S3 bucket with built in IAM policy to allow CloudTrail logs - View it on GitHub