title: Enable logging S3 via cloudFormation template?
body: <p>I am trying to create 2 buckets with 2 different policies. </p>
  
  <p>One bucket, VendorsWGLogs, will be the destination for log output.</p>
  
  <p>The other bucket, VendorsWG,  will give GetObject, PutObject, and DeleteObject access to a specified IAM group.</p>
  
  <p>Here is what I have so far:</p>
  
  <pre><code>"Resources": {
      "VendorsWGLogs": {
        "Type": "AWS::S3::Bucket",
        "Properties": {},
      },
      "LogsBucketPolicy": {
        "Type": "AWS::S3::BucketPolicy",
        "Properties": {
          "Bucket": {
            "Ref": "VendorsWGLogs"
          },
          "PolicyDocument": {
            "Version": "2012-10-17",
            "Statement": [
              {
                "Sid": "WeatherGuidance LogBucket permissions",
                "Effect": "Allow",
                "Principal": {
                  "AWS" : "arn:aws:s3:::VendorsWG"
                },
                "Action": [
                  "s3:GetObject",
                  "s3:PutObject",
                  "s3:PutObjectAcl"
                ],
                "Resource" : { "Fn::Join" : [
                    "", [ "arn:aws:s3:::", { "Ref" : "VendorsWGLogs" } , "/*" ]
                 ]}
              }
            ]
          }
        }
      },
      "VendorsWG": {
        "Type": "AWS::S3::Bucket",
        "Properties": {
          "LoggingConfiguration": {
            "DestinationBucketName": {"Ref" : "VendorsWGLogs"},
            "LogFilePrefix": "testing-logs"
          }
        },
        "Metadata": {
          "AWS::CloudFormation::Designer": {
            "id": "a1169860-d743-406e-a3e5-e12831826439"
          },
        }
      },
      "S3BP4TNQZ": {
        "Type": "AWS::S3::BucketPolicy",
        "Properties": {
          "Bucket": {
            "Ref": "VendorsWG"
          },
          "PolicyDocument": {
            "Version": "2012-10-17",
            "Statement": [
              {
                "Sid": "WeatherGuidance Object permissions",
                "Effect": "Allow",
                "Principal": {
                  "AWS" : "arn:aws:iam::someUserGroup"
                },
                "Action": [
                  "s3:GetObject",
                  "s3:PutObject",
                  "s3:DeleteObject"
                ],
                "Resource" : { "Fn::Join" : [
                    "", [ "arn:aws:s3:::", { "Ref" : "VendorsWG" } , "/*" ]
                 ]}
              },
              {
                "Sid": "WeatherGuidance ListBucket",
                "Effect": "Allow",
                "Principal": {
                  "AWS" : "arn:aws:iam::someUserGroup"
                },
                "Action": "s3:ListBucket",
                "Resource" : { "Fn::Join" : [
                    "", [ "arn:aws:s3:::", { "Ref" : "VendorsWG" } ]
                 ]},
                "Condition": {
                  "StringLike": {
                    "s3:prefix": "weatherguidance*"
                  }
                }
              }
            ]
          }
        }
      }
    }
  </code></pre>
  
  <p>When I try to create a stack, I get this error<a href="https://i.stack.imgur.com/aBWsT.png" rel="noreferrer"><img src="https://i.stack.imgur.com/aBWsT.png" alt="enter image description here"></a></p>
  
  <p>Event Log output:</p>
  
  <p>Type:</p>
  
  <pre><code>AWS::S3::Bucket
  </code></pre>
  
  <p>Logical ID:</p>
  
  <pre><code>VendorsWG   
  </code></pre>
  
  <p>Status reason:</p>
  
  <pre><code>You must give the log-delivery group WRITE and READ_ACP permissions to the target bucket
  </code></pre>
  
  <p>I thought that specifying the target bucket's policy's principal as VendorsWGLogs would fix this, and now I am out of ideas. </p>
  
  <p>What am I doing wrong? What can I do to get logging enabled?
  Thanks</p>