diff --git a/cloudtrail/cloudwatch.tf b/cloudtrail/cloudwatch.tf
index 6d49cfc..54b75e7 100644
--- a/cloudtrail/cloudwatch.tf
+++ b/cloudtrail/cloudwatch.tf
@@ -2,8 +2,8 @@ locals {
   cloudwatch_prefix        = replace(aws_cloudwatch_log_group.this.arn, "/:\\*$/", "")
   cloudwatch_suffix        = format("%v_CloudTrail_%v", local.account_id, local.region)
   org_cloudwatch_suffix    = format("%v_*", var.organization_id)
-  cloudwatch_resources     = join(":", list(local.cloudwatch_prefix, "log-stream", local.cloudwatch_suffix))
-  org_cloudwatch_resources = var.enable_organization ? join(":", list(local.cloudwatch_prefix, "log-stream", local.org_cloudwatch_suffix)) : null
+  cloudwatch_resources     = join(":", tolist(local.cloudwatch_prefix, "log-stream", local.cloudwatch_suffix))
+  org_cloudwatch_resources = var.enable_organization ? join(":", tolist(local.cloudwatch_prefix, "log-stream", local.org_cloudwatch_suffix)) : null
   resources                = compact([local.cloudwatch_resources, local.org_cloudwatch_resources])
 }