CloudFormation HostedZone CREATE_FAILED – InvalidInputException: ARN for CloudWatch Logs log group is invalid

I understand you're experiencing an issue with a CloudFormation HostedZone resource failing due to an invalid CloudWatch Logs log group ARN.

This error typically occurs when there's a problem with the format of the ARN you're providing for the CloudWatch Logs log group in your Route53 HostedZone's QueryLoggingConfig.

A common cause of this issue is including a wildcard character (*) at the end of the log group ARN. While wildcards are mentioned in documentation examples (like arn:aws:logs:us-east-1:123412341234:log-group:/aws/route53/*), they can cause validation errors in certain contexts.

To fix this issue, you can try removing the wildcard character from the end of your log group ARN. If you're using the !GetAtt function to reference your log group ARN and it's automatically appending a wildcard, you can use the following approach to remove it:

!Select [ 0, !Split [ ':*', !GetAtt YourLogGroup.Arn ] ]

This solution splits the ARN at the :* and selects the first part, effectively removing the wildcard character.

Unfortunately, AWS doesn't offer live chat support through this interface. For immediate assistance, you would need to contact AWS Support through your AWS Management Console if you have a support plan.
Sources
This AWS::Cognito::LogDeliveryConfiguration resource is in a CREATE_FAILED state because of a regex mismatch? | AWS re:Post
AWS::Route53::HostedZone - AWS CloudFormation
AWS::Route53::HostedZone QueryLoggingConfig - AWS CloudFormation