Need to ensure that the AWS role used by Pulumi has the

CloudWatch Logs: CreateDelivery

permission for the target resource. Need to look into this package to see how the permissions are defined

usEast1Provider := provider.GetUsEast1Provider(ctx)

Permissions are in place for User used by Pulumi. Provider:

var usEast1Provider pulumi.ProviderResource

func init() {
    usEast1Provider = nil
}
func GetUsEast1Provider(ctx *pulumi.Context) pulumi.ProviderResource {
    if usEast1Provider == nil {
       var err error
       usEast1Provider, err = aws.NewProvider(ctx, "us-east-1-provider", &aws.ProviderArgs{
          Region: pulumi.String("us-east-1"),
       })
       if err != nil {
          log.Fatalf("Failed to create us-east-1 provider: %v", err)
       }
       log.Debug("Created us-east-1 provider for CloudFront-related resources")
    }
    return usEast1Provider
}