AWS CloudFormation Error: Create Failed - Invalid ARN for Log Group

Select Language:

If you’re running into an error with your Route53 HostedZone setup, it’s likely because there’s an issue with how the CloudWatch Logs log group is referenced. The most common problem is that the ARN (Amazon Resource Name) is not correctly formatted or is referencing a policy instead of the actual log group.

First, check that you’ve created a log group resource, such as “MyLogGroupRavi1.” This log group needs to exist before you attempt to link it to your hosted zone. In your template, you should see this resource defined properly.

Next, ensure you’re referencing the log group’s ARN correctly. Instead of pointing to a policy or an object, you should use a function that retrieves the ARN of the log group directly. For example, in your setup, use a command like !GetAtt MyLogGroupRavi1.Arn. This will fetch the exact ARN you need for proper configuration.

Here’s what your setup should look like:

yaml
HostedZoneRavi1:
Type: AWS::Route53::HostedZone
DependsOn: MyLogGroupRavi1
Properties:
Name: ravi-hostedzone.com
QueryLoggingConfig:
CloudWatchLogsLogGroupArn: !GetAtt MyLogGroupRavi1.Arn

Make sure that the resource named “MyLogGroupRavi1” is a CloudWatch Logs log group resource, created earlier in your template, so it exists when you reference it.

If you’re mistakenly referencing a policy’s ARN instead of the log group, correct that by pointing directly to the log group ARN. This adjustment ensures your Route53 setup can properly connect to the logs without errors.

For more info, review the official documentation:

Fixing these reference issues will resolve the ARN format error and allow your hosted zone to log queries successfully.