code: def runlogs_policy(log_group_ref):
      
      p = Policy(
          Statement=[
              Statement(
                  Effect=Allow,
                  Resource=[
                      Join('', [
                          'arn:aws:logs:*:*:log-group:',
                          log_group_ref,
                          ':log-stream:*'])],
                  Action=[
                      logs.CreateLogStream,
                      logs.PutLogEvents,
                  ])])
      return p
docs: Policy needed for Empire -> Cloudwatch logs to record run output.