ec2-instance-policy.tf

#
# up in the aws_instance.mycoolinstance resource:
# iam_instance_profile         = "${aws_iam_instance_profile.cloudwatch_logs.name}"
#

resource "aws_iam_instance_profile" "cloudwatch_logs" {
  name = "cloudwatch_logs"
  role = "${aws_iam_role.cloudwatch.name}"
}

resource "aws_iam_role" "cloudwatch" {
  name = "cloudwatch"
  path = "/"

  # https://www.terraform.io/docs/providers/aws/r/iam_instance_profile.html
  assume_role_policy = <<EOF
{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Action": "sts:AssumeRole",
            "Effect": "Allow",
            "Principal": {
                "Service": "ec2.amazonaws.com"
            }
        }
    ]
}
EOF
}

resource "aws_iam_role_policy" "cloudwatch" {
  name = "cloudwatch"
  role = "${aws_iam_role.cloudwatch.id}"
  # https://docs.aws.amazon.com/AmazonCloudWatch/latest/logs/QuickStartEC2Instance.html
  policy = <<EOF
{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": [
        "logs:CreateLogGroup",
        "logs:CreateLogStream",
        "logs:PutLogEvents",
        "logs:DescribeLogStreams"
    ],
      "Resource": [
        "arn:aws:logs:*:*:*"
    ]
  }
 ]
}
EOF
}