                                                                                                                                                                  | `map(string)`                                                                                                           | `{}`                                                                                |    no    |
 | <a name="input_prefix"></a> [prefix](#input\_prefix)                                                                                             | The prefix name of customer to be displayed in AWS console and resource                                                                                                                                                                                                                                                                                                                                                                                                                                                    | `string`                                                                                                                | n/a                                                                                 |   yes    |
 | <a name="input_reserved_concurrent_executions"></a> [reserved\_concurrent\_executions](#input\_reserved\_concurrent\_executions)                 | (Optional) Amount of reserved concurrent executions for this lambda function. A value of 0 disables lambda from being triggered and -1 removes any concurrency limitations. Defaults to Unreserved Concurrency Limits -1. See Managing Concurrency                                                                                                                                                                                                                                                                         | `number`                                                                                                                | `-1`                                                                                |    no    |
-| <a name="input_retention_in_days"></a> [retention\_in\_days](#input\_retention\_in\_days)                                                        | Retention day for cloudwatch log group                                                                                                                                                                                                                                                                                                                                                                                                                                                                                     | `number`                                                                                                                | `30`                                                                                |    no    |
 | <a name="input_runtime"></a> [runtime](#input\_runtime)                                                                                          | The runtime of the lambda function                                                                                                                                                                                                                                                                                                                                                                                                                                                                                         | `string`                                                                                                                | n/a                                                                                 |   yes    |
 | <a name="input_source_code_dir"></a> [source\_code\_dir](#input\_source\_code\_dir)                                                              | An absolute path to the directory containing the code to upload to lambda                                                                                                                                                                                                                                                                                                                                                                                                                                                  | `string`                                                                                                                | `""`                                                                                |    no    |
 | <a name="input_ssm_params"></a> [ssm\_params](#input\_ssm\_params)                                                                               | Lambda@Edge does not support env vars, so it is a common pattern to exchange Env vars for SSM params.<br>  ! SECRET<br><br>  you would have lookups in SSM, like:<br>  `const someEnvValue = await ssmClient.getParameter({ Name: 'SOME_SSM_PARAM_NAME', WithDecryption: true })`                                                                                                                                                                                                                                          | `map(string)`                                                                                                           | `{}`                                                                                |    no    |

main.tf

@@ -307,7 +307,8 @@ resource "aws_cloudwatch_log_group" "this" {
   count = var.is_create_cloudwatch_log_group ? 1 : 0
 
   name              = format("/aws/lambda/%s-function", local.name)
-  retention_in_days = var.retention_in_days
+  retention_in_days = var.cloudwatch_log_retention_in_days
+  kms_key_id        = var.cloudwatch_log_kms_key_id
 
   tags = merge(local.tags, { "Name" = format("/aws/lambda/%s-function", local.name) })
 }

variables.tf

@@ -194,12 +194,17 @@ variable "is_create_cloudwatch_log_group" {
   default     = true
 }
 
-variable "retention_in_days" {
+variable "cloudwatch_log_retention_in_days" {
   description = "Retention day for cloudwatch log group"
   type        = number
-  default     = 30
+  default     = 90
 }
 
+variable "cloudwatch_log_kms_key_id" {
+  description = "The ARN for the KMS encryption key."
+  type        = string
+  default     = null
+}
 
 variable "ssm_params" {
   description = <<EOF