The logs are created by apache or logrotate, but salt shouldn't change permissions of existing logfiles everytime it runs.