smoketest fails (not authorized to create CloudWatch Logs Log Group)

[rockdaboot]

From https://github.com/elastic/apm-aws-lambda/actions/runs/10195260850/job/28203620257

Error: creating CloudWatch Logs Log Group (/aws/lambda/github-actions-smoke-testing-test): operation error CloudWatch Logs: CreateLogGroup, https response error StatusCode: 400, RequestID: 1be16b55-ea41-4bea-903d-5878767700a7, api error AccessDeniedException: User: arn:aws:sts::697149045717:assumed-role/gha-55ef6f9ad3e07084a079d653f88b25e629e0812c646a890bd344605-role/GitHubActions is not authorized to perform: logs:CreateLogGroup on resource: arn:aws:logs:eu-central-1:697149045717:log-group:/aws/lambda/github-actions-smoke-testing-test:log-stream: because no identity-based policy allows the logs:CreateLogGroup action

  with aws_cloudwatch_log_group.example,
  on main.tf line 105, in resource "aws_cloudwatch_log_group" "example":
 105: resource "aws_cloudwatch_log_group" "example" {


Error: creating IAM Policy (smoketest_extension_lambda_logging): operation error IAM: CreatePolicy, https response error StatusCode: 403, RequestID: a4f30910-cdfd-4441-a488-70cb882f0d32, api error AccessDenied: User: arn:aws:sts::697149045717:assumed-role/gha-55ef6f9ad3e07084a079d653f88b25e629e0812c646a890bd344605-role/GitHubActions is not authorized to perform: iam:CreatePolicy on resource: policy smoketest_extension_lambda_logging because no identity-based policy allows the iam:CreatePolicy action

  with aws_iam_policy.lambda_logging,
  on main.tf line 124, in resource "aws_iam_policy" "lambda_logging":
 124: resource "aws_iam_policy" "lambda_logging" {

Error: Terraform exited with code 1.
-> Calling the lambda function...

An error occurred (AccessDeniedException) when calling the Invoke operation: User: arn:aws:sts::697149045717:assumed-role/gha-55ef6f9ad3e07084a079d653f88b25e629e0812c646a890bd344605-role/GitHubActions is not authorized to perform: lambda:InvokeFunction on resource: arn:aws:lambda:eu-central-1:697149045717:function:github-actions-smoke-testing-test because no identity-based policy allows the lambda:InvokeFunction action