Merge branch 'main' into huijbers/mfa-when-profile

.devcontainer/Dockerfile

@@ -2,6 +2,15 @@ FROM jsii/superchain:1-bookworm-slim-node20
 
 USER root
 
+# Setup oh-my-zsh
+RUN apt-get update && export DEBIAN_FRONTEND=noninteractive \
+    && apt-get -y install --no-install-recommends zsh vim \
+    && rm -rf /var/lib/apt/lists/* \
+    && chsh -s $(which zsh) superchain
+
+# Required, otherwise shell is extermly slow due the size of the aws-cdk
+RUN sh -c 'echo "[oh-my-zsh]\n        hide-dirty = 1" > /etc/gitconfig'
+
 # Change uid/guid of superchain so it can work with the docker-in-docker feature
 RUN groupmod --gid 1000 superchain \
     && usermod --uid 1000 --gid 1000 superchain \
@@ -10,10 +19,4 @@ RUN groupmod --gid 1000 superchain \
 USER superchain
 
 # Setup oh-my-zsh
-RUN sudo apt-get update && export DEBIAN_FRONTEND=noninteractive \
-    && sudo apt-get -y install --no-install-recommends zsh vim \
-    && sudo rm -rf /var/lib/apt/lists/* \
-    && sudo chsh -s $(which zsh) $(whoami)
-RUN sh -c "$(curl -fsSL https://raw.githubusercontent.com/ohmyzsh/ohmyzsh/master/tools/install.sh)" "" --unattended \
-    # Required, otherwise shell is extermly slow due the size of the aws-cdk
-    && sudo sh -c 'echo "[oh-my-zsh]\n        hide-dirty = 1" > /etc/gitconfig'
+RUN sh -c "$(curl -fsSL https://raw.githubusercontent.com/ohmyzsh/ohmyzsh/master/tools/install.sh)" "" --unattended

.devcontainer/devcontainer.json

@@ -3,17 +3,17 @@
   "build": {
     "dockerfile": "Dockerfile"
   },
-
   "customizations": {
     "vscode": {
-      "extensions": ["dbaeumer.vscode-eslint"]
+      "extensions": [
+        "dbaeumer.vscode-eslint"
+      ]
     }
   },
-
   "postCreateCommand": "yarn install",
   "remoteUser": "superchain",
   "features": {
-    "docker-in-docker": {
+    "ghcr.io/devcontainers/features/docker-in-docker:2": {
       "version": "latest",
       "moby": true
     }

.github/workflows/codecov.yml

@@ -28,7 +28,7 @@ jobs:
         run: cd packages/aws-cdk && yarn test
 
       - name: Upload results to Codecov
-        uses: codecov/codecov-action@v5
+        uses: codecov/codecov-action@v4
         with:
           directory: packages/aws-cdk/coverage
           fail_ci_if_error: true

packages/aws-cdk-lib/aws-cloudfront/lib/origin.ts

@@ -149,6 +149,7 @@ export abstract class OriginBase implements IOrigin {
   private readonly originShieldRegion?: string;
   private readonly originShieldEnabled: boolean;
   private readonly originId?: string;
+  private readonly originAccessControlId?: string;
 
   protected constructor(domainName: string, props: OriginProps = {}) {
     validateIntInRangeOrUndefined('connectionTimeout', 1, 10, props.connectionTimeout?.toSeconds());
@@ -163,6 +164,7 @@ export abstract class OriginBase implements IOrigin {
     this.originShieldRegion = props.originShieldRegion;
     this.originId = props.originId;
     this.originShieldEnabled = props.originShieldEnabled ?? true;
+    this.originAccessControlId = props.originAccessControlId;
   }
 
   /**
@@ -187,6 +189,7 @@ export abstract class OriginBase implements IOrigin {
         s3OriginConfig,
         customOriginConfig,
         originShield: this.renderOriginShield(this.originShieldEnabled, this.originShieldRegion),
+        originAccessControlId: this.originAccessControlId,
       },
     };
   }

packages/aws-cdk-lib/aws-cloudfront/test/distribution.test.ts

@@ -1,4 +1,4 @@
-import { defaultOrigin, defaultOriginGroup } from './test-origin';
+import { defaultOrigin, defaultOriginGroup, defaultOriginWithOriginAccessControl } from './test-origin';
 import { Annotations, Match, Template } from '../../assertions';
 import * as acm from '../../aws-certificatemanager';
 import * as cloudwatch from '../../aws-cloudwatch';
@@ -1282,6 +1282,36 @@ test('with publish additional metrics', () => {
   });
 });
 
+test('with origin access control id', () => {
+  const origin = defaultOriginWithOriginAccessControl();
+  new Distribution(stack, 'MyDist', {
+    defaultBehavior: { origin },
+    publishAdditionalMetrics: true,
+  });
+
+  Template.fromStack(stack).hasResourceProperties('AWS::CloudFront::Distribution', {
+    DistributionConfig: {
+      DefaultCacheBehavior: {
+        CachePolicyId: '658327ea-f89d-4fab-a63d-7e88639e58f6',
+        Compress: true,
+        TargetOriginId: 'StackMyDistOrigin1D6D5E535',
+        ViewerProtocolPolicy: 'allow-all',
+      },
+      Enabled: true,
+      HttpVersion: 'http2',
+      IPV6Enabled: true,
+      Origins: [{
+        DomainName: 'www.example.com',
+        Id: 'StackMyDistOrigin1D6D5E535',
+        CustomOriginConfig: {
+          OriginProtocolPolicy: 'https-only',
+        },
+        OriginAccessControlId: 'test-origin-access-control-id',
+      }],
+    },
+  });
+});
+
 describe('Distribution metrics tests', () => {
   const additionalMetrics = [
     { name: 'OriginLatency', method: 'metricOriginLatency', statistic: 'Average', additionalMetricsRequired: true, errorMetricName: 'Origin latency' },

packages/aws-cdk-lib/aws-cloudfront/test/test-origin.ts

@@ -1,16 +1,31 @@
 import { Construct } from 'constructs';
-import { CfnDistribution, IOrigin, OriginBase, OriginBindConfig, OriginBindOptions, OriginProps, OriginProtocolPolicy } from '../lib';
+import {
+  CfnDistribution,
+  IOrigin,
+  OriginBase,
+  OriginBindConfig,
+  OriginBindOptions,
+  OriginProps,
+  OriginProtocolPolicy,
+} from '../lib';
 
 /** Used for testing common Origin functionality */
 export class TestOrigin extends OriginBase {
-  constructor(domainName: string, props: OriginProps = {}) { super(domainName, props); }
-  protected renderCustomOriginConfig(): CfnDistribution.CustomOriginConfigProperty | undefined {
+  constructor(domainName: string, props: OriginProps = {}) {
+    super(domainName, props);
+  }
+  protected renderCustomOriginConfig():
+  | CfnDistribution.CustomOriginConfigProperty
+  | undefined {
     return { originProtocolPolicy: OriginProtocolPolicy.HTTPS_ONLY };
   }
 }
 
 export class TestOriginGroup implements IOrigin {
-  constructor(private readonly primaryDomainName: string, private readonly secondaryDomainName: string) { }
+  constructor(
+    private readonly primaryDomainName: string,
+    private readonly secondaryDomainName: string,
+  ) {}
   /* eslint-disable @cdklabs/no-core-construct */
   public bind(scope: Construct, options: OriginBindOptions): OriginBindConfig {
     const primaryOrigin = new TestOrigin(this.primaryDomainName);
@@ -35,3 +50,15 @@ export function defaultOrigin(domainName?: string, originId?: string): IOrigin {
 export function defaultOriginGroup(): IOrigin {
   return new TestOriginGroup('www.example.com', 'foo.example.com');
 }
+
+export function defaultOriginWithOriginAccessControl(
+  domainName?: string,
+  originId?: string,
+  originAccessControlId?: string,
+): IOrigin {
+  return new TestOrigin(domainName ?? 'www.example.com', {
+    originId,
+    originAccessControlId:
+      originAccessControlId ?? 'test-origin-access-control-id',
+  });
+}

packages/aws-cdk/lib/api/util/cloudformation/stack-activity-monitor.ts

@@ -3,7 +3,7 @@ import { ArtifactMetadataEntryType, type MetadataEntry } from '@aws-cdk/cloud-as
 import type { CloudFormationStackArtifact } from '@aws-cdk/cx-api';
 import * as chalk from 'chalk';
 import { ResourceEvent, StackEventPoller } from './stack-event-poller';
-import { error, logLevel, LogLevel, setLogLevel } from '../../../logging';
+import { error, LogLevel, setLogLevel } from '../../../logging';
 import type { ICloudFormationClient } from '../../aws-auth';
 import { RewritableBlock } from '../display';
 
@@ -102,7 +102,7 @@ export class StackActivityMonitor {
     };
 
     const isWindows = process.platform === 'win32';
-    const verbose = options.logLevel ?? logLevel;
+    const verbose = options.logLevel ?? LogLevel.INFO;
     // On some CI systems (such as CircleCI) output still reports as a TTY so we also
     // need an individual check for whether we're running on CI.
     // see: https://discuss.circleci.com/t/circleci-terminal-is-a-tty-but-term-is-not-set/9965
@@ -626,7 +626,7 @@ export class CurrentActivityPrinter extends ActivityPrinterBase {
    */
   public readonly updateSleep: number = 2_000;
 
-  private oldLogLevel: LogLevel = LogLevel.DEFAULT;
+  private oldLogLevel: LogLevel = LogLevel.INFO;
   private block = new RewritableBlock(this.stream);
 
   constructor(props: PrinterProps) {
@@ -674,8 +674,7 @@ export class CurrentActivityPrinter extends ActivityPrinterBase {
   public start() {
     // Need to prevent the waiter from printing 'stack not stable' every 5 seconds, it messes
     // with the output calculations.
-    this.oldLogLevel = logLevel;
-    setLogLevel(LogLevel.DEFAULT);
+    setLogLevel(LogLevel.INFO);
   }
 
   public stop() {

packages/aws-cdk/lib/cli.ts

@@ -22,7 +22,7 @@ import { realHandler as docs } from '../lib/commands/docs';
 import { realHandler as doctor } from '../lib/commands/doctor';
 import { MIGRATE_SUPPORTED_LANGUAGES, getMigrateScanType } from '../lib/commands/migrate';
 import { availableInitLanguages, cliInit, printAvailableTemplates } from '../lib/init';
-import { data, debug, error, print, setLogLevel, setCI } from '../lib/logging';
+import { data, debug, error, print, setCI, setLogLevel, LogLevel } from '../lib/logging';
 import { Notices } from '../lib/notices';
 import { Command, Configuration, Settings } from '../lib/settings';
 import * as version from '../lib/version';
@@ -48,8 +48,20 @@ export async function exec(args: string[], synthesizer?: Synthesizer): Promise<n
 
   const argv = await parseCommandLineArguments(args, makeBrowserDefault(), await availableInitLanguages(), MIGRATE_SUPPORTED_LANGUAGES as string[], version.DISPLAY_VERSION, yargsNegativeAlias);
 
+  // if one -v, log at a DEBUG level
+  // if 2 -v, log at a TRACE level
   if (argv.verbose) {
-    setLogLevel(argv.verbose);
+    let logLevel: LogLevel;
+    switch (argv.verbose) {
+      case 1:
+        logLevel = LogLevel.DEBUG;
+        break;
+      case 2:
+      default:
+        logLevel = LogLevel.TRACE;
+        break;
+    }
+    setLogLevel(logLevel);
   }
 
   // Debug should always imply tracing