data "aws_iam_policy_document" "elasticsearch_cloudwatch_logs_policy_document" {
  statement {
    actions = [
      "logs:CreateLogStream",
      "logs:PutLogEvents",
      "logs:PutLogEventsBatch",
    ]

    resources = ["arn:aws:logs:*"]

    principals {
      identifiers = ["es.amazonaws.com"]
      type        = "Service"
    }
  }
}

resource "aws_cloudwatch_log_resource_policy" "elasticsearch_cloudwatch_logs_policy" {
  policy_document = data.aws_iam_policy_document.elasticsearch_cloudwatch_logs_policy_document.json
  policy_name     = "Elasticsearch-log-publishing-policy"
}