Cloudwatch Logs w/encryption. S3 Logs bucket w/encryption. Session KMS key for encryption at rest. With this module you can also create custom documents to execute on your instances with SSM Agent ...