chore(release): 2.101.0 (#27534)

See [CHANGELOG](https://github.com/aws/aws-cdk/blob/bump/2.101.0/CHANGELOG.md)
aws · Oct 13, 2023 · cbaa50e · cbaa50e
2 parents e1b5c77 + b2e59c3
commit cbaa50e
Show file tree

Hide file tree

Showing 257 changed files with 79,902 additions and 4,232 deletions.
diff --git a/.github/workflows/issue-label-assign.yml b/.github/workflows/issue-label-assign.yml
@@ -239,6 +239,8 @@ env:
             {"area":"@aws-cdk/aws-s3outposts","keywords":["aws-s3outposts","s3outposts"],"labels":["@aws-cdk/aws-s3outposts"]},
             {"area":"@aws-cdk/aws-sagemaker","keywords":["aws-sagemaker","sagemaker"],"labels":["@aws-cdk/aws-sagemaker"]},
             {"area":"@aws-cdk/aws-sam","keywords":["serverless-application-model","aws-sam","sam"],"labels":["@aws-cdk/aws-sam"]},
+            {"area":"@aws-cdk/aws-scheduler","keywords":["aws-scheduler","scheduler"],"labels":["@aws-cdk/aws-scheduler"]},
+            {"area":"@aws-cdk/aws-scheduler-targets","keywords":["aws-scheduler-targets","scheduler-targets"],"labels":["@aws-cdk/aws-scheduler-targets"]},
             {"area":"@aws-cdk/aws-sdb","keywords":["simpledb","aws-sdb","sdb"],"labels":["@aws-cdk/aws-sdb"]},
             {"area":"@aws-cdk/aws-secretsmanager","keywords":["secret","aws-secretsmanager","secrets-manager"],"labels":["@aws-cdk/aws-secretsmanager"]},
             {"area":"@aws-cdk/aws-securityhub","keywords":["aws-securityhub","security-hub"],"labels":["@aws-cdk/aws-securityhub"]},

diff --git a/.github/workflows/repo-metrics.yml b/.github/workflows/repo-metrics.yml
@@ -52,7 +52,7 @@ jobs:
     - name: Create report for PRs
       uses: peter-evans/create-issue-from-file@v4
       with:
-        title: Monthly issue metrics report
+        title: Monthly PR metrics report
         token: ${{ secrets.GITHUB_TOKEN }}
         content-filepath: ./issue_metrics.md
         assignees: evgenyka
diff --git a/.github/workflows/request-cli-integ-test.yml b/.github/workflows/request-cli-integ-test.yml
@@ -19,7 +19,7 @@ jobs:
           persist-credentials: false
       - name: Find changed cli files
         id: changed-cli-files
-        uses: tj-actions/changed-files@8238a4103220c636f2dad328ead8a7c8dbe316a3
+        uses: tj-actions/changed-files@db153baf731265ad02cd490b07f470e2d55e3345
         with:
           base_sha: ${{ github.event.pull_request.base.sha }}
           files_yaml: |

diff --git a/.github/workflows/v2-pull-request.yml b/.github/workflows/v2-pull-request.yml
@@ -32,6 +32,6 @@ jobs:
           yarn install --frozen-lockfile
           yarn pkglint
       - name: push
-        uses: stefanzweifel/git-auto-commit-action@v4
+        uses: stefanzweifel/git-auto-commit-action@v5
         with:
           commit_message: 'automatic pkglint fixes'
diff --git a/CHANGELOG.v2.alpha.md b/CHANGELOG.v2.alpha.md
@@ -2,16 +2,30 @@
 
 All notable changes to this project will be documented in this file. See [standard-version](https://github.com/conventional-changelog/standard-version) for commit guidelines.
 
-## [2.100.0-alpha.0](https://github.com/aws/aws-cdk/compare/v2.99.1-alpha.0...v2.100.0-alpha.0) (2023-10-06)
+## [2.101.0-alpha.0](https://github.com/aws/aws-cdk/compare/v2.100.0-alpha.0...v2.101.0-alpha.0) (2023-10-13)
 
 
 ### ⚠ BREAKING CHANGES TO EXPERIMENTAL FEATURES
 
-* **redshift:** the behavior of redshift tables has changed. UPDATE action will not be triggered on new table names and instead be triggered on table id changes.
+* **glue-alpha:** `SparkUIProps.prefix` strings in the original `/prefix-name` format will now result in a validation error. To retain the same behavior, prefixes must be changed to the new `prefix-name/` format.
 
 ### Features
 
-* **synthetics:** CloudWatch Synthetics NodeJS Pupeteer 6.0 Runtime with NodeJS 18 ([#27339](https://github.com/aws/aws-cdk/issues/27339)) ([e48af04](https://github.com/aws/aws-cdk/commit/e48af04c0b483d705d99c97a1f7bf8c6cd8e71c6)), closes [#27337](https://github.com/aws/aws-cdk/issues/27337)
+* **lambda-python-alpha:** add without-urls option for poetry ([#27442](https://github.com/aws/aws-cdk/issues/27442)) ([5893b3f](https://github.com/aws/aws-cdk/commit/5893b3fadb7f54360db6997a98cce8dc74b86cd7)), closes [#27103](https://github.com/aws/aws-cdk/issues/27103)
+* **scheduler-targets:** step function start execution target ([#27424](https://github.com/aws/aws-cdk/issues/27424)) ([3a87141](https://github.com/aws/aws-cdk/commit/3a87141cc56609e063787ce855873a059f9880ab)), closes [40aws-cdk/aws-scheduler-targets-alpha/lib/lambda-invoke.ts#L8](https://github.com/40aws-cdk/aws-scheduler-targets-alpha/lib/lambda-invoke.ts/issues/L8) [#27377](https://github.com/aws/aws-cdk/issues/27377)
+
+
+### Bug Fixes
+
+* **glue-alpha:** prefix validation logic is incorrect ([#27472](https://github.com/aws/aws-cdk/issues/27472)) ([b898d3b](https://github.com/aws/aws-cdk/commit/b898d3b9fe0d5f9ddc46c2deb71d0a95f88677fb)), closes [#27396](https://github.com/aws/aws-cdk/issues/27396)
+* **integ-tests:** cannot make two or more identical assertions ([#27380](https://github.com/aws/aws-cdk/issues/27380)) ([ea06f7d](https://github.com/aws/aws-cdk/commit/ea06f7db4857e12e9b13508c64b5321a841e6dc4)), closes [#22043](https://github.com/aws/aws-cdk/issues/22043) [#23049](https://github.com/aws/aws-cdk/issues/23049)
+
+## [2.100.0-alpha.0](https://github.com/aws/aws-cdk/compare/v2.99.1-alpha.0...v2.100.0-alpha.0) (2023-10-06)
+
+
+### ⚠ BREAKING CHANGES TO EXPERIMENTAL FEATURES
+
+* **redshift:** the behavior of redshift tables has changed. UPDATE action will not be triggered on new table names and instead be triggered on table id changes.
 
 
 ### Bug Fixes

diff --git a/CHANGELOG.v2.md b/CHANGELOG.v2.md
@@ -2,6 +2,29 @@
 
 All notable changes to this project will be documented in this file. See [standard-version](https://github.com/conventional-changelog/standard-version) for commit guidelines.
 
+## [2.101.0](https://github.com/aws/aws-cdk/compare/v2.100.0...v2.101.0) (2023-10-13)
+
+
+### Features
+
+* **ec2:** Add SubnetFilter for CIDR Range ([#27425](https://github.com/aws/aws-cdk/issues/27425)) ([b1ce47b](https://github.com/aws/aws-cdk/commit/b1ce47b894c973ad1b6ccae29940b7b277bde3d2)), closes [#27421](https://github.com/aws/aws-cdk/issues/27421)
+* **init-templates:** update init templates to use the current LTS version of Java ([#27422](https://github.com/aws/aws-cdk/issues/27422)) ([6c34c9a](https://github.com/aws/aws-cdk/commit/6c34c9a75c513d629595fd30c3a2be3b64d69d68))
+* **stepfunctions:** adding custom state name prop ([#27306](https://github.com/aws/aws-cdk/issues/27306)) ([61be7a6](https://github.com/aws/aws-cdk/commit/61be7a659f22e7ff3df255fc9542214135d07d5e))
+* **stepfunctions-tasks:** add `ExecutionParameters` to `AthenaStartQueryExecution` ([#27287](https://github.com/aws/aws-cdk/issues/27287)) ([3fc86ca](https://github.com/aws/aws-cdk/commit/3fc86ca5a80b4788141ff7b06f2f129fb4d90d5f)), closes [#27286](https://github.com/aws/aws-cdk/issues/27286)
+* update AWS Service Spec ([#27464](https://github.com/aws/aws-cdk/issues/27464)) ([3899f15](https://github.com/aws/aws-cdk/commit/3899f158173d01565bb7c7204295d8ba573d55dc))
+
+
+### Bug Fixes
+
+* **assertions:** cannot use HTTP apis that do not return JSON ([#27463](https://github.com/aws/aws-cdk/issues/27463)) ([cae9db6](https://github.com/aws/aws-cdk/commit/cae9db6b4f4855c0e30b0db3de54cec52e09a7a8))
+* **s3:** grantRead does not allow s3:HeadObject ([#27416](https://github.com/aws/aws-cdk/issues/27416)) ([beac675](https://github.com/aws/aws-cdk/commit/beac6753021138ee56abdbf02eef0318f7098dde)), closes [#27389](https://github.com/aws/aws-cdk/issues/27389)
+* **stepfunctions-tasks:** SNS FIFO tasks does not support messageGroupId and messageDeduplicationId ([#27369](https://github.com/aws/aws-cdk/issues/27369)) ([9cb9fb8](https://github.com/aws/aws-cdk/commit/9cb9fb879a95c77b4f0048ac6a1d714bb9889efb)), closes [#27341](https://github.com/aws/aws-cdk/issues/27341)
+
+
+### Reverts
+
+* "fix(cli): cannot hotswap ECS task definitions containing certain intrinsics" ([#27358](https://github.com/aws/aws-cdk/issues/27358)) ([48d7726](https://github.com/aws/aws-cdk/commit/48d7726421352eb3c032b1293a361a70339b0566)), closes [#27343](https://github.com/aws/aws-cdk/issues/27343) [#27343](https://github.com/aws/aws-cdk/issues/27343)
+
 ## [2.100.0](https://github.com/aws/aws-cdk/compare/v2.99.1...v2.100.0) (2023-10-06)
 
 
@@ -13,6 +36,7 @@ All notable changes to this project will be documented in this file. See [standa
 * **cli:** declare `cdk import` stable ([#27390](https://github.com/aws/aws-cdk/issues/27390)) ([1057ef0](https://github.com/aws/aws-cdk/commit/1057ef0feba8f35ea5d7dc0f011e85e721146ce0))
 * **eks:** support INF2 instance types ([#27373](https://github.com/aws/aws-cdk/issues/27373)) ([bed9b8d](https://github.com/aws/aws-cdk/commit/bed9b8d43c236bc44c11b5b44447c1ea45935ba8))
 * **s3-deployment:** support Fn::Select in renderData() ([#27237](https://github.com/aws/aws-cdk/issues/27237)) ([8b20c11](https://github.com/aws/aws-cdk/commit/8b20c114068cc9e514aefc136516cb2d01df1e1b)), closes [#25504](https://github.com/aws/aws-cdk/issues/25504) [/github.com/aws/aws-cdk/blob/3edd2400bc0c8a86366a29d3a7eef1ef4fa5e016/packages/aws-cdk-lib/aws-elasticloadbalancingv2/lib/alb/application-target-group.ts#L438](https://github.com/aws//github.com/aws/aws-cdk/blob/3edd2400bc0c8a86366a29d3a7eef1ef4fa5e016/packages/aws-cdk-lib/aws-elasticloadbalancingv2/lib/alb/application-target-group.ts/issues/L438)
+* **synthetics:** CloudWatch Synthetics NodeJS Pupeteer 6.0 Runtime with NodeJS 18 ([#27339](https://github.com/aws/aws-cdk/issues/27339)) ([e48af04](https://github.com/aws/aws-cdk/commit/e48af04c0b483d705d99c97a1f7bf8c6cd8e71c6)), closes [#27337](https://github.com/aws/aws-cdk/issues/27337)
 * update AWS Service Spec ([#27375](https://github.com/aws/aws-cdk/issues/27375)) ([26d4afe](https://github.com/aws/aws-cdk/commit/26d4afee04ef2f5b17d0c211c767adc635d2cf37))
 * **rds:** add new RDS versions ([#27351](https://github.com/aws/aws-cdk/issues/27351)) ([e0c9792](https://github.com/aws/aws-cdk/commit/e0c9792811e5e0685729264694b645d147ff52de))
 

diff --git a/packages/@aws-cdk-testing/cli-integ/lib/with-cdk-app.ts b/packages/@aws-cdk-testing/cli-integ/lib/with-cdk-app.ts
@@ -84,6 +84,50 @@ export function withCdkApp(
   };
 }
 
+export function withCdkMigrateApp<A extends TestContext>(language: string, block: (context: TestFixture) => Promise<void>) {
+  return async (context: A) => {
+    const stackName = `cdk-migrate-${language}-integ-${context.randomString}`;
+    const integTestDir = path.join(os.tmpdir(), `cdk-migrate-${language}-integ-${context.randomString}`);
+
+    context.output.write(` Stack name:   ${stackName}\n`);
+    context.output.write(` Test directory: ${integTestDir}\n`);
+
+    const awsClients = await AwsClients.default(context.output);
+    fs.mkdirSync(integTestDir);
+    const fixture = new TestFixture(
+      integTestDir,
+      stackName,
+      context.output,
+      awsClients,
+      context.randomString,
+    );
+
+    await fixture.cdkMigrate(language, stackName);
+
+    const testFixture = new TestFixture(
+      path.join(integTestDir, stackName),
+      stackName,
+      context.output,
+      awsClients,
+      context.randomString,
+    );
+
+    let success = true;
+    try {
+      await block(testFixture);
+    } catch (e) {
+      success = false;
+      throw e;
+    } finally {
+      if (process.env.INTEG_NO_CLEAN) {
+        context.log(`Left test directory in '${integTestDir}' ($INTEG_NO_CLEAN)`);
+      } else {
+        await fixture.dispose(success);
+      }
+    }
+  };
+}
+
 export function withMonolithicCfnIncludeCdkApp<A extends TestContext>(block: (context: TestFixture) => Promise<void>) {
   return async (context: A) => {
     const uberPackage = process.env.UBERPACKAGE;
@@ -141,6 +185,10 @@ export function withDefaultFixture(block: (context: TestFixture) => Promise<void
   return withAws(withTimeout(DEFAULT_TEST_TIMEOUT_S, withCdkApp(block)));
 }
 
+export function withCDKMigrateFixture(language: string, block: (content: TestFixture) => Promise<void>) {
+  return withAws(withTimeout(DEFAULT_TEST_TIMEOUT_S, withCdkMigrateApp(language, block)));
+}
+
 export interface DisableBootstrapContext {
   /**
    * Whether to disable creating the default bootstrap
@@ -270,7 +318,7 @@ export class TestFixture extends ShellHelper {
     this.output.write(`${s}\n`);
   }
 
-  public async cdkDeploy(stackNames: string | string[], options: CdkCliOptions = {}) {
+  public async cdkDeploy(stackNames: string | string[], options: CdkCliOptions = {}, skipStackRename?: boolean) {
     stackNames = typeof stackNames === 'string' ? [stackNames] : stackNames;
 
     const neverRequireApproval = options.neverRequireApproval ?? true;
@@ -280,7 +328,7 @@ export class TestFixture extends ShellHelper {
       ...(options.options ?? []),
       // use events because bar renders bad in tests
       '--progress', 'events',
-      ...this.fullStackName(stackNames)], options);
+      ...(skipStackRename ? stackNames : this.fullStackName(stackNames))], options);
   }
 
   public async cdkSynth(options: CdkCliOptions = {}) {
@@ -379,6 +427,19 @@ export class TestFixture extends ShellHelper {
     });
   }
 
+  public async cdkMigrate(language: string, stackName: string, inputPath?: string, options?: CdkCliOptions) {
+    return this.cdk([
+      'migrate',
+      '--language',
+      language,
+      '--stack-name',
+      stackName,
+      '--from-path',
+      inputPath ?? path.join(__dirname, '..', 'resources', 'templates', 'sqs-template.json').toString(),
+      ...(options?.options ?? []),
+    ], options);
+  }
+
   public async cdk(args: string[], options: CdkCliOptions = {}) {
     const verbose = options.verbose ?? true;
 

diff --git a/packages/@aws-cdk-testing/cli-integ/resources/templates/sqs-template.json b/packages/@aws-cdk-testing/cli-integ/resources/templates/sqs-template.json
@@ -0,0 +1,36 @@
+{
+  "AWSTemplateFormatVersion": "2010-09-09",
+  "Description": "AWS CloudFormation Sample Template SQS_With_CloudWatch_Alarms: Sample template showing how to create an SQS queue with AWS CloudWatch alarms on queue depth.",
+  "Resources": {
+    "MyQueue": {
+      "Type": "AWS::SQS::Queue",
+      "Properties": {}
+    }
+  },
+  "Outputs": {
+    "QueueURL": {
+      "Description": "URL of newly created SQS Queue",
+      "Value": {
+        "Ref": "MyQueue"
+      }
+    },
+    "QueueARN": {
+      "Description": "ARN of newly created SQS Queue",
+      "Value": {
+        "Fn::GetAtt": [
+          "MyQueue",
+          "Arn"
+        ]
+      }
+    },
+    "QueueName": {
+      "Description": "Name newly created SQS Queue",
+      "Value": {
+        "Fn::GetAtt": [
+          "MyQueue",
+          "QueueName"
+        ]
+      }
+    }
+  }
+}
diff --git a/packages/@aws-cdk-testing/cli-integ/tests/cli-integ-tests/cli.integtest.ts b/packages/@aws-cdk-testing/cli-integ/tests/cli-integ-tests/cli.integtest.ts
@@ -1,7 +1,7 @@
 import { promises as fs, existsSync } from 'fs';
 import * as os from 'os';
 import * as path from 'path';
-import { integTest, cloneDirectory, shell, withDefaultFixture, retry, sleep, randomInteger, withSamIntegrationFixture, RESOURCES_DIR } from '../../lib';
+import { integTest, cloneDirectory, shell, withDefaultFixture, retry, sleep, randomInteger, withSamIntegrationFixture, RESOURCES_DIR, withCDKMigrateFixture } from '../../lib';
 
 jest.setTimeout(2 * 60 * 60_000); // Includes the time to acquire locks, worst-case single-threaded runtime
 
@@ -571,6 +571,23 @@ integTest('deploy with role', withDefaultFixture(async (fixture) => {
   }
 }));
 
+// TODO add go back in when template synths properly
+['typescript', 'python', 'csharp', 'java'].forEach(language => {
+  integTest(`cdk migrate ${language}`, withCDKMigrateFixture(language, async (fixture) => {
+    if (language === 'python') {
+      await fixture.shell(['pip', 'install', '-r', 'requirements.txt']);
+    }
+
+    const stackArn = await fixture.cdkDeploy(fixture.stackNamePrefix, { neverRequireApproval: true, verbose: true, captureStderr: false }, true);
+    const response = await fixture.aws.cloudFormation('describeStacks', {
+      StackName: stackArn,
+    });
+
+    expect(response.Stacks?.[0].StackStatus).toEqual('CREATE_COMPLETE');
+    await fixture.cdkDestroy(fixture.stackNamePrefix);
+  }));
+});
+
 integTest('cdk diff', withDefaultFixture(async (fixture) => {
   const diff1 = await fixture.cdk(['diff', fixture.fullStackName('test-1')]);
   expect(diff1).toContain('AWS::SNS::Topic');

diff --git a/...ebuild/test/integ.asset-build-spec.js.snapshot/CodeBuildAssetBuildSpecStack.template.json b/...ebuild/test/integ.asset-build-spec.js.snapshot/CodeBuildAssetBuildSpecStack.template.json
@@ -26,6 +26,7 @@
        "Action": [
         "s3:GetBucket*",
         "s3:GetObject*",
+        "s3:HeadObject",
         "s3:List*"
        ],
        "Effect": "Allow",

diff --git a/...k-integ/test/aws-codebuild/test/integ.caching.js.snapshot/aws-cdk-codebuild.template.json b/...k-integ/test/aws-codebuild/test/integ.caching.js.snapshot/aws-cdk-codebuild.template.json
@@ -33,6 +33,7 @@
         "s3:DeleteObject*",
         "s3:GetBucket*",
         "s3:GetObject*",
+        "s3:HeadObject",
         "s3:List*",
         "s3:PutObject",
         "s3:PutObjectLegalHold",

diff --git a/.../test/aws-codebuild/test/integ.project-bucket.js.snapshot/aws-cdk-codebuild.template.json b/.../test/aws-codebuild/test/integ.project-bucket.js.snapshot/aws-cdk-codebuild.template.json
@@ -31,6 +31,7 @@
        "Action": [
         "s3:GetBucket*",
         "s3:GetObject*",
+        "s3:HeadObject",
         "s3:List*"
        ],
        "Effect": "Allow",

diff --git a/...t-buildspec-artifacts.js.snapshot/aws-cdk-codebuild-buildspec-artifact-name.template.json b/...t-buildspec-artifacts.js.snapshot/aws-cdk-codebuild-buildspec-artifact-name.template.json
@@ -33,6 +33,7 @@
         "s3:DeleteObject*",
         "s3:GetBucket*",
         "s3:GetObject*",
+        "s3:HeadObject",
         "s3:List*",
         "s3:PutObject",
         "s3:PutObjectLegalHold",

diff --git a/...sources-artifacts.js.snapshot/aws-cdk-codebuild-secondary-sources-artifacts.template.json b/...sources-artifacts.js.snapshot/aws-cdk-codebuild-secondary-sources-artifacts.template.json
@@ -31,6 +31,7 @@
        "Action": [
         "s3:GetBucket*",
         "s3:GetObject*",
+        "s3:HeadObject",
         "s3:List*"
        ],
        "Effect": "Allow",
@@ -63,6 +64,7 @@
         "s3:DeleteObject*",
         "s3:GetBucket*",
         "s3:GetObject*",
+        "s3:HeadObject",
         "s3:List*",
         "s3:PutObject",
         "s3:PutObjectLegalHold",

diff --git a/...test/server/integ.deployment-group.js.snapshot/aws-cdk-codedeploy-server-dg.template.json b/...test/server/integ.deployment-group.js.snapshot/aws-cdk-codedeploy-server-dg.template.json
@@ -445,6 +445,7 @@
        "Action": [
         "s3:GetBucket*",
         "s3:GetObject*",
+        "s3:HeadObject",
         "s3:List*"
        ],
        "Effect": "Allow",

diff --git a/...tions/test/cloudformation/integ.stacksets.js.snapshot/StackSetPipelineStack.template.json b/...tions/test/cloudformation/integ.stacksets.js.snapshot/StackSetPipelineStack.template.json
@@ -170,6 +170,7 @@
         "s3:DeleteObject*",
         "s3:GetBucket*",
         "s3:GetObject*",
+        "s3:HeadObject",
         "s3:List*",
         "s3:PutObject",
         "s3:PutObjectLegalHold",
@@ -392,6 +393,7 @@
        "Action": [
         "s3:GetBucket*",
         "s3:GetObject*",
+        "s3:HeadObject",
         "s3:List*"
        ],
        "Effect": "Allow",
@@ -556,6 +558,7 @@
        "Action": [
         "s3:GetBucket*",
         "s3:GetObject*",
+        "s3:HeadObject",
         "s3:List*"
        ],
        "Effect": "Allow",

diff --git a/....cfn-template-from-repo.lit.js.snapshot/aws-cdk-codepipeline-cloudformation.template.json b/....cfn-template-from-repo.lit.js.snapshot/aws-cdk-codepipeline-cloudformation.template.json
@@ -158,6 +158,7 @@
         "s3:DeleteObject*",
         "s3:GetBucket*",
         "s3:GetObject*",
+        "s3:HeadObject",
         "s3:List*",
         "s3:PutObject",
         "s3:PutObjectLegalHold",
@@ -433,6 +434,7 @@
         "s3:DeleteObject*",
         "s3:GetBucket*",
         "s3:GetObject*",
+        "s3:HeadObject",
         "s3:List*",
         "s3:PutObject",
         "s3:PutObjectLegalHold",
@@ -558,6 +560,7 @@
        "Action": [
         "s3:GetBucket*",
         "s3:GetObject*",
+        "s3:HeadObject",
         "s3:List*"
        ],
        "Effect": "Allow",
@@ -668,6 +671,7 @@
        "Action": [
         "s3:GetBucket*",
         "s3:GetObject*",
+        "s3:HeadObject",
         "s3:List*"
        ],
        "Effect": "Allow",