Session manager hangs on connect due to logs policy

I've been working to get my sessions logging to cloudwatch with encrypted logs.

I've found that when I have the "logs" part of the IAM policy wide open, then I can connect and it works. My policy also includes the bits for the kms key, and the log group is encrypted with the same key.

If I put this style, it will hang on connection. Btw, my log group name is `/aws/sessions` so using an example policy like this, it hangs:
````
{
"Version":"2012-10-17",
"Statement":[
{
"Action": [
"logs:CreateLogStream",
"logs:DescribeLogStreams",
"logs:PutLogEvents",
"logs:GetLogEvents"
],
"Effect": "Allow",
"Resource": "arn:aws:logs:us-west-2:123456789012:log-group:/aws/sessions:*"
}
]
}
````

If I make it wide open, it will work:

````
{
"Sid": "EnableCreationAndManagementOfLogStreams",
"Effect": "Allow",
"Action": [
"logs:*"
],
"Resource": "*"
},
````

This style also fails, with `logs:*` just on the one group and streams that I want:

````
{
"Sid": "EnableCreationAndManagementOfLogStreams",
"Effect": "Allow",
"Action": [
"logs:*"
],
"Resource": [
"arn:aws:logs:${var.aws_region}:${data.aws_caller_identity.current.account_id}:log-group:${var.log_group_name}",
"arn:aws:logs:${var.aws_region}:${data.aws_caller_identity.current.account_id}:log-group:${var.log_group_name}:*"
]
},
````

What gives here? Shouldn't the top policy be sufficient? I can't seem to find a concrete example of what the policy should be. The fact that it hangs and I have to kill my terminal also seems like it could be handled better with a warning or some message. My situation on the hanging sounds just like this: https://github.com/aws/amazon-ssm-agent/issues/170

I would prefer that this instance not be able to read logs from other groups so I'd like to lock it down to just the one it needs.

Thanks!

The report names no source file or test. Start by reproducing a Session Manager connection with the scoped CloudWatch Logs policy and compare it with the working wide-open policy. Done means identifying the required permissions and making a denied permission produce a clear warning instead of a hang.

Written by the indexing model from the issue text.