cloudwatch_role_policy_and_data.tf

# Build data source to find AWS account id
data "aws_caller_identity" "current" {}

# Get region
data "aws_region" "current" {}

resource "aws_iam_role_policy" "GitHubCopRepoTrigger_Cloudwatch" {
  name = "Cloudwatch"
  role = aws_iam_role.GitHubCopNewRepoTriggerRole.id

  policy = jsonencode(
    {
      "Version" : "2012-10-17",
      "Statement" : [
        {
          "Effect" : "Allow",
          "Action" : "logs:CreateLogGroup",
          "Resource" : "arn:aws:logs:us-east-1:${data.aws_caller_identity.current.id}:*"
        },
        {
          "Effect" : "Allow",
          "Action" : [
            "logs:CreateLogStream",
            "logs:PutLogEvents"
          ],
          "Resource" : [
            "arn:aws:logs:${data.aws_region.current.name}:${data.aws_caller_identity.current.id}:log-group:/aws/lambda/GitHubCopRepoTrigger:*"
          ]
        }
      ]
    }
  )
}