Data Source: awsCloudtrailServiceAccount

/*Provider bindings are generated by running cdktf get.
See https://cdk.tf/provider-generation for more details.*/
import * as aws from "./.gen/providers/aws";
const awsS3BucketBucket = new aws.s3Bucket.S3Bucket(this, "bucket", {
  bucket: "tf-cloudtrail-logging-test-bucket",
  forceDestroy: true,
});
const dataAwsCloudtrailServiceAccountMain =
  new aws.dataAwsCloudtrailServiceAccount.DataAwsCloudtrailServiceAccount(
    this,
    "main",
    {}
  );
const dataAwsIamPolicyDocumentAllowCloudtrailLogging =
  new aws.dataAwsIamPolicyDocument.DataAwsIamPolicyDocument(
    this,
    "allow_cloudtrail_logging",
    {
      statement: [
        {
          actions: ["s3:PutObject"],
          effect: "Allow",
          principals: [
            {
              identifiers: [dataAwsCloudtrailServiceAccountMain.arn],
              type: "AWS",
            },
          ],
          resources: [`\${${awsS3BucketBucket.arn}}/*`],
          sid: "Put bucket policy needed for trails",
        },
        {
          actions: ["s3:GetBucketAcl"],
          effect: "Allow",
          principals: [
            {
              identifiers: [dataAwsCloudtrailServiceAccountMain.arn],
              type: "AWS",
            },
          ],
          resources: [awsS3BucketBucket.arn],
          sid: "Get bucket policy needed for trails",
        },
      ],
    }
  );
const awsS3BucketPolicyAllowCloudtrailLogging =
  new aws.s3BucketPolicy.S3BucketPolicy(this, "allow_cloudtrail_logging_3", {
    bucket: awsS3BucketBucket.id,
    policy: dataAwsIamPolicyDocumentAllowCloudtrailLogging.json,
  });
/*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
awsS3BucketPolicyAllowCloudtrailLogging.overrideLogicalId(
  "allow_cloudtrail_logging"
);