data "aws_iam_policy_document" "queue" {

  statement {
    actions = ["sqs:SendMessage"]

    condition {
      test = "ArnEquals"
      values = [aws_s3_bucket.bucket.arn]
      variable = "aws:SourceArn"
    }
    effect = "Allow"

    principals {
      identifiers = [*]
      type = *
    }
    resources = ["arn:aws:sqs:*:*:s3-event-notification-queue"]
  }
}

resource "aws_s3_bucket" "bucket" {
  bucket = "your-bucket-name"
}

resource "aws_s3_bucket_notification" "bucket_notification" {
  bucket = aws_s3_bucket.bucket.id

  queue {
    events = ["s3:ObjectCreated:*"]
    filter_suffix = ".log"
    queue_arn = aws_sqs_queue.queue.arn
  }
}

resource "aws_sqs_queue" "queue" {
  name = "s3-event-notification-queue"
  policy = data.aws_iam_policy_document.queue.json
}