feat(experimentation): enable Firehose CloudWatch error logging

[gagantrivedi]

Thanks for submitting a PR! Please check the boxes below:

• I have read the Contributing Guide.
• I have added information to docs/ if required so people know about the feature.
• I have filled in the "Changes" section below.
• I have filled in the "How did you test this code" section below.

Changes

Enables Amazon Data Firehose CloudWatch error logging on the per-organisation delivery streams, as AWS recommends, so delivery failures are diagnosable.

• Creates a per-organisation CloudWatch log group (/aws/kinesisfirehose/events-ingestion-org-{id}) and DestinationDelivery log stream when provisioning, and removes them on teardown.
• Sets CloudWatchLoggingOptions on the Firehose delivery stream's S3 destination.

Depends on matching Pulumi IAM changes: the Firehose delivery role needs logs:PutLogEvents, and the task-processor role needs logs:CreateLogGroup/CreateLogStream/DeleteLogGroup on /aws/kinesisfirehose/events-ingestion-org-* (separate Pulumi PR).

How did you test this code?

Unit tests (moto): assert the log group + DestinationDelivery stream are created, CloudWatchLoggingOptions is set on the delivery stream, and both are removed on teardown. experimentation.ingestion_infra_service remains at 100% coverage.

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
docs	Ready	Preview, Comment	Jul 22, 2026 10:16am

2 Skipped Deployments

Project	Deployment	Actions	Updated (UTC)
flagsmith-frontend-preview	Ignored		Jul 22, 2026 10:16am
flagsmith-frontend-staging	Ignored		Jul 22, 2026 10:16am

[coderabbitai]

📝 Walkthrough

Walkthrough

Firehose ingestion infrastructure now provisions a per-organisation CloudWatch Logs group and DestinationDelivery stream, enables Firehose destination logging, and removes the log group during deprovisioning. Unit tests cover configuration, resource creation, failure handling, and cleanup using mocked CloudWatch Logs. Observability documentation updates the recorded source line numbers for three ingestion infrastructure events.

Estimated code review effort: 2 (Simple) | ~15 minutes

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[github-actions]

Docker builds report

Image	Build Status	Security report
ghcr.io/flagsmith/flagsmith-e2e:pr-8068	Finished ✅	Skipped
ghcr.io/flagsmith/flagsmith-api-test:pr-8068	Finished ✅	Skipped
ghcr.io/flagsmith/flagsmith-frontend:pr-8068	Finished ✅	Results ✅
ghcr.io/flagsmith/flagsmith-api:pr-8068	Finished ✅	Results ✅
ghcr.io/flagsmith/flagsmith-private-cloud:pr-8068	Finished ✅	Results ✅
ghcr.io/flagsmith/flagsmith:pr-8068	Finished ✅	Results ✅

[coderabbitai]

Actionable comments posted: 3

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: ASSERTIVE

Plan: Pro Plus

Run ID: cef87322-9fcd-4d22-a42a-213775e9c26d

📥 Commits

Reviewing files that changed from the base of the PR and between 6bf7a23 and fc91ecb.

📒 Files selected for processing (3)

• api/experimentation/ingestion_infra_service.py
• api/tests/unit/experimentation/test_ingestion_infra_service.py
• docs/docs/deployment-self-hosting/observability/_events-catalogue.md

[github-actions]

✅ private-cloud · depot-ubuntu-latest-arm-16 — run #18618 (attempt 2)

Playwright Test Results (private-cloud - depot-ubuntu-latest-arm-16)

 2 passed

Details

 2 tests across 2 suites
 37.6 seconds
 fc91ecb
 🔄 Run: #18618 (attempt 2)

🗂️ Previous results

❌ private-cloud · depot-ubuntu-latest-arm-16 — run #18618 (attempt 1)

Playwright Test Results (private-cloud - depot-ubuntu-latest-arm-16)

 1 failed
 1 passed

Details

 2 tests across 2 suites
 60 seconds
 fc91ecb
 📦 Artifacts: View test results and HTML report
🔄 Run: #18618 (attempt 1)

Failed tests

firefox › tests/environment-permission-test.pw.ts › Environment Permission Tests › Environment-level permissions control access to features, identities, and segments @enterprise

✅ private-cloud · depot-ubuntu-latest-16 — run #18618 (attempt 1)

Playwright Test Results (private-cloud - depot-ubuntu-latest-16)

 1 passed

Details

 1 test across 1 suite
 55.7 seconds
 fc91ecb
 🔄 Run: #18618 (attempt 1)

✅ oss · depot-ubuntu-latest-16 — run #18618 (attempt 1)

Playwright Test Results (oss - depot-ubuntu-latest-16)

 1 passed

Details

 1 test across 1 suite
 43.2 seconds
 fc91ecb
 🔄 Run: #18618 (attempt 1)

✅ oss · depot-ubuntu-latest-arm-16 — run #18618 (attempt 1)

Playwright Test Results (oss - depot-ubuntu-latest-arm-16)

 2 passed

Details

 2 tests across 2 suites
 49.2 seconds
 fc91ecb
 🔄 Run: #18618 (attempt 1)

[github-actions]

Visual Regression

19 screenshots compared. See report for details.
View full report

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 98.66%. Comparing base (02a92d7) to head (fc91ecb).
⚠️ Report is 5 commits behind head on main.

Additional details and impacted files

@@           Coverage Diff           @@
##             main    #8068   +/-   ##
=======================================
  Coverage   98.66%   98.66%           
=======================================
  Files        1517     1517           
  Lines       60318    60363   +45     
=======================================
+ Hits        59512    59557   +45     
  Misses        806      806           

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.