KmsKeyId not valid property for AWS::Logs::LogGroup

[vennemp]

cfn-lint version: (cfn-lint --version)
0.39.0
Description of issue.

  CloudWatchKMS:
    Type: AWS::KMS::Key
    Properties:
      Enabled: true
      EnableKeyRotation: true
      KeyPolicy:
        Version: '2012-10-17'
        Statement:
          - Sid: Enable IAM User Permissions
            Effect: Allow
            Principal:
              AWS: !Sub arn:${AWS::Partition}:iam::${AWS::AccountId}:root
            Action: kms:*
            Resource: '*'
          - Sid: Allow Cloudwatch Access
            Effect: Allow
            Principal:
              Service: logs.region.amazonaws.com
            Action:
              - kms:Encrypt*
              - kms:Decrypt*
              - kms:ReEncrypt*
              - kms:GenerateDataKey*
              - kms:Describe*
            Resource: '*'
  MessagesLogCWGroup:
    Type: AWS::Logs::LogGroup
    Properties: 
      KmsKeyId: !GetAtt CloudWatchKMS.Arn
      LogGroupName: messages
      RetentionInDays: 30

E3002 Invalid Property Resources/MessagesLogCWGroup/Properties/KmsKeyId
template.yaml:627:7

[kddejong]

You can run cfn-lint --update-specs to get the update now or we will have the next release out this week.

[vennemp]

ok so i would run:

cfn-lint --template template.yaml --regions us-gov-west-1 --update-specs

[kddejong]

Just run cfn-lint --update-specs and then run cfn-lint --template template.yaml --regions us-gov-west-1

[PatMyron]

don't think AWS::Logs::LogGroup.KmsKeyId has been published to the us-gov-west-1 Resource Specification yet

so another case of Resource Specifications lagging recent releases, but should be present in the us-east-1 default now

[vennemp]

Thank you. I appreciate you following up.