feat(ec2): support Firehose IDeliveryStream as flow log destination

[Tietew]

Reopen #33883
The cyclic dependency issue #34592 should be resolved before merging this PR again.

Issue # (if applicable)

Related to #33757.

Reason for this change

FlowLogDestination.toKinesisDataFirehoseDestination() includes the former service name Kinesis and receives the string ARN.

Also, cross-account log delivery needs an IAM role. https://docs.aws.amazon.com/vpc/latest/userguide/firehose-cross-account-delivery.html

Description of changes

• Added FlowLogDestination.toFirehose() with an optional IAM role.
• Deprecate toKinesisDataFirehoseDestination()

Note: CDK cannot create the IAM role for cross-account delivery because the VPC ARN is needed but FlowLog construct doesn't know it.

Describe any new or updated permissions being added

N/A - Users must specify IAM roles for cross account delivery.

Description of how you validated changes

Unit tests and integ test.

Checklist

• My code adheres to the CONTRIBUTING GUIDE and DESIGN GUIDELINES

---

By submitting this pull request, I confirm that my contribution is made under the terms of the Apache-2.0 license

[Tietew]

Clarification Request

Importing ec2.Connections, ec2.IConnectable, and ec2.Peer directly instead of aws-ec2/index.ts should resolve cyclic dependency, I think.
See the dependency diagram below.

But I'm unsure how jsii works on dependency between each submodule in aws-cdk-lib.
Is this a correct solution?

--- a/packages/aws-cdk-lib/aws-kinesisfirehose/lib/delivery-stream.ts
+++ b/packages/aws-cdk-lib/aws-kinesisfirehose/lib/delivery-stream.ts
@@ -5,7 +5,8 @@ import { FirehoseMetrics } from './kinesisfirehose-canned-metrics.generated';
 import { CfnDeliveryStream } from './kinesisfirehose.generated';
 import { ISource } from './source';
 import * as cloudwatch from '../../aws-cloudwatch';
-import * as ec2 from '../../aws-ec2';
+import { Connections, IConnectable } from '../../aws-ec2/lib/connections';
+import { Peer } from '../../aws-ec2/lib/peer';
 import * as iam from '../../aws-iam';
 import * as kms from '../../aws-kms';
 import * as cdk from '../../core';

Before

graph TD;
  A1(aws-ec2)-->A2;
  A2(aws-ec2/lib/vpc-flow-logs.ts)--IDeliveryStream-->B1;
  B1(aws-kinesisfirehose)-->B2;
  B2(aws-kinesisfirehose/lib/delivery-stream.ts)--Connections,Peer,IConnectable-->A1;

Loading

After

graph TD;
  A1(aws-ec2)-->A2 & A3 & A4;
  A2(aws-ec2/lib/vpc-flow-logs.ts)--IDeliveryStream-->B1;
  A3(aws-ec2/lib/connections.ts)--Peer-->A4;
  A4(aws-ec2/lib/peer.ts)--Connections,IConnectable-->A3;
  B1(aws-kinesisfirehose)-->B2;
  B2(aws-kinesisfirehose/lib/delivery-stream.ts)--Connections,IConnectable-->A3;
  B2--Peer-->A4;

Loading

[ozelalisen]

I've reviewed the changes in this PR and can confirm that it fixes the cyclic dependency issue. Approving this PR

[mergify]

Thank you for contributing! Your pull request will be updated from main and then merged automatically (do not update manually, and be sure to allow changes to be pushed to your fork).

[aws-cdk-automation]

AWS CodeBuild CI Report

• CodeBuild project: AutoBuildv2Project1C6BFA3F-wQm2hXv2jqQv
• Commit ID: 217ad82
• Result: SUCCEEDED
• Build Logs (available for 30 days)

Powered by github-codebuild-logs, available on the AWS Serverless Application Repository

[mergify]

Thank you for contributing! Your pull request will be updated from main and then merged automatically (do not update manually, and be sure to allow changes to be pushed to your fork).

[github-actions]

Comments on closed issues and PRs are hard for our team to see.
If you need help, please open a new issue that references this one.

[ozelalisen]

Need to revert this PR as it created cyclic dependency again