Add aws broker tag log groups perm (#1813)

* add permission for tagging cloudwatch log groups for aws-broker resources

* allow tagging log groups for opensearch and RDS

terraform/modules/iam_role_policy/aws_broker/policy.json

@@ -199,6 +199,16 @@
       "Resource": [
         "*"
       ]
+    },
+    {
+      "Effect": "Allow",
+      "Action": [
+        "logs:TagResource"
+      ],
+      "Resource": [
+        "arn:${aws_partition}:logs:${aws_default_region}:${account_id}:log-group:/aws/rds/instance/cg-aws-broker*/*",
+        "arn:${aws_partition}:logs:${aws_default_region}:${account_id}:log-group:/aws/OpenSearchService/domains/cg-broker*/*"
+      ]
     }
   ]
 }