Unable to escape quotes in terraform when writing cloudwatch subscription filter patterns

I've got the following terraform resource declaration:

# Log subscription to lambda
resource "aws_cloudwatch_log_subscription_filter" "subscription" {
  provider = "aws.west"
  name            = "root-monitor"
  log_group_name  = "${aws_cloudwatch_log_group.log-group.name}"
  filter_pattern  = "{ $.userIdentity.type = \"Root\" && ( $.eventType = \"AwsConsoleSignIn\" || ( $.eventType = \"AwsApiCall\" && $.userIdentity.accessKeyId = \"*\" )) }"
  destination_arn = "${aws_lambda_function.lambda.arn}"
}

Note that the expression must contain double-quotes. The terraform must also be enclosed in double-quotes, so I've tried escaping with a backslash. (This is to say, neither the filter expression nor terraform accept single-quote as an alternative).

This is accepted and pushed successfully to aws, but the resulting pattern contains the backslashes:

$ aws logs describe-subscription-filters --log-group-name cloudtrail-root-monitor
{
    "subscriptionFilters": [
        {
            "filterName": "root-monitor",
            "logGroupName": "cloudtrail-root-monitor",
            "filterPattern": "{ $.userIdentity.type = \"Root\" && ( 
$.eventType = \"AwsConsoleSignIn\" || ( $.eventType = \"AwsApiCall\" && $.userIdentity.accessKeyId = \"*\" ))}",
            "destinationArn": "arn:aws:lambda:us-west-2:xxxxxxxxxxxx:function:root-alarm-processor",
            "distribution": "ByLogStream",
            "creationTime": 1506386842242
        }
    ]
}

I've also tried it the filter pattern as a docstring and unfortunately arrive at the same result.

Any help is appreciated. I've resorted to issuing a provisioner but in a multi-account setup it's a pain. Thank you.