title: Terraform: Adding server logging to S3 bucket
body: <p>I'm getting an error in my Terraform scripts when attempting to add logging to two buckets. These are part of one of my modules, and I've successfully used them before. I've come back to deploy a new environment...and now it's not working.</p>
  
  <p>I'm getting the following error:</p>
  
  <blockquote>
    <p>module.dev2_environment.module.portal.aws_s3_bucket.portal_bucket: 1 error occurred:
            * aws_s3_bucket.portal_bucket: Error putting S3 logging: InvalidTargetBucketForLogging: You must give the log-delivery group
    WRITE and READ_ACP permissions to the target bucket
            status code: 400, request id: 51AB42EFCACC9924, host id: nYCUxjHZE+xTisA1xG5syLTKVN/Rtwu8z3xF+O9GAPMdC2yGcafP4uwDURUGKd9Lx1SD8aHTcEI=</p>
  </blockquote>
  
  <p>I'm executing via CLI, with Admin credentials. No code changes were made between the working state and the error. Any ideas on what could have changed? Syntax? AWS config someplace?</p>
  
  <p>Terraform 11.14 and aws provider 2.16</p>
  
  <p>Log bucket:</p>
  
  <pre><code>resource "aws_s3_bucket" "logs_bucket" {
    bucket = "XYZ-${var.env}-cdnlogs"
    acl    = "log-delivery-write"
    server_side_encryption_configuration {
      rule {
        apply_server_side_encryption_by_default {
          sse_algorithm = "AES256"
        }
      }
    }
    tags {
      Finance     = "dev_env"
      Environment = "${var.env}"
    }
  }
  </code></pre>
  
  <p>Target Bucket:</p>
  
  <pre><code>resource "aws_s3_bucket" "portal_bucket" {
    bucket = "XYZ-${var.env}-portal"
    acl    = "private"
    server_side_encryption_configuration {
      rule {
        apply_server_side_encryption_by_default {
          sse_algorithm = "AES256"
        }
      }
    }
    logging {
      target_bucket = "${aws_s3_bucket.logs_bucket.id}"
      target_prefix = "logs/portal/"
    }
    website {
      index_document = "index.html"
      error_document = "index.html"
    }
    // Needed to allow logos to be uploaded the "Portal"
    cors_rule {
      allowed_headers = ["*"]
      allowed_methods = ["GET", "HEAD", "PUT", "POST"]
      allowed_origins = ["*"]
      max_age_seconds = 3000
    }
    tags {
      Finance     = "dev_env"
      Environment = "${var.env}"
    }
  }
  </code></pre>