feat(ec2): support Firehose `IDeliveryStreamRef` as flow log destination by Tietew · Pull Request #36278 · aws/aws-cdk · GitHub

Tietew · 2025-12-03T07:50:39Z

Issue # (if applicable)

Re-drive of #33883 and #34596.
Related to #33757.

Reason for this change

FlowLogDestination.toKinesisDataFirehoseDestination() includes the former service name Kinesis and receives the string ARN.

Also, cross-account log delivery needs an IAM role. https://docs.aws.amazon.com/vpc/latest/userguide/firehose-cross-account-delivery.html

Description of changes

Added FlowLogDestination.toFirehose() with an optional IAM role.
Deprecate toKinesisDataFirehoseDestination()

Note: CDK cannot create the IAM role for cross-account delivery because the VPC ARN is needed but FlowLog construct doesn't know it.

Changes from previous PRs

This PR refers the new reference interface IDeliveryStreamRef (defined in interfaces submodule) to avoid cyclic dependency.

BEFORE

graph TD;
  A1(aws-ec2)--IDeliveryStream-->B1;
  B1(aws-kinesisfirehose)--Connections,Peer,IConnectable-->A1;

AFTER

graph TD;
  A1(aws-ec2)--IDeliveryStreamRef-->C1;
  B1(aws-kinesisfirehose)--Connections,Peer,IConnecttable-->A1;
  B1(aws-kinesisfirehose)--IDeliveryStreamRef-->C1;
  C1(interfaces);

Describe any new or updated permissions being added

N/A - Users must specify IAM roles for cross account delivery.

Description of how you validated changes

Unit tests and integ test.

Checklist

My code adheres to the CONTRIBUTING GUIDE and DESIGN GUIDELINES

By submitting this pull request, I confirm that my contribution is made under the terms of the Apache-2.0 license

…ws#34596

github-actions · 2025-12-22T06:00:44Z

⚠️ Experimental Feature: This security report is currently in experimental phase. Results may include false positives and the rules are being actively refined.
Please try merge from main to avoid findings unrelated to the PR.

	Tests	Passed ❌️	Skipped	Failed
Security Guardian Results

Test	Result
No test annotations available

View Security Guardian Results

github-actions · 2025-12-22T06:00:46Z

⚠️ Experimental Feature: This security report is currently in experimental phase. Results may include false positives and the rules are being actively refined.
Please try merge from main to avoid findings unrelated to the PR.

	Tests	Passed ❌️	Skipped	Failed
Security Guardian Results with resolved templates

Test	Result
No test annotations available

View Security Guardian Results with resolved templates

aws-cdk-automation · 2026-02-04T16:14:54Z

➡️ PR build request submitted to test-main-pipeline ⬅️

A maintainer must now check the pipeline and add the pr-linter/cli-integ-tested label once the pipeline succeeds.

Tietew · 2026-02-05T02:45:50Z

@leonmk-aws Should I revert renaming integ test?

leonmk-aws

Thank you for your contribution, just a small change requested to clean up leftovers files. Regarding the integ test naming, no you can let it like this, looks like a small bug in how the integ runner workflow find which integ tests to deploy, but the new test deploys fine.

leonmk-aws · 2026-02-05T12:11:02Z

There are leftovers files, can you remove the directory completely since the test got removed.

Thanks for clarification. Removed them.

Pull request has been modified.

leonmk-aws

LGTM

mergify · 2026-02-06T10:28:55Z

Thank you for contributing! Your pull request will be updated from main and then merged automatically (do not update manually, and be sure to allow changes to be pushed to your fork).

mergify · 2026-02-06T10:29:05Z

Merge Queue Status

🟠 Waiting for merge conditions (rule: default-squash)

Entered the queue at: 2026-02-06 10:28 UTC.
Checks are running in-place (dashboard).
Merge ETA: 2026-02-06 10:29 UTC. Buckle up 🚀

Required conditions to merge

Required conditions to stay in the queue

Tietew · 2026-02-06T11:36:10Z

@Mergifyio refresh

mergify · 2026-02-06T13:37:38Z

refresh

✅ Pull request refreshed

mergify · 2026-02-06T13:37:49Z

Thank you for contributing! Your pull request will be updated from main and then merged automatically (do not update manually, and be sure to allow changes to be pushed to your fork).

github-actions · 2026-02-06T13:38:35Z

Comments on closed issues and PRs are hard for our team to see.
If you need help, please open a new issue that references this one.

Tietew added 3 commits December 3, 2025 16:03

feat(ec2): support Firehose IDeliveryStream as flow log destination a…

a08dc91

…ws#34596

IDeliveryStreamRef

ab9d243

update snapshot

50d66ae

aws-cdk-automation requested a review from a team December 3, 2025 07:50

github-actions Bot added distinguished-contributor [Pilot] contributed 50+ PRs to the CDK p2 labels Dec 3, 2025

aws-cdk-automation added the pr/needs-community-review This PR needs a review from a Trusted Community Member or Core Team Member. label Dec 3, 2025

pahud mentioned this pull request Dec 12, 2025

PRs with Conflicts - 8 PR(s) pahud/aws-cdk#13

Open

Merge branch 'main' into ec2-flowlog-firehose-v3

2105539

github-actions Bot mentioned this pull request Jan 1, 2026

Monthly PR metrics report #36544

Open

Tietew added 3 commits February 3, 2026 12:10

Merge branch 'main' into ec2-flowlog-firehose-v3

b15df36

eslint fix

892afec

eslint fix

e7a3bb4

leonmk-aws self-assigned this Feb 4, 2026

leonmk-aws added pr/needs-cli-test-run This PR needs CLI tests run against it. pr/request-cli-integ-tests Request CLI integ tests to be run. You will need to review the code and approve the deployment. and removed pr/needs-cli-test-run This PR needs CLI tests run against it. labels Feb 4, 2026

leonmk-aws had a problem deploying to test-pipeline February 4, 2026 16:08 — with GitHub Actions Failure

leonmk-aws temporarily deployed to test-pipeline February 4, 2026 16:08 — with GitHub Actions Inactive

leonmk-aws added the pr/needs-integration-tests-deployment Requires the PR to deploy the integration test snapshots. label Feb 4, 2026

leonmk-aws had a problem deploying to deployment-integ-test February 4, 2026 16:26 — with GitHub Actions Failure

leonmk-aws had a problem deploying to test-pipeline February 4, 2026 16:27 — with GitHub Actions Failure

leonmk-aws added the pr-linter/cli-integ-tested Assert that any CLI changes have been integ tested label Feb 5, 2026

leonmk-aws had a problem deploying to deployment-integ-test February 5, 2026 12:10 — with GitHub Actions Error

leonmk-aws had a problem deploying to test-pipeline February 5, 2026 12:10 — with GitHub Actions Failure

leonmk-aws previously requested changes Feb 5, 2026

View reviewed changes

leonmk-aws removed pr/request-cli-integ-tests Request CLI integ tests to be run. You will need to review the code and approve the deployment. pr/needs-integration-tests-deployment Requires the PR to deploy the integration test snapshots. labels Feb 5, 2026

aws-cdk-automation removed the pr/needs-community-review This PR needs a review from a Trusted Community Member or Core Team Member. label Feb 5, 2026

Tietew added 2 commits February 6, 2026 15:46

Merge branch 'main' into ec2-flowlog-firehose-v3

fff0bcd

remove leftover files

d877f34

aws-cdk-automation added the pr/needs-community-review This PR needs a review from a Trusted Community Member or Core Team Member. label Feb 6, 2026

leonmk-aws approved these changes Feb 6, 2026

View reviewed changes

Merge branch 'main' into ec2-flowlog-firehose-v3

bccadfb

aws-cdk-automation removed the pr/needs-community-review This PR needs a review from a Trusted Community Member or Core Team Member. label Feb 6, 2026

mergify Bot merged commit cd73498 into aws:main Feb 6, 2026
28 of 29 checks passed

github-actions Bot locked as resolved and limited conversation to collaborators Feb 6, 2026

Tietew deleted the ec2-flowlog-firehose-v3 branch February 6, 2026 14:33

Conversation

Tietew commented Dec 3, 2025

Issue # (if applicable)

Reason for this change

Description of changes

Changes from previous PRs

BEFORE

AFTER

Describe any new or updated permissions being added

Description of how you validated changes

Checklist

Uh oh!

github-actions Bot commented Dec 22, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions Bot commented Dec 22, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

aws-cdk-automation commented Feb 4, 2026

Uh oh!

Tietew commented Feb 5, 2026

Uh oh!

leonmk-aws left a comment

Choose a reason for hiding this comment

Uh oh!

leonmk-aws Feb 5, 2026

Choose a reason for hiding this comment

Uh oh!

Tietew Feb 6, 2026

Choose a reason for hiding this comment

Uh oh!

leonmk-aws left a comment

Choose a reason for hiding this comment

Uh oh!

mergify Bot commented Feb 6, 2026

Uh oh!

mergify Bot commented Feb 6, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Merge Queue Status

Uh oh!

Tietew commented Feb 6, 2026

Uh oh!

mergify Bot commented Feb 6, 2026

✅ Pull request refreshed

Uh oh!

mergify Bot commented Feb 6, 2026

Uh oh!

Uh oh!

github-actions Bot commented Feb 6, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

github-actions Bot commented Dec 22, 2025 •

edited

Loading

github-actions Bot commented Dec 22, 2025 •

edited

Loading

mergify Bot commented Feb 6, 2026 •

edited

Loading