[AWS CDK] Kinesis Data FirehoseのデータのS3出力失敗時のログを記録してみた

@

Kinesis Data Firehoseでは、配信ストリームのS3出力失敗時のログ記録設定は**CloudWatchLoggingOptions**を使用する必要があるので設定しています。

- [AWS::KinesisFirehose::DeliveryStream CloudWatchLoggingOptions - AWS CloudFormation](https://docs.aws.amazon.com/ja_jp/AWSCloudFormation/latest/UserGuide/aws-properties-kinesisfirehose-deliverystream-cloudwatchloggingoptions.html)

## 動作確認

### 正常時の動作

配信ストリームにレコードをPutします。

```shell
% aws firehose put-record \
  --delivery-stream-name deliveryStream \
  --record '{"Data":"SGVsbG8gd29ybGQ="}'

% aws s3 ls stream-destination-bucket-${REGION}-${ACCOUNT_ID} --recursive
2021-06-29 23:28:39         31 logs/2021/06/29/14/deliveryStream-1-2021-06-29-14-27-36-1107f8cb-4bda-46a5-95be-0ed2bec84ffa.gz

    /*
    deliveryStreamRole.addToPolicy(
      new iam.PolicyStatement({
        actions: [
          "s3:AbortMultipartUpload",
          "s3:GetBucketLocation",
          "s3:GetObject",
          "s3:ListBucket",
          "s3:ListBucketMultipartUploads",
          "s3:PutObject",
        ],
        effect: iam.Effect.ALLOW,
        resources: [
          streamDestinationBucket.bucketArn,
          `${streamDestinationBucket.bucketArn}/*`,
        ],
      })
    );
    */

この状態で配信ストリームにレコードをPutします。

```shell
% aws firehose put-record \
  --delivery-stream-name deliveryStream \
  --record '{"Data":"SGVsbG8gd29ybGQ="}'

{
    "deliveryStreamARN": "arn:aws:firehose:ap-northeast-1:XXXXXXXXXXXX:deliverystream/deliveryStream",
    "destination": "arn:aws:s3:::stream-destination-bucket-ap-northeast-1-XXXXXXXXXXXX",
    "deliveryStreamVersionId": 1,
    "message": "Access was denied. Ensure that the trust policy for the provided IAM role allows Firehose to assume the role, and the access policy allows access to the S3 bucket.",
    "errorCode": "S3.AccessDenied"
}

% aws s3 ls stream-destination-bucket-${REGION}-${ACCOUNT_ID} --recursive
2021-06-29 23:28:39         31 logs/2021/06/29/14/deliveryStream-1-2021-06-29-14-27-36-1107f8cb-4bda-46a5-95be-0ed2bec84ffa.gz
2021-06-30 00:03:56         31 logs/2021/06/29/14/deliveryStream-1-2021-06-29-14-38-45-0dd923b0-54b7-47f3-8479-670a0637caa4.gz