{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": [
        "s3:ListBucket"
      ],
      "Resource": "arn:aws:s3:::${LOGS_BUCKET}"
    },
    {
      "Effect": "Allow",
      "Action": [
        "s3:AbortMultipartUpload",
        "s3:GetObject",
        "s3:ListMultipartUploadParts",
        "s3:PutObject"
      ],
      "Resource": "arn:aws:s3:::${LOGS_LOCATION_BASE}/*"
    }
  ]
}

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": [
        "s3:ListBucket"
      ],
      "Resource": "arn:aws:s3:::${LOGS_BUCKET}"
    },
    {
      "Effect": "Allow",
      "Action": [
        "s3:AbortMultipartUpload",
        "s3:GetObject",
        "s3:ListMultipartUploadParts",
        "s3:PutObject"
      ],
      "Resource": "arn:aws:s3:::${LOGS_LOCATION_BASE}/*"
    },
    {
      "Effect": "Deny",
      "Action": "s3:GetObject",
      "Resource": [
        "arn:aws:s3:::${LOGS_LOCATION_BASE}/cluster-backups",
        "arn:aws:s3:::${LOGS_LOCATION_BASE}/cluster-backups/*"
      ]
    }
  ]
}
Update example logging IAM policy to block FreeIPA backup access
CB-7506: Update example logging IAM policy to block FreeIPA backup access

This changes the example logging policy so that the FreeIPA backups can
not be read.  It only allows write to that location.
