feat(ec2): support Firehose IDeliveryStreamRef as flow log destination

[Tietew]

Issue # (if applicable)

Re-drive of #33883 and #34596.
Related to #33757.

Reason for this change

FlowLogDestination.toKinesisDataFirehoseDestination() includes the former service name Kinesis and receives the string ARN.

Also, cross-account log delivery needs an IAM role. https://docs.aws.amazon.com/vpc/latest/userguide/firehose-cross-account-delivery.html

Description of changes

• Added FlowLogDestination.toFirehose() with an optional IAM role.
• Deprecate toKinesisDataFirehoseDestination()

Note: CDK cannot create the IAM role for cross-account delivery because the VPC ARN is needed but FlowLog construct doesn't know it.

Changes from previous PRs

This PR refers the new reference interface IDeliveryStreamRef (defined in interfaces submodule) to avoid cyclic dependency.

BEFORE

graph TD;
  A1(aws-ec2)--IDeliveryStream-->B1;
  B1(aws-kinesisfirehose)--Connections,Peer,IConnectable-->A1;

Loading

AFTER

graph TD;
  A1(aws-ec2)--IDeliveryStreamRef-->C1;
  B1(aws-kinesisfirehose)--Connections,Peer,IConnecttable-->A1;
  B1(aws-kinesisfirehose)--IDeliveryStreamRef-->C1;
  C1(interfaces);

Loading

Describe any new or updated permissions being added

N/A - Users must specify IAM roles for cross account delivery.

Description of how you validated changes

Unit tests and integ test.

Checklist

• My code adheres to the CONTRIBUTING GUIDE and DESIGN GUIDELINES

---

By submitting this pull request, I confirm that my contribution is made under the terms of the Apache-2.0 license