fix: Cloudwatch policy for pipes

[angelcharge]

Description

CloudWatch policy does not have proper resource and missing ability to use log_configuration.cloudwatch_logs_log_destination, targeting CloudWatch in pipes will result in:

    "error": {
        "message": "Target invocation failed with error from Logs. Not allowed to invoke.",
        "httpStatusCode": 400,
        "awsService": "logs",
        "exceptionType": "AccessDenied",
    },

Motivation and Context

Fixes issue #136

Breaking Changes

No.

How Has This Been Tested?

• I have updated at least one of the examples/* to demonstrate and validate my change(s)
• I have tested and validated these changes using one or more of the provided examples/* projects

• I have executed pre-commit run -a on my pull request