data "aws_iam_policy_document" "assume_role" {

  statement {
    actions = ["sts:AssumeRole"]
    effect = "Allow"

    principals {
      identifiers = ["appsync.amazonaws.com"]
      type = "Service"
    }
  }
}

resource "aws_appsync_graphql_api" "example" {

  log_config {
    cloudwatch_logs_role_arn = aws_iam_role.example.arn
    field_log_level = "ERROR"
  }
}

resource "aws_iam_role" "example" {
  assume_role_policy = data.aws_iam_policy_document.assume_role.json
  name = "example"
}

resource "aws_iam_role_policy_attachment" "example" {
  policy_arn = "arn:aws:iam::aws:policy/service-role/AWSAppSyncPushToCloudWatchLogs"
  role = aws_iam_role.example.name
}