chore(release): 2.148.0 #30764

aws-cdk-automation · 2024-07-05T18:53:00Z

See [CHANGELOG](https://github.com/aws/aws-cdk/blob/merge-back/2.147.0/CHANGELOG.md)

### Reason for this change missing property ### Description of changes https://docs.aws.amazon.com/cdk/api/v2/docs/aws-cdk-lib.aws_codebuild.CfnProjectProps.html#visibility ### Description of how you validated changes done test and integ-test ### Checklist - [x] My code adheres to the [CONTRIBUTING GUIDE](https://github.com/aws/aws-cdk/blob/main/CONTRIBUTING.md) and [DESIGN GUIDELINES](https://github.com/aws/aws-cdk/blob/main/docs/DESIGN_GUIDELINES.md) ---- *By submitting this pull request, I confirm that my contribution is made under the terms of the Apache-2.0 license*

### Issue # (if applicable) N/A ### Reason for this change The `defaulrRedirectUri` property missing in the current `UserPoolClient` class, The DefaultRedirectURI setting is essential when using Amazon Cognito Hosted UI because it specifies the primary destination where users will be redirected after successful authentication, ensuring a seamless and secure OAuth 2.0 or OpenID Connect flow. ### Description of changes Add missing property. ### Description of how you validated changes Add unit tests and integ tests. ### Checklist - [x] My code adheres to the [CONTRIBUTING GUIDE](https://github.com/aws/aws-cdk/blob/main/CONTRIBUTING.md) and [DESIGN GUIDELINES](https://github.com/aws/aws-cdk/blob/main/docs/DESIGN_GUIDELINES.md) ---- *By submitting this pull request, I confirm that my contribution is made under the terms of the Apache-2.0 license*

…30358) ### Issue # (if applicable) Closes #30353 . ### Reason for this change At the moment, L2 Construct does not support a custom auto scaling configuration for the AppRunner Service. ### Description of changes * Add `AutoScalingConfiguration` Class * Add `autoScalingConfiguration` property to the `Service` Class ### Description of how you validated changes Add unit tests and integ tests. ### Checklist - [x] My code adheres to the [CONTRIBUTING GUIDE](https://github.com/aws/aws-cdk/blob/main/CONTRIBUTING.md) and [DESIGN GUIDELINES](https://github.com/aws/aws-cdk/blob/main/docs/DESIGN_GUIDELINES.md) ---- *By submitting this pull request, I confirm that my contribution is made under the terms of the Apache-2.0 license*

… from instanceType (#30558) ### Issue # (if applicable) n/a ### Reason for this change When configuring NAT instance v2, currently we have to set machineImage manually when we want to use a graviton instance. Like this: ```ts const vpc = new Vpc(this, 'Vpc', { natGatewayProvider: NatProvider.instanceV2({ instanceType: InstanceType.of(InstanceClass.T4G, InstanceSize.NANO), // we should be able to omit this line! machineImage: MachineImage.latestAmazonLinux2023({ cpuType: AmazonLinuxCpuType.ARM_64 }), }), }); ``` This can be easily avoided if Nat instance v2 construct decides which cpu type to use for the given instance type. ### Description of changes Use `instanceType.architecture` to choose cpu type of a machine image. Now we can remove the redundant code: ```ts const vpc = new Vpc(this, 'Vpc', { natGatewayProvider: NatProvider.instanceV2({ instanceType: InstanceType.of(InstanceClass.T4G, InstanceSize.NANO), }), }); ``` ### Description of how you validated changes Added an integ test. ### Checklist - [X] My code adheres to the [CONTRIBUTING GUIDE](https://github.com/aws/aws-cdk/blob/main/CONTRIBUTING.md) and [DESIGN GUIDELINES](https://github.com/aws/aws-cdk/blob/main/docs/DESIGN_GUIDELINES.md) ---- *By submitting this pull request, I confirm that my contribution is made under the terms of the Apache-2.0 license*

…pes (#30495) ### Issue # (if applicable) Closes #29385. ### Reason for this change To use Step Functions state machine enrichment for eventbrige pipes ### Description of changes Add `StepFunctionsEnrichment` class. ### Description of how you validated changes Add unit test and integ tests. ### Checklist - [x] My code adheres to the [CONTRIBUTING GUIDE](https://github.com/aws/aws-cdk/blob/main/CONTRIBUTING.md) and [DESIGN GUIDELINES](https://github.com/aws/aws-cdk/blob/main/docs/DESIGN_GUIDELINES.md) ---- *By submitting this pull request, I confirm that my contribution is made under the terms of the Apache-2.0 license*

…time with imported `delegatedZone` (#30440)" (#30606) This reverts commit a3d9b10. ### Issue # (if applicable) Closes #30600. ### Reason for this change Reverting #30440 so that `cdk synth` succeed when using imported `delegatedZone` ### Description of changes Removed the `throw new Error()` ### Description of how you validated changes ### Checklist - [x] My code adheres to the [CONTRIBUTING GUIDE](https://github.com/aws/aws-cdk/blob/main/CONTRIBUTING.md) and [DESIGN GUIDELINES](https://github.com/aws/aws-cdk/blob/main/docs/DESIGN_GUIDELINES.md) ---- *By submitting this pull request, I confirm that my contribution is made under the terms of the Apache-2.0 license*

…ty (#30614) ### Issue # (if applicable) Closes #30613. ### Reason for this change Documentation for `KubernetesVersion.V1_30` property incorrectly refers to `KubectlV29Layer`. ### Description of changes Corrected documentation for KubernetesVersion.V1_30 property to refer to `KubectlV30Layer`. ### Description of how you validated changes N/A ### Checklist - [x] My code adheres to the [CONTRIBUTING GUIDE](https://github.com/aws/aws-cdk/blob/main/CONTRIBUTING.md) and [DESIGN GUIDELINES](https://github.com/aws/aws-cdk/blob/main/docs/DESIGN_GUIDELINES.md) ---- *By submitting this pull request, I confirm that my contribution is made under the terms of the Apache-2.0 license*

…moved from roadmap (#30572) ### Issue # (if applicable) Closes #<issue number here>. ### Reason for this change ### Description of changes ### Description of how you validated changes ### Checklist - [x] My code adheres to the [CONTRIBUTING GUIDE](https://github.com/aws/aws-cdk/blob/main/CONTRIBUTING.md) and [DESIGN GUIDELINES](https://github.com/aws/aws-cdk/blob/main/docs/DESIGN_GUIDELINES.md) ---- *By submitting this pull request, I confirm that my contribution is made under the terms of the Apache-2.0 license*

… system (#30343) ### Issue # (if applicable) Closes #30340. ### Reason for this change Current LustreFileSystem class does not support automatic backups. ### Description of changes Add properties equivalent to those of the L1 construct to the L2 construct. * [automaticBackupRetentionDays](https://docs.aws.amazon.com/cdk/api/v2/docs/aws-cdk-lib.aws%5C_fsx.CfnFileSystem.LustreConfigurationProperty.html#automaticbackupretentiondays) * [copyTagsToBackups](https://docs.aws.amazon.com/cdk/api/v2/docs/aws-cdk-lib.aws%5C_fsx.CfnFileSystem.LustreConfigurationProperty.html#copytagstobackups) * [dailyAutomaticBackupStartTime](https://docs.aws.amazon.com/cdk/api/v2/docs/aws-cdk-lib.aws%5C_fsx.CfnFileSystem.LustreConfigurationProperty.html#dailyautomaticbackupstarttime) Segregated the `dailyAutomaticBackupStartTime` as a class to enable its usage in another file system's L2 construct (for example, Ontap) in the future. ### Description of how you validated changes Add unit tests and integ tests. ### Checklist - [x] My code adheres to the [CONTRIBUTING GUIDE](https://github.com/aws/aws-cdk/blob/main/CONTRIBUTING.md) and [DESIGN GUIDELINES](https://github.com/aws/aws-cdk/blob/main/docs/DESIGN_GUIDELINES.md) ---- *By submitting this pull request, I confirm that my contribution is made under the terms of the Apache-2.0 license*

Updates the L1 CloudFormation resource definitions with the latest changes from `@aws-cdk/aws-service-spec` **L1 CloudFormation resource definition changes:** ``` ├[+] service aws-apptest │ ├ capitalized: AppTest │ │ cloudFormationNamespace: AWS::AppTest │ │ name: aws-apptest │ │ shortName: apptest │ └ resources │ └resource AWS::AppTest::TestCase │ ├ name: TestCase │ │ cloudFormationType: AWS::AppTest::TestCase │ │ documentation: Represents a Test Case that can be captured and executed │ │ tagInformation: {"tagPropertyName":"Tags","variant":"map"} │ ├ properties │ │ ├Description: string │ │ ├Name: string (required, immutable) │ │ ├Steps: Array<Step> (required) │ │ └Tags: Map<string, string> │ ├ attributes │ │ ├CreationTime: string │ │ ├LastUpdateTime: string │ │ ├LatestVersion: TestCaseLatestVersion │ │ ├Status: string │ │ ├TestCaseArn: string │ │ ├TestCaseId: string │ │ └TestCaseVersion: number │ └ types │ ├type TestCaseLatestVersion │ │├ name: TestCaseLatestVersion │ │└ properties │ │ ├Version: number (required) │ │ └Status: string (required) │ ├type Step │ │├ name: Step │ │└ properties │ │ ├Name: string (required) │ │ ├Description: string │ │ └Action: StepAction (required) │ ├type StepAction │ │├ name: StepAction │ │└ properties │ │ ├ResourceAction: ResourceAction │ │ ├MainframeAction: MainframeAction │ │ └CompareAction: CompareAction │ ├type ResourceAction │ │├ name: ResourceAction │ │└ properties │ │ ├M2ManagedApplicationAction: M2ManagedApplicationAction │ │ ├M2NonManagedApplicationAction: M2NonManagedApplicationAction │ │ └CloudFormationAction: CloudFormationAction │ ├type M2ManagedApplicationAction │ │├ name: M2ManagedApplicationAction │ │└ properties │ │ ├Resource: string (required) │ │ ├ActionType: string (required) │ │ └Properties: M2ManagedActionProperties │ ├type M2ManagedActionProperties │ │├ name: M2ManagedActionProperties │ │└ properties │ │ ├ForceStop: boolean │ │ └ImportDataSetLocation: string │ ├type M2NonManagedApplicationAction │ │├ name: M2NonManagedApplicationAction │ │└ properties │ │ ├Resource: string (required) │ │ └ActionType: string (required) │ ├type CloudFormationAction │ │├ name: CloudFormationAction │ │└ properties │ │ ├Resource: string (required) │ │ └ActionType: string │ ├type MainframeAction │ │├ name: MainframeAction │ │└ properties │ │ ├Resource: string (required) │ │ ├ActionType: MainframeActionType (required) │ │ └Properties: MainframeActionProperties │ ├type MainframeActionType │ │├ name: MainframeActionType │ │└ properties │ │ ├Batch: Batch │ │ └Tn3270: TN3270 │ ├type Batch │ │├ name: Batch │ │└ properties │ │ ├BatchJobName: string (required) │ │ ├BatchJobParameters: Map<string, string> │ │ └ExportDataSetNames: Array<string> │ ├type TN3270 │ │├ name: TN3270 │ │└ properties │ │ ├Script: Script (required) │ │ └ExportDataSetNames: Array<string> │ ├type Script │ │├ name: Script │ │└ properties │ │ ├ScriptLocation: string (required) │ │ └Type: string (required) │ ├type MainframeActionProperties │ │├ name: MainframeActionProperties │ │└ properties │ │ └DmsTaskArn: string │ ├type CompareAction │ │├ name: CompareAction │ │└ properties │ │ ├Input: Input (required) │ │ └Output: Output │ ├type Input │ │├ name: Input │ │└ properties │ │ └File: InputFile (required) │ ├type InputFile │ │├ name: InputFile │ │└ properties │ │ ├SourceLocation: string (required) │ │ ├TargetLocation: string (required) │ │ └FileMetadata: FileMetadata (required) │ ├type FileMetadata │ │├ name: FileMetadata │ │└ properties │ │ ├DataSets: Array<DataSet> │ │ └DatabaseCDC: DatabaseCDC │ ├type DataSet │ │├ name: DataSet │ │└ properties │ │ ├Type: string (required) │ │ ├Name: string (required) │ │ ├Ccsid: string (required) │ │ ├Format: string (required) │ │ └Length: number (required) │ ├type DatabaseCDC │ │├ name: DatabaseCDC │ │└ properties │ │ ├SourceMetadata: SourceDatabaseMetadata (required) │ │ └TargetMetadata: TargetDatabaseMetadata (required) │ ├type SourceDatabaseMetadata │ │├ name: SourceDatabaseMetadata │ │└ properties │ │ ├Type: string (required) │ │ └CaptureTool: string (required) │ ├type TargetDatabaseMetadata │ │├ name: TargetDatabaseMetadata │ │└ properties │ │ ├Type: string (required) │ │ └CaptureTool: string (required) │ ├type Output │ │├ name: Output │ │└ properties │ │ └File: OutputFile (required) │ └type OutputFile │ ├ name: OutputFile │ └ properties │ └FileLocation: string ├[~] service aws-batch │ └ resources │ └[~] resource AWS::Batch::JobDefinition │ └ types │ └[~] type NodeRangeProperty │ └ properties │ └[-] EksProperties: EksProperties ├[~] service aws-kinesisfirehose │ └ resources │ └[~] resource AWS::KinesisFirehose::DeliveryStream │ └ types │ ├[~] type HttpEndpointDestinationConfiguration │ │ └ properties │ │ └[+] SecretsManagerConfiguration: SecretsManagerConfiguration │ ├[~] type RedshiftDestinationConfiguration │ │ └ properties │ │ ├ Password: - string (required) │ │ │ + string │ │ ├[+] SecretsManagerConfiguration: SecretsManagerConfiguration │ │ └ Username: - string (required) │ │ + string │ ├[+] type SecretsManagerConfiguration │ │ ├ name: SecretsManagerConfiguration │ │ └ properties │ │ ├Enabled: boolean (required) │ │ ├RoleARN: string │ │ └SecretARN: string │ ├[~] type SnowflakeDestinationConfiguration │ │ └ properties │ │ ├ PrivateKey: - string (required) │ │ │ + string │ │ ├[+] SecretsManagerConfiguration: SecretsManagerConfiguration │ │ └ User: - string (required) │ │ + string │ └[~] type SplunkDestinationConfiguration │ └ properties │ ├ HECToken: - string (required) │ │ + string │ └[+] SecretsManagerConfiguration: SecretsManagerConfiguration └[~] service aws-mediapackagev2 └ resources ├[~] resource AWS::MediaPackageV2::Channel │ └ attributes │ └[+] IngestEndpointUrls: Array<string> └[~] resource AWS::MediaPackageV2::OriginEndpoint └ attributes ├[+] DashManifestUrls: Array<string> ├[+] HlsManifestUrls: Array<string> └[+] LowLatencyHlsManifestUrls: Array<string> ```

…PI call (#30061) ### Issue # (if applicable) Closes #29918. ### Reason for this change It would be useful if we could call AWS API across regions from a Step Functions state machine. Currently it is not officially supported even with AWS SDK integration tasks. Our usecase is to automate a cross-region failover scenario in a multi-region application. This requires you to orchestrate multiple API calls for both active and standby regions (e.g. failover Aurora DB cluster, rewrite AppConfig parameter, etc), and it would be great if we can manage these operations in a single state machine. ### Description of changes This PR adds a new construct `CallAwsServiceCrossRegion` that deploys 1. a Lambda function to call AWS API in different regions 2. SFn task to call the function. Because most properties are compatible with the existing `CallAwsService` construct, you can use the new construct by just adding the `region` property. Additionally, it also allows to set `endpoint` to override AWS API endpoint, because some AWS APIs requires you to override it. (e.g. [Route53 ARC](https://docs.aws.amazon.com/r53recovery/latest/dg/getting-started-cli-routing.control-state.html)) ### Description of how you validated changes Added unit tests and integ tests. ### Checklist - [X] My code adheres to the [CONTRIBUTING GUIDE](https://github.com/aws/aws-cdk/blob/main/CONTRIBUTING.md) and [DESIGN GUIDELINES](https://github.com/aws/aws-cdk/blob/main/docs/DESIGN_GUIDELINES.md) ---- *By submitting this pull request, I confirm that my contribution is made under the terms of the Apache-2.0 license*

Add Anthropic's Claude 3.5 Sonnet model. Ref * https://aws.amazon.com/about-aws/whats-new/2024/06/anthropic-claude-3-5-sonnet-model-bedrock/ * https://docs.aws.amazon.com/bedrock/latest/userguide/model-ids.html ### Checklist - [x] My code adheres to the [CONTRIBUTING GUIDE](https://github.com/aws/aws-cdk/blob/main/CONTRIBUTING.md) and [DESIGN GUIDELINES](https://github.com/aws/aws-cdk/blob/main/docs/DESIGN_GUIDELINES.md) ---- *By submitting this pull request, I confirm that my contribution is made under the terms of the Apache-2.0 license*

…#30359) ### Issue # (if applicable) Closes #22985 . ### Reason for this change At the moment, L2 Construct does not support a tracing setting for the AppRunner Service. ### Description of changes * Add `ObservabilityConfiguration` Class * Add `observabilityConfiguration` property to the `Service` Class ### Description of how you validated changes Add unit tests and integ tests. ### Checklist - [x] My code adheres to the [CONTRIBUTING GUIDE](https://github.com/aws/aws-cdk/blob/main/CONTRIBUTING.md) and [DESIGN GUIDELINES](https://github.com/aws/aws-cdk/blob/main/docs/DESIGN_GUIDELINES.md) ---- *By submitting this pull request, I confirm that my contribution is made under the terms of the Apache-2.0 license*

…bled` is broken (#30624) ### Issue # (if applicable) None ### Reason for this change The documentation link of `crossZoneEnabled` is broken due to unnecessary hyphen. https://docs.aws.amazon.com/cdk/api/v2/docs/aws-cdk-lib.aws_elasticloadbalancingv2.NetworkLoadBalancer.html#crosszoneenabled <img width="732" alt="スクリーンショット 2024-06-23 0 33 20" src="https://github.com/aws/aws-cdk/assets/64848616/5096bf05-4e6e-4e72-a882-1e8d1a817ff5"> ### Description of changes Removed unnecessary hyphen. ### Description of how you validated changes None ### Checklist - [x] My code adheres to the [CONTRIBUTING GUIDE](https://github.com/aws/aws-cdk/blob/main/CONTRIBUTING.md) and [DESIGN GUIDELINES](https://github.com/aws/aws-cdk/blob/main/docs/DESIGN_GUIDELINES.md) ---- *By submitting this pull request, I confirm that my contribution is made under the terms of the Apache-2.0 license*

Add new minor version. Ref: https://aws.amazon.com/about-aws/whats-new/2024/06/amazon-rds-mysql-new-minor-version-8-0-37/ ### Checklist - [x] My code adheres to the [CONTRIBUTING GUIDE](https://github.com/aws/aws-cdk/blob/main/CONTRIBUTING.md) and [DESIGN GUIDELINES](https://github.com/aws/aws-cdk/blob/main/docs/DESIGN_GUIDELINES.md) ---- *By submitting this pull request, I confirm that my contribution is made under the terms of the Apache-2.0 license*

…ture flag) (#30389) Closes #30368. Doc: https://docs.aws.amazon.com/AmazonECS/latest/developerguide/security_iam_id-based-policy-examples.html#IAM_run_policies

…aged Termination Protection is disable (#30335) Let AsgCapacityProvider use IAutoScalingGroup only when Managed Termination Protection is disable. The code will throw an exception with a clear message when the user specify a self managed ASG using `AutoScalingGroup.fromAutoScalingGroupName` and let the Managed Termination Protection enabled. It will also throw a clear exception when calling `Cluster.addAsgCapacityProvider` with an `AsgCapacityProvider` created with an imported ASG. ### Issue # (if applicable) Closes #29174. ### Reason for this change As there is no clear fix to the original issue, this change's purpose it to bring clarity to the users about what is not allowed when using the L2 Constructs `AsgCapacityProvider` and `Cluster` with an imported ASG. ### Description of changes This change will replace non explicit exception, caused by missing methods, by clear error messages. ### Description of how you validated changes Added unit tests. ### Checklist - [x] My code adheres to the [CONTRIBUTING GUIDE](https://github.com/aws/aws-cdk/blob/main/CONTRIBUTING.md) and [DESIGN GUIDELINES](https://github.com/aws/aws-cdk/blob/main/docs/DESIGN_GUIDELINES.md) ---- *By submitting this pull request, I confirm that my contribution is made under the terms of the Apache-2.0 license*

Removed unnecessary hyphens before links in the @see section of the document. Unnecessary hyphens are breaking the links in the document. Same as #30624. Ref: https://docs.aws.amazon.com/cdk/api/v2/docs/aws-cdk-lib.aws_ecs.BaseServiceProps.html#launchtype https://docs.aws.amazon.com/cdk/api/v2/docs/aws-cdk-lib.aws_eks.NodegroupOptions.html#instancetypes https://docs.aws.amazon.com/cdk/api/v2/docs/aws-cdk-lib.aws_eks.NodegroupOptions.html#launchtemplatespec ### Checklist - [x] My code adheres to the [CONTRIBUTING GUIDE](https://github.com/aws/aws-cdk/blob/main/CONTRIBUTING.md) and [DESIGN GUIDELINES](https://github.com/aws/aws-cdk/blob/main/docs/DESIGN_GUIDELINES.md) ---- *By submitting this pull request, I confirm that my contribution is made under the terms of the Apache-2.0 license*

…d due to lack of a permission (#30630) ### Issue # (if applicable) Closes #26640 ### Reason for this change According to the [docs](https://docs.aws.amazon.com/apprunner/latest/dg/security_iam_service-with-iam.html#security_iam_service-with-iam-roles), required permissions for an App Runner's AccessRole to access images in ECR repository are the followings: 1. "ecr:GetDownloadUrlForLayer", 2. "ecr:BatchCheckLayerAvailability", 3. "ecr:BatchGetImage", 4. "ecr:DescribeImages", 5. "ecr:GetAuthorizationToken" No.1~3 are granted by the [grantPull](https://github.com/aws/aws-cdk/blob/main/packages/aws-cdk-lib/aws-ecr/lib/repository.ts#L385) method of `ecr.Repository`. https://github.com/aws/aws-cdk/blob/main/packages/%40aws-cdk/aws-apprunner-alpha/lib/service.ts#L1303 Permission for No.5 is granted by the following. **Note** : It is correct that the resources here is set to `*`(Ref: [docs](https://docs.aws.amazon.com/apprunner/latest/dg/security_iam_service-with-iam.html#security_iam_service-with-iam-roles)) > If you create your own custom policy for your access role, be sure to specify "Resource": "*" for the ecr:GetAuthorizationToken action. Tokens can be used to access any Amazon ECR registry that you have access to. https://github.com/aws/aws-cdk/blob/main/packages/%40aws-cdk/aws-apprunner-alpha/lib/service.ts#L1368 At the moment, No.4 permission is missing. So we need to add. ### Description of changes Add a `ecr:DescribeImages` permisison to the AccessRole. ### Description of how you validated changes Update a unit test and a integ test. ### Checklist - [x] My code adheres to the [CONTRIBUTING GUIDE](https://github.com/aws/aws-cdk/blob/main/CONTRIBUTING.md) and [DESIGN GUIDELINES](https://github.com/aws/aws-cdk/blob/main/docs/DESIGN_GUIDELINES.md) ---- *By submitting this pull request, I confirm that my contribution is made under the terms of the Apache-2.0 license*

Ran npm-check-updates and yarn upgrade to keep the `yarn.lock` file up-to-date.

We were seeing build failures (most likely) caused by nx version mismatches. This PR aligns those versions. ### Checklist - [ ] My code adheres to the [CONTRIBUTING GUIDE](https://github.com/aws/aws-cdk/blob/main/CONTRIBUTING.md) and [DESIGN GUIDELINES](https://github.com/aws/aws-cdk/blob/main/docs/DESIGN_GUIDELINES.md) ---- *By submitting this pull request, I confirm that my contribution is made under the terms of the Apache-2.0 license*

…M_3 (#30670) ### Description of changes Fixed typo in the comment at CodeBuildImage.AMAZON_LINUX_2_ARM_3. ### Checklist - [x] My code adheres to the [CONTRIBUTING GUIDE](https://github.com/aws/aws-cdk/blob/main/CONTRIBUTING.md) and [DESIGN GUIDELINES](https://github.com/aws/aws-cdk/blob/main/docs/DESIGN_GUIDELINES.md) ---- *By submitting this pull request, I confirm that my contribution is made under the terms of the Apache-2.0 license*

See [CHANGELOG](https://github.com/aws/aws-cdk/blob/merge-back/2.147.1/CHANGELOG.md)

Ran npm-check-updates and yarn upgrade to keep the `yarn.lock` file up-to-date.

See [CHANGELOG](https://github.com/aws/aws-cdk/blob/merge-back/2.147.3/CHANGELOG.md)

See [CHANGELOG](https://github.com/aws/aws-cdk/blob/merge-back/2.147.2/CHANGELOG.md)

…test function version (#29856) ### Issue # (if applicable) Closes #20177 ### Reason for this change `fn.grantInvoke()` will grant invoke permission to invoke both the latest version and all pervious version of the lambda function. We can see this behavior could bring some security concern for some of our customers. ### Description of changes We provides a new function `fn.grantInvokeLatestVersion()` to grant invoke only to the Latest version of function and the unqualified lambda arn Example: ```ts // Grant permissions to a service declare const fn: lambda.Function; const principal = new iam.ServicePrincipal('my-service'); fn.grantInvokeLatestVersion(principal); ``` ### Description of how you validated changes Added unit tests and integration tests. When using `fn.grantInvokeLatestVersion()` granted principle to invoke a function's past version, it will get the following error: ``` An error occurred (AccessDeniedException) when calling the Invoke operation: User: {$principle} is not authorized to perform: lambda:InvokeFunction on resource: {$LambdaArn:$version} because no identity-based policy allows the lambda:InvokeFunction action ``` ### Alternative design (to discuss) setup a `grantInvokeProp` including `grantVersionAccess` flag to pass in the `grantInvokeLatestVersion` instead using `grantVersionAccess` flag directly on `grantInvokeLatestVersion` -> This is discussed in the comments, I agree having props will have future extensibility but usually for grant methods specifically we haven't seen before. So we will not add prop to the new function `grantInvokeLatestVersion` ### Checklist - [x] My code adheres to the [CONTRIBUTING GUIDE](https://github.com/aws/aws-cdk/blob/main/CONTRIBUTING.md) and [DESIGN GUIDELINES](https://github.com/aws/aws-cdk/blob/main/docs/DESIGN_GUIDELINES.md) ---- *By submitting this pull request, I confirm that my contribution is made under the terms of the Apache-2.0 license*

…ations (under feature flag) (#30706) ### Issue # (if applicable) Closes #28915 ### Reason for this change Fix to address the issues deleting the existing S3 event notifications and adding new event notifications on top of existing notifications. ### Description of changes We fixed the hashing logic used to identify old vs external S3 event notifications ### Description of how you validated changes Manually tested, integration and unit tested the changes yes ### Checklist - [x] My code adheres to the [CONTRIBUTING GUIDE](https://github.com/aws/aws-cdk/blob/main/CONTRIBUTING.md) and [DESIGN GUIDELINES](https://github.com/aws/aws-cdk/blob/main/docs/DESIGN_GUIDELINES.md) ---- *By submitting this pull request, I confirm that my contribution is made under the terms of the Apache-2.0 license*

Ran npm-check-updates and yarn upgrade to keep the `yarn.lock` file up-to-date.

This was causing integ test failures because 1.22 is no longer supported. ### Checklist - [ ] My code adheres to the [CONTRIBUTING GUIDE](https://github.com/aws/aws-cdk/blob/main/CONTRIBUTING.md) and [DESIGN GUIDELINES](https://github.com/aws/aws-cdk/blob/main/docs/DESIGN_GUIDELINES.md) ---- *By submitting this pull request, I confirm that my contribution is made under the terms of the Apache-2.0 license*

This test was failing due to the solution stack version not being supported any longer. ### Issue # (if applicable) Closes #<issue number here>. ### Reason for this change ### Description of changes ### Description of how you validated changes ### Checklist - [ ] My code adheres to the [CONTRIBUTING GUIDE](https://github.com/aws/aws-cdk/blob/main/CONTRIBUTING.md) and [DESIGN GUIDELINES](https://github.com/aws/aws-cdk/blob/main/docs/DESIGN_GUIDELINES.md) ---- *By submitting this pull request, I confirm that my contribution is made under the terms of the Apache-2.0 license*

Note that the docstring in `aws-entities` states that the regions are added in the order they went live. For several, that was not accurate so I reordered them. This is unlikely to matter but I made the change so that the documentation there would be factually correct. Not all of these regions/partitions are live yet, but they have been announced [here](https://aws.amazon.com/blogs/aws/category/regions/) ### Checklist - [ ] My code adheres to the [CONTRIBUTING GUIDE](https://github.com/aws/aws-cdk/blob/main/CONTRIBUTING.md) and [DESIGN GUIDELINES](https://github.com/aws/aws-cdk/blob/main/docs/DESIGN_GUIDELINES.md) ---- *By submitting this pull request, I confirm that my contribution is made under the terms of the Apache-2.0 license*

aws-cdk-automation · 2024-07-05T19:32:22Z

AWS CodeBuild CI Report

CodeBuild project: AutoBuildv2Project1C6BFA3F-wQm2hXv2jqQv
Commit ID: a923a59
Result: SUCCEEDED
Build Logs (available for 30 days)

Powered by github-codebuild-logs, available on the AWS Serverless Application Repository

mergify · 2024-07-05T19:32:40Z

Thank you for contributing! Your pull request will be automatically updated and merged without squashing (do not update manually, and be sure to allow changes to be pushed to your fork).

aws-cdk-automation · 2024-07-05T19:32:43Z

➡️ PR build request submitted to test-main-pipeline ⬅️

A maintainer must now check the pipeline and add the pr-linter/cli-integ-tested label once the pipeline succeeds.

aws-cdk-automation · 2024-07-25T17:43:13Z

Comments on closed issues and PRs are hard for our team to see. If you need help, please open a new issue that references this one.

mergify bot and others added 30 commits June 20, 2024 22:35

chore(merge-back): 2.147.0 (#30605)

5588694

See [CHANGELOG](https://github.com/aws/aws-cdk/blob/merge-back/2.147.0/CHANGELOG.md)

Merge branch 'main' into merge-back/2.147.1

1491eb5

fix(stepfunctions-tasks): run task permission is too broad (under fea…

8ebfade

…ture flag) (#30389) Closes #30368. Doc: https://docs.aws.amazon.com/AmazonECS/latest/developerguide/security_iam_id-based-policy-examples.html#IAM_run_policies

Merge branch 'main' into merge-back/2.147.1

2d9b8c9

chore: npm-check-updates && yarn upgrade (#30589)

d75c0b1

Ran npm-check-updates and yarn upgrade to keep the `yarn.lock` file up-to-date.

Merge branch 'main' into merge-back/2.147.1

de41d89

Merge branch 'main' into merge-back/2.147.1

afc4a0f

chore(merge-back): 2.147.1 (#30651)

07cb5b0

See [CHANGELOG](https://github.com/aws/aws-cdk/blob/merge-back/2.147.1/CHANGELOG.md)

chore: npm-check-updates && yarn upgrade (#30678)

eaa8f3e

Ran npm-check-updates and yarn upgrade to keep the `yarn.lock` file up-to-date.

mergify bot and others added 11 commits July 2, 2024 01:27

Merge branch 'main' into merge-back/2.147.3

8947451

chore(merge-back): 2.147.3 (#30730)

84fc01f

See [CHANGELOG](https://github.com/aws/aws-cdk/blob/merge-back/2.147.3/CHANGELOG.md)

Merge branch 'main' into merge-back/2.147.2

22165da

chore(merge-back): 2.147.2 (#30707)

e525de3

See [CHANGELOG](https://github.com/aws/aws-cdk/blob/merge-back/2.147.2/CHANGELOG.md)

chore: npm-check-updates && yarn upgrade (#30744)

b7f626b

Ran npm-check-updates and yarn upgrade to keep the `yarn.lock` file up-to-date.

chore(release): 2.148.0

64dd445

aws-cdk-automation added auto-approve pr/no-squash This PR should be merged instead of squash-merging it labels Jul 5, 2024

aws-cdk-automation requested a review from a team July 5, 2024 18:53

github-actions bot added the p2 label Jul 5, 2024

github-actions bot approved these changes Jul 5, 2024

View reviewed changes

aws-cdk-automation had a problem deploying to test-pipeline July 5, 2024 18:54 — with GitHub Actions Failure

GavinZZ had a problem deploying to test-pipeline July 5, 2024 18:56 — with GitHub Actions Failure

chore: update CHANGELOG.v2.md

a923a59

GavinZZ force-pushed the bump/2.148.0 branch from a842618 to a923a59 Compare July 5, 2024 19:02

GavinZZ temporarily deployed to test-pipeline July 5, 2024 19:03 — with GitHub Actions Inactive

mergify bot merged commit e5740c0 into v2-release Jul 5, 2024
12 checks passed

mergify bot deleted the bump/2.148.0 branch July 5, 2024 19:32

github-actions bot mentioned this pull request Jul 8, 2024

Weekly PR metrics report #30783

Closed

aws locked as resolved and limited conversation to collaborators Jul 25, 2024

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

chore(release): 2.148.0 #30764

chore(release): 2.148.0 #30764

aws-cdk-automation commented Jul 5, 2024 •

edited

Loading

aws-cdk-automation commented Jul 5, 2024

mergify bot commented Jul 5, 2024

aws-cdk-automation commented Jul 5, 2024

aws-cdk-automation commented Jul 25, 2024

chore(release): 2.148.0 #30764

chore(release): 2.148.0 #30764

Conversation

aws-cdk-automation commented Jul 5, 2024 • edited Loading

aws-cdk-automation commented Jul 5, 2024

AWS CodeBuild CI Report

mergify bot commented Jul 5, 2024

aws-cdk-automation commented Jul 5, 2024

aws-cdk-automation commented Jul 25, 2024

aws-cdk-automation commented Jul 5, 2024 •

edited

Loading