Allow CloudWatch to stream logs to Kinesis

policy.json

{
  "Statement": [
    {
      "Effect": "Allow",
      "Action": "kinesis:PutRecord",
      "Resource": "arn:aws:kinesis:AWS_REGION:ACOUNT_ID:stream/cloudwatch-logs"
    },
    {
      "Effect": "Allow",
      "Action": "iam:PassRole",
      "Resource": "arn:aws:iam::ACOUNT_ID:role/CloudWatchStreamToKinesisRole"
    }
  ]
}