enable audit logs on tarballs.nixos.org

[Mic92]

I haven't yet tried applying it but here is the diff:

./tf.sh plan --target aws_s3_bucket.nixpkgs-tarballs-cloudtrail-logs --target aws_cloudtrail.nixpkgs-tarballs --target aws_iam_role.nixpkgs-tarballs-cloudtrail

  # aws_cloudtrail.nixpkgs-tarballs will be created
  + resource "aws_cloudtrail" "nixpkgs-tarballs" {
      + arn                           = (known after apply)
      + cloud_watch_logs_role_arn     = (known after apply)
      + enable_log_file_validation    = true
      + enable_logging                = true
      + home_region                   = (known after apply)
      + id                            = (known after apply)
      + include_global_service_events = true
      + is_multi_region_trail         = false
      + is_organization_trail         = false
      + name                          = "nixpkgs-tarballs"
      + s3_bucket_name                = "nixpkgs-tarballs-cloudtrail-logs"
      + tags_all                      = (known after apply)

      + event_selector {
          + include_management_events = false
          + read_write_type           = "WriteOnly"

          + data_resource {
              + type   = "AWS::S3::Object"
              + values = [
                  + "arn:aws:s3:::nixpkgs-tarballs/",
                ]
            }
        }
    }

  # aws_iam_role.nixpkgs-tarballs-cloudtrail will be created
  + resource "aws_iam_role" "nixpkgs-tarballs-cloudtrail" {
      + arn                   = (known after apply)
      + assume_role_policy    = jsonencode(
            {
              + Statement = [
                  + {
                      + Action    = "sts:AssumeRole"
                      + Effect    = "Allow"
                      + Principal = {
                          + Service = "cloudtrail.amazonaws.com"
                        }
                    },
                ]
              + Version   = "2012-10-17"
            }
        )
      + create_date           = (known after apply)
      + force_detach_policies = false
      + id                    = (known after apply)
      + managed_policy_arns   = (known after apply)
      + max_session_duration  = 3600
      + name                  = "nixpkgs-tarballs-cloudtrail"
      + name_prefix           = (known after apply)
      + path                  = "/"
      + tags_all              = (known after apply)
      + unique_id             = (known after apply)
    }

  # aws_s3_bucket.nixpkgs-tarballs-cloudtrail-logs will be created
  + resource "aws_s3_bucket" "nixpkgs-tarballs-cloudtrail-logs" {
      + acceleration_status         = (known after apply)
      + acl                         = "private"
      + arn                         = (known after apply)
      + bucket                      = "nixpkgs-tarballs-cloudtrail-logs"
      + bucket_domain_name          = (known after apply)
      + bucket_prefix               = (known after apply)
      + bucket_regional_domain_name = (known after apply)
      + force_destroy               = false
      + hosted_zone_id              = (known after apply)
      + id                          = (known after apply)
      + object_lock_enabled         = (known after apply)
      + policy                      = (known after apply)
      + region                      = (known after apply)
      + request_payer               = (known after apply)
      + tags_all                    = (known after apply)
      + website_domain              = (known after apply)
      + website_endpoint            = (known after apply)

      + versioning {
          + enabled    = true
          + mfa_delete = false
        }
    }