title: Assign ELB Account to S3 Bucket Policy
body: <p>I used the AWS console from the load balancer edit attributes screen and used it to create a bucket to use for access logging. I'm using this policy to form CDK code in typescript to stand up new S3 buckets to use for access logging in higher level environments where I cannot use the console. This is the policy I need to somehow form in typescript CDK code:</p>
  <pre><code>&quot;Statement&quot;: [
  {
      &quot;Effect&quot;:Allow&quot;,
      &quot;Principal&quot;: {
          &quot;AWS&quot;: &quot;arn:--ELB-arnstuff--:root&quot;
      },
      &quot;Action&quot;: &quot;s3:PutObject&quot;,
      &quot;Resource&quot;: &quot;arn:--S3-Bucket-arnstuff--/AWSLogs/123456789/*&quot;
  }
  ]
  </code></pre>
  <p>I've managed to get the cdk code figured out to this point:</p>
  <pre><code>bucket.addToResourcePolicy(
      new cdk.aws_iam.PolicyStatement({ 
        effect: awsIam.Effect.ALLOW,
        principals: //'**This is part I haven't figured out**',
        actions: ['s3:PutObject'],
        resources: ['${bucket.bucketArn}/*']
      })
  );
  </code></pre>
  <p>At this point I don't care if it's hard coded in the CDK, I just need something to help keep the ball rolling forward. Any help is appreciated, thanks</p>