data "aws_caller_identity" "current" {
}

data "aws_iam_policy_document" "example" {

  statement {
    actions = ["logs:CreateLogStream", "logs:PutLogEvents"]

    condition {
      test = "ArnLike"
      values = ["arn:aws:logs:${data.aws_region.current.name}:${data.aws_caller_identity.current.account_id}:*"]
      variable = "aws:SourceArn"
    }

    condition {
      test = "StringEquals"
      values = [tostring(data.aws_caller_identity.current.account_id)]
      variable = "aws:SourceAccount"
    }
    effect = "Allow"

    principals {
      identifiers = ["delivery.logs.amazonaws.com"]
      type = "Service"
    }
    resources = ["${aws_cloudwatch_log_group.example.arn}:*"]
  }
  version = "2012-10-17"
}

data "aws_region" "current" {
}

resource "aws_cloudwatch_log_group" "example" {
  name = "aws-waf-logs-some-uniq-suffix"
}

resource "aws_cloudwatch_log_resource_policy" "example" {
  policy_document = data.aws_iam_policy_document.example.json
  policy_name = "webacl-policy-uniq-name"
}

resource "aws_wafv2_web_acl_logging_configuration" "example" {
  log_destination_configs = [aws_cloudwatch_log_group.example.arn]
  resource_arn = "aws_wafv2_web_acl.example.arn"
}