Using multiple SubscriptionFilter fails

[MariusRumpf]

When creating multiple instances of a aws-log SubscriptionFilter for aws-lambda Function an error occurs. This is not the case using only a single instance. Same error occurs when using the .addSubscriptionFilter() method on the aws-log LogGroup directly.

Reproduction Steps

import { Stack, Construct, StackProps} from '@aws-cdk/core';
import { Function, Runtime, Code } from '@aws-cdk/aws-lambda';
import { LogGroup, SubscriptionFilter, FilterPattern } from '@aws-cdk/aws-logs';
import { LambdaDestination } from '@aws-cdk/aws-logs-destinations';

export class LoggingStack extends Stack {
  constructor(scope: Construct, id: string, props?: StackProps) {
    super(scope, id, props);

    const handler = new Function(this, 'LoggingLambda', {
      runtime: Runtime.PYTHON_2_7,
      code: Code.asset('lambda'),
      handler: 'logging.lambda_handler',
    });

    const logGroupIr = new LogGroup(this, 'IrLogGroup', {
      logGroupName: '/aws/lambda/logging-1'
    });

    const logGroupUpload = new LogGroup(this, 'UploadLogGroup', {
      logGroupName: '/aws/lambda/logging-2'
    });

    const lambdaLogDest = new LambdaDestination(handler);

    new SubscriptionFilter(this, 'IrSubscription', {
      logGroup: logGroupIr,
      destination: lambdaLogDest,
      filterPattern: FilterPattern.allEvents(),
    });

    new SubscriptionFilter(this, 'UploadSubscription', {
      logGroup: logGroupUpload,
      destination: lambdaLogDest,
      filterPattern: FilterPattern.allEvents(),
    });
  }
}

Error Log

There is already a Construct with name 'InvokedByCloudWatchLogs'

Environment

• CLI Version : 1.15.0 (build bdbe3aa)
• Framework Version: 1.15.0
• OS : Mac
• Language : Typescript

Other

According to this code the permission might be attempted to be created multiple times.

---

This is 🐛 Bug Report

[rix0rrr]

Yep, you are right. Thanks for reporting. As a workaround to get yourself unstuck, you can make your own implementation of LambdaDestination which does not have the issue.

import iam = require('@aws-cdk/aws-iam');
import lambda = require('@aws-cdk/aws-lambda');
import logs = require('@aws-cdk/aws-logs');
import { Construct } from '@aws-cdk/core';

/**
 * Use a Lamda Function as the destination for a log subscription
 */
export class LambdaDestination implements logs.ILogSubscriptionDestination {
  constructor(private readonly fn: lambda.IFunction) {
  }

  public bind(scope: Construct, logGroup: logs.ILogGroup): logs.LogSubscriptionDestinationConfig {
    const arn = logGroup.logGroupArn;

    this.fn.addPermission('CanInvokeLambda', {
      principal: new iam.ServicePrincipal(`logs.amazonaws.com`),
      sourceArn: arn,
      // Using SubScription Filter as scope is okay, since every Subscription Filter has only
      // one destination.
      scope
    });
    return { arn: this.fn.functionArn };
  }
}```