data "aws_iam_policy_document" "assume_role" {

  statement {
    actions = ["sts:AssumeRole"]
    effect = "Allow"

    principals {
      identifiers = ["lambda.amazonaws.com"]
      type = "Service"
    }
  }
}

resource "aws_iam_role" "iam_for_lambda" {
  assume_role_policy = data.aws_iam_policy_document.assume_role.json
  name = "iam_for_lambda"
}

resource "aws_lambda_function" "func" {
}

resource "aws_lambda_permission" "allow_bucket" {
  action = "lambda:InvokeFunction"
  function_name = aws_lambda_function.func.arn
  principal = "s3.amazonaws.com"
  source_arn = aws_s3_bucket.bucket.arn
  statement_id = "AllowExecutionFromS3Bucket"
}

resource "aws_s3_bucket" "bucket" {
  bucket = "your-bucket-name"
}

resource "aws_s3_bucket_notification" "bucket_notification" {
  bucket = aws_s3_bucket.bucket.id
  depends_on = ["aws_lambda_permission.allow_bucket"]

  lambda_function {
    events = ["s3:ObjectCreated:*"]
    filter_prefix = "AWSLogs/"
    filter_suffix = ".log"
    lambda_function_arn = aws_lambda_function.func.arn
  }
}