KendraCustomerSession permission to access logs:DescribeLogGroups

How about this:

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": "logs:DescribeLogGroups",
      "Resource": "*"
    }
  ]
}

Expect result:

• Grants permission to describe all log groups in CloudWatch Logs.
• The Resource: "*" is necessary because logs:DescribeLogGroups is a non-resource-level API, meaning it doesn’t support fine-grained resource scoping.

Attach the Policy:

• Go to the IAM console in AWS.
• Find the role or user associated with KendraCustomerSession.
• Attach a new inline policy or add this to an existing one.
• Save and test the sync job again.

Hey,

Hope you're keeping well.

The logs:DescribeLogGroups action is a CloudWatch Logs API that doesn’t support resource-level permissions, so it must be granted with Resource: "*". In IAM, locate the role used by KendraCustomerSession (this is likely created automatically for your Q Business or Kendra app) and attach an inline policy such as:

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": "logs:DescribeLogGroups",
      "Resource": "*"
    }
  ]
}

Once attached, re-run your sync job. If you also see errors for other CloudWatch Logs actions, you may need to add them to the same statement so the role can fully access the required log groups.

Thanks and regards,
Taz