Skip to content

Conversation

@ShadowCat567
Copy link
Contributor

@ShadowCat567 ShadowCat567 commented Nov 12, 2025

Adds new data source to populate logTypes attribute for Cloudformation resources. Does not add github actions to update the data source (for now).

@github-actions

This comment was marked as outdated.

@cdklabs cdklabs deleted a comment from github-actions bot Nov 13, 2025
@cdklabs cdklabs deleted a comment from github-actions bot Nov 13, 2025
readonly validations?: unknown;
arnTemplate?: string;
isStateful?: boolean;
logTypes?: string[];
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This is probably not quite enough. Let's make this a list of a new custom type VendedLogs. See slack discussion for details on what needs to go there.

@github-actions

This comment was marked as outdated.

@github-actions

This comment was marked as outdated.

>,
report: ProblemReport,
) {
// clears vendedLogs property from all resources before processing - goal: ensure that logTypes and destinations are up to date and cut down on complicated deduplication code
Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Open to other ideas to handle possible duplication of logTypes (when it comes to repeated imports of data source) or removal of logTypes (if a service stops supporting a certain logType). This current implementation is a bit aggressive.

Copy link
Contributor

@mrgrain mrgrain Nov 17, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

You just don't need to do that at all. The DB starts out empty.

@github-actions

This comment was marked as outdated.

@github-actions

This comment was marked as outdated.

Comment on lines 18 to 22
for (const resource of db.all('resource')) {
if (resource.vendedLogs) {
delete resource.vendedLogs;
}
}
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Suggested change
for (const resource of db.all('resource')) {
if (resource.vendedLogs) {
delete resource.vendedLogs;
}
}

/**
* What version of permissions the destination supports V1 | V2
*/
permissionsVersion: string;
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Suggested change
permissionsVersion: string;
readonly permissionsVersion: string;

/**
* List of the destinations the can consume those logs
*/
readonly logDestinations: LogDestination[];
Copy link
Contributor

@mrgrain mrgrain Nov 17, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Prefer to remove duplicate naming. In this context, its pretty clear we are talking about log destinations.

Suggested change
readonly logDestinations: LogDestination[];
readonly destinations: LogDestination[];

/**
* List of the types of logs a Cloudformation resource can produce
*/
readonly logTypes: string[];
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Normally you would consider removing the log prefix here as well (see next comment). In this case it's probably okay to keep it because A/ types is very generic (probably too generic) and B/ it's the term used here.

So I vote to keep it in this case.

/**
* Resource type of the destination S3 | CWL | FH | XRAY
*/
readonly destinationType: string;
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Again doubling up. Here I think it's fine to remove the prefix. You could also call it something like service or not even have a separate interface.

Suggested change
readonly destinationType: string;
readonly type: string;

Copy link
Contributor Author

@ShadowCat567 ShadowCat567 Nov 17, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

currently have this as a separate interface since we may want logFormat (json, parquet, plain text, raw...) in the future and that can vary per destination service

Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Both is fine. My usual approach is to not over-optimize for future possibilities.

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

ended up moving this out of its separate interface since it will be easier to handle and we currently don't have plans to add logFormat or any service-specific fields that would require the separate interface

/**
* Resource type of the destination S3 | CWL | FH | XRAY
*/
readonly destinationType: string;
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

There should be no reason to not strongly type this:

Suggested change
readonly destinationType: string;
readonly destinationType: "S3" | "CWL" | "FH" | "XRAY";

Comment on lines 28 to 42
let permissionValue = '';
for (const dest of value.Destinations) {
if (permissionValue === '') {
permissionValue = dest.PermissionsVersion;
} else {
if (permissionValue !== dest.PermissionsVersion) {
report.reportFailure(
new ReportAudience('Log Source Import'),
'interpreting',
failure.in(resourceType)(
`Resouce of type ${resourceType} has inconsistent permissions version for log of type ${value.LogType}`,
),
);
}
}
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

You can simplify this a lot along these lines

Suggested change
let permissionValue = '';
for (const dest of value.Destinations) {
if (permissionValue === '') {
permissionValue = dest.PermissionsVersion;
} else {
if (permissionValue !== dest.PermissionsVersion) {
report.reportFailure(
new ReportAudience('Log Source Import'),
'interpreting',
failure.in(resourceType)(
`Resouce of type ${resourceType} has inconsistent permissions version for log of type ${value.LogType}`,
),
);
}
}
const permissionValue = Value.Destinations[0].PermissionsVersion;
if (!value.Destinations.every(v => v.PermissionsVersion === permissionValue)) {
// ... report failure
}

Comment on lines 49 to 67
if (resource.vendedLogs) {
// we take whatever the newest permissions value is and assume that all logs in a resource use the same permissions
resource.vendedLogs.permissionsVersion = permissionValue;
resource.vendedLogs.logTypes.push(value.LogType);
// dedupes incoming destinations
const newDestinations = destinations.filter(
(dest) =>
!resource.vendedLogs!.logDestinations.some(
(existing) => existing.destinationType === dest.destinationType,
),
);
resource.vendedLogs.logDestinations.push(...newDestinations);
} else {
resource.vendedLogs = {
permissionsVersion: permissionValue,
logTypes: [value.LogType],
logDestinations: destinations,
};
}
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Simplify by flipping it around:

??= = Nullish coalescing assignment

Suggested change
if (resource.vendedLogs) {
// we take whatever the newest permissions value is and assume that all logs in a resource use the same permissions
resource.vendedLogs.permissionsVersion = permissionValue;
resource.vendedLogs.logTypes.push(value.LogType);
// dedupes incoming destinations
const newDestinations = destinations.filter(
(dest) =>
!resource.vendedLogs!.logDestinations.some(
(existing) => existing.destinationType === dest.destinationType,
),
);
resource.vendedLogs.logDestinations.push(...newDestinations);
} else {
resource.vendedLogs = {
permissionsVersion: permissionValue,
logTypes: [value.LogType],
logDestinations: destinations,
};
}
resource.vendedLogs ??= {};
resource.vendedLogs.logTypes ??= [];
resource.vendedLogs.logDestinations ??= [];
// we take whatever the newest permissions value is and assume that all logs in a resource use the same permissions
resource.vendedLogs.permissionsVersion = permissionValue;
// Add log types
resource.vendedLogs.logTypes.push(value.LogType);
// dedupes incoming destinations
const newDestinations = destinations.filter(
(dest) =>
!resource.vendedLogs!.logDestinations.some(
(existing) => existing.destinationType === dest.destinationType,
),
);
resource.vendedLogs.logDestinations.push(...newDestinations);

Copy link
Contributor

@mrgrain mrgrain left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Some minor inline comments

│            └logDestinations: [{"destinationType":"S3"}, {"destinationType":"CWL"}, {"destinationType":"FH"}]

If you keep LogDestination as an interface type, let's please simplify this diff to

│            └logDestinations: [S3, CW,  FH]

If you change LogDestination to be a string (or rather S3, CW, FH, XRAY) this should happen more or less for free.

@github-actions

This comment was marked as outdated.

@mrgrain mrgrain changed the title feat: new data source for log types feat: data source for vended log types Nov 17, 2025
@ShadowCat567 ShadowCat567 marked this pull request as ready for review November 17, 2025 16:24
@github-actions

This comment was marked as outdated.

@github-actions
Copy link
Contributor

@aws-cdk/aws-service-spec: Model database diff detected
📁 Download full diff

├[~] service aws-aps
│ └ resources
│    ├[~]  resource AWS::APS::Scraper
│    │  └ vendedLogs
│    │     └[+] vendedLogs
│    │       ├permissionsVersion: V1
│    │       ├logTypes: [APPLICATION_LOGS]
│    │       └destinations: [S3, CWL, FH]
│    └[~]  resource AWS::APS::Workspace
│       └ vendedLogs
│          └[+] vendedLogs
│            ├permissionsVersion: V1
│            ├logTypes: [MANAGED_PROMETHEUS_LOGS]
│            └destinations: [S3, CWL, FH]
├[~] service aws-b2bi
│ └ resources
│    └[~]  resource AWS::B2BI::Transformer
│       └ vendedLogs
│          └[+] vendedLogs
│            ├permissionsVersion: V1
│            ├logTypes: [B2BI_EXECUTION_LOGS]
│            └destinations: [S3, CWL, FH]
├[~] service aws-backupgateway
│ └ resources
│    └[~]  resource AWS::BackupGateway::Hypervisor
│       └ vendedLogs
│          └[+] vendedLogs
│            ├permissionsVersion: V1
│            ├logTypes: [BGW_HYPERVISOR_LOGS, DATA_ACCESS_LOGS]
│            └destinations: [S3, CWL, FH]
├[~] service aws-bedrock
│ └ resources
│    ├[~]  resource AWS::Bedrock::Agent
│    │  └ vendedLogs
│    │     └[+] vendedLogs
│    │       ├permissionsVersion: V2
│    │       ├logTypes: [APPLICATION_LOGS]
│    │       └destinations: [S3, CWL, FH]
│    ├[~]  resource AWS::Bedrock::AgentAlias
│    │  └ vendedLogs
│    │     └[+] vendedLogs
│    │       ├permissionsVersion: V2
│    │       ├logTypes: [EVENT_LOGS]
│    │       └destinations: [S3, CWL, FH]
│    ├[~]  resource AWS::Bedrock::Flow
│    │  └ vendedLogs
│    │     └[+] vendedLogs
│    │       ├permissionsVersion: V2
│    │       ├logTypes: [APPLICATION_LOGS]
│    │       └destinations: [S3, CWL, FH]
│    └[~]  resource AWS::Bedrock::KnowledgeBase
│       └ vendedLogs
│          └[+] vendedLogs
│            ├permissionsVersion: V2
│            ├logTypes: [APPLICATION_LOGS, RUNTIME_LOGS]
│            └destinations: [S3, CWL, FH]
├[~] service aws-bedrockagentcore
│ └ resources
│    ├[~]  resource AWS::BedrockAgentCore::Gateway
│    │  └ vendedLogs
│    │     └[+] vendedLogs
│    │       ├permissionsVersion: V2
│    │       ├logTypes: [APPLICATION_LOGS, TRACES]
│    │       └destinations: [S3, CWL, FH, XRAY]
│    ├[~]  resource AWS::BedrockAgentCore::Memory
│    │  └ vendedLogs
│    │     └[+] vendedLogs
│    │       ├permissionsVersion: V2
│    │       ├logTypes: [APPLICATION_LOGS, TRACES]
│    │       └destinations: [S3, CWL, FH, XRAY]
│    └[~]  resource AWS::BedrockAgentCore::Runtime
│       └ vendedLogs
│          └[+] vendedLogs
│            ├permissionsVersion: V2
│            ├logTypes: [APPLICATION_LOGS, TRACES, USAGE_LOGS]
│            └destinations: [S3, CWL, FH, XRAY]
├[~] service aws-cleanrooms
│ └ resources
│    └[~]  resource AWS::CleanRooms::Membership
│       └ vendedLogs
│          └[+] vendedLogs
│            ├permissionsVersion: V1
│            ├logTypes: [ANALYSIS_LOGS]
│            └destinations: [S3, CWL, FH]
├[~] service aws-cloudfront
│ └ resources
│    └[~]  resource AWS::CloudFront::Distribution
│       └ vendedLogs
│          └[+] vendedLogs
│            ├permissionsVersion: V2
│            ├logTypes: [CONNECTION_LOGS]
│            └destinations: [S3, CWL, FH]
├[~] service aws-cognito
│ └ resources
│    └[~]  resource AWS::Cognito::UserPool
│       └ vendedLogs
│          └[+] vendedLogs
│            ├permissionsVersion: V1
│            ├logTypes: [APPLICATION_LOGS]
│            └destinations: [S3, CWL, FH]
├[~] service aws-connect
│ └ resources
│    └[~]  resource AWS::Connect::Instance
│       └ vendedLogs
│          └[+] vendedLogs
│            ├permissionsVersion: V2
│            ├logTypes: [AMAZON_CONNECT_FLOW_LOGS]
│            └destinations: [S3, CWL, FH]
├[~] service aws-ec2
│ └ resources
│    ├[~]  resource AWS::EC2::RouteServerPeer
│    │  └ vendedLogs
│    │     └[+] vendedLogs
│    │       ├permissionsVersion: V2
│    │       ├logTypes: [EVENT_LOGS]
│    │       └destinations: [S3, CWL, FH]
│    ├[~]  resource AWS::EC2::VerifiedAccessInstance
│    │  └ vendedLogs
│    │     └[+] vendedLogs
│    │       ├permissionsVersion: V1
│    │       ├logTypes: [VERIFIED_ACCESS_LOGS]
│    │       └destinations: [S3, CWL, FH]
│    ├[~]  resource AWS::EC2::VPC
│    │  └ vendedLogs
│    │     └[+] vendedLogs
│    │       ├permissionsVersion: V1
│    │       ├logTypes: [ROUTE53_RESOLVER_QUERY_LOGS]
│    │       └destinations: [S3, CWL, FH]
│    └[~]  resource AWS::EC2::VPNConnection
│       └ vendedLogs
│          └[+] vendedLogs
│            ├permissionsVersion: V2
│            ├logTypes: [EVENT_LOGS, CONNECTION_LOGS]
│            └destinations: [S3, CWL, FH]
├[~] service aws-eks
│ └ resources
│    └[~]  resource AWS::EKS::Cluster
│       └ vendedLogs
│          └[+] vendedLogs
│            ├permissionsVersion: V2
│            ├logTypes: [AUTO_MODE_BLOCK_STORAGE_LOGS, AUTO_MODE_COMPUTE_LOGS, AUTO_MODE_IPAM_LOGS, AUTO_MODE_LOAD_BALANCING_LOGS]
│            └destinations: [S3, CWL, FH]
├[~] service aws-elasticache
│ └ resources
│    └[~]  resource AWS::ElastiCache::CacheCluster
│       └ vendedLogs
│          └[+] vendedLogs
│            ├permissionsVersion: V1
│            ├logTypes: [ELASTICACHE_LOGS]
│            └destinations: [S3, CWL, FH]
├[~] service aws-elasticloadbalancingv2
│ └ resources
│    └[~]  resource AWS::ElasticLoadBalancingV2::LoadBalancer
│       └ vendedLogs
│          └[+] vendedLogs
│            ├permissionsVersion: V1
│            ├logTypes: [NLB_ACCESS_LOGS]
│            └destinations: [S3]
├[~] service aws-entityresolution
│ └ resources
│    ├[~]  resource AWS::EntityResolution::IdMappingWorkflow
│    │  └ vendedLogs
│    │     └[+] vendedLogs
│    │       ├permissionsVersion: V2
│    │       ├logTypes: [WORKFLOW_LOGS]
│    │       └destinations: [S3, CWL, FH]
│    └[~]  resource AWS::EntityResolution::MatchingWorkflow
│       └ vendedLogs
│          └[+] vendedLogs
│            ├permissionsVersion: V2
│            ├logTypes: [WORKFLOW_LOGS]
│            └destinations: [S3, CWL, FH]
├[~] service aws-events
│ └ resources
│    └[~]  resource AWS::Events::EventBus
│       └ vendedLogs
│          └[+] vendedLogs
│            ├permissionsVersion: V2
│            ├logTypes: [ERROR_LOGS, INFO_LOGS, TRACE_LOGS]
│            └destinations: [S3, CWL, FH]
├[~] service aws-grafana
│ └ resources
│    └[~]  resource AWS::Grafana::Workspace
│       └ vendedLogs
│          └[+] vendedLogs
│            ├permissionsVersion: V2
│            ├logTypes: [APPLICATION_LOGS]
│            └destinations: [S3, CWL, FH]
├[~] service aws-iotfleetwise
│ └ resources
│    ├[~]  resource AWS::IoTFleetWise::Campaign
│    │  └ vendedLogs
│    │     └[+] vendedLogs
│    │       ├permissionsVersion: V1
│    │       ├logTypes: [IOT_FLEETWISE_LOGS]
│    │       └destinations: [S3, CWL, FH]
│    └[~]  resource AWS::IoTFleetWise::Vehicle
│       └ vendedLogs
│          └[+] vendedLogs
│            ├permissionsVersion: V1
│            ├logTypes: [IOT_FLEETWISE_LOGS]
│            └destinations: [S3, CWL, FH]
├[~] service aws-ivschat
│ └ resources
│    └[~]  resource AWS::IVSChat::Room
│       └ vendedLogs
│          └[+] vendedLogs
│            ├permissionsVersion: V1
│            ├logTypes: [IVS_CHAT_LOGS]
│            └destinations: [S3, CWL, FH]
├[~] service aws-kafkaconnect
│ └ resources
│    └[~]  resource AWS::KafkaConnect::Connector
│       └ vendedLogs
│          └[+] vendedLogs
│            ├permissionsVersion: V1
│            ├logTypes: [APPLICATION_LOGS]
│            └destinations: [S3, CWL, FH]
├[~] service aws-m2
│ └ resources
│    └[~]  resource AWS::M2::Application
│       └ vendedLogs
│          └[+] vendedLogs
│            ├permissionsVersion: V1
│            ├logTypes: [CONFIG_LOGS, BATCH_JOB_LOGS, CONSOLE_LOGS, DATASET_IMPORT_LOGS]
│            └destinations: [S3, CWL, FH]
├[~] service aws-mediapackagev2
│ └ resources
│    └[~]  resource AWS::MediaPackageV2::ChannelGroup
│       └ vendedLogs
│          └[+] vendedLogs
│            ├permissionsVersion: V2
│            ├logTypes: [EGRESS_ACCESS_LOGS, INGRESS_ACCESS_LOGS]
│            └destinations: [S3, CWL, FH]
├[~] service aws-mediatailor
│ └ resources
│    └[~]  resource AWS::MediaTailor::PlaybackConfiguration
│       └ vendedLogs
│          └[+] vendedLogs
│            ├permissionsVersion: V2
│            ├logTypes: [AD_DECISION_SERVER_LOGS, MANIFEST_SERVICE_LOGS, TRANSCODE_LOGS]
│            └destinations: [S3, CWL, FH]
├[~] service aws-msk
│ └ resources
│    └[~]  resource AWS::MSK::Cluster
│       └ vendedLogs
│          └[+] vendedLogs
│            ├permissionsVersion: V1
│            ├logTypes: [BROKER_LOGS]
│            └destinations: [S3, CWL, FH]
├[~] service aws-networkfirewall
│ └ resources
│    └[~]  resource AWS::NetworkFirewall::Firewall
│       └ vendedLogs
│          └[+] vendedLogs
│            ├permissionsVersion: V1
│            ├logTypes: [ALERT_LOGS, FLOW_LOGS, TLS_LOGS]
│            └destinations: [S3, CWL, FH]
├[~] service aws-organizations
│ └ resources
│    └[~]  resource AWS::Organizations::Organization
│       └ vendedLogs
│          └[+] vendedLogs
│            ├permissionsVersion: V2
│            ├logTypes: [ACCESS_CONTROL_LOGS, AUTHENTICATION_LOGS, WORKMAIL_AVAILABILITY_PROVIDER_LOGS, WORKMAIL_MAILBOX_ACCESS_LOGS, WORKMAIL_PERSONAL_ACCESS_TOKEN_LOGS]
│            └destinations: [S3, CWL, FH]
├[~] service aws-osis
│ └ resources
│    └[~]  resource AWS::OSIS::Pipeline
│       └ vendedLogs
│          └[+] vendedLogs
│            ├permissionsVersion: V1
│            ├logTypes: [PIPELINE_LOGS]
│            └destinations: [S3, CWL, FH]
├[~] service aws-pcs
│ └ resources
│    └[~]  resource AWS::PCS::Cluster
│       └ vendedLogs
│          └[+] vendedLogs
│            ├permissionsVersion: V2
│            ├logTypes: [PCS_JOBCOMP_LOGS, PCS_SCHEDULER_LOGS]
│            └destinations: [S3, CWL, FH]
├[~] service aws-pipes
│ └ resources
│    └[~]  resource AWS::Pipes::Pipe
│       └ vendedLogs
│          └[+] vendedLogs
│            ├permissionsVersion: V1
│            ├logTypes: [EXECUTION_LOGS]
│            └destinations: [S3, CWL, FH]
├[~] service aws-qbusiness
│ └ resources
│    └[~]  resource AWS::QBusiness::Application
│       └ vendedLogs
│          └[+] vendedLogs
│            ├permissionsVersion: V2
│            ├logTypes: [SYNC_JOB_LOGS, EVENT_LOGS]
│            └destinations: [S3, CWL, FH]
├[~] service aws-route53profiles
│ └ resources
│    └[~]  resource AWS::Route53Profiles::Profile
│       └ vendedLogs
│          └[+] vendedLogs
│            ├permissionsVersion: V1
│            ├logTypes: [ROUTE53_PROFILES_RESOLVER_QUERY_LOGS]
│            └destinations: [S3, CWL, FH]
├[~] service aws-rum
│ └ resources
│    └[~]  resource AWS::RUM::AppMonitor
│       └ vendedLogs
│          └[+] vendedLogs
│            ├permissionsVersion: V1
│            ├logTypes: [RUM_TELEMETRY_LOGS, RUM_OTEL_LOGS, RUM_OTEL_SPANS]
│            └destinations: [S3, CWL, FH]
├[~] service aws-sagemaker
│ └ resources
│    └[~]  resource AWS::SageMaker::Workteam
│       └ vendedLogs
│          └[+] vendedLogs
│            ├permissionsVersion: V1
│            ├logTypes: [ACTIVITY_LOGS]
│            └destinations: [S3, CWL]
├[~] service aws-ses
│ └ resources
│    ├[~]  resource AWS::SES::MailManagerIngressPoint
│    │  └ vendedLogs
│    │     └[+] vendedLogs
│    │       ├permissionsVersion: V2
│    │       ├logTypes: [APPLICATION_LOGS, TRAFFIC_POLICY_DEBUG_LOGS]
│    │       └destinations: [S3, CWL, FH]
│    └[~]  resource AWS::SES::MailManagerRuleSet
│       └ vendedLogs
│          └[+] vendedLogs
│            ├permissionsVersion: V2
│            ├logTypes: [APPLICATION_LOGS]
│            └destinations: [S3, CWL, FH]
├[~] service aws-shield
│ └ resources
│    └[~]  resource AWS::Shield::Protection
│       └ vendedLogs
│          └[+] vendedLogs
│            ├permissionsVersion: V2
│            ├logTypes: [FLOW_LOGS]
│            └destinations: [S3, CWL, FH]
├[~] service aws-stepfunctions
│ └ resources
│    └[~]  resource AWS::StepFunctions::StateMachine
│       └ vendedLogs
│          └[+] vendedLogs
│            ├permissionsVersion: V1
│            ├logTypes: [EXPRESS_LOGS, STANDARD_LOGS]
│            └destinations: [CWL]
├[~] service aws-transfer
│ └ resources
│    └[~]  resource AWS::Transfer::Server
│       └ vendedLogs
│          └[+] vendedLogs
│            ├permissionsVersion: V1
│            ├logTypes: [TRANSFER_LOGS]
│            └destinations: [S3, CWL, FH]
├[~] service aws-vpclattice
│ └ resources
│    ├[~]  resource AWS::VpcLattice::ResourceConfiguration
│    │  └ vendedLogs
│    │     └[+] vendedLogs
│    │       ├permissionsVersion: V1
│    │       ├logTypes: [RESOURCE_ACCESS_LOGS]
│    │       └destinations: [S3, CWL, FH]
│    └[~]  resource AWS::VpcLattice::Service
│       └ vendedLogs
│          └[+] vendedLogs
│            ├permissionsVersion: V1
│            ├logTypes: [ACCESS_LOGS]
│            └destinations: [S3, CWL, FH]
├[~] service aws-wafv2
│ └ resources
│    └[~]  resource AWS::WAFv2::WebACL
│       └ vendedLogs
│          └[+] vendedLogs
│            ├permissionsVersion: V1
│            ├logTypes: [ACCESS_LOGS, TOKEN_LOGS]
│            └destinations: [S3, CWL, FH]
└[~] service aws-wisdom
  └ resources
     └[~]  resource AWS::Wisdom::Assistant
        └ vendedLogs
           └[+] vendedLogs
             ├permissionsVersion: V2
             ├logTypes: [EVENT_LOGS]
             └destinations: [S3, CWL, FH]

@aws-cdk-automation aws-cdk-automation added this pull request to the merge queue Nov 17, 2025
Merged via the queue into main with commit c355286 Nov 17, 2025
10 checks passed
@aws-cdk-automation aws-cdk-automation deleted the loggroupsource branch November 17, 2025 16:45
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants