data "aws_iam_policy_document" "sme-dc-dev-dc-d-vpc-flow-logs" {
  statement {
    sid    = "AWSLogDeliveryWrite"
    effect = "Allow"
    resources = [
      "arn:aws:s3:::sme-dc-dev-dc-d-vpc-flow-logs/AWSLogs/349279974635/*",
      "arn:aws:s3:::sme-dc-dev-dc-d-vpc-flow-logs/AWSLogs/156555176793/*"
    ]
    actions = ["s3:PutObject"]

    condition {
      test     = "ArnLike"
      variable = "aws:SourceArn"
      values = [
        "arn:aws:logs:us-east-1:349279974635:*",
        "arn:aws:logs:us-east-1:156555176793:*"
      ]
    }

    condition {
      test     = "StringEquals"
      variable = "aws:SourceAccount"
      values = [
        "349279974635",
        "156555176793"
      ]
    }

    condition {
      test     = "StringEquals"
      variable = "s3:x-amz-acl"
      values   = ["bucket-owner-full-control"]
    }

    principals {
      type        = "Service"
      identifiers = ["delivery.logs.amazonaws.com"]
    }
  }

  statement {
    sid       = "AWSLogDeliveryAclCheck"
    effect    = "Allow"
    resources = ["arn:aws:s3:::sme-dc-dev-dc-d-vpc-flow-logs"]
    actions   = ["s3:GetBucketAcl"]

    condition {
      test     = "StringEquals"
      variable = "aws:SourceAccount"
      values = [
        "349279974635",
        "156555176793"
      ]
    }

    condition {
      test     = "ArnLike"
      variable = "aws:SourceArn"
      values = [
        "arn:aws:logs:us-east-1:349279974635:*",
        "arn:aws:logs:us-east-1:156555176793:*"
      ]
    }

    principals {
      type        = "Service"
      identifiers = ["delivery.logs.amazonaws.com"]
    }
  }

  statement {
    sid       = "S3PolicyStmt-DO-NOT-MODIFY-1653542309917"
    effect    = "Allow"
    resources = ["arn:aws:s3:::sme-dc-dev-dc-d-vpc-flow-logs/*"]
    actions   = ["s3:PutObject"]

    principals {
      type        = "Service"
      identifiers = ["logging.s3.amazonaws.com"]
    }
  }
}