Enable logging with private s3 bucket

aws-s3-private-bucket/main.tf

@@ -1,6 +1,8 @@
 locals {
   # If grants are defined, we use `grant` to grant permissions, otherwise it will use the `acl` to grant permissions
-  acl = length(var.grants) == 0 ? "private" : null
+  private_acl            = length(var.grants) == 0 ? "private" : null
+  log_delivery_write_acl = var.log_delivery_write_acl_enable ? "log-delivery-write" : null
+  acl                    = try(coalesce(local.log_delivery_write_acl, local.private_acl), null)
 
   tags = {
     project   = var.project

aws-s3-private-bucket/variables.tf

@@ -68,3 +68,9 @@ variable grants {
   default     = []
   description = "A list of canonical user ID to permissions pairs. Used when we want to grant permissions to AWS accounts via the S3 ACL system."
 }
+
+variable log_delivery_write_acl_enable {
+  type        = bool
+  default     = false
+  description = "Enables logging"
+}