How do I set up centralized logging with a VPC Endpoint for CloudWatch Logs?

import * as pulumi from "@pulumi/pulumi";
import * as aws from "@pulumi/aws";

// Create a VPC
const vpc = new aws.ec2.Vpc("myVpc", {
    cidrBlock: "10.0.0.0/16",
    enableDnsSupport: true,
    enableDnsHostnames: true,
});

// Create subnets
const subnet = new aws.ec2.Subnet("mySubnet", {
    vpcId: vpc.id,
    cidrBlock: "10.0.1.0/24",
    availabilityZone: "us-west-2a",
});

// Create an Internet Gateway
const internetGateway = new aws.ec2.InternetGateway("myInternetGateway", {
    vpcId: vpc.id,
});

// Create a route table
const routeTable = new aws.ec2.RouteTable("myRouteTable", {
    vpcId: vpc.id,
    routes: [{
        cidrBlock: "0.0.0.0/0",
        gatewayId: internetGateway.id,
    }],
});

// Associate route table with subnet
new aws.ec2.RouteTableAssociation("myRouteTableAssociation", {
    subnetId: subnet.id,
    routeTableId: routeTable.id,
});

// Create a VPC Endpoint for CloudWatch Logs
const vpcEndpoint = new aws.ec2.VpcEndpoint("myVpcEndpoint", {
    vpcId: vpc.id,
    serviceName: `com.amazonaws.${aws.config.region}.logs`,
    subnetIds: [subnet.id],
    securityGroupIds: [],
    vpcEndpointType: "Interface",
});

// Create an IAM Role for CloudWatch Logs
const logRole = new aws.iam.Role("logRole", {
    assumeRolePolicy: aws.iam.assumeRolePolicyForPrincipal({ Service: "logs.amazonaws.com" }),
});

// Attach a policy to the IAM Role
const logPolicy = new aws.iam.RolePolicy("logPolicy", {
    role: logRole.id,
    policy: pulumi.output({
        Version: "2012-10-17",
        Statement: [{
            Effect: "Allow",
            Action: "logs:*",
            Resource: "*",
        }],
    }),
});

// Create a CloudWatch Log Group
const logGroup = new aws.cloudwatch.LogGroup("myLogGroup", {
    retentionInDays: 7,
});

// Create a Log Stream within the Log Group
const logStream = new aws.cloudwatch.LogStream("myLogStream", {
    logGroupName: logGroup.name,
});

// Export the VPC Endpoint DNS name
export const vpcEndpointDnsName = vpcEndpoint.dnsEntries.apply(entries => entries[0].dnsName);