from troposphere import Join, iam, logs

from .common import arn_prefix
from .template import template

container_log_group = logs.LogGroup(
    "ContainerLogs",
    template=template,
    RetentionInDays=365,
    DeletionPolicy="Retain",
)


logging_policy = iam.Policy(
    PolicyName="LoggingPolicy",
    PolicyDocument=dict(
        Statement=[dict(
            Effect="Allow",
            Action=[
                "logs:Create*",
                "logs:PutLogEvents",
            ],
            Resource=Join("", [
                arn_prefix,
                ":logs:*:*:*",  # allow logging to any log group
            ]),
        )],
    ),
)

from troposphere import Join, iam, logs

from .common import arn_prefix
from .template import template

container_log_group = logs.LogGroup(
    "ContainerLogs",
    template=template,
    RetentionInDays=365,
    DeletionPolicy="Retain",
)


logging_policy = iam.Policy(
    PolicyName="LoggingPolicy",
    PolicyDocument=dict(
        Statement=[dict(
            Effect="Allow",
            Action=[
                "logs:Create*",
                "logs:PutLogEvents",
                # Needed by aws-for-fluent-bit:
                "logs:DescribeLogGroups",
                "logs:DescribeLogStreams",
            ],
            Resource=Join("", [
                arn_prefix,
                ":logs:*:*:*",  # allow logging to any log group
            ]),
        )],
    ),
)

Add logging permissions needed by aws-for-fluent-bit
Add logging permissions needed by aws-for-fluent-bit