EventBridgeからのログをCloudWatch Logsにて受け取れなかったときに漏れていた設定（リソースポリシー）

# CloudWatch Logs ロググループ
resource "aws_cloudwatch_log_group" "eventbridge_logs" {
  name              = "/aws/eventbridge/inspector-automation"
  retention_in_days = 7
  tags = {
    Name = "EventBridge-Inspector-Logs"
  }
}

$ aws logs describe-resource-policies | jq '.resourcePolicies[] | select(.policyDocument | contains("/aws/eventbridge/inspector-automation"))'
# ⇒何も表示されない

# CloudWatch Logs ロググループ
resource "aws_cloudwatch_log_group" "eventbridge_logs" {
  name              = "/aws/eventbridge/inspector-automation"
  retention_in_days = 7
  tags = {
    Name = "EventBridge-Inspector-Logs"
  }
}
# ★リソースポリシーの設定を追加
resource "aws_cloudwatch_log_resource_policy" "eventbridge_logs_policy" {
  policy_name = "EventBridgeLogsPolicy"
  policy_document = templatefile("${path.module}/policies/cloudwatch-logs-resource-policy.json", {
    log_group_arn = aws_cloudwatch_log_group.eventbridge_logs.arn
  })
}

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Sid": "EventBridgeLogsPolicy",
            "Effect": "Allow",
            "Principal": {
            "Service": "events.amazonaws.com"
            },
            "Action": [
                "logs:CreateLogStream",
                "logs:PutLogEvents"
            ],
            "Resource": "${log_group_arn}:*"
        }
    ]
}