# FlowLogDestination

The destination type for the flow log.

- Source: [`aws-ec2/lib/vpc-flow-logs.ts`](https://github.com/aws/aws-cdk/blob/v2.275.0/packages/aws-cdk-lib/aws-ec2/lib/vpc-flow-logs.ts#L206)
- Type last changed: v2.238.0 · 9 Feb 2026

## Example

```ts
declare const vpc: ec2.Vpc;

const logGroup = new logs.LogGroup(this, 'MyCustomLogGroup');

const role = new iam.Role(this, 'MyCustomRole', {
  assumedBy: new iam.ServicePrincipal('vpc-flow-logs.amazonaws.com')
});

new ec2.FlowLog(this, 'FlowLog', {
  resourceType: ec2.FlowLogResourceType.fromVpc(vpc),
  destination: ec2.FlowLogDestination.toCloudWatchLogs(logGroup, role)
});
```

## Initializer

```ts
new FlowLogDestination()
```

## Methods

- `bind(scope: Construct, flowLog: FlowLog): FlowLogDestinationConfig` — Generates a flow log destination configuration.

- `toCloudWatchLogs(logGroup?: ILogGroupRef, iamRole?: IRole): FlowLogDestination // chainable` (static) — Use CloudWatch logs as the destination.

- `toFirehose(deliveryStream: IDeliveryStreamRef, iamRole?: IRole): FlowLogDestination // chainable` (static) — Use Amazon Data Firehose as the destination.

  If the delivery stream and the VPC are in different account, you must specify `iamRole`.

  **Parameters**

  - `deliveryStream` — the Amazon Data Firehose delivery stream to publish logs to.
  - `iamRole` — the IAM Role for cross account log delivery.

- `toKinesisDataFirehoseDestination(deliveryStreamArn: string): FlowLogDestination // chainable` (static) — use `toFirehose`

  **Parameters**

  - `deliveryStreamArn` — the ARN of Amazon Data Firehose delivery stream to publish logs to.

- `toS3(bucket?: IBucket, keyPrefix?: string, options?: S3DestinationOptions): FlowLogDestination // chainable` (static) — Use S3 as the destination.

  **Parameters**

  - `bucket` — optional s3 bucket to publish logs to.
  - `keyPrefix` — optional prefix within the bucket to write logs to.
  - `options` — additional s3 destination options.