Amazon-ssm-agent: Unhelpful Error

[evanstoddard23]

When SSM agent can't connect to CloudWatch, it provides this unhelpful error: "We couldn't start the session because encryption is not set up on the selected CloudWatch Logs log group. Either encrypt the log group or choose an option to enable logging without encryption."

[evanstoddard23]

Also, these docs and these docs don't make it clear that networking from an instance to CloudWatch is necessary.

[AmyZhangAmz]

Hi @evanstoddard23,
Thanks you for your comments about the Amazon SSM Agent. We’ll will add this work to our backlog and get our development team to work on it.

[gvk777]

Hi @AmyZhangAmz

I am getting the same issue when trying to connect an Windows EC2 instance via Sessions Manager. I am able to connect to Linux EC2 instance without any issue and the same instance role is attached for both the instances.

Issue:
Your session has been terminated for the following reasons: We couldn't start the session because encryption is not set up on the selected Amazon S3 bucket.
Either encrypt the bucket or choose an option to enable logging without encryption.

Could you please help me on the same.

[luis02lopez]

To solve this, I've added CloudWatch permissions to the EC2 instance role.