code: function buildLogBucketPolicy() {
    return {
      LogBucketPolicy: {
        Type: 'AWS::S3::BucketPolicy',
        Properties: {
          Bucket: {
            Ref: 'LogBucket',
          },
          PolicyDocument: {
            Version: '2012-10-17',
            Statement: [
              {
                Sid: 'AWSLogDeliveryAclCheck',
                Effect: 'Allow',
                Principal: {
                  Service: 'delivery.logs.amazonaws.com',
                },
                Action: 's3:GetBucketAcl',
                Resource: {
                  'Fn::GetAtt': ['LogBucket', 'Arn'],
                },
              },
              {
                Sid: 'AWSLogDeliveryWrite',
                Effect: 'Allow',
                Principal: {
                  Service: 'delivery.logs.amazonaws.com',
                },
                Action: 's3:PutObject',
                Resource: {
                  'Fn::Join': [
                    '',
                    [
                      'arn:aws:s3:::',
                      { Ref: 'LogBucket' },
                      '/AWSLogs/',
                      { Ref: 'AWS::AccountId' },
                      '/*',
                    ],
                  ],
                },
                Condition: {
                  StringEquals: {
                    's3:x-amz-acl': 'bucket-owner-full-control',
                  },
                },
              },
            ],
          },
        },
      },
    };
  }
docs: Build an S3 Bucket Policy for the logging bucket
  
  @return {Object}
  @see https://docs.aws.amazon.com/vpc/latest/userguide/flow-logs-s3.html#flow-logs-s3-permissions