This is a CDK project that set up centralized logging to an S3 bucket via a Kinesis Firehose. The solution allows you to specify trusted accounts for different regions and then will configure the CloudWatch Log Delivery Endpoint with proper permission in those regions Solution is based heavily on Centralize Cloudwatch Log with CDK https://github.com/aws-samples/aws-centralize-logs-using-cdk - View it on GitHub