Is cloudwatch_log_group_kms_key_id enforced for FedRAMP Moderate Baseline Rev 4?

Yes, To help protect sensitive data at rest, ensure encryption is enabled for your AWS CloudWatch Log Group.

Is cloudwatch_log_group_retention_in_days enforced for FedRAMP Moderate Baseline Rev 4?

Yes, Ensure a minimum duration of event log data is retained for your log groups to help with troubleshooting and forensics investigations.

3 controls from FedRAMP Moderate Baseline Rev 4 apply to this module.

Control	Clause	Change
CloudWatch log groups should have retention period of at least 365 dayscloudwatch_log_group_retention_period_365 AU-6(1)(3)	AU-6(1)(3)
Log groups should have encryption at rest enabledlog_group_encryption_at_rest_enabled None	None
VPC Security groups should only allow unrestricted incoming traffic for authorized portsvpc_security_group_allows_ingress_authorized_ports SC-7	SC-7