diff --git a/.dependabot/config.yml b/.dependabot/config.yml
index c26adc9528af4..df04c1e8e14c4 100644
--- a/.dependabot/config.yml
+++ b/.dependabot/config.yml
@@ -10,6 +10,6 @@ update_configs:
       - match:
           # Don't suggest upgrading @types/node to versions >= 9
           dependency_name: '@types/node'
-          version_requirement: '>= 9'
+          version_requirement: '>= 11'
     version_requirement_updates: increase_versions
     default_labels: []
diff --git a/.mergify.yml b/.mergify.yml
index 234106f399ccb..2b51d67130607 100644
--- a/.mergify.yml
+++ b/.mergify.yml
@@ -1,6 +1,13 @@
 # See https://doc.mergify.io
 
 pull_request_rules:
+  - name: label core
+    actions:
+      label:
+        add: [ contribution/core ]
+    conditions:
+      - author=(eladb|RomainMuller|garnaat|nija-at|shivlaks|skinny85|rix0rrr|NGL321|Jerry-AWS|SomayaB)
+      - -label~="contribution/core"
   - name: automatic merge
     actions:
       comment:
@@ -11,8 +18,6 @@ pull_request_rules:
         strict_method: merge
       delete_head_branch: {}
     conditions:
-      - author!=dependabot[bot]
-      - author!=dependabot-preview[bot]
       - -title~=(WIP|wip)
       - -label~=(blocked|do-not-merge)
       - -merged
diff --git a/CHANGELOG.md b/CHANGELOG.md
index 0e1ca718724d1..b30b264444b26 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -2,6 +2,74 @@
 
 All notable changes to this project will be documented in this file. See [standard-version](https://github.com/conventional-changelog/standard-version) for commit guidelines.
 
+## [1.15.0](https://github.com/aws/aws-cdk/compare/v1.14.0...v1.15.0) (2019-10-28)
+
+
+### ⚠ BREAKING CHANGES
+
+* **rds:** `securityGroup: ec2.ISecurityGroup` is now `securityGroups: ec2.ISecurityGroup[]` in `DatabaseInstanceAttributes`
+* **rds:** removed `securityGroupId` from `IDatabaseInstance`
+
+### Bug Fixes
+
+* **acm:** update CertificateRequestorFunction runtime ([#4612](https://github.com/aws/aws-cdk/issues/4612)) ([a711425](https://github.com/aws/aws-cdk/commit/a711425)), closes [#4610](https://github.com/aws/aws-cdk/issues/4610)
+* **assets:** docker asset versions are pushed to separate repositories ([#4537](https://github.com/aws/aws-cdk/issues/4537)) ([8484114](https://github.com/aws/aws-cdk/commit/8484114)), closes [#4535](https://github.com/aws/aws-cdk/issues/4535)
+* **aws-lambda:** update deprecation warning for node.js 8.10 ([#4624](https://github.com/aws/aws-cdk/issues/4624)) ([ace8041](https://github.com/aws/aws-cdk/commit/ace8041))
+* **cli:** add Cloud Assembly backwards compat tests ([#4625](https://github.com/aws/aws-cdk/issues/4625)) ([5d2e5e3](https://github.com/aws/aws-cdk/commit/5d2e5e3)), closes [#4475](https://github.com/aws/aws-cdk/issues/4475) [#4544](https://github.com/aws/aws-cdk/issues/4544)
+* **cloudformation:** cannot reference resource attributes with "." in nested stacks ([#4684](https://github.com/aws/aws-cdk/issues/4684)) ([561bb73](https://github.com/aws/aws-cdk/commit/561bb73))
+* **codebuild:** revert validation that only a project with source CODEPIPELINE can be added to a pipeline ([#4689](https://github.com/aws/aws-cdk/issues/4689)) ([8e72720](https://github.com/aws/aws-cdk/commit/8e72720)), closes [#4646](https://github.com/aws/aws-cdk/issues/4646)
+* **codepipeline:** the CodeBuild action now works with imported projects ([#4637](https://github.com/aws/aws-cdk/issues/4637)) ([6c4085e](https://github.com/aws/aws-cdk/commit/6c4085e)), closes [#4613](https://github.com/aws/aws-cdk/issues/4613)
+* **core:** fix docs for CfnInclude ([#4703](https://github.com/aws/aws-cdk/issues/4703)) ([ba38b76](https://github.com/aws/aws-cdk/commit/ba38b76)), closes [#3424](https://github.com/aws/aws-cdk/issues/3424)
+* **core:** removalpolicy correct default ([#4499](https://github.com/aws/aws-cdk/issues/4499)) ([09d89c3](https://github.com/aws/aws-cdk/commit/09d89c3)), closes [#4416](https://github.com/aws/aws-cdk/issues/4416)
+* **custom-resources:** increase and expose timeout for AwsCustomResource ([#4623](https://github.com/aws/aws-cdk/issues/4623)) ([f17f809](https://github.com/aws/aws-cdk/commit/f17f809)), closes [#3272](https://github.com/aws/aws-cdk/issues/3272)
+* **eks:** cannot update cluster configuration ([#4696](https://github.com/aws/aws-cdk/issues/4696)) ([e17ba55](https://github.com/aws/aws-cdk/commit/e17ba55)), closes [#4311](https://github.com/aws/aws-cdk/issues/4311) [#4310](https://github.com/aws/aws-cdk/issues/4310)
+* **elbv2:** fix disabling proxy protocol v2 attribute for NetworkTargetGroup ([#4596](https://github.com/aws/aws-cdk/issues/4596)) ([8b598c4](https://github.com/aws/aws-cdk/commit/8b598c4)), closes [#4574](https://github.com/aws/aws-cdk/issues/4574)
+* **iam:** fix `managedPolicyName`, cross-account references ([#4630](https://github.com/aws/aws-cdk/issues/4630)) ([9b7d2d0](https://github.com/aws/aws-cdk/commit/9b7d2d0)), closes [#4581](https://github.com/aws/aws-cdk/issues/4581) [#4567](https://github.com/aws/aws-cdk/issues/4567)
+* **ssm:** invalid parameter arn ([#4685](https://github.com/aws/aws-cdk/issues/4685)) ([e26a36c](https://github.com/aws/aws-cdk/commit/e26a36c)), closes [#4672](https://github.com/aws/aws-cdk/issues/4672)
+
+
+### Features
+
+* **apigateway:** add convenience url property at resource level ([#4686](https://github.com/aws/aws-cdk/issues/4686)) ([012eeed](https://github.com/aws/aws-cdk/commit/012eeed))
+* **autoscaling:** let AutoScalingGroup be IGrantable ([#4654](https://github.com/aws/aws-cdk/issues/4654)) ([406dc8e](https://github.com/aws/aws-cdk/commit/406dc8e))
+* **cloudfront:** complete viewerCertificate support ([#4579](https://github.com/aws/aws-cdk/issues/4579)) ([80b4ac9](https://github.com/aws/aws-cdk/commit/80b4ac9))
+* **codedeploy:** Model ECS deployment resources and pipeline action ([#4600](https://github.com/aws/aws-cdk/issues/4600)) ([ed639ca](https://github.com/aws/aws-cdk/commit/ed639ca))
+* **codepipeline:** add ability to override env variables in CodeBuild actions ([#4502](https://github.com/aws/aws-cdk/issues/4502)) ([c0c0513](https://github.com/aws/aws-cdk/commit/c0c0513)), closes [#4531](https://github.com/aws/aws-cdk/issues/4531)
+* **ec2:** Support explicit Subnet selection ([#4622](https://github.com/aws/aws-cdk/issues/4622)) ([203a605](https://github.com/aws/aws-cdk/commit/203a605))
+* **ecs:** add support for start and stop timeout in ContainerDefinition ([#4638](https://github.com/aws/aws-cdk/issues/4638)) ([b00c0af](https://github.com/aws/aws-cdk/commit/b00c0af))
+* **ecs-patterns:** add family name to load balanced service properties ([#4688](https://github.com/aws/aws-cdk/issues/4688)) ([d7654e7](https://github.com/aws/aws-cdk/commit/d7654e7))
+* **ecs-patterns:** add service name to queue processing service properties ([#4505](https://github.com/aws/aws-cdk/issues/4505)) ([3202720](https://github.com/aws/aws-cdk/commit/3202720)), closes [#4504](https://github.com/aws/aws-cdk/issues/4504) [#4504](https://github.com/aws/aws-cdk/issues/4504)
+* **rds:** allow using existing security groups for new instance ([#4495](https://github.com/aws/aws-cdk/issues/4495)) ([ef1ce5e](https://github.com/aws/aws-cdk/commit/ef1ce5e)), closes [#2949](https://github.com/aws/aws-cdk/issues/2949)
+* **vpc:** additional validation around Subnet Types ([#4668](https://github.com/aws/aws-cdk/issues/4668)) ([9a96c37](https://github.com/aws/aws-cdk/commit/9a96c37)), closes [#3704](https://github.com/aws/aws-cdk/issues/3704)
+
+## [1.14.0](https://github.com/aws/aws-cdk/compare/v1.13.1...v1.14.0) (2019-10-22)
+
+**NOTICE**: since Node.js 8.x is going out of maintenance [early next year](https://nodejs.org/en/about/releases), starting in the next release, we will only test the AWS CDK against Node.js 10.x. If you are using an older version of Node.js, we recommend to [upgrade](https://nodejs.org/en/).
+
+### Bug Fixes
+
+* **apigateway:** deployment not invalidated when integration is changed ([#4552](https://github.com/aws/aws-cdk/issues/4552)) ([eac7695](https://github.com/aws/aws-cdk/commit/eac7695)), closes [#4551](https://github.com/aws/aws-cdk/issues/4551) [aws-samples/aws-cdk-intro-workshop#83](https://github.com/aws-samples/aws-cdk-intro-workshop/issues/83)
+* **cli:** patch security vulnerability in https-proxy-agent (npm advisory 1184) ([#4603](https://github.com/aws/aws-cdk/issues/4603)) ([ddb05f9](https://github.com/aws/aws-cdk/commit/ddb05f9))
+* **cli:** upgrade proxy-agent to address security volnarability ([#4618](https://github.com/aws/aws-cdk/issues/4618)) ([5a941a2](https://github.com/aws/aws-cdk/commit/5a941a2))
+* **cloudfront:** expose CfnDistribution as defaultChild ([#4556](https://github.com/aws/aws-cdk/issues/4556)) ([8a79cad](https://github.com/aws/aws-cdk/commit/8a79cad))
+* **codepipeline:** work around CodeBuild's pipeline key bug ([#4183](https://github.com/aws/aws-cdk/issues/4183)) ([b149b02](https://github.com/aws/aws-cdk/commit/b149b02)), closes [#4033](https://github.com/aws/aws-cdk/issues/4033)
+* **core:** child stack assembly metadata is duplidated on parent ([#4540](https://github.com/aws/aws-cdk/issues/4540)) ([eeb5ae9](https://github.com/aws/aws-cdk/commit/eeb5ae9)), closes [#2900](https://github.com/aws/aws-cdk/issues/2900)
+* **eks:** invalid arn when mapping users to rbac ([#4549](https://github.com/aws/aws-cdk/issues/4549)) ([8f4a38d](https://github.com/aws/aws-cdk/commit/8f4a38d)), closes [#4545](https://github.com/aws/aws-cdk/issues/4545)
+* **elbv2:** correct wrong invalidation rules ([#4583](https://github.com/aws/aws-cdk/issues/4583)) ([5f50e5f](https://github.com/aws/aws-cdk/commit/5f50e5f))
+* **region-info:** add eu-west-1 to AWS_OLDER_REGIONS ([#4584](https://github.com/aws/aws-cdk/issues/4584)) ([7055ee3](https://github.com/aws/aws-cdk/commit/7055ee3))
+* **s3:** access denied when adding an event notification to a s3 bucket ([#4219](https://github.com/aws/aws-cdk/issues/4219)) ([6f22446](https://github.com/aws/aws-cdk/commit/6f22446)), closes [#3318](https://github.com/aws/aws-cdk/issues/3318)
+* **s3:** bucket notifications deleted during stack update ([#4458](https://github.com/aws/aws-cdk/issues/4458)) ([f5daa6e](https://github.com/aws/aws-cdk/commit/f5daa6e)), closes [#1566](https://github.com/aws/aws-cdk/issues/1566)
+* **ssm:** allow specifying encryption key ([#4511](https://github.com/aws/aws-cdk/issues/4511)) ([02a447f](https://github.com/aws/aws-cdk/commit/02a447f)), closes [#4498](https://github.com/aws/aws-cdk/issues/4498)
+* **stepfunctions:** map state validation fix ([#4382](https://github.com/aws/aws-cdk/issues/4382)) ([bbe0380](https://github.com/aws/aws-cdk/commit/bbe0380))
+* **stepfunctions-tasks:** update resourceArn in service integrations ([#4598](https://github.com/aws/aws-cdk/issues/4598)) ([b0f8a74](https://github.com/aws/aws-cdk/commit/b0f8a74)), closes [#4597](https://github.com/aws/aws-cdk/issues/4597)
+
+
+### Features
+
+* **apigateway:** cors preflight support ([#4211](https://github.com/aws/aws-cdk/issues/4211)) ([0f06223](https://github.com/aws/aws-cdk/commit/0f06223))
+* **ec2:** mutable? param for imported SecurityGroups ([#4493](https://github.com/aws/aws-cdk/issues/4493)) ([9764996](https://github.com/aws/aws-cdk/commit/9764996))
+* **ecs-patterns:** add family name to queue processing service properties ([#4508](https://github.com/aws/aws-cdk/issues/4508)) ([b0874bb](https://github.com/aws/aws-cdk/commit/b0874bb)), closes [#4507](https://github.com/aws/aws-cdk/issues/4507)
+
 ## [1.13.1](https://github.com/aws/aws-cdk/compare/v1.13.0...v1.13.1) (2019-10-15)
 
 
@@ -27,7 +95,7 @@ All notable changes to this project will be documented in this file. See [standa
 ### Features
 
 * **aws-s3-deployment:** support specifying objects metadata ([#4288](https://github.com/aws/aws-cdk/issues/4288)) ([63cb2da](https://github.com/aws/aws-cdk/commit/63cb2da))
-* **cli:** add tags to CDKToolkit stack through bootstrap cli command ([#4320](https://github.com/aws/aws-cdk/issues/4320)) ([4284aa2](https://github.com/aws/aws-cdk/commit/4284aa2)), closes [#4227](https://github.com/aws/aws-cdk/issues/4227) [#4227](https://github.com/aws/aws-cdk/issues/4227) [#4227](https://github.com/aws/aws-cdk/issues/4227) [#4227](https://github.com/aws/aws-cdk/issues/4227) [#4227](https://github.com/aws/aws-cdk/issues/4227) [#4227](https://github.com/aws/aws-cdk/issues/4227) [#4227](https://github.com/aws/aws-cdk/issues/4227)
+* **cli:** add tags to CDKToolkit stack through bootstrap cli command ([#4320](https://github.com/aws/aws-cdk/issues/4320)) ([4284aa2](https://github.com/aws/aws-cdk/commit/4284aa2)), closes [#4227](https://github.com/aws/aws-cdk/issues/4227)
 * **cli:** notify option in deploy command to specify SNS Notification ARNs ([#4420](https://github.com/aws/aws-cdk/issues/4420)) ([7d6b474](https://github.com/aws/aws-cdk/commit/7d6b474)), closes [#2528](https://github.com/aws/aws-cdk/issues/2528)
 * **codepipeline:** support cross-environment deployments for all actions ([#4276](https://github.com/aws/aws-cdk/issues/4276)) ([1eebf92](https://github.com/aws/aws-cdk/commit/1eebf92)), closes [#3389](https://github.com/aws/aws-cdk/issues/3389)
 * **core:** Add ability to set stack description ([#4457](https://github.com/aws/aws-cdk/issues/4457)) ([#4477](https://github.com/aws/aws-cdk/issues/4477)) ([443394c](https://github.com/aws/aws-cdk/commit/443394c))
diff --git a/MANUAL_INSTALLATION.md b/MANUAL_INSTALLATION.md
index 43a2ffc4d60d1..036c4dce40305 100644
--- a/MANUAL_INSTALLATION.md
+++ b/MANUAL_INSTALLATION.md
@@ -1,11 +1,7 @@
 # CDK Manual Installation Instructions
 
-The CDK is also distributed as a single zip file which contains:
-
-1. The CDK command-line toolkit
-2. Documentation HTML
-2. JavaScript/TypeScript Framework and AWS Constructs
-3. Java Framework and AWS Constructs
+The CDK is also distributed as a single zip file which contains the
+same packages that we also publish to the various package managers.
 
 You can download the zip file from the
 [Releases](http://github.com/aws/aws-cdk/releases) page on GitHub.
@@ -15,62 +11,55 @@ can be verified (see below).
 
 ## Installation overview
 
-We recommend you extract the package to `~/.cdk`, and use the binaries from `~/.cdk/bin`.
+After extracting the archive, follow the following instructions:
 
-When using the manual installation method, use the command `y-npm` (provided
-with the distribution) wherever you would normally use `npm`.
+### Installing the CLI
 
-## Step by step instructions
+The CLI (the `cdk` command) is always installed using npm, regardless of your language.
 
-### Extract the installation archive to ~/.cdk
+```
+npm install -g /path/to/zip/js/aws-cdk-1.2.3.tgz
+```
 
-Once you've downloaded the bits, install them into `~/.cdk` and add to your `PATH`:
+### TypeScript/JavaScript (npm)
 
-#### Linux/MacOS (bash/zsh)
+Run `npm install` on the desired tarballs:
 
-```shell
-# Unpack to ~/.cdk
-rm -fr ~/.cdk
-mkdir ~/.cdk
-unzip <path-to-zip-file> -d ~/.cdk
-
-# Add to PATH and reload profile
-echo 'PATH=$PATH:$HOME/.cdk/bin' >> ~/.bashrc && source ~/.bashrc  # for bash
-echo 'PATH=$PATH:$HOME/.cdk/bin' >> ~/.zshrc && source ~/.zshrc    # for zsh
+```
+# Install individual packages into your current project
+npm install /path/to/zip/js/aws-lambda@1.2.3.jsii.tgz ...
 ```
 
-#### Windows (PowerShell)
-
-Open an elevated PowerShell terminal ("Run as Administrator"):
+### Python (pip)
 
-```powershell
-# Unpack to ~/.cdk
-Remove-Item -Force -Recurse ~/.cdk
-New-Item -Type Directory ~/.cdk
-Expand-Archive -Path <path-to-zip-file> -DestinationPath ~/.cdk
+Run `pip install` on the `.whl` files you want to install into your current virtual
+env (or the global Python install):
 
-# Add to PATH and reload profile
-New-Item -Force -ItemType Directory -Path (Split-Path $PROFILE)
-Add-Content -Path $PROFILE -Value '$env:Path = "$env:Path;$env:UserProfile\.cdk\node_modules\.bin"'
-Set-ExecutionPolicy Unrestricted
-& $PROFILE
+```
+# Install all wheels into your current Python env
+pip install path/to/zip/python/*.whl
 ```
 
-#### Install the command-line toolkit
+### Java (Maven)
 
-Install (or update) `aws-cdk` globally
+Install the packages using Maven:
 
-```shell
-y-npm install --global aws-cdk # sudo might be needed
+```
+# For every package you want to install
+mvn install:install-file -Dfile=/path/to/zip/java/software/amazon/awscdk/dynamodb/1.2.3/dynamodb-1.2.3.jar
+mvn install:install-file -Dfile=/path/to/zip/java/software/amazon/awscdk/dynamodb/1.2.3/dynamodb-1.2.3-sources.jar
+mvn install:install-file -Dfile=/path/to/zip/java/software/amazon/awscdk/dynamodb/1.2.3/dynamodb-1.2.3-javadoc.jar
 ```
 
-> `y-npm` is an npm wrapper which allows installing npm modules from a local repository located at `~/.cdk/y/npm`. `y-npm` will fall back to the public npm repository if a module cannot be found locally.
+### .NET (NuGet)
 
-To check which CDK version you have installed:
+From a NuGet shell:
 
-```shell
-cdk --version
 ```
+# For every package you want to install
+Install-Package C:\Path\To\Zip\dotnet\Amazon.CDK.AWS.Events.1.2.3.nupkg
+```
+
 
 ## Verifying the integrity of your download
 
diff --git a/bump.sh b/bump.sh
index 549bd91cbefa1..1a2d6a7fdf72e 100755
--- a/bump.sh
+++ b/bump.sh
@@ -21,7 +21,7 @@ export NODE_OPTIONS="--max-old-space-size=4096 ${NODE_OPTIONS:-}"
 
 /bin/bash ./install.sh
 
-npx lerna version ${version} --exact --force-publish=* --no-git-tag-version --no-push
+npx lerna version ${version} --yes --exact --force-publish=* --no-git-tag-version --no-push
 
 # Another round of install to fix package-lock.jsons
 /bin/bash ./install.sh
@@ -31,4 +31,4 @@ npx lerna version ${version} --exact --force-publish=* --no-git-tag-version --no
 /bin/bash scripts/fix-peer-deps.sh
 
 # Generate CHANGELOG and create a commit
-npx standard-version --release --skip.tag=true --commit-all
\ No newline at end of file
+npx standard-version --release --skip.tag=true --commit-all
diff --git a/lerna.json b/lerna.json
index 4dd3844d80f2f..b6811b974029f 100644
--- a/lerna.json
+++ b/lerna.json
@@ -9,5 +9,5 @@
     "tools/*"
   ],
   "rejectCycles": "true",
-  "version": "1.13.1"
+  "version": "1.15.0"
 }
diff --git a/package.json b/package.json
index a9b04336c37c5..36d682bf7978c 100644
--- a/package.json
+++ b/package.json
@@ -1,6 +1,6 @@
 {
   "name": "aws-cdk",
-  "version": "1.13.1",
+  "version": "1.15.0",
   "private": true,
   "pkglint": {
     "include": "dependencies/node-version"
@@ -11,13 +11,13 @@
   },
   "devDependencies": {
     "@types/jest": "^24.0.19",
-    "@types/node": "^8.10.55",
+    "@types/node": "^8.10.56",
     "@types/nodeunit": "^0.0.30",
     "conventional-changelog-cli": "^2.0.25",
     "fs-extra": "^8.1.0",
     "jest": "^24.9.0",
     "jsii-diff": "^0.19.0",
-    "lerna": "^3.18.1",
+    "lerna": "^3.18.3",
     "nodeunit": "^0.11.3",
     "nyc": "^14.1.1",
     "standard-version": "^7.0.0",
diff --git a/packages/@aws-cdk/alexa-ask/package.json b/packages/@aws-cdk/alexa-ask/package.json
index 503cc94ce2365..98a22796126ef 100644
--- a/packages/@aws-cdk/alexa-ask/package.json
+++ b/packages/@aws-cdk/alexa-ask/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@aws-cdk/alexa-ask",
-  "version": "1.13.1",
+  "version": "1.15.0",
   "description": "The CDK Construct Library for Alexa::ASK",
   "main": "lib/index.js",
   "types": "lib/index.d.ts",
@@ -64,16 +64,16 @@
   },
   "license": "Apache-2.0",
   "devDependencies": {
-    "@aws-cdk/assert": "1.13.1",
-    "cdk-build-tools": "^1.13.1",
-    "cfn2ts": "^1.13.1",
-    "pkglint": "^1.13.1"
+    "@aws-cdk/assert": "1.15.0",
+    "cdk-build-tools": "^1.15.0",
+    "cfn2ts": "^1.15.0",
+    "pkglint": "^1.15.0"
   },
   "dependencies": {
-    "@aws-cdk/core": "1.13.1"
+    "@aws-cdk/core": "1.15.0"
   },
   "peerDependencies": {
-    "@aws-cdk/core": "1.13.1"
+    "@aws-cdk/core": "1.15.0"
   },
   "engines": {
     "node": ">= 10.3.0"
diff --git a/packages/@aws-cdk/app-delivery/package.json b/packages/@aws-cdk/app-delivery/package.json
index 1b2d7dbb75e55..f9581f512d7e2 100644
--- a/packages/@aws-cdk/app-delivery/package.json
+++ b/packages/@aws-cdk/app-delivery/package.json
@@ -1,7 +1,7 @@
 {
   "name": "@aws-cdk/app-delivery",
   "description": "Continuous Integration / Continuous Delivery for CDK Applications",
-  "version": "1.13.1",
+  "version": "1.15.0",
   "main": "lib/index.js",
   "types": "lib/index.d.ts",
   "jsii": {
@@ -41,22 +41,22 @@
     "build+test": "npm run build && npm test"
   },
   "dependencies": {
-    "@aws-cdk/aws-cloudformation": "1.13.1",
-    "@aws-cdk/aws-codebuild": "1.13.1",
-    "@aws-cdk/aws-codepipeline": "1.13.1",
-    "@aws-cdk/aws-codepipeline-actions": "1.13.1",
-    "@aws-cdk/aws-events": "1.13.1",
-    "@aws-cdk/aws-iam": "1.13.1",
-    "@aws-cdk/core": "1.13.1",
-    "@aws-cdk/cx-api": "1.13.1"
+    "@aws-cdk/aws-cloudformation": "1.15.0",
+    "@aws-cdk/aws-codebuild": "1.15.0",
+    "@aws-cdk/aws-codepipeline": "1.15.0",
+    "@aws-cdk/aws-codepipeline-actions": "1.15.0",
+    "@aws-cdk/aws-events": "1.15.0",
+    "@aws-cdk/aws-iam": "1.15.0",
+    "@aws-cdk/core": "1.15.0",
+    "@aws-cdk/cx-api": "1.15.0"
   },
   "devDependencies": {
-    "@aws-cdk/assert": "1.13.1",
-    "@aws-cdk/aws-s3": "1.13.1",
-    "cdk-build-tools": "^1.13.1",
-    "cdk-integ-tools": "^1.13.1",
-    "fast-check": "^1.17.0",
-    "pkglint": "^1.13.1"
+    "@aws-cdk/assert": "1.15.0",
+    "@aws-cdk/aws-s3": "1.15.0",
+    "cdk-build-tools": "^1.15.0",
+    "cdk-integ-tools": "^1.15.0",
+    "fast-check": "^1.18.1",
+    "pkglint": "^1.15.0"
   },
   "repository": {
     "type": "git",
@@ -75,17 +75,26 @@
     "cdk"
   ],
   "peerDependencies": {
-    "@aws-cdk/aws-cloudformation": "1.13.1",
-    "@aws-cdk/aws-codebuild": "1.13.1",
-    "@aws-cdk/aws-codepipeline": "1.13.1",
-    "@aws-cdk/aws-codepipeline-actions": "1.13.1",
-    "@aws-cdk/aws-events": "1.13.1",
-    "@aws-cdk/aws-iam": "1.13.1",
-    "@aws-cdk/core": "1.13.1",
-    "@aws-cdk/cx-api": "1.13.1"
+    "@aws-cdk/aws-cloudformation": "1.15.0",
+    "@aws-cdk/aws-codebuild": "1.15.0",
+    "@aws-cdk/aws-codepipeline": "1.15.0",
+    "@aws-cdk/aws-codepipeline-actions": "1.15.0",
+    "@aws-cdk/aws-events": "1.15.0",
+    "@aws-cdk/aws-iam": "1.15.0",
+    "@aws-cdk/core": "1.15.0",
+    "@aws-cdk/cx-api": "1.15.0"
   },
   "engines": {
     "node": ">= 10.3.0"
   },
-  "stability": "experimental"
+  "stability": "experimental",
+  "awslint": {
+    "exclude": [
+      "docs-public-apis:@aws-cdk/app-delivery.PipelineDeployStackAction.actionProperties",
+      "docs-public-apis:@aws-cdk/app-delivery.PipelineDeployStackAction.deploymentRole",
+      "docs-public-apis:@aws-cdk/app-delivery.PipelineDeployStackAction.bind",
+      "docs-public-apis:@aws-cdk/app-delivery.PipelineDeployStackAction.onStateChange",
+      "docs-public-apis:@aws-cdk/app-delivery.PipelineDeployStackActionProps"
+    ]
+  }
 }
diff --git a/packages/@aws-cdk/assert/package.json b/packages/@aws-cdk/assert/package.json
index 9d9b1ead97c38..e8f25931029be 100644
--- a/packages/@aws-cdk/assert/package.json
+++ b/packages/@aws-cdk/assert/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@aws-cdk/assert",
-  "version": "1.13.1",
+  "version": "1.15.0",
   "description": "An assertion library for use with CDK Apps",
   "main": "lib/index.js",
   "types": "lib/index.d.ts",
@@ -27,13 +27,13 @@
   "license": "Apache-2.0",
   "devDependencies": {
     "@types/jest": "^24.0.19",
-    "cdk-build-tools": "^1.13.1",
-    "pkglint": "^1.13.1"
+    "cdk-build-tools": "^1.15.0",
+    "pkglint": "^1.15.0"
   },
   "dependencies": {
-    "@aws-cdk/cloudformation-diff": "1.13.1",
-    "@aws-cdk/core": "1.13.1",
-    "@aws-cdk/cx-api": "1.13.1",
+    "@aws-cdk/cloudformation-diff": "1.15.0",
+    "@aws-cdk/core": "1.15.0",
+    "@aws-cdk/cx-api": "1.15.0",
     "jest": "^24.9.0",
     "source-map-support": "^0.5.13"
   },
diff --git a/packages/@aws-cdk/assets/package.json b/packages/@aws-cdk/assets/package.json
index c1d6784937d23..89c1c5935e5bf 100644
--- a/packages/@aws-cdk/assets/package.json
+++ b/packages/@aws-cdk/assets/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@aws-cdk/assets",
-  "version": "1.13.1",
+  "version": "1.15.0",
   "description": "Integration of CDK apps with local assets",
   "main": "lib/index.js",
   "types": "lib/index.d.ts",
@@ -64,25 +64,25 @@
   },
   "license": "Apache-2.0",
   "devDependencies": {
-    "@aws-cdk/assert": "1.13.1",
+    "@aws-cdk/assert": "1.15.0",
     "@types/minimatch": "^3.0.3",
     "@types/sinon": "^7.5.0",
-    "aws-cdk": "1.13.1",
-    "cdk-build-tools": "^1.13.1",
-    "cdk-integ-tools": "^1.13.1",
-    "pkglint": "^1.13.1",
+    "aws-cdk": "1.15.0",
+    "cdk-build-tools": "^1.15.0",
+    "cdk-integ-tools": "^1.15.0",
+    "pkglint": "^1.15.0",
     "sinon": "^7.5.0",
     "ts-mock-imports": "^1.2.6"
   },
   "dependencies": {
-    "@aws-cdk/core": "1.13.1",
-    "@aws-cdk/cx-api": "1.13.1",
+    "@aws-cdk/core": "1.15.0",
+    "@aws-cdk/cx-api": "1.15.0",
     "minimatch": "^3.0.4"
   },
   "homepage": "https://github.com/aws/aws-cdk",
   "peerDependencies": {
-    "@aws-cdk/core": "1.13.1",
-    "@aws-cdk/cx-api": "1.13.1"
+    "@aws-cdk/core": "1.15.0",
+    "@aws-cdk/cx-api": "1.15.0"
   },
   "engines": {
     "node": ">= 10.3.0"
@@ -90,5 +90,12 @@
   "bundledDependencies": [
     "minimatch"
   ],
-  "stability": "experimental"
+  "stability": "experimental",
+  "awslint": {
+    "exclude": [
+      "docs-public-apis:@aws-cdk/assets.StagingProps",
+      "docs-public-apis:@aws-cdk/assets.StagingProps.sourcePath",
+      "docs-public-apis:@aws-cdk/assets.FollowMode"
+    ]
+  }
 }
diff --git a/packages/@aws-cdk/aws-amazonmq/package.json b/packages/@aws-cdk/aws-amazonmq/package.json
index 4b08120ab104a..404eb02f41e5e 100644
--- a/packages/@aws-cdk/aws-amazonmq/package.json
+++ b/packages/@aws-cdk/aws-amazonmq/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@aws-cdk/aws-amazonmq",
-  "version": "1.13.1",
+  "version": "1.15.0",
   "description": "The CDK Construct Library for AWS::AmazonMQ",
   "main": "lib/index.js",
   "types": "lib/index.d.ts",
@@ -64,16 +64,16 @@
   },
   "license": "Apache-2.0",
   "devDependencies": {
-    "@aws-cdk/assert": "1.13.1",
-    "cdk-build-tools": "^1.13.1",
-    "cfn2ts": "^1.13.1",
-    "pkglint": "^1.13.1"
+    "@aws-cdk/assert": "1.15.0",
+    "cdk-build-tools": "^1.15.0",
+    "cfn2ts": "^1.15.0",
+    "pkglint": "^1.15.0"
   },
   "dependencies": {
-    "@aws-cdk/core": "1.13.1"
+    "@aws-cdk/core": "1.15.0"
   },
   "peerDependencies": {
-    "@aws-cdk/core": "1.13.1"
+    "@aws-cdk/core": "1.15.0"
   },
   "engines": {
     "node": ">= 10.3.0"
diff --git a/packages/@aws-cdk/aws-amplify/package.json b/packages/@aws-cdk/aws-amplify/package.json
index 2d2ebe379e732..8fbeda4eb9ff0 100644
--- a/packages/@aws-cdk/aws-amplify/package.json
+++ b/packages/@aws-cdk/aws-amplify/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@aws-cdk/aws-amplify",
-  "version": "1.13.1",
+  "version": "1.15.0",
   "description": "The CDK Construct Library for AWS::Amplify",
   "main": "lib/index.js",
   "types": "lib/index.d.ts",
@@ -65,16 +65,16 @@
   },
   "license": "Apache-2.0",
   "devDependencies": {
-    "@aws-cdk/assert": "1.13.1",
-    "cdk-build-tools": "^1.13.1",
-    "cfn2ts": "^1.13.1",
-    "pkglint": "^1.13.1"
+    "@aws-cdk/assert": "1.15.0",
+    "cdk-build-tools": "^1.15.0",
+    "cfn2ts": "^1.15.0",
+    "pkglint": "^1.15.0"
   },
   "dependencies": {
-    "@aws-cdk/core": "1.13.1"
+    "@aws-cdk/core": "1.15.0"
   },
   "peerDependencies": {
-    "@aws-cdk/core": "1.13.1"
+    "@aws-cdk/core": "1.15.0"
   },
   "engines": {
     "node": ">= 10.3.0"
diff --git a/packages/@aws-cdk/aws-apigateway/lib/resource.ts b/packages/@aws-cdk/aws-apigateway/lib/resource.ts
index 6139be562ba4c..db3f2e00509f5 100644
--- a/packages/@aws-cdk/aws-apigateway/lib/resource.ts
+++ b/packages/@aws-cdk/aws-apigateway/lib/resource.ts
@@ -352,6 +352,10 @@ export abstract class ResourceBase extends ResourceConstruct implements IResourc
 
     return resource.resourceForPath(parts.join('/'));
   }
+
+  public get url(): string {
+    return this.restApi.urlForPath(this.path);
+  }
 }
 
 export class Resource extends ResourceBase {
diff --git a/packages/@aws-cdk/aws-apigateway/package.json b/packages/@aws-cdk/aws-apigateway/package.json
index e93c03cc03a0c..9d28d48d8fbe8 100644
--- a/packages/@aws-cdk/aws-apigateway/package.json
+++ b/packages/@aws-cdk/aws-apigateway/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@aws-cdk/aws-apigateway",
-  "version": "1.13.1",
+  "version": "1.15.0",
   "description": "The CDK Construct Library for AWS::ApiGateway",
   "main": "lib/index.js",
   "types": "lib/index.d.ts",
@@ -66,27 +66,27 @@
   },
   "license": "Apache-2.0",
   "devDependencies": {
-    "@aws-cdk/assert": "1.13.1",
-    "@aws-cdk/aws-ec2": "1.13.1",
-    "cdk-build-tools": "^1.13.1",
-    "cdk-integ-tools": "^1.13.1",
-    "cfn2ts": "^1.13.1",
-    "pkglint": "^1.13.1"
+    "@aws-cdk/assert": "1.15.0",
+    "@aws-cdk/aws-ec2": "1.15.0",
+    "cdk-build-tools": "^1.15.0",
+    "cdk-integ-tools": "^1.15.0",
+    "cfn2ts": "^1.15.0",
+    "pkglint": "^1.15.0"
   },
   "dependencies": {
-    "@aws-cdk/aws-certificatemanager": "1.13.1",
-    "@aws-cdk/aws-elasticloadbalancingv2": "1.13.1",
-    "@aws-cdk/aws-iam": "1.13.1",
-    "@aws-cdk/aws-lambda": "1.13.1",
-    "@aws-cdk/core": "1.13.1"
+    "@aws-cdk/aws-certificatemanager": "1.15.0",
+    "@aws-cdk/aws-elasticloadbalancingv2": "1.15.0",
+    "@aws-cdk/aws-iam": "1.15.0",
+    "@aws-cdk/aws-lambda": "1.15.0",
+    "@aws-cdk/core": "1.15.0"
   },
   "homepage": "https://github.com/aws/aws-cdk",
   "peerDependencies": {
-    "@aws-cdk/aws-certificatemanager": "1.13.1",
-    "@aws-cdk/aws-elasticloadbalancingv2": "1.13.1",
-    "@aws-cdk/aws-iam": "1.13.1",
-    "@aws-cdk/aws-lambda": "1.13.1",
-    "@aws-cdk/core": "1.13.1"
+    "@aws-cdk/aws-certificatemanager": "1.15.0",
+    "@aws-cdk/aws-elasticloadbalancingv2": "1.15.0",
+    "@aws-cdk/aws-iam": "1.15.0",
+    "@aws-cdk/aws-lambda": "1.15.0",
+    "@aws-cdk/core": "1.15.0"
   },
   "engines": {
     "node": ">= 10.3.0"
@@ -106,7 +106,185 @@
       "props-physical-name:@aws-cdk/aws-apigateway.BasePathMappingProps",
       "props-physical-name:@aws-cdk/aws-apigateway.LambdaRestApiProps",
       "construct-interface-extends-iconstruct:@aws-cdk/aws-apigateway.IModel",
-      "resource-interface-extends-resource:@aws-cdk/aws-apigateway.IModel"
+      "resource-interface-extends-resource:@aws-cdk/aws-apigateway.IModel",
+      "docs-public-apis:@aws-cdk/aws-apigateway.JsonSchema.definitions",
+      "docs-public-apis:@aws-cdk/aws-apigateway.Period.MONTH",
+      "docs-public-apis:@aws-cdk/aws-apigateway.Period.WEEK",
+      "docs-public-apis:@aws-cdk/aws-apigateway.Period.DAY",
+      "docs-public-apis:@aws-cdk/aws-apigateway.PassthroughBehavior",
+      "docs-public-apis:@aws-cdk/aws-apigateway.MethodLoggingLevel.INFO",
+      "docs-public-apis:@aws-cdk/aws-apigateway.MethodLoggingLevel.ERROR",
+      "docs-public-apis:@aws-cdk/aws-apigateway.MethodLoggingLevel.OFF",
+      "docs-public-apis:@aws-cdk/aws-apigateway.MethodLoggingLevel",
+      "docs-public-apis:@aws-cdk/aws-apigateway.JsonSchemaVersion.DRAFT7",
+      "docs-public-apis:@aws-cdk/aws-apigateway.JsonSchemaVersion",
+      "docs-public-apis:@aws-cdk/aws-apigateway.JsonSchemaType.STRING",
+      "docs-public-apis:@aws-cdk/aws-apigateway.JsonSchemaType.INTEGER",
+      "docs-public-apis:@aws-cdk/aws-apigateway.JsonSchemaType.NUMBER",
+      "docs-public-apis:@aws-cdk/aws-apigateway.JsonSchemaType.ARRAY",
+      "docs-public-apis:@aws-cdk/aws-apigateway.JsonSchemaType.OBJECT",
+      "docs-public-apis:@aws-cdk/aws-apigateway.JsonSchemaType.BOOLEAN",
+      "docs-public-apis:@aws-cdk/aws-apigateway.JsonSchemaType.NULL",
+      "docs-public-apis:@aws-cdk/aws-apigateway.JsonSchemaType",
+      "docs-public-apis:@aws-cdk/aws-apigateway.IntegrationType",
+      "docs-public-apis:@aws-cdk/aws-apigateway.EndpointType",
+      "docs-public-apis:@aws-cdk/aws-apigateway.ContentHandling",
+      "docs-public-apis:@aws-cdk/aws-apigateway.ConnectionType",
+      "docs-public-apis:@aws-cdk/aws-apigateway.AuthorizationType",
+      "docs-public-apis:@aws-cdk/aws-apigateway.ApiKeySourceType",
+      "docs-public-apis:@aws-cdk/aws-apigateway.UsagePlanProps",
+      "docs-public-apis:@aws-cdk/aws-apigateway.UsagePlanPerApiStage.throttle",
+      "docs-public-apis:@aws-cdk/aws-apigateway.UsagePlanPerApiStage.api",
+      "docs-public-apis:@aws-cdk/aws-apigateway.StageProps",
+      "docs-public-apis:@aws-cdk/aws-apigateway.StageOptions",
+      "docs-public-apis:@aws-cdk/aws-apigateway.RestApiProps",
+      "docs-public-apis:@aws-cdk/aws-apigateway.ResourceProps",
+      "docs-public-apis:@aws-cdk/aws-apigateway.ResourceOptions",
+      "docs-public-apis:@aws-cdk/aws-apigateway.RequestValidatorProps",
+      "docs-public-apis:@aws-cdk/aws-apigateway.RequestValidatorOptions",
+      "docs-public-apis:@aws-cdk/aws-apigateway.ProxyResourceProps",
+      "docs-public-apis:@aws-cdk/aws-apigateway.ProxyResourceOptions",
+      "docs-public-apis:@aws-cdk/aws-apigateway.ModelProps",
+      "docs-public-apis:@aws-cdk/aws-apigateway.ModelOptions",
+      "docs-public-apis:@aws-cdk/aws-apigateway.MethodResponse",
+      "docs-public-apis:@aws-cdk/aws-apigateway.Cors",
+      "docs-public-apis:@aws-cdk/aws-apigateway.Deployment.api",
+      "docs-public-apis:@aws-cdk/aws-apigateway.Deployment.deploymentId",
+      "docs-public-apis:@aws-cdk/aws-apigateway.DomainName",
+      "docs-public-apis:@aws-cdk/aws-apigateway.Method",
+      "docs-public-apis:@aws-cdk/aws-apigateway.Method.httpMethod",
+      "docs-public-apis:@aws-cdk/aws-apigateway.Method.methodId",
+      "docs-public-apis:@aws-cdk/aws-apigateway.Method.resource",
+      "docs-public-apis:@aws-cdk/aws-apigateway.Method.restApi",
+      "docs-public-apis:@aws-cdk/aws-apigateway.Model",
+      "docs-public-apis:@aws-cdk/aws-apigateway.Model.fromModelName",
+      "docs-public-apis:@aws-cdk/aws-apigateway.RequestValidator",
+      "docs-public-apis:@aws-cdk/aws-apigateway.RequestValidator.fromRequestValidatorId",
+      "docs-public-apis:@aws-cdk/aws-apigateway.Resource",
+      "docs-public-apis:@aws-cdk/aws-apigateway.ResourceBase",
+      "docs-public-apis:@aws-cdk/aws-apigateway.RestApi.fromRestApiId",
+      "docs-public-apis:@aws-cdk/aws-apigateway.RestApi.arnForExecuteApi",
+      "docs-public-apis:@aws-cdk/aws-apigateway.Stage",
+      "docs-public-apis:@aws-cdk/aws-apigateway.Stage.restApi",
+      "docs-public-apis:@aws-cdk/aws-apigateway.Stage.stageName",
+      "docs-public-apis:@aws-cdk/aws-apigateway.UsagePlan",
+      "docs-public-apis:@aws-cdk/aws-apigateway.UsagePlan.usagePlanId",
+      "docs-public-apis:@aws-cdk/aws-apigateway.VpcLink.addTargets",
+      "docs-public-apis:@aws-cdk/aws-apigateway.AwsIntegrationProps",
+      "props-default-doc:@aws-cdk/aws-apigateway.AwsIntegrationProps.action",
+      "props-default-doc:@aws-cdk/aws-apigateway.AwsIntegrationProps.actionParameters",
+      "props-default-doc:@aws-cdk/aws-apigateway.AwsIntegrationProps.options",
+      "props-default-doc:@aws-cdk/aws-apigateway.AwsIntegrationProps.path",
+      "props-default-doc:@aws-cdk/aws-apigateway.AwsIntegrationProps.subdomain",
+      "docs-public-apis:@aws-cdk/aws-apigateway.BasePathMappingOptions",
+      "docs-public-apis:@aws-cdk/aws-apigateway.BasePathMappingProps",
+      "docs-public-apis:@aws-cdk/aws-apigateway.CorsOptions",
+      "docs-public-apis:@aws-cdk/aws-apigateway.DeploymentProps",
+      "docs-public-apis:@aws-cdk/aws-apigateway.DomainNameAttributes",
+      "docs-public-apis:@aws-cdk/aws-apigateway.DomainNameOptions",
+      "docs-public-apis:@aws-cdk/aws-apigateway.DomainNameProps",
+      "docs-public-apis:@aws-cdk/aws-apigateway.HttpIntegrationProps",
+      "docs-public-apis:@aws-cdk/aws-apigateway.IDomainName",
+      "docs-public-apis:@aws-cdk/aws-apigateway.IModel",
+      "docs-public-apis:@aws-cdk/aws-apigateway.IRequestValidator",
+      "docs-public-apis:@aws-cdk/aws-apigateway.IResource",
+      "docs-public-apis:@aws-cdk/aws-apigateway.IRestApi",
+      "docs-public-apis:@aws-cdk/aws-apigateway.IntegrationOptions",
+      "props-default-doc:@aws-cdk/aws-apigateway.IntegrationOptions.cacheKeyParameters",
+      "props-default-doc:@aws-cdk/aws-apigateway.IntegrationOptions.cacheNamespace",
+      "props-default-doc:@aws-cdk/aws-apigateway.IntegrationOptions.integrationResponses",
+      "props-default-doc:@aws-cdk/aws-apigateway.IntegrationOptions.passthroughBehavior",
+      "props-default-doc:@aws-cdk/aws-apigateway.IntegrationOptions.requestParameters",
+      "props-default-doc:@aws-cdk/aws-apigateway.IntegrationOptions.requestTemplates",
+      "props-default-doc:@aws-cdk/aws-apigateway.IntegrationOptions.vpcLink",
+      "docs-public-apis:@aws-cdk/aws-apigateway.IntegrationProps",
+      "props-default-doc:@aws-cdk/aws-apigateway.IntegrationProps.integrationHttpMethod",
+      "props-default-doc:@aws-cdk/aws-apigateway.IntegrationProps.options",
+      "props-default-doc:@aws-cdk/aws-apigateway.IntegrationProps.uri",
+      "docs-public-apis:@aws-cdk/aws-apigateway.IntegrationResponse",
+      "props-default-doc:@aws-cdk/aws-apigateway.IntegrationResponse.responseParameters",
+      "props-default-doc:@aws-cdk/aws-apigateway.IntegrationResponse.responseTemplates",
+      "props-default-doc:@aws-cdk/aws-apigateway.IntegrationResponse.selectionPattern",
+      "docs-public-apis:@aws-cdk/aws-apigateway.JsonSchema.additionalItems",
+      "props-default-doc:@aws-cdk/aws-apigateway.JsonSchema.additionalItems",
+      "docs-public-apis:@aws-cdk/aws-apigateway.JsonSchema.additionalProperties",
+      "props-default-doc:@aws-cdk/aws-apigateway.JsonSchema.additionalProperties",
+      "docs-public-apis:@aws-cdk/aws-apigateway.JsonSchema.allOf",
+      "props-default-doc:@aws-cdk/aws-apigateway.JsonSchema.allOf",
+      "docs-public-apis:@aws-cdk/aws-apigateway.JsonSchema.anyOf",
+      "props-default-doc:@aws-cdk/aws-apigateway.JsonSchema.anyOf",
+      "docs-public-apis:@aws-cdk/aws-apigateway.JsonSchema.contains",
+      "props-default-doc:@aws-cdk/aws-apigateway.JsonSchema.contains",
+      "docs-public-apis:@aws-cdk/aws-apigateway.MethodProps",
+      "props-default-doc:@aws-cdk/aws-apigateway.JsonSchema.definitions",
+      "docs-public-apis:@aws-cdk/aws-apigateway.JsonSchema.dependencies",
+      "props-default-doc:@aws-cdk/aws-apigateway.JsonSchema.dependencies",
+      "docs-public-apis:@aws-cdk/aws-apigateway.JsonSchema.description",
+      "props-default-doc:@aws-cdk/aws-apigateway.JsonSchema.description",
+      "docs-public-apis:@aws-cdk/aws-apigateway.JsonSchema.enum",
+      "props-default-doc:@aws-cdk/aws-apigateway.JsonSchema.enum",
+      "docs-public-apis:@aws-cdk/aws-apigateway.JsonSchema.exclusiveMaximum",
+      "props-default-doc:@aws-cdk/aws-apigateway.JsonSchema.exclusiveMaximum",
+      "docs-public-apis:@aws-cdk/aws-apigateway.JsonSchema.exclusiveMinimum",
+      "props-default-doc:@aws-cdk/aws-apigateway.JsonSchema.exclusiveMinimum",
+      "docs-public-apis:@aws-cdk/aws-apigateway.JsonSchema.format",
+      "props-default-doc:@aws-cdk/aws-apigateway.JsonSchema.format",
+      "docs-public-apis:@aws-cdk/aws-apigateway.JsonSchema.id",
+      "props-default-doc:@aws-cdk/aws-apigateway.JsonSchema.id",
+      "docs-public-apis:@aws-cdk/aws-apigateway.JsonSchema.items",
+      "props-default-doc:@aws-cdk/aws-apigateway.JsonSchema.items",
+      "docs-public-apis:@aws-cdk/aws-apigateway.JsonSchema.maximum",
+      "props-default-doc:@aws-cdk/aws-apigateway.JsonSchema.maximum",
+      "docs-public-apis:@aws-cdk/aws-apigateway.JsonSchema.maxItems",
+      "props-default-doc:@aws-cdk/aws-apigateway.JsonSchema.maxItems",
+      "docs-public-apis:@aws-cdk/aws-apigateway.JsonSchema.maxLength",
+      "props-default-doc:@aws-cdk/aws-apigateway.JsonSchema.maxLength",
+      "docs-public-apis:@aws-cdk/aws-apigateway.JsonSchema.maxProperties",
+      "props-default-doc:@aws-cdk/aws-apigateway.JsonSchema.maxProperties",
+      "docs-public-apis:@aws-cdk/aws-apigateway.JsonSchema.minimum",
+      "props-default-doc:@aws-cdk/aws-apigateway.JsonSchema.minimum",
+      "docs-public-apis:@aws-cdk/aws-apigateway.JsonSchema.minItems",
+      "props-default-doc:@aws-cdk/aws-apigateway.JsonSchema.minItems",
+      "docs-public-apis:@aws-cdk/aws-apigateway.JsonSchema.minLength",
+      "props-default-doc:@aws-cdk/aws-apigateway.JsonSchema.minLength",
+      "docs-public-apis:@aws-cdk/aws-apigateway.JsonSchema.minProperties",
+      "props-default-doc:@aws-cdk/aws-apigateway.JsonSchema.minProperties",
+      "docs-public-apis:@aws-cdk/aws-apigateway.JsonSchema.multipleOf",
+      "props-default-doc:@aws-cdk/aws-apigateway.JsonSchema.multipleOf",
+      "docs-public-apis:@aws-cdk/aws-apigateway.JsonSchema.not",
+      "props-default-doc:@aws-cdk/aws-apigateway.JsonSchema.not",
+      "docs-public-apis:@aws-cdk/aws-apigateway.JsonSchema.oneOf",
+      "props-default-doc:@aws-cdk/aws-apigateway.JsonSchema.oneOf",
+      "docs-public-apis:@aws-cdk/aws-apigateway.JsonSchema.pattern",
+      "props-default-doc:@aws-cdk/aws-apigateway.JsonSchema.pattern",
+      "docs-public-apis:@aws-cdk/aws-apigateway.JsonSchema.patternProperties",
+      "props-default-doc:@aws-cdk/aws-apigateway.JsonSchema.patternProperties",
+      "docs-public-apis:@aws-cdk/aws-apigateway.JsonSchema.properties",
+      "props-default-doc:@aws-cdk/aws-apigateway.JsonSchema.properties",
+      "docs-public-apis:@aws-cdk/aws-apigateway.JsonSchema.propertyNames",
+      "props-default-doc:@aws-cdk/aws-apigateway.JsonSchema.propertyNames",
+      "docs-public-apis:@aws-cdk/aws-apigateway.JsonSchema.ref",
+      "props-default-doc:@aws-cdk/aws-apigateway.JsonSchema.ref",
+      "docs-public-apis:@aws-cdk/aws-apigateway.JsonSchema.required",
+      "props-default-doc:@aws-cdk/aws-apigateway.JsonSchema.required",
+      "docs-public-apis:@aws-cdk/aws-apigateway.JsonSchema.schema",
+      "props-default-doc:@aws-cdk/aws-apigateway.JsonSchema.schema",
+      "docs-public-apis:@aws-cdk/aws-apigateway.JsonSchema.title",
+      "props-default-doc:@aws-cdk/aws-apigateway.JsonSchema.title",
+      "docs-public-apis:@aws-cdk/aws-apigateway.JsonSchema.type",
+      "props-default-doc:@aws-cdk/aws-apigateway.JsonSchema.type",
+      "docs-public-apis:@aws-cdk/aws-apigateway.JsonSchema.uniqueItems",
+      "props-default-doc:@aws-cdk/aws-apigateway.JsonSchema.uniqueItems",
+      "docs-public-apis:@aws-cdk/aws-apigateway.LambdaIntegrationOptions",
+      "docs-public-apis:@aws-cdk/aws-apigateway.LambdaRestApiProps",
+      "docs-public-apis:@aws-cdk/aws-apigateway.LambdaRestApiProps.options",
+      "docs-public-apis:@aws-cdk/aws-apigateway.MethodDeploymentOptions",
+      "docs-public-apis:@aws-cdk/aws-apigateway.MethodOptions",
+      "props-default-doc:@aws-cdk/aws-apigateway.MethodOptions.authorizer",
+      "props-default-doc:@aws-cdk/aws-apigateway.MethodOptions.operationName",
+      "props-default-doc:@aws-cdk/aws-apigateway.MethodOptions.requestModels",
+      "props-default-doc:@aws-cdk/aws-apigateway.MethodOptions.requestValidator",
+      "docs-public-apis:@aws-cdk/aws-apigateway.ResourceBase.url"
     ]
   },
   "stability": "stable"
diff --git a/packages/@aws-cdk/aws-apigateway/test/test.resource.ts b/packages/@aws-cdk/aws-apigateway/test/test.resource.ts
index d4d67ff2d99c1..5a94b5ab1cbb4 100644
--- a/packages/@aws-cdk/aws-apigateway/test/test.resource.ts
+++ b/packages/@aws-cdk/aws-apigateway/test/test.resource.ts
@@ -178,6 +178,51 @@ export = {
     test.done();
   },
 
+  'url for a resource'(test: Test) {
+    // GIVEN
+    const stack = new Stack();
+    const api = new apigw.RestApi(stack, 'api');
+
+    // WHEN
+    const aResource = api.root.addResource('a');
+    const cResource = aResource.addResource('b').addResource('c');
+
+    // THEN
+    test.deepEqual(stack.resolve(aResource.url), {
+      'Fn::Join': [
+        '',
+        [
+          'https://',
+          { Ref: 'apiC8550315' },
+          '.execute-api.',
+          { Ref: 'AWS::Region' },
+          '.',
+          { Ref: 'AWS::URLSuffix' },
+          '/',
+          { Ref: 'apiDeploymentStageprod896C8101' },
+          '/a'
+        ]
+      ]
+    });
+    test.deepEqual(stack.resolve(cResource.url), {
+      'Fn::Join': [
+        '',
+        [
+          'https://',
+          { Ref: 'apiC8550315' },
+          '.execute-api.',
+          { Ref: 'AWS::Region' },
+          '.',
+          { Ref: 'AWS::URLSuffix' },
+          '/',
+          { Ref: 'apiDeploymentStageprod896C8101' },
+          '/a/b/c'
+        ]
+      ]
+    });
+    test.done();
+  },
+
   'getResource': {
 
     'root resource': {
diff --git a/packages/@aws-cdk/aws-applicationautoscaling/package.json b/packages/@aws-cdk/aws-applicationautoscaling/package.json
index fef077bf44826..70f9d81f15e08 100644
--- a/packages/@aws-cdk/aws-applicationautoscaling/package.json
+++ b/packages/@aws-cdk/aws-applicationautoscaling/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@aws-cdk/aws-applicationautoscaling",
-  "version": "1.13.1",
+  "version": "1.15.0",
   "description": "The CDK Construct Library for AWS::ApplicationAutoScaling",
   "main": "lib/index.js",
   "types": "lib/index.d.ts",
@@ -63,31 +63,53 @@
   },
   "license": "Apache-2.0",
   "devDependencies": {
-    "@aws-cdk/assert": "1.13.1",
-    "cdk-build-tools": "^1.13.1",
-    "cfn2ts": "^1.13.1",
-    "fast-check": "^1.17.0",
-    "pkglint": "^1.13.1"
+    "@aws-cdk/assert": "1.15.0",
+    "cdk-build-tools": "^1.15.0",
+    "cfn2ts": "^1.15.0",
+    "fast-check": "^1.18.1",
+    "pkglint": "^1.15.0"
   },
   "dependencies": {
-    "@aws-cdk/aws-autoscaling-common": "1.13.1",
-    "@aws-cdk/aws-cloudwatch": "1.13.1",
-    "@aws-cdk/aws-iam": "1.13.1",
-    "@aws-cdk/core": "1.13.1"
+    "@aws-cdk/aws-autoscaling-common": "1.15.0",
+    "@aws-cdk/aws-cloudwatch": "1.15.0",
+    "@aws-cdk/aws-iam": "1.15.0",
+    "@aws-cdk/core": "1.15.0"
   },
   "homepage": "https://github.com/aws/aws-cdk",
   "peerDependencies": {
-    "@aws-cdk/aws-autoscaling-common": "1.13.1",
-    "@aws-cdk/aws-cloudwatch": "1.13.1",
-    "@aws-cdk/aws-iam": "1.13.1",
-    "@aws-cdk/core": "1.13.1"
+    "@aws-cdk/aws-autoscaling-common": "1.15.0",
+    "@aws-cdk/aws-cloudwatch": "1.15.0",
+    "@aws-cdk/aws-iam": "1.15.0",
+    "@aws-cdk/core": "1.15.0"
   },
   "engines": {
     "node": ">= 10.3.0"
   },
   "awslint": {
     "exclude": [
-      "props-physical-name:@aws-cdk/aws-applicationautoscaling.ScalableTargetProps"
+      "props-physical-name:@aws-cdk/aws-applicationautoscaling.ScalableTargetProps",
+      "docs-public-apis:@aws-cdk/aws-applicationautoscaling.TargetTrackingScalingPolicyProps.scalingTarget",
+      "docs-public-apis:@aws-cdk/aws-applicationautoscaling.PredefinedMetric.ECS_SERVICE_AVERAGE_MEMORY_UTILIZATION",
+      "docs-public-apis:@aws-cdk/aws-applicationautoscaling.ScalableTarget.fromScalableTargetId",
+      "docs-public-apis:@aws-cdk/aws-applicationautoscaling.StepScalingPolicy.lowerAction",
+      "docs-public-apis:@aws-cdk/aws-applicationautoscaling.StepScalingPolicy.lowerAlarm",
+      "docs-public-apis:@aws-cdk/aws-applicationautoscaling.StepScalingPolicy.upperAction",
+      "docs-public-apis:@aws-cdk/aws-applicationautoscaling.StepScalingPolicy.upperAlarm",
+      "docs-public-apis:@aws-cdk/aws-applicationautoscaling.TargetTrackingScalingPolicy",
+      "docs-public-apis:@aws-cdk/aws-applicationautoscaling.BasicStepScalingPolicyProps",
+      "docs-public-apis:@aws-cdk/aws-applicationautoscaling.IScalableTarget",
+      "docs-public-apis:@aws-cdk/aws-applicationautoscaling.IScalableTarget.scalableTargetId",
+      "docs-public-apis:@aws-cdk/aws-applicationautoscaling.StepScalingPolicyProps",
+      "docs-public-apis:@aws-cdk/aws-applicationautoscaling.PredefinedMetric.ECS_SERVICE_AVERAGE_CPU_UTILIZATION",
+      "docs-public-apis:@aws-cdk/aws-applicationautoscaling.PredefinedMetric.DYNAMODB_READ_CAPACITY_UTILIZATION",
+      "docs-public-apis:@aws-cdk/aws-applicationautoscaling.PredefinedMetric.DYANMODB_WRITE_CAPACITY_UTILIZATION",
+      "docs-public-apis:@aws-cdk/aws-applicationautoscaling.PredefinedMetric.ALB_REQUEST_COUNT_PER_TARGET",
+      "docs-public-apis:@aws-cdk/aws-applicationautoscaling.PredefinedMetric.RDS_READER_AVERAGE_CPU_UTILIZATION",
+      "docs-public-apis:@aws-cdk/aws-applicationautoscaling.PredefinedMetric.RDS_READER_AVERAGE_DATABASE_CONNECTIONS",
+      "docs-public-apis:@aws-cdk/aws-applicationautoscaling.PredefinedMetric.EC2_SPOT_FLEET_REQUEST_AVERAGE_CPU_UTILIZATION",
+      "docs-public-apis:@aws-cdk/aws-applicationautoscaling.PredefinedMetric.EC2_SPOT_FLEET_REQUEST_AVERAGE_NETWORK_IN",
+      "docs-public-apis:@aws-cdk/aws-applicationautoscaling.PredefinedMetric.EC2_SPOT_FLEET_REQUEST_AVERAGE_NETWORK_OUT",
+      "docs-public-apis:@aws-cdk/aws-applicationautoscaling.PredefinedMetric.SAGEMAKER_VARIANT_INVOCATIONS_PER_INSTANCE"
     ]
   },
   "stability": "stable"
diff --git a/packages/@aws-cdk/aws-appmesh/package.json b/packages/@aws-cdk/aws-appmesh/package.json
index 5614431e60da8..8f05d7c00039b 100644
--- a/packages/@aws-cdk/aws-appmesh/package.json
+++ b/packages/@aws-cdk/aws-appmesh/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@aws-cdk/aws-appmesh",
-  "version": "1.13.1",
+  "version": "1.15.0",
   "description": "The CDK Construct Library for AWS::AppMesh",
   "main": "lib/index.js",
   "types": "lib/index.d.ts",
@@ -65,23 +65,23 @@
   },
   "license": "Apache-2.0",
   "devDependencies": {
-    "@aws-cdk/assert": "1.13.1",
-    "cdk-build-tools": "^1.13.1",
-    "cdk-integ-tools": "^1.13.1",
-    "cfn2ts": "1.13.1",
-    "pkglint": "^1.13.1"
+    "@aws-cdk/assert": "1.15.0",
+    "cdk-build-tools": "^1.15.0",
+    "cdk-integ-tools": "^1.15.0",
+    "cfn2ts": "1.15.0",
+    "pkglint": "^1.15.0"
   },
   "dependencies": {
-    "@aws-cdk/aws-ec2": "1.13.1",
-    "@aws-cdk/aws-iam": "1.13.1",
-    "@aws-cdk/aws-servicediscovery": "1.13.1",
-    "@aws-cdk/core": "1.13.1"
+    "@aws-cdk/aws-ec2": "1.15.0",
+    "@aws-cdk/aws-iam": "1.15.0",
+    "@aws-cdk/aws-servicediscovery": "1.15.0",
+    "@aws-cdk/core": "1.15.0"
   },
   "peerDependencies": {
-    "@aws-cdk/aws-ec2": "1.13.1",
-    "@aws-cdk/aws-iam": "1.13.1",
-    "@aws-cdk/aws-servicediscovery": "1.13.1",
-    "@aws-cdk/core": "1.13.1"
+    "@aws-cdk/aws-ec2": "1.15.0",
+    "@aws-cdk/aws-iam": "1.15.0",
+    "@aws-cdk/aws-servicediscovery": "1.15.0",
+    "@aws-cdk/core": "1.15.0"
   },
   "engines": {
     "node": ">= 10.3.0"
@@ -111,7 +111,14 @@
       "resource-attribute:@aws-cdk/aws-appmesh.VirtualRouter.virtualRouterMeshName",
       "resource-attribute:@aws-cdk/aws-appmesh.VirtualRouter.virtualRouterUid",
       "resource-attribute:@aws-cdk/aws-appmesh.VirtualService.virtualServiceMeshName",
-      "resource-attribute:@aws-cdk/aws-appmesh.VirtualService.virtualServiceUid"
+      "resource-attribute:@aws-cdk/aws-appmesh.VirtualService.virtualServiceUid",
+      "docs-public-apis:@aws-cdk/aws-appmesh.Protocol.TCP",
+      "docs-public-apis:@aws-cdk/aws-appmesh.VirtualRouter",
+      "props-default-doc:@aws-cdk/aws-appmesh.VirtualRouterAttributes.mesh",
+      "props-default-doc:@aws-cdk/aws-appmesh.VirtualRouterAttributes.meshName",
+      "props-default-doc:@aws-cdk/aws-appmesh.VirtualRouterAttributes.virtualRouterArn",
+      "props-default-doc:@aws-cdk/aws-appmesh.VirtualRouterAttributes.virtualRouterName",
+      "docs-public-apis:@aws-cdk/aws-appmesh.Protocol.HTTP"
     ]
   },
   "stability": "experimental"
diff --git a/packages/@aws-cdk/aws-appstream/package.json b/packages/@aws-cdk/aws-appstream/package.json
index 0a4dece2830a5..21a8564757f5e 100644
--- a/packages/@aws-cdk/aws-appstream/package.json
+++ b/packages/@aws-cdk/aws-appstream/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@aws-cdk/aws-appstream",
-  "version": "1.13.1",
+  "version": "1.15.0",
   "description": "The CDK Construct Library for AWS::AppStream",
   "main": "lib/index.js",
   "types": "lib/index.d.ts",
@@ -64,16 +64,16 @@
   },
   "license": "Apache-2.0",
   "devDependencies": {
-    "@aws-cdk/assert": "1.13.1",
-    "cdk-build-tools": "^1.13.1",
-    "cfn2ts": "^1.13.1",
-    "pkglint": "^1.13.1"
+    "@aws-cdk/assert": "1.15.0",
+    "cdk-build-tools": "^1.15.0",
+    "cfn2ts": "^1.15.0",
+    "pkglint": "^1.15.0"
   },
   "dependencies": {
-    "@aws-cdk/core": "1.13.1"
+    "@aws-cdk/core": "1.15.0"
   },
   "peerDependencies": {
-    "@aws-cdk/core": "1.13.1"
+    "@aws-cdk/core": "1.15.0"
   },
   "engines": {
     "node": ">= 10.3.0"
diff --git a/packages/@aws-cdk/aws-appsync/package.json b/packages/@aws-cdk/aws-appsync/package.json
index 3974f5bcb6fdb..83c0ce21b0b26 100644
--- a/packages/@aws-cdk/aws-appsync/package.json
+++ b/packages/@aws-cdk/aws-appsync/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@aws-cdk/aws-appsync",
-  "version": "1.13.1",
+  "version": "1.15.0",
   "description": "The CDK Construct Library for AWS::AppSync",
   "main": "lib/index.js",
   "types": "lib/index.d.ts",
@@ -63,17 +63,17 @@
   },
   "license": "Apache-2.0",
   "devDependencies": {
-    "@aws-cdk/assert": "1.13.1",
-    "cdk-build-tools": "^1.13.1",
-    "cfn2ts": "^1.13.1",
-    "pkglint": "^1.13.1"
+    "@aws-cdk/assert": "1.15.0",
+    "cdk-build-tools": "^1.15.0",
+    "cfn2ts": "^1.15.0",
+    "pkglint": "^1.15.0"
   },
   "dependencies": {
-    "@aws-cdk/core": "1.13.1"
+    "@aws-cdk/core": "1.15.0"
   },
   "homepage": "https://github.com/aws/aws-cdk",
   "peerDependencies": {
-    "@aws-cdk/core": "1.13.1"
+    "@aws-cdk/core": "1.15.0"
   },
   "engines": {
     "node": ">= 10.3.0"
diff --git a/packages/@aws-cdk/aws-athena/package.json b/packages/@aws-cdk/aws-athena/package.json
index 6a78caec1d2d7..575fa29fc68e1 100644
--- a/packages/@aws-cdk/aws-athena/package.json
+++ b/packages/@aws-cdk/aws-athena/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@aws-cdk/aws-athena",
-  "version": "1.13.1",
+  "version": "1.15.0",
   "description": "The CDK Construct Library for AWS::Athena",
   "main": "lib/index.js",
   "types": "lib/index.d.ts",
@@ -63,17 +63,17 @@
   },
   "license": "Apache-2.0",
   "devDependencies": {
-    "@aws-cdk/assert": "1.13.1",
-    "cdk-build-tools": "^1.13.1",
-    "cfn2ts": "^1.13.1",
-    "pkglint": "^1.13.1"
+    "@aws-cdk/assert": "1.15.0",
+    "cdk-build-tools": "^1.15.0",
+    "cfn2ts": "^1.15.0",
+    "pkglint": "^1.15.0"
   },
   "dependencies": {
-    "@aws-cdk/core": "1.13.1"
+    "@aws-cdk/core": "1.15.0"
   },
   "homepage": "https://github.com/aws/aws-cdk",
   "peerDependencies": {
-    "@aws-cdk/core": "1.13.1"
+    "@aws-cdk/core": "1.15.0"
   },
   "engines": {
     "node": ">= 10.3.0"
diff --git a/packages/@aws-cdk/aws-autoscaling-common/package.json b/packages/@aws-cdk/aws-autoscaling-common/package.json
index 9c075b9e54143..036a8c833054c 100644
--- a/packages/@aws-cdk/aws-autoscaling-common/package.json
+++ b/packages/@aws-cdk/aws-autoscaling-common/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@aws-cdk/aws-autoscaling-common",
-  "version": "1.13.1",
+  "version": "1.15.0",
   "description": "Common implementation package for @aws-cdk/aws-autoscaling and @aws-cdk/aws-applicationautoscaling",
   "main": "lib/index.js",
   "types": "lib/index.d.ts",
@@ -59,24 +59,40 @@
   },
   "license": "Apache-2.0",
   "devDependencies": {
-    "@aws-cdk/assert": "1.13.1",
-    "cdk-build-tools": "^1.13.1",
-    "cdk-integ-tools": "^1.13.1",
-    "fast-check": "^1.17.0",
-    "pkglint": "^1.13.1"
+    "@aws-cdk/assert": "1.15.0",
+    "cdk-build-tools": "^1.15.0",
+    "cdk-integ-tools": "^1.15.0",
+    "fast-check": "^1.18.1",
+    "pkglint": "^1.15.0"
   },
   "dependencies": {
-    "@aws-cdk/aws-iam": "1.13.1",
-    "@aws-cdk/core": "1.13.1"
+    "@aws-cdk/aws-iam": "1.15.0",
+    "@aws-cdk/core": "1.15.0"
   },
   "homepage": "https://github.com/aws/aws-cdk",
   "peerDependencies": {
-    "@aws-cdk/aws-iam": "1.13.1",
-    "@aws-cdk/core": "1.13.1"
+    "@aws-cdk/aws-iam": "1.15.0",
+    "@aws-cdk/core": "1.15.0"
   },
   "awslint": {
     "exclude": [
-      "no-unused-type:@aws-cdk/aws-autoscaling-common.*"
+      "no-unused-type:@aws-cdk/aws-autoscaling-common.*",
+      "docs-public-apis:@aws-cdk/aws-autoscaling-common.ArbitraryIntervals",
+      "docs-public-apis:@aws-cdk/aws-autoscaling-common.IRandomGenerator.nextInt",
+      "docs-public-apis:@aws-cdk/aws-autoscaling-common.IRandomGenerator.nextBoolean",
+      "docs-public-apis:@aws-cdk/aws-autoscaling-common.IRandomGenerator",
+      "props-default-doc:@aws-cdk/aws-autoscaling-common.CompleteScalingInterval.change",
+      "docs-public-apis:@aws-cdk/aws-autoscaling-common.Alarms",
+      "docs-public-apis:@aws-cdk/aws-autoscaling-common.Alarms.lowerAlarmIntervalIndex",
+      "props-default-doc:@aws-cdk/aws-autoscaling-common.Alarms.lowerAlarmIntervalIndex",
+      "docs-public-apis:@aws-cdk/aws-autoscaling-common.Alarms.upperAlarmIntervalIndex",
+      "props-default-doc:@aws-cdk/aws-autoscaling-common.Alarms.upperAlarmIntervalIndex",
+      "docs-public-apis:@aws-cdk/aws-autoscaling-common.CompleteScalingInterval.change",
+      "docs-public-apis:@aws-cdk/aws-autoscaling-common.ArbitraryIntervals.absolute",
+      "docs-public-apis:@aws-cdk/aws-autoscaling-common.ArbitraryIntervals.intervals",
+      "docs-public-apis:@aws-cdk/aws-autoscaling-common.CompleteScalingInterval",
+      "docs-public-apis:@aws-cdk/aws-autoscaling-common.CompleteScalingInterval.lower",
+      "docs-public-apis:@aws-cdk/aws-autoscaling-common.CompleteScalingInterval.upper"
     ]
   },
   "engines": {
diff --git a/packages/@aws-cdk/aws-autoscaling-hooktargets/package.json b/packages/@aws-cdk/aws-autoscaling-hooktargets/package.json
index 8e645088ede8a..61fd571236b03 100644
--- a/packages/@aws-cdk/aws-autoscaling-hooktargets/package.json
+++ b/packages/@aws-cdk/aws-autoscaling-hooktargets/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@aws-cdk/aws-autoscaling-hooktargets",
-  "version": "1.13.1",
+  "version": "1.15.0",
   "description": "Lifecycle hook for AWS AutoScaling",
   "main": "lib/index.js",
   "types": "lib/index.d.ts",
@@ -71,32 +71,32 @@
   },
   "license": "Apache-2.0",
   "devDependencies": {
-    "@aws-cdk/assert": "1.13.1",
-    "@aws-cdk/aws-ec2": "1.13.1",
-    "cdk-build-tools": "^1.13.1",
-    "cdk-integ-tools": "^1.13.1",
-    "cfn2ts": "^1.13.1",
+    "@aws-cdk/assert": "1.15.0",
+    "@aws-cdk/aws-ec2": "1.15.0",
+    "cdk-build-tools": "^1.15.0",
+    "cdk-integ-tools": "^1.15.0",
+    "cfn2ts": "^1.15.0",
     "jest": "^24.9.0",
-    "pkglint": "^1.13.1"
+    "pkglint": "^1.15.0"
   },
   "dependencies": {
-    "@aws-cdk/aws-autoscaling": "1.13.1",
-    "@aws-cdk/aws-iam": "1.13.1",
-    "@aws-cdk/aws-lambda": "1.13.1",
-    "@aws-cdk/aws-sns": "1.13.1",
-    "@aws-cdk/aws-sns-subscriptions": "1.13.1",
-    "@aws-cdk/aws-sqs": "1.13.1",
-    "@aws-cdk/core": "1.13.1"
+    "@aws-cdk/aws-autoscaling": "1.15.0",
+    "@aws-cdk/aws-iam": "1.15.0",
+    "@aws-cdk/aws-lambda": "1.15.0",
+    "@aws-cdk/aws-sns": "1.15.0",
+    "@aws-cdk/aws-sns-subscriptions": "1.15.0",
+    "@aws-cdk/aws-sqs": "1.15.0",
+    "@aws-cdk/core": "1.15.0"
   },
   "homepage": "https://github.com/aws/aws-cdk",
   "peerDependencies": {
-    "@aws-cdk/aws-autoscaling": "1.13.1",
-    "@aws-cdk/aws-iam": "1.13.1",
-    "@aws-cdk/aws-lambda": "1.13.1",
-    "@aws-cdk/aws-sns": "1.13.1",
-    "@aws-cdk/aws-sns-subscriptions": "1.13.1",
-    "@aws-cdk/aws-sqs": "1.13.1",
-    "@aws-cdk/core": "1.13.1"
+    "@aws-cdk/aws-autoscaling": "1.15.0",
+    "@aws-cdk/aws-iam": "1.15.0",
+    "@aws-cdk/aws-lambda": "1.15.0",
+    "@aws-cdk/aws-sns": "1.15.0",
+    "@aws-cdk/aws-sns-subscriptions": "1.15.0",
+    "@aws-cdk/aws-sqs": "1.15.0",
+    "@aws-cdk/core": "1.15.0"
   },
   "engines": {
     "node": ">= 10.3.0"
diff --git a/packages/@aws-cdk/aws-autoscaling/lib/auto-scaling-group.ts b/packages/@aws-cdk/aws-autoscaling/lib/auto-scaling-group.ts
index db8209eccc379..d67a98c0173c6 100644
--- a/packages/@aws-cdk/aws-autoscaling/lib/auto-scaling-group.ts
+++ b/packages/@aws-cdk/aws-autoscaling/lib/auto-scaling-group.ts
@@ -348,7 +348,8 @@ export class AutoScalingGroup extends AutoScalingGroupBase implements
   elb.ILoadBalancerTarget,
   ec2.IConnectable,
   elbv2.IApplicationLoadBalancerTarget,
-  elbv2.INetworkLoadBalancerTarget {
+  elbv2.INetworkLoadBalancerTarget,
+  iam.IGrantable {
 
   public static fromAutoScalingGroupName(scope: Construct, id: string, autoScalingGroupName: string): IAutoScalingGroup {
     class Import extends AutoScalingGroupBase {
@@ -378,6 +379,11 @@ export class AutoScalingGroup extends AutoScalingGroupBase implements
    */
   public readonly role: iam.IRole;
 
+  /**
+   * The principal to grant permissions to
+   */
+  public readonly grantPrincipal: iam.IPrincipal;
+
   /**
    * Name of the AutoScalingGroup
    */
@@ -421,6 +427,8 @@ export class AutoScalingGroup extends AutoScalingGroupBase implements
       assumedBy: new iam.ServicePrincipal('ec2.amazonaws.com')
     });
 
+    this.grantPrincipal = this.role;
+
     const iamProfile = new iam.CfnInstanceProfile(this, 'InstanceProfile', {
       roles: [ this.role.roleName ]
     });
diff --git a/packages/@aws-cdk/aws-autoscaling/package.json b/packages/@aws-cdk/aws-autoscaling/package.json
index 2fba78623833a..0a179735c149d 100644
--- a/packages/@aws-cdk/aws-autoscaling/package.json
+++ b/packages/@aws-cdk/aws-autoscaling/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@aws-cdk/aws-autoscaling",
-  "version": "1.13.1",
+  "version": "1.15.0",
   "description": "The CDK Construct Library for AWS::AutoScaling",
   "main": "lib/index.js",
   "types": "lib/index.d.ts",
@@ -63,33 +63,33 @@
   },
   "license": "Apache-2.0",
   "devDependencies": {
-    "@aws-cdk/assert": "1.13.1",
-    "@aws-cdk/cx-api": "1.13.1",
-    "cdk-build-tools": "^1.13.1",
-    "cdk-integ-tools": "^1.13.1",
-    "cfn2ts": "^1.13.1",
-    "pkglint": "^1.13.1"
+    "@aws-cdk/assert": "1.15.0",
+    "@aws-cdk/cx-api": "1.15.0",
+    "cdk-build-tools": "^1.15.0",
+    "cdk-integ-tools": "^1.15.0",
+    "cfn2ts": "^1.15.0",
+    "pkglint": "^1.15.0"
   },
   "dependencies": {
-    "@aws-cdk/aws-autoscaling-common": "1.13.1",
-    "@aws-cdk/aws-cloudwatch": "1.13.1",
-    "@aws-cdk/aws-ec2": "1.13.1",
-    "@aws-cdk/aws-elasticloadbalancing": "1.13.1",
-    "@aws-cdk/aws-elasticloadbalancingv2": "1.13.1",
-    "@aws-cdk/aws-iam": "1.13.1",
-    "@aws-cdk/aws-sns": "1.13.1",
-    "@aws-cdk/core": "1.13.1"
+    "@aws-cdk/aws-autoscaling-common": "1.15.0",
+    "@aws-cdk/aws-cloudwatch": "1.15.0",
+    "@aws-cdk/aws-ec2": "1.15.0",
+    "@aws-cdk/aws-elasticloadbalancing": "1.15.0",
+    "@aws-cdk/aws-elasticloadbalancingv2": "1.15.0",
+    "@aws-cdk/aws-iam": "1.15.0",
+    "@aws-cdk/aws-sns": "1.15.0",
+    "@aws-cdk/core": "1.15.0"
   },
   "homepage": "https://github.com/aws/aws-cdk",
   "peerDependencies": {
-    "@aws-cdk/aws-autoscaling-common": "1.13.1",
-    "@aws-cdk/aws-cloudwatch": "1.13.1",
-    "@aws-cdk/aws-ec2": "1.13.1",
-    "@aws-cdk/aws-elasticloadbalancing": "1.13.1",
-    "@aws-cdk/aws-elasticloadbalancingv2": "1.13.1",
-    "@aws-cdk/aws-iam": "1.13.1",
-    "@aws-cdk/aws-sns": "1.13.1",
-    "@aws-cdk/core": "1.13.1"
+    "@aws-cdk/aws-autoscaling-common": "1.15.0",
+    "@aws-cdk/aws-cloudwatch": "1.15.0",
+    "@aws-cdk/aws-ec2": "1.15.0",
+    "@aws-cdk/aws-elasticloadbalancing": "1.15.0",
+    "@aws-cdk/aws-elasticloadbalancingv2": "1.15.0",
+    "@aws-cdk/aws-iam": "1.15.0",
+    "@aws-cdk/aws-sns": "1.15.0",
+    "@aws-cdk/core": "1.15.0"
   },
   "engines": {
     "node": ">= 10.3.0"
@@ -100,7 +100,40 @@
       "resource-interface-extends-construct:@aws-cdk/aws-autoscaling.IAutoScalingGroup",
       "export:@aws-cdk/aws-autoscaling.IAutoScalingGroup",
       "props-physical-name:@aws-cdk/aws-autoscaling.AutoScalingGroupProps",
-      "props-physical-name:@aws-cdk/aws-autoscaling.ScheduledActionProps"
+      "props-physical-name:@aws-cdk/aws-autoscaling.ScheduledActionProps",
+      "props-default-doc:@aws-cdk/aws-autoscaling.EbsDeviceOptionsBase.iops",
+      "docs-public-apis:@aws-cdk/aws-autoscaling.ScalingProcess.ADD_TO_LOAD_BALANCER",
+      "docs-public-apis:@aws-cdk/aws-autoscaling.ScalingProcess.SCHEDULED_ACTIONS",
+      "docs-public-apis:@aws-cdk/aws-autoscaling.ScalingProcess.ALARM_NOTIFICATION",
+      "docs-public-apis:@aws-cdk/aws-autoscaling.ScalingProcess.AZ_REBALANCE",
+      "docs-public-apis:@aws-cdk/aws-autoscaling.AutoScalingGroup.fromAutoScalingGroupName",
+      "docs-public-apis:@aws-cdk/aws-autoscaling.BlockDeviceVolume.ebsDevice",
+      "docs-public-apis:@aws-cdk/aws-autoscaling.BlockDeviceVolume.virtualName",
+      "docs-public-apis:@aws-cdk/aws-autoscaling.HealthCheck.type",
+      "docs-public-apis:@aws-cdk/aws-autoscaling.HealthCheck.gracePeriod",
+      "docs-public-apis:@aws-cdk/aws-autoscaling.StepScalingPolicy.lowerAction",
+      "docs-public-apis:@aws-cdk/aws-autoscaling.StepScalingPolicy.lowerAlarm",
+      "docs-public-apis:@aws-cdk/aws-autoscaling.StepScalingPolicy.upperAction",
+      "docs-public-apis:@aws-cdk/aws-autoscaling.StepScalingPolicy.upperAlarm",
+      "docs-public-apis:@aws-cdk/aws-autoscaling.TargetTrackingScalingPolicy",
+      "docs-public-apis:@aws-cdk/aws-autoscaling.BasicStepScalingPolicyProps",
+      "docs-public-apis:@aws-cdk/aws-autoscaling.BlockDevice",
+      "docs-public-apis:@aws-cdk/aws-autoscaling.EbsDeviceOptions",
+      "docs-public-apis:@aws-cdk/aws-autoscaling.EbsDeviceOptionsBase",
+      "docs-public-apis:@aws-cdk/aws-autoscaling.ScalingProcess.REPLACE_UNHEALTHY",
+      "docs-public-apis:@aws-cdk/aws-autoscaling.EbsDeviceProps",
+      "docs-public-apis:@aws-cdk/aws-autoscaling.EbsDeviceProps.snapshotId",
+      "props-default-doc:@aws-cdk/aws-autoscaling.EbsDeviceProps.snapshotId",
+      "docs-public-apis:@aws-cdk/aws-autoscaling.EbsDeviceSnapshotOptions",
+      "docs-public-apis:@aws-cdk/aws-autoscaling.StepScalingPolicyProps",
+      "docs-public-apis:@aws-cdk/aws-autoscaling.TargetTrackingScalingPolicyProps.autoScalingGroup",
+      "docs-public-apis:@aws-cdk/aws-autoscaling.DefaultResult",
+      "docs-public-apis:@aws-cdk/aws-autoscaling.DefaultResult.CONTINUE",
+      "docs-public-apis:@aws-cdk/aws-autoscaling.DefaultResult.ABANDON",
+      "docs-public-apis:@aws-cdk/aws-autoscaling.ScalingProcess",
+      "docs-public-apis:@aws-cdk/aws-autoscaling.ScalingProcess.LAUNCH",
+      "docs-public-apis:@aws-cdk/aws-autoscaling.ScalingProcess.TERMINATE",
+      "docs-public-apis:@aws-cdk/aws-autoscaling.ScalingProcess.HEALTH_CHECK"
     ]
   },
   "stability": "stable"
diff --git a/packages/@aws-cdk/aws-autoscalingplans/package.json b/packages/@aws-cdk/aws-autoscalingplans/package.json
index e1f2f7782aedb..584718d7400f7 100644
--- a/packages/@aws-cdk/aws-autoscalingplans/package.json
+++ b/packages/@aws-cdk/aws-autoscalingplans/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@aws-cdk/aws-autoscalingplans",
-  "version": "1.13.1",
+  "version": "1.15.0",
   "description": "The CDK Construct Library for AWS::AutoScalingPlans",
   "main": "lib/index.js",
   "types": "lib/index.d.ts",
@@ -63,17 +63,17 @@
   },
   "license": "Apache-2.0",
   "devDependencies": {
-    "@aws-cdk/assert": "1.13.1",
-    "cdk-build-tools": "^1.13.1",
-    "cfn2ts": "^1.13.1",
-    "pkglint": "^1.13.1"
+    "@aws-cdk/assert": "1.15.0",
+    "cdk-build-tools": "^1.15.0",
+    "cfn2ts": "^1.15.0",
+    "pkglint": "^1.15.0"
   },
   "dependencies": {
-    "@aws-cdk/core": "1.13.1"
+    "@aws-cdk/core": "1.15.0"
   },
   "homepage": "https://github.com/aws/aws-cdk",
   "peerDependencies": {
-    "@aws-cdk/core": "1.13.1"
+    "@aws-cdk/core": "1.15.0"
   },
   "engines": {
     "node": ">= 10.3.0"
diff --git a/packages/@aws-cdk/aws-backup/package.json b/packages/@aws-cdk/aws-backup/package.json
index 81de0ee1e9a78..8f43ef81e1d78 100644
--- a/packages/@aws-cdk/aws-backup/package.json
+++ b/packages/@aws-cdk/aws-backup/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@aws-cdk/aws-backup",
-  "version": "1.13.1",
+  "version": "1.15.0",
   "description": "The CDK Construct Library for AWS::Backup",
   "main": "lib/index.js",
   "types": "lib/index.d.ts",
@@ -65,16 +65,16 @@
   },
   "license": "Apache-2.0",
   "devDependencies": {
-    "@aws-cdk/assert": "1.13.1",
-    "cdk-build-tools": "^1.13.1",
-    "cfn2ts": "1.13.1",
-    "pkglint": "^1.13.1"
+    "@aws-cdk/assert": "1.15.0",
+    "cdk-build-tools": "^1.15.0",
+    "cfn2ts": "1.15.0",
+    "pkglint": "^1.15.0"
   },
   "dependencies": {
-    "@aws-cdk/core": "1.13.1"
+    "@aws-cdk/core": "1.15.0"
   },
   "peerDependencies": {
-    "@aws-cdk/core": "1.13.1"
+    "@aws-cdk/core": "1.15.0"
   },
   "engines": {
     "node": ">= 10.3.0"
diff --git a/packages/@aws-cdk/aws-batch/package.json b/packages/@aws-cdk/aws-batch/package.json
index 8f73a8e5f65e3..ad646866ed49d 100644
--- a/packages/@aws-cdk/aws-batch/package.json
+++ b/packages/@aws-cdk/aws-batch/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@aws-cdk/aws-batch",
-  "version": "1.13.1",
+  "version": "1.15.0",
   "description": "The CDK Construct Library for AWS::Batch",
   "main": "lib/index.js",
   "types": "lib/index.d.ts",
@@ -63,17 +63,17 @@
   },
   "license": "Apache-2.0",
   "devDependencies": {
-    "@aws-cdk/assert": "1.13.1",
-    "cdk-build-tools": "^1.13.1",
-    "cfn2ts": "^1.13.1",
-    "pkglint": "^1.13.1"
+    "@aws-cdk/assert": "1.15.0",
+    "cdk-build-tools": "^1.15.0",
+    "cfn2ts": "^1.15.0",
+    "pkglint": "^1.15.0"
   },
   "dependencies": {
-    "@aws-cdk/core": "1.13.1"
+    "@aws-cdk/core": "1.15.0"
   },
   "homepage": "https://github.com/aws/aws-cdk",
   "peerDependencies": {
-    "@aws-cdk/core": "1.13.1"
+    "@aws-cdk/core": "1.15.0"
   },
   "engines": {
     "node": ">= 10.3.0"
diff --git a/packages/@aws-cdk/aws-budgets/package.json b/packages/@aws-cdk/aws-budgets/package.json
index 1dd8d50f15afd..e32c0d219a317 100644
--- a/packages/@aws-cdk/aws-budgets/package.json
+++ b/packages/@aws-cdk/aws-budgets/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@aws-cdk/aws-budgets",
-  "version": "1.13.1",
+  "version": "1.15.0",
   "description": "The CDK Construct Library for AWS::Budgets",
   "main": "lib/index.js",
   "types": "lib/index.d.ts",
@@ -63,17 +63,17 @@
   },
   "license": "Apache-2.0",
   "devDependencies": {
-    "@aws-cdk/assert": "1.13.1",
-    "cdk-build-tools": "^1.13.1",
-    "cfn2ts": "^1.13.1",
-    "pkglint": "^1.13.1"
+    "@aws-cdk/assert": "1.15.0",
+    "cdk-build-tools": "^1.15.0",
+    "cfn2ts": "^1.15.0",
+    "pkglint": "^1.15.0"
   },
   "dependencies": {
-    "@aws-cdk/core": "1.13.1"
+    "@aws-cdk/core": "1.15.0"
   },
   "homepage": "https://github.com/aws/aws-cdk",
   "peerDependencies": {
-    "@aws-cdk/core": "1.13.1"
+    "@aws-cdk/core": "1.15.0"
   },
   "engines": {
     "node": ">= 10.3.0"
diff --git a/packages/@aws-cdk/aws-certificatemanager/lambda-packages/dns_validated_certificate_handler/.node-version b/packages/@aws-cdk/aws-certificatemanager/lambda-packages/dns_validated_certificate_handler/.node-version
index 7f6758ef97bc0..6495db7e2138e 100644
--- a/packages/@aws-cdk/aws-certificatemanager/lambda-packages/dns_validated_certificate_handler/.node-version
+++ b/packages/@aws-cdk/aws-certificatemanager/lambda-packages/dns_validated_certificate_handler/.node-version
@@ -1 +1 @@
-8.10.0
+10.3.0
\ No newline at end of file
diff --git a/packages/@aws-cdk/aws-certificatemanager/lambda-packages/dns_validated_certificate_handler/package.json b/packages/@aws-cdk/aws-certificatemanager/lambda-packages/dns_validated_certificate_handler/package.json
index ac0e2cdf9951d..1a7a327ea822b 100644
--- a/packages/@aws-cdk/aws-certificatemanager/lambda-packages/dns_validated_certificate_handler/package.json
+++ b/packages/@aws-cdk/aws-certificatemanager/lambda-packages/dns_validated_certificate_handler/package.json
@@ -1,7 +1,7 @@
 {
   "name": "dns_validated_certificate_handler",
   "private": true,
-  "version": "1.13.1",
+  "version": "1.15.0",
   "description": "This module is part of the [AWS Cloud Development Kit](https://github.com/aws/aws-cdk) project.",
   "main": "lib/index.js",
   "directories": {
diff --git a/packages/@aws-cdk/aws-certificatemanager/lib/dns-validated-certificate.ts b/packages/@aws-cdk/aws-certificatemanager/lib/dns-validated-certificate.ts
index 5b1e5f1987dfb..e3d273122b99d 100644
--- a/packages/@aws-cdk/aws-certificatemanager/lib/dns-validated-certificate.ts
+++ b/packages/@aws-cdk/aws-certificatemanager/lib/dns-validated-certificate.ts
@@ -61,7 +61,7 @@ export class DnsValidatedCertificate extends cdk.Resource implements ICertificat
         const requestorFunction = new lambda.Function(this, 'CertificateRequestorFunction', {
             code: lambda.Code.fromAsset(path.resolve(__dirname, '..', 'lambda-packages', 'dns_validated_certificate_handler', 'lib')),
             handler: 'index.certificateRequestHandler',
-            runtime: lambda.Runtime.NODEJS_8_10,
+            runtime: lambda.Runtime.NODEJS_10_X,
             timeout: cdk.Duration.minutes(15),
             role: props.customResourceRole
         });
diff --git a/packages/@aws-cdk/aws-certificatemanager/lib/index.ts b/packages/@aws-cdk/aws-certificatemanager/lib/index.ts
index 85e821e42fbb6..ee15ab71b8d4b 100644
--- a/packages/@aws-cdk/aws-certificatemanager/lib/index.ts
+++ b/packages/@aws-cdk/aws-certificatemanager/lib/index.ts
@@ -1,5 +1,6 @@
 export * from './certificate';
 export * from './dns-validated-certificate';
+export * from './util';
 
 // AWS::CertificateManager CloudFormation Resources:
 export * from './certificatemanager.generated';
diff --git a/packages/@aws-cdk/aws-certificatemanager/lib/util.ts b/packages/@aws-cdk/aws-certificatemanager/lib/util.ts
index 29710565b772d..d18dbb67f62d1 100644
--- a/packages/@aws-cdk/aws-certificatemanager/lib/util.ts
+++ b/packages/@aws-cdk/aws-certificatemanager/lib/util.ts
@@ -1,3 +1,6 @@
+import { Arn, Stack, Token } from '@aws-cdk/core';
+import { ICertificate } from './certificate';
+import { DnsValidatedCertificate } from './dns-validated-certificate';
 import publicSuffixes = require('./public-suffixes');
 
 /**
@@ -16,3 +19,33 @@ export function apexDomain(domainName: string): string {
   }
   return accumulated.reverse().join('.');
 }
+
+export function isDnsValidatedCertificate(cert: ICertificate): cert is DnsValidatedCertificate {
+  return cert.hasOwnProperty('domainName');
+}
+
+export function getCertificateRegion(cert: ICertificate): string | undefined {
+  const { certificateArn, stack } = cert;
+
+  if (isDnsValidatedCertificate(cert)) {
+    const requestResource = cert.node.findChild('CertificateRequestorResource').node.defaultChild;
+
+    // @ts-ignore
+    const { _cfnProperties: properties } = requestResource;
+    const { Region: region } = properties;
+
+    if (region && !Token.isUnresolved(region)) {
+      return region;
+    }
+  }
+
+  {
+    const { region } = Arn.parse(certificateArn);
+
+    if (region && !Token.isUnresolved(region)) {
+      return region;
+    }
+  }
+
+  return Stack.of(stack).region;
+}
diff --git a/packages/@aws-cdk/aws-certificatemanager/package.json b/packages/@aws-cdk/aws-certificatemanager/package.json
index 17071a7c753ef..fe278a8e68e34 100644
--- a/packages/@aws-cdk/aws-certificatemanager/package.json
+++ b/packages/@aws-cdk/aws-certificatemanager/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@aws-cdk/aws-certificatemanager",
-  "version": "1.13.1",
+  "version": "1.15.0",
   "description": "The CDK Construct Library for AWS::CertificateManager",
   "main": "lib/index.js",
   "types": "lib/index.d.ts",
@@ -63,25 +63,25 @@
   },
   "license": "Apache-2.0",
   "devDependencies": {
-    "@aws-cdk/assert": "1.13.1",
-    "cdk-build-tools": "^1.13.1",
-    "cfn2ts": "^1.13.1",
-    "pkglint": "^1.13.1"
+    "@aws-cdk/assert": "1.15.0",
+    "cdk-build-tools": "^1.15.0",
+    "cfn2ts": "^1.15.0",
+    "pkglint": "^1.15.0"
   },
   "dependencies": {
-    "@aws-cdk/aws-cloudformation": "1.13.1",
-    "@aws-cdk/aws-iam": "1.13.1",
-    "@aws-cdk/aws-lambda": "1.13.1",
-    "@aws-cdk/aws-route53": "1.13.1",
-    "@aws-cdk/core": "1.13.1"
+    "@aws-cdk/aws-cloudformation": "1.15.0",
+    "@aws-cdk/aws-iam": "1.15.0",
+    "@aws-cdk/aws-lambda": "1.15.0",
+    "@aws-cdk/aws-route53": "1.15.0",
+    "@aws-cdk/core": "1.15.0"
   },
   "homepage": "https://github.com/aws/aws-cdk",
   "peerDependencies": {
-    "@aws-cdk/aws-cloudformation": "1.13.1",
-    "@aws-cdk/aws-iam": "1.13.1",
-    "@aws-cdk/aws-lambda": "1.13.1",
-    "@aws-cdk/aws-route53": "1.13.1",
-    "@aws-cdk/core": "1.13.1"
+    "@aws-cdk/aws-cloudformation": "1.15.0",
+    "@aws-cdk/aws-iam": "1.15.0",
+    "@aws-cdk/aws-lambda": "1.15.0",
+    "@aws-cdk/aws-route53": "1.15.0",
+    "@aws-cdk/core": "1.15.0"
   },
   "engines": {
     "node": ">= 10.3.0"
@@ -89,7 +89,9 @@
   "awslint": {
     "exclude": [
       "props-physical-name:@aws-cdk/aws-certificatemanager.CertificateProps",
-      "props-physical-name:@aws-cdk/aws-certificatemanager.DnsValidatedCertificateProps"
+      "props-physical-name:@aws-cdk/aws-certificatemanager.DnsValidatedCertificateProps",
+      "docs-public-apis:@aws-cdk/aws-certificatemanager.DnsValidatedCertificateProps",
+      "docs-public-apis:@aws-cdk/aws-certificatemanager.ICertificate"
     ]
   },
   "stability": "stable"
diff --git a/packages/@aws-cdk/aws-certificatemanager/test/test.dns-validated-certificate.ts b/packages/@aws-cdk/aws-certificatemanager/test/test.dns-validated-certificate.ts
index 7768b0060e093..4efbbe454157b 100644
--- a/packages/@aws-cdk/aws-certificatemanager/test/test.dns-validated-certificate.ts
+++ b/packages/@aws-cdk/aws-certificatemanager/test/test.dns-validated-certificate.ts
@@ -32,7 +32,7 @@ export = {
     }));
     expect(stack).to(haveResource('AWS::Lambda::Function', {
       Handler: 'index.certificateRequestHandler',
-      Runtime: 'nodejs8.10',
+      Runtime: 'nodejs10.x',
       Timeout: 900,
     }));
     expect(stack).to(haveResource('AWS::IAM::Policy', {
diff --git a/packages/@aws-cdk/aws-certificatemanager/test/test.util.ts b/packages/@aws-cdk/aws-certificatemanager/test/test.util.ts
index b14cb669873b1..78b2bc597b14d 100644
--- a/packages/@aws-cdk/aws-certificatemanager/test/test.util.ts
+++ b/packages/@aws-cdk/aws-certificatemanager/test/test.util.ts
@@ -1,15 +1,108 @@
+import { PublicHostedZone } from '@aws-cdk/aws-route53';
+import { App, Stack } from '@aws-cdk/core';
 import { Test } from 'nodeunit';
-import { apexDomain } from '../lib/util';
+import { Certificate, DnsValidatedCertificate } from '../lib';
+import { apexDomain, getCertificateRegion, isDnsValidatedCertificate } from '../lib/util';
 
 export = {
-  'apex domain returns right domain'(test: Test) {
-    test.equals('domain.com', apexDomain('domain.com'));
-    test.equals('domain.com', apexDomain('test.domain.com'));
-    test.done();
+  'apex domain': {
+    'returns right domain'(test: Test) {
+      test.equals('domain.com', apexDomain('domain.com'));
+      test.equals('domain.com', apexDomain('test.domain.com'));
+      test.done();
+    },
+
+    'understands eTLDs'(test: Test) {
+      test.equals('domain.co.uk', apexDomain('test.domain.co.uk'));
+      test.done();
+    },
+  },
+  'isDnsValidatedCertificate': {
+    'new DnsValidatedCertificate is a DnsValidatedCertificate'(test: Test) {
+      const stack = new Stack();
+
+      const hostedZone = new PublicHostedZone(stack, 'ExampleDotCom', {
+        zoneName: 'example.com'
+      });
+      const cert = new DnsValidatedCertificate(stack, 'Certificate', {
+        domainName: 'test.example.com',
+        hostedZone
+      });
+
+      test.ok(isDnsValidatedCertificate(cert));
+      test.done();
+    },
+    'new Certificate is not a DnsValidatedCertificate'(test: Test) {
+      const stack = new Stack();
+
+      const cert = new Certificate(stack, 'Certificate', {
+        domainName: 'test.example.com'
+      });
+
+      test.ok(!isDnsValidatedCertificate(cert));
+      test.done();
+    },
+    'fromCertificateArn is not a DnsValidatedCertificate'(test: Test) {
+      const stack = new Stack();
+
+      const cert = Certificate.fromCertificateArn(stack, 'Certificate', 'cert-arn');
+
+      test.ok(!isDnsValidatedCertificate(cert));
+      test.done();
+    },
   },
+  'getCertificateRegion': {
+    'from stack'(test: Test) {
+      // GIVEN
+      const app = new App();
+      const stack = new Stack(app, 'RegionStack', {env: {region: 'eu-west-1'}});
 
-  'apex domain understands eTLDs'(test: Test) {
-    test.equals('domain.co.uk', apexDomain('test.domain.co.uk'));
-    test.done();
-  }
+      const certificate = new Certificate(stack, 'TestCertificate', {
+        domainName: 'www.example.com',
+      });
+
+      test.equals(getCertificateRegion(certificate), 'eu-west-1');
+      test.done();
+    },
+    'from DnsValidatedCertificate region'(test: Test) {
+      // GIVEN
+      const app = new App();
+      const stack = new Stack(app, 'RegionStack', {env: {region: 'eu-west-1'}});
+      const hostedZone = new PublicHostedZone(stack, 'ExampleDotCom', {
+        zoneName: 'example.com'
+      });
+
+      const certificate = new DnsValidatedCertificate(stack, 'TestCertificate', {
+        domainName: 'www.example.com',
+        hostedZone,
+        region: 'eu-west-3'
+      });
+
+      test.equals(getCertificateRegion(certificate), 'eu-west-3');
+      test.done();
+    },
+    'fromCertificateArn'(test: Test) {
+      // GIVEN
+      const app = new App();
+      const stack = new Stack(app, 'RegionStack', {env: {region: 'eu-west-1'}});
+
+      const certificate = Certificate.fromCertificateArn(
+        stack, 'TestCertificate', 'arn:aws:acm:us-east-2:1111111:certificate/11-3336f1-44483d-adc7-9cd375c5169d'
+        );
+
+      test.equals(getCertificateRegion(certificate), 'us-east-2');
+      test.done();
+    },
+    'region agnostic stack'(test: Test) {
+      // GIVEN
+      const stack = new Stack();
+
+      const certificate = new Certificate(stack, 'TestCertificate', {
+        domainName: 'www.example.com',
+      });
+
+      test.equals(getCertificateRegion(certificate), '${Token[AWS::Region.4]}');
+      test.done();
+    },
+  },
 };
diff --git a/packages/@aws-cdk/aws-cloud9/package.json b/packages/@aws-cdk/aws-cloud9/package.json
index 76a05a55cf02c..3d3c16ff55295 100644
--- a/packages/@aws-cdk/aws-cloud9/package.json
+++ b/packages/@aws-cdk/aws-cloud9/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@aws-cdk/aws-cloud9",
-  "version": "1.13.1",
+  "version": "1.15.0",
   "description": "The CDK Construct Library for AWS::Cloud9",
   "main": "lib/index.js",
   "types": "lib/index.d.ts",
@@ -63,17 +63,17 @@
   },
   "license": "Apache-2.0",
   "devDependencies": {
-    "@aws-cdk/assert": "1.13.1",
-    "cdk-build-tools": "^1.13.1",
-    "cfn2ts": "^1.13.1",
-    "pkglint": "^1.13.1"
+    "@aws-cdk/assert": "1.15.0",
+    "cdk-build-tools": "^1.15.0",
+    "cfn2ts": "^1.15.0",
+    "pkglint": "^1.15.0"
   },
   "dependencies": {
-    "@aws-cdk/core": "1.13.1"
+    "@aws-cdk/core": "1.15.0"
   },
   "homepage": "https://github.com/aws/aws-cdk",
   "peerDependencies": {
-    "@aws-cdk/core": "1.13.1"
+    "@aws-cdk/core": "1.15.0"
   },
   "engines": {
     "node": ">= 10.3.0"
diff --git a/packages/@aws-cdk/aws-cloudformation/lib/nested-stack.ts b/packages/@aws-cdk/aws-cloudformation/lib/nested-stack.ts
index 1b1061fcfe7fc..f0cb88607f284 100644
--- a/packages/@aws-cdk/aws-cloudformation/lib/nested-stack.ts
+++ b/packages/@aws-cdk/aws-cloudformation/lib/nested-stack.ts
@@ -149,7 +149,8 @@ export class NestedStack extends Stack {
     // the nested stack references a resource from the parent stack:
     // we pass it through a as a cloudformation parameter
     if (targetStack === sourceStack.parentStack) {
-      const paramId = `reference-to-${reference.target.node.uniqueId}.${reference.displayName}`;
+      // we call "this.resolve" to ensure that tokens do not creep in (for example, if the reference display name includes tokens)
+      const paramId = this.resolve(`reference-to-${reference.target.node.uniqueId}.${reference.displayName}`);
       let param = this.node.tryFindChild(paramId) as CfnParameter;
       if (!param) {
         param = new CfnParameter(this, paramId, { type: 'String' });
@@ -195,7 +196,7 @@ export class NestedStack extends Stack {
       output = new CfnOutput(this, outputId, { value: Token.asString(reference) });
     }
 
-    return this.resource.getAtt(`Outputs.${outputId}`);
+    return this.resource.getAtt(`Outputs.${output.logicalId}`);
   }
 
   private contextualAttribute(innerValue: string, outerValue: string) {
diff --git a/packages/@aws-cdk/aws-cloudformation/package.json b/packages/@aws-cdk/aws-cloudformation/package.json
index 223967023dd09..a991c7751eb5a 100644
--- a/packages/@aws-cdk/aws-cloudformation/package.json
+++ b/packages/@aws-cdk/aws-cloudformation/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@aws-cdk/aws-cloudformation",
-  "version": "1.13.1",
+  "version": "1.15.0",
   "description": "CDK Constructs for AWS CloudFormation",
   "main": "lib/index.js",
   "types": "lib/index.d.ts",
@@ -63,34 +63,34 @@
   },
   "license": "Apache-2.0",
   "devDependencies": {
-    "@aws-cdk/assert": "1.13.1",
-    "@aws-cdk/aws-events": "1.13.1",
-    "@aws-cdk/aws-s3-assets": "1.13.1",
-    "@aws-cdk/aws-sns-subscriptions": "1.13.1",
-    "@aws-cdk/aws-sqs": "1.13.1",
-    "@aws-cdk/aws-ssm": "1.13.1",
+    "@aws-cdk/assert": "1.15.0",
+    "@aws-cdk/aws-events": "1.15.0",
+    "@aws-cdk/aws-s3-assets": "1.15.0",
+    "@aws-cdk/aws-sns-subscriptions": "1.15.0",
+    "@aws-cdk/aws-sqs": "1.15.0",
+    "@aws-cdk/aws-ssm": "1.15.0",
     "@types/aws-lambda": "^8.10.33",
-    "cdk-build-tools": "^1.13.1",
-    "cdk-integ-tools": "^1.13.1",
-    "cfn2ts": "^1.13.1",
-    "pkglint": "^1.13.1"
+    "cdk-build-tools": "^1.15.0",
+    "cdk-integ-tools": "^1.15.0",
+    "cfn2ts": "^1.15.0",
+    "pkglint": "^1.15.0"
   },
   "dependencies": {
-    "@aws-cdk/aws-iam": "1.13.1",
-    "@aws-cdk/aws-lambda": "1.13.1",
-    "@aws-cdk/aws-s3": "1.13.1",
-    "@aws-cdk/aws-sns": "1.13.1",
-    "@aws-cdk/core": "1.13.1",
-    "@aws-cdk/cx-api": "1.13.1"
+    "@aws-cdk/aws-iam": "1.15.0",
+    "@aws-cdk/aws-lambda": "1.15.0",
+    "@aws-cdk/aws-s3": "1.15.0",
+    "@aws-cdk/aws-sns": "1.15.0",
+    "@aws-cdk/core": "1.15.0",
+    "@aws-cdk/cx-api": "1.15.0"
   },
   "homepage": "https://github.com/aws/aws-cdk",
   "peerDependencies": {
-    "@aws-cdk/aws-iam": "1.13.1",
-    "@aws-cdk/aws-lambda": "1.13.1",
-    "@aws-cdk/aws-s3": "1.13.1",
-    "@aws-cdk/aws-sns": "1.13.1",
-    "@aws-cdk/core": "1.13.1",
-    "@aws-cdk/cx-api": "1.13.1"
+    "@aws-cdk/aws-iam": "1.15.0",
+    "@aws-cdk/aws-lambda": "1.15.0",
+    "@aws-cdk/aws-s3": "1.15.0",
+    "@aws-cdk/aws-sns": "1.15.0",
+    "@aws-cdk/core": "1.15.0",
+    "@aws-cdk/cx-api": "1.15.0"
   },
   "engines": {
     "node": ">= 10.3.0"
@@ -101,7 +101,10 @@
       "construct-ctor:@aws-cdk/aws-cloudformation.PipelineCloudFormationDeployAction.<initializer>",
       "construct-ctor-props-optional:@aws-cdk/aws-cloudformation.AwsCustomResource",
       "no-unused-type:@aws-cdk/aws-cloudformation.CloudFormationCapabilities",
-      "props-physical-name:@aws-cdk/aws-cloudformation.CustomResourceProps"
+      "props-physical-name:@aws-cdk/aws-cloudformation.CustomResourceProps",
+      "docs-public-apis:@aws-cdk/aws-cloudformation.CustomResourceProvider",
+      "docs-public-apis:@aws-cdk/aws-cloudformation.CustomResourceProvider.serviceToken",
+      "docs-public-apis:@aws-cdk/aws-cloudformation.NestedStackProps"
     ]
   },
   "stability": "stable"
diff --git a/packages/@aws-cdk/aws-cloudformation/test/test.nested-stack.ts b/packages/@aws-cdk/aws-cloudformation/test/test.nested-stack.ts
index e75e4262c764b..41b9a1cf8753d 100644
--- a/packages/@aws-cdk/aws-cloudformation/test/test.nested-stack.ts
+++ b/packages/@aws-cdk/aws-cloudformation/test/test.nested-stack.ts
@@ -827,6 +827,50 @@ export = {
         data: 'bar'
       }
     ]);
+    test.done();
+  },
+
+  'referencing attributes with period across stacks'(test: Test) {
+    // GIVEN
+    const parent = new Stack();
+    const nested = new NestedStack(parent, 'nested');
+    const consumed = new CfnResource(nested, 'resource-in-nested', { type: 'CONSUMED' });
+
+    // WHEN
+    new CfnResource(parent, 'resource-in-parent', {
+      type: 'CONSUMER',
+      properties: {
+        ConsumedAttribute: consumed.getAtt('Consumed.Attribute')
+      }
+    });
+
+    // THEN
+    expect(nested).toMatch({
+      Resources: {
+        resourceinnested: {
+          Type: "CONSUMED"
+        }
+      },
+      Outputs: {
+        nestedresourceinnested59B1F01CConsumedAttribute: {
+          Value: {
+            "Fn::GetAtt": [
+              "resourceinnested",
+              "Consumed.Attribute"
+            ]
+          }
+        }
+      }
+    });
+    expect(parent).to(haveResource('CONSUMER', {
+      ConsumedAttribute: {
+        "Fn::GetAtt": [
+          "nestedNestedStacknestedNestedStackResource3DD143BF",
+          "Outputs.nestedresourceinnested59B1F01CConsumedAttribute"
+        ]
+      }
+    }));
+
     test.done();
   }
 };
diff --git a/packages/@aws-cdk/aws-cloudfront/README.md b/packages/@aws-cdk/aws-cloudfront/README.md
index 0980f2059ac30..fda46177e9d69 100644
--- a/packages/@aws-cdk/aws-cloudfront/README.md
+++ b/packages/@aws-cdk/aws-cloudfront/README.md
@@ -21,7 +21,7 @@ Example usage:
 
 ```ts
 const sourceBucket = new Bucket(this, 'Bucket');
- 
+
 const distribution = new CloudFrontWebDistribution(this, 'MyDistribution', {
     originConfigs: [
         {
@@ -33,3 +33,39 @@ const distribution = new CloudFrontWebDistribution(this, 'MyDistribution', {
     ]
  });
 ```
+
+### Viewer certificate
+
+By default, CloudFront Web Distributions will answer HTTPS requests with CloudFront's default certificate, only containing the distribution `domainName` (e.g. d111111abcdef8.cloudfront.net).
+You can customize the viewer certificate property to provide a custom certificate and/or list of domain name aliases to fit your needs.
+
+See [Using Alternate Domain Names and HTTPS](https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/using-https-alternate-domain-names.html) in the CloudFront User Guide.
+
+#### Default certificate
+
+You can customize the default certificate aliases. This is intended to be used in combination with CNAME records in your DNS zone.
+
+Example:
+
+[create a distrubution with an default certificiate example](test/example.default-cert-alias.lit.ts)
+
+#### ACM certificate
+
+You can change the default certificate by one stored Amazon Certificate Manager, or ACM.
+Those certificate can either be generated by AWS, or purchased by another CA imported into ACM.
+
+For more information, see [the aws-certificatemanager module documentation](https://docs.aws.amazon.com/cdk/api/latest/docs/aws-certificatemanager-readme.html) or [Importing Certificates into AWS Certificate Manager](https://docs.aws.amazon.com/acm/latest/userguide/import-certificate.html) in the AWS Certificate Manager User Guide.
+
+Example:
+
+[create a distrubution with an acm certificate example](test/example.acm-cert-alias.lit.ts)
+
+#### IAM certificate
+
+You can also import a certificate into the IAM certificate store.
+
+See [Importing an SSL/TLS Certificate](https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/cnames-and-https-procedures.html#cnames-and-https-uploading-certificates) in the CloudFront User Guide.
+
+Example:
+
+[create a distrubution with an iam certificate example](test/example.iam-cert-alias.lit.ts)
diff --git a/packages/@aws-cdk/aws-cloudfront/lib/web_distribution.ts b/packages/@aws-cdk/aws-cloudfront/lib/web_distribution.ts
index 1e31fd7790209..836ff3568636c 100644
--- a/packages/@aws-cdk/aws-cloudfront/lib/web_distribution.ts
+++ b/packages/@aws-cdk/aws-cloudfront/lib/web_distribution.ts
@@ -1,3 +1,4 @@
+import certificatemanager = require('@aws-cdk/aws-certificatemanager');
 import lambda = require('@aws-cdk/aws-lambda');
 import s3 = require('@aws-cdk/aws-s3');
 import cdk = require('@aws-cdk/core');
@@ -389,12 +390,104 @@ export enum LambdaEdgeEventType {
   VIEWER_RESPONSE = "viewer-response",
 }
 
+export interface ViewerCertificateOptions {
+  /**
+   * How CloudFront should serve HTTPS requests.
+   *
+   * See the notes on SSLMethod if you wish to use other SSL termination types.
+   *
+   * @default SSLMethod.SNI
+   * @see https://docs.aws.amazon.com/cloudfront/latest/APIReference/API_ViewerCertificate.html
+   */
+  readonly sslMethod?: SSLMethod;
+
+  /**
+   * The minimum version of the SSL protocol that you want CloudFront to use for HTTPS connections.
+   *
+   * CloudFront serves your objects only to browsers or devices that support at
+   * least the SSL version that you specify.
+   *
+   * @default - SSLv3 if sslMethod VIP, TLSv1 if sslMethod SNI
+   */
+  readonly securityPolicy?: SecurityPolicyProtocol;
+
+  /**
+   * Domain names on the certificate (both main domain name and Subject Alternative names)
+   */
+  readonly aliases?: string[];
+}
+
+/**
+ * Viewer certificate configuration class
+ */
+export class ViewerCertificate {
+  /**
+   * Generate an AWS Certificate Manager (ACM) viewer certificate configuration
+   *
+   * @param certificate AWS Certificate Manager (ACM) certificate.
+   *                    Your certificate must be located in the us-east-1 (US East (N. Virginia)) region to be accessed by CloudFront
+   * @param options certificate configuration options
+   */
+  public static fromAcmCertificate(certificate: certificatemanager.ICertificate, options: ViewerCertificateOptions = {}) {
+    const {
+       sslMethod: sslSupportMethod = SSLMethod.SNI,
+       securityPolicy: minimumProtocolVersion,
+       aliases,
+    } = options;
+
+    const certificateRegion = certificatemanager.getCertificateRegion(certificate);
+
+    if (certificateRegion && !cdk.Token.isUnresolved(certificateRegion) && certificateRegion !== 'us-east-1') {
+      throw new Error(`acmCertificate certficate must be in the us-east-1 region, got ${certificateRegion}`);
+    }
+
+    return new ViewerCertificate({
+      acmCertificateArn: certificate.certificateArn, sslSupportMethod, minimumProtocolVersion
+    }, aliases);
+  }
+
+  /**
+   * Generate an IAM viewer certificate configuration
+   *
+   * @param iamCertificateId Identifier of the IAM certificate
+   * @param options certificate configuration options
+   */
+  public static fromIamCertificate(iamCertificateId: string, options: ViewerCertificateOptions = {}) {
+    const {
+      sslMethod: sslSupportMethod = SSLMethod.SNI,
+      securityPolicy: minimumProtocolVersion,
+      aliases,
+    } = options;
+
+    return new ViewerCertificate({
+      iamCertificateId, sslSupportMethod, minimumProtocolVersion
+    }, aliases);
+  }
+
+  /**
+   * Generate a viewer certifcate configuration using
+   * the CloudFront default certificate (e.g. d111111abcdef8.cloudfront.net)
+   * and a {@link SecurityPolicyProtocol.TLS_V1} security policy.
+   *
+   * @param aliases Alternative CNAME aliases
+   *                You also must create a CNAME record with your DNS service to route queries
+   */
+  public static fromCloudFrontDefaultCertificate(...aliases: string[]) {
+    return new ViewerCertificate({ cloudFrontDefaultCertificate: true }, aliases);
+  }
+
+  private constructor(
+    public readonly props: CfnDistribution.ViewerCertificateProperty,
+    public readonly aliases: string[] = []) { }
+}
+
 export interface CloudFrontWebDistributionProps {
 
   /**
    * AliasConfiguration is used to configured CloudFront to respond to requests on custom domain names.
    *
    * @default - None.
+   * @deprecated see {@link CloudFrontWebDistributionProps#viewerCertificate} with {@link ViewerCertificate#acmCertificate}
    */
   readonly aliasConfiguration?: AliasConfiguration;
 
@@ -472,6 +565,16 @@ export interface CloudFrontWebDistributionProps {
    */
   readonly webACLId?: string;
 
+  /**
+   * Specifies whether you want viewers to use HTTP or HTTPS to request your objects,
+   * whether you're using an alternate domain name with HTTPS, and if so,
+   * if you're using AWS Certificate Manager (ACM) or a third-party certificate authority.
+   *
+   * @default ViewerCertificate.fromCloudFrontDefaultCertificate()
+   *
+   * @see https://aws.amazon.com/premiumsupport/knowledge-center/custom-ssl-certificate-cloudfront/
+   */
+  readonly viewerCertificate?: ViewerCertificate;
 }
 
 /**
@@ -542,12 +645,12 @@ export class CloudFrontWebDistribution extends cdk.Construct implements IDistrib
   /**
    * Maps for which SecurityPolicyProtocol are available to which SSLMethods
    */
-  private readonly VALID_SSL_PROTOCOLS: { [key: string]: string[] } = {
-    "sni-only": [
+  private readonly VALID_SSL_PROTOCOLS: { [method in SSLMethod]: string[] } = {
+    [SSLMethod.SNI]: [
       SecurityPolicyProtocol.TLS_V1, SecurityPolicyProtocol.TLS_V1_1_2016,
       SecurityPolicyProtocol.TLS_V1_2016, SecurityPolicyProtocol.TLS_V1_2_2018
     ],
-    "vip": [SecurityPolicyProtocol.SSL_V3, SecurityPolicyProtocol.TLS_V1],
+    [SSLMethod.VIP]: [SecurityPolicyProtocol.SSL_V3, SecurityPolicyProtocol.TLS_V1],
   };
 
   constructor(scope: cdk.Construct, id: string, props: CloudFrontWebDistributionProps) {
@@ -651,27 +754,31 @@ export class CloudFrontWebDistribution extends cdk.Construct implements IDistrib
 
     distributionConfig = { ...distributionConfig, cacheBehaviors: otherBehaviors.length > 0 ? otherBehaviors : undefined };
 
+    if (props.aliasConfiguration && props.viewerCertificate) {
+      throw new Error([
+        'You cannot set both aliasConfiguration and viewerCertificate properties.',
+        'Please only use viewerCertificate, as aliasConfiguration is deprecated.'
+      ].join(' '));
+    }
+
+    let _viewerCertificate = props.viewerCertificate;
     if (props.aliasConfiguration) {
-      const minimumProtocolVersion = props.aliasConfiguration.securityPolicy;
-      const sslSupportMethod = props.aliasConfiguration.sslMethod || SSLMethod.SNI;
-      const acmCertificateArn = props.aliasConfiguration.acmCertRef;
+      const {acmCertRef, securityPolicy, sslMethod, names: aliases} = props.aliasConfiguration;
 
-      distributionConfig = {
-        ...distributionConfig,
-        aliases: props.aliasConfiguration.names,
-        viewerCertificate: {
-          acmCertificateArn,
-          sslSupportMethod,
-          minimumProtocolVersion
-        }
-      };
+      _viewerCertificate = ViewerCertificate.fromAcmCertificate(
+        certificatemanager.Certificate.fromCertificateArn(scope, 'AliasConfigurationCert', acmCertRef),
+        { securityPolicy, sslMethod, aliases }
+      );
+    }
 
-      if (minimumProtocolVersion !== undefined) {
-        const validProtocols = this.VALID_SSL_PROTOCOLS[sslSupportMethod.toString()];
+    if (_viewerCertificate) {
+      const {props: viewerCertificate, aliases} = _viewerCertificate;
+      Object.assign(distributionConfig, {aliases, viewerCertificate});
 
-        if (validProtocols === undefined) {
-          throw new Error(`Invalid sslMethod. ${sslSupportMethod.toString()} is not fully implemented yet.`);
-        }
+      const {minimumProtocolVersion, sslSupportMethod} = viewerCertificate;
+
+      if (minimumProtocolVersion != null && sslSupportMethod != null) {
+        const validProtocols = this.VALID_SSL_PROTOCOLS[sslSupportMethod as SSLMethod];
 
         if (validProtocols.indexOf(minimumProtocolVersion.toString()) === -1) {
           // tslint:disable-next-line:max-line-length
diff --git a/packages/@aws-cdk/aws-cloudfront/package.json b/packages/@aws-cdk/aws-cloudfront/package.json
index d628160ef01cb..70601f28d4e25 100644
--- a/packages/@aws-cdk/aws-cloudfront/package.json
+++ b/packages/@aws-cdk/aws-cloudfront/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@aws-cdk/aws-cloudfront",
-  "version": "1.13.1",
+  "version": "1.15.0",
   "description": "CDK Constructs for AWS CloudFront",
   "main": "lib/index.js",
   "types": "lib/index.d.ts",
@@ -63,32 +63,81 @@
   },
   "license": "Apache-2.0",
   "devDependencies": {
-    "@aws-cdk/assert": "1.13.1",
-    "aws-sdk": "^2.553.0",
-    "cdk-build-tools": "^1.13.1",
-    "cdk-integ-tools": "^1.13.1",
-    "cfn2ts": "^1.13.1",
-    "pkglint": "^1.13.1"
+    "@aws-cdk/assert": "1.15.0",
+    "aws-sdk": "^2.558.0",
+    "cdk-build-tools": "^1.15.0",
+    "cdk-integ-tools": "^1.15.0",
+    "cfn2ts": "^1.15.0",
+    "pkglint": "^1.15.0"
   },
   "dependencies": {
-    "@aws-cdk/aws-certificatemanager": "1.13.1",
-    "@aws-cdk/aws-iam": "1.13.1",
-    "@aws-cdk/aws-kms": "1.13.1",
-    "@aws-cdk/aws-lambda": "1.13.1",
-    "@aws-cdk/aws-s3": "1.13.1",
-    "@aws-cdk/core": "1.13.1"
+    "@aws-cdk/aws-certificatemanager": "1.15.0",
+    "@aws-cdk/aws-iam": "1.15.0",
+    "@aws-cdk/aws-kms": "1.15.0",
+    "@aws-cdk/aws-lambda": "1.15.0",
+    "@aws-cdk/aws-s3": "1.15.0",
+    "@aws-cdk/core": "1.15.0"
   },
   "homepage": "https://github.com/aws/aws-cdk",
   "peerDependencies": {
-    "@aws-cdk/aws-certificatemanager": "1.13.1",
-    "@aws-cdk/aws-iam": "1.13.1",
-    "@aws-cdk/aws-kms": "1.13.1",
-    "@aws-cdk/aws-lambda": "1.13.1",
-    "@aws-cdk/aws-s3": "1.13.1",
-    "@aws-cdk/core": "1.13.1"
+    "@aws-cdk/aws-certificatemanager": "1.15.0",
+    "@aws-cdk/aws-iam": "1.15.0",
+    "@aws-cdk/aws-kms": "1.15.0",
+    "@aws-cdk/aws-lambda": "1.15.0",
+    "@aws-cdk/aws-s3": "1.15.0",
+    "@aws-cdk/core": "1.15.0"
   },
   "engines": {
     "node": ">= 10.3.0"
   },
-  "stability": "experimental"
+  "stability": "experimental",
+  "awslint": {
+    "exclude": [
+      "docs-public-apis:@aws-cdk/aws-cloudfront.OriginProtocolPolicy",
+      "docs-public-apis:@aws-cdk/aws-cloudfront.ViewerProtocolPolicy.ALLOW_ALL",
+      "docs-public-apis:@aws-cdk/aws-cloudfront.ViewerProtocolPolicy.REDIRECT_TO_HTTPS",
+      "props-default-doc:@aws-cdk/aws-cloudfront.Behavior.isDefaultBehavior",
+      "props-default-doc:@aws-cdk/aws-cloudfront.Behavior.minTtl",
+      "props-default-doc:@aws-cdk/aws-cloudfront.Behavior.pathPattern",
+      "props-default-doc:@aws-cdk/aws-cloudfront.Behavior.trustedSigners",
+      "docs-public-apis:@aws-cdk/aws-cloudfront.CloudFrontWebDistributionProps",
+      "docs-public-apis:@aws-cdk/aws-cloudfront.LambdaFunctionAssociation",
+      "docs-public-apis:@aws-cdk/aws-cloudfront.S3OriginConfig",
+      "props-default-doc:@aws-cdk/aws-cloudfront.S3OriginConfig.originAccessIdentityId",
+      "props-default-doc:@aws-cdk/aws-cloudfront.SourceConfiguration.customOriginSource",
+      "props-default-doc:@aws-cdk/aws-cloudfront.SourceConfiguration.s3OriginSource",
+      "docs-public-apis:@aws-cdk/aws-cloudfront.CloudFrontAllowedCachedMethods.GET_HEAD",
+      "docs-public-apis:@aws-cdk/aws-cloudfront.CloudFrontAllowedCachedMethods.GET_HEAD_OPTIONS",
+      "docs-public-apis:@aws-cdk/aws-cloudfront.CloudFrontAllowedMethods.GET_HEAD",
+      "docs-public-apis:@aws-cdk/aws-cloudfront.CloudFrontAllowedMethods.GET_HEAD_OPTIONS",
+      "docs-public-apis:@aws-cdk/aws-cloudfront.CloudFrontAllowedMethods.ALL",
+      "docs-public-apis:@aws-cdk/aws-cloudfront.HttpVersion",
+      "docs-public-apis:@aws-cdk/aws-cloudfront.HttpVersion.HTTP1_1",
+      "docs-public-apis:@aws-cdk/aws-cloudfront.HttpVersion.HTTP2",
+      "docs-public-apis:@aws-cdk/aws-cloudfront.LambdaEdgeEventType",
+      "docs-public-apis:@aws-cdk/aws-cloudfront.ViewerProtocolPolicy.HTTPS_ONLY",
+      "docs-public-apis:@aws-cdk/aws-cloudfront.OriginProtocolPolicy.HTTP_ONLY",
+      "docs-public-apis:@aws-cdk/aws-cloudfront.OriginProtocolPolicy.MATCH_VIEWER",
+      "docs-public-apis:@aws-cdk/aws-cloudfront.OriginProtocolPolicy.HTTPS_ONLY",
+      "docs-public-apis:@aws-cdk/aws-cloudfront.OriginSslPolicy",
+      "docs-public-apis:@aws-cdk/aws-cloudfront.OriginSslPolicy.SSL_V3",
+      "docs-public-apis:@aws-cdk/aws-cloudfront.OriginSslPolicy.TLS_V1",
+      "docs-public-apis:@aws-cdk/aws-cloudfront.OriginSslPolicy.TLS_V1_1",
+      "docs-public-apis:@aws-cdk/aws-cloudfront.OriginSslPolicy.TLS_V1_2",
+      "docs-public-apis:@aws-cdk/aws-cloudfront.PriceClass.PRICE_CLASS_100",
+      "docs-public-apis:@aws-cdk/aws-cloudfront.PriceClass.PRICE_CLASS_200",
+      "docs-public-apis:@aws-cdk/aws-cloudfront.PriceClass.PRICE_CLASS_ALL",
+      "docs-public-apis:@aws-cdk/aws-cloudfront.SSLMethod.SNI",
+      "docs-public-apis:@aws-cdk/aws-cloudfront.SSLMethod.VIP",
+      "docs-public-apis:@aws-cdk/aws-cloudfront.SecurityPolicyProtocol.SSL_V3",
+      "docs-public-apis:@aws-cdk/aws-cloudfront.SecurityPolicyProtocol.TLS_V1",
+      "docs-public-apis:@aws-cdk/aws-cloudfront.SecurityPolicyProtocol.TLS_V1_2016",
+      "docs-public-apis:@aws-cdk/aws-cloudfront.SecurityPolicyProtocol.TLS_V1_1_2016",
+      "docs-public-apis:@aws-cdk/aws-cloudfront.SecurityPolicyProtocol.TLS_V1_2_2018",
+      "docs-public-apis:@aws-cdk/aws-cloudfront.ViewerCertificate.aliases",
+      "docs-public-apis:@aws-cdk/aws-cloudfront.ViewerCertificate.props",
+      "docs-public-apis:@aws-cdk/aws-cloudfront.ViewerCertificateOptions",
+      "props-default-doc:@aws-cdk/aws-cloudfront.ViewerCertificateOptions.aliases"
+    ]
+  }
 }
diff --git a/packages/@aws-cdk/aws-cloudfront/test/example.acm-cert-alias.lit.ts b/packages/@aws-cdk/aws-cloudfront/test/example.acm-cert-alias.lit.ts
new file mode 100644
index 0000000000000..efc04d782a5f1
--- /dev/null
+++ b/packages/@aws-cdk/aws-cloudfront/test/example.acm-cert-alias.lit.ts
@@ -0,0 +1,41 @@
+import certificatemanager = require('@aws-cdk/aws-certificatemanager');
+import s3 = require('@aws-cdk/aws-s3');
+import { App, Construct, Stack } from '@aws-cdk/core';
+import cloudfront = require('../lib');
+
+class AcmCertificateAliasStack extends Stack {
+  constructor(scope: Construct, id: string) {
+    super(scope, id);
+    /// !show
+    const s3BucketSource = new s3.Bucket(this, 'Bucket');
+
+    const certificate = new certificatemanager.Certificate(this, 'Certificate', {
+      domainName: 'example.com',
+      subjectAlternativeNames: ['*.example.com'],
+    });
+
+    const distribution = new cloudfront.CloudFrontWebDistribution(this, 'AnAmazingWebsiteProbably', {
+      originConfigs: [{
+        s3OriginSource: { s3BucketSource },
+        behaviors: [{ isDefaultBehavior: true }]
+      }],
+      viewerCertificate: cloudfront.ViewerCertificate.fromAcmCertificate(
+        certificate,
+        {
+          aliases: ['example.com', 'www.example.com'],
+          securityPolicy: cloudfront.SecurityPolicyProtocol.TLS_V1, // default
+          sslMethod: cloudfront.SSLMethod.SNI, // default
+        }
+      ),
+    });
+    /// !hide
+
+    Array.isArray(s3BucketSource);
+    Array.isArray(certificate);
+    Array.isArray(distribution);
+  }
+}
+
+const app = new App();
+new AcmCertificateAliasStack(app, 'AcmCertificateAliasStack');
+app.synth();
\ No newline at end of file
diff --git a/packages/@aws-cdk/aws-cloudfront/test/example.default-cert-alias.lit.ts b/packages/@aws-cdk/aws-cloudfront/test/example.default-cert-alias.lit.ts
new file mode 100644
index 0000000000000..8a1d792c7447a
--- /dev/null
+++ b/packages/@aws-cdk/aws-cloudfront/test/example.default-cert-alias.lit.ts
@@ -0,0 +1,29 @@
+import s3 = require('@aws-cdk/aws-s3');
+import { App, Construct, Stack } from '@aws-cdk/core';
+import cloudfront = require('../lib');
+
+class AcmCertificateAliasStack extends Stack {
+  constructor(scope: Construct, id: string) {
+    super(scope, id);
+    /// !show
+    const s3BucketSource = new s3.Bucket(this, 'Bucket');
+
+    const distribution = new cloudfront.CloudFrontWebDistribution(this, 'AnAmazingWebsiteProbably', {
+      originConfigs: [{
+        s3OriginSource: { s3BucketSource },
+        behaviors: [{ isDefaultBehavior: true }]
+      }],
+      viewerCertificate: cloudfront.ViewerCertificate.fromCloudFrontDefaultCertificate(
+        'www.example.com'
+      ),
+    });
+    /// !hide
+
+    Array.isArray(s3BucketSource);
+    Array.isArray(distribution);
+  }
+}
+
+const app = new App();
+new AcmCertificateAliasStack(app, 'AcmCertificateAliasStack');
+app.synth();
\ No newline at end of file
diff --git a/packages/@aws-cdk/aws-cloudfront/test/example.iam-cert-alias.lit.ts b/packages/@aws-cdk/aws-cloudfront/test/example.iam-cert-alias.lit.ts
new file mode 100644
index 0000000000000..afac5546a0dcd
--- /dev/null
+++ b/packages/@aws-cdk/aws-cloudfront/test/example.iam-cert-alias.lit.ts
@@ -0,0 +1,34 @@
+import s3 = require('@aws-cdk/aws-s3');
+import { App, Construct, Stack } from '@aws-cdk/core';
+import cloudfront = require('../lib');
+
+class AcmCertificateAliasStack extends Stack {
+  constructor(scope: Construct, id: string) {
+    super(scope, id);
+    /// !show
+    const s3BucketSource = new s3.Bucket(this, 'Bucket');
+
+    const distribution = new cloudfront.CloudFrontWebDistribution(this, 'AnAmazingWebsiteProbably', {
+      originConfigs: [{
+        s3OriginSource: { s3BucketSource },
+        behaviors: [{ isDefaultBehavior: true }]
+      }],
+      viewerCertificate: cloudfront.ViewerCertificate.fromIamCertificate(
+        'certificateId',
+        {
+          aliases: ['example.com'],
+          securityPolicy: cloudfront.SecurityPolicyProtocol.SSL_V3, // default
+          sslMethod: cloudfront.SSLMethod.SNI, // default
+        }
+      ),
+    });
+    /// !hide
+
+    Array.isArray(s3BucketSource);
+    Array.isArray(distribution);
+  }
+}
+
+const app = new App();
+new AcmCertificateAliasStack(app, 'AcmCertificateAliasStack');
+app.synth();
\ No newline at end of file
diff --git a/packages/@aws-cdk/aws-cloudfront/test/integ.cloudfront-security-policy.expected.json b/packages/@aws-cdk/aws-cloudfront/test/integ.cloudfront-security-policy.expected.json
index a8a4613b6caf0..52342683a6a9f 100644
--- a/packages/@aws-cdk/aws-cloudfront/test/integ.cloudfront-security-policy.expected.json
+++ b/packages/@aws-cdk/aws-cloudfront/test/integ.cloudfront-security-policy.expected.json
@@ -51,7 +51,7 @@
           ],
           "PriceClass": "PriceClass_100",
           "ViewerCertificate": {
-            "AcmCertificateArn": "testACM",
+            "AcmCertificateArn": "arn:aws:acm:us-east-1:1111111:certificate/11-3336f1-44483d-adc7-9cd375c5169d",
             "MinimumProtocolVersion": "TLSv1",
             "SslSupportMethod": "sni-only"
           },
diff --git a/packages/@aws-cdk/aws-cloudfront/test/integ.cloudfront-security-policy.ts b/packages/@aws-cdk/aws-cloudfront/test/integ.cloudfront-security-policy.ts
index e508ed44e58d3..030446b02a6a5 100644
--- a/packages/@aws-cdk/aws-cloudfront/test/integ.cloudfront-security-policy.ts
+++ b/packages/@aws-cdk/aws-cloudfront/test/integ.cloudfront-security-policy.ts
@@ -23,7 +23,7 @@ new cloudfront.CloudFrontWebDistribution(stack, 'AnAmazingWebsiteProbably', {
     }
   ],
   aliasConfiguration: {
-    acmCertRef: 'testACM',
+    acmCertRef: 'arn:aws:acm:us-east-1:1111111:certificate/11-3336f1-44483d-adc7-9cd375c5169d',
     names: ['test.test.com'],
     sslMethod: cloudfront.SSLMethod.SNI,
     securityPolicy: cloudfront.SecurityPolicyProtocol.TLS_V1
diff --git a/packages/@aws-cdk/aws-cloudfront/test/test.basic.ts b/packages/@aws-cdk/aws-cloudfront/test/test.basic.ts
index 6fe5079b43ac5..d9bbd52a41857 100644
--- a/packages/@aws-cdk/aws-cloudfront/test/test.basic.ts
+++ b/packages/@aws-cdk/aws-cloudfront/test/test.basic.ts
@@ -1,9 +1,13 @@
 import { expect, haveResourceLike } from '@aws-cdk/assert';
+import certificatemanager = require('@aws-cdk/aws-certificatemanager');
 import * as lambda from '@aws-cdk/aws-lambda';
 import s3 = require('@aws-cdk/aws-s3');
 import cdk = require('@aws-cdk/core');
 import { Test } from 'nodeunit';
-import { CfnDistribution, CloudFrontWebDistribution, LambdaEdgeEventType, ViewerProtocolPolicy } from '../lib';
+import {
+  CfnDistribution, CloudFrontWebDistribution, LambdaEdgeEventType, SecurityPolicyProtocol, SSLMethod,
+  ViewerCertificate, ViewerProtocolPolicy
+} from '../lib';
 
 // tslint:disable:object-literal-key-quotes
 
@@ -475,4 +479,263 @@ export = {
     test.done();
   },
 
+  'viewerCertificate': {
+    'acmCertificate': {
+      'base usage'(test: Test) {
+        const stack = new cdk.Stack();
+        const sourceBucket = new s3.Bucket(stack, 'Bucket');
+
+        const certificate = new certificatemanager.Certificate(stack, 'cert', {
+          domainName: 'example.com',
+        });
+
+        new CloudFrontWebDistribution(stack, 'AnAmazingWebsiteProbably', {
+          originConfigs: [{
+            s3OriginSource: { s3BucketSource: sourceBucket },
+            behaviors: [{ isDefaultBehavior: true }]
+          }],
+          viewerCertificate: ViewerCertificate.fromAcmCertificate(certificate),
+        });
+
+        expect(stack).to(haveResourceLike('AWS::CloudFront::Distribution', {
+          "DistributionConfig": {
+            "Aliases": [],
+            "ViewerCertificate": {
+              "AcmCertificateArn": {
+                "Ref": "cert56CA94EB"
+              },
+              "SslSupportMethod": "sni-only"
+            }
+          }
+        }));
+
+        test.done();
+      },
+      'imported certificate fromCertificateArn'(test: Test) {
+        const stack = new cdk.Stack();
+        const sourceBucket = new s3.Bucket(stack, 'Bucket');
+
+        const certificate = certificatemanager.Certificate.fromCertificateArn(
+          stack, 'cert', 'arn:aws:acm:us-east-1:1111111:certificate/11-3336f1-44483d-adc7-9cd375c5169d'
+        );
+
+        new CloudFrontWebDistribution(stack, 'AnAmazingWebsiteProbably', {
+          originConfigs: [{
+            s3OriginSource: { s3BucketSource: sourceBucket },
+            behaviors: [{ isDefaultBehavior: true }]
+          }],
+          viewerCertificate: ViewerCertificate.fromAcmCertificate(certificate),
+        });
+
+        expect(stack).to(haveResourceLike('AWS::CloudFront::Distribution', {
+          "DistributionConfig": {
+            "Aliases": [],
+            "ViewerCertificate": {
+              "AcmCertificateArn": "arn:aws:acm:us-east-1:1111111:certificate/11-3336f1-44483d-adc7-9cd375c5169d",
+              "SslSupportMethod": "sni-only"
+            }
+          }
+        }));
+
+        test.done();
+      },
+      'advanced usage'(test: Test) {
+        const stack = new cdk.Stack();
+        const sourceBucket = new s3.Bucket(stack, 'Bucket');
+
+        const certificate = new certificatemanager.Certificate(stack, 'cert', {
+          domainName: 'example.com',
+        });
+
+        new CloudFrontWebDistribution(stack, 'AnAmazingWebsiteProbably', {
+          originConfigs: [{
+            s3OriginSource: { s3BucketSource: sourceBucket },
+            behaviors: [{ isDefaultBehavior: true }]
+          }],
+          viewerCertificate: ViewerCertificate.fromAcmCertificate(certificate, {
+            securityPolicy: SecurityPolicyProtocol.SSL_V3,
+            sslMethod: SSLMethod.VIP,
+            aliases: ['example.com', 'www.example.com']
+          }),
+        });
+
+        expect(stack).to(haveResourceLike('AWS::CloudFront::Distribution', {
+          "DistributionConfig": {
+            "Aliases": ["example.com", "www.example.com"],
+            "ViewerCertificate": {
+              "AcmCertificateArn": {
+                "Ref": "cert56CA94EB"
+              },
+              "MinimumProtocolVersion": "SSLv3",
+              "SslSupportMethod": "vip"
+            }
+          }
+        }));
+
+        test.done();
+      },
+    },
+    'iamCertificate': {
+      'base usage'(test: Test) {
+        const stack = new cdk.Stack();
+        const sourceBucket = new s3.Bucket(stack, 'Bucket');
+
+        new CloudFrontWebDistribution(stack, 'AnAmazingWebsiteProbably', {
+          originConfigs: [{
+            s3OriginSource: { s3BucketSource: sourceBucket },
+            behaviors: [{ isDefaultBehavior: true }]
+          }],
+          viewerCertificate: ViewerCertificate.fromIamCertificate('test'),
+        });
+
+        expect(stack).to(haveResourceLike('AWS::CloudFront::Distribution', {
+          "DistributionConfig": {
+            "Aliases": [],
+            "ViewerCertificate": {
+              "IamCertificateId": "test",
+              "SslSupportMethod": "sni-only"
+            }
+          }
+        }));
+
+        test.done();
+      },
+      'advanced usage'(test: Test) {
+        const stack = new cdk.Stack();
+        const sourceBucket = new s3.Bucket(stack, 'Bucket');
+
+        new CloudFrontWebDistribution(stack, 'AnAmazingWebsiteProbably', {
+          originConfigs: [{
+            s3OriginSource: { s3BucketSource: sourceBucket },
+            behaviors: [{ isDefaultBehavior: true }]
+          }],
+          viewerCertificate: ViewerCertificate.fromIamCertificate('test', {
+            securityPolicy: SecurityPolicyProtocol.TLS_V1,
+            sslMethod: SSLMethod.VIP,
+            aliases: ['example.com']
+          }),
+        });
+
+        expect(stack).to(haveResourceLike('AWS::CloudFront::Distribution', {
+          "DistributionConfig": {
+            "Aliases": ["example.com"],
+            "ViewerCertificate": {
+              "IamCertificateId": "test",
+              "MinimumProtocolVersion": "TLSv1",
+              "SslSupportMethod": "vip"
+            }
+          }
+        }));
+
+        test.done();
+      },
+    },
+    'cloudFrontDefaultCertificate': {
+      'base usage'(test: Test) {
+        const stack = new cdk.Stack();
+        const sourceBucket = new s3.Bucket(stack, 'Bucket');
+
+        new CloudFrontWebDistribution(stack, 'AnAmazingWebsiteProbably', {
+          originConfigs: [{
+            s3OriginSource: { s3BucketSource: sourceBucket },
+            behaviors: [{ isDefaultBehavior: true }]
+          }],
+          viewerCertificate: ViewerCertificate.fromCloudFrontDefaultCertificate(),
+        });
+
+        expect(stack).to(haveResourceLike('AWS::CloudFront::Distribution', {
+          "DistributionConfig": {
+            "Aliases": [],
+            "ViewerCertificate": {
+              "CloudFrontDefaultCertificate": true
+            }
+          }
+        }));
+
+        test.done();
+      },
+      'aliases are set'(test: Test) {
+        const stack = new cdk.Stack();
+        const sourceBucket = new s3.Bucket(stack, 'Bucket');
+
+        new CloudFrontWebDistribution(stack, 'AnAmazingWebsiteProbably', {
+          originConfigs: [{
+            s3OriginSource: { s3BucketSource: sourceBucket },
+            behaviors: [{ isDefaultBehavior: true }]
+          }],
+          viewerCertificate: ViewerCertificate.fromCloudFrontDefaultCertificate('example.com', 'www.example.com'),
+        });
+
+        expect(stack).to(haveResourceLike('AWS::CloudFront::Distribution', {
+          "DistributionConfig": {
+            "Aliases": ["example.com", "www.example.com"],
+            "ViewerCertificate": {
+              "CloudFrontDefaultCertificate": true
+            }
+          }
+        }));
+
+        test.done();
+      },
+    },
+    'errors': {
+      'throws if both deprecated aliasConfiguration and viewerCertificate'(test: Test) {
+        const stack = new cdk.Stack();
+        const sourceBucket = new s3.Bucket(stack, 'Bucket');
+
+        test.throws(() => {
+          new CloudFrontWebDistribution(stack, 'AnAmazingWebsiteProbably', {
+            originConfigs: [{
+              s3OriginSource: { s3BucketSource: sourceBucket },
+              behaviors: [{ isDefaultBehavior: true }]
+            }],
+            aliasConfiguration: {acmCertRef: 'test', names: ['ftp.example.com']},
+            viewerCertificate: ViewerCertificate.fromCloudFrontDefaultCertificate('example.com', 'www.example.com'),
+          });
+        }, /You cannot set both aliasConfiguration and viewerCertificate properties/);
+
+        test.done();
+      },
+      'throws if invalid security policy for SSL method'(test: Test) {
+        const stack = new cdk.Stack();
+        const sourceBucket = new s3.Bucket(stack, 'Bucket');
+
+        test.throws(() => {
+          new CloudFrontWebDistribution(stack, 'AnAmazingWebsiteProbably', {
+            originConfigs: [{
+              s3OriginSource: { s3BucketSource: sourceBucket },
+              behaviors: [{ isDefaultBehavior: true }]
+            }],
+            viewerCertificate: ViewerCertificate.fromIamCertificate('test', {
+              securityPolicy: SecurityPolicyProtocol.TLS_V1_1_2016,
+              sslMethod: SSLMethod.VIP
+            }),
+          });
+        }, /TLSv1.1_2016 is not compabtible with sslMethod vip./);
+
+        test.done();
+      },
+      'throws if acmCertificate explicitly not in us-east-1'(test: Test) {
+        const stack = new cdk.Stack();
+        const sourceBucket = new s3.Bucket(stack, 'Bucket');
+
+        const certificate = certificatemanager.Certificate.fromCertificateArn(
+          stack, 'cert', 'arn:aws:acm:eu-west-3:1111111:certificate/11-3336f1-44483d-adc7-9cd375c5169d'
+        );
+
+        test.throws(() => {
+          new CloudFrontWebDistribution(stack, 'AnAmazingWebsiteProbably', {
+            originConfigs: [{
+              s3OriginSource: { s3BucketSource: sourceBucket },
+              behaviors: [{ isDefaultBehavior: true }]
+            }],
+            viewerCertificate: ViewerCertificate.fromAcmCertificate(certificate),
+          });
+        }, /acmCertificate certficate must be in the us-east-1 region, got eu-west-3/);
+
+        test.done();
+      },
+    }
+  },
+
 };
diff --git a/packages/@aws-cdk/aws-cloudtrail/package.json b/packages/@aws-cdk/aws-cloudtrail/package.json
index 2301634af75fd..d719c4112c33c 100644
--- a/packages/@aws-cdk/aws-cloudtrail/package.json
+++ b/packages/@aws-cdk/aws-cloudtrail/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@aws-cdk/aws-cloudtrail",
-  "version": "1.13.1",
+  "version": "1.15.0",
   "description": "CDK Constructs for AWS CloudTrail",
   "main": "lib/index.js",
   "types": "lib/index.d.ts",
@@ -63,33 +63,44 @@
   },
   "license": "Apache-2.0",
   "devDependencies": {
-    "@aws-cdk/assert": "1.13.1",
-    "aws-sdk": "^2.553.0",
-    "cdk-build-tools": "^1.13.1",
-    "cdk-integ-tools": "^1.13.1",
-    "cfn2ts": "^1.13.1",
+    "@aws-cdk/assert": "1.15.0",
+    "aws-sdk": "^2.558.0",
+    "cdk-build-tools": "^1.15.0",
+    "cdk-integ-tools": "^1.15.0",
+    "cfn2ts": "^1.15.0",
     "colors": "^1.4.0",
-    "pkglint": "^1.13.1"
+    "pkglint": "^1.15.0"
   },
   "dependencies": {
-    "@aws-cdk/aws-events": "1.13.1",
-    "@aws-cdk/aws-iam": "1.13.1",
-    "@aws-cdk/aws-kms": "1.13.1",
-    "@aws-cdk/aws-logs": "1.13.1",
-    "@aws-cdk/aws-s3": "1.13.1",
-    "@aws-cdk/core": "1.13.1"
+    "@aws-cdk/aws-events": "1.15.0",
+    "@aws-cdk/aws-iam": "1.15.0",
+    "@aws-cdk/aws-kms": "1.15.0",
+    "@aws-cdk/aws-logs": "1.15.0",
+    "@aws-cdk/aws-s3": "1.15.0",
+    "@aws-cdk/core": "1.15.0"
   },
   "homepage": "https://github.com/aws/aws-cdk",
   "peerDependencies": {
-    "@aws-cdk/aws-events": "1.13.1",
-    "@aws-cdk/aws-iam": "1.13.1",
-    "@aws-cdk/aws-kms": "1.13.1",
-    "@aws-cdk/aws-logs": "1.13.1",
-    "@aws-cdk/aws-s3": "1.13.1",
-    "@aws-cdk/core": "1.13.1"
+    "@aws-cdk/aws-events": "1.15.0",
+    "@aws-cdk/aws-iam": "1.15.0",
+    "@aws-cdk/aws-kms": "1.15.0",
+    "@aws-cdk/aws-logs": "1.15.0",
+    "@aws-cdk/aws-s3": "1.15.0",
+    "@aws-cdk/core": "1.15.0"
   },
   "engines": {
     "node": ">= 10.3.0"
   },
-  "stability": "experimental"
+  "stability": "experimental",
+  "awslint": {
+    "exclude": [
+      "docs-public-apis:@aws-cdk/aws-cloudtrail.Trail.trailArn",
+      "docs-public-apis:@aws-cdk/aws-cloudtrail.Trail.trailSnsTopicArn",
+      "docs-public-apis:@aws-cdk/aws-cloudtrail.TrailProps",
+      "docs-public-apis:@aws-cdk/aws-cloudtrail.ReadWriteType",
+      "docs-public-apis:@aws-cdk/aws-cloudtrail.ReadWriteType.READ_ONLY",
+      "docs-public-apis:@aws-cdk/aws-cloudtrail.ReadWriteType.WRITE_ONLY",
+      "docs-public-apis:@aws-cdk/aws-cloudtrail.ReadWriteType.ALL"
+    ]
+  }
 }
diff --git a/packages/@aws-cdk/aws-cloudwatch-actions/package.json b/packages/@aws-cdk/aws-cloudwatch-actions/package.json
index 7675537491c77..21af3ca1d2b59 100644
--- a/packages/@aws-cdk/aws-cloudwatch-actions/package.json
+++ b/packages/@aws-cdk/aws-cloudwatch-actions/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@aws-cdk/aws-cloudwatch-actions",
-  "version": "1.13.1",
+  "version": "1.15.0",
   "description": "Alarm Actions for AWS CloudWatch CDK library",
   "main": "lib/index.js",
   "types": "lib/index.d.ts",
@@ -71,33 +71,40 @@
   },
   "license": "Apache-2.0",
   "devDependencies": {
-    "@aws-cdk/assert": "1.13.1",
-    "@aws-cdk/aws-ec2": "1.13.1",
-    "cdk-build-tools": "^1.13.1",
-    "cdk-integ-tools": "^1.13.1",
-    "cfn2ts": "^1.13.1",
+    "@aws-cdk/assert": "1.15.0",
+    "@aws-cdk/aws-ec2": "1.15.0",
+    "cdk-build-tools": "^1.15.0",
+    "cdk-integ-tools": "^1.15.0",
+    "cfn2ts": "^1.15.0",
     "jest": "^24.9.0",
-    "pkglint": "^1.13.1"
+    "pkglint": "^1.15.0"
   },
   "dependencies": {
-    "@aws-cdk/aws-applicationautoscaling": "1.13.1",
-    "@aws-cdk/aws-autoscaling": "1.13.1",
-    "@aws-cdk/aws-cloudwatch": "1.13.1",
-    "@aws-cdk/aws-iam": "1.13.1",
-    "@aws-cdk/aws-sns": "1.13.1",
-    "@aws-cdk/core": "1.13.1"
+    "@aws-cdk/aws-applicationautoscaling": "1.15.0",
+    "@aws-cdk/aws-autoscaling": "1.15.0",
+    "@aws-cdk/aws-cloudwatch": "1.15.0",
+    "@aws-cdk/aws-iam": "1.15.0",
+    "@aws-cdk/aws-sns": "1.15.0",
+    "@aws-cdk/core": "1.15.0"
   },
   "homepage": "https://github.com/aws/aws-cdk",
   "peerDependencies": {
-    "@aws-cdk/aws-applicationautoscaling": "1.13.1",
-    "@aws-cdk/aws-autoscaling": "1.13.1",
-    "@aws-cdk/aws-cloudwatch": "1.13.1",
-    "@aws-cdk/aws-iam": "1.13.1",
-    "@aws-cdk/aws-sns": "1.13.1",
-    "@aws-cdk/core": "1.13.1"
+    "@aws-cdk/aws-applicationautoscaling": "1.15.0",
+    "@aws-cdk/aws-autoscaling": "1.15.0",
+    "@aws-cdk/aws-cloudwatch": "1.15.0",
+    "@aws-cdk/aws-iam": "1.15.0",
+    "@aws-cdk/aws-sns": "1.15.0",
+    "@aws-cdk/core": "1.15.0"
   },
   "engines": {
     "node": ">= 10.3.0"
   },
-  "stability": "stable"
+  "stability": "stable",
+  "awslint": {
+    "exclude": [
+      "docs-public-apis:@aws-cdk/aws-cloudwatch-actions.ApplicationScalingAction.bind",
+      "docs-public-apis:@aws-cdk/aws-cloudwatch-actions.AutoScalingAction.bind",
+      "docs-public-apis:@aws-cdk/aws-cloudwatch-actions.SnsAction.bind"
+    ]
+  }
 }
diff --git a/packages/@aws-cdk/aws-cloudwatch/lib/graph.ts b/packages/@aws-cdk/aws-cloudwatch/lib/graph.ts
index c97463a218cbd..145f662feb3cd 100644
--- a/packages/@aws-cdk/aws-cloudwatch/lib/graph.ts
+++ b/packages/@aws-cdk/aws-cloudwatch/lib/graph.ts
@@ -201,6 +201,13 @@ export interface SingleValueWidgetProps extends MetricWidgetProps {
    * Metrics to display
    */
   readonly metrics: IMetric[];
+
+  /**
+   * Whether to show the value from the entire time range.
+   *
+   * @default false
+   */
+  readonly setPeriodToTimeRange?: boolean;
 }
 
 /**
@@ -225,7 +232,8 @@ export class SingleValueWidget extends ConcreteWidget {
         view: 'singleValue',
         title: this.props.title,
         region: this.props.region || cdk.Aws.REGION,
-        metrics: this.props.metrics.map(m => metricJson(m, 'left'))
+        metrics: this.props.metrics.map(m => metricJson(m, 'left')),
+        setPeriodToTimeRange: this.props.setPeriodToTimeRange
       }
     }];
   }
diff --git a/packages/@aws-cdk/aws-cloudwatch/package.json b/packages/@aws-cdk/aws-cloudwatch/package.json
index 0894d2765bf11..076d522b1af16 100644
--- a/packages/@aws-cdk/aws-cloudwatch/package.json
+++ b/packages/@aws-cdk/aws-cloudwatch/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@aws-cdk/aws-cloudwatch",
-  "version": "1.13.1",
+  "version": "1.15.0",
   "description": "CDK Constructs for AWS CloudWatch",
   "main": "lib/index.js",
   "types": "lib/index.d.ts",
@@ -63,25 +63,100 @@
   },
   "license": "Apache-2.0",
   "devDependencies": {
-    "@aws-cdk/assert": "1.13.1",
-    "cdk-build-tools": "^1.13.1",
-    "cdk-integ-tools": "^1.13.1",
-    "cfn2ts": "^1.13.1",
-    "pkglint": "^1.13.1"
+    "@aws-cdk/assert": "1.15.0",
+    "cdk-build-tools": "^1.15.0",
+    "cdk-integ-tools": "^1.15.0",
+    "cfn2ts": "^1.15.0",
+    "pkglint": "^1.15.0"
   },
   "dependencies": {
-    "@aws-cdk/aws-iam": "1.13.1",
-    "@aws-cdk/core": "1.13.1"
+    "@aws-cdk/aws-iam": "1.15.0",
+    "@aws-cdk/core": "1.15.0"
   },
   "homepage": "https://github.com/aws/aws-cdk",
   "peerDependencies": {
-    "@aws-cdk/aws-iam": "1.13.1",
-    "@aws-cdk/core": "1.13.1"
+    "@aws-cdk/aws-iam": "1.15.0",
+    "@aws-cdk/core": "1.15.0"
   },
   "awslint": {
     "exclude": [
       "duration-prop-type:@aws-cdk/aws-cloudwatch.MetricAlarmConfig.period",
-      "duration-prop-type:@aws-cdk/aws-cloudwatch.MetricGraphConfig.period"
+      "duration-prop-type:@aws-cdk/aws-cloudwatch.MetricGraphConfig.period",
+      "docs-public-apis:@aws-cdk/aws-cloudwatch.ComparisonOperator.GREATER_THAN_OR_EQUAL_TO_THRESHOLD",
+      "docs-public-apis:@aws-cdk/aws-cloudwatch.Unit.NONE",
+      "docs-public-apis:@aws-cdk/aws-cloudwatch.Unit.COUNT_PER_SECOND",
+      "docs-public-apis:@aws-cdk/aws-cloudwatch.Unit.TERABITS_PER_SECOND",
+      "docs-public-apis:@aws-cdk/aws-cloudwatch.Alarm.fromAlarmArn",
+      "docs-public-apis:@aws-cdk/aws-cloudwatch.Metric.metricName",
+      "docs-public-apis:@aws-cdk/aws-cloudwatch.Metric.namespace",
+      "docs-public-apis:@aws-cdk/aws-cloudwatch.Metric.period",
+      "docs-public-apis:@aws-cdk/aws-cloudwatch.Metric.statistic",
+      "docs-public-apis:@aws-cdk/aws-cloudwatch.Metric.color",
+      "docs-public-apis:@aws-cdk/aws-cloudwatch.Metric.dimensions",
+      "docs-public-apis:@aws-cdk/aws-cloudwatch.Metric.label",
+      "docs-public-apis:@aws-cdk/aws-cloudwatch.Metric.unit",
+      "props-default-doc:@aws-cdk/aws-cloudwatch.AlarmWidgetProps.leftYAxis",
+      "props-default-doc:@aws-cdk/aws-cloudwatch.CommonMetricOptions.color",
+      "props-default-doc:@aws-cdk/aws-cloudwatch.CommonMetricOptions.label",
+      "props-default-doc:@aws-cdk/aws-cloudwatch.CommonMetricOptions.unit",
+      "docs-public-apis:@aws-cdk/aws-cloudwatch.DashboardProps",
+      "props-default-doc:@aws-cdk/aws-cloudwatch.GraphWidgetProps.left",
+      "props-default-doc:@aws-cdk/aws-cloudwatch.GraphWidgetProps.leftAnnotations",
+      "props-default-doc:@aws-cdk/aws-cloudwatch.GraphWidgetProps.leftYAxis",
+      "props-default-doc:@aws-cdk/aws-cloudwatch.GraphWidgetProps.right",
+      "props-default-doc:@aws-cdk/aws-cloudwatch.GraphWidgetProps.rightAnnotations",
+      "props-default-doc:@aws-cdk/aws-cloudwatch.GraphWidgetProps.rightYAxis",
+      "props-default-doc:@aws-cdk/aws-cloudwatch.GraphWidgetProps.stacked",
+      "docs-public-apis:@aws-cdk/aws-cloudwatch.IAlarm",
+      "docs-public-apis:@aws-cdk/aws-cloudwatch.IAlarm.alarmArn",
+      "docs-public-apis:@aws-cdk/aws-cloudwatch.IAlarm.alarmName",
+      "docs-public-apis:@aws-cdk/aws-cloudwatch.IAlarmAction.bind",
+      "props-default-doc:@aws-cdk/aws-cloudwatch.MetricAlarmConfig.dimensions",
+      "props-default-doc:@aws-cdk/aws-cloudwatch.MetricAlarmConfig.extendedStatistic",
+      "props-default-doc:@aws-cdk/aws-cloudwatch.MetricAlarmConfig.statistic",
+      "props-default-doc:@aws-cdk/aws-cloudwatch.MetricAlarmConfig.unit",
+      "props-default-doc:@aws-cdk/aws-cloudwatch.MetricGraphConfig.color",
+      "props-default-doc:@aws-cdk/aws-cloudwatch.MetricGraphConfig.dimensions",
+      "props-default-doc:@aws-cdk/aws-cloudwatch.MetricGraphConfig.label",
+      "props-default-doc:@aws-cdk/aws-cloudwatch.MetricGraphConfig.statistic",
+      "props-default-doc:@aws-cdk/aws-cloudwatch.MetricGraphConfig.unit",
+      "props-default-doc:@aws-cdk/aws-cloudwatch.MetricWidgetProps.title",
+      "docs-public-apis:@aws-cdk/aws-cloudwatch.Unit.GIGABITS_PER_SECOND",
+      "docs-public-apis:@aws-cdk/aws-cloudwatch.ComparisonOperator.GREATER_THAN_THRESHOLD",
+      "docs-public-apis:@aws-cdk/aws-cloudwatch.ComparisonOperator.LESS_THAN_THRESHOLD",
+      "docs-public-apis:@aws-cdk/aws-cloudwatch.ComparisonOperator.LESS_THAN_OR_EQUAL_TO_THRESHOLD",
+      "docs-public-apis:@aws-cdk/aws-cloudwatch.PeriodOverride",
+      "docs-public-apis:@aws-cdk/aws-cloudwatch.PeriodOverride.AUTO",
+      "docs-public-apis:@aws-cdk/aws-cloudwatch.PeriodOverride.INHERIT",
+      "docs-public-apis:@aws-cdk/aws-cloudwatch.Shading",
+      "docs-public-apis:@aws-cdk/aws-cloudwatch.Statistic.SAMPLE_COUNT",
+      "docs-public-apis:@aws-cdk/aws-cloudwatch.Statistic.AVERAGE",
+      "docs-public-apis:@aws-cdk/aws-cloudwatch.Statistic.SUM",
+      "docs-public-apis:@aws-cdk/aws-cloudwatch.Statistic.MINIMUM",
+      "docs-public-apis:@aws-cdk/aws-cloudwatch.Statistic.MAXIMUM",
+      "docs-public-apis:@aws-cdk/aws-cloudwatch.Unit.SECONDS",
+      "docs-public-apis:@aws-cdk/aws-cloudwatch.Unit.MICROSECONDS",
+      "docs-public-apis:@aws-cdk/aws-cloudwatch.Unit.MILLISECONDS",
+      "docs-public-apis:@aws-cdk/aws-cloudwatch.Unit.BYTES",
+      "docs-public-apis:@aws-cdk/aws-cloudwatch.Unit.KILOBYTES",
+      "docs-public-apis:@aws-cdk/aws-cloudwatch.Unit.MEGABYTES",
+      "docs-public-apis:@aws-cdk/aws-cloudwatch.Unit.GIGABYTES",
+      "docs-public-apis:@aws-cdk/aws-cloudwatch.Unit.TERABYTES",
+      "docs-public-apis:@aws-cdk/aws-cloudwatch.Unit.BITS",
+      "docs-public-apis:@aws-cdk/aws-cloudwatch.Unit.KILOBITS",
+      "docs-public-apis:@aws-cdk/aws-cloudwatch.Unit.MEGABITS",
+      "docs-public-apis:@aws-cdk/aws-cloudwatch.Unit.GIGABITS",
+      "docs-public-apis:@aws-cdk/aws-cloudwatch.Unit.TERABITS",
+      "docs-public-apis:@aws-cdk/aws-cloudwatch.Unit.PERCENT",
+      "docs-public-apis:@aws-cdk/aws-cloudwatch.Unit.COUNT",
+      "docs-public-apis:@aws-cdk/aws-cloudwatch.Unit.BYTES_PER_SECOND",
+      "docs-public-apis:@aws-cdk/aws-cloudwatch.Unit.KILOBYTES_PER_SECOND",
+      "docs-public-apis:@aws-cdk/aws-cloudwatch.Unit.MEGABYTES_PER_SECOND",
+      "docs-public-apis:@aws-cdk/aws-cloudwatch.Unit.GIGABYTES_PER_SECOND",
+      "docs-public-apis:@aws-cdk/aws-cloudwatch.Unit.TERABYTES_PER_SECOND",
+      "docs-public-apis:@aws-cdk/aws-cloudwatch.Unit.BITS_PER_SECOND",
+      "docs-public-apis:@aws-cdk/aws-cloudwatch.Unit.KILOBITS_PER_SECOND",
+      "docs-public-apis:@aws-cdk/aws-cloudwatch.Unit.MEGABITS_PER_SECOND"
     ]
   },
   "engines": {
diff --git a/packages/@aws-cdk/aws-cloudwatch/test/test.graphs.ts b/packages/@aws-cdk/aws-cloudwatch/test/test.graphs.ts
index 2d5a2a9375343..c9d57f1a4ca35 100644
--- a/packages/@aws-cdk/aws-cloudwatch/test/test.graphs.ts
+++ b/packages/@aws-cdk/aws-cloudwatch/test/test.graphs.ts
@@ -288,4 +288,33 @@ export = {
 
     test.done();
   },
+
+  'add setPeriodToTimeRange to singleValueWidget'(test: Test) {
+    // GIVEN
+    const stack = new Stack();
+    const metric = new Metric({ namespace: 'CDK', metricName: 'Test' });
+
+    // WHEN
+    const widget = new SingleValueWidget({
+      metrics: [ metric ],
+      setPeriodToTimeRange: true
+    });
+
+    // THEN
+    test.deepEqual(stack.resolve(widget.toJson()), [{
+      type: 'metric',
+      width: 6,
+      height: 3,
+      properties: {
+        view: 'singleValue',
+        region: { Ref: 'AWS::Region' },
+        metrics: [
+          ['CDK', 'Test', { yAxis: 'left', period: 300, stat: 'Average' }],
+        ],
+        setPeriodToTimeRange: true
+      }
+    }]);
+
+    test.done();
+  },
 };
diff --git a/packages/@aws-cdk/aws-codebuild/lib/project.ts b/packages/@aws-cdk/aws-codebuild/lib/project.ts
index d42c0bd6055df..30c5addc2468e 100644
--- a/packages/@aws-cdk/aws-codebuild/lib/project.ts
+++ b/packages/@aws-cdk/aws-codebuild/lib/project.ts
@@ -617,6 +617,23 @@ export class Project extends ProjectBase {
     return new Import(scope, id);
   }
 
+  /**
+   * Convert the environment variables map of string to {@link BuildEnvironmentVariable},
+   * which is the customer-facing type, to a list of {@link CfnProject.EnvironmentVariableProperty},
+   * which is the representation of environment variables in CloudFormation.
+   *
+   * @param environmentVariables the map of string to environment variables
+   * @returns an array of {@link CfnProject.EnvironmentVariableProperty} instances
+   */
+  public static serializeEnvVariables(environmentVariables: { [name: string]: BuildEnvironmentVariable }):
+      CfnProject.EnvironmentVariableProperty[] {
+    return Object.keys(environmentVariables).map(name => ({
+      name,
+      type: environmentVariables[name].type || BuildEnvironmentVariableType.PLAINTEXT,
+      value: environmentVariables[name].value,
+    }));
+  }
+
   public readonly grantPrincipal: iam.IPrincipal;
 
   /**
@@ -762,10 +779,6 @@ export class Project extends ProjectBase {
    * @param options additional options for the binding
    */
   public bindToCodePipeline(_scope: Construct, options: BindToCodePipelineOptions): void {
-    if (this.source.type !== CODEPIPELINE_SOURCE_ARTIFACTS_TYPE) {
-      throw new Error('Only a PipelineProject can be added to a CodePipeline');
-    }
-
     // work around a bug in CodeBuild: it ignores the KMS key set on the pipeline,
     // and always uses its own, project-level key
     if (options.artifactBucket.encryptionKey && !this._encryptionKey) {
@@ -870,11 +883,7 @@ export class Project extends ProjectBase {
         : undefined,
       privilegedMode: env.privileged || false,
       computeType: env.computeType || this.buildImage.defaultComputeType,
-      environmentVariables: !hasEnvironmentVars ? undefined : Object.keys(vars).map(name => ({
-        name,
-        type: vars[name].type || BuildEnvironmentVariableType.PLAINTEXT,
-        value: vars[name].value
-      }))
+      environmentVariables: hasEnvironmentVars ? Project.serializeEnvVariables(vars) : undefined,
     };
   }
 
diff --git a/packages/@aws-cdk/aws-codebuild/package.json b/packages/@aws-cdk/aws-codebuild/package.json
index 739485a8177ef..f3ebc29e73cf1 100644
--- a/packages/@aws-cdk/aws-codebuild/package.json
+++ b/packages/@aws-cdk/aws-codebuild/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@aws-cdk/aws-codebuild",
-  "version": "1.13.1",
+  "version": "1.15.0",
   "description": "CDK Constructs for AWS CodeBuild",
   "main": "lib/index.js",
   "types": "lib/index.d.ts",
@@ -67,45 +67,45 @@
   },
   "license": "Apache-2.0",
   "devDependencies": {
-    "@aws-cdk/assert": "1.13.1",
-    "@aws-cdk/aws-sns": "1.13.1",
-    "@aws-cdk/aws-sqs": "1.13.1",
-    "aws-sdk": "^2.553.0",
-    "cdk-build-tools": "^1.13.1",
-    "cdk-integ-tools": "^1.13.1",
-    "cfn2ts": "^1.13.1",
-    "pkglint": "^1.13.1"
+    "@aws-cdk/assert": "1.15.0",
+    "@aws-cdk/aws-sns": "1.15.0",
+    "@aws-cdk/aws-sqs": "1.15.0",
+    "aws-sdk": "^2.558.0",
+    "cdk-build-tools": "^1.15.0",
+    "cdk-integ-tools": "^1.15.0",
+    "cfn2ts": "^1.15.0",
+    "pkglint": "^1.15.0"
   },
   "dependencies": {
-    "@aws-cdk/assets": "1.13.1",
-    "@aws-cdk/aws-cloudwatch": "1.13.1",
-    "@aws-cdk/aws-codecommit": "1.13.1",
-    "@aws-cdk/aws-ec2": "1.13.1",
-    "@aws-cdk/aws-ecr": "1.13.1",
-    "@aws-cdk/aws-ecr-assets": "1.13.1",
-    "@aws-cdk/aws-events": "1.13.1",
-    "@aws-cdk/aws-iam": "1.13.1",
-    "@aws-cdk/aws-kms": "1.13.1",
-    "@aws-cdk/aws-s3": "1.13.1",
-    "@aws-cdk/aws-s3-assets": "1.13.1",
-    "@aws-cdk/aws-secretsmanager": "1.13.1",
-    "@aws-cdk/core": "1.13.1"
+    "@aws-cdk/assets": "1.15.0",
+    "@aws-cdk/aws-cloudwatch": "1.15.0",
+    "@aws-cdk/aws-codecommit": "1.15.0",
+    "@aws-cdk/aws-ec2": "1.15.0",
+    "@aws-cdk/aws-ecr": "1.15.0",
+    "@aws-cdk/aws-ecr-assets": "1.15.0",
+    "@aws-cdk/aws-events": "1.15.0",
+    "@aws-cdk/aws-iam": "1.15.0",
+    "@aws-cdk/aws-kms": "1.15.0",
+    "@aws-cdk/aws-s3": "1.15.0",
+    "@aws-cdk/aws-s3-assets": "1.15.0",
+    "@aws-cdk/aws-secretsmanager": "1.15.0",
+    "@aws-cdk/core": "1.15.0"
   },
   "homepage": "https://github.com/aws/aws-cdk",
   "peerDependencies": {
-    "@aws-cdk/assets": "1.13.1",
-    "@aws-cdk/aws-cloudwatch": "1.13.1",
-    "@aws-cdk/aws-codecommit": "1.13.1",
-    "@aws-cdk/aws-ec2": "1.13.1",
-    "@aws-cdk/aws-ecr": "1.13.1",
-    "@aws-cdk/aws-ecr-assets": "1.13.1",
-    "@aws-cdk/aws-events": "1.13.1",
-    "@aws-cdk/aws-iam": "1.13.1",
-    "@aws-cdk/aws-kms": "1.13.1",
-    "@aws-cdk/aws-s3": "1.13.1",
-    "@aws-cdk/aws-s3-assets": "1.13.1",
-    "@aws-cdk/aws-secretsmanager": "1.13.1",
-    "@aws-cdk/core": "1.13.1"
+    "@aws-cdk/assets": "1.15.0",
+    "@aws-cdk/aws-cloudwatch": "1.15.0",
+    "@aws-cdk/aws-codecommit": "1.15.0",
+    "@aws-cdk/aws-ec2": "1.15.0",
+    "@aws-cdk/aws-ecr": "1.15.0",
+    "@aws-cdk/aws-ecr-assets": "1.15.0",
+    "@aws-cdk/aws-events": "1.15.0",
+    "@aws-cdk/aws-iam": "1.15.0",
+    "@aws-cdk/aws-kms": "1.15.0",
+    "@aws-cdk/aws-s3": "1.15.0",
+    "@aws-cdk/aws-s3-assets": "1.15.0",
+    "@aws-cdk/aws-secretsmanager": "1.15.0",
+    "@aws-cdk/core": "1.15.0"
   },
   "engines": {
     "node": ">= 10.3.0"
@@ -114,7 +114,91 @@
     "exclude": [
       "construct-ctor-props-optional:@aws-cdk/aws-codebuild.Project",
       "duration-prop-type:@aws-cdk/aws-codebuild.PhaseChangeEvent.completedPhaseDurationSeconds",
-      "duration-prop-name:@aws-cdk/aws-codebuild.PhaseChangeEvent.completedPhaseDurationSeconds"
+      "duration-prop-name:@aws-cdk/aws-codebuild.PhaseChangeEvent.completedPhaseDurationSeconds",
+      "docs-public-apis:@aws-cdk/aws-codebuild.Project.metric",
+      "docs-public-apis:@aws-cdk/aws-codebuild.ComputeType.LARGE",
+      "docs-public-apis:@aws-cdk/aws-codebuild.ComputeType.MEDIUM",
+      "docs-public-apis:@aws-cdk/aws-codebuild.ComputeType.SMALL",
+      "docs-public-apis:@aws-cdk/aws-codebuild.BuildEnvironmentVariableType",
+      "docs-public-apis:@aws-cdk/aws-codebuild.Artifacts.s3",
+      "docs-public-apis:@aws-cdk/aws-codebuild.BuildSpec.fromObject",
+      "docs-public-apis:@aws-cdk/aws-codebuild.Cache.none",
+      "docs-public-apis:@aws-cdk/aws-codebuild.LinuxBuildImage.AMAZON_LINUX_2",
+      "docs-public-apis:@aws-cdk/aws-codebuild.LinuxBuildImage.STANDARD_1_0",
+      "docs-public-apis:@aws-cdk/aws-codebuild.LinuxBuildImage.STANDARD_2_0",
+      "docs-public-apis:@aws-cdk/aws-codebuild.LinuxBuildImage.UBUNTU_14_04_ANDROID_JAVA8_24_4_1",
+      "docs-public-apis:@aws-cdk/aws-codebuild.LinuxBuildImage.UBUNTU_14_04_ANDROID_JAVA8_26_1_1",
+      "docs-public-apis:@aws-cdk/aws-codebuild.LinuxBuildImage.UBUNTU_14_04_BASE",
+      "docs-public-apis:@aws-cdk/aws-codebuild.LinuxBuildImage.UBUNTU_14_04_DOCKER_17_09_0",
+      "docs-public-apis:@aws-cdk/aws-codebuild.LinuxBuildImage.UBUNTU_14_04_DOCKER_18_09_0",
+      "docs-public-apis:@aws-cdk/aws-codebuild.LinuxBuildImage.UBUNTU_14_04_DOTNET_CORE_1_1",
+      "docs-public-apis:@aws-cdk/aws-codebuild.LinuxBuildImage.UBUNTU_14_04_DOTNET_CORE_2_0",
+      "docs-public-apis:@aws-cdk/aws-codebuild.LinuxBuildImage.UBUNTU_14_04_DOTNET_CORE_2_1",
+      "docs-public-apis:@aws-cdk/aws-codebuild.LinuxBuildImage.UBUNTU_14_04_GOLANG_1_10",
+      "docs-public-apis:@aws-cdk/aws-codebuild.LinuxBuildImage.UBUNTU_14_04_GOLANG_1_11",
+      "docs-public-apis:@aws-cdk/aws-codebuild.LinuxBuildImage.UBUNTU_14_04_NODEJS_10_1_0",
+      "docs-public-apis:@aws-cdk/aws-codebuild.LinuxBuildImage.UBUNTU_14_04_NODEJS_10_14_1",
+      "docs-public-apis:@aws-cdk/aws-codebuild.LinuxBuildImage.UBUNTU_14_04_NODEJS_6_3_1",
+      "docs-public-apis:@aws-cdk/aws-codebuild.LinuxBuildImage.UBUNTU_14_04_NODEJS_8_11_0",
+      "docs-public-apis:@aws-cdk/aws-codebuild.LinuxBuildImage.UBUNTU_14_04_OPEN_JDK_11",
+      "docs-public-apis:@aws-cdk/aws-codebuild.LinuxBuildImage.UBUNTU_14_04_OPEN_JDK_8",
+      "docs-public-apis:@aws-cdk/aws-codebuild.LinuxBuildImage.UBUNTU_14_04_OPEN_JDK_9",
+      "docs-public-apis:@aws-cdk/aws-codebuild.LinuxBuildImage.UBUNTU_14_04_PHP_5_6",
+      "docs-public-apis:@aws-cdk/aws-codebuild.LinuxBuildImage.UBUNTU_14_04_PHP_7_0",
+      "docs-public-apis:@aws-cdk/aws-codebuild.LinuxBuildImage.UBUNTU_14_04_PHP_7_1",
+      "docs-public-apis:@aws-cdk/aws-codebuild.LinuxBuildImage.UBUNTU_14_04_PYTHON_2_7_12",
+      "docs-public-apis:@aws-cdk/aws-codebuild.LinuxBuildImage.UBUNTU_14_04_PYTHON_3_3_6",
+      "docs-public-apis:@aws-cdk/aws-codebuild.LinuxBuildImage.UBUNTU_14_04_PYTHON_3_4_5",
+      "docs-public-apis:@aws-cdk/aws-codebuild.LinuxBuildImage.UBUNTU_14_04_PYTHON_3_5_2",
+      "docs-public-apis:@aws-cdk/aws-codebuild.LinuxBuildImage.UBUNTU_14_04_PYTHON_3_6_5",
+      "docs-public-apis:@aws-cdk/aws-codebuild.LinuxBuildImage.UBUNTU_14_04_PYTHON_3_7_1",
+      "docs-public-apis:@aws-cdk/aws-codebuild.LinuxBuildImage.UBUNTU_14_04_RUBY_2_2_5",
+      "docs-public-apis:@aws-cdk/aws-codebuild.LinuxBuildImage.UBUNTU_14_04_RUBY_2_3_1",
+      "docs-public-apis:@aws-cdk/aws-codebuild.LinuxBuildImage.UBUNTU_14_04_RUBY_2_5_1",
+      "docs-public-apis:@aws-cdk/aws-codebuild.LinuxBuildImage.UBUNTU_14_04_RUBY_2_5_3",
+      "docs-public-apis:@aws-cdk/aws-codebuild.LinuxBuildImage.fromDockerRegistry",
+      "docs-public-apis:@aws-cdk/aws-codebuild.LinuxBuildImage.fromEcrRepository",
+      "docs-public-apis:@aws-cdk/aws-codebuild.Project.fromProjectArn",
+      "props-default-doc:@aws-cdk/aws-codebuild.SourceProps.identifier",
+      "docs-public-apis:@aws-cdk/aws-codebuild.Source.badgeSupported",
+      "docs-public-apis:@aws-cdk/aws-codebuild.Source.type",
+      "docs-public-apis:@aws-cdk/aws-codebuild.Source.identifier",
+      "docs-public-apis:@aws-cdk/aws-codebuild.Source.bitBucket",
+      "docs-public-apis:@aws-cdk/aws-codebuild.Source.codeCommit",
+      "docs-public-apis:@aws-cdk/aws-codebuild.Source.gitHub",
+      "docs-public-apis:@aws-cdk/aws-codebuild.Source.gitHubEnterprise",
+      "docs-public-apis:@aws-cdk/aws-codebuild.Source.s3",
+      "docs-public-apis:@aws-cdk/aws-codebuild.StateChangeEvent.currentPhase",
+      "docs-public-apis:@aws-cdk/aws-codebuild.WindowsBuildImage.WIN_SERVER_CORE_2016_BASE",
+      "docs-public-apis:@aws-cdk/aws-codebuild.WindowsBuildImage.fromDockerRegistry",
+      "docs-public-apis:@aws-cdk/aws-codebuild.WindowsBuildImage.fromEcrRepository",
+      "props-default-doc:@aws-cdk/aws-codebuild.ArtifactsProps.identifier",
+      "props-default-doc:@aws-cdk/aws-codebuild.BitBucketSourceProps.cloneDepth",
+      "docs-public-apis:@aws-cdk/aws-codebuild.BucketCacheOptions",
+      "props-default-doc:@aws-cdk/aws-codebuild.BucketCacheOptions.prefix",
+      "docs-public-apis:@aws-cdk/aws-codebuild.BuildEnvironment",
+      "props-default-doc:@aws-cdk/aws-codebuild.BuildEnvironment.environmentVariables",
+      "docs-public-apis:@aws-cdk/aws-codebuild.BuildEnvironmentVariable",
+      "docs-public-apis:@aws-cdk/aws-codebuild.CodeCommitSourceProps.repository",
+      "props-default-doc:@aws-cdk/aws-codebuild.CodeCommitSourceProps.cloneDepth",
+      "docs-public-apis:@aws-cdk/aws-codebuild.CommonProjectProps",
+      "props-default-doc:@aws-cdk/aws-codebuild.GitHubEnterpriseSourceProps.cloneDepth",
+      "props-default-doc:@aws-cdk/aws-codebuild.GitHubSourceProps.cloneDepth",
+      "docs-public-apis:@aws-cdk/aws-codebuild.IProject",
+      "docs-public-apis:@aws-cdk/aws-codebuild.IProject.addToRolePolicy",
+      "docs-public-apis:@aws-cdk/aws-codebuild.IProject.metric",
+      "docs-public-apis:@aws-cdk/aws-codebuild.ISource.badgeSupported",
+      "docs-public-apis:@aws-cdk/aws-codebuild.ISource.type",
+      "docs-public-apis:@aws-cdk/aws-codebuild.ISource.identifier",
+      "docs-public-apis:@aws-cdk/aws-codebuild.ISource.bind",
+      "docs-public-apis:@aws-cdk/aws-codebuild.PipelineProjectProps",
+      "docs-public-apis:@aws-cdk/aws-codebuild.ProjectProps",
+      "props-default-doc:@aws-cdk/aws-codebuild.S3ArtifactsProps.path",
+      "docs-public-apis:@aws-cdk/aws-codebuild.S3SourceProps.bucket",
+      "docs-public-apis:@aws-cdk/aws-codebuild.S3SourceProps.path",
+      "docs-public-apis:@aws-cdk/aws-codebuild.SourceConfig.sourceProperty",
+      "docs-public-apis:@aws-cdk/aws-codebuild.SourceConfig.buildTriggers",
+      "props-default-doc:@aws-cdk/aws-codebuild.SourceConfig.buildTriggers"
     ]
   },
   "stability": "stable"
diff --git a/packages/@aws-cdk/aws-codebuild/test/test.project.ts b/packages/@aws-cdk/aws-codebuild/test/test.project.ts
index d7a0907a37873..a42703d064f83 100644
--- a/packages/@aws-cdk/aws-codebuild/test/test.project.ts
+++ b/packages/@aws-cdk/aws-codebuild/test/test.project.ts
@@ -150,7 +150,7 @@ export = {
       test.done();
     },
 
-    'cannot have bindToCodePipeline() be called on it'(test: Test) {
+    'can be added to a CodePipeline'(test: Test) {
       const stack = new cdk.Stack();
       const project = new codebuild.Project(stack, 'Project', {
         source: codebuild.Source.gitHub({
@@ -159,11 +159,9 @@ export = {
         }),
       });
 
-      test.throws(() => {
-        project.bindToCodePipeline(project, {
-          artifactBucket: new s3.Bucket(stack, 'Bucket'),
-        });
-      }, /Only a PipelineProject can be added to a CodePipeline/);
+      project.bindToCodePipeline(project, {
+        artifactBucket: new s3.Bucket(stack, 'Bucket'),
+      }); // no exception
 
       test.done();
     },
diff --git a/packages/@aws-cdk/aws-codecommit/package.json b/packages/@aws-cdk/aws-codecommit/package.json
index 156c6ed08cfb8..0c60af891e66f 100644
--- a/packages/@aws-cdk/aws-codecommit/package.json
+++ b/packages/@aws-cdk/aws-codecommit/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@aws-cdk/aws-codecommit",
-  "version": "1.13.1",
+  "version": "1.15.0",
   "description": "CDK Constructs for AWS CodeCommit",
   "main": "lib/index.js",
   "types": "lib/index.d.ts",
@@ -68,27 +68,42 @@
   },
   "license": "Apache-2.0",
   "devDependencies": {
-    "@aws-cdk/assert": "1.13.1",
-    "@aws-cdk/aws-sns": "1.13.1",
-    "aws-sdk": "^2.553.0",
-    "cdk-build-tools": "^1.13.1",
-    "cdk-integ-tools": "^1.13.1",
-    "cfn2ts": "^1.13.1",
-    "pkglint": "^1.13.1"
+    "@aws-cdk/assert": "1.15.0",
+    "@aws-cdk/aws-sns": "1.15.0",
+    "aws-sdk": "^2.558.0",
+    "cdk-build-tools": "^1.15.0",
+    "cdk-integ-tools": "^1.15.0",
+    "cfn2ts": "^1.15.0",
+    "pkglint": "^1.15.0"
   },
   "dependencies": {
-    "@aws-cdk/aws-events": "1.13.1",
-    "@aws-cdk/aws-iam": "1.13.1",
-    "@aws-cdk/core": "1.13.1"
+    "@aws-cdk/aws-events": "1.15.0",
+    "@aws-cdk/aws-iam": "1.15.0",
+    "@aws-cdk/core": "1.15.0"
   },
   "homepage": "https://github.com/aws/aws-cdk",
   "peerDependencies": {
-    "@aws-cdk/aws-events": "1.13.1",
-    "@aws-cdk/aws-iam": "1.13.1",
-    "@aws-cdk/core": "1.13.1"
+    "@aws-cdk/aws-events": "1.15.0",
+    "@aws-cdk/aws-iam": "1.15.0",
+    "@aws-cdk/core": "1.15.0"
   },
   "engines": {
     "node": ">= 10.3.0"
   },
-  "stability": "stable"
+  "stability": "stable",
+  "awslint": {
+    "exclude": [
+      "props-default-doc:@aws-cdk/aws-codecommit.RepositoryTriggerOptions.events",
+      "docs-public-apis:@aws-cdk/aws-codecommit.Repository.fromRepositoryName",
+      "docs-public-apis:@aws-cdk/aws-codecommit.RepositoryProps",
+      "props-default-doc:@aws-cdk/aws-codecommit.RepositoryTriggerOptions.branches",
+      "props-default-doc:@aws-cdk/aws-codecommit.RepositoryTriggerOptions.customData",
+      "docs-public-apis:@aws-cdk/aws-codecommit.IRepository",
+      "props-default-doc:@aws-cdk/aws-codecommit.RepositoryTriggerOptions.name",
+      "docs-public-apis:@aws-cdk/aws-codecommit.RepositoryEventTrigger.ALL",
+      "docs-public-apis:@aws-cdk/aws-codecommit.RepositoryEventTrigger.UPDATE_REF",
+      "docs-public-apis:@aws-cdk/aws-codecommit.RepositoryEventTrigger.CREATE_REF",
+      "docs-public-apis:@aws-cdk/aws-codecommit.RepositoryEventTrigger.DELETE_REF"
+    ]
+  }
 }
diff --git a/packages/@aws-cdk/aws-codedeploy/lib/ecs/application.ts b/packages/@aws-cdk/aws-codedeploy/lib/ecs/application.ts
new file mode 100644
index 0000000000000..848db6eaa69bc
--- /dev/null
+++ b/packages/@aws-cdk/aws-codedeploy/lib/ecs/application.ts
@@ -0,0 +1,79 @@
+import { Construct, IResource, Resource } from '@aws-cdk/core';
+import { CfnApplication } from "../codedeploy.generated";
+import { arnForApplication } from "../utils";
+
+/**
+ * Represents a reference to a CodeDeploy Application deploying to Amazon ECS.
+ *
+ * If you're managing the Application alongside the rest of your CDK resources,
+ * use the {@link EcsApplication} class.
+ *
+ * If you want to reference an already existing Application,
+ * or one defined in a different CDK Stack,
+ * use the {@link EcsApplication#fromEcsApplicationName} method.
+ */
+export interface IEcsApplication extends IResource {
+  /** @attribute */
+  readonly applicationArn: string;
+
+  /** @attribute */
+  readonly applicationName: string;
+}
+
+/**
+ * Construction properties for {@link EcsApplication}.
+ */
+export interface EcsApplicationProps {
+  /**
+   * The physical, human-readable name of the CodeDeploy Application.
+   *
+   * @default an auto-generated name will be used
+   */
+  readonly applicationName?: string;
+}
+
+/**
+ * A CodeDeploy Application that deploys to an Amazon ECS service.
+ *
+ * @resource AWS::CodeDeploy::Application
+ */
+export class EcsApplication extends Resource implements IEcsApplication {
+  /**
+   * Import an Application defined either outside the CDK, or in a different CDK Stack.
+   *
+   * @param scope the parent Construct for this new Construct
+   * @param id the logical ID of this new Construct
+   * @param ecsApplicationName the name of the application to import
+   * @returns a Construct representing a reference to an existing Application
+   */
+  public static fromEcsApplicationName(scope: Construct, id: string, ecsApplicationName: string): IEcsApplication {
+    class Import extends Resource implements IEcsApplication {
+      public applicationArn = arnForApplication(ecsApplicationName);
+      public applicationName = ecsApplicationName;
+    }
+
+    return new Import(scope, id);
+  }
+
+  public readonly applicationArn: string;
+  public readonly applicationName: string;
+
+  constructor(scope: Construct, id: string, props: EcsApplicationProps = {}) {
+    super(scope, id, {
+      physicalName: props.applicationName,
+    });
+
+    const resource = new CfnApplication(this, 'Resource', {
+      applicationName: this.physicalName,
+      computePlatform: 'ECS',
+    });
+
+    this.applicationName = this.getResourceNameAttribute(resource.ref);
+    this.applicationArn = this.getResourceArnAttribute(arnForApplication(resource.ref), {
+      service: 'codedeploy',
+      resource: 'application',
+      resourceName: this.physicalName,
+      sep: ':',
+    });
+  }
+}
diff --git a/packages/@aws-cdk/aws-codedeploy/lib/ecs/deployment-config.ts b/packages/@aws-cdk/aws-codedeploy/lib/ecs/deployment-config.ts
new file mode 100644
index 0000000000000..55edd73f300d1
--- /dev/null
+++ b/packages/@aws-cdk/aws-codedeploy/lib/ecs/deployment-config.ts
@@ -0,0 +1,52 @@
+import cdk = require('@aws-cdk/core');
+import { arnForDeploymentConfig } from '../utils';
+
+/**
+ * The Deployment Configuration of an ECS Deployment Group.
+ * The default, pre-defined Configurations are available as constants on the {@link EcsDeploymentConfig} class
+ * (for example, `EcsDeploymentConfig.AllAtOnce`).
+ *
+ * Note: CloudFormation does not currently support creating custom ECS configs outside
+ * of using a custom resource. You can import custom deployment config created outside the
+ * CDK or via a custom resource with {@link EcsDeploymentConfig#fromEcsDeploymentConfigName}.
+ */
+export interface IEcsDeploymentConfig {
+  readonly deploymentConfigName: string;
+  readonly deploymentConfigArn: string;
+}
+
+/**
+ * A custom Deployment Configuration for an ECS Deployment Group.
+ *
+ * Note: This class currently stands as namespaced container of the default configurations
+ * until CloudFormation supports custom ECS Deployment Configs. Until then it is closed
+ * (private constructor) and does not extend {@link cdk.Construct}
+ *
+ * @resource AWS::CodeDeploy::DeploymentConfig
+ */
+export class EcsDeploymentConfig {
+  public static readonly ALL_AT_ONCE = deploymentConfig('CodeDeployDefault.ECSAllAtOnce');
+
+  /**
+   * Import a custom Deployment Configuration for an ECS Deployment Group defined outside the CDK.
+   *
+   * @param _scope the parent Construct for this new Construct
+   * @param _id the logical ID of this new Construct
+   * @param ecsDeploymentConfigName the name of the referenced custom Deployment Configuration
+   * @returns a Construct representing a reference to an existing custom Deployment Configuration
+   */
+  public static fromEcsDeploymentConfigName(_scope: cdk.Construct, _id: string, ecsDeploymentConfigName: string): IEcsDeploymentConfig {
+    return deploymentConfig(ecsDeploymentConfigName);
+  }
+
+  private constructor() {
+    // nothing to do until CFN supports custom ECS deployment configurations
+  }
+}
+
+function deploymentConfig(name: string): IEcsDeploymentConfig {
+  return {
+    deploymentConfigName: name,
+    deploymentConfigArn: arnForDeploymentConfig(name),
+  };
+}
diff --git a/packages/@aws-cdk/aws-codedeploy/lib/ecs/deployment-group.ts b/packages/@aws-cdk/aws-codedeploy/lib/ecs/deployment-group.ts
new file mode 100644
index 0000000000000..a0a8c5f6c5ab2
--- /dev/null
+++ b/packages/@aws-cdk/aws-codedeploy/lib/ecs/deployment-group.ts
@@ -0,0 +1,102 @@
+import cdk = require('@aws-cdk/core');
+
+import { arnForDeploymentGroup } from '../utils';
+import { IEcsApplication } from './application';
+import { EcsDeploymentConfig, IEcsDeploymentConfig } from './deployment-config';
+
+/**
+ * Interface for an ECS deployment group.
+ */
+export interface IEcsDeploymentGroup extends cdk.IResource {
+  /**
+   * The reference to the CodeDeploy ECS Application that this Deployment Group belongs to.
+   */
+  readonly application: IEcsApplication;
+
+  /**
+   * The physical name of the CodeDeploy Deployment Group.
+   * @attribute
+   */
+  readonly deploymentGroupName: string;
+
+  /**
+   * The ARN of this Deployment Group.
+   * @attribute
+   */
+  readonly deploymentGroupArn: string;
+
+  /**
+   * The Deployment Configuration this Group uses.
+   */
+  readonly deploymentConfig: IEcsDeploymentConfig;
+}
+
+/**
+ * Note: This class currently stands as a namespaced container for importing an ECS
+ * Deployment Group defined outside the CDK app until CloudFormation supports provisioning
+ * ECS Deployment Groups. Until then it is closed (private constructor) and does not
+ * extend {@link cdk.Construct}.
+ *
+ * @resource AWS::CodeDeploy::DeploymentGroup
+ */
+export class EcsDeploymentGroup {
+  /**
+   * Import an ECS Deployment Group defined outside the CDK app.
+   *
+   * @param scope the parent Construct for this new Construct
+   * @param id the logical ID of this new Construct
+   * @param attrs the properties of the referenced Deployment Group
+   * @returns a Construct representing a reference to an existing Deployment Group
+   */
+  public static fromEcsDeploymentGroupAttributes(
+      scope: cdk.Construct,
+      id: string,
+      attrs: EcsDeploymentGroupAttributes): IEcsDeploymentGroup {
+    return new ImportedEcsDeploymentGroup(scope, id, attrs);
+  }
+
+  private constructor() {
+    // nothing to do until CFN supports ECS deployment groups
+  }
+}
+
+/**
+ * Properties of a reference to a CodeDeploy ECS Deployment Group.
+ *
+ * @see EcsDeploymentGroup#fromEcsDeploymentGroupAttributes
+ */
+export interface EcsDeploymentGroupAttributes {
+  /**
+   * The reference to the CodeDeploy ECS Application
+   * that this Deployment Group belongs to.
+   */
+  readonly application: IEcsApplication;
+
+  /**
+   * The physical, human-readable name of the CodeDeploy ECS Deployment Group
+   * that we are referencing.
+   */
+  readonly deploymentGroupName: string;
+
+  /**
+   * The Deployment Configuration this Deployment Group uses.
+   *
+   * @default EcsDeploymentConfig.ALL_AT_ONCE
+   */
+  readonly deploymentConfig?: IEcsDeploymentConfig;
+}
+
+class ImportedEcsDeploymentGroup extends cdk.Resource implements IEcsDeploymentGroup {
+  public readonly application: IEcsApplication;
+  public readonly deploymentGroupName: string;
+  public readonly deploymentGroupArn: string;
+  public readonly deploymentConfig: IEcsDeploymentConfig;
+
+  constructor(scope: cdk.Construct, id: string, props: EcsDeploymentGroupAttributes) {
+    super(scope, id);
+    this.application = props.application;
+    this.deploymentGroupName = props.deploymentGroupName;
+    this.deploymentGroupArn = arnForDeploymentGroup(props.application.applicationName, props.deploymentGroupName);
+    this.deploymentConfig = props.deploymentConfig || EcsDeploymentConfig.ALL_AT_ONCE;
+  }
+}
diff --git a/packages/@aws-cdk/aws-codedeploy/lib/ecs/index.ts b/packages/@aws-cdk/aws-codedeploy/lib/ecs/index.ts
new file mode 100644
index 0000000000000..933062a88e18e
--- /dev/null
+++ b/packages/@aws-cdk/aws-codedeploy/lib/ecs/index.ts
@@ -0,0 +1,3 @@
+export * from './application';
+export * from './deployment-config';
+export * from './deployment-group';
diff --git a/packages/@aws-cdk/aws-codedeploy/lib/index.ts b/packages/@aws-cdk/aws-codedeploy/lib/index.ts
index 7b78d58755771..147f27580b874 100644
--- a/packages/@aws-cdk/aws-codedeploy/lib/index.ts
+++ b/packages/@aws-cdk/aws-codedeploy/lib/index.ts
@@ -1,4 +1,5 @@
 export * from './rollback-config';
+export * from './ecs';
 export * from './lambda';
 export * from './server';
 
diff --git a/packages/@aws-cdk/aws-codedeploy/package.json b/packages/@aws-cdk/aws-codedeploy/package.json
index b2163b9c3f9b6..ad49590e7621c 100644
--- a/packages/@aws-cdk/aws-codedeploy/package.json
+++ b/packages/@aws-cdk/aws-codedeploy/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@aws-cdk/aws-codedeploy",
-  "version": "1.13.1",
+  "version": "1.15.0",
   "description": "The CDK Construct Library for AWS::CodeDeploy",
   "main": "lib/index.js",
   "types": "lib/index.d.ts",
@@ -66,33 +66,33 @@
   },
   "license": "Apache-2.0",
   "devDependencies": {
-    "@aws-cdk/assert": "1.13.1",
-    "@aws-cdk/aws-ec2": "1.13.1",
-    "cdk-build-tools": "^1.13.1",
-    "cdk-integ-tools": "^1.13.1",
-    "cfn2ts": "^1.13.1",
-    "pkglint": "^1.13.1"
+    "@aws-cdk/assert": "1.15.0",
+    "@aws-cdk/aws-ec2": "1.15.0",
+    "cdk-build-tools": "^1.15.0",
+    "cdk-integ-tools": "^1.15.0",
+    "cfn2ts": "^1.15.0",
+    "pkglint": "^1.15.0"
   },
   "dependencies": {
-    "@aws-cdk/aws-autoscaling": "1.13.1",
-    "@aws-cdk/aws-cloudwatch": "1.13.1",
-    "@aws-cdk/aws-elasticloadbalancing": "1.13.1",
-    "@aws-cdk/aws-elasticloadbalancingv2": "1.13.1",
-    "@aws-cdk/aws-iam": "1.13.1",
-    "@aws-cdk/aws-lambda": "1.13.1",
-    "@aws-cdk/aws-s3": "1.13.1",
-    "@aws-cdk/core": "1.13.1"
+    "@aws-cdk/aws-autoscaling": "1.15.0",
+    "@aws-cdk/aws-cloudwatch": "1.15.0",
+    "@aws-cdk/aws-elasticloadbalancing": "1.15.0",
+    "@aws-cdk/aws-elasticloadbalancingv2": "1.15.0",
+    "@aws-cdk/aws-iam": "1.15.0",
+    "@aws-cdk/aws-lambda": "1.15.0",
+    "@aws-cdk/aws-s3": "1.15.0",
+    "@aws-cdk/core": "1.15.0"
   },
   "homepage": "https://github.com/aws/aws-cdk",
   "peerDependencies": {
-    "@aws-cdk/aws-autoscaling": "1.13.1",
-    "@aws-cdk/aws-cloudwatch": "1.13.1",
-    "@aws-cdk/aws-elasticloadbalancing": "1.13.1",
-    "@aws-cdk/aws-elasticloadbalancingv2": "1.13.1",
-    "@aws-cdk/aws-iam": "1.13.1",
-    "@aws-cdk/aws-lambda": "1.13.1",
-    "@aws-cdk/aws-s3": "1.13.1",
-    "@aws-cdk/core": "1.13.1"
+    "@aws-cdk/aws-autoscaling": "1.15.0",
+    "@aws-cdk/aws-cloudwatch": "1.15.0",
+    "@aws-cdk/aws-elasticloadbalancing": "1.15.0",
+    "@aws-cdk/aws-elasticloadbalancingv2": "1.15.0",
+    "@aws-cdk/aws-iam": "1.15.0",
+    "@aws-cdk/aws-lambda": "1.15.0",
+    "@aws-cdk/aws-s3": "1.15.0",
+    "@aws-cdk/core": "1.15.0"
   },
   "engines": {
     "node": ">= 10.3.0"
@@ -100,7 +100,58 @@
   "awslint": {
     "exclude": [
       "construct-interface-extends-iconstruct:@aws-cdk/aws-codedeploy.IServerDeploymentConfig",
-      "resource-interface-extends-resource:@aws-cdk/aws-codedeploy.IServerDeploymentConfig"
+      "resource-interface-extends-resource:@aws-cdk/aws-codedeploy.IServerDeploymentConfig",
+      "docs-public-apis:@aws-cdk/aws-codedeploy.ServerDeploymentConfig.deploymentConfigArn",
+      "docs-public-apis:@aws-cdk/aws-codedeploy.IServerDeploymentGroup.role",
+      "docs-public-apis:@aws-cdk/aws-codedeploy.InstanceTagSet.instanceTagGroups",
+      "docs-public-apis:@aws-cdk/aws-codedeploy.LambdaApplication.applicationArn",
+      "docs-public-apis:@aws-cdk/aws-codedeploy.LambdaApplication.applicationName",
+      "docs-public-apis:@aws-cdk/aws-codedeploy.LambdaDeploymentConfig.ALL_AT_ONCE",
+      "docs-public-apis:@aws-cdk/aws-codedeploy.LambdaDeploymentConfig.CANARY_10PERCENT_10MINUTES",
+      "docs-public-apis:@aws-cdk/aws-codedeploy.LambdaDeploymentConfig.CANARY_10PERCENT_15MINUTES",
+      "docs-public-apis:@aws-cdk/aws-codedeploy.LambdaDeploymentConfig.CANARY_10PERCENT_30MINUTES",
+      "docs-public-apis:@aws-cdk/aws-codedeploy.LambdaDeploymentConfig.CANARY_10PERCENT_5MINUTES",
+      "docs-public-apis:@aws-cdk/aws-codedeploy.LambdaDeploymentConfig.LINEAR_10PERCENT_EVERY_10MINUTES",
+      "docs-public-apis:@aws-cdk/aws-codedeploy.LambdaDeploymentConfig.LINEAR_10PERCENT_EVERY_1MINUTE",
+      "docs-public-apis:@aws-cdk/aws-codedeploy.LambdaDeploymentConfig.LINEAR_10PERCENT_EVERY_2MINUTES",
+      "docs-public-apis:@aws-cdk/aws-codedeploy.LambdaDeploymentConfig.LINEAR_10PERCENT_EVERY_3MINUTES",
+      "docs-public-apis:@aws-cdk/aws-codedeploy.LambdaDeploymentGroup",
+      "docs-public-apis:@aws-cdk/aws-codedeploy.LambdaDeploymentGroup.role",
+      "docs-public-apis:@aws-cdk/aws-codedeploy.LoadBalancer.generation",
+      "docs-public-apis:@aws-cdk/aws-codedeploy.LoadBalancer.name",
+      "docs-public-apis:@aws-cdk/aws-codedeploy.ServerApplication.applicationArn",
+      "docs-public-apis:@aws-cdk/aws-codedeploy.ServerApplication.applicationName",
+      "docs-public-apis:@aws-cdk/aws-codedeploy.ServerDeploymentConfig.ALL_AT_ONCE",
+      "docs-public-apis:@aws-cdk/aws-codedeploy.ServerDeploymentConfig.HALF_AT_A_TIME",
+      "docs-public-apis:@aws-cdk/aws-codedeploy.ServerDeploymentConfig.ONE_AT_A_TIME",
+      "docs-public-apis:@aws-cdk/aws-codedeploy.IServerDeploymentGroup.autoScalingGroups",
+      "docs-public-apis:@aws-cdk/aws-codedeploy.ServerDeploymentConfig.deploymentConfigName",
+      "docs-public-apis:@aws-cdk/aws-codedeploy.ServerDeploymentGroup.application",
+      "docs-public-apis:@aws-cdk/aws-codedeploy.ServerDeploymentGroup.deploymentConfig",
+      "docs-public-apis:@aws-cdk/aws-codedeploy.ServerDeploymentGroup.deploymentGroupArn",
+      "docs-public-apis:@aws-cdk/aws-codedeploy.ServerDeploymentGroup.deploymentGroupName",
+      "docs-public-apis:@aws-cdk/aws-codedeploy.ServerDeploymentGroup.autoScalingGroups",
+      "docs-public-apis:@aws-cdk/aws-codedeploy.ServerDeploymentGroup.role",
+      "docs-public-apis:@aws-cdk/aws-codedeploy.ILambdaApplication.applicationArn",
+      "docs-public-apis:@aws-cdk/aws-codedeploy.ILambdaApplication.applicationName",
+      "docs-public-apis:@aws-cdk/aws-codedeploy.ILambdaDeploymentConfig.deploymentConfigArn",
+      "docs-public-apis:@aws-cdk/aws-codedeploy.ILambdaDeploymentConfig.deploymentConfigName",
+      "docs-public-apis:@aws-cdk/aws-codedeploy.IServerApplication.applicationArn",
+      "docs-public-apis:@aws-cdk/aws-codedeploy.IServerApplication.applicationName",
+      "docs-public-apis:@aws-cdk/aws-codedeploy.IServerDeploymentConfig.deploymentConfigArn",
+      "docs-public-apis:@aws-cdk/aws-codedeploy.IServerDeploymentConfig.deploymentConfigName",
+      "docs-public-apis:@aws-cdk/aws-codedeploy.IServerDeploymentGroup",
+      "docs-public-apis:@aws-cdk/aws-codedeploy.IServerDeploymentGroup.application",
+      "docs-public-apis:@aws-cdk/aws-codedeploy.IServerDeploymentGroup.deploymentConfig",
+      "docs-public-apis:@aws-cdk/aws-codedeploy.IServerDeploymentGroup.deploymentGroupArn",
+      "docs-public-apis:@aws-cdk/aws-codedeploy.IServerDeploymentGroup.deploymentGroupName",
+      "docs-public-apis:@aws-cdk/aws-codedeploy.EcsApplication.applicationArn",
+      "docs-public-apis:@aws-cdk/aws-codedeploy.EcsApplication.applicationName",
+      "docs-public-apis:@aws-cdk/aws-codedeploy.EcsDeploymentConfig.ALL_AT_ONCE",
+      "docs-public-apis:@aws-cdk/aws-codedeploy.IEcsApplication.applicationArn",
+      "docs-public-apis:@aws-cdk/aws-codedeploy.IEcsApplication.applicationName",
+      "docs-public-apis:@aws-cdk/aws-codedeploy.IEcsDeploymentConfig.deploymentConfigArn",
+      "docs-public-apis:@aws-cdk/aws-codedeploy.IEcsDeploymentConfig.deploymentConfigName"
     ]
   },
   "stability": "stable"
diff --git a/packages/@aws-cdk/aws-codedeploy/test/ecs/test.application.ts b/packages/@aws-cdk/aws-codedeploy/test/ecs/test.application.ts
new file mode 100644
index 0000000000000..eff88ef934950
--- /dev/null
+++ b/packages/@aws-cdk/aws-codedeploy/test/ecs/test.application.ts
@@ -0,0 +1,33 @@
+import { expect, haveResource } from '@aws-cdk/assert';
+import cdk = require('@aws-cdk/core');
+import { Test } from 'nodeunit';
+import codedeploy = require('../../lib');
+
+export = {
+  'CodeDeploy ECS Application': {
+    'can be created'(test: Test) {
+      const stack = new cdk.Stack();
+      new codedeploy.EcsApplication(stack, 'MyApp');
+
+      expect(stack).to(haveResource('AWS::CodeDeploy::Application', {
+        ComputePlatform: 'ECS',
+      }));
+
+      test.done();
+    },
+
+    'can be created with explicit name'(test: Test) {
+      const stack = new cdk.Stack();
+      new codedeploy.EcsApplication(stack, 'MyApp', {
+        applicationName: 'my-name',
+      });
+
+      expect(stack).to(haveResource('AWS::CodeDeploy::Application', {
+        ApplicationName: 'my-name',
+        ComputePlatform: 'ECS',
+      }));
+
+      test.done();
+    },
+  }
+};
diff --git a/packages/@aws-cdk/aws-codedeploy/test/ecs/test.deployment-group.ts b/packages/@aws-cdk/aws-codedeploy/test/ecs/test.deployment-group.ts
new file mode 100644
index 0000000000000..0f92e707ddf8e
--- /dev/null
+++ b/packages/@aws-cdk/aws-codedeploy/test/ecs/test.deployment-group.ts
@@ -0,0 +1,24 @@
+import cdk = require('@aws-cdk/core');
+import { Test } from 'nodeunit';
+import codedeploy = require('../../lib');
+import { EcsDeploymentConfig } from '../../lib';
+
+export = {
+  "CodeDeploy ECS DeploymentGroup": {
+    'imported with fromEcsDeploymentGroupAttributes': {
+      'defaults the Deployment Config to AllAtOnce'(test: Test) {
+        const stack = new cdk.Stack();
+
+        const ecsApp = codedeploy.EcsApplication.fromEcsApplicationName(stack, 'EA', 'EcsApplication');
+        const importedGroup = codedeploy.EcsDeploymentGroup.fromEcsDeploymentGroupAttributes(stack, 'EDG', {
+          application: ecsApp,
+          deploymentGroupName: 'EcsDeploymentGroup',
+        });
+
+        test.equal(importedGroup.deploymentConfig, EcsDeploymentConfig.ALL_AT_ONCE);
+
+        test.done();
+      },
+    },
+  },
+};
diff --git a/packages/@aws-cdk/aws-codepipeline-actions/lib/codebuild/build-action.ts b/packages/@aws-cdk/aws-codepipeline-actions/lib/codebuild/build-action.ts
index 46a57d7f1ff08..b6c1e826d620d 100644
--- a/packages/@aws-cdk/aws-codepipeline-actions/lib/codebuild/build-action.ts
+++ b/packages/@aws-cdk/aws-codepipeline-actions/lib/codebuild/build-action.ts
@@ -60,6 +60,15 @@ export interface CodeBuildActionProps extends codepipeline.CommonAwsActionProps
    * @default CodeBuildActionType.BUILD
    */
   readonly type?: CodeBuildActionType;
+
+  /**
+   * The environment variables to pass to the CodeBuild project when this action executes.
+   * If a variable with the same name was set both on the project level, and here,
+   * this value will take precedence.
+   *
+   * @default - No additional environment variables are specified.
+   */
+  readonly environmentVariables?: { [name: string]: codebuild.BuildEnvironmentVariable };
 }
 
 /**
@@ -107,10 +116,14 @@ export class CodeBuildAction extends Action {
     }));
 
     // allow the Project access to the Pipeline's artifact Bucket
-    if ((this.actionProperties.outputs || []).length > 0) {
-      options.bucket.grantReadWrite(this.props.project);
-    } else {
-      options.bucket.grantRead(this.props.project);
+    // but only if the project is not imported
+    // (ie., has a role) - otherwise, the IAM library throws an error
+    if (this.props.project.role) {
+      if ((this.actionProperties.outputs || []).length > 0) {
+        options.bucket.grantReadWrite(this.props.project);
+      } else {
+        options.bucket.grantRead(this.props.project);
+      }
     }
 
     if (this.props.project instanceof codebuild.Project) {
@@ -121,6 +134,8 @@ export class CodeBuildAction extends Action {
 
     const configuration: any = {
       ProjectName: this.props.project.projectName,
+      EnvironmentVariables: this.props.environmentVariables &&
+        cdk.Stack.of(scope).toJsonString(codebuild.Project.serializeEnvVariables(this.props.environmentVariables)),
     };
     if ((this.actionProperties.inputs || []).length > 1) {
       // lazy, because the Artifact name might be generated lazily
diff --git a/packages/@aws-cdk/aws-codepipeline-actions/lib/codedeploy/ecs-deploy-action.ts b/packages/@aws-cdk/aws-codepipeline-actions/lib/codedeploy/ecs-deploy-action.ts
new file mode 100644
index 0000000000000..e678c37ff3b4a
--- /dev/null
+++ b/packages/@aws-cdk/aws-codepipeline-actions/lib/codedeploy/ecs-deploy-action.ts
@@ -0,0 +1,235 @@
+import codedeploy = require('@aws-cdk/aws-codedeploy');
+import codepipeline = require('@aws-cdk/aws-codepipeline');
+import iam = require('@aws-cdk/aws-iam');
+import { Construct } from '@aws-cdk/core';
+import { Action } from '../action';
+
+/**
+ * Configuration for replacing a placeholder string in the ECS task
+ * definition template file with an image URI.
+ */
+export interface CodeDeployEcsContainerImageInput {
+  /**
+   * The artifact that contains an `imageDetails.json` file with the image URI.
+   *
+   * The artifact's `imageDetails.json` file must be a JSON file containing an
+   * `ImageURI` property.  For example:
+   * `{ "ImageURI": "ACCOUNTID.dkr.ecr.us-west-2.amazonaws.com/dk-image-repo@sha256:example3" }`
+   */
+  readonly input: codepipeline.Artifact;
+
+  /**
+   * The placeholder string in the ECS task definition template file that will
+   * be replaced with the image URI.
+   *
+   * The placeholder string must be surrounded by angle brackets in the template file.
+   * For example, if the task definition template file contains a placeholder like
+   * `"image": "<PLACEHOLDER>"`, then the `taskDefinitionPlaceholder` value should
+   * be `PLACEHOLDER`.
+   *
+   * @default IMAGE
+   */
+  readonly taskDefinitionPlaceholder?: string;
+}
+
+/**
+ * Construction properties of the {@link CodeDeployEcsDeployAction CodeDeploy ECS deploy CodePipeline Action}.
+ */
+export interface CodeDeployEcsDeployActionProps extends codepipeline.CommonAwsActionProps {
+  /**
+   * The CodeDeploy ECS Deployment Group to deploy to.
+   */
+  readonly deploymentGroup: codedeploy.IEcsDeploymentGroup;
+
+  /**
+   * The artifact containing the ECS task definition template file.
+   * During deployment, the task definition template file contents
+   * will be registered with ECS.
+   *
+   * If you use this property, it's assumed the file is called 'taskdef.json'.
+   * If your task definition template uses a different filename, leave this property empty,
+   * and use the `taskDefinitionTemplateFile` property instead.
+   *
+   * @default - one of this property, or `taskDefinitionTemplateFile`, is required
+   */
+  readonly taskDefinitionTemplateInput?: codepipeline.Artifact;
+
+  /**
+   * The name of the ECS task definition template file.
+   * During deployment, the task definition template file contents
+   * will be registered with ECS.
+   *
+   * Use this property if you want to use a different name for this file than the default 'taskdef.json'.
+   * If you use this property, you don't need to specify the `taskDefinitionTemplateInput` property.
+   *
+   * @default - one of this property, or `taskDefinitionTemplateInput`, is required
+   */
+  readonly taskDefinitionTemplateFile?: codepipeline.ArtifactPath;
+
+  /**
+   * The artifact containing the CodeDeploy AppSpec file.
+   * During deployment, a new task definition will be registered
+   * with ECS, and the new task definition ID will be inserted into
+   * the CodeDeploy AppSpec file.  The AppSpec file contents will be
+   * provided to CodeDeploy for the deployment.
+   *
+   * If you use this property, it's assumed the file is called 'appspec.yaml'.
+   * If your AppSpec file uses a different filename, leave this property empty,
+   * and use the `appSpecTemplateFile` property instead.
+   *
+   * @default - one of this property, or `appSpecTemplateFile`, is required
+   */
+  readonly appSpecTemplateInput?: codepipeline.Artifact;
+
+  /**
+   * The name of the CodeDeploy AppSpec file.
+   * During deployment, a new task definition will be registered
+   * with ECS, and the new task definition ID will be inserted into
+   * the CodeDeploy AppSpec file.  The AppSpec file contents will be
+   * provided to CodeDeploy for the deployment.
+   *
+   * Use this property if you want to use a different name for this file than the default 'appspec.yaml'.
+   * If you use this property, you don't need to specify the `appSpecTemplateInput` property.
+   *
+   * @default - one of this property, or `appSpecTemplateInput`, is required
+   */
+  readonly appSpecTemplateFile?: codepipeline.ArtifactPath;
+
+  /**
+   * Configuration for dynamically updated images in the task definition.
+   *
+   * Provide pairs of an image details input artifact and a placeholder string
+   * that will be used to dynamically update the ECS task definition template
+   * file prior to deployment. A maximum of 4 images can be given.
+   */
+  readonly containerImageInputs?: CodeDeployEcsContainerImageInput[];
+}
+
+export class CodeDeployEcsDeployAction extends Action {
+  private readonly actionProps: CodeDeployEcsDeployActionProps;
+
+  constructor(props: CodeDeployEcsDeployActionProps) {
+    const inputs: codepipeline.Artifact[] = [];
+    inputs.push(determineTaskDefinitionArtifact(props));
+    inputs.push(determineAppSpecArtifact(props));
+
+    if (props.containerImageInputs) {
+      if (props.containerImageInputs.length > 4) {
+        throw new Error(`Action cannot have more than 4 container image inputs, got: ${props.containerImageInputs.length}`);
+      }
+
+      for (const imageInput of props.containerImageInputs) {
+        inputs.push(imageInput.input);
+      }
+    }
+
+    super({
+      ...props,
+      resource: props.deploymentGroup,
+      category: codepipeline.ActionCategory.DEPLOY,
+      provider: 'CodeDeployToECS',
+      artifactBounds: { minInputs: 1, maxInputs: 5, minOutputs: 0, maxOutputs: 0 },
+      inputs,
+    });
+
+    this.actionProps = props;
+  }
+
+  protected bound(_scope: Construct, _stage: codepipeline.IStage, options: codepipeline.ActionBindOptions):
+      codepipeline.ActionConfig {
+    // permissions, based on:
+    // https://docs.aws.amazon.com/codedeploy/latest/userguide/auth-and-access-control-permissions-reference.html
+
+    options.role.addToPolicy(new iam.PolicyStatement({
+      resources: [this.actionProps.deploymentGroup.application.applicationArn],
+      actions: ['codedeploy:GetApplication', 'codedeploy:GetApplicationRevision', 'codedeploy:RegisterApplicationRevision']
+    }));
+
+    options.role.addToPolicy(new iam.PolicyStatement({
+      resources: [this.actionProps.deploymentGroup.deploymentGroupArn],
+      actions: ['codedeploy:CreateDeployment', 'codedeploy:GetDeployment'],
+    }));
+
+    options.role.addToPolicy(new iam.PolicyStatement({
+      resources: [this.actionProps.deploymentGroup.deploymentConfig.deploymentConfigArn],
+      actions: ['codedeploy:GetDeploymentConfig']
+    }));
+
+    // Allow action to register the task definition template file with ECS
+    options.role.addToPolicy(new iam.PolicyStatement({
+      resources: ['*'],
+      actions: ['ecs:RegisterTaskDefinition']
+    }));
+
+    // Allow passing any roles specified in the task definition template file to ECS
+    options.role.addToPolicy(new iam.PolicyStatement({
+      actions: ['iam:PassRole'],
+      resources: ['*'],
+      conditions: {
+        StringEqualsIfExists: {
+          'iam:PassedToService': [
+            'ecs-tasks.amazonaws.com',
+          ],
+        }
+      }
+    }));
+
+    // the Action's Role needs to read from the Bucket to get artifacts
+    options.bucket.grantRead(options.role);
+
+    const actionConfig: codepipeline.ActionConfig = {
+      configuration: {
+        ApplicationName: this.actionProps.deploymentGroup.application.applicationName,
+        DeploymentGroupName: this.actionProps.deploymentGroup.deploymentGroupName,
+
+        TaskDefinitionTemplateArtifact: determineTaskDefinitionArtifact(this.actionProps).artifactName,
+        TaskDefinitionTemplatePath: this.actionProps.taskDefinitionTemplateFile
+          ? this.actionProps.taskDefinitionTemplateFile.fileName
+          : 'taskdef.json',
+
+        AppSpecTemplateArtifact: determineAppSpecArtifact(this.actionProps).artifactName,
+        AppSpecTemplatePath: this.actionProps.appSpecTemplateFile
+          ? this.actionProps.appSpecTemplateFile.fileName
+          : 'appspec.yaml',
+      },
+    };
+
+    if (this.actionProps.containerImageInputs) {
+      for (let i = 1; i <= this.actionProps.containerImageInputs.length; i++) {
+        const imageInput = this.actionProps.containerImageInputs[i - 1];
+        actionConfig.configuration[`Image${i}ArtifactName`] = imageInput.input.artifactName;
+        actionConfig.configuration[`Image${i}ContainerName`] = imageInput.taskDefinitionPlaceholder
+          ? imageInput.taskDefinitionPlaceholder
+          : 'IMAGE';
+      }
+    }
+
+    return actionConfig;
+  }
+}
+
+function determineTaskDefinitionArtifact(props: CodeDeployEcsDeployActionProps): codepipeline.Artifact {
+  if (props.taskDefinitionTemplateFile && props.taskDefinitionTemplateInput) {
+    throw new Error("Exactly one of 'taskDefinitionTemplateInput' or 'taskDefinitionTemplateFile' can be provided in the ECS CodeDeploy Action");
+  }
+  if (props.taskDefinitionTemplateFile) {
+    return props.taskDefinitionTemplateFile.artifact;
+  }
+  if (props.taskDefinitionTemplateInput) {
+    return props.taskDefinitionTemplateInput;
+  }
+  throw new Error("Specifying one of 'taskDefinitionTemplateInput' or 'taskDefinitionTemplateFile' is required for the ECS CodeDeploy Action");
+}
+
+function determineAppSpecArtifact(props: CodeDeployEcsDeployActionProps): codepipeline.Artifact {
+  if (props.appSpecTemplateFile && props.appSpecTemplateInput) {
+    throw new Error("Exactly one of 'appSpecTemplateInput' or 'appSpecTemplateFile' can be provided in the ECS CodeDeploy Action");
+  }
+  if (props.appSpecTemplateFile) {
+    return props.appSpecTemplateFile.artifact;
+  }
+  if (props.appSpecTemplateInput) {
+    return props.appSpecTemplateInput;
+  }
+  throw new Error("Specifying one of 'appSpecTemplateInput' or 'appSpecTemplateFile' is required for the ECS CodeDeploy Action");
+}
\ No newline at end of file
diff --git a/packages/@aws-cdk/aws-codepipeline-actions/lib/index.ts b/packages/@aws-cdk/aws-codepipeline-actions/lib/index.ts
index a785f68b6d7c4..d27a31e802791 100644
--- a/packages/@aws-cdk/aws-codepipeline-actions/lib/index.ts
+++ b/packages/@aws-cdk/aws-codepipeline-actions/lib/index.ts
@@ -2,6 +2,7 @@ export * from './alexa-ask/deploy-action';
 export * from './cloudformation/pipeline-actions';
 export * from './codebuild/build-action';
 export * from './codecommit/source-action';
+export * from './codedeploy/ecs-deploy-action';
 export * from './codedeploy/server-deploy-action';
 export * from './ecr/source-action';
 export * from './ecs/deploy-action';
diff --git a/packages/@aws-cdk/aws-codepipeline-actions/package.json b/packages/@aws-cdk/aws-codepipeline-actions/package.json
index fdad0e62ae745..28540222ab725 100644
--- a/packages/@aws-cdk/aws-codepipeline-actions/package.json
+++ b/packages/@aws-cdk/aws-codepipeline-actions/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@aws-cdk/aws-codepipeline-actions",
-  "version": "1.13.1",
+  "version": "1.15.0",
   "description": "Concrete Actions for AWS Code Pipeline",
   "main": "lib/index.js",
   "types": "lib/index.d.ts",
@@ -65,53 +65,98 @@
   },
   "license": "Apache-2.0",
   "devDependencies": {
-    "@aws-cdk/assert": "1.13.1",
-    "@aws-cdk/aws-cloudtrail": "1.13.1",
+    "@aws-cdk/assert": "1.15.0",
+    "@aws-cdk/aws-cloudtrail": "1.15.0",
     "@types/lodash": "^4.14.144",
-    "cdk-build-tools": "^1.13.1",
-    "cdk-integ-tools": "^1.13.1",
+    "cdk-build-tools": "^1.15.0",
+    "cdk-integ-tools": "^1.15.0",
     "lodash": "^4.17.15",
-    "pkglint": "^1.13.1"
+    "pkglint": "^1.15.0"
   },
   "dependencies": {
-    "@aws-cdk/aws-cloudformation": "1.13.1",
-    "@aws-cdk/aws-codebuild": "1.13.1",
-    "@aws-cdk/aws-codecommit": "1.13.1",
-    "@aws-cdk/aws-codedeploy": "1.13.1",
-    "@aws-cdk/aws-codepipeline": "1.13.1",
-    "@aws-cdk/aws-ec2": "1.13.1",
-    "@aws-cdk/aws-ecr": "1.13.1",
-    "@aws-cdk/aws-ecs": "1.13.1",
-    "@aws-cdk/aws-events": "1.13.1",
-    "@aws-cdk/aws-events-targets": "1.13.1",
-    "@aws-cdk/aws-iam": "1.13.1",
-    "@aws-cdk/aws-lambda": "1.13.1",
-    "@aws-cdk/aws-s3": "1.13.1",
-    "@aws-cdk/aws-sns": "1.13.1",
-    "@aws-cdk/aws-sns-subscriptions": "1.13.1",
-    "@aws-cdk/core": "1.13.1"
+    "@aws-cdk/aws-cloudformation": "1.15.0",
+    "@aws-cdk/aws-codebuild": "1.15.0",
+    "@aws-cdk/aws-codecommit": "1.15.0",
+    "@aws-cdk/aws-codedeploy": "1.15.0",
+    "@aws-cdk/aws-codepipeline": "1.15.0",
+    "@aws-cdk/aws-ec2": "1.15.0",
+    "@aws-cdk/aws-ecr": "1.15.0",
+    "@aws-cdk/aws-ecs": "1.15.0",
+    "@aws-cdk/aws-events": "1.15.0",
+    "@aws-cdk/aws-events-targets": "1.15.0",
+    "@aws-cdk/aws-iam": "1.15.0",
+    "@aws-cdk/aws-lambda": "1.15.0",
+    "@aws-cdk/aws-s3": "1.15.0",
+    "@aws-cdk/aws-sns": "1.15.0",
+    "@aws-cdk/aws-sns-subscriptions": "1.15.0",
+    "@aws-cdk/core": "1.15.0"
   },
   "homepage": "https://github.com/aws/aws-cdk",
   "peerDependencies": {
-    "@aws-cdk/aws-cloudformation": "1.13.1",
-    "@aws-cdk/aws-codebuild": "1.13.1",
-    "@aws-cdk/aws-codecommit": "1.13.1",
-    "@aws-cdk/aws-codedeploy": "1.13.1",
-    "@aws-cdk/aws-codepipeline": "1.13.1",
-    "@aws-cdk/aws-ec2": "1.13.1",
-    "@aws-cdk/aws-ecr": "1.13.1",
-    "@aws-cdk/aws-ecs": "1.13.1",
-    "@aws-cdk/aws-events": "1.13.1",
-    "@aws-cdk/aws-events-targets": "1.13.1",
-    "@aws-cdk/aws-iam": "1.13.1",
-    "@aws-cdk/aws-lambda": "1.13.1",
-    "@aws-cdk/aws-s3": "1.13.1",
-    "@aws-cdk/aws-sns": "1.13.1",
-    "@aws-cdk/aws-sns-subscriptions": "1.13.1",
-    "@aws-cdk/core": "1.13.1"
+    "@aws-cdk/aws-cloudformation": "1.15.0",
+    "@aws-cdk/aws-codebuild": "1.15.0",
+    "@aws-cdk/aws-codecommit": "1.15.0",
+    "@aws-cdk/aws-codedeploy": "1.15.0",
+    "@aws-cdk/aws-codepipeline": "1.15.0",
+    "@aws-cdk/aws-ec2": "1.15.0",
+    "@aws-cdk/aws-ecr": "1.15.0",
+    "@aws-cdk/aws-ecs": "1.15.0",
+    "@aws-cdk/aws-events": "1.15.0",
+    "@aws-cdk/aws-events-targets": "1.15.0",
+    "@aws-cdk/aws-iam": "1.15.0",
+    "@aws-cdk/aws-lambda": "1.15.0",
+    "@aws-cdk/aws-s3": "1.15.0",
+    "@aws-cdk/aws-sns": "1.15.0",
+    "@aws-cdk/aws-sns-subscriptions": "1.15.0",
+    "@aws-cdk/core": "1.15.0"
   },
   "engines": {
     "node": ">= 10.3.0"
   },
-  "stability": "stable"
+  "stability": "stable",
+  "awslint": {
+    "exclude": [
+      "docs-public-apis:@aws-cdk/aws-codepipeline-actions.CodeCommitSourceActionProps.output",
+      "docs-public-apis:@aws-cdk/aws-codepipeline-actions.Action.actionProperties",
+      "docs-public-apis:@aws-cdk/aws-codepipeline-actions.Action.onStateChange",
+      "docs-public-apis:@aws-cdk/aws-codepipeline-actions.BaseJenkinsProvider",
+      "docs-public-apis:@aws-cdk/aws-codepipeline-actions.BaseJenkinsProvider.providerName",
+      "docs-public-apis:@aws-cdk/aws-codepipeline-actions.BaseJenkinsProvider.serverUrl",
+      "docs-public-apis:@aws-cdk/aws-codepipeline-actions.BaseJenkinsProvider.version",
+      "docs-public-apis:@aws-cdk/aws-codepipeline-actions.CloudFormationCreateReplaceChangeSetAction.deploymentRole",
+      "docs-public-apis:@aws-cdk/aws-codepipeline-actions.CloudFormationCreateUpdateStackAction.deploymentRole",
+      "docs-public-apis:@aws-cdk/aws-codepipeline-actions.CloudFormationDeleteStackAction.deploymentRole",
+      "docs-public-apis:@aws-cdk/aws-codepipeline-actions.CodeDeployServerDeployAction",
+      "docs-public-apis:@aws-cdk/aws-codepipeline-actions.JenkinsProvider.providerName",
+      "docs-public-apis:@aws-cdk/aws-codepipeline-actions.JenkinsProvider.serverUrl",
+      "docs-public-apis:@aws-cdk/aws-codepipeline-actions.ManualApprovalAction.notificationTopic",
+      "props-default-doc:@aws-cdk/aws-codepipeline-actions.AlexaSkillDeployActionProps.parameterOverridesArtifact",
+      "props-default-doc:@aws-cdk/aws-codepipeline-actions.CloudFormationCreateReplaceChangeSetActionProps.extraInputs",
+      "props-default-doc:@aws-cdk/aws-codepipeline-actions.CloudFormationCreateUpdateStackActionProps.extraInputs",
+      "props-default-doc:@aws-cdk/aws-codepipeline-actions.CloudFormationDeleteStackActionProps.extraInputs",
+      "props-default-doc:@aws-cdk/aws-codepipeline-actions.CodeBuildActionProps.extraInputs",
+      "docs-public-apis:@aws-cdk/aws-codepipeline-actions.Action.bind",
+      "docs-public-apis:@aws-cdk/aws-codepipeline-actions.CodeCommitSourceActionProps.branch",
+      "docs-public-apis:@aws-cdk/aws-codepipeline-actions.EcrSourceActionProps.output",
+      "docs-public-apis:@aws-cdk/aws-codepipeline-actions.GitHubSourceActionProps.output",
+      "docs-public-apis:@aws-cdk/aws-codepipeline-actions.IJenkinsProvider.providerName",
+      "docs-public-apis:@aws-cdk/aws-codepipeline-actions.IJenkinsProvider.serverUrl",
+      "docs-public-apis:@aws-cdk/aws-codepipeline-actions.IJenkinsProvider.version",
+      "props-default-doc:@aws-cdk/aws-codepipeline-actions.JenkinsActionProps.inputs",
+      "docs-public-apis:@aws-cdk/aws-codepipeline-actions.JenkinsActionProps.outputs",
+      "props-default-doc:@aws-cdk/aws-codepipeline-actions.JenkinsActionProps.outputs",
+      "docs-public-apis:@aws-cdk/aws-codepipeline-actions.JenkinsProviderProps",
+      "props-default-doc:@aws-cdk/aws-codepipeline-actions.LambdaInvokeActionProps.userParameters",
+      "props-default-doc:@aws-cdk/aws-codepipeline-actions.ManualApprovalActionProps.additionalInformation",
+      "props-default-doc:@aws-cdk/aws-codepipeline-actions.ManualApprovalActionProps.notificationTopic",
+      "props-default-doc:@aws-cdk/aws-codepipeline-actions.ManualApprovalActionProps.notifyEmails",
+      "props-default-doc:@aws-cdk/aws-codepipeline-actions.S3DeployActionProps.objectKey",
+      "docs-public-apis:@aws-cdk/aws-codepipeline-actions.S3SourceActionProps.output",
+      "docs-public-apis:@aws-cdk/aws-codepipeline-actions.GitHubTrigger.NONE",
+      "docs-public-apis:@aws-cdk/aws-codepipeline-actions.GitHubTrigger.POLL",
+      "docs-public-apis:@aws-cdk/aws-codepipeline-actions.GitHubTrigger.WEBHOOK",
+      "docs-public-apis:@aws-cdk/aws-codepipeline-actions.CodeDeployEcsDeployAction",
+      "props-default-doc:@aws-cdk/aws-codepipeline-actions.CodeDeployEcsDeployActionProps.containerImageInputs"
+    ]
+  }
 }
diff --git a/packages/@aws-cdk/aws-codepipeline-actions/test/codebuild/test.codebuild-action.ts b/packages/@aws-cdk/aws-codepipeline-actions/test/codebuild/test.codebuild-action.ts
index 2e05c41e362b6..a9e38b4dc4561 100644
--- a/packages/@aws-cdk/aws-codepipeline-actions/test/codebuild/test.codebuild-action.ts
+++ b/packages/@aws-cdk/aws-codepipeline-actions/test/codebuild/test.codebuild-action.ts
@@ -1,6 +1,8 @@
+import { expect, haveResourceLike } from "@aws-cdk/assert";
 import codebuild = require('@aws-cdk/aws-codebuild');
 import codecommit = require('@aws-cdk/aws-codecommit');
 import codepipeline = require('@aws-cdk/aws-codepipeline');
+import s3 = require('@aws-cdk/aws-s3');
 import { App, Stack } from '@aws-cdk/core';
 import { Test } from 'nodeunit';
 import cpactions = require('../../lib');
@@ -8,59 +10,116 @@ import cpactions = require('../../lib');
 // tslint:disable:object-literal-key-quotes
 
 export = {
-  'a cross-account CodeBuild action with outputs': {
-    'causes an error'(test: Test) {
-      const app = new App();
+  'CodeBuild action': {
+    'that is cross-account and has outputs': {
+      'causes an error'(test: Test) {
+        const app = new App();
 
-      const projectStack = new Stack(app, 'ProjectStack', {
-        env: {
-          region: 'us-west-2',
-          account: '012345678912',
-        },
-      });
-      const project = new codebuild.PipelineProject(projectStack, 'Project');
+        const projectStack = new Stack(app, 'ProjectStack', {
+          env: {
+            region: 'us-west-2',
+            account: '012345678912',
+          },
+        });
+        const project = new codebuild.PipelineProject(projectStack, 'Project');
+
+        const pipelineStack = new Stack(app, 'PipelineStack', {
+          env: {
+            region: 'us-west-2',
+            account: '012345678913',
+          },
+        });
+        const sourceOutput = new codepipeline.Artifact();
+        const pipeline = new codepipeline.Pipeline(pipelineStack, 'Pipeline', {
+          stages: [
+            {
+              stageName: 'Source',
+              actions: [new cpactions.CodeCommitSourceAction({
+                actionName: 'CodeCommit',
+                repository: codecommit.Repository.fromRepositoryName(pipelineStack, 'Repo', 'repo-name'),
+                output: sourceOutput,
+              })],
+            },
+          ],
+        });
+        const buildStage = pipeline.addStage({
+          stageName: 'Build',
+        });
+
+        // this works fine - no outputs!
+        buildStage.addAction(new cpactions.CodeBuildAction({
+          actionName: 'Build1',
+          input: sourceOutput,
+          project,
+        }));
+
+        const buildAction2 = new cpactions.CodeBuildAction({
+          actionName: 'Build2',
+          input: sourceOutput,
+          project,
+          outputs: [new codepipeline.Artifact()],
+        });
+
+        test.throws(() => {
+          buildStage.addAction(buildAction2);
+        }, /https:\/\/github\.com\/aws\/aws-cdk\/issues\/4169/);
+
+        test.done();
+      },
+    },
+
+    'can be backed by an imported project'(test: Test) {
+      const stack = new Stack();
+
+      const codeBuildProject = codebuild.PipelineProject.fromProjectName(stack, 'CodeBuild',
+        'codeBuildProjectNameInAnotherAccount');
 
-      const pipelineStack = new Stack(app, 'PipelineStack', {
-        env: {
-          region: 'us-west-2',
-          account: '012345678913',
-        },
-      });
       const sourceOutput = new codepipeline.Artifact();
-      const pipeline = new codepipeline.Pipeline(pipelineStack, 'Pipeline', {
+      new codepipeline.Pipeline(stack, 'Pipeline', {
         stages: [
           {
             stageName: 'Source',
-            actions: [new cpactions.CodeCommitSourceAction({
-              actionName: 'CodeCommit',
-              repository: codecommit.Repository.fromRepositoryName(pipelineStack, 'Repo', 'repo-name'),
-              output: sourceOutput,
-            })],
+            actions: [
+              new cpactions.S3SourceAction({
+                actionName: 'S3_Source',
+                bucket: new s3.Bucket(stack, 'Bucket'),
+                bucketKey: 'key',
+                output: sourceOutput,
+              }),
+            ],
+          },
+          {
+            stageName: 'Build',
+            actions: [
+              new cpactions.CodeBuildAction({
+                actionName: 'CodeBuild',
+                input: sourceOutput,
+                project: codeBuildProject,
+              }),
+            ],
           },
         ],
       });
-      const buildStage = pipeline.addStage({
-        stageName: 'Build',
-      });
 
-      // this works fine - no outputs!
-      buildStage.addAction(new cpactions.CodeBuildAction({
-        actionName: 'Build1',
-        input: sourceOutput,
-        project,
+      expect(stack).to(haveResourceLike('AWS::CodePipeline::Pipeline', {
+        "Stages": [
+          {
+            "Name": "Source",
+          },
+          {
+            "Name": "Build",
+            "Actions": [
+              {
+                "Name": "CodeBuild",
+                "Configuration": {
+                  "ProjectName": "codeBuildProjectNameInAnotherAccount",
+                },
+              },
+            ],
+          },
+        ],
       }));
 
-      const buildAction2 = new cpactions.CodeBuildAction({
-        actionName: 'Build2',
-        input: sourceOutput,
-        project,
-        outputs: [new codepipeline.Artifact()],
-      });
-
-      test.throws(() => {
-        buildStage.addAction(buildAction2);
-      }, /https:\/\/github\.com\/aws\/aws-cdk\/issues\/4169/);
-
       test.done();
     },
   },
diff --git a/packages/@aws-cdk/aws-codepipeline-actions/test/codedeploy/test.ecs-deploy-action.ts b/packages/@aws-cdk/aws-codepipeline-actions/test/codedeploy/test.ecs-deploy-action.ts
new file mode 100644
index 0000000000000..f75197ec76711
--- /dev/null
+++ b/packages/@aws-cdk/aws-codepipeline-actions/test/codedeploy/test.ecs-deploy-action.ts
@@ -0,0 +1,243 @@
+import { expect, haveResourceLike } from "@aws-cdk/assert";
+import codedeploy = require('@aws-cdk/aws-codedeploy');
+import codepipeline = require('@aws-cdk/aws-codepipeline');
+import cdk = require('@aws-cdk/core');
+import { Test } from 'nodeunit';
+import cpactions = require('../../lib');
+
+export = {
+  'CodeDeploy ECS Deploy Action': {
+    'throws an exception if more than 4 container image inputs are provided'(test: Test) {
+      const stack = new cdk.Stack();
+      const deploymentGroup = addEcsDeploymentGroup(stack);
+      const artifact = new codepipeline.Artifact('Artifact');
+
+      const containerImageInputs: cpactions.CodeDeployEcsContainerImageInput[] = [];
+      for (let i = 0; i < 5; i++) {
+        containerImageInputs.push({
+          input: artifact
+        });
+      }
+
+      test.throws(() => {
+        new cpactions.CodeDeployEcsDeployAction({
+          actionName: 'DeployToECS',
+          deploymentGroup,
+          taskDefinitionTemplateInput: artifact,
+          appSpecTemplateInput: artifact,
+          containerImageInputs,
+        });
+      }, /Action cannot have more than 4 container image inputs, got: 5/);
+
+      test.done();
+    },
+
+    'throws an exception if both appspec artifact input and file are specified'(test: Test) {
+      const stack = new cdk.Stack();
+      const deploymentGroup = addEcsDeploymentGroup(stack);
+      const artifact = new codepipeline.Artifact('Artifact');
+      const artifactPath = new codepipeline.ArtifactPath(artifact, 'hello');
+
+      test.throws(() => {
+        new cpactions.CodeDeployEcsDeployAction({
+          actionName: 'DeployToECS',
+          deploymentGroup,
+          taskDefinitionTemplateInput: artifact,
+          appSpecTemplateInput: artifact,
+          appSpecTemplateFile: artifactPath,
+        });
+      }, /Exactly one of 'appSpecTemplateInput' or 'appSpecTemplateFile' can be provided in the ECS CodeDeploy Action/);
+
+      test.done();
+    },
+
+    'throws an exception if neither appspec artifact input nor file are specified'(test: Test) {
+      const stack = new cdk.Stack();
+      const deploymentGroup = addEcsDeploymentGroup(stack);
+      const artifact = new codepipeline.Artifact('Artifact');
+
+      test.throws(() => {
+        new cpactions.CodeDeployEcsDeployAction({
+          actionName: 'DeployToECS',
+          deploymentGroup,
+          taskDefinitionTemplateInput: artifact,
+        });
+      }, /Specifying one of 'appSpecTemplateInput' or 'appSpecTemplateFile' is required for the ECS CodeDeploy Action/);
+
+      test.done();
+    },
+
+    'throws an exception if both task definition artifact input and file are specified'(test: Test) {
+      const stack = new cdk.Stack();
+      const deploymentGroup = addEcsDeploymentGroup(stack);
+      const artifact = new codepipeline.Artifact('Artifact');
+      const artifactPath = new codepipeline.ArtifactPath(artifact, 'hello');
+
+      test.throws(() => {
+        new cpactions.CodeDeployEcsDeployAction({
+          actionName: 'DeployToECS',
+          deploymentGroup,
+          taskDefinitionTemplateInput: artifact,
+          taskDefinitionTemplateFile: artifactPath,
+          appSpecTemplateInput: artifact,
+        });
+      }, /Exactly one of 'taskDefinitionTemplateInput' or 'taskDefinitionTemplateFile' can be provided in the ECS CodeDeploy Action/);
+
+      test.done();
+    },
+
+    'throws an exception if neither task definition artifact input nor file are specified'(test: Test) {
+      const stack = new cdk.Stack();
+      const deploymentGroup = addEcsDeploymentGroup(stack);
+      const artifact = new codepipeline.Artifact('Artifact');
+
+      test.throws(() => {
+        new cpactions.CodeDeployEcsDeployAction({
+          actionName: 'DeployToECS',
+          deploymentGroup,
+          appSpecTemplateInput: artifact,
+        });
+      }, /Specifying one of 'taskDefinitionTemplateInput' or 'taskDefinitionTemplateFile' is required for the ECS CodeDeploy Action/);
+
+      test.done();
+    },
+
+    'defaults task definition and appspec template paths'(test: Test) {
+      const stack = new cdk.Stack();
+      const deploymentGroup = addEcsDeploymentGroup(stack);
+      addCodeDeployECSCodePipeline(stack, {
+        actionName: 'DeployToECS',
+        deploymentGroup,
+        taskDefinitionTemplateInput: new codepipeline.Artifact('TaskDefArtifact'),
+        appSpecTemplateInput: new codepipeline.Artifact('AppSpecArtifact')
+      });
+
+      expect(stack).to(haveResourceLike('AWS::CodePipeline::Pipeline', {
+        Stages: [
+          {},
+          {
+            Actions: [
+              {
+                Configuration: {
+                  ApplicationName: 'MyApplication',
+                  DeploymentGroupName: 'MyDeploymentGroup',
+                  TaskDefinitionTemplateArtifact: 'TaskDefArtifact',
+                  AppSpecTemplateArtifact: 'AppSpecArtifact',
+                  TaskDefinitionTemplatePath: 'taskdef.json',
+                  AppSpecTemplatePath: 'appspec.yaml'
+                },
+                InputArtifacts: [
+                  {
+                    Name: 'TaskDefArtifact'
+                  },
+                  {
+                    Name: 'AppSpecArtifact'
+                  }
+                ]
+              },
+            ],
+          },
+        ],
+      }));
+
+      test.done();
+    },
+
+    'defaults task definition placeholder string'(test: Test) {
+      const stack = new cdk.Stack();
+      const deploymentGroup = addEcsDeploymentGroup(stack);
+      const artifact1 = new codepipeline.Artifact('Artifact1');
+      const artifact2 = new codepipeline.Artifact('Artifact2');
+      addCodeDeployECSCodePipeline(stack, {
+        actionName: 'DeployToECS',
+        deploymentGroup,
+        taskDefinitionTemplateFile: new codepipeline.ArtifactPath(artifact1, 'task-definition.json'),
+        appSpecTemplateFile: new codepipeline.ArtifactPath(artifact2, 'appspec-test.yaml'),
+        containerImageInputs: [
+          {
+            input: artifact1
+          },
+          {
+            input: artifact2
+          }
+        ]
+      });
+
+      expect(stack).to(haveResourceLike('AWS::CodePipeline::Pipeline', {
+        Stages: [
+          {},
+          {
+            Actions: [
+              {
+                Configuration: {
+                  ApplicationName: 'MyApplication',
+                  DeploymentGroupName: 'MyDeploymentGroup',
+                  TaskDefinitionTemplateArtifact: 'Artifact1',
+                  AppSpecTemplateArtifact: 'Artifact2',
+                  TaskDefinitionTemplatePath: 'task-definition.json',
+                  AppSpecTemplatePath: 'appspec-test.yaml',
+                  Image1ArtifactName: 'Artifact1',
+                  Image1ContainerName: 'IMAGE',
+                  Image2ArtifactName: 'Artifact2',
+                  Image2ContainerName: 'IMAGE'
+                },
+                InputArtifacts: [
+                  {
+                    Name: 'Artifact1'
+                  },
+                  {
+                    Name: 'Artifact2'
+                  }
+                ]
+              },
+            ],
+          },
+        ],
+      }));
+
+      test.done();
+    },
+  },
+};
+
+function addEcsDeploymentGroup(stack: cdk.Stack): codedeploy.IEcsDeploymentGroup {
+  return codedeploy.EcsDeploymentGroup.fromEcsDeploymentGroupAttributes(
+    stack, 'EDG', {
+      application: codedeploy.EcsApplication.fromEcsApplicationName(
+        stack, 'EA', 'MyApplication'
+      ),
+      deploymentGroupName: 'MyDeploymentGroup'
+    });
+}
+
+function addCodeDeployECSCodePipeline(stack: cdk.Stack, props: cpactions.CodeDeployEcsDeployActionProps) {
+  new codepipeline.Pipeline(stack, 'Pipeline', {
+    stages: [
+      {
+        stageName: 'Source',
+        actions: [
+          new cpactions.GitHubSourceAction({
+            actionName: 'GitHub',
+            output: props.taskDefinitionTemplateInput || props.taskDefinitionTemplateFile!.artifact,
+            oauthToken: cdk.SecretValue.plainText('secret'),
+            owner: 'awslabs',
+            repo: 'aws-cdk',
+          }),
+          new cpactions.GitHubSourceAction({
+            actionName: 'GitHub2',
+            output: props.appSpecTemplateInput || props.appSpecTemplateFile!.artifact,
+            oauthToken: cdk.SecretValue.plainText('secret'),
+            owner: 'awslabs',
+            repo: 'aws-cdk-2',
+          }),
+        ],
+      },
+      {
+        stageName: 'Invoke',
+        actions: [
+          new cpactions.CodeDeployEcsDeployAction(props),
+        ],
+      },
+    ],
+  });
+}
\ No newline at end of file
diff --git a/packages/@aws-cdk/aws-codepipeline-actions/test/integ.lambda-deployed-through-codepipeline.lit.expected.json b/packages/@aws-cdk/aws-codepipeline-actions/test/integ.lambda-deployed-through-codepipeline.lit.expected.json
index 8840dc3631961..314d9b597afa4 100644
--- a/packages/@aws-cdk/aws-codepipeline-actions/test/integ.lambda-deployed-through-codepipeline.lit.expected.json
+++ b/packages/@aws-cdk/aws-codepipeline-actions/test/integ.lambda-deployed-through-codepipeline.lit.expected.json
@@ -1453,7 +1453,7 @@
       "Type": "AWS::CodeBuild::Project",
       "Properties": {
         "Artifacts": {
-          "Type": "CODEPIPELINE"
+          "Type": "NO_ARTIFACTS"
         },
         "EncryptionKey": {
           "Fn::GetAtt": [
@@ -1475,7 +1475,7 @@
         },
         "Source": {
           "BuildSpec": "{\n  \"version\": \"0.2\",\n  \"phases\": {\n    \"install\": {\n      \"commands\": \"npm install\"\n    },\n    \"build\": {\n      \"commands\": [\n        \"npm run build\",\n        \"npm run cdk synth LambdaStack -- -o .\"\n      ]\n    }\n  },\n  \"artifacts\": {\n    \"files\": \"LambdaStack.template.yaml\"\n  }\n}",
-          "Type": "CODEPIPELINE"
+          "Type": "NO_SOURCE"
         }
       }
     },
@@ -1637,7 +1637,7 @@
       "Type": "AWS::CodeBuild::Project",
       "Properties": {
         "Artifacts": {
-          "Type": "CODEPIPELINE"
+          "Type": "NO_ARTIFACTS"
         },
         "EncryptionKey": {
           "Fn::GetAtt": [
@@ -1659,7 +1659,7 @@
         },
         "Source": {
           "BuildSpec": "{\n  \"version\": \"0.2\",\n  \"phases\": {\n    \"install\": {\n      \"commands\": \"npm install\"\n    },\n    \"build\": {\n      \"commands\": \"npm run build\"\n    }\n  },\n  \"artifacts\": {\n    \"files\": [\n      \"index.js\",\n      \"node_modules/**/*\"\n    ]\n  }\n}",
-          "Type": "CODEPIPELINE"
+          "Type": "NO_SOURCE"
         }
       }
     }
diff --git a/packages/@aws-cdk/aws-codepipeline-actions/test/integ.lambda-deployed-through-codepipeline.lit.ts b/packages/@aws-cdk/aws-codepipeline-actions/test/integ.lambda-deployed-through-codepipeline.lit.ts
index edc553a169620..3ece4cfed6a89 100644
--- a/packages/@aws-cdk/aws-codepipeline-actions/test/integ.lambda-deployed-through-codepipeline.lit.ts
+++ b/packages/@aws-cdk/aws-codepipeline-actions/test/integ.lambda-deployed-through-codepipeline.lit.ts
@@ -47,7 +47,7 @@ pipeline.addStage({
 // synthesize the Lambda CDK template, using CodeBuild
 // the below values are just examples, assuming your CDK code is in TypeScript/JavaScript -
 // adjust the build environment and/or commands accordingly
-const cdkBuildProject = new codebuild.PipelineProject(pipelineStack, 'CdkBuildProject', {
+const cdkBuildProject = new codebuild.Project(pipelineStack, 'CdkBuildProject', {
   environment: {
     buildImage: codebuild.LinuxBuildImage.UBUNTU_14_04_NODEJS_10_1_0,
   },
@@ -80,7 +80,7 @@ const cdkBuildAction = new codepipeline_actions.CodeBuildAction({
 // build your Lambda code, using CodeBuild
 // again, this example assumes your Lambda is written in TypeScript/JavaScript -
 // make sure to adjust the build environment and/or commands if they don't match your specific situation
-const lambdaBuildProject = new codebuild.PipelineProject(pipelineStack, 'LambdaBuildProject', {
+const lambdaBuildProject = new codebuild.Project(pipelineStack, 'LambdaBuildProject', {
   environment: {
     buildImage: codebuild.LinuxBuildImage.UBUNTU_14_04_NODEJS_10_1_0,
   },
diff --git a/packages/@aws-cdk/aws-codepipeline-actions/test/integ.pipeline-code-commit-build.expected.json b/packages/@aws-cdk/aws-codepipeline-actions/test/integ.pipeline-code-commit-build.expected.json
index 0e844eaed2a35..f6d7ff99a57d0 100644
--- a/packages/@aws-cdk/aws-codepipeline-actions/test/integ.pipeline-code-commit-build.expected.json
+++ b/packages/@aws-cdk/aws-codepipeline-actions/test/integ.pipeline-code-commit-build.expected.json
@@ -578,7 +578,8 @@
                 "Configuration": {
                   "ProjectName": {
                     "Ref": "MyBuildProject30DB9D6E"
-                  }
+                  },
+                  "EnvironmentVariables": "[{\"name\":\"TEST_ENV_VARIABLE\",\"type\":\"PLAINTEXT\",\"value\":\"test env variable value\"},{\"name\":\"PARAM_STORE_VARIABLE\",\"type\":\"PARAMETER_STORE\",\"value\":\"param_store\"}]"
                 },
                 "InputArtifacts": [
                   {
diff --git a/packages/@aws-cdk/aws-codepipeline-actions/test/integ.pipeline-code-commit-build.ts b/packages/@aws-cdk/aws-codepipeline-actions/test/integ.pipeline-code-commit-build.ts
index fc1e812e4a976..0a02b4cc66e29 100644
--- a/packages/@aws-cdk/aws-codepipeline-actions/test/integ.pipeline-code-commit-build.ts
+++ b/packages/@aws-cdk/aws-codepipeline-actions/test/integ.pipeline-code-commit-build.ts
@@ -4,6 +4,8 @@ import codepipeline = require('@aws-cdk/aws-codepipeline');
 import cdk = require('@aws-cdk/core');
 import cpactions = require('../lib');
 
+// tslint:disable:object-literal-key-quotes
+
 const app = new cdk.App();
 
 const stack = new cdk.Stack(app, 'aws-cdk-codepipeline-codecommit-codebuild');
@@ -25,6 +27,15 @@ const buildAction = new cpactions.CodeBuildAction({
   project,
   input: sourceOutput,
   outputs: [new codepipeline.Artifact()],
+  environmentVariables: {
+    'TEST_ENV_VARIABLE': {
+      value: 'test env variable value',
+    },
+    'PARAM_STORE_VARIABLE': {
+      value: 'param_store',
+      type: codebuild.BuildEnvironmentVariableType.PARAMETER_STORE,
+    },
+  },
 });
 const testAction = new cpactions.CodeBuildAction({
   type: cpactions.CodeBuildActionType.TEST,
diff --git a/packages/@aws-cdk/aws-codepipeline-actions/test/integ.pipeline-code-deploy-ecs.expected.json b/packages/@aws-cdk/aws-codepipeline-actions/test/integ.pipeline-code-deploy-ecs.expected.json
new file mode 100644
index 0000000000000..c5ab6fac3ec74
--- /dev/null
+++ b/packages/@aws-cdk/aws-codepipeline-actions/test/integ.pipeline-code-deploy-ecs.expected.json
@@ -0,0 +1,473 @@
+{
+  "Resources": {
+    "CodeDeployPipelineIntegTest9F618D61": {
+      "Type": "AWS::S3::Bucket",
+      "Properties": {
+        "VersioningConfiguration": {
+          "Status": "Enabled"
+        }
+      },
+      "DeletionPolicy": "Delete",
+      "UpdateReplacePolicy": "Delete"
+    },
+    "PipelineRoleD68726F7": {
+      "Type": "AWS::IAM::Role",
+      "Properties": {
+        "AssumeRolePolicyDocument": {
+          "Statement": [
+            {
+              "Action": "sts:AssumeRole",
+              "Effect": "Allow",
+              "Principal": {
+                "Service": "codepipeline.amazonaws.com"
+              }
+            }
+          ],
+          "Version": "2012-10-17"
+        }
+      }
+    },
+    "PipelineRoleDefaultPolicyC7A05455": {
+      "Type": "AWS::IAM::Policy",
+      "Properties": {
+        "PolicyDocument": {
+          "Statement": [
+            {
+              "Action": [
+                "s3:GetObject*",
+                "s3:GetBucket*",
+                "s3:List*",
+                "s3:DeleteObject*",
+                "s3:PutObject*",
+                "s3:Abort*"
+              ],
+              "Effect": "Allow",
+              "Resource": [
+                {
+                  "Fn::GetAtt": [
+                    "CodeDeployPipelineIntegTest9F618D61",
+                    "Arn"
+                  ]
+                },
+                {
+                  "Fn::Join": [
+                    "",
+                    [
+                      {
+                        "Fn::GetAtt": [
+                          "CodeDeployPipelineIntegTest9F618D61",
+                          "Arn"
+                        ]
+                      },
+                      "/*"
+                    ]
+                  ]
+                }
+              ]
+            },
+            {
+              "Action": "sts:AssumeRole",
+              "Effect": "Allow",
+              "Resource": {
+                "Fn::GetAtt": [
+                  "PipelineSourceS3SourceCodePipelineActionRole8DE11A40",
+                  "Arn"
+                ]
+              }
+            },
+            {
+              "Action": "sts:AssumeRole",
+              "Effect": "Allow",
+              "Resource": {
+                "Fn::GetAtt": [
+                  "PipelineDeployCodeDeployCodePipelineActionRoleFA7F8EEF",
+                  "Arn"
+                ]
+              }
+            }
+          ],
+          "Version": "2012-10-17"
+        },
+        "PolicyName": "PipelineRoleDefaultPolicyC7A05455",
+        "Roles": [
+          {
+            "Ref": "PipelineRoleD68726F7"
+          }
+        ]
+      }
+    },
+    "PipelineC660917D": {
+      "Type": "AWS::CodePipeline::Pipeline",
+      "Properties": {
+        "RoleArn": {
+          "Fn::GetAtt": [
+            "PipelineRoleD68726F7",
+            "Arn"
+          ]
+        },
+        "Stages": [
+          {
+            "Actions": [
+              {
+                "ActionTypeId": {
+                  "Category": "Source",
+                  "Owner": "AWS",
+                  "Provider": "S3",
+                  "Version": "1"
+                },
+                "Configuration": {
+                  "S3Bucket": {
+                    "Ref": "CodeDeployPipelineIntegTest9F618D61"
+                  },
+                  "S3ObjectKey": "application.zip"
+                },
+                "Name": "S3Source",
+                "OutputArtifacts": [
+                  {
+                    "Name": "SourceOutput"
+                  }
+                ],
+                "RoleArn": {
+                  "Fn::GetAtt": [
+                    "PipelineSourceS3SourceCodePipelineActionRole8DE11A40",
+                    "Arn"
+                  ]
+                },
+                "RunOrder": 1
+              }
+            ],
+            "Name": "Source"
+          },
+          {
+            "Actions": [
+              {
+                "ActionTypeId": {
+                  "Category": "Deploy",
+                  "Owner": "AWS",
+                  "Provider": "CodeDeployToECS",
+                  "Version": "1"
+                },
+                "Configuration": {
+                  "ApplicationName": "IntegTestDeployApp",
+                  "DeploymentGroupName": "IntegTestDeploymentGroup",
+                  "TaskDefinitionTemplateArtifact": "SourceOutput",
+                  "AppSpecTemplateArtifact": "SourceOutput",
+                  "AppSpecTemplatePath": "appspec-test.json",
+                  "TaskDefinitionTemplatePath": "task-definition-test.json",
+                  "Image1ArtifactName": "SourceOutput",
+                  "Image1ContainerName": "PLACEHOLDER"
+                },
+                "InputArtifacts": [
+                  {
+                    "Name": "SourceOutput"
+                  }
+                ],
+                "Name": "CodeDeploy",
+                "RoleArn": {
+                  "Fn::GetAtt": [
+                    "PipelineDeployCodeDeployCodePipelineActionRoleFA7F8EEF",
+                    "Arn"
+                  ]
+                },
+                "RunOrder": 1
+              }
+            ],
+            "Name": "Deploy"
+          }
+        ],
+        "ArtifactStore": {
+          "Location": {
+            "Ref": "CodeDeployPipelineIntegTest9F618D61"
+          },
+          "Type": "S3"
+        }
+      },
+      "DependsOn": [
+        "PipelineRoleDefaultPolicyC7A05455",
+        "PipelineRoleD68726F7"
+      ]
+    },
+    "PipelineSourceS3SourceCodePipelineActionRole8DE11A40": {
+      "Type": "AWS::IAM::Role",
+      "Properties": {
+        "AssumeRolePolicyDocument": {
+          "Statement": [
+            {
+              "Action": "sts:AssumeRole",
+              "Effect": "Allow",
+              "Principal": {
+                "AWS": {
+                  "Fn::Join": [
+                    "",
+                    [
+                      "arn:",
+                      {
+                        "Ref": "AWS::Partition"
+                      },
+                      ":iam::",
+                      {
+                        "Ref": "AWS::AccountId"
+                      },
+                      ":root"
+                    ]
+                  ]
+                }
+              }
+            }
+          ],
+          "Version": "2012-10-17"
+        }
+      }
+    },
+    "PipelineSourceS3SourceCodePipelineActionRoleDefaultPolicy352A3912": {
+      "Type": "AWS::IAM::Policy",
+      "Properties": {
+        "PolicyDocument": {
+          "Statement": [
+            {
+              "Action": [
+                "s3:GetObject*",
+                "s3:GetBucket*",
+                "s3:List*"
+              ],
+              "Effect": "Allow",
+              "Resource": [
+                {
+                  "Fn::GetAtt": [
+                    "CodeDeployPipelineIntegTest9F618D61",
+                    "Arn"
+                  ]
+                },
+                {
+                  "Fn::Join": [
+                    "",
+                    [
+                      {
+                        "Fn::GetAtt": [
+                          "CodeDeployPipelineIntegTest9F618D61",
+                          "Arn"
+                        ]
+                      },
+                      "/*"
+                    ]
+                  ]
+                }
+              ]
+            },
+            {
+              "Action": [
+                "s3:DeleteObject*",
+                "s3:PutObject*",
+                "s3:Abort*"
+              ],
+              "Effect": "Allow",
+              "Resource": [
+                {
+                  "Fn::GetAtt": [
+                    "CodeDeployPipelineIntegTest9F618D61",
+                    "Arn"
+                  ]
+                },
+                {
+                  "Fn::Join": [
+                    "",
+                    [
+                      {
+                        "Fn::GetAtt": [
+                          "CodeDeployPipelineIntegTest9F618D61",
+                          "Arn"
+                        ]
+                      },
+                      "/*"
+                    ]
+                  ]
+                }
+              ]
+            }
+          ],
+          "Version": "2012-10-17"
+        },
+        "PolicyName": "PipelineSourceS3SourceCodePipelineActionRoleDefaultPolicy352A3912",
+        "Roles": [
+          {
+            "Ref": "PipelineSourceS3SourceCodePipelineActionRole8DE11A40"
+          }
+        ]
+      }
+    },
+    "PipelineDeployCodeDeployCodePipelineActionRoleFA7F8EEF": {
+      "Type": "AWS::IAM::Role",
+      "Properties": {
+        "AssumeRolePolicyDocument": {
+          "Statement": [
+            {
+              "Action": "sts:AssumeRole",
+              "Effect": "Allow",
+              "Principal": {
+                "AWS": {
+                  "Fn::Join": [
+                    "",
+                    [
+                      "arn:",
+                      {
+                        "Ref": "AWS::Partition"
+                      },
+                      ":iam::",
+                      {
+                        "Ref": "AWS::AccountId"
+                      },
+                      ":root"
+                    ]
+                  ]
+                }
+              }
+            }
+          ],
+          "Version": "2012-10-17"
+        }
+      }
+    },
+    "PipelineDeployCodeDeployCodePipelineActionRoleDefaultPolicy7B34E673": {
+      "Type": "AWS::IAM::Policy",
+      "Properties": {
+        "PolicyDocument": {
+          "Statement": [
+            {
+              "Action": [
+                "codedeploy:GetApplication",
+                "codedeploy:GetApplicationRevision",
+                "codedeploy:RegisterApplicationRevision"
+              ],
+              "Effect": "Allow",
+              "Resource": {
+                "Fn::Join": [
+                  "",
+                  [
+                    "arn:",
+                    {
+                      "Ref": "AWS::Partition"
+                    },
+                    ":codedeploy:",
+                    {
+                      "Ref": "AWS::Region"
+                    },
+                    ":",
+                    {
+                      "Ref": "AWS::AccountId"
+                    },
+                    ":application:IntegTestDeployApp"
+                  ]
+                ]
+              }
+            },
+            {
+              "Action": [
+                "codedeploy:CreateDeployment",
+                "codedeploy:GetDeployment"
+              ],
+              "Effect": "Allow",
+              "Resource": {
+                "Fn::Join": [
+                  "",
+                  [
+                    "arn:",
+                    {
+                      "Ref": "AWS::Partition"
+                    },
+                    ":codedeploy:",
+                    {
+                      "Ref": "AWS::Region"
+                    },
+                    ":",
+                    {
+                      "Ref": "AWS::AccountId"
+                    },
+                    ":deploymentgroup:IntegTestDeployApp/IntegTestDeploymentGroup"
+                  ]
+                ]
+              }
+            },
+            {
+              "Action": "codedeploy:GetDeploymentConfig",
+              "Effect": "Allow",
+              "Resource": {
+                "Fn::Join": [
+                  "",
+                  [
+                    "arn:",
+                    {
+                      "Ref": "AWS::Partition"
+                    },
+                    ":codedeploy:",
+                    {
+                      "Ref": "AWS::Region"
+                    },
+                    ":",
+                    {
+                      "Ref": "AWS::AccountId"
+                    },
+                    ":deploymentconfig:CodeDeployDefault.ECSAllAtOnce"
+                  ]
+                ]
+              }
+            },
+            {
+              "Action": "ecs:RegisterTaskDefinition",
+              "Effect": "Allow",
+              "Resource": "*"
+            },
+            {
+              "Action": "iam:PassRole",
+              "Condition": {
+                "StringEqualsIfExists": {
+                  "iam:PassedToService": [
+                    "ecs-tasks.amazonaws.com"
+                  ]
+               }
+              },
+              "Effect": "Allow",
+              "Resource": "*"
+            },
+            {
+              "Action": [
+                "s3:GetObject*",
+                "s3:GetBucket*",
+                "s3:List*"
+              ],
+              "Effect": "Allow",
+              "Resource": [
+                {
+                  "Fn::GetAtt": [
+                    "CodeDeployPipelineIntegTest9F618D61",
+                    "Arn"
+                  ]
+                },
+                {
+                  "Fn::Join": [
+                    "",
+                    [
+                      {
+                        "Fn::GetAtt": [
+                          "CodeDeployPipelineIntegTest9F618D61",
+                          "Arn"
+                        ]
+                      },
+                      "/*"
+                    ]
+                  ]
+                }
+              ]
+            }
+          ],
+          "Version": "2012-10-17"
+        },
+        "PolicyName": "PipelineDeployCodeDeployCodePipelineActionRoleDefaultPolicy7B34E673",
+        "Roles": [
+          {
+            "Ref": "PipelineDeployCodeDeployCodePipelineActionRoleFA7F8EEF"
+          }
+        ]
+      }
+    }
+  }
+}
diff --git a/packages/@aws-cdk/aws-codepipeline-actions/test/integ.pipeline-code-deploy-ecs.ts b/packages/@aws-cdk/aws-codepipeline-actions/test/integ.pipeline-code-deploy-ecs.ts
new file mode 100644
index 0000000000000..798d31ea85c06
--- /dev/null
+++ b/packages/@aws-cdk/aws-codepipeline-actions/test/integ.pipeline-code-deploy-ecs.ts
@@ -0,0 +1,51 @@
+import codedeploy = require('@aws-cdk/aws-codedeploy');
+import codepipeline = require('@aws-cdk/aws-codepipeline');
+import s3 = require('@aws-cdk/aws-s3');
+import cdk = require('@aws-cdk/core');
+import cpactions = require('../lib');
+
+const app = new cdk.App();
+
+const stack = new cdk.Stack(app, 'aws-cdk-codepipeline-codedeploy-ecs');
+
+const application = codedeploy.EcsApplication.fromEcsApplicationName(stack, 'CodeDeployApplication', 'IntegTestDeployApp');
+
+const deploymentGroup = codedeploy.EcsDeploymentGroup.fromEcsDeploymentGroupAttributes(stack, 'CodeDeployGroup', {
+  application,
+  deploymentGroupName: 'IntegTestDeploymentGroup'
+});
+
+const bucket = new s3.Bucket(stack, 'CodeDeployPipelineIntegTest', {
+  versioned: true,
+  removalPolicy: cdk.RemovalPolicy.DESTROY,
+});
+
+const pipeline = new codepipeline.Pipeline(stack, 'Pipeline', {
+  artifactBucket: bucket,
+});
+
+const sourceStage = pipeline.addStage({ stageName: 'Source' });
+const sourceOutput = new codepipeline.Artifact('SourceOutput');
+const sourceAction = new cpactions.S3SourceAction({
+  actionName: 'S3Source',
+  bucketKey: 'application.zip',
+  output: sourceOutput,
+  bucket,
+});
+sourceStage.addAction(sourceAction);
+
+const deployStage = pipeline.addStage({ stageName: 'Deploy' });
+deployStage.addAction(new cpactions.CodeDeployEcsDeployAction({
+  actionName: 'CodeDeploy',
+  deploymentGroup,
+  taskDefinitionTemplateFile: new codepipeline.ArtifactPath(sourceOutput, 'task-definition-test.json'),
+  appSpecTemplateFile: new codepipeline.ArtifactPath(sourceOutput, 'appspec-test.json'),
+  containerImageInputs: [
+    {
+      input: sourceOutput,
+      taskDefinitionPlaceholder: 'PLACEHOLDER'
+    }
+  ]
+}));
+
+app.synth();
diff --git a/packages/@aws-cdk/aws-codepipeline/package.json b/packages/@aws-cdk/aws-codepipeline/package.json
index 9a9e8222f83dc..7a4bf0a194180 100644
--- a/packages/@aws-cdk/aws-codepipeline/package.json
+++ b/packages/@aws-cdk/aws-codepipeline/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@aws-cdk/aws-codepipeline",
-  "version": "1.13.1",
+  "version": "1.15.0",
   "description": "Better interface to AWS Code Pipeline",
   "main": "lib/index.js",
   "types": "lib/index.d.ts",
@@ -70,26 +70,26 @@
   },
   "license": "Apache-2.0",
   "devDependencies": {
-    "@aws-cdk/assert": "1.13.1",
-    "cdk-build-tools": "^1.13.1",
-    "cdk-integ-tools": "^1.13.1",
-    "cfn2ts": "^1.13.1",
-    "pkglint": "^1.13.1"
+    "@aws-cdk/assert": "1.15.0",
+    "cdk-build-tools": "^1.15.0",
+    "cdk-integ-tools": "^1.15.0",
+    "cfn2ts": "^1.15.0",
+    "pkglint": "^1.15.0"
   },
   "dependencies": {
-    "@aws-cdk/aws-events": "1.13.1",
-    "@aws-cdk/aws-iam": "1.13.1",
-    "@aws-cdk/aws-kms": "1.13.1",
-    "@aws-cdk/aws-s3": "1.13.1",
-    "@aws-cdk/core": "1.13.1"
+    "@aws-cdk/aws-events": "1.15.0",
+    "@aws-cdk/aws-iam": "1.15.0",
+    "@aws-cdk/aws-kms": "1.15.0",
+    "@aws-cdk/aws-s3": "1.15.0",
+    "@aws-cdk/core": "1.15.0"
   },
   "homepage": "https://github.com/aws/aws-cdk",
   "peerDependencies": {
-    "@aws-cdk/aws-events": "1.13.1",
-    "@aws-cdk/aws-iam": "1.13.1",
-    "@aws-cdk/aws-kms": "1.13.1",
-    "@aws-cdk/aws-s3": "1.13.1",
-    "@aws-cdk/core": "1.13.1"
+    "@aws-cdk/aws-events": "1.15.0",
+    "@aws-cdk/aws-iam": "1.15.0",
+    "@aws-cdk/aws-kms": "1.15.0",
+    "@aws-cdk/aws-s3": "1.15.0",
+    "@aws-cdk/core": "1.15.0"
   },
   "engines": {
     "node": ">= 10.3.0"
@@ -103,7 +103,60 @@
       "no-unused-type:@aws-cdk/aws-codepipeline.CommonActionProps",
       "no-unused-type:@aws-cdk/aws-codepipeline.CommonAwsActionProps",
       "resource-attribute:@aws-cdk/aws-codepipeline.IPipeline.pipelineVersion",
-      "from-method:@aws-cdk/aws-codepipeline.Pipeline"
+      "from-method:@aws-cdk/aws-codepipeline.Pipeline",
+      "docs-public-apis:@aws-cdk/aws-codepipeline.ActionProperties.owner",
+      "docs-public-apis:@aws-cdk/aws-codepipeline.ActionCategory.INVOKE",
+      "docs-public-apis:@aws-cdk/aws-codepipeline.ActionCategory.DEPLOY",
+      "docs-public-apis:@aws-cdk/aws-codepipeline.ActionCategory.APPROVAL",
+      "docs-public-apis:@aws-cdk/aws-codepipeline.ActionCategory.TEST",
+      "docs-public-apis:@aws-cdk/aws-codepipeline.Artifact.artifactName",
+      "docs-public-apis:@aws-cdk/aws-codepipeline.Artifact.toString",
+      "docs-public-apis:@aws-cdk/aws-codepipeline.ArtifactPath.artifact",
+      "docs-public-apis:@aws-cdk/aws-codepipeline.ArtifactPath.fileName",
+      "docs-public-apis:@aws-cdk/aws-codepipeline.ArtifactPath.location",
+      "docs-public-apis:@aws-cdk/aws-codepipeline.ArtifactPath.artifactPath",
+      "docs-public-apis:@aws-cdk/aws-codepipeline.ActionArtifactBounds.maxInputs",
+      "docs-public-apis:@aws-cdk/aws-codepipeline.ActionArtifactBounds.maxOutputs",
+      "docs-public-apis:@aws-cdk/aws-codepipeline.ActionArtifactBounds.minInputs",
+      "docs-public-apis:@aws-cdk/aws-codepipeline.ActionArtifactBounds.minOutputs",
+      "docs-public-apis:@aws-cdk/aws-codepipeline.ActionBindOptions",
+      "docs-public-apis:@aws-cdk/aws-codepipeline.ActionBindOptions.bucket",
+      "docs-public-apis:@aws-cdk/aws-codepipeline.ActionBindOptions.role",
+      "docs-public-apis:@aws-cdk/aws-codepipeline.ActionConfig",
+      "docs-public-apis:@aws-cdk/aws-codepipeline.ActionConfig.configuration",
+      "props-default-doc:@aws-cdk/aws-codepipeline.ActionConfig.configuration",
+      "docs-public-apis:@aws-cdk/aws-codepipeline.ActionProperties",
+      "docs-public-apis:@aws-cdk/aws-codepipeline.ActionProperties.actionName",
+      "docs-public-apis:@aws-cdk/aws-codepipeline.ActionProperties.artifactBounds",
+      "props-default-doc:@aws-cdk/aws-codepipeline.ActionProperties.account",
+      "docs-public-apis:@aws-cdk/aws-codepipeline.ActionProperties.inputs",
+      "props-default-doc:@aws-cdk/aws-codepipeline.ActionProperties.inputs",
+      "docs-public-apis:@aws-cdk/aws-codepipeline.ActionProperties.outputs",
+      "props-default-doc:@aws-cdk/aws-codepipeline.ActionProperties.outputs",
+      "docs-public-apis:@aws-cdk/aws-codepipeline.ActionCategory.BUILD",
+      "props-default-doc:@aws-cdk/aws-codepipeline.ActionProperties.owner",
+      "props-default-doc:@aws-cdk/aws-codepipeline.ActionProperties.resource",
+      "docs-public-apis:@aws-cdk/aws-codepipeline.ActionProperties.role",
+      "props-default-doc:@aws-cdk/aws-codepipeline.ActionProperties.role",
+      "props-default-doc:@aws-cdk/aws-codepipeline.ActionProperties.runOrder",
+      "docs-public-apis:@aws-cdk/aws-codepipeline.ActionProperties.version",
+      "props-default-doc:@aws-cdk/aws-codepipeline.ActionProperties.version",
+      "docs-public-apis:@aws-cdk/aws-codepipeline.IAction",
+      "docs-public-apis:@aws-cdk/aws-codepipeline.IAction.actionProperties",
+      "docs-public-apis:@aws-cdk/aws-codepipeline.IAction.bind",
+      "docs-public-apis:@aws-cdk/aws-codepipeline.IAction.onStateChange",
+      "docs-public-apis:@aws-cdk/aws-codepipeline.IStage.pipeline",
+      "docs-public-apis:@aws-cdk/aws-codepipeline.IStage.addAction",
+      "docs-public-apis:@aws-cdk/aws-codepipeline.IStage.onStateChange",
+      "docs-public-apis:@aws-cdk/aws-codepipeline.PipelineProps",
+      "docs-public-apis:@aws-cdk/aws-codepipeline.StageOptions",
+      "docs-public-apis:@aws-cdk/aws-codepipeline.StageOptions.placement",
+      "props-default-doc:@aws-cdk/aws-codepipeline.StageOptions.placement",
+      "props-default-doc:@aws-cdk/aws-codepipeline.StagePlacement.justAfter",
+      "props-default-doc:@aws-cdk/aws-codepipeline.StagePlacement.rightBefore",
+      "props-default-doc:@aws-cdk/aws-codepipeline.StageProps.actions",
+      "docs-public-apis:@aws-cdk/aws-codepipeline.ActionCategory",
+      "docs-public-apis:@aws-cdk/aws-codepipeline.ActionCategory.SOURCE"
     ]
   },
   "stability": "stable"
diff --git a/packages/@aws-cdk/aws-codestar/package.json b/packages/@aws-cdk/aws-codestar/package.json
index 977457f5ff202..cfb6a30b797ea 100644
--- a/packages/@aws-cdk/aws-codestar/package.json
+++ b/packages/@aws-cdk/aws-codestar/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@aws-cdk/aws-codestar",
-  "version": "1.13.1",
+  "version": "1.15.0",
   "description": "The CDK Construct Library for AWS::CodeStar",
   "main": "lib/index.js",
   "types": "lib/index.d.ts",
@@ -65,16 +65,16 @@
   },
   "license": "Apache-2.0",
   "devDependencies": {
-    "@aws-cdk/assert": "1.13.1",
-    "cdk-build-tools": "^1.13.1",
-    "cfn2ts": "1.13.1",
-    "pkglint": "^1.13.1"
+    "@aws-cdk/assert": "1.15.0",
+    "cdk-build-tools": "^1.15.0",
+    "cfn2ts": "1.15.0",
+    "pkglint": "^1.15.0"
   },
   "dependencies": {
-    "@aws-cdk/core": "1.13.1"
+    "@aws-cdk/core": "1.15.0"
   },
   "peerDependencies": {
-    "@aws-cdk/core": "1.13.1"
+    "@aws-cdk/core": "1.15.0"
   },
   "engines": {
     "node": ">= 10.3.0"
diff --git a/packages/@aws-cdk/aws-cognito/package.json b/packages/@aws-cdk/aws-cognito/package.json
index e861ed282ca9b..fbd9d400d995f 100644
--- a/packages/@aws-cdk/aws-cognito/package.json
+++ b/packages/@aws-cdk/aws-cognito/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@aws-cdk/aws-cognito",
-  "version": "1.13.1",
+  "version": "1.15.0",
   "description": "The CDK Construct Library for AWS::Cognito",
   "main": "lib/index.js",
   "types": "lib/index.d.ts",
@@ -63,21 +63,21 @@
   },
   "license": "Apache-2.0",
   "devDependencies": {
-    "@aws-cdk/assert": "1.13.1",
-    "cdk-build-tools": "^1.13.1",
-    "cfn2ts": "^1.13.1",
-    "pkglint": "^1.13.1"
+    "@aws-cdk/assert": "1.15.0",
+    "cdk-build-tools": "^1.15.0",
+    "cfn2ts": "^1.15.0",
+    "pkglint": "^1.15.0"
   },
   "dependencies": {
-    "@aws-cdk/aws-iam": "1.13.1",
-    "@aws-cdk/aws-lambda": "1.13.1",
-    "@aws-cdk/core": "1.13.1"
+    "@aws-cdk/aws-iam": "1.15.0",
+    "@aws-cdk/aws-lambda": "1.15.0",
+    "@aws-cdk/core": "1.15.0"
   },
   "homepage": "https://github.com/aws/aws-cdk",
   "peerDependencies": {
-    "@aws-cdk/aws-iam": "1.13.1",
-    "@aws-cdk/aws-lambda": "1.13.1",
-    "@aws-cdk/core": "1.13.1"
+    "@aws-cdk/aws-iam": "1.15.0",
+    "@aws-cdk/aws-lambda": "1.15.0",
+    "@aws-cdk/core": "1.15.0"
   },
   "engines": {
     "node": ">= 10.3.0"
@@ -85,7 +85,25 @@
   "awslint": {
     "exclude": [
       "from-method:@aws-cdk/aws-cognito.UserPool",
-      "from-arn:UserPool.fromUserPoolArn"
+      "from-arn:UserPool.fromUserPoolArn",
+      "docs-public-apis:@aws-cdk/aws-cognito.IUserPool",
+      "props-default-doc:@aws-cdk/aws-cognito.UserPoolTriggers.verifyAuthChallengeResponse",
+      "props-default-doc:@aws-cdk/aws-cognito.UserPoolTriggers.userMigration",
+      "props-default-doc:@aws-cdk/aws-cognito.UserPoolTriggers.preTokenGeneration",
+      "props-default-doc:@aws-cdk/aws-cognito.UserPoolTriggers.preSignUp",
+      "props-default-doc:@aws-cdk/aws-cognito.UserPoolTriggers.preAuthentication",
+      "props-default-doc:@aws-cdk/aws-cognito.UserPoolTriggers.postConfirmation",
+      "props-default-doc:@aws-cdk/aws-cognito.UserPoolTriggers.postAuthentication",
+      "props-default-doc:@aws-cdk/aws-cognito.UserPoolTriggers.defineAuthChallenge",
+      "props-default-doc:@aws-cdk/aws-cognito.UserPoolTriggers.customMessage",
+      "props-default-doc:@aws-cdk/aws-cognito.UserPoolTriggers.createAuthChallenge",
+      "docs-public-apis:@aws-cdk/aws-cognito.UserPoolTriggers",
+      "docs-public-apis:@aws-cdk/aws-cognito.UserPoolClient.userPoolClientClientSecret",
+      "docs-public-apis:@aws-cdk/aws-cognito.UserPoolClient.userPoolClientId",
+      "docs-public-apis:@aws-cdk/aws-cognito.UserPoolClient.userPoolClientName",
+      "docs-public-apis:@aws-cdk/aws-cognito.UserPoolProps",
+      "docs-public-apis:@aws-cdk/aws-cognito.UserPoolAttributes",
+      "docs-public-apis:@aws-cdk/aws-cognito.UserPoolClientProps"
     ]
   },
   "stability": "experimental"
diff --git a/packages/@aws-cdk/aws-config/package.json b/packages/@aws-cdk/aws-config/package.json
index 77677f0d05709..e9be0f78aa3ff 100644
--- a/packages/@aws-cdk/aws-config/package.json
+++ b/packages/@aws-cdk/aws-config/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@aws-cdk/aws-config",
-  "version": "1.13.1",
+  "version": "1.15.0",
   "description": "The CDK Construct Library for AWS::Config",
   "main": "lib/index.js",
   "types": "lib/index.d.ts",
@@ -63,30 +63,39 @@
   },
   "license": "Apache-2.0",
   "devDependencies": {
-    "@aws-cdk/assert": "1.13.1",
-    "@aws-cdk/aws-events-targets": "1.13.1",
-    "cdk-build-tools": "^1.13.1",
-    "cdk-integ-tools": "^1.13.1",
-    "cfn2ts": "^1.13.1",
-    "pkglint": "^1.13.1"
+    "@aws-cdk/assert": "1.15.0",
+    "@aws-cdk/aws-events-targets": "1.15.0",
+    "cdk-build-tools": "^1.15.0",
+    "cdk-integ-tools": "^1.15.0",
+    "cfn2ts": "^1.15.0",
+    "pkglint": "^1.15.0"
   },
   "dependencies": {
-    "@aws-cdk/aws-events": "1.13.1",
-    "@aws-cdk/aws-iam": "1.13.1",
-    "@aws-cdk/aws-lambda": "1.13.1",
-    "@aws-cdk/aws-sns": "1.13.1",
-    "@aws-cdk/core": "1.13.1"
+    "@aws-cdk/aws-events": "1.15.0",
+    "@aws-cdk/aws-iam": "1.15.0",
+    "@aws-cdk/aws-lambda": "1.15.0",
+    "@aws-cdk/aws-sns": "1.15.0",
+    "@aws-cdk/core": "1.15.0"
   },
   "homepage": "https://github.com/aws/aws-cdk",
   "peerDependencies": {
-    "@aws-cdk/aws-events": "1.13.1",
-    "@aws-cdk/aws-iam": "1.13.1",
-    "@aws-cdk/aws-lambda": "1.13.1",
-    "@aws-cdk/aws-sns": "1.13.1",
-    "@aws-cdk/core": "1.13.1"
+    "@aws-cdk/aws-events": "1.15.0",
+    "@aws-cdk/aws-iam": "1.15.0",
+    "@aws-cdk/aws-lambda": "1.15.0",
+    "@aws-cdk/aws-sns": "1.15.0",
+    "@aws-cdk/core": "1.15.0"
   },
   "engines": {
     "node": ">= 10.3.0"
   },
-  "stability": "experimental"
+  "stability": "experimental",
+  "awslint": {
+    "exclude": [
+      "docs-public-apis:@aws-cdk/aws-config.MaximumExecutionFrequency.TWENTY_FOUR_HOURS",
+      "docs-public-apis:@aws-cdk/aws-config.MaximumExecutionFrequency.ONE_HOUR",
+      "docs-public-apis:@aws-cdk/aws-config.MaximumExecutionFrequency.THREE_HOURS",
+      "docs-public-apis:@aws-cdk/aws-config.MaximumExecutionFrequency.SIX_HOURS",
+      "docs-public-apis:@aws-cdk/aws-config.MaximumExecutionFrequency.TWELVE_HOURS"
+    ]
+  }
 }
diff --git a/packages/@aws-cdk/aws-datapipeline/package.json b/packages/@aws-cdk/aws-datapipeline/package.json
index 463b573419e5a..366431acf66f0 100644
--- a/packages/@aws-cdk/aws-datapipeline/package.json
+++ b/packages/@aws-cdk/aws-datapipeline/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@aws-cdk/aws-datapipeline",
-  "version": "1.13.1",
+  "version": "1.15.0",
   "description": "The CDK Construct Library for AWS::DataPipeline",
   "main": "lib/index.js",
   "types": "lib/index.d.ts",
@@ -63,17 +63,17 @@
   },
   "license": "Apache-2.0",
   "devDependencies": {
-    "@aws-cdk/assert": "1.13.1",
-    "cdk-build-tools": "^1.13.1",
-    "cfn2ts": "^1.13.1",
-    "pkglint": "^1.13.1"
+    "@aws-cdk/assert": "1.15.0",
+    "cdk-build-tools": "^1.15.0",
+    "cfn2ts": "^1.15.0",
+    "pkglint": "^1.15.0"
   },
   "dependencies": {
-    "@aws-cdk/core": "1.13.1"
+    "@aws-cdk/core": "1.15.0"
   },
   "homepage": "https://github.com/aws/aws-cdk",
   "peerDependencies": {
-    "@aws-cdk/core": "1.13.1"
+    "@aws-cdk/core": "1.15.0"
   },
   "engines": {
     "node": ">= 10.3.0"
diff --git a/packages/@aws-cdk/aws-dax/package.json b/packages/@aws-cdk/aws-dax/package.json
index 06f77e67ceb6b..e9f4008ed4b11 100644
--- a/packages/@aws-cdk/aws-dax/package.json
+++ b/packages/@aws-cdk/aws-dax/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@aws-cdk/aws-dax",
-  "version": "1.13.1",
+  "version": "1.15.0",
   "description": "The CDK Construct Library for AWS::DAX",
   "main": "lib/index.js",
   "types": "lib/index.d.ts",
@@ -63,17 +63,17 @@
   },
   "license": "Apache-2.0",
   "devDependencies": {
-    "@aws-cdk/assert": "1.13.1",
-    "cdk-build-tools": "^1.13.1",
-    "cfn2ts": "^1.13.1",
-    "pkglint": "^1.13.1"
+    "@aws-cdk/assert": "1.15.0",
+    "cdk-build-tools": "^1.15.0",
+    "cfn2ts": "^1.15.0",
+    "pkglint": "^1.15.0"
   },
   "dependencies": {
-    "@aws-cdk/core": "1.13.1"
+    "@aws-cdk/core": "1.15.0"
   },
   "homepage": "https://github.com/aws/aws-cdk",
   "peerDependencies": {
-    "@aws-cdk/core": "1.13.1"
+    "@aws-cdk/core": "1.15.0"
   },
   "engines": {
     "node": ">= 10.3.0"
diff --git a/packages/@aws-cdk/aws-directoryservice/package.json b/packages/@aws-cdk/aws-directoryservice/package.json
index 1f59ec282f135..9a405aaf8595e 100644
--- a/packages/@aws-cdk/aws-directoryservice/package.json
+++ b/packages/@aws-cdk/aws-directoryservice/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@aws-cdk/aws-directoryservice",
-  "version": "1.13.1",
+  "version": "1.15.0",
   "description": "The CDK Construct Library for AWS::DirectoryService",
   "main": "lib/index.js",
   "types": "lib/index.d.ts",
@@ -63,17 +63,17 @@
   },
   "license": "Apache-2.0",
   "devDependencies": {
-    "@aws-cdk/assert": "1.13.1",
-    "cdk-build-tools": "^1.13.1",
-    "cfn2ts": "^1.13.1",
-    "pkglint": "^1.13.1"
+    "@aws-cdk/assert": "1.15.0",
+    "cdk-build-tools": "^1.15.0",
+    "cfn2ts": "^1.15.0",
+    "pkglint": "^1.15.0"
   },
   "dependencies": {
-    "@aws-cdk/core": "1.13.1"
+    "@aws-cdk/core": "1.15.0"
   },
   "homepage": "https://github.com/aws/aws-cdk",
   "peerDependencies": {
-    "@aws-cdk/core": "1.13.1"
+    "@aws-cdk/core": "1.15.0"
   },
   "engines": {
     "node": ">= 10.3.0"
diff --git a/packages/@aws-cdk/aws-dlm/package.json b/packages/@aws-cdk/aws-dlm/package.json
index d335a2f6c95b7..3eaa7e5d1908f 100644
--- a/packages/@aws-cdk/aws-dlm/package.json
+++ b/packages/@aws-cdk/aws-dlm/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@aws-cdk/aws-dlm",
-  "version": "1.13.1",
+  "version": "1.15.0",
   "description": "The CDK Construct Library for AWS::DLM",
   "main": "lib/index.js",
   "types": "lib/index.d.ts",
@@ -64,16 +64,16 @@
   },
   "license": "Apache-2.0",
   "devDependencies": {
-    "@aws-cdk/assert": "1.13.1",
-    "cdk-build-tools": "^1.13.1",
-    "cfn2ts": "^1.13.1",
-    "pkglint": "^1.13.1"
+    "@aws-cdk/assert": "1.15.0",
+    "cdk-build-tools": "^1.15.0",
+    "cfn2ts": "^1.15.0",
+    "pkglint": "^1.15.0"
   },
   "dependencies": {
-    "@aws-cdk/core": "1.13.1"
+    "@aws-cdk/core": "1.15.0"
   },
   "peerDependencies": {
-    "@aws-cdk/core": "1.13.1"
+    "@aws-cdk/core": "1.15.0"
   },
   "engines": {
     "node": ">= 10.3.0"
diff --git a/packages/@aws-cdk/aws-dms/package.json b/packages/@aws-cdk/aws-dms/package.json
index de70b75a21ba0..623256d36cca5 100644
--- a/packages/@aws-cdk/aws-dms/package.json
+++ b/packages/@aws-cdk/aws-dms/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@aws-cdk/aws-dms",
-  "version": "1.13.1",
+  "version": "1.15.0",
   "description": "The CDK Construct Library for AWS::DMS",
   "main": "lib/index.js",
   "types": "lib/index.d.ts",
@@ -63,17 +63,17 @@
   },
   "license": "Apache-2.0",
   "devDependencies": {
-    "@aws-cdk/assert": "1.13.1",
-    "cdk-build-tools": "^1.13.1",
-    "cfn2ts": "^1.13.1",
-    "pkglint": "^1.13.1"
+    "@aws-cdk/assert": "1.15.0",
+    "cdk-build-tools": "^1.15.0",
+    "cfn2ts": "^1.15.0",
+    "pkglint": "^1.15.0"
   },
   "dependencies": {
-    "@aws-cdk/core": "1.13.1"
+    "@aws-cdk/core": "1.15.0"
   },
   "homepage": "https://github.com/aws/aws-cdk",
   "peerDependencies": {
-    "@aws-cdk/core": "1.13.1"
+    "@aws-cdk/core": "1.15.0"
   },
   "engines": {
     "node": ">= 10.3.0"
diff --git a/packages/@aws-cdk/aws-docdb/package.json b/packages/@aws-cdk/aws-docdb/package.json
index 17400c730de4e..5aaf8e1bfcb6a 100644
--- a/packages/@aws-cdk/aws-docdb/package.json
+++ b/packages/@aws-cdk/aws-docdb/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@aws-cdk/aws-docdb",
-  "version": "1.13.1",
+  "version": "1.15.0",
   "description": "The CDK Construct Library for AWS::DocDB",
   "main": "lib/index.js",
   "types": "lib/index.d.ts",
@@ -65,16 +65,16 @@
   },
   "license": "Apache-2.0",
   "devDependencies": {
-    "@aws-cdk/assert": "1.13.1",
-    "cdk-build-tools": "^1.13.1",
-    "cfn2ts": "^1.13.1",
-    "pkglint": "^1.13.1"
+    "@aws-cdk/assert": "1.15.0",
+    "cdk-build-tools": "^1.15.0",
+    "cfn2ts": "^1.15.0",
+    "pkglint": "^1.15.0"
   },
   "dependencies": {
-    "@aws-cdk/core": "1.13.1"
+    "@aws-cdk/core": "1.15.0"
   },
   "peerDependencies": {
-    "@aws-cdk/core": "1.13.1"
+    "@aws-cdk/core": "1.15.0"
   },
   "engines": {
     "node": ">= 10.3.0"
diff --git a/packages/@aws-cdk/aws-dynamodb-global/lambda-packages/aws-global-table-coordinator/package.json b/packages/@aws-cdk/aws-dynamodb-global/lambda-packages/aws-global-table-coordinator/package.json
index 88a3d6ada5e8d..efd8db6be6603 100644
--- a/packages/@aws-cdk/aws-dynamodb-global/lambda-packages/aws-global-table-coordinator/package.json
+++ b/packages/@aws-cdk/aws-dynamodb-global/lambda-packages/aws-global-table-coordinator/package.json
@@ -1,7 +1,7 @@
 {
   "name": "aws-global-lambda-coordinator",
   "private": true,
-  "version": "1.13.1",
+  "version": "1.15.0",
   "description": "This module is part of the [AWS Cloud Development Kit](https://github.com/aws/aws-cdk) project.",
   "main": "lib/handler.js",
   "directories": {
diff --git a/packages/@aws-cdk/aws-dynamodb-global/package.json b/packages/@aws-cdk/aws-dynamodb-global/package.json
index 2e0caf66c8788..6c0911e1c42d6 100644
--- a/packages/@aws-cdk/aws-dynamodb-global/package.json
+++ b/packages/@aws-cdk/aws-dynamodb-global/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@aws-cdk/aws-dynamodb-global",
-  "version": "1.13.1",
+  "version": "1.15.0",
   "description": "Build a global dynamodb table",
   "license": "Apache-2.0",
   "homepage": "https://github.com/aws/aws-cdk",
@@ -47,25 +47,25 @@
     "global"
   ],
   "dependencies": {
-    "@aws-cdk/aws-cloudformation": "1.13.1",
-    "@aws-cdk/aws-dynamodb": "1.13.1",
-    "@aws-cdk/aws-iam": "1.13.1",
-    "@aws-cdk/aws-lambda": "1.13.1",
-    "@aws-cdk/core": "1.13.1"
+    "@aws-cdk/aws-cloudformation": "1.15.0",
+    "@aws-cdk/aws-dynamodb": "1.15.0",
+    "@aws-cdk/aws-iam": "1.15.0",
+    "@aws-cdk/aws-lambda": "1.15.0",
+    "@aws-cdk/core": "1.15.0"
   },
   "devDependencies": {
-    "@aws-cdk/assert": "1.13.1",
-    "cdk-build-tools": "^1.13.1",
-    "cdk-integ-tools": "^1.13.1",
-    "cfn2ts": "^1.13.1",
-    "pkglint": "^1.13.1"
+    "@aws-cdk/assert": "1.15.0",
+    "cdk-build-tools": "^1.15.0",
+    "cdk-integ-tools": "^1.15.0",
+    "cfn2ts": "^1.15.0",
+    "pkglint": "^1.15.0"
   },
   "peerDependencies": {
-    "@aws-cdk/aws-cloudformation": "1.13.1",
-    "@aws-cdk/aws-dynamodb": "1.13.1",
-    "@aws-cdk/aws-iam": "1.13.1",
-    "@aws-cdk/aws-lambda": "1.13.1",
-    "@aws-cdk/core": "1.13.1"
+    "@aws-cdk/aws-cloudformation": "1.15.0",
+    "@aws-cdk/aws-dynamodb": "1.15.0",
+    "@aws-cdk/aws-iam": "1.15.0",
+    "@aws-cdk/aws-lambda": "1.15.0",
+    "@aws-cdk/core": "1.15.0"
   },
   "scripts": {
     "build": "cdk-build",
diff --git a/packages/@aws-cdk/aws-dynamodb/package.json b/packages/@aws-cdk/aws-dynamodb/package.json
index 7b043f401c2c0..c117ada03fb10 100644
--- a/packages/@aws-cdk/aws-dynamodb/package.json
+++ b/packages/@aws-cdk/aws-dynamodb/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@aws-cdk/aws-dynamodb",
-  "version": "1.13.1",
+  "version": "1.15.0",
   "description": "CDK Constructs for AWS DynamoDB",
   "main": "lib/index.js",
   "types": "lib/index.d.ts",
@@ -63,25 +63,46 @@
   },
   "license": "Apache-2.0",
   "devDependencies": {
-    "@aws-cdk/assert": "1.13.1",
-    "cdk-build-tools": "^1.13.1",
-    "cdk-integ-tools": "^1.13.1",
-    "cfn2ts": "^1.13.1",
-    "pkglint": "^1.13.1"
+    "@aws-cdk/assert": "1.15.0",
+    "cdk-build-tools": "^1.15.0",
+    "cdk-integ-tools": "^1.15.0",
+    "cfn2ts": "^1.15.0",
+    "pkglint": "^1.15.0"
   },
   "dependencies": {
-    "@aws-cdk/aws-applicationautoscaling": "1.13.1",
-    "@aws-cdk/aws-iam": "1.13.1",
-    "@aws-cdk/core": "1.13.1"
+    "@aws-cdk/aws-applicationautoscaling": "1.15.0",
+    "@aws-cdk/aws-iam": "1.15.0",
+    "@aws-cdk/core": "1.15.0"
   },
   "homepage": "https://github.com/aws/aws-cdk",
   "peerDependencies": {
-    "@aws-cdk/aws-applicationautoscaling": "1.13.1",
-    "@aws-cdk/aws-iam": "1.13.1",
-    "@aws-cdk/core": "1.13.1"
+    "@aws-cdk/aws-applicationautoscaling": "1.15.0",
+    "@aws-cdk/aws-iam": "1.15.0",
+    "@aws-cdk/core": "1.15.0"
   },
   "engines": {
     "node": ">= 10.3.0"
   },
-  "stability": "stable"
+  "stability": "stable",
+  "awslint": {
+    "exclude": [
+      "docs-public-apis:@aws-cdk/aws-dynamodb.TableProps",
+      "docs-public-apis:@aws-cdk/aws-dynamodb.ProjectionType.ALL",
+      "docs-public-apis:@aws-cdk/aws-dynamodb.Table.tableName",
+      "docs-public-apis:@aws-cdk/aws-dynamodb.Table.tableStreamArn",
+      "docs-public-apis:@aws-cdk/aws-dynamodb.Attribute",
+      "docs-public-apis:@aws-cdk/aws-dynamodb.GlobalSecondaryIndexProps",
+      "docs-public-apis:@aws-cdk/aws-dynamodb.LocalSecondaryIndexProps",
+      "docs-public-apis:@aws-cdk/aws-dynamodb.SecondaryIndexProps",
+      "docs-public-apis:@aws-cdk/aws-dynamodb.TableOptions",
+      "docs-public-apis:@aws-cdk/aws-dynamodb.Table.tableArn",
+      "docs-public-apis:@aws-cdk/aws-dynamodb.AttributeType",
+      "docs-public-apis:@aws-cdk/aws-dynamodb.AttributeType.BINARY",
+      "docs-public-apis:@aws-cdk/aws-dynamodb.AttributeType.NUMBER",
+      "docs-public-apis:@aws-cdk/aws-dynamodb.AttributeType.STRING",
+      "docs-public-apis:@aws-cdk/aws-dynamodb.ProjectionType",
+      "docs-public-apis:@aws-cdk/aws-dynamodb.ProjectionType.KEYS_ONLY",
+      "docs-public-apis:@aws-cdk/aws-dynamodb.ProjectionType.INCLUDE"
+    ]
+  }
 }
diff --git a/packages/@aws-cdk/aws-ec2/lib/security-group.ts b/packages/@aws-cdk/aws-ec2/lib/security-group.ts
index 903823e02acc5..de2e26e399ea2 100644
--- a/packages/@aws-cdk/aws-ec2/lib/security-group.ts
+++ b/packages/@aws-cdk/aws-ec2/lib/security-group.ts
@@ -230,6 +230,17 @@ export interface SecurityGroupImportOptions {
    * @default true
    */
   readonly allowAllOutbound?: boolean;
+
+  /**
+   * If a SecurityGroup is mutable CDK can add rules to existing groups
+   *
+   * Beware that making a SecurityGroup immutable might lead to issue
+   * due to missing ingress/egress rules for new resources.
+   *
+   * @experimental
+   * @default true
+   */
+  readonly mutable?: boolean;
 }
 
 /**
@@ -245,7 +256,7 @@ export class SecurityGroup extends SecurityGroupBase {
    * Import an existing security group into this app.
    */
   public static fromSecurityGroupId(scope: Construct, id: string, securityGroupId: string, options: SecurityGroupImportOptions = {}): ISecurityGroup {
-    class Import extends SecurityGroupBase {
+    class MutableImport extends SecurityGroupBase {
       public securityGroupId = securityGroupId;
 
       public addEgressRule(peer: IPeer, connection: Port, description?: string, remoteRule?: boolean) {
@@ -256,7 +267,21 @@ export class SecurityGroup extends SecurityGroupBase {
       }
     }
 
-    return new Import(scope, id);
+    class ImmutableImport extends SecurityGroupBase {
+      public securityGroupId = securityGroupId;
+
+      public addEgressRule(_peer: IPeer, _connection: Port, _description?: string, _remoteRule?: boolean) {
+        // do nothing
+      }
+
+      public addIngressRule(_peer: IPeer, _connection: Port, _description?: string, _remoteRule?: boolean)  {
+        // do nothing
+      }
+    }
+
+    return options.mutable !== false
+    ? new MutableImport(scope, id)
+    : new ImmutableImport(scope, id);
   }
 
   /**
diff --git a/packages/@aws-cdk/aws-ec2/lib/vpc.ts b/packages/@aws-cdk/aws-ec2/lib/vpc.ts
index 5443554c4cea2..1a809380d38ab 100644
--- a/packages/@aws-cdk/aws-ec2/lib/vpc.ts
+++ b/packages/@aws-cdk/aws-ec2/lib/vpc.ts
@@ -118,10 +118,10 @@ export interface IVpc extends IResource {
  */
 export enum SubnetType {
   /**
-   * Isolated Subnets do not route Outbound traffic
+   * Isolated Subnets do not route traffic to the Internet (in this VPC).
    *
-   * This can be good for subnets with RDS or
-   * Elasticache endpoints
+   * This can be good for subnets with RDS or Elasticache instances,
+   * or which route Internet traffic through a peer VPC.
    */
   ISOLATED = 'Isolated',
 
@@ -129,13 +129,12 @@ export enum SubnetType {
    * Subnet that routes to the internet, but not vice versa.
    *
    * Instances in a private subnet can connect to the Internet, but will not
-   * allow connections to be initiated from the Internet.
+   * allow connections to be initiated from the Internet. Internet traffic will
+   * be routed via a NAT Gateway.
    *
-   * Outbound traffic will be routed via a NAT Gateway. Preference being in
-   * the same AZ, but if not available will use another AZ (control by
-   * specifing `maxGateways` on Vpc). This might be used for
-   * experimental cost conscious accounts or accounts where HA outbound
-   * traffic is not needed.
+   * Normally a Private subnet will use a NAT gateway in the same AZ, but
+   * if `natGateways` is used to reduce the number of NAT gateways, a NAT
+   * gateway from another AZ will be used instead.
    */
   PRIVATE = 'Private',
 
@@ -166,7 +165,7 @@ export interface SubnetSelection {
    *
    * At most one of `subnetType` and `subnetGroupName` can be supplied.
    *
-   * @default SubnetType.PRIVATE
+   * @default SubnetType.PRIVATE (or ISOLATED or PUBLIC if there are no PRIVATE subnets)
    */
   readonly subnetType?: SubnetType;
 
@@ -205,6 +204,19 @@ export interface SubnetSelection {
    * @default false
    */
   readonly onePerAz?: boolean;
+
+  /**
+   * Explicitly select individual subnets
+   *
+   * Use this if you don't want to automatically use all subnets in
+   * a group, but have a need to control selection down to
+   * individual subnets.
+   *
+   * Cannot be specified together with `subnetType` or `subnetGroupName`.
+   *
+   * @default - Use all subnets in a selected group (all private subnets by default)
+   */
+  readonly subnets?: ISubnet[]
 }
 
 /**
@@ -337,9 +349,12 @@ abstract class VpcBase extends Resource implements IVpc {
    * Return the subnets appropriate for the placement strategy
    */
   protected selectSubnetObjects(selection: SubnetSelection = {}): ISubnet[] {
-    selection = reifySelectionDefaults(selection);
+    selection = this.reifySelectionDefaults(selection);
+
+    if (selection.subnets !== undefined) {
+      return selection.subnets;
 
-    if (selection.subnetGroupName !== undefined) { // Select by name
+    } else if (selection.subnetGroupName !== undefined) { // Select by name
       return this.selectSubnetObjectsByName(selection.subnetGroupName);
 
     } else {
@@ -384,6 +399,36 @@ abstract class VpcBase extends Resource implements IVpc {
 
     return subnets;
   }
+
+  /**
+   * Validate the fields in a SubnetSelection object, and reify defaults if necessary
+   *
+   * In case of default selection, select the first type of PRIVATE, ISOLATED,
+   * PUBLIC (in that order) that has any subnets.
+   */
+  private reifySelectionDefaults(placement: SubnetSelection): SubnetSelection {
+    if (placement.subnetName !== undefined) {
+      if (placement.subnetGroupName !== undefined) {
+        throw new Error(`Please use only 'subnetGroupName' ('subnetName' is deprecated and has the same behavior)`);
+      }
+      placement = {...placement, subnetGroupName: placement.subnetName };
+    }
+
+    const exclusiveSelections: Array<keyof SubnetSelection> = ['subnets', 'subnetType', 'subnetGroupName'];
+    const providedSelections = exclusiveSelections.filter(key => placement[key] !== undefined);
+    if (providedSelections.length > 1) {
+      throw new Error(`Only one of '${providedSelections}' can be supplied to subnet selection.`);
+    }
+
+    if (placement.subnetType === undefined && placement.subnetGroupName === undefined && placement.subnets === undefined) {
+      // Return default subnet type based on subnets that actually exist
+      if (this.privateSubnets.length > 0) { return { subnetType: SubnetType.PRIVATE, onePerAz: placement.onePerAz }; }
+      if (this.isolatedSubnets.length > 0) { return { subnetType: SubnetType.ISOLATED, onePerAz: placement.onePerAz }; }
+      return { subnetType: SubnetType.PUBLIC, onePerAz: placement.onePerAz };
+    }
+
+    return placement;
+  }
 }
 
 /**
@@ -563,8 +608,9 @@ export interface VpcProps {
   /**
    * The number of NAT Gateways to create.
    *
-   * For example, if set this to 1 and your subnet configuration is for 3 Public subnets then only
-   * one of the Public subnets will have a gateway and all Private subnets will route to this NAT Gateway.
+   * You can set this number lower than the number of Availability Zones in your
+   * VPC in order to save on NAT gateway cost. Be aware you may be charged for
+   * cross-AZ data traffic instead.
    *
    * @default - One NAT gateway per Availability Zone
    */
@@ -952,7 +998,11 @@ export class Vpc extends VpcBase {
     this.vpcId = this.resource.ref;
 
     this.subnetConfiguration = ifUndefined(props.subnetConfiguration, Vpc.DEFAULT_SUBNETS);
-    // subnetConfiguration and natGateways must be set before calling createSubnets
+
+    const natGatewayPlacement = props.natGatewaySubnets || { subnetType: SubnetType.PUBLIC };
+    const natGatewayCount = determineNatGatewayCount(props.natGateways, this.subnetConfiguration, this.availabilityZones.length);
+
+    // subnetConfiguration must be set before calling createSubnets
     this.createSubnets();
 
     const allowOutbound = this.subnetConfiguration.filter(
@@ -973,17 +1023,19 @@ export class Vpc extends VpcBase {
       });
 
       // if gateways are needed create them
-      this.createNatGateways(props.natGateways, props.natGatewaySubnets);
-
-      (this.privateSubnets as PrivateSubnet[]).forEach((privateSubnet, i) => {
-        let ngwId = this.natGatewayByAZ[privateSubnet.availabilityZone];
-        if (ngwId === undefined) {
-          const ngwArray = Array.from(Object.values(this.natGatewayByAZ));
-          // round robin the available NatGW since one is not in your AZ
-          ngwId = ngwArray[i % ngwArray.length];
-        }
-        privateSubnet.addDefaultNatRoute(ngwId);
-      });
+      if (natGatewayCount > 0) {
+        this.createNatGateways(natGatewayCount, natGatewayPlacement);
+
+        (this.privateSubnets as PrivateSubnet[]).forEach((privateSubnet, i) => {
+          let ngwId = this.natGatewayByAZ[privateSubnet.availabilityZone];
+          if (ngwId === undefined) {
+            const ngwArray = Array.from(Object.values(this.natGatewayByAZ));
+            // round robin the available NatGW since one is not in your AZ
+            ngwId = ngwArray[i % ngwArray.length];
+          }
+          privateSubnet.addDefaultNatRoute(ngwId);
+        });
+      }
     }
 
     if ((props.vpnConnections || props.vpnGatewayAsn) && props.vpnGateway === false) {
@@ -1059,24 +1111,12 @@ export class Vpc extends VpcBase {
     });
   }
 
-  private createNatGateways(gateways?: number, placement?: SubnetSelection): void {
-    const useNatGateway = this.subnetConfiguration.filter(
-      subnet => (subnet.subnetType === SubnetType.PRIVATE)).length > 0;
-
-    const natCount = ifUndefined(gateways,
-      useNatGateway ? this.availabilityZones.length : 0);
-
-    let natSubnets: PublicSubnet[];
-    if (placement) {
-      const subnets = this.selectSubnetObjects(placement);
-      for (const sub of subnets) {
-        if (this.publicSubnets.indexOf(sub) === -1) {
-          throw new Error(`natGatewayPlacement ${placement} contains non public subnet ${sub}`);
-        }
+  private createNatGateways(natCount: number, placement: SubnetSelection): void {
+    let natSubnets: PublicSubnet[] = this.selectSubnetObjects(placement) as PublicSubnet[];
+    for (const sub of natSubnets) {
+      if (this.publicSubnets.indexOf(sub) === -1) {
+        throw new Error(`natGatewayPlacement ${placement} contains non public subnet ${sub}`);
       }
-      natSubnets = subnets as PublicSubnet[];
-    } else {
-      natSubnets =  this.publicSubnets as PublicSubnet[];
     }
 
     natSubnets = natSubnets.slice(0, natCount);
@@ -1446,31 +1486,6 @@ class ImportedVpc extends VpcBase {
   }
 }
 
-/**
- * If the placement strategy is completely "default", reify the defaults so
- * consuming code doesn't have to reimplement the same analysis every time.
- *
- * Returns "private subnets" by default.
- */
-function reifySelectionDefaults(placement: SubnetSelection): SubnetSelection {
-  if (placement.subnetName !== undefined) {
-    if (placement.subnetGroupName !== undefined) {
-      throw new Error(`Please use only 'subnetGroupName' ('subnetName' is deprecated and has the same behavior)`);
-    }
-    placement = {...placement, subnetGroupName: placement.subnetName };
-  }
-
-  if (placement.subnetType !== undefined && placement.subnetGroupName !== undefined) {
-    throw new Error(`Only one of 'subnetType' and 'subnetGroupName' can be supplied`);
-  }
-
-  if (placement.subnetType === undefined && placement.subnetGroupName === undefined) {
-    return { subnetType: SubnetType.PRIVATE, onePerAz: placement.onePerAz };
-  }
-
-  return placement;
-}
-
 class CompositeDependable implements IDependable {
   private readonly dependables = new Array<IDependable>();
 
@@ -1538,6 +1553,36 @@ class ImportedSubnet extends Resource implements ISubnet, IPublicSubnet, IPrivat
   }
 }
 
+/**
+ * Determine (and validate) the NAT gateway count w.r.t. the rest of the subnet configuration
+ *
+ * We have the following requirements:
+ *
+ * - NatGatewayCount = 0 ==> there are no private subnets
+ * - NatGatewayCount > 0 ==> there must be public subnets
+ *
+ * Do we want to require that there are private subnets if there are NatGateways?
+ * They seem pointless but I see no reason to prevent it.
+ */
+function determineNatGatewayCount(requestedCount: number | undefined, subnetConfig: SubnetConfiguration[], azCount: number) {
+  const hasPrivateSubnets = subnetConfig.some(c => c.subnetType === SubnetType.PRIVATE);
+  const hasPublicSubnets = subnetConfig.some(c => c.subnetType === SubnetType.PUBLIC);
+
+  const count = requestedCount !== undefined ? Math.min(requestedCount, azCount) : (hasPrivateSubnets ? azCount : 0);
+
+  if (count === 0 && hasPrivateSubnets) {
+    // tslint:disable-next-line:max-line-length
+    throw new Error(`If you do not want NAT gateways (natGateways=0), make sure you don't configure any PRIVATE subnets in 'subnetConfiguration' (make them PUBLIC or ISOLATED instead)`);
+  }
+
+  if (count > 0 && !hasPublicSubnets) {
+    // tslint:disable-next-line:max-line-length
+    throw new Error(`If you configure PRIVATE subnets in 'subnetConfiguration', you must also configure PUBLIC subnets to put the NAT gateways into (got ${JSON.stringify(subnetConfig)}.`);
+  }
+
+  return count;
+}
+
 /**
  * There are returned when the provider has not supplied props yet
  *
diff --git a/packages/@aws-cdk/aws-ec2/package.json b/packages/@aws-cdk/aws-ec2/package.json
index 01fd9bc049862..2425fa6d5a88f 100644
--- a/packages/@aws-cdk/aws-ec2/package.json
+++ b/packages/@aws-cdk/aws-ec2/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@aws-cdk/aws-ec2",
-  "version": "1.13.1",
+  "version": "1.15.0",
   "description": "CDK Constructs for AWS EC2",
   "main": "lib/index.js",
   "types": "lib/index.d.ts",
@@ -63,26 +63,26 @@
   },
   "license": "Apache-2.0",
   "devDependencies": {
-    "@aws-cdk/assert": "1.13.1",
-    "cdk-build-tools": "^1.13.1",
-    "cdk-integ-tools": "^1.13.1",
-    "cfn2ts": "^1.13.1",
-    "pkglint": "^1.13.1"
+    "@aws-cdk/assert": "1.15.0",
+    "cdk-build-tools": "^1.15.0",
+    "cdk-integ-tools": "^1.15.0",
+    "cfn2ts": "^1.15.0",
+    "pkglint": "^1.15.0"
   },
   "dependencies": {
-    "@aws-cdk/aws-cloudwatch": "1.13.1",
-    "@aws-cdk/aws-iam": "1.13.1",
-    "@aws-cdk/aws-ssm": "1.13.1",
-    "@aws-cdk/core": "1.13.1",
-    "@aws-cdk/cx-api": "1.13.1"
+    "@aws-cdk/aws-cloudwatch": "1.15.0",
+    "@aws-cdk/aws-iam": "1.15.0",
+    "@aws-cdk/aws-ssm": "1.15.0",
+    "@aws-cdk/core": "1.15.0",
+    "@aws-cdk/cx-api": "1.15.0"
   },
   "homepage": "https://github.com/aws/aws-cdk",
   "peerDependencies": {
-    "@aws-cdk/aws-cloudwatch": "1.13.1",
-    "@aws-cdk/aws-iam": "1.13.1",
-    "@aws-cdk/aws-ssm": "1.13.1",
-    "@aws-cdk/core": "1.13.1",
-    "@aws-cdk/cx-api": "1.13.1"
+    "@aws-cdk/aws-cloudwatch": "1.15.0",
+    "@aws-cdk/aws-iam": "1.15.0",
+    "@aws-cdk/aws-ssm": "1.15.0",
+    "@aws-cdk/core": "1.15.0",
+    "@aws-cdk/cx-api": "1.15.0"
   },
   "engines": {
     "node": ">= 10.3.0"
@@ -103,7 +103,360 @@
       "props-physical-name:@aws-cdk/aws-ec2.InterfaceVpcEndpointProps",
       "from-method:@aws-cdk/aws-ec2.Instance",
       "attribute-tag:@aws-cdk/aws-ec2.Instance.instance",
-      "from-signature:@aws-cdk/aws-ec2.SecurityGroup.fromSecurityGroupId"
+      "from-signature:@aws-cdk/aws-ec2.SecurityGroup.fromSecurityGroupId",
+      "docs-public-apis:@aws-cdk/aws-ec2.WindowsVersion.WINDOWS_SERVER_2016_ENGLISH_DEEP_LEARNING",
+      "docs-public-apis:@aws-cdk/aws-ec2.WindowsVersion.WINDOWS_SERVER_2016_ENGLISH_FULL_SQL_2017_EXPRESS",
+      "docs-public-apis:@aws-cdk/aws-ec2.WindowsVersion.WINDOWS_SERVER_2016_ENGLISH_FULL_SQL_2016_SP2_WEB",
+      "docs-public-apis:@aws-cdk/aws-ec2.WindowsVersion.WINDOWS_SERVER_2016_CHINESE_TRADITIONAL_FULL_BASE",
+      "docs-public-apis:@aws-cdk/aws-ec2.WindowsVersion.WINDOWS_SERVER_2012_RTM_RUSSIAN_64BIT_BASE",
+      "docs-public-apis:@aws-cdk/aws-ec2.WindowsVersion.WINDOWS_SERVER_2012_RTM_KOREAN_64BIT_BASE",
+      "docs-public-apis:@aws-cdk/aws-ec2.WindowsVersion.WINDOWS_SERVER_2012_R2_RTM_ENGLISH_64BIT_HYPERV",
+      "docs-public-apis:@aws-cdk/aws-ec2.WindowsVersion.WINDOWS_SERVER_2019_SWEDISH_FULL_BASE",
+      "docs-public-apis:@aws-cdk/aws-ec2.WindowsVersion.WINDOWS_SERVER_2019_PORTUGESE_PORTUGAL_FULL_BASE",
+      "docs-public-apis:@aws-cdk/aws-ec2.WindowsVersion.WINDOWS_SERVER_2016_JAPANESE_FULL_SQL_2016_SP2_STANDARD",
+      "docs-public-apis:@aws-cdk/aws-ec2.WindowsVersion.WINDOWS_SERVER_2016_ENGLISH_CORE_SQL_2016_SP2_STANDARD",
+      "docs-public-apis:@aws-cdk/aws-ec2.WindowsVersion.WINDOWS_SERVER_2012_RTM_JAPANESE_64BIT_SQL_2014_SP3_EXPRESS",
+      "docs-public-apis:@aws-cdk/aws-ec2.WindowsVersion.WINDOWS_SERVER_2012_R2_RTM_SPANISH_64BIT_BASE",
+      "docs-public-apis:@aws-cdk/aws-ec2.WindowsVersion.WINDOWS_SERVER_2012_R2_RTM_JAPANESE_64BIT_SQL_2014_SP3_STANDARD",
+      "docs-public-apis:@aws-cdk/aws-ec2.WindowsVersion.WINDOWS_SERVER_2012_R2_RTM_ENGLISH_P3",
+      "docs-public-apis:@aws-cdk/aws-ec2.WindowsVersion.WINDOWS_SERVER_2008_R2_SP1_ENGLISH_64BIT_SHAREPOINT_2010_SP2_FOUNDATION",
+      "docs-public-apis:@aws-cdk/aws-ec2.WindowsVersion.WINDOWS_SERVER_2008_R2_SP1_ENGLISH_64BIT_SQL_2008_R2_SP3_STANDARD",
+      "docs-public-apis:@aws-cdk/aws-ec2.WindowsVersion.WINDOWS_SERVER_2019_PORTUGESE_BRAZIL_FULL_BASE",
+      "docs-public-apis:@aws-cdk/aws-ec2.WindowsVersion.WINDOWS_SERVER_2016_ENGLISH_FULL_SQL_2017_STANDARD",
+      "docs-public-apis:@aws-cdk/aws-ec2.WindowsVersion.WINDOWS_SERVER_2016_ENGLISH_CORE_SQL_2016_SP2_WEB",
+      "docs-public-apis:@aws-cdk/aws-ec2.WindowsVersion.WINDOWS_SERVER_2016_ENGLISH_CORE_SQL_2016_SP2_EXPRESS",
+      "docs-public-apis:@aws-cdk/aws-ec2.WindowsVersion.WINDOWS_SERVER_2016_ENGLISH_CORE_SQL_2016_SP1_STANDARD",
+      "docs-public-apis:@aws-cdk/aws-ec2.WindowsVersion.WINDOWS_SERVER_2016_ENGLISH_64BIT_SQL_2012_SP4_ENTERPRISE",
+      "docs-public-apis:@aws-cdk/aws-ec2.WindowsVersion.WINDOWS_SERVER_2012_RTM_DUTCH_64BIT_BASE",
+      "docs-public-apis:@aws-cdk/aws-ec2.WindowsVersion.WINDOWS_SERVER_2012_R2_RTM_KOREAN_64BIT_BASE",
+      "docs-public-apis:@aws-cdk/aws-ec2.WindowsVersion.WINDOWS_SERVER_2012_R2_RTM_ENGLISH_64BIT_SQL_2016_SP2_WEB",
+      "docs-public-apis:@aws-cdk/aws-ec2.WindowsVersion.WINDOWS_SERVER_2008_R2_SP1_ENGLISH_64BIT_CORE",
+      "docs-public-apis:@aws-cdk/aws-ec2.WindowsVersion.WINDOWS_SERVER_2019_DUTCH_FULL_BASE",
+      "docs-public-apis:@aws-cdk/aws-ec2.WindowsVersion.WINDOWS_SERVER_2016_JAPANESE_FULL_SQL_2016_SP1_STANDARD",
+      "docs-public-apis:@aws-cdk/aws-ec2.WindowsVersion.WINDOWS_SERVER_2016_CZECH_FULL_BASE",
+      "docs-public-apis:@aws-cdk/aws-ec2.WindowsVersion.WINDOWS_SERVER_2012_RTM_PORTUGESE_PORTUGAL_64BIT_BASE",
+      "docs-public-apis:@aws-cdk/aws-ec2.WindowsVersion.WINDOWS_SERVER_2012_RTM_JAPANESE_64BIT_SQL_2012_SP4_EXPRESS",
+      "docs-public-apis:@aws-cdk/aws-ec2.WindowsVersion.WINDOWS_SERVER_2012_R2_RTM_JAPANESE_64BIT_SQL_2014_SP2_STANDARD",
+      "docs-public-apis:@aws-cdk/aws-ec2.WindowsVersion.WINDOWS_SERVER_2008_SP2_PORTUGESE_BRAZIL_32BIT_BASE",
+      "docs-public-apis:@aws-cdk/aws-ec2.WindowsVersion.WINDOWS_SERVER_2008_R2_SP1_ENGLISH_64BIT_SQL_2012_SP4_STANDARD",
+      "docs-public-apis:@aws-cdk/aws-ec2.WindowsVersion.WINDOWS_SERVER_2008_R2_SP1_ENGLISH_61BIT_SQL_2012_RTM_SP2_ENTERPRISE",
+      "docs-public-apis:@aws-cdk/aws-ec2.WindowsVersion.WINDOWS_SERVER_1709_ENGLISH_CORE_BASE",
+      "docs-public-apis:@aws-cdk/aws-ec2.WindowsVersion.WINDOWS_SERVER_2019_ENGLISH_FULL_SQL_2016_SP2_ENTERPRISE",
+      "docs-public-apis:@aws-cdk/aws-ec2.WindowsVersion.WINDOWS_SERVER_2016_JAPANESE_FULL_SQL_2016_SP2_EXPRESS",
+      "docs-public-apis:@aws-cdk/aws-ec2.WindowsVersion.WINDOWS_SERVER_2016_ENGLISH_FULL_SQL_2016_SP1_ENTERPRISE",
+      "docs-public-apis:@aws-cdk/aws-ec2.WindowsVersion.WINDOWS_SERVER_2012_RTM_SPANISH_64BIT_BASE",
+      "docs-public-apis:@aws-cdk/aws-ec2.WindowsVersion.WINDOWS_SERVER_2012_RTM_POLISH_64BIT_BASE",
+      "docs-public-apis:@aws-cdk/aws-ec2.WindowsVersion.WINDOWS_SERVER_2012_RTM_JAPANESE_64BIT_SQL_2012_SP4_WEB",
+      "docs-public-apis:@aws-cdk/aws-ec2.WindowsVersion.WINDOWS_SERVER_2012_R2_RTM_TURKISH_64BIT_BASE",
+      "docs-public-apis:@aws-cdk/aws-ec2.WindowsVersion.WINDOWS_SERVER_2003_R2_SP2_LANGUAGE_PACKS_64BIT_SQL_2005_SP4_EXPRESS",
+      "docs-public-apis:@aws-cdk/aws-ec2.WindowsVersion.WINDOWS_SERVER_1809_ENGLISH_CORE_CONTAINERSLATEST",
+      "docs-public-apis:@aws-cdk/aws-ec2.WindowsVersion.WINDOWS_SERVER_1809_ENGLISH_CORE_BASE",
+      "docs-public-apis:@aws-cdk/aws-ec2.WindowsVersion.WINDOWS_SERVER_2019_CZECH_FULL_BASE",
+      "docs-public-apis:@aws-cdk/aws-ec2.WindowsVersion.WINDOWS_SERVER_2016_JAPANESE_FULL_SQL_2016_SP2_ENTERPRISE",
+      "docs-public-apis:@aws-cdk/aws-ec2.WindowsVersion.WINDOWS_SERVER_2016_FRENCH_FULL_BASE",
+      "docs-public-apis:@aws-cdk/aws-ec2.WindowsVersion.WINDOWS_SERVER_2012_RTM_JAPANESE_64BIT_SQL_2008_R2_SP3_EXPRESS",
+      "docs-public-apis:@aws-cdk/aws-ec2.WindowsVersion.WINDOWS_SERVER_2012_RTM_ENGLISH_64BIT_SQL_2014_SP2_WEB",
+      "docs-public-apis:@aws-cdk/aws-ec2.WindowsVersion.WINDOWS_SERVER_2012_R2_RTM_ENGLISH_64BIT_SQL_2016_SP1_ENTERPRISE",
+      "docs-public-apis:@aws-cdk/aws-ec2.WindowsVersion.WINDOWS_SERVER_2008_R2_SP1_JAPANESE_64BIT_SQL_2008_R2_SP3_EXPRESS",
+      "docs-public-apis:@aws-cdk/aws-ec2.WindowsVersion.WINDOWS_SERVER_2008_R2_SP1_ENGLISH_64BIT_SQL_2012_SP4_ENTERPRISE",
+      "docs-public-apis:@aws-cdk/aws-ec2.WindowsVersion.WINDOWS_SERVER_2003_R2_SP2_ENGLISH_64BIT_SQL_2005_SP4_STANDARD",
+      "docs-public-apis:@aws-cdk/aws-ec2.WindowsVersion.WINDOWS_SERVER_2019_GERMAN_FULL_BASE",
+      "docs-public-apis:@aws-cdk/aws-ec2.WindowsVersion.WINDOWS_SERVER_2016_ENGLISH_FULL_SQL_2017_WEB",
+      "docs-public-apis:@aws-cdk/aws-ec2.WindowsVersion.WINDOWS_SERVER_2016_ENGLISH_FULL_BASE",
+      "docs-public-apis:@aws-cdk/aws-ec2.WindowsVersion.WINDOWS_SERVER_2016_ENGLISH_CORE_BASE",
+      "docs-public-apis:@aws-cdk/aws-ec2.WindowsVersion.WINDOWS_SERVER_2012_RTM_JAPANESE_64BIT_SQL_2014_SP2_STANDARD",
+      "docs-public-apis:@aws-cdk/aws-ec2.WindowsVersion.WINDOWS_SERVER_2012_RTM_ENGLISH_64BIT_SQL_2014_SP3_EXPRESS",
+      "docs-public-apis:@aws-cdk/aws-ec2.WindowsVersion.WINDOWS_SERVER_2012_RTM_JAPANESE_64BIT_SQL_2016_SP2_EXPRESS",
+      "docs-public-apis:@aws-cdk/aws-ec2.AclCidr.toCidrConfig",
+      "docs-public-apis:@aws-cdk/aws-ec2.AclTraffic.toTrafficConfig",
+      "docs-public-apis:@aws-cdk/aws-ec2.Connections.connections",
+      "docs-public-apis:@aws-cdk/aws-ec2.Connections.securityGroups",
+      "docs-public-apis:@aws-cdk/aws-ec2.GatewayVpcEndpoint.vpcEndpointDnsEntries",
+      "docs-public-apis:@aws-cdk/aws-ec2.GatewayVpcEndpoint.vpcEndpointNetworkInterfaceIds",
+      "docs-public-apis:@aws-cdk/aws-ec2.GatewayVpcEndpoint.fromGatewayVpcEndpointId",
+      "docs-public-apis:@aws-cdk/aws-ec2.GatewayVpcEndpointAwsService.DYNAMODB",
+      "docs-public-apis:@aws-cdk/aws-ec2.GatewayVpcEndpointAwsService.S3",
+      "docs-public-apis:@aws-cdk/aws-ec2.InterfaceVpcEndpointAwsService.APIGATEWAY",
+      "docs-public-apis:@aws-cdk/aws-ec2.InterfaceVpcEndpointAwsService.CLOUDFORMATION",
+      "docs-public-apis:@aws-cdk/aws-ec2.InterfaceVpcEndpointAwsService.CLOUDTRAIL",
+      "docs-public-apis:@aws-cdk/aws-ec2.InterfaceVpcEndpointAwsService.CLOUDWATCH",
+      "docs-public-apis:@aws-cdk/aws-ec2.InterfaceVpcEndpointAwsService.CLOUDWATCH_EVENTS",
+      "docs-public-apis:@aws-cdk/aws-ec2.InterfaceVpcEndpointAwsService.CLOUDWATCH_LOGS",
+      "docs-public-apis:@aws-cdk/aws-ec2.InterfaceVpcEndpointAwsService.CODEBUILD",
+      "docs-public-apis:@aws-cdk/aws-ec2.InterfaceVpcEndpointAwsService.CODEBUILD_FIPS",
+      "docs-public-apis:@aws-cdk/aws-ec2.InterfaceVpcEndpointAwsService.CODECOMMIT",
+      "docs-public-apis:@aws-cdk/aws-ec2.InterfaceVpcEndpointAwsService.CODECOMMIT_FIPS",
+      "docs-public-apis:@aws-cdk/aws-ec2.InterfaceVpcEndpointAwsService.CODECOMMIT_GIT",
+      "docs-public-apis:@aws-cdk/aws-ec2.InterfaceVpcEndpointAwsService.CODECOMMIT_GIT_FIPS",
+      "docs-public-apis:@aws-cdk/aws-ec2.InterfaceVpcEndpointAwsService.CODEPIPELINE",
+      "docs-public-apis:@aws-cdk/aws-ec2.InterfaceVpcEndpointAwsService.CONFIG",
+      "docs-public-apis:@aws-cdk/aws-ec2.InterfaceVpcEndpointAwsService.EC2",
+      "docs-public-apis:@aws-cdk/aws-ec2.InterfaceVpcEndpointAwsService.EC2_MESSAGES",
+      "docs-public-apis:@aws-cdk/aws-ec2.InterfaceVpcEndpointAwsService.ECR",
+      "docs-public-apis:@aws-cdk/aws-ec2.InterfaceVpcEndpointAwsService.ECR_DOCKER",
+      "docs-public-apis:@aws-cdk/aws-ec2.InterfaceVpcEndpointAwsService.ECS",
+      "docs-public-apis:@aws-cdk/aws-ec2.InterfaceVpcEndpointAwsService.ECS_AGENT",
+      "docs-public-apis:@aws-cdk/aws-ec2.InterfaceVpcEndpointAwsService.ECS_TELEMETRY",
+      "docs-public-apis:@aws-cdk/aws-ec2.InterfaceVpcEndpointAwsService.ELASTIC_INFERENCE_RUNTIME",
+      "docs-public-apis:@aws-cdk/aws-ec2.InterfaceVpcEndpointAwsService.ELASTIC_LOAD_BALANCING",
+      "docs-public-apis:@aws-cdk/aws-ec2.InterfaceVpcEndpointAwsService.KINESIS_STREAMS",
+      "docs-public-apis:@aws-cdk/aws-ec2.InterfaceVpcEndpointAwsService.KMS",
+      "docs-public-apis:@aws-cdk/aws-ec2.InterfaceVpcEndpointAwsService.SAGEMAKER_API",
+      "docs-public-apis:@aws-cdk/aws-ec2.InterfaceVpcEndpointAwsService.SAGEMAKER_NOTEBOOK",
+      "docs-public-apis:@aws-cdk/aws-ec2.InterfaceVpcEndpointAwsService.SAGEMAKER_RUNTIME",
+      "docs-public-apis:@aws-cdk/aws-ec2.InterfaceVpcEndpointAwsService.SAGEMAKER_RUNTIME_FIPS",
+      "docs-public-apis:@aws-cdk/aws-ec2.InterfaceVpcEndpointAwsService.SECRETS_MANAGER",
+      "docs-public-apis:@aws-cdk/aws-ec2.InterfaceVpcEndpointAwsService.SERVICE_CATALOG",
+      "docs-public-apis:@aws-cdk/aws-ec2.InterfaceVpcEndpointAwsService.SNS",
+      "docs-public-apis:@aws-cdk/aws-ec2.InterfaceVpcEndpointAwsService.SQS",
+      "docs-public-apis:@aws-cdk/aws-ec2.InterfaceVpcEndpointAwsService.SSM",
+      "docs-public-apis:@aws-cdk/aws-ec2.InterfaceVpcEndpointAwsService.SSM_MESSAGES",
+      "docs-public-apis:@aws-cdk/aws-ec2.InterfaceVpcEndpointAwsService.STS",
+      "docs-public-apis:@aws-cdk/aws-ec2.InterfaceVpcEndpointAwsService.TRANSFER",
+      "docs-public-apis:@aws-cdk/aws-ec2.Port.toString",
+      "docs-public-apis:@aws-cdk/aws-ec2.PrivateSubnet.fromPrivateSubnetAttributes",
+      "docs-public-apis:@aws-cdk/aws-ec2.PublicSubnet.fromPublicSubnetAttributes",
+      "docs-public-apis:@aws-cdk/aws-ec2.SecurityGroup.connections",
+      "docs-public-apis:@aws-cdk/aws-ec2.SecurityGroup.defaultPort",
+      "docs-public-apis:@aws-cdk/aws-ec2.Subnet.subnetAvailabilityZone",
+      "docs-public-apis:@aws-cdk/aws-ec2.Subnet.subnetIpv6CidrBlocks",
+      "docs-public-apis:@aws-cdk/aws-ec2.Subnet.subnetNetworkAclAssociationId",
+      "docs-public-apis:@aws-cdk/aws-ec2.Subnet.subnetVpcId",
+      "docs-public-apis:@aws-cdk/aws-ec2.Subnet.fromSubnetAttributes",
+      "docs-public-apis:@aws-cdk/aws-ec2.Subnet.isVpcSubnet",
+      "docs-public-apis:@aws-cdk/aws-ec2.SubnetNetworkAclAssociation",
+      "docs-public-apis:@aws-cdk/aws-ec2.SubnetNetworkAclAssociation.fromSubnetNetworkAclAssociationAssociationId",
+      "docs-public-apis:@aws-cdk/aws-ec2.UserData.forOperatingSystem",
+      "docs-public-apis:@aws-cdk/aws-ec2.Vpc.vpcCidrBlock",
+      "docs-public-apis:@aws-cdk/aws-ec2.Vpc.vpcCidrBlockAssociations",
+      "docs-public-apis:@aws-cdk/aws-ec2.Vpc.vpcDefaultNetworkAcl",
+      "docs-public-apis:@aws-cdk/aws-ec2.Vpc.vpcDefaultSecurityGroup",
+      "docs-public-apis:@aws-cdk/aws-ec2.Vpc.vpcIpv6CidrBlocks",
+      "docs-public-apis:@aws-cdk/aws-ec2.VpcEndpoint",
+      "props-default-doc:@aws-cdk/aws-ec2.AclCidrConfig.cidrBlock",
+      "props-default-doc:@aws-cdk/aws-ec2.AclCidrConfig.ipv6CidrBlock",
+      "props-default-doc:@aws-cdk/aws-ec2.AclIcmp.code",
+      "props-default-doc:@aws-cdk/aws-ec2.AclIcmp.type",
+      "props-default-doc:@aws-cdk/aws-ec2.AclPortRange.from",
+      "props-default-doc:@aws-cdk/aws-ec2.AclPortRange.to",
+      "docs-public-apis:@aws-cdk/aws-ec2.ConnectionRule",
+      "docs-public-apis:@aws-cdk/aws-ec2.IConnectable.connections",
+      "docs-public-apis:@aws-cdk/aws-ec2.IInstance",
+      "docs-public-apis:@aws-cdk/aws-ec2.IPrivateSubnet",
+      "docs-public-apis:@aws-cdk/aws-ec2.IPublicSubnet",
+      "docs-public-apis:@aws-cdk/aws-ec2.ISecurityGroup",
+      "docs-public-apis:@aws-cdk/aws-ec2.ISubnet",
+      "docs-public-apis:@aws-cdk/aws-ec2.IVpc",
+      "docs-public-apis:@aws-cdk/aws-ec2.IVpnConnection",
+      "docs-public-apis:@aws-cdk/aws-ec2.PrivateSubnetAttributes",
+      "docs-public-apis:@aws-cdk/aws-ec2.PrivateSubnetProps",
+      "docs-public-apis:@aws-cdk/aws-ec2.PublicSubnetAttributes",
+      "docs-public-apis:@aws-cdk/aws-ec2.PublicSubnetProps",
+      "docs-public-apis:@aws-cdk/aws-ec2.SecurityGroupProps",
+      "docs-public-apis:@aws-cdk/aws-ec2.SubnetAttributes",
+      "props-default-doc:@aws-cdk/aws-ec2.SubnetAttributes.routeTableId",
+      "props-default-doc:@aws-cdk/aws-ec2.SubnetSelection.subnetName",
+      "props-default-doc:@aws-cdk/aws-ec2.VpcAttributes.isolatedSubnetIds",
+      "props-default-doc:@aws-cdk/aws-ec2.VpcAttributes.isolatedSubnetNames",
+      "props-default-doc:@aws-cdk/aws-ec2.VpcAttributes.isolatedSubnetRouteTableIds",
+      "props-default-doc:@aws-cdk/aws-ec2.VpcAttributes.privateSubnetIds",
+      "props-default-doc:@aws-cdk/aws-ec2.VpcAttributes.privateSubnetNames",
+      "props-default-doc:@aws-cdk/aws-ec2.VpcAttributes.privateSubnetRouteTableIds",
+      "props-default-doc:@aws-cdk/aws-ec2.VpcAttributes.publicSubnetIds",
+      "props-default-doc:@aws-cdk/aws-ec2.VpcAttributes.publicSubnetNames",
+      "props-default-doc:@aws-cdk/aws-ec2.VpcAttributes.publicSubnetRouteTableIds",
+      "props-default-doc:@aws-cdk/aws-ec2.VpcAttributes.vpnGatewayId",
+      "docs-public-apis:@aws-cdk/aws-ec2.VpnConnectionOptions",
+      "docs-public-apis:@aws-cdk/aws-ec2.VpnConnectionProps",
+      "docs-public-apis:@aws-cdk/aws-ec2.VpnTunnelOption",
+      "docs-public-apis:@aws-cdk/aws-ec2.AmazonLinuxStorage",
+      "docs-public-apis:@aws-cdk/aws-ec2.InstanceSize.NANO",
+      "docs-public-apis:@aws-cdk/aws-ec2.InstanceSize.MICRO",
+      "docs-public-apis:@aws-cdk/aws-ec2.InstanceSize.SMALL",
+      "docs-public-apis:@aws-cdk/aws-ec2.InstanceSize.MEDIUM",
+      "docs-public-apis:@aws-cdk/aws-ec2.InstanceSize.LARGE",
+      "docs-public-apis:@aws-cdk/aws-ec2.InstanceSize.XLARGE",
+      "docs-public-apis:@aws-cdk/aws-ec2.InstanceSize.XLARGE2",
+      "docs-public-apis:@aws-cdk/aws-ec2.InstanceSize.XLARGE4",
+      "docs-public-apis:@aws-cdk/aws-ec2.InstanceSize.XLARGE8",
+      "docs-public-apis:@aws-cdk/aws-ec2.InstanceSize.XLARGE9",
+      "docs-public-apis:@aws-cdk/aws-ec2.InstanceSize.XLARGE10",
+      "docs-public-apis:@aws-cdk/aws-ec2.InstanceSize.XLARGE12",
+      "docs-public-apis:@aws-cdk/aws-ec2.InstanceSize.XLARGE16",
+      "docs-public-apis:@aws-cdk/aws-ec2.InstanceSize.XLARGE18",
+      "docs-public-apis:@aws-cdk/aws-ec2.InstanceSize.XLARGE24",
+      "docs-public-apis:@aws-cdk/aws-ec2.InstanceSize.XLARGE32",
+      "docs-public-apis:@aws-cdk/aws-ec2.InstanceSize.METAL",
+      "docs-public-apis:@aws-cdk/aws-ec2.OperatingSystemType.LINUX",
+      "docs-public-apis:@aws-cdk/aws-ec2.OperatingSystemType.WINDOWS",
+      "docs-public-apis:@aws-cdk/aws-ec2.Protocol.ALL",
+      "docs-public-apis:@aws-cdk/aws-ec2.Protocol.TCP",
+      "docs-public-apis:@aws-cdk/aws-ec2.Protocol.UDP",
+      "docs-public-apis:@aws-cdk/aws-ec2.Protocol.ICMP",
+      "docs-public-apis:@aws-cdk/aws-ec2.Protocol.ICMPV6",
+      "docs-public-apis:@aws-cdk/aws-ec2.WindowsVersion.WINDOWS_SERVER_2008_SP2_ENGLISH_64BIT_SQL_2008_SP4_EXPRESS",
+      "docs-public-apis:@aws-cdk/aws-ec2.WindowsVersion.WINDOWS_SERVER_2012_R2_RTM_CHINESE_SIMPLIFIED_64BIT_BASE",
+      "docs-public-apis:@aws-cdk/aws-ec2.WindowsVersion.WINDOWS_SERVER_2012_R2_RTM_CHINESE_TRADITIONAL_64BIT_BASE",
+      "docs-public-apis:@aws-cdk/aws-ec2.WindowsVersion.WINDOWS_SERVER_2012_R2_RTM_DUTCH_64BIT_BASE",
+      "docs-public-apis:@aws-cdk/aws-ec2.WindowsVersion.WINDOWS_SERVER_2012_R2_RTM_ENGLISH_64BIT_SQL_2014_SP2_ENTERPRISE",
+      "docs-public-apis:@aws-cdk/aws-ec2.WindowsVersion.WINDOWS_SERVER_2012_R2_RTM_HUNGARIAN_64BIT_BASE",
+      "docs-public-apis:@aws-cdk/aws-ec2.WindowsVersion.WINDOWS_SERVER_2012_R2_RTM_JAPANESE_64BIT_BASE",
+      "docs-public-apis:@aws-cdk/aws-ec2.WindowsVersion.WINDOWS_SERVER_2016_ENGLISH_CORE_CONTAINERS",
+      "docs-public-apis:@aws-cdk/aws-ec2.WindowsVersion.WINDOWS_SERVER_2016_ENGLISH_CORE_SQL_2016_SP1_WEB",
+      "docs-public-apis:@aws-cdk/aws-ec2.WindowsVersion.WINDOWS_SERVER_2016_GERMAL_FULL_BASE",
+      "docs-public-apis:@aws-cdk/aws-ec2.WindowsVersion.WINDOWS_SERVER_2003_R2_SP2_LANGUAGE_PACKS_32BIT_BASE",
+      "docs-public-apis:@aws-cdk/aws-ec2.WindowsVersion.WINDOWS_SERVER_2008_R2_SP1_ENGLISH_64BIT_SQL_2008_R2_SP3_WEB",
+      "docs-public-apis:@aws-cdk/aws-ec2.WindowsVersion.WINDOWS_SERVER_2008_R2_SP1_ENGLISH_64BIT_SQL_2012_SP4_EXPRESS",
+      "docs-public-apis:@aws-cdk/aws-ec2.WindowsVersion.WINDOWS_SERVER_2012_R2_SP1_PORTUGESE_BRAZIL_64BIT_CORE",
+      "docs-public-apis:@aws-cdk/aws-ec2.WindowsVersion.WINDOWS_SERVER_2012_R2_RTM_ENGLISH_64BIT_SQL_2016_SP2_STANDARD",
+      "docs-public-apis:@aws-cdk/aws-ec2.WindowsVersion.WINDOWS_SERVER_2012_RTM_ENGLISH_64BIT_SQL_2014_SP2_EXPRESS",
+      "docs-public-apis:@aws-cdk/aws-ec2.WindowsVersion.WINDOWS_SERVER_2012_RTM_ITALIAN_64BIT_BASE",
+      "docs-public-apis:@aws-cdk/aws-ec2.WindowsVersion.WINDOWS_SERVER_2016_ENGLISH_CORE_SQL_2016_SP1_EXPRESS",
+      "docs-public-apis:@aws-cdk/aws-ec2.WindowsVersion.WINDOWS_SERVER_2012_R2_RTM_JAPANESE_64BIT_SQL_2016_SP1_ENTERPRISE",
+      "docs-public-apis:@aws-cdk/aws-ec2.WindowsVersion.WINDOWS_SERVER_2019_ITALIAN_FULL_BASE",
+      "docs-public-apis:@aws-cdk/aws-ec2.WindowsVersion.WINDOWS_SERVER_2008_R2_SP1_KOREAN_64BIT_BASE",
+      "docs-public-apis:@aws-cdk/aws-ec2.WindowsVersion.WINDOWS_SERVER_2012_R2_RTM_ENGLISH_64BIT_SQL_2016_SP1_EXPRESS",
+      "docs-public-apis:@aws-cdk/aws-ec2.WindowsVersion.WINDOWS_SERVER_2012_R2_RTM_JAPANESE_64BIT_SQL_2016_SP2_WEB",
+      "docs-public-apis:@aws-cdk/aws-ec2.WindowsVersion.WINDOWS_SERVER_2016_JAPANESE_FULL_FQL_2016_SP2_WEB",
+      "docs-public-apis:@aws-cdk/aws-ec2.WindowsVersion.WINDOWS_SERVER_2016_KOREAN_FULL_BASE",
+      "docs-public-apis:@aws-cdk/aws-ec2.WindowsVersion.WINDOWS_SERVER_2016_KOREAN_FULL_SQL_2016_SP2_STANDARD",
+      "docs-public-apis:@aws-cdk/aws-ec2.WindowsVersion.WINDOWS_SERVER_2016_PORTUGESE_PORTUGAL_FULL_BASE",
+      "docs-public-apis:@aws-cdk/aws-ec2.WindowsVersion.WINDOWS_SERVER_2019_ENGLISH_FULL_SQL_2017_WEB",
+      "docs-public-apis:@aws-cdk/aws-ec2.WindowsVersion.WINDOWS_SERVER_2019_FRENCH_FULL_BASE",
+      "docs-public-apis:@aws-cdk/aws-ec2.WindowsVersion.WINDOWS_SERVER_2019_KOREAN_FULL_BASE",
+      "docs-public-apis:@aws-cdk/aws-ec2.WindowsVersion.WINDOWS_SERVER_2008_R2_SP1_CHINESE_HONG_KONG_SAR_64BIT_BASE",
+      "docs-public-apis:@aws-cdk/aws-ec2.WindowsVersion.WINDOWS_SERVER_2008_R2_SP1_CHINESE_PRC_64BIT_BASE",
+      "docs-public-apis:@aws-cdk/aws-ec2.WindowsVersion.WINDOWS_SERVER_2012_RTM_FRENCH_64BIT_BASE",
+      "docs-public-apis:@aws-cdk/aws-ec2.WindowsVersion.WINDOWS_SERVER_2016_ENGLISH_FULL_CONTAINERS",
+      "docs-public-apis:@aws-cdk/aws-ec2.WindowsVersion.WINDOWS_SERVER_2016_ENGLISH_FULL_SQL_2016_SP1_STANDARD",
+      "docs-public-apis:@aws-cdk/aws-ec2.WindowsVersion.WINDOWS_SERVER_2016_RUSSIAN_FULL_BASE",
+      "docs-public-apis:@aws-cdk/aws-ec2.WindowsVersion.WINDOWS_SERVER_2019_CHINESE_SIMPLIFIED_FULL_BASE",
+      "docs-public-apis:@aws-cdk/aws-ec2.WindowsVersion.WINDOWS_SERVER_2019_ENGLISH_FULL_SQL_2016_SP2_STANDARD",
+      "docs-public-apis:@aws-cdk/aws-ec2.WindowsVersion.WINDOWS_SERVER_2019_HUNGARIAN_FULL_BASE",
+      "docs-public-apis:@aws-cdk/aws-ec2.WindowsVersion.WINDOWS_SERVER_2008_R2_SP1_ENGLISH_64BIT_SQL_2008_R2_SP3_EXPRESS",
+      "docs-public-apis:@aws-cdk/aws-ec2.WindowsVersion.WINDOWS_SERVER_2007_R2_SP1_LANGUAGE_PACKS_64BIT_BASE",
+      "docs-public-apis:@aws-cdk/aws-ec2.WindowsVersion.WINDOWS_SERVER_2008_SP2_ENGLISH_32BIT_BASE",
+      "docs-public-apis:@aws-cdk/aws-ec2.WindowsVersion.WINDOWS_SERVER_2012_R2_RTM_ENGLISH_64BIT_SQL_2012_SP4_ENTERPRISE",
+      "docs-public-apis:@aws-cdk/aws-ec2.WindowsVersion.WINDOWS_SERVER_2012_RTM_CHINESE_TRADITIONAL_64BIT_BASE",
+      "docs-public-apis:@aws-cdk/aws-ec2.WindowsVersion.WINDOWS_SERVER_2012_RTM_ENGLISH_64BIT_SQL_2008_R2_SP3_EXPRESS",
+      "docs-public-apis:@aws-cdk/aws-ec2.WindowsVersion.WINDOWS_SERVER_2012_RTM_ENGLISH_64BIT_SQL_2014_SP2_STANDARD",
+      "docs-public-apis:@aws-cdk/aws-ec2.WindowsVersion.WINDOWS_SERVER_2012_RTM_JAPANESE_64BIT_SQL_2014_SP2_EXPRESS",
+      "docs-public-apis:@aws-cdk/aws-ec2.WindowsVersion.WINDOWS_SERVER_2016_POLISH_FULL_BASE",
+      "docs-public-apis:@aws-cdk/aws-ec2.WindowsVersion.WINDOWS_SERVER_2019_ENGLISH_FULL_SQL_2016_SP2_WEB",
+      "docs-public-apis:@aws-cdk/aws-ec2.WindowsVersion.WINDOWS_SERVER_2012_R2_RTM_ENGLISH_64BIT_SQL_2014_SP3_STANDARD",
+      "docs-public-apis:@aws-cdk/aws-ec2.WindowsVersion.WINDOWS_SERVER_2012_R2_RTM_ENGLISH_64BIT_SQL_2016_SP2_EXPRESS",
+      "docs-public-apis:@aws-cdk/aws-ec2.WindowsVersion.WINDOWS_SERVER_2012_R2_RTM_ENGLISH_DEEP_LEARNING",
+      "docs-public-apis:@aws-cdk/aws-ec2.WindowsVersion.WINDOWS_SERVER_2012_R2_RTM_GERMAN_64BIT_BASE",
+      "docs-public-apis:@aws-cdk/aws-ec2.WindowsVersion.WINDOWS_SERVER_2012_R2_RTM_JAPANESE_64BIT_SQL_2016_SP1_EXPRESS",
+      "docs-public-apis:@aws-cdk/aws-ec2.WindowsVersion.WINDOWS_SERVER_2012_R2_RTM_RUSSIAN_64BIT_BASE",
+      "docs-public-apis:@aws-cdk/aws-ec2.WindowsVersion.WINDOWS_SERVER_2012_RTM_CHINESE_TRADITIONAL_HONG_KONG_SAR_64BIT_BASE",
+      "docs-public-apis:@aws-cdk/aws-ec2.WindowsVersion.WINDOWS_SERVER_2012_RTM_HUNGARIAN_64BIT_BASE",
+      "docs-public-apis:@aws-cdk/aws-ec2.WindowsVersion.WINDOWS_SERVER_2012_RTM_JAPANESE_64BIT_SQL_2014_SP3_STANDARD",
+      "docs-public-apis:@aws-cdk/aws-ec2.WindowsVersion.WINDOWS_SERVER_2019_ENGLISH_FULL_HYPERV",
+      "docs-public-apis:@aws-cdk/aws-ec2.WindowsVersion.WINDOWS_SERVER_2003_R2_SP2_ENGLISH_64BIT_SQL_2005_SP4_EXPRESS",
+      "docs-public-apis:@aws-cdk/aws-ec2.WindowsVersion.WINDOWS_SERVER_2008_R2_SP1_JAPANESE_64BIT_SQL_2012_SP4_EXPRESS",
+      "docs-public-apis:@aws-cdk/aws-ec2.WindowsVersion.WINDOWS_SERVER_2012_RTM_GERMAN_64BIT_BASE",
+      "docs-public-apis:@aws-cdk/aws-ec2.WindowsVersion.WINDOWS_SERVER_2012_RTM_JAPANESE_64BIT_SQL_2008_R2_SP3_STANDARD",
+      "docs-public-apis:@aws-cdk/aws-ec2.WindowsVersion.WINDOWS_SERVER_2016_ENGLISH_FULL_SQL_2016_SP2_STANDARD",
+      "docs-public-apis:@aws-cdk/aws-ec2.WindowsVersion.WINDOWS_SERVER_2019_ENGLISH_FULL_SQL_2017_EXPRESS",
+      "docs-public-apis:@aws-cdk/aws-ec2.WindowsVersion.WINDOWS_SERVER_2019_JAPANESE_FULL_BASE",
+      "docs-public-apis:@aws-cdk/aws-ec2.WindowsVersion.WINDOWS_SERVER_2019_RUSSIAN_FULL_BASE",
+      "docs-public-apis:@aws-cdk/aws-ec2.WindowsVersion.WINDOWS_SERVER_2012_R2_RTM_ENGLISH_64BIT_SQL_2014_SP2_STANDARD",
+      "docs-public-apis:@aws-cdk/aws-ec2.WindowsVersion.WINDOWS_SERVER_2012_R2_RTM_ITALIAN_64BIT_BASE",
+      "docs-public-apis:@aws-cdk/aws-ec2.WindowsVersion.WINDOWS_SERVER_2012_RTM_ENGLISH_64BIT_BASE",
+      "docs-public-apis:@aws-cdk/aws-ec2.WindowsVersion.WINDOWS_SERVER_2012_RTM_ENGLISH_64BIT_SQL_2008_R2_SP3_STANDARD",
+      "docs-public-apis:@aws-cdk/aws-ec2.WindowsVersion.WINDOWS_SERVER_2016_ENGLISH_FULL_HYPERV",
+      "docs-public-apis:@aws-cdk/aws-ec2.WindowsVersion.WINDOWS_SERVER_2016_ENGLISH_FULL_SQL_2016_SP2_ENTERPRISE",
+      "docs-public-apis:@aws-cdk/aws-ec2.WindowsVersion.WINDOWS_SERVER_2019_CHINESE_TRADITIONAL_FULL_BASE",
+      "docs-public-apis:@aws-cdk/aws-ec2.WindowsVersion.WINDOWS_SERVER_2019_ENGLISH_CORE_BASE",
+      "docs-public-apis:@aws-cdk/aws-ec2.WindowsVersion.WINDOWS_SERVER_2019_ENGLISH_CORE_CONTAINERSLATEST",
+      "docs-public-apis:@aws-cdk/aws-ec2.WindowsVersion.WINDOWS_SERVER_2008_SP2_ENGLISH_64BIT_BASE",
+      "docs-public-apis:@aws-cdk/aws-ec2.WindowsVersion.WINDOWS_SERVER_2012_R2_RTM_FRENCH_64BIT_BASE",
+      "docs-public-apis:@aws-cdk/aws-ec2.WindowsVersion.WINDOWS_SERVER_2012_R2_RTM_POLISH_64BIT_BASE",
+      "docs-public-apis:@aws-cdk/aws-ec2.WindowsVersion.WINDOWS_SERVER_2012_RTM_ENGLISH_64BIT_SQL_2012_SP4_EXPRESS",
+      "docs-public-apis:@aws-cdk/aws-ec2.WindowsVersion.WINDOWS_SERVER_2012_RTM_ENGLISH_64BIT_SQL_2014_SP3_STANDARD",
+      "docs-public-apis:@aws-cdk/aws-ec2.WindowsVersion.WINDOWS_SERVER_2012_RTM_JAPANESE_64BIT_2012_SP4_STANDARD",
+      "docs-public-apis:@aws-cdk/aws-ec2.WindowsVersion.WINDOWS_SERVER_2016_ENGLISH_CORE_CONTAINERSLATEST",
+      "docs-public-apis:@aws-cdk/aws-ec2.WindowsVersion.WINDOWS_SERVER_2019_ENGLISH_FULL_SQL_2016_SP2_EXPRESS",
+      "docs-public-apis:@aws-cdk/aws-ec2.WindowsVersion.WINDOWS_SERVER_2019_TURKISH_FULL_BASE",
+      "docs-public-apis:@aws-cdk/aws-ec2.WindowsVersion.WINDOWS_SERVER_2012_R2_RTM_ENGLISH_64BIT_SQL_2014_SP2_EXPRESS",
+      "docs-public-apis:@aws-cdk/aws-ec2.WindowsVersion.WINDOWS_SERVER_2012_R2_RTM_ENGLISH_64BIT_SQL_2014_SP3_WEB",
+      "docs-public-apis:@aws-cdk/aws-ec2.WindowsVersion.WINDOWS_SERVER_2012_R2_RTM_JAPANESE_64BIT_SQL_2016_SP1_WEB",
+      "docs-public-apis:@aws-cdk/aws-ec2.WindowsVersion.WINDOWS_SERVER_2012_R2_RTM_PORTUGESE_BRAZIL_64BIT_BASE",
+      "docs-public-apis:@aws-cdk/aws-ec2.WindowsVersion.WINDOWS_SERVER_2012_R2_RTM_PORTUGESE_PORTUGAL_64BIT_BASE",
+      "docs-public-apis:@aws-cdk/aws-ec2.WindowsVersion.WINDOWS_SERVER_2012_R2_RTM_SWEDISH_64BIT_BASE",
+      "docs-public-apis:@aws-cdk/aws-ec2.WindowsVersion.WINDOWS_SERVER_2016_ENGLISH_FULL_SQL_2016_SP1_EXPRESS",
+      "docs-public-apis:@aws-cdk/aws-ec2.WindowsVersion.WINDOWS_SERVER_2016_ITALIAN_FULL_BASE",
+      "docs-public-apis:@aws-cdk/aws-ec2.WindowsVersion.WINDOWS_SERVER_2016_SPANISH_FULL_BASE",
+      "docs-public-apis:@aws-cdk/aws-ec2.WindowsVersion.WINDOWS_SERVER_2019_ENGLISH_FULL_SQL_2017_STANDARD",
+      "docs-public-apis:@aws-cdk/aws-ec2.WindowsVersion.WINDOWS_SERVER_2003_R2_SP2_LANGUAGE_PACKS_64BIT_SQL_2005_SP4_STANDARD",
+      "docs-public-apis:@aws-cdk/aws-ec2.WindowsVersion.WINDOWS_SERVER_2008_R2_SP1_JAPANESE_64BIT_SQL_2008_R2_SP3_STANDARD",
+      "docs-public-apis:@aws-cdk/aws-ec2.WindowsVersion.WINDOWS_SERVER_2012_R2_RTM_JAPANESE_64BIT_SQL_2016_SP1_STANDARD",
+      "docs-public-apis:@aws-cdk/aws-ec2.WindowsVersion.WINDOWS_SERVER_2012_RTM_ENGLISH_64BIT_SQL_2007_R2_SP3_WEB",
+      "docs-public-apis:@aws-cdk/aws-ec2.WindowsVersion.WINDOWS_SERVER_2012_RTM_JAPANESE_64BIT_SQL_2014_SP2_WEB",
+      "docs-public-apis:@aws-cdk/aws-ec2.WindowsVersion.WINDOWS_SERVER_2016_ENGLISH_CORE_SQL_2016_SP2_ENTERPRISE",
+      "docs-public-apis:@aws-cdk/aws-ec2.WindowsVersion.WINDOWS_SERVER_2016_PORTUGESE_BRAZIL_FULL_BASE",
+      "docs-public-apis:@aws-cdk/aws-ec2.WindowsVersion.WINDOWS_SERVER_2019_ENGLISH_FULL_BASE",
+      "docs-public-apis:@aws-cdk/aws-ec2.WindowsVersion.WINDOWS_SERVER_2003_R2_SP2_ENGLISH_32BIT_BASE",
+      "docs-public-apis:@aws-cdk/aws-ec2.WindowsVersion.WINDOWS_SERVER_2012_R2_RTM_CZECH_64BIT_BASE",
+      "docs-public-apis:@aws-cdk/aws-ec2.WindowsVersion.WINDOWS_SERVER_2012_R2_RTM_ENGLISH_64BIT_SQL_2016_SP1_STANDARD",
+      "docs-public-apis:@aws-cdk/aws-ec2.WindowsVersion.WINDOWS_SERVER_2012_R2_RTM_JAPANESE_64BIT_SQL_2014_SP2_EXPRESS",
+      "docs-public-apis:@aws-cdk/aws-ec2.WindowsVersion.WINDOWS_SERVER_2012_RTM_ENGLISH_64BIT_SQL_2012_SP4_STANDARD",
+      "docs-public-apis:@aws-cdk/aws-ec2.WindowsVersion.WINDOWS_SERVER_2016_ENGLISH_CORE_SQL_2016_SP1_ENTERPRISE",
+      "docs-public-apis:@aws-cdk/aws-ec2.WindowsVersion.WINDOWS_SERVER_2016_JAPANESE_FULL_SQL_2016_SP1_WEB",
+      "docs-public-apis:@aws-cdk/aws-ec2.WindowsVersion.WINDOWS_SERVER_2016_SWEDISH_FULL_BASE",
+      "docs-public-apis:@aws-cdk/aws-ec2.WindowsVersion.WINDOWS_SERVER_2016_TURKISH_FULL_BASE",
+      "docs-public-apis:@aws-cdk/aws-ec2.WindowsVersion.WINDOWS_SERVER_2008_R2_SP1_ENGLISH_64BIT_CORE_SQL_2012_SP4_STANDARD",
+      "docs-public-apis:@aws-cdk/aws-ec2.WindowsVersion.WINDOWS_SERVER_2008_R2_SP1_LANGUAGE_PACKS_64BIT_SQL_2008_R2_SP3_STANDARD",
+      "docs-public-apis:@aws-cdk/aws-ec2.WindowsVersion.WINDOWS_SERVER_2012_RTM_CZECH_64BIT_BASE",
+      "docs-public-apis:@aws-cdk/aws-ec2.WindowsVersion.WINDOWS_SERVER_2012_RTM_TURKISH_64BIT_BASE",
+      "docs-public-apis:@aws-cdk/aws-ec2.WindowsVersion.WINDOWS_SERVER_2016_DUTCH_FULL_BASE",
+      "docs-public-apis:@aws-cdk/aws-ec2.WindowsVersion.WINDOWS_SERVER_2016_ENGLISH_FULL_SQL_2016_SP2_EXPRESS",
+      "docs-public-apis:@aws-cdk/aws-ec2.WindowsVersion.WINDOWS_SERVER_2016_ENGLISH_FULL_SQL_2017_ENTERPRISE",
+      "docs-public-apis:@aws-cdk/aws-ec2.WindowsVersion.WINDOWS_SERVER_2016_HUNGARIAN_FULL_BASE",
+      "docs-public-apis:@aws-cdk/aws-ec2.WindowsVersion.WINDOWS_SERVER_2016_KOREAN_FULL_SQL_2016_SP1_STANDARD",
+      "docs-public-apis:@aws-cdk/aws-ec2.WindowsVersion.WINDOWS_SERVER_2019_SPANISH_FULL_BASE",
+      "docs-public-apis:@aws-cdk/aws-ec2.WindowsVersion.WINDOWS_SERVER_2003_R2_SP2_ENGLISH_64BIT_BASE",
+      "docs-public-apis:@aws-cdk/aws-ec2.WindowsVersion.WINDOWS_SERVER_2008_R2_SP1_ENGLISH_64BIT_BASE",
+      "docs-public-apis:@aws-cdk/aws-ec2.WindowsVersion.WINDOWS_SERVER_2008_R2_SP1_LANGUAGE_PACKS_64BIT_SQL_2008_R2_SP3_EXPRESS",
+      "docs-public-apis:@aws-cdk/aws-ec2.WindowsVersion.WINDOWS_SERVER_2012_SP2_PORTUGESE_BRAZIL_64BIT_BASE",
+      "docs-public-apis:@aws-cdk/aws-ec2.WindowsVersion.WINDOWS_SERVER_2012_R2_RTM_ENGLISH_64BIT_SQL_2016_SP1_WEB",
+      "docs-public-apis:@aws-cdk/aws-ec2.WindowsVersion.WINDOWS_SERVER_2012_R2_RTM_JAPANESE_64BIT_SQL_2014_SP3_EXPRESS",
+      "docs-public-apis:@aws-cdk/aws-ec2.WindowsVersion.WINDOWS_SERVER_2012_R2_RTM_JAPANESE_64BIT_SQL_2016_SP2_ENTERPRISE",
+      "docs-public-apis:@aws-cdk/aws-ec2.WindowsVersion.WINDOWS_SERVER_2012_RTM_JAPANESE_64BIT_BASE",
+      "docs-public-apis:@aws-cdk/aws-ec2.WindowsVersion.WINDOWS_SERVER_2019_ENGLISH_FULL_CONTAINERSLATEST",
+      "docs-public-apis:@aws-cdk/aws-ec2.WindowsVersion.WINDOWS_SERVER_2019_ENGLISH_FULL_SQL_2017_ENTERPRISE",
+      "docs-public-apis:@aws-cdk/aws-ec2.WindowsVersion.WINDOWS_SERVER_1709_ENGLISH_CORE_CONTAINERSLATEST",
+      "docs-public-apis:@aws-cdk/aws-ec2.WindowsVersion.WINDOWS_SERVER_1803_ENGLISH_CORE_BASE",
+      "docs-public-apis:@aws-cdk/aws-ec2.WindowsVersion.WINDOWS_SERVER_2008_R2_SP1_ENGLISH_64BIT_SQL_2012_SP4_WEB",
+      "docs-public-apis:@aws-cdk/aws-ec2.WindowsVersion.WINDOWS_SERVER_2008_R2_SP1_JAPANESE_64BIT_BASE",
+      "docs-public-apis:@aws-cdk/aws-ec2.WindowsVersion.WINDOWS_SERVER_2008_SP2_ENGLISH_64BIT_SQL_2008_SP4_STANDARD",
+      "docs-public-apis:@aws-cdk/aws-ec2.WindowsVersion.WINDOWS_SERVER_2012_R2_RTM_ENGLISH_64BIT_BASE",
+      "docs-public-apis:@aws-cdk/aws-ec2.WindowsVersion.WINDOWS_SERVER_2012_RTM_PORTUGESE_BRAZIL_64BIT_BASE",
+      "docs-public-apis:@aws-cdk/aws-ec2.WindowsVersion.WINDOWS_SERVER_2016_ENGLISH_FULL_SQL_2016_SP1_WEB",
+      "docs-public-apis:@aws-cdk/aws-ec2.WindowsVersion.WINDOWS_SERVER_2016_ENGLISH_P3",
+      "docs-public-apis:@aws-cdk/aws-ec2.WindowsVersion.WINDOWS_SERVER_2016_JAPANESE_FULL_SQL_2016_SP1_ENTERPRISE",
+      "docs-public-apis:@aws-cdk/aws-ec2.WindowsVersion.WINDOWS_SERVER_2003_R2_SP2_LANGUAGE_PACKS_64BIT_BASE",
+      "docs-public-apis:@aws-cdk/aws-ec2.WindowsVersion.WINDOWS_SERVER_2012_R2_RTM_CHINESE_TRADITIONAL_HONG_KONG_64BIT_BASE",
+      "docs-public-apis:@aws-cdk/aws-ec2.WindowsVersion.WINDOWS_SERVER_2012_R2_RTM_ENGLISH_64BIT_SQL_2014_SP3_EXPRESS",
+      "docs-public-apis:@aws-cdk/aws-ec2.WindowsVersion.WINDOWS_SERVER_2012_R2_RTM_ENGLISH_64BIT_SQL_2016_SP2_ENTERPRISE",
+      "docs-public-apis:@aws-cdk/aws-ec2.WindowsVersion.WINDOWS_SERVER_2012_RTM_CHINESE_SIMPLIFIED_64BIT_BASE",
+      "docs-public-apis:@aws-cdk/aws-ec2.WindowsVersion.WINDOWS_SERVER_2012_RTM_ENGLISH_64BIT_SQL_2012_SP4_WEB",
+      "docs-public-apis:@aws-cdk/aws-ec2.WindowsVersion.WINDOWS_SERVER_2012_RTM_JAPANESE_64BIT_SQL_2014_SP3_WEB",
+      "docs-public-apis:@aws-cdk/aws-ec2.WindowsVersion.WINDOWS_SERVER_2016_JAPANESE_FULL_BASE",
+      "docs-public-apis:@aws-cdk/aws-ec2.WindowsVersion.WINDOWS_SERVER_2016_JAPANESE_FULL_SQL_2016_SP1_EXPRESS",
+      "docs-public-apis:@aws-cdk/aws-ec2.WindowsVersion.WINDOWS_SERVER_1803_ENGLISH_CORE_CONTAINERSLATEST",
+      "docs-public-apis:@aws-cdk/aws-ec2.WindowsVersion.WINDOWS_SERVER_2008_R2_SP1_JAPANESE_64BIT_SQL_2012_SP4_STANDARD",
+      "docs-public-apis:@aws-cdk/aws-ec2.WindowsVersion.WINDOWS_SERVER_2012_R2_RTM_ENGLISH_64BIT_CORE",
+      "docs-public-apis:@aws-cdk/aws-ec2.WindowsVersion.WINDOWS_SERVER_2012_R2_RTM_ENGLISH_64BIT_SQL_2014_SP2_WEB",
+      "docs-public-apis:@aws-cdk/aws-ec2.WindowsVersion.WINDOWS_SERVER_2012_R2_RTM_ENGLISH_64BIT_SQL_2014_SP3_ENTERPRISE",
+      "docs-public-apis:@aws-cdk/aws-ec2.WindowsVersion.WINDOWS_SERVER_2012_R2_RTM_JAPANESE_64BIT_SQL_2016_SP2_STANDARD",
+      "docs-public-apis:@aws-cdk/aws-ec2.WindowsVersion.WINDOWS_SERVER_2012_RTM_ENGLISH_64BIT_2014_SP3_WEB",
+      "docs-public-apis:@aws-cdk/aws-ec2.WindowsVersion.WINDOWS_SERVER_2012_RTM_SWEDISH_64BIT_BASE",
+      "docs-public-apis:@aws-cdk/aws-ec2.WindowsVersion.WINDOWS_SERVER_2016_CHINESE_SIMPLIFIED_FULL_BASE",
+      "docs-public-apis:@aws-cdk/aws-ec2.WindowsVersion.WINDOWS_SERVER_2019_POLISH_FULL_BASE",
+      "docs-public-apis:@aws-cdk/aws-ec2.WindowsVersion.WINDOWS_SERVER_2008_R2_SP1_JAPANESE_64BIT_SQL_2008_R2_SP3_WEB",
+      "docs-public-apis:@aws-cdk/aws-ec2.WindowsVersion.WINDOWS_SERVER_2008_R2_SP1_PORTUGESE_BRAZIL_64BIT_BASE"
     ]
   },
   "stability": "stable"
diff --git a/packages/@aws-cdk/aws-ec2/test/test.instance.ts b/packages/@aws-cdk/aws-ec2/test/test.instance.ts
index 00afd846b123f..bbaea12bc9299 100644
--- a/packages/@aws-cdk/aws-ec2/test/test.instance.ts
+++ b/packages/@aws-cdk/aws-ec2/test/test.instance.ts
@@ -87,7 +87,7 @@ export = {
                   {
                     Ref: "AWS::AccountId"
                   },
-                  ":parameter",
+                  ":parameter/",
                   {
                     Ref: "Param165332EC"
                   }
diff --git a/packages/@aws-cdk/aws-ec2/test/test.security-group.ts b/packages/@aws-cdk/aws-ec2/test/test.security-group.ts
index 458aa4bffaeb4..d0e39d848e6dd 100644
--- a/packages/@aws-cdk/aws-ec2/test/test.security-group.ts
+++ b/packages/@aws-cdk/aws-ec2/test/test.security-group.ts
@@ -1,4 +1,4 @@
-import { expect, haveResource } from '@aws-cdk/assert';
+import { expect, haveResource, not } from '@aws-cdk/assert';
 import { Intrinsic, Lazy, Stack, Token } from '@aws-cdk/core';
 import { Test } from 'nodeunit';
 import { Peer, Port, SecurityGroup, Vpc } from "../lib";
@@ -112,6 +112,42 @@ export = {
     test.done();
   },
 
+  'immutable imports do not add rules'(test: Test) {
+    // GIVEN
+    const stack = new Stack();
+
+    // WHEN
+    const sg = SecurityGroup.fromSecurityGroupId(stack, 'SG1', "test-id", {mutable: false});
+    sg.addEgressRule(Peer.anyIpv4(), Port.tcp(86), 'This rule was not added');
+    sg.addIngressRule(Peer.anyIpv4(), Port.tcp(86), 'This rule was not added');
+
+    expect(stack).to(not(haveResource('AWS::EC2::SecurityGroup', {
+      SecurityGroupEgress: [
+        {
+          CidrIp: "0.0.0.0/0",
+          Description: "This rule was not added",
+          FromPort: 86,
+          IpProtocol: "tcp",
+          ToPort: 86
+        }
+      ],
+    })));
+
+    expect(stack).to(not(haveResource('AWS::EC2::SecurityGroup', {
+      SecurityGroupIngress: [
+        {
+          CidrIp: "0.0.0.0/0",
+          Description: "This rule was not added",
+          FromPort: 86,
+          IpProtocol: "tcp",
+          ToPort: 86
+        }
+      ],
+    })));
+
+    test.done();
+  },
+
   'peer between all types of peers and port range types'(test: Test) {
     // GIVEN
     const stack = new Stack(undefined, 'TestStack', { env: { account: '12345678', region: 'dummy' }});
diff --git a/packages/@aws-cdk/aws-ec2/test/test.vpc.ts b/packages/@aws-cdk/aws-ec2/test/test.vpc.ts
index ec7bda122c3ef..4d6021ed9902d 100644
--- a/packages/@aws-cdk/aws-ec2/test/test.vpc.ts
+++ b/packages/@aws-cdk/aws-ec2/test/test.vpc.ts
@@ -2,7 +2,7 @@ import { countResources, expect, haveResource, haveResourceLike, isSuperObject,
 import { CfnOutput, Lazy, Stack, Tag } from '@aws-cdk/core';
 import { Test } from 'nodeunit';
 import { AclCidr, AclTraffic, CfnSubnet, CfnVPC, DefaultInstanceTenancy, NetworkAcl, NetworkAclEntry,
-  Subnet, SubnetType, TrafficDirection, Vpc } from '../lib';
+  PrivateSubnet, Subnet, SubnetType, TrafficDirection, Vpc } from '../lib';
 
 export = {
   "When creating a VPC": {
@@ -164,8 +164,8 @@ export = {
         subnetConfiguration: [
           {
             cidrMask: 24,
-            subnetType: SubnetType.PRIVATE,
-            name: 'Private',
+            subnetType: SubnetType.PUBLIC,
+            name: 'Public',
           },
           {
             cidrMask: 24,
@@ -192,7 +192,7 @@ export = {
           {
             cidrMask: 24,
             name: 'ingress',
-            subnetType: SubnetType.PRIVATE,
+            subnetType: SubnetType.PUBLIC,
           },
           {
             cidrMask: 24,
@@ -415,6 +415,18 @@ export = {
       }
       test.done();
     },
+
+    'natGateways = 0 requires there to be no PRIVATE subnets'(test: Test) {
+      const stack = getTestStack();
+      test.throws(() => {
+        new Vpc(stack, 'VPC', {
+          natGateways: 0,
+        });
+      }, /make sure you don't configure any PRIVATE subnets/);
+      test.done();
+
+    },
+
     'with mis-matched nat and subnet configs it throws'(test: Test) {
       const stack = getTestStack();
       test.throws(() => new Vpc(stack, 'VPC', {
@@ -480,7 +492,7 @@ export = {
       const stack = getTestStack();
       new Vpc(stack, 'VPC', {
         subnetConfiguration: [
-          { subnetType: SubnetType.PRIVATE, name: 'Private' },
+          { subnetType: SubnetType.PUBLIC, name: 'Public' },
           { subnetType: SubnetType.ISOLATED, name: 'Isolated' },
         ],
         vpnGateway: true,
@@ -514,6 +526,7 @@ export = {
       const stack = getTestStack();
       new Vpc(stack, 'VPC', {
         subnetConfiguration: [
+          { subnetType: SubnetType.PUBLIC, name: 'Public' },
           { subnetType: SubnetType.PRIVATE, name: 'Private' },
           { subnetType: SubnetType.ISOLATED, name: 'Isolated' },
         ],
@@ -749,7 +762,7 @@ export = {
       const stack = getTestStack();
       const vpc = new Vpc(stack, 'VPC', {
         subnetConfiguration: [
-          { subnetType: SubnetType.PRIVATE, name: 'Private' },
+          { subnetType: SubnetType.PUBLIC, name: 'Public' },
           { subnetType: SubnetType.ISOLATED, name: 'Isolated' },
         ]
       });
@@ -768,6 +781,7 @@ export = {
       const stack = getTestStack();
       const vpc = new Vpc(stack, 'VPC', {
         subnetConfiguration: [
+          { subnetType: SubnetType.PUBLIC, name: 'BlaBla' },
           { subnetType: SubnetType.PRIVATE, name: 'DontTalkToMe' },
           { subnetType: SubnetType.ISOLATED, name: 'DontTalkAtAll' },
         ]
@@ -786,6 +800,7 @@ export = {
       const stack = getTestStack();
       const vpc = new Vpc(stack, 'VPC', {
         subnetConfiguration: [
+          { subnetType: SubnetType.PUBLIC, name: 'BlaBla' },
           { subnetType: SubnetType.PRIVATE, name: 'DontTalkToMe' },
           { subnetType: SubnetType.ISOLATED, name: 'DontTalkAtAll' },
         ]
@@ -799,7 +814,25 @@ export = {
       test.done();
     },
 
-    'selecting default subnets in a VPC with only public subnets throws an error'(test: Test) {
+    'selecting default subnets in a VPC with only isolated subnets returns the isolateds'(test: Test) {
+      // GIVEN
+      const stack = new Stack();
+      const vpc = Vpc.fromVpcAttributes(stack, 'VPC', {
+        vpcId: 'vpc-1234',
+        availabilityZones: ['dummy1a', 'dummy1b', 'dummy1c'],
+        isolatedSubnetIds: ['iso-1', 'iso-2', 'iso-3'],
+        isolatedSubnetRouteTableIds: ['rt-1', 'rt-2', 'rt-3'],
+      });
+
+      // WHEN
+      const subnets = vpc.selectSubnets();
+
+      // THEN
+      test.deepEqual(subnets.subnetIds, ['iso-1', 'iso-2', 'iso-3']);
+      test.done();
+    },
+
+    'selecting default subnets in a VPC with only public subnets returns the publics'(test: Test) {
       // GIVEN
       const stack = new Stack();
       const vpc = Vpc.fromVpcAttributes(stack, 'VPC', {
@@ -809,10 +842,11 @@ export = {
         publicSubnetRouteTableIds: ['rt-1', 'rt-2', 'rt-3'],
       });
 
-      test.throws(() => {
-        vpc.selectSubnets();
-      }, /There are no 'Private' subnet groups in this VPC. Available types: Public/);
+      // WHEN
+      const subnets = vpc.selectSubnets();
 
+      // THEN
+      test.deepEqual(subnets.subnetIds, ['pub-1', 'pub-2', 'pub-3']);
       test.done();
     },
 
@@ -834,6 +868,7 @@ export = {
       const vpc = new Vpc(stack, 'VpcNetwork', {
         maxAzs: 1,
         subnetConfiguration: [
+          {name: 'lb', subnetType: SubnetType.PUBLIC },
           {name: 'app', subnetType: SubnetType.PRIVATE },
           {name: 'db', subnetType: SubnetType.PRIVATE },
         ]
@@ -846,6 +881,30 @@ export = {
       test.deepEqual(subnetIds.length, 1);
       test.deepEqual(subnetIds[0], vpc.privateSubnets[0].subnetId);
       test.done();
+    },
+
+    'select explicitly defined subnets'(test: Test) {
+      // GIVEN
+      const stack = getTestStack();
+      const vpc = Vpc.fromVpcAttributes(stack, 'VPC', {
+        vpcId: 'vpc-1234',
+        availabilityZones: ['dummy1a', 'dummy1b', 'dummy1c'],
+        publicSubnetIds: ['pub-1', 'pub-2', 'pub-3'],
+        publicSubnetRouteTableIds: ['rt-1', 'rt-2', 'rt-3'],
+      });
+      const subnet = new PrivateSubnet(stack, 'Subnet', {
+        availabilityZone: vpc.availabilityZones[0],
+        cidrBlock: '10.0.0.0/28',
+        vpcId: vpc.vpcId
+      });
+
+      // WHEN
+      const { subnetIds } = vpc.selectSubnets({ subnets: [subnet] });
+
+      // THEN
+      test.deepEqual(subnetIds.length, 1);
+      test.deepEqual(subnetIds[0], subnet.subnetId);
+      test.done();
     }
   },
 
diff --git a/packages/@aws-cdk/aws-ecr-assets/lib/image-asset.ts b/packages/@aws-cdk/aws-ecr-assets/lib/image-asset.ts
index 662883cc72bd0..bc51c8f13a0c6 100644
--- a/packages/@aws-cdk/aws-ecr-assets/lib/image-asset.ts
+++ b/packages/@aws-cdk/aws-ecr-assets/lib/image-asset.ts
@@ -96,7 +96,7 @@ export class DockerImageAsset extends Construct implements assets.IAsset {
       directoryName: staging.stagedPath,
       dockerBuildArgs: props.buildArgs,
       dockerBuildTarget: props.target,
-      repositoryName: props.repositoryName,
+      repositoryName: props.repositoryName || `cdk/${this.node.uniqueId.replace(/[:/]/g, '-').toLowerCase()}`,
       sourceHash: staging.sourceHash
     });
 
diff --git a/packages/@aws-cdk/aws-ecr-assets/package.json b/packages/@aws-cdk/aws-ecr-assets/package.json
index f4a71e072b20e..fa073b90432b2 100644
--- a/packages/@aws-cdk/aws-ecr-assets/package.json
+++ b/packages/@aws-cdk/aws-ecr-assets/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@aws-cdk/aws-ecr-assets",
-  "version": "1.13.1",
+  "version": "1.15.0",
   "description": "Docker image assets deployed to ECR",
   "main": "lib/index.js",
   "types": "lib/index.d.ts",
@@ -60,34 +60,34 @@
   },
   "license": "Apache-2.0",
   "devDependencies": {
-    "@aws-cdk/assert": "1.13.1",
+    "@aws-cdk/assert": "1.15.0",
     "@types/proxyquire": "^1.3.28",
-    "aws-cdk": "1.13.1",
-    "cdk-build-tools": "^1.13.1",
-    "cdk-integ-tools": "^1.13.1",
-    "pkglint": "^1.13.1",
+    "aws-cdk": "1.15.0",
+    "cdk-build-tools": "^1.15.0",
+    "cdk-integ-tools": "^1.15.0",
+    "pkglint": "^1.15.0",
     "proxyquire": "^2.1.3"
   },
   "dependencies": {
-    "@aws-cdk/assets": "1.13.1",
-    "@aws-cdk/aws-cloudformation": "1.13.1",
-    "@aws-cdk/aws-ecr": "1.13.1",
-    "@aws-cdk/aws-iam": "1.13.1",
-    "@aws-cdk/aws-lambda": "1.13.1",
-    "@aws-cdk/aws-s3": "1.13.1",
-    "@aws-cdk/core": "1.13.1",
-    "@aws-cdk/cx-api": "1.13.1"
+    "@aws-cdk/assets": "1.15.0",
+    "@aws-cdk/aws-cloudformation": "1.15.0",
+    "@aws-cdk/aws-ecr": "1.15.0",
+    "@aws-cdk/aws-iam": "1.15.0",
+    "@aws-cdk/aws-lambda": "1.15.0",
+    "@aws-cdk/aws-s3": "1.15.0",
+    "@aws-cdk/core": "1.15.0",
+    "@aws-cdk/cx-api": "1.15.0"
   },
   "homepage": "https://github.com/aws/aws-cdk",
   "peerDependencies": {
-    "@aws-cdk/assets": "1.13.1",
-    "@aws-cdk/aws-cloudformation": "1.13.1",
-    "@aws-cdk/aws-ecr": "1.13.1",
-    "@aws-cdk/aws-iam": "1.13.1",
-    "@aws-cdk/aws-lambda": "1.13.1",
-    "@aws-cdk/aws-s3": "1.13.1",
-    "@aws-cdk/core": "1.13.1",
-    "@aws-cdk/cx-api": "1.13.1"
+    "@aws-cdk/assets": "1.15.0",
+    "@aws-cdk/aws-cloudformation": "1.15.0",
+    "@aws-cdk/aws-ecr": "1.15.0",
+    "@aws-cdk/aws-iam": "1.15.0",
+    "@aws-cdk/aws-lambda": "1.15.0",
+    "@aws-cdk/aws-s3": "1.15.0",
+    "@aws-cdk/core": "1.15.0",
+    "@aws-cdk/cx-api": "1.15.0"
   },
   "nyc": {
     "statements": 70
@@ -95,5 +95,10 @@
   "engines": {
     "node": ">= 10.3.0"
   },
-  "stability": "experimental"
+  "stability": "experimental",
+  "awslint": {
+    "exclude": [
+      "docs-public-apis:@aws-cdk/aws-ecr-assets.DockerImageAssetProps"
+    ]
+  }
 }
diff --git a/packages/@aws-cdk/aws-ecr-assets/test/test.image-asset.ts b/packages/@aws-cdk/aws-ecr-assets/test/test.image-asset.ts
index 955d0e8e3d98a..5ba6e96e2ab3e 100644
--- a/packages/@aws-cdk/aws-ecr-assets/test/test.image-asset.ts
+++ b/packages/@aws-cdk/aws-ecr-assets/test/test.image-asset.ts
@@ -1,6 +1,7 @@
 import { expect, haveResource, SynthUtils } from '@aws-cdk/assert';
 import iam = require('@aws-cdk/aws-iam');
-import { App, Lazy, Stack } from '@aws-cdk/core';
+import { App, Construct, Lazy, Resource, Stack } from '@aws-cdk/core';
+import { ASSET_METADATA } from '@aws-cdk/cx-api';
 import fs = require('fs');
 import { Test } from 'nodeunit';
 import path = require('path');
@@ -28,6 +29,27 @@ export = {
     test.done();
   },
 
+  'repository name is derived from node unique id'(test: Test) {
+    // GIVEN
+    const stack = new Stack();
+    class CoolConstruct extends Resource {
+      constructor(scope: Construct, id: string) {
+        super(scope, id);
+      }
+    }
+    const coolConstruct = new CoolConstruct(stack, 'CoolConstruct');
+
+    // WHEN
+    new DockerImageAsset(coolConstruct, 'Image', {
+      directory: path.join(__dirname, 'demo-image'),
+    });
+
+    // THEN
+    const assetMetadata = stack.node.metadata.find(({ type }) => type === ASSET_METADATA);
+    test.deepEqual(assetMetadata && assetMetadata.data.repositoryName, 'cdk/coolconstructimage78ab38fc');
+    test.done();
+  },
+
   'with build args'(test: Test) {
     // GIVEN
     const stack = new Stack();
@@ -41,7 +63,7 @@ export = {
     });
 
     // THEN
-    const assetMetadata = stack.node.metadata.find(({ type }) => type === 'aws:cdk:asset');
+    const assetMetadata = stack.node.metadata.find(({ type }) => type === ASSET_METADATA);
     test.deepEqual(assetMetadata && assetMetadata.data.buildArgs, { a: 'b' });
     test.done();
   },
@@ -60,7 +82,7 @@ export = {
     });
 
     // THEN
-    const assetMetadata = stack.node.metadata.find(({ type }) => type === 'aws:cdk:asset');
+    const assetMetadata = stack.node.metadata.find(({ type }) => type === ASSET_METADATA);
     test.deepEqual(assetMetadata && assetMetadata.data.target, 'a-target');
     test.done();
   },
diff --git a/packages/@aws-cdk/aws-ecr/package.json b/packages/@aws-cdk/aws-ecr/package.json
index 4088b583c34c2..8a8f730ae6c80 100644
--- a/packages/@aws-cdk/aws-ecr/package.json
+++ b/packages/@aws-cdk/aws-ecr/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@aws-cdk/aws-ecr",
-  "version": "1.13.1",
+  "version": "1.15.0",
   "description": "The CDK Construct Library for AWS::ECR",
   "main": "lib/index.js",
   "types": "lib/index.d.ts",
@@ -67,22 +67,22 @@
   },
   "license": "Apache-2.0",
   "devDependencies": {
-    "@aws-cdk/assert": "1.13.1",
-    "cdk-build-tools": "^1.13.1",
-    "cdk-integ-tools": "^1.13.1",
-    "cfn2ts": "^1.13.1",
-    "pkglint": "^1.13.1"
+    "@aws-cdk/assert": "1.15.0",
+    "cdk-build-tools": "^1.15.0",
+    "cdk-integ-tools": "^1.15.0",
+    "cfn2ts": "^1.15.0",
+    "pkglint": "^1.15.0"
   },
   "dependencies": {
-    "@aws-cdk/aws-events": "1.13.1",
-    "@aws-cdk/aws-iam": "1.13.1",
-    "@aws-cdk/core": "1.13.1"
+    "@aws-cdk/aws-events": "1.15.0",
+    "@aws-cdk/aws-iam": "1.15.0",
+    "@aws-cdk/core": "1.15.0"
   },
   "homepage": "https://github.com/aws/aws-cdk",
   "peerDependencies": {
-    "@aws-cdk/aws-events": "1.13.1",
-    "@aws-cdk/aws-iam": "1.13.1",
-    "@aws-cdk/core": "1.13.1"
+    "@aws-cdk/aws-events": "1.15.0",
+    "@aws-cdk/aws-iam": "1.15.0",
+    "@aws-cdk/core": "1.15.0"
   },
   "engines": {
     "node": ">= 10.3.0"
@@ -90,7 +90,16 @@
   "awslint": {
     "exclude": [
       "import:@aws-cdk/aws-ecr.Repository",
-      "construct-base-is-private:@aws-cdk/aws-ecr.RepositoryBase"
+      "construct-base-is-private:@aws-cdk/aws-ecr.RepositoryBase",
+      "docs-public-apis:@aws-cdk/aws-ecr.Repository.fromRepositoryArn",
+      "docs-public-apis:@aws-cdk/aws-ecr.Repository.fromRepositoryName",
+      "props-default-doc:@aws-cdk/aws-ecr.LifecycleRule.maxImageAge",
+      "props-default-doc:@aws-cdk/aws-ecr.LifecycleRule.maxImageCount",
+      "props-default-doc:@aws-cdk/aws-ecr.LifecycleRule.tagPrefixList",
+      "docs-public-apis:@aws-cdk/aws-ecr.RepositoryAttributes",
+      "docs-public-apis:@aws-cdk/aws-ecr.RepositoryAttributes.repositoryArn",
+      "docs-public-apis:@aws-cdk/aws-ecr.RepositoryAttributes.repositoryName",
+      "docs-public-apis:@aws-cdk/aws-ecr.RepositoryProps"
     ]
   },
   "stability": "stable"
diff --git a/packages/@aws-cdk/aws-ecs-patterns/lib/base/application-load-balanced-service-base.ts b/packages/@aws-cdk/aws-ecs-patterns/lib/base/application-load-balanced-service-base.ts
index 3ddbfd71bff7e..605bc9db0f103 100644
--- a/packages/@aws-cdk/aws-ecs-patterns/lib/base/application-load-balanced-service-base.ts
+++ b/packages/@aws-cdk/aws-ecs-patterns/lib/base/application-load-balanced-service-base.ts
@@ -203,6 +203,13 @@ export interface ApplicationLoadBalancedTaskImageOptions {
    * @default 80
    */
   readonly containerPort?: number;
+
+  /**
+   * The name of a family that this task definition is registered to. A family groups multiple versions of a task definition.
+   *
+   * @default - Automatically generated name.
+   */
+  readonly family?: string;
 }
 
 /**
diff --git a/packages/@aws-cdk/aws-ecs-patterns/lib/base/network-load-balanced-service-base.ts b/packages/@aws-cdk/aws-ecs-patterns/lib/base/network-load-balanced-service-base.ts
index 0757bf9117e3e..d3a92f867168a 100644
--- a/packages/@aws-cdk/aws-ecs-patterns/lib/base/network-load-balanced-service-base.ts
+++ b/packages/@aws-cdk/aws-ecs-patterns/lib/base/network-load-balanced-service-base.ts
@@ -181,6 +181,13 @@ export interface NetworkLoadBalancedTaskImageOptions {
    * @default 80
    */
   readonly containerPort?: number;
+
+  /**
+   * The name of a family that this task definition is registered to. A family groups multiple versions of a task definition.
+   *
+   * @default - Automatically generated name.
+   */
+  readonly family?: string;
 }
 
 /**
diff --git a/packages/@aws-cdk/aws-ecs-patterns/lib/base/queue-processing-service-base.ts b/packages/@aws-cdk/aws-ecs-patterns/lib/base/queue-processing-service-base.ts
index 13dd8c526ff35..2954881272b8a 100644
--- a/packages/@aws-cdk/aws-ecs-patterns/lib/base/queue-processing-service-base.ts
+++ b/packages/@aws-cdk/aws-ecs-patterns/lib/base/queue-processing-service-base.ts
@@ -8,6 +8,13 @@ import { CfnOutput, Construct, Stack } from '@aws-cdk/core';
  * The properties for the base QueueProcessingEc2Service or QueueProcessingFargateService service.
  */
 export interface QueueProcessingServiceBaseProps {
+  /**
+   * The name of the service.
+   *
+   * @default - CloudFormation-generated name.
+   */
+  readonly serviceName?: string;
+
   /**
    * The name of the cluster that hosts the service.
    *
diff --git a/packages/@aws-cdk/aws-ecs-patterns/lib/ecs/application-load-balanced-ecs-service.ts b/packages/@aws-cdk/aws-ecs-patterns/lib/ecs/application-load-balanced-ecs-service.ts
index 38e03326f9b26..d29fe3fb2778e 100644
--- a/packages/@aws-cdk/aws-ecs-patterns/lib/ecs/application-load-balanced-ecs-service.ts
+++ b/packages/@aws-cdk/aws-ecs-patterns/lib/ecs/application-load-balanced-ecs-service.ts
@@ -92,7 +92,8 @@ export class ApplicationLoadBalancedEc2Service extends ApplicationLoadBalancedSe
       const taskImageOptions = props.taskImageOptions;
       this.taskDefinition = new Ec2TaskDefinition(this, 'TaskDef', {
         executionRole: taskImageOptions.executionRole,
-        taskRole: taskImageOptions.taskRole
+        taskRole: taskImageOptions.taskRole,
+        family: taskImageOptions.family,
       });
 
       // Create log driver if logging is enabled
diff --git a/packages/@aws-cdk/aws-ecs-patterns/lib/ecs/network-load-balanced-ecs-service.ts b/packages/@aws-cdk/aws-ecs-patterns/lib/ecs/network-load-balanced-ecs-service.ts
index 2415ede78a4e1..9f699c334198c 100644
--- a/packages/@aws-cdk/aws-ecs-patterns/lib/ecs/network-load-balanced-ecs-service.ts
+++ b/packages/@aws-cdk/aws-ecs-patterns/lib/ecs/network-load-balanced-ecs-service.ts
@@ -90,7 +90,8 @@ export class NetworkLoadBalancedEc2Service extends NetworkLoadBalancedServiceBas
       const taskImageOptions = props.taskImageOptions;
       this.taskDefinition = new Ec2TaskDefinition(this, 'TaskDef', {
         executionRole: taskImageOptions.executionRole,
-        taskRole: taskImageOptions.taskRole
+        taskRole: taskImageOptions.taskRole,
+        family: taskImageOptions.family,
       });
 
       // Create log driver if logging is enabled
diff --git a/packages/@aws-cdk/aws-ecs-patterns/lib/ecs/queue-processing-ecs-service.ts b/packages/@aws-cdk/aws-ecs-patterns/lib/ecs/queue-processing-ecs-service.ts
index 70a3532cec3b5..be566bcd0a5ba 100644
--- a/packages/@aws-cdk/aws-ecs-patterns/lib/ecs/queue-processing-ecs-service.ts
+++ b/packages/@aws-cdk/aws-ecs-patterns/lib/ecs/queue-processing-ecs-service.ts
@@ -95,6 +95,7 @@ export class QueueProcessingEc2Service extends QueueProcessingServiceBase {
       cluster: this.cluster,
       desiredCount: this.desiredCount,
       taskDefinition: this.taskDefinition,
+      serviceName: props.serviceName,
       propagateTags: props.propagateTags,
       enableECSManagedTags: props.enableECSManagedTags,
     });
diff --git a/packages/@aws-cdk/aws-ecs-patterns/lib/fargate/application-load-balanced-fargate-service.ts b/packages/@aws-cdk/aws-ecs-patterns/lib/fargate/application-load-balanced-fargate-service.ts
index 5f38ee8ede9e5..bb6ef7133396c 100644
--- a/packages/@aws-cdk/aws-ecs-patterns/lib/fargate/application-load-balanced-fargate-service.ts
+++ b/packages/@aws-cdk/aws-ecs-patterns/lib/fargate/application-load-balanced-fargate-service.ts
@@ -103,7 +103,8 @@ export class ApplicationLoadBalancedFargateService extends ApplicationLoadBalanc
         memoryLimitMiB: props.memoryLimitMiB,
         cpu: props.cpu,
         executionRole: taskImageOptions.executionRole,
-        taskRole: taskImageOptions.taskRole
+        taskRole: taskImageOptions.taskRole,
+        family: taskImageOptions.family,
       });
 
       // Create log driver if logging is enabled
diff --git a/packages/@aws-cdk/aws-ecs-patterns/lib/fargate/network-load-balanced-fargate-service.ts b/packages/@aws-cdk/aws-ecs-patterns/lib/fargate/network-load-balanced-fargate-service.ts
index 9579de0382654..634392df497d5 100644
--- a/packages/@aws-cdk/aws-ecs-patterns/lib/fargate/network-load-balanced-fargate-service.ts
+++ b/packages/@aws-cdk/aws-ecs-patterns/lib/fargate/network-load-balanced-fargate-service.ts
@@ -99,7 +99,8 @@ export class NetworkLoadBalancedFargateService extends NetworkLoadBalancedServic
         memoryLimitMiB: props.memoryLimitMiB,
         cpu: props.cpu,
         executionRole: taskImageOptions.executionRole,
-        taskRole: taskImageOptions.taskRole
+        taskRole: taskImageOptions.taskRole,
+        family: taskImageOptions.family,
       });
 
       // Create log driver if logging is enabled
diff --git a/packages/@aws-cdk/aws-ecs-patterns/lib/fargate/queue-processing-fargate-service.ts b/packages/@aws-cdk/aws-ecs-patterns/lib/fargate/queue-processing-fargate-service.ts
index 853dfa7782d83..9a02bacbf6584 100644
--- a/packages/@aws-cdk/aws-ecs-patterns/lib/fargate/queue-processing-fargate-service.ts
+++ b/packages/@aws-cdk/aws-ecs-patterns/lib/fargate/queue-processing-fargate-service.ts
@@ -89,6 +89,7 @@ export class QueueProcessingFargateService extends QueueProcessingServiceBase {
       cluster: this.cluster,
       desiredCount: this.desiredCount,
       taskDefinition: this.taskDefinition,
+      serviceName: props.serviceName,
       propagateTags: props.propagateTags,
       enableECSManagedTags: props.enableECSManagedTags,
     });
diff --git a/packages/@aws-cdk/aws-ecs-patterns/package.json b/packages/@aws-cdk/aws-ecs-patterns/package.json
index 1762ae2a0976c..c2a0e3b2ab495 100644
--- a/packages/@aws-cdk/aws-ecs-patterns/package.json
+++ b/packages/@aws-cdk/aws-ecs-patterns/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@aws-cdk/aws-ecs-patterns",
-  "version": "1.13.1",
+  "version": "1.15.0",
   "description": "CDK Constructs for AWS ECS",
   "main": "lib/index.js",
   "types": "lib/index.d.ts",
@@ -61,46 +61,54 @@
   },
   "license": "Apache-2.0",
   "devDependencies": {
-    "@aws-cdk/assert": "1.13.1",
-    "cdk-build-tools": "^1.13.1",
-    "cdk-integ-tools": "^1.13.1",
-    "cfn2ts": "^1.13.1",
+    "@aws-cdk/assert": "1.15.0",
+    "cdk-build-tools": "^1.15.0",
+    "cdk-integ-tools": "^1.15.0",
+    "cfn2ts": "^1.15.0",
     "jest": "^24.9.0",
-    "pkglint": "^1.13.1"
+    "pkglint": "^1.15.0"
   },
   "dependencies": {
-    "@aws-cdk/aws-applicationautoscaling": "1.13.1",
-    "@aws-cdk/aws-certificatemanager": "1.13.1",
-    "@aws-cdk/aws-ec2": "1.13.1",
-    "@aws-cdk/aws-ecs": "1.13.1",
-    "@aws-cdk/aws-elasticloadbalancingv2": "1.13.1",
-    "@aws-cdk/aws-events": "1.13.1",
-    "@aws-cdk/aws-events-targets": "1.13.1",
-    "@aws-cdk/aws-iam": "1.13.1",
-    "@aws-cdk/aws-route53": "1.13.1",
-    "@aws-cdk/aws-route53-targets": "1.13.1",
-    "@aws-cdk/aws-servicediscovery": "1.13.1",
-    "@aws-cdk/aws-sqs": "1.13.1",
-    "@aws-cdk/core": "1.13.1"
+    "@aws-cdk/aws-applicationautoscaling": "1.15.0",
+    "@aws-cdk/aws-certificatemanager": "1.15.0",
+    "@aws-cdk/aws-ec2": "1.15.0",
+    "@aws-cdk/aws-ecs": "1.15.0",
+    "@aws-cdk/aws-elasticloadbalancingv2": "1.15.0",
+    "@aws-cdk/aws-events": "1.15.0",
+    "@aws-cdk/aws-events-targets": "1.15.0",
+    "@aws-cdk/aws-iam": "1.15.0",
+    "@aws-cdk/aws-route53": "1.15.0",
+    "@aws-cdk/aws-route53-targets": "1.15.0",
+    "@aws-cdk/aws-servicediscovery": "1.15.0",
+    "@aws-cdk/aws-sqs": "1.15.0",
+    "@aws-cdk/core": "1.15.0"
   },
   "homepage": "https://github.com/aws/aws-cdk",
   "peerDependencies": {
-    "@aws-cdk/aws-applicationautoscaling": "1.13.1",
-    "@aws-cdk/aws-certificatemanager": "1.13.1",
-    "@aws-cdk/aws-ec2": "1.13.1",
-    "@aws-cdk/aws-ecs": "1.13.1",
-    "@aws-cdk/aws-elasticloadbalancingv2": "1.13.1",
-    "@aws-cdk/aws-events": "1.13.1",
-    "@aws-cdk/aws-events-targets": "1.13.1",
-    "@aws-cdk/aws-iam": "1.13.1",
-    "@aws-cdk/aws-route53": "1.13.1",
-    "@aws-cdk/aws-route53-targets": "1.13.1",
-    "@aws-cdk/aws-servicediscovery": "1.13.1",
-    "@aws-cdk/aws-sqs": "1.13.1",
-    "@aws-cdk/core": "1.13.1"
+    "@aws-cdk/aws-applicationautoscaling": "1.15.0",
+    "@aws-cdk/aws-certificatemanager": "1.15.0",
+    "@aws-cdk/aws-ec2": "1.15.0",
+    "@aws-cdk/aws-ecs": "1.15.0",
+    "@aws-cdk/aws-elasticloadbalancingv2": "1.15.0",
+    "@aws-cdk/aws-events": "1.15.0",
+    "@aws-cdk/aws-events-targets": "1.15.0",
+    "@aws-cdk/aws-iam": "1.15.0",
+    "@aws-cdk/aws-route53": "1.15.0",
+    "@aws-cdk/aws-route53-targets": "1.15.0",
+    "@aws-cdk/aws-servicediscovery": "1.15.0",
+    "@aws-cdk/aws-sqs": "1.15.0",
+    "@aws-cdk/core": "1.15.0"
   },
   "engines": {
     "node": ">= 10.3.0"
   },
-  "stability": "stable"
+  "stability": "stable",
+  "awslint": {
+    "exclude": [
+      "docs-public-apis:@aws-cdk/aws-ecs-patterns.NetworkLoadBalancedFargateService.assignPublicIp",
+      "docs-public-apis:@aws-cdk/aws-ecs-patterns.ApplicationLoadBalancedTaskImageOptions",
+      "docs-public-apis:@aws-cdk/aws-ecs-patterns.NetworkLoadBalancedTaskImageOptions",
+      "docs-public-apis:@aws-cdk/aws-ecs-patterns.ScheduledTaskImageProps"
+    ]
+  }
 }
diff --git a/packages/@aws-cdk/aws-ecs-patterns/test/ec2/test.queue-processing-ecs-service.ts b/packages/@aws-cdk/aws-ecs-patterns/test/ec2/test.queue-processing-ecs-service.ts
index 80e0bcd6d71bb..f607cc6a458dd 100644
--- a/packages/@aws-cdk/aws-ecs-patterns/test/ec2/test.queue-processing-ecs-service.ts
+++ b/packages/@aws-cdk/aws-ecs-patterns/test/ec2/test.queue-processing-ecs-service.ts
@@ -90,13 +90,15 @@ export = {
       },
       queue,
       maxScalingCapacity: 5,
+      serviceName: "ecs-test-service",
       family: "ecs-task-family"
     });
 
     // THEN - QueueWorker is of EC2 launch type, an SQS queue is created and all optional properties are set.
     expect(stack).to(haveResource("AWS::ECS::Service", {
       DesiredCount: 2,
-      LaunchType: "EC2"
+      LaunchType: "EC2",
+      ServiceName: "ecs-test-service"
     }));
 
     expect(stack).to(haveResource("AWS::SQS::Queue", {
diff --git a/packages/@aws-cdk/aws-ecs-patterns/test/fargate/test.load-balanced-fargate-service.ts b/packages/@aws-cdk/aws-ecs-patterns/test/fargate/test.load-balanced-fargate-service.ts
index 0990f7728e250..e723a0f1c6959 100644
--- a/packages/@aws-cdk/aws-ecs-patterns/test/fargate/test.load-balanced-fargate-service.ts
+++ b/packages/@aws-cdk/aws-ecs-patterns/test/fargate/test.load-balanced-fargate-service.ts
@@ -1,4 +1,4 @@
-import { expect, haveResourceLike, SynthUtils } from '@aws-cdk/assert';
+import { expect, haveResource, haveResourceLike, SynthUtils } from '@aws-cdk/assert';
 import ec2 = require('@aws-cdk/aws-ec2');
 import ecs = require('@aws-cdk/aws-ecs');
 import iam = require('@aws-cdk/aws-iam');
@@ -202,4 +202,57 @@ export = {
     test.done();
   },
 
+  'test load balanced service with family defined'(test: Test) {
+    // GIVEN
+    const stack = new cdk.Stack();
+    const vpc = new ec2.Vpc(stack, 'VPC');
+    const cluster = new ecs.Cluster(stack, 'Cluster', { vpc });
+    cluster.addCapacity('DefaultAutoScalingGroup', { instanceType: new ec2.InstanceType('t2.micro') });
+
+    // WHEN
+    new ecsPatterns.ApplicationLoadBalancedFargateService(stack, 'Service', {
+      cluster,
+      taskImageOptions: {
+        image: ecs.ContainerImage.fromRegistry("/aws/aws-example-app"),
+        enableLogging: false,
+        environment: {
+          TEST_ENVIRONMENT_VARIABLE1: "test environment variable 1 value",
+          TEST_ENVIRONMENT_VARIABLE2: "test environment variable 2 value"
+        },
+        family: "fargate-task-family",
+      },
+      desiredCount: 2,
+      memoryLimitMiB: 512,
+      serviceName: "fargate-test-service",
+    });
+
+    // THEN
+    expect(stack).to(haveResource("AWS::ECS::Service", {
+      DesiredCount: 2,
+      LaunchType: "FARGATE",
+      ServiceName: "fargate-test-service"
+    }));
+
+    expect(stack).to(haveResourceLike('AWS::ECS::TaskDefinition', {
+      ContainerDefinitions: [
+        {
+          Environment: [
+            {
+              Name: "TEST_ENVIRONMENT_VARIABLE1",
+              Value: "test environment variable 1 value"
+            },
+            {
+              Name: "TEST_ENVIRONMENT_VARIABLE2",
+              Value: "test environment variable 2 value"
+            }
+          ],
+          Image: "/aws/aws-example-app",
+        }
+      ],
+      Family: "fargate-task-family"
+    }));
+
+    test.done();
+  },
+
 };
diff --git a/packages/@aws-cdk/aws-ecs-patterns/test/fargate/test.queue-processing-fargate-service.ts b/packages/@aws-cdk/aws-ecs-patterns/test/fargate/test.queue-processing-fargate-service.ts
index 41d6cc6c13009..dbe2e2ac6f49c 100644
--- a/packages/@aws-cdk/aws-ecs-patterns/test/fargate/test.queue-processing-fargate-service.ts
+++ b/packages/@aws-cdk/aws-ecs-patterns/test/fargate/test.queue-processing-fargate-service.ts
@@ -88,13 +88,15 @@ export = {
       },
       queue,
       maxScalingCapacity: 5,
+      serviceName: "fargate-test-service",
       family: "fargate-task-family"
     });
 
     // THEN - QueueWorker is of FARGATE launch type, an SQS queue is created and all optional properties are set.
     expect(stack).to(haveResource("AWS::ECS::Service", {
       DesiredCount: 2,
-      LaunchType: "FARGATE"
+      LaunchType: "FARGATE",
+      ServiceName: "fargate-test-service"
     }));
 
     expect(stack).to(haveResource("AWS::SQS::Queue", { QueueName: 'fargate-test-sqs-queue' }));
diff --git a/packages/@aws-cdk/aws-ecs/README.md b/packages/@aws-cdk/aws-ecs/README.md
index bf12090f992be..446fb8ed1dd63 100644
--- a/packages/@aws-cdk/aws-ecs/README.md
+++ b/packages/@aws-cdk/aws-ecs/README.md
@@ -276,30 +276,21 @@ const service = new ecs.FargateService(this, 'Service', { /* ... */ });
 
 const lb = new elbv2.ApplicationLoadBalancer(this, 'LB', { vpc, internetFacing: true });
 const listener = lb.addListener('Listener', { port: 80 });
-const target = listener.addTargets('ECS', {
+const targetGroup1 = listener.addTargets('ECS1', {
   port: 80,
   targets: [service]
 });
-```
-
-Note that in the example above, if you have multiple containers with multiple ports, then only the first essential container along with its first added container port will be registered as target. To have more control over which container and port to register as targets:
-
-```ts
-import elbv2 = require('@aws-cdk/aws-elasticloadbalancingv2');
-
-const service = new ecs.FargateService(this, 'Service', { /* ... */ });
-
-const lb = new elbv2.ApplicationLoadBalancer(this, 'LB', { vpc, internetFacing: true });
-const listener = lb.addListener('Listener', { port: 80 });
-const target = listener.addTargets('ECS', {
+const targetGroup2 = listener.addTargets('ECS2', {
   port: 80,
   targets: [service.loadBalancerTarget({
     containerName: 'MyContainer',
-    containerPort: 12345
+    containerPort: 8080
   })]
 });
 ```
 
+Note that in the example above, the default `service` only allows you to register the first essential container or the first mapped port on the container as a target and add it to a new target group. To have more control over which container and port to register as targets, you can use `service.loadBalancerTarget()` to return a load balancing target for a specific container and port.
+
 Alternatively, you can also create all load balancer targets to be registered in this service, add them to target groups, and attach target groups to listeners accordingly.
 
 ```ts
@@ -323,6 +314,21 @@ service.registerLoadBalancerTargets(
 );
 ```
 
+### Using a Load Balancer from a different Stack
+
+If you want to put your Load Balancer and the Service it is load balancing to in
+different stacks, you may not be able to use the convenience methods
+`loadBalancer.addListener()` and `listener.addTargets()`.
+
+The reason is that these methods will create resources in the same Stack as the
+object they're called on, which may lead to cyclic references between stacks.
+Instead, you will have to create an `ApplicationListener` in the service stack,
+or an empty `TargetGroup` in the load balancer stack that you attach your
+service to.
+
+See the [ecs/cross-stack-load-balancer example](https://github.com/aws-samples/aws-cdk-examples/tree/master/typescript/ecs/cross-stack-load-balancer/)
+for the alternatives.
+
 ### Include a classic load balancer
 `Services` can also be directly attached to a classic load balancer as targets:
 
@@ -454,7 +460,7 @@ Currently Supported Log Drivers:
 - journald
 - json-file
 - splunk
-- syslog  
+- syslog
 
 ### awslogs Log Driver
 
diff --git a/packages/@aws-cdk/aws-ecs/lib/base/base-service.ts b/packages/@aws-cdk/aws-ecs/lib/base/base-service.ts
index d66a806f8a71e..168064d6b7db9 100644
--- a/packages/@aws-cdk/aws-ecs/lib/base/base-service.ts
+++ b/packages/@aws-cdk/aws-ecs/lib/base/base-service.ts
@@ -368,7 +368,7 @@ export abstract class BaseService extends Resource
    *
    * @example
    *
-   * listener.addTarget(service.loadBalancerTarget({
+   * listener.addTargets(service.loadBalancerTarget({
    *   containerName: 'MyContainer',
    *   containerPort: 1234
    * }));
@@ -396,6 +396,8 @@ export abstract class BaseService extends Resource
    * Use this function to create all load balancer targets to be registered in this service, add them to
    * target groups, and attach target groups to listeners accordingly.
    *
+   * Alternatively, you can use `listener.addTargets()` to create targets and add them to target groups.
+   *
    * @example
    *
    * service.registerLoadBalancerTargets(
diff --git a/packages/@aws-cdk/aws-ecs/lib/container-definition.ts b/packages/@aws-cdk/aws-ecs/lib/container-definition.ts
index 0cf1e89605ce5..4b730b6007259 100644
--- a/packages/@aws-cdk/aws-ecs/lib/container-definition.ts
+++ b/packages/@aws-cdk/aws-ecs/lib/container-definition.ts
@@ -128,6 +128,20 @@ export interface ContainerDefinitionOptions {
    */
   readonly secrets?: { [key: string]: Secret };
 
+  /**
+   * Time duration (in seconds) to wait before giving up on resolving dependencies for a container.
+   *
+   * @default - none
+   */
+  readonly startTimeout?: cdk.Duration;
+
+  /**
+   * Time duration (in seconds) to wait before the container is forcefully killed if it doesn't exit normally on its own.
+   *
+   * @default - none
+   */
+  readonly stopTimeout?: cdk.Duration;
+
   /**
    * Specifies whether the container is marked essential.
    *
@@ -402,7 +416,7 @@ export class ContainerDefinition extends cdk.Construct {
     this.portMappings.push(...portMappings.map(pm => {
       if (this.taskDefinition.networkMode === NetworkMode.AWS_VPC || this.taskDefinition.networkMode === NetworkMode.HOST) {
         if (pm.containerPort !== pm.hostPort && pm.hostPort !== undefined) {
-          throw new Error(`Host port ${pm.hostPort} does not match container port ${pm.containerPort}.`);
+          throw new Error(`Host port (${pm.hostPort}) must be left out or equal to container port ${pm.containerPort} for network mode ${this.taskDefinition.networkMode}`);
         }
       }
 
@@ -522,6 +536,8 @@ export class ContainerDefinition extends cdk.Construct {
       privileged: this.props.privileged,
       readonlyRootFilesystem: this.props.readonlyRootFilesystem,
       repositoryCredentials: this.imageConfig.repositoryCredentials,
+      startTimeout: this.props.startTimeout && this.props.startTimeout.toSeconds(),
+      stopTimeout: this.props.stopTimeout && this.props.stopTimeout.toSeconds(),
       ulimits: cdk.Lazy.anyValue({ produce: () => this.ulimits.map(renderUlimit) }, { omitEmptyArray: true }),
       user: this.props.user,
       volumesFrom: cdk.Lazy.anyValue({ produce: () => this.volumesFrom.map(renderVolumeFrom) }, { omitEmptyArray: true }),
diff --git a/packages/@aws-cdk/aws-ecs/package.json b/packages/@aws-cdk/aws-ecs/package.json
index 3166a0dd36628..06f741dc23786 100644
--- a/packages/@aws-cdk/aws-ecs/package.json
+++ b/packages/@aws-cdk/aws-ecs/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@aws-cdk/aws-ecs",
-  "version": "1.13.1",
+  "version": "1.15.0",
   "description": "The CDK Construct Library for AWS::ECS",
   "main": "lib/index.js",
   "types": "lib/index.d.ts",
@@ -63,64 +63,64 @@
   },
   "license": "Apache-2.0",
   "devDependencies": {
-    "@aws-cdk/assert": "1.13.1",
+    "@aws-cdk/assert": "1.15.0",
     "@types/proxyquire": "^1.3.28",
-    "cdk-build-tools": "^1.13.1",
-    "cdk-integ-tools": "^1.13.1",
-    "cfn2ts": "^1.13.1",
-    "pkglint": "^1.13.1",
+    "cdk-build-tools": "^1.15.0",
+    "cdk-integ-tools": "^1.15.0",
+    "cfn2ts": "^1.15.0",
+    "pkglint": "^1.15.0",
     "proxyquire": "^2.1.3"
   },
   "dependencies": {
-    "@aws-cdk/aws-applicationautoscaling": "1.13.1",
-    "@aws-cdk/aws-autoscaling": "1.13.1",
-    "@aws-cdk/aws-autoscaling-hooktargets": "1.13.1",
-    "@aws-cdk/aws-certificatemanager": "1.13.1",
-    "@aws-cdk/aws-cloudformation": "1.13.1",
-    "@aws-cdk/aws-cloudwatch": "1.13.1",
-    "@aws-cdk/aws-ec2": "1.13.1",
-    "@aws-cdk/aws-ecr": "1.13.1",
-    "@aws-cdk/aws-ecr-assets": "1.13.1",
-    "@aws-cdk/aws-elasticloadbalancing": "1.13.1",
-    "@aws-cdk/aws-elasticloadbalancingv2": "1.13.1",
-    "@aws-cdk/aws-iam": "1.13.1",
-    "@aws-cdk/aws-lambda": "1.13.1",
-    "@aws-cdk/aws-logs": "1.13.1",
-    "@aws-cdk/aws-route53": "1.13.1",
-    "@aws-cdk/aws-route53-targets": "1.13.1",
-    "@aws-cdk/aws-secretsmanager": "1.13.1",
-    "@aws-cdk/aws-servicediscovery": "1.13.1",
-    "@aws-cdk/aws-sns": "1.13.1",
-    "@aws-cdk/aws-sqs": "1.13.1",
-    "@aws-cdk/aws-ssm": "1.13.1",
-    "@aws-cdk/core": "1.13.1",
-    "@aws-cdk/cx-api": "1.13.1"
+    "@aws-cdk/aws-applicationautoscaling": "1.15.0",
+    "@aws-cdk/aws-autoscaling": "1.15.0",
+    "@aws-cdk/aws-autoscaling-hooktargets": "1.15.0",
+    "@aws-cdk/aws-certificatemanager": "1.15.0",
+    "@aws-cdk/aws-cloudformation": "1.15.0",
+    "@aws-cdk/aws-cloudwatch": "1.15.0",
+    "@aws-cdk/aws-ec2": "1.15.0",
+    "@aws-cdk/aws-ecr": "1.15.0",
+    "@aws-cdk/aws-ecr-assets": "1.15.0",
+    "@aws-cdk/aws-elasticloadbalancing": "1.15.0",
+    "@aws-cdk/aws-elasticloadbalancingv2": "1.15.0",
+    "@aws-cdk/aws-iam": "1.15.0",
+    "@aws-cdk/aws-lambda": "1.15.0",
+    "@aws-cdk/aws-logs": "1.15.0",
+    "@aws-cdk/aws-route53": "1.15.0",
+    "@aws-cdk/aws-route53-targets": "1.15.0",
+    "@aws-cdk/aws-secretsmanager": "1.15.0",
+    "@aws-cdk/aws-servicediscovery": "1.15.0",
+    "@aws-cdk/aws-sns": "1.15.0",
+    "@aws-cdk/aws-sqs": "1.15.0",
+    "@aws-cdk/aws-ssm": "1.15.0",
+    "@aws-cdk/core": "1.15.0",
+    "@aws-cdk/cx-api": "1.15.0"
   },
   "homepage": "https://github.com/aws/aws-cdk",
   "peerDependencies": {
-    "@aws-cdk/aws-applicationautoscaling": "1.13.1",
-    "@aws-cdk/aws-autoscaling": "1.13.1",
-    "@aws-cdk/aws-autoscaling-hooktargets": "1.13.1",
-    "@aws-cdk/aws-certificatemanager": "1.13.1",
-    "@aws-cdk/aws-cloudformation": "1.13.1",
-    "@aws-cdk/aws-cloudwatch": "1.13.1",
-    "@aws-cdk/aws-ec2": "1.13.1",
-    "@aws-cdk/aws-ecr": "1.13.1",
-    "@aws-cdk/aws-ecr-assets": "1.13.1",
-    "@aws-cdk/aws-elasticloadbalancing": "1.13.1",
-    "@aws-cdk/aws-elasticloadbalancingv2": "1.13.1",
-    "@aws-cdk/aws-iam": "1.13.1",
-    "@aws-cdk/aws-lambda": "1.13.1",
-    "@aws-cdk/aws-logs": "1.13.1",
-    "@aws-cdk/aws-route53": "1.13.1",
-    "@aws-cdk/aws-route53-targets": "1.13.1",
-    "@aws-cdk/aws-secretsmanager": "1.13.1",
-    "@aws-cdk/aws-servicediscovery": "1.13.1",
-    "@aws-cdk/aws-sns": "1.13.1",
-    "@aws-cdk/aws-sqs": "1.13.1",
-    "@aws-cdk/aws-ssm": "1.13.1",
-    "@aws-cdk/core": "1.13.1",
-    "@aws-cdk/cx-api": "1.13.1"
+    "@aws-cdk/aws-applicationautoscaling": "1.15.0",
+    "@aws-cdk/aws-autoscaling": "1.15.0",
+    "@aws-cdk/aws-autoscaling-hooktargets": "1.15.0",
+    "@aws-cdk/aws-certificatemanager": "1.15.0",
+    "@aws-cdk/aws-cloudformation": "1.15.0",
+    "@aws-cdk/aws-cloudwatch": "1.15.0",
+    "@aws-cdk/aws-ec2": "1.15.0",
+    "@aws-cdk/aws-ecr": "1.15.0",
+    "@aws-cdk/aws-ecr-assets": "1.15.0",
+    "@aws-cdk/aws-elasticloadbalancing": "1.15.0",
+    "@aws-cdk/aws-elasticloadbalancingv2": "1.15.0",
+    "@aws-cdk/aws-iam": "1.15.0",
+    "@aws-cdk/aws-lambda": "1.15.0",
+    "@aws-cdk/aws-logs": "1.15.0",
+    "@aws-cdk/aws-route53": "1.15.0",
+    "@aws-cdk/aws-route53-targets": "1.15.0",
+    "@aws-cdk/aws-secretsmanager": "1.15.0",
+    "@aws-cdk/aws-servicediscovery": "1.15.0",
+    "@aws-cdk/aws-sns": "1.15.0",
+    "@aws-cdk/aws-sqs": "1.15.0",
+    "@aws-cdk/aws-ssm": "1.15.0",
+    "@aws-cdk/core": "1.15.0",
+    "@aws-cdk/cx-api": "1.15.0"
   },
   "engines": {
     "node": ">= 10.3.0"
@@ -129,7 +129,127 @@
     "exclude": [
       "props-physical-name:@aws-cdk/aws-ecs.TaskDefinitionProps",
       "props-physical-name:@aws-cdk/aws-ecs.Ec2TaskDefinitionProps",
-      "props-physical-name:@aws-cdk/aws-ecs.FargateTaskDefinitionProps"
+      "props-physical-name:@aws-cdk/aws-ecs.FargateTaskDefinitionProps",
+      "docs-public-apis:@aws-cdk/aws-ecs.GelfCompressionType.GZIP",
+      "docs-public-apis:@aws-cdk/aws-ecs.WindowsOptimizedVersion.SERVER_2016",
+      "docs-public-apis:@aws-cdk/aws-ecs.WindowsOptimizedVersion.SERVER_2019",
+      "docs-public-apis:@aws-cdk/aws-ecs.Secret.arn",
+      "docs-public-apis:@aws-cdk/aws-ecs.Secret.grantRead",
+      "props-default-doc:@aws-cdk/aws-ecs.AppMeshProxyConfigurationProps.egressIgnoredIPs",
+      "props-default-doc:@aws-cdk/aws-ecs.AppMeshProxyConfigurationProps.egressIgnoredPorts",
+      "props-default-doc:@aws-cdk/aws-ecs.AppMeshProxyConfigurationProps.ignoredGID",
+      "props-default-doc:@aws-cdk/aws-ecs.AppMeshProxyConfigurationProps.ignoredUID",
+      "docs-public-apis:@aws-cdk/aws-ecs.BaseLogDriverProps",
+      "props-default-doc:@aws-cdk/aws-ecs.CloudMapOptions.failureThreshold",
+      "docs-public-apis:@aws-cdk/aws-ecs.ContainerDefinitionOptions",
+      "props-default-doc:@aws-cdk/aws-ecs.ContainerImageConfig.repositoryCredentials",
+      "docs-public-apis:@aws-cdk/aws-ecs.EcsTarget",
+      "props-default-doc:@aws-cdk/aws-ecs.Host.sourcePath",
+      "props-default-doc:@aws-cdk/aws-ecs.LogDriverConfig.options",
+      "props-default-doc:@aws-cdk/aws-ecs.PortMapping.hostPort",
+      "props-default-doc:@aws-cdk/aws-ecs.RepositoryImageProps.credentials",
+      "docs-public-apis:@aws-cdk/aws-ecs.ScratchSpace.sourcePath",
+      "props-default-doc:@aws-cdk/aws-ecs.Tmpfs.mountOptions",
+      "props-default-doc:@aws-cdk/aws-ecs.Volume.dockerVolumeConfiguration",
+      "props-default-doc:@aws-cdk/aws-ecs.Volume.host",
+      "docs-public-apis:@aws-cdk/aws-ecs.Capability.ALL",
+      "docs-public-apis:@aws-cdk/aws-ecs.Capability.AUDIT_CONTROL",
+      "docs-public-apis:@aws-cdk/aws-ecs.Capability.AUDIT_WRITE",
+      "docs-public-apis:@aws-cdk/aws-ecs.Capability.BLOCK_SUSPEND",
+      "docs-public-apis:@aws-cdk/aws-ecs.Capability.CHOWN",
+      "docs-public-apis:@aws-cdk/aws-ecs.Capability.DAC_OVERRIDE",
+      "docs-public-apis:@aws-cdk/aws-ecs.Capability.DAC_READ_SEARCH",
+      "docs-public-apis:@aws-cdk/aws-ecs.Capability.FOWNER",
+      "docs-public-apis:@aws-cdk/aws-ecs.Capability.FSETID",
+      "docs-public-apis:@aws-cdk/aws-ecs.Capability.IPC_LOCK",
+      "docs-public-apis:@aws-cdk/aws-ecs.Capability.IPC_OWNER",
+      "docs-public-apis:@aws-cdk/aws-ecs.Capability.KILL",
+      "docs-public-apis:@aws-cdk/aws-ecs.Capability.LEASE",
+      "docs-public-apis:@aws-cdk/aws-ecs.Capability.LINUX_IMMUTABLE",
+      "docs-public-apis:@aws-cdk/aws-ecs.Capability.MAC_ADMIN",
+      "docs-public-apis:@aws-cdk/aws-ecs.Capability.MAC_OVERRIDE",
+      "docs-public-apis:@aws-cdk/aws-ecs.Capability.MKNOD",
+      "docs-public-apis:@aws-cdk/aws-ecs.Capability.NET_ADMIN",
+      "docs-public-apis:@aws-cdk/aws-ecs.Capability.NET_BIND_SERVICE",
+      "docs-public-apis:@aws-cdk/aws-ecs.Capability.NET_BROADCAST",
+      "docs-public-apis:@aws-cdk/aws-ecs.Capability.NET_RAW",
+      "docs-public-apis:@aws-cdk/aws-ecs.Capability.SETFCAP",
+      "docs-public-apis:@aws-cdk/aws-ecs.Capability.SETGID",
+      "docs-public-apis:@aws-cdk/aws-ecs.Capability.SETPCAP",
+      "docs-public-apis:@aws-cdk/aws-ecs.Capability.SETUID",
+      "docs-public-apis:@aws-cdk/aws-ecs.Capability.SYS_ADMIN",
+      "docs-public-apis:@aws-cdk/aws-ecs.Capability.SYS_BOOT",
+      "docs-public-apis:@aws-cdk/aws-ecs.Capability.SYS_CHROOT",
+      "docs-public-apis:@aws-cdk/aws-ecs.Capability.SYS_MODULE",
+      "docs-public-apis:@aws-cdk/aws-ecs.Capability.SYS_NICE",
+      "docs-public-apis:@aws-cdk/aws-ecs.Capability.SYS_PACCT",
+      "docs-public-apis:@aws-cdk/aws-ecs.Capability.SYS_PTRACE",
+      "docs-public-apis:@aws-cdk/aws-ecs.Capability.SYS_RAWIO",
+      "docs-public-apis:@aws-cdk/aws-ecs.Capability.SYS_RESOURCE",
+      "docs-public-apis:@aws-cdk/aws-ecs.Capability.SYS_TIME",
+      "docs-public-apis:@aws-cdk/aws-ecs.Capability.SYS_TTY_CONFIG",
+      "docs-public-apis:@aws-cdk/aws-ecs.Capability.SYSLOG",
+      "docs-public-apis:@aws-cdk/aws-ecs.Capability.WAKE_ALARM",
+      "docs-public-apis:@aws-cdk/aws-ecs.ContainerDependencyCondition",
+      "docs-public-apis:@aws-cdk/aws-ecs.UlimitName.STACK",
+      "docs-public-apis:@aws-cdk/aws-ecs.GelfCompressionType.ZLIB",
+      "docs-public-apis:@aws-cdk/aws-ecs.GelfCompressionType.NONE",
+      "docs-public-apis:@aws-cdk/aws-ecs.SplunkLogFormat.INLINE",
+      "docs-public-apis:@aws-cdk/aws-ecs.SplunkLogFormat.JSON",
+      "docs-public-apis:@aws-cdk/aws-ecs.SplunkLogFormat.RAW",
+      "docs-public-apis:@aws-cdk/aws-ecs.TmpfsMountOption.DEFAULTS",
+      "docs-public-apis:@aws-cdk/aws-ecs.TmpfsMountOption.RO",
+      "docs-public-apis:@aws-cdk/aws-ecs.TmpfsMountOption.RW",
+      "docs-public-apis:@aws-cdk/aws-ecs.TmpfsMountOption.SUID",
+      "docs-public-apis:@aws-cdk/aws-ecs.TmpfsMountOption.NOSUID",
+      "docs-public-apis:@aws-cdk/aws-ecs.TmpfsMountOption.DEV",
+      "docs-public-apis:@aws-cdk/aws-ecs.TmpfsMountOption.NODEV",
+      "docs-public-apis:@aws-cdk/aws-ecs.TmpfsMountOption.EXEC",
+      "docs-public-apis:@aws-cdk/aws-ecs.TmpfsMountOption.NOEXEC",
+      "docs-public-apis:@aws-cdk/aws-ecs.TmpfsMountOption.SYNC",
+      "docs-public-apis:@aws-cdk/aws-ecs.TmpfsMountOption.ASYNC",
+      "docs-public-apis:@aws-cdk/aws-ecs.TmpfsMountOption.DIRSYNC",
+      "docs-public-apis:@aws-cdk/aws-ecs.TmpfsMountOption.REMOUNT",
+      "docs-public-apis:@aws-cdk/aws-ecs.TmpfsMountOption.MAND",
+      "docs-public-apis:@aws-cdk/aws-ecs.TmpfsMountOption.NOMAND",
+      "docs-public-apis:@aws-cdk/aws-ecs.TmpfsMountOption.ATIME",
+      "docs-public-apis:@aws-cdk/aws-ecs.TmpfsMountOption.NOATIME",
+      "docs-public-apis:@aws-cdk/aws-ecs.TmpfsMountOption.DIRATIME",
+      "docs-public-apis:@aws-cdk/aws-ecs.TmpfsMountOption.NODIRATIME",
+      "docs-public-apis:@aws-cdk/aws-ecs.TmpfsMountOption.BIND",
+      "docs-public-apis:@aws-cdk/aws-ecs.TmpfsMountOption.RBIND",
+      "docs-public-apis:@aws-cdk/aws-ecs.TmpfsMountOption.UNBINDABLE",
+      "docs-public-apis:@aws-cdk/aws-ecs.TmpfsMountOption.RUNBINDABLE",
+      "docs-public-apis:@aws-cdk/aws-ecs.TmpfsMountOption.PRIVATE",
+      "docs-public-apis:@aws-cdk/aws-ecs.TmpfsMountOption.RPRIVATE",
+      "docs-public-apis:@aws-cdk/aws-ecs.TmpfsMountOption.SHARED",
+      "docs-public-apis:@aws-cdk/aws-ecs.TmpfsMountOption.RSHARED",
+      "docs-public-apis:@aws-cdk/aws-ecs.TmpfsMountOption.SLAVE",
+      "docs-public-apis:@aws-cdk/aws-ecs.TmpfsMountOption.RSLAVE",
+      "docs-public-apis:@aws-cdk/aws-ecs.TmpfsMountOption.RELATIME",
+      "docs-public-apis:@aws-cdk/aws-ecs.TmpfsMountOption.NORELATIME",
+      "docs-public-apis:@aws-cdk/aws-ecs.TmpfsMountOption.STRICTATIME",
+      "docs-public-apis:@aws-cdk/aws-ecs.TmpfsMountOption.NOSTRICTATIME",
+      "docs-public-apis:@aws-cdk/aws-ecs.TmpfsMountOption.MODE",
+      "docs-public-apis:@aws-cdk/aws-ecs.TmpfsMountOption.UID",
+      "docs-public-apis:@aws-cdk/aws-ecs.TmpfsMountOption.GID",
+      "docs-public-apis:@aws-cdk/aws-ecs.TmpfsMountOption.NR_INODES",
+      "docs-public-apis:@aws-cdk/aws-ecs.TmpfsMountOption.NR_BLOCKS",
+      "docs-public-apis:@aws-cdk/aws-ecs.TmpfsMountOption.MPOL",
+      "docs-public-apis:@aws-cdk/aws-ecs.UlimitName.CORE",
+      "docs-public-apis:@aws-cdk/aws-ecs.UlimitName.CPU",
+      "docs-public-apis:@aws-cdk/aws-ecs.UlimitName.DATA",
+      "docs-public-apis:@aws-cdk/aws-ecs.UlimitName.FSIZE",
+      "docs-public-apis:@aws-cdk/aws-ecs.UlimitName.LOCKS",
+      "docs-public-apis:@aws-cdk/aws-ecs.UlimitName.MEMLOCK",
+      "docs-public-apis:@aws-cdk/aws-ecs.UlimitName.MSGQUEUE",
+      "docs-public-apis:@aws-cdk/aws-ecs.UlimitName.NICE",
+      "docs-public-apis:@aws-cdk/aws-ecs.UlimitName.NOFILE",
+      "docs-public-apis:@aws-cdk/aws-ecs.UlimitName.NPROC",
+      "docs-public-apis:@aws-cdk/aws-ecs.UlimitName.RSS",
+      "docs-public-apis:@aws-cdk/aws-ecs.UlimitName.RTPRIO",
+      "docs-public-apis:@aws-cdk/aws-ecs.UlimitName.RTTIME",
+      "docs-public-apis:@aws-cdk/aws-ecs.UlimitName.SIGPENDING"
     ]
   },
   "stability": "stable"
diff --git a/packages/@aws-cdk/aws-ecs/test/test.container-definition.ts b/packages/@aws-cdk/aws-ecs/test/test.container-definition.ts
index 974fc46c0aed3..e181a8f4915a3 100644
--- a/packages/@aws-cdk/aws-ecs/test/test.container-definition.ts
+++ b/packages/@aws-cdk/aws-ecs/test/test.container-definition.ts
@@ -33,6 +33,152 @@ export = {
       test.done();
     },
 
+    "add a container using all props"(test: Test) {
+      // GIVEN
+      const stack = new cdk.Stack();
+      const taskDefinition = new ecs.Ec2TaskDefinition(stack, 'TaskDef');
+      const secret = new secretsmanager.Secret(stack, 'Secret');
+      new ecs.ContainerDefinition(stack, "Container", {
+        image: ecs.ContainerImage.fromRegistry("/aws/aws-example-app"),
+        taskDefinition,
+        memoryLimitMiB: 1024,
+        memoryReservationMiB: 512,
+        command: ["CMD-SHELL"],
+        cpu: 128,
+        disableNetworking: true,
+        dnsSearchDomains: ['example.com'],
+        dnsServers: ['host.com'],
+        dockerLabels: {
+          key: 'fooLabel',
+          value: 'barLabel'
+        },
+        dockerSecurityOptions: ['ECS_SELINUX_CAPABLE=true'],
+        entryPoint: ["top", "-b"],
+        environment: {
+          key: "foo",
+          value: "bar"
+        },
+        essential: true,
+        extraHosts: {
+          name: 'dev-db.hostname.pvt'
+        },
+        gpuCount: 256,
+        hostname: "host.example.com",
+        privileged: true,
+        readonlyRootFilesystem: true,
+        startTimeout: cdk.Duration.millis(2000),
+        stopTimeout: cdk.Duration.millis(5000),
+        user: "rootUser",
+        workingDirectory: "a/b/c",
+        healthCheck: {
+          command: ["curl localhost:8000"]
+        },
+        linuxParameters: new ecs.LinuxParameters(stack, 'LinuxParameters'),
+        logging: new ecs.AwsLogDriver({ streamPrefix: 'prefix' }),
+        secrets: {
+          SECRET: ecs.Secret.fromSecretsManager(secret),
+        }
+      });
+
+      // THEN
+      expect(stack).to(haveResourceLike('AWS::ECS::TaskDefinition', {
+        ContainerDefinitions: [
+          {
+            Command: [
+              "CMD-SHELL"
+            ],
+            Cpu: 128,
+            DisableNetworking: true,
+            DnsSearchDomains: [
+              "example.com"
+            ],
+            DnsServers: [
+              "host.com"
+            ],
+            DockerLabels: {
+              key: "fooLabel",
+              value: "barLabel"
+            },
+            DockerSecurityOptions: [
+              "ECS_SELINUX_CAPABLE=true"
+            ],
+            EntryPoint: [
+              "top",
+              "-b"
+            ],
+            Environment: [
+              {
+                Name: "key",
+                Value: "foo"
+              },
+              {
+                Name: "value",
+                Value: "bar"
+              }
+            ],
+            Essential: true,
+            ExtraHosts: [
+              {
+                Hostname: "name",
+                IpAddress: "dev-db.hostname.pvt"
+              }
+            ],
+            HealthCheck: {
+              Command: [
+                "CMD-SHELL",
+                "curl localhost:8000"
+              ],
+              Interval: 30,
+              Retries: 3,
+              Timeout: 5
+            },
+            Hostname: "host.example.com",
+            Image: "/aws/aws-example-app",
+            LinuxParameters: {
+              Capabilities: {}
+            },
+            LogConfiguration: {
+              LogDriver: "awslogs",
+              Options: {
+                "awslogs-group": {
+                  Ref: "ContainerLogGroupE6FD74A4"
+                },
+                "awslogs-stream-prefix": "prefix",
+                "awslogs-region": {
+                  Ref: "AWS::Region"
+                }
+              }
+            },
+            Memory: 1024,
+            MemoryReservation: 512,
+            Name: "Container",
+            Privileged: true,
+            ReadonlyRootFilesystem: true,
+            ResourceRequirements: [
+              {
+                Type: "GPU",
+                Value: "256"
+              }
+            ],
+            Secrets: [
+              {
+                Name: "SECRET",
+                ValueFrom: {
+                  Ref: "SecretA720EF05"
+                }
+              }
+            ],
+            StartTimeout: 2,
+            StopTimeout: 5,
+            User: "rootUser",
+            WorkingDirectory: "a/b/c"
+          }
+        ]
+      }));
+
+      test.done();
+    },
+
     "throws when MemoryLimit is less than MemoryReservationLimit"(test: Test) {
       // GIVEN
       const stack = new cdk.Stack();
diff --git a/packages/@aws-cdk/aws-ecs/test/test.ecs-cluster.ts b/packages/@aws-cdk/aws-ecs/test/test.ecs-cluster.ts
index 8f604e84a60b7..80a7e030e2609 100644
--- a/packages/@aws-cdk/aws-ecs/test/test.ecs-cluster.ts
+++ b/packages/@aws-cdk/aws-ecs/test/test.ecs-cluster.ts
@@ -1199,4 +1199,123 @@ export = {
 
     test.done();
   },
+
+  "ASG with a public VPC without NAT Gateways"(test: Test) {
+    // GIVEN
+    const stack = new cdk.Stack();
+    const vpc = new ec2.Vpc(stack, 'MyPublicVpc', {
+      natGateways: 0,
+      subnetConfiguration: [
+        { cidrMask: 24, name: "ingress", subnetType: ec2.SubnetType.PUBLIC }
+      ]
+    });
+
+    const cluster = new ecs.Cluster(stack, 'EcsCluster', { vpc });
+
+    // WHEN
+    cluster.addCapacity("DefaultAutoScalingGroup", {
+      instanceType: new ec2.InstanceType('t2.micro'),
+      associatePublicIpAddress: true,
+      vpcSubnets: {
+        onePerAz: true,
+        subnetType: ec2.SubnetType.PUBLIC
+      },
+    });
+
+    expect(stack).to(haveResource("AWS::ECS::Cluster"));
+
+    expect(stack).to(haveResource("AWS::EC2::VPC", {
+      CidrBlock: '10.0.0.0/16',
+      EnableDnsHostnames: true,
+      EnableDnsSupport: true,
+      InstanceTenancy: ec2.DefaultInstanceTenancy.DEFAULT,
+      Tags: [
+        {
+          Key: "Name",
+          Value: "MyPublicVpc"
+        }
+      ]
+    }));
+
+    expect(stack).to(haveResource("AWS::AutoScaling::LaunchConfiguration", {
+      ImageId: {
+        Ref: "SsmParameterValueawsserviceecsoptimizedamiamazonlinux2recommendedimageidC96584B6F00A464EAD1953AFF4B05118Parameter"
+      },
+      InstanceType: "t2.micro",
+      AssociatePublicIpAddress: true,
+      IamInstanceProfile: {
+        Ref: "EcsClusterDefaultAutoScalingGroupInstanceProfile2CE606B3"
+      },
+      SecurityGroups: [
+        {
+          "Fn::GetAtt": [
+            "EcsClusterDefaultAutoScalingGroupInstanceSecurityGroup912E1231",
+            "GroupId"
+          ]
+        }
+      ],
+      UserData: {
+        "Fn::Base64": {
+          "Fn::Join": [
+            "",
+            [
+              "#!/bin/bash\necho ECS_CLUSTER=",
+              {
+                Ref: "EcsCluster97242B84"
+              },
+              // tslint:disable-next-line:max-line-length
+              " >> /etc/ecs/ecs.config\nsudo iptables --insert FORWARD 1 --in-interface docker+ --destination 169.254.169.254/32 --jump DROP\nsudo service iptables save\necho ECS_AWSVPC_BLOCK_IMDS=true >> /etc/ecs/ecs.config"
+            ]
+          ]
+        }
+      }
+    }));
+
+    expect(stack).to(haveResource("AWS::AutoScaling::AutoScalingGroup", {
+      MaxSize: "1",
+      MinSize: "1",
+      DesiredCapacity: "1",
+      LaunchConfigurationName: {
+        Ref: "EcsClusterDefaultAutoScalingGroupLaunchConfigB7E376C1"
+      },
+      Tags: [
+        {
+          Key: "Name",
+          PropagateAtLaunch: true,
+          Value: "EcsCluster/DefaultAutoScalingGroup"
+        }
+      ],
+      VPCZoneIdentifier: [
+        {
+          Ref: "MyPublicVpcingressSubnet1Subnet9191044C"
+        },
+        {
+          Ref: "MyPublicVpcingressSubnet2SubnetD2F2E034"
+        }
+      ]
+    }));
+
+    expect(stack).to(haveResource("AWS::EC2::SecurityGroup", {
+      GroupDescription: "EcsCluster/DefaultAutoScalingGroup/InstanceSecurityGroup",
+      SecurityGroupEgress: [
+        {
+          CidrIp: "0.0.0.0/0",
+          Description: "Allow all outbound traffic by default",
+          IpProtocol: "-1"
+        }
+      ],
+      Tags: [
+        {
+          Key: "Name",
+          Value: "EcsCluster/DefaultAutoScalingGroup"
+        }
+      ],
+      VpcId: {
+        Ref: "MyPublicVpcA2BF6CDA"
+      }
+    }));
+
+    // THEN
+    test.done();
+  },
 };
diff --git a/packages/@aws-cdk/aws-efs/package.json b/packages/@aws-cdk/aws-efs/package.json
index 6d127d9181dbc..1a6ab83a5ce13 100644
--- a/packages/@aws-cdk/aws-efs/package.json
+++ b/packages/@aws-cdk/aws-efs/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@aws-cdk/aws-efs",
-  "version": "1.13.1",
+  "version": "1.15.0",
   "description": "The CDK Construct Library for AWS::EFS",
   "main": "lib/index.js",
   "types": "lib/index.d.ts",
@@ -63,17 +63,17 @@
   },
   "license": "Apache-2.0",
   "devDependencies": {
-    "@aws-cdk/assert": "1.13.1",
-    "cdk-build-tools": "^1.13.1",
-    "cfn2ts": "^1.13.1",
-    "pkglint": "^1.13.1"
+    "@aws-cdk/assert": "1.15.0",
+    "cdk-build-tools": "^1.15.0",
+    "cfn2ts": "^1.15.0",
+    "pkglint": "^1.15.0"
   },
   "dependencies": {
-    "@aws-cdk/core": "1.13.1"
+    "@aws-cdk/core": "1.15.0"
   },
   "homepage": "https://github.com/aws/aws-cdk",
   "peerDependencies": {
-    "@aws-cdk/core": "1.13.1"
+    "@aws-cdk/core": "1.15.0"
   },
   "engines": {
     "node": ">= 10.3.0"
diff --git a/packages/@aws-cdk/aws-eks/lib/cluster-resource.ts b/packages/@aws-cdk/aws-eks/lib/cluster-resource.ts
index 2e1f6434a352f..88e010ce962a0 100644
--- a/packages/@aws-cdk/aws-eks/lib/cluster-resource.ts
+++ b/packages/@aws-cdk/aws-eks/lib/cluster-resource.ts
@@ -55,7 +55,7 @@ export class ClusterResource extends Construct {
 
     // since we don't know the cluster name at this point, we must give this role star resource permissions
     handler.addToRolePolicy(new PolicyStatement({
-      actions: [ 'eks:CreateCluster', 'eks:DescribeCluster', 'eks:DeleteCluster' ],
+      actions: [ 'eks:CreateCluster', 'eks:DescribeCluster', 'eks:DeleteCluster', 'eks:UpdateClusterVersion' ],
       resources: [ '*' ]
     }));
 
diff --git a/packages/@aws-cdk/aws-eks/lib/cluster-resource/index.py b/packages/@aws-cdk/aws-eks/lib/cluster-resource/index.py
index f953c2dccfae9..07cad9a8db1ba 100644
--- a/packages/@aws-cdk/aws-eks/lib/cluster-resource/index.py
+++ b/packages/@aws-cdk/aws-eks/lib/cluster-resource/index.py
@@ -36,6 +36,10 @@ def cfn_error(message=None):
         old_props = event.get('OldResourceProperties', {})
         physical_id = event.get('PhysicalResourceId', None)
         config = props['Config']
+        old_config = old_props.get('Config', {})
+
+        def new_cluster_name():
+            return "cluster-%s" % request_id
 
         logger.info(json.dumps(config))
 
@@ -49,11 +53,36 @@ def cfn_error(message=None):
         cluster_name=config.get('name', None)
         if cluster_name is None:
             if physical_id: cluster_name = physical_id
-            elif request_type == 'Create': cluster_name = "cluster-%s" % request_id
+            elif request_type == 'Create': cluster_name = new_cluster_name()
             else: raise Exception("unexpected error. cannot determine cluster name")
         config['name'] = cluster_name
         logger.info("request: %s" % config)
 
+        # extract additional options
+        resourcesVpcConfig = config.get('resourcesVpcConfig', None)
+        roleArn = config.get('roleArn', None)
+        version = config.get('version', None)
+
+        def should_replace_cluster():
+            logger.info("old config: %s" % json.dumps(old_config))
+
+            old_name = physical_id
+            if old_name != cluster_name:
+                logger.info("'name' change requires replacement (old=%s, new=%s)" % (old_name, cluster_name))
+                return True
+
+            old_resourcesVpcConfig = old_config.get('resourcesVpcConfig', None)
+            if old_resourcesVpcConfig != resourcesVpcConfig:
+                logger.info("'resourcesVpcConfig' change requires replacement (old=%s, new=%s)" % (old_resourcesVpcConfig, resourcesVpcConfig))
+                return True
+            
+            old_roleArn = old_config.get('roleArn', None)
+            if old_roleArn != roleArn:
+                logger.info("'roleArn' change requires replacement (old=%s, new=%s)" % (old_roleArn, roleArn))
+                return True
+            
+            return False
+
         # delete is a special case
         if request_type == 'Delete':
             logger.info('deleting cluster')
@@ -69,9 +98,36 @@ def cfn_error(message=None):
             resp = eks.create_cluster(**config)
             logger.info("create response: %s" % resp)
         elif request_type == 'Update':
-            logger.info("updating cluster %s" % cluster_name)
-            resp = eks.update_cluster_config(**config)
-            logger.info("update response: %s" % resp)
+            # physical_id is always defined for "update"
+            logger.info("updating cluster %s" % physical_id)
+            current_state = eks.describe_cluster(name=physical_id)['cluster']
+
+            # changes to "name", "resourcesVpcConfig" and "roleArn" all require replacement
+            # according to the cloudformation spec, so if one of these change, we basically need to create
+            # a new cluster with the new configuration (in this case, if "version" has been changed, the
+            # new version will be used by the new cluster).
+            if should_replace_cluster():
+                # unless we are renaming the cluster, allocate a new cluster name
+                if cluster_name == physical_id:
+                    cluster_name = new_cluster_name()
+                    config['name'] = cluster_name
+
+                logger.info("replacing cluster %s with a new cluster %s" % (physical_id, cluster_name))
+                resp = eks.create_cluster(**config)
+                logger.info("create (replacement) response: %s" % resp)
+            else:
+                # version change - we can do that without replacement
+                old_version = old_config.get('version', None)
+                if (old_version is None) and (version is None):
+                    logger.info("no version change")
+                else:
+                    old_version_actual = current_state['version']
+                    if version != old_version_actual:
+                        if version is None:
+                            raise Exception("Version cannot be changed from a specific value (%s) to undefined" % old_version)
+
+                        resp = eks.update_cluster_version(name=cluster_name,version=version)
+                        logger.info("update response: %s" % resp)
         else:
             raise Exception("Invalid request type %s" % request_type)
 
@@ -94,9 +150,8 @@ def cfn_error(message=None):
         logger.info("attributes: %s" % attrs)
         cfn_send(event, context, CFN_SUCCESS, responseData=attrs, physicalResourceId=cluster_name)
 
-    except KeyError as e:
-        cfn_error("invalid request. Missing '%s'" % str(e))
-    except Exception as e:
+    except:
+        e = sys.exc_info()[1]
         logger.exception(e)
         cfn_error(str(e))
 
@@ -111,10 +166,14 @@ def cfn_send(event, context, responseStatus, responseData={}, physicalResourceId
     responseUrl = event['ResponseURL']
     logger.info(responseUrl)
 
+    # use previous PhysicalResourceId if physical resource ID is not specified, otherwise update failures
+    # will result in resource replacement
+    physicalResourceId = physicalResourceId or event.get('PhysicalResourceId', context.log_stream_name)
+
     responseBody = {}
     responseBody['Status'] = responseStatus
     responseBody['Reason'] = reason or ('See the details in CloudWatch Log Stream: ' + context.log_stream_name)
-    responseBody['PhysicalResourceId'] = physicalResourceId or context.log_stream_name
+    responseBody['PhysicalResourceId'] = physicalResourceId
     responseBody['StackId'] = event['StackId']
     responseBody['RequestId'] = event['RequestId']
     responseBody['LogicalResourceId'] = event['LogicalResourceId']
diff --git a/packages/@aws-cdk/aws-eks/package.json b/packages/@aws-cdk/aws-eks/package.json
index 0115842110026..b5f676235a99b 100644
--- a/packages/@aws-cdk/aws-eks/package.json
+++ b/packages/@aws-cdk/aws-eks/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@aws-cdk/aws-eks",
-  "version": "1.13.1",
+  "version": "1.15.0",
   "description": "The CDK Construct Library for AWS::EKS",
   "main": "lib/index.js",
   "types": "lib/index.d.ts",
@@ -63,37 +63,43 @@
   },
   "license": "Apache-2.0",
   "devDependencies": {
-    "@aws-cdk/assert": "1.13.1",
-    "cdk-build-tools": "^1.13.1",
-    "cdk-integ-tools": "^1.13.1",
-    "cfn2ts": "^1.13.1",
-    "pkglint": "^1.13.1"
+    "@aws-cdk/assert": "1.15.0",
+    "cdk-build-tools": "^1.15.0",
+    "cdk-integ-tools": "^1.15.0",
+    "cfn2ts": "^1.15.0",
+    "pkglint": "^1.15.0"
   },
   "dependencies": {
-    "@aws-cdk/aws-autoscaling": "1.13.1",
-    "@aws-cdk/aws-cloudformation": "1.13.1",
-    "@aws-cdk/aws-ec2": "1.13.1",
-    "@aws-cdk/aws-iam": "1.13.1",
-    "@aws-cdk/aws-lambda": "1.13.1",
-    "@aws-cdk/aws-ssm": "1.13.1",
-    "@aws-cdk/core": "1.13.1"
+    "@aws-cdk/aws-autoscaling": "1.15.0",
+    "@aws-cdk/aws-cloudformation": "1.15.0",
+    "@aws-cdk/aws-ec2": "1.15.0",
+    "@aws-cdk/aws-iam": "1.15.0",
+    "@aws-cdk/aws-lambda": "1.15.0",
+    "@aws-cdk/aws-ssm": "1.15.0",
+    "@aws-cdk/core": "1.15.0"
   },
   "homepage": "https://github.com/aws/aws-cdk",
   "peerDependencies": {
-    "@aws-cdk/aws-autoscaling": "1.13.1",
-    "@aws-cdk/aws-cloudformation": "1.13.1",
-    "@aws-cdk/aws-ec2": "1.13.1",
-    "@aws-cdk/aws-iam": "1.13.1",
-    "@aws-cdk/aws-lambda": "1.13.1",
-    "@aws-cdk/aws-ssm": "1.13.1",
-    "@aws-cdk/core": "1.13.1"
+    "@aws-cdk/aws-autoscaling": "1.15.0",
+    "@aws-cdk/aws-cloudformation": "1.15.0",
+    "@aws-cdk/aws-ec2": "1.15.0",
+    "@aws-cdk/aws-iam": "1.15.0",
+    "@aws-cdk/aws-lambda": "1.15.0",
+    "@aws-cdk/aws-ssm": "1.15.0",
+    "@aws-cdk/core": "1.15.0"
   },
   "engines": {
     "node": ">= 10.3.0"
   },
   "awslint": {
     "exclude": [
-      "props-no-arn-refs:@aws-cdk/aws-eks.ClusterProps.outputMastersRoleArn"
+      "props-no-arn-refs:@aws-cdk/aws-eks.ClusterProps.outputMastersRoleArn",
+      "props-default-doc:@aws-cdk/aws-eks.AutoScalingGroupOptions.bootstrapOptions",
+      "docs-public-apis:@aws-cdk/aws-eks.AwsAuthProps",
+      "docs-public-apis:@aws-cdk/aws-eks.BootstrapOptions",
+      "docs-public-apis:@aws-cdk/aws-eks.ClusterAttributes",
+      "docs-public-apis:@aws-cdk/aws-eks.KubernetesResourceProps",
+      "docs-public-apis:@aws-cdk/aws-eks.Mapping"
     ]
   },
   "stability": "experimental"
diff --git a/packages/@aws-cdk/aws-eks/test/integ.eks-cluster.defaults.expected.json b/packages/@aws-cdk/aws-eks/test/integ.eks-cluster.defaults.expected.json
index dc8d10a52066d..4e212861a0efc 100644
--- a/packages/@aws-cdk/aws-eks/test/integ.eks-cluster.defaults.expected.json
+++ b/packages/@aws-cdk/aws-eks/test/integ.eks-cluster.defaults.expected.json
@@ -641,7 +641,8 @@
               "Action": [
                 "eks:CreateCluster",
                 "eks:DescribeCluster",
-                "eks:DeleteCluster"
+                "eks:DeleteCluster",
+                "eks:UpdateClusterVersion"
               ],
               "Effect": "Allow",
               "Resource": "*"
@@ -672,7 +673,7 @@
       "Properties": {
         "Code": {
           "S3Bucket": {
-            "Ref": "AssetParametersc58ce740cd907e33a1af503069821ee4befab4fec4075707d67e86d2a0dbf128S3BucketA2C12383"
+            "Ref": "AssetParametersea4957b16062595851e7d293ee45835db05c5693669a729cc02944b6ad19a204S3Bucket371D99F8"
           },
           "S3Key": {
             "Fn::Join": [
@@ -685,7 +686,7 @@
                       "Fn::Split": [
                         "||",
                         {
-                          "Ref": "AssetParametersc58ce740cd907e33a1af503069821ee4befab4fec4075707d67e86d2a0dbf128S3VersionKeyB5F0BEF8"
+                          "Ref": "AssetParametersea4957b16062595851e7d293ee45835db05c5693669a729cc02944b6ad19a204S3VersionKeyFDCB25DD"
                         }
                       ]
                     }
@@ -698,7 +699,7 @@
                       "Fn::Split": [
                         "||",
                         {
-                          "Ref": "AssetParametersc58ce740cd907e33a1af503069821ee4befab4fec4075707d67e86d2a0dbf128S3VersionKeyB5F0BEF8"
+                          "Ref": "AssetParametersea4957b16062595851e7d293ee45835db05c5693669a729cc02944b6ad19a204S3VersionKeyFDCB25DD"
                         }
                       ]
                     }
@@ -1017,8 +1018,8 @@
         ],
         "Tags": [
           {
-            "Key":"Name",
-            "Value":"eks-integ-defaults/Cluster/DefaultCapacity"
+            "Key": "Name",
+            "Value": "eks-integ-defaults/Cluster/DefaultCapacity"
           },
           {
             "Key": {
@@ -1185,18 +1186,6 @@
       }
     }
   },
-  "Parameters": {
-    "AssetParametersc58ce740cd907e33a1af503069821ee4befab4fec4075707d67e86d2a0dbf128S3BucketA2C12383": {"Type":"String","Description":"S3 bucket for asset \"c58ce740cd907e33a1af503069821ee4befab4fec4075707d67e86d2a0dbf128\""},
-    "AssetParametersc58ce740cd907e33a1af503069821ee4befab4fec4075707d67e86d2a0dbf128S3VersionKeyB5F0BEF8": {"Type":"String","Description":"S3 key for asset version \"c58ce740cd907e33a1af503069821ee4befab4fec4075707d67e86d2a0dbf128\""},
-    "AssetParametersc58ce740cd907e33a1af503069821ee4befab4fec4075707d67e86d2a0dbf128ArtifactHash8E5121DE": {"Type":"String","Description":"Artifact hash for asset \"c58ce740cd907e33a1af503069821ee4befab4fec4075707d67e86d2a0dbf128\""},
-    "AssetParameters640847533c8a00b3133aeb128edcac41fb7b60349c9e18764fcf7ea4af14d444S3Bucket919126CB": {"Type":"String","Description":"S3 bucket for asset \"640847533c8a00b3133aeb128edcac41fb7b60349c9e18764fcf7ea4af14d444\""},
-    "AssetParameters640847533c8a00b3133aeb128edcac41fb7b60349c9e18764fcf7ea4af14d444S3VersionKey529BEF54": {"Type":"String","Description":"S3 key for asset version \"640847533c8a00b3133aeb128edcac41fb7b60349c9e18764fcf7ea4af14d444\""},
-    "AssetParameters640847533c8a00b3133aeb128edcac41fb7b60349c9e18764fcf7ea4af14d444ArtifactHash606C8127": {"Type":"String","Description":"Artifact hash for asset \"640847533c8a00b3133aeb128edcac41fb7b60349c9e18764fcf7ea4af14d444\""},
-    "SsmParameterValueawsserviceeksoptimizedami114amazonlinux2recommendedimageidC96584B6F00A464EAD1953AFF4B05118Parameter": {
-      "Type": "AWS::SSM::Parameter::Value<String>",
-      "Default": "/aws/service/eks/optimized-ami/1.14/amazon-linux-2/recommended/image_id"
-    }
-  },
   "Outputs": {
     "ClusterConfigCommand43AAE40F": {
       "Value": {
@@ -1226,5 +1215,35 @@
         ]
       }
     }
+  },
+  "Parameters": {
+    "AssetParametersea4957b16062595851e7d293ee45835db05c5693669a729cc02944b6ad19a204S3Bucket371D99F8": {
+      "Type": "String",
+      "Description": "S3 bucket for asset \"ea4957b16062595851e7d293ee45835db05c5693669a729cc02944b6ad19a204\""
+    },
+    "AssetParametersea4957b16062595851e7d293ee45835db05c5693669a729cc02944b6ad19a204S3VersionKeyFDCB25DD": {
+      "Type": "String",
+      "Description": "S3 key for asset version \"ea4957b16062595851e7d293ee45835db05c5693669a729cc02944b6ad19a204\""
+    },
+    "AssetParametersea4957b16062595851e7d293ee45835db05c5693669a729cc02944b6ad19a204ArtifactHashB80B497F": {
+      "Type": "String",
+      "Description": "Artifact hash for asset \"ea4957b16062595851e7d293ee45835db05c5693669a729cc02944b6ad19a204\""
+    },
+    "AssetParameters640847533c8a00b3133aeb128edcac41fb7b60349c9e18764fcf7ea4af14d444S3Bucket919126CB": {
+      "Type": "String",
+      "Description": "S3 bucket for asset \"640847533c8a00b3133aeb128edcac41fb7b60349c9e18764fcf7ea4af14d444\""
+    },
+    "AssetParameters640847533c8a00b3133aeb128edcac41fb7b60349c9e18764fcf7ea4af14d444S3VersionKey529BEF54": {
+      "Type": "String",
+      "Description": "S3 key for asset version \"640847533c8a00b3133aeb128edcac41fb7b60349c9e18764fcf7ea4af14d444\""
+    },
+    "AssetParameters640847533c8a00b3133aeb128edcac41fb7b60349c9e18764fcf7ea4af14d444ArtifactHash606C8127": {
+      "Type": "String",
+      "Description": "Artifact hash for asset \"640847533c8a00b3133aeb128edcac41fb7b60349c9e18764fcf7ea4af14d444\""
+    },
+    "SsmParameterValueawsserviceeksoptimizedami114amazonlinux2recommendedimageidC96584B6F00A464EAD1953AFF4B05118Parameter": {
+      "Type": "AWS::SSM::Parameter::Value<String>",
+      "Default": "/aws/service/eks/optimized-ami/1.14/amazon-linux-2/recommended/image_id"
+    }
   }
-}
+}
\ No newline at end of file
diff --git a/packages/@aws-cdk/aws-eks/test/integ.eks-cluster.kubectl-disabled.expected.json b/packages/@aws-cdk/aws-eks/test/integ.eks-cluster.kubectl-disabled.expected.json
index 121d53b46ceef..1df699dabf083 100644
--- a/packages/@aws-cdk/aws-eks/test/integ.eks-cluster.kubectl-disabled.expected.json
+++ b/packages/@aws-cdk/aws-eks/test/integ.eks-cluster.kubectl-disabled.expected.json
@@ -10,7 +10,7 @@
         "Tags": [
           {
             "Key": "Name",
-            "Value": "eks-integ-test/VPC"
+            "Value": "eks-integ-kubectl-disabled/VPC"
           }
         ]
       }
@@ -27,7 +27,7 @@
         "Tags": [
           {
             "Key": "Name",
-            "Value": "eks-integ-test/VPC/PublicSubnet1"
+            "Value": "eks-integ-kubectl-disabled/VPC/PublicSubnet1"
           },
           {
             "Key": "aws-cdk:subnet-name",
@@ -49,7 +49,7 @@
         "Tags": [
           {
             "Key": "Name",
-            "Value": "eks-integ-test/VPC/PublicSubnet1"
+            "Value": "eks-integ-kubectl-disabled/VPC/PublicSubnet1"
           }
         ]
       }
@@ -101,7 +101,7 @@
         "Tags": [
           {
             "Key": "Name",
-            "Value": "eks-integ-test/VPC/PublicSubnet1"
+            "Value": "eks-integ-kubectl-disabled/VPC/PublicSubnet1"
           }
         ]
       }
@@ -118,7 +118,7 @@
         "Tags": [
           {
             "Key": "Name",
-            "Value": "eks-integ-test/VPC/PublicSubnet2"
+            "Value": "eks-integ-kubectl-disabled/VPC/PublicSubnet2"
           },
           {
             "Key": "aws-cdk:subnet-name",
@@ -140,7 +140,7 @@
         "Tags": [
           {
             "Key": "Name",
-            "Value": "eks-integ-test/VPC/PublicSubnet2"
+            "Value": "eks-integ-kubectl-disabled/VPC/PublicSubnet2"
           }
         ]
       }
@@ -192,7 +192,7 @@
         "Tags": [
           {
             "Key": "Name",
-            "Value": "eks-integ-test/VPC/PublicSubnet2"
+            "Value": "eks-integ-kubectl-disabled/VPC/PublicSubnet2"
           }
         ]
       }
@@ -209,7 +209,7 @@
         "Tags": [
           {
             "Key": "Name",
-            "Value": "eks-integ-test/VPC/PublicSubnet3"
+            "Value": "eks-integ-kubectl-disabled/VPC/PublicSubnet3"
           },
           {
             "Key": "aws-cdk:subnet-name",
@@ -231,7 +231,7 @@
         "Tags": [
           {
             "Key": "Name",
-            "Value": "eks-integ-test/VPC/PublicSubnet3"
+            "Value": "eks-integ-kubectl-disabled/VPC/PublicSubnet3"
           }
         ]
       }
@@ -283,7 +283,7 @@
         "Tags": [
           {
             "Key": "Name",
-            "Value": "eks-integ-test/VPC/PublicSubnet3"
+            "Value": "eks-integ-kubectl-disabled/VPC/PublicSubnet3"
           }
         ]
       }
@@ -300,7 +300,7 @@
         "Tags": [
           {
             "Key": "Name",
-            "Value": "eks-integ-test/VPC/PrivateSubnet1"
+            "Value": "eks-integ-kubectl-disabled/VPC/PrivateSubnet1"
           },
           {
             "Key": "aws-cdk:subnet-name",
@@ -326,7 +326,7 @@
         "Tags": [
           {
             "Key": "Name",
-            "Value": "eks-integ-test/VPC/PrivateSubnet1"
+            "Value": "eks-integ-kubectl-disabled/VPC/PrivateSubnet1"
           },
           {
             "Key": "kubernetes.io/role/internal-elb",
@@ -370,7 +370,7 @@
         "Tags": [
           {
             "Key": "Name",
-            "Value": "eks-integ-test/VPC/PrivateSubnet2"
+            "Value": "eks-integ-kubectl-disabled/VPC/PrivateSubnet2"
           },
           {
             "Key": "aws-cdk:subnet-name",
@@ -396,7 +396,7 @@
         "Tags": [
           {
             "Key": "Name",
-            "Value": "eks-integ-test/VPC/PrivateSubnet2"
+            "Value": "eks-integ-kubectl-disabled/VPC/PrivateSubnet2"
           },
           {
             "Key": "kubernetes.io/role/internal-elb",
@@ -440,7 +440,7 @@
         "Tags": [
           {
             "Key": "Name",
-            "Value": "eks-integ-test/VPC/PrivateSubnet3"
+            "Value": "eks-integ-kubectl-disabled/VPC/PrivateSubnet3"
           },
           {
             "Key": "aws-cdk:subnet-name",
@@ -466,7 +466,7 @@
         "Tags": [
           {
             "Key": "Name",
-            "Value": "eks-integ-test/VPC/PrivateSubnet3"
+            "Value": "eks-integ-kubectl-disabled/VPC/PrivateSubnet3"
           },
           {
             "Key": "kubernetes.io/role/internal-elb",
@@ -504,7 +504,7 @@
         "Tags": [
           {
             "Key": "Name",
-            "Value": "eks-integ-test/VPC"
+            "Value": "eks-integ-kubectl-disabled/VPC"
           }
         ]
       }
@@ -579,11 +579,11 @@
         }
       }
     },
-    "EKSClusterControlPlaneSecurityGroupfromeksintegtestEKSClusterNodesInstanceSecurityGroup1F94DB4244376AEF332": {
+    "EKSClusterControlPlaneSecurityGroupfromeksintegkubectldisabledEKSClusterNodesInstanceSecurityGroup1E8EEB07443828A1FF0": {
       "Type": "AWS::EC2::SecurityGroupIngress",
       "Properties": {
         "IpProtocol": "tcp",
-        "Description": "from eksintegtestEKSClusterNodesInstanceSecurityGroup1F94DB42:443",
+        "Description": "from eksintegkubectldisabledEKSClusterNodesInstanceSecurityGroup1E8EEB07:443",
         "FromPort": 443,
         "GroupId": {
           "Fn::GetAtt": [
@@ -644,7 +644,7 @@
     "EKSClusterNodesInstanceSecurityGroup460A275E": {
       "Type": "AWS::EC2::SecurityGroup",
       "Properties": {
-        "GroupDescription": "eks-integ-test/EKSCluster/Nodes/InstanceSecurityGroup",
+        "GroupDescription": "eks-integ-kubectl-disabled/EKSCluster/Nodes/InstanceSecurityGroup",
         "SecurityGroupEgress": [
           {
             "CidrIp": "0.0.0.0/0",
@@ -655,7 +655,7 @@
         "Tags": [
           {
             "Key": "Name",
-            "Value": "eks-integ-test/EKSCluster/Nodes"
+            "Value": "eks-integ-kubectl-disabled/EKSCluster/Nodes"
           },
           {
             "Key": {
@@ -677,11 +677,11 @@
         }
       }
     },
-    "EKSClusterNodesInstanceSecurityGroupfromeksintegtestEKSClusterNodesInstanceSecurityGroup1F94DB42ALLTRAFFIC8DF6EC00": {
+    "EKSClusterNodesInstanceSecurityGroupfromeksintegkubectldisabledEKSClusterNodesInstanceSecurityGroup1E8EEB07ALLTRAFFIC813BA9BB": {
       "Type": "AWS::EC2::SecurityGroupIngress",
       "Properties": {
         "IpProtocol": "-1",
-        "Description": "from eksintegtestEKSClusterNodesInstanceSecurityGroup1F94DB42:ALL TRAFFIC",
+        "Description": "from eksintegkubectldisabledEKSClusterNodesInstanceSecurityGroup1E8EEB07:ALL TRAFFIC",
         "GroupId": {
           "Fn::GetAtt": [
             "EKSClusterNodesInstanceSecurityGroup460A275E",
@@ -696,11 +696,11 @@
         }
       }
     },
-    "EKSClusterNodesInstanceSecurityGroupfromeksintegtestEKSClusterControlPlaneSecurityGroup99328DC644383C2D9E9": {
+    "EKSClusterNodesInstanceSecurityGroupfromeksintegkubectldisabledEKSClusterControlPlaneSecurityGroupA8D847C7443405A887C": {
       "Type": "AWS::EC2::SecurityGroupIngress",
       "Properties": {
         "IpProtocol": "tcp",
-        "Description": "from eksintegtestEKSClusterControlPlaneSecurityGroup99328DC6:443",
+        "Description": "from eksintegkubectldisabledEKSClusterControlPlaneSecurityGroupA8D847C7:443",
         "FromPort": 443,
         "GroupId": {
           "Fn::GetAtt": [
@@ -717,11 +717,11 @@
         "ToPort": 443
       }
     },
-    "EKSClusterNodesInstanceSecurityGroupfromeksintegtestEKSClusterControlPlaneSecurityGroup99328DC61025655350D985847": {
+    "EKSClusterNodesInstanceSecurityGroupfromeksintegkubectldisabledEKSClusterControlPlaneSecurityGroupA8D847C71025655350C1AD63E": {
       "Type": "AWS::EC2::SecurityGroupIngress",
       "Properties": {
         "IpProtocol": "tcp",
-        "Description": "from eksintegtestEKSClusterControlPlaneSecurityGroup99328DC6:1025-65535",
+        "Description": "from eksintegkubectldisabledEKSClusterControlPlaneSecurityGroupA8D847C7:1025-65535",
         "FromPort": 1025,
         "GroupId": {
           "Fn::GetAtt": [
@@ -803,8 +803,8 @@
         ],
         "Tags": [
           {
-            "Key":"Name",
-            "Value":"eks-integ-test/EKSCluster/Nodes"
+            "Key": "Name",
+            "Value": "eks-integ-kubectl-disabled/EKSCluster/Nodes"
           },
           {
             "Key": {
@@ -860,7 +860,7 @@
                 {
                   "Ref": "EKSClusterBA6ECF8F"
                 },
-                " --kubelet-extra-args \"--node-labels lifecycle=OnDemand\"\n/opt/aws/bin/cfn-signal --exit-code $? --stack eks-integ-test --resource EKSClusterNodesASGC2597E34 --region test-region"
+                " --kubelet-extra-args \"--node-labels lifecycle=OnDemand\"\n/opt/aws/bin/cfn-signal --exit-code $? --stack eks-integ-kubectl-disabled --resource EKSClusterNodesASGC2597E34 --region test-region"
               ]
             ]
           }
@@ -883,7 +883,7 @@
           {
             "Key": "Name",
             "PropagateAtLaunch": true,
-            "Value": "eks-integ-test/EKSCluster/Nodes"
+            "Value": "eks-integ-kubectl-disabled/EKSCluster/Nodes"
           },
           {
             "Key": {
@@ -931,12 +931,6 @@
       }
     }
   },
-  "Parameters": {
-    "SsmParameterValueawsserviceeksoptimizedami114amazonlinux2recommendedimageidC96584B6F00A464EAD1953AFF4B05118Parameter": {
-      "Type": "AWS::SSM::Parameter::Value<String>",
-      "Default": "/aws/service/eks/optimized-ami/1.14/amazon-linux-2/recommended/image_id"
-    }
-  },
   "Outputs": {
     "EKSClusterConfigCommand3809C9C9": {
       "Value": {
@@ -974,5 +968,11 @@
         ]
       }
     }
+  },
+  "Parameters": {
+    "SsmParameterValueawsserviceeksoptimizedami114amazonlinux2recommendedimageidC96584B6F00A464EAD1953AFF4B05118Parameter": {
+      "Type": "AWS::SSM::Parameter::Value<String>",
+      "Default": "/aws/service/eks/optimized-ami/1.14/amazon-linux-2/recommended/image_id"
+    }
   }
-}
+}
\ No newline at end of file
diff --git a/packages/@aws-cdk/aws-eks/test/integ.eks-cluster.kubectl-disabled.ts b/packages/@aws-cdk/aws-eks/test/integ.eks-cluster.kubectl-disabled.ts
index 261f05eb5dfa7..d7a9b215e29b8 100644
--- a/packages/@aws-cdk/aws-eks/test/integ.eks-cluster.kubectl-disabled.ts
+++ b/packages/@aws-cdk/aws-eks/test/integ.eks-cluster.kubectl-disabled.ts
@@ -28,6 +28,6 @@ const app = new cdk.App();
 
 // since the EKS optimized AMI is hard-coded here based on the region,
 // we need to actually pass in a specific region.
-new EksClusterStack(app, 'eks-integ-test');
+new EksClusterStack(app, 'eks-integ-kubectl-disabled');
 
 app.synth();
\ No newline at end of file
diff --git a/packages/@aws-cdk/aws-eks/test/integ.eks-cluster.lit.expected.json b/packages/@aws-cdk/aws-eks/test/integ.eks-cluster.lit.expected.json
index 68630e9dce88f..11e75ee00d8bf 100644
--- a/packages/@aws-cdk/aws-eks/test/integ.eks-cluster.lit.expected.json
+++ b/packages/@aws-cdk/aws-eks/test/integ.eks-cluster.lit.expected.json
@@ -641,7 +641,8 @@
               "Action": [
                 "eks:CreateCluster",
                 "eks:DescribeCluster",
-                "eks:DeleteCluster"
+                "eks:DeleteCluster",
+                "eks:UpdateClusterVersion"
               ],
               "Effect": "Allow",
               "Resource": "*"
@@ -672,7 +673,7 @@
       "Properties": {
         "Code": {
           "S3Bucket": {
-            "Ref": "AssetParametersc58ce740cd907e33a1af503069821ee4befab4fec4075707d67e86d2a0dbf128S3BucketA2C12383"
+            "Ref": "AssetParametersea4957b16062595851e7d293ee45835db05c5693669a729cc02944b6ad19a204S3Bucket371D99F8"
           },
           "S3Key": {
             "Fn::Join": [
@@ -685,7 +686,7 @@
                       "Fn::Split": [
                         "||",
                         {
-                          "Ref": "AssetParametersc58ce740cd907e33a1af503069821ee4befab4fec4075707d67e86d2a0dbf128S3VersionKeyB5F0BEF8"
+                          "Ref": "AssetParametersea4957b16062595851e7d293ee45835db05c5693669a729cc02944b6ad19a204S3VersionKeyFDCB25DD"
                         }
                       ]
                     }
@@ -698,7 +699,7 @@
                       "Fn::Split": [
                         "||",
                         {
-                          "Ref": "AssetParametersc58ce740cd907e33a1af503069821ee4befab4fec4075707d67e86d2a0dbf128S3VersionKeyB5F0BEF8"
+                          "Ref": "AssetParametersea4957b16062595851e7d293ee45835db05c5693669a729cc02944b6ad19a204S3VersionKeyFDCB25DD"
                         }
                       ]
                     }
@@ -1017,8 +1018,8 @@
         ],
         "Tags": [
           {
-            "Key":"Name",
-            "Value":"eks-integ-test-basic/EKSCluster/Nodes"
+            "Key": "Name",
+            "Value": "eks-integ-test-basic/EKSCluster/Nodes"
           },
           {
             "Key": {
@@ -1185,18 +1186,6 @@
       }
     }
   },
-  "Parameters": {
-    "AssetParametersc58ce740cd907e33a1af503069821ee4befab4fec4075707d67e86d2a0dbf128S3BucketA2C12383": {"Type":"String","Description":"S3 bucket for asset \"c58ce740cd907e33a1af503069821ee4befab4fec4075707d67e86d2a0dbf128\""},
-    "AssetParametersc58ce740cd907e33a1af503069821ee4befab4fec4075707d67e86d2a0dbf128S3VersionKeyB5F0BEF8": {"Type":"String","Description":"S3 key for asset version \"c58ce740cd907e33a1af503069821ee4befab4fec4075707d67e86d2a0dbf128\""},
-    "AssetParametersc58ce740cd907e33a1af503069821ee4befab4fec4075707d67e86d2a0dbf128ArtifactHash8E5121DE": {"Type":"String","Description":"Artifact hash for asset \"c58ce740cd907e33a1af503069821ee4befab4fec4075707d67e86d2a0dbf128\""},
-    "AssetParameters640847533c8a00b3133aeb128edcac41fb7b60349c9e18764fcf7ea4af14d444S3Bucket919126CB": {"Type":"String","Description":"S3 bucket for asset \"640847533c8a00b3133aeb128edcac41fb7b60349c9e18764fcf7ea4af14d444\""},
-    "AssetParameters640847533c8a00b3133aeb128edcac41fb7b60349c9e18764fcf7ea4af14d444S3VersionKey529BEF54": {"Type":"String","Description":"S3 key for asset version \"640847533c8a00b3133aeb128edcac41fb7b60349c9e18764fcf7ea4af14d444\""},
-    "AssetParameters640847533c8a00b3133aeb128edcac41fb7b60349c9e18764fcf7ea4af14d444ArtifactHash606C8127": {"Type":"String","Description":"Artifact hash for asset \"640847533c8a00b3133aeb128edcac41fb7b60349c9e18764fcf7ea4af14d444\""},
-    "SsmParameterValueawsserviceeksoptimizedami114amazonlinux2recommendedimageidC96584B6F00A464EAD1953AFF4B05118Parameter": {
-      "Type": "AWS::SSM::Parameter::Value<String>",
-      "Default": "/aws/service/eks/optimized-ami/1.14/amazon-linux-2/recommended/image_id"
-    }
-  },
   "Outputs": {
     "EKSClusterConfigCommand3809C9C9": {
       "Value": {
@@ -1226,5 +1215,35 @@
         ]
       }
     }
+  },
+  "Parameters": {
+    "AssetParametersea4957b16062595851e7d293ee45835db05c5693669a729cc02944b6ad19a204S3Bucket371D99F8": {
+      "Type": "String",
+      "Description": "S3 bucket for asset \"ea4957b16062595851e7d293ee45835db05c5693669a729cc02944b6ad19a204\""
+    },
+    "AssetParametersea4957b16062595851e7d293ee45835db05c5693669a729cc02944b6ad19a204S3VersionKeyFDCB25DD": {
+      "Type": "String",
+      "Description": "S3 key for asset version \"ea4957b16062595851e7d293ee45835db05c5693669a729cc02944b6ad19a204\""
+    },
+    "AssetParametersea4957b16062595851e7d293ee45835db05c5693669a729cc02944b6ad19a204ArtifactHashB80B497F": {
+      "Type": "String",
+      "Description": "Artifact hash for asset \"ea4957b16062595851e7d293ee45835db05c5693669a729cc02944b6ad19a204\""
+    },
+    "AssetParameters640847533c8a00b3133aeb128edcac41fb7b60349c9e18764fcf7ea4af14d444S3Bucket919126CB": {
+      "Type": "String",
+      "Description": "S3 bucket for asset \"640847533c8a00b3133aeb128edcac41fb7b60349c9e18764fcf7ea4af14d444\""
+    },
+    "AssetParameters640847533c8a00b3133aeb128edcac41fb7b60349c9e18764fcf7ea4af14d444S3VersionKey529BEF54": {
+      "Type": "String",
+      "Description": "S3 key for asset version \"640847533c8a00b3133aeb128edcac41fb7b60349c9e18764fcf7ea4af14d444\""
+    },
+    "AssetParameters640847533c8a00b3133aeb128edcac41fb7b60349c9e18764fcf7ea4af14d444ArtifactHash606C8127": {
+      "Type": "String",
+      "Description": "Artifact hash for asset \"640847533c8a00b3133aeb128edcac41fb7b60349c9e18764fcf7ea4af14d444\""
+    },
+    "SsmParameterValueawsserviceeksoptimizedami114amazonlinux2recommendedimageidC96584B6F00A464EAD1953AFF4B05118Parameter": {
+      "Type": "AWS::SSM::Parameter::Value<String>",
+      "Default": "/aws/service/eks/optimized-ami/1.14/amazon-linux-2/recommended/image_id"
+    }
   }
-}
+}
\ No newline at end of file
diff --git a/packages/@aws-cdk/aws-eks/test/integ.eks-kubectl.lit.expected.json b/packages/@aws-cdk/aws-eks/test/integ.eks-kubectl.lit.expected.json
index a94f755bc4777..8d2096bd5bde7 100644
--- a/packages/@aws-cdk/aws-eks/test/integ.eks-kubectl.lit.expected.json
+++ b/packages/@aws-cdk/aws-eks/test/integ.eks-kubectl.lit.expected.json
@@ -527,7 +527,8 @@
                 "Action": [
                   "eks:CreateCluster",
                   "eks:DescribeCluster",
-                  "eks:DeleteCluster"
+                  "eks:DeleteCluster",
+                  "eks:UpdateClusterVersion"
                 ],
                 "Effect": "Allow",
                 "Resource": "*"
@@ -558,7 +559,7 @@
         "Properties": {
           "Code": {
             "S3Bucket": {
-              "Ref": "AssetParametersc58ce740cd907e33a1af503069821ee4befab4fec4075707d67e86d2a0dbf128S3BucketA2C12383"
+              "Ref": "AssetParametersea4957b16062595851e7d293ee45835db05c5693669a729cc02944b6ad19a204S3Bucket371D99F8"
             },
             "S3Key": {
               "Fn::Join": [
@@ -571,7 +572,7 @@
                         "Fn::Split": [
                           "||",
                           {
-                            "Ref": "AssetParametersc58ce740cd907e33a1af503069821ee4befab4fec4075707d67e86d2a0dbf128S3VersionKeyB5F0BEF8"
+                            "Ref": "AssetParametersea4957b16062595851e7d293ee45835db05c5693669a729cc02944b6ad19a204S3VersionKeyFDCB25DD"
                           }
                         ]
                       }
@@ -584,7 +585,7 @@
                         "Fn::Split": [
                           "||",
                           {
-                            "Ref": "AssetParametersc58ce740cd907e33a1af503069821ee4befab4fec4075707d67e86d2a0dbf128S3VersionKeyB5F0BEF8"
+                            "Ref": "AssetParametersea4957b16062595851e7d293ee45835db05c5693669a729cc02944b6ad19a204S3VersionKeyFDCB25DD"
                           }
                         ]
                       }
@@ -1142,17 +1143,17 @@
       }
     },
     "Parameters": {
-      "AssetParametersc58ce740cd907e33a1af503069821ee4befab4fec4075707d67e86d2a0dbf128S3BucketA2C12383": {
+      "AssetParametersea4957b16062595851e7d293ee45835db05c5693669a729cc02944b6ad19a204S3Bucket371D99F8": {
         "Type": "String",
-        "Description": "S3 bucket for asset \"c58ce740cd907e33a1af503069821ee4befab4fec4075707d67e86d2a0dbf128\""
+        "Description": "S3 bucket for asset \"ea4957b16062595851e7d293ee45835db05c5693669a729cc02944b6ad19a204\""
       },
-      "AssetParametersc58ce740cd907e33a1af503069821ee4befab4fec4075707d67e86d2a0dbf128S3VersionKeyB5F0BEF8": {
+      "AssetParametersea4957b16062595851e7d293ee45835db05c5693669a729cc02944b6ad19a204S3VersionKeyFDCB25DD": {
         "Type": "String",
-        "Description": "S3 key for asset version \"c58ce740cd907e33a1af503069821ee4befab4fec4075707d67e86d2a0dbf128\""
+        "Description": "S3 key for asset version \"ea4957b16062595851e7d293ee45835db05c5693669a729cc02944b6ad19a204\""
       },
-      "AssetParametersc58ce740cd907e33a1af503069821ee4befab4fec4075707d67e86d2a0dbf128ArtifactHash8E5121DE": {
+      "AssetParametersea4957b16062595851e7d293ee45835db05c5693669a729cc02944b6ad19a204ArtifactHashB80B497F": {
         "Type": "String",
-        "Description": "Artifact hash for asset \"c58ce740cd907e33a1af503069821ee4befab4fec4075707d67e86d2a0dbf128\""
+        "Description": "Artifact hash for asset \"ea4957b16062595851e7d293ee45835db05c5693669a729cc02944b6ad19a204\""
       },
       "AssetParameters640847533c8a00b3133aeb128edcac41fb7b60349c9e18764fcf7ea4af14d444S3Bucket919126CB": {
         "Type": "String",
diff --git a/packages/@aws-cdk/aws-eks/test/integ.eks-spot.expected.json b/packages/@aws-cdk/aws-eks/test/integ.eks-spot.expected.json
index 92adde90ad68d..ed96b80703d1a 100644
--- a/packages/@aws-cdk/aws-eks/test/integ.eks-spot.expected.json
+++ b/packages/@aws-cdk/aws-eks/test/integ.eks-spot.expected.json
@@ -501,7 +501,8 @@
               "Action": [
                 "eks:CreateCluster",
                 "eks:DescribeCluster",
-                "eks:DeleteCluster"
+                "eks:DeleteCluster",
+                "eks:UpdateClusterVersion"
               ],
               "Effect": "Allow",
               "Resource": "*"
@@ -532,7 +533,7 @@
       "Properties": {
         "Code": {
           "S3Bucket": {
-            "Ref": "AssetParametersc58ce740cd907e33a1af503069821ee4befab4fec4075707d67e86d2a0dbf128S3BucketA2C12383"
+            "Ref": "AssetParametersea4957b16062595851e7d293ee45835db05c5693669a729cc02944b6ad19a204S3Bucket371D99F8"
           },
           "S3Key": {
             "Fn::Join": [
@@ -545,7 +546,7 @@
                       "Fn::Split": [
                         "||",
                         {
-                          "Ref": "AssetParametersc58ce740cd907e33a1af503069821ee4befab4fec4075707d67e86d2a0dbf128S3VersionKeyB5F0BEF8"
+                          "Ref": "AssetParametersea4957b16062595851e7d293ee45835db05c5693669a729cc02944b6ad19a204S3VersionKeyFDCB25DD"
                         }
                       ]
                     }
@@ -558,7 +559,7 @@
                       "Fn::Split": [
                         "||",
                         {
-                          "Ref": "AssetParametersc58ce740cd907e33a1af503069821ee4befab4fec4075707d67e86d2a0dbf128S3VersionKeyB5F0BEF8"
+                          "Ref": "AssetParametersea4957b16062595851e7d293ee45835db05c5693669a729cc02944b6ad19a204S3VersionKeyFDCB25DD"
                         }
                       ]
                     }
@@ -809,26 +810,6 @@
     "myClusterDefaultCapacityInstanceRoleA36E0984": {
       "Type": "AWS::IAM::Role",
       "Properties": {
-        "Tags": [
-          {
-            "Key": "Name",
-            "Value": "integ-eks-spot/myCluster/DefaultCapacity"
-          },
-          {
-            "Key": {
-              "Fn::Join": [
-                "",
-                [
-                  "kubernetes.io/cluster/",
-                  {
-                    "Ref": "myClusterE51CD07F"
-                  }
-                ]
-              ]
-            },
-            "Value": "owned"
-          }
-        ],
         "AssumeRolePolicyDocument": {
           "Statement": [
             {
@@ -888,6 +869,26 @@
               ]
             ]
           }
+        ],
+        "Tags": [
+          {
+            "Key": "Name",
+            "Value": "integ-eks-spot/myCluster/DefaultCapacity"
+          },
+          {
+            "Key": {
+              "Fn::Join": [
+                "",
+                [
+                  "kubernetes.io/cluster/",
+                  {
+                    "Ref": "myClusterE51CD07F"
+                  }
+                ]
+              ]
+            },
+            "Value": "owned"
+          }
         ]
       }
     },
@@ -1130,26 +1131,6 @@
     "myClusterspotInstanceRole03AE80B5": {
       "Type": "AWS::IAM::Role",
       "Properties": {
-        "Tags": [
-          {
-            "Key": "Name",
-            "Value": "integ-eks-spot/myCluster/spot"
-          },
-          {
-            "Key": {
-              "Fn::Join": [
-                "",
-                [
-                  "kubernetes.io/cluster/",
-                  {
-                    "Ref": "myClusterE51CD07F"
-                  }
-                ]
-              ]
-            },
-            "Value": "owned"
-          }
-        ],
         "AssumeRolePolicyDocument": {
           "Statement": [
             {
@@ -1209,6 +1190,26 @@
               ]
             ]
           }
+        ],
+        "Tags": [
+          {
+            "Key": "Name",
+            "Value": "integ-eks-spot/myCluster/spot"
+          },
+          {
+            "Key": {
+              "Fn::Join": [
+                "",
+                [
+                  "kubernetes.io/cluster/",
+                  {
+                    "Ref": "myClusterE51CD07F"
+                  }
+                ]
+              ]
+            },
+            "Value": "owned"
+          }
         ]
       }
     },
@@ -1344,18 +1345,6 @@
       }
     }
   },
-  "Parameters": {
-    "AssetParametersc58ce740cd907e33a1af503069821ee4befab4fec4075707d67e86d2a0dbf128S3BucketA2C12383": {"Type":"String","Description":"S3 bucket for asset \"c58ce740cd907e33a1af503069821ee4befab4fec4075707d67e86d2a0dbf128\""},
-    "AssetParametersc58ce740cd907e33a1af503069821ee4befab4fec4075707d67e86d2a0dbf128S3VersionKeyB5F0BEF8": {"Type":"String","Description":"S3 key for asset version \"c58ce740cd907e33a1af503069821ee4befab4fec4075707d67e86d2a0dbf128\""},
-    "AssetParametersc58ce740cd907e33a1af503069821ee4befab4fec4075707d67e86d2a0dbf128ArtifactHash8E5121DE": {"Type":"String","Description":"Artifact hash for asset \"c58ce740cd907e33a1af503069821ee4befab4fec4075707d67e86d2a0dbf128\""},
-    "AssetParameters640847533c8a00b3133aeb128edcac41fb7b60349c9e18764fcf7ea4af14d444S3Bucket919126CB": {"Type":"String","Description":"S3 bucket for asset \"640847533c8a00b3133aeb128edcac41fb7b60349c9e18764fcf7ea4af14d444\""},
-    "AssetParameters640847533c8a00b3133aeb128edcac41fb7b60349c9e18764fcf7ea4af14d444S3VersionKey529BEF54": {"Type":"String","Description":"S3 key for asset version \"640847533c8a00b3133aeb128edcac41fb7b60349c9e18764fcf7ea4af14d444\""},
-    "AssetParameters640847533c8a00b3133aeb128edcac41fb7b60349c9e18764fcf7ea4af14d444ArtifactHash606C8127": {"Type":"String","Description":"Artifact hash for asset \"640847533c8a00b3133aeb128edcac41fb7b60349c9e18764fcf7ea4af14d444\""},
-    "SsmParameterValueawsserviceeksoptimizedami114amazonlinux2recommendedimageidC96584B6F00A464EAD1953AFF4B05118Parameter": {
-      "Type": "AWS::SSM::Parameter::Value<String>",
-      "Default": "/aws/service/eks/optimized-ami/1.14/amazon-linux-2/recommended/image_id"
-    }
-  },
   "Outputs": {
     "myClusterConfigCommandAC521B60": {
       "Value": {
@@ -1385,5 +1374,35 @@
         ]
       }
     }
+  },
+  "Parameters": {
+    "AssetParametersea4957b16062595851e7d293ee45835db05c5693669a729cc02944b6ad19a204S3Bucket371D99F8": {
+      "Type": "String",
+      "Description": "S3 bucket for asset \"ea4957b16062595851e7d293ee45835db05c5693669a729cc02944b6ad19a204\""
+    },
+    "AssetParametersea4957b16062595851e7d293ee45835db05c5693669a729cc02944b6ad19a204S3VersionKeyFDCB25DD": {
+      "Type": "String",
+      "Description": "S3 key for asset version \"ea4957b16062595851e7d293ee45835db05c5693669a729cc02944b6ad19a204\""
+    },
+    "AssetParametersea4957b16062595851e7d293ee45835db05c5693669a729cc02944b6ad19a204ArtifactHashB80B497F": {
+      "Type": "String",
+      "Description": "Artifact hash for asset \"ea4957b16062595851e7d293ee45835db05c5693669a729cc02944b6ad19a204\""
+    },
+    "AssetParameters640847533c8a00b3133aeb128edcac41fb7b60349c9e18764fcf7ea4af14d444S3Bucket919126CB": {
+      "Type": "String",
+      "Description": "S3 bucket for asset \"640847533c8a00b3133aeb128edcac41fb7b60349c9e18764fcf7ea4af14d444\""
+    },
+    "AssetParameters640847533c8a00b3133aeb128edcac41fb7b60349c9e18764fcf7ea4af14d444S3VersionKey529BEF54": {
+      "Type": "String",
+      "Description": "S3 key for asset version \"640847533c8a00b3133aeb128edcac41fb7b60349c9e18764fcf7ea4af14d444\""
+    },
+    "AssetParameters640847533c8a00b3133aeb128edcac41fb7b60349c9e18764fcf7ea4af14d444ArtifactHash606C8127": {
+      "Type": "String",
+      "Description": "Artifact hash for asset \"640847533c8a00b3133aeb128edcac41fb7b60349c9e18764fcf7ea4af14d444\""
+    },
+    "SsmParameterValueawsserviceeksoptimizedami114amazonlinux2recommendedimageidC96584B6F00A464EAD1953AFF4B05118Parameter": {
+      "Type": "AWS::SSM::Parameter::Value<String>",
+      "Default": "/aws/service/eks/optimized-ami/1.14/amazon-linux-2/recommended/image_id"
+    }
   }
 }
\ No newline at end of file
diff --git a/packages/@aws-cdk/aws-eks/test/test.cluster-resource.ts b/packages/@aws-cdk/aws-eks/test/test.cluster-resource.ts
new file mode 100644
index 0000000000000..08e81789f9234
--- /dev/null
+++ b/packages/@aws-cdk/aws-eks/test/test.cluster-resource.ts
@@ -0,0 +1,69 @@
+import { Test } from 'nodeunit';
+
+export = {
+  create: {
+    'defaults'(test: Test) {
+      test.done();
+    },
+    'with no specific version'(test: Test) {
+      test.done();
+    }
+  },
+
+  update: {
+    'requires replacement': {
+      'change of "name" creates a new cluster with the new name and deletes the old cluster'(test: Test) {
+        test.done();
+      },
+      'change of "resourcesVpcConfig"'(test: Test) {
+        test.done();
+      },
+      'change of "roleArn"'(test: Test) {
+        test.done();
+      },
+      'change of "roleArn" and "version"'(test: Test) {
+        test.done();
+      }
+    },
+
+    'in-place': {
+      'version change': {
+        'from undefined to a specific value'(test: Test) {
+          test.done();
+        },
+
+        'from a specific value to another value'(test: Test) {
+          test.done();
+        },
+
+        'fails from specific value to undefined'(test: Test) {
+          test.done();
+        }
+      }
+    },
+
+    'update failure returns the previous physical name': {
+
+      'for "version" updates'(test: Test) {
+        test.done();
+      },
+
+      'for "name" updates'(test: Test) {
+        test.done();
+      },
+
+      'for "roleArn" updates'(test: Test) {
+        test.done();
+      }
+
+    }
+  },
+
+  delete: {
+    'delete failure': {
+      'returns correct physical name'(test: Test) {
+        test.done();
+      }
+    }
+  }
+};
\ No newline at end of file
diff --git a/packages/@aws-cdk/aws-elasticache/package.json b/packages/@aws-cdk/aws-elasticache/package.json
index db655756ef186..0106028af093a 100644
--- a/packages/@aws-cdk/aws-elasticache/package.json
+++ b/packages/@aws-cdk/aws-elasticache/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@aws-cdk/aws-elasticache",
-  "version": "1.13.1",
+  "version": "1.15.0",
   "description": "The CDK Construct Library for AWS::ElastiCache",
   "main": "lib/index.js",
   "types": "lib/index.d.ts",
@@ -63,17 +63,17 @@
   },
   "license": "Apache-2.0",
   "devDependencies": {
-    "@aws-cdk/assert": "1.13.1",
-    "cdk-build-tools": "^1.13.1",
-    "cfn2ts": "^1.13.1",
-    "pkglint": "^1.13.1"
+    "@aws-cdk/assert": "1.15.0",
+    "cdk-build-tools": "^1.15.0",
+    "cfn2ts": "^1.15.0",
+    "pkglint": "^1.15.0"
   },
   "dependencies": {
-    "@aws-cdk/core": "1.13.1"
+    "@aws-cdk/core": "1.15.0"
   },
   "homepage": "https://github.com/aws/aws-cdk",
   "peerDependencies": {
-    "@aws-cdk/core": "1.13.1"
+    "@aws-cdk/core": "1.15.0"
   },
   "engines": {
     "node": ">= 10.3.0"
diff --git a/packages/@aws-cdk/aws-elasticbeanstalk/package.json b/packages/@aws-cdk/aws-elasticbeanstalk/package.json
index 74b79e6edd8ed..b5554f7463cc0 100644
--- a/packages/@aws-cdk/aws-elasticbeanstalk/package.json
+++ b/packages/@aws-cdk/aws-elasticbeanstalk/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@aws-cdk/aws-elasticbeanstalk",
-  "version": "1.13.1",
+  "version": "1.15.0",
   "description": "The CDK Construct Library for AWS::ElasticBeanstalk",
   "main": "lib/index.js",
   "types": "lib/index.d.ts",
@@ -63,17 +63,17 @@
   },
   "license": "Apache-2.0",
   "devDependencies": {
-    "@aws-cdk/assert": "1.13.1",
-    "cdk-build-tools": "^1.13.1",
-    "cfn2ts": "^1.13.1",
-    "pkglint": "^1.13.1"
+    "@aws-cdk/assert": "1.15.0",
+    "cdk-build-tools": "^1.15.0",
+    "cfn2ts": "^1.15.0",
+    "pkglint": "^1.15.0"
   },
   "dependencies": {
-    "@aws-cdk/core": "1.13.1"
+    "@aws-cdk/core": "1.15.0"
   },
   "homepage": "https://github.com/aws/aws-cdk",
   "peerDependencies": {
-    "@aws-cdk/core": "1.13.1"
+    "@aws-cdk/core": "1.15.0"
   },
   "engines": {
     "node": ">= 10.3.0"
diff --git a/packages/@aws-cdk/aws-elasticloadbalancing/package.json b/packages/@aws-cdk/aws-elasticloadbalancing/package.json
index 566faacf1a2db..9a09bb2b8b66a 100644
--- a/packages/@aws-cdk/aws-elasticloadbalancing/package.json
+++ b/packages/@aws-cdk/aws-elasticloadbalancing/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@aws-cdk/aws-elasticloadbalancing",
-  "version": "1.13.1",
+  "version": "1.15.0",
   "description": "CDK Constructs for AWS ElasticLoadBalancing",
   "main": "lib/index.js",
   "types": "lib/index.d.ts",
@@ -63,27 +63,44 @@
   },
   "license": "Apache-2.0",
   "devDependencies": {
-    "@aws-cdk/assert": "1.13.1",
-    "cdk-build-tools": "^1.13.1",
-    "cdk-integ-tools": "^1.13.1",
-    "cfn2ts": "^1.13.1",
-    "pkglint": "^1.13.1"
+    "@aws-cdk/assert": "1.15.0",
+    "cdk-build-tools": "^1.15.0",
+    "cdk-integ-tools": "^1.15.0",
+    "cfn2ts": "^1.15.0",
+    "pkglint": "^1.15.0"
   },
   "dependencies": {
-    "@aws-cdk/aws-ec2": "1.13.1",
-    "@aws-cdk/core": "1.13.1"
+    "@aws-cdk/aws-ec2": "1.15.0",
+    "@aws-cdk/core": "1.15.0"
   },
   "homepage": "https://github.com/aws/aws-cdk",
   "peerDependencies": {
-    "@aws-cdk/aws-ec2": "1.13.1",
-    "@aws-cdk/core": "1.13.1"
+    "@aws-cdk/aws-ec2": "1.15.0",
+    "@aws-cdk/core": "1.15.0"
   },
   "engines": {
     "node": ">= 10.3.0"
   },
   "awslint": {
     "exclude": [
-      "props-physical-name:@aws-cdk/aws-elasticloadbalancing.LoadBalancerProps"
+      "props-physical-name:@aws-cdk/aws-elasticloadbalancing.LoadBalancerProps",
+      "docs-public-apis:@aws-cdk/aws-elasticloadbalancing.LoadBalancer.addTarget",
+      "docs-public-apis:@aws-cdk/aws-elasticloadbalancing.LoadBalancingProtocol.HTTPS",
+      "docs-public-apis:@aws-cdk/aws-elasticloadbalancing.ListenerPort.connections",
+      "docs-public-apis:@aws-cdk/aws-elasticloadbalancing.LoadBalancer.loadBalancerCanonicalHostedZoneName",
+      "docs-public-apis:@aws-cdk/aws-elasticloadbalancing.LoadBalancer.loadBalancerCanonicalHostedZoneNameId",
+      "docs-public-apis:@aws-cdk/aws-elasticloadbalancing.LoadBalancer.loadBalancerDnsName",
+      "docs-public-apis:@aws-cdk/aws-elasticloadbalancing.LoadBalancer.loadBalancerName",
+      "docs-public-apis:@aws-cdk/aws-elasticloadbalancing.LoadBalancer.loadBalancerSourceSecurityGroupGroupName",
+      "docs-public-apis:@aws-cdk/aws-elasticloadbalancing.LoadBalancer.loadBalancerSourceSecurityGroupOwnerAlias",
+      "docs-public-apis:@aws-cdk/aws-elasticloadbalancing.LoadBalancingProtocol.HTTP",
+      "props-default-doc:@aws-cdk/aws-elasticloadbalancing.LoadBalancerListener.externalProtocol",
+      "props-default-doc:@aws-cdk/aws-elasticloadbalancing.LoadBalancerListener.internalProtocol",
+      "props-default-doc:@aws-cdk/aws-elasticloadbalancing.LoadBalancerListener.policyNames",
+      "props-default-doc:@aws-cdk/aws-elasticloadbalancing.LoadBalancerListener.sslCertificateId",
+      "docs-public-apis:@aws-cdk/aws-elasticloadbalancing.LoadBalancingProtocol",
+      "docs-public-apis:@aws-cdk/aws-elasticloadbalancing.LoadBalancingProtocol.TCP",
+      "docs-public-apis:@aws-cdk/aws-elasticloadbalancing.LoadBalancingProtocol.SSL"
     ]
   },
   "stability": "stable"
diff --git a/packages/@aws-cdk/aws-elasticloadbalancingv2-targets/package.json b/packages/@aws-cdk/aws-elasticloadbalancingv2-targets/package.json
index 8997872bf1d4a..3cc729efd75af 100644
--- a/packages/@aws-cdk/aws-elasticloadbalancingv2-targets/package.json
+++ b/packages/@aws-cdk/aws-elasticloadbalancingv2-targets/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@aws-cdk/aws-elasticloadbalancingv2-targets",
-  "version": "1.13.1",
+  "version": "1.15.0",
   "description": "Integration targets for AWS ElasticLoadBalancingV2",
   "main": "lib/index.js",
   "types": "lib/index.d.ts",
@@ -72,30 +72,36 @@
   },
   "license": "Apache-2.0",
   "devDependencies": {
-    "@aws-cdk/assert": "1.13.1",
-    "@aws-cdk/aws-ec2": "1.13.1",
-    "cdk-build-tools": "^1.13.1",
-    "cdk-integ-tools": "^1.13.1",
+    "@aws-cdk/assert": "1.15.0",
+    "@aws-cdk/aws-ec2": "1.15.0",
+    "cdk-build-tools": "^1.15.0",
+    "cdk-integ-tools": "^1.15.0",
     "jest": "^24.9.0",
-    "pkglint": "^1.13.1"
+    "pkglint": "^1.15.0"
   },
   "dependencies": {
-    "@aws-cdk/assets": "1.13.1",
-    "@aws-cdk/aws-elasticloadbalancingv2": "1.13.1",
-    "@aws-cdk/aws-iam": "1.13.1",
-    "@aws-cdk/aws-lambda": "1.13.1",
-    "@aws-cdk/core": "1.13.1"
+    "@aws-cdk/assets": "1.15.0",
+    "@aws-cdk/aws-elasticloadbalancingv2": "1.15.0",
+    "@aws-cdk/aws-iam": "1.15.0",
+    "@aws-cdk/aws-lambda": "1.15.0",
+    "@aws-cdk/core": "1.15.0"
   },
   "homepage": "https://github.com/aws/aws-cdk",
   "peerDependencies": {
-    "@aws-cdk/assets": "1.13.1",
-    "@aws-cdk/aws-elasticloadbalancingv2": "1.13.1",
-    "@aws-cdk/aws-iam": "1.13.1",
-    "@aws-cdk/aws-lambda": "1.13.1",
-    "@aws-cdk/core": "1.13.1"
+    "@aws-cdk/assets": "1.15.0",
+    "@aws-cdk/aws-elasticloadbalancingv2": "1.15.0",
+    "@aws-cdk/aws-iam": "1.15.0",
+    "@aws-cdk/aws-lambda": "1.15.0",
+    "@aws-cdk/core": "1.15.0"
   },
   "engines": {
     "node": ">= 10.3.0"
   },
-  "stability": "experimental"
+  "stability": "experimental",
+  "awslint": {
+    "exclude": [
+      "docs-public-apis:@aws-cdk/aws-elasticloadbalancingv2-targets.InstanceTarget",
+      "docs-public-apis:@aws-cdk/aws-elasticloadbalancingv2-targets.LambdaTarget"
+    ]
+  }
 }
diff --git a/packages/@aws-cdk/aws-elasticloadbalancingv2/README.md b/packages/@aws-cdk/aws-elasticloadbalancingv2/README.md
index b5038f5596d43..619dcf754b139 100644
--- a/packages/@aws-cdk/aws-elasticloadbalancingv2/README.md
+++ b/packages/@aws-cdk/aws-elasticloadbalancingv2/README.md
@@ -208,6 +208,22 @@ listener.addTargets('AppFleet', {
 listener.connections.allowFrom(lb, ec2.Port.tcp(8088));
 ```
 
+### Using a Load Balancer from a different Stack
+
+If you want to put your Load Balancer and the Targets it is load balancing to in
+different stacks, you may not be able to use the convenience methods
+`loadBalancer.addListener()` and `listener.addTargets()`.
+
+The reason is that these methods will create resources in the same Stack as the
+object they're called on, which may lead to cyclic references between stacks.
+Instead, you will have to create an `ApplicationListener` in the target stack,
+or an empty `TargetGroup` in the load balancer stack that you attach your
+service to.
+
+For an example of the alternatives while load balancing to an ECS service, see the
+[ecs/cross-stack-load-balancer
+example](https://github.com/aws-samples/aws-cdk-examples/tree/master/typescript/ecs/cross-stack-load-balancer/).
+
 ### Protocol for Load Balancer Targets
 
 Constructs that want to be a load balancer target should implement
diff --git a/packages/@aws-cdk/aws-elasticloadbalancingv2/lib/alb/application-target-group.ts b/packages/@aws-cdk/aws-elasticloadbalancingv2/lib/alb/application-target-group.ts
index 1b8d550e0a227..8b46b5154a8a6 100644
--- a/packages/@aws-cdk/aws-elasticloadbalancingv2/lib/alb/application-target-group.ts
+++ b/packages/@aws-cdk/aws-elasticloadbalancingv2/lib/alb/application-target-group.ts
@@ -3,7 +3,7 @@ import ec2 = require('@aws-cdk/aws-ec2');
 import { Construct, Duration, IConstruct } from '@aws-cdk/core';
 import {
   BaseTargetGroupProps, ITargetGroup, loadBalancerNameFromListenerArn, LoadBalancerTargetProps,
-  TargetGroupBase, TargetGroupImportProps
+  TargetGroupAttributes, TargetGroupBase, TargetGroupImportProps
 } from '../shared/base-target-group';
 import { ApplicationProtocol, Protocol, TargetType } from '../shared/enums';
 import { ImportedTargetGroupBase } from '../shared/imported';
@@ -70,8 +70,17 @@ export class ApplicationTargetGroup extends TargetGroupBase implements IApplicat
   /**
    * Import an existing target group
    */
+  public static fromTargetGroupAttributes(scope: Construct, id: string, attrs: TargetGroupAttributes): IApplicationTargetGroup {
+    return new ImportedApplicationTargetGroup(scope, id, attrs);
+  }
+
+  /**
+   * Import an existing target group
+   *
+   * @deprecated Use `fromTargetGroupAttributes` instead
+   */
   public static import(scope: Construct, id: string, props: TargetGroupImportProps): IApplicationTargetGroup {
-    return new ImportedApplicationTargetGroup(scope, id, props);
+    return ApplicationTargetGroup.fromTargetGroupAttributes(scope, id, props);
   }
 
   private readonly connectableMembers: ConnectableMember[];
@@ -352,6 +361,11 @@ export interface IApplicationTargetGroup extends ITargetGroup {
    * Don't call this directly. It will be called by load balancing targets.
    */
   registerConnectable(connectable: ec2.IConnectable, portRange?: ec2.Port): void;
+
+  /**
+   * Add a load balancing target to this target group
+   */
+  addTarget(...targets: IApplicationLoadBalancerTarget[]): void;
 }
 
 /**
@@ -366,6 +380,16 @@ class ImportedApplicationTargetGroup extends ImportedTargetGroupBase implements
   public registerConnectable(_connectable: ec2.IConnectable, _portRange?: ec2.Port | undefined): void {
     this.node.addWarning(`Cannot register connectable on imported target group -- security groups might need to be updated manually`);
   }
+
+  public addTarget(...targets: IApplicationLoadBalancerTarget[]) {
+    for (const target of targets) {
+      const result = target.attachToApplicationTargetGroup(this);
+
+      if (result.targetJson !== undefined) {
+        throw new Error('Cannot add a non-self registering target to an imported TargetGroup. Create a new TargetGroup instead.');
+      }
+    }
+  }
 }
 
 /**
diff --git a/packages/@aws-cdk/aws-elasticloadbalancingv2/lib/nlb/network-target-group.ts b/packages/@aws-cdk/aws-elasticloadbalancingv2/lib/nlb/network-target-group.ts
index 5fe5fc5a23ba7..d8f9842d90a6e 100644
--- a/packages/@aws-cdk/aws-elasticloadbalancingv2/lib/nlb/network-target-group.ts
+++ b/packages/@aws-cdk/aws-elasticloadbalancingv2/lib/nlb/network-target-group.ts
@@ -1,6 +1,6 @@
 import cdk = require('@aws-cdk/core');
 import { BaseTargetGroupProps, HealthCheck, ITargetGroup, loadBalancerNameFromListenerArn, LoadBalancerTargetProps,
-         TargetGroupBase, TargetGroupImportProps } from '../shared/base-target-group';
+         TargetGroupAttributes, TargetGroupBase, TargetGroupImportProps } from '../shared/base-target-group';
 import { Protocol } from '../shared/enums';
 import { ImportedTargetGroupBase } from '../shared/imported';
 import { INetworkListener } from './network-listener';
@@ -37,11 +37,20 @@ export interface NetworkTargetGroupProps extends BaseTargetGroupProps {
  * Define a Network Target Group
  */
 export class NetworkTargetGroup extends TargetGroupBase implements INetworkTargetGroup {
+  /**
+   * Import an existing target group
+   */
+  public static fromTargetGroupAttributes(scope: cdk.Construct, id: string, attrs: TargetGroupAttributes): INetworkTargetGroup {
+    return new ImportedNetworkTargetGroup(scope, id, attrs);
+  }
+
   /**
    * Import an existing listener
+   *
+   * @deprecated Use `fromTargetGroupAttributes` instead
    */
   public static import(scope: cdk.Construct, id: string, props: TargetGroupImportProps): INetworkTargetGroup {
-    return new ImportedNetworkTargetGroup(scope, id, props);
+    return NetworkTargetGroup.fromTargetGroupAttributes(scope, id, props);
   }
 
   private readonly listeners: INetworkListener[];
@@ -54,8 +63,8 @@ export class NetworkTargetGroup extends TargetGroupBase implements INetworkTarge
 
     this.listeners = [];
 
-    if (props.proxyProtocolV2) {
-      this.setAttribute('proxy_protocol_v2.enabled', 'true');
+    if (props.proxyProtocolV2 != null) {
+      this.setAttribute('proxy_protocol_v2.enabled', props.proxyProtocolV2 ? 'true' : 'false');
     }
 
     this.addTarget(...(props.targets || []));
@@ -103,14 +112,25 @@ export class NetworkTargetGroup extends TargetGroupBase implements INetworkTarge
         ret.push(`Health check interval '${seconds}' not supported. Must be one of the following values '${allowedIntervals.join(',')}'.`);
       }
     }
-    if (healthCheck.path) {
-      ret.push('Health check paths are not supported for Network Load Balancer health checks');
+
+    if (!healthCheck.protocol) {
+      return ret;
     }
-    if (healthCheck.protocol && !NLB_HEALTH_CHECK_PROTOCOLS.includes(healthCheck.protocol)) {
+
+    if (!NLB_HEALTH_CHECK_PROTOCOLS.includes(healthCheck.protocol)) {
       ret.push(`Health check protocol '${healthCheck.protocol}' is not supported. Must be one of [${NLB_HEALTH_CHECK_PROTOCOLS.join(', ')}]`);
     }
-    if (healthCheck.timeout) {
-      ret.push('Custom health check timeouts are not supported for Network Load Balancer health checks');
+    if (healthCheck.path && !NLB_PATH_HEALTH_CHECK_PROTOCOLS.includes(healthCheck.protocol)) {
+      ret.push([
+        `'${healthCheck.protocol}' health checks do not support the path property.`,
+        `Must be one of [${NLB_PATH_HEALTH_CHECK_PROTOCOLS.join(', ')}]`
+      ].join(' '));
+    }
+    if (healthCheck.timeout && healthCheck.timeout.toSeconds() !== NLB_HEALTH_CHECK_TIMEOUTS[healthCheck.protocol]) {
+      ret.push([
+        'Custom health check timeouts are not supported for Network Load Balancer health checks.',
+        `Expected ${NLB_HEALTH_CHECK_TIMEOUTS[healthCheck.protocol]} seconds for ${healthCheck.protocol}, got ${healthCheck.timeout.toSeconds()}`
+      ].join(' '));
     }
 
     return ret;
@@ -128,6 +148,11 @@ export interface INetworkTargetGroup extends ITargetGroup {
    * Don't call this directly. It will be called by listeners.
    */
   registerListener(listener: INetworkListener): void;
+
+  /**
+   * Add a load balancing target to this target group
+   */
+  addTarget(...targets: INetworkLoadBalancerTarget[]): void;
 }
 
 /**
@@ -137,6 +162,15 @@ class ImportedNetworkTargetGroup extends ImportedTargetGroupBase implements INet
   public registerListener(_listener: INetworkListener) {
     // Nothing to do, we know nothing of our members
   }
+
+  public addTarget(...targets: INetworkLoadBalancerTarget[]) {
+    for (const target of targets) {
+      const result = target.attachToNetworkTargetGroup(this);
+      if (result.targetJson !== undefined) {
+        throw new Error('Cannot add a non-self registering target to an imported TargetGroup. Create a new TargetGroup instead.');
+      }
+    }
+  }
 }
 
 /**
@@ -152,4 +186,10 @@ export interface INetworkLoadBalancerTarget {
   attachToNetworkTargetGroup(targetGroup: INetworkTargetGroup): LoadBalancerTargetProps;
 }
 
-const NLB_HEALTH_CHECK_PROTOCOLS = [Protocol.HTTP, Protocol.HTTPS, Protocol.TCP];
\ No newline at end of file
+const NLB_HEALTH_CHECK_PROTOCOLS = [Protocol.HTTP, Protocol.HTTPS, Protocol.TCP];
+const NLB_PATH_HEALTH_CHECK_PROTOCOLS = [Protocol.HTTP, Protocol.HTTPS];
+const NLB_HEALTH_CHECK_TIMEOUTS: {[protocol in Protocol]?: number} =  {
+  [Protocol.HTTP]: 6,
+  [Protocol.HTTPS]: 10,
+  [Protocol.TCP]: 10,
+};
diff --git a/packages/@aws-cdk/aws-elasticloadbalancingv2/lib/shared/base-target-group.ts b/packages/@aws-cdk/aws-elasticloadbalancingv2/lib/shared/base-target-group.ts
index 156e21c1ded57..dcaf16af8b5e7 100644
--- a/packages/@aws-cdk/aws-elasticloadbalancingv2/lib/shared/base-target-group.ts
+++ b/packages/@aws-cdk/aws-elasticloadbalancingv2/lib/shared/base-target-group.ts
@@ -301,7 +301,11 @@ export abstract class TargetGroupBase extends cdk.Construct implements ITargetGr
   protected validate(): string[]  {
     const ret = super.validate();
 
-    if (this.targetType !== undefined && this.targetType !== TargetType.LAMBDA && this.vpc === undefined) {
+    if (this.targetType === undefined && this.targetsJson.length === 0) {
+      this.node.addWarning(`When creating an empty TargetGroup, you should specify a 'targetType' (this warning may become an error in the future).`);
+    }
+
+    if (this.targetType !== TargetType.LAMBDA && this.vpc === undefined) {
       ret.push(`'vpc' is required for a non-Lambda TargetGroup`);
     }
 
@@ -312,7 +316,7 @@ export abstract class TargetGroupBase extends cdk.Construct implements ITargetGr
 /**
  * Properties to reference an existing target group
  */
-export interface TargetGroupImportProps {
+export interface TargetGroupAttributes {
   /**
    * ARN of the target group
    */
@@ -320,8 +324,10 @@ export interface TargetGroupImportProps {
 
   /**
    * Port target group is listening on
+   *
+   * @deprecated - This property is unused and the wrong type. No need to use it.
    */
-  readonly defaultPort: string;
+  readonly defaultPort?: string;
 
   /**
    * A Token representing the list of ARNs for the load balancer routing to this target group
@@ -329,6 +335,14 @@ export interface TargetGroupImportProps {
   readonly loadBalancerArns?: string;
 }
 
+/**
+ * Properties to reference an existing target group
+ *
+ * @deprecated Use TargetGroupAttributes instead
+ */
+export interface TargetGroupImportProps extends TargetGroupAttributes {
+}
+
 /**
  * A target group
  */
diff --git a/packages/@aws-cdk/aws-elasticloadbalancingv2/package.json b/packages/@aws-cdk/aws-elasticloadbalancingv2/package.json
index 5b0a8ac258317..2b7ec745b3a13 100644
--- a/packages/@aws-cdk/aws-elasticloadbalancingv2/package.json
+++ b/packages/@aws-cdk/aws-elasticloadbalancingv2/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@aws-cdk/aws-elasticloadbalancingv2",
-  "version": "1.13.1",
+  "version": "1.15.0",
   "description": "The CDK Construct Library for AWS::ElasticLoadBalancingV2",
   "main": "lib/index.js",
   "types": "lib/index.d.ts",
@@ -63,30 +63,30 @@
   },
   "license": "Apache-2.0",
   "devDependencies": {
-    "@aws-cdk/assert": "1.13.1",
-    "cdk-build-tools": "^1.13.1",
-    "cdk-integ-tools": "^1.13.1",
-    "cfn2ts": "^1.13.1",
-    "pkglint": "^1.13.1"
+    "@aws-cdk/assert": "1.15.0",
+    "cdk-build-tools": "^1.15.0",
+    "cdk-integ-tools": "^1.15.0",
+    "cfn2ts": "^1.15.0",
+    "pkglint": "^1.15.0"
   },
   "dependencies": {
-    "@aws-cdk/aws-certificatemanager": "1.13.1",
-    "@aws-cdk/aws-cloudwatch": "1.13.1",
-    "@aws-cdk/aws-ec2": "1.13.1",
-    "@aws-cdk/aws-iam": "1.13.1",
-    "@aws-cdk/aws-lambda": "1.13.1",
-    "@aws-cdk/aws-s3": "1.13.1",
-    "@aws-cdk/core": "1.13.1"
+    "@aws-cdk/aws-certificatemanager": "1.15.0",
+    "@aws-cdk/aws-cloudwatch": "1.15.0",
+    "@aws-cdk/aws-ec2": "1.15.0",
+    "@aws-cdk/aws-iam": "1.15.0",
+    "@aws-cdk/aws-lambda": "1.15.0",
+    "@aws-cdk/aws-s3": "1.15.0",
+    "@aws-cdk/core": "1.15.0"
   },
   "homepage": "https://github.com/aws/aws-cdk",
   "peerDependencies": {
-    "@aws-cdk/aws-certificatemanager": "1.13.1",
-    "@aws-cdk/aws-cloudwatch": "1.13.1",
-    "@aws-cdk/aws-ec2": "1.13.1",
-    "@aws-cdk/aws-iam": "1.13.1",
-    "@aws-cdk/aws-lambda": "1.13.1",
-    "@aws-cdk/aws-s3": "1.13.1",
-    "@aws-cdk/core": "1.13.1"
+    "@aws-cdk/aws-certificatemanager": "1.15.0",
+    "@aws-cdk/aws-cloudwatch": "1.15.0",
+    "@aws-cdk/aws-ec2": "1.15.0",
+    "@aws-cdk/aws-iam": "1.15.0",
+    "@aws-cdk/aws-lambda": "1.15.0",
+    "@aws-cdk/aws-s3": "1.15.0",
+    "@aws-cdk/core": "1.15.0"
   },
   "engines": {
     "node": ">= 10.3.0"
@@ -97,7 +97,28 @@
       "construct-ctor:@aws-cdk/aws-elasticloadbalancingv2.BaseLoadBalancer.<initializer>",
       "construct-ctor:@aws-cdk/aws-elasticloadbalancingv2.TargetGroupBase.<initializer>",
       "props-physical-name:@aws-cdk/aws-elasticloadbalancingv2.ApplicationListenerProps",
-      "props-physical-name:@aws-cdk/aws-elasticloadbalancingv2.NetworkListenerProps"
+      "props-physical-name:@aws-cdk/aws-elasticloadbalancingv2.NetworkListenerProps",
+      "props-default-doc:@aws-cdk/aws-elasticloadbalancingv2.ApplicationListenerAttributes.defaultPort",
+      "docs-public-apis:@aws-cdk/aws-elasticloadbalancingv2.ContentType.APPLICATION_JSON",
+      "docs-public-apis:@aws-cdk/aws-elasticloadbalancingv2.ContentType.APPLICATION_JAVASCRIPT",
+      "docs-public-apis:@aws-cdk/aws-elasticloadbalancingv2.ContentType.TEXT_HTML",
+      "docs-public-apis:@aws-cdk/aws-elasticloadbalancingv2.ContentType.TEXT_CSS",
+      "docs-public-apis:@aws-cdk/aws-elasticloadbalancingv2.ApplicationLoadBalancer.connections",
+      "docs-public-apis:@aws-cdk/aws-elasticloadbalancingv2.BaseListener.listenerArn",
+      "docs-public-apis:@aws-cdk/aws-elasticloadbalancingv2.BaseLoadBalancer.loadBalancerSecurityGroups",
+      "docs-public-apis:@aws-cdk/aws-elasticloadbalancingv2.NetworkLoadBalancer.fromNetworkLoadBalancerAttributes",
+      "docs-public-apis:@aws-cdk/aws-elasticloadbalancingv2.TargetGroupBase.healthCheck",
+      "props-default-doc:@aws-cdk/aws-elasticloadbalancingv2.AddApplicationTargetsProps.targets",
+      "props-default-doc:@aws-cdk/aws-elasticloadbalancingv2.AddNetworkTargetsProps.targets",
+      "docs-public-apis:@aws-cdk/aws-elasticloadbalancingv2.ContentType.TEXT_PLAIN",
+      "props-default-doc:@aws-cdk/aws-elasticloadbalancingv2.ApplicationListenerAttributes.securityGroup",
+      "props-default-doc:@aws-cdk/aws-elasticloadbalancingv2.ApplicationListenerAttributes.securityGroupId",
+      "props-default-doc:@aws-cdk/aws-elasticloadbalancingv2.HealthCheck.healthyHttpCodes",
+      "docs-public-apis:@aws-cdk/aws-elasticloadbalancingv2.ILoadBalancerV2",
+      "props-default-doc:@aws-cdk/aws-elasticloadbalancingv2.LoadBalancerTargetProps.targetJson",
+      "props-default-doc:@aws-cdk/aws-elasticloadbalancingv2.TargetGroupImportProps.loadBalancerArns",
+      "props-default-doc:@aws-cdk/aws-elasticloadbalancingv2.TargetGroupAttributes.defaultPort",
+      "props-default-doc:@aws-cdk/aws-elasticloadbalancingv2.TargetGroupAttributes.loadBalancerArns"
     ]
   },
   "stability": "stable"
diff --git a/packages/@aws-cdk/aws-elasticloadbalancingv2/test/alb/test.target-group.ts b/packages/@aws-cdk/aws-elasticloadbalancingv2/test/alb/test.target-group.ts
new file mode 100644
index 0000000000000..95fd27ddec619
--- /dev/null
+++ b/packages/@aws-cdk/aws-elasticloadbalancingv2/test/alb/test.target-group.ts
@@ -0,0 +1,56 @@
+import ec2 = require('@aws-cdk/aws-ec2');
+import cdk = require('@aws-cdk/core');
+import { Test } from 'nodeunit';
+import elbv2 = require('../../lib');
+import { InstanceTarget } from '../../lib';
+import { FakeSelfRegisteringTarget } from '../helpers';
+
+export = {
+  'Empty target Group without type still requires a VPC'(test: Test) {
+    // GIVEN
+    const app = new cdk.App();
+    const stack = new cdk.Stack(app, 'Stack');
+
+    // WHEN
+    new elbv2.ApplicationTargetGroup(stack, 'LB', {});
+
+    // THEN
+    test.throws(() => {
+      app.synth();
+    }, /'vpc' is required for a non-Lambda TargetGroup/);
+
+    test.done();
+  },
+
+  'Can add self-registering target to imported TargetGroup'(test: Test) {
+    // GIVEN
+    const app = new cdk.App();
+    const stack = new cdk.Stack(app, 'Stack');
+    const vpc = new ec2.Vpc(stack, 'Vpc');
+
+    // WHEN
+    const tg = elbv2.ApplicationTargetGroup.fromTargetGroupAttributes(stack, 'TG', {
+      targetGroupArn: 'arn'
+    });
+    tg.addTarget(new FakeSelfRegisteringTarget(stack, 'Target', vpc));
+
+    // THEN
+    test.done();
+  },
+
+  'Cannot add direct target to imported TargetGroup'(test: Test) {
+    // GIVEN
+    const app = new cdk.App();
+    const stack = new cdk.Stack(app, 'Stack');
+    const tg = elbv2.ApplicationTargetGroup.fromTargetGroupAttributes(stack, 'TG', {
+      targetGroupArn: 'arn'
+    });
+
+    // WHEN
+    test.throws(() => {
+      tg.addTarget(new InstanceTarget('i-1234'));
+    }, /Cannot add a non-self registering target to an imported TargetGroup/);
+
+    test.done();
+  }
+};
\ No newline at end of file
diff --git a/packages/@aws-cdk/aws-elasticloadbalancingv2/test/helpers.ts b/packages/@aws-cdk/aws-elasticloadbalancingv2/test/helpers.ts
index 255e8fe3592b0..eae4fc5cd677b 100644
--- a/packages/@aws-cdk/aws-elasticloadbalancingv2/test/helpers.ts
+++ b/packages/@aws-cdk/aws-elasticloadbalancingv2/test/helpers.ts
@@ -23,4 +23,4 @@ export class FakeSelfRegisteringTarget extends cdk.Construct implements elbv2.IA
   public attachToNetworkTargetGroup(_targetGroup: elbv2.NetworkTargetGroup): elbv2.LoadBalancerTargetProps {
     return { targetType: elbv2.TargetType.INSTANCE };
   }
-}
+}
\ No newline at end of file
diff --git a/packages/@aws-cdk/aws-elasticloadbalancingv2/test/nlb/test.listener.ts b/packages/@aws-cdk/aws-elasticloadbalancingv2/test/nlb/test.listener.ts
index 02d2ded66d69b..ef1189ecb3663 100644
--- a/packages/@aws-cdk/aws-elasticloadbalancingv2/test/nlb/test.listener.ts
+++ b/packages/@aws-cdk/aws-elasticloadbalancingv2/test/nlb/test.listener.ts
@@ -230,6 +230,60 @@ export = {
     test.done();
   },
 
+  'validation error if invalid path health check protocol'(test: Test) {
+    const stack = new cdk.Stack();
+    const vpc = new ec2.Vpc(stack, 'Stack');
+    const lb = new elbv2.NetworkLoadBalancer(stack, 'LB', { vpc });
+    const listener = lb.addListener('PublicListener', { port: 80 });
+    const targetGroup = listener.addTargets('ECS', {
+      port: 80,
+      healthCheck: {
+        interval: cdk.Duration.seconds(60)
+      }
+    });
+
+    targetGroup.configureHealthCheck({
+      interval: cdk.Duration.seconds(30),
+      protocol: elbv2.Protocol.TCP,
+      path: '/'
+    });
+
+    // THEN
+    const validationErrors: string[] = (targetGroup as any).validate();
+    test.deepEqual(validationErrors, [
+      "'TCP' health checks do not support the path property. Must be one of [HTTP, HTTPS]"
+    ]);
+
+    test.done();
+  },
+
+  'validation error if invalid timeout health check'(test: Test) {
+    const stack = new cdk.Stack();
+    const vpc = new ec2.Vpc(stack, 'Stack');
+    const lb = new elbv2.NetworkLoadBalancer(stack, 'LB', { vpc });
+    const listener = lb.addListener('PublicListener', { port: 80 });
+    const targetGroup = listener.addTargets('ECS', {
+      port: 80,
+      healthCheck: {
+        interval: cdk.Duration.seconds(60)
+      }
+    });
+
+    targetGroup.configureHealthCheck({
+      interval: cdk.Duration.seconds(30),
+      protocol: elbv2.Protocol.HTTP,
+      timeout: cdk.Duration.seconds(10),
+    });
+
+    // THEN
+    const validationErrors: string[] = (targetGroup as any).validate();
+    test.deepEqual(validationErrors, [
+      "Custom health check timeouts are not supported for Network Load Balancer health checks. Expected 6 seconds for HTTP, got 10"
+    ]);
+
+    test.done();
+  },
+
   'Protocol & certs TLS listener'(test: Test) {
     const stack = new cdk.Stack();
     const vpc = new ec2.Vpc(stack, 'Stack');
diff --git a/packages/@aws-cdk/aws-elasticloadbalancingv2/test/nlb/test.target-group.ts b/packages/@aws-cdk/aws-elasticloadbalancingv2/test/nlb/test.target-group.ts
new file mode 100644
index 0000000000000..355c83907222b
--- /dev/null
+++ b/packages/@aws-cdk/aws-elasticloadbalancingv2/test/nlb/test.target-group.ts
@@ -0,0 +1,57 @@
+import { expect, haveResource } from '@aws-cdk/assert';
+import ec2 = require('@aws-cdk/aws-ec2');
+import cdk = require('@aws-cdk/core');
+import { Test } from 'nodeunit';
+import elbv2 = require('../../lib');
+
+export = {
+  'Enable proxy protocol v2 attribute for target group'(test: Test) {
+    // GIVEN
+    const stack = new cdk.Stack();
+    const vpc = new ec2.Vpc(stack, 'Vpc');
+
+    // WHEN
+    new elbv2.NetworkTargetGroup(stack, 'Group', {
+      vpc,
+      port: 80,
+      proxyProtocolV2: true
+    });
+
+    // THEN
+    expect(stack).to(haveResource('AWS::ElasticLoadBalancingV2::TargetGroup', {
+      TargetGroupAttributes: [
+        {
+          Key: 'proxy_protocol_v2.enabled',
+          Value: 'true'
+        }
+      ]
+    }));
+
+    test.done();
+  },
+
+  'Disable proxy protocol v2 for attribute target group'(test: Test) {
+    // GIVEN
+    const stack = new cdk.Stack();
+    const vpc = new ec2.Vpc(stack, 'Vpc');
+
+    // WHEN
+    new elbv2.NetworkTargetGroup(stack, 'Group', {
+      vpc,
+      port: 80,
+      proxyProtocolV2: false
+    });
+
+    // THEN
+    expect(stack).to(haveResource('AWS::ElasticLoadBalancingV2::TargetGroup', {
+      TargetGroupAttributes: [
+        {
+          Key: 'proxy_protocol_v2.enabled',
+          Value: 'false'
+        }
+      ]
+    }));
+
+    test.done();
+  },
+};
diff --git a/packages/@aws-cdk/aws-elasticsearch/package.json b/packages/@aws-cdk/aws-elasticsearch/package.json
index 1a218d5bc7906..7ad74f00a611a 100644
--- a/packages/@aws-cdk/aws-elasticsearch/package.json
+++ b/packages/@aws-cdk/aws-elasticsearch/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@aws-cdk/aws-elasticsearch",
-  "version": "1.13.1",
+  "version": "1.15.0",
   "description": "The CDK Construct Library for AWS::Elasticsearch",
   "main": "lib/index.js",
   "types": "lib/index.d.ts",
@@ -63,17 +63,17 @@
   },
   "license": "Apache-2.0",
   "devDependencies": {
-    "@aws-cdk/assert": "1.13.1",
-    "cdk-build-tools": "^1.13.1",
-    "cfn2ts": "^1.13.1",
-    "pkglint": "^1.13.1"
+    "@aws-cdk/assert": "1.15.0",
+    "cdk-build-tools": "^1.15.0",
+    "cfn2ts": "^1.15.0",
+    "pkglint": "^1.15.0"
   },
   "dependencies": {
-    "@aws-cdk/core": "1.13.1"
+    "@aws-cdk/core": "1.15.0"
   },
   "homepage": "https://github.com/aws/aws-cdk",
   "peerDependencies": {
-    "@aws-cdk/core": "1.13.1"
+    "@aws-cdk/core": "1.15.0"
   },
   "engines": {
     "node": ">= 10.3.0"
diff --git a/packages/@aws-cdk/aws-emr/package.json b/packages/@aws-cdk/aws-emr/package.json
index 48696dd787ed3..8167a2ca182ae 100644
--- a/packages/@aws-cdk/aws-emr/package.json
+++ b/packages/@aws-cdk/aws-emr/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@aws-cdk/aws-emr",
-  "version": "1.13.1",
+  "version": "1.15.0",
   "description": "The CDK Construct Library for AWS::EMR",
   "main": "lib/index.js",
   "types": "lib/index.d.ts",
@@ -63,17 +63,17 @@
   },
   "license": "Apache-2.0",
   "devDependencies": {
-    "@aws-cdk/assert": "1.13.1",
-    "cdk-build-tools": "^1.13.1",
-    "cfn2ts": "^1.13.1",
-    "pkglint": "^1.13.1"
+    "@aws-cdk/assert": "1.15.0",
+    "cdk-build-tools": "^1.15.0",
+    "cfn2ts": "^1.15.0",
+    "pkglint": "^1.15.0"
   },
   "dependencies": {
-    "@aws-cdk/core": "1.13.1"
+    "@aws-cdk/core": "1.15.0"
   },
   "homepage": "https://github.com/aws/aws-cdk",
   "peerDependencies": {
-    "@aws-cdk/core": "1.13.1"
+    "@aws-cdk/core": "1.15.0"
   },
   "engines": {
     "node": ">= 10.3.0"
diff --git a/packages/@aws-cdk/aws-events-targets/package.json b/packages/@aws-cdk/aws-events-targets/package.json
index 24298dba2cad3..25311cf588e30 100644
--- a/packages/@aws-cdk/aws-events-targets/package.json
+++ b/packages/@aws-cdk/aws-events-targets/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@aws-cdk/aws-events-targets",
-  "version": "1.13.1",
+  "version": "1.15.0",
   "description": "Event targets for AWS CloudWatch Events",
   "main": "lib/index.js",
   "types": "lib/index.d.ts",
@@ -49,7 +49,7 @@
   },
   "cdk-build": {
     "pre": [
-      "cp -f $(node -p 'require.resolve(\"aws-sdk/apis/metadata.json\")') lib/sdk-api-metadata.json"
+      "cp -f $(node -p 'require.resolve(\"aws-sdk\")')/aws-sdk/apis/metadata.json lib/sdk-api-metadata.json"
     ]
   },
   "jest": {
@@ -79,48 +79,59 @@
   },
   "license": "Apache-2.0",
   "devDependencies": {
-    "@aws-cdk/assert": "1.13.1",
-    "@aws-cdk/aws-codecommit": "1.13.1",
-    "aws-sdk": "^2.553.0",
+    "@aws-cdk/assert": "1.15.0",
+    "@aws-cdk/aws-codecommit": "1.15.0",
+    "aws-sdk": "^2.558.0",
     "aws-sdk-mock": "^4.5.0",
-    "cdk-build-tools": "^1.13.1",
-    "cdk-integ-tools": "^1.13.1",
+    "cdk-build-tools": "^1.15.0",
+    "cdk-integ-tools": "^1.15.0",
     "jest": "^24.9.0",
-    "pkglint": "^1.13.1"
+    "pkglint": "^1.15.0"
   },
   "dependencies": {
-    "@aws-cdk/aws-cloudformation": "1.13.1",
-    "@aws-cdk/aws-codebuild": "1.13.1",
-    "@aws-cdk/aws-codepipeline": "1.13.1",
-    "@aws-cdk/aws-ec2": "1.13.1",
-    "@aws-cdk/aws-ecs": "1.13.1",
-    "@aws-cdk/aws-events": "1.13.1",
-    "@aws-cdk/aws-iam": "1.13.1",
-    "@aws-cdk/aws-lambda": "1.13.1",
-    "@aws-cdk/aws-sns": "1.13.1",
-    "@aws-cdk/aws-sns-subscriptions": "1.13.1",
-    "@aws-cdk/aws-sqs": "1.13.1",
-    "@aws-cdk/aws-stepfunctions": "1.13.1",
-    "@aws-cdk/core": "1.13.1"
+    "@aws-cdk/aws-cloudformation": "1.15.0",
+    "@aws-cdk/aws-codebuild": "1.15.0",
+    "@aws-cdk/aws-codepipeline": "1.15.0",
+    "@aws-cdk/aws-ec2": "1.15.0",
+    "@aws-cdk/aws-ecs": "1.15.0",
+    "@aws-cdk/aws-events": "1.15.0",
+    "@aws-cdk/aws-iam": "1.15.0",
+    "@aws-cdk/aws-lambda": "1.15.0",
+    "@aws-cdk/aws-sns": "1.15.0",
+    "@aws-cdk/aws-sns-subscriptions": "1.15.0",
+    "@aws-cdk/aws-sqs": "1.15.0",
+    "@aws-cdk/aws-stepfunctions": "1.15.0",
+    "@aws-cdk/core": "1.15.0"
   },
   "homepage": "https://github.com/aws/aws-cdk",
   "peerDependencies": {
-    "@aws-cdk/aws-cloudformation": "1.13.1",
-    "@aws-cdk/aws-codebuild": "1.13.1",
-    "@aws-cdk/aws-codepipeline": "1.13.1",
-    "@aws-cdk/aws-ec2": "1.13.1",
-    "@aws-cdk/aws-ecs": "1.13.1",
-    "@aws-cdk/aws-events": "1.13.1",
-    "@aws-cdk/aws-iam": "1.13.1",
-    "@aws-cdk/aws-lambda": "1.13.1",
-    "@aws-cdk/aws-sns": "1.13.1",
-    "@aws-cdk/aws-sns-subscriptions": "1.13.1",
-    "@aws-cdk/aws-sqs": "1.13.1",
-    "@aws-cdk/aws-stepfunctions": "1.13.1",
-    "@aws-cdk/core": "1.13.1"
+    "@aws-cdk/aws-cloudformation": "1.15.0",
+    "@aws-cdk/aws-codebuild": "1.15.0",
+    "@aws-cdk/aws-codepipeline": "1.15.0",
+    "@aws-cdk/aws-ec2": "1.15.0",
+    "@aws-cdk/aws-ecs": "1.15.0",
+    "@aws-cdk/aws-events": "1.15.0",
+    "@aws-cdk/aws-iam": "1.15.0",
+    "@aws-cdk/aws-lambda": "1.15.0",
+    "@aws-cdk/aws-sns": "1.15.0",
+    "@aws-cdk/aws-sns-subscriptions": "1.15.0",
+    "@aws-cdk/aws-sqs": "1.15.0",
+    "@aws-cdk/aws-stepfunctions": "1.15.0",
+    "@aws-cdk/core": "1.15.0"
   },
   "engines": {
     "node": ">= 10.3.0"
   },
-  "stability": "stable"
+  "stability": "stable",
+  "awslint": {
+    "exclude": [
+      "docs-public-apis:@aws-cdk/aws-events-targets.EcsTask.securityGroup",
+      "docs-public-apis:@aws-cdk/aws-events-targets.SfnStateMachine.machine",
+      "docs-public-apis:@aws-cdk/aws-events-targets.SnsTopic.topic",
+      "docs-public-apis:@aws-cdk/aws-events-targets.SqsQueue.queue",
+      "docs-public-apis:@aws-cdk/aws-events-targets.ContainerOverride",
+      "props-default-doc:@aws-cdk/aws-events-targets.ContainerOverride.environment",
+      "props-default-doc:@aws-cdk/aws-events-targets.EcsTaskProps.containerOverrides"
+    ]
+  }
 }
diff --git a/packages/@aws-cdk/aws-events/package.json b/packages/@aws-cdk/aws-events/package.json
index 2b50efd91bb1d..15060d2cae3fe 100644
--- a/packages/@aws-cdk/aws-events/package.json
+++ b/packages/@aws-cdk/aws-events/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@aws-cdk/aws-events",
-  "version": "1.13.1",
+  "version": "1.15.0",
   "description": "AWS CloudWatch Events Construct Library",
   "main": "lib/index.js",
   "types": "lib/index.d.ts",
@@ -64,19 +64,19 @@
   },
   "license": "Apache-2.0",
   "devDependencies": {
-    "@aws-cdk/assert": "1.13.1",
-    "cdk-build-tools": "^1.13.1",
-    "cfn2ts": "^1.13.1",
-    "pkglint": "^1.13.1"
+    "@aws-cdk/assert": "1.15.0",
+    "cdk-build-tools": "^1.15.0",
+    "cfn2ts": "^1.15.0",
+    "pkglint": "^1.15.0"
   },
   "dependencies": {
-    "@aws-cdk/aws-iam": "1.13.1",
-    "@aws-cdk/core": "1.13.1"
+    "@aws-cdk/aws-iam": "1.15.0",
+    "@aws-cdk/core": "1.15.0"
   },
   "homepage": "https://github.com/aws/aws-cdk",
   "peerDependencies": {
-    "@aws-cdk/aws-iam": "1.13.1",
-    "@aws-cdk/core": "1.13.1"
+    "@aws-cdk/aws-iam": "1.15.0",
+    "@aws-cdk/core": "1.15.0"
   },
   "engines": {
     "node": ">= 10.3.0"
@@ -84,7 +84,22 @@
   "awslint": {
     "exclude": [
       "from-method:@aws-cdk/aws-events.Rule",
-      "no-unused-type:@aws-cdk/aws-events.OnEventOptions"
+      "no-unused-type:@aws-cdk/aws-events.OnEventOptions",
+      "docs-public-apis:@aws-cdk/aws-events.RuleProps",
+      "props-default-doc:@aws-cdk/aws-events.RuleTargetInputProperties.inputTemplate",
+      "props-default-doc:@aws-cdk/aws-events.RuleTargetInputProperties.inputPathsMap",
+      "props-default-doc:@aws-cdk/aws-events.RuleTargetInputProperties.inputPath",
+      "docs-public-apis:@aws-cdk/aws-events.EventField.displayHint",
+      "docs-public-apis:@aws-cdk/aws-events.EventField.path",
+      "docs-public-apis:@aws-cdk/aws-events.EventField.toJSON",
+      "docs-public-apis:@aws-cdk/aws-events.Rule.fromEventRuleArn",
+      "docs-public-apis:@aws-cdk/aws-events.IRule",
+      "props-default-doc:@aws-cdk/aws-events.RuleTargetInputProperties.input",
+      "props-default-doc:@aws-cdk/aws-events.RuleTargetConfig.ecsParameters",
+      "props-default-doc:@aws-cdk/aws-events.RuleTargetConfig.kinesisParameters",
+      "props-default-doc:@aws-cdk/aws-events.RuleTargetConfig.role",
+      "props-default-doc:@aws-cdk/aws-events.RuleTargetConfig.runCommandParameters",
+      "props-default-doc:@aws-cdk/aws-events.RuleTargetConfig.sqsParameters"
     ]
   },
   "stability": "stable"
diff --git a/packages/@aws-cdk/aws-fsx/package.json b/packages/@aws-cdk/aws-fsx/package.json
index fff54fdea7dd9..98711f0b92259 100644
--- a/packages/@aws-cdk/aws-fsx/package.json
+++ b/packages/@aws-cdk/aws-fsx/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@aws-cdk/aws-fsx",
-  "version": "1.13.1",
+  "version": "1.15.0",
   "description": "The CDK Construct Library for AWS::FSx",
   "main": "lib/index.js",
   "types": "lib/index.d.ts",
@@ -65,16 +65,16 @@
   },
   "license": "Apache-2.0",
   "devDependencies": {
-    "@aws-cdk/assert": "1.13.1",
-    "cdk-build-tools": "^1.13.1",
-    "cfn2ts": "^1.13.1",
-    "pkglint": "^1.13.1"
+    "@aws-cdk/assert": "1.15.0",
+    "cdk-build-tools": "^1.15.0",
+    "cfn2ts": "^1.15.0",
+    "pkglint": "^1.15.0"
   },
   "dependencies": {
-    "@aws-cdk/core": "1.13.1"
+    "@aws-cdk/core": "1.15.0"
   },
   "peerDependencies": {
-    "@aws-cdk/core": "1.13.1"
+    "@aws-cdk/core": "1.15.0"
   },
   "engines": {
     "node": ">= 10.3.0"
diff --git a/packages/@aws-cdk/aws-gamelift/package.json b/packages/@aws-cdk/aws-gamelift/package.json
index 3b25ff0fc4b48..463657f44f4c7 100644
--- a/packages/@aws-cdk/aws-gamelift/package.json
+++ b/packages/@aws-cdk/aws-gamelift/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@aws-cdk/aws-gamelift",
-  "version": "1.13.1",
+  "version": "1.15.0",
   "description": "The CDK Construct Library for AWS::GameLift",
   "main": "lib/index.js",
   "types": "lib/index.d.ts",
@@ -63,17 +63,17 @@
   },
   "license": "Apache-2.0",
   "devDependencies": {
-    "@aws-cdk/assert": "1.13.1",
-    "cdk-build-tools": "^1.13.1",
-    "cfn2ts": "^1.13.1",
-    "pkglint": "^1.13.1"
+    "@aws-cdk/assert": "1.15.0",
+    "cdk-build-tools": "^1.15.0",
+    "cfn2ts": "^1.15.0",
+    "pkglint": "^1.15.0"
   },
   "dependencies": {
-    "@aws-cdk/core": "1.13.1"
+    "@aws-cdk/core": "1.15.0"
   },
   "homepage": "https://github.com/aws/aws-cdk",
   "peerDependencies": {
-    "@aws-cdk/core": "1.13.1"
+    "@aws-cdk/core": "1.15.0"
   },
   "engines": {
     "node": ">= 10.3.0"
diff --git a/packages/@aws-cdk/aws-glue/package.json b/packages/@aws-cdk/aws-glue/package.json
index f97afbf5aed66..c51403780d405 100644
--- a/packages/@aws-cdk/aws-glue/package.json
+++ b/packages/@aws-cdk/aws-glue/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@aws-cdk/aws-glue",
-  "version": "1.13.1",
+  "version": "1.15.0",
   "description": "The CDK Construct Library for AWS::Glue",
   "main": "lib/index.js",
   "types": "lib/index.d.ts",
@@ -63,27 +63,53 @@
   },
   "license": "Apache-2.0",
   "devDependencies": {
-    "@aws-cdk/assert": "1.13.1",
-    "cdk-build-tools": "^1.13.1",
-    "cdk-integ-tools": "^1.13.1",
-    "cfn2ts": "^1.13.1",
-    "pkglint": "^1.13.1"
+    "@aws-cdk/assert": "1.15.0",
+    "cdk-build-tools": "^1.15.0",
+    "cdk-integ-tools": "^1.15.0",
+    "cfn2ts": "^1.15.0",
+    "pkglint": "^1.15.0"
   },
   "dependencies": {
-    "@aws-cdk/aws-iam": "1.13.1",
-    "@aws-cdk/aws-kms": "1.13.1",
-    "@aws-cdk/aws-s3": "1.13.1",
-    "@aws-cdk/core": "1.13.1"
+    "@aws-cdk/aws-iam": "1.15.0",
+    "@aws-cdk/aws-kms": "1.15.0",
+    "@aws-cdk/aws-s3": "1.15.0",
+    "@aws-cdk/core": "1.15.0"
   },
   "homepage": "https://github.com/aws/aws-cdk",
   "peerDependencies": {
-    "@aws-cdk/aws-iam": "1.13.1",
-    "@aws-cdk/aws-kms": "1.13.1",
-    "@aws-cdk/aws-s3": "1.13.1",
-    "@aws-cdk/core": "1.13.1"
+    "@aws-cdk/aws-iam": "1.15.0",
+    "@aws-cdk/aws-kms": "1.15.0",
+    "@aws-cdk/aws-s3": "1.15.0",
+    "@aws-cdk/core": "1.15.0"
   },
   "engines": {
     "node": ">= 10.3.0"
   },
-  "stability": "experimental"
+  "stability": "experimental",
+  "awslint": {
+    "exclude": [
+      "docs-public-apis:@aws-cdk/aws-glue.Schema.BOOLEAN",
+      "docs-public-apis:@aws-cdk/aws-glue.TableEncryption.UNENCRYPTED",
+      "docs-public-apis:@aws-cdk/aws-glue.TableProps",
+      "docs-public-apis:@aws-cdk/aws-glue.TableAttributes.tableName",
+      "docs-public-apis:@aws-cdk/aws-glue.TableAttributes.tableArn",
+      "docs-public-apis:@aws-cdk/aws-glue.TableAttributes",
+      "docs-public-apis:@aws-cdk/aws-glue.ITable.tableName",
+      "docs-public-apis:@aws-cdk/aws-glue.ITable.tableArn",
+      "docs-public-apis:@aws-cdk/aws-glue.ITable",
+      "docs-public-apis:@aws-cdk/aws-glue.IDatabase",
+      "docs-public-apis:@aws-cdk/aws-glue.DatabaseProps",
+      "docs-public-apis:@aws-cdk/aws-glue.Database.fromDatabaseArn",
+      "docs-public-apis:@aws-cdk/aws-glue.InputFormat.className",
+      "docs-public-apis:@aws-cdk/aws-glue.OutputFormat.className",
+      "docs-public-apis:@aws-cdk/aws-glue.Schema",
+      "docs-public-apis:@aws-cdk/aws-glue.Schema.BINARY",
+      "docs-public-apis:@aws-cdk/aws-glue.Table.fromTableArn",
+      "docs-public-apis:@aws-cdk/aws-glue.Schema.DOUBLE",
+      "docs-public-apis:@aws-cdk/aws-glue.Schema.FLOAT",
+      "docs-public-apis:@aws-cdk/aws-glue.SerializationLibrary.HIVE_JSON",
+      "docs-public-apis:@aws-cdk/aws-glue.SerializationLibrary.OPENX_JSON",
+      "docs-public-apis:@aws-cdk/aws-glue.SerializationLibrary.className"
+    ]
+  }
 }
diff --git a/packages/@aws-cdk/aws-greengrass/package.json b/packages/@aws-cdk/aws-greengrass/package.json
index d433d94287564..c260a8376454a 100644
--- a/packages/@aws-cdk/aws-greengrass/package.json
+++ b/packages/@aws-cdk/aws-greengrass/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@aws-cdk/aws-greengrass",
-  "version": "1.13.1",
+  "version": "1.15.0",
   "description": "The CDK Construct Library for AWS::Greengrass",
   "main": "lib/index.js",
   "types": "lib/index.d.ts",
@@ -65,16 +65,16 @@
   },
   "license": "Apache-2.0",
   "devDependencies": {
-    "@aws-cdk/assert": "1.13.1",
-    "cdk-build-tools": "^1.13.1",
-    "cfn2ts": "^1.13.1",
-    "pkglint": "^1.13.1"
+    "@aws-cdk/assert": "1.15.0",
+    "cdk-build-tools": "^1.15.0",
+    "cfn2ts": "^1.15.0",
+    "pkglint": "^1.15.0"
   },
   "dependencies": {
-    "@aws-cdk/core": "1.13.1"
+    "@aws-cdk/core": "1.15.0"
   },
   "peerDependencies": {
-    "@aws-cdk/core": "1.13.1"
+    "@aws-cdk/core": "1.15.0"
   },
   "engines": {
     "node": ">= 10.3.0"
diff --git a/packages/@aws-cdk/aws-guardduty/package.json b/packages/@aws-cdk/aws-guardduty/package.json
index 553dc753bba2d..69b9bd964c79b 100644
--- a/packages/@aws-cdk/aws-guardduty/package.json
+++ b/packages/@aws-cdk/aws-guardduty/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@aws-cdk/aws-guardduty",
-  "version": "1.13.1",
+  "version": "1.15.0",
   "description": "The CDK Construct Library for AWS::GuardDuty",
   "main": "lib/index.js",
   "types": "lib/index.d.ts",
@@ -63,17 +63,17 @@
   },
   "license": "Apache-2.0",
   "devDependencies": {
-    "@aws-cdk/assert": "1.13.1",
-    "cdk-build-tools": "^1.13.1",
-    "cfn2ts": "^1.13.1",
-    "pkglint": "^1.13.1"
+    "@aws-cdk/assert": "1.15.0",
+    "cdk-build-tools": "^1.15.0",
+    "cfn2ts": "^1.15.0",
+    "pkglint": "^1.15.0"
   },
   "dependencies": {
-    "@aws-cdk/core": "1.13.1"
+    "@aws-cdk/core": "1.15.0"
   },
   "homepage": "https://github.com/aws/aws-cdk",
   "peerDependencies": {
-    "@aws-cdk/core": "1.13.1"
+    "@aws-cdk/core": "1.15.0"
   },
   "engines": {
     "node": ">= 10.3.0"
diff --git a/packages/@aws-cdk/aws-iam/lib/managed-policy.ts b/packages/@aws-cdk/aws-iam/lib/managed-policy.ts
index 90a906bd54ef6..06f58d2b845ff 100644
--- a/packages/@aws-cdk/aws-iam/lib/managed-policy.ts
+++ b/packages/@aws-cdk/aws-iam/lib/managed-policy.ts
@@ -203,11 +203,12 @@ export class ManagedPolicy extends Resource implements IManagedPolicy {
       props.statements.forEach(p => this.addStatements(p));
     }
 
-    this.managedPolicyName = this.getResourceNameAttribute(resource.ref);
+    // arn:aws:iam::123456789012:policy/teststack-CreateTestDBPolicy-16M23YE3CS700
+    this.managedPolicyName = this.getResourceNameAttribute(Stack.of(this).parseArn(resource.ref, '/').resourceName!);
     this.managedPolicyArn = this.getResourceArnAttribute(resource.ref, {
       region: '', // IAM is global in each partition
       service: 'iam',
-      resource: 'role',
+      resource: 'policy',
       resourceName: this.physicalName,
     });
   }
diff --git a/packages/@aws-cdk/aws-iam/package.json b/packages/@aws-cdk/aws-iam/package.json
index 97bea0407fbd8..199b1362fd60c 100644
--- a/packages/@aws-cdk/aws-iam/package.json
+++ b/packages/@aws-cdk/aws-iam/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@aws-cdk/aws-iam",
-  "version": "1.13.1",
+  "version": "1.15.0",
   "description": "CDK routines for easily assigning correct and minimal IAM permissions",
   "main": "lib/index.js",
   "types": "lib/index.d.ts",
@@ -65,20 +65,20 @@
   },
   "license": "Apache-2.0",
   "devDependencies": {
-    "@aws-cdk/assert": "1.13.1",
-    "cdk-build-tools": "^1.13.1",
-    "cdk-integ-tools": "^1.13.1",
-    "cfn2ts": "^1.13.1",
+    "@aws-cdk/assert": "1.15.0",
+    "cdk-build-tools": "^1.15.0",
+    "cdk-integ-tools": "^1.15.0",
+    "cfn2ts": "^1.15.0",
     "jest": "^24.9.0",
-    "pkglint": "^1.13.1"
+    "pkglint": "^1.15.0"
   },
   "dependencies": {
-    "@aws-cdk/core": "1.13.1",
-    "@aws-cdk/region-info": "1.13.1"
+    "@aws-cdk/core": "1.15.0",
+    "@aws-cdk/region-info": "1.15.0"
   },
   "peerDependencies": {
-    "@aws-cdk/core": "1.13.1",
-    "@aws-cdk/region-info": "1.13.1"
+    "@aws-cdk/core": "1.15.0",
+    "@aws-cdk/region-info": "1.15.0"
   },
   "jest": {
     "moduleFileExtensions": [
@@ -99,7 +99,56 @@
     "exclude": [
       "from-signature:@aws-cdk/aws-iam.Role.fromRoleArn",
       "construct-interface-extends-iconstruct:@aws-cdk/aws-iam.IManagedPolicy",
-      "resource-interface-extends-resource:@aws-cdk/aws-iam.IManagedPolicy"
+      "resource-interface-extends-resource:@aws-cdk/aws-iam.IManagedPolicy",
+      "docs-public-apis:@aws-cdk/aws-iam.PolicyStatement.addArnPrincipal",
+      "docs-public-apis:@aws-cdk/aws-iam.Effect.DENY",
+      "docs-public-apis:@aws-cdk/aws-iam.Effect.ALLOW",
+      "docs-public-apis:@aws-cdk/aws-iam.Effect",
+      "docs-public-apis:@aws-cdk/aws-iam.UserProps",
+      "docs-public-apis:@aws-cdk/aws-iam.RoleProps",
+      "docs-public-apis:@aws-cdk/aws-iam.PolicyProps",
+      "docs-public-apis:@aws-cdk/aws-iam.ManagedPolicyProps",
+      "docs-public-apis:@aws-cdk/aws-iam.AccountPrincipal",
+      "docs-public-apis:@aws-cdk/aws-iam.AccountPrincipal.accountId",
+      "docs-public-apis:@aws-cdk/aws-iam.AccountRootPrincipal",
+      "docs-public-apis:@aws-cdk/aws-iam.ArnPrincipal",
+      "docs-public-apis:@aws-cdk/aws-iam.ArnPrincipal.arn",
+      "docs-public-apis:@aws-cdk/aws-iam.CanonicalUserPrincipal.canonicalUserId",
+      "docs-public-apis:@aws-cdk/aws-iam.CompositePrincipal",
+      "docs-public-apis:@aws-cdk/aws-iam.CompositePrincipal.addPrincipals",
+      "docs-public-apis:@aws-cdk/aws-iam.FederatedPrincipal",
+      "docs-public-apis:@aws-cdk/aws-iam.FederatedPrincipal.conditions",
+      "docs-public-apis:@aws-cdk/aws-iam.FederatedPrincipal.federated",
+      "docs-public-apis:@aws-cdk/aws-iam.Group",
+      "docs-public-apis:@aws-cdk/aws-iam.LazyRole.roleId",
+      "docs-public-apis:@aws-cdk/aws-iam.OrganizationPrincipal.organizationId",
+      "docs-public-apis:@aws-cdk/aws-iam.Policy.fromPolicyName",
+      "docs-public-apis:@aws-cdk/aws-iam.PolicyDocument.isEmpty",
+      "docs-public-apis:@aws-cdk/aws-iam.PolicyStatement.effect",
+      "docs-public-apis:@aws-cdk/aws-iam.PolicyStatement.addAccountRootPrincipal",
+      "docs-public-apis:@aws-cdk/aws-iam.PolicyStatement.addActions",
+      "docs-public-apis:@aws-cdk/aws-iam.PolicyStatement.addAnyPrincipal",
+      "docs-public-apis:@aws-cdk/aws-iam.LazyRoleProps",
+      "docs-public-apis:@aws-cdk/aws-iam.PolicyStatement.addAwsAccountPrincipal",
+      "docs-public-apis:@aws-cdk/aws-iam.PolicyStatement.addCanonicalUserPrincipal",
+      "docs-public-apis:@aws-cdk/aws-iam.PolicyStatement.addFederatedPrincipal",
+      "docs-public-apis:@aws-cdk/aws-iam.PolicyStatement.addNotActions",
+      "docs-public-apis:@aws-cdk/aws-iam.PolicyStatement.addNotPrincipals",
+      "docs-public-apis:@aws-cdk/aws-iam.PolicyStatement.addNotResources",
+      "docs-public-apis:@aws-cdk/aws-iam.PolicyStatement.addPrincipals",
+      "docs-public-apis:@aws-cdk/aws-iam.PolicyStatement.addResources",
+      "docs-public-apis:@aws-cdk/aws-iam.PolicyStatement.toStatementJson",
+      "docs-public-apis:@aws-cdk/aws-iam.PolicyStatement.toString",
+      "docs-public-apis:@aws-cdk/aws-iam.PrincipalBase.toJSON",
+      "docs-public-apis:@aws-cdk/aws-iam.PrincipalPolicyFragment.conditions",
+      "docs-public-apis:@aws-cdk/aws-iam.PrincipalPolicyFragment.principalJson",
+      "docs-public-apis:@aws-cdk/aws-iam.ServicePrincipal.service",
+      "props-default-doc:@aws-cdk/aws-iam.GrantOnPrincipalOptions.scope",
+      "docs-public-apis:@aws-cdk/aws-iam.GroupProps",
+      "docs-public-apis:@aws-cdk/aws-iam.IGroup",
+      "docs-public-apis:@aws-cdk/aws-iam.IPolicy",
+      "docs-public-apis:@aws-cdk/aws-iam.IPolicy.policyName",
+      "docs-public-apis:@aws-cdk/aws-iam.IUser"
     ]
   },
   "stability": "stable"
diff --git a/packages/@aws-cdk/aws-iam/test/managed-policy.test.ts b/packages/@aws-cdk/aws-iam/test/managed-policy.test.ts
index 6fa052d3c5618..28d684e891d12 100644
--- a/packages/@aws-cdk/aws-iam/test/managed-policy.test.ts
+++ b/packages/@aws-cdk/aws-iam/test/managed-policy.test.ts
@@ -3,8 +3,15 @@ import cdk = require('@aws-cdk/core');
 import { Group, ManagedPolicy, PolicyStatement, Role, ServicePrincipal, User } from '../lib';
 
 describe('managed policy', () => {
+  let app: cdk.App;
+  let stack: cdk.Stack;
+
+  beforeEach(() => {
+    app = new cdk.App();
+    stack = new cdk.Stack(app, 'MyStack', { env: { account: '1234', region: 'us-east-1' }});
+  });
+
   test('simple AWS managed policy', () => {
-    const stack = new cdk.Stack();
     const mp = ManagedPolicy.fromAwsManagedPolicyName("service-role/SomePolicy");
 
     expect(stack.resolve(mp.managedPolicyArn)).toEqual({
@@ -17,24 +24,18 @@ describe('managed policy', () => {
   });
 
   test('simple customer managed policy', () => {
-    const stack = new cdk.Stack();
     const mp = ManagedPolicy.fromManagedPolicyName(stack, 'MyCustomerManagedPolicy', "SomeCustomerPolicy");
 
     expect(stack.resolve(mp.managedPolicyArn)).toEqual({
       "Fn::Join": ['', [
         'arn:',
         { Ref: 'AWS::Partition' },
-        ':iam::',
-        { Ref: 'AWS::AccountId' },
-        ':policy/SomeCustomerPolicy'
+        ':iam::1234:policy/SomeCustomerPolicy'
       ]]
     });
   });
 
   test('managed policy with statements', () => {
-    const app = new cdk.App();
-    const stack = new cdk.Stack(app, 'MyStack');
-
     const policy = new ManagedPolicy(stack, 'MyManagedPolicy', { managedPolicyName: 'MyManagedPolicyName' });
     policy.addStatements(new PolicyStatement({ resources: ['*'], actions: ['sqs:SendMessage'] }));
     policy.addStatements(new PolicyStatement({ resources: ['arn'], actions: ['sns:Subscribe'] }));
@@ -71,9 +72,6 @@ describe('managed policy', () => {
   });
 
   test('policy name can be omitted, in which case the logical id will be used', () => {
-    const app = new cdk.App();
-    const stack = new cdk.Stack(app, 'MyStack');
-
     const policy = new ManagedPolicy(stack, 'MyManagedPolicy');
     policy.addStatements(new PolicyStatement({ resources: ['*'], actions: ['sqs:SendMessage'] }));
     policy.addStatements(new PolicyStatement({ resources: ['arn'], actions: ['sns:Subscribe'] }));
@@ -109,10 +107,6 @@ describe('managed policy', () => {
   });
 
   test('via props, managed policy can be attached to users, groups and roles and permissions, description and path can be added', () => {
-    const app = new cdk.App();
-
-    const stack = new cdk.Stack(app, 'MyStack');
-
     const user1 = new User(stack, 'User1');
     const group1 = new Group(stack, 'Group1');
     const role1 = new Role(stack, 'Role1', {
@@ -168,8 +162,6 @@ describe('managed policy', () => {
   });
 
   test('idempotent if a principal (user/group/role) is attached twice', () => {
-    const app = new cdk.App();
-    const stack = new cdk.Stack(app, 'MyStack');
     const p = new ManagedPolicy(stack, 'MyManagedPolicy');
     p.addStatements(new PolicyStatement({ actions: ['*'], resources: ['*'] }));
 
@@ -224,10 +216,6 @@ describe('managed policy', () => {
   });
 
   test('users, groups, roles and permissions can be added using methods', () => {
-    const app = new cdk.App();
-
-    const stack = new cdk.Stack(app, 'MyStack');
-
     const p = new ManagedPolicy(stack, 'MyManagedPolicy', {
       managedPolicyName: 'Foo',
     });
@@ -278,9 +266,6 @@ describe('managed policy', () => {
   });
 
   test('policy can be attached to users, groups or role via methods on the principal', () => {
-    const app = new cdk.App();
-    const stack = new cdk.Stack(app, 'MyStack');
-
     const policy = new ManagedPolicy(stack, 'MyManagedPolicy');
     const user = new User(stack, 'MyUser');
     const group = new Group(stack, 'MyGroup');
@@ -327,9 +312,6 @@ describe('managed policy', () => {
   });
 
   test('policy from AWS managed policy lookup can be attached to users, groups or role via methods on the principal', () => {
-    const app = new cdk.App();
-    const stack = new cdk.Stack(app, 'MyStack');
-
     const policy = ManagedPolicy.fromAwsManagedPolicyName('AnAWSManagedPolicy');
     const user = new User(stack, 'MyUser');
     const group = new Group(stack, 'MyGroup');
@@ -403,9 +385,6 @@ describe('managed policy', () => {
   });
 
   test('policy from customer managed policy lookup can be attached to users, groups or role via methods', () => {
-    const app = new cdk.App();
-    const stack = new cdk.Stack(app, 'MyStack');
-
     const policy = ManagedPolicy.fromManagedPolicyName(stack, 'MyManagedPolicy', 'ACustomerManagedPolicyName');
     const user = new User(stack, 'MyUser');
     const group = new Group(stack, 'MyGroup');
@@ -427,9 +406,7 @@ describe('managed policy', () => {
                   [
                     "arn:",
                     { Ref: "AWS::Partition" },
-                    ":iam::",
-                    { Ref: "AWS::AccountId" },
-                    ":policy/ACustomerManagedPolicyName"
+                    ":iam::1234:policy/ACustomerManagedPolicyName"
                   ]
                 ]
               }]
@@ -445,9 +422,7 @@ describe('managed policy', () => {
                   [
                     "arn:",
                     { Ref: "AWS::Partition" },
-                    ":iam::",
-                    { Ref: "AWS::AccountId" },
-                    ":policy/ACustomerManagedPolicyName"
+                    ":iam::1234:policy/ACustomerManagedPolicyName"
                   ]
                 ]
               }]
@@ -463,9 +438,7 @@ describe('managed policy', () => {
                   [
                     "arn:",
                     { Ref: "AWS::Partition" },
-                    ":iam::",
-                    { Ref: "AWS::AccountId" },
-                    ":policy/ACustomerManagedPolicyName"
+                    ":iam::1234:policy/ACustomerManagedPolicyName"
                   ]
                 ]
               }],
@@ -485,10 +458,56 @@ describe('managed policy', () => {
   });
 
   test('fails if policy document is empty', () => {
-    const app = new cdk.App();
-    const stack = new cdk.Stack(app, 'MyStack');
     new ManagedPolicy(stack, 'MyPolicy');
     expect(() => app.synth())
       .toThrow(/Managed Policy is empty. You must add statements to the policy/);
   });
+
+  test('managed policy name is correctly calculated', () => {
+    const mp = new ManagedPolicy(stack, 'Policy');
+    mp.addStatements(new PolicyStatement({
+      actions: ['a:abc'],
+    }));
+
+    expect(stack.resolve(mp.managedPolicyName)).toEqual({
+      "Fn::Select": [ 1,
+        { "Fn::Split": [ "/",
+            { "Fn::Select": [ 5,
+              { "Fn::Split": [ ":",
+              { Ref: "Policy23B91518", }] }, ], }, ], }, ]
+    });
+  });
+
+  test('cross-stack hard-name contains the right resource type', () => {
+    const mp = new ManagedPolicy(stack, 'Policy', {
+      managedPolicyName: cdk.PhysicalName.GENERATE_IF_NEEDED
+    });
+    mp.addStatements(new PolicyStatement({
+      actions: ['a:abc'],
+    }));
+
+    const stack2 = new cdk.Stack(app, 'Stack2', { env: { account: '5678', region: 'us-east-1' }});
+    new cdk.CfnOutput(stack2, 'Output', {
+      value: mp.managedPolicyArn
+    });
+
+    expect(stack2).toMatchTemplate({
+      Outputs: {
+        Output: {
+          Value: {
+            "Fn::Join": [
+              "",
+              [
+                "arn:",
+                {
+                  Ref: "AWS::Partition"
+                },
+                ":iam::1234:policy/mystackmystackpolicy17395e221b1b6deaf875"
+              ]
+            ]
+          }
+        }
+      }
+    });
+  });
 });
diff --git a/packages/@aws-cdk/aws-inspector/package.json b/packages/@aws-cdk/aws-inspector/package.json
index 5cb887c8755a8..007e0c03f0144 100644
--- a/packages/@aws-cdk/aws-inspector/package.json
+++ b/packages/@aws-cdk/aws-inspector/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@aws-cdk/aws-inspector",
-  "version": "1.13.1",
+  "version": "1.15.0",
   "description": "The CDK Construct Library for AWS::Inspector",
   "main": "lib/index.js",
   "types": "lib/index.d.ts",
@@ -63,17 +63,17 @@
   },
   "license": "Apache-2.0",
   "devDependencies": {
-    "@aws-cdk/assert": "1.13.1",
-    "cdk-build-tools": "^1.13.1",
-    "cfn2ts": "^1.13.1",
-    "pkglint": "^1.13.1"
+    "@aws-cdk/assert": "1.15.0",
+    "cdk-build-tools": "^1.15.0",
+    "cfn2ts": "^1.15.0",
+    "pkglint": "^1.15.0"
   },
   "dependencies": {
-    "@aws-cdk/core": "1.13.1"
+    "@aws-cdk/core": "1.15.0"
   },
   "homepage": "https://github.com/aws/aws-cdk",
   "peerDependencies": {
-    "@aws-cdk/core": "1.13.1"
+    "@aws-cdk/core": "1.15.0"
   },
   "engines": {
     "node": ">= 10.3.0"
diff --git a/packages/@aws-cdk/aws-iot/package.json b/packages/@aws-cdk/aws-iot/package.json
index 8fd572c62b740..3521f6b19c925 100644
--- a/packages/@aws-cdk/aws-iot/package.json
+++ b/packages/@aws-cdk/aws-iot/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@aws-cdk/aws-iot",
-  "version": "1.13.1",
+  "version": "1.15.0",
   "description": "The CDK Construct Library for AWS::IoT",
   "main": "lib/index.js",
   "types": "lib/index.d.ts",
@@ -63,17 +63,17 @@
   },
   "license": "Apache-2.0",
   "devDependencies": {
-    "@aws-cdk/assert": "1.13.1",
-    "cdk-build-tools": "^1.13.1",
-    "cfn2ts": "^1.13.1",
-    "pkglint": "^1.13.1"
+    "@aws-cdk/assert": "1.15.0",
+    "cdk-build-tools": "^1.15.0",
+    "cfn2ts": "^1.15.0",
+    "pkglint": "^1.15.0"
   },
   "dependencies": {
-    "@aws-cdk/core": "1.13.1"
+    "@aws-cdk/core": "1.15.0"
   },
   "homepage": "https://github.com/aws/aws-cdk",
   "peerDependencies": {
-    "@aws-cdk/core": "1.13.1"
+    "@aws-cdk/core": "1.15.0"
   },
   "engines": {
     "node": ">= 10.3.0"
diff --git a/packages/@aws-cdk/aws-iot1click/package.json b/packages/@aws-cdk/aws-iot1click/package.json
index 12de1d9542c90..23caf355ed2f8 100644
--- a/packages/@aws-cdk/aws-iot1click/package.json
+++ b/packages/@aws-cdk/aws-iot1click/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@aws-cdk/aws-iot1click",
-  "version": "1.13.1",
+  "version": "1.15.0",
   "description": "The CDK Construct Library for AWS::IoT1Click",
   "main": "lib/index.js",
   "types": "lib/index.d.ts",
@@ -64,16 +64,16 @@
   },
   "license": "Apache-2.0",
   "devDependencies": {
-    "@aws-cdk/assert": "1.13.1",
-    "cdk-build-tools": "^1.13.1",
-    "cfn2ts": "^1.13.1",
-    "pkglint": "^1.13.1"
+    "@aws-cdk/assert": "1.15.0",
+    "cdk-build-tools": "^1.15.0",
+    "cfn2ts": "^1.15.0",
+    "pkglint": "^1.15.0"
   },
   "dependencies": {
-    "@aws-cdk/core": "1.13.1"
+    "@aws-cdk/core": "1.15.0"
   },
   "peerDependencies": {
-    "@aws-cdk/core": "1.13.1"
+    "@aws-cdk/core": "1.15.0"
   },
   "engines": {
     "node": ">= 10.3.0"
diff --git a/packages/@aws-cdk/aws-iotanalytics/package.json b/packages/@aws-cdk/aws-iotanalytics/package.json
index 87e42a2878efd..8fab949fd3e59 100644
--- a/packages/@aws-cdk/aws-iotanalytics/package.json
+++ b/packages/@aws-cdk/aws-iotanalytics/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@aws-cdk/aws-iotanalytics",
-  "version": "1.13.1",
+  "version": "1.15.0",
   "description": "The CDK Construct Library for AWS::IoTAnalytics",
   "main": "lib/index.js",
   "types": "lib/index.d.ts",
@@ -65,16 +65,16 @@
   },
   "license": "Apache-2.0",
   "devDependencies": {
-    "@aws-cdk/assert": "1.13.1",
-    "cdk-build-tools": "^1.13.1",
-    "cfn2ts": "^1.13.1",
-    "pkglint": "^1.13.1"
+    "@aws-cdk/assert": "1.15.0",
+    "cdk-build-tools": "^1.15.0",
+    "cfn2ts": "^1.15.0",
+    "pkglint": "^1.15.0"
   },
   "dependencies": {
-    "@aws-cdk/core": "1.13.1"
+    "@aws-cdk/core": "1.15.0"
   },
   "peerDependencies": {
-    "@aws-cdk/core": "1.13.1"
+    "@aws-cdk/core": "1.15.0"
   },
   "engines": {
     "node": ">= 10.3.0"
diff --git a/packages/@aws-cdk/aws-iotevents/package.json b/packages/@aws-cdk/aws-iotevents/package.json
index 4a5bd0b2e0798..047b1833ec667 100644
--- a/packages/@aws-cdk/aws-iotevents/package.json
+++ b/packages/@aws-cdk/aws-iotevents/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@aws-cdk/aws-iotevents",
-  "version": "1.13.1",
+  "version": "1.15.0",
   "description": "The CDK Construct Library for AWS::IoTEvents",
   "main": "lib/index.js",
   "types": "lib/index.d.ts",
@@ -65,16 +65,16 @@
   },
   "license": "Apache-2.0",
   "devDependencies": {
-    "@aws-cdk/assert": "1.13.1",
-    "cdk-build-tools": "^1.13.1",
-    "cfn2ts": "1.13.1",
-    "pkglint": "^1.13.1"
+    "@aws-cdk/assert": "1.15.0",
+    "cdk-build-tools": "^1.15.0",
+    "cfn2ts": "1.15.0",
+    "pkglint": "^1.15.0"
   },
   "dependencies": {
-    "@aws-cdk/core": "1.13.1"
+    "@aws-cdk/core": "1.15.0"
   },
   "peerDependencies": {
-    "@aws-cdk/core": "1.13.1"
+    "@aws-cdk/core": "1.15.0"
   },
   "engines": {
     "node": ">= 10.3.0"
diff --git a/packages/@aws-cdk/aws-iotthingsgraph/package.json b/packages/@aws-cdk/aws-iotthingsgraph/package.json
index c1bf7354e757b..a9f27d8b0919b 100644
--- a/packages/@aws-cdk/aws-iotthingsgraph/package.json
+++ b/packages/@aws-cdk/aws-iotthingsgraph/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@aws-cdk/aws-iotthingsgraph",
-  "version": "1.13.1",
+  "version": "1.15.0",
   "description": "The CDK Construct Library for AWS::IoTThingsGraph",
   "main": "lib/index.js",
   "types": "lib/index.d.ts",
@@ -65,16 +65,16 @@
   },
   "license": "Apache-2.0",
   "devDependencies": {
-    "@aws-cdk/assert": "1.13.1",
-    "cdk-build-tools": "^1.13.1",
-    "cfn2ts": "^1.13.1",
-    "pkglint": "^1.13.1"
+    "@aws-cdk/assert": "1.15.0",
+    "cdk-build-tools": "^1.15.0",
+    "cfn2ts": "^1.15.0",
+    "pkglint": "^1.15.0"
   },
   "dependencies": {
-    "@aws-cdk/core": "1.13.1"
+    "@aws-cdk/core": "1.15.0"
   },
   "peerDependencies": {
-    "@aws-cdk/core": "1.13.1"
+    "@aws-cdk/core": "1.15.0"
   },
   "engines": {
     "node": ">= 10.3.0"
diff --git a/packages/@aws-cdk/aws-kinesis/package.json b/packages/@aws-cdk/aws-kinesis/package.json
index 65927414308e5..6f8db0af70e0c 100644
--- a/packages/@aws-cdk/aws-kinesis/package.json
+++ b/packages/@aws-cdk/aws-kinesis/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@aws-cdk/aws-kinesis",
-  "version": "1.13.1",
+  "version": "1.15.0",
   "description": "CDK Constructs for AWS Kinesis",
   "main": "lib/index.js",
   "types": "lib/index.d.ts",
@@ -62,26 +62,34 @@
   },
   "license": "Apache-2.0",
   "devDependencies": {
-    "@aws-cdk/assert": "1.13.1",
-    "cdk-build-tools": "^1.13.1",
-    "cfn2ts": "^1.13.1",
-    "pkglint": "^1.13.1"
+    "@aws-cdk/assert": "1.15.0",
+    "cdk-build-tools": "^1.15.0",
+    "cfn2ts": "^1.15.0",
+    "pkglint": "^1.15.0"
   },
   "dependencies": {
-    "@aws-cdk/aws-iam": "1.13.1",
-    "@aws-cdk/aws-kms": "1.13.1",
-    "@aws-cdk/aws-logs": "1.13.1",
-    "@aws-cdk/core": "1.13.1"
+    "@aws-cdk/aws-iam": "1.15.0",
+    "@aws-cdk/aws-kms": "1.15.0",
+    "@aws-cdk/aws-logs": "1.15.0",
+    "@aws-cdk/core": "1.15.0"
   },
   "homepage": "https://github.com/aws/aws-cdk",
   "peerDependencies": {
-    "@aws-cdk/aws-iam": "1.13.1",
-    "@aws-cdk/aws-kms": "1.13.1",
-    "@aws-cdk/aws-logs": "1.13.1",
-    "@aws-cdk/core": "1.13.1"
+    "@aws-cdk/aws-iam": "1.15.0",
+    "@aws-cdk/aws-kms": "1.15.0",
+    "@aws-cdk/aws-logs": "1.15.0",
+    "@aws-cdk/core": "1.15.0"
   },
   "engines": {
     "node": ">= 10.3.0"
   },
-  "stability": "experimental"
+  "stability": "experimental",
+  "awslint": {
+    "exclude": [
+      "docs-public-apis:@aws-cdk/aws-kinesis.Stream.fromStreamArn",
+      "docs-public-apis:@aws-cdk/aws-kinesis.IStream",
+      "props-default-doc:@aws-cdk/aws-kinesis.StreamAttributes.encryptionKey",
+      "docs-public-apis:@aws-cdk/aws-kinesis.StreamProps"
+    ]
+  }
 }
diff --git a/packages/@aws-cdk/aws-kinesisanalytics/package.json b/packages/@aws-cdk/aws-kinesisanalytics/package.json
index 5ba9e19f278ef..c7d6f97cfb218 100644
--- a/packages/@aws-cdk/aws-kinesisanalytics/package.json
+++ b/packages/@aws-cdk/aws-kinesisanalytics/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@aws-cdk/aws-kinesisanalytics",
-  "version": "1.13.1",
+  "version": "1.15.0",
   "description": "The CDK Construct Library for AWS::KinesisAnalytics",
   "main": "lib/index.js",
   "types": "lib/index.d.ts",
@@ -66,17 +66,17 @@
   },
   "license": "Apache-2.0",
   "devDependencies": {
-    "@aws-cdk/assert": "1.13.1",
-    "cdk-build-tools": "^1.13.1",
-    "cfn2ts": "^1.13.1",
-    "pkglint": "^1.13.1"
+    "@aws-cdk/assert": "1.15.0",
+    "cdk-build-tools": "^1.15.0",
+    "cfn2ts": "^1.15.0",
+    "pkglint": "^1.15.0"
   },
   "dependencies": {
-    "@aws-cdk/core": "1.13.1"
+    "@aws-cdk/core": "1.15.0"
   },
   "homepage": "https://github.com/aws/aws-cdk",
   "peerDependencies": {
-    "@aws-cdk/core": "1.13.1"
+    "@aws-cdk/core": "1.15.0"
   },
   "engines": {
     "node": ">= 10.3.0"
diff --git a/packages/@aws-cdk/aws-kinesisfirehose/package.json b/packages/@aws-cdk/aws-kinesisfirehose/package.json
index 784f03165ac41..46ba0e3afd1c1 100644
--- a/packages/@aws-cdk/aws-kinesisfirehose/package.json
+++ b/packages/@aws-cdk/aws-kinesisfirehose/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@aws-cdk/aws-kinesisfirehose",
-  "version": "1.13.1",
+  "version": "1.15.0",
   "description": "The CDK Construct Library for AWS::KinesisFirehose",
   "main": "lib/index.js",
   "types": "lib/index.d.ts",
@@ -63,17 +63,17 @@
   },
   "license": "Apache-2.0",
   "devDependencies": {
-    "@aws-cdk/assert": "1.13.1",
-    "cdk-build-tools": "^1.13.1",
-    "cfn2ts": "^1.13.1",
-    "pkglint": "^1.13.1"
+    "@aws-cdk/assert": "1.15.0",
+    "cdk-build-tools": "^1.15.0",
+    "cfn2ts": "^1.15.0",
+    "pkglint": "^1.15.0"
   },
   "dependencies": {
-    "@aws-cdk/core": "1.13.1"
+    "@aws-cdk/core": "1.15.0"
   },
   "homepage": "https://github.com/aws/aws-cdk",
   "peerDependencies": {
-    "@aws-cdk/core": "1.13.1"
+    "@aws-cdk/core": "1.15.0"
   },
   "engines": {
     "node": ">= 10.3.0"
diff --git a/packages/@aws-cdk/aws-kms/package.json b/packages/@aws-cdk/aws-kms/package.json
index 64257557bdd16..8de1aea24e6b3 100644
--- a/packages/@aws-cdk/aws-kms/package.json
+++ b/packages/@aws-cdk/aws-kms/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@aws-cdk/aws-kms",
-  "version": "1.13.1",
+  "version": "1.15.0",
   "description": "CDK Constructs for AWS KMS",
   "main": "lib/index.js",
   "types": "lib/index.d.ts",
@@ -63,27 +63,31 @@
   },
   "license": "Apache-2.0",
   "devDependencies": {
-    "@aws-cdk/assert": "1.13.1",
-    "cdk-build-tools": "^1.13.1",
-    "cdk-integ-tools": "^1.13.1",
-    "cfn2ts": "^1.13.1",
-    "pkglint": "^1.13.1"
+    "@aws-cdk/assert": "1.15.0",
+    "cdk-build-tools": "^1.15.0",
+    "cdk-integ-tools": "^1.15.0",
+    "cfn2ts": "^1.15.0",
+    "pkglint": "^1.15.0"
   },
   "dependencies": {
-    "@aws-cdk/aws-iam": "1.13.1",
-    "@aws-cdk/core": "1.13.1"
+    "@aws-cdk/aws-iam": "1.15.0",
+    "@aws-cdk/core": "1.15.0"
   },
   "homepage": "https://github.com/aws/aws-cdk",
   "peerDependencies": {
-    "@aws-cdk/aws-iam": "1.13.1",
-    "@aws-cdk/core": "1.13.1"
+    "@aws-cdk/aws-iam": "1.15.0",
+    "@aws-cdk/core": "1.15.0"
   },
   "engines": {
     "node": ">= 10.3.0"
   },
   "awslint": {
     "exclude": [
-      "props-physical-name:@aws-cdk/aws-kms.KeyProps"
+      "props-physical-name:@aws-cdk/aws-kms.KeyProps",
+      "docs-public-apis:@aws-cdk/aws-kms.Alias.fromAliasAttributes",
+      "docs-public-apis:@aws-cdk/aws-kms.AliasAttributes",
+      "docs-public-apis:@aws-cdk/aws-kms.AliasAttributes.aliasName",
+      "docs-public-apis:@aws-cdk/aws-kms.AliasAttributes.aliasTargetKey"
     ]
   },
   "stability": "stable"
diff --git a/packages/@aws-cdk/aws-lakeformation/package.json b/packages/@aws-cdk/aws-lakeformation/package.json
index 2902166eeabae..e0ed8cd9971e9 100644
--- a/packages/@aws-cdk/aws-lakeformation/package.json
+++ b/packages/@aws-cdk/aws-lakeformation/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@aws-cdk/aws-lakeformation",
-  "version": "1.13.1",
+  "version": "1.15.0",
   "description": "The CDK Construct Library for AWS::LakeFormation",
   "main": "lib/index.js",
   "types": "lib/index.d.ts",
@@ -65,16 +65,16 @@
   },
   "license": "Apache-2.0",
   "devDependencies": {
-    "@aws-cdk/assert": "1.13.1",
-    "cdk-build-tools": "^1.13.1",
-    "cfn2ts": "1.13.1",
-    "pkglint": "^1.13.1"
+    "@aws-cdk/assert": "1.15.0",
+    "cdk-build-tools": "^1.15.0",
+    "cfn2ts": "1.15.0",
+    "pkglint": "^1.15.0"
   },
   "dependencies": {
-    "@aws-cdk/core": "1.13.1"
+    "@aws-cdk/core": "1.15.0"
   },
   "peerDependencies": {
-    "@aws-cdk/core": "1.13.1"
+    "@aws-cdk/core": "1.15.0"
   },
   "engines": {
     "node": ">= 10.3.0"
diff --git a/packages/@aws-cdk/aws-lambda-event-sources/package.json b/packages/@aws-cdk/aws-lambda-event-sources/package.json
index 40ce2a663a6b9..9048ebbba159a 100644
--- a/packages/@aws-cdk/aws-lambda-event-sources/package.json
+++ b/packages/@aws-cdk/aws-lambda-event-sources/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@aws-cdk/aws-lambda-event-sources",
-  "version": "1.13.1",
+  "version": "1.15.0",
   "description": "Event sources for AWS Lambda",
   "main": "lib/index.js",
   "types": "lib/index.d.ts",
@@ -59,42 +59,56 @@
   },
   "license": "Apache-2.0",
   "devDependencies": {
-    "@aws-cdk/assert": "1.13.1",
-    "cdk-build-tools": "^1.13.1",
-    "cdk-integ-tools": "^1.13.1",
-    "pkglint": "^1.13.1"
+    "@aws-cdk/assert": "1.15.0",
+    "cdk-build-tools": "^1.15.0",
+    "cdk-integ-tools": "^1.15.0",
+    "pkglint": "^1.15.0"
   },
   "dependencies": {
-    "@aws-cdk/aws-apigateway": "1.13.1",
-    "@aws-cdk/aws-dynamodb": "1.13.1",
-    "@aws-cdk/aws-events": "1.13.1",
-    "@aws-cdk/aws-iam": "1.13.1",
-    "@aws-cdk/aws-kinesis": "1.13.1",
-    "@aws-cdk/aws-lambda": "1.13.1",
-    "@aws-cdk/aws-s3": "1.13.1",
-    "@aws-cdk/aws-s3-notifications": "1.13.1",
-    "@aws-cdk/aws-sns": "1.13.1",
-    "@aws-cdk/aws-sns-subscriptions": "1.13.1",
-    "@aws-cdk/aws-sqs": "1.13.1",
-    "@aws-cdk/core": "1.13.1"
+    "@aws-cdk/aws-apigateway": "1.15.0",
+    "@aws-cdk/aws-dynamodb": "1.15.0",
+    "@aws-cdk/aws-events": "1.15.0",
+    "@aws-cdk/aws-iam": "1.15.0",
+    "@aws-cdk/aws-kinesis": "1.15.0",
+    "@aws-cdk/aws-lambda": "1.15.0",
+    "@aws-cdk/aws-s3": "1.15.0",
+    "@aws-cdk/aws-s3-notifications": "1.15.0",
+    "@aws-cdk/aws-sns": "1.15.0",
+    "@aws-cdk/aws-sns-subscriptions": "1.15.0",
+    "@aws-cdk/aws-sqs": "1.15.0",
+    "@aws-cdk/core": "1.15.0"
   },
   "homepage": "https://github.com/aws/aws-cdk",
   "peerDependencies": {
-    "@aws-cdk/aws-apigateway": "1.13.1",
-    "@aws-cdk/aws-dynamodb": "1.13.1",
-    "@aws-cdk/aws-events": "1.13.1",
-    "@aws-cdk/aws-iam": "1.13.1",
-    "@aws-cdk/aws-kinesis": "1.13.1",
-    "@aws-cdk/aws-lambda": "1.13.1",
-    "@aws-cdk/aws-s3": "1.13.1",
-    "@aws-cdk/aws-s3-notifications": "1.13.1",
-    "@aws-cdk/aws-sns": "1.13.1",
-    "@aws-cdk/aws-sns-subscriptions": "1.13.1",
-    "@aws-cdk/aws-sqs": "1.13.1",
-    "@aws-cdk/core": "1.13.1"
+    "@aws-cdk/aws-apigateway": "1.15.0",
+    "@aws-cdk/aws-dynamodb": "1.15.0",
+    "@aws-cdk/aws-events": "1.15.0",
+    "@aws-cdk/aws-iam": "1.15.0",
+    "@aws-cdk/aws-kinesis": "1.15.0",
+    "@aws-cdk/aws-lambda": "1.15.0",
+    "@aws-cdk/aws-s3": "1.15.0",
+    "@aws-cdk/aws-s3-notifications": "1.15.0",
+    "@aws-cdk/aws-sns": "1.15.0",
+    "@aws-cdk/aws-sns-subscriptions": "1.15.0",
+    "@aws-cdk/aws-sqs": "1.15.0",
+    "@aws-cdk/core": "1.15.0"
   },
   "engines": {
     "node": ">= 10.3.0"
   },
-  "stability": "stable"
+  "stability": "stable",
+  "awslint": {
+    "exclude": [
+      "docs-public-apis:@aws-cdk/aws-lambda-event-sources.ApiEventSource",
+      "docs-public-apis:@aws-cdk/aws-lambda-event-sources.KinesisEventSource.stream",
+      "docs-public-apis:@aws-cdk/aws-lambda-event-sources.S3EventSource.bucket",
+      "docs-public-apis:@aws-cdk/aws-lambda-event-sources.SnsEventSource.topic",
+      "docs-public-apis:@aws-cdk/aws-lambda-event-sources.SqsEventSource.queue",
+      "docs-public-apis:@aws-cdk/aws-lambda-event-sources.DynamoEventSourceProps",
+      "docs-public-apis:@aws-cdk/aws-lambda-event-sources.KinesisEventSourceProps",
+      "docs-public-apis:@aws-cdk/aws-lambda-event-sources.S3EventSourceProps",
+      "props-default-doc:@aws-cdk/aws-lambda-event-sources.S3EventSourceProps.filters",
+      "docs-public-apis:@aws-cdk/aws-lambda-event-sources.SqsEventSourceProps"
+    ]
+  }
 }
diff --git a/packages/@aws-cdk/aws-lambda/lib/runtime.ts b/packages/@aws-cdk/aws-lambda/lib/runtime.ts
index fb11823582bc7..bac41cfb31981 100644
--- a/packages/@aws-cdk/aws-lambda/lib/runtime.ts
+++ b/packages/@aws-cdk/aws-lambda/lib/runtime.ts
@@ -26,12 +26,13 @@ export class Runtime {
   /** A list of all known `Runtime`'s. */
   public static readonly ALL = new Array<Runtime>();
 
-  /** @deprecated Use `Nodejs810` or `Nodejs10x` */
+  /** @deprecated Use {@link NODEJS_10_X} */
   public static readonly NODEJS =       new Runtime('nodejs',         RuntimeFamily.NODEJS, { supportsInlineCode: true });
-  /** @deprecated Use `Nodejs810` or `Nodejs10x` */
+  /** @deprecated Use {@link NODEJS_10_X} */
   public static readonly NODEJS_4_3 =     new Runtime('nodejs4.3',      RuntimeFamily.NODEJS, { supportsInlineCode: true });
-  /** @deprecated Use `Nodejs810` or `Nodejs10x` */
+  /** @deprecated Use {@link NODEJS_10_X} */
   public static readonly NODEJS_6_10 =    new Runtime('nodejs6.10',     RuntimeFamily.NODEJS, { supportsInlineCode: true });
+  /** @deprecated Use {@link NODEJS_10_X} */
   public static readonly NODEJS_8_10 =    new Runtime('nodejs8.10',     RuntimeFamily.NODEJS, { supportsInlineCode: true });
   public static readonly NODEJS_10_X =    new Runtime('nodejs10.x',     RuntimeFamily.NODEJS, { supportsInlineCode: false });
   public static readonly PYTHON_2_7 =     new Runtime('python2.7',      RuntimeFamily.PYTHON, { supportsInlineCode: true });
diff --git a/packages/@aws-cdk/aws-lambda/package.json b/packages/@aws-cdk/aws-lambda/package.json
index 09e2a824704fb..77d50c5259b2c 100644
--- a/packages/@aws-cdk/aws-lambda/package.json
+++ b/packages/@aws-cdk/aws-lambda/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@aws-cdk/aws-lambda",
-  "version": "1.13.1",
+  "version": "1.15.0",
   "description": "CDK Constructs for AWS Lambda",
   "main": "lib/index.js",
   "types": "lib/index.d.ts",
@@ -67,44 +67,44 @@
   },
   "license": "Apache-2.0",
   "devDependencies": {
-    "@aws-cdk/assert": "1.13.1",
+    "@aws-cdk/assert": "1.15.0",
     "@types/aws-lambda": "^8.10.33",
     "@types/lodash": "^4.14.144",
     "@types/sinon": "^7.5.0",
-    "aws-sdk": "^2.553.0",
+    "aws-sdk": "^2.558.0",
     "aws-sdk-mock": "^4.5.0",
-    "cdk-build-tools": "^1.13.1",
-    "cdk-integ-tools": "^1.13.1",
-    "cfn2ts": "^1.13.1",
+    "cdk-build-tools": "^1.15.0",
+    "cdk-integ-tools": "^1.15.0",
+    "cfn2ts": "^1.15.0",
     "lodash": "^4.17.15",
-    "nock": "^11.4.0",
-    "pkglint": "^1.13.1",
+    "nock": "^11.6.0",
+    "pkglint": "^1.15.0",
     "sinon": "^7.5.0"
   },
   "dependencies": {
-    "@aws-cdk/aws-cloudwatch": "1.13.1",
-    "@aws-cdk/aws-ec2": "1.13.1",
-    "@aws-cdk/aws-events": "1.13.1",
-    "@aws-cdk/aws-iam": "1.13.1",
-    "@aws-cdk/aws-logs": "1.13.1",
-    "@aws-cdk/aws-s3": "1.13.1",
-    "@aws-cdk/aws-s3-assets": "1.13.1",
-    "@aws-cdk/aws-sqs": "1.13.1",
-    "@aws-cdk/core": "1.13.1",
-    "@aws-cdk/cx-api": "1.13.1"
+    "@aws-cdk/aws-cloudwatch": "1.15.0",
+    "@aws-cdk/aws-ec2": "1.15.0",
+    "@aws-cdk/aws-events": "1.15.0",
+    "@aws-cdk/aws-iam": "1.15.0",
+    "@aws-cdk/aws-logs": "1.15.0",
+    "@aws-cdk/aws-s3": "1.15.0",
+    "@aws-cdk/aws-s3-assets": "1.15.0",
+    "@aws-cdk/aws-sqs": "1.15.0",
+    "@aws-cdk/core": "1.15.0",
+    "@aws-cdk/cx-api": "1.15.0"
   },
   "homepage": "https://github.com/aws/aws-cdk",
   "peerDependencies": {
-    "@aws-cdk/aws-cloudwatch": "1.13.1",
-    "@aws-cdk/aws-ec2": "1.13.1",
-    "@aws-cdk/aws-events": "1.13.1",
-    "@aws-cdk/aws-iam": "1.13.1",
-    "@aws-cdk/aws-logs": "1.13.1",
-    "@aws-cdk/aws-s3": "1.13.1",
-    "@aws-cdk/aws-s3-assets": "1.13.1",
-    "@aws-cdk/aws-sqs": "1.13.1",
-    "@aws-cdk/core": "1.13.1",
-    "@aws-cdk/cx-api": "1.13.1"
+    "@aws-cdk/aws-cloudwatch": "1.15.0",
+    "@aws-cdk/aws-ec2": "1.15.0",
+    "@aws-cdk/aws-events": "1.15.0",
+    "@aws-cdk/aws-iam": "1.15.0",
+    "@aws-cdk/aws-logs": "1.15.0",
+    "@aws-cdk/aws-s3": "1.15.0",
+    "@aws-cdk/aws-s3-assets": "1.15.0",
+    "@aws-cdk/aws-sqs": "1.15.0",
+    "@aws-cdk/core": "1.15.0",
+    "@aws-cdk/cx-api": "1.15.0"
   },
   "engines": {
     "node": ">= 10.3.0"
@@ -113,7 +113,71 @@
     "exclude": [
       "integ-return-type:@aws-cdk/aws-lambda.IEventSource.bind",
       "props-physical-name:@aws-cdk/aws-lambda.VersionProps",
-      "props-physical-name:@aws-cdk/aws-lambda.EventSourceMappingProps"
+      "props-physical-name:@aws-cdk/aws-lambda.EventSourceMappingProps",
+      "docs-public-apis:@aws-cdk/aws-lambda.Runtime.runtimeEquals",
+      "docs-public-apis:@aws-cdk/aws-lambda.RuntimeFamily.OTHER",
+      "docs-public-apis:@aws-cdk/aws-lambda.RuntimeFamily.RUBY",
+      "docs-public-apis:@aws-cdk/aws-lambda.RuntimeFamily.GO",
+      "docs-public-apis:@aws-cdk/aws-lambda.RuntimeFamily.DOTNET_CORE",
+      "docs-public-apis:@aws-cdk/aws-lambda.RuntimeFamily.PYTHON",
+      "docs-public-apis:@aws-cdk/aws-lambda.RuntimeFamily.JAVA",
+      "docs-public-apis:@aws-cdk/aws-lambda.RuntimeFamily.NODEJS",
+      "docs-public-apis:@aws-cdk/aws-lambda.Alias.lambda",
+      "docs-public-apis:@aws-cdk/aws-lambda.Alias.fromAliasAttributes",
+      "docs-public-apis:@aws-cdk/aws-lambda.Code",
+      "docs-public-apis:@aws-cdk/aws-lambda.Code.asset",
+      "docs-public-apis:@aws-cdk/aws-lambda.Code.bucket",
+      "docs-public-apis:@aws-cdk/aws-lambda.Code.cfnParameters",
+      "docs-public-apis:@aws-cdk/aws-lambda.Code.fromBucket",
+      "docs-public-apis:@aws-cdk/aws-lambda.Code.fromInline",
+      "docs-public-apis:@aws-cdk/aws-lambda.Code.inline",
+      "docs-public-apis:@aws-cdk/aws-lambda.Function.fromFunctionArn",
+      "docs-public-apis:@aws-cdk/aws-lambda.FunctionBase",
+      "docs-public-apis:@aws-cdk/aws-lambda.QualifiedFunctionBase",
+      "docs-public-apis:@aws-cdk/aws-lambda.QualifiedFunctionBase.lambda",
+      "docs-public-apis:@aws-cdk/aws-lambda.Runtime.DOTNET_CORE_1",
+      "docs-public-apis:@aws-cdk/aws-lambda.Runtime.DOTNET_CORE_2",
+      "docs-public-apis:@aws-cdk/aws-lambda.Runtime.DOTNET_CORE_2_1",
+      "docs-public-apis:@aws-cdk/aws-lambda.Runtime.GO_1_X",
+      "docs-public-apis:@aws-cdk/aws-lambda.Runtime.JAVA_8",
+      "docs-public-apis:@aws-cdk/aws-lambda.Runtime.NODEJS",
+      "docs-public-apis:@aws-cdk/aws-lambda.Runtime.NODEJS_10_X",
+      "docs-public-apis:@aws-cdk/aws-lambda.Runtime.NODEJS_4_3",
+      "docs-public-apis:@aws-cdk/aws-lambda.Runtime.NODEJS_6_10",
+      "docs-public-apis:@aws-cdk/aws-lambda.Runtime.NODEJS_8_10",
+      "docs-public-apis:@aws-cdk/aws-lambda.Runtime.PROVIDED",
+      "docs-public-apis:@aws-cdk/aws-lambda.Runtime.PYTHON_2_7",
+      "docs-public-apis:@aws-cdk/aws-lambda.Runtime.PYTHON_3_6",
+      "docs-public-apis:@aws-cdk/aws-lambda.Runtime.PYTHON_3_7",
+      "docs-public-apis:@aws-cdk/aws-lambda.Runtime.RUBY_2_5",
+      "docs-public-apis:@aws-cdk/aws-lambda.RuntimeFamily",
+      "docs-public-apis:@aws-cdk/aws-lambda.Runtime.toString",
+      "docs-public-apis:@aws-cdk/aws-lambda.Version.fromVersionAttributes",
+      "docs-public-apis:@aws-cdk/aws-lambda.AliasAttributes",
+      "docs-public-apis:@aws-cdk/aws-lambda.AliasAttributes.aliasName",
+      "docs-public-apis:@aws-cdk/aws-lambda.AliasAttributes.aliasVersion",
+      "docs-public-apis:@aws-cdk/aws-lambda.CodeConfig",
+      "props-default-doc:@aws-cdk/aws-lambda.CodeConfig.inlineCode",
+      "props-default-doc:@aws-cdk/aws-lambda.CodeConfig.s3Location",
+      "docs-public-apis:@aws-cdk/aws-lambda.EventSourceMappingOptions",
+      "docs-public-apis:@aws-cdk/aws-lambda.EventSourceMappingProps",
+      "props-default-doc:@aws-cdk/aws-lambda.FunctionAttributes.role",
+      "props-default-doc:@aws-cdk/aws-lambda.FunctionAttributes.securityGroup",
+      "props-default-doc:@aws-cdk/aws-lambda.FunctionAttributes.securityGroupId",
+      "docs-public-apis:@aws-cdk/aws-lambda.FunctionProps",
+      "docs-public-apis:@aws-cdk/aws-lambda.IAlias",
+      "docs-public-apis:@aws-cdk/aws-lambda.IFunction",
+      "docs-public-apis:@aws-cdk/aws-lambda.IFunction.addEventSource",
+      "docs-public-apis:@aws-cdk/aws-lambda.ILayerVersion",
+      "docs-public-apis:@aws-cdk/aws-lambda.IVersion",
+      "docs-public-apis:@aws-cdk/aws-lambda.LambdaRuntimeProps",
+      "props-default-doc:@aws-cdk/aws-lambda.LayerVersionAttributes.compatibleRuntimes",
+      "props-default-doc:@aws-cdk/aws-lambda.LayerVersionPermission.organizationId",
+      "docs-public-apis:@aws-cdk/aws-lambda.LayerVersionProps",
+      "props-default-doc:@aws-cdk/aws-lambda.Permission.sourceAccount",
+      "props-default-doc:@aws-cdk/aws-lambda.Permission.sourceArn",
+      "docs-public-apis:@aws-cdk/aws-lambda.ResourceBindOptions",
+      "docs-public-apis:@aws-cdk/aws-lambda.VersionAttributes"
     ]
   },
   "stability": "stable"
diff --git a/packages/@aws-cdk/aws-logs-destinations/package.json b/packages/@aws-cdk/aws-logs-destinations/package.json
index f16f0712aad65..b23b6cf30bfcb 100644
--- a/packages/@aws-cdk/aws-logs-destinations/package.json
+++ b/packages/@aws-cdk/aws-logs-destinations/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@aws-cdk/aws-logs-destinations",
-  "version": "1.13.1",
+  "version": "1.15.0",
   "description": "Log Destinations for AWS CloudWatch Logs",
   "main": "lib/index.js",
   "types": "lib/index.d.ts",
@@ -71,27 +71,27 @@
   },
   "license": "Apache-2.0",
   "devDependencies": {
-    "@aws-cdk/assert": "1.13.1",
-    "cdk-build-tools": "^1.13.1",
-    "cdk-integ-tools": "^1.13.1",
-    "cfn2ts": "^1.13.1",
+    "@aws-cdk/assert": "1.15.0",
+    "cdk-build-tools": "^1.15.0",
+    "cdk-integ-tools": "^1.15.0",
+    "cfn2ts": "^1.15.0",
     "jest": "^24.9.0",
-    "pkglint": "^1.13.1"
+    "pkglint": "^1.15.0"
   },
   "dependencies": {
-    "@aws-cdk/aws-iam": "1.13.1",
-    "@aws-cdk/aws-kinesis": "1.13.1",
-    "@aws-cdk/aws-lambda": "1.13.1",
-    "@aws-cdk/aws-logs": "1.13.1",
-    "@aws-cdk/core": "1.13.1"
+    "@aws-cdk/aws-iam": "1.15.0",
+    "@aws-cdk/aws-kinesis": "1.15.0",
+    "@aws-cdk/aws-lambda": "1.15.0",
+    "@aws-cdk/aws-logs": "1.15.0",
+    "@aws-cdk/core": "1.15.0"
   },
   "homepage": "https://github.com/aws/aws-cdk",
   "peerDependencies": {
-    "@aws-cdk/aws-iam": "1.13.1",
-    "@aws-cdk/aws-kinesis": "1.13.1",
-    "@aws-cdk/aws-lambda": "1.13.1",
-    "@aws-cdk/aws-logs": "1.13.1",
-    "@aws-cdk/core": "1.13.1"
+    "@aws-cdk/aws-iam": "1.15.0",
+    "@aws-cdk/aws-kinesis": "1.15.0",
+    "@aws-cdk/aws-lambda": "1.15.0",
+    "@aws-cdk/aws-logs": "1.15.0",
+    "@aws-cdk/core": "1.15.0"
   },
   "engines": {
     "node": ">= 10.3.0"
diff --git a/packages/@aws-cdk/aws-logs/package.json b/packages/@aws-cdk/aws-logs/package.json
index 57522d5061b6d..3f6a543a4d612 100644
--- a/packages/@aws-cdk/aws-logs/package.json
+++ b/packages/@aws-cdk/aws-logs/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@aws-cdk/aws-logs",
-  "version": "1.13.1",
+  "version": "1.15.0",
   "description": "The CDK Construct Library for AWS::Logs",
   "main": "lib/index.js",
   "types": "lib/index.d.ts",
@@ -63,22 +63,22 @@
   },
   "license": "Apache-2.0",
   "devDependencies": {
-    "@aws-cdk/assert": "1.13.1",
-    "cdk-build-tools": "^1.13.1",
-    "cdk-integ-tools": "^1.13.1",
-    "cfn2ts": "^1.13.1",
-    "pkglint": "^1.13.1"
+    "@aws-cdk/assert": "1.15.0",
+    "cdk-build-tools": "^1.15.0",
+    "cdk-integ-tools": "^1.15.0",
+    "cfn2ts": "^1.15.0",
+    "pkglint": "^1.15.0"
   },
   "dependencies": {
-    "@aws-cdk/aws-cloudwatch": "1.13.1",
-    "@aws-cdk/aws-iam": "1.13.1",
-    "@aws-cdk/core": "1.13.1"
+    "@aws-cdk/aws-cloudwatch": "1.15.0",
+    "@aws-cdk/aws-iam": "1.15.0",
+    "@aws-cdk/core": "1.15.0"
   },
   "homepage": "https://github.com/aws/aws-cdk",
   "peerDependencies": {
-    "@aws-cdk/aws-cloudwatch": "1.13.1",
-    "@aws-cdk/aws-iam": "1.13.1",
-    "@aws-cdk/core": "1.13.1"
+    "@aws-cdk/aws-cloudwatch": "1.15.0",
+    "@aws-cdk/aws-iam": "1.15.0",
+    "@aws-cdk/core": "1.15.0"
   },
   "engines": {
     "node": ">= 10.3.0"
@@ -87,7 +87,17 @@
     "exclude": [
       "props-no-arn-refs:@aws-cdk/aws-logs.CrossAccountDestinationProps.targetArn",
       "props-physical-name:@aws-cdk/aws-logs.MetricFilterProps",
-      "props-physical-name:@aws-cdk/aws-logs.SubscriptionFilterProps"
+      "props-physical-name:@aws-cdk/aws-logs.SubscriptionFilterProps",
+      "docs-public-apis:@aws-cdk/aws-logs.JsonPattern.logPatternString",
+      "docs-public-apis:@aws-cdk/aws-logs.ILogStream",
+      "docs-public-apis:@aws-cdk/aws-logs.ILogGroup",
+      "docs-public-apis:@aws-cdk/aws-logs.IFilterPattern.logPatternString",
+      "props-default-doc:@aws-cdk/aws-logs.ColumnRestriction.stringValue",
+      "props-default-doc:@aws-cdk/aws-logs.ColumnRestriction.numberValue",
+      "docs-public-apis:@aws-cdk/aws-logs.CrossAccountDestination.addToPolicy",
+      "docs-public-apis:@aws-cdk/aws-logs.JsonPattern.jsonPatternString",
+      "docs-public-apis:@aws-cdk/aws-logs.ColumnRestriction",
+      "docs-public-apis:@aws-cdk/aws-logs.SpaceDelimitedTextPattern.logPatternString"
     ]
   },
   "stability": "stable"
diff --git a/packages/@aws-cdk/aws-managedblockchain/package.json b/packages/@aws-cdk/aws-managedblockchain/package.json
index 89219b070a245..ccda7d0f8cd6d 100644
--- a/packages/@aws-cdk/aws-managedblockchain/package.json
+++ b/packages/@aws-cdk/aws-managedblockchain/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@aws-cdk/aws-managedblockchain",
-  "version": "1.13.1",
+  "version": "1.15.0",
   "description": "The CDK Construct Library for AWS::ManagedBlockchain",
   "main": "lib/index.js",
   "types": "lib/index.d.ts",
@@ -65,16 +65,16 @@
   },
   "license": "Apache-2.0",
   "devDependencies": {
-    "@aws-cdk/assert": "1.13.1",
-    "cdk-build-tools": "^1.13.1",
-    "cfn2ts": "1.13.1",
-    "pkglint": "^1.13.1"
+    "@aws-cdk/assert": "1.15.0",
+    "cdk-build-tools": "^1.15.0",
+    "cfn2ts": "1.15.0",
+    "pkglint": "^1.15.0"
   },
   "dependencies": {
-    "@aws-cdk/core": "1.13.1"
+    "@aws-cdk/core": "1.15.0"
   },
   "peerDependencies": {
-    "@aws-cdk/core": "1.13.1"
+    "@aws-cdk/core": "1.15.0"
   },
   "engines": {
     "node": ">= 10.3.0"
diff --git a/packages/@aws-cdk/aws-medialive/package.json b/packages/@aws-cdk/aws-medialive/package.json
index 6b68ba14146cd..0be25ad1edb6b 100644
--- a/packages/@aws-cdk/aws-medialive/package.json
+++ b/packages/@aws-cdk/aws-medialive/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@aws-cdk/aws-medialive",
-  "version": "1.13.1",
+  "version": "1.15.0",
   "description": "The CDK Construct Library for AWS::MediaLive",
   "main": "lib/index.js",
   "types": "lib/index.d.ts",
@@ -65,16 +65,16 @@
   },
   "license": "Apache-2.0",
   "devDependencies": {
-    "@aws-cdk/assert": "1.13.1",
-    "cdk-build-tools": "^1.13.1",
-    "cfn2ts": "1.13.1",
-    "pkglint": "^1.13.1"
+    "@aws-cdk/assert": "1.15.0",
+    "cdk-build-tools": "^1.15.0",
+    "cfn2ts": "1.15.0",
+    "pkglint": "^1.15.0"
   },
   "dependencies": {
-    "@aws-cdk/core": "1.13.1"
+    "@aws-cdk/core": "1.15.0"
   },
   "peerDependencies": {
-    "@aws-cdk/core": "1.13.1"
+    "@aws-cdk/core": "1.15.0"
   },
   "engines": {
     "node": ">= 10.3.0"
diff --git a/packages/@aws-cdk/aws-mediastore/package.json b/packages/@aws-cdk/aws-mediastore/package.json
index 9234d53df1340..8c803a20889c0 100644
--- a/packages/@aws-cdk/aws-mediastore/package.json
+++ b/packages/@aws-cdk/aws-mediastore/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@aws-cdk/aws-mediastore",
-  "version": "1.13.1",
+  "version": "1.15.0",
   "description": "The CDK Construct Library for AWS::MediaStore",
   "main": "lib/index.js",
   "types": "lib/index.d.ts",
@@ -65,16 +65,16 @@
   },
   "license": "Apache-2.0",
   "devDependencies": {
-    "@aws-cdk/assert": "1.13.1",
-    "cdk-build-tools": "^1.13.1",
-    "cfn2ts": "^1.13.1",
-    "pkglint": "^1.13.1"
+    "@aws-cdk/assert": "1.15.0",
+    "cdk-build-tools": "^1.15.0",
+    "cfn2ts": "^1.15.0",
+    "pkglint": "^1.15.0"
   },
   "dependencies": {
-    "@aws-cdk/core": "1.13.1"
+    "@aws-cdk/core": "1.15.0"
   },
   "peerDependencies": {
-    "@aws-cdk/core": "1.13.1"
+    "@aws-cdk/core": "1.15.0"
   },
   "engines": {
     "node": ">= 10.3.0"
diff --git a/packages/@aws-cdk/aws-msk/package.json b/packages/@aws-cdk/aws-msk/package.json
index 3ac3b08aa3cbf..4d62481794f7c 100644
--- a/packages/@aws-cdk/aws-msk/package.json
+++ b/packages/@aws-cdk/aws-msk/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@aws-cdk/aws-msk",
-  "version": "1.13.1",
+  "version": "1.15.0",
   "description": "The CDK Construct Library for AWS::MSK",
   "main": "lib/index.js",
   "types": "lib/index.d.ts",
@@ -65,16 +65,16 @@
   },
   "license": "Apache-2.0",
   "devDependencies": {
-    "@aws-cdk/assert": "1.13.1",
-    "cdk-build-tools": "^1.13.1",
-    "cfn2ts": "^1.13.1",
-    "pkglint": "^1.13.1"
+    "@aws-cdk/assert": "1.15.0",
+    "cdk-build-tools": "^1.15.0",
+    "cfn2ts": "^1.15.0",
+    "pkglint": "^1.15.0"
   },
   "dependencies": {
-    "@aws-cdk/core": "1.13.1"
+    "@aws-cdk/core": "1.15.0"
   },
   "peerDependencies": {
-    "@aws-cdk/core": "1.13.1"
+    "@aws-cdk/core": "1.15.0"
   },
   "engines": {
     "node": ">= 10.3.0"
diff --git a/packages/@aws-cdk/aws-neptune/package.json b/packages/@aws-cdk/aws-neptune/package.json
index 96a17f9f74024..cf9cf574dc13c 100644
--- a/packages/@aws-cdk/aws-neptune/package.json
+++ b/packages/@aws-cdk/aws-neptune/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@aws-cdk/aws-neptune",
-  "version": "1.13.1",
+  "version": "1.15.0",
   "description": "The CDK Construct Library for AWS::Neptune",
   "main": "lib/index.js",
   "types": "lib/index.d.ts",
@@ -64,16 +64,16 @@
   },
   "license": "Apache-2.0",
   "devDependencies": {
-    "@aws-cdk/assert": "1.13.1",
-    "cdk-build-tools": "^1.13.1",
-    "cfn2ts": "^1.13.1",
-    "pkglint": "^1.13.1"
+    "@aws-cdk/assert": "1.15.0",
+    "cdk-build-tools": "^1.15.0",
+    "cfn2ts": "^1.15.0",
+    "pkglint": "^1.15.0"
   },
   "dependencies": {
-    "@aws-cdk/core": "1.13.1"
+    "@aws-cdk/core": "1.15.0"
   },
   "peerDependencies": {
-    "@aws-cdk/core": "1.13.1"
+    "@aws-cdk/core": "1.15.0"
   },
   "engines": {
     "node": ">= 10.3.0"
diff --git a/packages/@aws-cdk/aws-opsworks/package.json b/packages/@aws-cdk/aws-opsworks/package.json
index 0607847bdca03..e266761741ce0 100644
--- a/packages/@aws-cdk/aws-opsworks/package.json
+++ b/packages/@aws-cdk/aws-opsworks/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@aws-cdk/aws-opsworks",
-  "version": "1.13.1",
+  "version": "1.15.0",
   "description": "The CDK Construct Library for AWS::OpsWorks",
   "main": "lib/index.js",
   "types": "lib/index.d.ts",
@@ -63,17 +63,17 @@
   },
   "license": "Apache-2.0",
   "devDependencies": {
-    "@aws-cdk/assert": "1.13.1",
-    "cdk-build-tools": "^1.13.1",
-    "cfn2ts": "^1.13.1",
-    "pkglint": "^1.13.1"
+    "@aws-cdk/assert": "1.15.0",
+    "cdk-build-tools": "^1.15.0",
+    "cfn2ts": "^1.15.0",
+    "pkglint": "^1.15.0"
   },
   "dependencies": {
-    "@aws-cdk/core": "1.13.1"
+    "@aws-cdk/core": "1.15.0"
   },
   "homepage": "https://github.com/aws/aws-cdk",
   "peerDependencies": {
-    "@aws-cdk/core": "1.13.1"
+    "@aws-cdk/core": "1.15.0"
   },
   "engines": {
     "node": ">= 10.3.0"
diff --git a/packages/@aws-cdk/aws-opsworkscm/package.json b/packages/@aws-cdk/aws-opsworkscm/package.json
index 0e9026de28880..d6ff21950f55d 100644
--- a/packages/@aws-cdk/aws-opsworkscm/package.json
+++ b/packages/@aws-cdk/aws-opsworkscm/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@aws-cdk/aws-opsworkscm",
-  "version": "1.13.1",
+  "version": "1.15.0",
   "description": "The CDK Construct Library for AWS::OpsWorksCM",
   "main": "lib/index.js",
   "types": "lib/index.d.ts",
@@ -65,16 +65,16 @@
   },
   "license": "Apache-2.0",
   "devDependencies": {
-    "@aws-cdk/assert": "1.13.1",
-    "cdk-build-tools": "^1.13.1",
-    "cfn2ts": "^1.13.1",
-    "pkglint": "^1.13.1"
+    "@aws-cdk/assert": "1.15.0",
+    "cdk-build-tools": "^1.15.0",
+    "cfn2ts": "^1.15.0",
+    "pkglint": "^1.15.0"
   },
   "dependencies": {
-    "@aws-cdk/core": "1.13.1"
+    "@aws-cdk/core": "1.15.0"
   },
   "peerDependencies": {
-    "@aws-cdk/core": "1.13.1"
+    "@aws-cdk/core": "1.15.0"
   },
   "engines": {
     "node": ">= 10.3.0"
diff --git a/packages/@aws-cdk/aws-pinpoint/package.json b/packages/@aws-cdk/aws-pinpoint/package.json
index 6f6ca97c294b1..64e7a91652419 100644
--- a/packages/@aws-cdk/aws-pinpoint/package.json
+++ b/packages/@aws-cdk/aws-pinpoint/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@aws-cdk/aws-pinpoint",
-  "version": "1.13.1",
+  "version": "1.15.0",
   "description": "The CDK Construct Library for AWS::Pinpoint",
   "main": "lib/index.js",
   "types": "lib/index.d.ts",
@@ -65,16 +65,16 @@
   },
   "license": "Apache-2.0",
   "devDependencies": {
-    "@aws-cdk/assert": "1.13.1",
-    "cdk-build-tools": "^1.13.1",
-    "cfn2ts": "^1.13.1",
-    "pkglint": "^1.13.1"
+    "@aws-cdk/assert": "1.15.0",
+    "cdk-build-tools": "^1.15.0",
+    "cfn2ts": "^1.15.0",
+    "pkglint": "^1.15.0"
   },
   "dependencies": {
-    "@aws-cdk/core": "1.13.1"
+    "@aws-cdk/core": "1.15.0"
   },
   "peerDependencies": {
-    "@aws-cdk/core": "1.13.1"
+    "@aws-cdk/core": "1.15.0"
   },
   "engines": {
     "node": ">= 10.3.0"
diff --git a/packages/@aws-cdk/aws-pinpointemail/package.json b/packages/@aws-cdk/aws-pinpointemail/package.json
index 189c248493dd2..5c0631dbc4049 100644
--- a/packages/@aws-cdk/aws-pinpointemail/package.json
+++ b/packages/@aws-cdk/aws-pinpointemail/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@aws-cdk/aws-pinpointemail",
-  "version": "1.13.1",
+  "version": "1.15.0",
   "description": "The CDK Construct Library for AWS::PinpointEmail",
   "main": "lib/index.js",
   "types": "lib/index.d.ts",
@@ -65,16 +65,16 @@
   },
   "license": "Apache-2.0",
   "devDependencies": {
-    "@aws-cdk/assert": "1.13.1",
-    "cdk-build-tools": "^1.13.1",
-    "cfn2ts": "^1.13.1",
-    "pkglint": "^1.13.1"
+    "@aws-cdk/assert": "1.15.0",
+    "cdk-build-tools": "^1.15.0",
+    "cfn2ts": "^1.15.0",
+    "pkglint": "^1.15.0"
   },
   "dependencies": {
-    "@aws-cdk/core": "1.13.1"
+    "@aws-cdk/core": "1.15.0"
   },
   "peerDependencies": {
-    "@aws-cdk/core": "1.13.1"
+    "@aws-cdk/core": "1.15.0"
   },
   "engines": {
     "node": ">= 10.3.0"
diff --git a/packages/@aws-cdk/aws-qldb/package.json b/packages/@aws-cdk/aws-qldb/package.json
index 365a5e54fa499..b7fece5632d98 100644
--- a/packages/@aws-cdk/aws-qldb/package.json
+++ b/packages/@aws-cdk/aws-qldb/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@aws-cdk/aws-qldb",
-  "version": "1.13.1",
+  "version": "1.15.0",
   "description": "The CDK Construct Library for AWS::QLDB",
   "main": "lib/index.js",
   "types": "lib/index.d.ts",
@@ -65,16 +65,16 @@
   },
   "license": "Apache-2.0",
   "devDependencies": {
-    "@aws-cdk/assert": "1.13.1",
-    "cdk-build-tools": "^1.13.1",
-    "cfn2ts": "1.13.1",
-    "pkglint": "^1.13.1"
+    "@aws-cdk/assert": "1.15.0",
+    "cdk-build-tools": "^1.15.0",
+    "cfn2ts": "1.15.0",
+    "pkglint": "^1.15.0"
   },
   "dependencies": {
-    "@aws-cdk/core": "1.13.1"
+    "@aws-cdk/core": "1.15.0"
   },
   "peerDependencies": {
-    "@aws-cdk/core": "1.13.1"
+    "@aws-cdk/core": "1.15.0"
   },
   "engines": {
     "node": ">= 10.3.0"
diff --git a/packages/@aws-cdk/aws-ram/package.json b/packages/@aws-cdk/aws-ram/package.json
index 828c715c54bb3..0d8b9600cf98b 100644
--- a/packages/@aws-cdk/aws-ram/package.json
+++ b/packages/@aws-cdk/aws-ram/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@aws-cdk/aws-ram",
-  "version": "1.13.1",
+  "version": "1.15.0",
   "description": "The CDK Construct Library for AWS::RAM",
   "main": "lib/index.js",
   "types": "lib/index.d.ts",
@@ -65,16 +65,16 @@
   },
   "license": "Apache-2.0",
   "devDependencies": {
-    "@aws-cdk/assert": "1.13.1",
-    "cdk-build-tools": "^1.13.1",
-    "cfn2ts": "^1.13.1",
-    "pkglint": "^1.13.1"
+    "@aws-cdk/assert": "1.15.0",
+    "cdk-build-tools": "^1.15.0",
+    "cfn2ts": "^1.15.0",
+    "pkglint": "^1.15.0"
   },
   "dependencies": {
-    "@aws-cdk/core": "1.13.1"
+    "@aws-cdk/core": "1.15.0"
   },
   "peerDependencies": {
-    "@aws-cdk/core": "1.13.1"
+    "@aws-cdk/core": "1.15.0"
   },
   "engines": {
     "node": ">= 10.3.0"
diff --git a/packages/@aws-cdk/aws-rds/lib/instance.ts b/packages/@aws-cdk/aws-rds/lib/instance.ts
index 8bf7d60882c11..04f5e96acd487 100644
--- a/packages/@aws-cdk/aws-rds/lib/instance.ts
+++ b/packages/@aws-cdk/aws-rds/lib/instance.ts
@@ -5,7 +5,7 @@ import kms = require('@aws-cdk/aws-kms');
 import lambda = require('@aws-cdk/aws-lambda');
 import logs = require('@aws-cdk/aws-logs');
 import secretsmanager = require('@aws-cdk/aws-secretsmanager');
-import { Construct, Duration, IResource, RemovalPolicy, Resource, SecretValue, Stack, Token } from '@aws-cdk/core';
+import { Construct, Duration, IResource, Lazy, RemovalPolicy, Resource, SecretValue, Stack, Token } from '@aws-cdk/core';
 import { DatabaseSecret } from './database-secret';
 import { Endpoint } from './endpoint';
 import { IOptionGroup } from './option-group';
@@ -44,11 +44,6 @@ export interface IDatabaseInstance extends IResource, ec2.IConnectable, secretsm
    */
   readonly instanceEndpoint: Endpoint;
 
-  /**
-   * The security group identifier of the instance.
-   */
-  readonly securityGroupId: string;
-
   /**
    * Defines a CloudWatch event rule which triggers for instance events. Use
    * `rule.addEventPattern(pattern)` to specify a filter.
@@ -76,9 +71,9 @@ export interface DatabaseInstanceAttributes {
   readonly port: number;
 
   /**
-   * The security group of the instance.
+   * The security groups of the instance.
    */
-  readonly securityGroup: ec2.ISecurityGroup;
+  readonly securityGroups: ec2.ISecurityGroup[];
 }
 
 /**
@@ -92,14 +87,13 @@ export abstract class DatabaseInstanceBase extends Resource implements IDatabase
     class Import extends DatabaseInstanceBase implements IDatabaseInstance {
       public readonly defaultPort = ec2.Port.tcp(attrs.port);
       public readonly connections = new ec2.Connections({
-        securityGroups: [attrs.securityGroup],
+        securityGroups: attrs.securityGroups,
         defaultPort: this.defaultPort
       });
       public readonly instanceIdentifier = attrs.instanceIdentifier;
       public readonly dbInstanceEndpointAddress = attrs.instanceEndpointAddress;
       public readonly dbInstanceEndpointPort = attrs.port.toString();
       public readonly instanceEndpoint = new Endpoint(attrs.instanceEndpointAddress, attrs.port);
-      public readonly securityGroupId = attrs.securityGroup.securityGroupId;
     }
 
     return new Import(scope, id);
@@ -110,7 +104,6 @@ export abstract class DatabaseInstanceBase extends Resource implements IDatabase
   public abstract readonly dbInstanceEndpointPort: string;
   public abstract readonly instanceEndpoint: Endpoint;
   public abstract readonly connections: ec2.Connections;
-  public abstract readonly securityGroupId: string;
 
   /**
    * Defines a CloudWatch event rule which triggers for instance events. Use
@@ -305,6 +298,13 @@ export interface DatabaseInstanceNewProps {
    */
   readonly vpcPlacement?: ec2.SubnetSelection;
 
+  /**
+   * The security groups to assign to the DB instance.
+   *
+   * @default - a new security group is created
+   */
+  readonly securityGroups?: ec2.ISecurityGroup[];
+
   /**
    * The port for the instance.
    *
@@ -469,12 +469,11 @@ export interface DatabaseInstanceNewProps {
  * A new database instance.
  */
 abstract class DatabaseInstanceNew extends DatabaseInstanceBase implements IDatabaseInstance {
-  public readonly securityGroupId: string;
   public readonly vpc: ec2.IVpc;
+  public readonly connections: ec2.Connections;
 
   protected readonly vpcPlacement?: ec2.SubnetSelection;
   protected readonly newCfnProps: CfnDBInstanceProps;
-  protected readonly securityGroup: ec2.SecurityGroup;
 
   private readonly cloudwatchLogsExports?: string[];
   private readonly cloudwatchLogsRetention?: logs.RetentionDays;
@@ -493,11 +492,15 @@ abstract class DatabaseInstanceNew extends DatabaseInstanceBase implements IData
       subnetIds
     });
 
-    this.securityGroup = new ec2.SecurityGroup(this, 'SecurityGroup', {
+    const securityGroups = props.securityGroups || [new ec2.SecurityGroup(this, 'SecurityGroup', {
       description: `Security group for ${this.node.id} database`,
       vpc: props.vpc
+    })];
+
+    this.connections = new ec2.Connections({
+      securityGroups,
+      defaultPort: ec2.Port.tcp(Lazy.numberValue({ produce: () => this.instanceEndpoint.port }))
     });
-    this.securityGroupId = this.securityGroup.securityGroupId;
 
     let monitoringRole;
     if (props.monitoringInterval && props.monitoringInterval.toSeconds()) {
@@ -545,7 +548,7 @@ abstract class DatabaseInstanceNew extends DatabaseInstanceBase implements IData
       processorFeatures: props.processorFeatures && renderProcessorFeatures(props.processorFeatures),
       publiclyAccessible: props.vpcPlacement && props.vpcPlacement.subnetType === ec2.SubnetType.PUBLIC,
       storageType,
-      vpcSecurityGroups: [this.securityGroupId]
+      vpcSecurityGroups: securityGroups.map(s => s.securityGroupId)
     };
   }
 
@@ -724,7 +727,6 @@ export class DatabaseInstance extends DatabaseInstanceSource implements IDatabas
   public readonly dbInstanceEndpointAddress: string;
   public readonly dbInstanceEndpointPort: string;
   public readonly instanceEndpoint: Endpoint;
-  public readonly connections: ec2.Connections;
   public readonly secret?: secretsmanager.ISecret;
 
   constructor(scope: Construct, id: string, props: DatabaseInstanceProps) {
@@ -769,11 +771,6 @@ export class DatabaseInstance extends DatabaseInstanceSource implements IDatabas
       });
     }
 
-    this.connections = new ec2.Connections({
-      securityGroups: [this.securityGroup],
-      defaultPort: ec2.Port.tcp(this.instanceEndpoint.port)
-    });
-
     this.setLogRetention();
   }
 }
@@ -816,7 +813,6 @@ export class DatabaseInstanceFromSnapshot extends DatabaseInstanceSource impleme
   public readonly dbInstanceEndpointAddress: string;
   public readonly dbInstanceEndpointPort: string;
   public readonly instanceEndpoint: Endpoint;
-  public readonly connections: ec2.Connections;
   public readonly secret?: secretsmanager.ISecret;
 
   constructor(scope: Construct, id: string, props: DatabaseInstanceFromSnapshotProps) {
@@ -863,11 +859,6 @@ export class DatabaseInstanceFromSnapshot extends DatabaseInstanceSource impleme
       });
     }
 
-    this.connections = new ec2.Connections({
-      securityGroups: [this.securityGroup],
-      defaultPort: ec2.Port.tcp(this.instanceEndpoint.port)
-    });
-
     this.setLogRetention();
   }
 }
@@ -910,7 +901,6 @@ export class DatabaseInstanceReadReplica extends DatabaseInstanceNew implements
   public readonly dbInstanceEndpointAddress: string;
   public readonly dbInstanceEndpointPort: string;
   public readonly instanceEndpoint: Endpoint;
-  public readonly connections: ec2.Connections;
 
   constructor(scope: Construct, id: string, props: DatabaseInstanceReadReplicaProps) {
     super(scope, id, props);
@@ -934,11 +924,6 @@ export class DatabaseInstanceReadReplica extends DatabaseInstanceNew implements
       applyToUpdateReplacePolicy: true
     });
 
-    this.connections = new ec2.Connections({
-      securityGroups: [this.securityGroup],
-      defaultPort: ec2.Port.tcp(this.instanceEndpoint.port)
-    });
-
     this.setLogRetention();
   }
 }
diff --git a/packages/@aws-cdk/aws-rds/package.json b/packages/@aws-cdk/aws-rds/package.json
index 5f5ac0e15c6ff..ca1d17f5bf969 100644
--- a/packages/@aws-cdk/aws-rds/package.json
+++ b/packages/@aws-cdk/aws-rds/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@aws-cdk/aws-rds",
-  "version": "1.13.1",
+  "version": "1.15.0",
   "description": "CDK Constructs for AWS RDS",
   "main": "lib/index.js",
   "types": "lib/index.d.ts",
@@ -63,37 +63,37 @@
   },
   "license": "Apache-2.0",
   "devDependencies": {
-    "@aws-cdk/assert": "1.13.1",
-    "@aws-cdk/aws-events-targets": "1.13.1",
-    "cdk-build-tools": "^1.13.1",
-    "cdk-integ-tools": "^1.13.1",
-    "cfn2ts": "^1.13.1",
-    "pkglint": "^1.13.1"
+    "@aws-cdk/assert": "1.15.0",
+    "@aws-cdk/aws-events-targets": "1.15.0",
+    "cdk-build-tools": "^1.15.0",
+    "cdk-integ-tools": "^1.15.0",
+    "cfn2ts": "^1.15.0",
+    "pkglint": "^1.15.0"
   },
   "dependencies": {
-    "@aws-cdk/aws-cloudwatch": "1.13.1",
-    "@aws-cdk/aws-ec2": "1.13.1",
-    "@aws-cdk/aws-events": "1.13.1",
-    "@aws-cdk/aws-iam": "1.13.1",
-    "@aws-cdk/aws-kms": "1.13.1",
-    "@aws-cdk/aws-lambda": "1.13.1",
-    "@aws-cdk/aws-logs": "1.13.1",
-    "@aws-cdk/aws-sam": "1.13.1",
-    "@aws-cdk/aws-secretsmanager": "1.13.1",
-    "@aws-cdk/core": "1.13.1"
+    "@aws-cdk/aws-cloudwatch": "1.15.0",
+    "@aws-cdk/aws-ec2": "1.15.0",
+    "@aws-cdk/aws-events": "1.15.0",
+    "@aws-cdk/aws-iam": "1.15.0",
+    "@aws-cdk/aws-kms": "1.15.0",
+    "@aws-cdk/aws-lambda": "1.15.0",
+    "@aws-cdk/aws-logs": "1.15.0",
+    "@aws-cdk/aws-sam": "1.15.0",
+    "@aws-cdk/aws-secretsmanager": "1.15.0",
+    "@aws-cdk/core": "1.15.0"
   },
   "homepage": "https://github.com/aws/aws-cdk",
   "peerDependencies": {
-    "@aws-cdk/aws-cloudwatch": "1.13.1",
-    "@aws-cdk/aws-ec2": "1.13.1",
-    "@aws-cdk/aws-events": "1.13.1",
-    "@aws-cdk/aws-iam": "1.13.1",
-    "@aws-cdk/aws-kms": "1.13.1",
-    "@aws-cdk/aws-lambda": "1.13.1",
-    "@aws-cdk/aws-logs": "1.13.1",
-    "@aws-cdk/aws-sam": "1.13.1",
-    "@aws-cdk/aws-secretsmanager": "1.13.1",
-    "@aws-cdk/core": "1.13.1"
+    "@aws-cdk/aws-cloudwatch": "1.15.0",
+    "@aws-cdk/aws-ec2": "1.15.0",
+    "@aws-cdk/aws-events": "1.15.0",
+    "@aws-cdk/aws-iam": "1.15.0",
+    "@aws-cdk/aws-kms": "1.15.0",
+    "@aws-cdk/aws-lambda": "1.15.0",
+    "@aws-cdk/aws-logs": "1.15.0",
+    "@aws-cdk/aws-sam": "1.15.0",
+    "@aws-cdk/aws-secretsmanager": "1.15.0",
+    "@aws-cdk/core": "1.15.0"
   },
   "engines": {
     "node": ">= 10.3.0"
@@ -107,7 +107,48 @@
       "props-physical-name:@aws-cdk/aws-rds.DatabaseInstanceFromSnapshotProps",
       "props-physical-name:@aws-cdk/aws-rds.DatabaseInstanceReadReplicaProps",
       "props-physical-name:@aws-cdk/aws-rds.DatabaseSecretProps",
-      "props-physical-name:@aws-cdk/aws-rds.OptionGroupProps"
+      "props-physical-name:@aws-cdk/aws-rds.OptionGroupProps",
+      "docs-public-apis:@aws-cdk/aws-rds.DatabaseInstanceEngine.ORACLE_SE2",
+      "props-default-doc:@aws-cdk/aws-rds.ProcessorFeatures.threadsPerCore",
+      "props-default-doc:@aws-cdk/aws-rds.ProcessorFeatures.coreCount",
+      "props-default-doc:@aws-cdk/aws-rds.OptionConfiguration.vpc",
+      "docs-public-apis:@aws-cdk/aws-rds.IDatabaseInstance",
+      "props-default-doc:@aws-cdk/aws-rds.BackupProps.preferredWindow",
+      "docs-public-apis:@aws-cdk/aws-rds.SecretRotationApplication.semanticVersion",
+      "docs-public-apis:@aws-cdk/aws-rds.SecretRotationApplication.applicationId",
+      "docs-public-apis:@aws-cdk/aws-rds.SecretRotationApplication.SQLSERVER_ROTATION_SINGLE_USER",
+      "docs-public-apis:@aws-cdk/aws-rds.SecretRotationApplication.SQLSERVER_ROTATION_MULTI_USER",
+      "docs-public-apis:@aws-cdk/aws-rds.SecretRotationApplication.POSTGRES_ROTATION_SINGLE_USER",
+      "docs-public-apis:@aws-cdk/aws-rds.SecretRotationApplication.POSTGRES_ROTATION_MULTI_USER",
+      "docs-public-apis:@aws-cdk/aws-rds.SecretRotationApplication.ORACLE_ROTATION_SINGLE_USER",
+      "docs-public-apis:@aws-cdk/aws-rds.SecretRotationApplication.ORACLE_ROTATION_MULTI_USER",
+      "docs-public-apis:@aws-cdk/aws-rds.SecretRotationApplication.MYSQL_ROTATION_SINGLE_USER",
+      "docs-public-apis:@aws-cdk/aws-rds.SecretRotationApplication.MYSQL_ROTATION_MULTI_USER",
+      "docs-public-apis:@aws-cdk/aws-rds.SecretRotationApplication.MARIADB_ROTATION_SINGLE_USER",
+      "docs-public-apis:@aws-cdk/aws-rds.DatabaseClusterEngine.AURORA",
+      "docs-public-apis:@aws-cdk/aws-rds.DatabaseClusterEngine.AURORA_MYSQL",
+      "docs-public-apis:@aws-cdk/aws-rds.DatabaseClusterEngine.AURORA_POSTGRESQL",
+      "docs-public-apis:@aws-cdk/aws-rds.DatabaseInstance.connections",
+      "docs-public-apis:@aws-cdk/aws-rds.DatabaseInstance.vpc",
+      "docs-public-apis:@aws-cdk/aws-rds.DatabaseInstance.secret",
+      "docs-public-apis:@aws-cdk/aws-rds.DatabaseInstanceBase.connections",
+      "docs-public-apis:@aws-cdk/aws-rds.DatabaseInstanceEngine.MARIADB",
+      "docs-public-apis:@aws-cdk/aws-rds.DatabaseInstanceEngine.MYSQL",
+      "docs-public-apis:@aws-cdk/aws-rds.DatabaseInstanceEngine.ORACLE_EE",
+      "docs-public-apis:@aws-cdk/aws-rds.DatabaseInstanceEngine.ORACLE_SE",
+      "docs-public-apis:@aws-cdk/aws-rds.DatabaseInstanceEngine.ORACLE_SE1",
+      "docs-public-apis:@aws-cdk/aws-rds.SecretRotationApplication.MARIADB_ROTATION_MULTI_USER",
+      "docs-public-apis:@aws-cdk/aws-rds.DatabaseInstanceEngine.POSTGRES",
+      "docs-public-apis:@aws-cdk/aws-rds.DatabaseInstanceEngine.SQL_SERVER_EE",
+      "docs-public-apis:@aws-cdk/aws-rds.DatabaseInstanceEngine.SQL_SERVER_EX",
+      "docs-public-apis:@aws-cdk/aws-rds.DatabaseInstanceEngine.SQL_SERVER_SE",
+      "docs-public-apis:@aws-cdk/aws-rds.DatabaseInstanceEngine.SQL_SERVER_WEB",
+      "docs-public-apis:@aws-cdk/aws-rds.DatabaseInstanceFromSnapshot.connections",
+      "docs-public-apis:@aws-cdk/aws-rds.DatabaseInstanceFromSnapshot.vpc",
+      "docs-public-apis:@aws-cdk/aws-rds.DatabaseInstanceFromSnapshot.secret",
+      "docs-public-apis:@aws-cdk/aws-rds.DatabaseInstanceReadReplica.connections",
+      "docs-public-apis:@aws-cdk/aws-rds.DatabaseInstanceReadReplica.vpc",
+      "docs-public-apis:@aws-cdk/aws-rds.OptionGroup"
     ]
   },
   "stability": "experimental"
diff --git a/packages/@aws-cdk/aws-rds/test/test.instance.ts b/packages/@aws-cdk/aws-rds/test/test.instance.ts
index 2897da3e64d5d..ac53d9de008b3 100644
--- a/packages/@aws-cdk/aws-rds/test/test.instance.ts
+++ b/packages/@aws-cdk/aws-rds/test/test.instance.ts
@@ -499,9 +499,9 @@ export = {
       instanceEndpointAddress: 'address',
       instanceIdentifier: 'identifier',
       port: 3306,
-      securityGroup: ec2.SecurityGroup.fromSecurityGroupId(stack, 'SG', 'sg-123456789', {
+      securityGroups: [ec2.SecurityGroup.fromSecurityGroupId(stack, 'SG', 'sg-123456789', {
         allowAllOutbound: false
-      }),
+      })],
     });
 
     // WHEN
@@ -547,4 +547,46 @@ export = {
 
     test.done();
   },
+
+  'create an instance with an existing security group'(test: Test) {
+    // GIVEN
+    const stack = new cdk.Stack();
+    const vpc = new ec2.Vpc(stack, 'VPC');
+    const securityGroup = ec2.SecurityGroup.fromSecurityGroupId(stack, 'SG', 'sg-123456789', {
+      allowAllOutbound: false
+    });
+
+    // WHEN
+    const instance = new rds.DatabaseInstance(stack, 'Instance', {
+      engine: rds.DatabaseInstanceEngine.MYSQL,
+      instanceClass: ec2.InstanceType.of(ec2.InstanceClass.BURSTABLE2, ec2.InstanceSize.SMALL),
+      masterUsername: 'admin',
+      vpc,
+      securityGroups: [securityGroup],
+    });
+    instance.connections.allowDefaultPortFromAnyIpv4();
+
+    // THEN
+    expect(stack).to(haveResource('AWS::RDS::DBInstance', {
+      VPCSecurityGroups: ['sg-123456789']
+    }));
+
+    expect(stack).to(haveResource('AWS::EC2::SecurityGroupIngress', {
+      FromPort: {
+        'Fn::GetAtt': [
+          'InstanceC1063A87',
+          'Endpoint.Port'
+        ]
+      },
+      GroupId: 'sg-123456789',
+      ToPort: {
+        'Fn::GetAtt': [
+          'InstanceC1063A87',
+          'Endpoint.Port'
+        ]
+      }
+    }));
+
+    test.done();
+  }
 };
diff --git a/packages/@aws-cdk/aws-redshift/package.json b/packages/@aws-cdk/aws-redshift/package.json
index 6a8778feaf784..315e974cd21bd 100644
--- a/packages/@aws-cdk/aws-redshift/package.json
+++ b/packages/@aws-cdk/aws-redshift/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@aws-cdk/aws-redshift",
-  "version": "1.13.1",
+  "version": "1.15.0",
   "description": "The CDK Construct Library for AWS::Redshift",
   "main": "lib/index.js",
   "types": "lib/index.d.ts",
@@ -63,17 +63,17 @@
   },
   "license": "Apache-2.0",
   "devDependencies": {
-    "@aws-cdk/assert": "1.13.1",
-    "cdk-build-tools": "^1.13.1",
-    "cfn2ts": "^1.13.1",
-    "pkglint": "^1.13.1"
+    "@aws-cdk/assert": "1.15.0",
+    "cdk-build-tools": "^1.15.0",
+    "cfn2ts": "^1.15.0",
+    "pkglint": "^1.15.0"
   },
   "dependencies": {
-    "@aws-cdk/core": "1.13.1"
+    "@aws-cdk/core": "1.15.0"
   },
   "homepage": "https://github.com/aws/aws-cdk",
   "peerDependencies": {
-    "@aws-cdk/core": "1.13.1"
+    "@aws-cdk/core": "1.15.0"
   },
   "engines": {
     "node": ">= 10.3.0"
diff --git a/packages/@aws-cdk/aws-robomaker/package.json b/packages/@aws-cdk/aws-robomaker/package.json
index 00e49e4adc39a..4183b0f2413f1 100644
--- a/packages/@aws-cdk/aws-robomaker/package.json
+++ b/packages/@aws-cdk/aws-robomaker/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@aws-cdk/aws-robomaker",
-  "version": "1.13.1",
+  "version": "1.15.0",
   "description": "The CDK Construct Library for AWS::RoboMaker",
   "main": "lib/index.js",
   "types": "lib/index.d.ts",
@@ -65,16 +65,16 @@
   },
   "license": "Apache-2.0",
   "devDependencies": {
-    "@aws-cdk/assert": "1.13.1",
-    "cdk-build-tools": "^1.13.1",
-    "cfn2ts": "^1.13.1",
-    "pkglint": "^1.13.1"
+    "@aws-cdk/assert": "1.15.0",
+    "cdk-build-tools": "^1.15.0",
+    "cfn2ts": "^1.15.0",
+    "pkglint": "^1.15.0"
   },
   "dependencies": {
-    "@aws-cdk/core": "1.13.1"
+    "@aws-cdk/core": "1.15.0"
   },
   "peerDependencies": {
-    "@aws-cdk/core": "1.13.1"
+    "@aws-cdk/core": "1.15.0"
   },
   "engines": {
     "node": ">= 10.3.0"
diff --git a/packages/@aws-cdk/aws-route53-patterns/package.json b/packages/@aws-cdk/aws-route53-patterns/package.json
index 76a2ad0a1c742..3bec6754e3871 100644
--- a/packages/@aws-cdk/aws-route53-patterns/package.json
+++ b/packages/@aws-cdk/aws-route53-patterns/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@aws-cdk/aws-route53-patterns",
-  "version": "1.13.1",
+  "version": "1.15.0",
   "description": "CDK Constructs for AWS Route53 patterns",
   "main": "lib/index.js",
   "types": "lib/index.d.ts",
@@ -71,36 +71,42 @@
   },
   "license": "Apache-2.0",
   "devDependencies": {
-    "@aws-cdk/assert": "1.13.1",
-    "cdk-build-tools": "^1.13.1",
-    "cdk-integ-tools": "^1.13.1",
-    "cfn2ts": "^1.13.1",
+    "@aws-cdk/assert": "1.15.0",
+    "cdk-build-tools": "^1.15.0",
+    "cdk-integ-tools": "^1.15.0",
+    "cfn2ts": "^1.15.0",
     "jest": "^24.9.0",
-    "pkglint": "^1.13.1"
+    "pkglint": "^1.15.0"
   },
   "dependencies": {
-    "@aws-cdk/aws-certificatemanager": "1.13.1",
-    "@aws-cdk/aws-cloudfront": "1.13.1",
-    "@aws-cdk/aws-iam": "1.13.1",
-    "@aws-cdk/aws-route53": "1.13.1",
-    "@aws-cdk/aws-route53-targets": "1.13.1",
-    "@aws-cdk/aws-s3": "1.13.1",
-    "@aws-cdk/core": "1.13.1",
-    "@aws-cdk/region-info": "1.13.1"
+    "@aws-cdk/aws-certificatemanager": "1.15.0",
+    "@aws-cdk/aws-cloudfront": "1.15.0",
+    "@aws-cdk/aws-iam": "1.15.0",
+    "@aws-cdk/aws-route53": "1.15.0",
+    "@aws-cdk/aws-route53-targets": "1.15.0",
+    "@aws-cdk/aws-s3": "1.15.0",
+    "@aws-cdk/core": "1.15.0",
+    "@aws-cdk/region-info": "1.15.0"
   },
   "homepage": "https://github.com/aws/aws-cdk",
   "peerDependencies": {
-    "@aws-cdk/aws-certificatemanager": "1.13.1",
-    "@aws-cdk/aws-cloudfront": "1.13.1",
-    "@aws-cdk/aws-iam": "1.13.1",
-    "@aws-cdk/aws-route53": "1.13.1",
-    "@aws-cdk/aws-route53-targets": "1.13.1",
-    "@aws-cdk/aws-s3": "1.13.1",
-    "@aws-cdk/core": "1.13.1",
-    "@aws-cdk/region-info": "1.13.1"
+    "@aws-cdk/aws-certificatemanager": "1.15.0",
+    "@aws-cdk/aws-cloudfront": "1.15.0",
+    "@aws-cdk/aws-iam": "1.15.0",
+    "@aws-cdk/aws-route53": "1.15.0",
+    "@aws-cdk/aws-route53-targets": "1.15.0",
+    "@aws-cdk/aws-s3": "1.15.0",
+    "@aws-cdk/core": "1.15.0",
+    "@aws-cdk/region-info": "1.15.0"
   },
   "engines": {
     "node": ">= 10.3.0"
   },
-  "stability": "experimental"
+  "stability": "experimental",
+  "awslint": {
+    "exclude": [
+      "docs-public-apis:@aws-cdk/aws-route53-patterns.HttpsRedirect",
+      "docs-public-apis:@aws-cdk/aws-route53-patterns.HttpsRedirectProps"
+    ]
+  }
 }
diff --git a/packages/@aws-cdk/aws-route53-patterns/test/bucket-website-target.test.ts b/packages/@aws-cdk/aws-route53-patterns/test/bucket-website-target.test.ts
index 9ca9f587ff106..e857380309b16 100644
--- a/packages/@aws-cdk/aws-route53-patterns/test/bucket-website-target.test.ts
+++ b/packages/@aws-cdk/aws-route53-patterns/test/bucket-website-target.test.ts
@@ -79,7 +79,9 @@ test('create HTTPS redirect with existing cert', () => {
   // WHEN
   new HttpsRedirect(stack, 'Redirect', {
     recordNames: ['foo.example.com'],
-    certificate: Certificate.fromCertificateArn(stack, 'Certificate', 'someArn'),
+    certificate: Certificate.fromCertificateArn(
+      stack, 'Certificate', 'arn:aws:acm:us-east-1:1111111:certificate/11-3336f1-44483d-adc7-9cd375c5169d'
+    ),
     targetDomain: 'bar.example.com',
     zone: HostedZone.fromHostedZoneAttributes(stack, 'HostedZone', {
       hostedZoneId: 'ID',
@@ -99,7 +101,7 @@ test('create HTTPS redirect with existing cert', () => {
   expect(stack).toHaveResourceLike('AWS::CloudFront::Distribution', {
     DistributionConfig: {
       ViewerCertificate: {
-        AcmCertificateArn: "someArn"
+        AcmCertificateArn: "arn:aws:acm:us-east-1:1111111:certificate/11-3336f1-44483d-adc7-9cd375c5169d"
       }
     }
   });
diff --git a/packages/@aws-cdk/aws-route53-targets/package.json b/packages/@aws-cdk/aws-route53-targets/package.json
index 154e056630b56..919783c72ff29 100644
--- a/packages/@aws-cdk/aws-route53-targets/package.json
+++ b/packages/@aws-cdk/aws-route53-targets/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@aws-cdk/aws-route53-targets",
-  "version": "1.13.1",
+  "version": "1.15.0",
   "description": "CDK Constructs for AWS Route53 Alias Targets",
   "main": "lib/index.js",
   "types": "lib/index.d.ts",
@@ -71,38 +71,38 @@
   },
   "license": "Apache-2.0",
   "devDependencies": {
-    "@aws-cdk/assert": "1.13.1",
-    "@aws-cdk/aws-certificatemanager": "1.13.1",
-    "@aws-cdk/aws-ec2": "1.13.1",
-    "@aws-cdk/aws-lambda": "1.13.1",
-    "cdk-build-tools": "^1.13.1",
-    "cdk-integ-tools": "^1.13.1",
-    "cfn2ts": "^1.13.1",
+    "@aws-cdk/assert": "1.15.0",
+    "@aws-cdk/aws-certificatemanager": "1.15.0",
+    "@aws-cdk/aws-ec2": "1.15.0",
+    "@aws-cdk/aws-lambda": "1.15.0",
+    "cdk-build-tools": "^1.15.0",
+    "cdk-integ-tools": "^1.15.0",
+    "cfn2ts": "^1.15.0",
     "jest": "^24.9.0",
-    "pkglint": "^1.13.1"
+    "pkglint": "^1.15.0"
   },
   "dependencies": {
-    "@aws-cdk/aws-apigateway": "1.13.1",
-    "@aws-cdk/aws-cloudfront": "1.13.1",
-    "@aws-cdk/aws-elasticloadbalancing": "1.13.1",
-    "@aws-cdk/aws-elasticloadbalancingv2": "1.13.1",
-    "@aws-cdk/aws-iam": "1.13.1",
-    "@aws-cdk/aws-route53": "1.13.1",
-    "@aws-cdk/aws-s3": "1.13.1",
-    "@aws-cdk/core": "1.13.1",
-    "@aws-cdk/region-info": "1.13.1"
+    "@aws-cdk/aws-apigateway": "1.15.0",
+    "@aws-cdk/aws-cloudfront": "1.15.0",
+    "@aws-cdk/aws-elasticloadbalancing": "1.15.0",
+    "@aws-cdk/aws-elasticloadbalancingv2": "1.15.0",
+    "@aws-cdk/aws-iam": "1.15.0",
+    "@aws-cdk/aws-route53": "1.15.0",
+    "@aws-cdk/aws-s3": "1.15.0",
+    "@aws-cdk/core": "1.15.0",
+    "@aws-cdk/region-info": "1.15.0"
   },
   "homepage": "https://github.com/aws/aws-cdk",
   "peerDependencies": {
-    "@aws-cdk/aws-apigateway": "1.13.1",
-    "@aws-cdk/aws-cloudfront": "1.13.1",
-    "@aws-cdk/aws-elasticloadbalancing": "1.13.1",
-    "@aws-cdk/aws-elasticloadbalancingv2": "1.13.1",
-    "@aws-cdk/aws-iam": "1.13.1",
-    "@aws-cdk/aws-route53": "1.13.1",
-    "@aws-cdk/aws-s3": "1.13.1",
-    "@aws-cdk/core": "1.13.1",
-    "@aws-cdk/region-info": "1.13.1"
+    "@aws-cdk/aws-apigateway": "1.15.0",
+    "@aws-cdk/aws-cloudfront": "1.15.0",
+    "@aws-cdk/aws-elasticloadbalancing": "1.15.0",
+    "@aws-cdk/aws-elasticloadbalancingv2": "1.15.0",
+    "@aws-cdk/aws-iam": "1.15.0",
+    "@aws-cdk/aws-route53": "1.15.0",
+    "@aws-cdk/aws-s3": "1.15.0",
+    "@aws-cdk/core": "1.15.0",
+    "@aws-cdk/region-info": "1.15.0"
   },
   "engines": {
     "node": ">= 10.3.0"
diff --git a/packages/@aws-cdk/aws-route53/lib/hosted-zone.ts b/packages/@aws-cdk/aws-route53/lib/hosted-zone.ts
index c6edbf56a6533..324b863eaee1e 100644
--- a/packages/@aws-cdk/aws-route53/lib/hosted-zone.ts
+++ b/packages/@aws-cdk/aws-route53/lib/hosted-zone.ts
@@ -94,7 +94,7 @@ export class HostedZone extends Resource implements IHostedZone {
       response.Name = response.Name.substring(0, response.Name.length - 1);
     }
 
-    return this.fromHostedZoneAttributes(scope, id, {
+    return HostedZone.fromHostedZoneAttributes(scope, id, {
       hostedZoneId: response.Id,
       zoneName: response.Name,
     });
diff --git a/packages/@aws-cdk/aws-route53/package.json b/packages/@aws-cdk/aws-route53/package.json
index 3ed9a10ef22e7..869a1304e8add 100644
--- a/packages/@aws-cdk/aws-route53/package.json
+++ b/packages/@aws-cdk/aws-route53/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@aws-cdk/aws-route53",
-  "version": "1.13.1",
+  "version": "1.15.0",
   "description": "CDK Constructs for AWS Route53",
   "main": "lib/index.js",
   "types": "lib/index.d.ts",
@@ -63,25 +63,25 @@
   },
   "license": "Apache-2.0",
   "devDependencies": {
-    "@aws-cdk/assert": "1.13.1",
-    "aws-sdk": "^2.553.0",
-    "cdk-build-tools": "^1.13.1",
-    "cdk-integ-tools": "^1.13.1",
-    "cfn2ts": "^1.13.1",
-    "pkglint": "^1.13.1"
+    "@aws-cdk/assert": "1.15.0",
+    "aws-sdk": "^2.558.0",
+    "cdk-build-tools": "^1.15.0",
+    "cdk-integ-tools": "^1.15.0",
+    "cfn2ts": "^1.15.0",
+    "pkglint": "^1.15.0"
   },
   "dependencies": {
-    "@aws-cdk/aws-ec2": "1.13.1",
-    "@aws-cdk/aws-logs": "1.13.1",
-    "@aws-cdk/core": "1.13.1",
-    "@aws-cdk/cx-api": "1.13.1"
+    "@aws-cdk/aws-ec2": "1.15.0",
+    "@aws-cdk/aws-logs": "1.15.0",
+    "@aws-cdk/core": "1.15.0",
+    "@aws-cdk/cx-api": "1.15.0"
   },
   "homepage": "https://github.com/aws/aws-cdk",
   "peerDependencies": {
-    "@aws-cdk/aws-ec2": "1.13.1",
-    "@aws-cdk/aws-logs": "1.13.1",
-    "@aws-cdk/core": "1.13.1",
-    "@aws-cdk/cx-api": "1.13.1"
+    "@aws-cdk/aws-ec2": "1.15.0",
+    "@aws-cdk/aws-logs": "1.15.0",
+    "@aws-cdk/core": "1.15.0",
+    "@aws-cdk/cx-api": "1.15.0"
   },
   "engines": {
     "node": ">= 10.3.0"
@@ -102,7 +102,32 @@
       "props-physical-name:@aws-cdk/aws-route53.RecordSetProps",
       "props-physical-name:@aws-cdk/aws-route53.SrvRecordProps",
       "props-physical-name:@aws-cdk/aws-route53.TxtRecordProps",
-      "props-physical-name:@aws-cdk/aws-route53.AaaaRecordProps"
+      "props-physical-name:@aws-cdk/aws-route53.AaaaRecordProps",
+      "docs-public-apis:@aws-cdk/aws-route53.AddressRecordTarget",
+      "docs-public-apis:@aws-cdk/aws-route53.RecordType.TXT",
+      "docs-public-apis:@aws-cdk/aws-route53.RecordType.SRV",
+      "docs-public-apis:@aws-cdk/aws-route53.RecordType.SPF",
+      "docs-public-apis:@aws-cdk/aws-route53.RecordType.SOA",
+      "docs-public-apis:@aws-cdk/aws-route53.RecordType.PTR",
+      "docs-public-apis:@aws-cdk/aws-route53.RecordType.NS",
+      "docs-public-apis:@aws-cdk/aws-route53.RecordType.NAPTR",
+      "docs-public-apis:@aws-cdk/aws-route53.RecordType.MX",
+      "docs-public-apis:@aws-cdk/aws-route53.RecordType.CNAME",
+      "docs-public-apis:@aws-cdk/aws-route53.RecordType.CAA",
+      "docs-public-apis:@aws-cdk/aws-route53.RecordType.AAAA",
+      "docs-public-apis:@aws-cdk/aws-route53.RecordType.A",
+      "docs-public-apis:@aws-cdk/aws-route53.PrivateHostedZoneProps",
+      "docs-public-apis:@aws-cdk/aws-route53.IPublicHostedZone",
+      "docs-public-apis:@aws-cdk/aws-route53.IPrivateHostedZone",
+      "props-default-doc:@aws-cdk/aws-route53.HostedZoneProviderProps.vpcId",
+      "props-default-doc:@aws-cdk/aws-route53.HostedZoneProviderProps.privateZone",
+      "docs-public-apis:@aws-cdk/aws-route53.CommonHostedZoneProps",
+      "docs-public-apis:@aws-cdk/aws-route53.RecordTarget.values",
+      "docs-public-apis:@aws-cdk/aws-route53.RecordTarget.aliasTarget",
+      "docs-public-apis:@aws-cdk/aws-route53.PublicHostedZone.fromPublicHostedZoneId",
+      "docs-public-apis:@aws-cdk/aws-route53.PrivateHostedZone.fromPrivateHostedZoneId",
+      "docs-public-apis:@aws-cdk/aws-route53.HostedZone.fromHostedZoneId",
+      "docs-public-apis:@aws-cdk/aws-route53.HostedZone"
     ]
   },
   "stability": "stable",
diff --git a/packages/@aws-cdk/aws-route53resolver/package.json b/packages/@aws-cdk/aws-route53resolver/package.json
index 786d908cc52ce..b06afa009d37e 100644
--- a/packages/@aws-cdk/aws-route53resolver/package.json
+++ b/packages/@aws-cdk/aws-route53resolver/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@aws-cdk/aws-route53resolver",
-  "version": "1.13.1",
+  "version": "1.15.0",
   "description": "The CDK Construct Library for AWS::Route53Resolver",
   "main": "lib/index.js",
   "types": "lib/index.d.ts",
@@ -64,16 +64,16 @@
   },
   "license": "Apache-2.0",
   "devDependencies": {
-    "@aws-cdk/assert": "1.13.1",
-    "cdk-build-tools": "^1.13.1",
-    "cfn2ts": "^1.13.1",
-    "pkglint": "^1.13.1"
+    "@aws-cdk/assert": "1.15.0",
+    "cdk-build-tools": "^1.15.0",
+    "cfn2ts": "^1.15.0",
+    "pkglint": "^1.15.0"
   },
   "dependencies": {
-    "@aws-cdk/core": "1.13.1"
+    "@aws-cdk/core": "1.15.0"
   },
   "peerDependencies": {
-    "@aws-cdk/core": "1.13.1"
+    "@aws-cdk/core": "1.15.0"
   },
   "engines": {
     "node": ">= 10.3.0"
diff --git a/packages/@aws-cdk/aws-s3-assets/package.json b/packages/@aws-cdk/aws-s3-assets/package.json
index 8dbdb93b92a5d..9b98b75a220e9 100644
--- a/packages/@aws-cdk/aws-s3-assets/package.json
+++ b/packages/@aws-cdk/aws-s3-assets/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@aws-cdk/aws-s3-assets",
-  "version": "1.13.1",
+  "version": "1.15.0",
   "description": "Deploy local files and directories to S3",
   "main": "lib/index.js",
   "types": "lib/index.d.ts",
@@ -60,32 +60,38 @@
   },
   "license": "Apache-2.0",
   "devDependencies": {
-    "@aws-cdk/assert": "1.13.1",
+    "@aws-cdk/assert": "1.15.0",
     "@types/sinon": "^7.5.0",
-    "aws-cdk": "1.13.1",
-    "cdk-build-tools": "^1.13.1",
-    "cdk-integ-tools": "^1.13.1",
-    "pkglint": "^1.13.1",
+    "aws-cdk": "1.15.0",
+    "cdk-build-tools": "^1.15.0",
+    "cdk-integ-tools": "^1.15.0",
+    "pkglint": "^1.15.0",
     "sinon": "^7.5.0",
     "ts-mock-imports": "^1.2.6"
   },
   "dependencies": {
-    "@aws-cdk/assets": "1.13.1",
-    "@aws-cdk/aws-iam": "1.13.1",
-    "@aws-cdk/aws-s3": "1.13.1",
-    "@aws-cdk/core": "1.13.1",
-    "@aws-cdk/cx-api": "1.13.1"
+    "@aws-cdk/assets": "1.15.0",
+    "@aws-cdk/aws-iam": "1.15.0",
+    "@aws-cdk/aws-s3": "1.15.0",
+    "@aws-cdk/core": "1.15.0",
+    "@aws-cdk/cx-api": "1.15.0"
   },
   "homepage": "https://github.com/aws/aws-cdk",
   "peerDependencies": {
-    "@aws-cdk/assets": "1.13.1",
-    "@aws-cdk/aws-iam": "1.13.1",
-    "@aws-cdk/aws-s3": "1.13.1",
-    "@aws-cdk/core": "1.13.1",
-    "@aws-cdk/cx-api": "1.13.1"
+    "@aws-cdk/assets": "1.15.0",
+    "@aws-cdk/aws-iam": "1.15.0",
+    "@aws-cdk/aws-s3": "1.15.0",
+    "@aws-cdk/core": "1.15.0",
+    "@aws-cdk/cx-api": "1.15.0"
   },
   "engines": {
     "node": ">= 10.3.0"
   },
-  "stability": "experimental"
+  "stability": "experimental",
+  "awslint": {
+    "exclude": [
+      "docs-public-apis:@aws-cdk/aws-s3-assets.AssetOptions",
+      "docs-public-apis:@aws-cdk/aws-s3-assets.AssetProps"
+    ]
+  }
 }
diff --git a/packages/@aws-cdk/aws-s3-deployment/lib/bucket-deployment.ts b/packages/@aws-cdk/aws-s3-deployment/lib/bucket-deployment.ts
index 7e08e3a4a05aa..41b44deb1f826 100644
--- a/packages/@aws-cdk/aws-s3-deployment/lib/bucket-deployment.ts
+++ b/packages/@aws-cdk/aws-s3-deployment/lib/bucket-deployment.ts
@@ -10,6 +10,7 @@ import fs = require('fs');
 import path = require("path");
 import { ISource, SourceConfig } from "./source";
 
+const now = Date.now();
 const handlerCodeBundle = path.join(__dirname, "..", "lambda", "bundle.zip");
 const handlerSourceDirectory = path.join(__dirname, '..', 'lambda', 'src');
 
@@ -256,29 +257,10 @@ function mapUserMetadata(metadata: UserDefinedObjectMetadata) {
 }
 
 function mapSystemMetadata(metadata: BucketDeploymentProps) {
-  function mapCacheControlDirective(cacheControl: CacheControl) {
-    const { value } = cacheControl;
-
-    if (typeof value === "string") { return value; }
-    if ("max-age" in value) { return `max-age=${value["max-age"].toSeconds()}`; }
-    if ("s-max-age" in value) { return `s-max-age=${value["s-max-age"].toSeconds()}`; }
-
-    throw new Error(`Unsupported cache-control directive ${value}`);
-  }
-  function mapExpires(expires: Expires) {
-    const { value } = expires;
-
-    if (typeof value === "string") { return value; }
-    if (value instanceof Date) { return value.toUTCString(); }
-    if (value instanceof cdk.Duration) { return new Date(Date.now() + value.toMilliseconds()).toUTCString(); }
-
-    throw new Error(`Unsupported expires ${expires}`);
-  }
-
   const res: { [key: string]: string } = {};
 
-  if (metadata.cacheControl) { res["cache-control"] = metadata.cacheControl.map(mapCacheControlDirective).join(", "); }
-  if (metadata.expires) { res.expires = mapExpires(metadata.expires); }
+  if (metadata.cacheControl) { res["cache-control"] = metadata.cacheControl.map(c => c.value).join(", "); }
+  if (metadata.expires) { res.expires = metadata.expires.value; }
   if (metadata.contentDisposition) { res["content-disposition"] = metadata.contentDisposition; }
   if (metadata.contentEncoding) { res["content-encoding"] = metadata.contentEncoding; }
   if (metadata.contentLanguage) { res["content-language"] = metadata.contentLanguage; }
@@ -303,11 +285,11 @@ export class CacheControl {
   public static setPublic() { return new CacheControl("public"); }
   public static setPrivate() { return new CacheControl("private"); }
   public static proxyRevalidate() { return new CacheControl("proxy-revalidate"); }
-  public static maxAge(t: cdk.Duration) { return new CacheControl({ "max-age": t }); }
-  public static sMaxAge(t: cdk.Duration) { return new CacheControl({ "s-max-age": t }); }
+  public static maxAge(t: cdk.Duration) { return new CacheControl(`max-age=${t.toSeconds()}`); }
+  public static sMaxAge(t: cdk.Duration) { return new CacheControl(`s-max-age=${t.toSeconds()}`); }
   public static fromString(s: string) {  return new CacheControl(s); }
 
-  private constructor(public value: any) {}
+  private constructor(public readonly value: any) {}
 }
 
 /**
@@ -343,20 +325,23 @@ export class Expires {
    * Expire at the specified date
    * @param d date to expire at
    */
-  public static atDate(d: Date) { return new Expires(d); }
+  public static atDate(d: Date) { return new Expires(d.toUTCString()); }
+
   /**
    * Expire at the specified timestamp
    * @param t timestamp in unix milliseconds
    */
-  public static atTimestamp(t: number) { return new Expires(t); }
+  public static atTimestamp(t: number) { return Expires.atDate(new Date(t)); }
+
   /**
    * Expire once the specified duration has passed since deployment time
    * @param t the duration to wait before expiring
    */
-  public static after(t: cdk.Duration) { return new Expires(t); }
+  public static after(t: cdk.Duration) { return Expires.atDate(new Date(now + t.toMilliseconds())); }
+
   public static fromString(s: string) { return new Expires(s); }
 
-  private constructor(public value: any) {}
+  private constructor(public readonly value: any) {}
 }
 
 export interface UserDefinedObjectMetadata {
diff --git a/packages/@aws-cdk/aws-s3-deployment/package.json b/packages/@aws-cdk/aws-s3-deployment/package.json
index 2ad1e5ebfce23..829699519bc66 100644
--- a/packages/@aws-cdk/aws-s3-deployment/package.json
+++ b/packages/@aws-cdk/aws-s3-deployment/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@aws-cdk/aws-s3-deployment",
-  "version": "1.13.1",
+  "version": "1.15.0",
   "description": "Constructs for deploying contents to S3 buckets",
   "main": "lib/index.js",
   "types": "lib/index.d.ts",
@@ -77,32 +77,61 @@
   },
   "license": "Apache-2.0",
   "devDependencies": {
-    "@aws-cdk/assert": "1.13.1",
-    "cdk-build-tools": "^1.13.1",
-    "cdk-integ-tools": "^1.13.1",
-    "pkglint": "^1.13.1"
+    "@aws-cdk/assert": "1.15.0",
+    "cdk-build-tools": "^1.15.0",
+    "cdk-integ-tools": "^1.15.0",
+    "pkglint": "^1.15.0"
   },
   "dependencies": {
-    "@aws-cdk/aws-cloudformation": "1.13.1",
-    "@aws-cdk/aws-cloudfront": "1.13.1",
-    "@aws-cdk/aws-iam": "1.13.1",
-    "@aws-cdk/aws-lambda": "1.13.1",
-    "@aws-cdk/aws-s3": "1.13.1",
-    "@aws-cdk/aws-s3-assets": "1.13.1",
-    "@aws-cdk/core": "1.13.1"
+    "@aws-cdk/aws-cloudformation": "1.15.0",
+    "@aws-cdk/aws-cloudfront": "1.15.0",
+    "@aws-cdk/aws-iam": "1.15.0",
+    "@aws-cdk/aws-lambda": "1.15.0",
+    "@aws-cdk/aws-s3": "1.15.0",
+    "@aws-cdk/aws-s3-assets": "1.15.0",
+    "@aws-cdk/core": "1.15.0"
   },
   "homepage": "https://github.com/aws/aws-cdk",
   "peerDependencies": {
-    "@aws-cdk/aws-cloudformation": "1.13.1",
-    "@aws-cdk/aws-cloudfront": "1.13.1",
-    "@aws-cdk/aws-iam": "1.13.1",
-    "@aws-cdk/aws-lambda": "1.13.1",
-    "@aws-cdk/aws-s3": "1.13.1",
-    "@aws-cdk/aws-s3-assets": "1.13.1",
-    "@aws-cdk/core": "1.13.1"
+    "@aws-cdk/aws-cloudformation": "1.15.0",
+    "@aws-cdk/aws-cloudfront": "1.15.0",
+    "@aws-cdk/aws-iam": "1.15.0",
+    "@aws-cdk/aws-lambda": "1.15.0",
+    "@aws-cdk/aws-s3": "1.15.0",
+    "@aws-cdk/aws-s3-assets": "1.15.0",
+    "@aws-cdk/core": "1.15.0"
   },
   "engines": {
     "node": ">= 10.3.0"
   },
-  "stability": "experimental"
+  "stability": "experimental",
+  "awslint": {
+    "exclude": [
+      "docs-public-apis:@aws-cdk/aws-s3-deployment.Expires.fromString",
+      "docs-public-apis:@aws-cdk/aws-s3-deployment.BucketDeployment",
+      "docs-public-apis:@aws-cdk/aws-s3-deployment.CacheControl.fromString",
+      "docs-public-apis:@aws-cdk/aws-s3-deployment.CacheControl.maxAge",
+      "docs-public-apis:@aws-cdk/aws-s3-deployment.CacheControl.mustRevalidate",
+      "docs-public-apis:@aws-cdk/aws-s3-deployment.CacheControl.noCache",
+      "docs-public-apis:@aws-cdk/aws-s3-deployment.CacheControl.noTransform",
+      "docs-public-apis:@aws-cdk/aws-s3-deployment.CacheControl.proxyRevalidate",
+      "docs-public-apis:@aws-cdk/aws-s3-deployment.CacheControl.setPrivate",
+      "docs-public-apis:@aws-cdk/aws-s3-deployment.CacheControl.setPublic",
+      "docs-public-apis:@aws-cdk/aws-s3-deployment.CacheControl.sMaxAge",
+      "docs-public-apis:@aws-cdk/aws-s3-deployment.Expires.value",
+      "docs-public-apis:@aws-cdk/aws-s3-deployment.CacheControl.value",
+      "docs-public-apis:@aws-cdk/aws-s3-deployment.BucketDeploymentProps",
+      "docs-public-apis:@aws-cdk/aws-s3-deployment.SourceConfig",
+      "docs-public-apis:@aws-cdk/aws-s3-deployment.UserDefinedObjectMetadata",
+      "docs-public-apis:@aws-cdk/aws-s3-deployment.ServerSideEncryption.AES_256",
+      "docs-public-apis:@aws-cdk/aws-s3-deployment.ServerSideEncryption.AWS_KMS",
+      "docs-public-apis:@aws-cdk/aws-s3-deployment.StorageClass.STANDARD",
+      "docs-public-apis:@aws-cdk/aws-s3-deployment.StorageClass.REDUCED_REDUNDANCY",
+      "docs-public-apis:@aws-cdk/aws-s3-deployment.StorageClass.STANDARD_IA",
+      "docs-public-apis:@aws-cdk/aws-s3-deployment.StorageClass.ONEZONE_IA",
+      "docs-public-apis:@aws-cdk/aws-s3-deployment.StorageClass.INTELLIGENT_TIERING",
+      "docs-public-apis:@aws-cdk/aws-s3-deployment.StorageClass.GLACIER",
+      "docs-public-apis:@aws-cdk/aws-s3-deployment.StorageClass.DEEP_ARCHIVE"
+    ]
+  }
 }
diff --git a/packages/@aws-cdk/aws-s3-deployment/test/test.bucket-deployment.ts b/packages/@aws-cdk/aws-s3-deployment/test/test.bucket-deployment.ts
index 2771fbc7874f8..5a095209c67f8 100644
--- a/packages/@aws-cdk/aws-s3-deployment/test/test.bucket-deployment.ts
+++ b/packages/@aws-cdk/aws-s3-deployment/test/test.bucket-deployment.ts
@@ -255,7 +255,7 @@ export = {
         'storage-class': 'INTELLIGENT_TIERING',
         'server-side-encryption': 'AES256',
         'cache-control': 'public, max-age=3600',
-        'expires': new Date(Date.now() + 12 * 60 * 60 * 1000).toUTCString()
+        'expires': Expires.after(cdk.Duration.hours(12)).value
       }
     }));
 
diff --git a/packages/@aws-cdk/aws-s3-notifications/package.json b/packages/@aws-cdk/aws-s3-notifications/package.json
index e128c116519d6..9cfb7ddd103ea 100644
--- a/packages/@aws-cdk/aws-s3-notifications/package.json
+++ b/packages/@aws-cdk/aws-s3-notifications/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@aws-cdk/aws-s3-notifications",
-  "version": "1.13.1",
+  "version": "1.15.0",
   "description": "Bucket Notifications API for AWS S3",
   "main": "lib/index.js",
   "types": "lib/index.d.ts",
@@ -70,28 +70,28 @@
   },
   "license": "Apache-2.0",
   "devDependencies": {
-    "@aws-cdk/assert": "1.13.1",
-    "cdk-build-tools": "^1.13.1",
-    "cdk-integ-tools": "^1.13.1",
+    "@aws-cdk/assert": "1.15.0",
+    "cdk-build-tools": "^1.15.0",
+    "cdk-integ-tools": "^1.15.0",
     "jest": "^24.9.0",
-    "pkglint": "^1.13.1"
+    "pkglint": "^1.15.0"
   },
   "dependencies": {
-    "@aws-cdk/aws-iam": "1.13.1",
-    "@aws-cdk/aws-lambda": "1.13.1",
-    "@aws-cdk/aws-s3": "1.13.1",
-    "@aws-cdk/aws-sns": "1.13.1",
-    "@aws-cdk/aws-sqs": "1.13.1",
-    "@aws-cdk/core": "1.13.1"
+    "@aws-cdk/aws-iam": "1.15.0",
+    "@aws-cdk/aws-lambda": "1.15.0",
+    "@aws-cdk/aws-s3": "1.15.0",
+    "@aws-cdk/aws-sns": "1.15.0",
+    "@aws-cdk/aws-sqs": "1.15.0",
+    "@aws-cdk/core": "1.15.0"
   },
   "homepage": "https://github.com/aws/aws-cdk",
   "peerDependencies": {
-    "@aws-cdk/aws-iam": "1.13.1",
-    "@aws-cdk/aws-lambda": "1.13.1",
-    "@aws-cdk/aws-s3": "1.13.1",
-    "@aws-cdk/aws-sns": "1.13.1",
-    "@aws-cdk/aws-sqs": "1.13.1",
-    "@aws-cdk/core": "1.13.1"
+    "@aws-cdk/aws-iam": "1.15.0",
+    "@aws-cdk/aws-lambda": "1.15.0",
+    "@aws-cdk/aws-s3": "1.15.0",
+    "@aws-cdk/aws-sns": "1.15.0",
+    "@aws-cdk/aws-sqs": "1.15.0",
+    "@aws-cdk/core": "1.15.0"
   },
   "engines": {
     "node": ">= 10.3.0"
diff --git a/packages/@aws-cdk/aws-s3/package.json b/packages/@aws-cdk/aws-s3/package.json
index 1be1a481b6783..04f891139d78a 100644
--- a/packages/@aws-cdk/aws-s3/package.json
+++ b/packages/@aws-cdk/aws-s3/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@aws-cdk/aws-s3",
-  "version": "1.13.1",
+  "version": "1.15.0",
   "description": "CDK Constructs for AWS S3",
   "main": "lib/index.js",
   "types": "lib/index.d.ts",
@@ -63,24 +63,24 @@
   },
   "license": "Apache-2.0",
   "devDependencies": {
-    "@aws-cdk/assert": "1.13.1",
-    "cdk-build-tools": "^1.13.1",
-    "cdk-integ-tools": "^1.13.1",
-    "cfn2ts": "^1.13.1",
-    "pkglint": "^1.13.1"
+    "@aws-cdk/assert": "1.15.0",
+    "cdk-build-tools": "^1.15.0",
+    "cdk-integ-tools": "^1.15.0",
+    "cfn2ts": "^1.15.0",
+    "pkglint": "^1.15.0"
   },
   "dependencies": {
-    "@aws-cdk/aws-events": "1.13.1",
-    "@aws-cdk/aws-iam": "1.13.1",
-    "@aws-cdk/aws-kms": "1.13.1",
-    "@aws-cdk/core": "1.13.1"
+    "@aws-cdk/aws-events": "1.15.0",
+    "@aws-cdk/aws-iam": "1.15.0",
+    "@aws-cdk/aws-kms": "1.15.0",
+    "@aws-cdk/core": "1.15.0"
   },
   "homepage": "https://github.com/aws/aws-cdk",
   "peerDependencies": {
-    "@aws-cdk/aws-events": "1.13.1",
-    "@aws-cdk/aws-iam": "1.13.1",
-    "@aws-cdk/aws-kms": "1.13.1",
-    "@aws-cdk/core": "1.13.1"
+    "@aws-cdk/aws-events": "1.15.0",
+    "@aws-cdk/aws-iam": "1.15.0",
+    "@aws-cdk/aws-kms": "1.15.0",
+    "@aws-cdk/core": "1.15.0"
   },
   "engines": {
     "node": ">= 10.3.0"
@@ -88,7 +88,50 @@
   "awslint": {
     "exclude": [
       "props-physical-name:@aws-cdk/aws-s3.BucketPolicyProps",
-      "no-unused-type:@aws-cdk/aws-s3.Location"
+      "no-unused-type:@aws-cdk/aws-s3.Location",
+      "props-default-doc:@aws-cdk/aws-s3.BucketAttributes.bucketDualStackDomainName",
+      "docs-public-apis:@aws-cdk/aws-s3.RedirectProtocol.HTTPS",
+      "docs-public-apis:@aws-cdk/aws-s3.RedirectProtocol.HTTP",
+      "docs-public-apis:@aws-cdk/aws-s3.BlockPublicAccess",
+      "docs-public-apis:@aws-cdk/aws-s3.BlockPublicAccess.BLOCK_ACLS",
+      "docs-public-apis:@aws-cdk/aws-s3.BlockPublicAccess.BLOCK_ALL",
+      "docs-public-apis:@aws-cdk/aws-s3.BlockPublicAccess.blockPublicAcls",
+      "docs-public-apis:@aws-cdk/aws-s3.BlockPublicAccess.blockPublicPolicy",
+      "docs-public-apis:@aws-cdk/aws-s3.BlockPublicAccess.ignorePublicAcls",
+      "docs-public-apis:@aws-cdk/aws-s3.BlockPublicAccess.restrictPublicBuckets",
+      "docs-public-apis:@aws-cdk/aws-s3.Bucket.fromBucketArn",
+      "docs-public-apis:@aws-cdk/aws-s3.Bucket.fromBucketName",
+      "docs-public-apis:@aws-cdk/aws-s3.ReplaceKey",
+      "docs-public-apis:@aws-cdk/aws-s3.ReplaceKey.prefixWithKey",
+      "docs-public-apis:@aws-cdk/aws-s3.ReplaceKey.withKey",
+      "docs-public-apis:@aws-cdk/aws-s3.StorageClass.value",
+      "docs-public-apis:@aws-cdk/aws-s3.StorageClass.toString",
+      "docs-public-apis:@aws-cdk/aws-s3.BlockPublicAccessOptions",
+      "props-default-doc:@aws-cdk/aws-s3.BlockPublicAccessOptions.blockPublicAcls",
+      "props-default-doc:@aws-cdk/aws-s3.BlockPublicAccessOptions.blockPublicPolicy",
+      "props-default-doc:@aws-cdk/aws-s3.BlockPublicAccessOptions.ignorePublicAcls",
+      "props-default-doc:@aws-cdk/aws-s3.BlockPublicAccessOptions.restrictPublicBuckets",
+      "props-default-doc:@aws-cdk/aws-s3.BucketAttributes.bucketArn",
+      "docs-public-apis:@aws-cdk/aws-s3.BucketNotificationDestinationType.TOPIC",
+      "props-default-doc:@aws-cdk/aws-s3.BucketAttributes.bucketName",
+      "props-default-doc:@aws-cdk/aws-s3.BucketAttributes.bucketRegionalDomainName",
+      "docs-public-apis:@aws-cdk/aws-s3.BucketAttributes.encryptionKey",
+      "props-default-doc:@aws-cdk/aws-s3.BucketAttributes.encryptionKey",
+      "props-default-doc:@aws-cdk/aws-s3.BucketMetrics.prefix",
+      "props-default-doc:@aws-cdk/aws-s3.BucketMetrics.tagFilters",
+      "props-default-doc:@aws-cdk/aws-s3.BucketNotificationDestinationConfig.dependencies",
+      "docs-public-apis:@aws-cdk/aws-s3.BucketPolicyProps",
+      "docs-public-apis:@aws-cdk/aws-s3.BucketProps",
+      "docs-public-apis:@aws-cdk/aws-s3.IBucket",
+      "props-default-doc:@aws-cdk/aws-s3.LifecycleRule.id",
+      "props-default-doc:@aws-cdk/aws-s3.LifecycleRule.noncurrentVersionTransitions",
+      "props-default-doc:@aws-cdk/aws-s3.Location.objectVersion",
+      "docs-public-apis:@aws-cdk/aws-s3.NotificationKeyFilter",
+      "props-default-doc:@aws-cdk/aws-s3.NotificationKeyFilter.prefix",
+      "props-default-doc:@aws-cdk/aws-s3.NotificationKeyFilter.suffix",
+      "docs-public-apis:@aws-cdk/aws-s3.RoutingRuleCondition",
+      "docs-public-apis:@aws-cdk/aws-s3.BucketNotificationDestinationType.LAMBDA",
+      "docs-public-apis:@aws-cdk/aws-s3.BucketNotificationDestinationType.QUEUE"
     ]
   },
   "stability": "stable"
diff --git a/packages/@aws-cdk/aws-sagemaker/package.json b/packages/@aws-cdk/aws-sagemaker/package.json
index 5708e7876a86b..60c19c7f09942 100644
--- a/packages/@aws-cdk/aws-sagemaker/package.json
+++ b/packages/@aws-cdk/aws-sagemaker/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@aws-cdk/aws-sagemaker",
-  "version": "1.13.1",
+  "version": "1.15.0",
   "description": "The CDK Construct Library for AWS::SageMaker",
   "main": "lib/index.js",
   "types": "lib/index.d.ts",
@@ -64,16 +64,16 @@
   },
   "license": "Apache-2.0",
   "devDependencies": {
-    "@aws-cdk/assert": "1.13.1",
-    "cdk-build-tools": "^1.13.1",
-    "cfn2ts": "^1.13.1",
-    "pkglint": "^1.13.1"
+    "@aws-cdk/assert": "1.15.0",
+    "cdk-build-tools": "^1.15.0",
+    "cfn2ts": "^1.15.0",
+    "pkglint": "^1.15.0"
   },
   "dependencies": {
-    "@aws-cdk/core": "1.13.1"
+    "@aws-cdk/core": "1.15.0"
   },
   "peerDependencies": {
-    "@aws-cdk/core": "1.13.1"
+    "@aws-cdk/core": "1.15.0"
   },
   "engines": {
     "node": ">= 10.3.0"
diff --git a/packages/@aws-cdk/aws-sam/package.json b/packages/@aws-cdk/aws-sam/package.json
index 27b6f85f99cb0..86a9a76b47e2d 100644
--- a/packages/@aws-cdk/aws-sam/package.json
+++ b/packages/@aws-cdk/aws-sam/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@aws-cdk/aws-sam",
-  "version": "1.13.1",
+  "version": "1.15.0",
   "description": "The CDK Construct Library for the AWS Serverless Application Model (SAM) resources",
   "main": "lib/index.js",
   "types": "lib/index.d.ts",
@@ -64,16 +64,16 @@
   },
   "license": "Apache-2.0",
   "devDependencies": {
-    "@aws-cdk/assert": "1.13.1",
-    "cdk-build-tools": "^1.13.1",
-    "cfn2ts": "^1.13.1",
-    "pkglint": "^1.13.1"
+    "@aws-cdk/assert": "1.15.0",
+    "cdk-build-tools": "^1.15.0",
+    "cfn2ts": "^1.15.0",
+    "pkglint": "^1.15.0"
   },
   "dependencies": {
-    "@aws-cdk/core": "1.13.1"
+    "@aws-cdk/core": "1.15.0"
   },
   "peerDependencies": {
-    "@aws-cdk/core": "1.13.1"
+    "@aws-cdk/core": "1.15.0"
   },
   "engines": {
     "node": ">= 10.3.0"
diff --git a/packages/@aws-cdk/aws-sdb/package.json b/packages/@aws-cdk/aws-sdb/package.json
index 56ab4da0875f0..0cd55fe907bb7 100644
--- a/packages/@aws-cdk/aws-sdb/package.json
+++ b/packages/@aws-cdk/aws-sdb/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@aws-cdk/aws-sdb",
-  "version": "1.13.1",
+  "version": "1.15.0",
   "description": "The CDK Construct Library for AWS::SDB",
   "main": "lib/index.js",
   "types": "lib/index.d.ts",
@@ -63,17 +63,17 @@
   },
   "license": "Apache-2.0",
   "devDependencies": {
-    "@aws-cdk/assert": "1.13.1",
-    "cdk-build-tools": "^1.13.1",
-    "cfn2ts": "^1.13.1",
-    "pkglint": "^1.13.1"
+    "@aws-cdk/assert": "1.15.0",
+    "cdk-build-tools": "^1.15.0",
+    "cfn2ts": "^1.15.0",
+    "pkglint": "^1.15.0"
   },
   "dependencies": {
-    "@aws-cdk/core": "1.13.1"
+    "@aws-cdk/core": "1.15.0"
   },
   "homepage": "https://github.com/aws/aws-cdk",
   "peerDependencies": {
-    "@aws-cdk/core": "1.13.1"
+    "@aws-cdk/core": "1.15.0"
   },
   "engines": {
     "node": ">= 10.3.0"
diff --git a/packages/@aws-cdk/aws-secretsmanager/package.json b/packages/@aws-cdk/aws-secretsmanager/package.json
index 46c435b9c0682..792dc5c80ecea 100644
--- a/packages/@aws-cdk/aws-secretsmanager/package.json
+++ b/packages/@aws-cdk/aws-secretsmanager/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@aws-cdk/aws-secretsmanager",
-  "version": "1.13.1",
+  "version": "1.15.0",
   "description": "The CDK Construct Library for AWS::SecretsManager",
   "main": "lib/index.js",
   "types": "lib/index.d.ts",
@@ -64,25 +64,25 @@
   },
   "license": "Apache-2.0",
   "devDependencies": {
-    "@aws-cdk/assert": "1.13.1",
-    "cdk-build-tools": "^1.13.1",
-    "cdk-integ-tools": "^1.13.1",
-    "cfn2ts": "^1.13.1",
-    "pkglint": "^1.13.1"
+    "@aws-cdk/assert": "1.15.0",
+    "cdk-build-tools": "^1.15.0",
+    "cdk-integ-tools": "^1.15.0",
+    "cfn2ts": "^1.15.0",
+    "pkglint": "^1.15.0"
   },
   "dependencies": {
-    "@aws-cdk/aws-ec2": "1.13.1",
-    "@aws-cdk/aws-iam": "1.13.1",
-    "@aws-cdk/aws-kms": "1.13.1",
-    "@aws-cdk/aws-lambda": "1.13.1",
-    "@aws-cdk/core": "1.13.1"
+    "@aws-cdk/aws-ec2": "1.15.0",
+    "@aws-cdk/aws-iam": "1.15.0",
+    "@aws-cdk/aws-kms": "1.15.0",
+    "@aws-cdk/aws-lambda": "1.15.0",
+    "@aws-cdk/core": "1.15.0"
   },
   "peerDependencies": {
-    "@aws-cdk/aws-ec2": "1.13.1",
-    "@aws-cdk/aws-iam": "1.13.1",
-    "@aws-cdk/aws-kms": "1.13.1",
-    "@aws-cdk/aws-lambda": "1.13.1",
-    "@aws-cdk/core": "1.13.1"
+    "@aws-cdk/aws-ec2": "1.15.0",
+    "@aws-cdk/aws-iam": "1.15.0",
+    "@aws-cdk/aws-kms": "1.15.0",
+    "@aws-cdk/aws-lambda": "1.15.0",
+    "@aws-cdk/core": "1.15.0"
   },
   "engines": {
     "node": ">= 10.3.0"
@@ -92,7 +92,13 @@
       "from-signature:@aws-cdk/aws-secretsmanager.SecretTargetAttachment.fromSecretTargetAttachmentSecretArn",
       "from-attributes:fromSecretTargetAttachmentAttributes",
       "props-physical-name:@aws-cdk/aws-secretsmanager.RotationScheduleProps",
-      "props-physical-name:@aws-cdk/aws-secretsmanager.SecretTargetAttachmentProps"
+      "props-physical-name:@aws-cdk/aws-secretsmanager.SecretTargetAttachmentProps",
+      "docs-public-apis:@aws-cdk/aws-secretsmanager.Secret.fromSecretArn",
+      "props-default-doc:@aws-cdk/aws-secretsmanager.SecretStringGenerator.secretStringTemplate",
+      "props-default-doc:@aws-cdk/aws-secretsmanager.SecretStringGenerator.generateStringKey",
+      "props-default-doc:@aws-cdk/aws-secretsmanager.SecretAttributes.encryptionKey",
+      "docs-public-apis:@aws-cdk/aws-secretsmanager.ISecretTargetAttachment",
+      "docs-public-apis:@aws-cdk/aws-secretsmanager.SecretTargetAttachment.fromSecretTargetAttachmentSecretArn"
     ]
   },
   "stability": "stable"
diff --git a/packages/@aws-cdk/aws-securityhub/package.json b/packages/@aws-cdk/aws-securityhub/package.json
index 7cd29be972311..1ecf18e68dbc1 100644
--- a/packages/@aws-cdk/aws-securityhub/package.json
+++ b/packages/@aws-cdk/aws-securityhub/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@aws-cdk/aws-securityhub",
-  "version": "1.13.1",
+  "version": "1.15.0",
   "description": "The CDK Construct Library for AWS::SecurityHub",
   "main": "lib/index.js",
   "types": "lib/index.d.ts",
@@ -65,16 +65,16 @@
   },
   "license": "Apache-2.0",
   "devDependencies": {
-    "@aws-cdk/assert": "1.13.1",
-    "cdk-build-tools": "^1.13.1",
-    "cfn2ts": "1.13.1",
-    "pkglint": "^1.13.1"
+    "@aws-cdk/assert": "1.15.0",
+    "cdk-build-tools": "^1.15.0",
+    "cfn2ts": "1.15.0",
+    "pkglint": "^1.15.0"
   },
   "dependencies": {
-    "@aws-cdk/core": "1.13.1"
+    "@aws-cdk/core": "1.15.0"
   },
   "peerDependencies": {
-    "@aws-cdk/core": "1.13.1"
+    "@aws-cdk/core": "1.15.0"
   },
   "engines": {
     "node": ">= 10.3.0"
diff --git a/packages/@aws-cdk/aws-servicecatalog/package.json b/packages/@aws-cdk/aws-servicecatalog/package.json
index 3fbfda3e2261f..d62a17b16eb55 100644
--- a/packages/@aws-cdk/aws-servicecatalog/package.json
+++ b/packages/@aws-cdk/aws-servicecatalog/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@aws-cdk/aws-servicecatalog",
-  "version": "1.13.1",
+  "version": "1.15.0",
   "description": "The CDK Construct Library for AWS::ServiceCatalog",
   "main": "lib/index.js",
   "types": "lib/index.d.ts",
@@ -63,17 +63,17 @@
   },
   "license": "Apache-2.0",
   "devDependencies": {
-    "@aws-cdk/assert": "1.13.1",
-    "cdk-build-tools": "^1.13.1",
-    "cfn2ts": "^1.13.1",
-    "pkglint": "^1.13.1"
+    "@aws-cdk/assert": "1.15.0",
+    "cdk-build-tools": "^1.15.0",
+    "cfn2ts": "^1.15.0",
+    "pkglint": "^1.15.0"
   },
   "dependencies": {
-    "@aws-cdk/core": "1.13.1"
+    "@aws-cdk/core": "1.15.0"
   },
   "homepage": "https://github.com/aws/aws-cdk",
   "peerDependencies": {
-    "@aws-cdk/core": "1.13.1"
+    "@aws-cdk/core": "1.15.0"
   },
   "engines": {
     "node": ">= 10.3.0"
diff --git a/packages/@aws-cdk/aws-servicediscovery/package.json b/packages/@aws-cdk/aws-servicediscovery/package.json
index aa1b35a41ffeb..d4d6096ad3481 100644
--- a/packages/@aws-cdk/aws-servicediscovery/package.json
+++ b/packages/@aws-cdk/aws-servicediscovery/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@aws-cdk/aws-servicediscovery",
-  "version": "1.13.1",
+  "version": "1.15.0",
   "description": "The CDK Construct Library for AWS::ServiceDiscovery",
   "main": "lib/index.js",
   "types": "lib/index.d.ts",
@@ -63,24 +63,24 @@
   },
   "license": "Apache-2.0",
   "devDependencies": {
-    "@aws-cdk/assert": "1.13.1",
-    "cdk-build-tools": "^1.13.1",
-    "cdk-integ-tools": "^1.13.1",
-    "cfn2ts": "^1.13.1",
-    "pkglint": "^1.13.1"
+    "@aws-cdk/assert": "1.15.0",
+    "cdk-build-tools": "^1.15.0",
+    "cdk-integ-tools": "^1.15.0",
+    "cfn2ts": "^1.15.0",
+    "pkglint": "^1.15.0"
   },
   "dependencies": {
-    "@aws-cdk/aws-ec2": "1.13.1",
-    "@aws-cdk/aws-elasticloadbalancingv2": "1.13.1",
-    "@aws-cdk/aws-route53": "1.13.1",
-    "@aws-cdk/core": "1.13.1"
+    "@aws-cdk/aws-ec2": "1.15.0",
+    "@aws-cdk/aws-elasticloadbalancingv2": "1.15.0",
+    "@aws-cdk/aws-route53": "1.15.0",
+    "@aws-cdk/core": "1.15.0"
   },
   "homepage": "https://github.com/aws/aws-cdk",
   "peerDependencies": {
-    "@aws-cdk/aws-ec2": "1.13.1",
-    "@aws-cdk/aws-elasticloadbalancingv2": "1.13.1",
-    "@aws-cdk/aws-route53": "1.13.1",
-    "@aws-cdk/core": "1.13.1"
+    "@aws-cdk/aws-ec2": "1.15.0",
+    "@aws-cdk/aws-elasticloadbalancingv2": "1.15.0",
+    "@aws-cdk/aws-route53": "1.15.0",
+    "@aws-cdk/core": "1.15.0"
   },
   "engines": {
     "node": ">= 10.3.0"
@@ -94,7 +94,53 @@
       "props-physical-name:@aws-cdk/aws-servicediscovery.CnameInstanceProps",
       "props-physical-name:@aws-cdk/aws-servicediscovery.IpInstanceProps",
       "props-physical-name:@aws-cdk/aws-servicediscovery.NonIpInstanceProps",
-      "props-physical-name:@aws-cdk/aws-servicediscovery.ServiceProps"
+      "props-physical-name:@aws-cdk/aws-servicediscovery.ServiceProps",
+      "docs-public-apis:@aws-cdk/aws-servicediscovery.CnameInstanceProps",
+      "docs-public-apis:@aws-cdk/aws-servicediscovery.RoutingPolicy",
+      "docs-public-apis:@aws-cdk/aws-servicediscovery.NamespaceType",
+      "docs-public-apis:@aws-cdk/aws-servicediscovery.HealthCheckType",
+      "docs-public-apis:@aws-cdk/aws-servicediscovery.DnsRecordType",
+      "docs-public-apis:@aws-cdk/aws-servicediscovery.ServiceProps",
+      "docs-public-apis:@aws-cdk/aws-servicediscovery.ServiceAttributes.serviceName",
+      "docs-public-apis:@aws-cdk/aws-servicediscovery.ServiceAttributes.serviceId",
+      "docs-public-apis:@aws-cdk/aws-servicediscovery.ServiceAttributes.serviceArn",
+      "docs-public-apis:@aws-cdk/aws-servicediscovery.ServiceAttributes.routingPolicy",
+      "docs-public-apis:@aws-cdk/aws-servicediscovery.ServiceAttributes.namespace",
+      "docs-public-apis:@aws-cdk/aws-servicediscovery.ServiceAttributes.dnsRecordType",
+      "docs-public-apis:@aws-cdk/aws-servicediscovery.HttpNamespace.httpNamespaceArn",
+      "docs-public-apis:@aws-cdk/aws-servicediscovery.HttpNamespace.httpNamespaceId",
+      "docs-public-apis:@aws-cdk/aws-servicediscovery.HttpNamespace.httpNamespaceName",
+      "docs-public-apis:@aws-cdk/aws-servicediscovery.HttpNamespace.fromHttpNamespaceAttributes",
+      "docs-public-apis:@aws-cdk/aws-servicediscovery.InstanceBase",
+      "docs-public-apis:@aws-cdk/aws-servicediscovery.PrivateDnsNamespace.privateDnsNamespaceArn",
+      "docs-public-apis:@aws-cdk/aws-servicediscovery.PrivateDnsNamespace.privateDnsNamespaceId",
+      "docs-public-apis:@aws-cdk/aws-servicediscovery.PrivateDnsNamespace.privateDnsNamespaceName",
+      "docs-public-apis:@aws-cdk/aws-servicediscovery.PrivateDnsNamespace.fromPrivateDnsNamespaceAttributes",
+      "docs-public-apis:@aws-cdk/aws-servicediscovery.PublicDnsNamespace.publicDnsNamespaceArn",
+      "docs-public-apis:@aws-cdk/aws-servicediscovery.PublicDnsNamespace.publicDnsNamespaceId",
+      "docs-public-apis:@aws-cdk/aws-servicediscovery.PublicDnsNamespace.publicDnsNamespaceName",
+      "docs-public-apis:@aws-cdk/aws-servicediscovery.PublicDnsNamespace.fromPublicDnsNamespaceAttributes",
+      "docs-public-apis:@aws-cdk/aws-servicediscovery.Service.fromServiceAttributes",
+      "docs-public-apis:@aws-cdk/aws-servicediscovery.AliasTargetInstanceProps",
+      "docs-public-apis:@aws-cdk/aws-servicediscovery.BaseNamespaceProps",
+      "docs-public-apis:@aws-cdk/aws-servicediscovery.CnameInstanceBaseProps",
+      "docs-public-apis:@aws-cdk/aws-servicediscovery.ServiceAttributes",
+      "docs-public-apis:@aws-cdk/aws-servicediscovery.HttpNamespaceAttributes",
+      "docs-public-apis:@aws-cdk/aws-servicediscovery.HttpNamespaceProps",
+      "docs-public-apis:@aws-cdk/aws-servicediscovery.IHttpNamespace",
+      "docs-public-apis:@aws-cdk/aws-servicediscovery.IInstance",
+      "docs-public-apis:@aws-cdk/aws-servicediscovery.INamespace",
+      "docs-public-apis:@aws-cdk/aws-servicediscovery.IPrivateDnsNamespace",
+      "docs-public-apis:@aws-cdk/aws-servicediscovery.IPublicDnsNamespace",
+      "docs-public-apis:@aws-cdk/aws-servicediscovery.IService",
+      "docs-public-apis:@aws-cdk/aws-servicediscovery.IpInstanceBaseProps",
+      "docs-public-apis:@aws-cdk/aws-servicediscovery.IpInstanceProps",
+      "docs-public-apis:@aws-cdk/aws-servicediscovery.NonIpInstanceBaseProps",
+      "docs-public-apis:@aws-cdk/aws-servicediscovery.NonIpInstanceProps",
+      "docs-public-apis:@aws-cdk/aws-servicediscovery.PrivateDnsNamespaceAttributes",
+      "docs-public-apis:@aws-cdk/aws-servicediscovery.PrivateDnsNamespaceProps",
+      "docs-public-apis:@aws-cdk/aws-servicediscovery.PublicDnsNamespaceAttributes",
+      "docs-public-apis:@aws-cdk/aws-servicediscovery.PublicDnsNamespaceProps"
     ]
   },
   "stability": "stable"
diff --git a/packages/@aws-cdk/aws-ses-actions/package.json b/packages/@aws-cdk/aws-ses-actions/package.json
index 6562d51a4504c..72c265a53cf94 100644
--- a/packages/@aws-cdk/aws-ses-actions/package.json
+++ b/packages/@aws-cdk/aws-ses-actions/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@aws-cdk/aws-ses-actions",
-  "version": "1.13.1",
+  "version": "1.15.0",
   "description": "Receipt rule actions for AWS SES",
   "main": "lib/index.js",
   "types": "lib/index.d.ts",
@@ -72,34 +72,46 @@
   },
   "license": "Apache-2.0",
   "devDependencies": {
-    "@aws-cdk/assert": "1.13.1",
-    "cdk-build-tools": "^1.13.1",
-    "cdk-integ-tools": "^1.13.1",
-    "cfn2ts": "^1.13.1",
+    "@aws-cdk/assert": "1.15.0",
+    "cdk-build-tools": "^1.15.0",
+    "cdk-integ-tools": "^1.15.0",
+    "cfn2ts": "^1.15.0",
     "jest": "^24.9.0",
-    "pkglint": "^1.13.1"
+    "pkglint": "^1.15.0"
   },
   "dependencies": {
-    "@aws-cdk/aws-iam": "1.13.1",
-    "@aws-cdk/aws-kms": "1.13.1",
-    "@aws-cdk/aws-lambda": "1.13.1",
-    "@aws-cdk/aws-s3": "1.13.1",
-    "@aws-cdk/aws-ses": "1.13.1",
-    "@aws-cdk/aws-sns": "1.13.1",
-    "@aws-cdk/core": "1.13.1"
+    "@aws-cdk/aws-iam": "1.15.0",
+    "@aws-cdk/aws-kms": "1.15.0",
+    "@aws-cdk/aws-lambda": "1.15.0",
+    "@aws-cdk/aws-s3": "1.15.0",
+    "@aws-cdk/aws-ses": "1.15.0",
+    "@aws-cdk/aws-sns": "1.15.0",
+    "@aws-cdk/core": "1.15.0"
   },
   "homepage": "https://github.com/aws/aws-cdk",
   "peerDependencies": {
-    "@aws-cdk/aws-iam": "1.13.1",
-    "@aws-cdk/aws-kms": "1.13.1",
-    "@aws-cdk/aws-lambda": "1.13.1",
-    "@aws-cdk/aws-s3": "1.13.1",
-    "@aws-cdk/aws-ses": "1.13.1",
-    "@aws-cdk/aws-sns": "1.13.1",
-    "@aws-cdk/core": "1.13.1"
+    "@aws-cdk/aws-iam": "1.15.0",
+    "@aws-cdk/aws-kms": "1.15.0",
+    "@aws-cdk/aws-lambda": "1.15.0",
+    "@aws-cdk/aws-s3": "1.15.0",
+    "@aws-cdk/aws-ses": "1.15.0",
+    "@aws-cdk/aws-sns": "1.15.0",
+    "@aws-cdk/core": "1.15.0"
   },
   "engines": {
     "node": ">= 10.3.0"
   },
-  "stability": "experimental"
+  "stability": "experimental",
+  "awslint": {
+    "exclude": [
+      "docs-public-apis:@aws-cdk/aws-ses-actions.BounceTemplate.MAILBOX_DOES_NOT_EXIST",
+      "docs-public-apis:@aws-cdk/aws-ses-actions.BounceTemplate.MAILBOX_FULL",
+      "docs-public-apis:@aws-cdk/aws-ses-actions.BounceTemplate.MESSAGE_CONTENT_REJECTED",
+      "docs-public-apis:@aws-cdk/aws-ses-actions.BounceTemplate.MESSAGE_TOO_LARGE",
+      "docs-public-apis:@aws-cdk/aws-ses-actions.BounceTemplate.TEMPORARY_FAILURE",
+      "docs-public-apis:@aws-cdk/aws-ses-actions.BounceTemplate.props",
+      "props-default-doc:@aws-cdk/aws-ses-actions.BounceTemplateProps.statusCode",
+      "props-default-doc:@aws-cdk/aws-ses-actions.StopProps.topic"
+    ]
+  }
 }
diff --git a/packages/@aws-cdk/aws-ses/package.json b/packages/@aws-cdk/aws-ses/package.json
index 730d005b5f989..f2dab9d93f7ff 100644
--- a/packages/@aws-cdk/aws-ses/package.json
+++ b/packages/@aws-cdk/aws-ses/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@aws-cdk/aws-ses",
-  "version": "1.13.1",
+  "version": "1.15.0",
   "description": "The CDK Construct Library for AWS::SES",
   "main": "lib/index.js",
   "types": "lib/index.d.ts",
@@ -63,25 +63,39 @@
   },
   "license": "Apache-2.0",
   "devDependencies": {
-    "@aws-cdk/assert": "1.13.1",
-    "cdk-build-tools": "^1.13.1",
-    "cdk-integ-tools": "^1.13.1",
-    "cfn2ts": "^1.13.1",
-    "pkglint": "^1.13.1"
+    "@aws-cdk/assert": "1.15.0",
+    "cdk-build-tools": "^1.15.0",
+    "cdk-integ-tools": "^1.15.0",
+    "cfn2ts": "^1.15.0",
+    "pkglint": "^1.15.0"
   },
   "dependencies": {
-    "@aws-cdk/aws-iam": "1.13.1",
-    "@aws-cdk/aws-lambda": "1.13.1",
-    "@aws-cdk/core": "1.13.1"
+    "@aws-cdk/aws-iam": "1.15.0",
+    "@aws-cdk/aws-lambda": "1.15.0",
+    "@aws-cdk/core": "1.15.0"
   },
   "homepage": "https://github.com/aws/aws-cdk",
   "peerDependencies": {
-    "@aws-cdk/aws-iam": "1.13.1",
-    "@aws-cdk/aws-lambda": "1.13.1",
-    "@aws-cdk/core": "1.13.1"
+    "@aws-cdk/aws-iam": "1.15.0",
+    "@aws-cdk/aws-lambda": "1.15.0",
+    "@aws-cdk/core": "1.15.0"
   },
   "engines": {
     "node": ">= 10.3.0"
   },
-  "stability": "experimental"
+  "stability": "experimental",
+  "awslint": {
+    "exclude": [
+      "props-default-doc:@aws-cdk/aws-ses.ReceiptRuleActionConfig.addHeaderAction",
+      "props-default-doc:@aws-cdk/aws-ses.ReceiptRuleActionConfig.workmailAction",
+      "props-default-doc:@aws-cdk/aws-ses.ReceiptRuleActionConfig.stopAction",
+      "props-default-doc:@aws-cdk/aws-ses.ReceiptRuleActionConfig.snsAction",
+      "docs-public-apis:@aws-cdk/aws-ses.DropSpamReceiptRule.rule",
+      "docs-public-apis:@aws-cdk/aws-ses.ReceiptRule.fromReceiptRuleName",
+      "docs-public-apis:@aws-cdk/aws-ses.DropSpamReceiptRuleProps",
+      "props-default-doc:@aws-cdk/aws-ses.ReceiptRuleActionConfig.s3Action",
+      "props-default-doc:@aws-cdk/aws-ses.ReceiptRuleActionConfig.bounceAction",
+      "props-default-doc:@aws-cdk/aws-ses.ReceiptRuleActionConfig.lambdaAction"
+    ]
+  }
 }
diff --git a/packages/@aws-cdk/aws-sns-subscriptions/package.json b/packages/@aws-cdk/aws-sns-subscriptions/package.json
index 30154d0ffd029..2afec44069194 100644
--- a/packages/@aws-cdk/aws-sns-subscriptions/package.json
+++ b/packages/@aws-cdk/aws-sns-subscriptions/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@aws-cdk/aws-sns-subscriptions",
-  "version": "1.13.1",
+  "version": "1.15.0",
   "description": "CDK Subscription Constructs for AWS SNS",
   "main": "lib/index.js",
   "types": "lib/index.d.ts",
@@ -71,30 +71,39 @@
   },
   "license": "Apache-2.0",
   "devDependencies": {
-    "@aws-cdk/assert": "1.13.1",
-    "cdk-build-tools": "^1.13.1",
-    "cdk-integ-tools": "^1.13.1",
-    "cfn2ts": "^1.13.1",
+    "@aws-cdk/assert": "1.15.0",
+    "cdk-build-tools": "^1.15.0",
+    "cdk-integ-tools": "^1.15.0",
+    "cfn2ts": "^1.15.0",
     "jest": "^24.9.0",
-    "pkglint": "^1.13.1"
+    "pkglint": "^1.15.0"
   },
   "dependencies": {
-    "@aws-cdk/aws-iam": "1.13.1",
-    "@aws-cdk/aws-lambda": "1.13.1",
-    "@aws-cdk/aws-sns": "1.13.1",
-    "@aws-cdk/aws-sqs": "1.13.1",
-    "@aws-cdk/core": "1.13.1"
+    "@aws-cdk/aws-iam": "1.15.0",
+    "@aws-cdk/aws-lambda": "1.15.0",
+    "@aws-cdk/aws-sns": "1.15.0",
+    "@aws-cdk/aws-sqs": "1.15.0",
+    "@aws-cdk/core": "1.15.0"
   },
   "homepage": "https://github.com/aws/aws-cdk",
   "peerDependencies": {
-    "@aws-cdk/aws-iam": "1.13.1",
-    "@aws-cdk/aws-lambda": "1.13.1",
-    "@aws-cdk/aws-sns": "1.13.1",
-    "@aws-cdk/aws-sqs": "1.13.1",
-    "@aws-cdk/core": "1.13.1"
+    "@aws-cdk/aws-iam": "1.15.0",
+    "@aws-cdk/aws-lambda": "1.15.0",
+    "@aws-cdk/aws-sns": "1.15.0",
+    "@aws-cdk/aws-sqs": "1.15.0",
+    "@aws-cdk/core": "1.15.0"
   },
   "engines": {
     "node": ">= 10.3.0"
   },
-  "stability": "stable"
+  "stability": "stable",
+  "awslint": {
+    "exclude": [
+      "docs-public-apis:@aws-cdk/aws-sns-subscriptions.EmailSubscription.bind",
+      "docs-public-apis:@aws-cdk/aws-sns-subscriptions.LambdaSubscription.bind",
+      "docs-public-apis:@aws-cdk/aws-sns-subscriptions.SqsSubscription.bind",
+      "docs-public-apis:@aws-cdk/aws-sns-subscriptions.UrlSubscription.bind",
+      "docs-public-apis:@aws-cdk/aws-sns-subscriptions.SubscriptionProps"
+    ]
+  }
 }
diff --git a/packages/@aws-cdk/aws-sns/package.json b/packages/@aws-cdk/aws-sns/package.json
index b9c60641833af..5264288a1e978 100644
--- a/packages/@aws-cdk/aws-sns/package.json
+++ b/packages/@aws-cdk/aws-sns/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@aws-cdk/aws-sns",
-  "version": "1.13.1",
+  "version": "1.15.0",
   "description": "CDK Constructs for AWS SNS",
   "main": "lib/index.js",
   "types": "lib/index.d.ts",
@@ -66,25 +66,25 @@
   },
   "license": "Apache-2.0",
   "devDependencies": {
-    "@aws-cdk/assert": "1.13.1",
-    "@aws-cdk/aws-s3": "1.13.1",
-    "cdk-build-tools": "^1.13.1",
-    "cdk-integ-tools": "^1.13.1",
-    "cfn2ts": "^1.13.1",
-    "pkglint": "^1.13.1"
+    "@aws-cdk/assert": "1.15.0",
+    "@aws-cdk/aws-s3": "1.15.0",
+    "cdk-build-tools": "^1.15.0",
+    "cdk-integ-tools": "^1.15.0",
+    "cfn2ts": "^1.15.0",
+    "pkglint": "^1.15.0"
   },
   "dependencies": {
-    "@aws-cdk/aws-cloudwatch": "1.13.1",
-    "@aws-cdk/aws-events": "1.13.1",
-    "@aws-cdk/aws-iam": "1.13.1",
-    "@aws-cdk/core": "1.13.1"
+    "@aws-cdk/aws-cloudwatch": "1.15.0",
+    "@aws-cdk/aws-events": "1.15.0",
+    "@aws-cdk/aws-iam": "1.15.0",
+    "@aws-cdk/core": "1.15.0"
   },
   "homepage": "https://github.com/aws/aws-cdk",
   "peerDependencies": {
-    "@aws-cdk/aws-cloudwatch": "1.13.1",
-    "@aws-cdk/aws-events": "1.13.1",
-    "@aws-cdk/aws-iam": "1.13.1",
-    "@aws-cdk/core": "1.13.1"
+    "@aws-cdk/aws-cloudwatch": "1.15.0",
+    "@aws-cdk/aws-events": "1.15.0",
+    "@aws-cdk/aws-iam": "1.15.0",
+    "@aws-cdk/core": "1.15.0"
   },
   "engines": {
     "node": ">= 10.3.0"
@@ -93,7 +93,28 @@
     "exclude": [
       "construct-base-is-private:@aws-cdk/aws-sns.TopicBase",
       "props-physical-name:@aws-cdk/aws-sns.SubscriptionProps",
-      "props-physical-name:@aws-cdk/aws-sns.TopicPolicyProps"
+      "props-physical-name:@aws-cdk/aws-sns.TopicPolicyProps",
+      "docs-public-apis:@aws-cdk/aws-sns.ITopic.topicName",
+      "docs-public-apis:@aws-cdk/aws-sns.TopicPolicyProps",
+      "props-default-doc:@aws-cdk/aws-sns.StringConditions.whitelist",
+      "props-default-doc:@aws-cdk/aws-sns.StringConditions.matchPrefixes",
+      "props-default-doc:@aws-cdk/aws-sns.StringConditions.blacklist",
+      "docs-public-apis:@aws-cdk/aws-sns.SubscriptionFilter.conditions",
+      "docs-public-apis:@aws-cdk/aws-sns.Topic.topicArn",
+      "docs-public-apis:@aws-cdk/aws-sns.Topic.topicName",
+      "docs-public-apis:@aws-cdk/aws-sns.Topic.fromTopicArn",
+      "docs-public-apis:@aws-cdk/aws-sns.TopicBase.topicArn",
+      "docs-public-apis:@aws-cdk/aws-sns.TopicBase.topicName",
+      "docs-public-apis:@aws-cdk/aws-sns.ITopic",
+      "docs-public-apis:@aws-cdk/aws-sns.ITopic.topicArn",
+      "props-default-doc:@aws-cdk/aws-sns.NumericConditions.whitelist",
+      "docs-public-apis:@aws-cdk/aws-sns.ITopicSubscription.bind",
+      "props-default-doc:@aws-cdk/aws-sns.NumericConditions.between",
+      "props-default-doc:@aws-cdk/aws-sns.NumericConditions.betweenStrict",
+      "props-default-doc:@aws-cdk/aws-sns.NumericConditions.greaterThan",
+      "props-default-doc:@aws-cdk/aws-sns.NumericConditions.greaterThanOrEqualTo",
+      "props-default-doc:@aws-cdk/aws-sns.NumericConditions.lessThan",
+      "props-default-doc:@aws-cdk/aws-sns.NumericConditions.lessThanOrEqualTo"
     ]
   },
   "stability": "stable"
diff --git a/packages/@aws-cdk/aws-sqs/package.json b/packages/@aws-cdk/aws-sqs/package.json
index 228e43c443adc..f3fdf2b463b67 100644
--- a/packages/@aws-cdk/aws-sqs/package.json
+++ b/packages/@aws-cdk/aws-sqs/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@aws-cdk/aws-sqs",
-  "version": "1.13.1",
+  "version": "1.15.0",
   "description": "CDK Constructs for AWS SQS",
   "main": "lib/index.js",
   "types": "lib/index.d.ts",
@@ -63,25 +63,26 @@
   },
   "license": "Apache-2.0",
   "devDependencies": {
-    "@aws-cdk/assert": "1.13.1",
-    "@aws-cdk/aws-s3": "1.13.1",
-    "aws-sdk": "^2.553.0",
-    "cdk-build-tools": "^1.13.1",
-    "cdk-integ-tools": "^1.13.1",
-    "pkglint": "^1.13.1"
+    "@aws-cdk/assert": "1.15.0",
+    "@aws-cdk/aws-s3": "1.15.0",
+    "aws-sdk": "^2.558.0",
+    "cdk-build-tools": "^1.15.0",
+    "cdk-integ-tools": "^1.15.0",
+    "cfn2ts": "^1.15.0",
+    "pkglint": "^1.15.0"
   },
   "dependencies": {
-    "@aws-cdk/aws-cloudwatch": "1.13.1",
-    "@aws-cdk/aws-iam": "1.13.1",
-    "@aws-cdk/aws-kms": "1.13.1",
-    "@aws-cdk/core": "1.13.1"
+    "@aws-cdk/aws-cloudwatch": "1.15.0",
+    "@aws-cdk/aws-iam": "1.15.0",
+    "@aws-cdk/aws-kms": "1.15.0",
+    "@aws-cdk/core": "1.15.0"
   },
   "homepage": "https://github.com/aws/aws-cdk",
   "peerDependencies": {
-    "@aws-cdk/aws-cloudwatch": "1.13.1",
-    "@aws-cdk/aws-iam": "1.13.1",
-    "@aws-cdk/aws-kms": "1.13.1",
-    "@aws-cdk/core": "1.13.1"
+    "@aws-cdk/aws-cloudwatch": "1.15.0",
+    "@aws-cdk/aws-iam": "1.15.0",
+    "@aws-cdk/aws-kms": "1.15.0",
+    "@aws-cdk/core": "1.15.0"
   },
   "engines": {
     "node": ">= 10.3.0"
@@ -89,7 +90,12 @@
   "awslint": {
     "exclude": [
       "construct-base-is-private:@aws-cdk/aws-sqs.QueueBase",
-      "props-physical-name:@aws-cdk/aws-sqs.QueuePolicyProps"
+      "props-physical-name:@aws-cdk/aws-sqs.QueuePolicyProps",
+      "docs-public-apis:@aws-cdk/aws-sqs.Queue.fromQueueArn",
+      "docs-public-apis:@aws-cdk/aws-sqs.IQueue",
+      "props-default-doc:@aws-cdk/aws-sqs.QueueAttributes.keyArn",
+      "props-default-doc:@aws-cdk/aws-sqs.QueueAttributes.queueUrl",
+      "docs-public-apis:@aws-cdk/aws-sqs.QueuePolicyProps"
     ]
   },
   "stability": "stable"
diff --git a/packages/@aws-cdk/aws-ssm/lib/parameter.ts b/packages/@aws-cdk/aws-ssm/lib/parameter.ts
index 5f848a9984906..4cbbabacdcffd 100644
--- a/packages/@aws-cdk/aws-ssm/lib/parameter.ts
+++ b/packages/@aws-cdk/aws-ssm/lib/parameter.ts
@@ -444,10 +444,18 @@ function makeIdentityForImportedValue(parameterName: string) {
 }
 
 function arnForParameterName(scope: IConstruct, parameterName: string): string {
+
+  // remove trailing "/" if we can resolve parameter name.
+  if (!Token.isUnresolved(parameterName)) {
+    if (parameterName.startsWith('/')) {
+      parameterName = parameterName.substr(1);
+    }
+  }
+
   return Stack.of(scope).formatArn({
     service: 'ssm',
     resource: 'parameter',
-    sep: '', // Sep is empty because this.parameterName starts with a / already!
+    sep: '/', // Sep is empty because this.parameterName starts with a / already!
     resourceName: parameterName,
   });
 }
diff --git a/packages/@aws-cdk/aws-ssm/package.json b/packages/@aws-cdk/aws-ssm/package.json
index b120194bd40f2..ece58e00a6838 100644
--- a/packages/@aws-cdk/aws-ssm/package.json
+++ b/packages/@aws-cdk/aws-ssm/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@aws-cdk/aws-ssm",
-  "version": "1.13.1",
+  "version": "1.15.0",
   "description": "The CDK Construct Library for AWS::SSM",
   "main": "lib/index.js",
   "types": "lib/index.d.ts",
@@ -63,24 +63,24 @@
   },
   "license": "Apache-2.0",
   "devDependencies": {
-    "@aws-cdk/assert": "1.13.1",
-    "cdk-build-tools": "^1.13.1",
-    "cdk-integ-tools": "^1.13.1",
-    "cfn2ts": "^1.13.1",
-    "pkglint": "^1.13.1"
+    "@aws-cdk/assert": "1.15.0",
+    "cdk-build-tools": "^1.15.0",
+    "cdk-integ-tools": "^1.15.0",
+    "cfn2ts": "^1.15.0",
+    "pkglint": "^1.15.0"
   },
   "dependencies": {
-    "@aws-cdk/aws-iam": "1.13.1",
-    "@aws-cdk/aws-kms": "1.13.1",
-    "@aws-cdk/core": "1.13.1",
-    "@aws-cdk/cx-api": "1.13.1"
+    "@aws-cdk/aws-iam": "1.15.0",
+    "@aws-cdk/aws-kms": "1.15.0",
+    "@aws-cdk/core": "1.15.0",
+    "@aws-cdk/cx-api": "1.15.0"
   },
   "homepage": "https://github.com/aws/aws-cdk",
   "peerDependencies": {
-    "@aws-cdk/aws-iam": "1.13.1",
-    "@aws-cdk/aws-kms": "1.13.1",
-    "@aws-cdk/core": "1.13.1",
-    "@aws-cdk/cx-api": "1.13.1"
+    "@aws-cdk/aws-iam": "1.15.0",
+    "@aws-cdk/aws-kms": "1.15.0",
+    "@aws-cdk/core": "1.15.0",
+    "@aws-cdk/cx-api": "1.15.0"
   },
   "engines": {
     "node": ">= 10.3.0"
@@ -93,7 +93,11 @@
       "from-attributes:fromStringParameterAttributes",
       "from-attributes:fromStringListParameterAttributes",
       "props-physical-name:@aws-cdk/aws-ssm.StringListParameterProps",
-      "props-physical-name:@aws-cdk/aws-ssm.StringParameterProps"
+      "props-physical-name:@aws-cdk/aws-ssm.StringParameterProps",
+      "docs-public-apis:@aws-cdk/aws-ssm.StringParameterAttributes",
+      "docs-public-apis:@aws-cdk/aws-ssm.SecureStringParameterAttributes",
+      "docs-public-apis:@aws-cdk/aws-ssm.StringParameter.encryptionKey",
+      "docs-public-apis:@aws-cdk/aws-ssm.StringListParameter.encryptionKey"
     ]
   },
   "stability": "stable"
diff --git a/packages/@aws-cdk/aws-ssm/test/integ.parameter.lit.expected.json b/packages/@aws-cdk/aws-ssm/test/integ.parameter.lit.expected.json
index ee9c0735a975b..2068dd41957f6 100644
--- a/packages/@aws-cdk/aws-ssm/test/integ.parameter.lit.expected.json
+++ b/packages/@aws-cdk/aws-ssm/test/integ.parameter.lit.expected.json
@@ -61,7 +61,7 @@
                     {
                       "Ref": "AWS::AccountId"
                     },
-                    ":parameter",
+                    ":parameter/",
                     {
                       "Ref": "StringParameter472EED0E"
                     }
@@ -113,6 +113,31 @@
           }
         ]
       }
+    },
+    "ParamArn": {
+      "Value": {
+        "Fn::Join": [
+          "",
+          [
+            "arn:",
+            {
+              "Ref": "AWS::Partition"
+            },
+            ":ssm:",
+            {
+              "Ref": "AWS::Region"
+            },
+            ":",
+            {
+              "Ref": "AWS::AccountId"
+            },
+            ":parameter/",
+            {
+              "Ref": "StringParameter472EED0E"
+            }
+          ]
+        ]
+      }
     }
   }
-}
+}
\ No newline at end of file
diff --git a/packages/@aws-cdk/aws-ssm/test/integ.parameter.lit.ts b/packages/@aws-cdk/aws-ssm/test/integ.parameter.lit.ts
index 448a30623bd74..dbd6b41b44d52 100644
--- a/packages/@aws-cdk/aws-ssm/test/integ.parameter.lit.ts
+++ b/packages/@aws-cdk/aws-ssm/test/integ.parameter.lit.ts
@@ -34,4 +34,8 @@ new cdk.CfnOutput(stack, 'StringListOutput', {
   value: cdk.Fn.join('+', listParameter.stringListValue),
 });
 
+new cdk.CfnOutput(stack, 'ParamArn', {
+  value: param.parameterArn
+});
+
 app.synth();
diff --git a/packages/@aws-cdk/aws-ssm/test/test.parameter.ts b/packages/@aws-cdk/aws-ssm/test/test.parameter.ts
index 722f25a1eaf27..6889bcdd743f8 100644
--- a/packages/@aws-cdk/aws-ssm/test/test.parameter.ts
+++ b/packages/@aws-cdk/aws-ssm/test/test.parameter.ts
@@ -2,7 +2,7 @@ import { expect, haveResource } from '@aws-cdk/assert';
 import iam = require('@aws-cdk/aws-iam');
 import kms = require('@aws-cdk/aws-kms');
 import cdk = require('@aws-cdk/core');
-import { App, Stack } from '@aws-cdk/core';
+import { App, CfnParameter, Stack } from '@aws-cdk/core';
 import { Test } from 'nodeunit';
 import ssm = require('../lib');
 
@@ -123,7 +123,7 @@ export = {
         { Ref: 'AWS::Region' },
         ':',
         { Ref: 'AWS::AccountId' },
-        ':parameter',
+        ':parameter/',
         { Ref: 'Parameter9E1B4FBA' }
       ]]
     });
@@ -146,7 +146,7 @@ export = {
         { Ref: 'AWS::Region' },
         ':',
         { Ref: 'AWS::AccountId' },
-        ':parameterMyParamName' ] ]
+        ':parameter/MyParamName' ] ]
     });
     test.deepEqual(stack.resolve(param.parameterName), 'MyParamName');
     test.deepEqual(stack.resolve(param.parameterType), 'String');
@@ -181,7 +181,7 @@ export = {
         { Ref: 'AWS::Region' },
         ':',
         { Ref: 'AWS::AccountId' },
-        ':parameterMyParamName' ] ]
+        ':parameter/MyParamName' ] ]
     });
     test.deepEqual(stack.resolve(param.parameterName), 'MyParamName');
     test.deepEqual(stack.resolve(param.parameterType), 'String');
@@ -208,7 +208,7 @@ export = {
         { Ref: 'AWS::Region' },
         ':',
         { Ref: 'AWS::AccountId' },
-        ':parameterMyParamName' ] ]
+        ':parameter/MyParamName' ] ]
     });
     test.deepEqual(stack.resolve(param.parameterName), 'MyParamName');
     test.deepEqual(stack.resolve(param.parameterType), 'SecureString');
@@ -265,7 +265,7 @@ export = {
                   {
                     Ref: 'AWS::AccountId'
                   },
-                  ':parameterMyParamName'
+                  ':parameter/MyParamName'
                 ]
               ]
             }
@@ -326,7 +326,7 @@ export = {
                   {
                     Ref: 'AWS::AccountId'
                   },
-                  ':parameterMyParamName'
+                  ':parameter/MyParamName'
                 ]
               ]
             }
@@ -355,7 +355,7 @@ export = {
         { Ref: 'AWS::Region' },
         ':',
         { Ref: 'AWS::AccountId' },
-        ':parameterMyParamName' ] ]
+        ':parameter/MyParamName' ] ]
     });
     test.deepEqual(stack.resolve(param.parameterName), 'MyParamName');
     test.deepEqual(stack.resolve(param.parameterType), 'StringList');
@@ -445,5 +445,43 @@ export = {
 
       test.done();
     },
+  },
+
+  'rendering of parameter arns'(test: Test) {
+    const stack = new Stack();
+    const param = new CfnParameter(stack, 'param');
+    const expectedA = { 'Fn::Join': [ '', [ 'arn:', { Ref: 'AWS::Partition' }, ':ssm:', { Ref: 'AWS::Region' }, ':', { Ref: 'AWS::AccountId' }, ':parameter/bam' ] ] };
+    const expectedB = { 'Fn::Join': [ '', [ 'arn:', { Ref: 'AWS::Partition' }, ':ssm:', { Ref: 'AWS::Region' }, ':', { Ref: 'AWS::AccountId' }, ':parameter/', { Ref: 'param' } ] ] };
+    let i = 0;
+
+    // WHEN
+    const case1 = ssm.StringParameter.fromStringParameterName(stack, `p${i++}`, 'bam');
+    const case2 = ssm.StringParameter.fromStringParameterName(stack, `p${i++}`, '/bam');
+    const case3 = ssm.StringParameter.fromStringParameterName(stack, `p${i++}`, param.valueAsString);
+    const case4 = ssm.StringParameter.fromStringParameterAttributes(stack, `p${i++}`, { parameterName: 'bam' });
+    const case5 = ssm.StringParameter.fromStringParameterAttributes(stack, `p${i++}`, { parameterName: '/bam' });
+    const case6 = ssm.StringParameter.fromStringParameterAttributes(stack, `p${i++}`, { parameterName: param.valueAsString });
+    const case7 = ssm.StringParameter.fromSecureStringParameterAttributes(stack, `p${i++}`, { parameterName: 'bam', version: 10 });
+    const case8 = ssm.StringParameter.fromSecureStringParameterAttributes(stack, `p${i++}`, { parameterName: '/bam', version: 10 });
+    const case9 = ssm.StringParameter.fromSecureStringParameterAttributes(stack, `p${i++}`, { parameterName: param.valueAsString, version: 10 });
+    const case10 = new ssm.StringParameter(stack, `p${i++}`, { stringValue: 'value' });
+
+    // THEN
+    test.deepEqual(stack.resolve(case1.parameterArn), expectedA);
+    test.deepEqual(stack.resolve(case2.parameterArn), expectedA);
+    test.deepEqual(stack.resolve(case3.parameterArn), expectedB);
+    test.deepEqual(stack.resolve(case4.parameterArn), expectedA);
+    test.deepEqual(stack.resolve(case5.parameterArn), expectedA);
+    test.deepEqual(stack.resolve(case6.parameterArn), expectedB);
+    test.deepEqual(stack.resolve(case7.parameterArn), expectedA);
+    test.deepEqual(stack.resolve(case8.parameterArn), expectedA);
+    test.deepEqual(stack.resolve(case9.parameterArn), expectedB);
+    test.deepEqual(stack.resolve(case10.parameterArn), {
+      'Fn::Join': [ '', [
+        'arn:', { Ref: 'AWS::Partition' }, ':ssm:', { Ref: 'AWS::Region' }, ':', { Ref: 'AWS::AccountId' }, ':parameter/', { Ref: 'p97A508212' }
+      ]
+    ] });
+
+    test.done();
   }
 };
diff --git a/packages/@aws-cdk/aws-stepfunctions-tasks/lib/publish-to-topic.ts b/packages/@aws-cdk/aws-stepfunctions-tasks/lib/publish-to-topic.ts
index dc8ea7bae7a4c..3f24d5f87565f 100644
--- a/packages/@aws-cdk/aws-stepfunctions-tasks/lib/publish-to-topic.ts
+++ b/packages/@aws-cdk/aws-stepfunctions-tasks/lib/publish-to-topic.ts
@@ -1,7 +1,7 @@
 import iam = require('@aws-cdk/aws-iam');
 import sns = require('@aws-cdk/aws-sns');
 import sfn = require('@aws-cdk/aws-stepfunctions');
-import { resourceArnSuffix } from './resource-arn-suffix';
+import { getResourceArn } from './resource-arn-suffix';
 
 /**
  * Properties for PublishTask
@@ -70,7 +70,7 @@ export class PublishToTopic implements sfn.IStepFunctionsTask {
 
   public bind(_task: sfn.Task): sfn.StepFunctionsTaskConfig {
     return {
-      resourceArn: 'arn:aws:states:::sns:publish' + resourceArnSuffix.get(this.integrationPattern),
+      resourceArn: getResourceArn("sns", "publish", this.integrationPattern),
       policyStatements: [new iam.PolicyStatement({
         actions: ['sns:Publish'],
         resources: [this.topic.topicArn]
diff --git a/packages/@aws-cdk/aws-stepfunctions-tasks/lib/resource-arn-suffix.ts b/packages/@aws-cdk/aws-stepfunctions-tasks/lib/resource-arn-suffix.ts
index be7d81e8fef78..d49d9a529eef8 100644
--- a/packages/@aws-cdk/aws-stepfunctions-tasks/lib/resource-arn-suffix.ts
+++ b/packages/@aws-cdk/aws-stepfunctions-tasks/lib/resource-arn-suffix.ts
@@ -1,4 +1,5 @@
 import sfn = require('@aws-cdk/aws-stepfunctions');
+import { Aws } from '@aws-cdk/core';
 
 /**
  * Suffixes corresponding to different service integration patterns
@@ -12,4 +13,10 @@ resourceArnSuffix.set(sfn.ServiceIntegrationPattern.FIRE_AND_FORGET, "");
 resourceArnSuffix.set(sfn.ServiceIntegrationPattern.SYNC, ".sync");
 resourceArnSuffix.set(sfn.ServiceIntegrationPattern.WAIT_FOR_TASK_TOKEN, ".waitForTaskToken");
 
-export { resourceArnSuffix };
\ No newline at end of file
+export function getResourceArn(service: string, api: string, integrationPattern: sfn.ServiceIntegrationPattern): string {
+    if (!service || !api) {
+        throw new Error("Both 'service' and 'api' must be provided to build the resource ARN.");
+    }
+    return `arn:${Aws.PARTITION}:states:::${service}:${api}` +
+        (integrationPattern ? resourceArnSuffix.get(integrationPattern) : "");
+}
diff --git a/packages/@aws-cdk/aws-stepfunctions-tasks/lib/run-ecs-task-base.ts b/packages/@aws-cdk/aws-stepfunctions-tasks/lib/run-ecs-task-base.ts
index 379bd8acfc9da..acba56c3c2e1e 100644
--- a/packages/@aws-cdk/aws-stepfunctions-tasks/lib/run-ecs-task-base.ts
+++ b/packages/@aws-cdk/aws-stepfunctions-tasks/lib/run-ecs-task-base.ts
@@ -4,7 +4,7 @@ import iam = require('@aws-cdk/aws-iam');
 import sfn = require('@aws-cdk/aws-stepfunctions');
 import cdk = require('@aws-cdk/core');
 import { Stack } from '@aws-cdk/core';
-import { resourceArnSuffix } from './resource-arn-suffix';
+import { getResourceArn } from './resource-arn-suffix';
 import { ContainerOverride } from './run-ecs-task-base-types';
 
 /**
@@ -104,7 +104,7 @@ export class EcsRunTaskBase implements ec2.IConnectable, sfn.IStepFunctionsTask
     }
 
     return {
-      resourceArn: 'arn:aws:states:::ecs:runTask' + resourceArnSuffix.get(this.integrationPattern),
+      resourceArn: getResourceArn("ecs", "runTask", this.integrationPattern),
       parameters: {
         Cluster: this.props.cluster.clusterArn,
         TaskDefinition: this.props.taskDefinition.taskDefinitionArn,
diff --git a/packages/@aws-cdk/aws-stepfunctions-tasks/lib/run-lambda-task.ts b/packages/@aws-cdk/aws-stepfunctions-tasks/lib/run-lambda-task.ts
index 5d58164a641d8..45f60b0e565ab 100644
--- a/packages/@aws-cdk/aws-stepfunctions-tasks/lib/run-lambda-task.ts
+++ b/packages/@aws-cdk/aws-stepfunctions-tasks/lib/run-lambda-task.ts
@@ -1,7 +1,7 @@
 import iam = require('@aws-cdk/aws-iam');
 import lambda = require('@aws-cdk/aws-lambda');
 import sfn = require('@aws-cdk/aws-stepfunctions');
-import { resourceArnSuffix } from './resource-arn-suffix';
+import { getResourceArn } from './resource-arn-suffix';
 
 /**
  * Properties for RunLambdaTask
@@ -79,10 +79,8 @@ export class RunLambdaTask implements sfn.IStepFunctionsTask {
   }
 
   public bind(_task: sfn.Task): sfn.StepFunctionsTaskConfig {
-    const resourceArn = 'arn:aws:states:::lambda:invoke' + resourceArnSuffix.get(this.integrationPattern);
-
     return {
-      resourceArn,
+      resourceArn: getResourceArn("lambda", "invoke", this.integrationPattern),
       policyStatements: [new iam.PolicyStatement({
         resources: [this.lambdaFunction.functionArn],
         actions: ["lambda:InvokeFunction"],
diff --git a/packages/@aws-cdk/aws-stepfunctions-tasks/lib/sagemaker-train-task.ts b/packages/@aws-cdk/aws-stepfunctions-tasks/lib/sagemaker-train-task.ts
index 63e17a8fda208..d123bcff64eb2 100644
--- a/packages/@aws-cdk/aws-stepfunctions-tasks/lib/sagemaker-train-task.ts
+++ b/packages/@aws-cdk/aws-stepfunctions-tasks/lib/sagemaker-train-task.ts
@@ -2,7 +2,7 @@ import ec2 = require('@aws-cdk/aws-ec2');
 import iam = require('@aws-cdk/aws-iam');
 import sfn = require('@aws-cdk/aws-stepfunctions');
 import { Duration, Lazy, Stack } from '@aws-cdk/core';
-import { resourceArnSuffix } from './resource-arn-suffix';
+import { getResourceArn } from './resource-arn-suffix';
 import { AlgorithmSpecification, Channel, InputMode, OutputDataConfig, ResourceConfig,
          S3DataType, StoppingCondition, VpcConfig,  } from './sagemaker-task-base-types';
 
@@ -251,7 +251,7 @@ export class SagemakerTrainTask implements iam.IGrantable, ec2.IConnectable, sfn
         }
 
         return {
-          resourceArn: 'arn:aws:states:::sagemaker:createTrainingJob' + resourceArnSuffix.get(this.integrationPattern),
+          resourceArn: getResourceArn("sagemaker", "createTrainingJob", this.integrationPattern),
           parameters: this.renderParameters(),
           policyStatements: this.makePolicyStatements(task),
         };
diff --git a/packages/@aws-cdk/aws-stepfunctions-tasks/lib/sagemaker-transform-task.ts b/packages/@aws-cdk/aws-stepfunctions-tasks/lib/sagemaker-transform-task.ts
index 33a2ccc90ef66..198e8e362a4a0 100644
--- a/packages/@aws-cdk/aws-stepfunctions-tasks/lib/sagemaker-transform-task.ts
+++ b/packages/@aws-cdk/aws-stepfunctions-tasks/lib/sagemaker-transform-task.ts
@@ -2,7 +2,7 @@ import ec2 = require('@aws-cdk/aws-ec2');
 import iam = require('@aws-cdk/aws-iam');
 import sfn = require('@aws-cdk/aws-stepfunctions');
 import { Stack } from '@aws-cdk/core';
-import { resourceArnSuffix } from './resource-arn-suffix';
+import { getResourceArn } from './resource-arn-suffix';
 import { BatchStrategy, S3DataType, TransformInput, TransformOutput, TransformResources } from './sagemaker-task-base-types';
 
 /**
@@ -141,7 +141,7 @@ export class SagemakerTransformTask implements sfn.IStepFunctionsTask {
         }
 
         return {
-          resourceArn: 'arn:aws:states:::sagemaker:createTransformJob' + resourceArnSuffix.get(this.integrationPattern),
+          resourceArn: getResourceArn("sagemaker", "createTransformJob", this.integrationPattern),
           parameters: this.renderParameters(),
           policyStatements: this.makePolicyStatements(task),
         };
diff --git a/packages/@aws-cdk/aws-stepfunctions-tasks/lib/send-to-queue.ts b/packages/@aws-cdk/aws-stepfunctions-tasks/lib/send-to-queue.ts
index 4395168cc5935..3b0977e24de2e 100644
--- a/packages/@aws-cdk/aws-stepfunctions-tasks/lib/send-to-queue.ts
+++ b/packages/@aws-cdk/aws-stepfunctions-tasks/lib/send-to-queue.ts
@@ -2,7 +2,7 @@ import iam = require('@aws-cdk/aws-iam');
 import sqs = require('@aws-cdk/aws-sqs');
 import sfn = require('@aws-cdk/aws-stepfunctions');
 import { Duration } from '@aws-cdk/core';
-import { resourceArnSuffix } from './resource-arn-suffix';
+import { getResourceArn } from './resource-arn-suffix';
 
 /**
  * Properties for SendMessageTask
@@ -80,7 +80,7 @@ export class SendToQueue implements sfn.IStepFunctionsTask {
 
   public bind(_task: sfn.Task): sfn.StepFunctionsTaskConfig {
     return {
-      resourceArn: 'arn:aws:states:::sqs:sendMessage' + resourceArnSuffix.get(this.integrationPattern),
+      resourceArn: getResourceArn("sqs", "sendMessage", this.integrationPattern),
       policyStatements: [new iam.PolicyStatement({
         actions: ['sqs:SendMessage'],
         resources: [this.queue.queueArn]
diff --git a/packages/@aws-cdk/aws-stepfunctions-tasks/lib/start-execution.ts b/packages/@aws-cdk/aws-stepfunctions-tasks/lib/start-execution.ts
index 9c824e33b4c9c..04cfaf4941b11 100644
--- a/packages/@aws-cdk/aws-stepfunctions-tasks/lib/start-execution.ts
+++ b/packages/@aws-cdk/aws-stepfunctions-tasks/lib/start-execution.ts
@@ -1,7 +1,7 @@
 import iam = require('@aws-cdk/aws-iam');
 import sfn = require('@aws-cdk/aws-stepfunctions');
 import { Stack } from '@aws-cdk/core';
-import { resourceArnSuffix } from './resource-arn-suffix';
+import { getResourceArn } from './resource-arn-suffix';
 
 /**
  * Properties for StartExecution
@@ -59,10 +59,8 @@ export class StartExecution implements sfn.IStepFunctionsTask {
   }
 
   public bind(task: sfn.Task): sfn.StepFunctionsTaskConfig {
-    const resourceArn = 'arn:aws:states:::states:startExecution' + resourceArnSuffix.get(this.integrationPattern);
-
     return {
-      resourceArn,
+      resourceArn: getResourceArn("states", "startExecution", this.integrationPattern),
       policyStatements: this.createScopedAccessPolicy(task),
       parameters: {
         Input: this.props.input,
diff --git a/packages/@aws-cdk/aws-stepfunctions-tasks/package.json b/packages/@aws-cdk/aws-stepfunctions-tasks/package.json
index 57744505abf0c..f890e3d00f235 100644
--- a/packages/@aws-cdk/aws-stepfunctions-tasks/package.json
+++ b/packages/@aws-cdk/aws-stepfunctions-tasks/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@aws-cdk/aws-stepfunctions-tasks",
-  "version": "1.13.1",
+  "version": "1.15.0",
   "description": "Task integrations for AWS StepFunctions",
   "main": "lib/index.js",
   "types": "lib/index.d.ts",
@@ -74,47 +74,107 @@
   },
   "license": "Apache-2.0",
   "devDependencies": {
-    "@aws-cdk/assert": "1.13.1",
-    "cdk-build-tools": "^1.13.1",
-    "cdk-integ-tools": "^1.13.1",
+    "@aws-cdk/assert": "1.15.0",
+    "cdk-build-tools": "^1.15.0",
+    "cdk-integ-tools": "^1.15.0",
     "jest": "^24.9.0",
-    "pkglint": "^1.13.1"
+    "pkglint": "^1.15.0"
   },
   "dependencies": {
-    "@aws-cdk/assets": "1.13.1",
-    "@aws-cdk/aws-cloudwatch": "1.13.1",
-    "@aws-cdk/aws-ec2": "1.13.1",
-    "@aws-cdk/aws-ecr": "1.13.1",
-    "@aws-cdk/aws-ecr-assets": "1.13.1",
-    "@aws-cdk/aws-ecs": "1.13.1",
-    "@aws-cdk/aws-iam": "1.13.1",
-    "@aws-cdk/aws-kms": "1.13.1",
-    "@aws-cdk/aws-lambda": "1.13.1",
-    "@aws-cdk/aws-s3": "1.13.1",
-    "@aws-cdk/aws-sns": "1.13.1",
-    "@aws-cdk/aws-sqs": "1.13.1",
-    "@aws-cdk/aws-stepfunctions": "1.13.1",
-    "@aws-cdk/core": "1.13.1"
+    "@aws-cdk/assets": "1.15.0",
+    "@aws-cdk/aws-cloudwatch": "1.15.0",
+    "@aws-cdk/aws-ec2": "1.15.0",
+    "@aws-cdk/aws-ecr": "1.15.0",
+    "@aws-cdk/aws-ecr-assets": "1.15.0",
+    "@aws-cdk/aws-ecs": "1.15.0",
+    "@aws-cdk/aws-iam": "1.15.0",
+    "@aws-cdk/aws-kms": "1.15.0",
+    "@aws-cdk/aws-lambda": "1.15.0",
+    "@aws-cdk/aws-s3": "1.15.0",
+    "@aws-cdk/aws-sns": "1.15.0",
+    "@aws-cdk/aws-sqs": "1.15.0",
+    "@aws-cdk/aws-stepfunctions": "1.15.0",
+    "@aws-cdk/core": "1.15.0"
   },
   "homepage": "https://github.com/aws/aws-cdk",
   "peerDependencies": {
-    "@aws-cdk/assets": "1.13.1",
-    "@aws-cdk/aws-cloudwatch": "1.13.1",
-    "@aws-cdk/aws-ec2": "1.13.1",
-    "@aws-cdk/aws-ecr": "1.13.1",
-    "@aws-cdk/aws-ecr-assets": "1.13.1",
-    "@aws-cdk/aws-ecs": "1.13.1",
-    "@aws-cdk/aws-iam": "1.13.1",
-    "@aws-cdk/aws-kms": "1.13.1",
-    "@aws-cdk/aws-lambda": "1.13.1",
-    "@aws-cdk/aws-s3": "1.13.1",
-    "@aws-cdk/aws-sns": "1.13.1",
-    "@aws-cdk/aws-sqs": "1.13.1",
-    "@aws-cdk/aws-stepfunctions": "1.13.1",
-    "@aws-cdk/core": "1.13.1"
+    "@aws-cdk/assets": "1.15.0",
+    "@aws-cdk/aws-cloudwatch": "1.15.0",
+    "@aws-cdk/aws-ec2": "1.15.0",
+    "@aws-cdk/aws-ecr": "1.15.0",
+    "@aws-cdk/aws-ecr-assets": "1.15.0",
+    "@aws-cdk/aws-ecs": "1.15.0",
+    "@aws-cdk/aws-iam": "1.15.0",
+    "@aws-cdk/aws-kms": "1.15.0",
+    "@aws-cdk/aws-lambda": "1.15.0",
+    "@aws-cdk/aws-s3": "1.15.0",
+    "@aws-cdk/aws-sns": "1.15.0",
+    "@aws-cdk/aws-sqs": "1.15.0",
+    "@aws-cdk/aws-stepfunctions": "1.15.0",
+    "@aws-cdk/core": "1.15.0"
   },
   "engines": {
     "node": ">= 10.3.0"
   },
-  "stability": "experimental"
+  "stability": "experimental",
+  "awslint": {
+    "exclude": [
+      "docs-public-apis:@aws-cdk/aws-stepfunctions-tasks.S3LocationConfig.uri",
+      "docs-public-apis:@aws-cdk/aws-stepfunctions-tasks.AlgorithmSpecification",
+      "props-default-doc:@aws-cdk/aws-stepfunctions-tasks.AlgorithmSpecification.metricDefinitions",
+      "props-default-doc:@aws-cdk/aws-stepfunctions-tasks.AlgorithmSpecification.trainingImage",
+      "props-default-doc:@aws-cdk/aws-stepfunctions-tasks.Channel.compressionType",
+      "props-default-doc:@aws-cdk/aws-stepfunctions-tasks.Channel.contentType",
+      "props-default-doc:@aws-cdk/aws-stepfunctions-tasks.Channel.inputMode",
+      "props-default-doc:@aws-cdk/aws-stepfunctions-tasks.Channel.recordWrapperType",
+      "props-default-doc:@aws-cdk/aws-stepfunctions-tasks.Channel.shuffleConfig",
+      "props-default-doc:@aws-cdk/aws-stepfunctions-tasks.CommonEcsRunTaskProps.containerOverrides",
+      "docs-public-apis:@aws-cdk/aws-stepfunctions-tasks.ContainerOverride",
+      "props-default-doc:@aws-cdk/aws-stepfunctions-tasks.ContainerOverride.cpu",
+      "props-default-doc:@aws-cdk/aws-stepfunctions-tasks.ContainerOverride.environment",
+      "props-default-doc:@aws-cdk/aws-stepfunctions-tasks.ContainerOverride.memoryLimit",
+      "props-default-doc:@aws-cdk/aws-stepfunctions-tasks.ContainerOverride.memoryReservation",
+      "props-default-doc:@aws-cdk/aws-stepfunctions-tasks.EcsRunTaskBaseProps.parameters",
+      "docs-public-apis:@aws-cdk/aws-stepfunctions-tasks.ISageMakerTask",
+      "docs-public-apis:@aws-cdk/aws-stepfunctions-tasks.OutputDataConfig",
+      "props-default-doc:@aws-cdk/aws-stepfunctions-tasks.OutputDataConfig.encryptionKey",
+      "props-default-doc:@aws-cdk/aws-stepfunctions-tasks.PublishToTopicProps.messagePerSubscriptionType",
+      "props-default-doc:@aws-cdk/aws-stepfunctions-tasks.PublishToTopicProps.subject",
+      "docs-public-apis:@aws-cdk/aws-stepfunctions-tasks.ResourceConfig",
+      "props-default-doc:@aws-cdk/aws-stepfunctions-tasks.ResourceConfig.volumeEncryptionKey",
+      "props-default-doc:@aws-cdk/aws-stepfunctions-tasks.RunLambdaTaskProps.payload",
+      "props-default-doc:@aws-cdk/aws-stepfunctions-tasks.S3DataSource.attributeNames",
+      "props-default-doc:@aws-cdk/aws-stepfunctions-tasks.S3DataSource.s3DataDistributionType",
+      "props-default-doc:@aws-cdk/aws-stepfunctions-tasks.S3DataSource.s3DataType",
+      "docs-public-apis:@aws-cdk/aws-stepfunctions-tasks.S3LocationConfig",
+      "props-default-doc:@aws-cdk/aws-stepfunctions-tasks.AlgorithmSpecification.algorithmName",
+      "docs-public-apis:@aws-cdk/aws-stepfunctions-tasks.SagemakerTrainTaskProps",
+      "props-default-doc:@aws-cdk/aws-stepfunctions-tasks.SagemakerTrainTaskProps.hyperparameters",
+      "props-default-doc:@aws-cdk/aws-stepfunctions-tasks.SagemakerTrainTaskProps.resourceConfig",
+      "props-default-doc:@aws-cdk/aws-stepfunctions-tasks.SagemakerTrainTaskProps.stoppingCondition",
+      "props-default-doc:@aws-cdk/aws-stepfunctions-tasks.SagemakerTrainTaskProps.tags",
+      "props-default-doc:@aws-cdk/aws-stepfunctions-tasks.SagemakerTrainTaskProps.vpcConfig",
+      "docs-public-apis:@aws-cdk/aws-stepfunctions-tasks.SagemakerTransformProps",
+      "props-default-doc:@aws-cdk/aws-stepfunctions-tasks.SagemakerTransformProps.batchStrategy",
+      "props-default-doc:@aws-cdk/aws-stepfunctions-tasks.SagemakerTransformProps.environment",
+      "props-default-doc:@aws-cdk/aws-stepfunctions-tasks.SagemakerTransformProps.maxConcurrentTransforms",
+      "props-default-doc:@aws-cdk/aws-stepfunctions-tasks.SagemakerTransformProps.maxPayloadInMB",
+      "props-default-doc:@aws-cdk/aws-stepfunctions-tasks.SagemakerTransformProps.role",
+      "props-default-doc:@aws-cdk/aws-stepfunctions-tasks.SagemakerTransformProps.tags",
+      "props-default-doc:@aws-cdk/aws-stepfunctions-tasks.SagemakerTransformProps.transformResources",
+      "props-default-doc:@aws-cdk/aws-stepfunctions-tasks.StartExecutionProps.input",
+      "props-default-doc:@aws-cdk/aws-stepfunctions-tasks.StartExecutionProps.name",
+      "docs-public-apis:@aws-cdk/aws-stepfunctions-tasks.StoppingCondition",
+      "props-default-doc:@aws-cdk/aws-stepfunctions-tasks.StoppingCondition.maxRuntime",
+      "props-default-doc:@aws-cdk/aws-stepfunctions-tasks.TransformInput.compressionType",
+      "props-default-doc:@aws-cdk/aws-stepfunctions-tasks.TransformInput.contentType",
+      "props-default-doc:@aws-cdk/aws-stepfunctions-tasks.TransformInput.splitType",
+      "props-default-doc:@aws-cdk/aws-stepfunctions-tasks.TransformOutput.accept",
+      "props-default-doc:@aws-cdk/aws-stepfunctions-tasks.TransformOutput.assembleWith",
+      "props-default-doc:@aws-cdk/aws-stepfunctions-tasks.TransformOutput.encryptionKey",
+      "props-default-doc:@aws-cdk/aws-stepfunctions-tasks.TransformResources.volumeKmsKeyId",
+      "docs-public-apis:@aws-cdk/aws-stepfunctions-tasks.VpcConfig",
+      "props-default-doc:@aws-cdk/aws-stepfunctions-tasks.VpcConfig.subnets"
+    ]
+  }
 }
diff --git a/packages/@aws-cdk/aws-stepfunctions-tasks/test/ecs-tasks.test.ts b/packages/@aws-cdk/aws-stepfunctions-tasks/test/ecs-tasks.test.ts
index f3a8669b915bb..f8c038d8ef2c7 100644
--- a/packages/@aws-cdk/aws-stepfunctions-tasks/test/ecs-tasks.test.ts
+++ b/packages/@aws-cdk/aws-stepfunctions-tasks/test/ecs-tasks.test.ts
@@ -104,7 +104,18 @@ test('Running a Fargate Task', () => {
         ],
       },
     },
-    Resource: "arn:aws:states:::ecs:runTask.sync",
+    Resource: {
+      "Fn::Join": [
+        "",
+        [
+          "arn:",
+          {
+            Ref: "AWS::Partition",
+          },
+          ":states:::ecs:runTask.sync",
+        ],
+      ],
+    },
     Type: "Task",
   });
 
@@ -193,7 +204,18 @@ test('Running an EC2 Task with bridge network', () => {
         ],
       },
     },
-    Resource: "arn:aws:states:::ecs:runTask.sync",
+    Resource: {
+      "Fn::Join": [
+        "",
+        [
+          "arn:",
+          {
+            Ref: "AWS::Partition",
+          },
+          ":states:::ecs:runTask.sync",
+        ],
+      ],
+    },
     Type: "Task",
   });
 
@@ -277,7 +299,18 @@ test('Running an EC2 Task with placement strategies', () => {
         { Type: "random", },
       ],
     },
-    Resource: "arn:aws:states:::ecs:runTask.sync",
+    Resource: {
+      "Fn::Join": [
+        "",
+        [
+          "arn:",
+          {
+            Ref: "AWS::Partition",
+          },
+          ":states:::ecs:runTask.sync",
+        ],
+      ],
+    },
     Type: "Task",
   });
 });
@@ -326,7 +359,18 @@ test('Running an EC2 Task with overridden number values', () => {
         ],
       },
     },
-    Resource: "arn:aws:states:::ecs:runTask.sync",
+    Resource: {
+      "Fn::Join": [
+        "",
+        [
+          "arn:",
+          {
+            Ref: "AWS::Partition",
+          },
+          ":states:::ecs:runTask.sync",
+        ],
+      ],
+    },
     Type: "Task",
   });
 });
diff --git a/packages/@aws-cdk/aws-stepfunctions-tasks/test/integ.ec2-task.expected.json b/packages/@aws-cdk/aws-stepfunctions-tasks/test/integ.ec2-task.expected.json
index 803a5cad378ef..5ac5792327ff0 100644
--- a/packages/@aws-cdk/aws-stepfunctions-tasks/test/integ.ec2-task.expected.json
+++ b/packages/@aws-cdk/aws-stepfunctions-tasks/test/integ.ec2-task.expected.json
@@ -876,7 +876,11 @@
               {
                 "Ref": "TaskDef54694570"
               },
-              "\",\"Overrides\":{\"ContainerOverrides\":[{\"Name\":\"TheContainer\",\"Environment\":[{\"Name\":\"SOME_KEY\",\"Value.$\":\"$.SomeKey\"}]}]},\"LaunchType\":\"EC2\"},\"Type\":\"Task\",\"Resource\":\"arn:aws:states:::ecs:runTask.sync\"}}}"
+              "\",\"Overrides\":{\"ContainerOverrides\":[{\"Name\":\"TheContainer\",\"Environment\":[{\"Name\":\"SOME_KEY\",\"Value.$\":\"$.SomeKey\"}]}]},\"LaunchType\":\"EC2\"},\"Type\":\"Task\",\"Resource\":\"arn:",
+              {
+                "Ref": "AWS::Partition"
+              },
+              ":states:::ecs:runTask.sync\"}}}"
             ]
           ]
         },
diff --git a/packages/@aws-cdk/aws-stepfunctions-tasks/test/integ.fargate-task.expected.json b/packages/@aws-cdk/aws-stepfunctions-tasks/test/integ.fargate-task.expected.json
index 66af2f5913397..43d619e3598c9 100644
--- a/packages/@aws-cdk/aws-stepfunctions-tasks/test/integ.fargate-task.expected.json
+++ b/packages/@aws-cdk/aws-stepfunctions-tasks/test/integ.fargate-task.expected.json
@@ -475,7 +475,11 @@
                   "GroupId"
                 ]
               },
-              "\"]}},\"Overrides\":{\"ContainerOverrides\":[{\"Name\":\"TheContainer\",\"Environment\":[{\"Name\":\"SOME_KEY\",\"Value.$\":\"$.SomeKey\"}]}]},\"LaunchType\":\"FARGATE\"},\"Type\":\"Task\",\"Resource\":\"arn:aws:states:::ecs:runTask.sync\"}}}"
+              "\"]}},\"Overrides\":{\"ContainerOverrides\":[{\"Name\":\"TheContainer\",\"Environment\":[{\"Name\":\"SOME_KEY\",\"Value.$\":\"$.SomeKey\"}]}]},\"LaunchType\":\"FARGATE\"},\"Type\":\"Task\",\"Resource\":\"arn:",
+                {
+                  "Ref": "AWS::Partition"
+                },
+                ":states:::ecs:runTask.sync\"}}}"
             ]
           ]
         },
diff --git a/packages/@aws-cdk/aws-stepfunctions-tasks/test/integ.invoke-function.expected.json b/packages/@aws-cdk/aws-stepfunctions-tasks/test/integ.invoke-function.expected.json
index af5ffe6b651d8..4a00555924632 100644
--- a/packages/@aws-cdk/aws-stepfunctions-tasks/test/integ.invoke-function.expected.json
+++ b/packages/@aws-cdk/aws-stepfunctions-tasks/test/integ.invoke-function.expected.json
@@ -252,7 +252,11 @@
               {
                 "Ref": "CallbackHandler4434C38D"
               },
-              "\",\"Payload\":{\"token.$\":\"$$.Task.Token\"}},\"Type\":\"Task\",\"Resource\":\"arn:aws:states:::lambda:invoke.waitForTaskToken\",\"ResultPath\":\"$.status\"},\"Job Complete?\":{\"Type\":\"Choice\",\"Choices\":[{\"Variable\":\"$.status\",\"StringEquals\":\"FAILED\",\"Next\":\"Job Failed\"},{\"Variable\":\"$.status\",\"StringEquals\":\"SUCCEEDED\",\"Next\":\"Final step\"}]},\"Job Failed\":{\"Type\":\"Fail\",\"Error\":\"DescribeJob returned FAILED\",\"Cause\":\"AWS Batch Job Failed\"},\"Final step\":{\"Type\":\"Pass\",\"End\":true}},\"TimeoutSeconds\":30}"
+              "\",\"Payload\":{\"token.$\":\"$$.Task.Token\"}},\"Type\":\"Task\",\"Resource\":\"arn:",
+                {
+                  "Ref": "AWS::Partition"
+                },
+                ":states:::lambda:invoke.waitForTaskToken\",\"ResultPath\":\"$.status\"},\"Job Complete?\":{\"Type\":\"Choice\",\"Choices\":[{\"Variable\":\"$.status\",\"StringEquals\":\"FAILED\",\"Next\":\"Job Failed\"},{\"Variable\":\"$.status\",\"StringEquals\":\"SUCCEEDED\",\"Next\":\"Final step\"}]},\"Job Failed\":{\"Type\":\"Fail\",\"Error\":\"DescribeJob returned FAILED\",\"Cause\":\"AWS Batch Job Failed\"},\"Final step\":{\"Type\":\"Pass\",\"End\":true}},\"TimeoutSeconds\":30}"
             ]
           ]
         },
diff --git a/packages/@aws-cdk/aws-stepfunctions-tasks/test/integ.sagemaker.expected.json b/packages/@aws-cdk/aws-stepfunctions-tasks/test/integ.sagemaker.expected.json
index 0050a0140a282..a1b42cd21b43d 100644
--- a/packages/@aws-cdk/aws-stepfunctions-tasks/test/integ.sagemaker.expected.json
+++ b/packages/@aws-cdk/aws-stepfunctions-tasks/test/integ.sagemaker.expected.json
@@ -376,7 +376,11 @@
               {
                 "Ref": "TrainingData3FDB6D34"
               },
-              "/result/\"},\"ResourceConfig\":{\"InstanceCount\":1,\"InstanceType\":\"ml.m4.xlarge\",\"VolumeSizeInGB\":10},\"StoppingCondition\":{\"MaxRuntimeInSeconds\":3600}},\"Type\":\"Task\",\"Resource\":\"arn:aws:states:::sagemaker:createTrainingJob\"}}}"
+              "/result/\"},\"ResourceConfig\":{\"InstanceCount\":1,\"InstanceType\":\"ml.m4.xlarge\",\"VolumeSizeInGB\":10},\"StoppingCondition\":{\"MaxRuntimeInSeconds\":3600}},\"Type\":\"Task\",\"Resource\":\"arn:",
+              {
+                "Ref": "AWS::Partition"
+              },
+              ":states:::sagemaker:createTrainingJob\"}}}"
             ]
           ]
         },
diff --git a/packages/@aws-cdk/aws-stepfunctions-tasks/test/publish-to-topic.test.ts b/packages/@aws-cdk/aws-stepfunctions-tasks/test/publish-to-topic.test.ts
index 18a0bf421ff28..c3755314ff8b9 100644
--- a/packages/@aws-cdk/aws-stepfunctions-tasks/test/publish-to-topic.test.ts
+++ b/packages/@aws-cdk/aws-stepfunctions-tasks/test/publish-to-topic.test.ts
@@ -16,7 +16,18 @@ test('Publish literal message to SNS topic', () => {
   // THEN
   expect(stack.resolve(pub.toStateJson())).toEqual({
     Type: 'Task',
-    Resource: 'arn:aws:states:::sns:publish',
+    Resource: {
+      "Fn::Join": [
+        "",
+        [
+          "arn:",
+          {
+            Ref: "AWS::Partition",
+          },
+          ":states:::sns:publish",
+        ],
+      ],
+    },
     End: true,
     Parameters: {
       TopicArn: { Ref: 'TopicBFC7AF6E' },
@@ -42,7 +53,18 @@ test('Publish JSON to SNS topic with task token', () => {
   // THEN
   expect(stack.resolve(pub.toStateJson())).toEqual({
     Type: 'Task',
-    Resource: 'arn:aws:states:::sns:publish.waitForTaskToken',
+    Resource: {
+      "Fn::Join": [
+        "",
+        [
+          "arn:",
+          {
+            Ref: "AWS::Partition",
+          },
+          ":states:::sns:publish.waitForTaskToken",
+        ],
+      ],
+    },
     End: true,
     Parameters: {
       TopicArn: { Ref: 'TopicBFC7AF6E' },
@@ -81,7 +103,18 @@ test('Publish to topic with ARN from payload', () => {
   // THEN
   expect(stack.resolve(pub.toStateJson())).toEqual({
     Type: 'Task',
-    Resource: 'arn:aws:states:::sns:publish',
+    Resource: {
+      "Fn::Join": [
+        "",
+        [
+          "arn:",
+          {
+            Ref: "AWS::Partition",
+          },
+          ":states:::sns:publish",
+        ],
+      ],
+    },
     End: true,
     Parameters: {
       'TopicArn.$': '$.topicArn',
diff --git a/packages/@aws-cdk/aws-stepfunctions-tasks/test/run-lambda-task.test.ts b/packages/@aws-cdk/aws-stepfunctions-tasks/test/run-lambda-task.test.ts
index 61f452b84d556..3825306e1281d 100644
--- a/packages/@aws-cdk/aws-stepfunctions-tasks/test/run-lambda-task.test.ts
+++ b/packages/@aws-cdk/aws-stepfunctions-tasks/test/run-lambda-task.test.ts
@@ -30,14 +30,31 @@ test('Invoke lambda with default magic ARN', () => {
     definition: task
   });
 
-  expect(stack).toHaveResource('AWS::StepFunctions::StateMachine', {
-    DefinitionString: {
-      "Fn::Join": ["", [
-          "{\"StartAt\":\"Task\",\"States\":{\"Task\":{\"End\":true,\"Parameters\":{\"FunctionName\":\"",
-          { Ref: "Fn9270CBC0" },
-          "\",\"Payload\":{\"foo\":\"bar\"},\"InvocationType\":\"RequestResponse\",\"ClientContext\":\"eyJoZWxsbyI6IndvcmxkIn0=\","
-          + "\"Qualifier\":\"1\"},\"Type\":\"Task\",\"Resource\":\"arn:aws:states:::lambda:invoke\"}}}"
-      ]]
+  expect(stack.resolve(task.toStateJson())).toEqual({
+    Type: 'Task',
+    Resource: {
+      "Fn::Join": [
+        "",
+        [
+          "arn:",
+          {
+            Ref: "AWS::Partition",
+          },
+          ":states:::lambda:invoke",
+        ],
+      ],
+    },
+    End: true,
+    Parameters: {
+      FunctionName: {
+        Ref: "Fn9270CBC0"
+      },
+      Payload: {
+        foo: "bar"
+      },
+      InvocationType: "RequestResponse",
+      ClientContext: "eyJoZWxsbyI6IndvcmxkIn0=",
+      Qualifier: "1"
     },
   });
 });
@@ -55,13 +72,28 @@ test('Lambda function can be used in a Task with Task Token', () => {
     definition: task
   });
 
-  expect(stack).toHaveResource('AWS::StepFunctions::StateMachine', {
-    DefinitionString: {
-      "Fn::Join": ["", [
-          "{\"StartAt\":\"Task\",\"States\":{\"Task\":{\"End\":true,\"Parameters\":{\"FunctionName\":\"",
-          { Ref: "Fn9270CBC0" },
-          "\",\"Payload\":{\"token.$\":\"$$.Task.Token\"}},\"Type\":\"Task\",\"Resource\":\"arn:aws:states:::lambda:invoke.waitForTaskToken\"}}}"
-      ]]
+  expect(stack.resolve(task.toStateJson())).toEqual({
+    Type: 'Task',
+    Resource: {
+      "Fn::Join": [
+        "",
+        [
+          "arn:",
+          {
+            Ref: "AWS::Partition",
+          },
+          ":states:::lambda:invoke.waitForTaskToken",
+        ],
+      ],
+    },
+    End: true,
+    Parameters: {
+      FunctionName: {
+        Ref: "Fn9270CBC0"
+      },
+      Payload: {
+        "token.$": "$$.Task.Token"
+      }
     },
   });
 });
diff --git a/packages/@aws-cdk/aws-stepfunctions-tasks/test/sagemaker-training-job.test.ts b/packages/@aws-cdk/aws-stepfunctions-tasks/test/sagemaker-training-job.test.ts
index 9218b1f8d2c5e..5f203d206c4f9 100644
--- a/packages/@aws-cdk/aws-stepfunctions-tasks/test/sagemaker-training-job.test.ts
+++ b/packages/@aws-cdk/aws-stepfunctions-tasks/test/sagemaker-training-job.test.ts
@@ -40,7 +40,18 @@ test('create basic training job', () => {
     // THEN
     expect(stack.resolve(task.toStateJson())).toEqual({
       Type: 'Task',
-      Resource: 'arn:aws:states:::sagemaker:createTrainingJob',
+      Resource: {
+        "Fn::Join": [
+          "",
+          [
+            "arn:",
+            {
+              Ref: "AWS::Partition",
+            },
+            ":states:::sagemaker:createTrainingJob",
+          ],
+        ],
+      },
       End: true,
       Parameters: {
         AlgorithmSpecification: {
@@ -186,7 +197,18 @@ test('create complex training job', () => {
     // THEN
     expect(stack.resolve(task.toStateJson())).toEqual({
       Type: 'Task',
-      Resource: 'arn:aws:states:::sagemaker:createTrainingJob.sync',
+      Resource: {
+        "Fn::Join": [
+          "",
+          [
+            "arn:",
+            {
+              Ref: "AWS::Partition",
+            },
+            ":states:::sagemaker:createTrainingJob.sync",
+          ],
+        ],
+      },
       End: true,
       Parameters: {
         TrainingJobName: 'MyTrainJob',
@@ -306,7 +328,18 @@ test('pass param to training job', () => {
     // THEN
     expect(stack.resolve(task.toStateJson())).toEqual({
       Type: 'Task',
-      Resource: 'arn:aws:states:::sagemaker:createTrainingJob',
+      Resource: {
+        "Fn::Join": [
+          "",
+          [
+            "arn:",
+            {
+              Ref: "AWS::Partition",
+            },
+            ":states:::sagemaker:createTrainingJob",
+          ],
+        ],
+      },
       End: true,
       Parameters: {
         'TrainingJobName.$': '$.JobName',
diff --git a/packages/@aws-cdk/aws-stepfunctions-tasks/test/sagemaker-transform-job.test.ts b/packages/@aws-cdk/aws-stepfunctions-tasks/test/sagemaker-transform-job.test.ts
index e92fa9bb99ac1..2332309c4ec97 100644
--- a/packages/@aws-cdk/aws-stepfunctions-tasks/test/sagemaker-transform-job.test.ts
+++ b/packages/@aws-cdk/aws-stepfunctions-tasks/test/sagemaker-transform-job.test.ts
@@ -41,7 +41,18 @@ test('create basic transform job', () => {
     // THEN
     expect(stack.resolve(task.toStateJson())).toEqual({
       Type: 'Task',
-      Resource: 'arn:aws:states:::sagemaker:createTransformJob',
+      Resource: {
+        "Fn::Join": [
+          "",
+          [
+            "arn:",
+            {
+              Ref: "AWS::Partition",
+            },
+            ":states:::sagemaker:createTransformJob",
+          ],
+        ],
+      },
       End: true,
       Parameters: {
         TransformJobName: 'MyTransformJob',
@@ -124,7 +135,18 @@ test('create complex transform job', () => {
     // THEN
     expect(stack.resolve(task.toStateJson())).toEqual({
       Type: 'Task',
-      Resource: 'arn:aws:states:::sagemaker:createTransformJob.sync',
+      Resource: {
+        "Fn::Join": [
+          "",
+          [
+            "arn:",
+            {
+              Ref: "AWS::Partition",
+            },
+            ":states:::sagemaker:createTransformJob.sync",
+          ],
+        ],
+      },
       End: true,
       Parameters: {
         TransformJobName: 'MyTransformJob',
@@ -185,7 +207,18 @@ test('pass param to transform job', () => {
     // THEN
     expect(stack.resolve(task.toStateJson())).toEqual({
         Type: 'Task',
-        Resource: 'arn:aws:states:::sagemaker:createTransformJob',
+        Resource: {
+            "Fn::Join": [
+              "",
+              [
+                "arn:",
+                {
+                  Ref: "AWS::Partition",
+                },
+                ":states:::sagemaker:createTransformJob",
+              ],
+            ],
+        },
         End: true,
         Parameters: {
           'TransformJobName.$': '$.TransformJobName',
diff --git a/packages/@aws-cdk/aws-stepfunctions-tasks/test/send-to-queue.test.ts b/packages/@aws-cdk/aws-stepfunctions-tasks/test/send-to-queue.test.ts
index 323d1da5fe7f9..cdb3d08b24aed 100644
--- a/packages/@aws-cdk/aws-stepfunctions-tasks/test/send-to-queue.test.ts
+++ b/packages/@aws-cdk/aws-stepfunctions-tasks/test/send-to-queue.test.ts
@@ -22,7 +22,18 @@ test('Send message to queue', () => {
   // THEN
   expect(stack.resolve(task.toStateJson())).toEqual({
     Type: 'Task',
-    Resource: 'arn:aws:states:::sqs:sendMessage',
+    Resource: {
+      "Fn::Join": [
+        "",
+        [
+          "arn:",
+          {
+            Ref: "AWS::Partition",
+          },
+          ":states:::sqs:sendMessage",
+        ],
+      ],
+    },
     End: true,
     Parameters: {
       'QueueUrl': { Ref: 'Queue4A7E3555' },
@@ -45,7 +56,18 @@ test('Send message to SQS queue with task token', () => {
   // THEN
   expect(stack.resolve(task.toStateJson())).toEqual({
     Type: 'Task',
-    Resource: 'arn:aws:states:::sqs:sendMessage.waitForTaskToken',
+    Resource: {
+      "Fn::Join": [
+        "",
+        [
+          "arn:",
+          {
+            Ref: "AWS::Partition",
+          },
+          ":states:::sqs:sendMessage.waitForTaskToken",
+        ],
+      ],
+    },
     End: true,
     Parameters: {
       QueueUrl: { Ref: 'Queue4A7E3555' },
@@ -79,7 +101,18 @@ test('Message body can come from state', () => {
   // THEN
   expect(stack.resolve(task.toStateJson())).toEqual({
     Type: 'Task',
-    Resource: 'arn:aws:states:::sqs:sendMessage',
+    Resource: {
+      "Fn::Join": [
+        "",
+        [
+          "arn:",
+          {
+            Ref: "AWS::Partition",
+          },
+          ":states:::sqs:sendMessage",
+        ],
+      ],
+    },
     End: true,
     Parameters: {
       'QueueUrl': { Ref: 'Queue4A7E3555' },
@@ -102,7 +135,18 @@ test('Message body can be an object', () => {
   // THEN
   expect(stack.resolve(task.toStateJson())).toEqual({
     Type: 'Task',
-    Resource: 'arn:aws:states:::sqs:sendMessage',
+    Resource: {
+      "Fn::Join": [
+        "",
+        [
+          "arn:",
+          {
+            Ref: "AWS::Partition",
+          },
+          ":states:::sqs:sendMessage",
+        ],
+      ],
+    },
     End: true,
     Parameters: {
       QueueUrl: { Ref: 'Queue4A7E3555' },
@@ -127,7 +171,18 @@ test('Message body object can contain references', () => {
   // THEN
   expect(stack.resolve(task.toStateJson())).toEqual({
     Type: 'Task',
-    Resource: 'arn:aws:states:::sqs:sendMessage',
+    Resource: {
+      "Fn::Join": [
+        "",
+        [
+          "arn:",
+          {
+            Ref: "AWS::Partition",
+          },
+          ":states:::sqs:sendMessage",
+        ],
+      ],
+    },
     End: true,
     Parameters: {
       QueueUrl: { Ref: 'Queue4A7E3555' },
diff --git a/packages/@aws-cdk/aws-stepfunctions-tasks/test/start-execution.test.ts b/packages/@aws-cdk/aws-stepfunctions-tasks/test/start-execution.test.ts
index 900022641d0f1..e31ec5ad7cea4 100644
--- a/packages/@aws-cdk/aws-stepfunctions-tasks/test/start-execution.test.ts
+++ b/packages/@aws-cdk/aws-stepfunctions-tasks/test/start-execution.test.ts
@@ -26,13 +26,29 @@ test('Execute State Machine - Default - Fire and Forget', () => {
     definition: task
   });
 
-  expect(stack).toHaveResource('AWS::StepFunctions::StateMachine', {
-    DefinitionString: {
-      "Fn::Join": ["", [
-          "{\"StartAt\":\"ChildTask\",\"States\":{\"ChildTask\":{\"End\":true,\"Parameters\":{\"Input\":{\"foo\":\"bar\"},\"StateMachineArn\":\"",
-          { Ref: "ChildStateMachine9133117F" },
-          "\",\"Name\":\"myExecutionName\"},\"Type\":\"Task\",\"Resource\":\"arn:aws:states:::states:startExecution\"}}}"
-      ]]
+  expect(stack.resolve(task.toStateJson())).toEqual({
+    Type: 'Task',
+    Resource: {
+      "Fn::Join": [
+        "",
+        [
+          "arn:",
+          {
+            Ref: "AWS::Partition",
+          },
+          ":states:::states:startExecution",
+        ],
+      ],
+    },
+    End: true,
+    Parameters: {
+      Input: {
+        foo: "bar"
+       },
+      Name: 'myExecutionName',
+      StateMachineArn: {
+        Ref: "ChildStateMachine9133117F"
+      }
     },
   });
 });
@@ -48,13 +64,25 @@ test('Execute State Machine - Sync', () => {
     definition: task
   });
 
-  expect(stack).toHaveResource('AWS::StepFunctions::StateMachine', {
-    DefinitionString: {
-      "Fn::Join": ["", [
-          "{\"StartAt\":\"ChildTask\",\"States\":{\"ChildTask\":{\"End\":true,\"Parameters\":{\"StateMachineArn\":\"",
-          { Ref: "ChildStateMachine9133117F" },
-          "\"},\"Type\":\"Task\",\"Resource\":\"arn:aws:states:::states:startExecution.sync\"}}}"
-      ]]
+  expect(stack.resolve(task.toStateJson())).toEqual({
+    Type: 'Task',
+    Resource: {
+      "Fn::Join": [
+        "",
+        [
+          "arn:",
+          {
+            Ref: "AWS::Partition",
+          },
+          ":states:::states:startExecution.sync",
+        ],
+      ],
+    },
+    End: true,
+    Parameters: {
+      StateMachineArn: {
+        Ref: "ChildStateMachine9133117F"
+      }
     },
   });
 });
@@ -73,14 +101,28 @@ test('Execute State Machine - Wait For Task Token', () => {
     definition: task
   });
 
-  expect(stack).toHaveResource('AWS::StepFunctions::StateMachine', {
-    DefinitionString: {
-      "Fn::Join": ["", [
-          "{\"StartAt\":\"ChildTask\",\"States\":{\"ChildTask\":{\"End\":true,\"Parameters\":{\"Input\":"
-          + "{\"token.$\":\"$$.Task.Token\"},\"StateMachineArn\":\"",
-          { Ref: "ChildStateMachine9133117F" },
-          "\"},\"Type\":\"Task\",\"Resource\":\"arn:aws:states:::states:startExecution.waitForTaskToken\"}}}"
-      ]]
+  expect(stack.resolve(task.toStateJson())).toEqual({
+    Type: 'Task',
+    Resource: {
+      "Fn::Join": [
+        "",
+        [
+          "arn:",
+          {
+            Ref: "AWS::Partition",
+          },
+          ":states:::states:startExecution.waitForTaskToken",
+        ],
+      ],
+    },
+    End: true,
+    Parameters: {
+      Input: {
+        "token.$": "$$.Task.Token"
+      },
+      StateMachineArn: {
+        Ref: "ChildStateMachine9133117F"
+      }
     },
   });
 });
diff --git a/packages/@aws-cdk/aws-stepfunctions/lib/states/map.ts b/packages/@aws-cdk/aws-stepfunctions/lib/states/map.ts
index 6e6301eb1e6e7..c2a951246439d 100644
--- a/packages/@aws-cdk/aws-stepfunctions/lib/states/map.ts
+++ b/packages/@aws-cdk/aws-stepfunctions/lib/states/map.ts
@@ -70,6 +70,19 @@ export interface MapProps {
     readonly maxConcurrency?: number;
 }
 
+/**
+ * Returns true if the value passed is a positive integer
+ * @param value the value ti validate
+ */
+
+export const isPositiveInteger = (value: number) => {
+    const isFloat = Math.floor(value) !== value;
+
+    const isNotPositiveInteger = value < 0 || value > Number.MAX_SAFE_INTEGER;
+
+    return !isFloat && !isNotPositiveInteger;
+};
+
 /**
  * Define a Map state in the state machine
  *
@@ -80,7 +93,7 @@ export interface MapProps {
 export class Map extends State implements INextable {
     public readonly endStates: INextable[];
 
-    private readonly maxConcurrency?: number;
+    private readonly maxConcurrency: number | undefined;
     private readonly itemsPath?: string;
 
     constructor(scope: cdk.Construct, id: string, props: MapProps = {}) {
@@ -150,10 +163,17 @@ export class Map extends State implements INextable {
      * Validate this state
      */
     protected validate(): string[] {
-        if (!!this.iterator) {
-            return ['Map state must have a non-empty iterator'];
+        const errors: string[] = [];
+
+        if (this.iteration === undefined) {
+            errors.push('Map state must have a non-empty iterator');
         }
-        return [];
+
+        if (this.maxConcurrency !== undefined && !isPositiveInteger(this.maxConcurrency)) {
+            errors.push('maxConcurrency has to be a positive integer');
+        }
+
+        return errors;
     }
 
     private renderItemsPath(): any {
diff --git a/packages/@aws-cdk/aws-stepfunctions/package.json b/packages/@aws-cdk/aws-stepfunctions/package.json
index 01caeef4d3af7..bd01691bcf512 100644
--- a/packages/@aws-cdk/aws-stepfunctions/package.json
+++ b/packages/@aws-cdk/aws-stepfunctions/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@aws-cdk/aws-stepfunctions",
-  "version": "1.13.1",
+  "version": "1.15.0",
   "description": "The CDK Construct Library for AWS::StepFunctions",
   "main": "lib/index.js",
   "types": "lib/index.d.ts",
@@ -63,24 +63,24 @@
   },
   "license": "Apache-2.0",
   "devDependencies": {
-    "@aws-cdk/assert": "1.13.1",
-    "cdk-build-tools": "^1.13.1",
-    "cdk-integ-tools": "^1.13.1",
-    "cfn2ts": "^1.13.1",
-    "pkglint": "^1.13.1"
+    "@aws-cdk/assert": "1.15.0",
+    "cdk-build-tools": "^1.15.0",
+    "cdk-integ-tools": "^1.15.0",
+    "cfn2ts": "^1.15.0",
+    "pkglint": "^1.15.0"
   },
   "dependencies": {
-    "@aws-cdk/aws-cloudwatch": "1.13.1",
-    "@aws-cdk/aws-events": "1.13.1",
-    "@aws-cdk/aws-iam": "1.13.1",
-    "@aws-cdk/core": "1.13.1"
+    "@aws-cdk/aws-cloudwatch": "1.15.0",
+    "@aws-cdk/aws-events": "1.15.0",
+    "@aws-cdk/aws-iam": "1.15.0",
+    "@aws-cdk/core": "1.15.0"
   },
   "homepage": "https://github.com/aws/aws-cdk",
   "peerDependencies": {
-    "@aws-cdk/aws-cloudwatch": "1.13.1",
-    "@aws-cdk/aws-events": "1.13.1",
-    "@aws-cdk/aws-iam": "1.13.1",
-    "@aws-cdk/core": "1.13.1"
+    "@aws-cdk/aws-cloudwatch": "1.15.0",
+    "@aws-cdk/aws-events": "1.15.0",
+    "@aws-cdk/aws-iam": "1.15.0",
+    "@aws-cdk/core": "1.15.0"
   },
   "engines": {
     "node": ">= 10.3.0"
@@ -91,7 +91,17 @@
       "export:@aws-cdk/aws-stepfunctions.IActivity",
       "duration-prop-type:@aws-cdk/aws-stepfunctions.WaitProps.duration",
       "duration-prop-type:@aws-cdk/aws-stepfunctions.Errors.TIMEOUT",
-      "no-unused-type:@aws-cdk/aws-stepfunctions.ServiceIntegrationPattern"
+      "no-unused-type:@aws-cdk/aws-stepfunctions.ServiceIntegrationPattern",
+      "docs-public-apis:@aws-cdk/aws-stepfunctions.TaskInput.value",
+      "docs-public-apis:@aws-cdk/aws-stepfunctions.InputType.OBJECT",
+      "docs-public-apis:@aws-cdk/aws-stepfunctions.Data.isJsonPathString",
+      "docs-public-apis:@aws-cdk/aws-stepfunctions.Result.value",
+      "docs-public-apis:@aws-cdk/aws-stepfunctions.StateGraph.startState",
+      "docs-public-apis:@aws-cdk/aws-stepfunctions.TaskInput.type",
+      "docs-public-apis:@aws-cdk/aws-stepfunctions.InputType.TEXT",
+      "docs-public-apis:@aws-cdk/aws-stepfunctions.WaitTime",
+      "docs-public-apis:@aws-cdk/aws-stepfunctions.ActivityProps",
+      "docs-public-apis:@aws-cdk/aws-stepfunctions.IActivity"
     ]
   },
   "stability": "experimental"
diff --git a/packages/@aws-cdk/aws-stepfunctions/test/test.map.ts b/packages/@aws-cdk/aws-stepfunctions/test/test.map.ts
index ab6fa9e61cbdc..7d0b30757feb3 100644
--- a/packages/@aws-cdk/aws-stepfunctions/test/test.map.ts
+++ b/packages/@aws-cdk/aws-stepfunctions/test/test.map.ts
@@ -1,6 +1,7 @@
 import cdk = require('@aws-cdk/core');
 import { Test } from 'nodeunit';
 import stepfunctions = require('../lib');
+import { isPositiveInteger } from '../lib';
 
 export = {
     'State Machine With Map State'(test: Test) {
@@ -42,9 +43,129 @@ export = {
         });
 
         test.done();
+    },
+    'synth is successful'(test: Test) {
+
+        const app = createAppWithMap((stack) => {
+            const map = new stepfunctions.Map(stack, 'Map State', {
+                maxConcurrency: 1,
+                itemsPath: stepfunctions.Data.stringAt('$.inputForMap')
+            });
+            map.iterator(new stepfunctions.Pass(stack, 'Pass State'));
+            return map;
+        });
+
+        app.synth();
+        test.done();
+    },
+    'fails in synthesis if iterator is missing'(test: Test) {
+
+        const app = createAppWithMap((stack) => {
+            const map = new stepfunctions.Map(stack, 'Map State', {
+                maxConcurrency: 1,
+                itemsPath: stepfunctions.Data.stringAt('$.inputForMap')
+            });
+
+            return map;
+        });
+
+        test.throws(() => {
+            app.synth();
+        }, /Map state must have a non-empty iterator/, 'A validation was expected');
+
+        test.done();
+    },
+    'fails in synthesis when maxConcurrency is a float'(test: Test) {
+
+        const app = createAppWithMap((stack) => {
+            const map = new stepfunctions.Map(stack, 'Map State', {
+                maxConcurrency: 1.2,
+                itemsPath: stepfunctions.Data.stringAt('$.inputForMap')
+            });
+            map.iterator(new stepfunctions.Pass(stack, 'Pass State'));
+
+            return map;
+        });
+
+        test.throws(() => {
+            app.synth();
+        }, /maxConcurrency has to be a positive integer/, 'A validation was expected');
+
+        test.done();
+
+    },
+    'fails in synthesis when maxConcurrency is a negative integer'(test: Test) {
+
+        const app = createAppWithMap((stack) => {
+            const map = new stepfunctions.Map(stack, 'Map State', {
+                maxConcurrency: -1,
+                itemsPath: stepfunctions.Data.stringAt('$.inputForMap')
+            });
+            map.iterator(new stepfunctions.Pass(stack, 'Pass State'));
+
+            return map;
+        });
+
+        test.throws(() => {
+            app.synth();
+        }, /maxConcurrency has to be a positive integer/, 'A validation was expected');
+
+        test.done();
+    },
+    'fails in synthesis when maxConcurrency is too big to be an integer'(test: Test) {
+
+        const app = createAppWithMap((stack) => {
+            const map = new stepfunctions.Map(stack, 'Map State', {
+                maxConcurrency: Number.MAX_VALUE,
+                itemsPath: stepfunctions.Data.stringAt('$.inputForMap')
+            });
+            map.iterator(new stepfunctions.Pass(stack, 'Pass State'));
+
+            return map;
+        });
+
+        test.throws(() => {
+            app.synth();
+        }, /maxConcurrency has to be a positive integer/, 'A validation was expected');
+
+        test.done();
+
+    },
+    'isPositiveInteger is false with negative number'(test: Test) {
+        test.equals(isPositiveInteger(-1), false, '-1 is not a valid positive integer');
+        test.done();
+    },
+    'isPositiveInteger is false with decimal number'(test: Test) {
+        test.equals(isPositiveInteger(1.2), false, '1.2 is not a valid positive integer');
+        test.done();
+    },
+    'isPositiveInteger is false with a value greater than safe integer '(test: Test) {
+        const valueToTest = Number.MAX_SAFE_INTEGER + 1;
+        test.equals(isPositiveInteger(valueToTest), false, `${valueToTest} is not a valid positive integer`);
+        test.done();
+    },
+    'isPositiveInteger is true with 0'(test: Test) {
+        test.equals(isPositiveInteger(0), true, '0 is expected to be a positive integer');
+        test.done();
+    },
+    'isPositiveInteger is true with 10'(test: Test) {
+        test.equals(isPositiveInteger(10), true, '10 is expected to be a positive integer');
+        test.done();
+    },
+    'isPositiveInteger is true with max integer value'(test: Test) {
+        test.equals(isPositiveInteger(Number.MAX_SAFE_INTEGER), true, `${Number.MAX_SAFE_INTEGER} is expected to be a positive integer`);
+        test.done();
     }
 };
 
 function render(sm: stepfunctions.IChainable) {
     return new cdk.Stack().resolve(new stepfunctions.StateGraph(sm.startState, 'Test Graph').toGraphJson());
 }
+
+function createAppWithMap(mapFactory: (stack: cdk.Stack) => stepfunctions.Map) {
+    const app = new cdk.App();
+    const stack = new cdk.Stack(app, 'my-stack');
+    const map = mapFactory(stack);
+    new stepfunctions.StateGraph(map, 'Test Graph');
+    return app;
+}
diff --git a/packages/@aws-cdk/aws-transfer/package.json b/packages/@aws-cdk/aws-transfer/package.json
index 89cdfb3edee8c..789c255205b0a 100644
--- a/packages/@aws-cdk/aws-transfer/package.json
+++ b/packages/@aws-cdk/aws-transfer/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@aws-cdk/aws-transfer",
-  "version": "1.13.1",
+  "version": "1.15.0",
   "description": "The CDK Construct Library for AWS::Transfer",
   "main": "lib/index.js",
   "types": "lib/index.d.ts",
@@ -65,16 +65,16 @@
   },
   "license": "Apache-2.0",
   "devDependencies": {
-    "@aws-cdk/assert": "1.13.1",
-    "cdk-build-tools": "^1.13.1",
-    "cfn2ts": "^1.13.1",
-    "pkglint": "^1.13.1"
+    "@aws-cdk/assert": "1.15.0",
+    "cdk-build-tools": "^1.15.0",
+    "cfn2ts": "^1.15.0",
+    "pkglint": "^1.15.0"
   },
   "dependencies": {
-    "@aws-cdk/core": "1.13.1"
+    "@aws-cdk/core": "1.15.0"
   },
   "peerDependencies": {
-    "@aws-cdk/core": "1.13.1"
+    "@aws-cdk/core": "1.15.0"
   },
   "engines": {
     "node": ">= 10.3.0"
diff --git a/packages/@aws-cdk/aws-waf/package.json b/packages/@aws-cdk/aws-waf/package.json
index 8b78f8800cf57..7d631df754a0b 100644
--- a/packages/@aws-cdk/aws-waf/package.json
+++ b/packages/@aws-cdk/aws-waf/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@aws-cdk/aws-waf",
-  "version": "1.13.1",
+  "version": "1.15.0",
   "description": "The CDK Construct Library for AWS::WAF",
   "main": "lib/index.js",
   "types": "lib/index.d.ts",
@@ -63,17 +63,17 @@
   },
   "license": "Apache-2.0",
   "devDependencies": {
-    "@aws-cdk/assert": "1.13.1",
-    "cdk-build-tools": "^1.13.1",
-    "cfn2ts": "^1.13.1",
-    "pkglint": "^1.13.1"
+    "@aws-cdk/assert": "1.15.0",
+    "cdk-build-tools": "^1.15.0",
+    "cfn2ts": "^1.15.0",
+    "pkglint": "^1.15.0"
   },
   "dependencies": {
-    "@aws-cdk/core": "1.13.1"
+    "@aws-cdk/core": "1.15.0"
   },
   "homepage": "https://github.com/aws/aws-cdk",
   "peerDependencies": {
-    "@aws-cdk/core": "1.13.1"
+    "@aws-cdk/core": "1.15.0"
   },
   "engines": {
     "node": ">= 10.3.0"
diff --git a/packages/@aws-cdk/aws-wafregional/package.json b/packages/@aws-cdk/aws-wafregional/package.json
index e40d13c35e404..8815844faa2bf 100644
--- a/packages/@aws-cdk/aws-wafregional/package.json
+++ b/packages/@aws-cdk/aws-wafregional/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@aws-cdk/aws-wafregional",
-  "version": "1.13.1",
+  "version": "1.15.0",
   "description": "The CDK Construct Library for AWS::WAFRegional",
   "main": "lib/index.js",
   "types": "lib/index.d.ts",
@@ -63,17 +63,17 @@
   },
   "license": "Apache-2.0",
   "devDependencies": {
-    "@aws-cdk/assert": "1.13.1",
-    "cdk-build-tools": "^1.13.1",
-    "cfn2ts": "^1.13.1",
-    "pkglint": "^1.13.1"
+    "@aws-cdk/assert": "1.15.0",
+    "cdk-build-tools": "^1.15.0",
+    "cfn2ts": "^1.15.0",
+    "pkglint": "^1.15.0"
   },
   "dependencies": {
-    "@aws-cdk/core": "1.13.1"
+    "@aws-cdk/core": "1.15.0"
   },
   "homepage": "https://github.com/aws/aws-cdk",
   "peerDependencies": {
-    "@aws-cdk/core": "1.13.1"
+    "@aws-cdk/core": "1.15.0"
   },
   "engines": {
     "node": ">= 10.3.0"
diff --git a/packages/@aws-cdk/aws-workspaces/package.json b/packages/@aws-cdk/aws-workspaces/package.json
index 8a1af9832a3fe..900cda420d141 100644
--- a/packages/@aws-cdk/aws-workspaces/package.json
+++ b/packages/@aws-cdk/aws-workspaces/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@aws-cdk/aws-workspaces",
-  "version": "1.13.1",
+  "version": "1.15.0",
   "description": "The CDK Construct Library for AWS::WorkSpaces",
   "main": "lib/index.js",
   "types": "lib/index.d.ts",
@@ -63,17 +63,17 @@
   },
   "license": "Apache-2.0",
   "devDependencies": {
-    "@aws-cdk/assert": "1.13.1",
-    "cdk-build-tools": "^1.13.1",
-    "cfn2ts": "^1.13.1",
-    "pkglint": "^1.13.1"
+    "@aws-cdk/assert": "1.15.0",
+    "cdk-build-tools": "^1.15.0",
+    "cfn2ts": "^1.15.0",
+    "pkglint": "^1.15.0"
   },
   "dependencies": {
-    "@aws-cdk/core": "1.13.1"
+    "@aws-cdk/core": "1.15.0"
   },
   "homepage": "https://github.com/aws/aws-cdk",
   "peerDependencies": {
-    "@aws-cdk/core": "1.13.1"
+    "@aws-cdk/core": "1.15.0"
   },
   "engines": {
     "node": ">= 10.3.0"
diff --git a/packages/@aws-cdk/cfnspec/CHANGELOG.md b/packages/@aws-cdk/cfnspec/CHANGELOG.md
index b8e2aeeb40326..5bab8c64246c7 100644
--- a/packages/@aws-cdk/cfnspec/CHANGELOG.md
+++ b/packages/@aws-cdk/cfnspec/CHANGELOG.md
@@ -1,3 +1,43 @@
+# CloudFormation Resource Specification v7.1.0
+
+## New Resource Types
+
+* AWS::EC2::TrafficMirrorFilter
+* AWS::EC2::TrafficMirrorFilterRule
+* AWS::EC2::TrafficMirrorSession
+* AWS::EC2::TrafficMirrorTarget
+* AWS::Events::EventBus
+
+## Attribute Changes
+
+
+## Property Changes
+
+* AWS::FSx::FileSystem FileSystemType.Required (__changed__)
+  * Old: false
+  * New: true
+* AWS::FSx::FileSystem SubnetIds.Required (__changed__)
+  * Old: false
+  * New: true
+* AWS::MSK::Cluster NumberOfBrokerNodes.UpdateType (__changed__)
+  * Old: Immutable
+  * New: Mutable
+
+## Property Type Changes
+
+* AWS::FSx::FileSystem.SelfManagedActiveDirectoryConfiguration (__added__)
+* AWS::Batch::ComputeEnvironment.ComputeResources AllocationStrategy (__added__)
+* AWS::Cognito::IdentityPoolRoleAttachment.RoleMapping IdentityProvider (__added__)
+* AWS::FSx::FileSystem.WindowsConfiguration SelfManagedActiveDirectoryConfiguration (__added__)
+
+# Serverless Application Model (SAM) Resource Specification v2016-10-31
+
+## Property Type Changes
+
+* AWS::Serverless::Function.S3Location Version.Required (__changed__)
+  * Old: true
+  * New: false
+
 # CloudFormation Resource Specification v6.3.0
 
 ## New Resource Types
diff --git a/packages/@aws-cdk/cfnspec/package.json b/packages/@aws-cdk/cfnspec/package.json
index 4115627a2603e..4140c62fdcdac 100644
--- a/packages/@aws-cdk/cfnspec/package.json
+++ b/packages/@aws-cdk/cfnspec/package.json
@@ -1,7 +1,7 @@
 {
   "name": "@aws-cdk/cfnspec",
   "description": "The CloudFormation resource specification used by @aws-cdk packages",
-  "version": "1.13.1",
+  "version": "1.15.0",
   "scripts": {
     "update": "cdk-build && /bin/bash build-tools/update.sh",
     "build": "cdk-build && node build-tools/build",
@@ -24,11 +24,11 @@
   "devDependencies": {
     "@types/fs-extra": "^8.0.1",
     "@types/md5": "^2.1.33",
-    "cdk-build-tools": "^1.13.1",
-    "fast-json-patch": "^3.0.0-1",
+    "cdk-build-tools": "^1.15.0",
+    "fast-json-patch": "^2.2.1",
     "fs-extra": "^8.1.0",
     "json-diff": "^0.5.4",
-    "pkglint": "^1.13.1",
+    "pkglint": "^1.15.0",
     "sort-json": "^2.0.0"
   },
   "dependencies": {
diff --git a/packages/@aws-cdk/cfnspec/spec-source/000_CloudFormationResourceSpecification.json b/packages/@aws-cdk/cfnspec/spec-source/000_CloudFormationResourceSpecification.json
index fcb0fa6ed83b4..fd58e83a6a785 100644
--- a/packages/@aws-cdk/cfnspec/spec-source/000_CloudFormationResourceSpecification.json
+++ b/packages/@aws-cdk/cfnspec/spec-source/000_CloudFormationResourceSpecification.json
@@ -3308,6 +3308,12 @@
     "AWS::Batch::ComputeEnvironment.ComputeResources": {
       "Documentation": "http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-batch-computeenvironment-computeresources.html",
       "Properties": {
+        "AllocationStrategy": {
+          "Documentation": "http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-batch-computeenvironment-computeresources.html#cfn-batch-computeenvironment-computeresources-allocationstrategy",
+          "PrimitiveType": "String",
+          "Required": false,
+          "UpdateType": "Immutable"
+        },
         "BidPercentage": {
           "Documentation": "http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-batch-computeenvironment-computeresources.html#cfn-batch-computeenvironment-computeresources-bidpercentage",
           "PrimitiveType": "Integer",
@@ -6229,6 +6235,12 @@
           "Required": false,
           "UpdateType": "Mutable"
         },
+        "IdentityProvider": {
+          "Documentation": "http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-cognito-identitypoolroleattachment-rolemapping.html#cfn-cognito-identitypoolroleattachment-rolemapping-identityprovider",
+          "PrimitiveType": "String",
+          "Required": false,
+          "UpdateType": "Mutable"
+        },
         "RulesConfiguration": {
           "Documentation": "http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-cognito-identitypoolroleattachment-rolemapping.html#cfn-cognito-identitypoolroleattachment-rolemapping-rulesconfiguration",
           "Required": false,
@@ -9844,17 +9856,17 @@
         }
       }
     },
-    "AWS::EC2::TrafficMirrorFilterRule.TrafficMirrorPortRangeRequest": {
-      "Documentation": "http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-ec2-trafficmirrorfilterrule-trafficmirrorportrangerequest.html",
+    "AWS::EC2::TrafficMirrorFilterRule.TrafficMirrorPortRange": {
+      "Documentation": "http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-ec2-trafficmirrorfilterrule-trafficmirrorportrange.html",
       "Properties": {
         "FromPort": {
-          "Documentation": "http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-ec2-trafficmirrorfilterrule-trafficmirrorportrangerequest.html#cfn-ec2-trafficmirrorfilterrule-trafficmirrorportrangerequest-fromport",
+          "Documentation": "http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-ec2-trafficmirrorfilterrule-trafficmirrorportrange.html#cfn-ec2-trafficmirrorfilterrule-trafficmirrorportrange-fromport",
           "PrimitiveType": "Integer",
           "Required": true,
           "UpdateType": "Mutable"
         },
         "ToPort": {
-          "Documentation": "http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-ec2-trafficmirrorfilterrule-trafficmirrorportrangerequest.html#cfn-ec2-trafficmirrorfilterrule-trafficmirrorportrangerequest-toport",
+          "Documentation": "http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-ec2-trafficmirrorfilterrule-trafficmirrorportrange.html#cfn-ec2-trafficmirrorfilterrule-trafficmirrorportrange-toport",
           "PrimitiveType": "Integer",
           "Required": true,
           "UpdateType": "Mutable"
@@ -13674,6 +13686,48 @@
         }
       }
     },
+    "AWS::FSx::FileSystem.SelfManagedActiveDirectoryConfiguration": {
+      "Documentation": "http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-fsx-filesystem-windowsconfiguration-selfmanagedactivedirectoryconfiguration.html",
+      "Properties": {
+        "DnsIps": {
+          "Documentation": "http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-fsx-filesystem-windowsconfiguration-selfmanagedactivedirectoryconfiguration.html#cfn-fsx-filesystem-windowsconfiguration-selfmanagedactivedirectoryconfiguration-dnsips",
+          "PrimitiveItemType": "String",
+          "Required": false,
+          "Type": "List",
+          "UpdateType": "Mutable"
+        },
+        "DomainName": {
+          "Documentation": "http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-fsx-filesystem-windowsconfiguration-selfmanagedactivedirectoryconfiguration.html#cfn-fsx-filesystem-windowsconfiguration-selfmanagedactivedirectoryconfiguration-domainname",
+          "PrimitiveType": "String",
+          "Required": false,
+          "UpdateType": "Immutable"
+        },
+        "FileSystemAdministratorsGroup": {
+          "Documentation": "http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-fsx-filesystem-windowsconfiguration-selfmanagedactivedirectoryconfiguration.html#cfn-fsx-filesystem-windowsconfiguration-selfmanagedactivedirectoryconfiguration-filesystemadministratorsgroup",
+          "PrimitiveType": "String",
+          "Required": false,
+          "UpdateType": "Immutable"
+        },
+        "OrganizationalUnitDistinguishedName": {
+          "Documentation": "http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-fsx-filesystem-windowsconfiguration-selfmanagedactivedirectoryconfiguration.html#cfn-fsx-filesystem-windowsconfiguration-selfmanagedactivedirectoryconfiguration-organizationalunitdistinguishedname",
+          "PrimitiveType": "String",
+          "Required": false,
+          "UpdateType": "Immutable"
+        },
+        "Password": {
+          "Documentation": "http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-fsx-filesystem-windowsconfiguration-selfmanagedactivedirectoryconfiguration.html#cfn-fsx-filesystem-windowsconfiguration-selfmanagedactivedirectoryconfiguration-password",
+          "PrimitiveType": "String",
+          "Required": false,
+          "UpdateType": "Mutable"
+        },
+        "UserName": {
+          "Documentation": "http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-fsx-filesystem-windowsconfiguration-selfmanagedactivedirectoryconfiguration.html#cfn-fsx-filesystem-windowsconfiguration-selfmanagedactivedirectoryconfiguration-username",
+          "PrimitiveType": "String",
+          "Required": false,
+          "UpdateType": "Mutable"
+        }
+      }
+    },
     "AWS::FSx::FileSystem.WindowsConfiguration": {
       "Documentation": "http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-fsx-filesystem-windowsconfiguration.html",
       "Properties": {
@@ -13701,6 +13755,12 @@
           "Required": false,
           "UpdateType": "Mutable"
         },
+        "SelfManagedActiveDirectoryConfiguration": {
+          "Documentation": "http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-fsx-filesystem-windowsconfiguration.html#cfn-fsx-filesystem-windowsconfiguration-selfmanagedactivedirectoryconfiguration",
+          "Required": false,
+          "Type": "SelfManagedActiveDirectoryConfiguration",
+          "UpdateType": "Mutable"
+        },
         "ThroughputCapacity": {
           "Documentation": "http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-fsx-filesystem-windowsconfiguration.html#cfn-fsx-filesystem-windowsconfiguration-throughputcapacity",
           "PrimitiveType": "Integer",
@@ -26100,7 +26160,7 @@
       }
     }
   },
-  "ResourceSpecificationVersion": "6.3.0",
+  "ResourceSpecificationVersion": "7.1.0",
   "ResourceTypes": {
     "AWS::AmazonMQ::Broker": {
       "Attributes": {
@@ -34117,6 +34177,180 @@
         }
       }
     },
+    "AWS::EC2::TrafficMirrorFilter": {
+      "Documentation": "http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-ec2-trafficmirrorfilter.html",
+      "Properties": {
+        "Description": {
+          "Documentation": "http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-ec2-trafficmirrorfilter.html#cfn-ec2-trafficmirrorfilter-description",
+          "PrimitiveType": "String",
+          "Required": false,
+          "UpdateType": "Immutable"
+        },
+        "NetworkServices": {
+          "Documentation": "http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-ec2-trafficmirrorfilter.html#cfn-ec2-trafficmirrorfilter-networkservices",
+          "PrimitiveItemType": "String",
+          "Required": false,
+          "Type": "List",
+          "UpdateType": "Mutable"
+        },
+        "Tags": {
+          "Documentation": "http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-ec2-trafficmirrorfilter.html#cfn-ec2-trafficmirrorfilter-tags",
+          "ItemType": "Tag",
+          "Required": false,
+          "Type": "List",
+          "UpdateType": "Mutable"
+        }
+      }
+    },
+    "AWS::EC2::TrafficMirrorFilterRule": {
+      "Documentation": "http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-ec2-trafficmirrorfilterrule.html",
+      "Properties": {
+        "Description": {
+          "Documentation": "http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-ec2-trafficmirrorfilterrule.html#cfn-ec2-trafficmirrorfilterrule-description",
+          "PrimitiveType": "String",
+          "Required": false,
+          "UpdateType": "Mutable"
+        },
+        "DestinationCidrBlock": {
+          "Documentation": "http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-ec2-trafficmirrorfilterrule.html#cfn-ec2-trafficmirrorfilterrule-destinationcidrblock",
+          "PrimitiveType": "String",
+          "Required": true,
+          "UpdateType": "Mutable"
+        },
+        "DestinationPortRange": {
+          "Documentation": "http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-ec2-trafficmirrorfilterrule.html#cfn-ec2-trafficmirrorfilterrule-destinationportrange",
+          "Required": false,
+          "Type": "TrafficMirrorPortRange",
+          "UpdateType": "Mutable"
+        },
+        "Protocol": {
+          "Documentation": "http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-ec2-trafficmirrorfilterrule.html#cfn-ec2-trafficmirrorfilterrule-protocol",
+          "PrimitiveType": "Integer",
+          "Required": false,
+          "UpdateType": "Mutable"
+        },
+        "RuleAction": {
+          "Documentation": "http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-ec2-trafficmirrorfilterrule.html#cfn-ec2-trafficmirrorfilterrule-ruleaction",
+          "PrimitiveType": "String",
+          "Required": true,
+          "UpdateType": "Mutable"
+        },
+        "RuleNumber": {
+          "Documentation": "http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-ec2-trafficmirrorfilterrule.html#cfn-ec2-trafficmirrorfilterrule-rulenumber",
+          "PrimitiveType": "Integer",
+          "Required": true,
+          "UpdateType": "Mutable"
+        },
+        "SourceCidrBlock": {
+          "Documentation": "http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-ec2-trafficmirrorfilterrule.html#cfn-ec2-trafficmirrorfilterrule-sourcecidrblock",
+          "PrimitiveType": "String",
+          "Required": true,
+          "UpdateType": "Mutable"
+        },
+        "SourcePortRange": {
+          "Documentation": "http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-ec2-trafficmirrorfilterrule.html#cfn-ec2-trafficmirrorfilterrule-sourceportrange",
+          "Required": false,
+          "Type": "TrafficMirrorPortRange",
+          "UpdateType": "Mutable"
+        },
+        "TrafficDirection": {
+          "Documentation": "http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-ec2-trafficmirrorfilterrule.html#cfn-ec2-trafficmirrorfilterrule-trafficdirection",
+          "PrimitiveType": "String",
+          "Required": true,
+          "UpdateType": "Mutable"
+        },
+        "TrafficMirrorFilterId": {
+          "Documentation": "http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-ec2-trafficmirrorfilterrule.html#cfn-ec2-trafficmirrorfilterrule-trafficmirrorfilterid",
+          "PrimitiveType": "String",
+          "Required": true,
+          "UpdateType": "Immutable"
+        }
+      }
+    },
+    "AWS::EC2::TrafficMirrorSession": {
+      "Documentation": "http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-ec2-trafficmirrorsession.html",
+      "Properties": {
+        "Description": {
+          "Documentation": "http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-ec2-trafficmirrorsession.html#cfn-ec2-trafficmirrorsession-description",
+          "PrimitiveType": "String",
+          "Required": false,
+          "UpdateType": "Mutable"
+        },
+        "NetworkInterfaceId": {
+          "Documentation": "http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-ec2-trafficmirrorsession.html#cfn-ec2-trafficmirrorsession-networkinterfaceid",
+          "PrimitiveType": "String",
+          "Required": true,
+          "UpdateType": "Immutable"
+        },
+        "PacketLength": {
+          "Documentation": "http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-ec2-trafficmirrorsession.html#cfn-ec2-trafficmirrorsession-packetlength",
+          "PrimitiveType": "Integer",
+          "Required": false,
+          "UpdateType": "Mutable"
+        },
+        "SessionNumber": {
+          "Documentation": "http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-ec2-trafficmirrorsession.html#cfn-ec2-trafficmirrorsession-sessionnumber",
+          "PrimitiveType": "Integer",
+          "Required": true,
+          "UpdateType": "Mutable"
+        },
+        "Tags": {
+          "Documentation": "http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-ec2-trafficmirrorsession.html#cfn-ec2-trafficmirrorsession-tags",
+          "ItemType": "Tag",
+          "Required": false,
+          "Type": "List",
+          "UpdateType": "Mutable"
+        },
+        "TrafficMirrorFilterId": {
+          "Documentation": "http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-ec2-trafficmirrorsession.html#cfn-ec2-trafficmirrorsession-trafficmirrorfilterid",
+          "PrimitiveType": "String",
+          "Required": true,
+          "UpdateType": "Mutable"
+        },
+        "TrafficMirrorTargetId": {
+          "Documentation": "http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-ec2-trafficmirrorsession.html#cfn-ec2-trafficmirrorsession-trafficmirrortargetid",
+          "PrimitiveType": "String",
+          "Required": true,
+          "UpdateType": "Mutable"
+        },
+        "VirtualNetworkId": {
+          "Documentation": "http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-ec2-trafficmirrorsession.html#cfn-ec2-trafficmirrorsession-virtualnetworkid",
+          "PrimitiveType": "Integer",
+          "Required": false,
+          "UpdateType": "Mutable"
+        }
+      }
+    },
+    "AWS::EC2::TrafficMirrorTarget": {
+      "Documentation": "http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-ec2-trafficmirrortarget.html",
+      "Properties": {
+        "Description": {
+          "Documentation": "http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-ec2-trafficmirrortarget.html#cfn-ec2-trafficmirrortarget-description",
+          "PrimitiveType": "String",
+          "Required": false,
+          "UpdateType": "Immutable"
+        },
+        "NetworkInterfaceId": {
+          "Documentation": "http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-ec2-trafficmirrortarget.html#cfn-ec2-trafficmirrortarget-networkinterfaceid",
+          "PrimitiveType": "String",
+          "Required": false,
+          "UpdateType": "Immutable"
+        },
+        "NetworkLoadBalancerArn": {
+          "Documentation": "http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-ec2-trafficmirrortarget.html#cfn-ec2-trafficmirrortarget-networkloadbalancerarn",
+          "PrimitiveType": "String",
+          "Required": false,
+          "UpdateType": "Immutable"
+        },
+        "Tags": {
+          "Documentation": "http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-ec2-trafficmirrortarget.html#cfn-ec2-trafficmirrortarget-tags",
+          "ItemType": "Tag",
+          "Required": false,
+          "Type": "List",
+          "UpdateType": "Mutable"
+        }
+      }
+    },
     "AWS::EC2::TransitGateway": {
       "Documentation": "http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-ec2-transitgateway.html",
       "Properties": {
@@ -36659,6 +36893,34 @@
         }
       }
     },
+    "AWS::Events::EventBus": {
+      "Attributes": {
+        "Arn": {
+          "PrimitiveType": "String"
+        },
+        "Name": {
+          "PrimitiveType": "String"
+        },
+        "Policy": {
+          "PrimitiveType": "String"
+        }
+      },
+      "Documentation": "http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-events-eventbus.html",
+      "Properties": {
+        "EventSourceName": {
+          "Documentation": "http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-events-eventbus.html#cfn-events-eventbus-eventsourcename",
+          "PrimitiveType": "String",
+          "Required": false,
+          "UpdateType": "Immutable"
+        },
+        "Name": {
+          "Documentation": "http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-events-eventbus.html#cfn-events-eventbus-name",
+          "PrimitiveType": "String",
+          "Required": true,
+          "UpdateType": "Immutable"
+        }
+      }
+    },
     "AWS::Events::EventBusPolicy": {
       "Documentation": "http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-events-eventbuspolicy.html",
       "Properties": {
@@ -36760,7 +37022,7 @@
         "FileSystemType": {
           "Documentation": "http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-fsx-filesystem.html#cfn-fsx-filesystem-filesystemtype",
           "PrimitiveType": "String",
-          "Required": false,
+          "Required": true,
           "UpdateType": "Immutable"
         },
         "KmsKeyId": {
@@ -36791,7 +37053,7 @@
         "SubnetIds": {
           "Documentation": "http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-fsx-filesystem.html#cfn-fsx-filesystem-subnetids",
           "PrimitiveItemType": "String",
-          "Required": false,
+          "Required": true,
           "Type": "List",
           "UpdateType": "Immutable"
         },
@@ -39998,7 +40260,7 @@
           "Documentation": "http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-msk-cluster.html#cfn-msk-cluster-numberofbrokernodes",
           "PrimitiveType": "Integer",
           "Required": true,
-          "UpdateType": "Immutable"
+          "UpdateType": "Mutable"
         },
         "Tags": {
           "Documentation": "http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-msk-cluster.html#cfn-msk-cluster-tags",
diff --git a/packages/@aws-cdk/cfnspec/spec-source/000_sam.spec.json b/packages/@aws-cdk/cfnspec/spec-source/000_sam.spec.json
index 122a2074913c9..62d0020f684ce 100644
--- a/packages/@aws-cdk/cfnspec/spec-source/000_sam.spec.json
+++ b/packages/@aws-cdk/cfnspec/spec-source/000_sam.spec.json
@@ -449,7 +449,7 @@
                 "Version": {
                     "Documentation": "https://github.com/awslabs/serverless-application-model/blob/master/versions/2016-10-31.md#awsserverlessfunction",
                     "PrimitiveType": "Integer",
-                    "Required": true,
+                    "Required": false,
                     "UpdateType": "Immutable"
                 }
             }
diff --git a/packages/@aws-cdk/cloudformation-diff/package.json b/packages/@aws-cdk/cloudformation-diff/package.json
index 6ccd89133e7a1..0f61bf5624534 100644
--- a/packages/@aws-cdk/cloudformation-diff/package.json
+++ b/packages/@aws-cdk/cloudformation-diff/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@aws-cdk/cloudformation-diff",
-  "version": "1.13.1",
+  "version": "1.15.0",
   "description": "Utilities to diff CDK stacks against CloudFormation templates",
   "main": "lib/index.js",
   "types": "lib/index.d.ts",
@@ -26,8 +26,8 @@
   },
   "license": "Apache-2.0",
   "dependencies": {
-    "@aws-cdk/cfnspec": "1.13.1",
-    "@aws-cdk/cx-api": "1.13.1",
+    "@aws-cdk/cfnspec": "1.15.0",
+    "@aws-cdk/cx-api": "1.15.0",
     "colors": "^1.4.0",
     "diff": "^4.0.1",
     "fast-deep-equal": "^2.0.1",
@@ -36,10 +36,11 @@
     "table": "^5.4.6"
   },
   "devDependencies": {
+    "@types/string-width": "^4.0.1",
     "@types/table": "^4.0.7",
-    "cdk-build-tools": "^1.13.1",
-    "fast-check": "^1.17.0",
-    "pkglint": "^1.13.1"
+    "cdk-build-tools": "^1.15.0",
+    "fast-check": "^1.18.1",
+    "pkglint": "^1.15.0"
   },
   "repository": {
     "url": "https://github.com/aws/aws-cdk.git",
diff --git a/packages/@aws-cdk/core/lib/cfn-include.ts b/packages/@aws-cdk/core/lib/cfn-include.ts
index 667c31ad34c23..5bc3662ec04bc 100644
--- a/packages/@aws-cdk/core/lib/cfn-include.ts
+++ b/packages/@aws-cdk/core/lib/cfn-include.ts
@@ -24,7 +24,7 @@ export class CfnInclude extends CfnElement {
    * stack.
    * @param scope The parent construct of this template
    * @param id The ID of this construct
-   * @param template The template to adopt.
+   * @param props Initialization properties.
    */
   constructor(scope: Construct, id: string, props: CfnIncludeProps) {
     super(scope, id);
diff --git a/packages/@aws-cdk/core/lib/removal-policy.ts b/packages/@aws-cdk/core/lib/removal-policy.ts
index e8ad5a8da24eb..e98a6546024c8 100644
--- a/packages/@aws-cdk/core/lib/removal-policy.ts
+++ b/packages/@aws-cdk/core/lib/removal-policy.ts
@@ -16,7 +16,8 @@ export interface RemovalPolicyOptions {
   /**
    * The default policy to apply in case the removal policy is not defined.
    *
-   * @default RemovalPolicy.Retain
+   * @default - Default value is resource specific. To determine the default value for a resoure,
+   * please consult that specific resource's documentation.
    */
   readonly default?: RemovalPolicy;
 
diff --git a/packages/@aws-cdk/core/lib/stack.ts b/packages/@aws-cdk/core/lib/stack.ts
index e994030e2aeac..e469aba35947b 100644
--- a/packages/@aws-cdk/core/lib/stack.ts
+++ b/packages/@aws-cdk/core/lib/stack.ts
@@ -532,7 +532,7 @@ export class Stack extends Construct implements ITaggable {
       params = new DockerImageAssetParameters(this.assetParameters, asset.sourceHash);
 
       const metadata: cxapi.ContainerImageAssetMetadataEntry = {
-        id: this.node.uniqueId,
+        id: asset.sourceHash,
         packaging: 'container-image',
         path: asset.directoryName,
         sourceHash: asset.sourceHash,
diff --git a/packages/@aws-cdk/core/package.json b/packages/@aws-cdk/core/package.json
index 479ea65d0c844..4fb9bc2b936f8 100644
--- a/packages/@aws-cdk/core/package.json
+++ b/packages/@aws-cdk/core/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@aws-cdk/core",
-  "version": "1.13.1",
+  "version": "1.15.0",
   "description": "AWS Cloud Development Kit Core Library",
   "main": "lib/index.js",
   "types": "lib/index.d.ts",
@@ -41,7 +41,82 @@
       "duration-prop-type:@aws-cdk/core.ResourceSignal.timeout",
       "props-no-any:@aws-cdk/core.CfnParameterProps.default",
       "props-no-cfn-types:@aws-cdk/core.CfnRuleProps.assertions",
-      "construct-ctor:@aws-cdk/core.Stack.<initializer>.params[1]"
+      "construct-ctor:@aws-cdk/core.Stack.<initializer>.params[1]",
+      "docs-public-apis:@aws-cdk/core.ScopedAws.urlSuffix",
+      "docs-public-apis:@aws-cdk/core.TagType.NOT_TAGGABLE",
+      "docs-public-apis:@aws-cdk/core.TagType.KEY_VALUE",
+      "docs-public-apis:@aws-cdk/core.TagType.MAP",
+      "docs-public-apis:@aws-cdk/core.TagType.AUTOSCALING_GROUP",
+      "docs-public-apis:@aws-cdk/core.Arn",
+      "docs-public-apis:@aws-cdk/core.Aws.ACCOUNT_ID",
+      "docs-public-apis:@aws-cdk/core.Aws.NO_VALUE",
+      "docs-public-apis:@aws-cdk/core.Aws.NOTIFICATION_ARNS",
+      "docs-public-apis:@aws-cdk/core.Aws.PARTITION",
+      "docs-public-apis:@aws-cdk/core.Aws.REGION",
+      "docs-public-apis:@aws-cdk/core.Aws.STACK_ID",
+      "docs-public-apis:@aws-cdk/core.Aws.STACK_NAME",
+      "docs-public-apis:@aws-cdk/core.Aws.URL_SUFFIX",
+      "docs-public-apis:@aws-cdk/core.ConstructNode.root",
+      "docs-public-apis:@aws-cdk/core.ContextProvider.getKey",
+      "docs-public-apis:@aws-cdk/core.ContextProvider.getValue",
+      "docs-public-apis:@aws-cdk/core.Duration.days",
+      "docs-public-apis:@aws-cdk/core.Duration.hours",
+      "docs-public-apis:@aws-cdk/core.Duration.millis",
+      "docs-public-apis:@aws-cdk/core.Duration.minutes",
+      "docs-public-apis:@aws-cdk/core.Duration.seconds",
+      "docs-public-apis:@aws-cdk/core.Duration.toDays",
+      "docs-public-apis:@aws-cdk/core.Duration.toHours",
+      "docs-public-apis:@aws-cdk/core.Duration.toISOString",
+      "docs-public-apis:@aws-cdk/core.Duration.toMilliseconds",
+      "docs-public-apis:@aws-cdk/core.Duration.toMinutes",
+      "docs-public-apis:@aws-cdk/core.Duration.toSeconds",
+      "docs-public-apis:@aws-cdk/core.Lazy.anyValue",
+      "docs-public-apis:@aws-cdk/core.Lazy.listValue",
+      "docs-public-apis:@aws-cdk/core.Lazy.numberValue",
+      "docs-public-apis:@aws-cdk/core.Lazy.stringValue",
+      "docs-public-apis:@aws-cdk/core.Reference.displayName",
+      "docs-public-apis:@aws-cdk/core.Reference.target",
+      "docs-public-apis:@aws-cdk/core.ScopedAws.accountId",
+      "docs-public-apis:@aws-cdk/core.ScopedAws.notificationArns",
+      "docs-public-apis:@aws-cdk/core.ScopedAws.partition",
+      "docs-public-apis:@aws-cdk/core.ScopedAws.region",
+      "docs-public-apis:@aws-cdk/core.ScopedAws.stackId",
+      "docs-public-apis:@aws-cdk/core.ScopedAws.stackName",
+      "docs-public-apis:@aws-cdk/core.TagType.STANDARD",
+      "docs-public-apis:@aws-cdk/core.Stack.addDockerImageAsset",
+      "docs-public-apis:@aws-cdk/core.Stack.addFileAsset",
+      "docs-public-apis:@aws-cdk/core.TagManager.applyTagAspectHere",
+      "docs-public-apis:@aws-cdk/core.TokenizedStringFragments.firstValue",
+      "docs-public-apis:@aws-cdk/core.TokenizedStringFragments.length",
+      "docs-public-apis:@aws-cdk/core.TokenizedStringFragments.firstToken",
+      "docs-public-apis:@aws-cdk/core.TokenizedStringFragments.addIntrinsic",
+      "docs-public-apis:@aws-cdk/core.TokenizedStringFragments.addLiteral",
+      "docs-public-apis:@aws-cdk/core.TokenizedStringFragments.addToken",
+      "docs-public-apis:@aws-cdk/core.ValidationResult.errorMessage",
+      "docs-public-apis:@aws-cdk/core.ValidationResult.isSuccess",
+      "docs-public-apis:@aws-cdk/core.ValidationResult.results",
+      "docs-public-apis:@aws-cdk/core.ValidationResults.isSuccess",
+      "docs-public-apis:@aws-cdk/core.ValidationResults.results",
+      "docs-public-apis:@aws-cdk/core.ValidationResults.collect",
+      "docs-public-apis:@aws-cdk/core.ValidationResults.errorTreeList",
+      "docs-public-apis:@aws-cdk/core.ArnComponents",
+      "props-default-doc:@aws-cdk/core.ArnComponents.resourceName",
+      "docs-public-apis:@aws-cdk/core.DockerImageAssetSource",
+      "props-default-doc:@aws-cdk/core.EncodingOptions.displayHint",
+      "docs-public-apis:@aws-cdk/core.GetContextKeyOptions",
+      "props-default-doc:@aws-cdk/core.GetContextKeyOptions.props",
+      "docs-public-apis:@aws-cdk/core.GetContextKeyResult",
+      "docs-public-apis:@aws-cdk/core.GetContextKeyResult.key",
+      "docs-public-apis:@aws-cdk/core.GetContextKeyResult.props",
+      "docs-public-apis:@aws-cdk/core.GetContextValueOptions",
+      "docs-public-apis:@aws-cdk/core.GetContextValueResult",
+      "docs-public-apis:@aws-cdk/core.GetContextValueResult.value",
+      "props-default-doc:@aws-cdk/core.GetContextValueResult.value",
+      "docs-public-apis:@aws-cdk/core.ICfnResourceOptions",
+      "docs-public-apis:@aws-cdk/core.RemovalPolicyOptions",
+      "docs-public-apis:@aws-cdk/core.StackProps",
+      "docs-public-apis:@aws-cdk/core.RemovalPolicy",
+      "docs-public-apis:@aws-cdk/core.TagType"
     ]
   },
   "scripts": {
@@ -74,18 +149,18 @@
   "license": "Apache-2.0",
   "devDependencies": {
     "@types/lodash": "^4.14.144",
-    "cdk-build-tools": "^1.13.1",
-    "cfn2ts": "^1.13.1",
-    "fast-check": "^1.17.0",
+    "cdk-build-tools": "^1.15.0",
+    "cfn2ts": "^1.15.0",
+    "fast-check": "^1.18.1",
     "lodash": "^4.17.15",
-    "pkglint": "^1.13.1"
+    "pkglint": "^1.15.0"
   },
   "dependencies": {
-    "@aws-cdk/cx-api": "1.13.1"
+    "@aws-cdk/cx-api": "1.15.0"
   },
   "homepage": "https://github.com/aws/aws-cdk",
   "peerDependencies": {
-    "@aws-cdk/cx-api": "1.13.1"
+    "@aws-cdk/cx-api": "1.15.0"
   },
   "engines": {
     "node": ">= 10.3.0"
diff --git a/packages/@aws-cdk/core/test/test.assets.ts b/packages/@aws-cdk/core/test/test.assets.ts
new file mode 100644
index 0000000000000..06560d8bcaac9
--- /dev/null
+++ b/packages/@aws-cdk/core/test/test.assets.ts
@@ -0,0 +1,77 @@
+import cxapi = require('@aws-cdk/cx-api');
+import { Test } from 'nodeunit';
+import { FileAssetPackaging, Stack } from '../lib';
+import { toCloudFormation } from './util';
+
+export = {
+  'addFileAsset correctly sets metadata and creates S3 parameters'(test: Test) {
+    // GIVEN
+    const stack = new Stack();
+
+    // WHEN
+    stack.addFileAsset({
+      fileName: 'file-name',
+      packaging: FileAssetPackaging.ZIP_DIRECTORY,
+      sourceHash: 'source-hash'
+    });
+
+    // THEN
+    const assetMetadata = stack.node.metadata.find(({ type }) => type === cxapi.ASSET_METADATA);
+
+    test.equal(assetMetadata && assetMetadata.data.path, 'file-name');
+    test.equal(assetMetadata && assetMetadata.data.id, 'source-hash');
+    test.equal(assetMetadata && assetMetadata.data.packaging, FileAssetPackaging.ZIP_DIRECTORY);
+    test.equal(assetMetadata && assetMetadata.data.sourceHash, 'source-hash');
+
+    test.deepEqual(toCloudFormation(stack), {
+      Parameters: {
+        AssetParameterssourcehashS3BucketE6E91E3E: {
+          Type: 'String',
+          Description: 'S3 bucket for asset "source-hash"'
+        },
+        AssetParameterssourcehashS3VersionKeyAC4157C3: {
+          Type: 'String',
+          Description: 'S3 key for asset version "source-hash"'
+        },
+        AssetParameterssourcehashArtifactHashADBAE418: {
+          Type: 'String',
+          Description: 'Artifact hash for asset "source-hash"'
+        }
+      }
+    });
+
+    test.done();
+
+  },
+
+  'addDockerImageAsset correctly sets metadata and creates an ECR parameter'(test: Test) {
+    // GIVEN
+    const stack = new Stack();
+
+    // WHEN
+    stack.addDockerImageAsset({
+      sourceHash: 'source-hash',
+      directoryName: 'directory-name',
+      repositoryName: 'repository-name'
+    });
+
+    // THEN
+    const assetMetadata = stack.node.metadata.find(({ type }) => type === cxapi.ASSET_METADATA);
+
+    test.equal(assetMetadata && assetMetadata.data.packaging, 'container-image');
+    test.equal(assetMetadata && assetMetadata.data.path, 'directory-name');
+    test.equal(assetMetadata && assetMetadata.data.sourceHash, 'source-hash');
+    test.equal(assetMetadata && assetMetadata.data.repositoryName, 'repository-name');
+
+    test.deepEqual(toCloudFormation(stack), {
+      Parameters: {
+        AssetParameterssourcehashImageName3B572B12: {
+          Type: 'String',
+          Description: 'ECR repository name and tag for asset "source-hash"'
+        }
+      }
+    });
+
+    test.done();
+  },
+};
diff --git a/packages/@aws-cdk/custom-resources/lib/aws-custom-resource.ts b/packages/@aws-cdk/custom-resources/lib/aws-custom-resource.ts
index bf23fa7e2c973..b76ff5c5bbf41 100644
--- a/packages/@aws-cdk/custom-resources/lib/aws-custom-resource.ts
+++ b/packages/@aws-cdk/custom-resources/lib/aws-custom-resource.ts
@@ -124,6 +124,13 @@ export interface AwsCustomResourceProps {
    * @default extract the permissions from the calls
    */
   readonly policyStatements?: iam.PolicyStatement[];
+
+  /**
+   * The timeout for the Lambda function implementing this custom resource.
+   *
+   * @default Duration.seconds(30)
+   */
+  readonly timeout?: cdk.Duration
 }
 
 export class AwsCustomResource extends cdk.Construct {
@@ -147,7 +154,8 @@ export class AwsCustomResource extends cdk.Construct {
       runtime: lambda.Runtime.NODEJS_10_X,
       handler: 'index.handler',
       uuid: '679f53fa-c002-430c-b0da-5b7982bd2287',
-      lambdaPurpose: 'AWS'
+      lambdaPurpose: 'AWS',
+      timeout: props.timeout || cdk.Duration.seconds(30),
     });
 
     if (props.policyStatements) {
diff --git a/packages/@aws-cdk/custom-resources/package.json b/packages/@aws-cdk/custom-resources/package.json
index 94bd98a7e30cd..a87ae6319800b 100644
--- a/packages/@aws-cdk/custom-resources/package.json
+++ b/packages/@aws-cdk/custom-resources/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@aws-cdk/custom-resources",
-  "version": "1.13.1",
+  "version": "1.15.0",
   "description": "Constructs for implementing CDK custom resources",
   "main": "lib/index.js",
   "types": "lib/index.d.ts",
@@ -49,7 +49,7 @@
   },
   "cdk-build": {
     "pre": [
-      "cp -f $(node -p 'require.resolve(\"aws-sdk/apis/metadata.json\")') lib/sdk-api-metadata.json"
+      "cp -f $(node -p 'require.resolve(\"aws-sdk\")')/aws-sdk/apis/metadata.json lib/sdk-api-metadata.json"
     ]
   },
   "keywords": [
@@ -67,34 +67,34 @@
   },
   "license": "Apache-2.0",
   "devDependencies": {
-    "@aws-cdk/assert": "1.13.1",
-    "@aws-cdk/aws-events": "1.13.1",
-    "@aws-cdk/aws-ssm": "1.13.1",
+    "@aws-cdk/assert": "1.15.0",
+    "@aws-cdk/aws-events": "1.15.0",
+    "@aws-cdk/aws-ssm": "1.15.0",
     "@types/aws-lambda": "^8.10.33",
     "@types/sinon": "^7.5.0",
-    "aws-sdk": "^2.553.0",
+    "aws-sdk": "^2.558.0",
     "aws-sdk-mock": "^4.5.0",
-    "cdk-build-tools": "^1.13.1",
-    "cdk-integ-tools": "^1.13.1",
-    "cfn2ts": "^1.13.1",
-    "nock": "^11.4.0",
-    "pkglint": "^1.13.1",
+    "cdk-build-tools": "^1.15.0",
+    "cdk-integ-tools": "^1.15.0",
+    "cfn2ts": "^1.15.0",
+    "nock": "^11.6.0",
+    "pkglint": "^1.15.0",
     "sinon": "^7.5.0"
   },
   "dependencies": {
-    "@aws-cdk/aws-cloudformation": "1.13.1",
-    "@aws-cdk/aws-iam": "1.13.1",
-    "@aws-cdk/aws-lambda": "1.13.1",
-    "@aws-cdk/aws-sns": "1.13.1",
-    "@aws-cdk/core": "1.13.1"
+    "@aws-cdk/aws-cloudformation": "1.15.0",
+    "@aws-cdk/aws-iam": "1.15.0",
+    "@aws-cdk/aws-lambda": "1.15.0",
+    "@aws-cdk/aws-sns": "1.15.0",
+    "@aws-cdk/core": "1.15.0"
   },
   "homepage": "https://github.com/aws/aws-cdk",
   "peerDependencies": {
-    "@aws-cdk/aws-cloudformation": "1.13.1",
-    "@aws-cdk/aws-iam": "1.13.1",
-    "@aws-cdk/aws-lambda": "1.13.1",
-    "@aws-cdk/aws-sns": "1.13.1",
-    "@aws-cdk/core": "1.13.1"
+    "@aws-cdk/aws-cloudformation": "1.15.0",
+    "@aws-cdk/aws-iam": "1.15.0",
+    "@aws-cdk/aws-lambda": "1.15.0",
+    "@aws-cdk/aws-sns": "1.15.0",
+    "@aws-cdk/core": "1.15.0"
   },
   "engines": {
     "node": ">= 10.3.0"
@@ -102,7 +102,10 @@
   "stability": "experimental",
   "awslint": {
     "exclude": [
-      "construct-ctor-props-optional:@aws-cdk/custom-resources.AwsCustomResource"
+      "construct-ctor-props-optional:@aws-cdk/custom-resources.AwsCustomResource",
+      "docs-public-apis:@aws-cdk/custom-resources.AwsCustomResource",
+      "docs-public-apis:@aws-cdk/custom-resources.AwsCustomResourceProps",
+      "props-default-doc:@aws-cdk/custom-resources.AwsSdkCall.parameters"
     ]
   }
 }
diff --git a/packages/@aws-cdk/custom-resources/test/integ.aws-custom-resource.expected.json b/packages/@aws-cdk/custom-resources/test/integ.aws-custom-resource.expected.json
index 211281f25bfa5..090a8728b723c 100644
--- a/packages/@aws-cdk/custom-resources/test/integ.aws-custom-resource.expected.json
+++ b/packages/@aws-cdk/custom-resources/test/integ.aws-custom-resource.expected.json
@@ -152,7 +152,8 @@
             "Arn"
           ]
         },
-        "Runtime": "nodejs10.x"
+        "Runtime": "nodejs10.x",
+        "Timeout": 30
       },
       "DependsOn": [
         "AWS679f53fac002430cb0da5b7982bd2287ServiceRoleDefaultPolicyD28E1A5E",
diff --git a/packages/@aws-cdk/custom-resources/test/test.aws-custom-resource.ts b/packages/@aws-cdk/custom-resources/test/test.aws-custom-resource.ts
index c2177a090ea26..1e6189d558724 100644
--- a/packages/@aws-cdk/custom-resources/test/test.aws-custom-resource.ts
+++ b/packages/@aws-cdk/custom-resources/test/test.aws-custom-resource.ts
@@ -223,4 +223,47 @@ export = {
 
     test.done();
   },
+
+  'timeout defaults to 30 seconds'(test: Test) {
+    // GIVEN
+    const stack = new cdk.Stack();
+
+    // WHEN
+    new AwsCustomResource(stack, 'AwsSdk', {
+      onCreate: {
+        service: 'service',
+        action: 'action',
+        physicalResourceId: 'id'
+      }
+    });
+
+    // THEN
+    expect(stack).to(haveResource('AWS::Lambda::Function', {
+      Timeout: 30
+    }));
+
+    test.done();
+  },
+
+  'can specify timeout'(test: Test) {
+    // GIVEN
+    const stack = new cdk.Stack();
+
+    // WHEN
+    new AwsCustomResource(stack, 'AwsSdk', {
+      onCreate: {
+        service: 'service',
+        action: 'action',
+        physicalResourceId: 'id'
+      },
+      timeout: cdk.Duration.minutes(15)
+    });
+
+    // THEN
+    expect(stack).to(haveResource('AWS::Lambda::Function', {
+      Timeout: 900
+    }));
+
+    test.done();
+  }
 };
diff --git a/packages/@aws-cdk/cx-api/package.json b/packages/@aws-cdk/cx-api/package.json
index 26a5acf65eb05..d3eb6e971aeea 100644
--- a/packages/@aws-cdk/cx-api/package.json
+++ b/packages/@aws-cdk/cx-api/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@aws-cdk/cx-api",
-  "version": "1.13.1",
+  "version": "1.15.0",
   "description": "Cloud executable protocol",
   "main": "lib/index.js",
   "types": "lib/index.d.ts",
@@ -63,9 +63,9 @@
   "devDependencies": {
     "@types/jest": "^24.0.19",
     "@types/semver": "^6.0.2",
-    "cdk-build-tools": "^1.13.1",
+    "cdk-build-tools": "^1.15.0",
     "jest": "^24.9.0",
-    "pkglint": "^1.13.1"
+    "pkglint": "^1.15.0"
   },
   "repository": {
     "url": "https://github.com/aws/aws-cdk.git",
@@ -83,5 +83,63 @@
   "engines": {
     "node": ">= 10.3.0"
   },
-  "stability": "experimental"
+  "stability": "experimental",
+  "awslint": {
+    "exclude": [
+      "props-default-doc:@aws-cdk/cx-api.MetadataEntry.data",
+      "docs-public-apis:@aws-cdk/cx-api.CloudArtifact.assembly",
+      "docs-public-apis:@aws-cdk/cx-api.CloudArtifact.findMetadataByType",
+      "docs-public-apis:@aws-cdk/cx-api.CloudAssembly.stacks",
+      "docs-public-apis:@aws-cdk/cx-api.CloudFormationStackArtifact",
+      "docs-public-apis:@aws-cdk/cx-api.EnvironmentUtils",
+      "docs-public-apis:@aws-cdk/cx-api.EnvironmentUtils.format",
+      "docs-public-apis:@aws-cdk/cx-api.EnvironmentUtils.parse",
+      "docs-public-apis:@aws-cdk/cx-api.TreeCloudArtifact",
+      "docs-public-apis:@aws-cdk/cx-api.TreeCloudArtifact.file",
+      "props-default-doc:@aws-cdk/cx-api.ArtifactManifest.dependencies",
+      "props-default-doc:@aws-cdk/cx-api.ArtifactManifest.environment",
+      "props-default-doc:@aws-cdk/cx-api.ArtifactManifest.metadata",
+      "props-default-doc:@aws-cdk/cx-api.ArtifactManifest.properties",
+      "docs-public-apis:@aws-cdk/cx-api.AssemblyBuildOptions",
+      "props-default-doc:@aws-cdk/cx-api.AssemblyManifest.artifacts",
+      "props-default-doc:@aws-cdk/cx-api.AssemblyManifest.missing",
+      "props-default-doc:@aws-cdk/cx-api.AssemblyManifest.runtime",
+      "props-default-doc:@aws-cdk/cx-api.AvailabilityZonesContextQuery.account",
+      "props-default-doc:@aws-cdk/cx-api.AvailabilityZonesContextQuery.region",
+      "props-default-doc:@aws-cdk/cx-api.AwsCloudFormationStackProperties.parameters",
+      "docs-public-apis:@aws-cdk/cx-api.ContainerImageAssetMetadataEntry",
+      "docs-public-apis:@aws-cdk/cx-api.FileAssetMetadataEntry",
+      "props-default-doc:@aws-cdk/cx-api.HostedZoneContextQuery.account",
+      "props-default-doc:@aws-cdk/cx-api.HostedZoneContextQuery.privateZone",
+      "props-default-doc:@aws-cdk/cx-api.HostedZoneContextQuery.region",
+      "props-default-doc:@aws-cdk/cx-api.HostedZoneContextQuery.vpcId",
+      "docs-public-apis:@aws-cdk/cx-api.CloudArtifact.id",
+      "props-default-doc:@aws-cdk/cx-api.MetadataEntry.trace",
+      "docs-public-apis:@aws-cdk/cx-api.MetadataEntryResult",
+      "props-default-doc:@aws-cdk/cx-api.SSMParameterContextQuery.account",
+      "props-default-doc:@aws-cdk/cx-api.SSMParameterContextQuery.parameterName",
+      "props-default-doc:@aws-cdk/cx-api.SSMParameterContextQuery.region",
+      "docs-public-apis:@aws-cdk/cx-api.SynthesisMessage",
+      "docs-public-apis:@aws-cdk/cx-api.SynthesisMessage.entry",
+      "docs-public-apis:@aws-cdk/cx-api.SynthesisMessage.id",
+      "docs-public-apis:@aws-cdk/cx-api.SynthesisMessage.level",
+      "props-default-doc:@aws-cdk/cx-api.VpcContextQuery.account",
+      "props-default-doc:@aws-cdk/cx-api.VpcContextQuery.region",
+      "props-default-doc:@aws-cdk/cx-api.VpcContextResponse.isolatedSubnetIds",
+      "props-default-doc:@aws-cdk/cx-api.VpcContextResponse.isolatedSubnetNames",
+      "props-default-doc:@aws-cdk/cx-api.VpcContextResponse.isolatedSubnetRouteTableIds",
+      "props-default-doc:@aws-cdk/cx-api.VpcContextResponse.privateSubnetIds",
+      "props-default-doc:@aws-cdk/cx-api.VpcContextResponse.privateSubnetNames",
+      "props-default-doc:@aws-cdk/cx-api.VpcContextResponse.privateSubnetRouteTableIds",
+      "props-default-doc:@aws-cdk/cx-api.VpcContextResponse.publicSubnetIds",
+      "props-default-doc:@aws-cdk/cx-api.VpcContextResponse.publicSubnetNames",
+      "props-default-doc:@aws-cdk/cx-api.VpcContextResponse.publicSubnetRouteTableIds",
+      "props-default-doc:@aws-cdk/cx-api.VpcContextResponse.vpnGatewayId",
+      "docs-public-apis:@aws-cdk/cx-api.ArtifactType.NONE",
+      "docs-public-apis:@aws-cdk/cx-api.SynthesisMessageLevel",
+      "docs-public-apis:@aws-cdk/cx-api.SynthesisMessageLevel.INFO",
+      "docs-public-apis:@aws-cdk/cx-api.SynthesisMessageLevel.WARNING",
+      "docs-public-apis:@aws-cdk/cx-api.SynthesisMessageLevel.ERROR"
+    ]
+  }
 }
diff --git a/packages/@aws-cdk/region-info/README.md b/packages/@aws-cdk/region-info/README.md
index 5fa911356fe02..7a9983405a7ac 100644
--- a/packages/@aws-cdk/region-info/README.md
+++ b/packages/@aws-cdk/region-info/README.md
@@ -32,7 +32,7 @@ import { RegionInfo } from '@aws-cdk/region-info';
 const region = RegionInfo.get('eu-west-1');
 
 // Access attributes:
-region.s3StaticWebsiteEndpoint; // s3-website.eu-west-1.amazonaws.com
+region.s3StaticWebsiteEndpoint; // s3-website-eu-west-1.amazonaws.com
 region.servicePrincipal('logs.amazonaws.com'); // logs.eu-west-1.amazonaws.com
 ```
 
diff --git a/packages/@aws-cdk/region-info/build-tools/generate-static-data.ts b/packages/@aws-cdk/region-info/build-tools/generate-static-data.ts
index 92f05dd030585..10ee64f5c9558 100644
--- a/packages/@aws-cdk/region-info/build-tools/generate-static-data.ts
+++ b/packages/@aws-cdk/region-info/build-tools/generate-static-data.ts
@@ -29,7 +29,8 @@ async function main(): Promise<void> {
     'ap-southeast-1',
     'ap-southeast-2',
     'ap-northeast-1',
-    'sa-east-1'
+    'sa-east-1',
+    'eu-west-1',
   ]);
 
   const AWS_CDK_METADATA = new Set([
diff --git a/packages/@aws-cdk/region-info/package.json b/packages/@aws-cdk/region-info/package.json
index 139f708498378..fbd4a652ac3d5 100644
--- a/packages/@aws-cdk/region-info/package.json
+++ b/packages/@aws-cdk/region-info/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@aws-cdk/region-info",
-  "version": "1.13.1",
+  "version": "1.15.0",
   "description": "AWS region information, such as service principal names",
   "main": "lib/index.js",
   "types": "lib/index.d.ts",
@@ -41,6 +41,7 @@
     "lint": "cdk-lint",
     "test": "cdk-test",
     "pkglint": "pkglint -f",
+    "awslint": "cdk-awslint",
     "package": "cdk-package",
     "build+test+package": "npm run build+test && npm run package",
     "build+test": "npm run build && npm test"
@@ -53,9 +54,9 @@
   "license": "Apache-2.0",
   "devDependencies": {
     "@types/fs-extra": "^8.0.1",
-    "cdk-build-tools": "^1.13.1",
+    "cdk-build-tools": "^1.15.0",
     "fs-extra": "^8.1.0",
-    "pkglint": "^1.13.1"
+    "pkglint": "^1.15.0"
   },
   "jest": {
     "coverageReporters": [
@@ -88,5 +89,12 @@
   "engines": {
     "node": ">= 10.3.0"
   },
-  "stability": "experimental"
+  "stability": "experimental",
+  "awslint": {
+    "exclude": [
+      "docs-public-apis:@aws-cdk/region-info.Fact.regions",
+      "docs-public-apis:@aws-cdk/region-info.RegionInfo.regions",
+      "docs-public-apis:@aws-cdk/region-info.RegionInfo.name"
+    ]
+  }
 }
diff --git a/packages/@aws-cdk/region-info/test/__snapshots__/region-info.test.ts.snap b/packages/@aws-cdk/region-info/test/__snapshots__/region-info.test.ts.snap
index 2bbec72eee94a..b966696c0f7ec 100644
--- a/packages/@aws-cdk/region-info/test/__snapshots__/region-info.test.ts.snap
+++ b/packages/@aws-cdk/region-info/test/__snapshots__/region-info.test.ts.snap
@@ -215,7 +215,7 @@ Object {
     "cdkMetadataResourceAvailable": true,
     "domainSuffix": "amazonaws.com",
     "partition": "aws",
-    "s3StaticWebsiteEndpoint": "s3-website.eu-west-1.amazonaws.com",
+    "s3StaticWebsiteEndpoint": "s3-website-eu-west-1.amazonaws.com",
     "servicePrincipals": Object {
       "application-autoscaling": "application-autoscaling.amazonaws.com",
       "autoscaling": "autoscaling.amazonaws.com",
diff --git a/packages/aws-cdk/.gitignore b/packages/aws-cdk/.gitignore
index 75d51ebc9fd05..17e9b17659ffc 100644
--- a/packages/aws-cdk/.gitignore
+++ b/packages/aws-cdk/.gitignore
@@ -16,3 +16,4 @@ coverage
 *.snk
 
 !test/integ/run-wrappers/dist
+!test/integ/cli/**/*
diff --git a/packages/aws-cdk/bin/cdk.ts b/packages/aws-cdk/bin/cdk.ts
index 9c7fb7ef955fa..97864cd79f503 100644
--- a/packages/aws-cdk/bin/cdk.ts
+++ b/packages/aws-cdk/bin/cdk.ts
@@ -230,6 +230,8 @@ async function initCommandLine() {
         } else {
           return await cliInit(args.TEMPLATE, language);
         }
+      case 'version':
+        return print(version.DISPLAY_VERSION);
 
       default:
         throw new Error('Unknown command: ' + command);
diff --git a/packages/aws-cdk/lib/api/toolkit-info.ts b/packages/aws-cdk/lib/api/toolkit-info.ts
index f9fb23f18c34d..726d34ae16596 100644
--- a/packages/aws-cdk/lib/api/toolkit-info.ts
+++ b/packages/aws-cdk/lib/api/toolkit-info.ts
@@ -108,7 +108,7 @@ export class ToolkitInfo {
   public async prepareEcrRepository(asset: cxapi.ContainerImageAssetMetadataEntry): Promise<EcrRepositoryInfo> {
     const ecr = await this.props.sdk.ecr(this.props.environment.account, this.props.environment.region, Mode.ForWriting);
     let repositoryName;
-    if ( asset.repositoryName ) {
+    if (asset.repositoryName) {
       // Repository name provided by user
       repositoryName = asset.repositoryName;
     } else {
diff --git a/packages/aws-cdk/package.json b/packages/aws-cdk/package.json
index 880363912432c..bfe46111129b2 100644
--- a/packages/aws-cdk/package.json
+++ b/packages/aws-cdk/package.json
@@ -1,7 +1,7 @@
 {
   "name": "aws-cdk",
   "description": "CDK Toolkit, the command line tool for CDK apps",
-  "version": "1.13.1",
+  "version": "1.15.0",
   "main": "lib/index.js",
   "types": "lib/index.d.ts",
   "bin": {
@@ -42,7 +42,7 @@
     "@types/jszip": "^3.1.6",
     "@types/minimatch": "^3.0.3",
     "@types/mockery": "^1.4.29",
-    "@types/node": "^8.10.55",
+    "@types/node": "^8.10.56",
     "@types/request": "^2.48.3",
     "@types/semver": "^6.0.2",
     "@types/sinon": "^7.5.0",
@@ -51,18 +51,18 @@
     "@types/yaml": "^1.2.0",
     "@types/yargs": "^13.0.3",
     "aws-sdk-mock": "^4.5.0",
-    "cdk-build-tools": "^1.13.1",
+    "cdk-build-tools": "^1.15.0",
     "jszip": "^3.2.2",
     "mockery": "^2.1.0",
-    "pkglint": "^1.13.1",
+    "pkglint": "^1.15.0",
     "sinon": "^7.5.0"
   },
   "dependencies": {
-    "@aws-cdk/cloudformation-diff": "1.13.1",
-    "@aws-cdk/cx-api": "1.13.1",
-    "@aws-cdk/region-info": "1.13.1",
+    "@aws-cdk/cloudformation-diff": "1.15.0",
+    "@aws-cdk/cx-api": "1.15.0",
+    "@aws-cdk/region-info": "1.15.0",
     "archiver": "^3.1.1",
-    "aws-sdk": "^2.553.0",
+    "aws-sdk": "^2.558.0",
     "camelcase": "^5.3.1",
     "colors": "^1.4.0",
     "decamelize": "^3.2.0",
@@ -71,7 +71,7 @@
     "json-diff": "^0.5.4",
     "minimatch": ">=3.0",
     "promptly": "^3.0.3",
-    "proxy-agent": "^3.1.0",
+    "proxy-agent": "^3.1.1",
     "request": "^2.88.0",
     "semver": "^6.3.0",
     "source-map-support": "^0.5.13",
diff --git a/packages/aws-cdk/test/integ/cli/.gitignore b/packages/aws-cdk/test/integ/cli/.gitignore
new file mode 100644
index 0000000000000..e136cb6cd26fb
--- /dev/null
+++ b/packages/aws-cdk/test/integ/cli/.gitignore
@@ -0,0 +1 @@
+cdk.context.json
diff --git a/packages/aws-cdk/test/integ/cli/app/.gitignore b/packages/aws-cdk/test/integ/cli/app/.gitignore
deleted file mode 100644
index d4aa116a26c73..0000000000000
--- a/packages/aws-cdk/test/integ/cli/app/.gitignore
+++ /dev/null
@@ -1 +0,0 @@
-!*.js
diff --git a/packages/aws-cdk/test/integ/cli/cloud-assemblies/0.36.0/InitStack.template.json b/packages/aws-cdk/test/integ/cli/cloud-assemblies/0.36.0/InitStack.template.json
new file mode 100644
index 0000000000000..9e26dfeeb6e64
--- /dev/null
+++ b/packages/aws-cdk/test/integ/cli/cloud-assemblies/0.36.0/InitStack.template.json
@@ -0,0 +1 @@
+{}
\ No newline at end of file
diff --git a/packages/aws-cdk/test/integ/cli/cloud-assemblies/0.36.0/cdk.out b/packages/aws-cdk/test/integ/cli/cloud-assemblies/0.36.0/cdk.out
new file mode 100644
index 0000000000000..bfe018f236569
--- /dev/null
+++ b/packages/aws-cdk/test/integ/cli/cloud-assemblies/0.36.0/cdk.out
@@ -0,0 +1 @@
+{"version":"0.36.0"}
diff --git a/packages/aws-cdk/test/integ/cli/cloud-assemblies/0.36.0/manifest.json b/packages/aws-cdk/test/integ/cli/cloud-assemblies/0.36.0/manifest.json
new file mode 100644
index 0000000000000..025294fe09aa7
--- /dev/null
+++ b/packages/aws-cdk/test/integ/cli/cloud-assemblies/0.36.0/manifest.json
@@ -0,0 +1,19 @@
+{
+  "version": "0.36.0",
+  "artifacts": {
+    "InitStack": {
+      "type": "aws:cloudformation:stack",
+      "environment": "aws://unknown-account/unknown-region",
+      "properties": {
+        "templateFile": "InitStack.template.json"
+      }
+    }
+  },
+  "runtime": {
+    "libraries": {
+      "@aws-cdk/core": "1.12.0",
+      "@aws-cdk/cx-api": "1.12.0",
+      "jsii-runtime": "node.js/v8.11.4"
+    }
+  }
+}
diff --git a/packages/aws-cdk/test/integ/cli/cloud-assemblies/1.10.0-lookup-default-vpc/InitStack.template.json b/packages/aws-cdk/test/integ/cli/cloud-assemblies/1.10.0-lookup-default-vpc/InitStack.template.json
new file mode 100644
index 0000000000000..2c63c0851048d
--- /dev/null
+++ b/packages/aws-cdk/test/integ/cli/cloud-assemblies/1.10.0-lookup-default-vpc/InitStack.template.json
@@ -0,0 +1,2 @@
+{
+}
diff --git a/packages/aws-cdk/test/integ/cli/cloud-assemblies/1.10.0-lookup-default-vpc/cdk.out b/packages/aws-cdk/test/integ/cli/cloud-assemblies/1.10.0-lookup-default-vpc/cdk.out
new file mode 100644
index 0000000000000..77925ad4488a6
--- /dev/null
+++ b/packages/aws-cdk/test/integ/cli/cloud-assemblies/1.10.0-lookup-default-vpc/cdk.out
@@ -0,0 +1 @@
+{"version":"1.10.0"}
\ No newline at end of file
diff --git a/packages/aws-cdk/test/integ/cli/cloud-assemblies/1.10.0-lookup-default-vpc/manifest.json.js b/packages/aws-cdk/test/integ/cli/cloud-assemblies/1.10.0-lookup-default-vpc/manifest.json.js
new file mode 100644
index 0000000000000..e328ea2e9d2fd
--- /dev/null
+++ b/packages/aws-cdk/test/integ/cli/cloud-assemblies/1.10.0-lookup-default-vpc/manifest.json.js
@@ -0,0 +1,37 @@
+process.stdout.write(JSON.stringify({
+  "version": "1.10.0",
+  "artifacts": {
+    "InitStack": {
+      "type": "aws:cloudformation:stack",
+      "environment": `aws://${process.env.TEST_ACCOUNT}/${process.env.TEST_REGION}`,
+      "properties": {
+        "templateFile": "InitStack.template.json"
+      }
+    }
+  },
+  "runtime": {
+    "libraries": {
+      "@aws-cdk/core": "1.14.0",
+      "@aws-cdk/cx-api": "1.14.0",
+      "@aws-cdk/aws-ec2": "1.14.0",
+      "@aws-cdk/aws-iam": "1.14.0",
+      "@aws-cdk/region-info": "1.14.0",
+      "@aws-cdk/aws-ssm": "1.14.0",
+      "@aws-cdk/aws-cloudwatch": "1.14.0",
+      "jsii-runtime": "node.js/v8.11.4"
+    }
+  },
+  "missing": [
+    {
+      "key": `vpc-provider:account=${process.env.TEST_ACCOUNT}:filter.isDefault=true:region=${process.env.TEST_REGION}`,
+      "props": {
+        "account": process.env.TEST_ACCOUNT,
+        "region": process.env.TEST_REGION,
+        "filter": {
+          "isDefault": "true"
+        }
+      },
+      "provider": "vpc-provider"
+    }
+  ]
+}, undefined, 2));
diff --git a/packages/aws-cdk/test/integ/cli/cloud-assemblies/1.10.0-request-azs/InitStack.template.json b/packages/aws-cdk/test/integ/cli/cloud-assemblies/1.10.0-request-azs/InitStack.template.json
new file mode 100644
index 0000000000000..2c63c0851048d
--- /dev/null
+++ b/packages/aws-cdk/test/integ/cli/cloud-assemblies/1.10.0-request-azs/InitStack.template.json
@@ -0,0 +1,2 @@
+{
+}
diff --git a/packages/aws-cdk/test/integ/cli/cloud-assemblies/1.10.0-request-azs/cdk.out b/packages/aws-cdk/test/integ/cli/cloud-assemblies/1.10.0-request-azs/cdk.out
new file mode 100644
index 0000000000000..77925ad4488a6
--- /dev/null
+++ b/packages/aws-cdk/test/integ/cli/cloud-assemblies/1.10.0-request-azs/cdk.out
@@ -0,0 +1 @@
+{"version":"1.10.0"}
\ No newline at end of file
diff --git a/packages/aws-cdk/test/integ/cli/cloud-assemblies/1.10.0-request-azs/manifest.json.js b/packages/aws-cdk/test/integ/cli/cloud-assemblies/1.10.0-request-azs/manifest.json.js
new file mode 100644
index 0000000000000..9c88f8ad78941
--- /dev/null
+++ b/packages/aws-cdk/test/integ/cli/cloud-assemblies/1.10.0-request-azs/manifest.json.js
@@ -0,0 +1,34 @@
+process.stdout.write(JSON.stringify({
+  "version": "1.10.0",
+  "artifacts": {
+    "InitStack": {
+      "type": "aws:cloudformation:stack",
+      "environment": `aws://${process.env.TEST_ACCOUNT}/${process.env.TEST_REGION}`,
+      "properties": {
+        "templateFile": "InitStack.template.json"
+      }
+    }
+  },
+  "runtime": {
+    "libraries": {
+      "@aws-cdk/core": "1.14.0",
+      "@aws-cdk/cx-api": "1.14.0",
+      "@aws-cdk/aws-ec2": "1.14.0",
+      "@aws-cdk/aws-iam": "1.14.0",
+      "@aws-cdk/region-info": "1.14.0",
+      "@aws-cdk/aws-ssm": "1.14.0",
+      "@aws-cdk/aws-cloudwatch": "1.14.0",
+      "jsii-runtime": "node.js/v8.11.4"
+    }
+  },
+  "missing": [
+    {
+      "key": `availability-zones:account=${process.env.TEST_ACCOUNT}:region=${process.env.TEST_REGION}`,
+      "props": {
+        "account": process.env.TEST_ACCOUNT,
+        "region": process.env.TEST_REGION,
+      },
+      "provider": "availability-zones"
+    }
+  ]
+}, undefined, 2));
diff --git a/packages/aws-cdk/test/integ/cli/common.bash b/packages/aws-cdk/test/integ/cli/common.bash
index 95ee98f14ddf9..50a85c9889f0a 100644
--- a/packages/aws-cdk/test/integ/cli/common.bash
+++ b/packages/aws-cdk/test/integ/cli/common.bash
@@ -3,8 +3,11 @@ scriptdir=$(cd $(dirname $0) && pwd)
 cd ${scriptdir}
 
 if [[ -z "${CREDS_SET:-}" ]]; then
-    # Check that credentials are configured
-    aws sts get-caller-identity > /dev/null
+    # Check that credentials are configured (will error & abort if not)
+    creds=$(aws sts get-caller-identity)
+
+    export TEST_ACCOUNT=$(node -p "($creds).Account")
+    export TEST_REGION=${AWS_REGION:-${AWS_DEFAULT_REGION:-us-east-1}}
     export CREDS_SET=1
 fi
 
diff --git a/packages/aws-cdk/test/integ/cli/test-backwards-compat.sh b/packages/aws-cdk/test/integ/cli/test-backwards-compat.sh
new file mode 100755
index 0000000000000..eb14faf7010af
--- /dev/null
+++ b/packages/aws-cdk/test/integ/cli/test-backwards-compat.sh
@@ -0,0 +1,54 @@
+#!/bin/bash
+set -euo pipefail
+scriptdir=$(cd $(dirname $0) && pwd)
+source ${scriptdir}/common.bash
+# ----------------------------------------------------------
+
+tmpdir=$(dirname $(mktemp -u))
+casmdir=$tmpdir/cdk-integ-cx
+stderrfile=$casmdir/cdk.err
+
+# Copy the files from a cloud assembly source dir into the
+# tempdir. Evaluate .js files found their (interpret them
+# as templates).
+function prepare_cloud_assembly() {
+    local asmdir=$1
+    echo "ASSEMBLY ${asmdir}"
+    rm -rf $casmdir
+    mkdir -p $casmdir
+    cp -R $asmdir/* $casmdir
+
+    # Execute templates to produce file with the same name
+    # but without .js extension
+    shopt -s nullglob
+    for template in $casmdir/*.js; do
+        node $template > ${template%.js}
+    done
+}
+
+# Assert that there was no providerError in CDK's stderr
+# Because we rely on the app/framework to actually error in case the
+# provider fails, we inspect the logs here.
+function assert_no_error() {
+    local asmdir=$1
+
+    if grep '$providerError' $stderrfile; then
+        cat $stderrfile >&2
+        echo "There was an error executing the context provider for assembly ${asmdir}!" >&2
+        exit 1
+    fi
+}
+
+# Echo the TEST_ACCOUNT, TEST_REGION vars to make bash abort if they're not set.
+echo "Running backwards compatibility test (account ${TEST_ACCOUNT}, region ${TEST_REGION})"
+
+for assembly in ${scriptdir}/cloud-assemblies/*; do
+    prepare_cloud_assembly $assembly
+
+    rm -f cdk.context.json
+    cdk -a $casmdir -v synth > /dev/null 2> $stderrfile
+
+    assert_no_error $assembly
+done
+
+echo "✅  success"
diff --git a/packages/aws-cdk/test/integ/cli/test-cdk-ssm-parameter-provider-error.sh b/packages/aws-cdk/test/integ/cli/test-cdk-ssm-parameter-provider-error.sh
index 3b007f6e37b93..224e930658e0a 100755
--- a/packages/aws-cdk/test/integ/cli/test-cdk-ssm-parameter-provider-error.sh
+++ b/packages/aws-cdk/test/integ/cli/test-cdk-ssm-parameter-provider-error.sh
@@ -7,15 +7,13 @@ source ${scriptdir}/common.bash
 setup
 
 parameterName=/does/not/exist
-account=$(node -p "($(aws sts get-caller-identity)).Account")
-region=${AWS_REGION:-${AWS_DEFAULT_REGION:-us-east-1}}
 
 function cdk_synth() {
     (cdk synth $@ 2>&1 || true) | strip_color_codes
 }
 
 assert "cdk_synth ${STACK_NAME_PREFIX}-missing-ssm-parameter -c test:ssm-parameter-name=${parameterName}" <<HERE
-[Error at /${STACK_NAME_PREFIX}-missing-ssm-parameter] SSM parameter not available in account ${account}, region ${region}: /does/not/exist
+[Error at /${STACK_NAME_PREFIX}-missing-ssm-parameter] SSM parameter not available in account ${TEST_ACCOUNT}, region ${TEST_REGION}: /does/not/exist
 Found errors
 HERE
 
diff --git a/packages/aws-cdk/test/integ/cli/test-cdk-version.sh b/packages/aws-cdk/test/integ/cli/test-cdk-version.sh
new file mode 100644
index 0000000000000..6aa26d0dc00b3
--- /dev/null
+++ b/packages/aws-cdk/test/integ/cli/test-cdk-version.sh
@@ -0,0 +1,11 @@
+#!/bin/bash
+set -euo pipefail
+scriptdir=$(cd $(dirname $0) && pwd)
+source ${scriptdir}/common.bash
+# ----------------------------------------------------------
+
+setup
+
+assert "cdk version" "cdk --version"
+
+echo "✅  success"
diff --git a/packages/aws-cdk/test/test.docker.ts b/packages/aws-cdk/test/test.docker.ts
index e1213617cb53d..b187f859a4346 100644
--- a/packages/aws-cdk/test/test.docker.ts
+++ b/packages/aws-cdk/test/test.docker.ts
@@ -55,6 +55,53 @@ export = {
     test.done();
   },
 
+  async 'derives repository name from asset id'(test: Test) {
+    // GIVEN
+
+    let createdName;
+
+    const sdk = new MockSDK();
+    sdk.stubEcr({
+      describeRepositories() {
+        return { repositories: [] };
+      },
+
+      createRepository(req) {
+        createdName = req.repositoryName;
+
+        // Stop the test so that we don't actually docker build
+        throw new Error('STOPTEST');
+      },
+    });
+
+    const toolkit = new ToolkitInfo({
+      sdk,
+      bucketName: 'BUCKET_NAME',
+      bucketEndpoint: 'BUCKET_ENDPOINT',
+      environment: { name: 'env', account: '1234', region: 'abc' }
+    });
+
+    // WHEN
+    const asset: cxapi.ContainerImageAssetMetadataEntry = {
+      id: 'Stack:Construct/ABC123',
+      imageNameParameter: 'MyParameter',
+      packaging: 'container-image',
+      path: '/foo',
+      sourceHash: '0123456789abcdef',
+    };
+
+    try {
+      await prepareContainerAsset('.', asset, toolkit, false);
+    } catch (e) {
+      if (!/STOPTEST/.test(e.toString())) { throw e; }
+    }
+
+    // THEN
+    test.deepEqual(createdName, 'cdk/stack-construct-abc123');
+
+    test.done();
+  },
+
   async 'passes the correct target to docker build'(test: Test) {
     // GIVEN
     const toolkit = new ToolkitInfo({
diff --git a/packages/cdk-dasm/package.json b/packages/cdk-dasm/package.json
index 69c824970511c..b5653df51e393 100644
--- a/packages/cdk-dasm/package.json
+++ b/packages/cdk-dasm/package.json
@@ -1,6 +1,6 @@
 {
   "name": "cdk-dasm",
-  "version": "1.13.1",
+  "version": "1.15.0",
   "description": "AWS CDK disassembler: convert CloudFormation to code",
   "main": "lib/index.js",
   "types": "lib/index.d.ts",
@@ -40,6 +40,6 @@
   ],
   "homepage": "https://github.com/aws/aws-cdk",
   "engines": {
-    "node": ">= 10.3.0"
+    "node": ">= 8.10.0"
   }
 }
diff --git a/packages/cdk/package.json b/packages/cdk/package.json
index f7df5c3e7e22a..232674408a7c2 100644
--- a/packages/cdk/package.json
+++ b/packages/cdk/package.json
@@ -1,12 +1,12 @@
 {
   "name": "cdk",
-  "version": "1.13.1",
+  "version": "1.15.0",
   "description": "AWS CDK Toolkit",
   "bin": {
     "cdk": "bin/cdk"
   },
   "dependencies": {
-    "aws-cdk": "1.13.1"
+    "aws-cdk": "1.15.0"
   },
   "repository": {
     "type": "git",
@@ -34,6 +34,6 @@
     "build+test+package": "npm run build+test && npm run package"
   },
   "engines": {
-    "node": ">= 10.3.0"
+    "node": ">= 8.10.0"
   }
 }
diff --git a/packages/decdk/package.json b/packages/decdk/package.json
index 91228f64c3147..3270c2e99acba 100644
--- a/packages/decdk/package.json
+++ b/packages/decdk/package.json
@@ -1,6 +1,6 @@
 {
   "name": "decdk",
-  "version": "1.13.1",
+  "version": "1.15.0",
   "description": "Declarative CDK: a CloudFormation-like syntax for defining CDK stacks",
   "main": "lib/index.js",
   "types": "lib/index.d.ts",
@@ -27,130 +27,130 @@
   },
   "license": "Apache-2.0",
   "dependencies": {
-    "@aws-cdk/alexa-ask": "1.13.1",
-    "@aws-cdk/app-delivery": "1.13.1",
-    "@aws-cdk/assets": "1.13.1",
-    "@aws-cdk/aws-amazonmq": "1.13.1",
-    "@aws-cdk/aws-amplify": "1.13.1",
-    "@aws-cdk/aws-apigateway": "1.13.1",
-    "@aws-cdk/aws-applicationautoscaling": "1.13.1",
-    "@aws-cdk/aws-appmesh": "1.13.1",
-    "@aws-cdk/aws-appstream": "1.13.1",
-    "@aws-cdk/aws-appsync": "1.13.1",
-    "@aws-cdk/aws-athena": "1.13.1",
-    "@aws-cdk/aws-autoscaling": "1.13.1",
-    "@aws-cdk/aws-autoscaling-common": "1.13.1",
-    "@aws-cdk/aws-autoscaling-hooktargets": "1.13.1",
-    "@aws-cdk/aws-autoscalingplans": "1.13.1",
-    "@aws-cdk/aws-backup": "1.13.1",
-    "@aws-cdk/aws-batch": "1.13.1",
-    "@aws-cdk/aws-budgets": "1.13.1",
-    "@aws-cdk/aws-certificatemanager": "1.13.1",
-    "@aws-cdk/aws-cloud9": "1.13.1",
-    "@aws-cdk/aws-cloudformation": "1.13.1",
-    "@aws-cdk/aws-cloudfront": "1.13.1",
-    "@aws-cdk/aws-cloudtrail": "1.13.1",
-    "@aws-cdk/aws-cloudwatch": "1.13.1",
-    "@aws-cdk/aws-cloudwatch-actions": "1.13.1",
-    "@aws-cdk/aws-codebuild": "1.13.1",
-    "@aws-cdk/aws-codecommit": "1.13.1",
-    "@aws-cdk/aws-codedeploy": "1.13.1",
-    "@aws-cdk/aws-codepipeline": "1.13.1",
-    "@aws-cdk/aws-codepipeline-actions": "1.13.1",
-    "@aws-cdk/aws-codestar": "1.13.1",
-    "@aws-cdk/aws-cognito": "1.13.1",
-    "@aws-cdk/aws-config": "1.13.1",
-    "@aws-cdk/aws-datapipeline": "1.13.1",
-    "@aws-cdk/aws-dax": "1.13.1",
-    "@aws-cdk/aws-directoryservice": "1.13.1",
-    "@aws-cdk/aws-dlm": "1.13.1",
-    "@aws-cdk/aws-dms": "1.13.1",
-    "@aws-cdk/aws-docdb": "1.13.1",
-    "@aws-cdk/aws-dynamodb": "1.13.1",
-    "@aws-cdk/aws-dynamodb-global": "1.13.1",
-    "@aws-cdk/aws-ec2": "1.13.1",
-    "@aws-cdk/aws-ecr": "1.13.1",
-    "@aws-cdk/aws-ecr-assets": "1.13.1",
-    "@aws-cdk/aws-ecs": "1.13.1",
-    "@aws-cdk/aws-ecs-patterns": "1.13.1",
-    "@aws-cdk/aws-efs": "1.13.1",
-    "@aws-cdk/aws-eks": "1.13.1",
-    "@aws-cdk/aws-elasticache": "1.13.1",
-    "@aws-cdk/aws-elasticbeanstalk": "1.13.1",
-    "@aws-cdk/aws-elasticloadbalancing": "1.13.1",
-    "@aws-cdk/aws-elasticloadbalancingv2": "1.13.1",
-    "@aws-cdk/aws-elasticloadbalancingv2-targets": "1.13.1",
-    "@aws-cdk/aws-elasticsearch": "1.13.1",
-    "@aws-cdk/aws-emr": "1.13.1",
-    "@aws-cdk/aws-events": "1.13.1",
-    "@aws-cdk/aws-events-targets": "1.13.1",
-    "@aws-cdk/aws-fsx": "1.13.1",
-    "@aws-cdk/aws-gamelift": "1.13.1",
-    "@aws-cdk/aws-glue": "1.13.1",
-    "@aws-cdk/aws-greengrass": "1.13.1",
-    "@aws-cdk/aws-guardduty": "1.13.1",
-    "@aws-cdk/aws-iam": "1.13.1",
-    "@aws-cdk/aws-inspector": "1.13.1",
-    "@aws-cdk/aws-iot": "1.13.1",
-    "@aws-cdk/aws-iot1click": "1.13.1",
-    "@aws-cdk/aws-iotanalytics": "1.13.1",
-    "@aws-cdk/aws-iotevents": "1.13.1",
-    "@aws-cdk/aws-iotthingsgraph": "1.13.1",
-    "@aws-cdk/aws-kinesis": "1.13.1",
-    "@aws-cdk/aws-kinesisanalytics": "1.13.1",
-    "@aws-cdk/aws-kinesisfirehose": "1.13.1",
-    "@aws-cdk/aws-kms": "1.13.1",
-    "@aws-cdk/aws-lakeformation": "1.13.1",
-    "@aws-cdk/aws-lambda": "1.13.1",
-    "@aws-cdk/aws-lambda-event-sources": "1.13.1",
-    "@aws-cdk/aws-logs": "1.13.1",
-    "@aws-cdk/aws-logs-destinations": "1.13.1",
-    "@aws-cdk/aws-managedblockchain": "1.13.1",
-    "@aws-cdk/aws-medialive": "1.13.1",
-    "@aws-cdk/aws-mediastore": "1.13.1",
-    "@aws-cdk/aws-msk": "1.13.1",
-    "@aws-cdk/aws-neptune": "1.13.1",
-    "@aws-cdk/aws-opsworks": "1.13.1",
-    "@aws-cdk/aws-opsworkscm": "1.13.1",
-    "@aws-cdk/aws-pinpoint": "1.13.1",
-    "@aws-cdk/aws-pinpointemail": "1.13.1",
-    "@aws-cdk/aws-qldb": "1.13.1",
-    "@aws-cdk/aws-ram": "1.13.1",
-    "@aws-cdk/aws-rds": "1.13.1",
-    "@aws-cdk/aws-redshift": "1.13.1",
-    "@aws-cdk/aws-robomaker": "1.13.1",
-    "@aws-cdk/aws-route53": "1.13.1",
-    "@aws-cdk/aws-route53-patterns": "1.13.1",
-    "@aws-cdk/aws-route53-targets": "1.13.1",
-    "@aws-cdk/aws-route53resolver": "1.13.1",
-    "@aws-cdk/aws-s3": "1.13.1",
-    "@aws-cdk/aws-s3-assets": "1.13.1",
-    "@aws-cdk/aws-s3-deployment": "1.13.1",
-    "@aws-cdk/aws-s3-notifications": "1.13.1",
-    "@aws-cdk/aws-sagemaker": "1.13.1",
-    "@aws-cdk/aws-sam": "1.13.1",
-    "@aws-cdk/aws-sdb": "1.13.1",
-    "@aws-cdk/aws-secretsmanager": "1.13.1",
-    "@aws-cdk/aws-securityhub": "1.13.1",
-    "@aws-cdk/aws-servicecatalog": "1.13.1",
-    "@aws-cdk/aws-servicediscovery": "1.13.1",
-    "@aws-cdk/aws-ses": "1.13.1",
-    "@aws-cdk/aws-ses-actions": "1.13.1",
-    "@aws-cdk/aws-sns": "1.13.1",
-    "@aws-cdk/aws-sns-subscriptions": "1.13.1",
-    "@aws-cdk/aws-sqs": "1.13.1",
-    "@aws-cdk/aws-ssm": "1.13.1",
-    "@aws-cdk/aws-stepfunctions": "1.13.1",
-    "@aws-cdk/aws-stepfunctions-tasks": "1.13.1",
-    "@aws-cdk/aws-transfer": "1.13.1",
-    "@aws-cdk/aws-waf": "1.13.1",
-    "@aws-cdk/aws-wafregional": "1.13.1",
-    "@aws-cdk/aws-workspaces": "1.13.1",
-    "@aws-cdk/cfnspec": "1.13.1",
-    "@aws-cdk/core": "1.13.1",
-    "@aws-cdk/custom-resources": "1.13.1",
-    "@aws-cdk/cx-api": "1.13.1",
-    "@aws-cdk/region-info": "1.13.1",
+    "@aws-cdk/alexa-ask": "1.15.0",
+    "@aws-cdk/app-delivery": "1.15.0",
+    "@aws-cdk/assets": "1.15.0",
+    "@aws-cdk/aws-amazonmq": "1.15.0",
+    "@aws-cdk/aws-amplify": "1.15.0",
+    "@aws-cdk/aws-apigateway": "1.15.0",
+    "@aws-cdk/aws-applicationautoscaling": "1.15.0",
+    "@aws-cdk/aws-appmesh": "1.15.0",
+    "@aws-cdk/aws-appstream": "1.15.0",
+    "@aws-cdk/aws-appsync": "1.15.0",
+    "@aws-cdk/aws-athena": "1.15.0",
+    "@aws-cdk/aws-autoscaling": "1.15.0",
+    "@aws-cdk/aws-autoscaling-common": "1.15.0",
+    "@aws-cdk/aws-autoscaling-hooktargets": "1.15.0",
+    "@aws-cdk/aws-autoscalingplans": "1.15.0",
+    "@aws-cdk/aws-backup": "1.15.0",
+    "@aws-cdk/aws-batch": "1.15.0",
+    "@aws-cdk/aws-budgets": "1.15.0",
+    "@aws-cdk/aws-certificatemanager": "1.15.0",
+    "@aws-cdk/aws-cloud9": "1.15.0",
+    "@aws-cdk/aws-cloudformation": "1.15.0",
+    "@aws-cdk/aws-cloudfront": "1.15.0",
+    "@aws-cdk/aws-cloudtrail": "1.15.0",
+    "@aws-cdk/aws-cloudwatch": "1.15.0",
+    "@aws-cdk/aws-cloudwatch-actions": "1.15.0",
+    "@aws-cdk/aws-codebuild": "1.15.0",
+    "@aws-cdk/aws-codecommit": "1.15.0",
+    "@aws-cdk/aws-codedeploy": "1.15.0",
+    "@aws-cdk/aws-codepipeline": "1.15.0",
+    "@aws-cdk/aws-codepipeline-actions": "1.15.0",
+    "@aws-cdk/aws-codestar": "1.15.0",
+    "@aws-cdk/aws-cognito": "1.15.0",
+    "@aws-cdk/aws-config": "1.15.0",
+    "@aws-cdk/aws-datapipeline": "1.15.0",
+    "@aws-cdk/aws-dax": "1.15.0",
+    "@aws-cdk/aws-directoryservice": "1.15.0",
+    "@aws-cdk/aws-dlm": "1.15.0",
+    "@aws-cdk/aws-dms": "1.15.0",
+    "@aws-cdk/aws-docdb": "1.15.0",
+    "@aws-cdk/aws-dynamodb": "1.15.0",
+    "@aws-cdk/aws-dynamodb-global": "1.15.0",
+    "@aws-cdk/aws-ec2": "1.15.0",
+    "@aws-cdk/aws-ecr": "1.15.0",
+    "@aws-cdk/aws-ecr-assets": "1.15.0",
+    "@aws-cdk/aws-ecs": "1.15.0",
+    "@aws-cdk/aws-ecs-patterns": "1.15.0",
+    "@aws-cdk/aws-efs": "1.15.0",
+    "@aws-cdk/aws-eks": "1.15.0",
+    "@aws-cdk/aws-elasticache": "1.15.0",
+    "@aws-cdk/aws-elasticbeanstalk": "1.15.0",
+    "@aws-cdk/aws-elasticloadbalancing": "1.15.0",
+    "@aws-cdk/aws-elasticloadbalancingv2": "1.15.0",
+    "@aws-cdk/aws-elasticloadbalancingv2-targets": "1.15.0",
+    "@aws-cdk/aws-elasticsearch": "1.15.0",
+    "@aws-cdk/aws-emr": "1.15.0",
+    "@aws-cdk/aws-events": "1.15.0",
+    "@aws-cdk/aws-events-targets": "1.15.0",
+    "@aws-cdk/aws-fsx": "1.15.0",
+    "@aws-cdk/aws-gamelift": "1.15.0",
+    "@aws-cdk/aws-glue": "1.15.0",
+    "@aws-cdk/aws-greengrass": "1.15.0",
+    "@aws-cdk/aws-guardduty": "1.15.0",
+    "@aws-cdk/aws-iam": "1.15.0",
+    "@aws-cdk/aws-inspector": "1.15.0",
+    "@aws-cdk/aws-iot": "1.15.0",
+    "@aws-cdk/aws-iot1click": "1.15.0",
+    "@aws-cdk/aws-iotanalytics": "1.15.0",
+    "@aws-cdk/aws-iotevents": "1.15.0",
+    "@aws-cdk/aws-iotthingsgraph": "1.15.0",
+    "@aws-cdk/aws-kinesis": "1.15.0",
+    "@aws-cdk/aws-kinesisanalytics": "1.15.0",
+    "@aws-cdk/aws-kinesisfirehose": "1.15.0",
+    "@aws-cdk/aws-kms": "1.15.0",
+    "@aws-cdk/aws-lakeformation": "1.15.0",
+    "@aws-cdk/aws-lambda": "1.15.0",
+    "@aws-cdk/aws-lambda-event-sources": "1.15.0",
+    "@aws-cdk/aws-logs": "1.15.0",
+    "@aws-cdk/aws-logs-destinations": "1.15.0",
+    "@aws-cdk/aws-managedblockchain": "1.15.0",
+    "@aws-cdk/aws-medialive": "1.15.0",
+    "@aws-cdk/aws-mediastore": "1.15.0",
+    "@aws-cdk/aws-msk": "1.15.0",
+    "@aws-cdk/aws-neptune": "1.15.0",
+    "@aws-cdk/aws-opsworks": "1.15.0",
+    "@aws-cdk/aws-opsworkscm": "1.15.0",
+    "@aws-cdk/aws-pinpoint": "1.15.0",
+    "@aws-cdk/aws-pinpointemail": "1.15.0",
+    "@aws-cdk/aws-qldb": "1.15.0",
+    "@aws-cdk/aws-ram": "1.15.0",
+    "@aws-cdk/aws-rds": "1.15.0",
+    "@aws-cdk/aws-redshift": "1.15.0",
+    "@aws-cdk/aws-robomaker": "1.15.0",
+    "@aws-cdk/aws-route53": "1.15.0",
+    "@aws-cdk/aws-route53-patterns": "1.15.0",
+    "@aws-cdk/aws-route53-targets": "1.15.0",
+    "@aws-cdk/aws-route53resolver": "1.15.0",
+    "@aws-cdk/aws-s3": "1.15.0",
+    "@aws-cdk/aws-s3-assets": "1.15.0",
+    "@aws-cdk/aws-s3-deployment": "1.15.0",
+    "@aws-cdk/aws-s3-notifications": "1.15.0",
+    "@aws-cdk/aws-sagemaker": "1.15.0",
+    "@aws-cdk/aws-sam": "1.15.0",
+    "@aws-cdk/aws-sdb": "1.15.0",
+    "@aws-cdk/aws-secretsmanager": "1.15.0",
+    "@aws-cdk/aws-securityhub": "1.15.0",
+    "@aws-cdk/aws-servicecatalog": "1.15.0",
+    "@aws-cdk/aws-servicediscovery": "1.15.0",
+    "@aws-cdk/aws-ses": "1.15.0",
+    "@aws-cdk/aws-ses-actions": "1.15.0",
+    "@aws-cdk/aws-sns": "1.15.0",
+    "@aws-cdk/aws-sns-subscriptions": "1.15.0",
+    "@aws-cdk/aws-sqs": "1.15.0",
+    "@aws-cdk/aws-ssm": "1.15.0",
+    "@aws-cdk/aws-stepfunctions": "1.15.0",
+    "@aws-cdk/aws-stepfunctions-tasks": "1.15.0",
+    "@aws-cdk/aws-transfer": "1.15.0",
+    "@aws-cdk/aws-waf": "1.15.0",
+    "@aws-cdk/aws-wafregional": "1.15.0",
+    "@aws-cdk/aws-workspaces": "1.15.0",
+    "@aws-cdk/cfnspec": "1.15.0",
+    "@aws-cdk/core": "1.15.0",
+    "@aws-cdk/custom-resources": "1.15.0",
+    "@aws-cdk/cx-api": "1.15.0",
+    "@aws-cdk/region-info": "1.15.0",
     "fs-extra": "^8.1.0",
     "jsii-reflect": "^0.19.0",
     "jsonschema": "^1.2.4",
@@ -171,6 +171,6 @@
   ],
   "homepage": "https://github.com/aws/aws-cdk",
   "engines": {
-    "node": ">= 10.3.0"
+    "node": ">= 8.10.0"
   }
 }
diff --git a/tools/awslint/bin/awslint.ts b/tools/awslint/bin/awslint.ts
index bda8d30d51d84..5a3e991413e66 100644
--- a/tools/awslint/bin/awslint.ts
+++ b/tools/awslint/bin/awslint.ts
@@ -5,29 +5,13 @@ import fs = require('fs-extra');
 import reflect = require('jsii-reflect');
 import path = require('path');
 import yargs = require('yargs');
-import { AggregateLinter, apiLinter, attributesLinter, cfnResourceLinter, constructLinter, DiagnosticLevel, durationsLinter, eventsLinter, exportsLinter,
-  importsLinter, integrationLinter, moduleLinter, noUnusedTypeLinter, publicStaticPropertiesLinter, resourceLinter } from '../lib';
-
-const linter = new AggregateLinter(
-  moduleLinter,
-  constructLinter,
-  cfnResourceLinter,
-  resourceLinter,
-  apiLinter,
-  importsLinter,
-  attributesLinter,
-  exportsLinter,
-  eventsLinter,
-  integrationLinter,
-  noUnusedTypeLinter,
-  durationsLinter,
-  publicStaticPropertiesLinter
-);
+import { ALL_RULES_LINTER, DiagnosticLevel } from '../lib';
 
 let stackTrace = false;
 
 async function main() {
   const argv = yargs
+    .env('AWSLINT')
     .usage('awslint [options] [command]')
     .showHelpOnFail(true)
     .command('', 'lint the current module (default)')
@@ -73,7 +57,7 @@ async function main() {
   const config = path.join(workdir, 'package.json');
 
   if (command === 'list') {
-    for (const rule of linter.rules) {
+    for (const rule of ALL_RULES_LINTER.rules) {
       console.info(`${colors.cyan(rule.code)}: ${rule.message}`);
     }
     return;
@@ -122,7 +106,7 @@ async function main() {
 
     const results = [];
 
-    results.push(...linter.eval(assembly, {
+    results.push(...ALL_RULES_LINTER.eval(assembly, {
       include: args.include,
       exclude: args.exclude,
     }));
@@ -231,7 +215,9 @@ main().catch(e => {
 
 async function loadModule(dir: string) {
   const ts = new reflect.TypeSystem();
-  await ts.load(dir);
+  await ts.load(dir, { validate: false }); // Don't validate to save 66% of execution time (20s vs 1min).
+  // We run 'awslint' during build time, assemblies are guaranteed to be ok.
+
   if (ts.roots.length !== 1) {
     throw new Error(`Expecting only a single root assembly`);
   }
diff --git a/tools/awslint/lib/linter.ts b/tools/awslint/lib/linter.ts
index 4dedc791be35f..6cac735f4cd6b 100644
--- a/tools/awslint/lib/linter.ts
+++ b/tools/awslint/lib/linter.ts
@@ -116,6 +116,14 @@ export class Evaluation<T> {
     this.diagnostics = diagnostics;
   }
 
+  /**
+   * Record a failure if `condition` is not truthy.
+   *
+   * @param condition The condition to assert.
+   * @param scope Used to diagnose the location in the source, and is used in the
+   * ignore pattern.
+   * @param extra Used to replace %s in the default message format string.
+   */
   public assert(condition: any, scope: string, extra?: string): condition is true {
     // deduplicate: skip if this specific assertion ("rule:scope") was already examined
     if (this.diagnostics.find(d => d.rule.code === this.curr.code && d.scope === scope)) {
diff --git a/tools/awslint/lib/rules/construct.ts b/tools/awslint/lib/rules/construct.ts
index e615c940460ab..6d91a6622e0f8 100644
--- a/tools/awslint/lib/rules/construct.ts
+++ b/tools/awslint/lib/rules/construct.ts
@@ -261,23 +261,6 @@ constructLinter.add({
   }
 });
 
-constructLinter.add({
-  code: 'props-default-doc',
-  message: 'All optional props must have @default documentation',
-  eval: e => {
-    if (!e.ctx.propsType) { return; }
-    if (!e.ctx.hasPropsArgument) { return; }
-
-    // this rule does not apply to L1 constructs
-    if (CoreTypes.isCfnResource(e.ctx.classType)) { return; }
-
-    for (const property of e.ctx.propsType.allProperties) {
-      if (!property.optional) { continue; }
-      e.assert(property.docs.docs.default !== undefined, `${e.ctx.propsFqn}.${property.name}`);
-    }
-  }
-  });
-
 constructLinter.add({
   code: 'props-no-any',
   message: 'props must not use Typescript "any" type',
diff --git a/tools/awslint/lib/rules/core-types.ts b/tools/awslint/lib/rules/core-types.ts
index f444d5fff52af..7902efee40866 100644
--- a/tools/awslint/lib/rules/core-types.ts
+++ b/tools/awslint/lib/rules/core-types.ts
@@ -78,6 +78,13 @@ export class CoreTypes {
     return classType.extends(baseResource) || getDocTag(classType, "resource");
   }
 
+  /**
+   * Return true if the given interface type is a CFN class or prop type
+   */
+  public static isCfnType(interfaceType: reflect.Type) {
+    return interfaceType.name.startsWith('Cfn') || (interfaceType.namespace && interfaceType.namespace.startsWith('Cfn'));
+  }
+
   /**
    * @returns `classType` for the core type Construct
    */
diff --git a/tools/awslint/lib/rules/docs.ts b/tools/awslint/lib/rules/docs.ts
new file mode 100644
index 0000000000000..9b739fc81fab0
--- /dev/null
+++ b/tools/awslint/lib/rules/docs.ts
@@ -0,0 +1,91 @@
+import reflect = require('jsii-reflect');
+import { Linter } from '../linter';
+import { CoreTypes } from './core-types';
+
+type DocsLinterContext = {
+  readonly assembly: reflect.Assembly;
+  readonly errorKey: string;
+} & ({ readonly kind: 'type'; documentable: reflect.Type }
+  | { readonly kind: 'interface-property'; containingType: reflect.InterfaceType; documentable: reflect.Property }
+  | { readonly kind: 'class-property'; containingType: reflect.ClassType; documentable: reflect.Property }
+  | { readonly kind: 'method'; containingType: reflect.ReferenceType; documentable: reflect.Method }
+  | { readonly kind: 'enum-member'; containingType: reflect.EnumType; documentable: reflect.EnumMember }
+);
+
+export const docsLinter = new Linter<DocsLinterContext>(assembly => {
+  return [
+    ...flatMap(assembly.classes, classType => [
+      { assembly, kind: 'type', documentable: classType, errorKey: classType.fqn },
+      ...classType.ownProperties.map(property => ({ assembly, kind: 'class-property', containingType: classType, documentable: property, errorKey: `${classType.fqn}.${property.name}` })),
+      ...classType.ownMethods.map(method => ({ assembly, kind: 'method', containingType: classType, documentable: method, errorKey: `${classType.fqn}.${method.name}` })),
+    ]),
+    ...flatMap(assembly.interfaces, interfaceType => [
+      { assembly, kind: 'type', documentable: interfaceType, errorKey: interfaceType.fqn },
+      // tslint:disable-next-line:max-line-length
+      ...interfaceType.ownProperties.map(property => ({ assembly, kind: 'interface-property', containingType: interfaceType, documentable: property, errorKey: `${interfaceType.fqn}.${property.name}` })),
+      ...interfaceType.ownMethods.map(method => ({ assembly, kind: 'method', containingType: interfaceType, documentable: method, errorKey: `${interfaceType.fqn}.${method.name}` })),
+    ]),
+    ...flatMap(assembly.enums, enumType => [
+      { assembly, kind: 'type', documentable: enumType, errorKey: enumType.fqn },
+      ...enumType.members.map(member => ({ assembly, kind: 'enum-member', containingType: enumType, documentable: member, errorKey: `${enumType.fqn}.${member.name}` }))
+    ]),
+  ] as DocsLinterContext[];
+});
+
+docsLinter.add({
+  code: 'docs-public-apis',
+  message: 'Public API element must have a docstring',
+  eval: e => {
+    if (!isPublic(e.ctx)) { return; }
+    // this rule does not apply to L1 constructs
+    if (isCfnType(e.ctx)) { return; }
+
+    if (!e.ctx.documentable.docs.summary) {
+      e.assert(e.ctx.documentable.docs.summary, e.ctx.errorKey);
+    }
+  }
+});
+
+docsLinter.add({
+  code: 'props-default-doc',
+  message: 'Optional property must have @default documentation',
+  eval: e => {
+    if (e.ctx.kind !== 'interface-property') { return; }
+    if (!e.ctx.containingType.isDataType()) { return; }
+    // this rule does not apply to L1 constructs
+    if (CoreTypes.isCfnType(e.ctx.containingType)) { return; }
+
+    const property = e.ctx.documentable;
+    e.assert(!property.optional || property.docs.docs.default !== undefined, e.ctx.errorKey);
+  }
+});
+
+function isPublic(ctx: DocsLinterContext) {
+  switch (ctx.kind) {
+    case "class-property":
+    case "interface-property":
+    case "method":
+      return !ctx.documentable.protected;
+
+    case "enum-member":
+    case "type":
+      return true;
+  }
+}
+
+function isCfnType(ctx: DocsLinterContext) {
+  switch (ctx.kind) {
+    case "class-property":
+    case "interface-property":
+    case "method":
+    case "enum-member":
+      return CoreTypes.isCfnType(ctx.containingType);
+
+    case "type":
+      return CoreTypes.isCfnType(ctx.documentable);
+  }
+}
+
+function flatMap<T, U>(array: T[], callbackfn: (value: T, index: number, array: T[]) => U[]): U[] {
+  return Array.prototype.concat(...array.map(callbackfn));
+}
\ No newline at end of file
diff --git a/tools/awslint/lib/rules/index.ts b/tools/awslint/lib/rules/index.ts
index 6a905c70c1c21..e3fe69364f09b 100644
--- a/tools/awslint/lib/rules/index.ts
+++ b/tools/awslint/lib/rules/index.ts
@@ -1,13 +1,32 @@
-export * from './api';
-export * from './attributes';
-export * from './cfn-resource';
-export * from './cloudwatch-events';
-export * from './construct';
-export * from './durations';
-export * from './exports';
-export * from './imports';
-export * from './integrations';
-export * from './module';
-export * from './no-unused-type';
-export * from './resource';
-export * from './public-static-properties';
+import { AggregateLinter } from '../linter';
+import { apiLinter } from './api';
+import { attributesLinter } from './attributes';
+import { cfnResourceLinter } from './cfn-resource';
+import { eventsLinter } from './cloudwatch-events';
+import { constructLinter } from './construct';
+import { docsLinter } from './docs';
+import { durationsLinter } from './durations';
+import { exportsLinter } from './exports';
+import { importsLinter } from './imports';
+import { integrationLinter } from './integrations';
+import { moduleLinter } from './module';
+import { noUnusedTypeLinter } from './no-unused-type';
+import { publicStaticPropertiesLinter } from './public-static-properties';
+import { resourceLinter } from './resource';
+
+export const ALL_RULES_LINTER = new AggregateLinter(
+  moduleLinter,
+  constructLinter,
+  cfnResourceLinter,
+  resourceLinter,
+  apiLinter,
+  importsLinter,
+  attributesLinter,
+  exportsLinter,
+  eventsLinter,
+  integrationLinter,
+  noUnusedTypeLinter,
+  durationsLinter,
+  publicStaticPropertiesLinter,
+  docsLinter
+);
\ No newline at end of file
diff --git a/tools/awslint/package.json b/tools/awslint/package.json
index 845fc09b6941c..f94c9dbf73310 100644
--- a/tools/awslint/package.json
+++ b/tools/awslint/package.json
@@ -1,7 +1,7 @@
 {
   "name": "awslint",
   "private": true,
-  "version": "1.13.1",
+  "version": "1.15.0",
   "description": "Enforces the AWS Construct Library guidelines",
   "main": "index.js",
   "scripts": {
diff --git a/tools/cdk-build-tools/package.json b/tools/cdk-build-tools/package.json
index bcf5a2e877c71..88ef6c6bb3807 100644
--- a/tools/cdk-build-tools/package.json
+++ b/tools/cdk-build-tools/package.json
@@ -1,7 +1,7 @@
 {
   "name": "cdk-build-tools",
   "private": true,
-  "version": "1.13.1",
+  "version": "1.15.0",
   "description": "Tools package with shared build scripts for CDK packages",
   "main": "lib/index.js",
   "repository": {
@@ -33,10 +33,10 @@
     "@types/fs-extra": "^8.0.1",
     "@types/jest": "^24.0.19",
     "@types/yargs": "^13.0.3",
-    "pkglint": "^1.13.1"
+    "pkglint": "^1.15.0"
   },
   "dependencies": {
-    "awslint": "^1.13.1",
+    "awslint": "^1.15.0",
     "colors": "^1.4.0",
     "fs-extra": "^8.1.0",
     "jest": "^24.9.0",
diff --git a/tools/cdk-integ-tools/package.json b/tools/cdk-integ-tools/package.json
index 6edcf9af82f30..3a500ab958b69 100644
--- a/tools/cdk-integ-tools/package.json
+++ b/tools/cdk-integ-tools/package.json
@@ -1,7 +1,7 @@
 {
   "name": "cdk-integ-tools",
   "private": true,
-  "version": "1.13.1",
+  "version": "1.15.0",
   "description": "Package with integration test scripts for CDK packages",
   "main": "index.js",
   "repository": {
@@ -31,13 +31,13 @@
   "devDependencies": {
     "@types/fs-extra": "^8.0.1",
     "@types/yargs": "^13.0.3",
-    "cdk-build-tools": "^1.13.1",
-    "pkglint": "^1.13.1"
+    "cdk-build-tools": "^1.15.0",
+    "pkglint": "^1.15.0"
   },
   "dependencies": {
-    "@aws-cdk/cloudformation-diff": "1.13.1",
-    "@aws-cdk/cx-api": "1.13.1",
-    "aws-cdk": "1.13.1",
+    "@aws-cdk/cloudformation-diff": "1.15.0",
+    "@aws-cdk/cx-api": "1.15.0",
+    "aws-cdk": "1.15.0",
     "fs-extra": "^8.1.0",
     "yargs": "^14.2.0"
   },
diff --git a/tools/cfn2ts/package.json b/tools/cfn2ts/package.json
index 39c0037530a38..71e086a48329f 100644
--- a/tools/cfn2ts/package.json
+++ b/tools/cfn2ts/package.json
@@ -1,7 +1,7 @@
 {
   "name": "cfn2ts",
   "private": true,
-  "version": "1.13.1",
+  "version": "1.15.0",
   "description": "Generates typescript types from CloudFormation spec, with support for enrichments",
   "main": "lib/index.js",
   "types": "lib/index.d.ts",
@@ -34,7 +34,7 @@
   },
   "license": "Apache-2.0",
   "dependencies": {
-    "@aws-cdk/cfnspec": "1.13.1",
+    "@aws-cdk/cfnspec": "1.15.0",
     "codemaker": "^0.19.0",
     "fast-json-patch": "^3.0.0-1",
     "fs-extra": "^8.1.0",
@@ -43,8 +43,8 @@
   "devDependencies": {
     "@types/fs-extra": "^8.0.1",
     "@types/yargs": "^13.0.3",
-    "cdk-build-tools": "^1.13.1",
-    "pkglint": "^1.13.1"
+    "cdk-build-tools": "^1.15.0",
+    "pkglint": "^1.15.0"
   },
   "keywords": [
     "aws",
diff --git a/tools/pkglint/package.json b/tools/pkglint/package.json
index 475e9aa5d0ad2..fc4abe7f3de3e 100644
--- a/tools/pkglint/package.json
+++ b/tools/pkglint/package.json
@@ -1,6 +1,6 @@
 {
   "name": "pkglint",
-  "version": "1.13.1",
+  "version": "1.15.0",
   "private": true,
   "description": "Validate and fix package.json files",
   "main": "lib/index.js",
diff --git a/tools/pkgtools/package.json b/tools/pkgtools/package.json
index e310b470d127f..b1269ffcd4e09 100644
--- a/tools/pkgtools/package.json
+++ b/tools/pkgtools/package.json
@@ -1,7 +1,7 @@
 {
   "name": "pkgtools",
   "private": true,
-  "version": "1.13.1",
+  "version": "1.15.0",
   "description": "Tools for generating cross-package artifacts",
   "main": "index.js",
   "repository": {
@@ -31,8 +31,8 @@
   "devDependencies": {
     "@types/fs-extra": "^8.0.1",
     "@types/yargs": "^13.0.3",
-    "cdk-build-tools": "^1.13.1",
-    "pkglint": "^1.13.1"
+    "cdk-build-tools": "^1.15.0",
+    "pkglint": "^1.15.0"
   },
   "dependencies": {
     "fs-extra": "^8.1.0",
diff --git a/yarn.lock b/yarn.lock
index 15373354f529d..2619b2f48a1fb 100644
--- a/yarn.lock
+++ b/yarn.lock
@@ -420,16 +420,16 @@
     read-package-tree "^5.1.6"
     semver "^6.2.0"
 
-"@lerna/changed@3.18.0":
-  version "3.18.0"
-  resolved "https://registry.yarnpkg.com/@lerna/changed/-/changed-3.18.0.tgz#2175163861170dd6ecf82cd424152770bdf1832d"
-  integrity sha512-caur6qjNXIZmBwJts6gkWfl5A1MlSq4/p8lAABuZ7fsEIkgoeoTVvMIDvEcYiVSGdVV/WJZGgG3kU+MTBIv/Bg==
+"@lerna/changed@3.18.3":
+  version "3.18.3"
+  resolved "https://registry.yarnpkg.com/@lerna/changed/-/changed-3.18.3.tgz#50529e8bd5d7fe2d0ace046a6e274d3de652a493"
+  integrity sha512-xZW7Rm+DlDIGc0EvKGyJZgT9f8FFa4d52mr/Y752dZuXR2qRmf9tXhVloRG39881s2A6yi3jqLtXZggKhsQW4Q==
   dependencies:
     "@lerna/collect-updates" "3.18.0"
     "@lerna/command" "3.18.0"
     "@lerna/listable" "3.18.0"
     "@lerna/output" "3.13.0"
-    "@lerna/version" "3.18.0"
+    "@lerna/version" "3.18.3"
 
 "@lerna/check-working-tree@3.16.5":
   version "3.16.5"
@@ -862,10 +862,10 @@
     inquirer "^6.2.0"
     npmlog "^4.1.2"
 
-"@lerna/publish@3.18.1":
-  version "3.18.1"
-  resolved "https://registry.yarnpkg.com/@lerna/publish/-/publish-3.18.1.tgz#8d27ae4f3b72824c8c7afbdc35bfb494a5f7168e"
-  integrity sha512-3u65cMBkq24U8l7pQaZgdIAh2NO1Iw/sladW6/VBwFMcACwBBwEWm2LnrGStsB5Yijg3f+0NK1sT72xrzBpbag==
+"@lerna/publish@3.18.3":
+  version "3.18.3"
+  resolved "https://registry.yarnpkg.com/@lerna/publish/-/publish-3.18.3.tgz#478bb94ee712a40b723413e437bcb9e307d3709c"
+  integrity sha512-XlfWOWIhaSK0Y2sX5ppNWI5Y3CDtlxMcQa1hTbZlC5rrDA6vD32iutbmH6Ix3c6wtvVbSkgA39GWsQEXxPS+7w==
   dependencies:
     "@evocateur/libnpmaccess" "^3.1.2"
     "@evocateur/npm-registry-fetch" "^4.0.0"
@@ -888,7 +888,7 @@
     "@lerna/run-lifecycle" "3.16.2"
     "@lerna/run-topologically" "3.18.0"
     "@lerna/validation-error" "3.13.0"
-    "@lerna/version" "3.18.0"
+    "@lerna/version" "3.18.3"
     figgy-pudding "^3.5.1"
     fs-extra "^8.1.0"
     npm-package-arg "^6.1.0"
@@ -1000,10 +1000,10 @@
   dependencies:
     npmlog "^4.1.2"
 
-"@lerna/version@3.18.0":
-  version "3.18.0"
-  resolved "https://registry.yarnpkg.com/@lerna/version/-/version-3.18.0.tgz#81657c913f12eceee1ae499349365fed55440a36"
-  integrity sha512-mGw5EoQ8wXyofJIHEWNsNWqnTsXlgVvsqePyKkUZTZCsG54ez0ZKpU87EgirxXvj+QDyKgB7X5Dz1hftaX5PSw==
+"@lerna/version@3.18.3":
+  version "3.18.3"
+  resolved "https://registry.yarnpkg.com/@lerna/version/-/version-3.18.3.tgz#01344b39c0749fdeb6c178714733bacbde4d602f"
+  integrity sha512-IXXRlyM3Q/jrc+QZio+bgjG4ZaK+4LYmY4Yql1xyY0wZhAKsWP/Q6ho7e1EJNjNC5dUJO99Fq7qB05MkDf2OcQ==
   dependencies:
     "@lerna/check-working-tree" "3.16.5"
     "@lerna/child-process" "3.16.5"
@@ -1020,6 +1020,7 @@
     "@lerna/validation-error" "3.13.0"
     chalk "^2.3.1"
     dedent "^0.7.0"
+    load-json-file "^5.3.0"
     minimatch "^3.0.4"
     npmlog "^4.1.2"
     p-map "^2.1.0"
@@ -1029,6 +1030,7 @@
     semver "^6.2.0"
     slash "^2.0.0"
     temp-write "^3.4.0"
+    write-json-file "^3.2.0"
 
 "@lerna/write-log-file@3.13.0":
   version "3.13.0"
@@ -1269,10 +1271,10 @@
   resolved "https://registry.yarnpkg.com/@types/node/-/node-12.11.1.tgz#1fd7b821f798b7fa29f667a1be8f3442bb8922a3"
   integrity sha512-TJtwsqZ39pqcljJpajeoofYRfeZ7/I/OMUQ5pR4q5wOKf2ocrUvBAZUMhWsOvKx3dVc/aaV5GluBivt0sWqA5A==
 
-"@types/node@^8.10.55":
-  version "8.10.55"
-  resolved "https://registry.yarnpkg.com/@types/node/-/node-8.10.55.tgz#3951a64ebce1927b050fd1e420dc6f332be8a1e0"
-  integrity sha512-iZeh1EgupfmAAOASk580R1SL5lWF3CsBVgVH0395qyNF8fhO16xy1UwAav2PdGxIIsYRn7RzJgMGjdsvam6YYg==
+"@types/node@^8.10.56":
+  version "8.10.56"
+  resolved "https://registry.yarnpkg.com/@types/node/-/node-8.10.56.tgz#f1d55b979163cc0cfb6b927b6e4bf9632bcc8fe7"
+  integrity sha512-5yWs9hy3UWdandOgvmmPCNJ3jI5/o8syatQWOmiAO/9/PptOQ+0O2ANKHltFhE4MGCt/QiVkoxQFUbeha9Yf4w==
 
 "@types/nodeunit@^0.0.30":
   version "0.0.30"
@@ -1309,6 +1311,13 @@
   resolved "https://registry.yarnpkg.com/@types/stack-utils/-/stack-utils-1.0.1.tgz#0a851d3bd96498fa25c33ab7278ed3bd65f06c3e"
   integrity sha512-l42BggppR6zLmpfU6fq9HEa2oGPEI8yrSPL3GITjfRInppYFahObbIQOQK3UGxEnyQpltZLaPe75046NOZQikw==
 
+"@types/string-width@^4.0.1":
+  version "4.0.1"
+  resolved "https://registry.yarnpkg.com/@types/string-width/-/string-width-4.0.1.tgz#a02e22c305d0b550f8d8da12b5b13e05123dc7b8"
+  integrity sha512-zsZXP4RSmw3TOXf2eut1xxb7Gto7I+BrB0WxwdRaEdCBnUbAQa57yZf/OWcAfop9m7t6Zd0pw9tV2ghpJXJPZg==
+  dependencies:
+    string-width "*"
+
 "@types/table@^4.0.7":
   version "4.0.7"
   resolved "https://registry.yarnpkg.com/@types/table/-/table-4.0.7.tgz#c21100d37d4924abbbde85414170260d4d7b0316"
@@ -1713,10 +1722,10 @@ aws-sdk@^2.483.0, aws-sdk@^2.540.0:
     uuid "3.3.2"
     xml2js "0.4.19"
 
-aws-sdk@^2.553.0:
-  version "2.553.0"
-  resolved "https://registry.yarnpkg.com/aws-sdk/-/aws-sdk-2.553.0.tgz#a82c611015138db8f720e0079fe929a65b359a8e"
-  integrity sha512-tcITF/3ijBumvP13Qrq/VB1eRWW6szKF0xVwZ/ch0MGkaEiTQ9n3zNRPtQc1drllsVEm5u5aXp3inoi5zmq0xg==
+aws-sdk@^2.558.0:
+  version "2.558.0"
+  resolved "https://registry.yarnpkg.com/aws-sdk/-/aws-sdk-2.558.0.tgz#544b80f26d96026d85e84f6adeec09461accc9c3"
+  integrity sha512-L1cqcOLuL4FG93JKQIh/5u/ks9zj3ErahzfAb7vjuSLVZgEXx8mNgdiyIgcWj5VDOBEa6ygzwV1f72rDig359A==
   dependencies:
     buffer "4.9.1"
     events "1.1.1"
@@ -2730,6 +2739,13 @@ debug@3.1.0:
   dependencies:
     ms "2.0.0"
 
+debug@4, debug@^4.0.1, debug@^4.1.0, debug@^4.1.1:
+  version "4.1.1"
+  resolved "https://registry.yarnpkg.com/debug/-/debug-4.1.1.tgz#3b72260255109c6b589cee050f1d516139664791"
+  integrity sha512-pYAIzeRo8J6KPEaJ0VWOh5Pzkbw/RetuzehGM7QRRX5he4fPHx2rdKMB256ehJCkX+XRQm16eZLqLNS8RSZXZw==
+  dependencies:
+    ms "^2.1.1"
+
 debug@^3.1.0, debug@^3.2.6:
   version "3.2.6"
   resolved "https://registry.yarnpkg.com/debug/-/debug-3.2.6.tgz#e83d17de16d8a7efb7717edbe5fb10135eee629b"
@@ -2737,13 +2753,6 @@ debug@^3.1.0, debug@^3.2.6:
   dependencies:
     ms "^2.1.1"
 
-debug@^4.0.1, debug@^4.1.0, debug@^4.1.1:
-  version "4.1.1"
-  resolved "https://registry.yarnpkg.com/debug/-/debug-4.1.1.tgz#3b72260255109c6b589cee050f1d516139664791"
-  integrity sha512-pYAIzeRo8J6KPEaJ0VWOh5Pzkbw/RetuzehGM7QRRX5he4fPHx2rdKMB256ehJCkX+XRQm16eZLqLNS8RSZXZw==
-  dependencies:
-    ms "^2.1.1"
-
 debuglog@^1.0.1:
   version "1.0.1"
   resolved "https://registry.yarnpkg.com/debuglog/-/debuglog-1.0.1.tgz#aa24ffb9ac3df9a2351837cfb2d279360cd78492"
@@ -3451,13 +3460,13 @@ extsprintf@^1.2.0:
   resolved "https://registry.yarnpkg.com/extsprintf/-/extsprintf-1.4.0.tgz#e2689f8f356fad62cca65a3a91c5df5f9551692f"
   integrity sha1-4mifjzVvrWLMplo6kcXfX5VRaS8=
 
-fast-check@^1.17.0:
-  version "1.17.0"
-  resolved "https://registry.yarnpkg.com/fast-check/-/fast-check-1.17.0.tgz#f71ae0032564e028f2dd8aee23ad327ad04c67c8"
-  integrity sha512-+v+Ta6yOEhM9VjmlPSS5NHRoMe9E22nockrmNZIILUiH9TLSBefxVXeY+QW8YhanheRcgyIHCeVpQ0K48zQssg==
+fast-check@^1.18.1:
+  version "1.18.1"
+  resolved "https://registry.yarnpkg.com/fast-check/-/fast-check-1.18.1.tgz#64568dd417bca4c7c93d1705868d8e46fa7a3fdf"
+  integrity sha512-b2EOdqujCBzMC78WhqYMXMRzWUKC8cXuPAgt6UOZtU5QTHk2NpUMZDfQeMqHNDZYPZUQyZdHtZqQgq43lBCoIg==
   dependencies:
-    pure-rand "^1.6.2"
-    tslib "^1.9.3"
+    pure-rand "^1.7.0"
+    tslib "^1.10.0"
 
 fast-deep-equal@^2.0.1:
   version "2.0.1"
@@ -3476,6 +3485,13 @@ fast-glob@^2.2.6:
     merge2 "^1.2.3"
     micromatch "^3.1.10"
 
+fast-json-patch@^2.2.1:
+  version "2.2.1"
+  resolved "https://registry.yarnpkg.com/fast-json-patch/-/fast-json-patch-2.2.1.tgz#18150d36c9ab65c7209e7d4eb113f4f8eaabe6d9"
+  integrity sha512-4j5uBaTnsYAV5ebkidvxiLUYOwjQ+JSFljeqfTxCrH9bDmlCQaOJFS84oDJ2rAXZq2yskmk3ORfoP9DCwqFNig==
+  dependencies:
+    fast-deep-equal "^2.0.1"
+
 fast-json-patch@^3.0.0-1:
   version "3.0.0-1"
   resolved "https://registry.yarnpkg.com/fast-json-patch/-/fast-json-patch-3.0.0-1.tgz#4c68f2e7acfbab6d29d1719c44be51899c93dabb"
@@ -4084,6 +4100,14 @@ https-proxy-agent@^2.2.1:
     agent-base "^4.3.0"
     debug "^3.1.0"
 
+https-proxy-agent@^3.0.0:
+  version "3.0.1"
+  resolved "https://registry.yarnpkg.com/https-proxy-agent/-/https-proxy-agent-3.0.1.tgz#b8c286433e87602311b01c8ea34413d856a4af81"
+  integrity sha512-+ML2Rbh6DAuee7d07tYGEKOEi2voWPUGan+ExdPbPW6Z3svq+JCqr0v8WmKPOkz1vOVykPCBSuobe7G8GJUtVg==
+  dependencies:
+    agent-base "^4.3.0"
+    debug "^3.1.0"
+
 humanize-ms@^1.2.1:
   version "1.2.1"
   resolved "https://registry.yarnpkg.com/humanize-ms/-/humanize-ms-1.2.1.tgz#c46e3159a293f6b896da29316d8b6fe8bb79bbed"
@@ -5199,14 +5223,14 @@ left-pad@^1.3.0:
   resolved "https://registry.yarnpkg.com/left-pad/-/left-pad-1.3.0.tgz#5b8a3a7765dfe001261dde915589e782f8c94d1e"
   integrity sha512-XI5MPzVNApjAyhQzphX8BkmKsKUxD4LdyK24iZeQGinBN9yTQT3bFlCBy/aVx2HrNcqQGsdot8ghrjyrvMCoEA==
 
-lerna@^3.18.1:
-  version "3.18.1"
-  resolved "https://registry.yarnpkg.com/lerna/-/lerna-3.18.1.tgz#ddc3b68fbba09cb71e3d893500ade787e794b828"
-  integrity sha512-+EAAEgGl+oNeI1TBBW2btHp7NtpCrsRQET/NNCMRyVsl9/8a322t/WcpO9sCsAyEAITBXfhlRVB9rYifFQ6gNA==
+lerna@^3.18.3:
+  version "3.18.3"
+  resolved "https://registry.yarnpkg.com/lerna/-/lerna-3.18.3.tgz#c94556e76f98df9c7ae4ed3bc0166117cc42cd13"
+  integrity sha512-Bnr/RjyDSVA2Vu+NArK7do4UIpyy+EShOON7tignfAekPbi7cNDnMMGgSmbCQdKITkqPACMfCMdyq0hJlg6n3g==
   dependencies:
     "@lerna/add" "3.18.0"
     "@lerna/bootstrap" "3.18.0"
-    "@lerna/changed" "3.18.0"
+    "@lerna/changed" "3.18.3"
     "@lerna/clean" "3.18.0"
     "@lerna/cli" "3.18.0"
     "@lerna/create" "3.18.0"
@@ -5216,9 +5240,9 @@ lerna@^3.18.1:
     "@lerna/init" "3.18.0"
     "@lerna/link" "3.18.0"
     "@lerna/list" "3.18.0"
-    "@lerna/publish" "3.18.1"
+    "@lerna/publish" "3.18.3"
     "@lerna/run" "3.18.0"
-    "@lerna/version" "3.18.0"
+    "@lerna/version" "3.18.3"
     import-local "^2.0.0"
     npmlog "^4.1.2"
 
@@ -5433,7 +5457,7 @@ loud-rejection@^1.0.0:
     currently-unhandled "^0.4.1"
     signal-exit "^3.0.0"
 
-lru-cache@^4.0.1, lru-cache@^4.1.2:
+lru-cache@^4.0.1:
   version "4.1.5"
   resolved "https://registry.yarnpkg.com/lru-cache/-/lru-cache-4.1.5.tgz#8bbe50ea85bed59bc9e33dcab8235ee9bcf443cd"
   integrity sha512-sWZlbEP2OsHNkXrMl5GYk/jKk70MBng6UU4YI/qGDYbgf6YbP4EvmqISbXCoJiRKs+1bSpFHVgQxvJ17F2li5g==
@@ -5838,7 +5862,7 @@ nise@^1.5.2:
     lolex "^4.1.0"
     path-to-regexp "^1.7.0"
 
-nock@^11.3.5, nock@^11.4.0:
+nock@^11.3.5:
   version "11.4.0"
   resolved "https://registry.yarnpkg.com/nock/-/nock-11.4.0.tgz#68c2f9cf533f13ecb1a43e956823dbfba5593d17"
   integrity sha512-UrVEbEAvhyDoUttrS0fv3znhZ5nEJvlxqgmrC6Gb2Mf9cFci65RMK17e6EjDDQB57g5iwZw1TFnVvyeL0eUlhQ==
@@ -5850,6 +5874,18 @@ nock@^11.3.5, nock@^11.4.0:
     mkdirp "^0.5.0"
     propagate "^2.0.0"
 
+nock@^11.6.0:
+  version "11.6.0"
+  resolved "https://registry.yarnpkg.com/nock/-/nock-11.6.0.tgz#481961e0cf78794f200ea71e25d948d668446717"
+  integrity sha512-9ocFR68CxS6nf2XtQNpdSh5n4QQSKl87DhXgLnHO/RD4CsGThFtu8/QG6myHTnrUHRE6JSKpiGjLJdRe2ZSlIA==
+  dependencies:
+    chai "^4.1.2"
+    debug "^4.1.0"
+    json-stringify-safe "^5.0.1"
+    lodash "^4.17.13"
+    mkdirp "^0.5.0"
+    propagate "^2.0.0"
+
 node-fetch-npm@^2.0.2:
   version "2.0.2"
   resolved "https://registry.yarnpkg.com/node-fetch-npm/-/node-fetch-npm-2.0.2.tgz#7258c9046182dca345b4208eda918daf33697ff7"
@@ -6323,16 +6359,16 @@ p-waterfall@^1.0.0:
   dependencies:
     p-reduce "^1.0.0"
 
-pac-proxy-agent@^3.0.0:
-  version "3.0.0"
-  resolved "https://registry.yarnpkg.com/pac-proxy-agent/-/pac-proxy-agent-3.0.0.tgz#11d578b72a164ad74bf9d5bac9ff462a38282432"
-  integrity sha512-AOUX9jES/EkQX2zRz0AW7lSx9jD//hQS8wFXBvcnd/J2Py9KaMJMqV/LPqJssj1tgGufotb2mmopGPR15ODv1Q==
+pac-proxy-agent@^3.0.1:
+  version "3.0.1"
+  resolved "https://registry.yarnpkg.com/pac-proxy-agent/-/pac-proxy-agent-3.0.1.tgz#115b1e58f92576cac2eba718593ca7b0e37de2ad"
+  integrity sha512-44DUg21G/liUZ48dJpUSjZnFfZro/0K5JTyFYLBcmh9+T6Ooi4/i4efwUiEy0+4oQusCBqWdhv16XohIj1GqnQ==
   dependencies:
     agent-base "^4.2.0"
-    debug "^3.1.0"
+    debug "^4.1.1"
     get-uri "^2.0.0"
     http-proxy-agent "^2.1.0"
-    https-proxy-agent "^2.2.1"
+    https-proxy-agent "^3.0.0"
     pac-resolver "^3.0.0"
     raw-body "^2.2.0"
     socks-proxy-agent "^4.0.1"
@@ -6645,17 +6681,17 @@ protoduck@^5.0.1:
   dependencies:
     genfun "^5.0.0"
 
-proxy-agent@^3.1.0:
-  version "3.1.0"
-  resolved "https://registry.yarnpkg.com/proxy-agent/-/proxy-agent-3.1.0.tgz#3cf86ee911c94874de4359f37efd9de25157c113"
-  integrity sha512-IkbZL4ClW3wwBL/ABFD2zJ8iP84CY0uKMvBPk/OceQe/cEjrxzN1pMHsLwhbzUoRhG9QbSxYC+Z7LBkTiBNvrA==
+proxy-agent@^3.1.1:
+  version "3.1.1"
+  resolved "https://registry.yarnpkg.com/proxy-agent/-/proxy-agent-3.1.1.tgz#7e04e06bf36afa624a1540be247b47c970bd3014"
+  integrity sha512-WudaR0eTsDx33O3EJE16PjBRZWcX8GqCEeERw1W3hZJgH/F2a46g7jty6UGty6NeJ4CKQy8ds2CJPMiyeqaTvw==
   dependencies:
     agent-base "^4.2.0"
-    debug "^3.1.0"
+    debug "4"
     http-proxy-agent "^2.1.0"
-    https-proxy-agent "^2.2.1"
-    lru-cache "^4.1.2"
-    pac-proxy-agent "^3.0.0"
+    https-proxy-agent "^3.0.0"
+    lru-cache "^5.1.1"
+    pac-proxy-agent "^3.0.1"
     proxy-from-env "^1.0.0"
     socks-proxy-agent "^4.0.1"
 
@@ -6723,10 +6759,10 @@ punycode@^2.1.0, punycode@^2.1.1:
   resolved "https://registry.yarnpkg.com/punycode/-/punycode-2.1.1.tgz#b58b010ac40c22c5657616c8d2c2c02c7bf479ec"
   integrity sha512-XRsRjdf+j5ml+y/6GKHPZbrF/8p2Yga0JPtdqTIY2Xe5ohJPD9saDJJLPvp9+NSBprVvevdXZybnj2cv8OEd0A==
 
-pure-rand@^1.6.2:
-  version "1.6.2"
-  resolved "https://registry.yarnpkg.com/pure-rand/-/pure-rand-1.6.2.tgz#90b3ae78efe36f7e6e27bfffedf934f77382e6e6"
-  integrity sha512-HNwHOH63m7kCxe0kWEe5jSLwJiL2N83RUUN8POniFuZS+OsbFcMWlvXgxIU2nwKy2zYG2bQan40WBNK4biYPRg==
+pure-rand@^1.7.0:
+  version "1.7.0"
+  resolved "https://registry.yarnpkg.com/pure-rand/-/pure-rand-1.7.0.tgz#8b119d05f5f83c409efbede897f1386c4df32313"
+  integrity sha512-Mpghwu8LvQUpr8NRFmGTgX8mFi8WHqor9oE0cCj2Sk5XjA10lBx880qUXtXQPYzrUL8NVQ87nqZvV7LI6gVdOw==
 
 q@^1.5.1:
   version "1.5.1"
@@ -7556,6 +7592,15 @@ string-length@^2.0.0:
     astral-regex "^1.0.0"
     strip-ansi "^4.0.0"
 
+string-width@*, string-width@^4.1.0:
+  version "4.1.0"
+  resolved "https://registry.yarnpkg.com/string-width/-/string-width-4.1.0.tgz#ba846d1daa97c3c596155308063e075ed1c99aff"
+  integrity sha512-NrX+1dVVh+6Y9dnQ19pR0pP4FiEIlUvdTGn8pw6CKTNq5sgib2nIhmUNT5TAmhWmvKr3WcxBcP3E8nWezuipuQ==
+  dependencies:
+    emoji-regex "^8.0.0"
+    is-fullwidth-code-point "^3.0.0"
+    strip-ansi "^5.2.0"
+
 string-width@^1.0.1:
   version "1.0.2"
   resolved "https://registry.yarnpkg.com/string-width/-/string-width-1.0.2.tgz#118bdf5b8cdc51a2a7e70d211e07e2b0b9b107d3"
@@ -7582,15 +7627,6 @@ string-width@^3.0.0, string-width@^3.1.0:
     is-fullwidth-code-point "^2.0.0"
     strip-ansi "^5.1.0"
 
-string-width@^4.1.0:
-  version "4.1.0"
-  resolved "https://registry.yarnpkg.com/string-width/-/string-width-4.1.0.tgz#ba846d1daa97c3c596155308063e075ed1c99aff"
-  integrity sha512-NrX+1dVVh+6Y9dnQ19pR0pP4FiEIlUvdTGn8pw6CKTNq5sgib2nIhmUNT5TAmhWmvKr3WcxBcP3E8nWezuipuQ==
-  dependencies:
-    emoji-regex "^8.0.0"
-    is-fullwidth-code-point "^3.0.0"
-    strip-ansi "^5.2.0"
-
 string.prototype.repeat@^0.2.0:
   version "0.2.0"
   resolved "https://registry.yarnpkg.com/string.prototype.repeat/-/string.prototype.repeat-0.2.0.tgz#aba36de08dcee6a5a337d49b2ea1da1b28fc0ecf"
@@ -8064,7 +8100,7 @@ tsame@^2.0.1:
   resolved "https://registry.yarnpkg.com/tsame/-/tsame-2.0.1.tgz#70410ddbefcd29c61e2d68549b3347b0444d613f"
   integrity sha512-jxyxgKVKa4Bh5dPcO42TJL22lIvfd9LOVJwdovKOnJa4TLLrHxquK+DlGm4rkGmrcur+GRx+x4oW00O2pY/fFw==
 
-tslib@^1.8.0, tslib@^1.8.1, tslib@^1.9.0, tslib@^1.9.3:
+tslib@^1.10.0, tslib@^1.8.0, tslib@^1.8.1, tslib@^1.9.0:
   version "1.10.0"
   resolved "https://registry.yarnpkg.com/tslib/-/tslib-1.10.0.tgz#c3c19f95973fb0a62973fb09d90d961ee43e5c8a"
   integrity sha512-qOebF53frne81cf0S9B41ByenJ3/IuH8yJKngAX35CmiZySA0khhkovshKK+jGCaMnVomla7gVlIcc3EvKPbTQ==