fix: encrypt logs for new Lambda fns

cloudformation/subscriptions.yaml

@@ -100,6 +100,11 @@ Resources:
 
   RestHookLambdaRole:
     Type: AWS::IAM::Role
+    Metadata:
+      cfn_nag:
+        rules_to_suppress:
+          - id: W11
+            reason: '* only applies to X-Ray statement which does not define a group or sampling-rule'
     Properties:
       AssumeRolePolicyDocument:
         Version: '2012-10-17'

serverless.yaml

@@ -1019,6 +1019,21 @@ resources:
           KmsKeyId: !GetAtt LogKMSKey.Arn
         DependsOn:
           - LogKMSKey
+      SubscriptionsMatcherLogGroup:
+        Properties:
+          KmsKeyId: !GetAtt LogKMSKey.Arn
+        DependsOn:
+          - LogKMSKey
+      SubscriptionReaperLogGroup:
+        Properties:
+          KmsKeyId: !GetAtt LogKMSKey.Arn
+        DependsOn:
+          - LogKMSKey
+      SubscriptionsRestHookLogGroup:
+        Properties:
+          KmsKeyId: !GetAtt LogKMSKey.Arn
+        DependsOn:
+          - LogKMSKey
       ApiGatewayMethodMetadataGet:
         Metadata:
           cfn_nag: