[aws-events-targets] Support CloudWatch Logs as a target

Although it’s not well-documented yet, CloudWatch Logs is a supported target for event rules. The ARN is the log group ARN.

Use Case

This is useful for, among other things, recording ECS task state changes that are otherwise difficult to observe.

Proposed Solution

Here’s an example. Note, the log group name must start with /aws/events/ because EventBridge relies on an unpublished CloudWatch Logs resource policy in order to work properly.

Caller:

    const logGroup = new logs.LogGroup(this, 'EcsEventLog', {
      // must start with /aws/events/
      logGroupName: `/aws/events/ecs-${cluster.clusterName}` 
    });

    new cdk.CfnOutput(this, 'LogGroupName', {
      value: logGroup.logGroupName
    });

    const clusterEvents = new events.Rule(this, 'EcsEvents', {
      eventPattern: {
        source: ['aws.ecs'],
        detail: {
          clusterArn: [cluster.clusterArn]
        }
      },
      targets: [new CloudWatchLogsTarget(this, 'LogsTarget', logGroup)]
    });

Implementation:

export class CloudWatchLogsTarget extends cdk.Construct {
    private logGroup: logs.ILogGroup;

    constructor(scope: cdk.Construct, id: string, logGroup: logs.ILogGroup) {
        super(scope, id);
        this.logGroup = logGroup;
    }

    public bind(rule: events.IRule, id?: string): events.RuleTargetConfig {
        return {
            id: '',
            // we can't use logGroup.logArn because it has `:*` on the end, and it's a token
            // so we can't just remove the suffix with string replacement operations
            arn: `arn:aws:logs:${this.logGroup.stack.region}:${this.logGroup.stack.account}:log-group:${this.logGroup.logGroupName}`,
        }
    }
}

Ideally, we’d go one step further and implement event handler declarations on ECS Cluster objects, but that’s a story for another day.

Other

• 👋 I may be able to implement this feature request
• ⚠️ This feature might incur a breaking change

---

This is a 🚀 Feature Request

[otterley]

Looks good @demus. One runtime check I might add is to verify that the log group name starts with /aws/events/ and raise a runtime error if not.

[aripalo]

I guess this is due to that CloudFormation issue, but just today found this out since I had created CloudWatch Log Group as EventBridge Rule target manually in the console, but could not replicate it with CDK.

Just my two cents, it’d be a really useful feature to have!