Unable to send cloudwatch logs to loggly using a blueprint lambda - Invalid ciphertext
Follow these steps to fix InvalidCiphertextException:

Open the Lambda function in AWS console.

Scroll down to the Environment Variables section &amp; click Edit:




Delete the value of kmsEncryptedCustomerToken &amp; replace it with the customer token you got from https://&lt;your-company&gt;.loggly.com/tokens. The token looks like this: 72cf6d64-256e-449d-aabd-49e1f422ed58.

Expand the Encryption Configuration section at the bottom.

Select Enable helpers for encryption in transit.

Click the Encrypt button that appears next to kmsEncryptedCustomerToken.




Select the logglyCustomerToken KMS key (CMK) &amp; Encrypt.

Finally, Save the environment variables.


The Lambda function test should succeed now. If you face any other issues or need a complete end-to-end screenshot-guided tutorial for the entire process of sending CloudWatch Logs to Loggly, please see my blog post.