The error message you mentioned, “CloudWatch Logs role ARN must be set in account settings to enable logging,” typically occurs when you’re trying to enable logging for an AWS service that requires a CloudWatch Logs role, but the necessary role hasn’t been set up or configured correctly in your account settings. To resolve this issue, you can follow these steps:
Sign in to the AWS Management Console.
Open the AWS CloudTrail console at https://console.aws.amazon.com/cloudtrail/ .
In the navigation pane, click on “Settings.”
Under “Log delivery,” locate the “CloudWatch Logs settings” section.
Ensure that you have a CloudWatch Logs role set up and configured. If you haven’t created a CloudWatch Logs role yet, you can click on the “Create role” button to create one.
Follow the prompts to create the role. Provide a name for the role and select the necessary permissions. The required permissions depend on the service you’re trying to enable logging for. For example, if you’re enabling CloudTrail logging, the role should have permissions to write logs to CloudWatch Logs.
After creating the role, go back to the CloudTrail settings page and select the newly created role from the dropdown menu under “CloudWatch Logs settings.”
Save the settings.
Once you’ve completed these steps, the CloudWatch Logs role will be set up in your AWS account settings, and you should be able to enable logging for the respective service without encountering the “CloudWatch Logs role ARN must be set in account settings to enable logging” error message.
Note that the exact steps and interface may vary slightly depending on updates to the AWS Management Console. If you encounter any difficulties or have further questions, I recommend referring to the AWS documentation or reaching out to AWS Support for assistance.