ReadonlyencryptionThe KMS key the destination log group is encrypted with. The key's policy must already grant
CloudWatch Logs (logs.{region}.amazonaws.com) and vended delivery (delivery.logs.amazonaws.com)
use of the key, scoped to the destination log-group ARN — this helper does not add those grants.
ReadonlyidConstruct-id prefix for the child resources, so each caller keeps stable, non-colliding ids
(and existing baselines do not move). Children are created with ids
${idPrefix}loggroup${idSuffix}, ${idPrefix}logsource${idSuffix},
${idPrefix}logdestination${idSuffix}, ${idPrefix}logdelivery${idSuffix}.
Optional ReadonlyidConstruct-id suffix for the child resources (see idPrefix). Use for per-instance callers
that must disambiguate ids (e.g. -${kbName}); omit for a singleton caller.
ReadonlylogPath prefix for the destination log group name (MdaaLogGroup appends the MDAA-named segment),
e.g. /aws/vendedlogs/bedrock/knowledge-base/.
ReadonlylogCloudWatch Logs delivery log type for the source, e.g. APPLICATION_LOGS. Must be a log type
the source resource supports (an unsupported value fails at deploy).
ReadonlynamingMDAA naming used for the log group and the delivery source/destination names.
ReadonlyresourceThe ARN of the resource whose logs are delivered (the delivery source's resourceArn).
ReadonlyresourceThe MDAA-named segment passed to MdaaLogGroup as logGroupName and used as the delivery
source/destination resource-name seed (typically the resource / instance name).
Optional ReadonlyretentionRetention for the destination log group.
Props for createMdaaVendedLogDelivery.
CloudWatch Logs "vended log delivery" is how logs are captured for AWS resources that do not write to a log group directly (e.g. a Bedrock Knowledge Base or an AgentCore Gateway): a delivery source bound to the resource ARN → a delivery destination on a log group → a delivery linking them, writing into a CMK-encrypted destination log group. This wraps that fixed wiring so it is defined once instead of reimplemented per L3.
This helper adds no KMS key-policy grants — the CloudWatch Logs at-rest grant and the
delivery.logs.amazonaws.comvended-delivery grant are the responsibility of whoever provisions the key (the orchestrating construct), consistent with how the key is granted for the resource's other uses. The caller passes an already-granted key.