CCM-11586: refine logging bucket policies

Author: masl2

infrastructure/terraform/components/api/s3_bucket_logging.tf

@@ -44,5 +44,5 @@ resource "aws_s3_bucket_logging" "truststore" {
   bucket = aws_s3_bucket.truststore.id
 
   target_bucket = aws_s3_bucket.logging.bucket
-  target_prefix = "truststore/${aws_s3_bucket.truststore.bucket}/"
+  target_prefix = "${aws_s3_bucket.truststore.bucket}/"
 }

infrastructure/terraform/components/api/s3_bucket_policy_logging.tf

@@ -25,4 +25,20 @@ data "aws_iam_policy_document" "logging" {
       ]
     }
   }
+
+  statement {
+      sid    = "s3-log-delivery"
+      effect = "Allow"
+
+      principals {
+        type        = "Service"
+        identifiers = ["logging.s3.amazonaws.com"]
+      }
+
+      actions = ["s3:PutObject"]
+
+      resources = [
+        "${aws_s3_bucket.logging.arn}/*",
+      ]
+    }
 }