src/flow_logs.js
function buildLogBucketPolicy() {
  return {
    LogBucketPolicy: {
      Type: 'AWS::S3::BucketPolicy',
      Properties: {
        Bucket: {
          Ref: 'LogBucket',
        },
        PolicyDocument: {
          Version: '2012-10-17',
          Statement: [
            {
              Sid: 'AWSLogDeliveryAclCheck',
              Effect: 'Allow',
              Principal: {
                Service: 'delivery.logs.amazonaws.com',
              },
              Action: 's3:GetBucketAcl',
              Resource: {
                'Fn::GetAtt': ['LogBucket', 'Arn'],
              },
            },
            {
              Sid: 'AWSLogDeliveryWrite',
              Effect: 'Allow',
              Principal: {
                Service: 'delivery.logs.amazonaws.com',
              },
              Action: 's3:PutObject',
              Resource: {
                'Fn::Join': [
                  '',
                  [
                    'arn:aws:s3:::',
                    { Ref: 'LogBucket' },
                    '/AWSLogs/',
                    { Ref: 'AWS::AccountId' },
                    '/*',
                  ],
                ],
              },
              Condition: {
                StringEquals: {
                  's3:x-amz-acl': 'bucket-owner-full-control',
                },
              },
            },
          ],
        },
      },
    },
  };
}
function buildLogBucketPolicy() {
  return {
    LogBucketPolicy: {
      Type: 'AWS::S3::BucketPolicy',
      Properties: {
        Bucket: {
          Ref: 'LogBucket',
        },
        PolicyDocument: {
          Version: '2012-10-17',
          Statement: [
            {
              Sid: 'AWSLogDeliveryAclCheck',
              Effect: 'Allow',
              Principal: {
                Service: 'delivery.logs.amazonaws.com',
              },
              Action: 's3:GetBucketAcl',
              Resource: {
                'Fn::GetAtt': ['LogBucket', 'Arn'],
              },
            },
            {
              Sid: 'AWSLogDeliveryWrite',
              Effect: 'Allow',
              Principal: {
                Service: 'delivery.logs.amazonaws.com',
              },
              Action: 's3:PutObject',
              Resource: {
                'Fn::Join': [
                  '',
                  [
                    'arn:aws:s3:::',
                    { Ref: 'LogBucket' },
                    '/AWSLogs/',
                    { Ref: 'AWS::AccountId' },
                    '/*',
                  ],
                ],
              },
              Condition: {
                StringEquals: {
                  's3:x-amz-acl': 'bucket-owner-full-control',
                },
              },
            },
          ],
        },
      },
    },
  };
}
function buildLogBucketPolicy ( ) { return { LogBucketPolicy : { Type : 'AWS::S3::BucketPolicy' , Properties : { Bucket : { Ref : 'LogBucket' , } , PolicyDocument : { Version : '2012-10-17' , Statement : [ { Sid : 'AWSLogDeliveryAclCheck' , Effect : 'Allow' , Principal : { Service : 'delivery.logs.amazonaws.com' , } , Action : 's3:GetBucketAcl' , Resource : { 'Fn::GetAtt' : [ 'LogBucket' , 'Arn' ] , } , } , { Sid : 'AWSLogDeliveryWrite' , Effect : 'Allow' , Principal : { Service : 'delivery.logs.amazonaws.com' , } , Action : 's3:PutObject' , Resource : { 'Fn::Join' : [ '' , [ 'arn:aws:s3:::' , { Ref : 'LogBucket' } , '/AWSLogs/' , { Ref : 'AWS::AccountId' } , '/*' , ] , ] , } , Condition : { StringEquals : { 's3:x-amz-acl' : 'bucket-owner-full-control' , } , } , } , ] , } , } , } , } ; }
Build an S3 Bucket Policy for the logging bucket

@return {Object}
@see https://docs.aws.amazon.com/vpc/latest/userguide/flow-logs-s3.html#flow-logs-s3-permissions
Build an S3 Bucket Policy for the logging bucket