encrypt *LB access logs if KMS key is specified

[ab77]

• only S3-SSE is available for *LB log delivery

(Override all values in parentheses)

(Run yamllint folder/template.yaml, cfn-lint -i E1019 E3002 E2520 -t folder/template.yaml, and aws cloudformation validate-template --template-body file://folder/template.yaml before you open a PR)

(Do not include multiple changes in one PR. Open additional PRs instead.)

---

Assume encryption of *LB access logs using S3-SSE if KMS key is provided.

[michaelwittig]

I'm a bit confused that setting a KMS key results in a policy that only allows writes using S3-SSE.

I wonder if a new Access type (e.g. ElbAccessLogWriteEncrypted) would be more explicit?

[ab77]

I'm a bit confused that setting a KMS key results in a policy that only allows writes using S3-SSE.

I wonder if a new Access type (e.g. ElbAccessLogWriteEncrypted) would be more explicit?

That's a much better idea, I'll refactor.

[ab77]

I'm a bit confused that setting a KMS key results in a policy that only allows writes using S3-SSE.
I wonder if a new Access type (e.g. ElbAccessLogWriteEncrypted) would be more explicit?

That's a much better idea, I'll refactor.

@michaelwittig I've tested the new approach locally, works.