data "aws_iam_policy_document" "test_destination_policy" {

  statement {
    actions = ["logs:PutSubscriptionFilter"]
    effect = "Allow"

    principals {
      identifiers = ["123456789012"]
      type = "AWS"
    }
    resources = [aws_cloudwatch_log_destination.test_destination.arn]
  }
}

resource "aws_cloudwatch_log_destination" "test_destination" {
  name = "test_destination"
  role_arn = "aws_iam_role.iam_for_cloudwatch.arn"
  target_arn = "aws_kinesis_stream.kinesis_for_cloudwatch.arn"
}

resource "aws_cloudwatch_log_destination_policy" "test_destination_policy" {
  access_policy = data.aws_iam_policy_document.test_destination_policy.json
  destination_name = aws_cloudwatch_log_destination.test_destination.name
}