title: How to give the target bucket log-delivery group WRITE and READ_ACP permissions?
body: <p>I am trying to setup a cloudfront dist and s3 bucket with terraform. When I run <code>terraform apply</code> it is returning the following error: </p>
  
  <blockquote>
    <ul>
    <li>aws_s3_bucket.app: Error putting S3 logging: InvalidTargetBucketForLogging: You must give the log-delivery group WRITE and READ_ACP permissions to the target bucket</li>
    </ul>
  </blockquote>
  
  <p>my S3.tf file: </p>
  
  <pre><code>data "aws_iam_policy_document" "s3_policy" {
    policy_id = "PolicyForCloudFrontPrivateContent"
  
    statement {
      sid       = "1"
      actions   = ["s3:GetObject"]
      resources = ["arn:aws:s3:::${local.name_env}/*"]
  
      principals {
        type        = "AWS"
        identifiers = ["${aws_cloudfront_origin_access_identity.origin_access_identity.iam_arn}"]
      }
    }
  }
  
  resource "aws_s3_bucket" "app" {
    bucket = "${local.name_env}"
    policy = "${data.aws_iam_policy_document.s3_policy.json}"
  
    logging {
      target_bucket = "${local.logs_bucket}"
      target_prefix = "app-${var.environment}"
    }
  
    versioning {
      enabled = true
    }
  
    tags = "${local.tags}"
  }
  </code></pre>