Block all requests to cloudwatch logs rather than resource filtering when deny is enabled.

Author: trajano

CHANGES.md

@@ -1,5 +1,8 @@
 # Change Log
 
+## 7.1.12
+* Block all requests to cloudwatch logs rather than resource filtering when deny is enabled.
+
 ## 7.1.11
 * Ignore specific tag changes
 

iam-swarm.tf

@@ -61,7 +61,7 @@ data "aws_iam_policy_document" "deny-put-log-events" {
   statement {
     effect    = "Deny"
     actions   = ["logs:PutLogEvents"]
-    resources = ["arn:aws:logs:::log-group:${local.dns_name}:log-stream:*"]
+    resources = ["*"]
   }
 }