title: Unable to get aws:PrincipalOrgID to work with creating subscription filter
body: <p>I have an AWS account with Organizations enabled. I want to ensure that certain logs from my child accounts go to my Kinesis stream in a logging account. The idea is that in future if I create a new child account in Organizations, the logs should go to Kinesis.</p>
  
  <p>For this, I have created a Kinesis log destination in my logging account using <code>aws logs put-destination</code> command. I added a destination policy to it. The policy I used was:</p>
  
  <pre><code>{
      "Version": "2012-10-17",
      "Statement": {
          "Sid": "PutSubscriptionFilter",
          "Effect": "Allow",
          "Principal": {
              "AWS": ["*"]
          },
          "Action": "logs:PutSubscriptionFilter",
          "Resource": "arn:aws:logs:us-east-1:123456789012:destination:mytestLogDestination",
          "Condition": {
              "StringEquals": {
                  "aws:PrincipalOrgID": "o-abcde12345"
              }
          }
      }
  }
  </code></pre>
  
  <p>The command I used to add the destination policy was:</p>
  
  <pre><code>aws logs put-destination-policy \
      --destination-name mytestLogDestination \
      --access-policy file://destination_policy.json
  </code></pre>
  
  <p>This added the destination policy successfully. I can confirm this by running the command: <code>aws logs describe-destinations --destination-name-prefix mytestLogDestination</code>. When I try to create a new subscription filter in one of my member accounts using the following command, it errors out. The command I tried is:</p>
  
  <pre><code>aws logs put-subscription-filter \
      --log-group-name "/aws/lambda/GetOrgIdFunction" \
      --filter-name randomsubscriptionfilter --filter-pattern "" \
      --destination-arn arn:aws:logs:us-east-1:123456789012:destination:mytestLogDestination
  </code></pre>
  
  <p>Error message is:</p>
  
  <blockquote>
    <p>An error occurred (AccessDeniedException) when calling the PutSubscriptionFilter operation: User with accountId: 210987654321 is not authorized to perform: logs:PutSubscriptionFilter on resource: arn:aws:logs:us-east-1:123456789012:destination:mytestLogDestination</p>
  </blockquote>
  
  <p>When I remove the condition and restrict the Principal to just my account (210987654321), it works fine. Is it possible to get this setup working or does AWS currently not support it?</p>