How do I set up AWS CloudWatch log archiving to Glacier?

import * as pulumi from "@pulumi/pulumi";
import * as aws from "@pulumi/aws";

// Create an S3 bucket for storing logs
const logsBucket = new aws.s3.Bucket("logsBucket", {
    lifecycleRules: [{
        enabled: true,
        transitions: [{
            days: 30, // Transition objects to Glacier after 30 days
            storageClass: "GLACIER",
        }],
    }],
});

// Create a CloudWatch Log Group
const logGroup = new aws.cloudwatch.LogGroup("logGroup", {
    retentionInDays: 90, // Retain logs in CloudWatch for 90 days
});

// Create an IAM role for CloudWatch to access S3
const logRole = new aws.iam.Role("logRole", {
    assumeRolePolicy: aws.iam.assumeRolePolicyForPrincipal({ Service: "logs.amazonaws.com" }),
});

// Attach a policy to the role to allow writing to the S3 bucket
const logPolicy = new aws.iam.RolePolicy("logPolicy", {
    role: logRole.id,
    policy: logsBucket.arn.apply(arn => JSON.stringify({
        Version: "2012-10-17",
        Statement: [{
            Effect: "Allow",
            Action: [
                "s3:PutObject",
                "s3:GetBucketAcl",
                "s3:ListBucket",
            ],
            Resource: [
                `${arn}`,
                `${arn}/*`,
            ],
        }],
    })),
});

// Create a CloudWatch Log Group subscription filter to send logs to S3
const logSubscription = new aws.cloudwatch.LogSubscriptionFilter("logSubscription", {
    logGroup: logGroup.name,
    destinationArn: logsBucket.arn,
    roleArn: logRole.arn,
    filterPattern: "", // Match all logs
});

export const bucketName = logsBucket.bucket;
export const logGroupName = logGroup.name;