fix: Cloudwatch policy for pipes

[angelcharge]

Description

CloudWatch policy does not have proper resource and missing ability to use log_configuration.cloudwatch_logs_log_destination, targeting CloudWatch in pipes will result in:

    "error": {
        "message": "Target invocation failed with error from Logs. Not allowed to invoke.",
        "httpStatusCode": 400,
        "awsService": "logs",
        "exceptionType": "AccessDenied",
    },

Motivation and Context

Fixes issue #136

Breaking Changes

No.

How Has This Been Tested?

• I have updated at least one of the examples/* to demonstrate and validate my change(s)
• I have tested and validated these changes using one or more of the provided examples/* projects

• I have executed pre-commit run -a on my pull request

[github-actions]

This PR has been automatically marked as stale because it has been open 30 days
with no activity. Remove stale label or comment or this PR will be closed in 10 days

[antonbabenko]

This PR is included in version 3.14.1 🎉