{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": "s3:PutObject",
      "Resource": "arn:aws:s3:::${bucket_name}/*/AWSLogs/*",
      "Principal": {
        "AWS": "arn:aws:iam::${principal}:root"
      }
    }
  ]
}

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Sid": "ELBWriteS3Logs",
      "Effect": "Allow",
      "Action": "s3:PutObject",
      "Resource": "arn:aws:s3:::${bucket_name}/*/AWSLogs/*",
      "Principal": {
        "AWS": "arn:aws:iam::${principal}:root"
      }
    },
    {
      "Sid": "AWSDDoSResponseTeamAccessS3Bucket",
      "Effect": "Allow",
      "Action": [
                "s3:GetBucketLocation",
                "s3:GetObject",
                "s3:ListBucket"
      ],
      "Resource": [
        "arn:aws:s3:::${bucket_name}",
        "arn:aws:s3:::${bucket_name}/*"
      ],
      "Principal": {
        "Service": "drt.shield.amazonaws.com"
      }
    }
  ]
}

Add Shield DRT access policy to elb log bucket
Add Shield DRT access policy to elb log bucket

As per https://docs.aws.amazon.com/waf/latest/developerguide/authorize-DRT.html, the DRT needs a bucket policy in place so they can view our *LB logs.
