feat(aws-logs-destinations): add Firehose Log Subscription Destination

packages/@aws-cdk/aws-logs-destinations/README.md

@@ -1,4 +1,4 @@
-# CDK Construct Libray for AWS XXX
+# CDK Construct Library for AWS CloudWatch Logs Subscription Destinations
 <!--BEGIN STABILITY BANNER-->
 
 ---
@@ -9,4 +9,51 @@
 
 <!--END STABILITY BANNER-->
 
-A short description here.
+This library supplies constructs for working with CloudWatch Logs Subscription Destinations.
+
+## Logs Destinations
+
+Log events matching a particular filter can be sent to Lambda, Kinesis or Kinesis Data Firehose.
+
+Logs that are sent to a receiving service through a subscription filter are Base64 encoded and compressed with the gzip format. For further information, see the [Using CloudWatch Logs Subscription Filters](https://docs.aws.amazon.com/AmazonCloudWatch/latest/logs/SubscriptionFilters.html).
+
+Create a `SubscriptionFilter`, initialize it with an appropriate `Pattern` and supply the intended destination.
+
+### Lambda Destination
+
+```ts
+const fn = new lambda.Function(this, 'Lambda', { ... });
+const logGroup = new LogGroup(this, 'LogGroup', { ... });
+
+new SubscriptionFilter(this, 'Subscription', {
+  logGroup,
+  destination: new LogsDestinations.LambdaDestination(fn),
+  filterPattern: FilterPattern.allTerms("ERROR", "MainThread")
+});
+```
+
+### Kinesis Destination
+
+```ts
+const stream = new kinesis.Stream(stack, 'KinesisStream', { ... });
+const logGroup = new LogGroup(this, 'LogGroup', { ... });
+
+new SubscriptionFilter(this, 'Subscription', {
+  logGroup,
+  destination: new LogsDestinations.KinesisDestination(stream),
+  filterPattern: FilterPattern.allTerms("ERROR", "MainThread")
+});
+```
+
+### Kinesis Firehose Destination
+
+```ts
+const deliveryStream = new firehose.DeliveryStream(stack, 'Firehose', { ... });
+const logGroup = new LogGroup(this, 'LogGroup', { ... });
+
+new SubscriptionFilter(this, 'Subscription', {
+  logGroup,
+  destination: new LogsDestinations.KinesisFirehoseDestination(deliveryStream),
+  filterPattern: FilterPattern.allTerms("ERROR", "MainThread")
+});
+```

packages/@aws-cdk/aws-logs-destinations/lib/index.ts

@@ -1,2 +1,3 @@
 export * from './lambda';
 export * from './kinesis';
+export * from './kinesisfirehose';

packages/@aws-cdk/aws-logs-destinations/lib/kinesisfirehose.ts

@@ -0,0 +1,35 @@
+import * as iam from '@aws-cdk/aws-iam';
+import * as firehose from '@aws-cdk/aws-kinesisfirehose';
+import * as logs from '@aws-cdk/aws-logs';
+import { Stack } from '@aws-cdk/core';
+
+// keep this import separate from other imports to reduce chance for merge conflicts with v2-main
+// eslint-disable-next-line no-duplicate-imports, import/order
+import { Construct } from '@aws-cdk/core';
+
+/**
+ * Use a Kinesis Firehose as the destination for a log subscription
+ */
+export class KinesisFirehoseDestination implements logs.ILogSubscriptionDestination {
+  constructor(private readonly deliveryStream: firehose.DeliveryStream) {
+  }
+
+  public bind(_scope: Construct, _sourceLogGroup: logs.ILogGroup): logs.LogSubscriptionDestinationConfig {
+    const { region } = Stack.of(this.deliveryStream);
+
+    // Following example from https://docs.aws.amazon.com/AmazonCloudWatch/latest/logs/SubscriptionFilters.html#FirehoseExample
+    // Create a role to be assumed by CWL that can write to this Firehose.
+    const roleId = 'CloudWatchLogsCanPutRecordsIntoKinesisFirehose';
+    const role = this.deliveryStream.node.tryFindChild(roleId) as iam.IRole ??
+      new iam.Role(this.deliveryStream, roleId, {
+        assumedBy: new iam.ServicePrincipal(`logs.${region}.amazonaws.com`),
+      });
+
+    this.deliveryStream.grantPutRecords(role);
+
+    return {
+      arn: this.deliveryStream.deliveryStreamArn,
+      role,
+    };
+  }
+}

packages/@aws-cdk/aws-logs-destinations/lib/lambda.ts

@@ -6,7 +6,7 @@ import { Construct } from '@aws-cdk/core';
 /**
  * Options that may be provided to LambdaDestination
  */
-export interface LambdaDestinationOptions{
+export interface LambdaDestinationOptions {
   /** Whether or not to add Lambda Permissions.
    * @default true
    */

packages/@aws-cdk/aws-logs-destinations/package.json

@@ -70,11 +70,14 @@
     "cfn2ts": "0.0.0",
     "jest": "^26.6.3",
     "pkglint": "0.0.0",
-    "@aws-cdk/assert-internal": "0.0.0"
+    "@aws-cdk/assert-internal": "0.0.0",
+    "@aws-cdk/aws-kinesisfirehose-destinations": "0.0.0",
+    "@aws-cdk/aws-s3": "0.0.0"
   },
   "dependencies": {
     "@aws-cdk/aws-iam": "0.0.0",
     "@aws-cdk/aws-kinesis": "0.0.0",
+    "@aws-cdk/aws-kinesisfirehose": "0.0.0",
     "@aws-cdk/aws-lambda": "0.0.0",
     "@aws-cdk/aws-logs": "0.0.0",
     "@aws-cdk/core": "0.0.0",
@@ -84,6 +87,7 @@
   "peerDependencies": {
     "@aws-cdk/aws-iam": "0.0.0",
     "@aws-cdk/aws-kinesis": "0.0.0",
+    "@aws-cdk/aws-kinesisfirehose": "0.0.0",
     "@aws-cdk/aws-lambda": "0.0.0",
     "@aws-cdk/aws-logs": "0.0.0",
     "@aws-cdk/core": "0.0.0",