Enable access logging for mirror buckets

[dsotirho-ucsc]

[hannes-ucsc]

The mirror buckets live in different accounts and the log bucket has to reside in the same account as the logged bucket so there will be complications in forwarding the logs to CloudWatch in our main accounts.

• For now, we should at least enable S3 access logging for both buckets (managed and open access) into a third, obviously private, bucket.
• After that we should create a PR that updates the permissions of the forwarder Lambda function as summarized here
• Once the PR lands we can manually set-up an S3 Event Notification for the mirror buckets, as described on that page.

This goes to Sprint for me, for step one.

[hannes-ucsc]

First task is done.

anvilprod - mamirror

anvilprod - mirror

prod