Bucket policy that allows multiple accounts for AWS Config bucket

config.tf

data "aws_iam_policy_document" "config_organization" {
  statement {
    principals {
      identifiers = ["config.amazonaws.com"]
      type        = "Service"
    }
    actions   = ["s3:GetBucketAcl"]
    resources = [module.config_bucket.bucket_arn]
    condition {
      test     = "StringEquals"
      values   = var.account_ids
      variable = "AWS:SourceAccount"
    }
  }

  statement {
    principals {
      identifiers = ["config.amazonaws.com"]
      type        = "Service"
    }
    actions = ["s3:ListBucket"]
    resources = [
      module.config_bucket.bucket_arn,
    ]
    condition {
      test     = "StringEquals"
      values   = var.account_ids
      variable = "AWS:SourceAccount"
    }
  }

  statement {
    principals {
      identifiers = ["config.amazonaws.com"]
      type        = "Service"
    }
    actions   = ["s3:PutObject"]
    resources = [for account in var.account_ids : "${module.config_bucket.bucket_arn}/AWSLogs/${account}/*"]

    condition {
      test     = "StringEquals"
      values   = ["bucket-owner-full-control"]
      variable = "s3:x-amz-acl"
    }
    condition {
      test     = "StringEquals"
      values   = var.account_ids
      variable = "AWS:SourceAccount"
    }
  }
}