code/kinesis/cfn/kinesis-firehose-delivery-stream.yaml [106:133]:
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
      PolicyDocument:
        Version: 2012-10-17
        Statement:
          - Effect: Allow
            Action:
              - "logs:PutLogEvents"
            Resource:
              - !Sub "arn:aws:logs:${AWS::Region}:${AWS::AccountId}-id:log-group:KinesisFirehose:log-stream:aws-waf-logs-delivery-${AWS::AccountId}-${AWS::Region}"
          - Effect: Allow
            Action:
              - "s3:AbortMultipartUpload"
              - "s3:GetBucketLocation"
              - "s3:GetObject"
              - "s3:ListBucket"
              - "s3:ListBucketMultipartUploads"
              - "s3:PutObject"
              - "s3:PutObjectAcl"
            Resource:
              - !Sub "arn:aws:s3:::${WAFLogS3Bucket}*"
              - !Sub "arn:aws:s3:::${WAFLogS3Bucket}*/*"
          - Effect: Allow
            Action:
              - "kms:Encrypt"
              - "kms:Decrypt"
              - "kms:ReEncrypt"
              - "kms:GenerateDataKey"
              - "kms:DescribeKey"
            Resource:
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -



code/kinesis/cfn/kinesis-firehose-iam-role.yaml [39:66]:
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
      PolicyDocument:
        Version: 2012-10-17
        Statement:
          - Effect: Allow
            Action:
              - "logs:PutLogEvents"
            Resource:
              - !Sub "arn:aws:logs:${AWS::Region}:${AWS::AccountId}-id:log-group:KinesisFirehose:log-stream:aws-waf-logs-delivery-${AWS::AccountId}-${AWS::Region}"
          - Effect: Allow
            Action:
              - "s3:AbortMultipartUpload"
              - "s3:GetBucketLocation"
              - "s3:GetObject"
              - "s3:ListBucket"
              - "s3:ListBucketMultipartUploads"
              - "s3:PutObject"
              - "s3:PutObjectAcl"
            Resource:
              - !Sub "arn:aws:s3:::${WAFLogS3Bucket}*"
              - !Sub "arn:aws:s3:::${WAFLogS3Bucket}*/*"
          - Effect: Allow
            Action:
              - "kms:Encrypt"
              - "kms:Decrypt"
              - "kms:ReEncrypt"
              - "kms:GenerateDataKey"
              - "kms:DescribeKey"
            Resource:
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -



