InsufficientCloudWatchLogsResourcePolicy

Amazon Route 53 doesn't have the permissions required to create log streams and send query logs to log streams. Possible causes include the following:

• There is no resource policy that specifies the log group ARN in the value for Resource.

• The resource policy that includes the log group ARN in the value for Resource doesn't have the necessary permissions.

• The resource policy hasn't finished propagating yet.

• The Key management service (KMS) key you specified doesn’t exist or it can’t be used with the log group associated with query log. Update or provide a resource policy to grant permissions for the KMS key.

• The Key management service (KMS) key you specified is marked as disabled for the log group associated with query log. Update or provide a resource policy to grant permissions for the KMS key.