AWS cli: Document KMS key option for X-Ray Transaction Search spans log group

Service: cli · 2026-10-20 · Documentation medium

File: cli/latest/reference/xray/update-trace-segment-destination.md · Type: encryption

Summary

Adds the `--cloud-watch-logs-configuration` structure with `SpansLogGroupKmsKeyId` to update-trace-segment-destination, explaining that a customer-managed KMS key encrypts the aws/spans log group, the required kms:DescribeKey permission, and key-policy requirements.

Security assessment

The added text documents encryption-at-rest for X-Ray Transaction Search span logs using a customer-managed KMS key, including the required kms:DescribeKey permission and key-policy grant to CloudWatch Logs. This is security hardening guidance for log data rather than a fix for a specific vulnerability.

Evidence

>> The ARN of an AWS Key Management Service (AWS KMS) key that you create and manage, in the same account and Region, used to encrypt the `aws/spans` log group. Key IDs and alias ARNs are not supported.

Diff

diff --git a/cli/latest/reference/xray/update-trace-segment-destination.md b/cli/latest/reference/xray/update-trace-segment-destination.md
index 21eeeb5..2f350f4 100644
--- a//cli/latest/reference/xray/update-trace-segment-destination.md
+++ b//cli/latest/reference/xray/update-trace-segment-destination.md
@@ -15 +15 @@
-  * [AWS CLI 2.38.1 Command Reference](../../index.html) »
+  * [AWS CLI 2.38.2 Command Reference](../../index.html) »
@@ -67,0 +68 @@ See also: [AWS API Documentation](https://docs.aws.amazon.com/goto/WebAPI/xray-2
+    [--cloud-watch-logs-configuration <value>]
@@ -103,0 +105,33 @@ See also: [AWS API Documentation](https://docs.aws.amazon.com/goto/WebAPI/xray-2
+`--cloud-watch-logs-configuration` (structure)
+
+> Specifies settings for the CloudWatch Logs log groups that X-Ray creates for Transaction Search. Specify this only when `Destination` is `CloudWatchLogs` .
+> 
+> SpansLogGroupKmsKeyId -> (string)
+>
+>> The ARN of an AWS Key Management Service (AWS KMS) key that you create and manage, in the same account and Region, used to encrypt the `aws/spans` log group. Key IDs and alias ARNs are not supported.
+>> 
+>> X-Ray applies the key only when it creates `aws/spans` . If the account already has an `aws/spans` log group, X-Ray fails the request with an `InvalidRequestException` and does not change the log group. To enable Transaction Search with the existing log group as it is, call `UpdateTraceSegmentDestination` again without `SpansLogGroupKmsKeyId` . To set or change the key of the existing log group, use the CloudWatch Logs `AssociateKmsKey` operation.
+>> 
+>> You need `kms:DescribeKey` permission on the key, and the key policy must allow CloudWatch Logs to use the key. For more information, see [Encrypt log data in CloudWatch Logs using AWS Key Management Service](https://docs.aws.amazon.com/AmazonCloudWatch/latest/logs/encrypt-log-data-kms.html) .
+>> 
+>> Constraints:
+>> 
+>>   * min: `1`
+>>   * max: `256`
+>> 
+
+
+Shorthand Syntax:
+    
+    
+    SpansLogGroupKmsKeyId=string
+    
+
+JSON Syntax:
+    
+    
+    {
+      "SpansLogGroupKmsKeyId": "string"
+    }
+    
+
@@ -249 +283 @@ Status -> (string)
-  * [AWS CLI 2.38.1 Command Reference](../../index.html) »
+  * [AWS CLI 2.38.2 Command Reference](../../index.html) »