data "aws_iam_policy_document" "logging" {
  version = "2012-10-17"
  statement {
    effect = "Allow"
    actions = [
      "logs:CreateLogDelivery",
      "logs:CreateLogGroup",
      "logs:CreateLogStream",
      "logs:DeleteLogDelivery",
      "logs:DescribeLogGroups",
      "logs:DescribeLogStreams",
      "logs:DescribeResourcePolicies",
      "logs:GetLogDelivery",
      "logs:ListLogDeliveries",
      "logs:PutLogEvents",
      "logs:PutResourcePolicy",
      "logs:UpdateLogDelivery",
    ]
    resources = ["*"]
  }
}

resource "aws_iam_policy" "logging" {
  name        = "${var.name_prefix}-${var.name}"
  path        = var.path
  description = "Allows creating log groups, log streams and putting log events into cloudwatch logs"
  policy      = data.aws_iam_policy_document.logging.json
}