Session manager logging to encrypted CloudWatch Log group

When you encounter the error "We couldn't start the session because encryption is not set up on the selected CloudWatch Logs log group," there are two main approaches to resolve this issue:

Option 1: Disable the encryption requirement in Session Manager preferences

1. Open the AWS Systems Manager console
2. Navigate to Session Manager, then Preferences, and select Edit
3. Under CloudWatch logging, uncheck the "Allow only encrypted CloudWatch log groups" option
4. Save your changes

This will allow Session Manager to send logs to your CloudWatch log group without requiring encryption.

Option 2: Ensure proper permissions are configured (recommended if you want to maintain encryption) For instances managed with an IAM instance profile:

• Add a policy to the instance profile that provides permissions to upload encrypted logs to CloudWatch Logs
• Ensure the policy includes the necessary kms:Decrypt permissions for the KMS key you're using (accelerator/kms/cloudwatch/key)

For instances managed with Default Host Management Configuration:

• Add similar permissions to the IAM role used for management

The error occurs because Session Manager is unable to validate the encryption on your CloudWatch Logs log group, likely due to missing permissions to use the KMS key for encryption/decryption operations. Even though your log group is encrypted with the KMS key, the IAM role or instance profile used by Session Manager needs explicit permission to use that key.

CloudWatch Logs supports encryption context using kms:EncryptionContext:aws:logs:arn as the key and the ARN of the log group as the value. If you've restricted your KMS key policy, make sure it allows the necessary operations for the specific log group ARN being used.
Sources
Resolve session failure issues when using AWS Systems Manager Session Manager | AWS re:Post
Encrypt log data in CloudWatch Logs using AWS Key Management Service - Amazon CloudWatch Logs