fix: split DescribeLogGroups into wildcard resource statement

Author: Local E2E

src/cli/operations/deploy/post-deploy-ab-tests.ts

@@ -639,11 +639,16 @@ async function getOrCreateABTestRole(options: CreateABTestRoleOptions): Promise<
         Resource: `${arnPrefix(region)}:bedrock-agentcore:*:${accountId}:*`,
         Condition: { StringEquals: { 'aws:ResourceAccount': accountId } },
       },
+      {
+        Sid: 'CloudWatchLogsDescribe',
+        Effect: 'Allow',
+        Action: ['logs:DescribeLogGroups'],
+        Resource: '*',
+      },
       {
         Sid: 'CloudWatchLogs',
         Effect: 'Allow',
         Action: [
-          'logs:DescribeLogGroups',
           'logs:DescribeIndexPolicies',
           'logs:PutIndexPolicy',
           'logs:StartQuery',