S3 bucket policy to allow CloudFront logging

Hi,

I have two S3 buckets, and one of them has a website. Thanks fort he help, Route 53, CloudFront, and S3 are all working well to serve the website now.

I have also enabled CloudFront standard logging and selected an S3 bucket for log data.

Is there an example policy I can apply to the logging S3 permission?

I found this but I get 'Invalid principal in policy' error: https://docs.aws.amazon.com/AmazonS3/latest/userguide/example-bucket-policies.html#example-bucket-policies-cloudfront

{
    "Version": "2012-10-17",
    "Id": "PolicyForCloudFrontPrivateContent",
    "Statement": [
        {
            "Effect": "Allow",
            "Principal": {
                "AWS": "arn:aws:iam::cloudfront:user/CloudFront Origin Access Identity E27xxxx"
            },
            "Action": "s3:GetObject",
            "Resource": "arn:aws:s3:::DOC-EXAMPLE-BUCKET/*"
        }
    ]
}

Also, are there any disadvantages to turning on Cookie Logging?

Thanks!