Describe the bug

Creating a new OpenSearch domain creates a new ResourcePolicy every time if any of: slowSearchLogEnabled, slowIndexLogEnabled, appLogEnabled, auditLogEnabled is true.

According to the CloudWatch limits:

Up to 10 CloudWatch Logs resource policies per Region per account. This quota can't be changed.

We're hitting this quota easily since every domain we create creates a new ResourcePolicy

Expected Behavior

Not sure what what would be a good expected behavior.

May be: Reuse a previously created ResourcePolicy and add the new log policy statement.

Current Behavior

A new resource policy is created with every new domain that is created with logging enabled.

Reproduction Steps

Instantiate a new Domain and set any of the log types as true:

                 const domain = new Domain(stack, 'TheDomain', {
                      version: EngineVersion.OPENSEARCH_1_2,
                      logging: {
                          appLogEnabled: true
                      }
                  })

Possible Solution

Reuse a previously created ResourcePolicy and add the new log policy statement.

Additional Information/Context

No response

CDK CLI Version

1.187.0

Framework Version

1.187.0

Node.js Version

16.19.0

OS

Linux

Language

Typescript

Language Version

4.4.3

Other information

No response