title: KMS permissions for encrypted CloudWatch LogGroups with AWS Systems Session Manager
body: <p>I've set up a CMK (Custom Managed Key) to encrypt LogGroups with AWS Systems Session Manager:</p>
  <ol>
  <li><p>First, permissions for &quot;key administrators&quot; and &quot;key users/roles&quot; are added in the KMS console.</p>
  </li>
  <li><p>Next, the CMK is attached in AWS Systems Manager Session Manager Preferences to the LogGroup as shown in this image:</p>
  </li>
  </ol>
  <p><a href="https://i.stack.imgur.com/6u6Wb.jpg" rel="nofollow noreferrer"><img src="https://i.stack.imgur.com/6u6Wb.jpg" alt="enter image description here" /></a></p>
  <p><strong>Error:</strong></p>
  <p>The specified KMS key does not exist or is not allowed to be used with LogGroup 'arn:aws:logs:my_region:my_account_id:log-group:/SSM'</p>
  <p>The key must exist because it's used to encrypt the Sessions and is just not decrypting LogGroups properly, but it is linked to the LogGroup and the user has permission. What gives?</p>