Problems adding a logging configuration to waf web acl

The error you're encountering is related to the naming convention required for AWS WAF logging destinations. When creating a logging destination for AWS WAF, the name of your logging destination (in this case, your CloudWatch Logs log group) must start with aws-waf-logs-.

While you've correctly included this prefix in your log group name (/aws-waf-logs-test), the forward slash at the beginning might be causing the issue. CloudWatch Logs log group names can include forward slashes, but for AWS WAF logging configuration, try creating your log group without the leading slash:

aws logs create-log-group --log-group-name aws-waf-logs-test --region eu-north-1

Then update your logging configuration command to use this log group:

aws wafv2 put-logging-configuration \
--logging-configuration '{
"ResourceArn": "arn:aws:wafv2:eu-north-1:<account>:regional/webacl/<name>/28848694-e9dc-4f53-9324-7917db2371ed",
"LogDestinationConfigs": ["arn:aws:logs:eu-north-1:<account>:log-group:aws-waf-logs-test"]
}' \
--region eu-north-1

The key requirements for AWS WAF logging are:

1. The logging destination name must start with aws-waf-logs-
2. The ARN format must be correct for the destination type

When you successfully enable logging, AWS WAF will automatically create the necessary resource policy on the log group to allow writing logs to it.
Sources
PutLoggingConfiguration - AWS WAFV2
AWS WAFV2 examples using AWS CLI - AWS SDK Code Examples
Logging AWS WAF protection pack (web ACL) traffic - AWS WAF, AWS Firewall Manager, AWS Shield Advanced, and AWS Shield network security director

Hello.

Why not try registering it in an abbreviated format instead of JSON?
https://repost.aws/knowledge-center/waf-send-logs-centralized-account

aws wafv2 put-logging-configuration --logging-configuration ResourceArn=arn:aws:wafv2:eu-north-1:<account>:regional/webacl/<name>/28848694-e9dc-4f53-9324-7917db2371ed,LogDestinationConfigs=arn:aws:logs:eu-north-1:<account>:log-group:/aws-waf-logs-test --region eu-north-1

Hey,

Hope you're keeping well.

The error is due to the ARN format being incorrect for both the AWS WAF WebACL and the CloudWatch Logs destination. In the ResourceArn you must include your AWS account ID and the full WebACL name, including its scope, rather than leaving empty segments. For a regional WebACL the ARN format is arn:aws:wafv2:<region>:<account-id>:regional/webacl/<web-acl-name>/<web-acl-id> and the log group ARN must be arn:aws:logs:<region>:<account-id>:log-group:<log-group-name> as documented in the AWS WAF logging configuration reference.

Thanks and regards,
Taz