{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": [
        "s3:PutObject"
      ],
      "Resource": [
        "arn:aws:s3:::${bucket_name}/*/AWSLogs/*/*"
      ],
      "Principal": {
        "AWS": [
          "${principal}"
        ]
      }
    }
  ]
}

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": "s3:PutObject",
      "Resource": "arn:aws:s3:::${bucket_name}/*/AWSLogs/*/*",
      "Principal": {
        "AWS": "arn:aws:iam::${principal}:root"
      }
    }
  ]
}

Rewrite bucket policy so terraform does not flap
Rewrite bucket policy so terraform does not flap

AWS changes the AWS policy elements with a equivalent one by removing
lists or changing the ARN of the principal.

That makes terraform think that it needs to update the policy every
time:

  aws_s3_bucket.elb_access_log: Modifying... policy: "{\"Statement\":[{\"Action\":\"s3:PutObject\",\"Effect\":\"Allow\",\"Principal\":{\"AWS\":\"arn:aws:iam::156460612806:root\"},\"Resource\":\"arn:aws:s3:::mt-elb-access-log/*/AWSLogs/*/*\"}],\"Version\":\"2012-10-17\"}"  =>  "{\"Statement\":[{\"Action\":[\"s3:PutObject\"],\"Effect\":\"Allow\",\"Principal\":{\"AWS\":[\"156460612806\"]},\"Resource\":[\"arn:aws:s3:::mt-elb-access-log/*/AWSLogs/*/*\"]}],\"Version\":\"2012-10-17\"}"

Writing the policy as AWS stores it, prevents that situation.
