Destination

Source: src/AWS/Logs/Destination.ts

A CloudWatch Logs destination — a cross-account subscription target that forwards log events to a Kinesis stream. Producers in other accounts create subscription filters whose destinationArn points at this destination; the accessPolicy controls which accounts may subscribe.

Cross-Account Log Fan-Out

const destination = yield* Destination("CentralLogs", {
  targetArn: stream.streamArn,
  roleArn: role.roleArn,
  accessPolicy: {
    Version: "2012-10-17",
    Statement: [
      {
        Effect: "Allow",
        Principal: { AWS: "123456789012" },
        Action: ["logs:PutSubscriptionFilter"],
        Resource: "*",
      },
    ],
  },
});