def get_aws_cloudtrail_aclcheck_s3_policy_statement(s3_bucket_name):
    """ Return dictionary (that should be converted to json) of AWSCloudTrailAclCheck policy """

    # Grabbed from:
    # http://docs.aws.amazon.com/awscloudtrail/latest/userguide/create-s3-bucket-policy-for-cloudtrail.html
    return {
        "Sid": "AWSCloudTrailAclCheck20131101",
        "Effect": "Allow",
        "Principal": {
            "AWS": [
                "arn:aws:iam::903692715234:root",
                "arn:aws:iam::859597730677:root",
                "arn:aws:iam::814480443879:root",
                "arn:aws:iam::216624486486:root",
                "arn:aws:iam::086441151436:root",
                "arn:aws:iam::388731089494:root",
                "arn:aws:iam::284668455005:root",
                "arn:aws:iam::113285607260:root",
                "arn:aws:iam::035351147821:root"
            ]
        },
        "Action": "s3:GetBucketAcl",
        "Resource": "arn:aws:s3:::%s" % s3_bucket_name
    }