Merge branch 'main' into refactor/UserTablePriviligies

.github/ISSUE_TEMPLATE/notice.yml

@@ -0,0 +1,58 @@
+---
+name: "❗ Notice"
+description: Post a notice for a high impact issue
+title: "❗ NOTICE (module name): (short notice description)"
+labels: [p0, management/tracking]
+body:
+  - type: dropdown
+    attributes:
+      label: Status
+      description: What is the current status of this issue?
+      options:
+        - Investigating (Default)
+        - In-Progress
+        - Resolved
+    validations:
+      required: true        
+  - type: textarea
+    attributes:
+      label: What is the issue?
+      description: A clear and concise description of the issue you want customers to be aware of
+    validations:
+      required: true
+  - type: textarea
+    attributes:
+      label: Error message
+      description: If available, paste the error message users are seeing (no need to backticks)
+      render: console
+  - type: textarea
+    attributes:
+      label: What is the impact?
+      description: |
+        What can occur if this issue isn't addressed?
+    validations:
+        required: true
+  - type: textarea
+    attributes:
+      label: Workaround
+      description: |
+        Please provide a detailed workaround outlining all steps required for implementation. If none exist yet, leave blank
+  - type: textarea
+    attributes:
+      label: Who is affected?
+      description: |
+        What segment of customers are affected? Think about specific construct usage, version, feature toggles, etc...
+    validations:
+      required: true
+  - type: textarea
+    attributes:
+      label: How do I resolve this?
+      description: |
+        What actions should customers take to resolve the issue. Also elaborate on any code changes the customer may need to do. If unknown yet, say TBD
+    validations:
+      required: true        
+  - type: textarea
+    attributes:
+      label: Related issues
+      description: |
+        List all related issues here. If none related, leave blank

.github/workflows/github-merit-badger.yml

@@ -17,4 +17,4 @@ jobs:
           badges: '[beginning-contributor,repeat-contributor,valued-contributor,admired-contributor,star-contributor,distinguished-contributor]'
           thresholds: '[0,3,6,13,25,50]'
           badge-type: 'achievement'
-          ignore-usernames: '[RomainMuller,rix0rrr,MrArnoldPalmer,iliapolo,otaviomacedo,madeline-k,kaizencc,comcalvi,corymhall,peterwoodworth,ryparker,TheRealAmazonKendra,vinayak-kukreja,Naumel,mrgrain,pahud,cgarvis,kellertk,HBobertz,sumupitchayan,pattasai,SankyRed,udaypant,colifran,aws-cdk-automation,dependabot[bot],mergify[bot]]'
+          ignore-usernames: '[RomainMuller,rix0rrr,MrArnoldPalmer,iliapolo,otaviomacedo,madeline-k,kaizencc,comcalvi,corymhall,peterwoodworth,ryparker,TheRealAmazonKendra,vinayak-kukreja,Naumel,mrgrain,pahud,cgarvis,kellertk,HBobertz,sumupitchayan,pattasai,SankyRed,udaypant,colifran,khushail,aws-cdk-automation,dependabot[bot],mergify[bot]]'

.github/workflows/yarn-upgrade.yml

@@ -67,7 +67,7 @@ jobs:
             (cd $(dirname $pj) && ncu --upgrade --reject='constructs,${{ steps.list-packages.outputs.list }}')
           done
           # Upgrade dependencies at an aws-eks integ test docker image
-          cd packages/aws-cdk-lib/aws-eks/test/sdk-call-integ-test-docker-app/app/ && ncu --upgrade --reject=',${{ steps.list-packages.outputs.list }}'
+          cd packages/@aws-cdk-testing/framework-integ/test/aws-eks/test/sdk-call-integ-test-docker-app/app/ && ncu --upgrade --reject=',${{ steps.list-packages.outputs.list }}'
 
       # This will ensure the current lockfile is up-to-date with the dependency specifications (necessary for "yarn upgrade" to run)
       - name: Run "yarn install"

.gitpod.yml

@@ -3,7 +3,7 @@ github:
     pullRequestsFromForks: true
     addComment: true
 
-image: jsii/superchain:1-buster-slim-node16
+image: public.ecr.aws/jsii/superchain:1-buster-slim-node18
 
 tasks:
   - init: |

CHANGELOG.v2.alpha.md

@@ -2,6 +2,18 @@
 
 All notable changes to this project will be documented in this file. See [standard-version](https://github.com/conventional-changelog/standard-version) for commit guidelines.
 
+## [2.80.0-alpha.0](https://github.com/aws/aws-cdk/compare/v2.79.1-alpha.0...v2.80.0-alpha.0) (2023-05-19)
+
+## [2.79.1-alpha.0](https://github.com/aws/aws-cdk/compare/v2.79.0-alpha.0...v2.79.1-alpha.0) (2023-05-11)
+
+## [2.79.0-alpha.0](https://github.com/aws/aws-cdk/compare/v2.78.0-alpha.0...v2.79.0-alpha.0) (2023-05-10)
+
+
+### Bug Fixes
+
+* **servicecatalogappregistry:** Revert deprecated method to keep deprecated method in alpha version ([b20b123](https://github.com/aws/aws-cdk/commit/b20b1f231e12007e7d064cdc4f0c9dc7354827a3))
+* **batch:** JobDefinition's ContainerDefinition's Image is synthesized with `[Object object]` ([#25250](https://github.com/aws/aws-cdk/issues/25250)) ([b3d0d57](https://github.com/aws/aws-cdk/commit/b3d0d570fe02e124f4497e35eb87c96c0eb8a1d5))
+
 ## [2.78.0-alpha.0](https://github.com/aws/aws-cdk/compare/v2.77.0-alpha.0...v2.78.0-alpha.0) (2023-05-03)
 
 ## [2.77.0-alpha.0](https://github.com/aws/aws-cdk/compare/v2.76.0-alpha.0...v2.77.0-alpha.0) (2023-04-26)

CHANGELOG.v2.md

@@ -2,6 +2,58 @@
 
 All notable changes to this project will be documented in this file. See [standard-version](https://github.com/conventional-changelog/standard-version) for commit guidelines.
 
+## [2.80.0](https://github.com/aws/aws-cdk/compare/v2.79.1...v2.80.0) (2023-05-19)
+
+
+### ⚠ BREAKING CHANGES TO EXPERIMENTAL FEATURES
+
+* **eks:** A masters role is no longer provisioned by default. Use the `mastersRole` property to explicitly pass a role that needs cluster access. In addition, the creation role no longer allows any identity (with the appropriate `sts:AssumeRole` permissions) to assume it. 
+
+### Features
+
+* **apigateway:** add grantExecute to API Methods ([#25630](https://github.com/aws/aws-cdk/issues/25630)) ([ecb59fd](https://github.com/aws/aws-cdk/commit/ecb59fda50078e29d579b7b0ee82600f553aec75))
+* **appmesh:** access log format support for app mesh ([#25229](https://github.com/aws/aws-cdk/issues/25229)) ([c4b00be](https://github.com/aws/aws-cdk/commit/c4b00bee9a2ada024c8d838ba083549bc69889f8))
+* **appsync:** Add Private API support when creating a GraphqlApi ([#25569](https://github.com/aws/aws-cdk/issues/25569)) ([d7e263d](https://github.com/aws/aws-cdk/commit/d7e263d5d175f5f189f3ea3d1a5501b975a26281))
+* **cfnspec:** cloudformation spec v122.0.0 ([#25555](https://github.com/aws/aws-cdk/issues/25555)) ([5ccc569](https://github.com/aws/aws-cdk/commit/5ccc56975c323ea19fd0917def51184e13f440d9))
+* **cli:** assets can now depend on stacks ([#25536](https://github.com/aws/aws-cdk/issues/25536)) ([25d5d60](https://github.com/aws/aws-cdk/commit/25d5d60fd0ed852b1817d749b65c68d5279b38a3))
+* **cli:** logging can be corked ([#25644](https://github.com/aws/aws-cdk/issues/25644)) ([0643020](https://github.com/aws/aws-cdk/commit/064302007e902a1521ccc6948a5691cd777afc15)), closes [#25536](https://github.com/aws/aws-cdk/issues/25536)
+* **codepipeline-actions:** add KMSEncryptionKeyARN for S3DeployAction ([#24536](https://github.com/aws/aws-cdk/issues/24536)) ([b60876f](https://github.com/aws/aws-cdk/commit/b60876f7bd973f88e965c7e6204ced11c55c55a3)), closes [#24535](https://github.com/aws/aws-cdk/issues/24535)
+* **eks:** alb controller include versions 2.4.2 - 2.5.1 ([#25330](https://github.com/aws/aws-cdk/issues/25330)) ([83c4c36](https://github.com/aws/aws-cdk/commit/83c4c36e56917be248bdee1bc11516982d50b17a)), closes [#25307](https://github.com/aws/aws-cdk/issues/25307)
+* **msk:** Kafka version 3.4.0 ([#25557](https://github.com/aws/aws-cdk/issues/25557)) ([6317518](https://github.com/aws/aws-cdk/commit/6317518e5d68e5659237b676668fd69bfbd2f42f)), closes [#25522](https://github.com/aws/aws-cdk/issues/25522)
+* **scheduler:** schedule expression construct ([#25422](https://github.com/aws/aws-cdk/issues/25422)) ([97a698e](https://github.com/aws/aws-cdk/commit/97a698ee9e1e47ffb4af5d7d06cd309ddd3a2732))
+
+
+### Bug Fixes
+
+* **bootstrap:** bootstrap doesn't work in non-aws partitions anymore (revert security hub finding fix) ([#25540](https://github.com/aws/aws-cdk/issues/25540)) ([8854739](https://github.com/aws/aws-cdk/commit/8854739a6b4cdd33dc0da3b76b634b5ab151437b)), closes [/github.com/aws/aws-cdk/issues/19380#issuecomment-1512009270](https://github.com/aws//github.com/aws/aws-cdk/issues/19380/issues/issuecomment-1512009270) [#25272](https://github.com/aws/aws-cdk/issues/25272) [#25273](https://github.com/aws/aws-cdk/issues/25273) [#25507](https://github.com/aws/aws-cdk/issues/25507)
+* **eks:** overly permissive trust policies ([#25473](https://github.com/aws/aws-cdk/issues/25473)) ([51f0193](https://github.com/aws/aws-cdk/commit/51f0193bf34cca8254743561a1176e3ca5d83a74)). We would like to thank @twelvemo and @stefreak for reporting this issue.
+
+## [2.79.1](https://github.com/aws/aws-cdk/compare/v2.79.0...v2.79.1) (2023-05-11)
+
+
+### Bug Fixes
+
+* **bootstrap:** bootstrap doesn't work in non-aws partitions anymore (revert security hub finding fix) ([#25272](https://github.com/aws/aws-cdk/issues/25272)) ([4c4014e](https://github.com/aws/aws-cdk/commit/4c4014e0bd3fa90402cfc22971f1cbe5d372642f))
+
+## [2.79.0](https://github.com/aws/aws-cdk/compare/v2.78.0...v2.79.0) (2023-05-10)
+
+
+### Features
+
+* **cfnspec:** cloudformation spec v121.0 ([#25499](https://github.com/aws/aws-cdk/issues/25499)) ([c2ef657](https://github.com/aws/aws-cdk/commit/c2ef6571b7971384a60866b14371f204d30756cd))
+* **ecr:** grantRead on repositories ([#25445](https://github.com/aws/aws-cdk/issues/25445)) ([ce7bdea](https://github.com/aws/aws-cdk/commit/ce7bdea1d1b79de517b2b7ff6d4d73212f8a84c3))
+* **logs:** support DataProtectionPolicy in LogGroup construct ([#23402](https://github.com/aws/aws-cdk/issues/23402)) ([ed3962a](https://github.com/aws/aws-cdk/commit/ed3962af3a7e532d9a4d16fadb5f472dd065b43f)), closes [#23399](https://github.com/aws/aws-cdk/issues/23399)
+
+
+### Bug Fixes
+
+* **batch:** JobDefinition's ContainerDefinition's Image is synthesized with `[Object object]` ([#25466](https://github.com/aws/aws-cdk/issues/25466)) ([b3d0d57](https://github.com/aws/aws-cdk/commit/b3d0d570fe02e124f4497e35eb87c96c0eb8a1d5)), closes [#25250](https://github.com/aws/aws-cdk/issues/25250)
+* **cfn2ts:** doesn't handle property types with the same type as a primitive type ([#25460](https://github.com/aws/aws-cdk/issues/25460)) ([b76c182](https://github.com/aws/aws-cdk/commit/b76c18287ce452f5b5d27af68028e9f6b47d67b5)), closes [aws-cdk/cfnspec/spec-source/specification/000_cfn/000_official/000_AWS_IoT.json#L1437-L1442](https://github.com/aws-cdk/cfnspec/spec-source/specification/000_cfn/000_official/000_AWS_IoT.json/issues/L1437-L1442) [aws-cdk/cfnspec/spec-source/specification/000_cfn/000_official/000_AWS_IoT.json#L1727-L1742](https://github.com/aws-cdk/cfnspec/spec-source/specification/000_cfn/000_official/000_AWS_IoT.json/issues/L1727-L1742) [#22732](https://github.com/aws/aws-cdk/issues/22732)
+* **core:** crossRegionReferences don't work across multiple regions ([#25384](https://github.com/aws/aws-cdk/issues/25384)) ([65265e1](https://github.com/aws/aws-cdk/commit/65265e1297f47a5e8e85ade620095c5af1082290)), closes [#25190](https://github.com/aws/aws-cdk/issues/25190) [#25377](https://github.com/aws/aws-cdk/issues/25377)
+* **dynamodb:** fix hardcoded partition in replica-provider IAM policy ([#25428](https://github.com/aws/aws-cdk/issues/25428)) ([b5b4f66](https://github.com/aws/aws-cdk/commit/b5b4f66396cdc1fae3887f82509d30c4c4c6f6d4)), closes [#25407](https://github.com/aws/aws-cdk/issues/25407)
+* **elasticloadbalancingv2:** ALB auth return internal server error ([#24510](https://github.com/aws/aws-cdk/issues/24510)) ([75212eb](https://github.com/aws/aws-cdk/commit/75212ebc7a30d822097223ea39a0d58da6fe8d43)), closes [#21939](https://github.com/aws/aws-cdk/issues/21939) [#19035](https://github.com/aws/aws-cdk/issues/19035) [#18944](https://github.com/aws/aws-cdk/issues/18944)
+* **servicecatalogappregistry:** Revert deprecated method removing PR to keep deprecated method in alpha version ([#25454](https://github.com/aws/aws-cdk/issues/25454)) ([b20b1f2](https://github.com/aws/aws-cdk/commit/b20b1f231e12007e7d064cdc4f0c9dc7354827a3))
+
 ## [2.78.0](https://github.com/aws/aws-cdk/compare/v2.77.0...v2.78.0) (2023-05-03)
 
 

build.sh

@@ -8,6 +8,7 @@ check_prereqs="true"
 check_compat="true"
 ci="false"
 scope=""
+concurrency=""
 while [[ "${1:-}" != "" ]]; do
     case $1 in
         -h|--help)
@@ -32,6 +33,10 @@ while [[ "${1:-}" != "" ]]; do
         --ci)
           ci=true
           ;;
+        -c|--concurrency)
+            concurrency="$2"
+            shift
+            ;;
         *)
             echo "Unrecognized parameter: $1"
             exit 1
@@ -93,8 +98,14 @@ if [ "$run_tests" == "true" ]; then
     runtarget="$runtarget,test"
 fi
 
-# Limit top-level concurrency to available CPUs - 1 to limit CPU load.
-concurrency=$(node -p 'Math.max(1, require("os").cpus().length - 1)')
+if [[ "$concurrency" == "" ]]; then
+    # Auto-limit top-level concurrency to:
+    # - available CPUs - 1 to limit CPU load
+    # - total memory / 4GB  (N.B: constant here may need to be tweaked, configurable with $CDKBUILD_MEM_PER_PROCESS)
+    mem_per_process=${CDKBUILD_MEM_PER_PROCESS:-4_000_000_000}
+    concurrency=$(node -p "Math.max(1, Math.min(require('os').cpus().length - 1, Math.round(require('os').totalmem() / $mem_per_process)))")
+    echo "Concurrency: $concurrency"
+fi
 
 flags=""
 if [ "$ci" == "true" ]; then

docs/DESIGN_GUIDELINES.md

@@ -1523,6 +1523,27 @@ information that can be obtained from the stack trace.
 
 * Do not use FnSub
 
+### Lazys
+
+Do not use a `Lazy` to perform a mutation on the construct tree. For example:
+
+```ts
+constructor(scope: Scope, id: string, props: MyConstructProps) {
+  this.lazyProperty = Lazy.any({
+    produce: () => {
+      return props.logging.bind(this, this);
+    },
+  });
+}
+```
+
+`bind()` methods mutate the construct tree, and should not be called from a callback
+in a `Lazy`.
+
+* The why:
+ - `Lazy`s are called after the construct tree has already been sythesized. Mutating it
+ at this point could have not-obvious consequences.
+
 ## Documentation
 
 Documentation style (copy from official AWS docs) No need to Capitalize Resource

pack.sh

@@ -107,9 +107,3 @@ if find dist/ | grep -F "${marker}"; then
   echo "This is expected for builds in a development environment but should not happen in CI builds!"
   exit 1
 fi
-
-# for posterity, print all files in dist
-echo "=============================================================================================="
-echo " dist contents"
-echo "=============================================================================================="
-find dist/

package.json

@@ -15,22 +15,22 @@
     "build-all": "tsc -b"
   },
   "devDependencies": {
-    "@nrwl/cli": "^15.9.1",
-    "@nrwl/workspace": "^15.9.1",
+    "@nrwl/cli": "^15.9.4",
+    "@nrwl/workspace": "^15.9.4",
     "@types/node": "18.11.19",
     "@types/prettier": "2.6.0",
     "@yarnpkg/lockfile": "^1.1.0",
-    "cdk-generate-synthetic-examples": "^0.1.173",
+    "cdk-generate-synthetic-examples": "^0.1.244",
     "conventional-changelog-cli": "^2.2.2",
     "fs-extra": "^9.1.0",
-    "graceful-fs": "^4.2.10",
+    "graceful-fs": "^4.2.11",
     "jest-junit": "^13.2.0",
-    "jsii-diff": "1.78.1",
-    "jsii-pacmak": "1.78.1",
-    "jsii-reflect": "1.78.1",
-    "jsii-rosetta": "~5.0.7",
+    "jsii-diff": "1.81.0",
+    "jsii-pacmak": "1.81.0",
+    "jsii-reflect": "1.81.0",
+    "jsii-rosetta": "~5.0.8",
     "lerna": "^6.6.1",
-    "nx": "^15.9.1",
+    "nx": "^15.9.4",
     "patch-package": "^6.5.1",
     "semver": "^6.3.0",
     "standard-version": "^9.5.0",

packages/@aws-cdk-testing/cli-integ/lib/aws.ts

@@ -185,7 +185,6 @@ type AwsCallIO<T> =
 type First<T> = T extends [any, any] ? T[0] : never;
 type Second<T> = T extends [any, any] ? T[1] : never;
 
-
 export function isStackMissingError(e: Error) {
   return e.message.indexOf('does not exist') > -1;
 }

packages/@aws-cdk-testing/cli-integ/lib/files.ts

@@ -45,7 +45,6 @@ export function findUp(name: string, directory: string = process.cwd()): string
   return findUp(name, path.dirname(absoluteDirectory));
 }
 
-
 /**
  * Docker-safe home directory
  */

packages/@aws-cdk-testing/cli-integ/lib/staging/parallel-shell.ts

@@ -2,7 +2,6 @@ import PQueue from 'p-queue';
 import { sleep } from '../aws';
 import { MemoryStream } from '../corking';
 
-
 export type ErrorResponse = 'fail' | 'skip' | 'retry';
 
 /**

packages/@aws-cdk-testing/cli-integ/lib/with-sam.ts

@@ -10,7 +10,6 @@ import { AwsContext, withAws } from './with-aws';
 import { cloneDirectory, installNpmPackages, TestFixture, DEFAULT_TEST_TIMEOUT_S } from './with-cdk-app';
 import { withTimeout } from './with-timeout';
 
-
 export interface ActionOutput {
   actionSucceeded?: boolean;
   actionOutput?: any;

packages/@aws-cdk-testing/cli-integ/package.json

@@ -30,7 +30,7 @@
   "license": "Apache-2.0",
   "devDependencies": {
     "@aws-cdk/cdk-build-tools": "0.0.0",
-    "@types/semver": "^7.3.13",
+    "@types/semver": "^7.5.0",
     "@types/yargs": "^15.0.15",
     "@types/fs-extra": "^9.0.13",
     "@types/glob": "^7.2.0",
@@ -39,7 +39,7 @@
   },
   "dependencies": {
     "@octokit/rest": "^18.12.0",
-    "aws-sdk": "^2.1329.0",
+    "aws-sdk": "^2.1379.0",
     "axios": "^0.27.2",
     "fs-extra": "^9.1.0",
     "glob": "^7.2.3",
@@ -48,10 +48,10 @@
     "make-runnable": "^1.4.1",
     "npm": "^8.19.4",
     "p-queue": "^6.6.2",
-    "semver": "^7.3.8",
+    "semver": "^7.5.1",
     "ts-mock-imports": "^1.3.8",
     "yaml": "1.10.2",
-    "yargs": "^17.7.1"
+    "yargs": "^17.7.2"
   },
   "repository": {
     "url": "https://github.com/aws/aws-cdk.git",

packages/@aws-cdk-testing/cli-integ/test/xpmutex.test.ts

@@ -30,7 +30,6 @@ test('acquire waits', async () => {
   await secondProcess;
 });
 
-
 /**
  * Poll for some condition every 10ms
  */

packages/@aws-cdk-testing/cli-integ/tests/init-csharp/init-csharp.integtest.ts

@@ -13,4 +13,3 @@ import { integTest, withTemporaryDirectory, ShellHelper, withPackages } from '..
   })));
 });
 
-

packages/@aws-cdk-testing/framework-integ/package.json

@@ -37,12 +37,12 @@
   },
   "dependencies": {
     "@aws-cdk/integ-tests-alpha": "0.0.0",
-    "@aws-cdk/lambda-layer-kubectl-v24": "^2.0.100",
+    "@aws-cdk/lambda-layer-kubectl-v24": "^2.0.195",
     "aws-cdk-lib": "0.0.0",
-    "aws-sdk": "^2.1317.0",
+    "aws-sdk": "^2.1379.0",
     "aws-sdk-mock": "5.6.0",
-    "cdk8s": "^2.7.15",
-    "cdk8s-plus-24": "2.4.40",
+    "cdk8s": "^2.7.68",
+    "cdk8s-plus-24": "2.7.31",
     "constructs": "^10.0.0"
   },
   "repository": {

packages/@aws-cdk-testing/framework-integ/test/aws-apigateway/test/authorizers/integ.token-authorizer.ts

@@ -27,7 +27,6 @@ const restapi = new RestApi(stack, 'MyRestApi', {
   },
 });
 
-
 restapi.root.addMethod('ANY', new MockIntegration({
   integrationResponses: [
     { statusCode: '200' },

packages/@aws-cdk-testing/framework-integ/test/aws-apigateway/test/integ.domain-name.ts

@@ -92,7 +92,6 @@ const api2 = new Api(testCase, 'IntegApi2', {
   path: 'items',
 });
 
-
 /**
  * Test 1
  *
@@ -151,7 +150,6 @@ secondDomain.addApiMapping(api2.restApi.deploymentStage, {
   basePath: 'orders/v2',
 });
 
-
 /**
  * Test 3
  *
@@ -177,7 +175,6 @@ thirdDomain.addBasePathMapping(api2.restApi, {
   basePath: 'v2',
 });
 
-
 /**
  * -------------------------------------------------------
  * ------------------------- THEN ------------------------