fix(AWLS2-441): ensure S3 bucket exists before VPC flow log creation

[kirklandnuts]

Summary

Updates log_destination parameter in the vpc_flow_logs resource to directly reference our S3 bucket resource, ensuring Terraform creates resources in the correct order.

This fixes an intermittent "Access Denied" error that occurs when terraform tries to create the flow logs resource before the S3 bucket is fully provisioned.

Please refer to the linked Jira ticket for more details.

How did you test this change?

[WIP] Retried deployment a few times and stopped seeing intermittent failure due to permission error when creating the flow logs resource.

Issue

AWLS2-441

[wilderj]

probably still want to publish this to the sidekick/flow-logs path within the bucket for organization purposes.

[kirklandnuts]

good catch dude — addressed in a7af82d

[lacework-code-security]

(Audit Mode) Lacework IAC found 40 new violations

Violation	Severity	File	Guidelines
Ensure that S3 bucket has a Public Access block	High	main.tf	VIEW
Ensure that S3 bucket has a Public Access block	High	main.tf	VIEW
Ensure container insights are enabled on ECS cluster	Low	main.tf	VIEW
Ensure VPC flow logging is enabled in all VPCs	Low	main.tf	VIEW
Ensure VPC flow logging is enabled in all VPCs	Low	main.tf	VIEW
Ensure VPC flow logging is enabled in all VPCs	Low	main.tf	VIEW
Ensure the default security group of every VPC restricts all traffic	Low	main.tf	VIEW
Ensure container insights are enabled on ECS cluster	Low	main.tf	VIEW
Ensure the default security group of every VPC restricts all traffic	Low	main.tf	VIEW
Ensure container insights are enabled on ECS cluster	Low	main.tf	VIEW
Ensure the S3 bucket has access logging enabled	Low	main.tf	VIEW
Ensure VPC flow logging is enabled in all VPCs	Low	main.tf	VIEW
Ensure the default security group of every VPC restricts all traffic	Low	main.tf	VIEW
Ensure the S3 bucket has access logging enabled	Low	main.tf	VIEW
Ensure the default security group of every VPC restricts all traffic	Low	main.tf	VIEW
Ensure the S3 bucket has access logging enabled	Low	main.tf	VIEW
Ensure the default security group of every VPC restricts all traffic	Low	main.tf	VIEW
Ensure the default security group of every VPC restricts all traffic	Low	main.tf	VIEW
Ensure the S3 bucket has access logging enabled	Low	main.tf	VIEW
Ensure container insights are enabled on ECS cluster	Low	main.tf	VIEW
Ensure VPC flow logging is enabled in all VPCs	Low	main.tf	VIEW
Ensure the S3 bucket has access logging enabled	Low	main.tf	VIEW
Ensure the S3 bucket has access logging enabled	Low	main.tf	VIEW
Ensure container insights are enabled on ECS cluster	Low	main.tf	VIEW
Ensure VPC flow logging is enabled in all VPCs	Low	main.tf	VIEW
Ensure the S3 bucket has access logging enabled	Low	main.tf	VIEW
Ensure container insights are enabled on ECS cluster	Low	main.tf	VIEW
Ensure the S3 bucket has access logging enabled	Low	main.tf	VIEW
Ensure the S3 bucket has access logging enabled	Low	main.tf	VIEW
Ensure IAM policies does not allow write access without constraints	Medium	main.tf	VIEW
Ensure that S3 bucket has cross-region replication enabled	Medium	main.tf	VIEW
Ensure that S3 bucket has cross-region replication enabled	Medium	main.tf	VIEW
Ensure that S3 bucket has cross-region replication enabled	Medium	main.tf	VIEW
Ensure that S3 bucket has cross-region replication enabled	Medium	main.tf	VIEW
Ensure that S3 bucket has cross-region replication enabled	Medium	main.tf	VIEW
Ensure that S3 bucket has cross-region replication enabled	Medium	main.tf	VIEW
Ensure that S3 bucket has cross-region replication enabled	Medium	main.tf	VIEW
Ensure that S3 bucket has cross-region replication enabled	Medium	main.tf	VIEW
Ensure IAM policies does not allow write access without constraints	Medium	main.tf	VIEW
Ensure that S3 bucket has cross-region replication enabled	Medium	main.tf	VIEW

[leijin-lw]

It won't work since VPC flow log is a regional resources and aws_s3_bucket.agentless_scan_bucket[0].arn only exists when global = true