Merge branch 'main' into dynamodb-cw-insights-for-gsi-15671

.github/workflows/request-cli-integ-test.yml

@@ -54,7 +54,7 @@ jobs:
           git config --global user.email 'aws-cdk-automation@users.noreply.github.com'
           git push --force --atomic https://github.com/${{ github.repository }}.git FETCH_HEAD:test-main-pipeline
       - name: Explain next steps
-        uses: thollander/actions-comment-pull-request@fabd468d3a1a0b97feee5f6b9e499eab0dd903f6
+        uses: thollander/actions-comment-pull-request@e2c37e53a7d2227b61585343765f73a9ca57eda9
         with:
           message: |
             :arrow_right: **PR build request submitted to `test-main-pipeline`** :arrow_left:

.github/workflows/sync-from-upstream.yml

@@ -43,15 +43,21 @@ jobs:
       contents: write
     needs: [check-secret]
     steps:
-      - name: Checkout using User Token
+      - name: Checkout using User Token (+ download lfs dependencies)
         if: needs.check-secret.outputs.ok == 'true'
         uses: actions/checkout@v4
         with:
+          lfs: true
           token: ${{ secrets.PROJEN_GITHUB_TOKEN }}
 
-      - name: Checkout using GitHub Actions permissions
+      - name: Checkout using GitHub Actions permissions (+ download lfs dependencies)
         if: needs.check-secret.outputs.ok == 'false'
         uses: actions/checkout@v4
+        with:
+          lfs: true
+
+      - name: Checkout LFS objects
+        run: git lfs checkout
 
       - name: Sync from aws/aws-cdk
         run: |-

.mergify.yml

@@ -1,9 +1,22 @@
 # See https://doc.mergify.io
 queue_rules:
-  - name: default
+  - name: default-merge
     update_method: merge
+    merge_method: merge
     conditions:
       - status-success~=AWS CodeBuild us-east-1
+    commit_message_template: |-
+      {{ title }} (#{{ number }})
+      {{ body }}
+
+  - name: default-squash
+    update_method: merge
+    merge_method: squash
+    conditions:
+      - status-success~=AWS CodeBuild us-east-1
+    commit_message_template: |-
+      {{ title }} (#{{ number }})
+      {{ body }}
 
 pull_request_rules:
   - name: label core
@@ -18,11 +31,7 @@ pull_request_rules:
       comment:
         message: Thank you for contributing! Your pull request will be updated from main and then merged automatically (do not update manually, and be sure to [allow changes to be pushed to your fork](https://help.github.com/en/github/collaborating-with-issues-and-pull-requests/allowing-changes-to-a-pull-request-branch-created-from-a-fork)).
       queue:
-        name: default
-        method: squash
-        commit_message_template: |-
-          {{ title }} (#{{ number }})
-          {{ body }}
+        name: default-squash
     conditions:
       - base!=release
       - -title~=(WIP|wip)
@@ -41,11 +50,7 @@ pull_request_rules:
       comment:
         message: Thank you for contributing! Your pull request will be automatically updated and merged (do not update manually, and be sure to [allow changes to be pushed to your fork](https://help.github.com/en/github/collaborating-with-issues-and-pull-requests/allowing-changes-to-a-pull-request-branch-created-from-a-fork)).
       queue:
-        name: default
-        method: squash
-        commit_message_template: |-
-          {{ title }} (#{{ number }})
-          {{ body }}
+        name: default-squash
     conditions:
       - base!=release
       - -title~=(WIP|wip)
@@ -65,11 +70,7 @@ pull_request_rules:
       comment:
         message: Thank you for contributing! Your pull request will be automatically updated and merged without squashing (do not update manually, and be sure to [allow changes to be pushed to your fork](https://help.github.com/en/github/collaborating-with-issues-and-pull-requests/allowing-changes-to-a-pull-request-branch-created-from-a-fork)).
       queue:
-        name: default
-        method: merge
-        commit_message_template: |-
-          {{ title }} (#{{ number }})
-          {{ body }}
+        name: default-merge
     conditions:
       - -title~=(WIP|wip)
       - -label~=(blocked|do-not-merge)
@@ -112,11 +113,7 @@ pull_request_rules:
       comment:
         message: Thanks Dependabot!
       queue:
-        name: default
-        method: squash
-        commit_message_template: |-
-          {{ title }} (#{{ number }})
-          {{ body }}
+        name: default-squash
     conditions:
       - -title~=(WIP|wip)
       - -label~=(blocked|do-not-merge)

CHANGELOG.v2.alpha.md

@@ -2,6 +2,30 @@
 
 All notable changes to this project will be documented in this file. See [standard-version](https://github.com/conventional-changelog/standard-version) for commit guidelines.
 
+## [2.162.1-alpha.0](https://github.com/aws/aws-cdk/compare/v2.162.0-alpha.0...v2.162.1-alpha.0) (2024-10-11)
+
+## [2.162.0-alpha.0](https://github.com/aws/aws-cdk/compare/v2.161.1-alpha.0...v2.162.0-alpha.0) (2024-10-10)
+
+
+### ⚠ BREAKING CHANGES TO EXPERIMENTAL FEATURES
+
+* **kinesisfirehose-alpha:** replaced `destinations` property with `destination` (singular) and changed the type from array of Destinations to a single Destination. Old behaviour would only allow an array with a single Destination to be passed in anyway.
+
+### Features
+
+* **iot-alpha:** support for account audit configuration ([#31661](https://github.com/aws/aws-cdk/issues/31661)) ([fc19571](https://github.com/aws/aws-cdk/commit/fc19571c6392e905ff03998d0e8bc4e3b01399f4)), closes [#31663](https://github.com/aws/aws-cdk/issues/31663)
+* **pipes-targets:** add EventBridge ([#30654](https://github.com/aws/aws-cdk/issues/30654)) ([842f49a](https://github.com/aws/aws-cdk/commit/842f49a224ceadb1ef973dc3048ee3ac52d8f118))
+
+
+### Bug Fixes
+
+* **cli-lib:** cannot bootstrap specific environment ([#31713](https://github.com/aws/aws-cdk/issues/31713)) ([fec4bb1](https://github.com/aws/aws-cdk/commit/fec4bb1c26db54bbb151bd05239e1fc1be5de657))
+
+
+### Miscellaneous Chores
+
+* **kinesisfirehose-alpha:** replace`destinations` property with `destination` and change type from array to single IDestination ([#31630](https://github.com/aws/aws-cdk/issues/31630)) ([1e2cff1](https://github.com/aws/aws-cdk/commit/1e2cff19eec234e1d1f7f501230cba01b220a09b))
+
 ## [2.161.1-alpha.0](https://github.com/aws/aws-cdk/compare/v2.161.0-alpha.0...v2.161.1-alpha.0) (2024-10-05)
 
 ## [2.161.0-alpha.0](https://github.com/aws/aws-cdk/compare/v2.160.0-alpha.0...v2.161.0-alpha.0) (2024-10-03)

CHANGELOG.v2.md

@@ -2,6 +2,37 @@
 
 All notable changes to this project will be documented in this file. See [standard-version](https://github.com/conventional-changelog/standard-version) for commit guidelines.
 
+## [2.162.1](https://github.com/aws/aws-cdk/compare/v2.162.0...v2.162.1) (2024-10-11)
+
+
+### Bug Fixes
+
+* **cli:** `cdk import` errors with 'S3 error: Access Denied' ([#31727](https://github.com/aws/aws-cdk/issues/31727)) ([5c2787a](https://github.com/aws/aws-cdk/commit/5c2787ab9ee35b36f91d9a2889b92c6ac85e2fcb)), closes [#31597](https://github.com/aws/aws-cdk/issues/31597) [#31716](https://github.com/aws/aws-cdk/issues/31716)
+
+## [2.162.0](https://github.com/aws/aws-cdk/compare/v2.161.1...v2.162.0) (2024-10-10)
+
+
+### Features
+
+* **appsync:** add `ownerContact` property to the `GraphqlApi` ([#31585](https://github.com/aws/aws-cdk/issues/31585)) ([a8b2f01](https://github.com/aws/aws-cdk/commit/a8b2f0120d90ac5ed9ed8e222a673d996ea057fa))
+* **cdk:** expose authorizer id and authorization type ([#31622](https://github.com/aws/aws-cdk/issues/31622)) ([daaf0aa](https://github.com/aws/aws-cdk/commit/daaf0aaa18e5f0120e58c9d7655605c5351e8671)), closes [#31605](https://github.com/aws/aws-cdk/issues/31605)
+* **cli:** cdk rollback ([#31684](https://github.com/aws/aws-cdk/issues/31684)) ([3e40edc](https://github.com/aws/aws-cdk/commit/3e40edce14080939baa8b5b3a3a100e991d965fd)), closes [#31407](https://github.com/aws/aws-cdk/issues/31407)
+* **ecs:** add fargate ephemeral storage encryption to cluster settings ([#30759](https://github.com/aws/aws-cdk/issues/30759)) ([642a944](https://github.com/aws/aws-cdk/commit/642a9444e9549b04949ae81656aba0d8525e75f4)), closes [#30721](https://github.com/aws/aws-cdk/issues/30721)
+* **eks:** support eks with k8s 1.31 ([#31707](https://github.com/aws/aws-cdk/issues/31707)) ([fc09bc1](https://github.com/aws/aws-cdk/commit/fc09bc19166b2e4b76de6b836505c7b421111449))
+* **elasticloadbalancingv2:** support TCP idle timeout for Network Load Balancer Listener ([#31584](https://github.com/aws/aws-cdk/issues/31584)) ([8d851a9](https://github.com/aws/aws-cdk/commit/8d851a96a4d59b6cf03ca44ed1eac0c65602e27f)), closes [#31310](https://github.com/aws/aws-cdk/issues/31310)
+* update L1 CloudFormation resource definitions ([#31688](https://github.com/aws/aws-cdk/issues/31688)) ([b211189](https://github.com/aws/aws-cdk/commit/b2111890d55f33f43c42f27d2da6ede7de702f25))
+* **rds:** enable `grantDataApiAccess` method for imported database cluster ([#31280](https://github.com/aws/aws-cdk/issues/31280)) ([3c92012](https://github.com/aws/aws-cdk/commit/3c9201296e16a790f9ceccc8862f10e6d23e9d7d)), closes [#31116](https://github.com/aws/aws-cdk/issues/31116) [/github.com/aws/aws-cdk/blob/main/packages/aws-cdk-lib/aws-rds/lib/cluster.ts#L983](https://github.com/aws//github.com/aws/aws-cdk/blob/main/packages/aws-cdk-lib/aws-rds/lib/cluster.ts/issues/L983) [/github.com/aws/aws-cdk/blob/main/packages/aws-cdk-lib/aws-rds/lib/cluster.ts#L523-L526](https://github.com/aws//github.com/aws/aws-cdk/blob/main/packages/aws-cdk-lib/aws-rds/lib/cluster.ts/issues/L523-L526)
+
+
+### Bug Fixes
+
+* **core:** `cdk diff` on large templates fails when passing in `toolkitStackName` and `qualifier` ([#31636](https://github.com/aws/aws-cdk/issues/31636)) ([f603c97](https://github.com/aws/aws-cdk/commit/f603c97bc82172219d3715505fe228c1bb02f475)), closes [#29179](https://github.com/aws/aws-cdk/issues/29179)
+* **ecs:** ecs exec cannot be enabled for ECS Anywhere (ecs.ExternalService) ([#31374](https://github.com/aws/aws-cdk/issues/31374)) ([cff1fcd](https://github.com/aws/aws-cdk/commit/cff1fcd6961227f5ef8fd0c1fd3a6d108dc28e34)), closes [#31181](https://github.com/aws/aws-cdk/issues/31181)
+* **elasticloadbalancingv2:** `http2Enabled` with true is ignored in ApplicationLoadBalancer ([#31675](https://github.com/aws/aws-cdk/issues/31675)) ([c1b240e](https://github.com/aws/aws-cdk/commit/c1b240ee6fdba9a0ca1126c97c5e0173bae007ce)), closes [#31609](https://github.com/aws/aws-cdk/issues/31609)
+* **event-targets:** ecsTask uses invalid task definition arn in policy ([#31615](https://github.com/aws/aws-cdk/issues/31615)) ([4ada3ea](https://github.com/aws/aws-cdk/commit/4ada3ea4c06bb1f9155bbe2928f64babe4527d0d)), closes [#30390](https://github.com/aws/aws-cdk/issues/30390) [#30484](https://github.com/aws/aws-cdk/issues/30484)
+* **iam:** override Role.applyRemovalPolicy for customizeRoles ([#31652](https://github.com/aws/aws-cdk/issues/31652)) ([35ed5c6](https://github.com/aws/aws-cdk/commit/35ed5c64db787c74abc21ce75176eaa8d240689f)), closes [#31651](https://github.com/aws/aws-cdk/issues/31651)
+* **s3:** unable to update the s3 event notifications on an existing S3 bucket ([#31431](https://github.com/aws/aws-cdk/issues/31431)) ([0a56c0d](https://github.com/aws/aws-cdk/commit/0a56c0db7e9851af26e65a05521e0ec082a06c9c)), closes [#31303](https://github.com/aws/aws-cdk/issues/31303)
+
 ## [2.161.1](https://github.com/aws/aws-cdk/compare/v2.161.0...v2.161.1) (2024-10-05)
 
 

CONTRIBUTING.md

@@ -210,6 +210,8 @@ The following tools need to be installed on your system prior to installing the
 - [Python >= 3.8.0, < 4.0](https://www.python.org/downloads/release/python-380/)
 - [Docker >= 19.03](https://docs.docker.com/get-docker/)
   - the Docker daemon must also be running
+- [git-lfs](https://docs.github.com/en/repositories/working-with-files/managing-large-files/installing-git-large-file-storage)
+  - Without this, you'll get the message that the clone succeeded but the checkout failed when you initially clone the repo.
 
 First fork the repository https://github.com/aws/aws-cdk/fork, and then run the following commands to clone the repository locally.
 

allowed-breaking-changes.txt

@@ -932,4 +932,8 @@ removed:aws-cdk-lib.aws_ec2.WindowsVersion.WINDOWS_SERVER_2022_SWEDISH_FULL_BASE
 removed:aws-cdk-lib.aws_ec2.WindowsVersion.WINDOWS_SERVER_2022_TURKISH_FULL_BASE_2023_11_15
 removed:aws-cdk-lib.aws_ec2.WindowsVersion.WINDOWS_SERVER_2022_TURKISH_FULL_BASE_2023_12_13
 removed:aws-cdk-lib.aws_ec2.WindowsVersion.WINDOWS_SERVER_2022_TURKISH_FULL_BASE_2024_01_16
-removed:aws-cdk-lib.aws_ec2.WindowsVersion.WINDOWS_SERVER_2022_TURKISH_FULL_BASE_2024_02_14
+removed:aws-cdk-lib.aws_ec2.WindowsVersion.WINDOWS_SERVER_2022_TURKISH_FULL_BASE_2024_02_14
+
+# null() return a [] which is invalid filter rule. It should return [null].
+# Hence the return type changes from string[] to any
+change-return-type:aws-cdk-lib.aws_lambda.FilterRule.null

lerna.json

@@ -11,7 +11,6 @@
     "packages/@aws-cdk/*/lambda-packages/*",
     "tools/@aws-cdk/cdk-build-tools",
     "tools/@aws-cdk/cdk-release",
-    "tools/@aws-cdk/eslint-plugin",
     "tools/@aws-cdk/node-bundle",
     "tools/@aws-cdk/pkglint",
     "tools/@aws-cdk/pkgtools",

package.json

@@ -79,7 +79,6 @@
       "packages/@aws-cdk/*/lambda-packages/*",
       "tools/@aws-cdk/cdk-build-tools",
       "tools/@aws-cdk/cdk-release",
-      "tools/@aws-cdk/eslint-plugin",
       "tools/@aws-cdk/node-bundle",
       "tools/@aws-cdk/pkglint",
       "tools/@aws-cdk/pkgtools",

packages/@aws-cdk-testing/cli-integ/lib/with-cdk-app.ts

@@ -535,15 +535,15 @@ export class TestFixture extends ShellHelper {
     // Bootstrap stacks have buckets that need to be cleaned
     const bucketNames = stacksToDelete.map(stack => outputFromStack('BucketName', stack)).filter(defined);
     // Parallelism will be reasonable
-    // eslint-disable-next-line @aws-cdk/promiseall-no-unbounded-parallelism
+    // eslint-disable-next-line @cdklabs/promiseall-no-unbounded-parallelism
     await Promise.all(bucketNames.map(b => this.aws.emptyBucket(b)));
     // The bootstrap bucket has a removal policy of RETAIN by default, so add it to the buckets to be cleaned up.
     this.bucketsToDelete.push(...bucketNames);
 
     // Bootstrap stacks have ECR repositories with images which should be deleted
     const imageRepositoryNames = stacksToDelete.map(stack => outputFromStack('ImageRepositoryName', stack)).filter(defined);
     // Parallelism will be reasonable
-    // eslint-disable-next-line @aws-cdk/promiseall-no-unbounded-parallelism
+    // eslint-disable-next-line @cdklabs/promiseall-no-unbounded-parallelism
     await Promise.all(imageRepositoryNames.map(r => this.aws.deleteImageRepository(r)));
 
     await this.aws.deleteStacks(

packages/@aws-cdk-testing/cli-integ/test/resource-pool.test.ts

@@ -51,7 +51,7 @@ test('somewhat balance', async () => {
 
   const keys = Object.keys(counters) as Array<keyof typeof counters> ;
   const pool = ResourcePool.withResources(POOL_NAME, keys);
-  // eslint-disable-next-line @aws-cdk/promiseall-no-unbounded-parallelism
+  // eslint-disable-next-line @cdklabs/promiseall-no-unbounded-parallelism
   await Promise.all(Array.from(range(N)).map(() =>
     pool.using(async (x) => {
       counters[x] += 1;

packages/@aws-cdk-testing/cli-integ/tests/cli-integ-tests/bootstrapping.integtest.ts

@@ -1,4 +1,4 @@
-/* eslint-disable @aws-cdk/no-literal-partition */
+/* eslint-disable @cdklabs/no-literal-partition */
 import * as fs from 'fs';
 import * as path from 'path';
 import { DescribeStackResourcesCommand, DescribeStacksCommand } from '@aws-sdk/client-cloudformation';

packages/@aws-cdk-testing/framework-integ/README.md

@@ -6,13 +6,18 @@ See `integ-runner` package or `yarn integ --help` for detailed instructions.
 
 ## Common Errors
 
-### Error: For this test you must provide your own HostedZoneId/HostedZoneName/DomainName
+### Error: For this test you must provide your own HostedZoneId/HostedZoneName/DomainName/Certificate
 
 Some test cases require a publicly available domain name attached to a Amazon Route 53 Hosted Zone to work.
 These test cases need to add DNS records that are then retrieved via the public internet infrastructure. This can be a subdomain to an existing domain, but it must have a Hosted Zone configured and nameservers delegated to it.
 
 If you haven't got one ready, see the [Route 53 guide](https://docs.aws.amazon.com/Route53/latest/DeveloperGuide/CreatingHostedZone.html) to manually create a hosted zone.
 
+Some test cases require an ACM public certificate on a publicly available domain name to work.
+These test cases need a public certificate which uses DNS for domain ownership validation.
+
+See the [AWS Certificate Manager guide](https://docs.aws.amazon.com/acm/latest/userguide/acm-public-certificates.html) to request an Amazon-Issued certificate.
+
 AWS CDK core team members, please check our team internal docs for guidance on how to configure domains for testing.
 
 #### How to correctly run these tests
@@ -25,12 +30,15 @@ The checked-in snapshot uses dummy values that will not deploy.
 
 - Go to your Hosted Zone and write down the values for `HostedZoneId`, `HostedZoneName` and `DomainName`.
    All values must related to the **same** Hosted Zone.
+- Go to your AWS Certificate Manager and write down the ARN for the `Certificate`
+   The certificate should be attached to a domain name in the **same** Hosted Zone.
 - In your terminal run the following commands:
 
 ```console
 export HOSTED_ZONE_ID=your_hosted_zone_id
 export HOSTED_ZONE_NAME=your_hosted_zone_name
 export DOMAIN_NAME=your_domain_name
+export CERT_ARN=your_certificate_arn
 ```
 
 - Finally, in the same terminal run your specific test case with the **update workflow disabled**. For example:

packages/@aws-cdk-testing/framework-integ/package.json

@@ -42,6 +42,7 @@
     "@aws-cdk/lambda-layer-kubectl-v24": "^2.0.242",
     "@aws-cdk/lambda-layer-kubectl-v29": "^2.1.0",
     "@aws-cdk/lambda-layer-kubectl-v30": "^2.0.1",
+    "@aws-cdk/lambda-layer-kubectl-v31": "^2.0.0",
     "aws-cdk-lib": "0.0.0",
     "cdk8s": "2.69.0",
     "cdk8s-plus-27": "2.9.5",