Cognito user pool batch import failure "Cloudwatch Logs Role is missing permissions or has an invalid trust policy"

I'm following the official docs to import users into cognito user pool, but got error in the "aws cognito-idp start-user-import-job" step, error is "An error occurred (PreconditionNotMetException) when calling the StartUserImportJob operation: The configured Cloudwatch Logs Role is missing permissions or has an invalid trust policy." All the role configuration are following the docs here https://docs.aws.amazon.com/cognito/latest/developerguide/cognito-user-pools-using-import-tool.html