@aws-cdk/mixins-preview 2.240.0-alpha.0 → 2.242.0-alpha.0

package/lib/services/aws-logs/logs-delivery.js

@@ -4,14 +4,10 @@ exports.DestinationLogsDelivery = exports.XRayLogsDelivery = exports.LogGroupLog
 const jsiiDeprecationWarnings = require("../../../.warnings.jsii.js");
 const JSII_RTTI_SYMBOL_1 = Symbol.for("jsii.rtti");
 const core_1 = require("aws-cdk-lib/core");
-const aws_iam_1 = require("aws-cdk-lib/aws-iam");
 const logs = require("aws-cdk-lib/aws-logs");
-const s3 = require("aws-cdk-lib/aws-s3");
 const constructs_1 = require("constructs");
-const reflections_1 = require("../../mixins/private/reflections");
-const core_2 = require("../../core");
-const xray = require("../aws-xray/policy");
-const bucket_policy_1 = require("../aws-s3/bucket-policy");
+const reflections_1 = require("./reflections");
+const logs_destination_1 = require("./logs-destination");
 /**
  * S3 Vended Logs Permissions version.
  */
@@ -30,10 +26,13 @@ var S3LogsDeliveryPermissionsVersion;
  * Delivers vended logs to an S3 Bucket.
  */
 class S3LogsDelivery {
-    static [JSII_RTTI_SYMBOL_1] = { fqn: "@aws-cdk/mixins-preview.aws_logs.S3LogsDelivery", version: "2.240.0-alpha.0" };
+    static [JSII_RTTI_SYMBOL_1] = { fqn: "@aws-cdk/mixins-preview.aws_logs.S3LogsDelivery", version: "2.242.0-alpha.0" };
     bucket;
     permissions;
     kmsKey;
+    outputFormat;
+    providedFields;
+    mandatoryFields;
     /**
      * Creates a new S3 Bucket delivery.
      */
@@ -50,30 +49,29 @@ class S3LogsDelivery {
         this.bucket = bucket;
         this.permissions = props.permissionsVersion ?? S3LogsDeliveryPermissionsVersion.V2;
         this.kmsKey = props.kmsKey;
+        this.outputFormat = props.outputFormat;
+        this.providedFields = props.providedFields;
+        this.mandatoryFields = props.mandatoryFields;
     }
     /**
      * Binds S3 Bucket to a source resource for the purposes of log delivery and creates a delivery source, a delivery destination, and a connection between them.
      */
     bind(scope, logType, sourceResourceArn) {
         const container = new constructs_1.Construct(scope, deliveryId('S3', logType, scope, this.bucket));
-        const bucketPolicy = this.getOrCreateBucketPolicy(container);
-        this.grantLogsDelivery(bucketPolicy);
         const deliverySource = getOrCreateDeliverySource(logType, scope, sourceResourceArn);
         const deliverySourceRef = deliverySource.deliverySourceRef;
-        const kmsKey = this.findEncryptionKey();
-        if (kmsKey) {
-            this.addToEncryptionKeyPolicy(kmsKey);
-        }
-        const deliveryDestination = new logs.CfnDeliveryDestination(container, 'Dest', {
-            destinationResourceArn: this.bucket.bucketRef.bucketArn,
-            name: deliveryDestName('s3', logType, container),
-            deliveryDestinationType: 'S3',
+        const deliveryDestination = new logs_destination_1.S3DeliveryDestination(container, makeDestId(logType), {
+            bucket: this.bucket,
+            permissionsVersion: this.permissions,
+            encryptionKey: this.kmsKey,
+            outputFormat: this.outputFormat,
         });
+        const recordFields = computeRecordFields(this.providedFields, this.mandatoryFields);
         const delivery = new logs.CfnDelivery(container, 'Delivery', {
             deliveryDestinationArn: deliveryDestination.attrArn,
             deliverySourceName: deliverySourceRef.deliverySourceName,
+            recordFields,
         });
-        deliveryDestination.node.addDependency(bucketPolicy);
         delivery.node.addDependency(deliverySource);
         delivery.node.addDependency(deliveryDestination);
         return {
@@ -82,134 +80,51 @@ class S3LogsDelivery {
             delivery,
         };
     }
-    /**
-     * Gets or creates a bucket policy for the S3 destination Bucket.
-     * @param scope - The construct scope
-     * @returns The bucket policy
-     */
-    getOrCreateBucketPolicy(scope) {
-        const existingPolicy = (0, reflections_1.tryFindBucketPolicyForBucket)(this.bucket);
-        return existingPolicy ?? new s3.CfnBucketPolicy(scope, 'BucketPolicy', {
-            bucket: this.bucket.bucketRef.bucketName,
-            policyDocument: {
-                Version: '2012-10-17',
-                Statement: [],
-            },
-        });
-    }
-    /**
-     * Grants permissions for log delivery to the bucket policy.
-     * @param policy - The bucket policy
-     */
-    grantLogsDelivery(policy) {
-        const stack = core_1.Stack.of(policy);
-        // always required permissions
-        const statements = [
-            new aws_iam_1.PolicyStatement({
-                effect: aws_iam_1.Effect.ALLOW,
-                principals: [new aws_iam_1.ServicePrincipal('delivery.logs.amazonaws.com')],
-                actions: ['s3:PutObject'],
-                resources: [`${this.bucket.bucketRef.bucketArn}/AWSLogs/${stack.account}/*`],
-                conditions: {
-                    StringEquals: {
-                        's3:x-amz-acl': 'bucket-owner-full-control',
-                        'aws:SourceAccount': stack.account,
-                    },
-                    ArnLike: {
-                        'aws:SourceArn': `arn:${stack.partition}:logs:${stack.region}:${stack.account}:delivery-source:*`,
-                    },
-                },
-            }),
-        ];
-        if (this.permissions == 'V1') {
-            statements.push(new aws_iam_1.PolicyStatement({
-                effect: aws_iam_1.Effect.ALLOW,
-                principals: [new aws_iam_1.ServicePrincipal('delivery.logs.amazonaws.com')],
-                actions: ['s3:GetBucketAcl', 's3:ListBucket'],
-                resources: [this.bucket.bucketRef.bucketArn],
-                conditions: {
-                    StringEquals: {
-                        'aws:SourceAccount': stack.account,
-                    },
-                    ArnLike: {
-                        'aws:SourceArn': `arn:${stack.partition}:logs:${stack.region}:${stack.account}:*`,
-                    },
-                },
-            }));
-        }
-        core_2.Mixins.of(policy, core_2.ConstructSelector.onlyItself())
-            .apply(new bucket_policy_1.BucketPolicyStatementsMixin(statements));
-    }
-    findEncryptionKey() {
-        if (this.kmsKey) {
-            return (0, reflections_1.tryFindKmsKeyConstruct)(this.kmsKey);
-        }
-        return (0, reflections_1.tryFindKmsKeyforBucket)(this.bucket);
-    }
-    addToEncryptionKeyPolicy(key) {
-        const existingKeyPolicy = key.keyPolicy;
-        const sourceArnPostfix = this.permissions === S3LogsDeliveryPermissionsVersion.V1 ? '*' : 'delivery-source:*';
-        const sid = 'AWS CDK: Allow Logs Delivery to use the key';
-        const keyStatement = new aws_iam_1.PolicyStatement({
-            sid,
-            effect: aws_iam_1.Effect.ALLOW,
-            principals: [new aws_iam_1.ServicePrincipal('delivery.logs.amazonaws.com')],
-            actions: ['kms:Encrypt', 'kms:Decrypt', 'kms:ReEncrypt*', 'kms:GenerateDataKey*', 'kms:DescribeKey'],
-            resources: ['*'],
-            conditions: {
-                StringEquals: {
-                    'aws:SourceAccount': [key.env.account],
-                },
-                ArnLike: {
-                    'aws:SourceArn': [`arn:${core_1.Aws.PARTITION}:logs:${key.env.region}:${key.env.account}:${sourceArnPostfix}`],
-                },
-            },
-        });
-        if (!existingKeyPolicy) {
-            key.keyPolicy = new aws_iam_1.PolicyDocument({
-                statements: [keyStatement],
-            });
-            return;
-        }
-        // Check if a statement with this SID already exists
-        const hasDuplicateSid = existingKeyPolicy.statements.some((stmt) => stmt.sid === sid);
-        if (hasDuplicateSid) {
-            return;
-        }
-        existingKeyPolicy.addStatements(keyStatement);
-    }
 }
 exports.S3LogsDelivery = S3LogsDelivery;
 /**
  * Delivers vended logs to a Firehose Delivery Stream.
  */
 class FirehoseLogsDelivery {
-    static [JSII_RTTI_SYMBOL_1] = { fqn: "@aws-cdk/mixins-preview.aws_logs.FirehoseLogsDelivery", version: "2.240.0-alpha.0" };
+    static [JSII_RTTI_SYMBOL_1] = { fqn: "@aws-cdk/mixins-preview.aws_logs.FirehoseLogsDelivery", version: "2.242.0-alpha.0" };
     deliveryStream;
+    outputFormat;
+    providedFields;
+    mandatoryFields;
     /**
      * Creates a new Firehose delivery.
      * @param stream - The Kinesis Data Firehose delivery stream
      */
-    constructor(stream) {
+    constructor(stream, props = {}) {
+        try {
+            jsiiDeprecationWarnings._aws_cdk_mixins_preview_aws_logs_DeliveryProps(props);
+        }
+        catch (error) {
+            if (process.env.JSII_DEBUG !== "1" && error.name === "DeprecationError") {
+                Error.captureStackTrace(error, FirehoseLogsDelivery);
+            }
+            throw error;
+        }
         this.deliveryStream = stream;
+        this.outputFormat = props.outputFormat;
+        this.providedFields = props.providedFields;
+        this.mandatoryFields = props.mandatoryFields;
     }
     /**
      * Binds Firehose Delivery Stream to a source resource for the purposes of log delivery and creates a delivery source, a delivery destination, and a connection between them.
      */
     bind(scope, logType, sourceResourceArn) {
         const container = new constructs_1.Construct(scope, deliveryId('Firehose', logType, scope, this.deliveryStream));
-        // Firehose uses a service-linked role to deliver logs
-        // This tag marks the destination stream as an allowed destination for the service-linked role
-        core_1.Tags.of(this.deliveryStream).add('LogDeliveryEnabled', 'true');
         const deliverySource = getOrCreateDeliverySource(logType, scope, sourceResourceArn);
-        const deliveryDestination = new logs.CfnDeliveryDestination(container, 'Dest', {
-            destinationResourceArn: this.deliveryStream.deliveryStreamRef.deliveryStreamArn,
-            name: deliveryDestName('fh', logType, container),
-            deliveryDestinationType: 'FH',
+        const deliveryDestination = new logs_destination_1.FirehoseDeliveryDestination(container, makeDestId(logType), {
+            deliveryStream: this.deliveryStream,
+            outputFormat: this.outputFormat,
         });
+        const recordFields = computeRecordFields(this.providedFields, this.mandatoryFields);
         const delivery = new logs.CfnDelivery(container, 'Delivery', {
             deliveryDestinationArn: deliveryDestination.attrArn,
             deliverySourceName: deliverySource.deliverySourceRef.deliverySourceName,
+            recordFields,
         });
         delivery.node.addDependency(deliverySource);
         delivery.node.addDependency(deliveryDestination);
@@ -225,14 +140,29 @@ exports.FirehoseLogsDelivery = FirehoseLogsDelivery;
  * Delivers vended logs to a CloudWatch Log Group.
  */
 class LogGroupLogsDelivery {
-    static [JSII_RTTI_SYMBOL_1] = { fqn: "@aws-cdk/mixins-preview.aws_logs.LogGroupLogsDelivery", version: "2.240.0-alpha.0" };
+    static [JSII_RTTI_SYMBOL_1] = { fqn: "@aws-cdk/mixins-preview.aws_logs.LogGroupLogsDelivery", version: "2.242.0-alpha.0" };
     logGroup;
+    outputFormat;
+    providedFields;
+    mandatoryFields;
     /**
      * Creates a new log group delivery.
      * @param logGroup - The CloudWatch Logs log group reference
      */
-    constructor(logGroup) {
+    constructor(logGroup, props = {}) {
+        try {
+            jsiiDeprecationWarnings._aws_cdk_mixins_preview_aws_logs_DeliveryProps(props);
+        }
+        catch (error) {
+            if (process.env.JSII_DEBUG !== "1" && error.name === "DeprecationError") {
+                Error.captureStackTrace(error, LogGroupLogsDelivery);
+            }
+            throw error;
+        }
         this.logGroup = logGroup;
+        this.outputFormat = props.outputFormat;
+        this.providedFields = props.providedFields;
+        this.mandatoryFields = props.mandatoryFields;
     }
     /**
      * Binds Log Group to a source resource for the purposes of log delivery and creates a delivery source, a delivery destination, and a connection between them.
@@ -241,89 +171,64 @@ class LogGroupLogsDelivery {
         const container = new constructs_1.Construct(scope, deliveryId('LogGroup', logType, scope, this.logGroup));
         const deliverySource = getOrCreateDeliverySource(logType, scope, sourceResourceArn);
         const deliverySourceRef = deliverySource.deliverySourceRef;
-        const logGroupPolicy = this.getOrCreateLogsResourcePolicy(container);
-        this.grantLogsDelivery(logGroupPolicy);
-        const deliveryDestination = new logs.CfnDeliveryDestination(container, 'Dest', {
-            destinationResourceArn: this.logGroup.logGroupRef.logGroupArn,
-            name: deliveryDestName('cwl', logType, container),
-            deliveryDestinationType: 'CWL',
+        const deliveryDestination = new logs_destination_1.CloudwatchDeliveryDestination(container, makeDestId(logType), {
+            logGroup: this.logGroup,
+            outputFormat: this.outputFormat,
         });
+        const recordFields = computeRecordFields(this.providedFields, this.mandatoryFields);
         const delivery = new logs.CfnDelivery(container, 'Delivery', {
             deliveryDestinationArn: deliveryDestination.deliveryDestinationRef.deliveryDestinationArn,
             deliverySourceName: deliverySourceRef.deliverySourceName,
+            recordFields,
         });
         delivery.node.addDependency(deliverySource);
         delivery.node.addDependency(deliveryDestination);
-        deliveryDestination.node.addDependency(logGroupPolicy);
         return {
             deliverySource,
             deliveryDestination,
             delivery,
         };
     }
-    /**
-     * Gets or creates a singleton Logs Resource Policy.
-     * @param scope - The construct scope
-     * @returns The resource policy
-     */
-    getOrCreateLogsResourcePolicy(scope) {
-        const stack = core_1.Stack.of(scope);
-        const policyId = 'CdkLogGroupLogsDeliveryPolicy';
-        // Singleton policy per stack
-        const existingPolicy = stack.node.tryFindChild(policyId);
-        return existingPolicy ?? new logs.ResourcePolicy(stack, policyId, {
-            resourcePolicyName: core_1.Names.uniqueResourceName(scope, { maxLength: 255 }),
-        });
-    }
-    /**
-     * Grants permissions for log delivery to the resource policy.
-     * @param policy - The resource policy
-     */
-    grantLogsDelivery(policy) {
-        const stack = core_1.Stack.of(policy);
-        policy.document.addStatements(new aws_iam_1.PolicyStatement({
-            effect: aws_iam_1.Effect.ALLOW,
-            principals: [new aws_iam_1.ServicePrincipal('delivery.logs.amazonaws.com')],
-            actions: ['logs:CreateLogStream', 'logs:PutLogEvents'],
-            resources: [`${this.logGroup.logGroupRef.logGroupArn}:log-stream:*`],
-            conditions: {
-                StringEquals: {
-                    'aws:SourceAccount': stack.account,
-                },
-                ArnLike: {
-                    'aws:SourceArn': `arn:${stack.partition}:logs:${stack.region}:${stack.account}:*`,
-                },
-            },
-        }));
-    }
 }
 exports.LogGroupLogsDelivery = LogGroupLogsDelivery;
 /**
  * Delivers vended logs to AWS X-Ray.
  */
 class XRayLogsDelivery {
-    static [JSII_RTTI_SYMBOL_1] = { fqn: "@aws-cdk/mixins-preview.aws_logs.XRayLogsDelivery", version: "2.240.0-alpha.0" };
+    static [JSII_RTTI_SYMBOL_1] = { fqn: "@aws-cdk/mixins-preview.aws_logs.XRayLogsDelivery", version: "2.242.0-alpha.0" };
+    providedFields;
+    mandatoryFields;
     /**
      * Creates a new X-Ray delivery.
      */
-    constructor() { }
+    constructor(props = {}) {
+        try {
+            jsiiDeprecationWarnings._aws_cdk_mixins_preview_aws_logs_RecordFieldDeliveryProps(props);
+        }
+        catch (error) {
+            if (process.env.JSII_DEBUG !== "1" && error.name === "DeprecationError") {
+                Error.captureStackTrace(error, XRayLogsDelivery);
+            }
+            throw error;
+        }
+        this.providedFields = props.providedFields;
+        this.mandatoryFields = props.mandatoryFields;
+    }
     /**
      * Binds X-Ray Destination to a source resource for the purposes of log delivery and creates a delivery source, a delivery destination, and a connection between them.
      */
     bind(scope, logType, sourceResourceArn) {
         const deliverySource = getOrCreateDeliverySource(logType, scope, sourceResourceArn);
         const container = new constructs_1.Construct(scope, deliveryId('XRay', logType, scope, deliverySource));
-        const xrayResourcePolicy = this.getOrCreateResourcePolicy(container);
-        this.grantLogsDelivery(xrayResourcePolicy, sourceResourceArn);
-        const deliveryDestination = new logs.CfnDeliveryDestination(container, 'Dest', {
-            name: deliveryDestName('xray', logType, container),
-            deliveryDestinationType: 'XRAY',
+        const deliveryDestination = new logs_destination_1.XRayDeliveryDestination(container, makeDestId(logType), {
+            sourceResource: sourceResourceArn,
         });
+        const recordFields = computeRecordFields(this.providedFields, this.mandatoryFields);
         const delivery = new logs.CfnDelivery(container, 'Delivery', {
             deliveryDestinationArn: deliveryDestination.attrArn,
             deliverySourceName: deliverySource.deliverySourceRef.deliverySourceName,
+            recordFields,
         });
-        deliveryDestination.node.addDependency(xrayResourcePolicy);
         delivery.node.addDependency(deliverySource);
         delivery.node.addDependency(deliveryDestination);
         return {
@@ -332,57 +237,32 @@ class XRayLogsDelivery {
             delivery,
         };
     }
-    /**
-     * Gets or creates a singleton X-Ray resource policy.
-     *
-     * @param scope - The construct scope
-     * @returns The X-Ray resource policy
-     */
-    getOrCreateResourcePolicy(scope) {
-        const stack = core_1.Stack.of(scope);
-        const policyId = 'CdkXRayLogsDeliveryPolicy';
-        // Singleton policy per stack
-        const existingPolicy = stack.node.tryFindChild(policyId);
-        return existingPolicy ?? new xray.ResourcePolicy(stack, policyId);
-    }
-    /**
-     * Grants permissions for log delivery to resource policy.
-     * @param policy - The resource policy
-     */
-    grantLogsDelivery(policy, sourceResourceArn) {
-        const stack = core_1.Stack.of(policy);
-        policy.document.addStatements(new aws_iam_1.PolicyStatement({
-            sid: 'CDKLogsDeliveryWrite',
-            effect: aws_iam_1.Effect.ALLOW,
-            principals: [new aws_iam_1.ServicePrincipal('delivery.logs.amazonaws.com')],
-            actions: ['xray:PutTraceSegments'],
-            resources: ['*'],
-            conditions: {
-                'ForAllValues:ArnLike': {
-                    'logs:LogGeneratingResourceArns': [sourceResourceArn],
-                },
-                'StringEquals': {
-                    'aws:SourceAccount': stack.account,
-                },
-                'ArnLike': {
-                    'aws:SourceArn': `arn:${stack.partition}:logs:${stack.region}:${stack.account}:delivery-source:*`,
-                },
-            },
-        }));
-    }
 }
 exports.XRayLogsDelivery = XRayLogsDelivery;
 /**
  * Delivers vended logs to a CfnDeliveryDestination specified by an arn.
  */
 class DestinationLogsDelivery {
-    static [JSII_RTTI_SYMBOL_1] = { fqn: "@aws-cdk/mixins-preview.aws_logs.DestinationLogsDelivery", version: "2.240.0-alpha.0" };
+    static [JSII_RTTI_SYMBOL_1] = { fqn: "@aws-cdk/mixins-preview.aws_logs.DestinationLogsDelivery", version: "2.242.0-alpha.0" };
+    providedFields;
+    mandatoryFields;
     /**
      * Creates a new Destination delivery.
      */
     destination;
-    constructor(destination) {
+    constructor(destination, props = {}) {
+        try {
+            jsiiDeprecationWarnings._aws_cdk_mixins_preview_aws_logs_RecordFieldDeliveryProps(props);
+        }
+        catch (error) {
+            if (process.env.JSII_DEBUG !== "1" && error.name === "DeprecationError") {
+                Error.captureStackTrace(error, DestinationLogsDelivery);
+            }
+            throw error;
+        }
         this.destination = destination;
+        this.providedFields = props.providedFields;
+        this.mandatoryFields = props.mandatoryFields;
     }
     /**
      * Binds Delivery Destination to a source resource for the purposes of log delivery and creates a delivery source and a connection between the source and the destination.
@@ -391,15 +271,17 @@ class DestinationLogsDelivery {
         const deliverySource = getOrCreateDeliverySource(logType, scope, sourceResourceArn);
         const uniqueName = `Dest${core_1.Names.nodeUniqueId(this.destination.node)}`;
         const container = new constructs_1.Construct(scope, deliveryId(uniqueName, logType, scope, deliverySource));
+        const recordFields = computeRecordFields(this.providedFields, this.mandatoryFields);
         const delivery = new logs.CfnDelivery(container, 'Delivery', {
             deliveryDestinationArn: this.destination.deliveryDestinationRef.deliveryDestinationArn,
             deliverySourceName: deliverySource.deliverySourceRef.deliverySourceName,
+            recordFields,
         });
         delivery.node.addDependency(deliverySource);
-        const deliveryDestination = logs.CfnDeliveryDestination.fromDeliveryDestinationName(container, 'Destination', this.destination.deliveryDestinationRef.deliveryDestinationName);
+        delivery.node.addDependency(this.destination);
         return {
             deliverySource,
-            deliveryDestination,
+            deliveryDestination: this.destination,
             delivery,
         };
     }
@@ -408,9 +290,22 @@ exports.DestinationLogsDelivery = DestinationLogsDelivery;
 function deliveryId(destType, logType, ...scopes) {
     return `Cdk${destType}${logType.split('_').map(word => word.charAt(0) + word.slice(1).toLowerCase()).join('')}Delivery${scopes.map(s => core_1.Names.uniqueId(s)).join('')}`;
 }
-function deliveryDestName(destType, logType, scope) {
-    const prefix = `cdk-${destType}-${logType.split('_').map(word => word.toLowerCase()).join('-')}-dest-`;
-    return `${prefix}${core_1.Names.uniqueResourceName(scope, { maxLength: 60 - prefix.length })}`;
+function makeDestId(logType) {
+    return 'Dest' + logType.split('_').map(word => word.toLowerCase()).join('-');
+}
+function computeRecordFields(providedFields, mandatoryFields) {
+    if (!providedFields) {
+        // if providedFields is undefined, use default behavior
+        return undefined;
+    }
+    else if (!mandatoryFields) {
+        // if this log type has no mandatory fields, just use the providedFields
+        return providedFields;
+    }
+    // remove any mandatory fields we got from the providedFields array, return a concatination of the providedFields array without the mandatory fields and the mandatory fields
+    // covers instances where a log type has both optional and mandatory fields and instances when an incomplete set of mandatory fields is passed in
+    const onlyOptionalFields = providedFields.filter((field) => { return !mandatoryFields?.includes(field); });
+    return onlyOptionalFields.concat(mandatoryFields);
 }
 function getOrCreateDeliverySource(logType, resource, sourceArn) {
     const sourceResource = (0, reflections_1.tryFindDeliverySourceForResource)(resource, sourceArn, logType);

package/lib/services/aws-logs/logs-destination.d.ts

@@ -0,0 +1,140 @@
+import * as logs from 'aws-cdk-lib/aws-logs';
+import * as s3 from 'aws-cdk-lib/aws-s3';
+import type { Construct } from 'constructs';
+import type { IKeyRef } from 'aws-cdk-lib/aws-kms';
+import type { IDeliveryStreamRef } from 'aws-cdk-lib/aws-kinesisfirehose';
+import { S3LogsDeliveryPermissionsVersion } from './logs-delivery';
+/**
+ * Properties that are shared between most delivery destinations
+ */
+interface DeliveryDestinationProps {
+    /**
+     * Format of the logs that are sent to this delivery destination
+     */
+    readonly outputFormat?: string;
+}
+/**
+ * Properties for Delivery Destinations the participate in Cross Account Delivery
+ */
+interface CrossAccountDestinationProps extends DeliveryDestinationProps {
+    /**
+     * Optional acount id for account the delivery source is in for cross account Vended Logs
+     */
+    readonly sourceAccountId?: string;
+}
+/**
+ * Properties for S3 delivery destination.
+ */
+export interface S3DeliveryDestinationProps extends CrossAccountDestinationProps {
+    /**
+     * The S3 bucket to deliver logs to.
+     */
+    readonly bucket: s3.IBucketRef;
+    /**
+     * The permissions version ('V1' or 'V2') to be used for this delivery.
+     * Depending on the source of the logs, different permissions are required.
+     *
+     * @default "V2"
+     */
+    readonly permissionsVersion?: S3LogsDeliveryPermissionsVersion;
+    /**
+     * KMS key to use for encrypting logs in the S3 bucket.
+     * When provided, grants the logs delivery service permissions to use the key.
+     *
+     * @default - No encryption key is configured
+     */
+    readonly encryptionKey?: IKeyRef;
+}
+/**
+ * Properties for Firehose delivery destination
+ */
+export interface FirehoseDeliveryDestinationProps extends CrossAccountDestinationProps {
+    /**
+     * Delivery stream to delivery logs to
+     */
+    readonly deliveryStream: IDeliveryStreamRef;
+}
+/**
+ * Properties for Cloudwatch delivery destination
+ */
+export interface CloudwatchDeliveryDestinationProps extends DeliveryDestinationProps {
+    /**
+     * Log group to deliver logs to
+     */
+    readonly logGroup: logs.ILogGroupRef;
+}
+/**
+ * Properties for XRay delivery destination
+ */
+export interface XRayDeliveryDestinationProps {
+    /**
+     * Arn of the source resource
+     */
+    readonly sourceResource: string;
+}
+/**
+ * Creates an S3 delivery destination for CloudWatch Logs.
+ */
+export declare class S3DeliveryDestination extends logs.CfnDeliveryDestination {
+    private readonly bucket;
+    private readonly permissions;
+    private readonly kmsKey;
+    private readonly sourceAccount;
+    constructor(scope: Construct, id: string, props: S3DeliveryDestinationProps);
+    /**
+     * Gets or creates a bucket policy for the S3 destination Bucket.
+     * @param scope - The construct scope
+     * @returns The bucket policy
+     */
+    private getOrCreateBucketPolicy;
+    /**
+     * Grants permissions for log delivery to the bucket policy.
+     * @param policy - The bucket policy
+     */
+    private grantLogsDelivery;
+    private findEncryptionKey;
+    private addToEncryptionKeyPolicy;
+}
+/**
+ * Firehose delivery destination for CloudWatch Logs.
+ */
+export declare class FirehoseDeliveryDestination extends logs.CfnDeliveryDestination {
+    constructor(scope: Construct, id: string, props: FirehoseDeliveryDestinationProps);
+}
+/**
+ * CloudWatch delivery destination for CloudWatch Logs.
+ */
+export declare class CloudwatchDeliveryDestination extends logs.CfnDeliveryDestination {
+    private readonly logGroup;
+    constructor(scope: Construct, id: string, props: CloudwatchDeliveryDestinationProps);
+    /**
+     * Gets or creates a singleton Logs Resource Policy.
+     * @param scope - The construct scope
+     * @returns The resource policy
+     */
+    private getOrCreateLogsResourcePolicy;
+    /**
+     * Grants permissions for log delivery to the resource policy.
+     * @param policy - The resource policy
+     */
+    private grantLogsDelivery;
+}
+/**
+ * XRay delivery destination for XRay traces.
+ */
+export declare class XRayDeliveryDestination extends logs.CfnDeliveryDestination {
+    constructor(scope: Construct, id: string, props: XRayDeliveryDestinationProps);
+    /**
+     * Gets or creates a singleton X-Ray resource policy.
+     *
+     * @param scope - The construct scope
+     * @returns The X-Ray resource policy
+     */
+    private getOrCreateResourcePolicy;
+    /**
+     * Grants permissions for log delivery to resource policy.
+     * @param policy - The resource policy
+     */
+    private grantLogsDelivery;
+}
+export {};