Merge branch 'main' into awsgh-27341

.github/ISSUE_TEMPLATE/bug-report.yml

@@ -95,7 +95,7 @@ body:
       label: Language
       multiple: true
       options:
-        - Typescript
+        - TypeScript
         - Python
         - .NET
         - Java

.github/workflows/issue-label-assign.yml

@@ -239,6 +239,8 @@ env:
             {"area":"@aws-cdk/aws-s3outposts","keywords":["aws-s3outposts","s3outposts"],"labels":["@aws-cdk/aws-s3outposts"]},
             {"area":"@aws-cdk/aws-sagemaker","keywords":["aws-sagemaker","sagemaker"],"labels":["@aws-cdk/aws-sagemaker"]},
             {"area":"@aws-cdk/aws-sam","keywords":["serverless-application-model","aws-sam","sam"],"labels":["@aws-cdk/aws-sam"]},
+            {"area":"@aws-cdk/aws-scheduler","keywords":["aws-scheduler","scheduler"],"labels":["@aws-cdk/aws-scheduler"]},
+            {"area":"@aws-cdk/aws-scheduler-targets","keywords":["aws-scheduler-targets","scheduler-targets"],"labels":["@aws-cdk/aws-scheduler-targets"]},
             {"area":"@aws-cdk/aws-sdb","keywords":["simpledb","aws-sdb","sdb"],"labels":["@aws-cdk/aws-sdb"]},
             {"area":"@aws-cdk/aws-secretsmanager","keywords":["secret","aws-secretsmanager","secrets-manager"],"labels":["@aws-cdk/aws-secretsmanager"]},
             {"area":"@aws-cdk/aws-securityhub","keywords":["aws-securityhub","security-hub"],"labels":["@aws-cdk/aws-securityhub"]},

.github/workflows/repo-metrics.yml

@@ -52,7 +52,7 @@ jobs:
     - name: Create report for PRs
       uses: peter-evans/create-issue-from-file@v4
       with:
-        title: Monthly issue metrics report
+        title: Monthly PR metrics report
         token: ${{ secrets.GITHUB_TOKEN }}
         content-filepath: ./issue_metrics.md
         assignees: evgenyka

.github/workflows/request-cli-integ-test.yml

@@ -19,7 +19,7 @@ jobs:
           persist-credentials: false
       - name: Find changed cli files
         id: changed-cli-files
-        uses: tj-actions/changed-files@8238a4103220c636f2dad328ead8a7c8dbe316a3
+        uses: tj-actions/changed-files@db153baf731265ad02cd490b07f470e2d55e3345
         with:
           base_sha: ${{ github.event.pull_request.base.sha }}
           files_yaml: |

.github/workflows/v2-pull-request.yml

@@ -32,6 +32,6 @@ jobs:
           yarn install --frozen-lockfile
           yarn pkglint
       - name: push
-        uses: stefanzweifel/git-auto-commit-action@v4
+        uses: stefanzweifel/git-auto-commit-action@v5
         with:
           commit_message: 'automatic pkglint fixes'

CHANGELOG.v2.alpha.md

@@ -2,6 +2,20 @@
 
 All notable changes to this project will be documented in this file. See [standard-version](https://github.com/conventional-changelog/standard-version) for commit guidelines.
 
+## [2.100.0-alpha.0](https://github.com/aws/aws-cdk/compare/v2.99.1-alpha.0...v2.100.0-alpha.0) (2023-10-06)
+
+
+### ⚠ BREAKING CHANGES TO EXPERIMENTAL FEATURES
+
+* **redshift:** the behavior of redshift tables has changed. UPDATE action will not be triggered on new table names and instead be triggered on table id changes.
+
+
+### Bug Fixes
+
+* **redshift:** UserTablePriviliges to track changes using table IDs ([#26955](https://github.com/aws/aws-cdk/issues/26955)) ([7e4fdc7](https://github.com/aws/aws-cdk/commit/7e4fdc7ec12eb17224c4156ce9340da8c2bddc72)), closes [#26558](https://github.com/aws/aws-cdk/issues/26558)
+
+## [2.99.1-alpha.0](https://github.com/aws/aws-cdk/compare/v2.99.0-alpha.0...v2.99.1-alpha.0) (2023-09-29)
+
 ## [2.99.0-alpha.0](https://github.com/aws/aws-cdk/compare/v2.98.0-alpha.0...v2.99.0-alpha.0) (2023-09-27)
 
 

CHANGELOG.v2.md

@@ -2,6 +2,41 @@
 
 All notable changes to this project will be documented in this file. See [standard-version](https://github.com/conventional-changelog/standard-version) for commit guidelines.
 
+## [2.100.0](https://github.com/aws/aws-cdk/compare/v2.99.1...v2.100.0) (2023-10-06)
+
+
+### Features
+
+* **aws-cdk-lib:** reduce JavaScript load time, second attempt ([#27362](https://github.com/aws/aws-cdk/issues/27362)) ([0bb49b4](https://github.com/aws/aws-cdk/commit/0bb49b42406b9b3692063537e6194af80d65c7f9)), closes [#27314](https://github.com/aws/aws-cdk/issues/27314) [#27353](https://github.com/aws/aws-cdk/issues/27353)
+* **cdk:** add AppSync GraphQLSchema and pipeline resolvers as hot swappable ([#27197](https://github.com/aws/aws-cdk/issues/27197)) ([0ea6313](https://github.com/aws/aws-cdk/commit/0ea6313125c63608a90b175f2f73b2b51d7b2b05)), closes [#2659](https://github.com/aws/aws-cdk/issues/2659) [#24112](https://github.com/aws/aws-cdk/issues/24112) [#24113](https://github.com/aws/aws-cdk/issues/24113)
+* **cli:** CDK Migrate CLI command ([#27325](https://github.com/aws/aws-cdk/issues/27325)) ([db051ea](https://github.com/aws/aws-cdk/commit/db051ea4e92c70cab4f17e3bfef80294ea80093c))
+* **cli:** declare `cdk import` stable ([#27390](https://github.com/aws/aws-cdk/issues/27390)) ([1057ef0](https://github.com/aws/aws-cdk/commit/1057ef0feba8f35ea5d7dc0f011e85e721146ce0))
+* **eks:** support INF2 instance types ([#27373](https://github.com/aws/aws-cdk/issues/27373)) ([bed9b8d](https://github.com/aws/aws-cdk/commit/bed9b8d43c236bc44c11b5b44447c1ea45935ba8))
+* **s3-deployment:** support Fn::Select in renderData() ([#27237](https://github.com/aws/aws-cdk/issues/27237)) ([8b20c11](https://github.com/aws/aws-cdk/commit/8b20c114068cc9e514aefc136516cb2d01df1e1b)), closes [#25504](https://github.com/aws/aws-cdk/issues/25504) [/github.com/aws/aws-cdk/blob/3edd2400bc0c8a86366a29d3a7eef1ef4fa5e016/packages/aws-cdk-lib/aws-elasticloadbalancingv2/lib/alb/application-target-group.ts#L438](https://github.com/aws//github.com/aws/aws-cdk/blob/3edd2400bc0c8a86366a29d3a7eef1ef4fa5e016/packages/aws-cdk-lib/aws-elasticloadbalancingv2/lib/alb/application-target-group.ts/issues/L438)
+* **synthetics:** CloudWatch Synthetics NodeJS Pupeteer 6.0 Runtime with NodeJS 18 ([#27339](https://github.com/aws/aws-cdk/issues/27339)) ([e48af04](https://github.com/aws/aws-cdk/commit/e48af04c0b483d705d99c97a1f7bf8c6cd8e71c6)), closes [#27337](https://github.com/aws/aws-cdk/issues/27337)
+* update AWS Service Spec ([#27375](https://github.com/aws/aws-cdk/issues/27375)) ([26d4afe](https://github.com/aws/aws-cdk/commit/26d4afee04ef2f5b17d0c211c767adc635d2cf37))
+* **rds:** add new RDS versions ([#27351](https://github.com/aws/aws-cdk/issues/27351)) ([e0c9792](https://github.com/aws/aws-cdk/commit/e0c9792811e5e0685729264694b645d147ff52de))
+
+
+### Bug Fixes
+
+* **autoscaling:** ssmSessionPermissions does not add managed policy to role specified in launch template ([#27220](https://github.com/aws/aws-cdk/issues/27220)) ([20e4760](https://github.com/aws/aws-cdk/commit/20e4760621daf837f39cc0f1c760efd9bbf5e31b)), closes [#25904](https://github.com/aws/aws-cdk/issues/25904)
+* **cdk:** Resolve cross stack and default parameters for hotswaps ([#27195](https://github.com/aws/aws-cdk/issues/27195)) ([3507141](https://github.com/aws/aws-cdk/commit/3507141bd75022c72df1f8e24605f637deef5179)), closes [/docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/quickref-cloudformation.html#w2ab1c17c23c19b5](https://github.com/aws//docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/quickref-cloudformation.html/issues/w2ab1c17c23c19b5)
+* **cli:** report errors from resource failures in nested stacks ([#27318](https://github.com/aws/aws-cdk/issues/27318)) ([1f639c7](https://github.com/aws/aws-cdk/commit/1f639c7b79bd9e0841ccc429fc16006b770f4405))
+* **custom-resources:** IAM policy incorrect for SDKv3 names ([#27313](https://github.com/aws/aws-cdk/issues/27313)) ([c68ea44](https://github.com/aws/aws-cdk/commit/c68ea4453bb1c70f2cc7739012b11d25f10f4a8f)), closes [#27255](https://github.com/aws/aws-cdk/issues/27255) [#27268](https://github.com/aws/aws-cdk/issues/27268) [#27270](https://github.com/aws/aws-cdk/issues/27270) [#27395](https://github.com/aws/aws-cdk/issues/27395)
+* **logs:** remove invalid data protection data identifier ([#27388](https://github.com/aws/aws-cdk/issues/27388)) ([4db166d](https://github.com/aws/aws-cdk/commit/4db166d1f46e3057a58d4c216b9adf62a485e285))
+* **s3:** bucket deletion fails if object creation races against cleanup ([#26875](https://github.com/aws/aws-cdk/issues/26875)) ([735b786](https://github.com/aws/aws-cdk/commit/735b786af77abc09982e8c2cea4036a0fbaf6a19)), closes [#26874](https://github.com/aws/aws-cdk/issues/26874)
+* **sns-subscriptions:** cannot add SqsSubscription when using an Sqs Construct from a different Constructs library ([#27227](https://github.com/aws/aws-cdk/issues/27227)) ([52eee85](https://github.com/aws/aws-cdk/commit/52eee859d227a854c46d6975fcec2b4b10719097)), closes [#27225](https://github.com/aws/aws-cdk/issues/27225)
+* **stepfunctions:** Escaping newline characters in Step Functions intrinsics caused schema validation failures ([#27323](https://github.com/aws/aws-cdk/issues/27323)) ([4e96edd](https://github.com/aws/aws-cdk/commit/4e96edd057c940afb8f41b2a0fbe93267ce2424e))
+* reduce load time of JavaScript library, for real ([#27314](https://github.com/aws/aws-cdk/issues/27314)) ([48acd37](https://github.com/aws/aws-cdk/commit/48acd37389c9c194f0d6638437ea4be1c2302142))
+
+## [2.99.1](https://github.com/aws/aws-cdk/compare/v2.99.0...v2.99.1) (2023-09-29)
+
+
+### Bug Fixes
+
+* load time regression ([#27314](https://github.com/aws/aws-cdk/issues/27314)) ([fca5a73](https://github.com/aws/aws-cdk/commit/fca5a7344d2e205663873b577d5d91f203dd9d14))
+
 ## [2.99.0](https://github.com/aws/aws-cdk/compare/v2.98.0...v2.99.0) (2023-09-27)
 
 

CONTRIBUTORS.md

@@ -14,19 +14,19 @@ Shout out to our top contributors!
 - [otaviomacedo](https://github.com/otaviomacedo)
 - [madeline-k](https://github.com/madeline-k)
 - [NetaNir](https://github.com/NetaNir)
-- [robertd](https://github.com/robertd)
 - [comcalvi](https://github.com/comcalvi)
+- [robertd](https://github.com/robertd)
 - [pahud](https://github.com/pahud)
-- [peterwoodworth](https://github.com/peterwoodworth)
-- [MrArnoldPalmer](https://github.com/MrArnoldPalmer)
 - [mrgrain](https://github.com/mrgrain)
+- [MrArnoldPalmer](https://github.com/MrArnoldPalmer)
+- [peterwoodworth](https://github.com/peterwoodworth)
 - [TheRealAmazonKendra](https://github.com/TheRealAmazonKendra)
 - [nija-at](https://github.com/nija-at)
 - [hoegertn](https://github.com/hoegertn)
-- [nmussy](https://github.com/nmussy)
 - [lpizzinidev](https://github.com/lpizzinidev)
 - [jumic](https://github.com/jumic)
 - [SoManyHs](https://github.com/SoManyHs)
+- [watany-dev](https://github.com/watany-dev)
 
 
-_Last updated: Fri, 01 Sep 23 00:09:05 +0000_
+_Last updated: Sun, 01 Oct 23 00:09:32 +0000_

allowed-breaking-changes.txt

@@ -226,3 +226,6 @@ base-types:aws-cdk-lib.aws_autoscaling.CronOptions
 removed:aws-cdk-lib.aws_autoscaling.CronOptions.timeZone
 removed:aws-cdk-lib.aws_autoscaling.CronOptions.year
 removed:aws-cdk-lib.aws_backup.BackupPlanRuleProps.schedule
+
+# This data identifer was added by mistake; it had never worked.
+removed:aws-cdk-lib.aws_logs.DataIdentifier.PHONENUMBER

nx.json

@@ -17,7 +17,8 @@
       "outputs": [
         "{projectRoot}/**/*.integ.*.js.snapshot/*",
         "{projectRoot}/tsconfig.json",
-        "{projectRoot}/**/lib/aws-custom-resource/sdk-api-metadata.json",
+        "{projectRoot}/**/lib/aws-custom-resource/sdk-v2-to-v3.json",
+        "{projectRoot}/**/lib/aws-custom-resource/sdk-v3-metadata.json",
         "{projectRoot}/**/build-info.json",
         "{projectRoot}/**/*.js",
         "{projectRoot}/**/*.js.map",

package.json

@@ -19,6 +19,7 @@
     "@types/node": "18.11.19",
     "@types/prettier": "2.6.0",
     "@yarnpkg/lockfile": "^1.1.0",
+    "aws-sdk-js-codemod": "^0.18.3",
     "cdk-generate-synthetic-examples": "^0.1.291",
     "conventional-changelog-cli": "^2.2.2",
     "fs-extra": "^9.1.0",
@@ -75,7 +76,6 @@
       "packages/cdk-assets",
       "packages/@aws-cdk/*",
       "packages/awslint",
-      "packages/@aws-cdk-containers/*",
       "packages/@aws-cdk-testing/*",
       "packages/@aws-cdk/*/lambda-packages/*",
       "tools/@aws-cdk/cdk-build-tools",

packages/@aws-cdk-testing/cli-integ/tests/init-javascript/init-javascript.integtest.ts

@@ -25,8 +25,10 @@ integTest('Test importing CDK from ESM', withTemporaryDirectory(withPackages(asy
 
   // Rewrite some files
   await fs.writeFile(path.join(context.integTestDir, 'new-entrypoint.mjs'), `
-// Test two styles of imports
-import { Stack, aws_sns as sns, aws_sns_subscriptions as subs, aws_sqs as sqs } from 'aws-cdk-lib';
+// Test multiple styles of imports
+import { Stack, aws_sns as sns } from 'aws-cdk-lib';
+import { SqsSubscription } from 'aws-cdk-lib/aws-sns-subscriptions';
+import * as sqs from 'aws-cdk-lib/aws-sqs';
 import * as cdk from 'aws-cdk-lib';
 
 class TestjsStack extends Stack {
@@ -39,7 +41,7 @@ class TestjsStack extends Stack {
 
     const topic = new sns.Topic(this, 'TestjsTopic');
 
-    topic.addSubscription(new subs.SqsSubscription(queue));
+    topic.addSubscription(new SqsSubscription(queue));
   }
 }
 

packages/@aws-cdk-testing/framework-integ/test/aws-codebuild/test/integ.asset-build-spec.js.snapshot/CodeBuildAssetBuildSpecStack.template.json

@@ -26,6 +26,7 @@
        "Action": [
         "s3:GetBucket*",
         "s3:GetObject*",
+        "s3:HeadObject",
         "s3:List*"
        ],
        "Effect": "Allow",

packages/@aws-cdk-testing/framework-integ/test/aws-codebuild/test/integ.caching.js.snapshot/aws-cdk-codebuild.template.json

@@ -33,6 +33,7 @@
         "s3:DeleteObject*",
         "s3:GetBucket*",
         "s3:GetObject*",
+        "s3:HeadObject",
         "s3:List*",
         "s3:PutObject",
         "s3:PutObjectLegalHold",

packages/@aws-cdk-testing/framework-integ/test/aws-codebuild/test/integ.project-bucket.js.snapshot/aws-cdk-codebuild.template.json

@@ -31,6 +31,7 @@
        "Action": [
         "s3:GetBucket*",
         "s3:GetObject*",
+        "s3:HeadObject",
         "s3:List*"
        ],
        "Effect": "Allow",

packages/@aws-cdk-testing/framework-integ/test/aws-codebuild/test/integ.project-buildspec-artifacts.js.snapshot/aws-cdk-codebuild-buildspec-artifact-name.template.json

@@ -33,6 +33,7 @@
         "s3:DeleteObject*",
         "s3:GetBucket*",
         "s3:GetObject*",
+        "s3:HeadObject",
         "s3:List*",
         "s3:PutObject",
         "s3:PutObjectLegalHold",

packages/@aws-cdk-testing/framework-integ/test/aws-codebuild/test/integ.project-secondary-sources-artifacts.js.snapshot/aws-cdk-codebuild-secondary-sources-artifacts.template.json

@@ -31,6 +31,7 @@
        "Action": [
         "s3:GetBucket*",
         "s3:GetObject*",
+        "s3:HeadObject",
         "s3:List*"
        ],
        "Effect": "Allow",
@@ -63,6 +64,7 @@
         "s3:DeleteObject*",
         "s3:GetBucket*",
         "s3:GetObject*",
+        "s3:HeadObject",
         "s3:List*",
         "s3:PutObject",
         "s3:PutObjectLegalHold",

packages/@aws-cdk-testing/framework-integ/test/aws-codedeploy/test/server/integ.deployment-group.js.snapshot/aws-cdk-codedeploy-server-dg.template.json

@@ -445,6 +445,7 @@
        "Action": [
         "s3:GetBucket*",
         "s3:GetObject*",
+        "s3:HeadObject",
         "s3:List*"
        ],
        "Effect": "Allow",

packages/@aws-cdk-testing/framework-integ/test/aws-codepipeline-actions/test/cloudformation/integ.stacksets.js.snapshot/StackSetPipelineStack.template.json

@@ -170,6 +170,7 @@
         "s3:DeleteObject*",
         "s3:GetBucket*",
         "s3:GetObject*",
+        "s3:HeadObject",
         "s3:List*",
         "s3:PutObject",
         "s3:PutObjectLegalHold",
@@ -392,6 +393,7 @@
        "Action": [
         "s3:GetBucket*",
         "s3:GetObject*",
+        "s3:HeadObject",
         "s3:List*"
        ],
        "Effect": "Allow",
@@ -556,6 +558,7 @@
        "Action": [
         "s3:GetBucket*",
         "s3:GetObject*",
+        "s3:HeadObject",
         "s3:List*"
        ],
        "Effect": "Allow",

packages/@aws-cdk-testing/framework-integ/test/aws-codepipeline-actions/test/integ.cfn-template-from-repo.lit.js.snapshot/aws-cdk-codepipeline-cloudformation.template.json

@@ -158,6 +158,7 @@
         "s3:DeleteObject*",
         "s3:GetBucket*",
         "s3:GetObject*",
+        "s3:HeadObject",
         "s3:List*",
         "s3:PutObject",
         "s3:PutObjectLegalHold",
@@ -433,6 +434,7 @@
         "s3:DeleteObject*",
         "s3:GetBucket*",
         "s3:GetObject*",
+        "s3:HeadObject",
         "s3:List*",
         "s3:PutObject",
         "s3:PutObjectLegalHold",
@@ -558,6 +560,7 @@
        "Action": [
         "s3:GetBucket*",
         "s3:GetObject*",
+        "s3:HeadObject",
         "s3:List*"
        ],
        "Effect": "Allow",
@@ -668,6 +671,7 @@
        "Action": [
         "s3:GetBucket*",
         "s3:GetObject*",
+        "s3:HeadObject",
         "s3:List*"
        ],
        "Effect": "Allow",

packages/@aws-cdk-testing/framework-integ/test/aws-codepipeline-actions/test/integ.lambda-deployed-through-codepipeline.lit.js.snapshot/PipelineStack.template.json

@@ -152,6 +152,7 @@
         "s3:DeleteObject*",
         "s3:GetBucket*",
         "s3:GetObject*",
+        "s3:HeadObject",
         "s3:List*",
         "s3:PutObject",
         "s3:PutObjectLegalHold",
@@ -497,6 +498,7 @@
         "s3:DeleteObject*",
         "s3:GetBucket*",
         "s3:GetObject*",
+        "s3:HeadObject",
         "s3:List*",
         "s3:PutObject",
         "s3:PutObjectLegalHold",
@@ -614,6 +616,7 @@
         "s3:DeleteObject*",
         "s3:GetBucket*",
         "s3:GetObject*",
+        "s3:HeadObject",
         "s3:List*",
         "s3:PutObject",
         "s3:PutObjectLegalHold",
@@ -923,6 +926,7 @@
        "Action": [
         "s3:GetBucket*",
         "s3:GetObject*",
+        "s3:HeadObject",
         "s3:List*"
        ],
        "Effect": "Allow",
@@ -1031,6 +1035,7 @@
        "Action": [
         "s3:GetBucket*",
         "s3:GetObject*",
+        "s3:HeadObject",
         "s3:List*"
        ],
        "Effect": "Allow",
@@ -1347,6 +1352,7 @@
         "s3:DeleteObject*",
         "s3:GetBucket*",
         "s3:GetObject*",
+        "s3:HeadObject",
         "s3:List*",
         "s3:PutObject",
         "s3:PutObjectLegalHold",
@@ -1558,6 +1564,7 @@
         "s3:DeleteObject*",
         "s3:GetBucket*",
         "s3:GetObject*",
+        "s3:HeadObject",
         "s3:List*",
         "s3:PutObject",
         "s3:PutObjectLegalHold",

packages/@aws-cdk-testing/framework-integ/test/aws-codepipeline-actions/test/integ.lambda-pipeline.js.snapshot/aws-cdk-codepipeline-lambda.template.json

@@ -152,6 +152,7 @@
         "s3:DeleteObject*",
         "s3:GetBucket*",
         "s3:GetObject*",
+        "s3:HeadObject",
         "s3:List*",
         "s3:PutObject",
         "s3:PutObjectLegalHold",
@@ -360,6 +361,7 @@
        "Action": [
         "s3:GetBucket*",
         "s3:GetObject*",
+        "s3:HeadObject",
         "s3:List*"
        ],
        "Effect": "Allow",

packages/@aws-cdk-testing/framework-integ/test/aws-codepipeline-actions/test/integ.pipeline-alexa-deploy.js.snapshot/aws-cdk-codepipeline-alexa-deploy.template.json

@@ -162,6 +162,7 @@
         "s3:DeleteObject*",
         "s3:GetBucket*",
         "s3:GetObject*",
+        "s3:HeadObject",
         "s3:List*",
         "s3:PutObject",
         "s3:PutObjectLegalHold",
@@ -361,6 +362,7 @@
        "Action": [
         "s3:GetBucket*",
         "s3:GetObject*",
+        "s3:HeadObject",
         "s3:List*"
        ],
        "Effect": "Allow",