(aws-logs): Incorrect descriptions for involvement of `CrossAccountDestination`

[taesungh]

Describe the issue

Related to #6884, pointed out before in incomplete PR #20582:

Previously in #2655, constructs for CloudWatch Logs Subscription Destinations were moved to aws-logs-destinations, but there's some leftover inaccurate descriptions of using CrossAccountDestination: the docs indicate the constructs for Kinesis handle cross-account usage and suggestion consumers shouldn't need to use said construct, but there are no remaining supporting code references for such.

Would appreciate the construct itself being fixed, but that's out of scope.

Links

aws-cdk-lib.aws_logs module Overview

If the Kinesis stream lives in a different account, a CrossAccountDestination object needs to be added in the destination account which will act as a proxy for the remote Kinesis stream. This object is automatically created for you if you use the CDK Kinesis library.

class CrossAccountDestination (construct)

Consumers will hardly ever need to use this class. Instead, directly subscribe a Kinesis stream using the integration class in the aws-cdk-lib/aws-logs-destinations package; if necessary, a CrossAccountDestination will be created automatically.

[pahud]

Hi @taesungh,

Thanks for reporting this documentation issue. It appears the documentation for CrossAccountDestination contains inaccurate claims about automatic creation when using the KinesisDestination class.

From my analysis, the KinesisDestination.bind() method only creates an IAM role and returns the stream ARN - there's no code that automatically creates a CrossAccountDestination for cross-account scenarios. This appears to be leftover documentation from when the destinations were moved to aws-logs-destinations in PR #2655.

The fix for this issue would be a documentation update IMO.

The related functionality issue (#6884) for actually implementing cross-account support remains open as a separate concern.

If you'd like to contribute a PR to fix this documentation, that would be very welcome! The changes would be in:

• packages/aws-cdk-lib/aws-logs/README.md
• packages/aws-cdk-lib/aws-logs/lib/cross-account-destination.ts (JSDoc)