feat(mixins-preview): cross account delivery destinations

[ShadowCat567]

Reason for this change

Separating out log delivery destinations from log delivery. This is mostly to enable cross account delivery with Vended Logs.

Description of changes

Moved code to set up delivery destinations into their own file with their own classes. log-delivery file now uses the destination classes from log-destinations.
Because of some naming changes the occurred while moving the delivery destinations out from the log delivery classes, all of the vended logs mixin integ tests were regenerated.

Describe any new or updated permissions being added

Adds permissions to enable cross account delivery for S3 and Firehose destinations when they are involved in cross account log delivery.
Only S3 Buckets and Firehose Delivery Streams can be involved in cross account delivery, Cloudwatch Log Groups and XRays cannot participate in cross account log delivery through Vended Logs.
See for permissions added: https://docs.aws.amazon.com/AmazonCloudWatch/latest/logs/vended-logs-crossaccount-example.html

Description of how you validated changes

Added new unit tests, updated existing integration tests, and added new integration tests.

Checklist

• My code adheres to the CONTRIBUTING GUIDE and DESIGN GUIDELINES

---

By submitting this pull request, I confirm that my contribution is made under the terms of the Apache-2.0 license

[github-actions]

⚠️ Experimental Feature: This security report is currently in experimental phase. Results may include false positives and the rules are being actively refined.
Please try merge from main to avoid findings unrelated to the PR.

---

	Tests	Passed ✅	Skipped	Failed
Security Guardian Results	192 ran	192 passed

Test	Result
No test annotations available

• View Security Guardian Results

[github-actions]

⚠️ Experimental Feature: This security report is currently in experimental phase. Results may include false positives and the rules are being actively refined.
Please try merge from main to avoid findings unrelated to the PR.

---

	Tests	Passed ✅	Skipped	Failed
Security Guardian Results with resolved templates	192 ran	192 passed

Test	Result
No test annotations available

• View Security Guardian Results with resolved templates

[aws-cdk-automation]

(This review is outdated)

✅ Updated pull request passes all PRLinter validations. Dismissing previous PRLinter review.

[mergify]

Thank you for contributing! Your pull request will be updated from main and then merged automatically (do not update manually, and be sure to allow changes to be pushed to your fork).

[mergify]

Merge Queue Status

Rule: default-squash

---

• ✅ Entered queue — 2026-02-26 11:17 UTC
• ✅ Checks passed · in-place
• ✅ Merged — 2026-02-26 11:18 UTC · at 40940dfc41299997c72ec061cf6549648d4e0f4b

This pull request spent 6 seconds in the queue, with no time running CI.

Required conditions to merge

• #approved-reviews-by >= 1 [🛡 GitHub branch protection]
  • feat(mixins-preview): cross account delivery destinations #36827
• #changes-requested-reviews-by = 0 [🛡 GitHub branch protection]
  • feat(mixins-preview): cross account delivery destinations #36827
• any of [🛡 GitHub branch protection]:
  • check-success = validate-pr
  • check-neutral = validate-pr
  • check-skipped = validate-pr
• any of [🛡 GitHub branch protection]:
  • check-success = build
  • check-neutral = build
  • check-skipped = build

[github-actions]

Comments on closed issues and PRs are hard for our team to see.
If you need help, please open a new issue that references this one.