Missing CloudWatch Log group resource policy

[reidca]

I think the bus template needs a AWS::Logs::ResourcePolicy resource to allow event bridge to write to the CloudWatch log group.

e.g.

  SCPErrorsLogGroupEventBridgePolicy:
    Type: AWS::Logs::ResourcePolicy
    Properties:
      PolicyDocument: !Sub |
        {
          "Version": "2012-10-17",
          "Statement": [
            {
              "Sid": "AllowEventBridgeToWriteSCPErrorLogs",
              "Effect": "Allow",
              "Principal": {
                "Service": "events.amazonaws.com"
              },
              "Action": [
                "logs:CreateLogStream",
                "logs:PutLogEvents"
              ],
              "Resource": "${CloudWatchLogGroup.Arn}"
            }
          ]
        }
      PolicyName: "EventBridgeToSCPErrorsLogGroupPolicy"