Repository: turbot/steampipe-plugin-aws (language: go)

Issue:
Add tables for CloudWatch Logs Vended Log Delivery (CloudFront V2 Logging Support)
 **Is your feature request related to a problem? Please describe.**

Currently, the `aws_cloudfront_distribution` table includes a `logging` column, but it only reflects basic logging configuration and does **not support CloudFront Standard V2 or Vended Logs**.

With the rollout of CloudWatch Logs **vended log delivery**, CloudFront now supports **advanced logging options** (near real-time delivery, structured JSON format, flexible destinations like CloudWatch Logs, S3, or Firehose). These configurations are **not surfaced in the current plugin**, making it difficult to audit or manage CloudFront logging comprehensively via Steampipe.


**Describe the solution you'd like**

We should support **CloudFront V2 logging configuration** by introducing **dedicated tables** based on the AWS CloudWatch Logs delivery APIs. These new tables could include:

- `aws_cloudwatch_log_delivery_source`  
- `aws_cloudwatch_log_delivery`  
- `aws_cloudwatch_log_destination`

These tables would allow querying logging configurations across CloudFront and other AWS services that use CloudWatch's vended log delivery.

Each API supports pagination and represents distinct resource types, so they should be modeled as separate tables.

---

 **Describe alternatives you've considered**

- Extending the existing `aws_cloudfront_distribution` table with a `v2_logging` column, though this wouldn't scale well since CloudWatch Vended Logs are shared across services (e.g., Lambda, RDS).
- Manually querying AWS using the SDK or CLI (`logs:GetDelivery`, etc.), but this is inconsistent and not queryable in a unified way via SQL.

---

 **Additional context**

📘 **Relevant APIs and Docs:**

- [logs:GetDelivery](https://docs.aws.amazon.com/AmazonCloudWatchLogs/latest/APIReference/API_GetDelivery.html)
- [logs:GetDeliverySource](https://docs.aws.amazon.com/AmazonCloudWatchLogs/latest/APIReference/API_GetDeliverySource.html)  
- [logs:GetDeliveryDestination](https://docs.aws.amazon.com/AmazonCloudWatchLogs/latest/APIReference/API_GetDeliveryDestination.html)  
- [logs:GetDeliveryDestinationPolicy](https://docs.aws.amazon.com/AmazonCloudWatchLogs/latest/APIReference/API_GetDeliveryDestinationPolicy.html)
- [logs:ListDeliveries](https://docs.aws.amazon.com/AmazonCloudWatchLogs/latest/APIReference/API_ListDeliveries.html)  
- [logs:ListDeliverySources](https://docs.aws.amazon.com/AmazonCloudWatchLogs/latest/APIReference/API_ListDeliverySources.html)- [logs:ListDeliveryDestinations](https://docs.aws.amazon.com/AmazonCloudWatchLogs/latest/APIReference/API_ListDeliveryDestinations.html)  

📄 CloudWatch Logs Vended Logs Overview:  
https://docs.aws.amazon.com/AmazonCloudWatch/latest/logs/AWS-logs-and-resource-policy.html

📄 CloudFront V2 Logging Docs:  
https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/standard-logging.html



Discussion / hints:

Fix patch:
diff --git a/aws/plugin.go b/aws/plugin.go
index c8d556d45..53540d31e 100644
--- a/aws/plugin.go
+++ b/aws/plugin.go
@@ -138,6 +138,10 @@ func Plugin(ctx context.Context) *plugin.Plugin {
 			"aws_cloudtrail_trail":                                         tableAwsCloudtrailTrail(ctx),
 			"aws_cloudtrail_trail_event":                                   tableAwsCloudtrailTrailEvent(ctx),
 			"aws_cloudwatch_alarm":                                         tableAwsCloudWatchAlarm(ctx),
+			"aws_cloudwatch_log_delivery_destination":                      tableAwsCloudWatchLogDeliveryDestination(ctx),
+			"aws_cloudwatch_log_delivery_source":                           tableAwsCloudWatchLogDeliverySource(ctx),
+			"aws_cloudwatch_log_delivery":                                  tableAwsCloudWatchLogDelivery(ctx),
+			"aws_cloudwatch_log_destination":                               tableAwsCloudWatchLogDestination(ctx),
 			"aws_cloudwatch_log_event":                                     tableAwsCloudwatchLogEvent(ctx),
 			"aws_cloudwatch_log_group":                                     tableAwsCloudwatchLogGroup(ctx),
 			"aws_cloudwatch_log_metric_filter":                             tableAwsCloudwatchLogMetricFilter(ctx),
diff --git a/aws/table_aws_cloudwatch_log_delivery.go b/aws/table_aws_cloudwatch_log_delivery.go
new file mode 100644
index 000000000..cfb00501d
--- /dev/null
+++ b/aws/table_aws_cloudwatch_log_delivery.go
@@ -0,0 +1,153 @@
+package aws
+
+import (
+	"context"
+
+	"github.com/aws/aws-sdk-go-v2/service/cloudwatchlogs"
+	"github.com/turbot/steampipe-plugin-sdk/v5/grpc/proto"
+	"github.com/turbot/steampipe-plugin-sdk/v5/plugin"
+	"github.com/turbot/steampipe-plugin-sdk/v5/plugin/transform"
+)
+
+func tableAwsCloudWatchLogDelivery(_ context.Context) *plugin.Table {
+	return &plugin.Table{
+		Name:        "aws_cloudwatch_log_delivery",
+		Description: "AWS CloudWatch Log Delivery represents a delivery configuration for vended logs.",
+		Get: &plugin.GetConfig{
+			KeyColumns: plugin.SingleColumn("id"),
+			Hydrate:    getCloudWatchLogDelivery,
+			Tags:       map[string]string{"service": "logs", "action": "GetDelivery"},
+		},
+		List: &plugin.ListConfig{
+			Hydrate: listCloudWatchLogDeliveries,
+			Tags:    map[string]string{"service": "logs", "action": "ListDeliveries"},
+		},
+		GetMatrixItemFunc: CloudWatchRegionsMatrix,
+		Columns: []*plugin.Column{
+			{
+				Name:        "id",
+				Description: "The unique ID that identifies this delivery in your account.",
+				Type:        proto.ColumnType_STRING,
+			},
+			{
+				Name:        "arn",
+				Description: "The Amazon Resource Name (ARN) that uniquely identifies this delivery.",
+				Type:        proto.ColumnType_STRING,
+			},
+			{
+				Name:        "delivery_source_name",
+				Description: "The name of the delivery source that is associated with this delivery.",
+				Type:        proto.ColumnType_STRING,
+			},
+			{
+				Name:        "delivery_destination_arn",
+				Description: "The ARN of the delivery destination that is associated with this delivery.",
+				Type:        proto.ColumnType_STRING,
+			},
+			{
+				Name:        "delivery_destination_type",
+				Description: "Displays whether the delivery destination associated with this delivery is CloudWatch Logs, Amazon S3, or Firehose.",
+				Type:        proto.ColumnType_STRING,
+			},
+
+			// Standard columns
+			{
+				Name:        "title",
+				Description: resourceInterfaceDescription("title"),
+				Type:        proto.ColumnType_STRING,
+				Transform:   transform.FromField("Id"),
+			},
+			{
+				Name:        "tags",
+				Description: resourceInterfaceDescription("tags"),
+				Type:        proto.ColumnType_JSON,
+			},
+			{
+				Name:        "akas",
+				Description: resourceInterfaceDescription("akas"),
+				Type:        proto.ColumnType_JSON,
+				Transform:   transform.FromField("Arn").Transform(transform.EnsureStringArray),
+			},
+		},
+	}
+}
+
+//// LIST FUNCTION
+
+func listCloudWatchLogDeliveries(ctx context.Context, d *plugin.QueryData, _ *plugin.HydrateData) (interface{}, error) {
+	// Create session
+	svc, err := CloudWatchLogsClient(ctx, d)
+	if err != nil {
+		plugin.Logger(ctx).Error("aws_cloudwatch_log_delivery.listCloudWatchLogDeliveries", "connection_error", err)
+		return nil, err
+	}
+
+	// Limiting the results
+	maxLimit := int32(50)
+	if d.QueryContext.Limit != nil {
+		limit := int32(*d.QueryContext.Limit)
+		if limit < maxLimit {
+			maxLimit = limit
+		}
+	}
+
+	input := &cloudwatchlogs.DescribeDeliveriesInput{
+		Limit: &maxLimit,
+	}
+
+	paginator := cloudwatchlogs.NewDescribeDeliveriesPaginator(svc, input, func(o *cloudwatchlogs.DescribeDeliveriesPaginatorOptions) {
+		o.Limit = maxLimit
+		o.StopOnDuplicateToken = true
+	})
+
+	for paginator.HasMorePages() {
+		// apply rate limiting
+		d.WaitForListRateLimit(ctx)
+
+		output, err := paginator.NextPage(ctx)
+		if err != nil {
+			plugin.Logger(ctx).Error("aws_cloudwatch_log_delivery.listCloudWatchLogDeliveries", "api_error", err)
+			return nil, err
+		}
+
+		for _, delivery := range output.Deliveries {
+			d.StreamListItem(ctx, delivery)
+
+			// Context may get cancelled due to manual cancellation or if the limit has been reached
+			if d.RowsRemaining(ctx) == 0 {
+				return nil, nil
+			}
+		}
+	}
+
+	return nil, nil
+}
+
+//// HYDRATE FUNCTIONS
+
+func getCloudWatchLogDelivery(ctx context.Context, d *plugin.QueryData, _ *plugin.HydrateData) (interface{}, error) {
+	deliveryId := d.EqualsQuals["id"].GetStringValue()
+
+	// Create session
+	svc, err := CloudWatchLogsClient(ctx, d)
+	if err != nil {
+		plugin.Logger(ctx).Error("aws_cloudwatch_log_delivery.getCloudWatchLogDelivery", "connection_error", err)
+		return nil, err
+	}
+
+	params := &cloudwatchlogs.GetDeliveryInput{
+		Id: &deliveryId,
+	}
+
+	op, err := svc.GetDelivery(ctx, params)
+	if err != nil {
+		plugin.Logger(ctx).Error("aws_cloudwatch_log_delivery.getCloudWatchLogDelivery", "api_error", err)
+		return nil, err
+	}
+
+	if op.Delivery != nil {
+		return *op.Delivery, nil
+	}
+
+	return nil, nil
+}
diff --git a/aws/table_aws_cloudwatch_log_delivery_destination.go b/aws/table_aws_cloudwatch_log_delivery_destination.go
new file mode 100644
index 000000000..e7c909a74
--- /dev/null
+++ b/aws/table_aws_cloudwatch_log_delivery_destination.go
@@ -0,0 +1,189 @@
+package aws
+
+import (
+	"context"
+
+	"github.com/aws/aws-sdk-go-v2/service/cloudwatchlogs"
+	"github.com/aws/aws-sdk-go-v2/service/cloudwatchlogs/types"
+	"github.com/turbot/steampipe-plugin-sdk/v5/grpc/proto"
+	"github.com/turbot/steampipe-plugin-sdk/v5/plugin"
+	"github.com/turbot/steampipe-plugin-sdk/v5/plugin/transform"
+)
+
+func tableAwsCloudWatchLogDeliveryDestination(_ context.Context) *plugin.Table {
+	return &plugin.Table{
+		Name:        "aws_cloudwatch_log_delivery_destination",
+		Description: "AWS CloudWatch Log Delivery Destination represents a destination configuration for vended log delivery.",
+		Get: &plugin.GetConfig{
+			KeyColumns: plugin.SingleColumn("name"),
+			Hydrate:    getCloudWatchLogDeliveryDestination,
+			Tags:       map[string]string{"service": "logs", "action": "GetDeliveryDestination"},
+		},
+		List: &plugin.ListConfig{
+			Hydrate: listCloudWatchLogDeliveryDestinations,
+			Tags:    map[string]string{"service": "logs", "action": "ListDeliveryDestinations"},
+		},
+		GetMatrixItemFunc: CloudWatchRegionsMatrix,
+		Columns: []*plugin.Column{
+			{
+				Name:        "name",
+				Description: "The name of the delivery destination.",
+				Type:        proto.ColumnType_STRING,
+			},
+			{
+				Name:        "arn",
+				Description: "The Amazon Resource Name (ARN) that uniquely identifies this delivery destination.",
+				Type:        proto.ColumnType_STRING,
+			},
+			{
+				Name:        "destination_resource_arn",
+				Description: "The ARN of the Amazon Web Services destination that this delivery destination represents.",
+				Type:        proto.ColumnType_STRING,
+				Transform:   transform.FromField("DeliveryDestinationConfiguration.DestinationResourceArn"),
+			},
+			{
+				Name:        "delivery_destination_type",
+				Description: "Displays whether this delivery destination is CloudWatch Logs, Amazon S3, or Firehose.",
+				Type:        proto.ColumnType_STRING,
+			},
+			{
+				Name:        "output_format",
+				Description: "The format of the logs that are sent to this delivery destination.",
+				Type:        proto.ColumnType_STRING,
+			},
+			{
+				Name:        "policy",
+				Description: "The policy of the delivery destination.",
+				Type:        proto.ColumnType_JSON,
+				Hydrate:     getCloudWatchLogDeliveryDestinationPolicy,
+				Transform:   transform.FromValue(),
+			},
+
+			// Standard columns
+			{
+				Name:        "title",
+				Description: resourceInterfaceDescription("title"),
+				Type:        proto.ColumnType_STRING,
+				Transform:   transform.FromField("Name"),
+			},
+			{
+				Name:        "tags",
+				Description: resourceInterfaceDescription("tags"),
+				Type:        proto.ColumnType_JSON,
+			},
+			{
+				Name:        "akas",
+				Description: resourceInterfaceDescription("akas"),
+				Type:        proto.ColumnType_JSON,
+				Transform:   transform.FromField("Arn").Transform(transform.EnsureStringArray),
+			},
+		},
+	}
+}
+
+//// LIST FUNCTION
+
+func listCloudWatchLogDeliveryDestinations(ctx context.Context, d *plugin.QueryData, _ *plugin.HydrateData) (interface{}, error) {
+	// Create session
+	svc, err := CloudWatchLogsClient(ctx, d)
+	if err != nil {
+		plugin.Logger(ctx).Error("aws_cloudwatch_log_delivery_destination.listCloudWatchLogDeliveryDestinations", "connection_error", err)
+		return nil, err
+	}
+
+	// Limiting the results
+	maxLimit := int32(50)
+	if d.QueryContext.Limit != nil {
+		limit := int32(*d.QueryContext.Limit)
+		if limit < maxLimit {
+			maxLimit = limit
+		}
+	}
+
+	input := &cloudwatchlogs.DescribeDeliveryDestinationsInput{
+		Limit: &maxLimit,
+	}
+
+	paginator := cloudwatchlogs.NewDescribeDeliveryDestinationsPaginator(svc, input, func(o *cloudwatchlogs.DescribeDeliveryDestinationsPaginatorOptions) {
+		o.Limit = maxLimit
+		o.StopOnDuplicateToken = true
+	})
+
+	for paginator.HasMorePages() {
+		// apply rate limiting
+		d.WaitForListRateLimit(ctx)
+
+		output, err := paginator.NextPage(ctx)
+		if err != nil {
+			plugin.Logger(ctx).Error("aws_cloudwatch_log_delivery_destination.listCloudWatchLogDeliveryDestinations", "api_error", err)
+			return nil, err
+		}
+
+		for _, destination := range output.DeliveryDestinations {
+			d.StreamListItem(ctx, destination)
+
+			// Context may get cancelled due to manual cancellation or if the limit has been reached
+			if d.RowsRemaining(ctx) == 0 {
+				return nil, nil
+			}
+		}
+	}
+
+	return nil, nil
+}
+
+//// HYDRATE FUNCTIONS
+
+func getCloudWatchLogDeliveryDestination(ctx context.Context, d *plugin.QueryData, _ *plugin.HydrateData) (interface{}, error) {
+	destinationName := d.EqualsQuals["name"].GetStringValue()
+
+	// Create session
+	svc, err := CloudWatchLogsClient(ctx, d)
+	if err != nil {
+		plugin.Logger(ctx).Error("aws_cloudwatch_log_delivery_destination.getCloudWatchLogDeliveryDestination", "connection_error", err)
+		return nil, err
+	}
+
+	params := &cloudwatchlogs.GetDeliveryDestinationInput{
+		Name: &destinationName,
+	}
+
+	op, err := svc.GetDeliveryDestination(ctx, params)
+	if err != nil {
+		plugin.Logger(ctx).Error("aws_cloudwatch_log_delivery_destination.getCloudWatchLogDeliveryDestination", "api_error", err)
+		return nil, err
+	}
+
+	if op.DeliveryDestination != nil {
+		return *op.DeliveryDestination, nil
+	}
+
+	return nil, nil
+}
+
+func getCloudWatchLogDeliveryDestinationPolicy(ctx context.Context, d *plugin.QueryData, h *plugin.HydrateData) (interface{}, error) {
+	item := h.Item.(types.DeliveryDestination)
+
+	// Create session
+	svc, err := CloudWatchLogsClient(ctx, d)
+	if err != nil {
+		plugin.Logger(ctx).Error("aws_cloudwatch_log_delivery_destination.getCloudWatchLogDeliveryDestination", "connection_error", err)
+		return nil, err
+	}
+
+	params := &cloudwatchlogs.GetDeliveryDestinationPolicyInput{
+		DeliveryDestinationName: item.Name,
+	}
+
+	op, err := svc.GetDeliveryDestinationPolicy(ctx, params)
+	if err != nil {
+		plugin.Logger(ctx).Error("aws_cloudwatch_log_delivery_destination.getCloudWatchLogDeliveryDestination", "api_error", err)
+		return nil, err
+	}
+
+	if op.Policy != nil {
+		return op.Policy, nil
+	}
+
+	return nil, nil
+}
diff --git a/aws/table_aws_cloudwatch_log_delivery_source.go b/aws/table_aws_cloudwatch_log_delivery_source.go
new file mode 100644
index 000000000..51a82c219
--- /dev/null
+++ b/aws/table_aws_cloudwatch_log_delivery_source.go
@@ -0,0 +1,153 @@
+package aws
+
+import (
+	"context"
+
+	"github.com/aws/aws-sdk-go-v2/service/cloudwatchlogs"
+	"github.com/turbot/steampipe-plugin-sdk/v5/grpc/proto"
+	"github.com/turbot/steampipe-plugin-sdk/v5/plugin"
+	"github.com/turbot/steampipe-plugin-sdk/v5/plugin/transform"
+)
+
+func tableAwsCloudWatchLogDeliverySource(_ context.Context) *plugin.Table {
+	return &plugin.Table{
+		Name:        "aws_cloudwatch_log_delivery_source",
+		Description: "AWS CloudWatch Log Delivery Source represents a source configuration for vended log delivery.",
+		Get: &plugin.GetConfig{
+			KeyColumns: plugin.SingleColumn("name"),
+			Hydrate:    getCloudWatchLogDeliverySource,
+			Tags:       map[string]string{"service": "logs", "action": "GetDeliverySource"},
+		},
+		List: &plugin.ListConfig{
+			Hydrate: listCloudWatchLogDeliverySources,
+			Tags:    map[string]string{"service": "logs", "action": "ListDeliverySources"},
+		},
+		GetMatrixItemFunc: CloudWatchRegionsMatrix,
+		Columns: []*plugin.Column{
+			{
+				Name:        "name",
+				Description: "The name of the delivery source.",
+				Type:        proto.ColumnType_STRING,
+			},
+			{
+				Name:        "arn",
+				Description: "The Amazon Resource Name (ARN) that uniquely identifies this delivery source.",
+				Type:        proto.ColumnType_STRING,
+			},
+			{
+				Name:        "service",
+				Description: "The Amazon Web Services service that is sending logs.",
+				Type:        proto.ColumnType_STRING,
+			},
+			{
+				Name:        "log_type",
+				Description: "The type of log that the source is sending.",
+				Type:        proto.ColumnType_STRING,
+			},
+			{
+				Name:        "resource_arns",
+				Description: "This array contains the ARN of the Amazon Web Services resource that sends logs and is represented by this delivery source",
+				Type:        proto.ColumnType_JSON,
+			},
+
+			// Standard columns
+			{
+				Name:        "title",
+				Description: resourceInterfaceDescription("title"),
+				Type:        proto.ColumnType_STRING,
+				Transform:   transform.FromField("Name"),
+			},
+			{
+				Name:        "tags",
+				Description: resourceInterfaceDescription("tags"),
+				Type:        proto.ColumnType_JSON,
+			},
+			{
+				Name:        "akas",
+				Description: resourceInterfaceDescription("akas"),
+				Type:        proto.ColumnType_JSON,
+				Transform:   transform.FromField("Arn").Transform(transform.EnsureStringArray),
+			},
+		},
+	}
+}
+
+//// LIST FUNCTION
+
+func listCloudWatchLogDeliverySources(ctx context.Context, d *plugin.QueryData, _ *plugin.HydrateData) (interface{}, error) {
+	// Create session
+	svc, err := CloudWatchLogsClient(ctx, d)
+	if err != nil {
+		plugin.Logger(ctx).Error("aws_cloudwatch_log_delivery_source.listCloudWatchLogDeliverySources", "connection_error", err)
+		return nil, err
+	}
+
+	// Limiting the results
+	maxLimit := int32(50)
+	if d.QueryContext.Limit != nil {
+		limit := int32(*d.QueryContext.Limit)
+		if limit < maxLimit {
+			maxLimit = limit
+		}
+	}
+
+	input := &cloudwatchlogs.DescribeDeliverySourcesInput{
+		Limit: &maxLimit,
+	}
+
+	paginator := cloudwatchlogs.NewDescribeDeliverySourcesPaginator(svc, input, func(o *cloudwatchlogs.DescribeDeliverySourcesPaginatorOptions) {
+		o.Limit = maxLimit
+		o.StopOnDuplicateToken = true
+	})
+
+	for paginator.HasMorePages() {
+		// apply rate limiting
+		d.WaitForListRateLimit(ctx)
+
+		output, err := paginator.NextPage(ctx)
+		if err != nil {
+			plugin.Logger(ctx).Error("aws_cloudwatch_log_delivery_source.listCloudWatchLogDeliverySources", "api_error", err)
+			return nil, err
+		}
+
+		for _, source := range output.DeliverySources {
+			d.StreamListItem(ctx, source)
+
+			// Context may get cancelled due to manual cancellation or if the limit has been reached
+			if d.RowsRemaining(ctx) == 0 {
+				return nil, nil
+			}
+		}
+	}
+
+	return nil, nil
+}
+
+//// HYDRATE FUNCTIONS
+
+func getCloudWatchLogDeliverySource(ctx context.Context, d *plugin.QueryData, _ *plugin.HydrateData) (interface{}, error) {
+	sourceName := d.EqualsQuals["name"].GetStringValue()
+
+	// Create session
+	svc, err := CloudWatchLogsClient(ctx, d)
+	if err != nil {
+		plugin.Logger(ctx).Error("aws_cloudwatch_log_delivery_source.getCloudWatchLogDeliverySource", "connection_error", err)
+		return nil, err
+	}
+
+	params := &cloudwatchlogs.GetDeliverySourceInput{
+		Name: &sourceName,
+	}
+
+	op, err := svc.GetDeliverySource(ctx, params)
+	if err != nil {
+		plugin.Logger(ctx).Error("aws_cloudwatch_log_delivery_source.getCloudWatchLogDeliverySource", "api_error", err)
+		return nil, err
+	}
+
+	if op.DeliverySource != nil {
+		return *op.DeliverySource, nil
+	}
+
+	return nil, nil
+}
diff --git a/aws/table_aws_cloudwatch_log_destination.go b/aws/table_aws_cloudwatch_log_destination.go
new file mode 100644
index 000000000..230f281b0
--- /dev/null
+++ b/aws/table_aws_cloudwatch_log_destination.go
@@ -0,0 +1,115 @@
+package aws
+
+import (
+	"context"
+
+	"github.com/aws/aws-sdk-go-v2/service/cloudwatchlogs"
+	"github.com/turbot/steampipe-plugin-sdk/v5/grpc/proto"
+	"github.com/turbot/steampipe-plugin-sdk/v5/plugin"
+	"github.com/turbot/steampipe-plugin-sdk/v5/plugin/transform"
+)
+
+func tableAwsCloudWatchLogDestination(_ context.Context) *plugin.Table {
+	return &plugin.Table{
+		Name:        "aws_cloudwatch_log_destination",
+		Description: "AWS CloudWatch Log Destination represents a destination configuration for vended log delivery.",
+		List: &plugin.ListConfig{
+			Hydrate: listCloudWatchLogDestinations,
+			Tags:    map[string]string{"service": "logs", "action": "ListDestinations"},
+		},
+		GetMatrixItemFunc: CloudWatchRegionsMatrix,
+		Columns: []*plugin.Column{
+			{
+				Name:        "destination_name",
+				Description: "The name of the destination.",
+				Type:        proto.ColumnType_STRING,
+			},
+			{
+				Name:        "arn",
+				Description: "The Amazon Resource Name (ARN) of this destination.",
+				Type:        proto.ColumnType_STRING,
+			},
+			{
+				Name:        "creation_time",
+				Description: "The creation time of the destination.",
+				Type:        proto.ColumnType_TIMESTAMP,
+				Transform:   transform.FromField("CreationTime").Transform(transform.UnixMsToTimestamp),
+			},
+			{
+				Name:        "role_arn",
+				Description: "A role for impersonation, used when delivering log events to the target.",
+				Type:        proto.ColumnType_STRING,
+			},
+			{
+				Name:        "target_arn",
+				Description: "The Amazon Resource Name (ARN) of the physical target where the log events are delivered (for example, a Kinesis stream).",
+				Type:        proto.ColumnType_STRING,
+			},
+
+			// Standard columns
+			{
+				Name:        "title",
+				Description: resourceInterfaceDescription("title"),
+				Type:        proto.ColumnType_STRING,
+				Transform:   transform.FromField("DestinationName"),
+			},
+			{
+				Name:        "akas",
+				Description: resourceInterfaceDescription("akas"),
+				Type:        proto.ColumnType_JSON,
+				Transform:   transform.FromField("Arn").Transform(transform.EnsureStringArray),
+			},
+		},
+	}
+}
+
+//// LIST FUNCTION
+
+func listCloudWatchLogDestinations(ctx context.Context, d *plugin.QueryData, _ *plugin.HydrateData) (interface{}, error) {
+	// Create session
+	svc, err := CloudWatchLogsClient(ctx, d)
+	if err != nil {
+		plugin.Logger(ctx).Error("aws_cloudwatch_log_destination.listCloudWatchLogDestinations", "connection_error", err)
+		return nil, err
+	}
+
+	// Limiting the results
+	maxLimit := int32(50)
+	if d.QueryContext.Limit != nil {
+		limit := int32(*d.QueryContext.Limit)
+		if limit < maxLimit {
+			maxLimit = limit
+		}
+	}
+
+	input := &cloudwatchlogs.DescribeDestinationsInput{
+		Limit: &maxLimit,
+	}
+
+	paginator := cloudwatchlogs.NewDescribeDestinationsPaginator(svc, input, func(o *cloudwatchlogs.DescribeDestinationsPaginatorOptions) {
+		o.Limit = maxLimit
+		o.StopOnDuplicateToken = true
+	})
+
+	for paginator.HasMorePages() {
+		// apply rate limiting
+		d.WaitForListRateLimit(ctx)
+
+		output, err := paginator.NextPage(ctx)
+		if err != nil {
+			plugin.Logger(ctx).Error("aws_cloudwatch_log_destination.listCloudWatchLogDestinations", "api_error", err)
+			return nil, err
+		}
+
+		for _, destination := range output.Destinations {
+			d.StreamListItem(ctx, destination)
+
+			// Context may get cancelled due to manual cancellation or if the limit has been reached
+			if d.RowsRemaining(ctx) == 0 {
+				return nil, nil
+			}
+		}
+	}
+
+	return nil, nil
+}
diff --git a/docs/tables/aws_cloudwatch_log_delivery.md b/docs/tables/aws_cloudwatch_log_delivery.md
new file mode 100644
index 000000000..480e31e5d
--- /dev/null
+++ b/docs/tables/aws_cloudwatch_log_delivery.md
@@ -0,0 +1,202 @@
+---
+title: "Steampipe Table: aws_cloudwatch_log_delivery - Query AWS CloudWatch Log Deliveries using SQL"
+description: "Allows users to query AWS CloudWatch Log Deliveries, providing information about delivery configurations for vended log delivery."
+---
+
+# Table: aws_cloudwatch_log_delivery - Query AWS CloudWatch Log Deliveries using SQL
+
+AWS CloudWatch Log Delivery represents a delivery configuration for vended log delivery, connecting a delivery source to a destination. These deliveries define how logs from AWS services like CloudFront are delivered to destinations such as S3 buckets, CloudWatch Logs, or Firehose delivery streams, enabling near real-time log analysis and storage.
+
+## Table Usage Guide
+
+The `aws_cloudwatch_log_delivery` table in Steampipe provides you with information about delivery configurations for vended log delivery in AWS CloudWatch Logs. This table allows you, as a DevOps engineer, security analyst, or cloud administrator, to query delivery-specific details, including the associated source, destination, and status. You can utilize this table to gather insights on log delivery configurations, such as identifying where specific services are sending their logs, determining which destinations are receiving logs, and monitoring the status of your log delivery pipelines. The schema outlines the various attributes of the delivery configuration for you, including the delivery ID, source name, destination ARN, creation time, and associated tags.
+
+## Examples
+
+### Basic info
+Gain insights into your log delivery configurations to understand how logs are routed within your AWS environment.
+
+```sql+postgres
+select
+  id,
+  arn,
+  delivery_source_name,
+  delivery_destination_arn,
+  delivery_destination_type
+from
+  aws_cloudwatch_log_delivery;
+```
+
+```sql+sqlite
+select
+  id,
+  arn,
+  delivery_source_name,
+  delivery_destination_arn,
+  delivery_destination_type
+from
+  aws_cloudwatch_log_delivery;
+```
+
+### Count deliveries by destination type
+Analyze the distribution of deliveries across different destination types to understand your log delivery targets.
+
+```sql+postgres
+select
+  delivery_destination_type,
+  count(*) as delivery_count
+from
+  aws_cloudwatch_log_delivery
+group by
+  delivery_destination_type;
+```
+
+```sql+sqlite
+select
+  delivery_destination_type,
+  count(*) as delivery_count
+from
+  aws_cloudwatch_log_delivery
+group by
+  delivery_destination_type;
+```
+
+### Identify CloudFront deliveries to CloudWatch Logs
+Find all CloudFront sources configured to deliver logs to CloudWatch Log groups.
+
+```sql+postgres
+select
+  d.id as delivery_id,
+  s.name as source_name,
+  s.service,
+  d.delivery_destination_type,
+  split_part(d.delivery_destination_arn, ':', 7) as log_group_name
+from
+  aws_cloudwatch_log_delivery d
+join
+  aws_cloudwatch_log_delivery_source s on d.delivery_source_name = s.name
+where
+  s.service = 'cloudfront'
+  and d.delivery_destination_type = 'CloudWatchLogs';
+```
+
+```sql+sqlite
+select
+  d.id as delivery_id,
+  s.name as source_name,
+  s.service,
+  d.delivery_destination_type,
+  substr(
+    d.delivery_destination_arn,
+    instr(d.delivery_destination_arn, 'log-group:') + 10
+  ) as log_group_name
+from
+  aws_cloudwatch_log_delivery d
+join
+  aws_cloudwatch_log_delivery_source s on d.delivery_source_name = s.name
+where
+  s.service = 'cloudfront'
+  and d.delivery_destination_type = 'CloudWatchLogs';
+```
+
+### Get S3 bucket details for vended log deliveries
+List the S3 buckets used as delivery destinations for CloudWatch logs.
+
+```sql+postgres
+select
+  d.id as delivery_id,
+  s.name as source_name,
+  s.service,
+  b.name as bucket_name,
+  b.region,
+  b.creation_date
+from
+  aws_cloudwatch_log_delivery d
+join
+  aws_cloudwatch_log_delivery_source s on d.delivery_source_name = s.name
+join
+  aws_s3_bucket b on b.arn = d.delivery_destination_arn
+where
+  d.delivery_destination_type = 'S3';
+```
+
+```sql+sqlite
+select
+  d.id as delivery_id,
+  s.name as source_name,
+  s.service,
+  b.name as bucket_name,
+  b.region,
+  b.creation_date
+from
+  aws_cloudwatch_log_delivery d
+join
+  aws_cloudwatch_log_delivery_source s on d.delivery_source_name = s.name
+join
+  aws_s3_bucket b on b.arn = d.delivery_destination_arn
+where
+  d.delivery_destination_type = 'S3';
+```
+
+### Review full CloudFront logging configuration
+Compare logging targets for CloudFront distributions, including S3, CloudWatch Logs, and Firehose.
+
+```sql+postgres
+select
+  cf.id as distribution_id,
+  cf.domain_name,
+  s.name as source_name,
+  d.id as delivery_id,
+  d.delivery_destination_type,
+  case
+    when d.delivery_destination_type = 'S3' then b.name
+    when d.delivery_destination_type = 'CloudWatchLogs' then split_part(d.delivery_destination_arn, ':', 7)
+    when d.delivery_destination_type = 'Firehose' then split_part(d.delivery_destination_arn, '/', 2)
+    else 'Unknown'
+  end as destination_name
+from
+  aws_cloudfront_distribution cf
+join
+  aws_cloudwatch_log_delivery_source s
+    on s.resource_arns @> to_jsonb(array[cf.arn])
+    and s.service = 'cloudfront'
+join
+  aws_cloudwatch_log_delivery d
+    on s.name = d.delivery_source_name
+left join
+  aws_s3_bucket b
+    on b.arn = d.delivery_destination_arn
+    and d.delivery_destination_type = 'S3';
+```
+
+```sql+sqlite
+select
+  cf.id as distribution_id,
+  cf.domain_name,
+  s.name as source_name,
+  d.id as delivery_id,
+  d.delivery_destination_type,
+  case
+    when d.delivery_destination_type = 'S3' then b.name
+    when d.delivery_destination_type = 'CloudWatchLogs' then split(d.delivery_destination_arn, ':')[7]
+    when d.delivery_destination_type = 'Firehose' then split(d.delivery_destination_arn, '/')[2]
+    else 'Unknown'
+  end as destination_name
+from
+  aws_cloudwatch_log_delivery_source s
+join
+  json_each(s.resource_arns) as ra
+    on ra.value = cf.arn
+join
+  aws_cloudfront_distribution cf
+    on true
+join
+  aws_cloudwatch_log_delivery d
+    on s.name = d.delivery_source_name
+left join
+  aws_s3_bucket b
+    on b.arn = d.delivery_destination_arn
+    and d.delivery_destination_type = 'S3'
+where
+  s.service = 'cloudfront';
+```
\ No newline at end of file
diff --git a/docs/tables/aws_cloudwatch_log_delivery_destination.md b/docs/tables/aws_cloudwatch_log_delivery_destination.md
new file mode 100644
index 000000000..0ddffb11c
--- /dev/null
+++ b/docs/tables/aws_cloudwatch_log_delivery_destination.md
@@ -0,0 +1,200 @@
+---
+title: "Steampipe Table: aws_cloudwatch_log_delivery_destination - Query AWS CloudWatch Log Delivery Destinations using SQL"
+description: "Allows users to query AWS CloudWatch Log Delivery Destinations, providing information about destination configurations for vended log delivery."
+---
+
+# Table: aws_cloudwatch_log_delivery_destination - Query AWS CloudWatch Log Delivery Destinations using SQL
+
+AWS CloudWatch Log Delivery Destination represents a destination configuration for vended log delivery. These destinations define where logs can be sent, such as S3 buckets, CloudWatch Logs, or Firehose delivery streams. Delivery destinations are part of CloudWatch Logs Vended Log Delivery, which enables near real-time log delivery from AWS services like CloudFront.
+
+## Table Usage Guide
+
+The `aws_cloudwatch_log_delivery_destination` table in Steampipe provides you with information about destination configurations for vended log delivery in AWS CloudWatch Logs. This table allows you, as a DevOps engineer, security analyst, or cloud administrator, to query destination-specific details, including the destination type, ARN, output format, and associated policy. You can utilize this table to gather insights on log delivery destinations, such as identifying all S3 buckets configured as log destinations, understanding output formats in use, and managing delivery policies. The schema outlines the various attributes of the delivery destination for you, including the name, ARN, destination resource ARN, delivery destination type, output format, and associated tags.
+
+## Examples
+
+### Basic info
+Explore the configuration details of CloudWatch Log delivery destinations in your AWS account to understand where logs can be sent.
+
+```sql+postgres
+select
+  name,
+  arn,
+  destination_resource_arn,
+  delivery_destination_type,
+  output_format
+from
+  aws_cloudwatch_log_delivery_destination;
+```
+
+```sql+sqlite
+select
+  name,
+  arn,
+  destination_resource_arn,
+  delivery_destination_type,
+  output_format
+from
+  aws_cloudwatch_log_delivery_destination;
+```
+
+### Count destinations by type
+Count the number of log delivery destinations grouped by their destination type to get a quick summary of log delivery architecture.
+
+```sql+postgres
+select
+  delivery_destination_type,
+  count(*) as destination_count
+from
+  aws_cloudwatch_log_delivery_destination
+group by
+  delivery_destination_type
+order by
+  destination_count desc;
+```
+
+```sql+sqlite
+select
+  delivery_destination_type,
+  count(*) as destination_count
+from
+  aws_cloudwatch_log_delivery_destination
+group by
+  delivery_destination_type
+order by
+  destination_count desc;
+```
+
+### Get S3 buckets used as log destinations
+Retrieve a list of S3 buckets used as destinations for vended log delivery to validate where your logs are being stored.
+
+```sql+postgres
+select
+  d.name as destination_name,
+  d.arn as destination_arn,
+  d.destination_resource_arn,
+  b.name as bucket_name,
+  b.region,
+  d.output_format
+from
+  aws_cloudwatch_log_delivery_destination d
+join
+  aws_s3_bucket b on d.destination_resource_arn like concat('arn:aws:s3:::', b.name, '%')
+where
+  d.delivery_destination_type = 'S3';
+```
+
+```sql+sqlite
+select
+  d.name as destination_name,
+  d.arn as destination_arn,
+  d.destination_resource_arn,
+  b.name as bucket_name,
+  b.region,
+  d.output_format
+from
+  aws_cloudwatch_log_delivery_destination d
+join
+  aws_s3_bucket b on d.destination_resource_arn like 'arn:aws:s3:::' || b.name || '%'
+where
+  d.delivery_destination_type = 'S3';
+```
+
+### Count destinations by output format
+Analyze how many destinations use each output format to understand log formatting standards across destinations.
+
+```sql+postgres
+select
+  output_format,
+  delivery_destination_type,
+  count(*) as destination_count
+from
+  aws_cloudwatch_log_delivery_destination
+group by
+  output_format,
+  delivery_destination_type
+order by
+  output_format,
+  destination_count desc;
+```
+
+```sql+sqlite
+select
+  output_format,
+  delivery_destination_type,
+  count(*) as destination_count
+from
+  aws_cloudwatch_log_delivery_destination
+group by
+  output_format,
+  delivery_destination_type
+order by
+  output_format,
+  destination_count desc;
+```
+
+### View destinations with defined policies
+Identify destinations that have explicit policies defined to assess access control configurations.
+
+```sql+postgres
+select
+  name,
+  delivery_destination_type,
+  policy
+from
+  aws_cloudwatch_log_delivery_destination
+where
+  policy is not null;
+```
+
+```sql+sqlite
+select
+  name,
+  delivery_destination_type,
+  policy
+from
+  aws_cloudwatch_log_delivery_destination
+where
+  policy is not null;
+```
+
+### Identify which sources are using each destination
+Identify the source destination mappings.
+
+```sql+postgres
+select
+  dest.name as destination_name,
+  dest.delivery_destination_type,
+  dest.output_format,
+  s.name as source_name,
+  s.service,
+  s.log_type,
+  d.id as delivery_id
+from
+  aws_cloudwatch_log_delivery_destination dest
+join
+  aws_cloudwatch_log_delivery d on dest.arn = d.delivery_destination_arn
+join
+  aws_cloudwatch_log_delivery_source s on d.delivery_source_name = s.name
+order by
+  dest.name, s.service;
+```
+
+```sql+sqlite
+select
+  dest.name as destination_name,
+  dest.delivery_destination_type,
+  dest.output_format,
+  s.name as source_name,
+  s.service,
+  s.log_type,
+  d.id as delivery_id
+from
+  aws_cloudwatch_log_delivery_destination dest
+join
+  aws_cloudwatch_log_delivery d on dest.arn = d.delivery_destination_arn
+join
+  aws_cloudwatch_log_delivery_source s on d.delivery_source_name = s.name
+order by
+  dest.name, s.service;
+```
\ No newline at end of file
diff --git a/docs/tables/aws_cloudwatch_log_delivery_source.md b/docs/tables/aws_cloudwatch_log_delivery_source.md
new file mode 100644
index 000000000..a9f5fe163
--- /dev/null
+++ b/docs/tables/aws_cloudwatch_log_delivery_source.md
@@ -0,0 +1,233 @@
+---
+title: "Steampipe Table: aws_cloudwatch_log_delivery_source - Query AWS CloudWatch Log Delivery Sources using SQL"
+description: "Allows users to query AWS CloudWatch Log Delivery Sources, providing information about source configurations for vended log delivery."
+---
+
+# Table: aws_cloudwatch_log_delivery_source - Query AWS CloudWatch Log Delivery Sources using SQL
+
+AWS CloudWatch Log Delivery Source represents a source configuration for vended log delivery. These sources define AWS services that can send logs to destinations like S3 buckets, CloudWatch Logs, or Firehose delivery streams. Delivery sources are part of CloudWatch Logs Vended Log Delivery, which enables services like CloudFront to deliver logs in near real-time.
+
+## Table Usage Guide
+
+The `aws_cloudwatch_log_delivery_source` table in Steampipe provides you with information about source configurations for vended log delivery in AWS CloudWatch Logs. This table allows you, as a DevOps engineer, security analyst, or cloud administrator, to query source-specific details, including the associated service, log type, and resource ARNs. You can utilize this table to gather insights on log delivery sources, such as identifying all CloudFront distributions configured for vended logs, understanding which services are configured to send logs, and monitoring your overall logging architecture. The schema outlines the various attributes of the delivery source for you, including the source name, ARN, service, creation time, and associated tags.
+
+## Examples
+
+### Basic info
+Explore the configuration details of CloudWatch Log delivery sources in your AWS account to understand what services are sending logs to which destinations.
+
+```sql+postgres
+select
+  name,
+  arn,
+  service,
+  log_type
+from
+  aws_cloudwatch_log_delivery_source;
+```
+
+```sql+sqlite
+select
+  name,
+  arn,
+  service,
+  log_type
+from
+  aws_cloudwatch_log_delivery_source;
+```
+
+### List CloudFront delivery sources
+Identify CloudFront distributions that are configured as log delivery sources.
+
+```sql+postgres
+select
+  name,
+  service,
+  log_type,
+  resource_arns
+from
+  aws_cloudwatch_log_delivery_source
+where
+  service = 'cloudfront';
+```
+
+```sql+sqlite
+select
+  name,
+  service,
+  log_type,
+  resource_arns
+from
+  aws_cloudwatch_log_delivery_source
+where
+  service = 'cloudfront';
+```
+
+### Count sources by service
+Count the number of delivery sources grouped by their originating AWS service.
+
+```sql+postgres
+select
+  service,
+  count(*) as source_count
+from
+  aws_cloudwatch_log_delivery_source
+group by
+  service
+order by
+  source_count desc;
+```
+
+```sql+sqlite
+select
+  service,
+  count(*) as source_count
+from
+  aws_cloudwatch_log_delivery_source
+group by
+  service
+order by
+  source_count desc;
+```
+
+### Get destinations for each delivery source
+Find out where each delivery source is sending its logs by joining with the delivery configuration.
+
+```sql+postgres
+select
+  s.name as source_name,
+  s.service,
+  s.log_type,
+  d.id as delivery_id,
+  d.delivery_destination_type
+from
+  aws_cloudwatch_log_delivery_source s
+left join
+  aws_cloudwatch_log_delivery d
+on
+  s.name = d.delivery_source_name;
+```
+
+```sql+sqlite
+select
+  s.name as source_name,
+  s.service,
+  s.log_type,
+  d.id as delivery_id,
+  d.delivery_destination_type
+from
+  aws_cloudwatch_log_delivery_source s
+left join
+  aws_cloudwatch_log_delivery d
+on
+  s.name = d.delivery_source_name;
+```
+
+### Find CloudFront log sources delivering to S3
+Get CloudFront sources that are sending vended logs to S3 destinations.
+
+```sql+postgres
+select
+  s.name as source_name,
+  cf.id as distribution_id,
+  cf.domain_name,
+  d.id as delivery_id,
+  d.delivery_destination_type,
+  s3.name as s3_bucket_name
+from
+  aws_cloudwatch_log_delivery_source s
+join
+  aws_cloudfront_distribution cf
+    on s.resource_arns @> to_jsonb(array[cf.arn])
+left join
+  aws_cloudwatch_log_delivery d
+    on s.name = d.delivery_source_name
+left join
+  aws_s3_bucket s3
+    on s3.arn = d.delivery_destination_arn
+where
+  s.service = 'cloudfront'
+  and d.delivery_destination_type = 'S3';
+```
+
+```sql+sqlite
+select
+  s.name as source_name,
+  cf.id as distribution_id,
+  cf.domain_name,
+  d.id as delivery_id,
+  d.delivery_destination_type,
+  s3.name as s3_bucket_name
+from
+  aws_cloudwatch_log_delivery_source s
+join
+  aws_cloudfront_distribution cf
+    on cf.arn in (
+      select value
+      from json_each(s.resource_arns)
+    )
+left join
+  aws_cloudwatch_log_delivery d
+    on s.name = d.delivery_source_name
+left join
+  aws_s3_bucket s3
+    on s3.arn = d.delivery_destination_arn
+where
+  s.service = 'cloudfront'
+  and d.delivery_destination_type = 'S3';
+```
+
+### Compare CloudFront standard vs vended logging
+Compare CloudFront distributions with standard logging and those with vended log delivery to evaluate logging configurations.
+
+```sql+postgres
+select
+  cf.id as distribution_id,
+  cf.domain_name,
+  case
+    when cf.logging->>'Enabled' = 'true' then 'Standard'
+    else 'Not configured'
+  end as standard_logging_status,
+  case
+    when s.name is not null then 'Configured'
+    else 'Not configured'
+  end as vended_logging_status,
+  s.name as source_name,
+  d.delivery_destination_type
+from
+  aws_cloudfront_distribution cf
+left join
+  aws_cloudwatch_log_delivery_source s
+    on s.resource_arns @> to_jsonb(array[cf.arn])
+    and s.service = 'cloudfront'
+left join
+  aws_cloudwatch_log_delivery d
+    on s.name = d.delivery_source_name;
+```
+
+```sql+sqlite
+select
+  cf.id as distribution_id,
+  cf.domain_name,
+  case
+    when cf.logging ->> 'Enabled' = 'true' then 'Standard'
+    else 'Not configured'
+  end as standard_logging_status,
+  case
+    when s.name is not null then 'Configured'
+    else 'Not configured'
+  end as vended_logging_status,
+  s.name as source_name,
+  d.delivery_destination_type
+from
+  aws_cloudfront_distribution cf
+left join
+  aws_cloudwatch_log_delivery_source s
+    on s.service = 'cloudfront'
+left join
+  json_each(s.resource_arns) as ra
+    on ra.value = cf.arn
+left join
+  aws_cloudwatch_log_delivery d
+    on s.name = d.delivery_source_name;
+```
\ No newline at end of file
diff --git a/docs/tables/aws_cloudwatch_log_destination.md b/docs/tables/aws_cloudwatch_log_destination.md
new file mode 100644
index 000000000..0905de607
--- /dev/null
+++ b/docs/tables/aws_cloudwatch_log_destination.md
@@ -0,0 +1,179 @@
+---
+title: "Steampipe Table: aws_cloudwatch_log_destination - Query AWS CloudWatch Log Destinations using SQL"
+description: "Allows users to query AWS CloudWatch Log Destinations, providing information about destination configurations for vended log delivery."
+---
+
+# Table: aws_cloudwatch_log_destination - Query AWS CloudWatch Log Destinations using SQL
+
+AWS CloudWatch Log Destination represents a destination configuration for vended log delivery. These destinations define where logs can be sent, such as S3 buckets, CloudWatch Logs, or Firehose delivery streams. Destinations are part of CloudWatch Logs Vended Log Delivery, which enables near real-time log delivery from AWS services like CloudFront.
+
+## Table Usage Guide
+
+The `aws_cloudwatch_log_destination` table in Steampipe provides you with information about destination configurations for vended log delivery in AWS CloudWatch Logs. This table allows you, as a DevOps engineer, security analyst, or cloud administrator, to query destination-specific details, including the destination type, ARN, and configuration. You can utilize this table to gather insights on log delivery destinations, such as identifying all S3 buckets configured as log destinations, understanding which CloudWatch Log groups are receiving logs, and monitoring your overall logging architecture. The schema outlines the various attributes of the delivery destination for you, including the destination name, ARN, type, creation time, and associated tags.
+
+## Examples
+
+### Basic info
+Explore the configuration details of CloudWatch Log delivery destinations in your AWS account to understand where logs can be sent.
+
+```sql+postgres
+select
+  destination_name,
+  arn,
+  role_arn,
+  target_arn,
+  creation_time
+from
+  aws_cloudwatch_log_destination;
+```
+
+```sql+sqlite
+select
+  destination_name,
+  arn,
+  role_arn,
+  target_arn,
+  creation_time
+from
+  aws_cloudwatch_log_destination;
+```
+
+### Classify destinations by target type
+Determine the types of destinations used for log delivery by classifying based on the target ARN.
+
+```sql+postgres
+select
+  destination_name,
+  case
+    when target_arn like 'arn:aws:s3:%' then 'S3'
+    when target_arn like 'arn:aws:firehose:%' then 'Firehose'
+    when target_arn like 'arn:aws:logs:%' then 'CloudWatch Logs'
+    else 'Other'
+  end as target_type,
+  target_arn
+from
+  aws_cloudwatch_log_destination
+order by
+  target_type;
+```
+
+```sql+sqlite
+select
+  destination_name,
+  case
+    when target_arn like 'arn:aws:s3:%' then 'S3'
+    when target_arn like 'arn:aws:firehose:%' then 'Firehose'
+    when target_arn like 'arn:aws:logs:%' then 'CloudWatch Logs'
+    else 'Other'
+  end as target_type,
+  target_arn
+from
+  aws_cloudwatch_log_destination
+order by
+  target_type;
+```
+
+### List S3 buckets configured as log destinations
+Identify S3 buckets that are used as targets for log delivery in your AWS environment.
+
+```sql+postgres
+select
+  d.destination_name,
+  d.arn as destination_arn,
+  d.target_arn,
+  b.name as bucket_name,
+  b.region,
+  b.creation_date
+from
+  aws_cloudwatch_log_destination d
+join
+  aws_s3_bucket b on d.target_arn like concat('arn:aws:s3:::', b.name, '%')
+where
+  d.target_arn like 'arn:aws:s3:%';
+```
+
+```sql+sqlite
+select
+  d.destination_name,
+  d.arn as destination_arn,
+  d.target_arn,
+  b.name as bucket_name,
+  b.region,
+  b.creation_date
+from
+  aws_cloudwatch_log_destination d
+join
+  aws_s3_bucket b on d.target_arn like 'arn:aws:s3:::' || b.name || '%'
+where
+  d.target_arn like 'arn:aws:s3:%';
+```
+
+### List recently created destinations
+Track recent changes in your logging setup by viewing recently created log destinations.
+
+```sql+postgres
+select
+  destination_name,
+  target_arn,
+  role_arn,
+  creation_time
+from
+  aws_cloudwatch_log_destination
+where
+  creation_time > now() - interval '7 days'
+order by
+  creation_time desc;
+```
+
+```sql+sqlite
+select
+  destination_name,
+  target_arn,
+  role_arn,
+  creation_time
+from
+  aws_cloudwatch_log_destination
+where
+  creation_time > datetime('now', '-7 days')
+order by
+  creation_time desc;
+```
+
+### Trace full delivery pipeline from source to destination
+Get end-to-end visibility of the log delivery pipeline across source, delivery, and destination.
+
+```sql+postgres
+select
+  s.name as source_name,
+  s.service,
+  s.log_type,
+  d.id as delivery_id,
+  dst.destination_name,
+  dst.target_arn
+from
+  aws_cloudwatch_log_delivery_source s
+join
+  aws_cloudwatch_log_delivery d on s.name = d.delivery_source_name
+join
+  aws_cloudwatch_log_destination dst on d.delivery_destination_arn = dst.arn
+order by
+  s.service, s.name;
+```
+
+```sql+sqlite
+select
+  s.name as source_name,
+  s.service,
+  s.log_type,
+  d.id as delivery_id,
+  dst.destination_name,
+  dst.target_arn
+from
+  aws_cloudwatch_log_delivery_source s
+join
+  aws_cloudwatch_log_delivery d on s.name = d.delivery_source_name
+join
+  aws_cloudwatch_log_destination dst on d.delivery_destination_arn = dst.arn
+order by
+  s.service, s.name;
+```
\ No newline at end of file


Test patch: