Provision an event bridge in terraform to connect s3 to glue workflow

I am creating a iac to connect an s3 on aws to a glue workflow using event bus and event bridge. I am getting error on defining ami and policies Here is the code I try

adding a role for glue

resource "aws_iam_role" "glue" {
  name               = "AWSGlueServiceRoleDefault"
  assume_role_policy = <<EOF
{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Action": "sts:AssumeRole",
      "Principal": {
        "Service": "glue.amazonaws.com"
      },
      "Effect": "Allow",
      "Sid": ""
    }
  ]
}
EOF
}

Here adding an event bus to transfer the events from s3 to glue workflow

resource "aws_cloudwatch_event_bus" "event_bus_…" {
  name = "…._event_bus"
}

A cloud watch group to store events

resource "aws_cloudwatch_log_group" "…._log_group" {
  name = "tran_hist_log_group"

 
}

Defining a key for s3 to store event logs

module "kms_key" {
  source = "cloudposse/kms-key/aws"

  stage                   = var.environment
  namespace               = var.organization
  name                    = "tran_hist_kms"
  description             = "KMS key for app"
  deletion_window_in_days = 10
  enable_key_rotation     = true
  alias                   = "alias/parameter_store_key"
}

Define a cloud trail to emit events from s3 and write them to event bus. Here I get credentials error for cloud trail.

resource "aws_cloudtrail" "aws_cloudtrail_for_…" {

  name           = "aws_cloudtrail_for_…"
  s3_bucket_name = module.s3_bucket_cloud_trail_log_…..bucket_id
   kms_key_id = module.kms_key.key_arn
  event_selector {
    read_write_type           = "All"
    include_management_events = true

    data_resource {
      type   = "AWS::S3::Object"
      values = ["arn:aws:s3"]
    }
  }
 
  cloud_watch_logs_role_arn = "${aws_iam_role.cloud_trail.arn}"

  cloud_watch_logs_group_arn = "${aws_cloudwatch_log_group…..arn}:*"

}

I tried the following role to provide enough access to cloud trail but still credentials is not enough. And I get error.

resource "aws_iam_role" "cloud_trail" {
  name = "cloudTrail-cloudWatch-role"

  assume_role_policy = <<EOF
{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Principal": {
        "Service": "cloudtrail.amazonaws.com"
      },
      "Action": "sts:AssumeRole"
    }
  ]
}
EOF
}

The error:

module.s3_1.aws_cloudtrail.aws_cloudtrail_for_trnx_hist: Still creating... [1m50s elapsed] ╷ │ Error: Error creating CloudTrail: InvalidCloudWatchLogsLogGroupArnException: Access denied. Verify in IAM that the role has adequate permissions.