aws logs associate-kms-key
Associates the specified KMS key with either one log group in the account, or with all stored CloudWatch Logs query insights results in the account. AWS CLI reference
3 options Its page in the AWS CLI reference
Options
--kms-key-idThe Amazon Resource Name (ARN) of the KMS key to use when encrypting log data.--log-group-nameThe name of the log group.--resource-identifierSpecifies the target for this operation.