diff --git a/packages/aws-cdk/lib/api/aws-auth/_env.ts b/packages/aws-cdk/lib/api/aws-auth/_env.ts
deleted file mode 100644
index a5df37a182412..0000000000000
--- a/packages/aws-cdk/lib/api/aws-auth/_env.ts
+++ /dev/null
@@ -1,17 +0,0 @@
-/**
- * This file exists to expose and centralize some features that the files in this module expect from the surrounding
- * CLI.
- *
- * The calls will be forwarded to whatever logging system is the "official" logging system for this CLI.
- *
- * Centralizing in this way makes it easy to copy/paste this directory out and have a single place to
- * break dependencies and replace these functions.
- */
-
-export { debug, warning, trace } from '../../logging';
-
-import { cdkCacheDir } from '../../util/directories';
-
-export function accountCacheDir() {
-  return cdkCacheDir();
-}
\ No newline at end of file
diff --git a/packages/aws-cdk/lib/api/aws-auth/account-cache.ts b/packages/aws-cdk/lib/api/aws-auth/account-cache.ts
index ec90ce48ec4d5..543dbf15d1188 100644
--- a/packages/aws-cdk/lib/api/aws-auth/account-cache.ts
+++ b/packages/aws-cdk/lib/api/aws-auth/account-cache.ts
@@ -1,7 +1,8 @@
 import * as path from 'path';
 import * as fs from 'fs-extra';
-import { accountCacheDir, debug } from './_env';
 import { Account } from './sdk-provider';
+import { debug } from '../../logging';
+import { cdkCacheDir } from '../../util/directories';
 
 /**
  * Disk cache which maps access key IDs to account IDs.
@@ -21,7 +22,7 @@ export class AccountAccessKeyCache {
    * @param filePath Path to the cache file
    */
   constructor(filePath?: string) {
-    this.cacheFile = filePath || path.join(accountCacheDir(), 'accounts_partitions.json');
+    this.cacheFile = filePath || path.join(cdkCacheDir(), 'accounts_partitions.json');
   }
 
   /**
@@ -67,7 +68,7 @@ export class AccountAccessKeyCache {
 
     // nuke cache if it's too big.
     if (Object.keys(map).length >= AccountAccessKeyCache.MAX_ENTRIES) {
-      map = { };
+      map = {};
     }
 
     map[accessKeyId] = account;
@@ -80,10 +81,14 @@ export class AccountAccessKeyCache {
     } catch (e: any) {
       // File doesn't exist or is not readable. This is a cache,
       // pretend we successfully loaded an empty map.
-      if (e.code === 'ENOENT' || e.code === 'EACCES') { return {}; }
+      if (e.name === 'ENOENT' || e.name === 'EACCES') {
+        return {};
+      }
       // File is not JSON, could be corrupted because of concurrent writes.
       // Again, an empty cache is fine.
-      if (e instanceof SyntaxError) { return {}; }
+      if (e instanceof SyntaxError) {
+        return {};
+      }
       throw e;
     }
   }
@@ -95,7 +100,9 @@ export class AccountAccessKeyCache {
     } catch (e: any) {
       // File doesn't exist or file/dir isn't writable. This is a cache,
       // if we can't write it then too bad.
-      if (e.code === 'ENOENT' || e.code === 'EACCES' || e.code === 'EROFS') { return; }
+      if (e.name === 'ENOENT' || e.name === 'EACCES' || e.name === 'EROFS') {
+        return;
+      }
       throw e;
     }
   }
diff --git a/packages/aws-cdk/lib/api/aws-auth/aws-sdk-inifile.ts b/packages/aws-cdk/lib/api/aws-auth/aws-sdk-inifile.ts
deleted file mode 100644
index 7ff3a840a6cbc..0000000000000
--- a/packages/aws-cdk/lib/api/aws-auth/aws-sdk-inifile.ts
+++ /dev/null
@@ -1,175 +0,0 @@
-import * as AWS from 'aws-sdk';
-
-/**
- * Hack-fix
- *
- * There are a number of issues in the upstream version of SharedIniFileCredentials
- * that need fixing:
- *
- * 1. The upstream aws-sdk does not support the 'credential_source' option. Meaning credentials
- *    for assume-role cannot be fetched using EC2/ESC metadata.
- *
- * 2. The upstream aws-sdk does not support SSO profiles as the source of RoleProfiles,
- *    because it will always use the `SharedIniFileCredentials` provider to load
- *    source credentials, but in order to support SSO profiles you must use a
- *    separate class (`SsoCredentials).
- */
-export class PatchedSharedIniFileCredentials extends AWS.SharedIniFileCredentials {
-  declare private profile: string;
-  declare private filename: string;
-  declare private disableAssumeRole: boolean;
-  declare private options: Record<string, string>;
-  declare private roleArn: string;
-  declare private httpOptions?: AWS.HTTPOptions;
-  declare private tokenCodeFn?: (mfaSerial: string, callback: (err?: Error, token?: string) => void) => void;
-
-  public loadRoleProfile(
-    creds: Record<string, Record<string, string>>,
-    roleProfile: Record<string, string>,
-    callback: (err?: Error, data?: any) => void) {
-
-    // Need to duplicate the whole implementation here -- the function is long and has been written in
-    // such a way that there are no small monkey patches possible.
-
-    if (this.disableAssumeRole) {
-      throw (AWS as any).util.error(
-        new Error('Role assumption profiles are disabled. ' +
-                  'Failed to load profile ' + this.profile +
-                  ' from ' + creds.filename),
-        { code: 'SharedIniFileCredentialsProviderFailure' },
-      );
-    }
-
-    var self = this;
-    var roleArn = roleProfile.role_arn;
-    var roleSessionName = roleProfile.role_session_name;
-    var externalId = roleProfile.external_id;
-    var mfaSerial = roleProfile.mfa_serial;
-    var sourceProfile = roleProfile.source_profile;
-    var credentialSource = roleProfile.credential_source;
-
-    if (!!sourceProfile === !!credentialSource) {
-      throw (AWS as any).util.error(
-        new Error(`When using 'role_arn' in profile ('${this.profile}'), you must also configure exactly one of 'source_profile' or 'credential_source'`),
-        { code: 'SharedIniFileCredentialsProviderFailure' },
-      );
-    }
-
-    // Confirmed this against AWS CLI behavior -- the region must be in the assumED profile,
-    // otherwise `us-east-1`. From the upstream comment in `aws-sdk-js`:
-    // -------- comment from aws-sdk-js -------------------
-    // Experimentation shows that the AWS CLI (tested at version 1.18.136)
-    // ignores the following potential sources of a region for the purposes of
-    // this AssumeRole call:
-    //
-    // - The [default] profile
-    // - The AWS_REGION environment variable
-    //
-    // Ignoring the [default] profile for the purposes of AssumeRole is arguably
-    // a bug in the CLI since it does use the [default] region for service
-    // calls... but right now we're matching behavior of the other tool.
-    // -------------------------------------------------
-
-    const region = roleProfile?.region ?? 'us-east-1';
-
-    const stsCreds = sourceProfile ? this.sourceProfileCredentials(sourceProfile, creds) : this.credentialSourceCredentials(credentialSource);
-
-    this.roleArn = roleArn;
-    var sts = new AWS.STS({
-      credentials: stsCreds,
-      region,
-      httpOptions: this.httpOptions,
-    });
-
-    var roleParams: AWS.STS.AssumeRoleRequest = {
-      RoleArn: roleArn,
-      RoleSessionName: roleSessionName || 'aws-sdk-js-' + Date.now(),
-    };
-
-    if (externalId) {
-      roleParams.ExternalId = externalId;
-    }
-
-    if (mfaSerial && self.tokenCodeFn) {
-      roleParams.SerialNumber = mfaSerial;
-      self.tokenCodeFn(mfaSerial, function(err, token) {
-        if (err) {
-          var message;
-          if (err instanceof Error) {
-            message = err.message;
-          } else {
-            message = err;
-          }
-          callback(
-            (AWS as any).util.error(
-              new Error('Error fetching MFA token: ' + message),
-              { code: 'SharedIniFileCredentialsProviderFailure' },
-            ));
-          return;
-        }
-
-        roleParams.TokenCode = token;
-        sts.assumeRole(roleParams, callback);
-      });
-      return;
-    }
-    sts.assumeRole(roleParams, callback);
-  }
-
-  private sourceProfileCredentials(sourceProfile: string, profiles: Record<string, Record<string, string>>) {
-    var sourceProfileExistanceTest = profiles[sourceProfile];
-
-    if (typeof sourceProfileExistanceTest !== 'object') {
-      throw (AWS as any).util.error(
-        new Error('source_profile ' + sourceProfile + ' using profile '
-          + this.profile + ' does not exist'),
-        { code: 'SharedIniFileCredentialsProviderFailure' },
-      );
-    }
-
-    // We need to do a manual check here if the source profile (providing the
-    // credentials for the AssumeRole) is an SSO profile. That's because
-    // `SharedIniFileCredentials` itself doesn't support providing credentials from
-    // arbitrary profiles, only for StaticCredentials and AssumeRole type
-    // profiles; if it's an SSO profile you need to instantiate a special
-    // Credential Provider for that.
-    //
-    // ---
-    //
-    // An SSO profile can be configured in 2 ways (put all the info in the profile
-    // section, or put half of it in an `[sso-session]` block), but in both cases
-    // the primary profile block must have the `sso_account_id` key
-    if (sourceProfileExistanceTest.sso_account_id) {
-      return new AWS.SsoCredentials({ profile: sourceProfile });
-    }
-
-    return new PatchedSharedIniFileCredentials(
-      (AWS as any).util.merge(this.options || {}, {
-        profile: sourceProfile,
-        preferStaticCredentials: true,
-      }),
-    );
-
-  }
-
-  // the aws-sdk for js does not support 'credential_source' (https://github.com/aws/aws-sdk-js/issues/1916)
-  // so unfortunately we need to implement this ourselves.
-  private credentialSourceCredentials(sourceCredential: string) {
-    // see https://docs.aws.amazon.com/credref/latest/refdocs/setting-global-credential_source.html
-    switch (sourceCredential) {
-      case 'Environment': {
-        return new AWS.EnvironmentCredentials('AWS');
-      }
-      case 'Ec2InstanceMetadata': {
-        return new AWS.EC2MetadataCredentials();
-      }
-      case 'EcsContainer': {
-        return new AWS.ECSCredentials();
-      }
-      default: {
-        throw new Error(`credential_source ${sourceCredential} in profile ${this.profile} is unsupported. choose one of [Environment, Ec2InstanceMetadata, EcsContainer]`);
-      }
-    }
-
-  }
-}
diff --git a/packages/aws-cdk/lib/api/aws-auth/awscli-compatible.ts b/packages/aws-cdk/lib/api/aws-auth/awscli-compatible.ts
index de434f2f95957..58bb2138ef9ba 100644
--- a/packages/aws-cdk/lib/api/aws-auth/awscli-compatible.ts
+++ b/packages/aws-cdk/lib/api/aws-auth/awscli-compatible.ts
@@ -1,13 +1,15 @@
-import * as child_process from 'child_process';
-import * as os from 'os';
-import * as path from 'path';
-import * as util from 'util';
-import * as AWS from 'aws-sdk';
-import * as fs from 'fs-extra';
+import { createCredentialChain, fromEnv, fromIni, fromNodeProviderChain } from '@aws-sdk/credential-providers';
+import { MetadataService } from '@aws-sdk/ec2-metadata-service';
+import type { NodeHttpHandlerOptions } from '@smithy/node-http-handler';
+import { loadSharedConfigFiles } from '@smithy/shared-ini-file-loader';
+import { AwsCredentialIdentityProvider, Logger } from '@smithy/types';
 import * as promptly from 'promptly';
-import { debug } from './_env';
-import { PatchedSharedIniFileCredentials } from './aws-sdk-inifile';
-import { SharedIniFile } from './sdk_ini_file';
+import type { SdkHttpOptions } from './sdk-provider';
+import { readIfPossible } from './util';
+import { debug } from '../../logging';
+
+const DEFAULT_CONNECTION_TIMEOUT = 10000;
+const DEFAULT_TIMEOUT = 300000;
 
 /**
  * Behaviors to match AWS CLI
@@ -20,134 +22,119 @@ import { SharedIniFile } from './sdk_ini_file';
 export class AwsCliCompatible {
   /**
    * Build an AWS CLI-compatible credential chain provider
-   *
-   * This is similar to the default credential provider chain created by the SDK
-   * except:
-   *
-   * 1. Accepts profile argument in the constructor (the SDK must have it prepopulated
-   *    in the environment).
-   * 2. Conditionally checks EC2 credentials, because checking for EC2
-   *    credentials on a non-EC2 machine may lead to long delays (in the best case)
-   *    or an exception (in the worst case).
-   * 3. Respects $AWS_SHARED_CREDENTIALS_FILE.
-   * 4. Respects $AWS_DEFAULT_PROFILE in addition to $AWS_PROFILE.
    */
-  public static async credentialChain(options: CredentialChainOptions = {}) {
-    // Force reading the `config` file if it exists by setting the appropriate
-    // environment variable.
-    await forceSdkToReadConfigIfPresent();
-
-    // To match AWS CLI behavior, if a profile is explicitly given using --profile,
-    // we use that to the exclusion of everything else (note: this does not apply
-    // to AWS_PROFILE, environment credentials still take precedence over AWS_PROFILE)
+  public static async credentialChainBuilder(
+    options: CredentialChainOptions = {},
+  ): Promise<AwsCredentialIdentityProvider> {
+    /**
+     * The previous implementation matched AWS CLI behavior:
+     *
+     * If a profile is explicitly set using `--profile`,
+     * we use that to the exclusion of everything else.
+     *
+     * Note: this does not apply to AWS_PROFILE,
+     * environment credentials still take precedence over AWS_PROFILE
+     */
     if (options.profile) {
-      return new AWS.CredentialProviderChain(iniFileCredentialFactories(options.profile, options.httpOptions));
-    }
-
-    const implicitProfile = process.env.AWS_PROFILE || process.env.AWS_DEFAULT_PROFILE || 'default';
-
-    const sources = [
-      () => new AWS.EnvironmentCredentials('AWS'),
-      () => new AWS.EnvironmentCredentials('AMAZON'),
-      ...iniFileCredentialFactories(implicitProfile, options.httpOptions),
-    ];
-
-    if (options.containerCreds ?? hasEcsCredentials()) {
-      sources.push(() => new AWS.ECSCredentials());
-    } else if (hasWebIdentityCredentials()) {
-      // else if: we have found WebIdentityCredentials as provided by EKS ServiceAccounts
-      sources.push(() => new AWS.TokenFileWebIdentityCredentials());
-    } else if (options.ec2instance ?? await isEc2Instance()) {
-      // else if: don't get EC2 creds if we should have gotten ECS or EKS creds
-      // ECS and EKS instances also run on EC2 boxes but the creds represent something different.
-      // Same behavior as upstream code.
-      sources.push(() => new AWS.EC2MetadataCredentials());
+      return fromIni({
+        profile: options.profile,
+        ignoreCache: true,
+        mfaCodeProvider: tokenCodeFn,
+        clientConfig: {
+          requestHandler: AwsCliCompatible.requestHandlerBuilder(options.httpOptions),
+          customUserAgent: 'aws-cdk',
+          logger: options.logger,
+        },
+        logger: options.logger,
+      });
     }
 
-    return new AWS.CredentialProviderChain(sources);
+    const profile = options.profile || process.env.AWS_PROFILE || process.env.AWS_DEFAULT_PROFILE;
+
+    /**
+     * Env AWS - EnvironmentCredentials with string AWS
+     * Env Amazon - EnvironmentCredentials with string AMAZON
+     * Profile Credentials - PatchedSharedIniFileCredentials with implicit profile, credentials file, http options, and token fn
+     *    SSO with implicit profile only
+     *    SharedIniFileCredentials with implicit profile and preferStaticCredentials true (profile with source_profile)
+     *    Shared Credential file that points to Environment Credentials with AWS prefix
+     *    Shared Credential file that points to EC2 Metadata
+     *    Shared Credential file that points to ECS Credentials
+     * SSO Credentials - SsoCredentials with implicit profile and http options
+     * ProcessCredentials with implicit profile
+     * ECS Credentials - ECSCredentials with no input OR Web Identity - TokenFileWebIdentityCredentials with no input OR EC2 Metadata - EC2MetadataCredentials with no input
+     *
+     * These translate to:
+     * fromEnv()
+     * fromSSO()/fromIni()
+     * fromProcess()
+     * fromContainerMetadata()
+     * fromTokenFile()
+     * fromInstanceMetadata()
+     */
+    const nodeProviderChain = fromNodeProviderChain({
+      profile: profile,
+      clientConfig: {
+        requestHandler: AwsCliCompatible.requestHandlerBuilder(options.httpOptions),
+        customUserAgent: 'aws-cdk',
+        logger: options.logger,
+      },
+      logger: options.logger,
+      ignoreCache: true,
+    });
 
-    function profileCredentials(profileName: string) {
-      return new PatchedSharedIniFileCredentials({
-        profile: profileName,
-        filename: credentialsFileName(),
-        httpOptions: options.httpOptions,
-        tokenCodeFn,
-      });
-    }
+    return shouldPrioritizeEnv()
+      ? createCredentialChain(fromEnv(), nodeProviderChain).expireAfter(60 * 60_000)
+      : nodeProviderChain;
+  }
 
-    function iniFileCredentialFactories(theProfile: string, theHttpOptions?: AWS.HTTPOptions) {
-      return [
-        () => profileCredentials(theProfile),
-        () => new AWS.SsoCredentials({
-          profile: theProfile,
-          httpOptions: theHttpOptions,
-        }),
-        () => new AWS.ProcessCredentials({ profile: theProfile }),
-      ];
-    }
+  public static requestHandlerBuilder(options: SdkHttpOptions = {}): NodeHttpHandlerOptions {
+    const config: NodeHttpHandlerOptions = {
+      connectionTimeout: DEFAULT_CONNECTION_TIMEOUT,
+      requestTimeout: DEFAULT_TIMEOUT,
+      httpsAgent: {
+        ca: tryGetCACert(options.caBundlePath),
+        localAddress: options.proxyAddress,
+      },
+      httpAgent: {
+        localAddress: options.proxyAddress,
+      },
+    };
+    return config;
   }
 
   /**
-   * Return the default region in a CLI-compatible way
+   * Attempts to get the region from a number of sources and falls back to us-east-1 if no region can be found,
+   * as is done in the AWS CLI.
    *
-   * Mostly copied from node_loader.js, but with the following differences to make it
-   * AWS CLI compatible:
+   * The order of priority is the following:
    *
-   * 1. Takes a profile name as an argument (instead of forcing it to be taken from $AWS_PROFILE).
-   *    This requires having made a copy of the SDK's `SharedIniFile` (the original
-   *    does not take an argument).
-   * 2. $AWS_DEFAULT_PROFILE and $AWS_DEFAULT_REGION are also respected.
-   *
-   * Lambda and CodeBuild set the $AWS_REGION variable.
+   * 1. Environment variables specifying region, with both an AWS prefix and AMAZON prefix
+   *    to maintain backwards compatibility, and without `DEFAULT` in the name because
+   *    Lambda and CodeBuild set the $AWS_REGION variable.
+   * 2. Regions listed in the Shared Ini Files - First checking for the profile provided
+   *    and then checking for the default profile.
+   * 3. IMDS instance identity region from the Metadata Service.
+   * 4. us-east-1
    */
-  public static async region(options: RegionOptions = {}): Promise<string> {
-    const profile = options.profile || process.env.AWS_PROFILE || process.env.AWS_DEFAULT_PROFILE || 'default';
-
-    // Defaults inside constructor
-    const toCheck = [
-      { filename: credentialsFileName(), profile },
-      { isConfig: true, filename: configFileName(), profile },
-      { isConfig: true, filename: configFileName(), profile: 'default' },
-    ];
-
-    let region = process.env.AWS_REGION || process.env.AMAZON_REGION ||
-      process.env.AWS_DEFAULT_REGION || process.env.AMAZON_DEFAULT_REGION;
-
-    while (!region && toCheck.length > 0) {
-      const opts = toCheck.shift()!;
-      if (await fs.pathExists(opts.filename)) {
-        const configFile = new SharedIniFile(opts);
-        const section = await configFile.getProfile(opts.profile);
-        region = section?.region;
-      }
-    }
-
-    if (!region && (options.ec2instance ?? await isEc2Instance())) {
-      debug('Looking up AWS region in the EC2 Instance Metadata Service (IMDS).');
-      const imdsOptions = {
-        httpOptions: { timeout: 1000, connectTimeout: 1000 }, maxRetries: 2,
-      };
-      const metadataService = new AWS.MetadataService(imdsOptions);
-
-      let token;
-      try {
-        token = await getImdsV2Token(metadataService);
-      } catch (e) {
-        debug(`No IMDSv2 token: ${e}`);
-      }
-
-      try {
-        region = await getRegionFromImds(metadataService, token);
-        debug(`AWS region from IMDS: ${region}`);
-      } catch (e) {
-        debug(`Unable to retrieve AWS region from IMDS: ${e}`);
-      }
-    }
+  public static async region(maybeProfile?: string): Promise<string> {
+    const defaultRegion = 'us-east-1';
+    const profile = maybeProfile || process.env.AWS_PROFILE || process.env.AWS_DEFAULT_PROFILE || 'default';
+
+    const region =
+      process.env.AWS_REGION ||
+      process.env.AMAZON_REGION ||
+      process.env.AWS_DEFAULT_REGION ||
+      process.env.AMAZON_DEFAULT_REGION ||
+      (await getRegionFromIni(profile)) ||
+      (await regionFromMetadataService());
 
     if (!region) {
       const usedProfile = !profile ? '' : ` (profile: "${profile}")`;
-      region = 'us-east-1'; // This is what the AWS CLI does
-      debug(`Unable to determine AWS region from environment or AWS configuration${usedProfile}, defaulting to '${region}'`);
+      debug(
+        `Unable to determine AWS region from environment or AWS configuration${usedProfile}, defaulting to '${defaultRegion}'`,
+      );
+      return defaultRegion;
     }
 
     return region;
@@ -155,177 +142,85 @@ export class AwsCliCompatible {
 }
 
 /**
- * Return whether it looks like we'll have ECS credentials available
+ * Looks up the region of the provided profile. If no region is present,
+ * it will attempt to lookup the default region.
+ * @param profile The profile to use to lookup the region
+ * @returns The region for the profile or default profile, if present. Otherwise returns undefined.
  */
-function hasEcsCredentials(): boolean {
-  return (AWS.ECSCredentials.prototype as any).isConfiguredForEcsCredentials();
+async function getRegionFromIni(profile: string): Promise<string | undefined> {
+  const sharedFiles = await loadSharedConfigFiles({ ignoreCache: true });
+  return sharedFiles?.configFile?.[profile]?.region || sharedFiles?.configFile?.default?.region;
 }
 
-/**
- * Return whether it looks like we'll have WebIdentityCredentials (that's what EKS uses) available
- * No check like hasEcsCredentials available, so have to implement our own.
- * @see https://github.com/aws/aws-sdk-js/blob/3ccfd94da07234ae87037f55c138392f38b6881d/lib/credentials/token_file_web_identity_credentials.js#L59
- */
-function hasWebIdentityCredentials(): boolean {
-  return Boolean(process.env.AWS_ROLE_ARN && process.env.AWS_WEB_IDENTITY_TOKEN_FILE);
-}
-
-/**
- * Return whether we're on an EC2 instance
- */
-async function isEc2Instance() {
-  if (isEc2InstanceCache === undefined) {
-    debug("Determining if we're on an EC2 instance.");
-    let instance = false;
-    if (process.platform === 'win32') {
-      // https://docs.aws.amazon.com/AWSEC2/latest/WindowsGuide/identify_ec2_instances.html
-      try {
-        const result = await util.promisify(child_process.exec)('wmic path win32_computersystemproduct get uuid', { encoding: 'utf-8' });
-        // output looks like
-        //  UUID
-        //  EC2AE145-D1DC-13B2-94ED-01234ABCDEF
-        const lines = result.stdout.toString().split('\n');
-        instance = lines.some(x => matchesRegex(/^ec2/i, x));
-      } catch (e: any) {
-        // Modern machines may not have wmic.exe installed. No reason to fail, just assume it's not an EC2 instance.
-        debug(`Checking using WMIC failed, assuming NOT an EC2 instance: ${e.message} (pass --ec2creds to force)`);
-        instance = false;
-      }
-    } else {
-      // https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/identify_ec2_instances.html
-      const files: Array<[string, RegExp]> = [
-        // This recognizes the Xen hypervisor based instances (pre-5th gen)
-        ['/sys/hypervisor/uuid', /^ec2/i],
-
-        // This recognizes the new Hypervisor (5th-gen instances and higher)
-        // Can't use the advertised file '/sys/devices/virtual/dmi/id/product_uuid' because it requires root to read.
-        // Instead, sys_vendor contains something like 'Amazon EC2'.
-        ['/sys/devices/virtual/dmi/id/sys_vendor', /ec2/i],
-      ];
-      for (const [file, re] of files) {
-        if (matchesRegex(re, readIfPossible(file))) {
-          instance = true;
-          break;
-        }
-      }
-    }
-    debug(instance ? 'Looks like an EC2 instance.' : 'Does not look like an EC2 instance.');
-    isEc2InstanceCache = instance;
+function tryGetCACert(bundlePath?: string) {
+  const path = bundlePath || caBundlePathFromEnvironment();
+  if (path) {
+    debug('Using CA bundle path: %s', bundlePath);
+    return readIfPossible(path);
   }
-  return isEc2InstanceCache;
-}
-
-let isEc2InstanceCache: boolean | undefined = undefined;
-
-/**
- * Attempts to get a Instance Metadata Service V2 token
- */
-async function getImdsV2Token(metadataService: AWS.MetadataService): Promise<string> {
-  debug('Attempting to retrieve an IMDSv2 token.');
-  return new Promise((resolve, reject) => {
-    metadataService.request(
-      '/latest/api/token',
-      {
-        method: 'PUT',
-        headers: { 'x-aws-ec2-metadata-token-ttl-seconds': '60' },
-      },
-      (err: AWS.AWSError, token: string | undefined) => {
-        if (err) {
-          reject(err);
-        } else if (!token) {
-          reject(new Error('IMDS did not return a token.'));
-        } else {
-          resolve(token);
-        }
-      });
-  });
+  return undefined;
 }
 
 /**
- * Attempts to get the region from the Instance Metadata Service
+ * Find and return a CA certificate bundle path to be passed into the SDK.
  */
-async function getRegionFromImds(metadataService: AWS.MetadataService, token: string | undefined): Promise<string> {
-  debug('Retrieving the AWS region from the IMDS.');
-  let options: { method?: string | undefined; headers?: { [key: string]: string } | undefined } = {};
-  if (token) {
-    options = { headers: { 'x-aws-ec2-metadata-token': token } };
+function caBundlePathFromEnvironment(): string | undefined {
+  if (process.env.aws_ca_bundle) {
+    return process.env.aws_ca_bundle;
   }
-  return new Promise((resolve, reject) => {
-    metadataService.request(
-      '/latest/dynamic/instance-identity/document',
-      options,
-      (err: AWS.AWSError, instanceIdentityDocument: string | undefined) => {
-        if (err) {
-          reject(err);
-        } else if (!instanceIdentityDocument) {
-          reject(new Error('IMDS did not return an Instance Identity Document.'));
-        } else {
-          try {
-            resolve(JSON.parse(instanceIdentityDocument).region);
-          } catch (e) {
-            reject(e);
-          }
-        }
-      });
-  });
-}
-
-function homeDir() {
-  return process.env.HOME || process.env.USERPROFILE
-    || (process.env.HOMEPATH ? ((process.env.HOMEDRIVE || 'C:/') + process.env.HOMEPATH) : null) || os.homedir();
-}
-
-function credentialsFileName() {
-  return process.env.AWS_SHARED_CREDENTIALS_FILE || path.join(homeDir(), '.aws', 'credentials');
-}
-
-function configFileName() {
-  return process.env.AWS_CONFIG_FILE || path.join(homeDir(), '.aws', 'config');
+  if (process.env.AWS_CA_BUNDLE) {
+    return process.env.AWS_CA_BUNDLE;
+  }
+  return undefined;
 }
 
 /**
- * Force the JS SDK to honor the ~/.aws/config file (and various settings therein)
- *
- * For example, there is just *NO* way to do AssumeRole credentials as long as AWS_SDK_LOAD_CONFIG is not set,
- * or read credentials from that file.
+ * We used to support both AWS and AMAZON prefixes for these environment variables.
  *
- * The SDK crashes if the variable is set but the file does not exist, so conditionally set it.
+ * Adding this for backward compatibility.
  */
-async function forceSdkToReadConfigIfPresent() {
-  if (await fs.pathExists(configFileName())) {
-    process.env.AWS_SDK_LOAD_CONFIG = '1';
+function shouldPrioritizeEnv() {
+  const id = process.env.AWS_ACCESS_KEY_ID || process.env.AMAZON_ACCESS_KEY_ID;
+  const key = process.env.AWS_SECRET_ACCESS_KEY || process.env.AMAZON_SECRET_ACCESS_KEY;
+  process.env.AWS_SESSION_TOKEN = process.env.AWS_SESSION_TOKEN || process.env.AMAZON_SESSION_TOKEN;
+
+  if (!!id && !!key) {
+    process.env.AWS_ACCESS_KEY_ID = id;
+    process.env.AWS_SECRET_ACCESS_KEY = key;
+    return true;
   }
-}
 
-function matchesRegex(re: RegExp, s: string | undefined) {
-  return s !== undefined && re.exec(s) !== null;
+  return false;
 }
 
 /**
- * Read a file if it exists, or return undefined
+ * The MetadataService class will attempt to fetch the instance identity document from
+ * IMDSv2 first, and then will attempt v1 as a fallback.
  *
- * Not async because it is used in the constructor
+ * If this fails, we will use us-east-1 as the region so no error should be thrown.
+ * @returns The region for the instance identity
  */
-function readIfPossible(filename: string): string | undefined {
+async function regionFromMetadataService() {
+  debug('Looking up AWS region in the EC2 Instance Metadata Service (IMDS).');
   try {
-    if (!fs.pathExistsSync(filename)) { return undefined; }
-    return fs.readFileSync(filename, { encoding: 'utf-8' });
-  } catch (e: any) {
-    debug(e);
-    return undefined;
+    const metadataService = new MetadataService({
+      httpOptions: {
+        timeout: 1000,
+      },
+    });
+
+    await metadataService.fetchMetadataToken();
+    const document = await metadataService.request('/latest/dynamic/instance-identity/document', {});
+    return JSON.parse(document).region;
+  } catch (e) {
+    debug(`Unable to retrieve AWS region from IMDS: ${e}`);
   }
 }
 
 export interface CredentialChainOptions {
   readonly profile?: string;
-  readonly ec2instance?: boolean;
-  readonly containerCreds?: boolean;
-  readonly httpOptions?: AWS.HTTPOptions;
-}
-
-export interface RegionOptions {
-  readonly profile?: string;
-  readonly ec2instance?: boolean;
+  readonly httpOptions?: SdkHttpOptions;
+  readonly logger?: Logger;
 }
 
 /**
@@ -333,7 +228,7 @@ export interface RegionOptions {
  *
  * Result is send to callback function for SDK to authorize the request
  */
-async function tokenCodeFn(serialArn: string, cb: (err?: Error, token?: string) => void): Promise<void> {
+async function tokenCodeFn(serialArn: string): Promise<string> {
   debug('Require MFA token for serial ARN', serialArn);
   try {
     const token: string = await promptly.prompt(`MFA token for ${serialArn}: `, {
@@ -341,9 +236,11 @@ async function tokenCodeFn(serialArn: string, cb: (err?: Error, token?: string)
       default: '',
     });
     debug('Successfully got MFA token from user');
-    cb(undefined, token);
+    return token;
   } catch (err: any) {
     debug('Failed to get MFA token', err);
-    cb(err);
+    const e = new Error(`Error fetching MFA token: ${err.message ?? err}`);
+    e.name = 'SharedIniFileCredentialsProviderFailure';
+    throw e;
   }
 }
diff --git a/packages/aws-cdk/lib/api/aws-auth/credential-plugins.ts b/packages/aws-cdk/lib/api/aws-auth/credential-plugins.ts
index 640e8cf4b462f..983377e6512ea 100644
--- a/packages/aws-cdk/lib/api/aws-auth/credential-plugins.ts
+++ b/packages/aws-cdk/lib/api/aws-auth/credential-plugins.ts
@@ -1,7 +1,6 @@
-import { debug } from './_env';
-import { Mode } from './credentials';
-import { warning } from '../../logging';
-import { CredentialProviderSource, PluginHost } from '../plugin';
+import type { AwsCredentialIdentity } from '@smithy/types';
+import { debug, warning } from '../../logging';
+import { CredentialProviderSource, Mode, PluginHost } from '../plugin';
 
 /**
  * Cache for credential providers.
@@ -16,7 +15,7 @@ import { CredentialProviderSource, PluginHost } from '../plugin';
  * for the given account.
  */
 export class CredentialPlugins {
-  private readonly cache: {[key: string]: PluginCredentials | undefined} = {};
+  private readonly cache: { [key: string]: PluginCredentials | undefined } = {};
 
   public async fetchCredentialsFor(awsAccountId: string, mode: Mode): Promise<PluginCredentials | undefined> {
     const key = `${awsAccountId}-${mode}`;
@@ -27,7 +26,7 @@ export class CredentialPlugins {
   }
 
   public get availablePluginNames(): string[] {
-    return PluginHost.instance.credentialProviderSources.map(s => s.name);
+    return PluginHost.instance.credentialProviderSources.map((s) => s.name);
   }
 
   private async lookupCredentials(awsAccountId: string, mode: Mode): Promise<PluginCredentials | undefined> {
@@ -56,13 +55,17 @@ export class CredentialPlugins {
         warning(`Uncaught exception in ${source.name}: ${e.message}`);
         canProvide = false;
       }
-      if (!canProvide) { continue; }
+      if (!canProvide) {
+        continue;
+      }
       debug(`Using ${source.name} credentials for account ${awsAccountId}`);
       const providerOrCreds = await source.getProvider(awsAccountId, mode);
 
       // Backwards compatibility: if the plugin returns a ProviderChain, resolve that chain.
       // Otherwise it must have returned credentials.
-      const credentials = (providerOrCreds as any).resolvePromise ? await (providerOrCreds as any).resolvePromise() : providerOrCreds;
+      const credentials = (providerOrCreds as any).resolvePromise
+        ? await (providerOrCreds as any).resolvePromise()
+        : providerOrCreds;
 
       return { credentials, pluginName: source.name };
     }
@@ -71,6 +74,6 @@ export class CredentialPlugins {
 }
 
 export interface PluginCredentials {
-  readonly credentials: AWS.Credentials;
+  readonly credentials: AwsCredentialIdentity;
   readonly pluginName: string;
 }
diff --git a/packages/aws-cdk/lib/api/aws-auth/credentials.ts b/packages/aws-cdk/lib/api/aws-auth/credentials.ts
deleted file mode 100644
index b93cd43550a5c..0000000000000
--- a/packages/aws-cdk/lib/api/aws-auth/credentials.ts
+++ /dev/null
@@ -1,3 +0,0 @@
-// Re-export this here because it used to be here and I don't want
-// to change imports too much.
-export { Mode } from '../plugin';
\ No newline at end of file
diff --git a/packages/aws-cdk/lib/api/aws-auth/index.ts b/packages/aws-cdk/lib/api/aws-auth/index.ts
index cade9b2eada26..a913c20f425c4 100644
--- a/packages/aws-cdk/lib/api/aws-auth/index.ts
+++ b/packages/aws-cdk/lib/api/aws-auth/index.ts
@@ -1,3 +1,2 @@
 export * from './sdk';
-export * from './sdk-provider';
-export * from './credentials';
\ No newline at end of file
+export * from './sdk-provider';
\ No newline at end of file
diff --git a/packages/aws-cdk/lib/api/aws-auth/sdk-provider.ts b/packages/aws-cdk/lib/api/aws-auth/sdk-provider.ts
index 6d8d341d7a8c5..196b192ed4040 100644
--- a/packages/aws-cdk/lib/api/aws-auth/sdk-provider.ts
+++ b/packages/aws-cdk/lib/api/aws-auth/sdk-provider.ts
@@ -1,29 +1,19 @@
 import * as os from 'os';
-import * as path from 'path';
-import * as cxschema from '@aws-cdk/cloud-assembly-schema';
-import * as cxapi from '@aws-cdk/cx-api';
-import * as AWS from 'aws-sdk';
-import type { ConfigurationOptions } from 'aws-sdk/lib/config-base';
-import * as fs from 'fs-extra';
-import { debug, warning } from './_env';
+import { ContextLookupRoleOptions } from '@aws-cdk/cloud-assembly-schema';
+import { Environment, EnvironmentUtils, UNKNOWN_ACCOUNT, UNKNOWN_REGION } from '@aws-cdk/cx-api';
+import { AssumeRoleCommandInput } from '@aws-sdk/client-sts';
+import { fromTemporaryCredentials } from '@aws-sdk/credential-providers';
+import type { NodeHttpHandlerOptions } from '@smithy/node-http-handler';
+import { AwsCredentialIdentity, AwsCredentialIdentityProvider, Logger } from '@smithy/types';
 import { AwsCliCompatible } from './awscli-compatible';
 import { cached } from './cached';
 import { CredentialPlugins } from './credential-plugins';
-import { Mode } from './credentials';
-import { ISDK, SDK, isUnrecoverableAwsError } from './sdk';
-import { rootDir } from '../../util/directories';
+import { SDK } from './sdk';
+import { debug, warning } from '../../logging';
 import { traceMethods } from '../../util/tracing';
+import { Mode } from '../plugin';
 
-// Partial because `RoleSessionName` is required in STS, but we have a default value for it.
-export type AssumeRoleAdditionalOptions = Partial<
-// cloud-assembly-schema validates that `ExternalId` and `RoleArn` are not configured
-Omit<AWS.STS.Types.AssumeRoleRequest, 'ExternalId' | 'RoleArn'>
->;
-
-// Some configuration that can only be achieved by setting
-// environment variables.
-process.env.AWS_STS_REGIONAL_ENDPOINTS = 'regional';
-process.env.AWS_NODEJS_CONNECTION_REUSE_ENABLED = '1';
+export type AssumeRoleAdditionalOptions = Partial<Omit<AssumeRoleCommandInput, 'ExternalId' | 'RoleArn'>>;
 
 /**
  * Options for the default SDK provider
@@ -37,23 +27,14 @@ export interface SdkProviderOptions {
   readonly profile?: string;
 
   /**
-   * Whether we should check for EC2 credentials
-   *
-   * @default - Autodetect
-   */
-  readonly ec2creds?: boolean;
-
-  /**
-   * Whether we should check for container credentials
-   *
-   * @default - Autodetect
+   * HTTP options for SDK
    */
-  readonly containerCreds?: boolean;
+  readonly httpOptions?: SdkHttpOptions;
 
   /**
-   * HTTP options for SDK
+   * The logger for sdk calls.
    */
-  readonly httpOptions?: SdkHttpOptions;
+  readonly logger?: Logger;
 }
 
 /**
@@ -73,13 +54,6 @@ export interface SdkHttpOptions {
    * @default No certificate bundle
    */
   readonly caBundlePath?: string;
-
-  /**
-   * The custom user agent to use.
-   *
-   * @default - <package-name>/<package-version>
-   */
-  readonly userAgent?: string;
 }
 
 const CACHED_ACCOUNT = Symbol('cached_account');
@@ -101,7 +75,7 @@ export interface SdkForEnvironment {
   /**
    * The SDK for the given environment
    */
-  readonly sdk: ISDK;
+  readonly sdk: SDK;
 
   /**
    * Whether or not the assume role was successful.
@@ -144,32 +118,27 @@ export class SdkProvider {
    * class `AwsCliCompatible` for the details.
    */
   public static async withAwsCliCompatibleDefaults(options: SdkProviderOptions = {}) {
-    const sdkOptions = parseHttpOptions(options.httpOptions ?? {});
-
-    const chain = await AwsCliCompatible.credentialChain({
-      profile: options.profile,
-      ec2instance: options.ec2creds,
-      containerCreds: options.containerCreds,
-      httpOptions: sdkOptions.httpOptions,
-    });
-    const region = await AwsCliCompatible.region({
+    const credentialProvider = await AwsCliCompatible.credentialChainBuilder({
       profile: options.profile,
-      ec2instance: options.ec2creds,
+      httpOptions: options.httpOptions,
+      logger: options.logger,
     });
 
-    return new SdkProvider(chain, region, sdkOptions);
+    const region = await AwsCliCompatible.region(options.profile);
+    const requestHandler = AwsCliCompatible.requestHandlerBuilder(options.httpOptions);
+    return new SdkProvider(credentialProvider, region, requestHandler);
   }
 
   private readonly plugins = new CredentialPlugins();
 
   public constructor(
-    private readonly defaultChain: AWS.CredentialProviderChain,
+    private readonly defaultCredentialProvider: AwsCredentialIdentityProvider,
     /**
      * Default region
      */
     public readonly defaultRegion: string,
-    private readonly sdkOptions: ConfigurationOptions = {}) {
-  }
+    private readonly requestHandler: NodeHttpHandlerOptions = {},
+  ) {}
 
   /**
    * Return an SDK which can do operations in the given environment
@@ -177,7 +146,7 @@ export class SdkProvider {
    * The `environment` parameter is resolved first (see `resolveEnvironment()`).
    */
   public async forEnvironment(
-    environment: cxapi.Environment,
+    environment: Environment,
     mode: Mode,
     options?: CredentialsOptions,
     quiet = false,
@@ -187,32 +156,39 @@ export class SdkProvider {
     const baseCreds = await this.obtainBaseCredentials(env.account, mode);
 
     // At this point, we need at least SOME credentials
-    if (baseCreds.source === 'none') { throw new Error(fmtObtainCredentialsError(env.account, baseCreds)); }
+    if (baseCreds.source === 'none') {
+      throw new Error(fmtObtainCredentialsError(env.account, baseCreds));
+    }
 
     // Simple case is if we don't need to "assumeRole" here. If so, we must now have credentials for the right
     // account.
     if (options?.assumeRoleArn === undefined) {
-      if (baseCreds.source === 'incorrectDefault') { throw new Error(fmtObtainCredentialsError(env.account, baseCreds)); }
+      if (baseCreds.source === 'incorrectDefault') {
+        throw new Error(fmtObtainCredentialsError(env.account, baseCreds));
+      }
 
       // Our current credentials must be valid and not expired. Confirm that before we get into doing
       // actual CloudFormation calls, which might take a long time to hang.
-      const sdk = new SDK(baseCreds.credentials, env.region, this.sdkOptions);
+      const sdk = new SDK(baseCreds.credentials, env.region, this.requestHandler);
       await sdk.validateCredentials();
       return { sdk, didAssumeRole: false };
     }
 
     // We will proceed to AssumeRole using whatever we've been given.
-    const sdk = await this.withAssumedRole(baseCreds, options.assumeRoleArn,
-      options.assumeRoleExternalId, options.assumeRoleAdditionalOptions, env.region);
+    const sdk = await this.withAssumedRole(
+      baseCreds,
+      options.assumeRoleArn,
+      options.assumeRoleExternalId,
+      options.assumeRoleAdditionalOptions,
+      env.region,
+    );
 
-    // Exercise the AssumeRoleCredentialsProvider we've gotten at least once so
-    // we can determine whether the AssumeRole call succeeds or not.
     try {
-      await sdk.forceCredentialRetrieval();
+      // Force retrieval here
       return { sdk, didAssumeRole: true };
-    } catch (e: any) {
-      if (isUnrecoverableAwsError(e)) {
-        throw e;
+    } catch (err: any) {
+      if (err.name === 'ExpiredToken') {
+        throw err;
       }
 
       // AssumeRole failed. Proceed and warn *if and only if* the baseCredentials were already for the right account
@@ -220,13 +196,18 @@ export class SdkProvider {
       // feed the CLI credentials which are sufficient by themselves. Prefer to assume the correct role if we can,
       // but if we can't then let's just try with available credentials anyway.
       if (baseCreds.source === 'correctDefault' || baseCreds.source === 'plugin') {
-        debug(e.message);
+        debug(err.message);
         const logger = quiet ? debug : warning;
-        logger(`${fmtObtainedCredentials(baseCreds)} could not be used to assume '${options.assumeRoleArn}', but are for the right account. Proceeding anyway.`);
-        return { sdk: new SDK(baseCreds.credentials, env.region, this.sdkOptions), didAssumeRole: false };
+        logger(
+          `${fmtObtainedCredentials(baseCreds)} could not be used to assume '${options.assumeRoleArn}', but are for the right account. Proceeding anyway.`,
+        );
+        return {
+          sdk: new SDK(baseCreds.credentials, env.region, this.requestHandler),
+          didAssumeRole: false,
+        };
       }
 
-      throw e;
+      throw err;
     }
   }
 
@@ -235,11 +216,13 @@ export class SdkProvider {
    *
    * Returns `undefined` if there are no base credentials.
    */
-  public async baseCredentialsPartition(environment: cxapi.Environment, mode: Mode): Promise<string | undefined> {
+  public async baseCredentialsPartition(environment: Environment, mode: Mode): Promise<string | undefined> {
     const env = await this.resolveEnvironment(environment);
     const baseCreds = await this.obtainBaseCredentials(env.account, mode);
-    if (baseCreds.source === 'none') { return undefined; }
-    return (await new SDK(baseCreds.credentials, env.region, this.sdkOptions).currentAccount()).partition;
+    if (baseCreds.source === 'none') {
+      return undefined;
+    }
+    return (await new SDK(baseCreds.credentials, env.region, this.requestHandler).currentAccount()).partition;
   }
 
   /**
@@ -252,18 +235,20 @@ export class SdkProvider {
    * It is an error if `UNKNOWN_ACCOUNT` is used but the user hasn't configured
    * any SDK credentials.
    */
-  public async resolveEnvironment(env: cxapi.Environment): Promise<cxapi.Environment> {
-    const region = env.region !== cxapi.UNKNOWN_REGION ? env.region : this.defaultRegion;
-    const account = env.account !== cxapi.UNKNOWN_ACCOUNT ? env.account : (await this.defaultAccount())?.accountId;
+  public async resolveEnvironment(env: Environment): Promise<Environment> {
+    const region = env.region !== UNKNOWN_REGION ? env.region : this.defaultRegion;
+    const account = env.account !== UNKNOWN_ACCOUNT ? env.account : (await this.defaultAccount())?.accountId;
 
     if (!account) {
-      throw new Error('Unable to resolve AWS account to use. It must be either configured when you define your CDK Stack, or through the environment');
+      throw new Error(
+        'Unable to resolve AWS account to use. It must be either configured when you define your CDK Stack, or through the environment',
+      );
     }
 
     return {
       region,
       account,
-      name: cxapi.EnvironmentUtils.format(account, region),
+      name: EnvironmentUtils.format(account, region),
     };
   }
 
@@ -280,27 +265,28 @@ export class SdkProvider {
    *
    * Uses a cache to avoid STS calls if we don't need 'em.
    */
-  public defaultAccount(): Promise<Account | undefined> {
+  public async defaultAccount(): Promise<Account | undefined> {
     return cached(this, CACHED_ACCOUNT, async () => {
       try {
-        const creds = await this.defaultCredentials();
-
-        const accessKeyId = creds.accessKeyId;
+        const credentials = await this.defaultCredentials();
+        const accessKeyId = credentials.accessKeyId;
         if (!accessKeyId) {
           throw new Error('Unable to resolve AWS credentials (setup with "aws configure")');
         }
 
-        return await new SDK(creds, this.defaultRegion, this.sdkOptions).currentAccount();
+        return await new SDK(credentials, this.defaultRegion, this.requestHandler).currentAccount();
       } catch (e: any) {
         // Treat 'ExpiredToken' specially. This is a common situation that people may find themselves in, and
         // they are complaining about if we fail 'cdk synth' on them. We loudly complain in order to show that
         // the current situation is probably undesirable, but we don't fail.
-        if (e.code === 'ExpiredToken') {
-          warning('There are expired AWS credentials in your environment. The CDK app will synth without current account information.');
+        if (e.name === 'ExpiredToken') {
+          warning(
+            'There are expired AWS credentials in your environment. The CDK app will synth without current account information.',
+          );
           return undefined;
         }
 
-        debug(`Unable to determine the default AWS account (${e.code}): ${e.message}`);
+        debug(`Unable to determine the default AWS account (${e.name}): ${e.message}`);
         return undefined;
       }
     });
@@ -319,7 +305,10 @@ export class SdkProvider {
     // First try 'current' credentials
     const defaultAccountId = (await this.defaultAccount())?.accountId;
     if (defaultAccountId === accountId) {
-      return { source: 'correctDefault', credentials: await this.defaultCredentials() };
+      return {
+        source: 'correctDefault',
+        credentials: await this.defaultCredentials(),
+      };
     }
 
     // Then try the plugins
@@ -348,10 +337,10 @@ export class SdkProvider {
   /**
    * Resolve the default chain to the first set of credentials that is available
    */
-  private defaultCredentials(): Promise<AWS.Credentials> {
-    return cached(this, CACHED_DEFAULT_CREDENTIALS, () => {
+  private async defaultCredentials(): Promise<AwsCredentialIdentity> {
+    return cached(this, CACHED_DEFAULT_CREDENTIALS, async () => {
       debug('Resolving default credentials');
-      return this.defaultChain.resolvePromise();
+      return this.defaultCredentialProvider();
     });
   }
 
@@ -363,34 +352,53 @@ export class SdkProvider {
    * otherwise it will be the current credentials.
    */
   private async withAssumedRole(
-    masterCredentials: Exclude<ObtainBaseCredentialsResult, { source: 'none' }>,
+    mainCredentials: Exclude<ObtainBaseCredentialsResult, { source: 'none' }>,
     roleArn: string,
-    externalId: string | undefined,
-    additionalOptions: AssumeRoleAdditionalOptions | undefined,
-    region: string | undefined) {
+    externalId?: string,
+    additionalOptions?: AssumeRoleAdditionalOptions,
+    region?: string,
+  ): Promise<SDK> {
     debug(`Assuming role '${roleArn}'.`);
 
     region = region ?? this.defaultRegion;
-    const creds = new AWS.ChainableTemporaryCredentials({
-      params: {
-        RoleArn: roleArn,
-        ExternalId: externalId,
-        RoleSessionName: `aws-cdk-${safeUsername()}`,
-        TransitiveTagKeys: additionalOptions?.Tags
-          ? additionalOptions.Tags.map((t) => t.Key)
-          : undefined,
-        ...(additionalOptions ?? {}),
-      },
-      stsConfig: {
-        region,
-        ...this.sdkOptions,
-      },
-      masterCredentials: masterCredentials.credentials,
-    });
 
-    return new SDK(creds, region, this.sdkOptions, {
-      assumeRoleCredentialsSourceDescription: fmtObtainedCredentials(masterCredentials),
-    });
+    const sourceDescription = fmtObtainedCredentials(mainCredentials);
+
+    try {
+      const credentials = await fromTemporaryCredentials({
+        masterCredentials: mainCredentials.credentials,
+        params: {
+          RoleArn: roleArn,
+          ExternalId: externalId,
+          RoleSessionName: `aws-cdk-${safeUsername()}`,
+          ...additionalOptions,
+          TransitiveTagKeys: additionalOptions?.Tags ? additionalOptions.Tags.map((t) => t.Key!) : undefined,
+        },
+        clientConfig: {
+          region,
+          ...this.requestHandler,
+        },
+      })();
+
+      return new SDK(credentials, region, this.requestHandler, {
+        assumeRoleCredentialsSourceDescription: fmtObtainedCredentials(mainCredentials),
+      });
+    } catch (err: any) {
+      if (err.name === 'ExpiredToken') {
+        throw err;
+      }
+
+      debug(`Assuming role failed: ${err.message}`);
+      throw new Error(
+        [
+          'Could not assume role in target account',
+          ...(sourceDescription ? [`using ${sourceDescription}`] : []),
+          err.message,
+          ". Please make sure that this role exists in the account. If it doesn't exist, (re)-bootstrap the environment " +
+            "with the right '--trust', using the latest version of the CDK CLI.",
+        ].join(' '),
+      );
+    }
   }
 }
 
@@ -412,93 +420,6 @@ export interface Account {
   readonly partition: string;
 }
 
-const DEFAULT_CONNECTION_TIMEOUT = 10000;
-const DEFAULT_TIMEOUT = 300000;
-
-/**
- * Get HTTP options for the SDK
- *
- * Read from user input or environment variables.
- *
- * Returns a complete `ConfigurationOptions` object because that's where
- * `customUserAgent` lives, but `httpOptions` is the most important attribute.
- */
-function parseHttpOptions(options: SdkHttpOptions) {
-  const config: ConfigurationOptions = {};
-  config.httpOptions = {};
-
-  config.httpOptions.connectTimeout = DEFAULT_CONNECTION_TIMEOUT;
-  config.httpOptions.timeout = DEFAULT_TIMEOUT;
-
-  let userAgent = options.userAgent;
-  if (userAgent == null) {
-    userAgent = defaultCliUserAgent();
-  }
-  config.customUserAgent = userAgent;
-
-  const caBundlePath = options.caBundlePath || caBundlePathFromEnvironment();
-  if (caBundlePath) {
-    debug('Using CA bundle path: %s', caBundlePath);
-    (config.httpOptions as any).ca = readIfPossible(caBundlePath);
-  }
-
-  if (options.proxyAddress) {
-    debug('Proxy server from command-line arguments: %s', options.proxyAddress);
-  }
-
-  // Configure the proxy agent. By default, this will use HTTPS?_PROXY and
-  // NO_PROXY environment variables to determine which proxy to use for each
-  // request.
-  //
-  // eslint-disable-next-line @typescript-eslint/no-require-imports
-  const { ProxyAgent } = require('proxy-agent');
-  config.httpOptions.agent = new ProxyAgent(options.proxyAddress);
-
-  return config;
-}
-
-/**
- * Find the package.json from the main toolkit.
- *
- * If we can't read it for some reason, try to do something reasonable anyway.
- * Fall back to argv[1], or a standard string if that is undefined for some reason.
- */
-export function defaultCliUserAgent() {
-  const root = rootDir(false);
-  const pkg = JSON.parse((root ? readIfPossible(path.join(root, 'package.json')) : undefined) ?? '{}');
-  const name = pkg.name ?? path.basename(process.argv[1] ?? 'cdk-cli');
-  const version = pkg.version ?? '<unknown>';
-  return `${name}/${version}`;
-}
-
-/**
- * Find and return a CA certificate bundle path to be passed into the SDK.
- */
-function caBundlePathFromEnvironment(): string | undefined {
-  if (process.env.aws_ca_bundle) {
-    return process.env.aws_ca_bundle;
-  }
-  if (process.env.AWS_CA_BUNDLE) {
-    return process.env.AWS_CA_BUNDLE;
-  }
-  return undefined;
-}
-
-/**
- * Read a file if it exists, or return undefined
- *
- * Not async because it is used in the constructor
- */
-function readIfPossible(filename: string): string | undefined {
-  try {
-    if (!fs.pathExistsSync(filename)) { return undefined; }
-    return fs.readFileSync(filename, { encoding: 'utf-8' });
-  } catch (e: any) {
-    debug(e);
-    return undefined;
-  }
-}
-
 /**
  * Return the username with characters invalid for a RoleSessionName removed
  *
@@ -536,9 +457,14 @@ export interface CredentialsOptions {
  * Result of obtaining base credentials
  */
 type ObtainBaseCredentialsResult =
-  { source: 'correctDefault'; credentials: AWS.Credentials }
-  | { source: 'plugin'; pluginName: string; credentials: AWS.Credentials }
-  | { source: 'incorrectDefault'; credentials: AWS.Credentials; accountId: string; unusedPlugins: string[] }
+  | { source: 'correctDefault'; credentials: AwsCredentialIdentity }
+  | { source: 'plugin'; pluginName: string; credentials: AwsCredentialIdentity }
+  | {
+    source: 'incorrectDefault';
+    credentials: AwsCredentialIdentity;
+    accountId: string;
+    unusedPlugins: string[];
+  }
   | { source: 'none'; unusedPlugins: string[] };
 
 /**
@@ -549,7 +475,12 @@ type ObtainBaseCredentialsResult =
  * - No credentials are available at all
  * - Default credentials are for the wrong account
  */
-function fmtObtainCredentialsError(targetAccountId: string, obtainResult: ObtainBaseCredentialsResult & { source: 'none' | 'incorrectDefault' }): string {
+function fmtObtainCredentialsError(
+  targetAccountId: string,
+  obtainResult: ObtainBaseCredentialsResult & {
+    source: 'none' | 'incorrectDefault';
+  },
+): string {
   const msg = [`Need to perform AWS calls for account ${targetAccountId}`];
   switch (obtainResult.source) {
     case 'incorrectDefault':
@@ -573,8 +504,7 @@ function fmtObtainCredentialsError(targetAccountId: string, obtainResult: Obtain
  * - Default credentials for the wrong account
  * - Credentials returned from a plugin
  */
-function fmtObtainedCredentials(
-  obtainResult: Exclude<ObtainBaseCredentialsResult, { source: 'none' }>): string {
+function fmtObtainedCredentials(obtainResult: Exclude<ObtainBaseCredentialsResult, { source: 'none' }>): string {
   switch (obtainResult.source) {
     case 'correctDefault':
       return 'current credentials';
@@ -597,8 +527,7 @@ function fmtObtainedCredentials(
  * Instantiate an SDK for context providers. This function ensures that all
  * lookup assume role options are used when context providers perform lookups.
  */
-export async function initContextProviderSdk(aws: SdkProvider, options: cxschema.ContextLookupRoleOptions): Promise<ISDK> {
-
+export async function initContextProviderSdk(aws: SdkProvider, options: ContextLookupRoleOptions): Promise<SDK> {
   const account = options.account;
   const region = options.region;
 
@@ -608,5 +537,5 @@ export async function initContextProviderSdk(aws: SdkProvider, options: cxschema
     assumeRoleAdditionalOptions: options.assumeRoleAdditionalOptions,
   };
 
-  return (await aws.forEnvironment(cxapi.EnvironmentUtils.make(account, region), Mode.ForReading, creds)).sdk;
-}
\ No newline at end of file
+  return (await aws.forEnvironment(EnvironmentUtils.make(account, region), Mode.ForReading, creds)).sdk;
+}
diff --git a/packages/aws-cdk/lib/api/aws-auth/sdk.ts b/packages/aws-cdk/lib/api/aws-auth/sdk.ts
index 6a78965620c01..381d057e343e3 100644
--- a/packages/aws-cdk/lib/api/aws-auth/sdk.ts
+++ b/packages/aws-cdk/lib/api/aws-auth/sdk.ts
@@ -1,74 +1,297 @@
-import * as AWS from 'aws-sdk';
-import type { ConfigurationOptions } from 'aws-sdk/lib/config-base';
-import { debug, trace } from './_env';
+import {
+  GetSchemaCreationStatusCommand,
+  type GetSchemaCreationStatusCommandInput,
+  type GetSchemaCreationStatusCommandOutput,
+  type ListFunctionsCommandInput,
+  type StartSchemaCreationCommandInput,
+  type StartSchemaCreationCommandOutput,
+  type UpdateApiKeyCommandInput,
+  type UpdateApiKeyCommandOutput,
+  type UpdateFunctionCommandInput,
+  type UpdateFunctionCommandOutput,
+  type UpdateResolverCommandInput,
+  type UpdateResolverCommandOutput,
+  StartSchemaCreationCommand,
+  UpdateApiKeyCommand,
+  UpdateFunctionCommand,
+  UpdateResolverCommand,
+  AppSyncClient,
+  paginateListFunctions,
+  FunctionConfiguration,
+} from '@aws-sdk/client-appsync';
+import {
+  CloudFormationClient,
+  CreateChangeSetCommand,
+  CreateStackCommand,
+  type CreateChangeSetCommandInput,
+  type CreateChangeSetCommandOutput,
+  type CreateStackCommandInput,
+  type CreateStackCommandOutput,
+  type DeleteChangeSetCommandInput,
+  type DeleteChangeSetCommandOutput,
+  type DeleteStackCommandInput,
+  type DeleteStackCommandOutput,
+  type DescribeChangeSetCommandInput,
+  type DescribeChangeSetCommandOutput,
+  type DescribeStackEventsCommandInput,
+  type DescribeStacksCommandInput,
+  type DescribeStacksCommandOutput,
+  type ExecuteChangeSetCommandInput,
+  type ExecuteChangeSetCommandOutput,
+  type GetTemplateCommandInput,
+  type GetTemplateCommandOutput,
+  type ListExportsCommandInput,
+  type ListExportsCommandOutput,
+  type ListStackResourcesCommandInput,
+  type UpdateStackCommandInput,
+  type UpdateStackCommandOutput,
+  type UpdateTerminationProtectionCommandInput,
+  type UpdateTerminationProtectionCommandOutput,
+  DeleteChangeSetCommand,
+  DeleteStackCommand,
+  DescribeChangeSetCommand,
+  DescribeStackResourcesCommand,
+  DescribeStacksCommand,
+  ExecuteChangeSetCommand,
+  GetTemplateCommand,
+  ListExportsCommand,
+  UpdateStackCommand,
+  UpdateTerminationProtectionCommand,
+  type GetTemplateSummaryCommandInput,
+  type GetTemplateSummaryCommandOutput,
+  GetTemplateSummaryCommand,
+  type ListResourceScanResourcesCommandInput,
+  type ListResourceScanResourcesCommandOutput,
+  ListResourceScanResourcesCommand,
+  type DescribeResourceScanCommandInput,
+  type DescribeResourceScanCommandOutput,
+  DescribeResourceScanCommand,
+  DescribeGeneratedTemplateCommand,
+  type DescribeGeneratedTemplateCommandOutput,
+  type DescribeGeneratedTemplateCommandInput,
+  GetGeneratedTemplateCommand,
+  type GetGeneratedTemplateCommandOutput,
+  type GetGeneratedTemplateCommandInput,
+  CreateGeneratedTemplateCommand,
+  type CreateGeneratedTemplateCommandOutput,
+  type CreateGeneratedTemplateCommandInput,
+  DeleteGeneratedTemplateCommand,
+  type DeleteGeneratedTemplateCommandInput,
+  type DeleteGeneratedTemplateCommandOutput,
+  ListResourceScanRelatedResourcesCommand,
+  type ListResourceScanRelatedResourcesCommandInput,
+  type ListResourceScanRelatedResourcesCommandOutput,
+  StartResourceScanCommand,
+  type StartResourceScanCommandInput,
+  type StartResourceScanCommandOutput,
+  ListResourceScansCommand,
+  type ListResourceScansCommandInput,
+  type ListResourceScansCommandOutput,
+  paginateDescribeStackEvents,
+  paginateListStackResources,
+  StackEvent,
+  StackResourceSummary,
+  RollbackStackCommandInput,
+  RollbackStackCommandOutput,
+  RollbackStackCommand,
+  ContinueUpdateRollbackCommandInput,
+  ContinueUpdateRollbackCommandOutput,
+  ContinueUpdateRollbackCommand,
+} from '@aws-sdk/client-cloudformation';
+import {
+  CloudWatchLogsClient,
+  DescribeLogGroupsCommand,
+  FilterLogEventsCommandInput,
+  type DescribeLogGroupsCommandInput,
+  type DescribeLogGroupsCommandOutput,
+  FilterLogEventsCommandOutput,
+  FilterLogEventsCommand,
+} from '@aws-sdk/client-cloudwatch-logs';
+import {
+  CodeBuildClient,
+  type UpdateProjectCommandInput,
+  type UpdateProjectCommandOutput,
+  UpdateProjectCommand,
+} from '@aws-sdk/client-codebuild';
+import {
+  EC2Client,
+  type DescribeAvailabilityZonesCommandInput,
+  type DescribeAvailabilityZonesCommandOutput,
+  type DescribeImagesCommandInput,
+  type DescribeImagesCommandOutput,
+  type DescribeInstancesCommandInput,
+  type DescribeInstancesCommandOutput,
+  type DescribeRouteTablesCommandInput,
+  type DescribeRouteTablesCommandOutput,
+  type DescribeSecurityGroupsCommandInput,
+  type DescribeSecurityGroupsCommandOutput,
+  type DescribeSubnetsCommandInput,
+  type DescribeSubnetsCommandOutput,
+  type DescribeVpcEndpointServicesCommandInput,
+  type DescribeVpcEndpointServicesCommandOutput,
+  type DescribeVpcsCommandInput,
+  type DescribeVpcsCommandOutput,
+  type DescribeVpnGatewaysCommandInput,
+  type DescribeVpnGatewaysCommandOutput,
+  DescribeAvailabilityZonesCommand,
+  DescribeImagesCommand,
+  DescribeInstancesCommand,
+  DescribeRouteTablesCommand,
+  DescribeSecurityGroupsCommand,
+  DescribeSubnetsCommand,
+  DescribeVpcEndpointServicesCommand,
+  DescribeVpcsCommand,
+  DescribeVpnGatewaysCommand,
+} from '@aws-sdk/client-ec2';
+import {
+  type CreateRepositoryCommandInput,
+  type CreateRepositoryCommandOutput,
+  type DescribeImagesCommandInput as ECRDescribeImagesCommandInput,
+  type DescribeImagesCommandOutput as ECRDescribeImagesCommandOutput,
+  DescribeImagesCommand as ECRDescribeImagesCommand,
+  type DescribeRepositoriesCommandInput,
+  type DescribeRepositoriesCommandOutput,
+  type PutImageScanningConfigurationCommandInput,
+  type PutImageScanningConfigurationCommandOutput,
+  type GetAuthorizationTokenCommandInput,
+  type GetAuthorizationTokenCommandOutput,
+  ECRClient,
+  CreateRepositoryCommand,
+  DescribeRepositoriesCommand,
+  GetAuthorizationTokenCommand,
+  PutImageScanningConfigurationCommand,
+} from '@aws-sdk/client-ecr';
+import {
+  ECSClient,
+  ListClustersCommand,
+  RegisterTaskDefinitionCommandInput,
+  type ListClustersCommandInput,
+  type ListClustersCommandOutput,
+  type RegisterTaskDefinitionCommandOutput,
+  RegisterTaskDefinitionCommand,
+  type UpdateServiceCommandInput,
+  type UpdateServiceCommandOutput,
+  UpdateServiceCommand,
+  DescribeServicesCommandInput,
+  waitUntilServicesStable,
+} from '@aws-sdk/client-ecs';
+import {
+  ElasticLoadBalancingV2Client,
+  type DescribeListenersCommandInput,
+  type DescribeListenersCommandOutput,
+  type DescribeLoadBalancersCommandInput,
+  type DescribeLoadBalancersCommandOutput,
+  type DescribeTagsCommandInput,
+  type DescribeTagsCommandOutput,
+  DescribeListenersCommand,
+  DescribeLoadBalancersCommand,
+  DescribeTagsCommand,
+  paginateDescribeListeners,
+  paginateDescribeLoadBalancers,
+  LoadBalancer,
+  Listener,
+} from '@aws-sdk/client-elastic-load-balancing-v2';
+import {
+  IAMClient,
+  type CreatePolicyCommandInput,
+  type CreatePolicyCommandOutput,
+  type GetPolicyCommandInput,
+  type GetPolicyCommandOutput,
+  type GetRoleCommandInput,
+  type GetRoleCommandOutput,
+  CreatePolicyCommand,
+  GetPolicyCommand,
+  GetRoleCommand,
+} from '@aws-sdk/client-iam';
+import {
+  KMSClient,
+  type DescribeKeyCommandInput,
+  type DescribeKeyCommandOutput,
+  type ListAliasesCommandInput,
+  type ListAliasesCommandOutput,
+  DescribeKeyCommand,
+  ListAliasesCommand,
+} from '@aws-sdk/client-kms';
+import {
+  LambdaClient,
+  type InvokeCommandInput,
+  type InvokeCommandOutput,
+  InvokeCommand,
+  type UpdateFunctionCodeCommandInput,
+  type UpdateFunctionCodeCommandOutput,
+  type UpdateFunctionConfigurationCommandInput,
+  type UpdateFunctionConfigurationCommandOutput,
+  UpdateFunctionConfigurationCommand,
+  UpdateFunctionCodeCommand,
+  type PublishVersionCommandInput,
+  type PublishVersionCommandOutput,
+  PublishVersionCommand,
+  type UpdateAliasCommandInput,
+  type UpdateAliasCommandOutput,
+  UpdateAliasCommand,
+  waitUntilFunctionUpdated,
+} from '@aws-sdk/client-lambda';
+import {
+  Route53Client,
+  type GetHostedZoneCommandInput,
+  type GetHostedZoneCommandOutput,
+  type ListHostedZonesByNameCommandInput,
+  type ListHostedZonesByNameCommandOutput,
+  type ListHostedZonesCommandInput,
+  type ListHostedZonesCommandOutput,
+  GetHostedZoneCommand,
+  ListHostedZonesCommand,
+  ListHostedZonesByNameCommand,
+} from '@aws-sdk/client-route-53';
+import {
+  type CompleteMultipartUploadCommandOutput,
+  type GetBucketEncryptionCommandInput,
+  type GetBucketEncryptionCommandOutput,
+  GetBucketLocationCommand,
+  type GetBucketLocationCommandInput,
+  type GetBucketLocationCommandOutput,
+  type GetObjectCommandInput,
+  type GetObjectCommandOutput,
+  ListObjectsV2Command,
+  type ListObjectsV2CommandInput,
+  type ListObjectsV2CommandOutput,
+  type PutObjectCommandInput,
+  S3Client,
+  GetBucketEncryptionCommand,
+  GetObjectCommand,
+} from '@aws-sdk/client-s3';
+import {
+  SecretsManagerClient,
+  type GetSecretValueCommandInput,
+  type GetSecretValueCommandOutput,
+  GetSecretValueCommand,
+} from '@aws-sdk/client-secrets-manager';
+import {
+  SFNClient,
+  UpdateStateMachineCommandInput,
+  UpdateStateMachineCommandOutput,
+  UpdateStateMachineCommand,
+} from '@aws-sdk/client-sfn';
+import {
+  SSMClient,
+  type GetParameterCommandInput,
+  type GetParameterCommandOutput,
+  GetParameterCommand,
+} from '@aws-sdk/client-ssm';
+import { GetCallerIdentityCommand, STSClient } from '@aws-sdk/client-sts';
+import { Upload } from '@aws-sdk/lib-storage';
+import { getEndpointFromInstructions } from '@smithy/middleware-endpoint';
+import type { NodeHttpHandlerOptions } from '@smithy/node-http-handler';
+import { AwsCredentialIdentity, Logger } from '@smithy/types';
+import { ConfiguredRetryStrategy } from '@smithy/util-retry';
+import { WaiterResult } from '@smithy/util-waiter';
 import { AccountAccessKeyCache } from './account-cache';
 import { cached } from './cached';
 import { Account } from './sdk-provider';
+import { defaultCliUserAgent } from './user-agent';
+import { debug } from '../../logging';
 import { traceMethods } from '../../util/tracing';
 
-// We need to map regions to domain suffixes, and the SDK already has a function to do this.
-// It's not part of the public API, but it's also unlikely to go away.
-//
-// Reuse that function, and add a safety check, so we don't accidentally break if they ever
-// refactor that away.
-
-/* eslint-disable @typescript-eslint/no-require-imports */
-const regionUtil = require('aws-sdk/lib/region_config');
-require('aws-sdk/lib/maintenance_mode_message').suppress = true;
-/* eslint-enable @typescript-eslint/no-require-imports */
-
-if (!regionUtil.getEndpointSuffix) {
-  throw new Error('This version of AWS SDK for JS does not have the \'getEndpointSuffix\' function!');
-}
-
-export interface ISDK {
-  /**
-   * The region this SDK has been instantiated for
-   *
-   * (As distinct from the `defaultRegion()` on SdkProvider which
-   * represents the region configured in the default config).
-   */
-  readonly currentRegion: string;
-
-  /**
-   * The Account this SDK has been instantiated for
-   *
-   * (As distinct from the `defaultAccount()` on SdkProvider which
-   * represents the account available by using default credentials).
-   */
-  currentAccount(): Promise<Account>;
-
-  getEndpointSuffix(region: string): string;
-
-  /**
-   * Appends the given string as the extra information to put into the User-Agent header for any requests invoked by this SDK.
-   * If the string is 'undefined', this method has no effect.
-   */
-  appendCustomUserAgent(userAgentData?: string): void;
-
-  /**
-   * Removes the given string from the extra User-Agent header data used for requests invoked by this SDK.
-   */
-  removeCustomUserAgent(userAgentData: string): void;
-
-  lambda(): AWS.Lambda;
-  cloudFormation(): AWS.CloudFormation;
-  ec2(): AWS.EC2;
-  iam(): AWS.IAM;
-  ssm(): AWS.SSM;
-  s3(): AWS.S3;
-  route53(): AWS.Route53;
-  ecr(): AWS.ECR;
-  ecs(): AWS.ECS;
-  elbv2(): AWS.ELBv2;
-  secretsManager(): AWS.SecretsManager;
-  kms(): AWS.KMS;
-  stepFunctions(): AWS.StepFunctions;
-  codeBuild(): AWS.CodeBuild;
-  cloudWatchLogs(): AWS.CloudWatchLogs;
-  appsync(): AWS.AppSync;
-}
-
 /**
  * Additional SDK configuration options
  */
@@ -81,34 +304,186 @@ export interface SdkOptions {
   readonly assumeRoleCredentialsSourceDescription?: string;
 }
 
+// TODO: still some cleanup here. Make the pagination functions do all the work here instead of in individual packages.
+// Also add async/await. Does that actually matter in this context? Find out and update accordingly.
+
+// Also add notes to the PR about why you imported everything individually and used 'type' so reviewers don't have to ask.
+
+export interface ConfigurationOptions {
+  region: string;
+  credentials: AwsCredentialIdentity;
+  requestHandler: NodeHttpHandlerOptions;
+  retryStrategy: ConfiguredRetryStrategy;
+  customUserAgent: string;
+  logger?: Logger;
+}
+
+export interface IAppSyncClient {
+  getSchemaCreationStatus(input: GetSchemaCreationStatusCommandInput): Promise<GetSchemaCreationStatusCommandOutput>;
+  startSchemaCreation(input: StartSchemaCreationCommandInput): Promise<StartSchemaCreationCommandOutput>;
+  updateApiKey(input: UpdateApiKeyCommandInput): Promise<UpdateApiKeyCommandOutput>;
+  updateFunction(input: UpdateFunctionCommandInput): Promise<UpdateFunctionCommandOutput>;
+  updateResolver(input: UpdateResolverCommandInput): Promise<UpdateResolverCommandOutput>;
+  // Pagination functions
+  listFunctions(input: ListFunctionsCommandInput): Promise<FunctionConfiguration[]>;
+}
+
+export interface ICloudFormationClient {
+  continueUpdateRollback(input: ContinueUpdateRollbackCommandInput): Promise<ContinueUpdateRollbackCommandOutput>;
+  createChangeSet(input: CreateChangeSetCommandInput): Promise<CreateChangeSetCommandOutput>;
+  createGeneratedTemplate(input: CreateGeneratedTemplateCommandInput): Promise<CreateGeneratedTemplateCommandOutput>;
+  createStack(input: CreateStackCommandInput): Promise<CreateStackCommandOutput>;
+  deleteChangeSet(input: DeleteChangeSetCommandInput): Promise<DeleteChangeSetCommandOutput>;
+  deleteGeneratedTemplate(input: DeleteGeneratedTemplateCommandInput): Promise<DeleteGeneratedTemplateCommandOutput>;
+  deleteStack(input: DeleteStackCommandInput): Promise<DeleteStackCommandOutput>;
+  describeChangeSet(input: DescribeChangeSetCommandInput): Promise<DescribeChangeSetCommandOutput>;
+  describeGeneratedTemplate(
+    input: DescribeGeneratedTemplateCommandInput,
+  ): Promise<DescribeGeneratedTemplateCommandOutput>;
+  describeResourceScan(input: DescribeResourceScanCommandInput): Promise<DescribeResourceScanCommandOutput>;
+  describeStacks(input: DescribeStacksCommandInput): Promise<DescribeStacksCommandOutput>;
+  executeChangeSet(input: ExecuteChangeSetCommandInput): Promise<ExecuteChangeSetCommandOutput>;
+  getGeneratedTemplate(input: GetGeneratedTemplateCommandInput): Promise<GetGeneratedTemplateCommandOutput>;
+  getTemplate(input: GetTemplateCommandInput): Promise<GetTemplateCommandOutput>;
+  getTemplateSummary(input: GetTemplateSummaryCommandInput): Promise<GetTemplateSummaryCommandOutput>;
+  listExports(input: ListExportsCommandInput): Promise<ListExportsCommandOutput>;
+  listResourceScanRelatedResources(
+    input: ListResourceScanRelatedResourcesCommandInput,
+  ): Promise<ListResourceScanRelatedResourcesCommandOutput>;
+  listResourceScanResources(
+    input: ListResourceScanResourcesCommandInput,
+  ): Promise<ListResourceScanResourcesCommandOutput>;
+  listResourceScans(input?: ListResourceScansCommandInput): Promise<ListResourceScansCommandOutput>;
+  rollbackStack(input: RollbackStackCommandInput): Promise<RollbackStackCommandOutput>;
+  startResourceScan(input: StartResourceScanCommandInput): Promise<StartResourceScanCommandOutput>;
+  updateStack(input: UpdateStackCommandInput): Promise<UpdateStackCommandOutput>;
+  updateTerminationProtection(
+    input: UpdateTerminationProtectionCommandInput,
+  ): Promise<UpdateTerminationProtectionCommandOutput>;
+  // Pagination functions
+  describeStackEvents(input: DescribeStackEventsCommandInput): Promise<StackEvent[]>;
+  listStackResources(input: ListStackResourcesCommandInput): Promise<StackResourceSummary[]>;
+}
+
+export interface ICloudWatchLogsClient {
+  describeLogGroups(input: DescribeLogGroupsCommandInput): Promise<DescribeLogGroupsCommandOutput>;
+  filterLogEvents(input: FilterLogEventsCommandInput): Promise<FilterLogEventsCommandOutput>;
+}
+
+export interface ICodeBuildClient {
+  updateProject(input: UpdateProjectCommandInput): Promise<UpdateProjectCommandOutput>;
+}
+export interface IEC2Client {
+  describeAvailabilityZones(
+    input: DescribeAvailabilityZonesCommandInput,
+  ): Promise<DescribeAvailabilityZonesCommandOutput>;
+  describeImages(input: DescribeImagesCommandInput): Promise<DescribeImagesCommandOutput>;
+  describeInstances(input: DescribeInstancesCommandInput): Promise<DescribeInstancesCommandOutput>;
+  describeRouteTables(input: DescribeRouteTablesCommandInput): Promise<DescribeRouteTablesCommandOutput>;
+  describeSecurityGroups(input: DescribeSecurityGroupsCommandInput): Promise<DescribeSecurityGroupsCommandOutput>;
+  describeSubnets(input: DescribeSubnetsCommandInput): Promise<DescribeSubnetsCommandOutput>;
+  describeVpcEndpointServices(
+    input: DescribeVpcEndpointServicesCommandInput,
+  ): Promise<DescribeVpcEndpointServicesCommandOutput>;
+  describeVpcs(input: DescribeVpcsCommandInput): Promise<DescribeVpcsCommandOutput>;
+  describeVpnGateways(input: DescribeVpnGatewaysCommandInput): Promise<DescribeVpnGatewaysCommandOutput>;
+}
+
+export interface IECRClient {
+  createRepository(input: CreateRepositoryCommandInput): Promise<CreateRepositoryCommandOutput>;
+  describeImages(input: ECRDescribeImagesCommandInput): Promise<ECRDescribeImagesCommandOutput>;
+  describeRepositories(input: DescribeRepositoriesCommandInput): Promise<DescribeRepositoriesCommandOutput>;
+  getAuthorizationToken(input: GetAuthorizationTokenCommandInput): Promise<GetAuthorizationTokenCommandOutput>;
+  putImageScanningConfiguration(
+    input: PutImageScanningConfigurationCommandInput,
+  ): Promise<PutImageScanningConfigurationCommandOutput>;
+}
+
+export interface IECSClient {
+  listClusters(input: ListClustersCommandInput): Promise<ListClustersCommandOutput>;
+  registerTaskDefinition(input: RegisterTaskDefinitionCommandInput): Promise<RegisterTaskDefinitionCommandOutput>;
+  updateService(input: UpdateServiceCommandInput): Promise<UpdateServiceCommandOutput>;
+  // Waiters
+  waitUntilServicesStable(input: DescribeServicesCommandInput): Promise<WaiterResult>;
+}
+
+export interface IElasticLoadBalancingV2Client {
+  describeListeners(input: DescribeListenersCommandInput): Promise<DescribeListenersCommandOutput>;
+  describeLoadBalancers(input: DescribeLoadBalancersCommandInput): Promise<DescribeLoadBalancersCommandOutput>;
+  describeTags(input: DescribeTagsCommandInput): Promise<DescribeTagsCommandOutput>;
+  // Pagination
+  paginateDescribeListeners(input: DescribeListenersCommandInput): Promise<Listener[]>;
+  paginateDescribeLoadBalancers(input: DescribeLoadBalancersCommandInput): Promise<LoadBalancer[]>;
+}
+
+export interface IIAMClient {
+  createPolicy(input: CreatePolicyCommandInput): Promise<CreatePolicyCommandOutput>;
+  getPolicy(input: GetPolicyCommandInput): Promise<GetPolicyCommandOutput>;
+  getRole(input: GetRoleCommandInput): Promise<GetRoleCommandOutput>;
+}
+
+export interface IKMSClient {
+  describeKey(input: DescribeKeyCommandInput): Promise<DescribeKeyCommandOutput>;
+  listAliases(input: ListAliasesCommandInput): Promise<ListAliasesCommandOutput>;
+}
+
+export interface ILambdaClient {
+  invokeCommand(input: InvokeCommandInput): Promise<InvokeCommandOutput>;
+  publishVersion(input: PublishVersionCommandInput): Promise<PublishVersionCommandOutput>;
+  updateAlias(input: UpdateAliasCommandInput): Promise<UpdateAliasCommandOutput>;
+  updateFunctionCode(input: UpdateFunctionCodeCommandInput): Promise<UpdateFunctionCodeCommandOutput>;
+  updateFunctionConfiguration(
+    input: UpdateFunctionConfigurationCommandInput,
+  ): Promise<UpdateFunctionConfigurationCommandOutput>;
+  // Waiters
+  waitUntilFunctionUpdated(delaySeconds: number, input: UpdateFunctionConfigurationCommandInput): Promise<WaiterResult>;
+}
+
+export interface IRoute53Client {
+  getHostedZone(input: GetHostedZoneCommandInput): Promise<GetHostedZoneCommandOutput>;
+  listHostedZones(input: ListHostedZonesCommandInput): Promise<ListHostedZonesCommandOutput>;
+  listHostedZonesByName(input: ListHostedZonesByNameCommandInput): Promise<ListHostedZonesByNameCommandOutput>;
+}
+
+export interface IS3Client {
+  getBucketEncryption(input: GetBucketEncryptionCommandInput): Promise<GetBucketEncryptionCommandOutput>;
+  getBucketLocation(input: GetBucketLocationCommandInput): Promise<GetBucketLocationCommandOutput>;
+  getObject(input: GetObjectCommandInput): Promise<GetObjectCommandOutput>;
+  listObjectsV2(input: ListObjectsV2CommandInput): Promise<ListObjectsV2CommandOutput>;
+  upload(input: PutObjectCommandInput): Promise<CompleteMultipartUploadCommandOutput>;
+}
+
+export interface ISecretsManagerClient {
+  getSecretValue(input: GetSecretValueCommandInput): Promise<GetSecretValueCommandOutput>;
+}
+
+export interface ISSMClient {
+  getParameter(input: GetParameterCommandInput): Promise<GetParameterCommandOutput>;
+}
+
+export interface IStepFunctionsClient {
+  // listStateMachines(input: ListStateMachinesCommandInput): Promise<ListStateMachinesCommandOutput>;
+  updateStateMachine(input: UpdateStateMachineCommandInput): Promise<UpdateStateMachineCommandOutput>;
+}
+
 /**
  * Base functionality of SDK without credential fetching
  */
 @traceMethods
-export class SDK implements ISDK {
+export class SDK {
   private static readonly accountCache = new AccountAccessKeyCache();
 
   public readonly currentRegion: string;
 
-  private readonly config: ConfigurationOptions;
-
-  /**
-   * Default retry options for SDK clients.
-   */
-  private readonly retryOptions = { maxRetries: 6, retryDelayOptions: { base: 300 } };
-
-  /**
-   * The more generous retry policy for CloudFormation, which has a 1 TPM limit on certain APIs,
-   * which are abundantly used for deployment tracking, ...
-   *
-   * So we're allowing way more retries, but waiting a bit more.
-   */
-  private readonly cloudFormationRetryOptions = { maxRetries: 10, retryDelayOptions: { base: 1_000 } };
+  public readonly config: ConfigurationOptions;
 
   /**
    * STS is used to check credential validity, don't do too many retries.
    */
-  private readonly stsRetryOptions = { maxRetries: 3, retryDelayOptions: { base: 100 } };
+  private readonly stsRetryOptions = {
+    maxRetries: 3,
+    retryDelayOptions: { base: 100 },
+  };
 
   /**
    * Whether we have proof that the credentials have not expired
@@ -120,17 +495,17 @@ export class SDK implements ISDK {
   private _credentialsValidated = false;
 
   constructor(
-    private readonly _credentials: AWS.Credentials,
+    private readonly _credentials: AwsCredentialIdentity,
     region: string,
-    httpOptions: ConfigurationOptions = {},
-    private readonly sdkOptions: SdkOptions = {}) {
-
+    requestHandler: NodeHttpHandlerOptions,
+    private readonly sdkOptions: SdkOptions = {},
+  ) {
     this.config = {
-      ...httpOptions,
-      ...this.retryOptions,
-      credentials: _credentials,
       region,
-      logger: { log: (...messages) => messages.forEach(m => trace('%s', m)) },
+      credentials: _credentials,
+      requestHandler,
+      retryStrategy: new ConfiguredRetryStrategy(7, (attempt) => attempt ** 300),
+      customUserAgent: defaultCliUserAgent(),
     };
     this.currentRegion = region;
   }
@@ -141,141 +516,387 @@ export class SDK implements ISDK {
     }
 
     const currentCustomUserAgent = this.config.customUserAgent;
-    this.config.customUserAgent = currentCustomUserAgent
-      ? `${currentCustomUserAgent} ${userAgentData}`
-      : userAgentData;
+    this.config.customUserAgent = currentCustomUserAgent ? `${currentCustomUserAgent} ${userAgentData}` : userAgentData;
   }
 
   public removeCustomUserAgent(userAgentData: string): void {
     this.config.customUserAgent = this.config.customUserAgent?.replace(userAgentData, '');
   }
 
-  public lambda(): AWS.Lambda {
-    return this.wrapServiceErrorHandling(new AWS.Lambda(this.config));
+  public appsync(): IAppSyncClient {
+    const client = new AppSyncClient(this.config);
+    return {
+      getSchemaCreationStatus: (
+        input: GetSchemaCreationStatusCommandInput,
+      ): Promise<GetSchemaCreationStatusCommandOutput> => client.send(new GetSchemaCreationStatusCommand(input)),
+      startSchemaCreation: (input: StartSchemaCreationCommandInput): Promise<StartSchemaCreationCommandOutput> =>
+        client.send(new StartSchemaCreationCommand(input)),
+      updateApiKey: (input: UpdateApiKeyCommandInput): Promise<UpdateApiKeyCommandOutput> =>
+        client.send(new UpdateApiKeyCommand(input)),
+      updateFunction: (input: UpdateFunctionCommandInput): Promise<UpdateFunctionCommandOutput> =>
+        client.send(new UpdateFunctionCommand(input)),
+      updateResolver: (input: UpdateResolverCommandInput): Promise<UpdateResolverCommandOutput> =>
+        client.send(new UpdateResolverCommand(input)),
+
+      // Pagination Functions
+      listFunctions: async (input: ListFunctionsCommandInput): Promise<FunctionConfiguration[]> => {
+        const functions = Array<FunctionConfiguration>();
+        const paginator = paginateListFunctions({ client }, input);
+        for await (const page of paginator) {
+          functions.push(...(page.functions || []));
+        }
+        return functions;
+      },
+    };
   }
 
-  public cloudFormation(): AWS.CloudFormation {
-    return this.wrapServiceErrorHandling(new AWS.CloudFormation({
+  public cloudFormation(): ICloudFormationClient {
+    const client = new CloudFormationClient({
       ...this.config,
-      ...this.cloudFormationRetryOptions,
-    }));
+      retryStrategy: new ConfiguredRetryStrategy(11, (attempt: number) => attempt ** 1000),
+    });
+    return {
+      continueUpdateRollback: async (
+        input: ContinueUpdateRollbackCommandInput,
+      ): Promise<ContinueUpdateRollbackCommandOutput> => client.send(new ContinueUpdateRollbackCommand(input)),
+      createChangeSet: (input: CreateChangeSetCommandInput): Promise<CreateChangeSetCommandOutput> =>
+        client.send(new CreateChangeSetCommand(input)),
+      createGeneratedTemplate: (
+        input: CreateGeneratedTemplateCommandInput,
+      ): Promise<CreateGeneratedTemplateCommandOutput> => client.send(new CreateGeneratedTemplateCommand(input)),
+      createStack: (input: CreateStackCommandInput): Promise<CreateStackCommandOutput> =>
+        client.send(new CreateStackCommand(input)),
+      deleteChangeSet: (input: DeleteChangeSetCommandInput): Promise<DeleteChangeSetCommandOutput> =>
+        client.send(new DeleteChangeSetCommand(input)),
+      deleteGeneratedTemplate: (
+        input: DeleteGeneratedTemplateCommandInput,
+      ): Promise<DeleteGeneratedTemplateCommandOutput> => client.send(new DeleteGeneratedTemplateCommand(input)),
+      deleteStack: (input: DeleteStackCommandInput): Promise<DeleteStackCommandOutput> =>
+        client.send(new DeleteStackCommand(input)),
+      describeChangeSet: (input: DescribeChangeSetCommandInput): Promise<DescribeChangeSetCommandOutput> =>
+        client.send(new DescribeChangeSetCommand(input)),
+      describeGeneratedTemplate: (
+        input: DescribeGeneratedTemplateCommandInput,
+      ): Promise<DescribeGeneratedTemplateCommandOutput> => client.send(new DescribeGeneratedTemplateCommand(input)),
+      describeResourceScan: (input: DescribeResourceScanCommandInput): Promise<DescribeResourceScanCommandOutput> =>
+        client.send(new DescribeResourceScanCommand(input)),
+      describeStacks: (input: DescribeStacksCommandInput): Promise<DescribeStacksCommandOutput> =>
+        client.send(new DescribeStacksCommand(input)),
+      executeChangeSet: (input: ExecuteChangeSetCommandInput): Promise<ExecuteChangeSetCommandOutput> =>
+        client.send(new ExecuteChangeSetCommand(input)),
+      getGeneratedTemplate: (input: GetGeneratedTemplateCommandInput): Promise<GetGeneratedTemplateCommandOutput> =>
+        client.send(new GetGeneratedTemplateCommand(input)),
+      getTemplate: (input: GetTemplateCommandInput): Promise<GetTemplateCommandOutput> =>
+        client.send(new GetTemplateCommand(input)),
+      getTemplateSummary: (input: GetTemplateSummaryCommandInput): Promise<GetTemplateSummaryCommandOutput> =>
+        client.send(new GetTemplateSummaryCommand(input)),
+      listExports: (input: ListExportsCommandInput): Promise<ListExportsCommandOutput> =>
+        client.send(new ListExportsCommand(input)),
+      listResourceScanRelatedResources: (
+        input: ListResourceScanRelatedResourcesCommandInput,
+      ): Promise<ListResourceScanRelatedResourcesCommandOutput> =>
+        client.send(new ListResourceScanRelatedResourcesCommand(input)),
+      listResourceScanResources: (
+        input: ListResourceScanResourcesCommandInput,
+      ): Promise<ListResourceScanResourcesCommandOutput> => client.send(new ListResourceScanResourcesCommand(input)),
+      listResourceScans: (input: ListResourceScansCommandInput): Promise<ListResourceScansCommandOutput> =>
+        client.send(new ListResourceScansCommand(input)),
+      rollbackStack: (input: RollbackStackCommandInput): Promise<RollbackStackCommandOutput> =>
+        client.send(new RollbackStackCommand(input)),
+      startResourceScan: (input: StartResourceScanCommandInput): Promise<StartResourceScanCommandOutput> =>
+        client.send(new StartResourceScanCommand(input)),
+      updateStack: (input: UpdateStackCommandInput): Promise<UpdateStackCommandOutput> =>
+        client.send(new UpdateStackCommand(input)),
+      updateTerminationProtection: (
+        input: UpdateTerminationProtectionCommandInput,
+      ): Promise<UpdateTerminationProtectionCommandOutput> =>
+        client.send(new UpdateTerminationProtectionCommand(input)),
+      describeStackEvents: async (input: DescribeStackEventsCommandInput): Promise<StackEvent[]> => {
+        const stackEvents = Array<StackEvent>();
+        const paginator = paginateDescribeStackEvents({ client }, input);
+        for await (const page of paginator) {
+          stackEvents.push(...(page?.StackEvents || []));
+        }
+        return stackEvents;
+      },
+      listStackResources: async (input: ListStackResourcesCommandInput): Promise<StackResourceSummary[]> => {
+        const stackResources = Array<StackResourceSummary>();
+        const paginator = paginateListStackResources({ client }, input);
+        for await (const page of paginator) {
+          stackResources.push(...(page?.StackResourceSummaries || []));
+        }
+        return stackResources;
+      },
+    };
   }
 
-  public ec2(): AWS.EC2 {
-    return this.wrapServiceErrorHandling(new AWS.EC2(this.config));
+  public cloudWatchLogs(): ICloudWatchLogsClient {
+    const client = new CloudWatchLogsClient(this.config);
+    return {
+      describeLogGroups: (input: DescribeLogGroupsCommandInput): Promise<DescribeLogGroupsCommandOutput> =>
+        client.send(new DescribeLogGroupsCommand(input)),
+      filterLogEvents: (input: FilterLogEventsCommandInput): Promise<FilterLogEventsCommandOutput> =>
+        client.send(new FilterLogEventsCommand(input)),
+    };
   }
 
-  public iam(): AWS.IAM {
-    return this.wrapServiceErrorHandling(new AWS.IAM(this.config));
+  public codeBuild(): ICodeBuildClient {
+    const client = this.wrapServiceErrorHandling(new CodeBuildClient(this.config));
+    return {
+      updateProject: (input: UpdateProjectCommandInput): Promise<UpdateProjectCommandOutput> =>
+        client.send(new UpdateProjectCommand(input)),
+    };
   }
 
-  public ssm(): AWS.SSM {
-    return this.wrapServiceErrorHandling(new AWS.SSM(this.config));
+  public ec2(): IEC2Client {
+    const client = this.wrapServiceErrorHandling(new EC2Client(this.config));
+    return {
+      describeAvailabilityZones: (
+        input: DescribeAvailabilityZonesCommandInput,
+      ): Promise<DescribeAvailabilityZonesCommandOutput> => client.send(new DescribeAvailabilityZonesCommand(input)),
+      describeImages: (input: DescribeImagesCommandInput): Promise<DescribeImagesCommandOutput> =>
+        client.send(new DescribeImagesCommand(input)),
+      describeInstances: (input: DescribeInstancesCommandInput): Promise<DescribeInstancesCommandOutput> =>
+        client.send(new DescribeInstancesCommand(input)),
+      describeRouteTables: (input: DescribeRouteTablesCommandInput): Promise<DescribeRouteTablesCommandOutput> =>
+        client.send(new DescribeRouteTablesCommand(input)),
+      describeSecurityGroups: (
+        input: DescribeSecurityGroupsCommandInput,
+      ): Promise<DescribeSecurityGroupsCommandOutput> => client.send(new DescribeSecurityGroupsCommand(input)),
+      describeSubnets: (input: DescribeSubnetsCommandInput): Promise<DescribeSubnetsCommandOutput> =>
+        client.send(new DescribeSubnetsCommand(input)),
+      describeVpcEndpointServices: (
+        input: DescribeVpcEndpointServicesCommandInput,
+      ): Promise<DescribeVpcEndpointServicesCommandOutput> =>
+        client.send(new DescribeVpcEndpointServicesCommand(input)),
+      describeVpcs: (input: DescribeVpcsCommandInput): Promise<DescribeVpcsCommandOutput> =>
+        client.send(new DescribeVpcsCommand(input)),
+      describeVpnGateways: (input: DescribeVpnGatewaysCommandInput): Promise<DescribeVpnGatewaysCommandOutput> =>
+        client.send(new DescribeVpnGatewaysCommand(input)),
+    };
   }
 
-  public s3(): AWS.S3 {
-    return this.wrapServiceErrorHandling(new AWS.S3(this.config));
+  public ecr(): IECRClient {
+    const client = this.wrapServiceErrorHandling(new ECRClient(this.config));
+    return {
+      createRepository: (input: CreateRepositoryCommandInput): Promise<CreateRepositoryCommandOutput> =>
+        client.send(new CreateRepositoryCommand(input)),
+      describeImages: (input: ECRDescribeImagesCommandInput): Promise<ECRDescribeImagesCommandOutput> =>
+        client.send(new ECRDescribeImagesCommand(input)),
+      describeRepositories: (input: DescribeRepositoriesCommandInput): Promise<DescribeRepositoriesCommandOutput> =>
+        client.send(new DescribeRepositoriesCommand(input)),
+      getAuthorizationToken: (input: GetAuthorizationTokenCommandInput): Promise<GetAuthorizationTokenCommandOutput> =>
+        client.send(new GetAuthorizationTokenCommand(input)),
+      putImageScanningConfiguration: (
+        input: PutImageScanningConfigurationCommandInput,
+      ): Promise<PutImageScanningConfigurationCommandOutput> =>
+        client.send(new PutImageScanningConfigurationCommand(input)),
+    };
   }
 
-  public route53(): AWS.Route53 {
-    return this.wrapServiceErrorHandling(new AWS.Route53(this.config));
+  public ecs(): IECSClient {
+    const client = this.wrapServiceErrorHandling(new ECSClient(this.config));
+    return {
+      listClusters: (input: ListClustersCommandInput): Promise<ListClustersCommandOutput> =>
+        client.send(new ListClustersCommand(input)),
+      registerTaskDefinition: (
+        input: RegisterTaskDefinitionCommandInput,
+      ): Promise<RegisterTaskDefinitionCommandOutput> => client.send(new RegisterTaskDefinitionCommand(input)),
+      updateService: (input: UpdateServiceCommandInput): Promise<UpdateServiceCommandOutput> =>
+        client.send(new UpdateServiceCommand(input)),
+      // Waiters
+      waitUntilServicesStable: (input: DescribeServicesCommandInput): Promise<WaiterResult> => {
+        return waitUntilServicesStable(
+          {
+            client,
+            maxWaitTime: 600,
+            minDelay: 6,
+            maxDelay: 6,
+          },
+          input,
+        );
+      },
+    };
   }
 
-  public ecr(): AWS.ECR {
-    return this.wrapServiceErrorHandling(new AWS.ECR(this.config));
+  public elbv2(): IElasticLoadBalancingV2Client {
+    const client = this.wrapServiceErrorHandling(new ElasticLoadBalancingV2Client(this.config));
+    return {
+      describeListeners: (input: DescribeListenersCommandInput): Promise<DescribeListenersCommandOutput> =>
+        client.send(new DescribeListenersCommand(input)),
+      describeLoadBalancers: (input: DescribeLoadBalancersCommandInput): Promise<DescribeLoadBalancersCommandOutput> =>
+        client.send(new DescribeLoadBalancersCommand(input)),
+      describeTags: (input: DescribeTagsCommandInput): Promise<DescribeTagsCommandOutput> =>
+        client.send(new DescribeTagsCommand(input)),
+      // Pagination Functions
+      paginateDescribeListeners: async (input: DescribeListenersCommandInput): Promise<Listener[]> => {
+        const listeners = Array<Listener>();
+        const paginator = paginateDescribeListeners({ client }, input);
+        for await (const page of paginator) {
+          listeners.push(...(page?.Listeners || []));
+        }
+        return listeners;
+      },
+      paginateDescribeLoadBalancers: async (input: DescribeLoadBalancersCommandInput): Promise<LoadBalancer[]> => {
+        const loadBalancers = Array<LoadBalancer>();
+        const paginator = paginateDescribeLoadBalancers({ client }, input);
+        for await (const page of paginator) {
+          loadBalancers.push(...(page?.LoadBalancers || []));
+        }
+        return loadBalancers;
+      },
+    };
   }
 
-  public ecs(): AWS.ECS {
-    return this.wrapServiceErrorHandling(new AWS.ECS(this.config));
+  public iam(): IIAMClient {
+    const client = this.wrapServiceErrorHandling(new IAMClient(this.config));
+    return {
+      createPolicy: (input: CreatePolicyCommandInput): Promise<CreatePolicyCommandOutput> =>
+        client.send(new CreatePolicyCommand(input)),
+      getPolicy: (input: GetPolicyCommandInput): Promise<GetPolicyCommandOutput> =>
+        client.send(new GetPolicyCommand(input)),
+      getRole: (input: GetRoleCommandInput): Promise<GetRoleCommandOutput> => client.send(new GetRoleCommand(input)),
+    };
   }
 
-  public elbv2(): AWS.ELBv2 {
-    return this.wrapServiceErrorHandling(new AWS.ELBv2(this.config));
+  public kms(): IKMSClient {
+    const client = this.wrapServiceErrorHandling(new KMSClient(this.config));
+    return {
+      describeKey: (input: DescribeKeyCommandInput): Promise<DescribeKeyCommandOutput> =>
+        client.send(new DescribeKeyCommand(input)),
+      listAliases: (input: ListAliasesCommandInput): Promise<ListAliasesCommandOutput> =>
+        client.send(new ListAliasesCommand(input)),
+    };
   }
 
-  public secretsManager(): AWS.SecretsManager {
-    return this.wrapServiceErrorHandling(new AWS.SecretsManager(this.config));
+  public lambda(): ILambdaClient {
+    const client = this.wrapServiceErrorHandling(new LambdaClient(this.config));
+    return {
+      invokeCommand: (input: InvokeCommandInput): Promise<InvokeCommandOutput> => client.send(new InvokeCommand(input)),
+      publishVersion: (input: PublishVersionCommandInput): Promise<PublishVersionCommandOutput> =>
+        client.send(new PublishVersionCommand(input)),
+      updateAlias: (input: UpdateAliasCommandInput): Promise<UpdateAliasCommandOutput> =>
+        client.send(new UpdateAliasCommand(input)),
+      updateFunctionCode: (input: UpdateFunctionCodeCommandInput): Promise<UpdateFunctionCodeCommandOutput> =>
+        client.send(new UpdateFunctionCodeCommand(input)),
+      updateFunctionConfiguration: (
+        input: UpdateFunctionConfigurationCommandInput,
+      ): Promise<UpdateFunctionConfigurationCommandOutput> =>
+        client.send(new UpdateFunctionConfigurationCommand(input)),
+      // Waiters
+      waitUntilFunctionUpdated: (
+        delaySeconds: number,
+        input: UpdateFunctionConfigurationCommandInput,
+      ): Promise<WaiterResult> => {
+        return waitUntilFunctionUpdated(
+          {
+            client,
+            maxDelay: delaySeconds,
+            minDelay: delaySeconds,
+            maxWaitTime: delaySeconds * 60,
+          },
+          input,
+        );
+      },
+    };
   }
 
-  public kms(): AWS.KMS {
-    return this.wrapServiceErrorHandling(new AWS.KMS(this.config));
+  public route53(): IRoute53Client {
+    const client = this.wrapServiceErrorHandling(new Route53Client(this.config));
+    return {
+      getHostedZone: (input: GetHostedZoneCommandInput): Promise<GetHostedZoneCommandOutput> =>
+        client.send(new GetHostedZoneCommand(input)),
+      listHostedZones: (input: ListHostedZonesCommandInput): Promise<ListHostedZonesCommandOutput> =>
+        client.send(new ListHostedZonesCommand(input)),
+      listHostedZonesByName: (input: ListHostedZonesByNameCommandInput): Promise<ListHostedZonesByNameCommandOutput> =>
+        client.send(new ListHostedZonesByNameCommand(input)),
+    };
   }
 
-  public stepFunctions(): AWS.StepFunctions {
-    return this.wrapServiceErrorHandling(new AWS.StepFunctions(this.config));
-  }
+  public s3(): IS3Client {
+    const client = this.wrapServiceErrorHandling(new S3Client(this.config));
+    return {
+      getBucketEncryption: (input: GetBucketEncryptionCommandInput): Promise<GetBucketEncryptionCommandOutput> =>
+        client.send(new GetBucketEncryptionCommand(input)),
+      getBucketLocation: (input: GetBucketLocationCommandInput): Promise<GetBucketLocationCommandOutput> =>
+        client.send(new GetBucketLocationCommand(input)),
+      getObject: (input: GetObjectCommandInput): Promise<GetObjectCommandOutput> =>
+        client.send(new GetObjectCommand(input)),
+      listObjectsV2: (input: ListObjectsV2CommandInput): Promise<ListObjectsV2CommandOutput> =>
+        client.send(new ListObjectsV2Command(input)),
+      upload: (input: PutObjectCommandInput): Promise<CompleteMultipartUploadCommandOutput> => {
+        try {
+          const upload = new Upload({
+            client,
+            params: input,
+          });
 
-  public codeBuild(): AWS.CodeBuild {
-    return this.wrapServiceErrorHandling(new AWS.CodeBuild(this.config));
+          return upload.done();
+        } catch (e: any) {
+          throw new Error(`Upload failed: ${e.message}`);
+        }
+      },
+    };
   }
 
-  public cloudWatchLogs(): AWS.CloudWatchLogs {
-    return this.wrapServiceErrorHandling(new AWS.CloudWatchLogs(this.config));
+  public secretsManager(): ISecretsManagerClient {
+    const client = this.wrapServiceErrorHandling(new SecretsManagerClient(this.config));
+    return {
+      getSecretValue: (input: GetSecretValueCommandInput): Promise<GetSecretValueCommandOutput> =>
+        client.send(new GetSecretValueCommand(input)),
+    };
   }
 
-  public appsync(): AWS.AppSync {
-    return this.wrapServiceErrorHandling(new AWS.AppSync(this.config));
+  public ssm(): ISSMClient {
+    const client = this.wrapServiceErrorHandling(new SSMClient(this.config));
+    return {
+      getParameter: (input: GetParameterCommandInput): Promise<GetParameterCommandOutput> =>
+        client.send(new GetParameterCommand(input)),
+    };
   }
 
-  public async currentAccount(): Promise<Account> {
-    // Get/refresh if necessary before we can access `accessKeyId`
-    await this.forceCredentialRetrieval();
-
-    return cached(this, CURRENT_ACCOUNT_KEY, () => SDK.accountCache.fetch(this._credentials.accessKeyId, async () => {
-      // if we don't have one, resolve from STS and store in cache.
-      debug('Looking up default account ID from STS');
-      const result = await new AWS.STS({ ...this.config, ...this.stsRetryOptions }).getCallerIdentity().promise();
-      const accountId = result.Account;
-      const partition = result.Arn!.split(':')[1];
-      if (!accountId) {
-        throw new Error('STS didn\'t return an account ID');
-      }
-      debug('Default account ID:', accountId);
-
-      // Save another STS call later if this one already succeeded
-      this._credentialsValidated = true;
-      return { accountId, partition };
-    }));
+  public stepFunctions(): IStepFunctionsClient {
+    const client = this.wrapServiceErrorHandling(new SFNClient(this.config));
+    return {
+      updateStateMachine: (input: UpdateStateMachineCommandInput): Promise<UpdateStateMachineCommandOutput> =>
+        client.send(new UpdateStateMachineCommand(input)),
+    };
   }
 
   /**
-   * Return the current credentials
-   *
-   * Don't use -- only used to write tests around assuming roles.
+   * The AWS SDK v3 requires a client config and a command in order to get an endpoint for
+   * any given service.
    */
-  public async currentCredentials(): Promise<AWS.Credentials> {
-    await this.forceCredentialRetrieval();
-    return this._credentials;
+  public async getUrlSuffix(region: string): Promise<string> {
+    const cfn = new CloudFormationClient({ region });
+    const endpoint = await getEndpointFromInstructions({}, DescribeStackResourcesCommand, { ...cfn.config });
+    return endpoint.url.hostname.split(`${region}.`).pop()!;
   }
 
-  /**
-   * Force retrieval of the current credentials
-   *
-   * Relevant if the current credentials are AssumeRole credentials -- do the actual
-   * lookup, and translate any error into a useful error message (taking into
-   * account credential provenance).
-   */
-  public async forceCredentialRetrieval() {
-    try {
-      await this._credentials.getPromise();
-    } catch (e: any) {
-      if (isUnrecoverableAwsError(e)) {
-        throw e;
-      }
+  public async currentAccount(): Promise<Account> {
+    return cached(this, CURRENT_ACCOUNT_KEY, () =>
+      SDK.accountCache.fetch(this._credentials.accessKeyId, async () => {
+        // if we don't have one, resolve from STS and store in cache.
+        debug('Looking up default account ID from STS');
+        const client = new STSClient({
+          ...this.config,
+          ...this.stsRetryOptions,
+        });
+        const command = new GetCallerIdentityCommand({});
+        const result = await client.send(command);
+        debug(result.Account!, result.Arn, result.UserId);
+        const accountId = result.Account;
+        const partition = result.Arn!.split(':')[1];
+        if (!accountId) {
+          throw new Error("STS didn't return an account ID");
+        }
+        debug('Default account ID:', accountId);
 
-      // Only reason this would fail is if it was an AssumRole. Otherwise,
-      // reading from an INI file or reading env variables is unlikely to fail.
-      debug(`Assuming role failed: ${e.message}`);
-      throw new Error([
-        'Could not assume role in target account',
-        ...this.sdkOptions.assumeRoleCredentialsSourceDescription
-          ? [`using ${this.sdkOptions.assumeRoleCredentialsSourceDescription}`]
-          : [],
-        e.message,
-        '. Please make sure that this role exists in the account. If it doesn\'t exist, (re)-bootstrap the environment ' +
-        'with the right \'--trust\', using the latest version of the CDK CLI.',
-      ].join(' '));
-    }
+        // Save another STS call later if this one already succeeded
+        this._credentialsValidated = true;
+        return { accountId, partition };
+      }),
+    );
   }
 
   /**
@@ -286,14 +907,11 @@ export class SDK implements ISDK {
       return;
     }
 
-    await new AWS.STS({ ...this.config, ...this.stsRetryOptions }).getCallerIdentity().promise();
+    const client = new STSClient({ ...this.config, ...this.stsRetryOptions });
+    await client.send(new GetCallerIdentityCommand({}));
     this._credentialsValidated = true;
   }
 
-  public getEndpointSuffix(region: string): string {
-    return regionUtil.getEndpointSuffix(region);
-  }
-
   /**
    * Return a wrapping object for the underlying service object
    *
@@ -328,28 +946,34 @@ export class SDK implements ISDK {
         // - Anything that's not a function.
         // - 'constructor', s3.upload() will use this to do some magic and we need the underlying constructor.
         // - Any method that's not on the service class (do not intercept 'makeRequest' and other helpers).
-        if (prop === 'constructor' || !classObject.hasOwnProperty(prop) || !isFunction(real)) { return real; }
+        if (prop === 'constructor' || !classObject.hasOwnProperty(prop) || !isFunction(real)) {
+          return real;
+        }
 
         // NOTE: This must be a function() and not an () => {
         // because I need 'this' to be dynamically bound and not statically bound.
         // If your linter complains don't listen to it!
-        return function(this: any) {
+        return function (this: any) {
           // Call the underlying function. If it returns an object with a promise()
           // method on it, wrap that 'promise' method.
           const args = [].slice.call(arguments, 0);
           const response = real.apply(this, args);
 
           // Don't intercept unless the return value is an object with a '.promise()' method.
-          if (typeof response !== 'object' || !response) { return response; }
-          if (!('promise' in response)) { return response; }
+          if (typeof response !== 'object' || !response) {
+            return response;
+          }
+          if (!('promise' in response)) {
+            return response;
+          }
 
           // Return an object with the promise method replaced with a wrapper which will
           // do additional things to errors.
           return Object.assign(Object.create(response), {
             promise() {
-              return response.promise().catch((e: Error & { code?: string }) => {
+              return response.catch((e: Error & { code?: string }) => {
                 e = self.makeDetailedException(e);
-                debug(`Call failed: ${prop}(${JSON.stringify(args[0])}) => ${e.message} (code=${e.code})`);
+                debug(`Call failed: ${prop}(${JSON.stringify(args[0])}) => ${e.message} (code=${e.name})`);
                 return Promise.reject(e); // Re-'throw' the new error
               });
             },
@@ -384,10 +1008,10 @@ export class SDK implements ISDK {
     if (e.message === 'Could not load credentials from ChainableTemporaryCredentials') {
       e.message = [
         'Could not assume role in target account',
-        ...this.sdkOptions.assumeRoleCredentialsSourceDescription
+        ...(this.sdkOptions.assumeRoleCredentialsSourceDescription
           ? [`using ${this.sdkOptions.assumeRoleCredentialsSourceDescription}`]
-          : [],
-        '(did you bootstrap the environment with the right \'--trust\'s?)',
+          : []),
+        "(did you bootstrap the environment with the right '--trust's?)",
       ].join(' ');
     }
 
@@ -415,10 +1039,3 @@ function allChainedExceptionMessages(e: Error | undefined) {
   }
   return ret.join(': ');
 }
-
-/**
- * Return whether an error should not be recovered from
- */
-export function isUnrecoverableAwsError(e: Error) {
-  return (e as any).code === 'ExpiredToken';
-}
diff --git a/packages/aws-cdk/lib/api/aws-auth/sdk_ini_file.ts b/packages/aws-cdk/lib/api/aws-auth/sdk_ini_file.ts
deleted file mode 100644
index 91c50e87c0a97..0000000000000
--- a/packages/aws-cdk/lib/api/aws-auth/sdk_ini_file.ts
+++ /dev/null
@@ -1,59 +0,0 @@
-/**
- * A reimplementation of JS AWS SDK's SharedIniFile class
- *
- * We need that class to parse the ~/.aws/config file to determine the correct
- * region at runtime, but unfortunately it is private upstream.
- */
-
-import * as os from 'os';
-import * as path from 'path';
-import * as AWS from 'aws-sdk';
-import * as fs from 'fs-extra';
-
-export interface SharedIniFileOptions {
-  isConfig?: boolean;
-  filename?: string;
-}
-
-export class SharedIniFile {
-  private readonly isConfig: boolean;
-  private readonly filename: string;
-  private parsedContents?: { [key: string]: { [key: string]: string } };
-
-  constructor(options?: SharedIniFileOptions) {
-    options = options || {};
-    this.isConfig = options.isConfig === true;
-    this.filename = options.filename || this.getDefaultFilepath();
-  }
-
-  public async getProfile(profile: string) {
-    await this.ensureFileLoaded();
-
-    const profileIndex = profile !== (AWS as any).util.defaultProfile && this.isConfig ?
-      'profile ' + profile : profile;
-
-    return this.parsedContents![profileIndex];
-  }
-
-  private getDefaultFilepath(): string {
-    return path.join(
-      os.homedir(),
-      '.aws',
-      this.isConfig ? 'config' : 'credentials',
-    );
-  }
-
-  private async ensureFileLoaded() {
-    if (this.parsedContents) {
-      return;
-    }
-
-    if (!await fs.pathExists(this.filename)) {
-      this.parsedContents = {};
-      return;
-    }
-
-    const contents: string = (await fs.readFile(this.filename)).toString();
-    this.parsedContents = (AWS as any).util.ini.parse(contents);
-  }
-}
diff --git a/packages/aws-cdk/lib/api/aws-auth/user-agent.ts b/packages/aws-cdk/lib/api/aws-auth/user-agent.ts
new file mode 100644
index 0000000000000..98e2f716d57d1
--- /dev/null
+++ b/packages/aws-cdk/lib/api/aws-auth/user-agent.ts
@@ -0,0 +1,17 @@
+import * as path from 'path';
+import { readIfPossible } from './util';
+import { rootDir } from '../../util/directories';
+
+/**
+ * Find the package.json from the main toolkit.
+ *
+ * If we can't read it for some reason, try to do something reasonable anyway.
+ * Fall back to argv[1], or a standard string if that is undefined for some reason.
+ */
+export function defaultCliUserAgent() {
+  const root = rootDir(false);
+  const pkg = JSON.parse((root ? readIfPossible(path.join(root, 'package.json')) : undefined) ?? '{}');
+  const name = pkg.name ?? path.basename(process.argv[1] ?? 'cdk-cli');
+  const version = pkg.version ?? '<unknown>';
+  return `${name}/${version}`;
+}
diff --git a/packages/aws-cdk/lib/api/aws-auth/util.ts b/packages/aws-cdk/lib/api/aws-auth/util.ts
new file mode 100644
index 0000000000000..b5c6f57b7032b
--- /dev/null
+++ b/packages/aws-cdk/lib/api/aws-auth/util.ts
@@ -0,0 +1,19 @@
+import * as fs from 'fs-extra';
+import { debug } from '../../logging';
+
+/**
+ * Read a file if it exists, or return undefined
+ *
+ * Not async because it is used in the constructor
+ */
+export function readIfPossible(filename: string): string | undefined {
+  try {
+    if (!fs.pathExistsSync(filename)) {
+      return undefined;
+    }
+    return fs.readFileSync(filename, { encoding: 'utf-8' });
+  } catch (e: any) {
+    debug(e);
+    return undefined;
+  }
+}
diff --git a/packages/aws-cdk/lib/api/bootstrap/bootstrap-environment.ts b/packages/aws-cdk/lib/api/bootstrap/bootstrap-environment.ts
index f3041fd3864ec..eaf7e47537679 100644
--- a/packages/aws-cdk/lib/api/bootstrap/bootstrap-environment.ts
+++ b/packages/aws-cdk/lib/api/bootstrap/bootstrap-environment.ts
@@ -1,27 +1,26 @@
 import { info } from 'console';
 import * as path from 'path';
 import * as cxapi from '@aws-cdk/cx-api';
-import { BootstrapEnvironmentOptions, BootstrappingParameters } from './bootstrap-props';
+import type { BootstrapEnvironmentOptions, BootstrappingParameters } from './bootstrap-props';
 import { BootstrapStack, bootstrapVersionFromTemplate } from './deploy-bootstrap';
 import { legacyBootstrapTemplate } from './legacy-template';
 import { warning } from '../../logging';
 import { loadStructuredFile, serializeStructure } from '../../serialize';
 import { rootDir } from '../../util/directories';
-import { ISDK, Mode, SdkProvider } from '../aws-auth';
-import { DeployStackResult } from '../deploy-stack';
+import type { SDK, SdkProvider } from '../aws-auth';
+import type { DeployStackResult } from '../deploy-stack';
+import { Mode } from '../plugin';
 
-/* eslint-disable max-len */
-
-export type BootstrapSource =
-  { source: 'legacy' }
-  | { source: 'default' }
-  | { source: 'custom'; templateFile: string };
+export type BootstrapSource = { source: 'legacy' } | { source: 'default' } | { source: 'custom'; templateFile: string };
 
 export class Bootstrapper {
-  constructor(private readonly source: BootstrapSource) {
-  }
+  constructor(private readonly source: BootstrapSource) {}
 
-  public bootstrapEnvironment(environment: cxapi.Environment, sdkProvider: SdkProvider, options: BootstrapEnvironmentOptions = {}): Promise<DeployStackResult> {
+  public bootstrapEnvironment(
+    environment: cxapi.Environment,
+    sdkProvider: SdkProvider,
+    options: BootstrapEnvironmentOptions = {},
+  ): Promise<DeployStackResult> {
     switch (this.source.source) {
       case 'legacy':
         return this.legacyBootstrap(environment, sdkProvider, options);
@@ -41,7 +40,11 @@ export class Bootstrapper {
    * Deploy legacy bootstrap stack
    *
    */
-  private async legacyBootstrap(environment: cxapi.Environment, sdkProvider: SdkProvider, options: BootstrapEnvironmentOptions = {}): Promise<DeployStackResult> {
+  private async legacyBootstrap(
+    environment: cxapi.Environment,
+    sdkProvider: SdkProvider,
+    options: BootstrapEnvironmentOptions = {},
+  ): Promise<DeployStackResult> {
     const params = options.parameters ?? {};
 
     if (params.trustedAccounts?.length) {
@@ -58,10 +61,14 @@ export class Bootstrapper {
     }
 
     const current = await BootstrapStack.lookup(sdkProvider, environment, options.toolkitStackName);
-    return current.update(await this.loadTemplate(params), {}, {
-      ...options,
-      terminationProtection: options.terminationProtection ?? current.terminationProtection,
-    });
+    return current.update(
+      await this.loadTemplate(params),
+      {},
+      {
+        ...options,
+        terminationProtection: options.terminationProtection ?? current.terminationProtection,
+      },
+    );
   }
 
   /**
@@ -71,8 +78,8 @@ export class Bootstrapper {
   private async modernBootstrap(
     environment: cxapi.Environment,
     sdkProvider: SdkProvider,
-    options: BootstrapEnvironmentOptions = {}): Promise<DeployStackResult> {
-
+    options: BootstrapEnvironmentOptions = {},
+  ): Promise<DeployStackResult> {
     const params = options.parameters ?? {};
 
     const bootstrapTemplate = await this.loadTemplate();
@@ -81,7 +88,9 @@ export class Bootstrapper {
     const partition = await current.partition();
 
     if (params.createCustomerMasterKey !== undefined && params.kmsKeyId) {
-      throw new Error('You cannot pass \'--bootstrap-kms-key-id\' and \'--bootstrap-customer-key\' together. Specify one or the other');
+      throw new Error(
+        "You cannot pass '--bootstrap-kms-key-id' and '--bootstrap-customer-key' together. Specify one or the other",
+      );
     }
 
     // If people re-bootstrap, existing parameter values are reused so that people don't accidentally change the configuration
@@ -95,10 +104,14 @@ export class Bootstrapper {
     const trustedAccounts = params.trustedAccounts ?? splitCfnArray(current.parameters.TrustedAccounts);
     info(`Trusted accounts for deployment: ${trustedAccounts.length > 0 ? trustedAccounts.join(', ') : '(none)'}`);
 
-    const trustedAccountsForLookup = params.trustedAccountsForLookup ?? splitCfnArray(current.parameters.TrustedAccountsForLookup);
-    info(`Trusted accounts for lookup: ${trustedAccountsForLookup.length > 0 ? trustedAccountsForLookup.join(', ') : '(none)'}`);
+    const trustedAccountsForLookup =
+      params.trustedAccountsForLookup ?? splitCfnArray(current.parameters.TrustedAccountsForLookup);
+    info(
+      `Trusted accounts for lookup: ${trustedAccountsForLookup.length > 0 ? trustedAccountsForLookup.join(', ') : '(none)'}`,
+    );
 
-    const cloudFormationExecutionPolicies = params.cloudFormationExecutionPolicies ?? splitCfnArray(current.parameters.CloudFormationExecutionPolicies);
+    const cloudFormationExecutionPolicies =
+      params.cloudFormationExecutionPolicies ?? splitCfnArray(current.parameters.CloudFormationExecutionPolicies);
     if (trustedAccounts.length === 0 && cloudFormationExecutionPolicies.length === 0) {
       // For self-trust it's okay to default to AdministratorAccess, and it improves the usability of bootstrapping a lot.
       //
@@ -114,9 +127,13 @@ export class Bootstrapper {
       // Would leave AdministratorAccess policies with a trust relationship, without the user explicitly
       // approving the trust policy.
       const implicitPolicy = `arn:${partition}:iam::aws:policy/AdministratorAccess`;
-      warning(`Using default execution policy of '${implicitPolicy}'. Pass '--cloudformation-execution-policies' to customize.`);
+      warning(
+        `Using default execution policy of '${implicitPolicy}'. Pass '--cloudformation-execution-policies' to customize.`,
+      );
     } else if (cloudFormationExecutionPolicies.length === 0) {
-      throw new Error(`Please pass \'--cloudformation-execution-policies\' when using \'--trust\' to specify deployment permissions. Try a managed policy of the form \'arn:${partition}:iam::aws:policy/<PolicyName>\'.`);
+      throw new Error(
+        `Please pass \'--cloudformation-execution-policies\' when using \'--trust\' to specify deployment permissions. Try a managed policy of the form \'arn:${partition}:iam::aws:policy/<PolicyName>\'.`,
+      );
     } else {
       // Remind people what the current settings are
       info(`Execution policies: ${cloudFormationExecutionPolicies.join(', ')}`);
@@ -129,21 +146,27 @@ export class Bootstrapper {
     //     * undefined if we already had a value in place (reusing what we had)
     //     * '-' if this is the first time we're deploying this stack (or upgrading from old to new bootstrap)
     const currentKmsKeyId = current.parameters.FileAssetsBucketKmsKeyId;
-    const kmsKeyId = params.kmsKeyId ??
-        (params.createCustomerMasterKey === true ? CREATE_NEW_KEY :
-          params.createCustomerMasterKey === false || currentKmsKeyId === undefined ? USE_AWS_MANAGED_KEY : undefined);
+    const kmsKeyId =
+      params.kmsKeyId ??
+      (params.createCustomerMasterKey === true
+        ? CREATE_NEW_KEY
+        : params.createCustomerMasterKey === false || currentKmsKeyId === undefined
+          ? USE_AWS_MANAGED_KEY
+          : undefined);
 
     /* A permissions boundary can be provided via:
-    *    - the flag indicating the example one should be used
-    *    - the name indicating the custom permissions boundary to be used
-    * Re-bootstrapping will NOT be blocked by either tightening or relaxing the permissions' boundary.
-    */
+     *    - the flag indicating the example one should be used
+     *    - the name indicating the custom permissions boundary to be used
+     * Re-bootstrapping will NOT be blocked by either tightening or relaxing the permissions' boundary.
+     */
 
     // InputPermissionsBoundary is an `any` type and if it is not defined it
     // appears as an empty string ''. We need to force it to evaluate an empty string
     // as undefined
     const currentPermissionsBoundary: string | undefined = current.parameters.InputPermissionsBoundary || undefined;
-    const inputPolicyName = params.examplePermissionsBoundary ? CDK_BOOTSTRAP_PERMISSIONS_BOUNDARY : params.customPermissionsBoundary;
+    const inputPolicyName = params.examplePermissionsBoundary
+      ? CDK_BOOTSTRAP_PERMISSIONS_BOUNDARY
+      : params.customPermissionsBoundary;
     let policyName: string | undefined;
     if (inputPolicyName) {
       // If the example policy is not already in place, it must be created.
@@ -170,27 +193,37 @@ export class Bootstrapper {
         TrustedAccountsForLookup: trustedAccountsForLookup.join(','),
         CloudFormationExecutionPolicies: cloudFormationExecutionPolicies.join(','),
         Qualifier: params.qualifier,
-        PublicAccessBlockConfiguration: params.publicAccessBlockConfiguration || params.publicAccessBlockConfiguration === undefined ? 'true' : 'false',
+        PublicAccessBlockConfiguration:
+          params.publicAccessBlockConfiguration || params.publicAccessBlockConfiguration === undefined
+            ? 'true'
+            : 'false',
         InputPermissionsBoundary: policyName,
-      }, {
+      },
+      {
         ...options,
         terminationProtection: options.terminationProtection ?? current.terminationProtection,
-      });
+      },
+    );
   }
 
   private async getPolicyName(
     environment: cxapi.Environment,
-    sdk: ISDK,
+    sdk: SDK,
     permissionsBoundary: string,
     partition: string,
-    params: BootstrappingParameters): Promise<string> {
-
+    params: BootstrappingParameters,
+  ): Promise<string> {
     if (permissionsBoundary !== CDK_BOOTSTRAP_PERMISSIONS_BOUNDARY) {
       this.validatePolicyName(permissionsBoundary);
       return Promise.resolve(permissionsBoundary);
     }
     // if no Qualifier is supplied, resort to the default one
-    const arn = await this.getExamplePermissionsBoundary(params.qualifier ?? 'hnb659fds', partition, environment.account, sdk);
+    const arn = await this.getExamplePermissionsBoundary(
+      params.qualifier ?? 'hnb659fds',
+      partition,
+      environment.account,
+      sdk,
+    );
     const policyName = arn.split('/').pop();
     if (!policyName) {
       throw new Error('Could not retrieve the example permission boundary!');
@@ -198,14 +231,19 @@ export class Bootstrapper {
     return Promise.resolve(policyName);
   }
 
-  private async getExamplePermissionsBoundary(qualifier: string, partition: string, account: string, sdk: ISDK): Promise<string> {
+  private async getExamplePermissionsBoundary(
+    qualifier: string,
+    partition: string,
+    account: string,
+    sdk: SDK,
+  ): Promise<string> {
     const iam = sdk.iam();
 
     let policyName = `cdk-${qualifier}-permissions-boundary`;
     const arn = `arn:${partition}:iam::${account}:policy/${policyName}`;
 
     try {
-      let getPolicyResp = await iam.getPolicy({ PolicyArn: arn }).promise();
+      let getPolicyResp = await iam.getPolicy({ PolicyArn: arn });
       if (getPolicyResp.Policy) {
         return arn;
       }
@@ -255,10 +293,7 @@ export class Bootstrapper {
           Sid: 'DenyPermBoundaryIAMPolicyAlteration',
         },
         {
-          Action: [
-            'iam:DeleteUserPermissionsBoundary',
-            'iam:DeleteRolePermissionsBoundary',
-          ],
+          Action: ['iam:DeleteUserPermissionsBoundary', 'iam:DeleteRolePermissionsBoundary'],
           Resource: '*',
           Effect: 'Deny',
           Sid: 'DenyRemovalOfPermBoundaryFromAnyUserOrRole',
@@ -269,7 +304,7 @@ export class Bootstrapper {
       PolicyName: policyName,
       PolicyDocument: JSON.stringify(policyDoc),
     };
-    const createPolicyResponse = await iam.createPolicy(request).promise();
+    const createPolicyResponse = await iam.createPolicy(request);
     if (createPolicyResponse.Policy?.Arn) {
       return createPolicyResponse.Policy.Arn;
     } else {
@@ -291,8 +326,8 @@ export class Bootstrapper {
   private async customBootstrap(
     environment: cxapi.Environment,
     sdkProvider: SdkProvider,
-    options: BootstrapEnvironmentOptions = {}): Promise<DeployStackResult> {
-
+    options: BootstrapEnvironmentOptions = {},
+  ): Promise<DeployStackResult> {
     // Look at the template, decide whether it's most likely a legacy or modern bootstrap
     // template, and use the right bootstrapper for that.
     const version = bootstrapVersionFromTemplate(await this.loadTemplate());
@@ -335,6 +370,8 @@ const CDK_BOOTSTRAP_PERMISSIONS_BOUNDARY = 'CDK_BOOTSTRAP_PERMISSIONS_BOUNDARY';
  * An empty string is the empty array (instead of `['']`).
  */
 function splitCfnArray(xs: string | undefined): string[] {
-  if (xs === '' || xs === undefined) { return []; }
+  if (xs === '' || xs === undefined) {
+    return [];
+  }
   return xs.split(',');
 }
diff --git a/packages/aws-cdk/lib/api/bootstrap/deploy-bootstrap.ts b/packages/aws-cdk/lib/api/bootstrap/deploy-bootstrap.ts
index 501122697eab5..5be78b63d480d 100644
--- a/packages/aws-cdk/lib/api/bootstrap/deploy-bootstrap.ts
+++ b/packages/aws-cdk/lib/api/bootstrap/deploy-bootstrap.ts
@@ -1,13 +1,20 @@
 import * as os from 'os';
 import * as path from 'path';
-import * as cxschema from '@aws-cdk/cloud-assembly-schema';
-import * as cxapi from '@aws-cdk/cx-api';
+import { ArtifactType } from '@aws-cdk/cloud-assembly-schema';
+import { CloudAssemblyBuilder, Environment, EnvironmentUtils } from '@aws-cdk/cx-api';
 import * as fs from 'fs-extra';
-import { BOOTSTRAP_VERSION_OUTPUT, BootstrapEnvironmentOptions, BOOTSTRAP_VERSION_RESOURCE, BOOTSTRAP_VARIANT_PARAMETER, DEFAULT_BOOTSTRAP_VARIANT } from './bootstrap-props';
+import {
+  BOOTSTRAP_VERSION_OUTPUT,
+  BootstrapEnvironmentOptions,
+  BOOTSTRAP_VERSION_RESOURCE,
+  BOOTSTRAP_VARIANT_PARAMETER,
+  DEFAULT_BOOTSTRAP_VARIANT,
+} from './bootstrap-props';
 import * as logging from '../../logging';
-import { Mode, SdkProvider, ISDK } from '../aws-auth';
-import { deployStack, DeployStackResult } from '../deploy-stack';
+import type { SdkProvider, SDK } from '../aws-auth';
+import { deployStack, type DeployStackResult } from '../deploy-stack';
 import { NoBootstrapStackEnvironmentResources } from '../environment-resources';
+import { Mode } from '../plugin';
 import { DEFAULT_TOOLKIT_STACK_NAME, ToolkitInfo } from '../toolkit-info';
 
 /**
@@ -25,7 +32,7 @@ import { DEFAULT_TOOLKIT_STACK_NAME, ToolkitInfo } from '../toolkit-info';
  * current bootstrap stack and doing something intelligent).
  */
 export class BootstrapStack {
-  public static async lookup(sdkProvider: SdkProvider, environment: cxapi.Environment, toolkitStackName?: string) {
+  public static async lookup(sdkProvider: SdkProvider, environment: Environment, toolkitStackName?: string) {
     toolkitStackName = toolkitStackName ?? DEFAULT_TOOLKIT_STACK_NAME;
 
     const resolvedEnvironment = await sdkProvider.resolveEnvironment(environment);
@@ -38,11 +45,11 @@ export class BootstrapStack {
 
   protected constructor(
     private readonly sdkProvider: SdkProvider,
-    private readonly sdk: ISDK,
-    private readonly resolvedEnvironment: cxapi.Environment,
+    private readonly sdk: SDK,
+    private readonly resolvedEnvironment: Environment,
     private readonly toolkitStackName: string,
-    private readonly currentToolkitInfo: ToolkitInfo) {
-  }
+    private readonly currentToolkitInfo: ToolkitInfo,
+  ) {}
 
   public get parameters(): Record<string, string> {
     return this.currentToolkitInfo.found ? this.currentToolkitInfo.bootstrapStack.parameters : {};
@@ -76,7 +83,9 @@ export class BootstrapStack {
       const currentVariant = this.currentToolkitInfo.variant;
       const newVariant = bootstrapVariantFromTemplate(template);
       if (currentVariant !== newVariant) {
-        logging.warning(`Bootstrap stack already exists, containing '${currentVariant}'. Not overwriting it with a template containing '${newVariant}' (use --force if you intend to overwrite)`);
+        logging.warning(
+          `Bootstrap stack already exists, containing '${currentVariant}'. Not overwriting it with a template containing '${newVariant}' (use --force if you intend to overwrite)`,
+        );
         return abortResponse;
       }
 
@@ -84,24 +93,28 @@ export class BootstrapStack {
       const newVersion = bootstrapVersionFromTemplate(template);
       const currentVersion = this.currentToolkitInfo.version;
       if (newVersion < currentVersion) {
-        logging.warning(`Bootstrap stack already at version ${currentVersion}. Not downgrading it to version ${newVersion} (use --force if you intend to downgrade)`);
+        logging.warning(
+          `Bootstrap stack already at version ${currentVersion}. Not downgrading it to version ${newVersion} (use --force if you intend to downgrade)`,
+        );
         if (newVersion === 0) {
           // A downgrade with 0 as target version means we probably have a new-style bootstrap in the account,
           // and an old-style bootstrap as current target, which means the user probably forgot to put this flag in.
-          logging.warning('(Did you set the \'@aws-cdk/core:newStyleStackSynthesis\' feature flag in cdk.json?)');
+          logging.warning("(Did you set the '@aws-cdk/core:newStyleStackSynthesis' feature flag in cdk.json?)");
         }
         return abortResponse;
       }
     }
 
     const outdir = await fs.mkdtemp(path.join(os.tmpdir(), 'cdk-bootstrap'));
-    const builder = new cxapi.CloudAssemblyBuilder(outdir);
+    const builder = new CloudAssemblyBuilder(outdir);
     const templateFile = `${this.toolkitStackName}.template.json`;
-    await fs.writeJson(path.join(builder.outdir, templateFile), template, { spaces: 2 });
+    await fs.writeJson(path.join(builder.outdir, templateFile), template, {
+      spaces: 2,
+    });
 
     builder.addArtifact(this.toolkitStackName, {
-      type: cxschema.ArtifactType.AWS_CLOUDFORMATION_STACK,
-      environment: cxapi.EnvironmentUtils.format(this.resolvedEnvironment.account, this.resolvedEnvironment.region),
+      type: ArtifactType.AWS_CLOUDFORMATION_STACK,
+      environment: EnvironmentUtils.format(this.resolvedEnvironment.account, this.resolvedEnvironment.region),
       properties: {
         templateFile,
         terminationProtection: options.terminationProtection ?? false,
@@ -134,7 +147,9 @@ export function bootstrapVersionFromTemplate(template: any): number {
   ];
 
   for (const vs of versionSources) {
-    if (typeof vs === 'number') { return vs; }
+    if (typeof vs === 'number') {
+      return vs;
+    }
     if (typeof vs === 'string' && !isNaN(parseInt(vs, 10))) {
       return parseInt(vs, 10);
     }
diff --git a/packages/aws-cdk/lib/api/deploy-stack.ts b/packages/aws-cdk/lib/api/deploy-stack.ts
index b8b44a60bc556..ccc2dbf749fab 100644
--- a/packages/aws-cdk/lib/api/deploy-stack.ts
+++ b/packages/aws-cdk/lib/api/deploy-stack.ts
@@ -1,21 +1,34 @@
 import * as cxapi from '@aws-cdk/cx-api';
-import type { CloudFormation } from 'aws-sdk';
+import type {
+  CreateChangeSetCommandInput,
+  CreateStackCommandInput,
+  DescribeChangeSetCommandOutput,
+  ExecuteChangeSetCommandInput,
+  UpdateStackCommandInput,
+  Tag,
+} from '@aws-sdk/client-cloudformation';
 import * as chalk from 'chalk';
 import * as uuid from 'uuid';
-import { ISDK, SdkProvider } from './aws-auth';
-import { EnvironmentResources } from './environment-resources';
+import type { SDK, SdkProvider, ICloudFormationClient } from './aws-auth';
+import type { EnvironmentResources } from './environment-resources';
 import { CfnEvaluationException } from './evaluate-cloudformation-template';
 import { HotswapMode, ICON } from './hotswap/common';
 import { tryHotswapDeployment } from './hotswap-deployments';
 import { addMetadataAssetsToManifest } from '../assets';
-import { Tag } from '../cdk-toolkit';
 import { debug, print, warning } from '../logging';
 import {
-  changeSetHasNoChanges, CloudFormationStack, TemplateParameters, waitForChangeSet,
-  waitForStackDeploy, waitForStackDelete, ParameterValues, ParameterChanges, ResourcesToImport,
+  changeSetHasNoChanges,
+  CloudFormationStack,
+  TemplateParameters,
+  waitForChangeSet,
+  waitForStackDeploy,
+  waitForStackDelete,
+  ParameterValues,
+  ParameterChanges,
+  ResourcesToImport,
 } from './util/cloudformation';
-import { StackActivityMonitor, StackActivityProgress } from './util/cloudformation/stack-activity-monitor';
-import { TemplateBodyParameter, makeBodyParameter } from './util/template-body-parameter';
+import { StackActivityMonitor, type StackActivityProgress } from './util/cloudformation/stack-activity-monitor';
+import { type TemplateBodyParameter, makeBodyParameter } from './util/template-body-parameter';
 import { AssetManifestBuilder } from '../util/asset-manifest-builder';
 import { publishAssets } from '../util/asset-publishing';
 
@@ -45,7 +58,7 @@ export interface DeployStackOptions {
    * Should have been initialized with the correct role with which
    * stack operations should be performed.
    */
-  readonly sdk: ISDK;
+  readonly sdk: SDK;
 
   /**
    * SDK provider (seeded with default credentials)
@@ -200,10 +213,7 @@ export interface DeployStackOptions {
   readonly assetParallelism?: boolean;
 }
 
-export type DeploymentMethod =
-  | DirectDeploymentMethod
-  | ChangeSetDeploymentMethod
-  ;
+export type DeploymentMethod = DirectDeploymentMethod | ChangeSetDeploymentMethod;
 
 export interface DirectDeploymentMethod {
   readonly method: 'direct';
@@ -237,11 +247,15 @@ export async function deployStack(options: DeployStackOptions): Promise<DeploySt
   let cloudFormationStack = await CloudFormationStack.lookup(cfn, deployName);
 
   if (cloudFormationStack.stackStatus.isCreationFailure) {
-    debug(`Found existing stack ${deployName} that had previously failed creation. Deleting it before attempting to re-create it.`);
-    await cfn.deleteStack({ StackName: deployName }).promise();
+    debug(
+      `Found existing stack ${deployName} that had previously failed creation. Deleting it before attempting to re-create it.`,
+    );
+    await cfn.deleteStack({ StackName: deployName });
     const deletedStack = await waitForStackDelete(cfn, deployName);
     if (deletedStack && deletedStack.stackStatus.name !== 'DELETE_COMPLETE') {
-      throw new Error(`Failed deleting stack ${deployName} that had previously failed creation (current state: ${deletedStack.stackStatus})`);
+      throw new Error(
+        `Failed deleting stack ${deployName} that had previously failed creation (current state: ${deletedStack.stackStatus})`,
+      );
     }
     // Update variable to mark that the stack does not exist anymore, but avoid
     // doing an actual lookup in CloudFormation (which would be silly to do if
@@ -253,7 +267,12 @@ export async function deployStack(options: DeployStackOptions): Promise<DeploySt
   // an ad-hoc asset manifest, while passing their locations via template
   // parameters.
   const legacyAssets = new AssetManifestBuilder();
-  const assetParams = await addMetadataAssetsToManifest(stackArtifact, legacyAssets, options.envResources, options.reuseAssets);
+  const assetParams = await addMetadataAssetsToManifest(
+    stackArtifact,
+    legacyAssets,
+    options.envResources,
+    options.reuseAssets,
+  );
 
   const finalParameterValues = { ...options.parameters, ...assetParams };
 
@@ -269,7 +288,10 @@ export async function deployStack(options: DeployStackOptions): Promise<DeploySt
     // if we can skip deployment and we are performing a hotswap, let the user know
     // that no hotswap deployment happened
     if (hotswapMode !== HotswapMode.FULL_DEPLOYMENT) {
-      print(`\n ${ICON} %s\n`, chalk.bold('hotswap deployment skipped - no changes were detected (use --force to override)'));
+      print(
+        `\n ${ICON} %s\n`,
+        chalk.bold('hotswap deployment skipped - no changes were detected (use --force to override)'),
+      );
     }
     return {
       noOp: true,
@@ -285,8 +307,8 @@ export async function deployStack(options: DeployStackOptions): Promise<DeploySt
     options.resolvedEnvironment,
     legacyAssets,
     options.envResources,
-    options.sdk,
-    options.overrideTemplate);
+    options.overrideTemplate,
+  );
   await publishAssets(legacyAssets.toManifest(stackArtifact.assembly.directory), options.sdkProvider, stackEnv, {
     parallel: options.assetParallelism,
   });
@@ -295,46 +317,64 @@ export async function deployStack(options: DeployStackOptions): Promise<DeploySt
     // attempt to short-circuit the deployment if possible
     try {
       const hotswapDeploymentResult = await tryHotswapDeployment(
-        options.sdkProvider, stackParams.values, cloudFormationStack, stackArtifact, hotswapMode,
+        options.sdkProvider,
+        stackParams.values,
+        cloudFormationStack,
+        stackArtifact,
+        hotswapMode,
       );
       if (hotswapDeploymentResult) {
         return hotswapDeploymentResult;
       }
-      print('Could not perform a hotswap deployment, as the stack %s contains non-Asset changes', stackArtifact.displayName);
+      print(
+        'Could not perform a hotswap deployment, as the stack %s contains non-Asset changes',
+        stackArtifact.displayName,
+      );
     } catch (e) {
       if (!(e instanceof CfnEvaluationException)) {
         throw e;
       }
-      print('Could not perform a hotswap deployment, because the CloudFormation template could not be resolved: %s', e.message);
+      print(
+        'Could not perform a hotswap deployment, because the CloudFormation template could not be resolved: %s',
+        e.message,
+      );
     }
 
     if (hotswapMode === HotswapMode.FALL_BACK) {
       print('Falling back to doing a full deployment');
       options.sdk.appendCustomUserAgent('cdk-hotswap/fallback');
     } else {
-      return { noOp: true, stackArn: cloudFormationStack.stackId, outputs: cloudFormationStack.outputs };
+      return {
+        noOp: true,
+        stackArn: cloudFormationStack.stackId,
+        outputs: cloudFormationStack.outputs,
+      };
     }
   }
 
   // could not short-circuit the deployment, perform a full CFN deploy instead
-  const fullDeployment = new FullCloudFormationDeployment(options, cloudFormationStack, stackArtifact, stackParams, bodyParameter);
+  const fullDeployment = new FullCloudFormationDeployment(
+    options,
+    cloudFormationStack,
+    stackArtifact,
+    stackParams,
+    bodyParameter,
+  );
   return fullDeployment.performDeployment();
 }
 
-type CommonPrepareOptions =
-  & keyof CloudFormation.CreateStackInput
-  & keyof CloudFormation.UpdateStackInput
-  & keyof CloudFormation.CreateChangeSetInput;
-type CommonExecuteOptions =
-  & keyof CloudFormation.CreateStackInput
-  & keyof CloudFormation.UpdateStackInput
-  & keyof CloudFormation.ExecuteChangeSetInput;
+type CommonPrepareOptions = keyof CreateStackCommandInput &
+keyof UpdateStackCommandInput &
+keyof CreateChangeSetCommandInput;
+type CommonExecuteOptions = keyof CreateStackCommandInput &
+keyof UpdateStackCommandInput &
+keyof ExecuteChangeSetCommandInput;
 
 /**
  * This class shares state and functionality between the different full deployment modes
  */
 class FullCloudFormationDeployment {
-  private readonly cfn: ReturnType<ISDK['cloudFormation']>;
+  private readonly cfn: ICloudFormationClient;
   private readonly stackName: string;
   private readonly update: boolean;
   private readonly verb: string;
@@ -356,7 +396,9 @@ class FullCloudFormationDeployment {
   }
 
   public async performDeployment(): Promise<DeployStackResult> {
-    const deploymentMethod = this.options.deploymentMethod ?? { method: 'change-set' };
+    const deploymentMethod = this.options.deploymentMethod ?? {
+      method: 'change-set',
+    };
 
     if (deploymentMethod.method === 'direct' && this.options.resourcesToImport) {
       throw new Error('Importing resources requires a changeset deployment');
@@ -381,25 +423,41 @@ class FullCloudFormationDeployment {
       debug('No changes are to be performed on %s.', this.stackName);
       if (execute) {
         debug('Deleting empty change set %s', changeSetDescription.ChangeSetId);
-        await this.cfn.deleteChangeSet({ StackName: this.stackName, ChangeSetName: changeSetName }).promise();
+        await this.cfn.deleteChangeSet({
+          StackName: this.stackName,
+          ChangeSetName: changeSetName,
+        });
       }
 
       if (this.options.force) {
-        warning([
-          'You used the --force flag, but CloudFormation reported that the deployment would not make any changes.',
-          'According to CloudFormation, all resources are already up-to-date with the state in your CDK app.',
-          '',
-          'You cannot use the --force flag to get rid of changes you made in the console. Try using',
-          'CloudFormation drift detection instead: https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/using-cfn-stack-drift.html',
-        ].join('\n'));
+        warning(
+          [
+            'You used the --force flag, but CloudFormation reported that the deployment would not make any changes.',
+            'According to CloudFormation, all resources are already up-to-date with the state in your CDK app.',
+            '',
+            'You cannot use the --force flag to get rid of changes you made in the console. Try using',
+            'CloudFormation drift detection instead: https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/using-cfn-stack-drift.html',
+          ].join('\n'),
+        );
       }
 
-      return { noOp: true, outputs: this.cloudFormationStack.outputs, stackArn: changeSetDescription.StackId! };
+      return {
+        noOp: true,
+        outputs: this.cloudFormationStack.outputs,
+        stackArn: changeSetDescription.StackId!,
+      };
     }
 
     if (!execute) {
-      print('Changeset %s created and waiting in review for manual execution (--no-execute)', changeSetDescription.ChangeSetId);
-      return { noOp: false, outputs: this.cloudFormationStack.outputs, stackArn: changeSetDescription.StackId! };
+      print(
+        'Changeset %s created and waiting in review for manual execution (--no-execute)',
+        changeSetDescription.ChangeSetId,
+      );
+      return {
+        noOp: false,
+        outputs: this.cloudFormationStack.outputs,
+        stackArn: changeSetDescription.StackId!,
+      };
     }
 
     return this.executeChangeSet(changeSetDescription);
@@ -418,14 +476,16 @@ class FullCloudFormationDeployment {
       Description: `CDK Changeset for execution ${this.uuid}`,
       ClientToken: `create${this.uuid}`,
       ...this.commonPrepareOptions(),
-    }).promise();
+    });
 
     debug('Initiated creation of changeset: %s; waiting for it to finish creating...', changeSet.Id);
     // Fetching all pages if we'll execute, so we can have the correct change count when monitoring.
-    return waitForChangeSet(this.cfn, this.stackName, changeSetName, { fetchAll: willExecute });
+    return waitForChangeSet(this.cfn, this.stackName, changeSetName, {
+      fetchAll: willExecute,
+    });
   }
 
-  private async executeChangeSet(changeSet: CloudFormation.DescribeChangeSetOutput): Promise<DeployStackResult> {
+  private async executeChangeSet(changeSet: DescribeChangeSetCommandOutput): Promise<DeployStackResult> {
     debug('Initiating execution of changeset %s on stack %s', changeSet.ChangeSetId, this.stackName);
 
     await this.cfn.executeChangeSet({
@@ -433,9 +493,13 @@ class FullCloudFormationDeployment {
       ChangeSetName: changeSet.ChangeSetName!,
       ClientRequestToken: `exec${this.uuid}`,
       ...this.commonExecuteOptions(),
-    }).promise();
+    });
 
-    debug('Execution of changeset %s on stack %s has started; waiting for the update to complete...', changeSet.ChangeSetId, this.stackName);
+    debug(
+      'Execution of changeset %s on stack %s has started; waiting for the update to complete...',
+      changeSet.ChangeSetId,
+      this.stackName,
+    );
 
     // +1 for the extra event emitted from updates.
     const changeSetLength: number = (changeSet.Changes ?? []).length + (this.update ? 1 : 0);
@@ -447,7 +511,10 @@ class FullCloudFormationDeployment {
       // Delete any existing change sets generated by CDK since change set names must be unique.
       // The delete request is successful as long as the stack exists (even if the change set does not exist).
       debug(`Removing existing change set with name ${changeSetName} if it exists`);
-      await this.cfn.deleteChangeSet({ StackName: this.stackName, ChangeSetName: changeSetName }).promise();
+      await this.cfn.deleteChangeSet({
+        StackName: this.stackName,
+        ChangeSetName: changeSetName,
+      });
     }
   }
 
@@ -455,11 +522,16 @@ class FullCloudFormationDeployment {
     // Update termination protection only if it has changed.
     const terminationProtection = this.stackArtifact.terminationProtection ?? false;
     if (!!this.cloudFormationStack.terminationProtection !== terminationProtection) {
-      debug('Updating termination protection from %s to %s for stack %s', this.cloudFormationStack.terminationProtection, terminationProtection, this.stackName);
+      debug(
+        'Updating termination protection from %s to %s for stack %s',
+        this.cloudFormationStack.terminationProtection,
+        terminationProtection,
+        this.stackName,
+      );
       await this.cfn.updateTerminationProtection({
         StackName: this.stackName,
         EnableTerminationProtection: terminationProtection,
-      }).promise();
+      });
       debug('Termination protection updated to %s for stack %s', terminationProtection, this.stackName);
     }
   }
@@ -478,11 +550,15 @@ class FullCloudFormationDeployment {
           ClientRequestToken: `update${this.uuid}`,
           ...this.commonPrepareOptions(),
           ...this.commonExecuteOptions(),
-        }).promise();
+        });
       } catch (err: any) {
         if (err.message === 'No updates are to be performed.') {
           debug('No updates are to be performed for stack %s', this.stackName);
-          return { noOp: true, outputs: this.cloudFormationStack.outputs, stackArn: this.cloudFormationStack.stackId };
+          return {
+            noOp: true,
+            outputs: this.cloudFormationStack.outputs,
+            stackArn: this.cloudFormationStack.stackId,
+          };
         }
         throw err;
       }
@@ -495,29 +571,33 @@ class FullCloudFormationDeployment {
       await this.cfn.createStack({
         StackName: this.stackName,
         ClientRequestToken: `create${this.uuid}`,
-        ...terminationProtection ? { EnableTerminationProtection: true } : undefined,
+        ...(terminationProtection ? { EnableTerminationProtection: true } : undefined),
         ...this.commonPrepareOptions(),
         ...this.commonExecuteOptions(),
-      }).promise();
+      });
 
       return this.monitorDeployment(startTime, undefined);
     }
   }
 
   private async monitorDeployment(startTime: Date, expectedChanges: number | undefined): Promise<DeployStackResult> {
-    const monitor = this.options.quiet ? undefined : StackActivityMonitor.withDefaultPrinter(this.cfn, this.stackName, this.stackArtifact, {
-      resourcesTotal: expectedChanges,
-      progress: this.options.progress,
-      changeSetCreationTime: startTime,
-      ci: this.options.ci,
-    }).start();
+    const monitor = this.options.quiet
+      ? undefined
+      : StackActivityMonitor.withDefaultPrinter(this.cfn, this.stackName, this.stackArtifact, {
+        resourcesTotal: expectedChanges,
+        progress: this.options.progress,
+        changeSetCreationTime: startTime,
+        ci: this.options.ci,
+      }).start();
 
     let finalState = this.cloudFormationStack;
     try {
       const successStack = await waitForStackDeploy(this.cfn, this.stackName);
 
       // This shouldn't really happen, but catch it anyway. You never know.
-      if (!successStack) { throw new Error('Stack deploy failed (the stack disappeared while we were deploying it)'); }
+      if (!successStack) {
+        throw new Error('Stack deploy failed (the stack disappeared while we were deploying it)');
+      }
       finalState = successStack;
     } catch (e: any) {
       throw new Error(suffixWithErrors(e.message, monitor?.errors));
@@ -525,13 +605,17 @@ class FullCloudFormationDeployment {
       await monitor?.stop();
     }
     debug('Stack %s has completed updating', this.stackName);
-    return { noOp: false, outputs: finalState.outputs, stackArn: finalState.stackId };
+    return {
+      noOp: false,
+      outputs: finalState.outputs,
+      stackArn: finalState.stackId,
+    };
   }
 
   /**
    * Return the options that are shared between CreateStack, UpdateStack and CreateChangeSet
    */
-  private commonPrepareOptions(): Partial<Pick<CloudFormation.UpdateStackInput, CommonPrepareOptions>> {
+  private commonPrepareOptions(): Partial<Pick<UpdateStackCommandInput, CommonPrepareOptions>> {
     return {
       Capabilities: ['CAPABILITY_IAM', 'CAPABILITY_NAMED_IAM', 'CAPABILITY_AUTO_EXPAND'],
       NotificationARNs: this.options.notificationArns,
@@ -549,12 +633,12 @@ class FullCloudFormationDeployment {
    * Be careful not to add in keys for options that aren't used, as the features may not have been
    * deployed everywhere yet.
    */
-  private commonExecuteOptions(): Partial<Pick<CloudFormation.UpdateStackInput, CommonExecuteOptions>> {
+  private commonExecuteOptions(): Partial<Pick<UpdateStackCommandInput, CommonExecuteOptions>> {
     const shouldDisableRollback = this.options.rollback === false;
 
     return {
       StackName: this.stackName,
-      ...shouldDisableRollback ? { DisableRollback: true } : undefined,
+      ...(shouldDisableRollback ? { DisableRollback: true } : undefined),
     };
   }
 }
@@ -565,7 +649,7 @@ export interface DestroyStackOptions {
    */
   stack: cxapi.CloudFormationStackArtifact;
 
-  sdk: ISDK;
+  sdk: SDK;
   roleArn?: string;
   deployName?: string;
   quiet?: boolean;
@@ -580,12 +664,14 @@ export async function destroyStack(options: DestroyStackOptions) {
   if (!currentStack.exists) {
     return;
   }
-  const monitor = options.quiet ? undefined : StackActivityMonitor.withDefaultPrinter(cfn, deployName, options.stack, {
-    ci: options.ci,
-  }).start();
+  const monitor = options.quiet
+    ? undefined
+    : StackActivityMonitor.withDefaultPrinter(cfn, deployName, options.stack, {
+      ci: options.ci,
+    }).start();
 
   try {
-    await cfn.deleteStack({ StackName: deployName, RoleARN: options.roleArn }).promise();
+    await cfn.deleteStack({ StackName: deployName, RoleARN: options.roleArn });
     const destroyedStack = await waitForStackDelete(cfn, deployName);
     if (destroyedStack && destroyedStack.stackStatus.name !== 'DELETE_COMPLETE') {
       throw new Error(`Failed to destroy ${deployName}: ${destroyedStack.stackStatus}`);
@@ -593,7 +679,9 @@ export async function destroyStack(options: DestroyStackOptions) {
   } catch (e: any) {
     throw new Error(suffixWithErrors(e.message, monitor?.errors));
   } finally {
-    if (monitor) { await monitor.stop(); }
+    if (monitor) {
+      await monitor.stop();
+    }
   }
 }
 
@@ -609,8 +697,8 @@ export async function destroyStack(options: DestroyStackOptions) {
 async function canSkipDeploy(
   deployStackOptions: DeployStackOptions,
   cloudFormationStack: CloudFormationStack,
-  parameterChanges: ParameterChanges): Promise<boolean> {
-
+  parameterChanges: ParameterChanges,
+): Promise<boolean> {
   const deployName = deployStackOptions.deployName || deployStackOptions.stack.stackName;
   debug(`${deployName}: checking if we can skip deploy`);
 
@@ -621,7 +709,10 @@ async function canSkipDeploy(
   }
 
   // Creating changeset only (default true), never skip
-  if (deployStackOptions.deploymentMethod?.method === 'change-set' && deployStackOptions.deploymentMethod.execute === false) {
+  if (
+    deployStackOptions.deploymentMethod?.method === 'change-set' &&
+    deployStackOptions.deploymentMethod.execute === false
+  ) {
     debug(`${deployName}: --no-execute, always creating change set`);
     return false;
   }
@@ -685,7 +776,7 @@ function compareTags(a: Tag[], b: Tag[]): boolean {
   }
 
   for (const aTag of a) {
-    const bTag = b.find(tag => tag.Key === aTag.Key);
+    const bTag = b.find((tag) => tag.Key === aTag.Key);
 
     if (!bTag || bTag.Value !== aTag.Value) {
       return false;
@@ -696,11 +787,9 @@ function compareTags(a: Tag[], b: Tag[]): boolean {
 }
 
 function suffixWithErrors(msg: string, errors?: string[]) {
-  return errors && errors.length > 0
-    ? `${msg}: ${errors.join(', ')}`
-    : msg;
+  return errors && errors.length > 0 ? `${msg}: ${errors.join(', ')}` : msg;
 }
 
 function arrayEquals(a: any[], b: any[]): boolean {
-  return a.every(item => b.includes(item)) && b.every(item => a.includes(item));
+  return a.every((item) => b.includes(item)) && b.every((item) => a.includes(item));
 }
diff --git a/packages/aws-cdk/lib/api/deployments.ts b/packages/aws-cdk/lib/api/deployments.ts
index d5b6f8a63e987..80639b4c9cbec 100644
--- a/packages/aws-cdk/lib/api/deployments.ts
+++ b/packages/aws-cdk/lib/api/deployments.ts
@@ -3,23 +3,40 @@ import * as cxapi from '@aws-cdk/cx-api';
 import * as cdk_assets from 'cdk-assets';
 import { AssetManifest, IManifestEntry } from 'cdk-assets';
 import * as chalk from 'chalk';
-import { Tag } from '../cdk-toolkit';
-import { debug, warning, error } from '../logging';
-import { Mode } from './aws-auth/credentials';
-import { ISDK } from './aws-auth/sdk';
-import { CredentialsOptions, SdkForEnvironment, SdkProvider } from './aws-auth/sdk-provider';
-import { deployStack, DeployStackResult, destroyStack, DeploymentMethod } from './deploy-stack';
-import { EnvironmentResources, EnvironmentResourcesRegistry } from './environment-resources';
+import type { SDK } from './aws-auth/sdk';
+import type { CredentialsOptions, SdkForEnvironment, SdkProvider } from './aws-auth/sdk-provider';
+import { deployStack, type DeployStackResult, destroyStack, type DeploymentMethod } from './deploy-stack';
+import { type EnvironmentResources, EnvironmentResourcesRegistry } from './environment-resources';
 import { HotswapMode } from './hotswap/common';
-import { loadCurrentTemplateWithNestedStacks, loadCurrentTemplate, RootTemplateWithNestedStacks } from './nested-stack-helpers';
-import { CloudFormationStack, Template, ResourcesToImport, ResourceIdentifierSummaries, stabilizeStack } from './util/cloudformation';
+import {
+  loadCurrentTemplateWithNestedStacks,
+  loadCurrentTemplate,
+  type RootTemplateWithNestedStacks,
+} from './nested-stack-helpers';
+import { Mode } from './plugin';
+import type { Tag } from '../cdk-toolkit';
+import { debug, warning, error } from '../logging';
+import {
+  CloudFormationStack,
+  type Template,
+  type ResourcesToImport,
+  type ResourceIdentifierSummaries,
+  stabilizeStack,
+} from './util/cloudformation';
 import { StackActivityMonitor, StackActivityProgress } from './util/cloudformation/stack-activity-monitor';
 import { StackEventPoller } from './util/cloudformation/stack-event-poller';
 import { RollbackChoice } from './util/cloudformation/stack-status';
 import { replaceEnvPlaceholders } from './util/placeholders';
 import { makeBodyParameter } from './util/template-body-parameter';
 import { AssetManifestBuilder } from '../util/asset-manifest-builder';
-import { buildAssets, publishAssets, BuildAssetsOptions, PublishAssetsOptions, PublishingAws, EVENT_TO_LOGGER } from '../util/asset-publishing';
+import {
+  buildAssets,
+  publishAssets,
+  type BuildAssetsOptions,
+  type PublishAssetsOptions,
+  PublishingAws,
+  EVENT_TO_LOGGER,
+} from '../util/asset-publishing';
 
 const BOOTSTRAP_STACK_VERSION_FOR_ROLLBACK = 23;
 
@@ -31,7 +48,7 @@ export interface PreparedSdkWithLookupRoleForEnvironment {
   /**
    * The SDK for the given environment
    */
-  readonly sdk: ISDK;
+  readonly sdk: SDK;
 
   /**
    * The resolved environment for the stack
@@ -360,7 +377,7 @@ export interface PreparedSdkForEnvironment {
   /**
    * The SDK for the given environment
    */
-  readonly stackSdk: ISDK;
+  readonly stackSdk: SDK;
 
   /**
    * The resolved environment for the stack
@@ -423,7 +440,11 @@ export class Deployments {
     debug(`Retrieving template summary for stack ${stackArtifact.displayName}.`);
     // Currently, needs to use `deploy-role` since it may need to read templates in the staging
     // bucket which have been encrypted with a KMS key (and lookup-role may not read encrypted things)
-    const { stackSdk, resolvedEnvironment, envResources } = await this.prepareSdkFor(stackArtifact, undefined, Mode.ForReading);
+    const { stackSdk, resolvedEnvironment, envResources } = await this.prepareSdkFor(
+      stackArtifact,
+      undefined,
+      Mode.ForReading,
+    );
     const cfn = stackSdk.cloudFormation();
 
     // Upload the template, if necessary, before passing it to CFN
@@ -432,9 +453,9 @@ export class Deployments {
       resolvedEnvironment,
       new AssetManifestBuilder(),
       envResources,
-      stackSdk);
+    );
 
-    const response = await cfn.getTemplateSummary(cfnParam).promise();
+    const response = await cfn.getTemplateSummary(cfnParam);
     if (!response.ResourceIdentifierSummaries) {
       debug('GetTemplateSummary API call did not return "ResourceIdentifierSummaries"');
     }
@@ -445,7 +466,9 @@ export class Deployments {
     let deploymentMethod = options.deploymentMethod;
     if (options.changeSetName || options.execute !== undefined) {
       if (deploymentMethod) {
-        throw new Error('You cannot supply both \'deploymentMethod\' and \'changeSetName/execute\'. Supply one or the other.');
+        throw new Error(
+          "You cannot supply both 'deploymentMethod' and 'changeSetName/execute'. Supply one or the other.",
+        );
       }
       deploymentMethod = {
         method: 'change-set',
@@ -454,19 +477,19 @@ export class Deployments {
       };
     }
 
-    const {
-      stackSdk,
-      resolvedEnvironment,
-      cloudFormationRoleArn,
-      envResources,
-    } = await this.prepareSdkFor(options.stack, options.roleArn, Mode.ForWriting);
+    const { stackSdk, resolvedEnvironment, cloudFormationRoleArn, envResources } = await this.prepareSdkFor(
+      options.stack,
+      options.roleArn,
+      Mode.ForWriting,
+    );
 
     // Do a verification of the bootstrap stack version
     await this.validateBootstrapStackVersion(
       options.stack.stackName,
       options.stack.requiresBootstrapStackVersion,
       options.stack.bootstrapStackVersionSsmParameter,
-      envResources);
+      envResources,
+    );
 
     return deployStack({
       stack: options.stack,
@@ -514,7 +537,8 @@ export class Deployments {
         options.stack.stackName,
         BOOTSTRAP_STACK_VERSION_FOR_ROLLBACK,
         options.stack.bootstrapStackVersionSsmParameter,
-        envResources);
+        envResources,
+      );
     }
 
     const cfn = stackSdk.cloudFormation();
@@ -538,7 +562,7 @@ export class Deployments {
             ClientRequestToken: randomUUID(),
             // Enabling this is just the better overall default, the only reason it isn't the upstream default is backwards compatibility
             RetainExceptOnCreate: true,
-          }).promise();
+          });
           break;
 
         case RollbackChoice.CONTINUE_UPDATE_ROLLBACK:
@@ -552,33 +576,35 @@ export class Deployments {
             });
             await poller.poll();
             resourcesToSkip = poller.resourceErrors
-              .filter(r => !r.isStackEvent && r.parentStackLogicalIds.length === 0)
-              .map(r => r.event.LogicalResourceId ?? '');
+              .filter((r) => !r.isStackEvent && r.parentStackLogicalIds.length === 0)
+              .map((r) => r.event.LogicalResourceId ?? '');
           }
 
-          const skipDescription = resourcesToSkip.length > 0
-            ? ` (orphaning: ${resourcesToSkip.join(', ')})`
-            : '';
+          const skipDescription = resourcesToSkip.length > 0 ? ` (orphaning: ${resourcesToSkip.join(', ')})` : '';
           warning(`Continuing rollback of stack ${deployName}${skipDescription}`);
           await cfn.continueUpdateRollback({
             StackName: deployName,
             ClientRequestToken: randomUUID(),
             RoleARN: cloudFormationRoleArn,
             ResourcesToSkip: resourcesToSkip,
-          }).promise();
+          });
           break;
 
         case RollbackChoice.ROLLBACK_FAILED:
-          warning(`Stack ${deployName} failed creation and rollback. This state cannot be rolled back. You can recreate this stack by running 'cdk deploy'.`);
+          warning(
+            `Stack ${deployName} failed creation and rollback. This state cannot be rolled back. You can recreate this stack by running 'cdk deploy'.`,
+          );
           return { notInRollbackableState: true };
 
         default:
           throw new Error(`Unexpected rollback choice: ${cloudFormationStack.stackStatus.rollbackChoice}`);
       }
 
-      const monitor = options.quiet ? undefined : StackActivityMonitor.withDefaultPrinter(cfn, deployName, options.stack, {
-        ci: options.ci,
-      }).start();
+      const monitor = options.quiet
+        ? undefined
+        : StackActivityMonitor.withDefaultPrinter(cfn, deployName, options.stack, {
+          ci: options.ci,
+        }).start();
 
       let stackErrorMessage: string | undefined = undefined;
       let finalStackState = cloudFormationStack;
@@ -586,7 +612,9 @@ export class Deployments {
         const successStack = await stabilizeStack(cfn, deployName);
 
         // This shouldn't really happen, but catch it anyway. You never know.
-        if (!successStack) { throw new Error('Stack deploy failed (the stack disappeared while we were rolling it back)'); }
+        if (!successStack) {
+          throw new Error('Stack deploy failed (the stack disappeared while we were rolling it back)');
+        }
         finalStackState = successStack;
 
         const errors = monitor?.errors?.join(', ');
@@ -609,13 +637,21 @@ export class Deployments {
         continue;
       }
 
-      throw new Error(`${stackErrorMessage} (fix problem and retry, or orphan these resources using --orphan or --force)`);;
+      throw new Error(
+        `${stackErrorMessage} (fix problem and retry, or orphan these resources using --orphan or --force)`,
+      );
     }
-    throw new Error('Rollback did not finish after a large number of iterations; stopping because it looks like we\'re not making progress anymore. You can retry if rollback was progressing as expected.');
+    throw new Error(
+      "Rollback did not finish after a large number of iterations; stopping because it looks like we're not making progress anymore. You can retry if rollback was progressing as expected.",
+    );
   }
 
   public async destroyStack(options: DestroyStackOptions): Promise<void> {
-    const { stackSdk, cloudFormationRoleArn: roleArn } = await this.prepareSdkFor(options.stack, options.roleArn, Mode.ForWriting);
+    const { stackSdk, cloudFormationRoleArn: roleArn } = await this.prepareSdkFor(
+      options.stack,
+      options.roleArn,
+      Mode.ForWriting,
+    );
 
     return destroyStack({
       sdk: stackSdk,
@@ -634,15 +670,22 @@ export class Deployments {
     } else {
       stackSdk = (await this.prepareSdkFor(options.stack, undefined, Mode.ForReading)).stackSdk;
     }
-    const stack = await CloudFormationStack.lookup(stackSdk.cloudFormation(), options.deployName ?? options.stack.stackName);
+    const stack = await CloudFormationStack.lookup(
+      stackSdk.cloudFormation(),
+      options.deployName ?? options.stack.stackName,
+    );
     return stack.exists;
   }
 
-  public async prepareSdkWithDeployRole(stackArtifact: cxapi.CloudFormationStackArtifact): Promise<PreparedSdkForEnvironment> {
+  public async prepareSdkWithDeployRole(
+    stackArtifact: cxapi.CloudFormationStackArtifact,
+  ): Promise<PreparedSdkForEnvironment> {
     return this.prepareSdkFor(stackArtifact, undefined, Mode.ForWriting);
   }
 
-  private async prepareSdkWithLookupOrDeployRole(stackArtifact: cxapi.CloudFormationStackArtifact): Promise<PreparedSdkForEnvironment> {
+  private async prepareSdkWithLookupOrDeployRole(
+    stackArtifact: cxapi.CloudFormationStackArtifact,
+  ): Promise<PreparedSdkForEnvironment> {
     // try to assume the lookup role
     try {
       const result = await this.prepareSdkWithLookupRoleFor(stackArtifact);
@@ -653,7 +696,7 @@ export class Deployments {
           envResources: result.envResources,
         };
       }
-    } catch { }
+    } catch {}
     // fall back to the deploy role
     return this.prepareSdkFor(stackArtifact, undefined, Mode.ForReading);
   }
@@ -679,54 +722,64 @@ export class Deployments {
     const resolvedEnvironment = await this.resolveEnvironment(stack);
 
     // Substitute any placeholders with information about the current environment
-    const arns = await replaceEnvPlaceholders({
-      assumeRoleArn: stack.assumeRoleArn,
+    const arns = await replaceEnvPlaceholders(
+      {
+        assumeRoleArn: stack.assumeRoleArn,
 
-      // Use the override if given, otherwise use the field from the stack
-      cloudFormationRoleArn: roleArn ?? stack.cloudFormationExecutionRoleArn,
-    }, resolvedEnvironment, this.sdkProvider);
+        // Use the override if given, otherwise use the field from the stack
+        cloudFormationRoleArn: roleArn ?? stack.cloudFormationExecutionRoleArn,
+      },
+      resolvedEnvironment,
+      this.sdkProvider,
+    );
 
-    const stackSdk = await this.cachedSdkForEnvironment(resolvedEnvironment, mode, {
-      assumeRoleArn: arns.assumeRoleArn,
-      assumeRoleExternalId: stack.assumeRoleExternalId,
-      assumeRoleAdditionalOptions: stack.assumeRoleAdditionalOptions,
-    });
+    const stackSdk = (
+      await this.cachedSdkForEnvironment(resolvedEnvironment, mode, {
+        assumeRoleArn: arns.assumeRoleArn,
+        assumeRoleExternalId: stack.assumeRoleExternalId,
+        assumeRoleAdditionalOptions: stack.assumeRoleAdditionalOptions,
+      })
+    ).sdk;
 
     return {
-      stackSdk: stackSdk.sdk,
+      stackSdk: stackSdk,
       resolvedEnvironment,
       cloudFormationRoleArn: arns.cloudFormationRoleArn,
-      envResources: this.environmentResources.for(resolvedEnvironment, stackSdk.sdk),
+      envResources: this.environmentResources.for(resolvedEnvironment, stackSdk),
     };
   }
 
   /**
-    * Try to use the bootstrap lookupRole. There are two scenarios that are handled here
-    *  1. The lookup role may not exist (it was added in bootstrap stack version 7)
-    *  2. The lookup role may not have the correct permissions (ReadOnlyAccess was added in
-    *      bootstrap stack version 8)
-    *
-    * In the case of 1 (lookup role doesn't exist) `forEnvironment` will either:
-    *   1. Return the default credentials if the default credentials are for the stack account
-    *   2. Throw an error if the default credentials are not for the stack account.
-    *
-    * If we successfully assume the lookup role we then proceed to 2 and check whether the bootstrap
-    * stack version is valid. If it is not we throw an error which should be handled in the calling
-    * function (and fallback to use a different role, etc)
-    *
-    * If we do not successfully assume the lookup role, but do get back the default credentials
-    * then return those and note that we are returning the default credentials. The calling
-    * function can then decide to use them or fallback to another role.
-    */
+   * Try to use the bootstrap lookupRole. There are two scenarios that are handled here
+   *  1. The lookup role may not exist (it was added in bootstrap stack version 7)
+   *  2. The lookup role may not have the correct permissions (ReadOnlyAccess was added in
+   *      bootstrap stack version 8)
+   *
+   * In the case of 1 (lookup role doesn't exist) `forEnvironment` will either:
+   *   1. Return the default credentials if the default credentials are for the stack account
+   *   2. Throw an error if the default credentials are not for the stack account.
+   *
+   * If we successfully assume the lookup role we then proceed to 2 and check whether the bootstrap
+   * stack version is valid. If it is not we throw an error which should be handled in the calling
+   * function (and fallback to use a different role, etc)
+   *
+   * If we do not successfully assume the lookup role, but do get back the default credentials
+   * then return those and note that we are returning the default credentials. The calling
+   * function can then decide to use them or fallback to another role.
+   */
   public async prepareSdkWithLookupRoleFor(
     stack: cxapi.CloudFormationStackArtifact,
   ): Promise<PreparedSdkWithLookupRoleForEnvironment> {
     const resolvedEnvironment = await this.sdkProvider.resolveEnvironment(stack.environment);
 
     // Substitute any placeholders with information about the current environment
-    const arns = await replaceEnvPlaceholders({
-      lookupRoleArn: stack.lookupRole?.arn,
-    }, resolvedEnvironment, this.sdkProvider);
+    const arns = await replaceEnvPlaceholders(
+      {
+        lookupRoleArn: stack.lookupRole?.arn,
+      },
+      resolvedEnvironment,
+      this.sdkProvider,
+    );
 
     // try to assume the lookup role
     const warningMessage = `Could not assume ${arns.lookupRoleArn}, proceeding anyway.`;
@@ -742,14 +795,22 @@ export class Deployments {
       const envResources = this.environmentResources.for(resolvedEnvironment, stackSdk.sdk);
 
       // if we succeed in assuming the lookup role, make sure we have the correct bootstrap stack version
-      if (stackSdk.didAssumeRole && stack.lookupRole?.bootstrapStackVersionSsmParameter && stack.lookupRole.requiresBootstrapStackVersion) {
+      if (
+        stackSdk.didAssumeRole &&
+        stack.lookupRole?.bootstrapStackVersionSsmParameter &&
+        stack.lookupRole.requiresBootstrapStackVersion
+      ) {
         const version = await envResources.versionFromSsmParameter(stack.lookupRole.bootstrapStackVersionSsmParameter);
         if (version < stack.lookupRole.requiresBootstrapStackVersion) {
-          throw new Error(`Bootstrap stack version '${stack.lookupRole.requiresBootstrapStackVersion}' is required, found version '${version}'. To get rid of this error, please upgrade to bootstrap version >= ${stack.lookupRole.requiresBootstrapStackVersion}`);
+          throw new Error(
+            `Bootstrap stack version '${stack.lookupRole.requiresBootstrapStackVersion}' is required, found version '${version}'. To get rid of this error, please upgrade to bootstrap version >= ${stack.lookupRole.requiresBootstrapStackVersion}`,
+          );
         }
       } else if (!stackSdk.didAssumeRole) {
         const lookUpRoleExists = stack.lookupRole ? true : false;
-        warning(`Lookup role ${ lookUpRoleExists ? 'exists but' : 'does not exist, hence'} was not assumed. Proceeding with default credentials.`);
+        warning(
+          `Lookup role ${lookUpRoleExists ? 'exists but' : 'does not exist, hence'} was not assumed. Proceeding with default credentials.`,
+        );
       }
       return { ...stackSdk, resolvedEnvironment, envResources };
     } catch (e: any) {
@@ -764,8 +825,7 @@ export class Deployments {
       if (e instanceof Error && e.message.includes('Bootstrap stack version')) {
         error(e.message);
       }
-
-      throw (e);
+      throw e;
     }
   }
 
@@ -776,7 +836,8 @@ export class Deployments {
       options.stack.stackName,
       asset.requiresBootstrapStackVersion,
       asset.bootstrapStackVersionSsmParameter,
-      envResources);
+      envResources,
+    );
 
     const manifest = AssetManifest.fromFile(asset.file);
 
@@ -806,15 +867,24 @@ export class Deployments {
   /**
    * Build a single asset from an asset manifest
    */
-  // eslint-disable-next-line max-len
-  public async buildSingleAsset(assetArtifact: cxapi.AssetManifestArtifact, assetManifest: AssetManifest, asset: IManifestEntry, options: BuildStackAssetsOptions) {
-    const { resolvedEnvironment, envResources } = await this.prepareSdkFor(options.stack, options.roleArn, Mode.ForWriting);
+  public async buildSingleAsset(
+    assetArtifact: cxapi.AssetManifestArtifact,
+    assetManifest: AssetManifest,
+    asset: IManifestEntry,
+    options: BuildStackAssetsOptions,
+  ) {
+    const { resolvedEnvironment, envResources } = await this.prepareSdkFor(
+      options.stack,
+      options.roleArn,
+      Mode.ForWriting,
+    );
 
     await this.validateBootstrapStackVersion(
       options.stack.stackName,
       assetArtifact.requiresBootstrapStackVersion,
       assetArtifact.bootstrapStackVersionSsmParameter,
-      envResources);
+      envResources,
+    );
 
     const publisher = this.cachedPublisher(assetManifest, resolvedEnvironment, options.stackName);
     await publisher.buildEntry(asset);
@@ -827,7 +897,11 @@ export class Deployments {
    * Publish a single asset from an asset manifest
    */
   // eslint-disable-next-line max-len
-  public async publishSingleAsset(assetManifest: AssetManifest, asset: IManifestEntry, options: PublishStackAssetsOptions) {
+  public async publishSingleAsset(
+    assetManifest: AssetManifest,
+    asset: IManifestEntry,
+    options: PublishStackAssetsOptions,
+  ) {
     const { resolvedEnvironment: stackEnv } = await this.prepareSdkFor(options.stack, options.roleArn, Mode.ForWriting);
 
     // No need to validate anymore, we already did that during build
@@ -841,7 +915,11 @@ export class Deployments {
   /**
    * Return whether a single asset has been published already
    */
-  public async isSingleAssetPublished(assetManifest: AssetManifest, asset: IManifestEntry, options: PublishStackAssetsOptions) {
+  public async isSingleAssetPublished(
+    assetManifest: AssetManifest,
+    asset: IManifestEntry,
+    options: PublishStackAssetsOptions,
+  ) {
     const { resolvedEnvironment: stackEnv } = await this.prepareSdkFor(options.stack, options.roleArn, Mode.ForWriting);
     const publisher = this.cachedPublisher(assetManifest, stackEnv, options.stackName);
     return publisher.isEntryPublished(asset);
@@ -856,8 +934,8 @@ export class Deployments {
     stackName: string,
     requiresBootstrapStackVersion: number | undefined,
     bootstrapStackVersionSsmParameter: string | undefined,
-    envResources: EnvironmentResources) {
-
+    envResources: EnvironmentResources,
+  ) {
     try {
       await envResources.validateVersion(requiresBootstrapStackVersion, bootstrapStackVersionSsmParameter);
     } catch (e: any) {
@@ -865,11 +943,7 @@ export class Deployments {
     }
   }
 
-  private async cachedSdkForEnvironment(
-    environment: cxapi.Environment,
-    mode: Mode,
-    options?: CredentialsOptions,
-  ) {
+  private async cachedSdkForEnvironment(environment: cxapi.Environment, mode: Mode, options?: CredentialsOptions) {
     const cacheKeyElements = [
       environment.account,
       environment.region,
@@ -911,8 +985,10 @@ export class Deployments {
  * Asset progress that doesn't do anything with percentages (currently)
  */
 class ParallelSafeAssetProgress implements cdk_assets.IPublishProgressListener {
-  constructor(private readonly prefix: string, private readonly quiet: boolean) {
-  }
+  constructor(
+    private readonly prefix: string,
+    private readonly quiet: boolean,
+  ) {}
 
   public onPublishEvent(type: cdk_assets.EventType, event: cdk_assets.IPublishProgress): void {
     const handler = this.quiet && type !== 'fail' ? debug : EVENT_TO_LOGGER[type];
@@ -920,14 +996,6 @@ class ParallelSafeAssetProgress implements cdk_assets.IPublishProgressListener {
   }
 }
 
-/**
- * @deprecated Use 'Deployments' instead
- */
-export class CloudFormationDeployments extends Deployments {
-}
-
 function suffixWithErrors(msg: string, errors?: string[]) {
-  return errors && errors.length > 0
-    ? `${msg}: ${errors.join(', ')}`
-    : msg;
-}
\ No newline at end of file
+  return errors && errors.length > 0 ? `${msg}: ${errors.join(', ')}` : msg;
+}
diff --git a/packages/aws-cdk/lib/api/environment-resources.ts b/packages/aws-cdk/lib/api/environment-resources.ts
index 937e813ad8f95..0c6aa7f7476ee 100644
--- a/packages/aws-cdk/lib/api/environment-resources.ts
+++ b/packages/aws-cdk/lib/api/environment-resources.ts
@@ -1,6 +1,6 @@
-import * as cxapi from '@aws-cdk/cx-api';
-import { ISDK } from './aws-auth';
-import { EcrRepositoryInfo, ToolkitInfo } from './toolkit-info';
+import type { Environment } from '@aws-cdk/cx-api';
+import type { SDK } from './aws-auth';
+import { type EcrRepositoryInfo, ToolkitInfo } from './toolkit-info';
 import { debug, warning } from '../logging';
 import { Notices } from '../notices';
 
@@ -16,10 +16,9 @@ import { Notices } from '../notices';
 export class EnvironmentResourcesRegistry {
   private readonly cache = new Map<string, EnvironmentCache>();
 
-  constructor(private readonly toolkitStackName?: string) {
-  }
+  constructor(private readonly toolkitStackName?: string) {}
 
-  public for(resolvedEnvironment: cxapi.Environment, sdk: ISDK) {
+  public for(resolvedEnvironment: Environment, sdk: SDK) {
     const key = `${resolvedEnvironment.account}:${resolvedEnvironment.region}`;
     let envCache = this.cache.get(key);
     if (!envCache) {
@@ -44,8 +43,8 @@ export class EnvironmentResourcesRegistry {
  */
 export class EnvironmentResources {
   constructor(
-    public readonly environment: cxapi.Environment,
-    private readonly sdk: ISDK,
+    public readonly environment: Environment,
+    private readonly sdk: SDK,
     private readonly cache: EnvironmentCache,
     private readonly toolkitStackName?: string,
   ) {}
@@ -81,7 +80,9 @@ export class EnvironmentResources {
         doValidate(await this.versionFromSsmParameter(ssmParameterName), this.environment);
         return;
       } catch (e: any) {
-        if (e.code !== 'AccessDeniedException') { throw e; }
+        if (e.name !== 'AccessDeniedException') {
+          throw e;
+        }
 
         // This is a fallback! The bootstrap template that goes along with this change introduces
         // a new 'ssm:GetParameter' permission, but when run using the previous bootstrap template we
@@ -92,12 +93,16 @@ export class EnvironmentResources {
         // so let it fail as it would if we didn't have this fallback.
         const bootstrapStack = await this.lookupToolkit();
         if (bootstrapStack.found && bootstrapStack.version < BOOTSTRAP_TEMPLATE_VERSION_INTRODUCING_GETPARAMETER) {
-          warning(`Could not read SSM parameter ${ssmParameterName}: ${e.message}, falling back to version from ${bootstrapStack}`);
+          warning(
+            `Could not read SSM parameter ${ssmParameterName}: ${e.message}, falling back to version from ${bootstrapStack}`,
+          );
           doValidate(bootstrapStack.version, this.environment);
           return;
         }
 
-        throw new Error(`This CDK deployment requires bootstrap stack version '${expectedVersion}', but during the confirmation via SSM parameter ${ssmParameterName} the following error occurred: ${e}`);
+        throw new Error(
+          `This CDK deployment requires bootstrap stack version '${expectedVersion}', but during the confirmation via SSM parameter ${ssmParameterName} the following error occurred: ${e}`,
+        );
       }
     }
 
@@ -105,7 +110,7 @@ export class EnvironmentResources {
     const bootstrapStack = await this.lookupToolkit();
     doValidate(bootstrapStack.version, this.environment);
 
-    function doValidate(version: number, environment: cxapi.Environment) {
+    function doValidate(version: number, environment: Environment) {
       const notices = Notices.get();
       if (notices) {
         // if `Notices` hasn't been initialized there is probably a good
@@ -113,7 +118,9 @@ export class EnvironmentResources {
         notices.addBootstrappedEnvironment({ bootstrapStackVersion: version, environment });
       }
       if (defExpectedVersion > version) {
-        throw new Error(`This CDK deployment requires bootstrap stack version '${expectedVersion}', found '${version}'. Please run 'cdk bootstrap'.`);
+        throw new Error(
+          `This CDK deployment requires bootstrap stack version '${expectedVersion}', found '${version}'. Please run 'cdk bootstrap'.`,
+        );
       }
     }
   }
@@ -123,12 +130,14 @@ export class EnvironmentResources {
    */
   public async versionFromSsmParameter(parameterName: string): Promise<number> {
     const existing = this.cache.ssmParameters.get(parameterName);
-    if (existing !== undefined) { return existing; }
+    if (existing !== undefined) {
+      return existing;
+    }
 
     const ssm = this.sdk.ssm();
 
     try {
-      const result = await ssm.getParameter({ Name: parameterName }).promise();
+      const result = await ssm.getParameter({ Name: parameterName });
 
       const asNumber = parseInt(`${result.Parameter?.Value}`, 10);
       if (isNaN(asNumber)) {
@@ -138,8 +147,10 @@ export class EnvironmentResources {
       this.cache.ssmParameters.set(parameterName, asNumber);
       return asNumber;
     } catch (e: any) {
-      if (e.code === 'ParameterNotFound') {
-        throw new Error(`SSM parameter ${parameterName} not found. Has the environment been bootstrapped? Please run \'cdk bootstrap\' (see https://docs.aws.amazon.com/cdk/latest/guide/bootstrapping.html)`);
+      if (e.name === 'ParameterNotFound') {
+        throw new Error(
+          `SSM parameter ${parameterName} not found. Has the environment been bootstrapped? Please run \'cdk bootstrap\' (see https://docs.aws.amazon.com/cdk/latest/guide/bootstrapping.html)`,
+        );
       }
       throw e;
     }
@@ -154,19 +165,26 @@ export class EnvironmentResources {
     // check if repo already exists
     try {
       debug(`${repositoryName}: checking if ECR repository already exists`);
-      const describeResponse = await ecr.describeRepositories({ repositoryNames: [repositoryName] }).promise();
+      const describeResponse = await ecr.describeRepositories({
+        repositoryNames: [repositoryName],
+      });
       const existingRepositoryUri = describeResponse.repositories![0]?.repositoryUri;
       if (existingRepositoryUri) {
         return { repositoryUri: existingRepositoryUri };
       }
     } catch (e: any) {
-      if (e.code !== 'RepositoryNotFoundException') { throw e; }
+      if (e.name !== 'RepositoryNotFoundException') {
+        throw e;
+      }
     }
 
     // create the repo (tag it so it will be easier to garbage collect in the future)
     debug(`${repositoryName}: creating ECR repository`);
     const assetTag = { Key: 'awscdk:asset', Value: 'true' };
-    const response = await ecr.createRepository({ repositoryName, tags: [assetTag] }).promise();
+    const response = await ecr.createRepository({
+      repositoryName,
+      tags: [assetTag],
+    });
     const repositoryUri = response.repository?.repositoryUri;
     if (!repositoryUri) {
       throw new Error(`CreateRepository did not return a repository URI for ${repositoryUri}`);
@@ -174,14 +192,17 @@ export class EnvironmentResources {
 
     // configure image scanning on push (helps in identifying software vulnerabilities, no additional charge)
     debug(`${repositoryName}: enable image scanning`);
-    await ecr.putImageScanningConfiguration({ repositoryName, imageScanningConfiguration: { scanOnPush: true } }).promise();
+    await ecr.putImageScanningConfiguration({
+      repositoryName,
+      imageScanningConfiguration: { scanOnPush: true },
+    });
 
     return { repositoryUri };
   }
 }
 
 export class NoBootstrapStackEnvironmentResources extends EnvironmentResources {
-  constructor(environment: cxapi.Environment, sdk: ISDK) {
+  constructor(environment: Environment, sdk: SDK) {
     super(environment, sdk, emptyCache());
   }
 
@@ -189,7 +210,9 @@ export class NoBootstrapStackEnvironmentResources extends EnvironmentResources {
    * Look up the toolkit for a given environment, using a given SDK
    */
   public async lookupToolkit(): Promise<ToolkitInfo> {
-    throw new Error('Trying to perform an operation that requires a bootstrap stack; you should not see this error, this is a bug in the CDK CLI.');
+    throw new Error(
+      'Trying to perform an operation that requires a bootstrap stack; you should not see this error, this is a bug in the CDK CLI.',
+    );
   }
 }
 
diff --git a/packages/aws-cdk/lib/api/evaluate-cloudformation-template.ts b/packages/aws-cdk/lib/api/evaluate-cloudformation-template.ts
index bf89af5ac6021..75c96c4eb6ad3 100644
--- a/packages/aws-cdk/lib/api/evaluate-cloudformation-template.ts
+++ b/packages/aws-cdk/lib/api/evaluate-cloudformation-template.ts
@@ -1,52 +1,41 @@
-import * as AWS from 'aws-sdk';
-import { PromiseResult } from 'aws-sdk/lib/request';
-import { ISDK } from './aws-auth';
-import { NestedStackTemplates } from './nested-stack-helpers';
+import type { Export, ListExportsCommandOutput, StackResourceSummary } from '@aws-sdk/client-cloudformation';
+import type { SDK } from './aws-auth';
+import type { NestedStackTemplates } from './nested-stack-helpers';
 
 export interface ListStackResources {
-  listStackResources(): Promise<AWS.CloudFormation.StackResourceSummary[]>;
+  listStackResources(): Promise<StackResourceSummary[]>;
 }
 
 export class LazyListStackResources implements ListStackResources {
-  private stackResources: Promise<AWS.CloudFormation.StackResourceSummary[]> | undefined;
+  private stackResources: Promise<StackResourceSummary[]> | undefined;
 
-  constructor(private readonly sdk: ISDK, private readonly stackName: string) {
-  }
+  constructor(
+    private readonly sdk: SDK,
+    private readonly stackName: string,
+  ) {}
 
-  public async listStackResources(): Promise<AWS.CloudFormation.StackResourceSummary[]> {
+  public async listStackResources(): Promise<StackResourceSummary[]> {
     if (this.stackResources === undefined) {
-      this.stackResources = this.getStackResources(undefined);
+      this.stackResources = this.sdk.cloudFormation().listStackResources({
+        StackName: this.stackName,
+      });
     }
     return this.stackResources;
   }
-
-  private async getStackResources(nextToken: string | undefined): Promise<AWS.CloudFormation.StackResourceSummary[]> {
-    const ret = new Array<AWS.CloudFormation.StackResourceSummary>();
-    return this.sdk.cloudFormation().listStackResources({
-      StackName: this.stackName,
-      NextToken: nextToken,
-    }).promise().then(async stackResourcesResponse => {
-      ret.push(...(stackResourcesResponse.StackResourceSummaries ?? []));
-      if (stackResourcesResponse.NextToken) {
-        ret.push(...await this.getStackResources(stackResourcesResponse.NextToken));
-      }
-      return ret;
-    });
-  }
 }
 
 export interface LookupExport {
-  lookupExport(name: string): Promise<AWS.CloudFormation.Export | undefined>;
+  lookupExport(name: string): Promise<Export | undefined>;
 }
 
-export class LookupExportError extends Error { }
+export class LookupExportError extends Error {}
 
 export class LazyLookupExport implements LookupExport {
-  private cachedExports: { [name: string]: AWS.CloudFormation.Export } = {}
+  private cachedExports: { [name: string]: Export } = {};
 
-  constructor(private readonly sdk: ISDK) { }
+  constructor(private readonly sdk: SDK) {}
 
-  async lookupExport(name: string): Promise<AWS.CloudFormation.Export | undefined> {
+  async lookupExport(name: string): Promise<Export | undefined> {
     if (this.cachedExports[name]) {
       return this.cachedExports[name];
     }
@@ -60,19 +49,16 @@ export class LazyLookupExport implements LookupExport {
       if (cfnExport.Name === name) {
         return cfnExport;
       }
-
     }
 
     return undefined; // export not found
   }
 
-  private async * listExports() {
+  // TODO: Paginate
+  private async *listExports() {
     let nextToken: string | undefined = undefined;
     while (true) {
-      const response: PromiseResult<AWS.CloudFormation.ListExportsOutput, AWS.AWSError> = await this.sdk.cloudFormation().listExports({
-        NextToken: nextToken,
-      }).promise();
-
+      const response: ListExportsCommandOutput = await this.sdk.cloudFormation().listExports({ NextToken: nextToken });
       for (const cfnExport of response.Exports ?? []) {
         yield cfnExport;
       }
@@ -85,7 +71,7 @@ export class LazyLookupExport implements LookupExport {
   }
 }
 
-export class CfnEvaluationException extends Error { }
+export class CfnEvaluationException extends Error {}
 
 export interface ResourceDefinition {
   readonly LogicalId: string;
@@ -100,9 +86,10 @@ export interface EvaluateCloudFormationTemplateProps {
   readonly account: string;
   readonly region: string;
   readonly partition: string;
-  readonly urlSuffix: (region: string) => string;
-  readonly sdk: ISDK;
-  readonly nestedStacks?: { [nestedStackLogicalId: string]: NestedStackTemplates };
+  readonly sdk: SDK;
+  readonly nestedStacks?: {
+    [nestedStackLogicalId: string]: NestedStackTemplates;
+  };
 }
 
 export class EvaluateCloudFormationTemplate {
@@ -112,9 +99,10 @@ export class EvaluateCloudFormationTemplate {
   private readonly account: string;
   private readonly region: string;
   private readonly partition: string;
-  private readonly urlSuffix: (region: string) => string;
-  private readonly sdk: ISDK;
-  private readonly nestedStacks: { [nestedStackLogicalId: string]: NestedStackTemplates };
+  private readonly sdk: SDK;
+  private readonly nestedStacks: {
+    [nestedStackLogicalId: string]: NestedStackTemplates;
+  };
   private readonly stackResources: ListStackResources;
   private readonly lookupExport: LookupExport;
 
@@ -132,7 +120,6 @@ export class EvaluateCloudFormationTemplate {
     this.account = props.account;
     this.region = props.region;
     this.partition = props.partition;
-    this.urlSuffix = props.urlSuffix;
     this.sdk = props.sdk;
 
     // We need names of nested stack so we can evaluate cross stack references
@@ -161,13 +148,15 @@ export class EvaluateCloudFormationTemplate {
       account: this.account,
       region: this.region,
       partition: this.partition,
-      urlSuffix: this.urlSuffix,
       sdk: this.sdk,
       nestedStacks: this.nestedStacks,
     });
   }
 
-  public async establishResourcePhysicalName(logicalId: string, physicalNameInCfnTemplate: any): Promise<string | undefined> {
+  public async establishResourcePhysicalName(
+    logicalId: string,
+    physicalNameInCfnTemplate: any,
+  ): Promise<string | undefined> {
     if (physicalNameInCfnTemplate != null) {
       try {
         return await this.evaluateCfnExpression(physicalNameInCfnTemplate);
@@ -184,12 +173,12 @@ export class EvaluateCloudFormationTemplate {
 
   public async findPhysicalNameFor(logicalId: string): Promise<string | undefined> {
     const stackResources = await this.stackResources.listStackResources();
-    return stackResources.find(sr => sr.LogicalResourceId === logicalId)?.PhysicalResourceId;
+    return stackResources.find((sr) => sr.LogicalResourceId === logicalId)?.PhysicalResourceId;
   }
 
   public async findLogicalIdForPhysicalName(physicalName: string): Promise<string | undefined> {
     const stackResources = await this.stackResources.listStackResources();
-    return stackResources.find(sr => sr.PhysicalResourceId === physicalName)?.LogicalResourceId;
+    return stackResources.find((sr) => sr.PhysicalResourceId === physicalName)?.LogicalResourceId;
   }
 
   public findReferencesTo(logicalId: string): Array<ResourceDefinition> {
@@ -242,7 +231,7 @@ export class EvaluateCloudFormationTemplate {
         return evaluatedArgs[index];
       }
 
-      async 'Ref'(logicalId: string): Promise<string> {
+      async Ref(logicalId: string): Promise<string> {
         const refTarget = await self.findRefTarget(logicalId);
         if (refTarget) {
           return refTarget;
@@ -257,23 +246,21 @@ export class EvaluateCloudFormationTemplate {
         if (attrValue) {
           return attrValue;
         } else {
-          throw new CfnEvaluationException(`Attribute '${attributeName}' of resource '${logicalId}' could not be found for evaluation`);
+          throw new CfnEvaluationException(
+            `Attribute '${attributeName}' of resource '${logicalId}' could not be found for evaluation`,
+          );
         }
       }
 
       async 'Fn::Sub'(template: string, explicitPlaceholders?: { [variable: string]: string }): Promise<string> {
-        const placeholders = explicitPlaceholders
-          ? await self.evaluateCfnExpression(explicitPlaceholders)
-          : {};
+        const placeholders = explicitPlaceholders ? await self.evaluateCfnExpression(explicitPlaceholders) : {};
 
-        return asyncGlobalReplace(template, /\${([^}]*)}/g, key => {
+        return asyncGlobalReplace(template, /\${([^}]*)}/g, (key) => {
           if (key in placeholders) {
             return placeholders[key];
           } else {
             const splitKey = key.split('.');
-            return splitKey.length === 1
-              ? this.Ref(key)
-              : this['Fn::GetAtt'](splitKey[0], splitKey.slice(1).join('.'));
+            return splitKey.length === 1 ? this.Ref(key) : this['Fn::GetAtt'](splitKey[0], splitKey.slice(1).join('.'));
           }
         });
       }
@@ -297,7 +284,7 @@ export class EvaluateCloudFormationTemplate {
     if (Array.isArray(cfnExpression)) {
       // Small arrays in practice
       // eslint-disable-next-line @aws-cdk/promiseall-no-unbounded-parallelism
-      return Promise.all(cfnExpression.map(expr => this.evaluateCfnExpression(expr)));
+      return Promise.all(cfnExpression.map((expr) => this.evaluateCfnExpression(expr)));
     }
 
     if (typeof cfnExpression === 'object') {
@@ -330,11 +317,11 @@ export class EvaluateCloudFormationTemplate {
     }
 
     if (Array.isArray(templateElement)) {
-      return templateElement.some(el => this.references(logicalId, el));
+      return templateElement.some((el) => this.references(logicalId, el));
     }
 
     if (typeof templateElement === 'object') {
-      return Object.values(templateElement).some(el => this.references(logicalId, el));
+      return Object.values(templateElement).some((el) => this.references(logicalId, el));
     }
 
     return false;
@@ -355,7 +342,7 @@ export class EvaluateCloudFormationTemplate {
     // first, check to see if the Ref is a Parameter who's value we have
     if (logicalId === 'AWS::URLSuffix') {
       if (!this.cachedUrlSuffix) {
-        this.cachedUrlSuffix = this.urlSuffix(this.region);
+        this.cachedUrlSuffix = await this.sdk.getUrlSuffix(this.region);
       }
 
       return this.cachedUrlSuffix;
@@ -378,7 +365,6 @@ export class EvaluateCloudFormationTemplate {
   }
 
   private async findGetAttTarget(logicalId: string, attribute?: string): Promise<string | undefined> {
-
     // Handle case where the attribute is referencing a stack output (used in nested stacks to share parameters)
     // See https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/quickref-cloudformation.html#w2ab1c17c23c19b5
     if (logicalId === 'Outputs' && attribute) {
@@ -386,7 +372,7 @@ export class EvaluateCloudFormationTemplate {
     }
 
     const stackResources = await this.stackResources.listStackResources();
-    const foundResource = stackResources.find(sr => sr.LogicalResourceId === logicalId);
+    const foundResource = stackResources.find((sr) => sr.LogicalResourceId === logicalId);
     if (!foundResource) {
       return undefined;
     }
@@ -400,30 +386,39 @@ export class EvaluateCloudFormationTemplate {
       const evaluateCfnTemplate = await this.createNestedEvaluateCloudFormationTemplate(
         dependantStack.physicalName,
         dependantStack.generatedTemplate,
-        dependantStack.generatedTemplate.Parameters!);
+        dependantStack.generatedTemplate.Parameters!,
+      );
 
       // Split Outputs.<refName> into 'Outputs' and '<refName>' and recursively call evaluate
-      return evaluateCfnTemplate.evaluateCfnExpression({ 'Fn::GetAtt': attribute.split(/\.(.*)/s) });
+      return evaluateCfnTemplate.evaluateCfnExpression({
+        'Fn::GetAtt': attribute.split(/\.(.*)/s),
+      });
     }
     // now, we need to format the appropriate identifier depending on the resource type,
     // and the requested attribute name
     return this.formatResourceAttribute(foundResource, attribute);
   }
 
-  private findNestedStack(logicalId: string, nestedStacks: {
-    [nestedStackLogicalId: string]: NestedStackTemplates;
-  }): NestedStackTemplates | undefined {
+  private findNestedStack(
+    logicalId: string,
+    nestedStacks: {
+      [nestedStackLogicalId: string]: NestedStackTemplates;
+    },
+  ): NestedStackTemplates | undefined {
     for (const nestedStackLogicalId of Object.keys(nestedStacks)) {
       if (nestedStackLogicalId === logicalId) {
         return nestedStacks[nestedStackLogicalId];
       }
-      const checkInNestedChildStacks = this.findNestedStack(logicalId, nestedStacks[nestedStackLogicalId].nestedStackTemplates);
+      const checkInNestedChildStacks = this.findNestedStack(
+        logicalId,
+        nestedStacks[nestedStackLogicalId].nestedStackTemplates,
+      );
       if (checkInNestedChildStacks) return checkInNestedChildStacks;
     }
     return undefined;
   }
 
-  private formatResourceAttribute(resource: AWS.CloudFormation.StackResourceSummary, attribute: string | undefined): string | undefined {
+  private formatResourceAttribute(resource: StackResourceSummary, attribute: string | undefined): string | undefined {
     const physicalId = resource.PhysicalResourceId;
 
     // no attribute means Ref expression, for which we use the physical ID directly
@@ -431,15 +426,19 @@ export class EvaluateCloudFormationTemplate {
       return physicalId;
     }
 
-    const resourceTypeFormats = RESOURCE_TYPE_ATTRIBUTES_FORMATS[resource.ResourceType];
+    const resourceTypeFormats = RESOURCE_TYPE_ATTRIBUTES_FORMATS[resource.ResourceType!];
     if (!resourceTypeFormats) {
-      throw new CfnEvaluationException(`We don't support attributes of the '${resource.ResourceType}' resource. This is a CDK limitation. ` +
-        'Please report it at https://github.com/aws/aws-cdk/issues/new/choose');
+      throw new CfnEvaluationException(
+        `We don't support attributes of the '${resource.ResourceType}' resource. This is a CDK limitation. ` +
+          'Please report it at https://github.com/aws/aws-cdk/issues/new/choose',
+      );
     }
     const attributeFmtFunc = resourceTypeFormats[attribute];
     if (!attributeFmtFunc) {
-      throw new CfnEvaluationException(`We don't support the '${attribute}' attribute of the '${resource.ResourceType}' resource. This is a CDK limitation. ` +
-        'Please report it at https://github.com/aws/aws-cdk/issues/new/choose');
+      throw new CfnEvaluationException(
+        `We don't support the '${attribute}' attribute of the '${resource.ResourceType}' resource. This is a CDK limitation. ` +
+          'Please report it at https://github.com/aws/aws-cdk/issues/new/choose',
+      );
     }
     const service = this.getServiceOfResource(resource);
     const resourceTypeArnPart = this.getResourceTypeArnPartOfResource(resource);
@@ -453,17 +452,17 @@ export class EvaluateCloudFormationTemplate {
     });
   }
 
-  private getServiceOfResource(resource: AWS.CloudFormation.StackResourceSummary): string {
-    return resource.ResourceType.split('::')[1].toLowerCase();
+  private getServiceOfResource(resource: StackResourceSummary): string {
+    return resource.ResourceType!.split('::')[1].toLowerCase();
   }
 
-  private getResourceTypeArnPartOfResource(resource: AWS.CloudFormation.StackResourceSummary): string {
-    const resourceType = resource.ResourceType;
+  private getResourceTypeArnPartOfResource(resource: StackResourceSummary): string {
+    const resourceType = resource.ResourceType!;
     const specialCaseResourceType = RESOURCE_TYPE_SPECIAL_NAMES[resourceType]?.resourceType;
     return specialCaseResourceType
       ? specialCaseResourceType
-      // this is the default case
-      : resourceType.split('::')[2].toLowerCase();
+      : // this is the default case
+      resourceType.split('::')[2].toLowerCase();
   }
 }
 
@@ -485,13 +484,17 @@ interface ArnParts {
  * However, some resource types break this simple convention, and we need to special-case them.
  * This map is for storing those cases.
  */
-const RESOURCE_TYPE_SPECIAL_NAMES: { [type: string]: { resourceType: string } } = {
+const RESOURCE_TYPE_SPECIAL_NAMES: {
+  [type: string]: { resourceType: string };
+} = {
   'AWS::Events::EventBus': {
     resourceType: 'event-bus',
   },
 };
 
-const RESOURCE_TYPE_ATTRIBUTES_FORMATS: { [type: string]: { [attribute: string]: (parts: ArnParts) => string } } = {
+const RESOURCE_TYPE_ATTRIBUTES_FORMATS: {
+  [type: string]: { [attribute: string]: (parts: ArnParts) => string };
+} = {
   'AWS::IAM::Role': { Arn: iamArnFmt },
   'AWS::IAM::User': { Arn: iamArnFmt },
   'AWS::IAM::Group': { Arn: iamArnFmt },
@@ -500,11 +503,13 @@ const RESOURCE_TYPE_ATTRIBUTES_FORMATS: { [type: string]: { [attribute: string]:
   'AWS::Events::EventBus': {
     Arn: stdSlashResourceArnFmt,
     // the name attribute of the EventBus is the same as the Ref
-    Name: parts => parts.resourceName,
+    Name: (parts) => parts.resourceName,
   },
   'AWS::DynamoDB::Table': { Arn: stdSlashResourceArnFmt },
   'AWS::AppSync::GraphQLApi': { ApiId: appsyncGraphQlApiApiIdFmt },
-  'AWS::AppSync::FunctionConfiguration': { FunctionId: appsyncGraphQlFunctionIDFmt },
+  'AWS::AppSync::FunctionConfiguration': {
+    FunctionId: appsyncGraphQlFunctionIDFmt,
+  },
   'AWS::AppSync::DataSource': { Name: appsyncGraphQlDataSourceNameFmt },
   'AWS::KMS::Key': { Arn: stdSlashResourceArnFmt },
 };
@@ -550,13 +555,17 @@ interface Intrinsic {
 }
 
 async function asyncGlobalReplace(str: string, regex: RegExp, cb: (x: string) => Promise<string>): Promise<string> {
-  if (!regex.global) { throw new Error('Regex must be created with /g flag'); }
+  if (!regex.global) {
+    throw new Error('Regex must be created with /g flag');
+  }
 
   const ret = new Array<string>();
   let start = 0;
   while (true) {
     const match = regex.exec(str);
-    if (!match) { break; }
+    if (!match) {
+      break;
+    }
 
     ret.push(str.substring(start, match.index));
     ret.push(await cb(match[1]));
diff --git a/packages/aws-cdk/lib/api/hotswap-deployments.ts b/packages/aws-cdk/lib/api/hotswap-deployments.ts
index 8aed36f033fc3..dc3d3657b8066 100644
--- a/packages/aws-cdk/lib/api/hotswap-deployments.ts
+++ b/packages/aws-cdk/lib/api/hotswap-deployments.ts
@@ -1,18 +1,32 @@
 import * as cfn_diff from '@aws-cdk/cloudformation-diff';
 import * as cxapi from '@aws-cdk/cx-api';
 import * as chalk from 'chalk';
-import { ISDK, Mode, SdkProvider } from './aws-auth';
-import { DeployStackResult } from './deploy-stack';
+import type { SDK, SdkProvider } from './aws-auth';
+import type { DeployStackResult } from './deploy-stack';
 import { EvaluateCloudFormationTemplate } from './evaluate-cloudformation-template';
 import { print } from '../logging';
 import { isHotswappableAppSyncChange } from './hotswap/appsync-mapping-templates';
 import { isHotswappableCodeBuildProjectChange } from './hotswap/code-build-projects';
-import { ICON, ChangeHotswapResult, HotswapMode, HotswappableChange, NonHotswappableChange, HotswappableChangeCandidate, ClassifiedResourceChanges, reportNonHotswappableChange, reportNonHotswappableResource } from './hotswap/common';
+import {
+  ICON,
+  ChangeHotswapResult,
+  HotswapMode,
+  HotswappableChange,
+  NonHotswappableChange,
+  HotswappableChangeCandidate,
+  ClassifiedResourceChanges,
+  reportNonHotswappableChange,
+  reportNonHotswappableResource,
+} from './hotswap/common';
 import { isHotswappableEcsServiceChange } from './hotswap/ecs-services';
 import { isHotswappableLambdaFunctionChange } from './hotswap/lambda-functions';
-import { skipChangeForS3DeployCustomResourcePolicy, isHotswappableS3BucketDeploymentChange } from './hotswap/s3-bucket-deployments';
+import {
+  skipChangeForS3DeployCustomResourcePolicy,
+  isHotswappableS3BucketDeploymentChange,
+} from './hotswap/s3-bucket-deployments';
 import { isHotswappableStateMachineChange } from './hotswap/stepfunctions-state-machines';
 import { NestedStackTemplates, loadCurrentTemplateWithNestedStacks } from './nested-stack-helpers';
+import { Mode } from './plugin';
 import { CloudFormationStack } from './util/cloudformation';
 
 // Must use a require() otherwise esbuild complains about calling a namespace
@@ -20,7 +34,9 @@ import { CloudFormationStack } from './util/cloudformation';
 const pLimit: typeof import('p-limit') = require('p-limit');
 
 type HotswapDetector = (
-  logicalId: string, change: HotswappableChangeCandidate, evaluateCfnTemplate: EvaluateCloudFormationTemplate
+  logicalId: string,
+  change: HotswappableChangeCandidate,
+  evaluateCfnTemplate: EvaluateCloudFormationTemplate,
 ) => Promise<ChangeHotswapResult>;
 
 const RESOURCE_DETECTORS: { [key: string]: HotswapDetector } = {
@@ -40,7 +56,9 @@ const RESOURCE_DETECTORS: { [key: string]: HotswapDetector } = {
   'AWS::StepFunctions::StateMachine': isHotswappableStateMachineChange,
   'Custom::CDKBucketDeployment': isHotswappableS3BucketDeploymentChange,
   'AWS::IAM::Policy': async (
-    logicalId: string, change: HotswappableChangeCandidate, evaluateCfnTemplate: EvaluateCloudFormationTemplate,
+    logicalId: string,
+    change: HotswappableChangeCandidate,
+    evaluateCfnTemplate: EvaluateCloudFormationTemplate,
   ): Promise<ChangeHotswapResult> => {
     // If the policy is for a S3BucketDeploymentChange, we can ignore the change
     if (await skipChangeForS3DeployCustomResourcePolicy(logicalId, change, evaluateCfnTemplate)) {
@@ -60,8 +78,10 @@ const RESOURCE_DETECTORS: { [key: string]: HotswapDetector } = {
  * returns `undefined`.
  */
 export async function tryHotswapDeployment(
-  sdkProvider: SdkProvider, assetParams: { [key: string]: string },
-  cloudFormationStack: CloudFormationStack, stackArtifact: cxapi.CloudFormationStackArtifact,
+  sdkProvider: SdkProvider,
+  assetParams: { [key: string]: string },
+  cloudFormationStack: CloudFormationStack,
+  stackArtifact: cxapi.CloudFormationStackArtifact,
   hotswapMode: HotswapMode,
 ): Promise<DeployStackResult | undefined> {
   // resolve the environment, so we can substitute things like AWS::Region in CFN expressions
@@ -79,14 +99,16 @@ export async function tryHotswapDeployment(
     account: resolvedEnv.account,
     region: resolvedEnv.region,
     partition: (await sdk.currentAccount()).partition,
-    urlSuffix: (region) => sdk.getEndpointSuffix(region),
     sdk,
     nestedStacks: currentTemplate.nestedStacks,
   });
 
   const stackChanges = cfn_diff.fullDiff(currentTemplate.deployedRootTemplate, stackArtifact.template);
   const { hotswappableChanges, nonHotswappableChanges } = await classifyResourceChanges(
-    stackChanges, evaluateCfnTemplate, sdk, currentTemplate.nestedStacks,
+    stackChanges,
+    evaluateCfnTemplate,
+    sdk,
+    currentTemplate.nestedStacks,
   );
 
   logNonHotswappableChanges(nonHotswappableChanges, hotswapMode);
@@ -101,7 +123,11 @@ export async function tryHotswapDeployment(
   // apply the short-circuitable changes
   await applyAllHotswappableChanges(sdk, hotswappableChanges);
 
-  return { noOp: hotswappableChanges.length === 0, stackArn: cloudFormationStack.stackId, outputs: cloudFormationStack.outputs };
+  return {
+    noOp: hotswappableChanges.length === 0,
+    stackArn: cloudFormationStack.stackId,
+    outputs: cloudFormationStack.outputs,
+  };
 }
 
 /**
@@ -111,7 +137,7 @@ export async function tryHotswapDeployment(
 async function classifyResourceChanges(
   stackChanges: cfn_diff.TemplateDiff,
   evaluateCfnTemplate: EvaluateCloudFormationTemplate,
-  sdk: ISDK,
+  sdk: SDK,
   nestedStackNames: { [nestedStackName: string]: NestedStackTemplates },
 ): Promise<ClassifiedResourceChanges> {
   const resourceDifferences = getStackResourceDifferences(stackChanges);
@@ -130,8 +156,17 @@ async function classifyResourceChanges(
   }
   // gather the results of the detector functions
   for (const [logicalId, change] of Object.entries(resourceDifferences)) {
-    if (change.newValue?.Type === 'AWS::CloudFormation::Stack' && change.oldValue?.Type === 'AWS::CloudFormation::Stack') {
-      const nestedHotswappableResources = await findNestedHotswappableChanges(logicalId, change, nestedStackNames, evaluateCfnTemplate, sdk);
+    if (
+      change.newValue?.Type === 'AWS::CloudFormation::Stack' &&
+      change.oldValue?.Type === 'AWS::CloudFormation::Stack'
+    ) {
+      const nestedHotswappableResources = await findNestedHotswappableChanges(
+        logicalId,
+        change,
+        nestedStackNames,
+        evaluateCfnTemplate,
+        sdk,
+      );
       hotswappableResources.push(...nestedHotswappableResources.hotswappableChanges);
       nonHotswappableResources.push(...nestedHotswappableResources.nonHotswappableChanges);
 
@@ -151,9 +186,16 @@ async function classifyResourceChanges(
     const resourceType: string = hotswappableChangeCandidate.newValue.Type;
     if (resourceType in RESOURCE_DETECTORS) {
       // run detector functions lazily to prevent unhandled promise rejections
-      promises.push(() => RESOURCE_DETECTORS[resourceType](logicalId, hotswappableChangeCandidate, evaluateCfnTemplate));
+      promises.push(() =>
+        RESOURCE_DETECTORS[resourceType](logicalId, hotswappableChangeCandidate, evaluateCfnTemplate),
+      );
     } else {
-      reportNonHotswappableChange(nonHotswappableResources, hotswappableChangeCandidate, undefined, 'This resource type is not supported for hotswap deployments');
+      reportNonHotswappableChange(
+        nonHotswappableResources,
+        hotswappableChangeCandidate,
+        undefined,
+        'This resource type is not supported for hotswap deployments',
+      );
     }
   }
 
@@ -168,9 +210,9 @@ async function classifyResourceChanges(
 
   for (const resourceDetectionResults of changesDetectionResults) {
     for (const propertyResult of resourceDetectionResults) {
-      propertyResult.hotswappable ?
-        hotswappableResources.push(propertyResult) :
-        nonHotswappableResources.push(propertyResult);
+      propertyResult.hotswappable
+        ? hotswappableResources.push(propertyResult)
+        : nonHotswappableResources.push(propertyResult);
     }
   }
 
@@ -185,12 +227,14 @@ async function classifyResourceChanges(
  *
  * @param stackChanges the collection of all changes to a given Stack
  */
-function getStackResourceDifferences(stackChanges: cfn_diff.TemplateDiff): { [logicalId: string]: cfn_diff.ResourceDifference } {
+function getStackResourceDifferences(stackChanges: cfn_diff.TemplateDiff): {
+  [logicalId: string]: cfn_diff.ResourceDifference;
+} {
   // we need to collapse logical ID rename changes into one change,
   // as they are represented in stackChanges as a pair of two changes: one addition and one removal
   const allResourceChanges: { [logId: string]: cfn_diff.ResourceDifference } = stackChanges.resources.changes;
-  const allRemovalChanges = filterDict(allResourceChanges, resChange => resChange.isRemoval);
-  const allNonRemovalChanges = filterDict(allResourceChanges, resChange => !resChange.isRemoval);
+  const allRemovalChanges = filterDict(allResourceChanges, (resChange) => resChange.isRemoval);
+  const allNonRemovalChanges = filterDict(allResourceChanges, (resChange) => !resChange.isRemoval);
   for (const [logId, nonRemovalChange] of Object.entries(allNonRemovalChanges)) {
     if (nonRemovalChange.isAddition) {
       const addChange = nonRemovalChange;
@@ -218,12 +262,15 @@ function getStackResourceDifferences(stackChanges: cfn_diff.TemplateDiff): { [lo
 
 /** Filters an object with string keys based on whether the callback returns 'true' for the given value in the object. */
 function filterDict<T>(dict: { [key: string]: T }, func: (t: T) => boolean): { [key: string]: T } {
-  return Object.entries(dict).reduce((acc, [key, t]) => {
-    if (func(t)) {
-      acc[key] = t;
-    }
-    return acc;
-  }, {} as { [key: string]: T });
+  return Object.entries(dict).reduce(
+    (acc, [key, t]) => {
+      if (func(t)) {
+        acc[key] = t;
+      }
+      return acc;
+    },
+    {} as { [key: string]: T },
+  );
 }
 
 /** Finds any hotswappable changes in all nested stacks. */
@@ -232,38 +279,53 @@ async function findNestedHotswappableChanges(
   change: cfn_diff.ResourceDifference,
   nestedStackTemplates: { [nestedStackName: string]: NestedStackTemplates },
   evaluateCfnTemplate: EvaluateCloudFormationTemplate,
-  sdk: ISDK,
+  sdk: SDK,
 ): Promise<ClassifiedResourceChanges> {
   const nestedStack = nestedStackTemplates[logicalId];
   if (!nestedStack.physicalName) {
     return {
       hotswappableChanges: [],
-      nonHotswappableChanges: [{
-        hotswappable: false,
-        logicalId,
-        reason: `physical name for AWS::CloudFormation::Stack '${logicalId}' could not be found in CloudFormation, so this is a newly created nested stack and cannot be hotswapped`,
-        rejectedChanges: [],
-        resourceType: 'AWS::CloudFormation::Stack',
-      }],
+      nonHotswappableChanges: [
+        {
+          hotswappable: false,
+          logicalId,
+          reason: `physical name for AWS::CloudFormation::Stack '${logicalId}' could not be found in CloudFormation, so this is a newly created nested stack and cannot be hotswapped`,
+          rejectedChanges: [],
+          resourceType: 'AWS::CloudFormation::Stack',
+        },
+      ],
     };
   }
 
   const evaluateNestedCfnTemplate = await evaluateCfnTemplate.createNestedEvaluateCloudFormationTemplate(
-    nestedStack.physicalName, nestedStack.generatedTemplate, change.newValue?.Properties?.Parameters,
+    nestedStack.physicalName,
+    nestedStack.generatedTemplate,
+    change.newValue?.Properties?.Parameters,
   );
 
   const nestedDiff = cfn_diff.fullDiff(
-    nestedStackTemplates[logicalId].deployedTemplate, nestedStackTemplates[logicalId].generatedTemplate,
+    nestedStackTemplates[logicalId].deployedTemplate,
+    nestedStackTemplates[logicalId].generatedTemplate,
   );
 
-  return classifyResourceChanges(nestedDiff, evaluateNestedCfnTemplate, sdk, nestedStackTemplates[logicalId].nestedStackTemplates);
+  return classifyResourceChanges(
+    nestedDiff,
+    evaluateNestedCfnTemplate,
+    sdk,
+    nestedStackTemplates[logicalId].nestedStackTemplates,
+  );
 }
 
 /** Returns 'true' if a pair of changes is for the same resource. */
-function changesAreForSameResource(oldChange: cfn_diff.ResourceDifference, newChange: cfn_diff.ResourceDifference): boolean {
-  return oldChange.oldResourceType === newChange.newResourceType &&
+function changesAreForSameResource(
+  oldChange: cfn_diff.ResourceDifference,
+  newChange: cfn_diff.ResourceDifference,
+): boolean {
+  return (
+    oldChange.oldResourceType === newChange.newResourceType &&
     // this isn't great, but I don't want to bring in something like underscore just for this comparison
-    JSON.stringify(oldChange.oldProperties) === JSON.stringify(newChange.newProperties);
+    JSON.stringify(oldChange.oldProperties) === JSON.stringify(newChange.newProperties)
+  );
 }
 
 function makeRenameDifference(
@@ -291,7 +353,8 @@ function makeRenameDifference(
  * Returns a `NonHotswappableChange` if the change is not hotswappable
  */
 function isCandidateForHotswapping(
-  change: cfn_diff.ResourceDifference, logicalId: string,
+  change: cfn_diff.ResourceDifference,
+  logicalId: string,
 ): HotswappableChange | NonHotswappableChange | HotswappableChangeCandidate {
   // a resource has been removed OR a resource has been added; we can't short-circuit that change
   if (!change.oldValue) {
@@ -331,7 +394,7 @@ function isCandidateForHotswapping(
   };
 }
 
-async function applyAllHotswappableChanges(sdk: ISDK, hotswappableChanges: HotswappableChange[]): Promise<void[]> {
+async function applyAllHotswappableChanges(sdk: SDK, hotswappableChanges: HotswappableChange[]): Promise<void[]> {
   if (hotswappableChanges.length > 0) {
     print(`\n${ICON} hotswapping resources:`);
   }
@@ -342,7 +405,7 @@ async function applyAllHotswappableChanges(sdk: ISDK, hotswappableChanges: Hotsw
   })));
 }
 
-async function applyHotswappableChange(sdk: ISDK, hotswapOperation: HotswappableChange): Promise<void> {
+async function applyHotswappableChange(sdk: SDK, hotswapOperation: HotswappableChange): Promise<void> {
   // note the type of service that was successfully hotswapped in the User-Agent
   const customUserAgent = `cdk-hotswap/success-${hotswapOperation.service}`;
   sdk.appendCustomUserAgent(customUserAgent);
@@ -381,15 +444,32 @@ function logNonHotswappableChanges(nonHotswappableChanges: NonHotswappableChange
     }
   }
   if (hotswapMode === HotswapMode.HOTSWAP_ONLY) {
-    print('\n%s %s', chalk.red('⚠️'), chalk.red('The following non-hotswappable changes were found. To reconcile these using CloudFormation, specify --hotswap-fallback'));
+    print(
+      '\n%s %s',
+      chalk.red('⚠️'),
+      chalk.red(
+        'The following non-hotswappable changes were found. To reconcile these using CloudFormation, specify --hotswap-fallback',
+      ),
+    );
   } else {
     print('\n%s %s', chalk.red('⚠️'), chalk.red('The following non-hotswappable changes were found:'));
   }
 
   for (const change of nonHotswappableChanges) {
-    change.rejectedChanges.length > 0 ?
-      print('    logicalID: %s, type: %s, rejected changes: %s, reason: %s', chalk.bold(change.logicalId), chalk.bold(change.resourceType), chalk.bold(change.rejectedChanges), chalk.red(change.reason)) :
-      print('    logicalID: %s, type: %s, reason: %s', chalk.bold(change.logicalId), chalk.bold(change.resourceType), chalk.red(change.reason));
+    change.rejectedChanges.length > 0
+      ? print(
+        '    logicalID: %s, type: %s, rejected changes: %s, reason: %s',
+        chalk.bold(change.logicalId),
+        chalk.bold(change.resourceType),
+        chalk.bold(change.rejectedChanges),
+        chalk.red(change.reason),
+      )
+      : print(
+        '    logicalID: %s, type: %s, reason: %s',
+        chalk.bold(change.logicalId),
+        chalk.bold(change.resourceType),
+        chalk.red(change.reason),
+      );
   }
 
   print(''); // newline
diff --git a/packages/aws-cdk/lib/api/hotswap/appsync-mapping-templates.ts b/packages/aws-cdk/lib/api/hotswap/appsync-mapping-templates.ts
index 91dcba4461f78..15af669c03c35 100644
--- a/packages/aws-cdk/lib/api/hotswap/appsync-mapping-templates.ts
+++ b/packages/aws-cdk/lib/api/hotswap/appsync-mapping-templates.ts
@@ -1,11 +1,22 @@
-import { GetSchemaCreationStatusRequest, GetSchemaCreationStatusResponse, ListFunctionsResponse, FunctionConfiguration } from 'aws-sdk/clients/appsync';
-import { ChangeHotswapResult, classifyChanges, HotswappableChangeCandidate, lowerCaseFirstCharacter, transformObjectKeys } from './common';
-import { ISDK } from '../aws-auth';
+import type {
+  GetSchemaCreationStatusCommandOutput,
+  GetSchemaCreationStatusCommandInput,
+} from '@aws-sdk/client-appsync';
+import {
+  type ChangeHotswapResult,
+  classifyChanges,
+  type HotswappableChangeCandidate,
+  lowerCaseFirstCharacter,
+  transformObjectKeys,
+} from './common';
+import type { SDK } from '../aws-auth';
 
-import { EvaluateCloudFormationTemplate } from '../evaluate-cloudformation-template';
+import type { EvaluateCloudFormationTemplate } from '../evaluate-cloudformation-template';
 
 export async function isHotswappableAppSyncChange(
-  logicalId: string, change: HotswappableChangeCandidate, evaluateCfnTemplate: EvaluateCloudFormationTemplate,
+  logicalId: string,
+  change: HotswappableChangeCandidate,
+  evaluateCfnTemplate: EvaluateCloudFormationTemplate,
 ): Promise<ChangeHotswapResult> {
   const isResolver = change.newValue.Type === 'AWS::AppSync::Resolver';
   const isFunction = change.newValue.Type === 'AWS::AppSync::FunctionConfiguration';
@@ -33,7 +44,10 @@ export async function isHotswappableAppSyncChange(
   const namesOfHotswappableChanges = Object.keys(classifiedChanges.hotswappableProps);
   if (namesOfHotswappableChanges.length > 0) {
     let physicalName: string | undefined = undefined;
-    const arn = await evaluateCfnTemplate.establishResourcePhysicalName(logicalId, isFunction ? change.newValue.Properties?.Name : undefined);
+    const arn = await evaluateCfnTemplate.establishResourcePhysicalName(
+      logicalId,
+      isFunction ? change.newValue.Properties?.Name : undefined,
+    );
     if (isResolver) {
       const arnParts = arn?.split('/');
       physicalName = arnParts ? `${arnParts[3]}.${arnParts[5]}` : undefined;
@@ -46,7 +60,7 @@ export async function isHotswappableAppSyncChange(
       propsChanged: namesOfHotswappableChanges,
       service: 'appsync',
       resourceNames: [`${change.newValue.Type} '${physicalName}'`],
-      apply: async (sdk: ISDK) => {
+      apply: async (sdk: SDK) => {
         if (!physicalName) {
           return;
         }
@@ -68,26 +82,31 @@ export async function isHotswappableAppSyncChange(
 
         // resolve s3 location files as SDK doesn't take in s3 location but inline code
         if (sdkRequestObject.requestMappingTemplateS3Location) {
-          sdkRequestObject.requestMappingTemplate = (await fetchFileFromS3(sdkRequestObject.requestMappingTemplateS3Location, sdk))?.toString('utf8');
+          sdkRequestObject.requestMappingTemplate = await fetchFileFromS3(
+            sdkRequestObject.requestMappingTemplateS3Location,
+            sdk,
+          );
           delete sdkRequestObject.requestMappingTemplateS3Location;
         }
         if (sdkRequestObject.responseMappingTemplateS3Location) {
-          sdkRequestObject.responseMappingTemplate = (await fetchFileFromS3(sdkRequestObject.responseMappingTemplateS3Location, sdk))?.toString('utf8');
+          sdkRequestObject.responseMappingTemplate = await fetchFileFromS3(
+            sdkRequestObject.responseMappingTemplateS3Location,
+            sdk,
+          );
           delete sdkRequestObject.responseMappingTemplateS3Location;
         }
         if (sdkRequestObject.definitionS3Location) {
-          sdkRequestObject.definition = (await fetchFileFromS3(sdkRequestObject.definitionS3Location, sdk))?.toString('utf8');
+          sdkRequestObject.definition = await fetchFileFromS3(sdkRequestObject.definitionS3Location, sdk);
           delete sdkRequestObject.definitionS3Location;
         }
         if (sdkRequestObject.codeS3Location) {
-          sdkRequestObject.code = (await fetchFileFromS3(sdkRequestObject.codeS3Location, sdk))?.toString('utf8');
+          sdkRequestObject.code = await fetchFileFromS3(sdkRequestObject.codeS3Location, sdk);
           delete sdkRequestObject.codeS3Location;
         }
 
         if (isResolver) {
-          await sdk.appsync().updateResolver(sdkRequestObject).promise();
+          await sdk.appsync().updateResolver(sdkRequestObject);
         } else if (isFunction) {
-
           // Function version is only applicable when using VTL and mapping templates
           // Runtime only applicable when using code (JS mapping templates)
           if (sdkRequestObject.code) {
@@ -96,26 +115,37 @@ export async function isHotswappableAppSyncChange(
             delete sdkRequestObject.runtime;
           }
 
-          const functions = await getAppSyncFunctions(sdk, sdkRequestObject.apiId);
-          const { functionId } = functions?.find(fn => fn.name === physicalName) ?? {};
+          const functions = await sdk.appsync().listFunctions({ apiId: sdkRequestObject.apiId });
+          const { functionId } = functions.find((fn) => fn.name === physicalName) ?? {};
           // Updating multiple functions at the same time or along with graphql schema results in `ConcurrentModificationException`
           await simpleRetry(
-            () => sdk.appsync().updateFunction({ ...sdkRequestObject, functionId: functionId! }).promise(),
+            () =>
+              sdk.appsync().updateFunction({
+                ...sdkRequestObject,
+                functionId: functionId,
+              }),
             5,
-            'ConcurrentModificationException');
+            'ConcurrentModificationException',
+          );
         } else if (isGraphQLSchema) {
-          let schemaCreationResponse: GetSchemaCreationStatusResponse = await sdk.appsync().startSchemaCreation(sdkRequestObject).promise();
-          while (schemaCreationResponse.status && ['PROCESSING', 'DELETING'].some(status => status === schemaCreationResponse.status)) {
+          let schemaCreationResponse: GetSchemaCreationStatusCommandOutput = await sdk
+            .appsync()
+            .startSchemaCreation(sdkRequestObject);
+          while (
+            schemaCreationResponse.status &&
+            ['PROCESSING', 'DELETING'].some((status) => status === schemaCreationResponse.status)
+          ) {
             await sleep(1000); // poll every second
-            const getSchemaCreationStatusRequest: GetSchemaCreationStatusRequest = {
+            const getSchemaCreationStatusRequest: GetSchemaCreationStatusCommandInput = {
               apiId: sdkRequestObject.apiId,
             };
-            schemaCreationResponse = await sdk.appsync().getSchemaCreationStatus(getSchemaCreationStatusRequest).promise();
+            schemaCreationResponse = await sdk.appsync().getSchemaCreationStatus(getSchemaCreationStatusRequest);
           }
           if (schemaCreationResponse.status === 'FAILED') {
             throw new Error(schemaCreationResponse.details);
           }
-        } else { //isApiKey
+        } else {
+          //isApiKey
           if (!sdkRequestObject.id) {
             // ApiKeyId is optional in CFN but required in SDK. Grab the KeyId from physicalArn if not available as part of CFN template
             const arnParts = physicalName?.split('/');
@@ -123,7 +153,7 @@ export async function isHotswappableAppSyncChange(
               sdkRequestObject.id = arnParts[3];
             }
           }
-          await sdk.appsync().updateApiKey(sdkRequestObject).promise();
+          await sdk.appsync().updateApiKey(sdkRequestObject);
         }
       },
     });
@@ -132,11 +162,11 @@ export async function isHotswappableAppSyncChange(
   return ret;
 }
 
-async function fetchFileFromS3(s3Url: string, sdk: ISDK) {
+async function fetchFileFromS3(s3Url: string, sdk: SDK) {
   const s3PathParts = s3Url.split('/');
   const s3Bucket = s3PathParts[2]; // first two are "s3:" and "" due to s3://
   const s3Key = s3PathParts.splice(3).join('/'); // after removing first three we reconstruct the key
-  return (await sdk.s3().getObject({ Bucket: s3Bucket, Key: s3Key }).promise()).Body;
+  return (await sdk.s3().getObject({ Bucket: s3Bucket, Key: s3Key })).Body?.transformToString();
 }
 
 async function simpleRetry(fn: () => Promise<any>, numOfRetries: number, errorCodeToRetry: string) {
@@ -153,20 +183,5 @@ async function simpleRetry(fn: () => Promise<any>, numOfRetries: number, errorCo
 }
 
 async function sleep(ms: number) {
-  return new Promise(ok => setTimeout(ok, ms));
-}
-
-/**
- * Get all functions for a given AppSync API by iterating through the paginated list of functions
- */
-async function getAppSyncFunctions(sdk: ISDK, apiId: string, nextToken?: string): Promise<FunctionConfiguration[]> {
-  const ret = new Array<FunctionConfiguration>();
-  return sdk.appsync().listFunctions({ apiId, nextToken }).promise()
-    .then(async (listFunctionsResponse: ListFunctionsResponse) => {
-      ret.push(...(listFunctionsResponse.functions ?? []));
-      if (listFunctionsResponse.nextToken) {
-        ret.push(...await getAppSyncFunctions(sdk, apiId, listFunctionsResponse.nextToken));
-      }
-      return ret;
-    });
+  return new Promise((ok) => setTimeout(ok, ms));
 }
diff --git a/packages/aws-cdk/lib/api/hotswap/code-build-projects.ts b/packages/aws-cdk/lib/api/hotswap/code-build-projects.ts
index 4d3e54cd15de3..0b2e57e6fbadb 100644
--- a/packages/aws-cdk/lib/api/hotswap/code-build-projects.ts
+++ b/packages/aws-cdk/lib/api/hotswap/code-build-projects.ts
@@ -1,10 +1,18 @@
-import * as AWS from 'aws-sdk';
-import { ChangeHotswapResult, classifyChanges, HotswappableChangeCandidate, lowerCaseFirstCharacter, transformObjectKeys } from './common';
-import { ISDK } from '../aws-auth';
-import { EvaluateCloudFormationTemplate } from '../evaluate-cloudformation-template';
+import type { UpdateProjectCommandInput } from '@aws-sdk/client-codebuild';
+import {
+  type ChangeHotswapResult,
+  classifyChanges,
+  type HotswappableChangeCandidate,
+  lowerCaseFirstCharacter,
+  transformObjectKeys,
+} from './common';
+import type { SDK } from '../aws-auth';
+import type { EvaluateCloudFormationTemplate } from '../evaluate-cloudformation-template';
 
 export async function isHotswappableCodeBuildProjectChange(
-  logicalId: string, change: HotswappableChangeCandidate, evaluateCfnTemplate: EvaluateCloudFormationTemplate,
+  logicalId: string,
+  change: HotswappableChangeCandidate,
+  evaluateCfnTemplate: EvaluateCloudFormationTemplate,
 ): Promise<ChangeHotswapResult> {
   if (change.newValue.Type !== 'AWS::CodeBuild::Project') {
     return [];
@@ -15,17 +23,20 @@ export async function isHotswappableCodeBuildProjectChange(
   const classifiedChanges = classifyChanges(change, ['Source', 'Environment', 'SourceVersion']);
   classifiedChanges.reportNonHotswappablePropertyChanges(ret);
   if (classifiedChanges.namesOfHotswappableProps.length > 0) {
-    const updateProjectInput: AWS.CodeBuild.UpdateProjectInput = {
+    const updateProjectInput: UpdateProjectCommandInput = {
       name: '',
     };
-    const projectName = await evaluateCfnTemplate.establishResourcePhysicalName(logicalId, change.newValue.Properties?.Name);
+    const projectName = await evaluateCfnTemplate.establishResourcePhysicalName(
+      logicalId,
+      change.newValue.Properties?.Name,
+    );
     ret.push({
       hotswappable: true,
       resourceType: change.newValue.Type,
       propsChanged: classifiedChanges.namesOfHotswappableProps,
       service: 'codebuild',
       resourceNames: [`CodeBuild Project '${projectName}'`],
-      apply: async (sdk: ISDK) => {
+      apply: async (sdk: SDK) => {
         if (!projectName) {
           return;
         }
@@ -52,7 +63,7 @@ export async function isHotswappableCodeBuildProjectChange(
           }
         }
 
-        await sdk.codeBuild().updateProject(updateProjectInput).promise();
+        await sdk.codeBuild().updateProject(updateProjectInput);
       },
     });
   }
diff --git a/packages/aws-cdk/lib/api/hotswap/common.ts b/packages/aws-cdk/lib/api/hotswap/common.ts
index eb4b787d04e92..6046b1c34883a 100644
--- a/packages/aws-cdk/lib/api/hotswap/common.ts
+++ b/packages/aws-cdk/lib/api/hotswap/common.ts
@@ -1,5 +1,5 @@
-import * as cfn_diff from '@aws-cdk/cloudformation-diff';
-import { ISDK } from '../aws-auth';
+import type { PropertyDifference, Resource } from '@aws-cdk/cloudformation-diff';
+import type { SDK } from '../aws-auth';
 
 export const ICON = '✨';
 
@@ -18,7 +18,7 @@ export interface HotswappableChange {
    */
   readonly resourceNames: string[];
 
-  readonly apply: (sdk: ISDK) => Promise<void>;
+  readonly apply: (sdk: SDK) => Promise<void>;
 }
 
 export interface NonHotswappableChange {
@@ -76,19 +76,19 @@ export class HotswappableChangeCandidate {
   /**
    * The value the resource is being updated from
    */
-  public readonly oldValue: cfn_diff.Resource;
+  public readonly oldValue: Resource;
 
   /**
    * The value the resource is being updated to
    */
-  public readonly newValue: cfn_diff.Resource;
+  public readonly newValue: Resource;
 
   /**
    * The changes made to the resource properties
    */
   public readonly propertyUpdates: PropDiffs;
 
-  public constructor(logicalId: string, oldValue: cfn_diff.Resource, newValue: cfn_diff.Resource, propertyUpdates: PropDiffs) {
+  public constructor(logicalId: string, oldValue: Resource, newValue: Resource, propertyUpdates: PropDiffs) {
     this.logicalId = logicalId;
     this.oldValue = oldValue;
     this.newValue = newValue;
@@ -96,7 +96,7 @@ export class HotswappableChangeCandidate {
   }
 }
 
-type Exclude = { [key: string]: Exclude | true }
+type Exclude = { [key: string]: Exclude | true };
 
 /**
  * This function transforms all keys (recursively) in the provided `val` object.
@@ -135,16 +135,16 @@ export function lowerCaseFirstCharacter(str: string): string {
   return str.length > 0 ? `${str[0].toLowerCase()}${str.slice(1)}` : str;
 }
 
-export type PropDiffs = Record<string, cfn_diff.PropertyDifference<any>>;
+export type PropDiffs = Record<string, PropertyDifference<any>>;
 
 export class ClassifiedChanges {
   public constructor(
     public readonly change: HotswappableChangeCandidate,
     public readonly hotswappableProps: PropDiffs,
     public readonly nonHotswappableProps: PropDiffs,
-  ) { }
+  ) {}
 
-  public reportNonHotswappablePropertyChanges(ret: ChangeHotswapResult):void {
+  public reportNonHotswappablePropertyChanges(ret: ChangeHotswapResult): void {
     const nonHotswappablePropNames = Object.keys(this.nonHotswappableProps);
     if (nonHotswappablePropNames.length > 0) {
       const tagOnlyChange = nonHotswappablePropNames.length === 1 && nonHotswappablePropNames[0] === 'Tags';
@@ -152,7 +152,9 @@ export class ClassifiedChanges {
         ret,
         this.change,
         this.nonHotswappableProps,
-        tagOnlyChange ? 'Tags are not hotswappable' : `resource properties '${nonHotswappablePropNames}' are not hotswappable on this resource type`,
+        tagOnlyChange
+          ? 'Tags are not hotswappable'
+          : `resource properties '${nonHotswappablePropNames}' are not hotswappable on this resource type`,
       );
     }
   }
@@ -162,10 +164,7 @@ export class ClassifiedChanges {
   }
 }
 
-export function classifyChanges(
-  xs: HotswappableChangeCandidate,
-  hotswappablePropNames: string[],
-): ClassifiedChanges {
+export function classifyChanges(xs: HotswappableChangeCandidate, hotswappablePropNames: string[]): ClassifiedChanges {
   const hotswappableProps: PropDiffs = {};
   const nonHotswappableProps: PropDiffs = {};
 
@@ -205,11 +204,13 @@ export function reportNonHotswappableResource(
   change: HotswappableChangeCandidate,
   reason?: string,
 ): ChangeHotswapResult {
-  return [{
-    hotswappable: false,
-    rejectedChanges: Object.keys(change.propertyUpdates),
-    logicalId: change.logicalId,
-    resourceType: change.newValue.Type,
-    reason,
-  }];
+  return [
+    {
+      hotswappable: false,
+      rejectedChanges: Object.keys(change.propertyUpdates),
+      logicalId: change.logicalId,
+      resourceType: change.newValue.Type,
+      reason,
+    },
+  ];
 }
diff --git a/packages/aws-cdk/lib/api/hotswap/ecs-services.ts b/packages/aws-cdk/lib/api/hotswap/ecs-services.ts
index c3e306fb0b878..5e4b367354945 100644
--- a/packages/aws-cdk/lib/api/hotswap/ecs-services.ts
+++ b/packages/aws-cdk/lib/api/hotswap/ecs-services.ts
@@ -1,10 +1,18 @@
-import * as AWS from 'aws-sdk';
-import { ChangeHotswapResult, classifyChanges, HotswappableChangeCandidate, lowerCaseFirstCharacter, reportNonHotswappableChange, transformObjectKeys } from './common';
-import { ISDK } from '../aws-auth';
-import { EvaluateCloudFormationTemplate } from '../evaluate-cloudformation-template';
+import {
+  type ChangeHotswapResult,
+  classifyChanges,
+  type HotswappableChangeCandidate,
+  lowerCaseFirstCharacter,
+  reportNonHotswappableChange,
+  transformObjectKeys,
+} from './common';
+import type { SDK } from '../aws-auth';
+import type { EvaluateCloudFormationTemplate } from '../evaluate-cloudformation-template';
 
 export async function isHotswappableEcsServiceChange(
-  logicalId: string, change: HotswappableChangeCandidate, evaluateCfnTemplate: EvaluateCloudFormationTemplate,
+  logicalId: string,
+  change: HotswappableChangeCandidate,
+  evaluateCfnTemplate: EvaluateCloudFormationTemplate,
 ): Promise<ChangeHotswapResult> {
   // the only resource change we can evaluate here is an ECS TaskDefinition
   if (change.newValue.Type !== 'AWS::ECS::TaskDefinition') {
@@ -21,7 +29,9 @@ export async function isHotswappableEcsServiceChange(
 
   // find all ECS Services that reference the TaskDefinition that changed
   const resourcesReferencingTaskDef = evaluateCfnTemplate.findReferencesTo(logicalId);
-  const ecsServiceResourcesReferencingTaskDef = resourcesReferencingTaskDef.filter(r => r.Type === 'AWS::ECS::Service');
+  const ecsServiceResourcesReferencingTaskDef = resourcesReferencingTaskDef.filter(
+    (r) => r.Type === 'AWS::ECS::Service',
+  );
   const ecsServicesReferencingTaskDef = new Array<EcsService>();
   for (const ecsServiceResource of ecsServiceResourcesReferencingTaskDef) {
     const serviceArn = await evaluateCfnTemplate.findPhysicalNameFor(ecsServiceResource.LogicalId);
@@ -33,12 +43,18 @@ export async function isHotswappableEcsServiceChange(
     // if there are no resources referencing the TaskDefinition,
     // hotswap is not possible in FALL_BACK mode
     reportNonHotswappableChange(ret, change, undefined, 'No ECS services reference the changed task definition', false);
-  } if (resourcesReferencingTaskDef.length > ecsServicesReferencingTaskDef.length) {
+  }
+  if (resourcesReferencingTaskDef.length > ecsServicesReferencingTaskDef.length) {
     // if something besides an ECS Service is referencing the TaskDefinition,
     // hotswap is not possible in FALL_BACK mode
-    const nonEcsServiceTaskDefRefs = resourcesReferencingTaskDef.filter(r => r.Type !== 'AWS::ECS::Service');
+    const nonEcsServiceTaskDefRefs = resourcesReferencingTaskDef.filter((r) => r.Type !== 'AWS::ECS::Service');
     for (const taskRef of nonEcsServiceTaskDefRefs) {
-      reportNonHotswappableChange(ret, change, undefined, `A resource '${taskRef.LogicalId}' with Type '${taskRef.Type}' that is not an ECS Service was found referencing the changed TaskDefinition '${logicalId}'`);
+      reportNonHotswappableChange(
+        ret,
+        change,
+        undefined,
+        `A resource '${taskRef.LogicalId}' with Type '${taskRef.Type}' that is not an ECS Service was found referencing the changed TaskDefinition '${logicalId}'`,
+      );
     }
   }
 
@@ -52,9 +68,9 @@ export async function isHotswappableEcsServiceChange(
       service: 'ecs-service',
       resourceNames: [
         `ECS Task Definition '${await taskDefinitionResource.Family}'`,
-        ...ecsServicesReferencingTaskDef.map(ecsService => `ECS Service '${ecsService.serviceArn.split('/')[2]}'`),
+        ...ecsServicesReferencingTaskDef.map((ecsService) => `ECS Service '${ecsService.serviceArn.split('/')[2]}'`),
       ],
-      apply: async (sdk: ISDK) => {
+      apply: async (sdk: SDK) => {
         // Step 1 - update the changed TaskDefinition, creating a new TaskDefinition Revision
         // we need to lowercase the evaluated TaskDef from CloudFormation,
         // as the AWS SDK uses lowercase property names for these
@@ -80,101 +96,31 @@ export async function isHotswappableEcsServiceChange(
             },
           },
         });
-        const registerTaskDefResponse = await sdk.ecs().registerTaskDefinition(lowercasedTaskDef).promise();
+        const registerTaskDefResponse = await sdk.ecs().registerTaskDefinition(lowercasedTaskDef);
         const taskDefRevArn = registerTaskDefResponse.taskDefinition?.taskDefinitionArn;
 
         // Step 2 - update the services using that TaskDefinition to point to the new TaskDefinition Revision
-        const servicePerClusterUpdates: { [cluster: string]: Array<{ promise: Promise<any>; ecsService: EcsService }> } = {};
-        for (const ecsService of ecsServicesReferencingTaskDef) {
-          const clusterName = ecsService.serviceArn.split('/')[1];
-
-          const existingClusterPromises = servicePerClusterUpdates[clusterName];
-          let clusterPromises: Array<{ promise: Promise<any>; ecsService: EcsService }>;
-          if (existingClusterPromises) {
-            clusterPromises = existingClusterPromises;
-          } else {
-            clusterPromises = [];
-            servicePerClusterUpdates[clusterName] = clusterPromises;
-          }
-          // Forcing New Deployment and setting Minimum Healthy Percent to 0.
-          // As CDK HotSwap is development only, this seems the most efficient way to ensure all tasks are replaced immediately, regardless of original amount.
-          clusterPromises.push({
-            promise: sdk.ecs().updateService({
-              service: ecsService.serviceArn,
+        // Forcing New Deployment and setting Minimum Healthy Percent to 0.
+        // As CDK HotSwap is development only, this seems the most efficient way to ensure all tasks are replaced immediately, regardless of original amount
+        await Promise.all(
+          ecsServicesReferencingTaskDef.map(async (service) => {
+            const cluster = service.serviceArn.split('/')[1];
+            const update = await sdk.ecs().updateService({
+              service: service.serviceArn,
               taskDefinition: taskDefRevArn,
-              cluster: clusterName,
+              cluster,
               forceNewDeployment: true,
               deploymentConfiguration: {
                 minimumHealthyPercent: 0,
               },
-            }).promise(),
-            ecsService: ecsService,
-          });
-        }
-        // Limited set of updates per cluster
-        // eslint-disable-next-line @aws-cdk/promiseall-no-unbounded-parallelism
-        await Promise.all(Object.values(servicePerClusterUpdates)
-          .map(clusterUpdates => {
-            // Limited set of updates per cluster
-            // eslint-disable-next-line @aws-cdk/promiseall-no-unbounded-parallelism
-            return Promise.all(clusterUpdates.map(serviceUpdate => serviceUpdate.promise));
+            });
+
+            await sdk.ecs().waitUntilServicesStable({
+              cluster: update.service?.clusterArn,
+              services: [service.serviceArn],
+            });
           }),
         );
-
-        // Step 3 - wait for the service deployments triggered in Step 2 to finish
-        // configure a custom Waiter
-        (sdk.ecs() as any).api.waiters.deploymentCompleted = {
-          name: 'DeploymentCompleted',
-          operation: 'describeServices',
-          delay: 6,
-          maxAttempts: 100,
-          acceptors: [
-            {
-              matcher: 'pathAny',
-              argument: 'failures[].reason',
-              expected: 'MISSING',
-              state: 'failure',
-            },
-            {
-              matcher: 'pathAny',
-              argument: 'services[].status',
-              expected: 'DRAINING',
-              state: 'failure',
-            },
-            {
-              matcher: 'pathAny',
-              argument: 'services[].status',
-              expected: 'INACTIVE',
-              state: 'failure',
-            },
-
-            // failure if any services report a deployment with status FAILED
-            {
-              matcher: 'path',
-              argument: "length(services[].deployments[? rolloutState == 'FAILED'][]) > `0`",
-              expected: true,
-              state: 'failure',
-            },
-
-            // wait for all services to report only a single deployment
-            {
-              matcher: 'path',
-              argument: 'length(services[? length(deployments) > `1`]) == `0`',
-              expected: true,
-              state: 'success',
-            },
-          ],
-        };
-        // create a custom Waiter that uses the deploymentCompleted configuration added above
-        const deploymentWaiter = new (AWS as any).ResourceWaiter(sdk.ecs(), 'deploymentCompleted');
-        // wait for all of the waiters to finish
-        // eslint-disable-next-line @aws-cdk/promiseall-no-unbounded-parallelism
-        await Promise.all(Object.entries(servicePerClusterUpdates).map(([clusterName, serviceUpdates]) => {
-          return deploymentWaiter.wait({
-            cluster: clusterName,
-            services: serviceUpdates.map(serviceUpdate => serviceUpdate.ecsService.serviceArn),
-          }).promise();
-        }));
       },
     });
   }
@@ -187,14 +133,19 @@ interface EcsService {
 }
 
 async function prepareTaskDefinitionChange(
-  evaluateCfnTemplate: EvaluateCloudFormationTemplate, logicalId: string, change: HotswappableChangeCandidate,
+  evaluateCfnTemplate: EvaluateCloudFormationTemplate,
+  logicalId: string,
+  change: HotswappableChangeCandidate,
 ) {
   const taskDefinitionResource: { [name: string]: any } = {
     ...change.oldValue.Properties,
     ContainerDefinitions: change.newValue.Properties?.ContainerDefinitions,
   };
   // first, let's get the name of the family
-  const familyNameOrArn = await evaluateCfnTemplate.establishResourcePhysicalName(logicalId, taskDefinitionResource?.Family);
+  const familyNameOrArn = await evaluateCfnTemplate.establishResourcePhysicalName(
+    logicalId,
+    taskDefinitionResource?.Family,
+  );
   if (!familyNameOrArn) {
     // if the Family property has not been provided, and we can't find it in the current Stack,
     // this means hotswapping is not possible
@@ -203,18 +154,19 @@ async function prepareTaskDefinitionChange(
   // the physical name of the Task Definition in CloudFormation includes its current revision number at the end,
   // remove it if needed
   const familyNameOrArnParts = familyNameOrArn.split(':');
-  const family = familyNameOrArnParts.length > 1
-    // familyNameOrArn is actually an ARN, of the format 'arn:aws:ecs:region:account:task-definition/<family-name>:<revision-nr>'
+  const family =
+    familyNameOrArnParts.length > 1
+      ? // familyNameOrArn is actually an ARN, of the format 'arn:aws:ecs:region:account:task-definition/<family-name>:<revision-nr>'
     // so, take the 6th element, at index 5, and split it on '/'
-    ? familyNameOrArnParts[5].split('/')[1]
-    // otherwise, familyNameOrArn is just the simple name evaluated from the CloudFormation template
-    : familyNameOrArn;
+      familyNameOrArnParts[5].split('/')[1]
+      : // otherwise, familyNameOrArn is just the simple name evaluated from the CloudFormation template
+      familyNameOrArn;
   // then, let's evaluate the body of the remainder of the TaskDef (without the Family property)
   return {
-    ...await evaluateCfnTemplate.evaluateCfnExpression({
+    ...(await evaluateCfnTemplate.evaluateCfnExpression({
       ...(taskDefinitionResource ?? {}),
       Family: undefined,
-    }),
+    })),
     Family: family,
   };
 }
diff --git a/packages/aws-cdk/lib/api/hotswap/lambda-functions.ts b/packages/aws-cdk/lib/api/hotswap/lambda-functions.ts
index 6df07dd5880d9..8c38941c198f2 100644
--- a/packages/aws-cdk/lib/api/hotswap/lambda-functions.ts
+++ b/packages/aws-cdk/lib/api/hotswap/lambda-functions.ts
@@ -1,30 +1,34 @@
 import { Writable } from 'stream';
-import * as AWS from 'aws-sdk';
-import { ChangeHotswapResult, classifyChanges, HotswappableChangeCandidate, PropDiffs } from './common';
+import { type FunctionConfiguration, type UpdateFunctionConfigurationCommandInput } from '@aws-sdk/client-lambda';
+import { type ChangeHotswapResult, classifyChanges, type HotswappableChangeCandidate, PropDiffs } from './common';
 import { flatMap } from '../../util';
-import { ISDK } from '../aws-auth';
-import { CfnEvaluationException, EvaluateCloudFormationTemplate } from '../evaluate-cloudformation-template';
+import type { ILambdaClient, SDK } from '../aws-auth';
+import { CfnEvaluationException, type EvaluateCloudFormationTemplate } from '../evaluate-cloudformation-template';
 
 // namespace object imports won't work in the bundle for function exports
 // eslint-disable-next-line @typescript-eslint/no-require-imports
 const archiver = require('archiver');
 
 export async function isHotswappableLambdaFunctionChange(
-  logicalId: string, change: HotswappableChangeCandidate, evaluateCfnTemplate: EvaluateCloudFormationTemplate,
+  logicalId: string,
+  change: HotswappableChangeCandidate,
+  evaluateCfnTemplate: EvaluateCloudFormationTemplate,
 ): Promise<ChangeHotswapResult> {
   // if the change is for a Lambda Version,
   // ignore it by returning an empty hotswap operation -
   // we will publish a new version when we get to hotswapping the actual Function this Version points to, below
   // (Versions can't be changed in CloudFormation anyway, they're immutable)
   if (change.newValue.Type === 'AWS::Lambda::Version') {
-    return [{
-      hotswappable: true,
-      resourceType: 'AWS::Lambda::Version',
-      resourceNames: [],
-      propsChanged: [],
-      service: 'lambda',
-      apply: async (_sdk: ISDK) => {},
-    }];
+    return [
+      {
+        hotswappable: true,
+        resourceType: 'AWS::Lambda::Version',
+        resourceNames: [],
+        propsChanged: [],
+        service: 'lambda',
+        apply: async (_sdk: SDK) => {},
+      },
+    ];
   }
 
   // we handle Aliases specially too
@@ -40,7 +44,10 @@ export async function isHotswappableLambdaFunctionChange(
   const classifiedChanges = classifyChanges(change, ['Code', 'Environment', 'Description']);
   classifiedChanges.reportNonHotswappablePropertyChanges(ret);
 
-  const functionName = await evaluateCfnTemplate.establishResourcePhysicalName(logicalId, change.newValue.Properties?.FunctionName);
+  const functionName = await evaluateCfnTemplate.establishResourcePhysicalName(
+    logicalId,
+    change.newValue.Properties?.FunctionName,
+  );
   const namesOfHotswappableChanges = Object.keys(classifiedChanges.hotswappableProps);
   if (namesOfHotswappableChanges.length > 0) {
     ret.push({
@@ -51,13 +58,19 @@ export async function isHotswappableLambdaFunctionChange(
       resourceNames: [
         `Lambda Function '${functionName}'`,
         // add Version here if we're publishing a new one
-        ...await renderVersions(logicalId, evaluateCfnTemplate, [`Lambda Version for Function '${functionName}'`]),
+        ...(await renderVersions(logicalId, evaluateCfnTemplate, [`Lambda Version for Function '${functionName}'`])),
         // add any Aliases that we are hotswapping here
-        ...await renderAliases(logicalId, evaluateCfnTemplate, async (alias) => `Lambda Alias '${alias}' for Function '${functionName}'`),
+        ...(await renderAliases(
+          logicalId,
+          evaluateCfnTemplate,
+          async (alias) => `Lambda Alias '${alias}' for Function '${functionName}'`,
+        )),
       ],
-      apply: async (sdk: ISDK) => {
+      apply: async (sdk: SDK) => {
         const lambdaCodeChange = await evaluateLambdaFunctionProps(
-          classifiedChanges.hotswappableProps, change.newValue.Properties?.Runtime, evaluateCfnTemplate,
+          classifiedChanges.hotswappableProps,
+          change.newValue.Properties?.Runtime,
+          evaluateCfnTemplate,
         );
         if (lambdaCodeChange === undefined) {
           return;
@@ -80,13 +93,13 @@ export async function isHotswappableLambdaFunctionChange(
               ImageUri: lambdaCodeChange.code.imageUri,
               ZipFile: lambdaCodeChange.code.functionCodeZip,
               S3ObjectVersion: lambdaCodeChange.code.s3ObjectVersion,
-            }).promise();
+            });
 
             await waitForLambdasPropertiesUpdateToFinish(updateFunctionCodeResponse, lambda, functionName);
           }
 
           if (lambdaCodeChange.configurations !== undefined) {
-            const updateRequest: AWS.Lambda.UpdateFunctionConfigurationRequest = {
+            const updateRequest: UpdateFunctionConfigurationCommandInput = {
               FunctionName: functionName,
             };
             if (lambdaCodeChange.configurations.description !== undefined) {
@@ -95,7 +108,7 @@ export async function isHotswappableLambdaFunctionChange(
             if (lambdaCodeChange.configurations.environment !== undefined) {
               updateRequest.Environment = lambdaCodeChange.configurations.environment;
             }
-            const updateFunctionCodeResponse = await lambda.updateFunctionConfiguration(updateRequest).promise();
+            const updateFunctionCodeResponse = await lambda.updateFunctionConfiguration(updateRequest);
             await waitForLambdasPropertiesUpdateToFinish(updateFunctionCodeResponse, lambda, functionName);
           }
 
@@ -103,17 +116,19 @@ export async function isHotswappableLambdaFunctionChange(
           if (versionsReferencingFunction.length > 0) {
             const publishVersionPromise = lambda.publishVersion({
               FunctionName: functionName,
-            }).promise();
+            });
 
             if (aliasesNames.length > 0) {
               // we need to wait for the Version to finish publishing
               const versionUpdate = await publishVersionPromise;
               for (const alias of aliasesNames) {
-                operations.push(lambda.updateAlias({
-                  FunctionName: functionName,
-                  Name: alias,
-                  FunctionVersion: versionUpdate.Version,
-                }).promise());
+                operations.push(
+                  lambda.updateAlias({
+                    FunctionName: functionName,
+                    Name: alias,
+                    FunctionVersion: versionUpdate.Version,
+                  }),
+                );
               }
             } else {
               operations.push(publishVersionPromise);
@@ -148,7 +163,7 @@ function classifyAliasChanges(change: HotswappableChangeCandidate): ChangeHotswa
       propsChanged: [],
       service: 'lambda',
       resourceNames: [],
-      apply: async (_sdk: ISDK) => {},
+      apply: async (_sdk: SDK) => {},
     });
   }
 
@@ -161,7 +176,9 @@ function classifyAliasChanges(change: HotswappableChangeCandidate): ChangeHotswa
  * Returns `undefined` if the change is not hotswappable.
  */
 async function evaluateLambdaFunctionProps(
-  hotswappablePropChanges: PropDiffs, runtime: string, evaluateCfnTemplate: EvaluateCloudFormationTemplate,
+  hotswappablePropChanges: PropDiffs,
+  runtime: string,
+  evaluateCfnTemplate: EvaluateCloudFormationTemplate,
 ): Promise<LambdaFunctionChange | undefined> {
   /*
    * At first glance, we would want to initialize these using the "previous" values (change.oldValue),
@@ -228,7 +245,9 @@ async function evaluateLambdaFunctionProps(
         break;
       default:
         // we will never get here, but just in case we do throw an error
-        throw new Error ('while apply()ing, found a property that cannot be hotswapped. Please report this at github.com/aws/aws-cdk/issues/new/choose');
+        throw new Error(
+          'while apply()ing, found a property that cannot be hotswapped. Please report this at github.com/aws/aws-cdk/issues/new/choose',
+        );
     }
   }
 
@@ -291,52 +310,29 @@ function zipString(fileName: string, rawString: string): Promise<Buffer> {
 }
 
 /**
-  * After a Lambda Function is updated, it cannot be updated again until the
-  * `State=Active` and the `LastUpdateStatus=Successful`.
-  *
-  * Depending on the configuration of the Lambda Function this could happen relatively quickly
-  * or very slowly. For example, Zip based functions _not_ in a VPC can take ~1 second whereas VPC
-  * or Container functions can take ~25 seconds (and 'idle' VPC functions can take minutes).
-  */
+ * After a Lambda Function is updated, it cannot be updated again until the
+ * `State=Active` and the `LastUpdateStatus=Successful`.
+ *
+ * Depending on the configuration of the Lambda Function this could happen relatively quickly
+ * or very slowly. For example, Zip based functions _not_ in a VPC can take ~1 second whereas VPC
+ * or Container functions can take ~25 seconds (and 'idle' VPC functions can take minutes).
+ */
 async function waitForLambdasPropertiesUpdateToFinish(
-  currentFunctionConfiguration: AWS.Lambda.FunctionConfiguration, lambda: AWS.Lambda, functionName: string,
+  currentFunctionConfiguration: FunctionConfiguration,
+  lambda: ILambdaClient,
+  functionName: string,
 ): Promise<void> {
-  const functionIsInVpcOrUsesDockerForCode = currentFunctionConfiguration.VpcConfig?.VpcId ||
-      currentFunctionConfiguration.PackageType === 'Image';
+  const functionIsInVpcOrUsesDockerForCode =
+    currentFunctionConfiguration.VpcConfig?.VpcId || currentFunctionConfiguration.PackageType === 'Image';
 
   // if the function is deployed in a VPC or if it is a container image function
   // then the update will take much longer and we can wait longer between checks
   // otherwise, the update will be quick, so a 1-second delay is fine
   const delaySeconds = functionIsInVpcOrUsesDockerForCode ? 5 : 1;
 
-  // configure a custom waiter to wait for the function update to complete
-  (lambda as any).api.waiters.updateFunctionPropertiesToFinish = {
-    name: 'UpdateFunctionPropertiesToFinish',
-    operation: 'getFunction',
-    // equates to 1 minute for zip function not in a VPC and
-    // 5 minutes for container functions or function in a VPC
-    maxAttempts: 60,
-    delay: delaySeconds,
-    acceptors: [
-      {
-        matcher: 'path',
-        argument: "Configuration.LastUpdateStatus == 'Successful' && Configuration.State == 'Active'",
-        expected: true,
-        state: 'success',
-      },
-      {
-        matcher: 'path',
-        argument: 'Configuration.LastUpdateStatus',
-        expected: 'Failed',
-        state: 'failure',
-      },
-    ],
-  };
-
-  const updateFunctionPropertiesWaiter = new (AWS as any).ResourceWaiter(lambda, 'updateFunctionPropertiesToFinish');
-  await updateFunctionPropertiesWaiter.wait({
+  await lambda.waitUntilFunctionUpdated(delaySeconds, {
     FunctionName: functionName,
-  }).promise();
+  });
 }
 
 /**
@@ -352,7 +348,9 @@ function determineCodeFileExtFromRuntime(runtime: string): string {
   }
   // Currently inline code only supports Node.js and Python, ignoring other runtimes.
   // https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-lambda-function-code.html#aws-properties-lambda-function-code-properties
-  throw new CfnEvaluationException(`runtime ${runtime} is unsupported, only node.js and python runtimes are currently supported.`);
+  throw new CfnEvaluationException(
+    `runtime ${runtime} is unsupported, only node.js and python runtimes are currently supported.`,
+  );
 }
 
 /**
@@ -361,8 +359,9 @@ function determineCodeFileExtFromRuntime(runtime: string): string {
  */
 async function versionsAndAliases(logicalId: string, evaluateCfnTemplate: EvaluateCloudFormationTemplate) {
   // find all Lambda Versions that reference this Function
-  const versionsReferencingFunction = evaluateCfnTemplate.findReferencesTo(logicalId)
-    .filter(r => r.Type === 'AWS::Lambda::Version');
+  const versionsReferencingFunction = evaluateCfnTemplate
+    .findReferencesTo(logicalId)
+    .filter((r) => r.Type === 'AWS::Lambda::Version');
   // find all Lambda Aliases that reference the above Versions
   const aliasesReferencingVersions = flatMap(versionsReferencingFunction, v =>
     evaluateCfnTemplate.findReferencesTo(v.LogicalId));
@@ -392,7 +391,11 @@ async function renderAliases(
 /**
  * Renders the string used in displaying Version resource names that reference the specified Lambda Function
  */
-async function renderVersions(logicalId: string, evaluateCfnTemplate: EvaluateCloudFormationTemplate, versionString: string[]): Promise<string[]> {
+async function renderVersions(
+  logicalId: string,
+  evaluateCfnTemplate: EvaluateCloudFormationTemplate,
+  versionString: string[],
+): Promise<string[]> {
   const versions = (await versionsAndAliases(logicalId, evaluateCfnTemplate)).versionsReferencingFunction;
 
   return versions.length > 0 ? versionString : [];
diff --git a/packages/aws-cdk/lib/api/hotswap/s3-bucket-deployments.ts b/packages/aws-cdk/lib/api/hotswap/s3-bucket-deployments.ts
index 4ccfa3a5f72d4..1df6eb545a6af 100644
--- a/packages/aws-cdk/lib/api/hotswap/s3-bucket-deployments.ts
+++ b/packages/aws-cdk/lib/api/hotswap/s3-bucket-deployments.ts
@@ -1,6 +1,6 @@
-import { ChangeHotswapResult, HotswappableChangeCandidate } from './common';
-import { ISDK } from '../aws-auth';
-import { EvaluateCloudFormationTemplate } from '../evaluate-cloudformation-template';
+import type { ChangeHotswapResult, HotswappableChangeCandidate } from './common';
+import type { SDK } from '../aws-auth';
+import type { EvaluateCloudFormationTemplate } from '../evaluate-cloudformation-template';
 
 /**
  * This means that the value is required to exist by CloudFormation's Custom Resource API (or our S3 Bucket Deployment Lambda's API)
@@ -9,7 +9,9 @@ import { EvaluateCloudFormationTemplate } from '../evaluate-cloudformation-templ
 export const REQUIRED_BY_CFN = 'required-to-be-present-by-cfn';
 
 export async function isHotswappableS3BucketDeploymentChange(
-  _logicalId: string, change: HotswappableChangeCandidate, evaluateCfnTemplate: EvaluateCloudFormationTemplate,
+  _logicalId: string,
+  change: HotswappableChangeCandidate,
+  evaluateCfnTemplate: EvaluateCloudFormationTemplate,
 ): Promise<ChangeHotswapResult> {
   // In old-style synthesis, the policy used by the lambda to copy assets Ref's the assets directly,
   // meaning that the changes made to the Policy are artifacts that can be safely ignored
@@ -31,14 +33,14 @@ export async function isHotswappableS3BucketDeploymentChange(
     propsChanged: ['*'],
     service: 'custom-s3-deployment',
     resourceNames: [`Contents of S3 Bucket '${customResourceProperties.DestinationBucketName}'`],
-    apply: async (sdk: ISDK) => {
+    apply: async (sdk: SDK) => {
       // note that this gives the ARN of the lambda, not the name. This is fine though, the invoke() sdk call will take either
       const functionName = await evaluateCfnTemplate.evaluateCfnExpression(change.newValue.Properties?.ServiceToken);
       if (!functionName) {
         return;
       }
 
-      await sdk.lambda().invoke({
+      await sdk.lambda().invokeCommand({
         FunctionName: functionName,
         // Lambda refuses to take a direct JSON object and requires it to be stringify()'d
         Payload: JSON.stringify({
@@ -50,7 +52,7 @@ export async function isHotswappableS3BucketDeploymentChange(
           LogicalResourceId: REQUIRED_BY_CFN,
           ResourceProperties: stringifyObject(customResourceProperties), // JSON.stringify() doesn't turn the actual objects to strings, but the lambda expects strings
         }),
-      }).promise();
+      });
     },
   });
 
@@ -58,7 +60,9 @@ export async function isHotswappableS3BucketDeploymentChange(
 }
 
 export async function skipChangeForS3DeployCustomResourcePolicy(
-  iamPolicyLogicalId: string, change: HotswappableChangeCandidate, evaluateCfnTemplate: EvaluateCloudFormationTemplate,
+  iamPolicyLogicalId: string,
+  change: HotswappableChangeCandidate,
+  evaluateCfnTemplate: EvaluateCloudFormationTemplate,
 ): Promise<boolean> {
   if (change.newValue.Type !== 'AWS::IAM::Policy') {
     return false;
@@ -81,21 +85,26 @@ export async function skipChangeForS3DeployCustomResourcePolicy(
     }
 
     // Find all interesting reference to the role
-    const roleRefs = evaluateCfnTemplate.findReferencesTo(roleLogicalId)
+    const roleRefs = evaluateCfnTemplate
+      .findReferencesTo(roleLogicalId)
       // we are not interested in the reference from the original policy - it always exists
-      .filter(roleRef => !(roleRef.Type == 'AWS::IAM::Policy' && roleRef.LogicalId === iamPolicyLogicalId));
+      .filter((roleRef) => !(roleRef.Type == 'AWS::IAM::Policy' && roleRef.LogicalId === iamPolicyLogicalId));
 
     // Check if the role is only used for S3Deployment
     // We know this is the case, if S3Deployment -> Lambda -> Role is satisfied for every reference
     // And we have at least one reference.
-    const isRoleOnlyForS3Deployment = roleRefs.length >= 1 && roleRefs.every(roleRef => {
-      if (roleRef.Type === 'AWS::Lambda::Function') {
-        const lambdaRefs = evaluateCfnTemplate.findReferencesTo(roleRef.LogicalId);
-        // Every reference must be to the custom resource and at least one reference must be present
-        return lambdaRefs.length >= 1 && lambdaRefs.every(lambdaRef => lambdaRef.Type === 'Custom::CDKBucketDeployment');
-      }
-      return false;
-    });
+    const isRoleOnlyForS3Deployment =
+      roleRefs.length >= 1 &&
+      roleRefs.every((roleRef) => {
+        if (roleRef.Type === 'AWS::Lambda::Function') {
+          const lambdaRefs = evaluateCfnTemplate.findReferencesTo(roleRef.LogicalId);
+          // Every reference must be to the custom resource and at least one reference must be present
+          return (
+            lambdaRefs.length >= 1 && lambdaRefs.every((lambdaRef) => lambdaRef.Type === 'Custom::CDKBucketDeployment')
+          );
+        }
+        return false;
+      });
 
     // We have determined this role is used for something else, so we can't skip the change
     if (!isRoleOnlyForS3Deployment) {
diff --git a/packages/aws-cdk/lib/api/hotswap/stepfunctions-state-machines.ts b/packages/aws-cdk/lib/api/hotswap/stepfunctions-state-machines.ts
index dadf403333583..55cfa67bffe9d 100644
--- a/packages/aws-cdk/lib/api/hotswap/stepfunctions-state-machines.ts
+++ b/packages/aws-cdk/lib/api/hotswap/stepfunctions-state-machines.ts
@@ -1,9 +1,11 @@
-import { ChangeHotswapResult, classifyChanges, HotswappableChangeCandidate } from './common';
-import { ISDK } from '../aws-auth';
-import { EvaluateCloudFormationTemplate } from '../evaluate-cloudformation-template';
+import { type ChangeHotswapResult, classifyChanges, type HotswappableChangeCandidate } from './common';
+import type { SDK } from '../aws-auth';
+import type { EvaluateCloudFormationTemplate } from '../evaluate-cloudformation-template';
 
 export async function isHotswappableStateMachineChange(
-  logicalId: string, change: HotswappableChangeCandidate, evaluateCfnTemplate: EvaluateCloudFormationTemplate,
+  logicalId: string,
+  change: HotswappableChangeCandidate,
+  evaluateCfnTemplate: EvaluateCloudFormationTemplate,
 ): Promise<ChangeHotswapResult> {
   if (change.newValue.Type !== 'AWS::StepFunctions::StateMachine') {
     return [];
@@ -17,7 +19,9 @@ export async function isHotswappableStateMachineChange(
     const stateMachineNameInCfnTemplate = change.newValue?.Properties?.StateMachineName;
     const stateMachineArn = stateMachineNameInCfnTemplate
       ? await evaluateCfnTemplate.evaluateCfnExpression({
-        'Fn::Sub': 'arn:${AWS::Partition}:states:${AWS::Region}:${AWS::AccountId}:stateMachine:' + stateMachineNameInCfnTemplate,
+        'Fn::Sub':
+            'arn:${AWS::Partition}:states:${AWS::Region}:${AWS::AccountId}:stateMachine:' +
+            stateMachineNameInCfnTemplate,
       })
       : await evaluateCfnTemplate.findPhysicalNameFor(logicalId);
     ret.push({
@@ -26,7 +30,7 @@ export async function isHotswappableStateMachineChange(
       propsChanged: namesOfHotswappableChanges,
       service: 'stepfunctions-service',
       resourceNames: [`${change.newValue.Type} '${stateMachineArn?.split(':')[6]}'`],
-      apply: async (sdk: ISDK) => {
+      apply: async (sdk: SDK) => {
         if (!stateMachineArn) {
           return;
         }
@@ -35,7 +39,7 @@ export async function isHotswappableStateMachineChange(
         await sdk.stepFunctions().updateStateMachine({
           stateMachineArn,
           definition: await evaluateCfnTemplate.evaluateCfnExpression(change.propertyUpdates.DefinitionString.newValue),
-        }).promise();
+        });
       },
     });
   }
diff --git a/packages/aws-cdk/lib/api/index.ts b/packages/aws-cdk/lib/api/index.ts
index 5671f05837205..ee04643de4a05 100644
--- a/packages/aws-cdk/lib/api/index.ts
+++ b/packages/aws-cdk/lib/api/index.ts
@@ -1,4 +1,3 @@
-export * from './aws-auth/credentials';
 export * from './bootstrap';
 export * from './deploy-stack';
 export * from './toolkit-info';
diff --git a/packages/aws-cdk/lib/api/logs/find-cloudwatch-logs.ts b/packages/aws-cdk/lib/api/logs/find-cloudwatch-logs.ts
index f56ed70d0746b..9bf9a755fd358 100644
--- a/packages/aws-cdk/lib/api/logs/find-cloudwatch-logs.ts
+++ b/packages/aws-cdk/lib/api/logs/find-cloudwatch-logs.ts
@@ -1,8 +1,9 @@
-import * as cxapi from '@aws-cdk/cx-api';
-import { CloudFormation } from 'aws-sdk';
-import { ISDK, Mode, SdkProvider } from '../aws-auth';
+import type { CloudFormationStackArtifact, Environment } from '@aws-cdk/cx-api';
+import type { StackResourceSummary } from '@aws-sdk/client-cloudformation';
+import type { SDK, SdkProvider } from '../aws-auth';
 import { Deployments } from '../deployments';
 import { EvaluateCloudFormationTemplate, LazyListStackResources } from '../evaluate-cloudformation-template';
+import { Mode } from '../plugin';
 
 // resource types that have associated CloudWatch Log Groups that should _not_ be monitored
 const IGNORE_LOGS_RESOURCE_TYPES = ['AWS::EC2::FlowLog', 'AWS::CloudTrail::Trail', 'AWS::CodeBuild::Project'];
@@ -16,13 +17,13 @@ export interface FoundLogGroupsResult {
    * The resolved environment (account/region) that the log
    * groups are deployed in
    */
-  readonly env: cxapi.Environment;
+  readonly env: Environment;
 
   /**
    * The SDK that can be used to read events from the CloudWatch
    * Log Groups in the given environment
    */
-  readonly sdk: ISDK;
+  readonly sdk: SDK;
 
   /**
    * The names of the relevant CloudWatch Log Groups
@@ -33,9 +34,9 @@ export interface FoundLogGroupsResult {
 
 export async function findCloudWatchLogGroups(
   sdkProvider: SdkProvider,
-  stackArtifact: cxapi.CloudFormationStackArtifact,
+  stackArtifact: CloudFormationStackArtifact,
 ): Promise<FoundLogGroupsResult> {
-  let sdk: ISDK;
+  let sdk: SDK;
   const resolvedEnv = await sdkProvider.resolveEnvironment(stackArtifact.environment);
   // try to assume the lookup role and fallback to the default credentials
   try {
@@ -52,7 +53,6 @@ export async function findCloudWatchLogGroups(
     account: resolvedEnv.account,
     region: resolvedEnv.region,
     partition: (await sdk.currentAccount()).partition,
-    urlSuffix: (region) => sdk.getEndpointSuffix(region),
     sdk,
   });
 
@@ -71,18 +71,18 @@ export async function findCloudWatchLogGroups(
  * with an ignored resource
  */
 function isReferencedFromIgnoredResource(
-  logGroupResource: CloudFormation.StackResourceSummary,
+  logGroupResource: StackResourceSummary,
   evaluateCfnTemplate: EvaluateCloudFormationTemplate,
 ): boolean {
-  const resourcesReferencingLogGroup = evaluateCfnTemplate.findReferencesTo(logGroupResource.LogicalResourceId);
-  return resourcesReferencingLogGroup.some(reference => {
+  const resourcesReferencingLogGroup = evaluateCfnTemplate.findReferencesTo(logGroupResource.LogicalResourceId!);
+  return resourcesReferencingLogGroup.some((reference) => {
     return IGNORE_LOGS_RESOURCE_TYPES.includes(reference.Type);
   });
 }
 
 type CloudWatchLogsResolver = (
-  resource: CloudFormation.StackResourceSummary,
-  evaluateCfnTemplate: EvaluateCloudFormationTemplate
+  resource: StackResourceSummary,
+  evaluateCfnTemplate: EvaluateCloudFormationTemplate,
 ) => string | undefined;
 
 const cloudWatchLogsResolvers: Record<string, CloudWatchLogsResolver> = {
@@ -97,7 +97,7 @@ const cloudWatchLogsResolvers: Record<string, CloudWatchLogsResolver> = {
   // The keys are CFN resource types, and the values are the name of the physical name property of that resource
   // and the service name that is used in the automatically created CloudWatch log group.
   'AWS::Lambda::Function': (resource, evaluateCfnTemplate) => {
-    const loggingConfig = evaluateCfnTemplate.getResourceProperty(resource.LogicalResourceId, 'LoggingConfig');
+    const loggingConfig = evaluateCfnTemplate.getResourceProperty(resource.LogicalResourceId!, 'LoggingConfig');
     if (loggingConfig?.LogGroup) {
       // if LogGroup is a string then use it as the LogGroupName as it is referred by LogGroup.fromLogGroupArn in CDK
       if (typeof loggingConfig.LogGroup === 'string') {
@@ -122,13 +122,13 @@ const cloudWatchLogsResolvers: Record<string, CloudWatchLogsResolver> = {
  * and Log Groups created implicitly (i.e. Lambda Functions)
  */
 function findAllLogGroupNames(
-  stackResources: CloudFormation.StackResourceSummary[],
+  stackResources: StackResourceSummary[],
   evaluateCfnTemplate: EvaluateCloudFormationTemplate,
 ): string[] {
   const logGroupNames: string[] = [];
 
   for (const resource of stackResources) {
-    const logGroupResolver = cloudWatchLogsResolvers[resource.ResourceType];
+    const logGroupResolver = cloudWatchLogsResolvers[resource.ResourceType!];
     if (logGroupResolver) {
       const logGroupName = logGroupResolver(resource, evaluateCfnTemplate);
       if (logGroupName) {
diff --git a/packages/aws-cdk/lib/api/logs/logs-monitor.ts b/packages/aws-cdk/lib/api/logs/logs-monitor.ts
index 446e4bd62033a..a796f90956680 100644
--- a/packages/aws-cdk/lib/api/logs/logs-monitor.ts
+++ b/packages/aws-cdk/lib/api/logs/logs-monitor.ts
@@ -3,7 +3,7 @@ import * as cxapi from '@aws-cdk/cx-api';
 import * as chalk from 'chalk';
 import { print, error } from '../../logging';
 import { flatten } from '../../util/arrays';
-import { ISDK } from '../aws-auth';
+import type { SDK } from '../aws-auth';
 
 /**
  * After reading events from all CloudWatch log groups
@@ -43,7 +43,7 @@ interface LogGroupsAccessSettings {
   /**
    * The SDK for a given environment (account/region)
    */
-  readonly sdk: ISDK;
+  readonly sdk: SDK;
 
   /**
    * A map of log groups and associated startTime in a given account.
@@ -101,12 +101,15 @@ export class CloudWatchLogEventMonitor {
    * per env along with the SDK object that has access to read from
    * that environment.
    */
-  public addLogGroups(env: cxapi.Environment, sdk: ISDK, logGroupNames: string[]): void {
+  public addLogGroups(env: cxapi.Environment, sdk: SDK, logGroupNames: string[]): void {
     const awsEnv = `${env.account}:${env.region}`;
-    const logGroupsStartTimes = logGroupNames.reduce((acc, groupName) => {
-      acc[groupName] = this.startTime;
-      return acc;
-    }, {} as { [logGroupName: string]: number });
+    const logGroupsStartTimes = logGroupNames.reduce(
+      (acc, groupName) => {
+        acc[groupName] = this.startTime;
+        return acc;
+      },
+      {} as { [logGroupName: string]: number },
+    );
     this.envsLogGroupsAccessSettings.set(awsEnv, {
       sdk,
       logGroupsStartTimes: {
@@ -117,7 +120,7 @@ export class CloudWatchLogEventMonitor {
   }
 
   private scheduleNextTick(sleep: number): void {
-    setTimeout(() => void(this.tick()), sleep);
+    setTimeout(() => void this.tick(), sleep);
   }
 
   private async tick(): Promise<void> {
@@ -126,7 +129,7 @@ export class CloudWatchLogEventMonitor {
     }
     try {
       const events = flatten(await this.readNewEvents());
-      events.forEach(event => {
+      events.forEach((event) => {
         this.print(event);
       });
     } catch (e) {
@@ -156,10 +159,14 @@ export class CloudWatchLogEventMonitor {
    * Print out a cloudwatch event
    */
   private print(event: CloudWatchLogEvent): void {
-    print(util.format('[%s] %s %s',
-      chalk.blue(event.logGroupName),
-      chalk.yellow(event.timestamp.toLocaleTimeString()),
-      event.message.trim()));
+    print(
+      util.format(
+        '[%s] %s %s',
+        chalk.blue(event.logGroupName),
+        chalk.yellow(event.timestamp.toLocaleTimeString()),
+        event.message.trim(),
+      ),
+    );
   }
 
   /**
@@ -183,7 +190,7 @@ export class CloudWatchLogEventMonitor {
         logGroupName: logGroupName,
         limit: 100,
         startTime: startTime,
-      }).promise();
+      });
       const filteredEvents = response.events ?? [];
 
       for (const event of filteredEvents) {
@@ -197,7 +204,6 @@ export class CloudWatchLogEventMonitor {
           if (event.timestamp && endTime < event.timestamp) {
             endTime = event.timestamp;
           }
-
         }
       }
       // As long as there are _any_ events in the log group `filterLogEvents` will return a nextToken.
@@ -215,7 +221,7 @@ export class CloudWatchLogEventMonitor {
       // with Lambda functions the CloudWatch is not created
       // until something is logged, so just keep polling until
       // there is somthing to find
-      if (e.code === 'ResourceNotFoundException') {
+      if (e.name === 'ResourceNotFoundException') {
         return [];
       }
       throw e;
diff --git a/packages/aws-cdk/lib/api/nested-stack-helpers.ts b/packages/aws-cdk/lib/api/nested-stack-helpers.ts
index 3242794aa1039..fcf2677a040b0 100644
--- a/packages/aws-cdk/lib/api/nested-stack-helpers.ts
+++ b/packages/aws-cdk/lib/api/nested-stack-helpers.ts
@@ -1,27 +1,32 @@
 import * as path from 'path';
-import * as cxapi from '@aws-cdk/cx-api';
+import type { CloudFormationStackArtifact } from '@aws-cdk/cx-api';
 import * as fs from 'fs-extra';
-import { ISDK } from './aws-auth';
-import { LazyListStackResources, ListStackResources } from './evaluate-cloudformation-template';
-import { CloudFormationStack, Template } from './util/cloudformation';
+import type { SDK } from './aws-auth';
+import { LazyListStackResources, type ListStackResources } from './evaluate-cloudformation-template';
+import { CloudFormationStack, type Template } from './util/cloudformation';
 
 export interface NestedStackTemplates {
   readonly physicalName: string | undefined;
   readonly deployedTemplate: Template;
   readonly generatedTemplate: Template;
-  readonly nestedStackTemplates: { [nestedStackLogicalId: string]: NestedStackTemplates};
+  readonly nestedStackTemplates: {
+    [nestedStackLogicalId: string]: NestedStackTemplates;
+  };
 }
 
 export interface RootTemplateWithNestedStacks {
   readonly deployedRootTemplate: Template;
-  readonly nestedStacks: { [nestedStackLogicalId: string]: NestedStackTemplates };
+  readonly nestedStacks: {
+    [nestedStackLogicalId: string]: NestedStackTemplates;
+  };
 }
 
 /**
  * Reads the currently deployed template and all of its nested stack templates from CloudFormation.
  */
 export async function loadCurrentTemplateWithNestedStacks(
-  rootStackArtifact: cxapi.CloudFormationStackArtifact, sdk: ISDK,
+  rootStackArtifact: CloudFormationStackArtifact,
+  sdk: SDK,
   retrieveProcessedTemplate: boolean = false,
 ): Promise<RootTemplateWithNestedStacks> {
   const deployedRootTemplate = await loadCurrentTemplate(rootStackArtifact, sdk, retrieveProcessedTemplate);
@@ -41,44 +46,53 @@ export async function loadCurrentTemplateWithNestedStacks(
  * Returns the currently deployed template from CloudFormation that corresponds to `stackArtifact`.
  */
 export async function loadCurrentTemplate(
-  stackArtifact: cxapi.CloudFormationStackArtifact, sdk: ISDK,
+  stackArtifact: CloudFormationStackArtifact,
+  sdk: SDK,
   retrieveProcessedTemplate: boolean = false,
 ): Promise<Template> {
   return loadCurrentStackTemplate(stackArtifact.stackName, sdk, retrieveProcessedTemplate);
 }
 
 async function loadCurrentStackTemplate(
-  stackName: string, sdk: ISDK, retrieveProcessedTemplate: boolean = false,
-) : Promise<Template> {
+  stackName: string,
+  sdk: SDK,
+  retrieveProcessedTemplate: boolean = false,
+): Promise<Template> {
   const cfn = sdk.cloudFormation();
   const stack = await CloudFormationStack.lookup(cfn, stackName, retrieveProcessedTemplate);
   return stack.template();
 }
 
 async function loadNestedStacks(
-  rootStackArtifact: cxapi.CloudFormationStackArtifact,
-  sdk: ISDK,
+  rootStackArtifact: CloudFormationStackArtifact,
+  sdk: SDK,
   parentTemplates: StackTemplates,
 ): Promise<{ [nestedStackLogicalId: string]: NestedStackTemplates }> {
-  const listStackResources = parentTemplates.deployedStackName ? new LazyListStackResources(sdk, parentTemplates.deployedStackName) : undefined;
+  const listStackResources = parentTemplates.deployedStackName
+    ? new LazyListStackResources(sdk, parentTemplates.deployedStackName)
+    : undefined;
   const nestedStacks: { [nestedStackLogicalId: string]: NestedStackTemplates } = {};
-  for (const [nestedStackLogicalId, generatedNestedStackResource] of Object.entries(parentTemplates.generatedTemplate.Resources ?? {})) {
+  for (const [nestedStackLogicalId, generatedNestedStackResource] of Object.entries(
+    parentTemplates.generatedTemplate.Resources ?? {},
+  )) {
     if (!isCdkManagedNestedStack(generatedNestedStackResource)) {
       continue;
     }
 
     const assetPath = generatedNestedStackResource.Metadata['aws:asset:path'];
-    const nestedStackTemplates = await getNestedStackTemplates(rootStackArtifact, assetPath, nestedStackLogicalId, listStackResources, sdk);
+    const nestedStackTemplates = await getNestedStackTemplates(
+      rootStackArtifact,
+      assetPath,
+      nestedStackLogicalId,
+      listStackResources,
+      sdk,
+    );
 
     nestedStacks[nestedStackLogicalId] = {
       deployedTemplate: nestedStackTemplates.deployedTemplate,
       generatedTemplate: nestedStackTemplates.generatedTemplate,
       physicalName: nestedStackTemplates.deployedStackName,
-      nestedStackTemplates: await loadNestedStacks(
-        rootStackArtifact,
-        sdk,
-        nestedStackTemplates,
-      ),
+      nestedStackTemplates: await loadNestedStacks(rootStackArtifact, sdk, nestedStackTemplates),
     };
   }
 
@@ -86,8 +100,11 @@ async function loadNestedStacks(
 }
 
 async function getNestedStackTemplates(
-  rootStackArtifact: cxapi.CloudFormationStackArtifact, nestedTemplateAssetPath: string, nestedStackLogicalId: string,
-  listStackResources: ListStackResources | undefined, sdk: ISDK,
+  rootStackArtifact: CloudFormationStackArtifact,
+  nestedTemplateAssetPath: string,
+  nestedStackLogicalId: string,
+  listStackResources: ListStackResources | undefined,
+  sdk: SDK,
 ): Promise<StackTemplates> {
   const nestedTemplatePath = path.join(rootStackArtifact.assembly.directory, nestedTemplateAssetPath);
 
@@ -99,19 +116,18 @@ async function getNestedStackTemplates(
 
   return {
     generatedTemplate: JSON.parse(fs.readFileSync(nestedTemplatePath, 'utf-8')),
-    deployedTemplate: deployedStackName
-      ? await loadCurrentStackTemplate(deployedStackName, sdk)
-      : {},
+    deployedTemplate: deployedStackName ? await loadCurrentStackTemplate(deployedStackName, sdk) : {},
     deployedStackName,
   };
 }
 
 async function getNestedStackArn(
-  nestedStackLogicalId: string, listStackResources?: ListStackResources,
+  nestedStackLogicalId: string,
+  listStackResources?: ListStackResources,
 ): Promise<string | undefined> {
   try {
     const stackResources = await listStackResources?.listStackResources();
-    return stackResources?.find(sr => sr.LogicalResourceId === nestedStackLogicalId)?.PhysicalResourceId;
+    return stackResources?.find((sr) => sr.LogicalResourceId === nestedStackLogicalId)?.PhysicalResourceId;
   } catch (e: any) {
     if (e.message.startsWith('Stack with id ') && e.message.endsWith(' does not exist')) {
       return;
@@ -121,7 +137,11 @@ async function getNestedStackArn(
 }
 
 function isCdkManagedNestedStack(stackResource: any): stackResource is NestedStackResource {
-  return stackResource.Type === 'AWS::CloudFormation::Stack' && stackResource.Metadata && stackResource.Metadata['aws:asset:path'];
+  return (
+    stackResource.Type === 'AWS::CloudFormation::Stack' &&
+    stackResource.Metadata &&
+    stackResource.Metadata['aws:asset:path']
+  );
 }
 
 interface StackTemplates {
diff --git a/packages/aws-cdk/lib/api/plugin/_env.ts b/packages/aws-cdk/lib/api/plugin/_env.ts
deleted file mode 100644
index 73973a120ee75..0000000000000
--- a/packages/aws-cdk/lib/api/plugin/_env.ts
+++ /dev/null
@@ -1,11 +0,0 @@
-/**
- * This file exists to expose and centralize some features that the files in this module expect from the surrounding
- * CLI.
- *
- * The calls will be forwarded to whatever logging system is the "official" logging system for this CLI.
- *
- * Centralizing in this way makes it easy to copy/paste this directory out and have a single place to
- * break dependencies and replace these functions.
- */
-
-export { error } from '../../logging';
\ No newline at end of file
diff --git a/packages/aws-cdk/lib/api/plugin/credential-provider-source.ts b/packages/aws-cdk/lib/api/plugin/credential-provider-source.ts
index eb575ac2680f5..78e781ae6e259 100644
--- a/packages/aws-cdk/lib/api/plugin/credential-provider-source.ts
+++ b/packages/aws-cdk/lib/api/plugin/credential-provider-source.ts
@@ -1,5 +1,4 @@
-import * as aws from 'aws-sdk';
-
+import type { AwsCredentialIdentity } from '@smithy/types';
 export enum Mode {
   ForReading,
   ForWriting,
@@ -27,5 +26,5 @@ export interface CredentialProviderSource {
    *
    * Guaranteed to be called only if canProvideCredentails() returned true at some point.
    */
-  getProvider(accountId: string, mode: Mode): Promise<aws.Credentials>;
+  getProvider(accountId: string, mode: Mode): Promise<AwsCredentialIdentity>;
 }
diff --git a/packages/aws-cdk/lib/api/plugin/plugin.ts b/packages/aws-cdk/lib/api/plugin/plugin.ts
index 3be643f8395d1..f3f63b775b0ef 100644
--- a/packages/aws-cdk/lib/api/plugin/plugin.ts
+++ b/packages/aws-cdk/lib/api/plugin/plugin.ts
@@ -1,9 +1,9 @@
 import { inspect } from 'util';
 import * as chalk from 'chalk';
 
-import { error } from './_env';
-import { ContextProviderPlugin, isContextProviderPlugin } from './context-provider-plugin';
-import { CredentialProviderSource } from './credential-provider-source';
+import { type ContextProviderPlugin, isContextProviderPlugin } from './context-provider-plugin';
+import type { CredentialProviderSource } from './credential-provider-source';
+import { error } from '../../logging';
 
 /**
  * The basic contract for plug-ins to adhere to::
@@ -71,7 +71,9 @@ export class PluginHost {
         error(`Module ${chalk.green(moduleSpec)} is not a valid plug-in, or has an unsupported version.`);
         throw new Error(`Module ${moduleSpec} does not define a valid plug-in.`);
       }
-      if (plugin.init) { plugin.init(PluginHost.instance); }
+      if (plugin.init) {
+        plugin.init(PluginHost.instance);
+      }
     } catch (e: any) {
       error(`Unable to load ${chalk.green(moduleSpec)}: ${e.stack}`);
       throw new Error(`Unable to load plug-in: ${moduleSpec}`);
diff --git a/packages/aws-cdk/lib/api/toolkit-info.ts b/packages/aws-cdk/lib/api/toolkit-info.ts
index 795a6d694420f..6785fcbcaec45 100644
--- a/packages/aws-cdk/lib/api/toolkit-info.ts
+++ b/packages/aws-cdk/lib/api/toolkit-info.ts
@@ -1,8 +1,14 @@
 import * as cxapi from '@aws-cdk/cx-api';
 import * as chalk from 'chalk';
-import { ISDK } from './aws-auth';
+import type { SDK } from './aws-auth';
 import { debug } from '../logging';
-import { BOOTSTRAP_VERSION_OUTPUT, BUCKET_DOMAIN_NAME_OUTPUT, BUCKET_NAME_OUTPUT, BOOTSTRAP_VARIANT_PARAMETER, DEFAULT_BOOTSTRAP_VARIANT } from './bootstrap/bootstrap-props';
+import {
+  BOOTSTRAP_VERSION_OUTPUT,
+  BUCKET_DOMAIN_NAME_OUTPUT,
+  BUCKET_NAME_OUTPUT,
+  BOOTSTRAP_VARIANT_PARAMETER,
+  DEFAULT_BOOTSTRAP_VARIANT,
+} from './bootstrap/bootstrap-props';
 import { stabilizeStack, CloudFormationStack } from './util/cloudformation';
 
 export const DEFAULT_TOOLKIT_STACK_NAME = 'CDKToolkit';
@@ -35,20 +41,32 @@ export abstract class ToolkitInfo {
     return overrideName ?? DEFAULT_TOOLKIT_STACK_NAME;
   }
 
-  public static async lookup(environment: cxapi.Environment, sdk: ISDK, stackName: string | undefined): Promise<ToolkitInfo> {
+  public static async lookup(
+    environment: cxapi.Environment,
+    sdk: SDK,
+    stackName: string | undefined,
+  ): Promise<ToolkitInfo> {
     const cfn = sdk.cloudFormation();
     stackName = ToolkitInfo.determineName(stackName);
     try {
       const stack = await stabilizeStack(cfn, stackName);
       if (!stack) {
-        debug('The environment %s doesn\'t have the CDK toolkit stack (%s) installed. Use %s to setup your environment for use with the toolkit.',
-          environment.name, stackName, chalk.blue(`cdk bootstrap "${environment.name}"`));
+        debug(
+          "The environment %s doesn't have the CDK toolkit stack (%s) installed. Use %s to setup your environment for use with the toolkit.",
+          environment.name,
+          stackName,
+          chalk.blue(`cdk bootstrap "${environment.name}"`),
+        );
         return ToolkitInfo.bootstrapStackNotFoundInfo(stackName);
       }
       if (stack.stackStatus.isCreationFailure) {
         // Treat a "failed to create" bootstrap stack as an absent one.
-        debug('The environment %s has a CDK toolkit stack (%s) that failed to create. Use %s to try provisioning it again.',
-          environment.name, stackName, chalk.blue(`cdk bootstrap "${environment.name}"`));
+        debug(
+          'The environment %s has a CDK toolkit stack (%s) that failed to create. Use %s to try provisioning it again.',
+          environment.name,
+          stackName,
+          chalk.blue(`cdk bootstrap "${environment.name}"`),
+        );
         return ToolkitInfo.bootstrapStackNotFoundInfo(stackName);
       }
 
@@ -63,11 +81,17 @@ export abstract class ToolkitInfo {
   }
 
   public static bootstrapStackNotFoundInfo(stackName: string): ToolkitInfo {
-    return new BootstrapStackNotFoundInfo(stackName, 'This deployment requires a bootstrap stack with a known name; pass \'--toolkit-stack-name\' or switch to using the \'DefaultStackSynthesizer\' (see https://docs.aws.amazon.com/cdk/latest/guide/bootstrapping.html)');
+    return new BootstrapStackNotFoundInfo(
+      stackName,
+      "This deployment requires a bootstrap stack with a known name; pass '--toolkit-stack-name' or switch to using the 'DefaultStackSynthesizer' (see https://docs.aws.amazon.com/cdk/latest/guide/bootstrapping.html)",
+    );
   }
 
   public static bootstrapStackLookupError(stackName: string, e: Error): ToolkitInfo {
-    return new BootstrapStackNotFoundInfo(stackName, `This deployment requires a bootstrap stack with a known name, but during its lookup the following error occurred: ${e}; pass \'--toolkit-stack-name\' or switch to using the \'DefaultStackSynthesizer\' (see https://docs.aws.amazon.com/cdk/latest/guide/bootstrapping.html)`);
+    return new BootstrapStackNotFoundInfo(
+      stackName,
+      `This deployment requires a bootstrap stack with a known name, but during its lookup the following error occurred: ${e}; pass \'--toolkit-stack-name\' or switch to using the \'DefaultStackSynthesizer\' (see https://docs.aws.amazon.com/cdk/latest/guide/bootstrapping.html)`,
+    );
   }
 
   public abstract readonly found: boolean;
@@ -78,8 +102,7 @@ export abstract class ToolkitInfo {
   public abstract readonly bootstrapStack: CloudFormationStack;
   public abstract readonly stackName: string;
 
-  constructor() {
-  }
+  constructor() {}
 }
 
 /**
@@ -126,7 +149,9 @@ class ExistingToolkitInfo extends ToolkitInfo {
    */
   private requireOutput(output: string): string {
     if (!(output in this.bootstrapStack.outputs)) {
-      throw new Error(`The CDK toolkit stack (${this.bootstrapStack.stackName}) does not have an output named ${output}. Use 'cdk bootstrap' to correct this.`);
+      throw new Error(
+        `The CDK toolkit stack (${this.bootstrapStack.stackName}) does not have an output named ${output}. Use 'cdk bootstrap' to correct this.`,
+      );
     }
     return this.bootstrapStack.outputs[output];
   }
@@ -145,7 +170,10 @@ class ExistingToolkitInfo extends ToolkitInfo {
 class BootstrapStackNotFoundInfo extends ToolkitInfo {
   public readonly found = false;
 
-  constructor(public readonly stackName: string, private readonly errorMessage: string) {
+  constructor(
+    public readonly stackName: string,
+    private readonly errorMessage: string,
+  ) {
     super();
   }
 
diff --git a/packages/aws-cdk/lib/api/util/cloudformation.ts b/packages/aws-cdk/lib/api/util/cloudformation.ts
index 85a2742449da0..540e26d1ddba0 100644
--- a/packages/aws-cdk/lib/api/util/cloudformation.ts
+++ b/packages/aws-cdk/lib/api/util/cloudformation.ts
@@ -1,16 +1,26 @@
-// Temporarily pull this in to avoid creating conflicts with the sdks in this package
-import { DescribeChangeSetOutput } from '@aws-cdk/cloudformation-diff';
 import { SSMPARAM_NO_INVALIDATE } from '@aws-cdk/cx-api';
 import * as cxapi from '@aws-cdk/cx-api';
-import { CloudFormation } from 'aws-sdk';
+import {
+  ChangeSetStatus,
+  type DescribeChangeSetCommandOutput,
+  type Parameter,
+  type ResourceIdentifierSummary,
+  type ResourceToImport,
+  type Stack,
+  type Tag,
+} from '@aws-sdk/client-cloudformation';
 import { AssetManifest, FileManifestEntry } from 'cdk-assets';
 import { StackStatus } from './cloudformation/stack-status';
 import { makeBodyParameter, TemplateBodyParameter } from './template-body-parameter';
 import { debug } from '../../logging';
 import { deserializeStructure } from '../../serialize';
 import { AssetManifestBuilder } from '../../util/asset-manifest-builder';
-import { SdkProvider } from '../aws-auth';
-import { Deployments } from '../deployments';
+import type { ICloudFormationClient, SdkProvider } from '../aws-auth';
+import type { Deployments } from '../deployments';
+
+export type ResourcesToImport = ResourceToImport[];
+export type ResourceIdentifierSummaries = ResourceIdentifierSummary[];
+export type ResourceIdentifierProperties = Record<string, string>;
 
 export type Template = {
   Parameters?: Record<string, TemplateParameter>;
@@ -24,10 +34,6 @@ interface TemplateParameter {
   [key: string]: any;
 }
 
-export type ResourceIdentifierProperties = CloudFormation.ResourceIdentifierProperties;
-export type ResourceIdentifierSummaries = CloudFormation.ResourceIdentifierSummaries;
-export type ResourcesToImport = CloudFormation.ResourcesToImport;
-
 /**
  * Represents an (existing) Stack in CloudFormation
  *
@@ -36,13 +42,15 @@ export type ResourcesToImport = CloudFormation.ResourcesToImport;
  */
 export class CloudFormationStack {
   public static async lookup(
-    cfn: CloudFormation, stackName: string, retrieveProcessedTemplate: boolean = false,
+    cfn: ICloudFormationClient,
+    stackName: string,
+    retrieveProcessedTemplate: boolean = false,
   ): Promise<CloudFormationStack> {
     try {
-      const response = await cfn.describeStacks({ StackName: stackName }).promise();
+      const response = await cfn.describeStacks({ StackName: stackName });
       return new CloudFormationStack(cfn, stackName, response.Stacks && response.Stacks[0], retrieveProcessedTemplate);
     } catch (e: any) {
-      if (e.code === 'ValidationError' && e.message === `Stack with id ${stackName} does not exist`) {
+      if (e.name === 'ValidationError' && e.message === `Stack with id ${stackName} does not exist`) {
         return new CloudFormationStack(cfn, stackName, undefined);
       }
       throw e;
@@ -54,24 +62,25 @@ export class CloudFormationStack {
    *
    * It's a little silly that it needs arguments to do that, but there we go.
    */
-  public static doesNotExist(cfn: CloudFormation, stackName: string) {
+  public static doesNotExist(cfn: ICloudFormationClient, stackName: string) {
     return new CloudFormationStack(cfn, stackName);
   }
 
   /**
    * From static information (for testing)
    */
-  public static fromStaticInformation(cfn: CloudFormation, stackName: string, stack: CloudFormation.Stack) {
+  public static fromStaticInformation(cfn: ICloudFormationClient, stackName: string, stack: Stack) {
     return new CloudFormationStack(cfn, stackName, stack);
   }
 
   private _template: any;
 
   protected constructor(
-    private readonly cfn: CloudFormation, public readonly stackName: string, private readonly stack?: CloudFormation.Stack,
+    private readonly cfn: ICloudFormationClient,
+    public readonly stackName: string,
+    private readonly stack?: Stack,
     private readonly retrieveProcessedTemplate: boolean = false,
-  ) {
-  }
+  ) {}
 
   /**
    * Retrieve the stack's deployed template
@@ -88,7 +97,7 @@ export class CloudFormationStack {
       const response = await this.cfn.getTemplate({
         StackName: this.stackName,
         TemplateStage: this.retrieveProcessedTemplate ? 'Processed' : 'Original',
-      }).promise();
+      });
       this._template = (response.TemplateBody && deserializeStructure(response.TemplateBody)) || {};
     }
     return this._template;
@@ -117,9 +126,11 @@ export class CloudFormationStack {
    * Empty object if the stack doesn't exist
    */
   public get outputs(): Record<string, string> {
-    if (!this.exists) { return {}; }
+    if (!this.exists) {
+      return {};
+    }
     const result: { [name: string]: string } = {};
-    (this.stack!.Outputs || []).forEach(output => {
+    (this.stack!.Outputs || []).forEach((output) => {
       result[output.OutputKey!] = output.OutputValue!;
     });
     return result;
@@ -142,7 +153,7 @@ export class CloudFormationStack {
    *
    * Empty list if the stack does not exist
    */
-  public get tags(): CloudFormation.Tags {
+  public get tags(): Tag[] {
     return this.stack?.Tags || [];
   }
 
@@ -151,7 +162,7 @@ export class CloudFormationStack {
    *
    * Empty list if the stack does not exist
    */
-  public get notificationArns(): CloudFormation.NotificationARNs {
+  public get notificationArns(): string[] {
     return this.stack?.NotificationARNs ?? [];
   }
 
@@ -170,7 +181,9 @@ export class CloudFormationStack {
    * Empty object if the stack does not exist.
    */
   public get parameters(): Record<string, string> {
-    if (!this.exists) { return {}; }
+    if (!this.exists) {
+      return {};
+    }
     const ret: Record<string, string> = {};
     for (const param of this.stack!.Parameters ?? []) {
       ret[param.ParameterKey!] = param.ResolvedValue ?? param.ParameterValue!;
@@ -203,12 +216,15 @@ export class CloudFormationStack {
  * @returns       CloudFormation information about the ChangeSet
  */
 async function describeChangeSet(
-  cfn: CloudFormation,
+  cfn: ICloudFormationClient,
   stackName: string,
   changeSetName: string,
   { fetchAll }: { fetchAll: boolean },
-): Promise<CloudFormation.DescribeChangeSetOutput> {
-  const response = await cfn.describeChangeSet({ StackName: stackName, ChangeSetName: changeSetName }).promise();
+): Promise<DescribeChangeSetCommandOutput> {
+  const response = await cfn.describeChangeSet({
+    StackName: stackName,
+    ChangeSetName: changeSetName,
+  });
 
   // If fetchAll is true, traverse all pages from the change set description.
   while (fetchAll && response.NextToken != null) {
@@ -216,13 +232,11 @@ async function describeChangeSet(
       StackName: stackName,
       ChangeSetName: response.ChangeSetId ?? changeSetName,
       NextToken: response.NextToken,
-    }).promise();
+    });
 
     // Consolidate the changes
     if (nextPage.Changes != null) {
-      response.Changes = response.Changes != null
-        ? response.Changes.concat(nextPage.Changes)
-        : nextPage.Changes;
+      response.Changes = response.Changes != null ? response.Changes.concat(nextPage.Changes) : nextPage.Changes;
     }
 
     // Forward the new NextToken
@@ -240,7 +254,10 @@ async function describeChangeSet(
  *
  * @returns       the value that was returned by +valueProvider+
  */
-async function waitFor<T>(valueProvider: () => Promise<T | null | undefined>, timeout: number = 5000): Promise<T | undefined> {
+async function waitFor<T>(
+  valueProvider: () => Promise<T | null | undefined>,
+  timeout: number = 5000,
+): Promise<T | undefined> {
   while (true) {
     const result = await valueProvider();
     if (result === null) {
@@ -248,7 +265,7 @@ async function waitFor<T>(valueProvider: () => Promise<T | null | undefined>, ti
     } else if (result !== undefined) {
       return result;
     }
-    await new Promise(cb => setTimeout(cb, timeout));
+    await new Promise((cb) => setTimeout(cb, timeout));
   }
 }
 
@@ -265,16 +282,17 @@ async function waitFor<T>(valueProvider: () => Promise<T | null | undefined>, ti
  *
  * @returns       the CloudFormation description of the ChangeSet
  */
-// eslint-disable-next-line max-len
 export async function waitForChangeSet(
-  cfn: CloudFormation,
+  cfn: ICloudFormationClient,
   stackName: string,
   changeSetName: string,
   { fetchAll }: { fetchAll: boolean },
-): Promise<CloudFormation.DescribeChangeSetOutput> {
+): Promise<DescribeChangeSetCommandOutput> {
   debug('Waiting for changeset %s on stack %s to finish creating...', changeSetName, stackName);
   const ret = await waitFor(async () => {
-    const description = await describeChangeSet(cfn, stackName, changeSetName, { fetchAll });
+    const description = await describeChangeSet(cfn, stackName, changeSetName, {
+      fetchAll,
+    });
     // The following doesn't use a switch because tsc will not allow fall-through, UNLESS it is allows
     // EVERYWHERE that uses this library directly or indirectly, which is undesirable.
     if (description.Status === 'CREATE_PENDING' || description.Status === 'CREATE_IN_PROGRESS') {
@@ -282,12 +300,14 @@ export async function waitForChangeSet(
       return undefined;
     }
 
-    if (description.Status === 'CREATE_COMPLETE' || changeSetHasNoChanges(description)) {
+    if (description.Status === ChangeSetStatus.CREATE_COMPLETE || changeSetHasNoChanges(description)) {
       return description;
     }
 
     // eslint-disable-next-line max-len
-    throw new Error(`Failed to create ChangeSet ${changeSetName} on ${stackName}: ${description.Status || 'NO_STATUS'}, ${description.StatusReason || 'no reason provided'}`);
+    throw new Error(
+      `Failed to create ChangeSet ${changeSetName} on ${stackName}: ${description.Status || 'NO_STATUS'}, ${description.StatusReason || 'no reason provided'}`,
+    );
   });
 
   if (!ret) {
@@ -310,7 +330,7 @@ export type PrepareChangeSetOptions = {
 }
 
 export type CreateChangeSetOptions = {
-  cfn: CloudFormation;
+  cfn: ICloudFormationClient;
   changeSetName: string;
   willExecute: boolean;
   exists: boolean;
@@ -318,18 +338,20 @@ export type CreateChangeSetOptions = {
   stack: cxapi.CloudFormationStackArtifact;
   bodyParameter: TemplateBodyParameter;
   parameters: { [name: string]: string | undefined };
-  resourcesToImport?: ResourcesToImport;
+  resourcesToImport?: ResourceToImport[];
   role?: string;
-}
+};
 
 /**
  * Create a changeset for a diff operation
  */
-export async function createDiffChangeSet(options: PrepareChangeSetOptions): Promise<DescribeChangeSetOutput | undefined> {
+export async function createDiffChangeSet(
+  options: PrepareChangeSetOptions,
+): Promise<DescribeChangeSetCommandOutput | undefined> {
   // `options.stack` has been modified to include any nested stack templates directly inline with its own template, under a special `NestedTemplate` property.
   // Thus the parent template's Resources section contains the nested template's CDK metadata check, which uses Fn::Equals.
   // This causes CreateChangeSet to fail with `Template Error: Fn::Equals cannot be partially collapsed`.
-  for (const resource of Object.values((options.stack.template.Resources ?? {}))) {
+  for (const resource of Object.values(options.stack.template.Resources ?? {})) {
     if ((resource as any).Type === 'AWS::CloudFormation::Stack') {
       // eslint-disable-next-line no-console
       debug('This stack contains one or more nested stacks, falling back to template-only diff...');
@@ -347,15 +369,17 @@ export async function createDiffChangeSet(options: PrepareChangeSetOptions): Pro
  *
  * Returns a tuple of [AssetManifest, FileManifestEntry[]]
  */
-function fileEntriesFromAssetManifestArtifact(artifact: cxapi.AssetManifestArtifact): [AssetManifest, FileManifestEntry[]] {
-  const assets: (FileManifestEntry)[] = [];
+function fileEntriesFromAssetManifestArtifact(
+  artifact: cxapi.AssetManifestArtifact,
+): [AssetManifest, FileManifestEntry[]] {
+  const assets: FileManifestEntry[] = [];
   const fileName = artifact.file;
   const assetManifest = AssetManifest.fromFile(fileName);
 
-  assetManifest.entries.forEach(entry => {
+  assetManifest.entries.forEach((entry) => {
     if (entry.type === 'file') {
       const source = (entry as FileManifestEntry).source;
-      if (source.path && (source.path.endsWith('.template.json'))) {
+      if (source.path && source.path.endsWith('.template.json')) {
         assets.push(entry as FileManifestEntry);
       }
     }
@@ -363,7 +387,9 @@ function fileEntriesFromAssetManifestArtifact(artifact: cxapi.AssetManifestArtif
   return [assetManifest, assets];
 }
 
-async function uploadBodyParameterAndCreateChangeSet(options: PrepareChangeSetOptions): Promise<DescribeChangeSetOutput | undefined> {
+async function uploadBodyParameterAndCreateChangeSet(
+  options: PrepareChangeSetOptions,
+): Promise<DescribeChangeSetCommandOutput | undefined> {
   try {
     for (const artifact of options.stack.dependencies) {
       // Skip artifact if it is not an Asset Manifest Artifact
@@ -384,7 +410,7 @@ async function uploadBodyParameterAndCreateChangeSet(options: PrepareChangeSetOp
         });
       }
     }
-    const preparedSdk = (await options.deployments.prepareSdkWithDeployRole(options.stack));
+    const preparedSdk = await options.deployments.prepareSdkWithDeployRole(options.stack);
 
     const bodyParameter = await makeBodyParameter(
       options.stack,
@@ -397,7 +423,9 @@ async function uploadBodyParameterAndCreateChangeSet(options: PrepareChangeSetOp
     const exists = (await CloudFormationStack.lookup(cfn, options.stack.stackName, false)).exists;
 
     const executionRoleArn = preparedSdk.cloudFormationRoleArn;
-    options.stream.write('Hold on while we create a read-only change set to get a diff with accurate replacement information (use --no-change-set to use a less accurate but faster template-only diff)\n');
+    options.stream.write(
+      'Hold on while we create a read-only change set to get a diff with accurate replacement information (use --no-change-set to use a less accurate but faster template-only diff)\n',
+    );
 
     return await createChangeSet({
       cfn,
@@ -412,14 +440,16 @@ async function uploadBodyParameterAndCreateChangeSet(options: PrepareChangeSetOp
       role: executionRoleArn,
     });
   } catch (e: any) {
-    debug(e.message);
-    options.stream.write('Could not create a change set, will base the diff on template differences (run again with -v to see the reason)\n');
+    debug(e);
+    options.stream.write(
+      'Could not create a change set, will base the diff on template differences (run again with -v to see the reason)\n',
+    );
 
     return undefined;
   }
 }
 
-async function createChangeSet(options: CreateChangeSetOptions): Promise<DescribeChangeSetOutput> {
+async function createChangeSet(options: CreateChangeSetOptions): Promise<DescribeChangeSetCommandOutput> {
   await cleanupOldChangeset(options.changeSetName, options.stack.stackName, options.cfn);
 
   debug(`Attempting to create ChangeSet with name ${options.changeSetName} for stack ${options.stack.stackName}`);
@@ -439,22 +469,26 @@ async function createChangeSet(options: CreateChangeSetOptions): Promise<Describ
     ResourcesToImport: options.resourcesToImport,
     RoleARN: options.role,
     Capabilities: ['CAPABILITY_IAM', 'CAPABILITY_NAMED_IAM', 'CAPABILITY_AUTO_EXPAND'],
-  }).promise();
+  });
 
   debug('Initiated creation of changeset: %s; waiting for it to finish creating...', changeSet.Id);
   // Fetching all pages if we'll execute, so we can have the correct change count when monitoring.
-  const createdChangeSet = await waitForChangeSet(options.cfn, options.stack.stackName, options.changeSetName, { fetchAll: options.willExecute });
+  const createdChangeSet = await waitForChangeSet(options.cfn, options.stack.stackName, options.changeSetName, {
+    fetchAll: options.willExecute,
+  });
   await cleanupOldChangeset(options.changeSetName, options.stack.stackName, options.cfn);
 
-  // TODO: Update this once we remove sdkv2 from the rest of this package
-  return createdChangeSet as DescribeChangeSetOutput;
+  return createdChangeSet;
 }
 
-export async function cleanupOldChangeset(changeSetName: string, stackName: string, cfn: CloudFormation) {
+export async function cleanupOldChangeset(changeSetName: string, stackName: string, cfn: ICloudFormationClient) {
   // Delete any existing change sets generated by CDK since change set names must be unique.
   // The delete request is successful as long as the stack exists (even if the change set does not exist).
   debug(`Removing existing change set with name ${changeSetName} if it exists`);
-  await cfn.deleteChangeSet({ StackName: stackName, ChangeSetName: changeSetName }).promise();
+  await cfn.deleteChangeSet({
+    StackName: stackName,
+    ChangeSetName: changeSetName,
+  });
 }
 
 /**
@@ -464,16 +498,17 @@ export async function cleanupOldChangeset(changeSetName: string, stackName: stri
  * object; the latter can be empty because no resources were changed, but if
  * there are changes to Outputs, the change set can still be executed.
  */
-export function changeSetHasNoChanges(description: CloudFormation.DescribeChangeSetOutput) {
+export function changeSetHasNoChanges(description: DescribeChangeSetCommandOutput) {
   const noChangeErrorPrefixes = [
     // Error message for a regular template
-    'The submitted information didn\'t contain changes.',
+    "The submitted information didn't contain changes.",
     // Error message when a Transform is involved (see #10650)
     'No updates are to be performed.',
   ];
 
-  return description.Status === 'FAILED'
-    && noChangeErrorPrefixes.some(p => (description.StatusReason ?? '').startsWith(p));
+  return (
+    description.Status === 'FAILED' && noChangeErrorPrefixes.some((p) => (description.StatusReason ?? '').startsWith(p))
+  );
 }
 
 /**
@@ -489,15 +524,19 @@ export function changeSetHasNoChanges(description: CloudFormation.DescribeChange
  * @returns     the CloudFormation description of the stabilized stack after the delete attempt
  */
 export async function waitForStackDelete(
-  cfn: CloudFormation,
-  stackName: string): Promise<CloudFormationStack | undefined> {
-
+  cfn: ICloudFormationClient,
+  stackName: string,
+): Promise<CloudFormationStack | undefined> {
   const stack = await stabilizeStack(cfn, stackName);
-  if (!stack) { return undefined; }
+  if (!stack) {
+    return undefined;
+  }
 
   const status = stack.stackStatus;
   if (status.isFailure) {
-    throw new Error(`The stack named ${stackName} is in a failed state. You may need to delete it from the AWS console : ${status}`);
+    throw new Error(
+      `The stack named ${stackName} is in a failed state. You may need to delete it from the AWS console : ${status}`,
+    );
   } else if (status.isDeleted) {
     return undefined;
   }
@@ -516,16 +555,20 @@ export async function waitForStackDelete(
  * @returns     the CloudFormation description of the stabilized stack after the update attempt
  */
 export async function waitForStackDeploy(
-  cfn: CloudFormation,
-  stackName: string): Promise<CloudFormationStack | undefined> {
-
+  cfn: ICloudFormationClient,
+  stackName: string,
+): Promise<CloudFormationStack | undefined> {
   const stack = await stabilizeStack(cfn, stackName);
-  if (!stack) { return undefined; }
+  if (!stack) {
+    return undefined;
+  }
 
   const status = stack.stackStatus;
 
   if (status.isCreationFailure) {
-    throw new Error(`The stack named ${stackName} failed creation, it may need to be manually deleted from the AWS console: ${status}`);
+    throw new Error(
+      `The stack named ${stackName} failed creation, it may need to be manually deleted from the AWS console: ${status}`,
+    );
   } else if (!status.isDeploySuccess) {
     throw new Error(`The stack named ${stackName} failed to deploy: ${status}`);
   }
@@ -536,7 +579,7 @@ export async function waitForStackDeploy(
 /**
  * Wait for a stack to become stable (no longer _IN_PROGRESS), returning it
  */
-export async function stabilizeStack(cfn: CloudFormation, stackName: string) {
+export async function stabilizeStack(cfn: ICloudFormationClient, stackName: string) {
   debug('Waiting for stack %s to finish creating or updating...', stackName);
   return waitFor(async () => {
     const stack = await CloudFormationStack.lookup(cfn, stackName);
@@ -570,8 +613,7 @@ export class TemplateParameters {
     return new TemplateParameters(template.Parameters || {});
   }
 
-  constructor(private readonly params: Record<string, TemplateParameter>) {
-  }
+  constructor(private readonly params: Record<string, TemplateParameter>) {}
 
   /**
    * Calculate stack parameters to pass from the given desired parameter values
@@ -591,7 +633,10 @@ export class TemplateParameters {
    * throw if parameters without a Default value or a Previous value are not
    * supplied.
    */
-  public updateExisting(updates: Record<string, string | undefined>, previousValues: Record<string, string>): ParameterValues {
+  public updateExisting(
+    updates: Record<string, string | undefined>,
+    previousValues: Record<string, string>,
+  ): ParameterValues {
     return new ParameterValues(this.params, updates, previousValues);
   }
 }
@@ -601,13 +646,13 @@ export class TemplateParameters {
  */
 export class ParameterValues {
   public readonly values: Record<string, string> = {};
-  public readonly apiParameters: CloudFormation.Parameter[] = [];
+  public readonly apiParameters: Parameter[] = [];
 
   constructor(
     private readonly formalParams: Record<string, TemplateParameter>,
     updates: Record<string, string | undefined>,
-    previousValues: Record<string, string> = {}) {
-
+    previousValues: Record<string, string> = {},
+  ) {
     const missingRequired = new Array<string>();
 
     for (const [key, formalParam] of Object.entries(this.formalParams)) {
@@ -618,7 +663,10 @@ export class ParameterValues {
       const updatedValue = updates[key];
       if (updatedValue !== undefined) {
         this.values[key] = updatedValue;
-        this.apiParameters.push({ ParameterKey: key, ParameterValue: updates[key] });
+        this.apiParameters.push({
+          ParameterKey: key,
+          ParameterValue: updates[key],
+        });
         continue;
       }
 
@@ -659,7 +707,11 @@ export class ParameterValues {
     // If any of the parameters are SSM parameters, deploying must always happen
     // because we can't predict what the values will be. We will allow some
     // parameters to opt out of this check by having a magic string in their description.
-    if (Object.values(this.formalParams).some(p => p.Type.startsWith('AWS::SSM::Parameter::') && !p.Description?.includes(SSMPARAM_NO_INVALIDATE))) {
+    if (
+      Object.values(this.formalParams).some(
+        (p) => p.Type.startsWith('AWS::SSM::Parameter::') && !p.Description?.includes(SSMPARAM_NO_INVALIDATE),
+      )
+    ) {
       return 'ssm';
     }
 
@@ -670,7 +722,7 @@ export class ParameterValues {
     }
 
     // - any of the values we're setting are new
-    if (Object.keys(this.values).some(key => !(key in currentValues))) {
+    if (Object.keys(this.values).some((key) => !(key in currentValues))) {
       return true;
     }
 
diff --git a/packages/aws-cdk/lib/api/util/cloudformation/stack-activity-monitor.ts b/packages/aws-cdk/lib/api/util/cloudformation/stack-activity-monitor.ts
index 6db3b7f67941c..a73e0efcc357d 100644
--- a/packages/aws-cdk/lib/api/util/cloudformation/stack-activity-monitor.ts
+++ b/packages/aws-cdk/lib/api/util/cloudformation/stack-activity-monitor.ts
@@ -1,10 +1,10 @@
 import * as util from 'util';
-import * as cxschema from '@aws-cdk/cloud-assembly-schema';
-import * as cxapi from '@aws-cdk/cx-api';
-import * as aws from 'aws-sdk';
+import { ArtifactMetadataEntryType, type MetadataEntry } from '@aws-cdk/cloud-assembly-schema';
+import type { CloudFormationStackArtifact } from '@aws-cdk/cx-api';
 import * as chalk from 'chalk';
 import { ResourceEvent, StackEventPoller } from './stack-event-poller';
 import { error, logLevel, LogLevel, setLogLevel } from '../../../logging';
+import type { ICloudFormationClient } from '../../aws-auth';
 import { RewritableBlock } from '../display';
 
 export interface StackActivity extends ResourceEvent {
@@ -12,7 +12,7 @@ export interface StackActivity extends ResourceEvent {
 }
 
 export interface ResourceMetadata {
-  entry: cxschema.MetadataEntry;
+  entry: MetadataEntry;
   constructPath: string;
 }
 
@@ -84,14 +84,15 @@ export interface WithDefaultPrinterProps {
 }
 
 export class StackActivityMonitor {
-
   /**
    * Create a Stack Activity Monitor using a default printer, based on context clues
    */
   public static withDefaultPrinter(
-    cfn: aws.CloudFormation,
+    cfn: ICloudFormationClient,
     stackName: string,
-    stackArtifact: cxapi.CloudFormationStackArtifact, options: WithDefaultPrinterProps = {}) {
+    stackArtifact: CloudFormationStackArtifact,
+    options: WithDefaultPrinterProps = {},
+  ) {
     const stream = options.ci ? process.stdout : process.stderr;
 
     const props: PrinterProps = {
@@ -108,9 +109,10 @@ export class StackActivityMonitor {
     const fancyOutputAvailable = !isWindows && stream.isTTY && !options.ci;
     const progress = options.progress ?? StackActivityProgress.BAR;
 
-    const printer = fancyOutputAvailable && !verbose && (progress === StackActivityProgress.BAR)
-      ? new CurrentActivityPrinter(props)
-      : new HistoryActivityPrinter(props);
+    const printer =
+      fancyOutputAvailable && !verbose && progress === StackActivityProgress.BAR
+        ? new CurrentActivityPrinter(props)
+        : new HistoryActivityPrinter(props);
 
     return new StackActivityMonitor(cfn, stackName, printer, stackArtifact, options.changeSetCreationTime);
   }
@@ -135,10 +137,10 @@ export class StackActivityMonitor {
   private readPromise?: Promise<any>;
 
   constructor(
-    cfn: aws.CloudFormation,
+    cfn: ICloudFormationClient,
     private readonly stackName: string,
     private readonly printer: IActivityPrinter,
-    private readonly stack?: cxapi.CloudFormationStackArtifact,
+    private readonly stack?: CloudFormationStackArtifact,
     changeSetCreationTime?: Date,
   ) {
     this.poller = new StackEventPoller(cfn, {
@@ -173,7 +175,7 @@ export class StackActivityMonitor {
       return;
     }
 
-    this.tickTimer = setTimeout(() => void(this.tick()), this.printer.updateSleep);
+    this.tickTimer = setTimeout(() => void this.tick(), this.printer.updateSleep);
   }
 
   private async tick() {
@@ -187,7 +189,9 @@ export class StackActivityMonitor {
       this.readPromise = undefined;
 
       // We might have been stop()ped while the network call was in progress.
-      if (!this.active) { return; }
+      if (!this.active) {
+        return;
+      }
 
       this.printer.print();
     } catch (e) {
@@ -198,11 +202,13 @@ export class StackActivityMonitor {
 
   private findMetadataFor(logicalId: string | undefined): ResourceMetadata | undefined {
     const metadata = this.stack?.manifest?.metadata;
-    if (!logicalId || !metadata) { return undefined; }
+    if (!logicalId || !metadata) {
+      return undefined;
+    }
     for (const path of Object.keys(metadata)) {
       const entry = metadata[path]
-        .filter(e => e.type === cxschema.ArtifactMetadataEntryType.LOGICAL_ID)
-        .find(e => e.data === logicalId);
+        .filter((e) => e.type === ArtifactMetadataEntryType.LOGICAL_ID)
+        .find((e) => e.data === logicalId);
       if (entry) {
         return {
           entry,
@@ -223,14 +229,14 @@ export class StackActivityMonitor {
   private async readNewEvents(): Promise<void> {
     const pollEvents = await this.poller.poll();
 
-    const activities: StackActivity[] = pollEvents.map(event => ({
+    const activities: StackActivity[] = pollEvents.map((event) => ({
       ...event,
       metadata: this.findMetadataFor(event.event.LogicalResourceId),
     }));
 
     for (const activity of activities) {
       this.checkForErrors(activity);
-      this.printer.addActivity(activity );
+      this.printer.addActivity(activity);
     }
   }
 
@@ -253,7 +259,6 @@ export class StackActivityMonitor {
   }
 
   private checkForErrors(activity: StackActivity) {
-
     if (hasErrorMessage(activity.event.ResourceStatus ?? '')) {
       const isCancelled = (activity.event.ResourceStatusReason ?? '').indexOf('cancelled') > -1;
 
@@ -396,7 +401,9 @@ abstract class ActivityPrinterBase implements IActivityPrinter {
     const status = activity.event.ResourceStatus;
     const hookStatus = activity.event.HookStatus;
     const hookType = activity.event.HookType;
-    if (!status || !activity.event.LogicalResourceId) { return; }
+    if (!status || !activity.event.LogicalResourceId) {
+      return;
+    }
 
     if (status === 'ROLLBACK_IN_PROGRESS' || status === 'UPDATE_ROLLBACK_IN_PROGRESS') {
       // Only triggered on the stack once we've started doing a rollback
@@ -439,8 +446,12 @@ abstract class ActivityPrinterBase implements IActivityPrinter {
       this.resourcesPrevCompleteState[activity.event.LogicalResourceId] = status;
     }
 
-    if (hookStatus !== undefined && hookStatus.endsWith('_COMPLETE_FAILED') && activity.event.LogicalResourceId !== undefined && hookType !== undefined) {
-
+    if (
+      hookStatus !== undefined &&
+      hookStatus.endsWith('_COMPLETE_FAILED') &&
+      activity.event.LogicalResourceId !== undefined &&
+      hookType !== undefined
+    ) {
       if (this.hookFailureMap.has(activity.event.LogicalResourceId)) {
         this.hookFailureMap.get(activity.event.LogicalResourceId)?.set(hookType, activity.event.HookStatusReason ?? '');
       } else {
@@ -516,39 +527,38 @@ export class HistoryActivityPrinter extends ActivityPrinterBase {
   }
 
   private printOne(activity: StackActivity, progress?: boolean) {
-    const e = activity.event;
-    const color = colorFromStatusResult(e.ResourceStatus);
+    const event = activity.event;
+    const color = colorFromStatusResult(event.ResourceStatus);
     let reasonColor = chalk.cyan;
 
     let stackTrace = '';
-    const md = activity.metadata;
+    const metadata = activity.metadata;
 
-    if (e.ResourceStatus && e.ResourceStatus.indexOf('FAILED') !== -1) {
+    if (event.ResourceStatus && event.ResourceStatus.indexOf('FAILED') !== -1) {
       if (progress == undefined || progress) {
-        e.ResourceStatusReason = e.ResourceStatusReason ? this.failureReason(activity) : '';
+        event.ResourceStatusReason = event.ResourceStatusReason ? this.failureReason(activity) : '';
       }
-      if (md) {
-        stackTrace = md.entry.trace ? `\n\t${md.entry.trace.join('\n\t\\_ ')}` : '';
-
+      if (metadata) {
+        stackTrace = metadata.entry.trace ? `\n\t${metadata.entry.trace.join('\n\t\\_ ')}` : '';
       }
       reasonColor = chalk.red;
     }
 
-    const resourceName = md ? md.constructPath : (e.LogicalResourceId || '');
+    const resourceName = metadata ? metadata.constructPath : event.LogicalResourceId || '';
 
-    const logicalId = resourceName !== e.LogicalResourceId ? `(${e.LogicalResourceId}) ` : '';
+    const logicalId = resourceName !== event.LogicalResourceId ? `(${event.LogicalResourceId}) ` : '';
 
     this.stream.write(
       util.format(
         '%s | %s%s | %s | %s | %s %s%s%s\n',
-        e.StackName,
-        (progress !== false ? `${this.progress()} | ` : ''),
-        new Date(e.Timestamp).toLocaleTimeString(),
-        color(padRight(STATUS_WIDTH, (e.ResourceStatus || '').slice(0, STATUS_WIDTH))), // pad left and trim
-        padRight(this.props.resourceTypeColumnWidth, e.ResourceType || ''),
+        event.StackName,
+        progress !== false ? `${this.progress()} | ` : '',
+        new Date(event.Timestamp!).toLocaleTimeString(),
+        color(padRight(STATUS_WIDTH, (event.ResourceStatus || '').slice(0, STATUS_WIDTH))), // pad left and trim
+        padRight(this.props.resourceTypeColumnWidth, event.ResourceType || ''),
         color(chalk.bold(resourceName)),
         logicalId,
-        reasonColor(chalk.bold(e.ResourceStatusReason ? e.ResourceStatusReason : '')),
+        reasonColor(chalk.bold(event.ResourceStatusReason ? event.ResourceStatusReason : '')),
         reasonColor(stackTrace),
       ),
     );
@@ -565,9 +575,11 @@ export class HistoryActivityPrinter extends ActivityPrinterBase {
       return padLeft(3, util.format('%s', this.resourcesDone)); // max 500 resources
     }
 
-    return util.format('%s/%s',
+    return util.format(
+      '%s/%s',
       padLeft(this.resourceDigits, this.resourcesDone.toString()),
-      padLeft(this.resourceDigits, this.resourcesTotal != null ? this.resourcesTotal.toString() : '?'));
+      padLeft(this.resourceDigits, this.resourcesTotal != null ? this.resourcesTotal.toString() : '?'),
+    );
   }
 
   /**
@@ -579,9 +591,13 @@ export class HistoryActivityPrinter extends ActivityPrinterBase {
     }
 
     if (Object.keys(this.resourcesInProgress).length > 0) {
-      this.stream.write(util.format('%s Currently in progress: %s\n',
-        this.progress(),
-        chalk.bold(Object.keys(this.resourcesInProgress).join(', '))));
+      this.stream.write(
+        util.format(
+          '%s Currently in progress: %s\n',
+          this.progress(),
+          chalk.bold(Object.keys(this.resourcesInProgress).join(', ')),
+        ),
+      );
     }
 
     // We cheat a bit here. To prevent printInProgress() from repeatedly triggering,
@@ -589,7 +605,6 @@ export class HistoryActivityPrinter extends ActivityPrinterBase {
     // occurs, after which we can be triggered again.
     this.lastPrintTime = +Infinity;
   }
-
 }
 
 /**
@@ -622,7 +637,10 @@ export class CurrentActivityPrinter extends ActivityPrinterBase {
     const lines = [];
 
     // Add a progress bar at the top
-    const progressWidth = Math.max(Math.min((this.block.width ?? 80) - PROGRESSBAR_EXTRA_SPACE - 1, MAX_PROGRESSBAR_WIDTH), MIN_PROGRESSBAR_WIDTH);
+    const progressWidth = Math.max(
+      Math.min((this.block.width ?? 80) - PROGRESSBAR_EXTRA_SPACE - 1, MAX_PROGRESSBAR_WIDTH),
+      MIN_PROGRESSBAR_WIDTH,
+    );
     const prog = this.progressBar(progressWidth);
     if (prog) {
       lines.push('  ' + prog, '');
@@ -632,19 +650,23 @@ export class CurrentActivityPrinter extends ActivityPrinterBase {
     // to keep an eye on the failures and know about the specific errors asquickly
     // as possible (while the stack is still rolling back), so add those in.
     const toPrint: StackActivity[] = [...this.failures, ...Object.values(this.resourcesInProgress)];
-    toPrint.sort((a, b) => a.event.Timestamp.getTime() - b.event.Timestamp.getTime());
-
-    lines.push(...toPrint.map(res => {
-      const color = colorFromStatusActivity(res.event.ResourceStatus);
-      const resourceName = res.metadata?.constructPath ?? res.event.LogicalResourceId ?? '';
-
-      return util.format('%s | %s | %s | %s%s',
-        padLeft(TIMESTAMP_WIDTH, new Date(res.event.Timestamp).toLocaleTimeString()),
-        color(padRight(STATUS_WIDTH, (res.event.ResourceStatus || '').slice(0, STATUS_WIDTH))),
-        padRight(this.props.resourceTypeColumnWidth, res.event.ResourceType || ''),
-        color(chalk.bold(shorten(40, resourceName))),
-        this.failureReasonOnNextLine(res));
-    }));
+    toPrint.sort((a, b) => a.event.Timestamp!.getTime() - b.event.Timestamp!.getTime());
+
+    lines.push(
+      ...toPrint.map((res) => {
+        const color = colorFromStatusActivity(res.event.ResourceStatus);
+        const resourceName = res.metadata?.constructPath ?? res.event.LogicalResourceId ?? '';
+
+        return util.format(
+          '%s | %s | %s | %s%s',
+          padLeft(TIMESTAMP_WIDTH, new Date(res.event.Timestamp!).toLocaleTimeString()),
+          color(padRight(STATUS_WIDTH, (res.event.ResourceStatus || '').slice(0, STATUS_WIDTH))),
+          padRight(this.props.resourceTypeColumnWidth, res.event.ResourceType || ''),
+          color(chalk.bold(shorten(40, resourceName))),
+          this.failureReasonOnNextLine(res),
+        );
+      }),
+    );
 
     this.block.displayLines(lines);
   }
@@ -667,12 +689,16 @@ export class CurrentActivityPrinter extends ActivityPrinterBase {
         continue;
       }
 
-      lines.push(util.format(chalk.red('%s | %s | %s | %s%s') + '\n',
-        padLeft(TIMESTAMP_WIDTH, new Date(failure.event.Timestamp).toLocaleTimeString()),
-        padRight(STATUS_WIDTH, (failure.event.ResourceStatus || '').slice(0, STATUS_WIDTH)),
-        padRight(this.props.resourceTypeColumnWidth, failure.event.ResourceType || ''),
-        shorten(40, failure.event.LogicalResourceId ?? ''),
-        this.failureReasonOnNextLine(failure)));
+      lines.push(
+        util.format(
+          chalk.red('%s | %s | %s | %s%s') + '\n',
+          padLeft(TIMESTAMP_WIDTH, new Date(failure.event.Timestamp!).toLocaleTimeString()),
+          padRight(STATUS_WIDTH, (failure.event.ResourceStatus || '').slice(0, STATUS_WIDTH)),
+          padRight(this.props.resourceTypeColumnWidth, failure.event.ResourceType || ''),
+          shorten(40, failure.event.LogicalResourceId ?? ''),
+          this.failureReasonOnNextLine(failure),
+        ),
+      );
 
       const trace = failure.metadata?.entry?.trace;
       if (trace) {
@@ -686,7 +712,9 @@ export class CurrentActivityPrinter extends ActivityPrinterBase {
   }
 
   private progressBar(width: number) {
-    if (!this.resourcesTotal) { return ''; }
+    if (!this.resourcesTotal) {
+      return '';
+    }
     const fraction = Math.min(this.resourcesDone / this.resourcesTotal, 1);
     const innerWidth = Math.max(1, width - 2);
     const chars = innerWidth * fraction;
@@ -712,7 +740,8 @@ const FULL_BLOCK = '█';
 const PARTIAL_BLOCK = ['', '▏', '▎', '▍', '▌', '▋', '▊', '▉'];
 const MAX_PROGRESSBAR_WIDTH = 60;
 const MIN_PROGRESSBAR_WIDTH = 10;
-const PROGRESSBAR_EXTRA_SPACE = 2 /* leading spaces */ + 2 /* brackets */ + 4 /* progress number decoration */ + 6 /* 2 progress numbers up to 999 */;
+const PROGRESSBAR_EXTRA_SPACE =
+  2 /* leading spaces */ + 2 /* brackets */ + 4 /* progress number decoration */ + 6; /* 2 progress numbers up to 999 */
 
 function hasErrorMessage(status: string) {
   return status.endsWith('_FAILED') || status === 'ROLLBACK_IN_PROGRESS' || status === 'UPDATE_ROLLBACK_IN_PROGRESS';
@@ -760,7 +789,9 @@ function colorFromStatusActivity(status?: string) {
 }
 
 function shorten(maxWidth: number, p: string) {
-  if (p.length <= maxWidth) { return p; }
+  if (p.length <= maxWidth) {
+    return p;
+  }
   const half = Math.floor((maxWidth - 3) / 2);
   return p.slice(0, half) + '...' + p.slice(-half);
 }
diff --git a/packages/aws-cdk/lib/api/util/cloudformation/stack-event-poller.ts b/packages/aws-cdk/lib/api/util/cloudformation/stack-event-poller.ts
index e32b168d4a64d..9c1729073913d 100644
--- a/packages/aws-cdk/lib/api/util/cloudformation/stack-event-poller.ts
+++ b/packages/aws-cdk/lib/api/util/cloudformation/stack-event-poller.ts
@@ -1,4 +1,5 @@
-import * as aws from 'aws-sdk';
+import type { StackEvent } from '@aws-sdk/client-cloudformation';
+import type { ICloudFormationClient } from '../../aws-auth';
 
 export interface StackEventPollerProps {
   /**
@@ -30,7 +31,7 @@ export interface StackEventPollerProps {
 }
 
 export interface ResourceEvent {
-  readonly event: aws.CloudFormation.StackEvent;
+  readonly event: StackEvent;
   readonly parentStackLogicalIds: string[];
 
   /**
@@ -48,14 +49,16 @@ export class StackEventPoller {
   private readonly eventIds = new Set<string>();
   private readonly nestedStackPollers: Record<string, StackEventPoller> = {};
 
-  constructor(private readonly cfn: aws.CloudFormation, private readonly props: StackEventPollerProps) {
-  }
+  constructor(
+    private readonly cfn: ICloudFormationClient,
+    private readonly props: StackEventPollerProps,
+  ) {}
 
   /**
    * From all accumulated events, return only the errors
    */
   public get resourceErrors(): ResourceEvent[] {
-    return this.events.filter(e => e.event.ResourceStatus?.endsWith('_FAILED') && !e.isStackEvent);
+    return this.events.filter((e) => e.event.ResourceStatus?.endsWith('_FAILED') && !e.isStackEvent);
   }
 
   /**
@@ -66,86 +69,89 @@ export class StackEventPoller {
    * Recurses into nested stacks, and returns events old-to-new.
    */
   public async poll(): Promise<ResourceEvent[]> {
-    const events: ResourceEvent[] = [];
-    try {
-      let nextToken: string | undefined;
-      let finished = false;
-      while (!finished) {
-        const response = await this.cfn.describeStackEvents({ StackName: this.props.stackName, NextToken: nextToken }).promise();
-        const eventPage = response?.StackEvents ?? [];
-
-        for (const event of eventPage) {
-          // Event from before we were interested in 'em
-          if (this.props.startTime !== undefined && event.Timestamp.valueOf() < this.props.startTime) {
-            finished = true;
-            break;
-          }
-
-          // Already seen this one
-          if (this.eventIds.has(event.EventId)) {
-            finished = true;
-            break;
-          }
-          this.eventIds.add(event.EventId);
-
-          // The events for the stack itself are also included next to events about resources; we can test for them in this way.
-          const isParentStackEvent = event.PhysicalResourceId === event.StackId;
-
-          if (isParentStackEvent && this.props.stackStatuses?.includes(event.ResourceStatus ?? '')) {
-            finished = true;
-            break;
-          }
-
-          // Fresh event
-          const resEvent: ResourceEvent = {
-            event: event,
-            parentStackLogicalIds: this.props.parentStackLogicalIds ?? [],
-            isStackEvent: isParentStackEvent,
-          };
-          events.push(resEvent);
-
-          if (!isParentStackEvent && event.ResourceType === 'AWS::CloudFormation::Stack' && isStackBeginOperationState(event.ResourceStatus)) {
-            // If the event is not for `this` stack and has a physical resource Id, recursively call for events in the nested stack
-            this.trackNestedStack(event, [...this.props.parentStackLogicalIds ?? [], event.LogicalResourceId ?? '']);
-          }
-
-          if (isParentStackEvent && isStackTerminalState(event.ResourceStatus)) {
-            this.complete = true;
-          }
-        }
-
-        // We're also done if there's nothing left to read
-        nextToken = response?.NextToken;
-        if (nextToken === undefined) {
-          finished = true;
-        }
-      }
-    } catch (e: any) {
-      if (e.code === 'ValidationError' && e.message === `Stack [${this.props.stackName}] does not exist`) {
-        // Ignore
-      } else {
-        throw e;
-      }
-    }
+    const events: ResourceEvent[] = await this.doPoll();
 
     // Also poll all nested stacks we're currently tracking
     for (const [logicalId, poller] of Object.entries(this.nestedStackPollers)) {
-      events.push(...await poller.poll());
+      events.push(...(await poller.poll()));
       if (poller.complete) {
         delete this.nestedStackPollers[logicalId];
       }
     }
 
     // Return what we have so far
-    events.sort((a, b) => a.event.Timestamp.valueOf() - b.event.Timestamp.valueOf());
+    events.sort((a, b) => a.event.Timestamp!.valueOf() - b.event.Timestamp!.valueOf());
     this.events.push(...events);
     return events;
   }
 
+  private async doPoll(): Promise<ResourceEvent[]> {
+    const events: ResourceEvent[] = [];
+    try {
+      const eventList = await this.cfn.describeStackEvents({ StackName: this.props.stackName });
+      for (const event of eventList) {
+        // Event from before we were interested in 'em
+        if (this.props.startTime !== undefined && event.Timestamp!.valueOf() < this.props.startTime) {
+          return events;
+        }
+
+        // Already seen this one
+        if (this.eventIds.has(event.EventId!)) {
+          return events;
+        }
+        this.eventIds.add(event.EventId!);
+
+        // The events for the stack itself are also included next to events about resources; we can test for them in this way.
+        const isParentStackEvent = event.PhysicalResourceId === event.StackId;
+
+        if (isParentStackEvent && this.props.stackStatuses?.includes(event.ResourceStatus ?? '')) {
+          return events;
+        }
+
+        // Fresh event
+        const resEvent: ResourceEvent = {
+          event: event,
+          parentStackLogicalIds: this.props.parentStackLogicalIds ?? [],
+          isStackEvent: isParentStackEvent,
+        };
+        events.push(resEvent);
+
+        if (
+          !isParentStackEvent &&
+          event.ResourceType === 'AWS::CloudFormation::Stack' &&
+          isStackBeginOperationState(event.ResourceStatus)
+        ) {
+          // If the event is not for `this` stack and has a physical resource Id, recursively call for events in the nested stack
+          this.trackNestedStack(event, [...(this.props.parentStackLogicalIds ?? []), event.LogicalResourceId ?? '']);
+        }
+
+        if (isParentStackEvent && isStackTerminalState(event.ResourceStatus)) {
+          this.complete = true;
+        }
+      }
+    } catch (e: any) {
+      if (!(e.code === 'ValidationError' && e.message === `Stack [${this.props.stackName}] does not exist`)) {
+        throw e;
+      }
+    }
+    // // Also poll all nested stacks we're currently tracking
+    // for (const [logicalId, poller] of Object.entries(this.nestedStackPollers)) {
+    //   events.push(...(await poller.poll()));
+    //   if (poller.complete) {
+    //     delete this.nestedStackPollers[logicalId];
+    //   }
+    // }
+
+    // // Return what we have so far
+    // events.sort((a, b) => a.event.Timestamp!.valueOf() - b.event.Timestamp!.valueOf());
+    // this.events.push(...events);
+    return events;
+  }
+
   /**
    * On the CREATE_IN_PROGRESS, UPDATE_IN_PROGRESS, DELETE_IN_PROGRESS event of a nested stack, poll the nested stack updates
    */
-  private trackNestedStack(event: aws.CloudFormation.StackEvent, parentStackLogicalIds: string[]) {
+  private trackNestedStack(event: StackEvent, parentStackLogicalIds: string[]) {
     const logicalId = event.LogicalResourceId;
     const physicalResourceId = event.PhysicalResourceId;
 
@@ -161,7 +167,7 @@ export class StackEventPoller {
       this.nestedStackPollers[logicalId] = new StackEventPoller(this.cfn, {
         stackName: physicalResourceId,
         parentStackLogicalIds: parentStackLogicalIds,
-        startTime: event.Timestamp.valueOf(),
+        startTime: event.Timestamp!.valueOf(),
       });
     }
   }
@@ -179,4 +185,4 @@ function isStackBeginOperationState(state: string | undefined) {
 
 function isStackTerminalState(state: string | undefined) {
   return !(state ?? '').endsWith('_IN_PROGRESS');
-}
\ No newline at end of file
+}
diff --git a/packages/aws-cdk/lib/api/util/cloudformation/stack-status.ts b/packages/aws-cdk/lib/api/util/cloudformation/stack-status.ts
index 4dd113aaa30db..f5d3dc7341f13 100644
--- a/packages/aws-cdk/lib/api/util/cloudformation/stack-status.ts
+++ b/packages/aws-cdk/lib/api/util/cloudformation/stack-status.ts
@@ -1,4 +1,4 @@
-import * as AWS from 'aws-sdk';
+import { type Stack, StackStatus as _StackStatus } from '@aws-sdk/client-cloudformation';
 
 /**
  * A utility class to inspect CloudFormation stack statuses.
@@ -6,15 +6,17 @@ import * as AWS from 'aws-sdk';
  * @see https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/using-cfn-describing-stacks.html
  */
 export class StackStatus {
-  public static fromStackDescription(description: AWS.CloudFormation.Stack) {
-    return new StackStatus(description.StackStatus, description.StackStatusReason);
+  public static fromStackDescription(description: Stack) {
+    return new StackStatus(description.StackStatus!, description.StackStatusReason);
   }
 
-  constructor(public readonly name: string, public readonly reason?: string) {}
+  constructor(
+    public readonly name: string,
+    public readonly reason?: string,
+  ) {}
 
   get isCreationFailure(): boolean {
-    return this.name === 'ROLLBACK_COMPLETE'
-      || this.name === 'ROLLBACK_FAILED';
+    return this.name === _StackStatus.ROLLBACK_COMPLETE || this.name === _StackStatus.ROLLBACK_FAILED;
   }
 
   get isDeleted(): boolean {
@@ -30,7 +32,7 @@ export class StackStatus {
   }
 
   get isReviewInProgress(): boolean {
-    return this.name === 'REVIEW_IN_PROGRESS';
+    return this.name === _StackStatus.REVIEW_IN_PROGRESS;
   }
 
   get isNotFound(): boolean {
@@ -38,12 +40,16 @@ export class StackStatus {
   }
 
   get isDeploySuccess(): boolean {
-    return !this.isNotFound && (this.name === 'CREATE_COMPLETE' || this.name === 'UPDATE_COMPLETE' || this.name === 'IMPORT_COMPLETE');
+    return (
+      !this.isNotFound &&
+      (this.name === _StackStatus.CREATE_COMPLETE ||
+        this.name === _StackStatus.UPDATE_COMPLETE ||
+        this.name === _StackStatus.IMPORT_COMPLETE)
+    );
   }
 
   get isRollbackSuccess(): boolean {
-    return this.name === 'ROLLBACK_COMPLETE'
-      || this.name === 'UPDATE_ROLLBACK_COMPLETE';
+    return this.name === _StackStatus.ROLLBACK_COMPLETE || this.name === _StackStatus.UPDATE_ROLLBACK_COMPLETE;
   }
 
   /**
@@ -53,12 +59,12 @@ export class StackStatus {
    */
   get rollbackChoice(): RollbackChoice {
     switch (this.name) {
-      case 'CREATE_FAILED':
-      case 'UPDATE_FAILED':
+      case _StackStatus.CREATE_FAILED:
+      case _StackStatus.UPDATE_FAILED:
         return RollbackChoice.START_ROLLBACK;
-      case 'UPDATE_ROLLBACK_FAILED':
+      case _StackStatus.UPDATE_ROLLBACK_FAILED:
         return RollbackChoice.CONTINUE_UPDATE_ROLLBACK;
-      case 'ROLLBACK_FAILED':
+      case _StackStatus.ROLLBACK_FAILED:
         // Unfortunately there is no option to continue a failed rollback without
         // a stable target state.
         return RollbackChoice.ROLLBACK_FAILED;
@@ -85,4 +91,4 @@ export enum RollbackChoice {
    */
   ROLLBACK_FAILED,
   NONE,
-}
\ No newline at end of file
+}
diff --git a/packages/aws-cdk/lib/api/util/placeholders.ts b/packages/aws-cdk/lib/api/util/placeholders.ts
index 4a209723e8936..bf9b9cc5097a8 100644
--- a/packages/aws-cdk/lib/api/util/placeholders.ts
+++ b/packages/aws-cdk/lib/api/util/placeholders.ts
@@ -1,12 +1,16 @@
-import * as cxapi from '@aws-cdk/cx-api';
-import { Mode } from '../aws-auth/credentials';
-import { SdkProvider } from '../aws-auth/sdk-provider';
+import { type Environment, EnvironmentPlaceholders } from '@aws-cdk/cx-api';
+import type { SdkProvider } from '../aws-auth/sdk-provider';
+import { Mode } from '../plugin';
 
 /**
  * Replace the {ACCOUNT} and {REGION} placeholders in all strings found in a complex object.
  */
-export async function replaceEnvPlaceholders<A extends { }>(object: A, env: cxapi.Environment, sdkProvider: SdkProvider): Promise<A> {
-  return cxapi.EnvironmentPlaceholders.replaceAsync(object, {
+export async function replaceEnvPlaceholders<A extends {}>(
+  object: A,
+  env: Environment,
+  sdkProvider: SdkProvider,
+): Promise<A> {
+  return EnvironmentPlaceholders.replaceAsync(object, {
     accountId: () => Promise.resolve(env.account),
     region: () => Promise.resolve(env.region),
     partition: async () => {
@@ -19,4 +23,3 @@ export async function replaceEnvPlaceholders<A extends { }>(object: A, env: cxap
     },
   });
 }
-
diff --git a/packages/aws-cdk/lib/api/util/template-body-parameter.ts b/packages/aws-cdk/lib/api/util/template-body-parameter.ts
index 87a70edd973ad..67d645127437d 100644
--- a/packages/aws-cdk/lib/api/util/template-body-parameter.ts
+++ b/packages/aws-cdk/lib/api/util/template-body-parameter.ts
@@ -1,12 +1,13 @@
 import * as path from 'path';
-import * as cxapi from '@aws-cdk/cx-api';
+import { type CloudFormationStackArtifact, type Environment, EnvironmentPlaceholders } from '@aws-cdk/cx-api';
+import { HeadObjectCommand, S3Client } from '@aws-sdk/client-s3';
+import { getEndpointFromInstructions } from '@smithy/middleware-endpoint';
 import * as chalk from 'chalk';
 import * as fs from 'fs-extra';
 import { debug, error } from '../../logging';
 import { toYAML } from '../../serialize';
 import { AssetManifestBuilder } from '../../util/asset-manifest-builder';
 import { contentHash } from '../../util/content-hash';
-import { ISDK } from '../aws-auth';
 import { EnvironmentResources } from '../environment-resources';
 
 export type TemplateBodyParameter = {
@@ -30,17 +31,17 @@ const LARGE_TEMPLATE_SIZE_KB = 50;
  * @param toolkitInfo information about the toolkit stack
  */
 export async function makeBodyParameter(
-  stack: cxapi.CloudFormationStackArtifact,
-  resolvedEnvironment: cxapi.Environment,
+  stack: CloudFormationStackArtifact,
+  resolvedEnvironment: Environment,
   assetManifest: AssetManifestBuilder,
   resources: EnvironmentResources,
-  sdk: ISDK,
   overrideTemplate?: any,
 ): Promise<TemplateBodyParameter> {
-
   // If the template has already been uploaded to S3, just use it from there.
   if (stack.stackTemplateAssetObjectUrl && !overrideTemplate) {
-    return { TemplateURL: restUrlFromManifest(stack.stackTemplateAssetObjectUrl, resolvedEnvironment, sdk) };
+    return {
+      TemplateURL: await restUrlFromManifest(stack.stackTemplateAssetObjectUrl, resolvedEnvironment),
+    };
   }
 
   // Otherwise, pass via API call (if small) or upload here (if large)
@@ -54,9 +55,10 @@ export async function makeBodyParameter(
   if (!toolkitInfo.found) {
     error(
       `The template for stack "${stack.displayName}" is ${Math.round(templateJson.length / 1024)}KiB. ` +
-      `Templates larger than ${LARGE_TEMPLATE_SIZE_KB}KiB must be uploaded to S3.\n` +
-      'Run the following command in order to setup an S3 bucket in this environment, and then re-deploy:\n\n',
-      chalk.blue(`\t$ cdk bootstrap ${resolvedEnvironment.name}\n`));
+        `Templates larger than ${LARGE_TEMPLATE_SIZE_KB}KiB must be uploaded to S3.\n` +
+        'Run the following command in order to setup an S3 bucket in this environment, and then re-deploy:\n\n',
+      chalk.blue(`\t$ cdk bootstrap ${resolvedEnvironment.name}\n`),
+    );
 
     throw new Error('Template too large to deploy ("cdk bootstrap" is required)');
   }
@@ -72,12 +74,16 @@ export async function makeBodyParameter(
     await fs.writeFile(templateFilePath, templateJson, { encoding: 'utf-8' });
   }
 
-  assetManifest.addFileAsset(templateHash, {
-    path: templateFile,
-  }, {
-    bucketName: toolkitInfo.bucketName,
-    objectKey: key,
-  });
+  assetManifest.addFileAsset(
+    templateHash,
+    {
+      path: templateFile,
+    },
+    {
+      bucketName: toolkitInfo.bucketName,
+      objectKey: key,
+    },
+  );
 
   const templateURL = `${toolkitInfo.bucketUrl}/${key}`;
   debug('Storing template in S3 at:', templateURL);
@@ -91,29 +97,39 @@ export async function makeBodyParameter(
  * and reformats s3://.../... urls into S3 REST URLs (which CloudFormation
  * expects)
  */
-function restUrlFromManifest(url: string, environment: cxapi.Environment, sdk: ISDK): string {
+async function restUrlFromManifest(url: string, environment: Environment): Promise<string> {
   const doNotUseMarker = '**DONOTUSE**';
+  const region = environment.region;
   // This URL may contain placeholders, so still substitute those.
-  url = cxapi.EnvironmentPlaceholders.replace(url, {
+  url = EnvironmentPlaceholders.replace(url, {
     accountId: environment.account,
-    region: environment.region,
+    region,
     partition: doNotUseMarker,
   });
 
   // Yes, this is extremely crude, but we don't actually need this so I'm not inclined to spend
   // a lot of effort trying to thread the right value to this location.
   if (url.indexOf(doNotUseMarker) > -1) {
-    throw new Error('Cannot use \'${AWS::Partition}\' in the \'stackTemplateAssetObjectUrl\' field');
+    throw new Error("Cannot use '${AWS::Partition}' in the 'stackTemplateAssetObjectUrl' field");
   }
 
   const s3Url = url.match(/s3:\/\/([^/]+)\/(.*)$/);
-  if (!s3Url) { return url; }
+  if (!s3Url) {
+    return url;
+  }
 
   // We need to pass an 'https://s3.REGION.amazonaws.com[.cn]/bucket/object' URL to CloudFormation, but we
   // got an 's3://bucket/object' URL instead. Construct the rest API URL here.
   const bucketName = s3Url[1];
   const objectKey = s3Url[2];
 
-  const urlSuffix: string = sdk.getEndpointSuffix(environment.region);
-  return `https://s3.${environment.region}.${urlSuffix}/${bucketName}/${objectKey}`;
+  // SDK v3 no longer allows for getting endpoints from only region.
+  // A command and client config must now be provided.
+  const s3 = new S3Client({ region });
+  const endpoint = await getEndpointFromInstructions({}, HeadObjectCommand, {
+    ...s3.config,
+  });
+  endpoint.url.hostname;
+
+  return `${endpoint.url.origin}/${bucketName}/${objectKey}`;
 }
diff --git a/packages/aws-cdk/lib/cdk-toolkit.ts b/packages/aws-cdk/lib/cdk-toolkit.ts
index 5dc5bdaabd61c..3ca9e06f27d5d 100644
--- a/packages/aws-cdk/lib/cdk-toolkit.ts
+++ b/packages/aws-cdk/lib/cdk-toolkit.ts
@@ -9,7 +9,13 @@ import * as uuid from 'uuid';
 import { DeploymentMethod } from './api';
 import { SdkProvider } from './api/aws-auth';
 import { Bootstrapper, BootstrapEnvironmentOptions } from './api/bootstrap';
-import { CloudAssembly, DefaultSelection, ExtendedStackSelection, StackCollection, StackSelector } from './api/cxapp/cloud-assembly';
+import {
+  CloudAssembly,
+  DefaultSelection,
+  ExtendedStackSelection,
+  StackCollection,
+  StackSelector,
+} from './api/cxapp/cloud-assembly';
 import { CloudExecutable } from './api/cxapp/cloud-executable';
 import { Deployments } from './api/deployments';
 import { HotswapMode } from './api/hotswap/common';
@@ -17,7 +23,24 @@ import { findCloudWatchLogGroups } from './api/logs/find-cloudwatch-logs';
 import { CloudWatchLogEventMonitor } from './api/logs/logs-monitor';
 import { createDiffChangeSet, ResourcesToImport } from './api/util/cloudformation';
 import { StackActivityProgress } from './api/util/cloudformation/stack-activity-monitor';
-import { generateCdkApp, generateStack, readFromPath, readFromStack, setEnvironment, parseSourceOptions, generateTemplate, FromScan, TemplateSourceOptions, GenerateTemplateOutput, CfnTemplateGeneratorProvider, writeMigrateJsonFile, buildGenertedTemplateOutput, buildCfnClient, appendWarningsToReadme, isThereAWarning } from './commands/migrate';
+import {
+  generateCdkApp,
+  generateStack,
+  readFromPath,
+  readFromStack,
+  setEnvironment,
+  parseSourceOptions,
+  generateTemplate,
+  FromScan,
+  TemplateSourceOptions,
+  GenerateTemplateOutput,
+  CfnTemplateGeneratorProvider,
+  writeMigrateJsonFile,
+  buildGenertedTemplateOutput,
+  appendWarningsToReadme,
+  isThereAWarning,
+  buildCfnClient,
+} from './commands/migrate';
 import { printSecurityDiff, printStackDiff, RequireApproval } from './diff';
 import { ResourceImporter, removeNonImportResources } from './import';
 import { listStacks } from './list-stacks';
@@ -36,7 +59,6 @@ import { environmentsFromDescriptors, globEnvironmentsFromStacks, looksLikeGlob
 const pLimit: typeof import('p-limit') = require('p-limit');
 
 export interface CdkToolkitProps {
-
   /**
    * The Cloud Executable
    */
@@ -104,8 +126,7 @@ export enum AssetBuildTime {
  * deploys applies them to `cloudFormation`.
  */
 export class CdkToolkit {
-  constructor(private readonly props: CdkToolkitProps) {
-  }
+  constructor(private readonly props: CdkToolkitProps) {}
 
   public async metadata(stackName: string, json: boolean) {
     const stacks = await this.selectSingleStackByName(stackName);
@@ -133,10 +154,12 @@ export class CdkToolkit {
     if (options.templatePath !== undefined) {
       // Compare single stack against fixed template
       if (stacks.stackCount !== 1) {
-        throw new Error('Can only select one stack when comparing to fixed template. Use --exclusively to avoid selecting multiple stacks.');
+        throw new Error(
+          'Can only select one stack when comparing to fixed template. Use --exclusively to avoid selecting multiple stacks.',
+        );
       }
 
-      if (!await fs.pathExists(options.templatePath)) {
+      if (!(await fs.pathExists(options.templatePath))) {
         throw new Error(`There is no file at ${options.templatePath}`);
       }
 
@@ -148,7 +171,8 @@ export class CdkToolkit {
       // Compare N stacks against deployed templates
       for (const stack of stacks.stackArtifacts) {
         const templateWithNestedStacks = await this.props.deployments.readCurrentTemplateWithNestedStacks(
-          stack, options.compareAgainstProcessedTemplate,
+          stack,
+          options.compareAgainstProcessedTemplate,
         );
         const currentTemplate = templateWithNestedStacks.deployedRootTemplate;
         const nestedStacks = templateWithNestedStacks.nestedStacks;
@@ -171,7 +195,9 @@ export class CdkToolkit {
           } catch (e: any) {
             debug(e.message);
             if (!quiet) {
-              stream.write(`Checking if the stack ${stack.stackName} exists before creating the changeset has failed, will base the diff on template differences (run again with -v to see the reason)\n`);
+              stream.write(
+                `Checking if the stack ${stack.stackName} exists before creating the changeset has failed, will base the diff on template differences (run again with -v to see the reason)\n`,
+              );
             }
             stackExists = false;
           }
@@ -189,16 +215,35 @@ export class CdkToolkit {
               toolkitStackName: options.toolkitStackName,
             });
           } else {
-            debug(`the stack '${stack.stackName}' has not been deployed to CloudFormation or describeStacks call failed, skipping changeset creation.`);
+            debug(
+              `the stack '${stack.stackName}' has not been deployed to CloudFormation or describeStacks call failed, skipping changeset creation.`,
+            );
           }
         }
 
-        const stackCount =
-        options.securityOnly
-          ? (numberFromBool(printSecurityDiff(currentTemplate, stack, RequireApproval.Broadening, quiet, stack.displayName, changeSet)))
-          : (printStackDiff(
-            currentTemplate, stack, strict, contextLines, quiet, stack.displayName, changeSet, !!resourcesToImport, stream, nestedStacks,
-          ));
+        const stackCount = options.securityOnly
+          ? numberFromBool(
+            printSecurityDiff(
+              currentTemplate,
+              stack,
+              RequireApproval.Broadening,
+              quiet,
+              stack.displayName,
+              changeSet,
+            ),
+          )
+          : printStackDiff(
+            currentTemplate,
+            stack,
+            strict,
+            contextLines,
+            quiet,
+            stack.displayName,
+            changeSet,
+            !!resourcesToImport,
+            stream,
+            nestedStacks,
+          );
 
         diffs += stackCount;
       }
@@ -215,8 +260,12 @@ export class CdkToolkit {
     }
 
     const startSynthTime = new Date().getTime();
-    const stackCollection = await this.selectStacksForDeploy(options.selector, options.exclusively,
-      options.cacheCloudAssembly, options.ignoreNoStacks);
+    const stackCollection = await this.selectStacksForDeploy(
+      options.selector,
+      options.exclusively,
+      options.cacheCloudAssembly,
+      options.ignoreNoStacks,
+    );
     const elapsedSynthTime = new Date().getTime() - startSynthTime;
     print('\n✨  Synthesis time: %ss\n', formatTime(elapsedSynthTime));
 
@@ -233,22 +282,29 @@ export class CdkToolkit {
     const parameterMap = buildParameterMap(options.parameters);
 
     if (options.hotswap !== HotswapMode.FULL_DEPLOYMENT) {
-      warning('⚠️ The --hotswap and --hotswap-fallback flags deliberately introduce CloudFormation drift to speed up deployments');
+      warning(
+        '⚠️ The --hotswap and --hotswap-fallback flags deliberately introduce CloudFormation drift to speed up deployments',
+      );
       warning('⚠️ They should only be used for development - never use them for your production Stacks!\n');
     }
 
     const stacks = stackCollection.stackArtifacts;
 
-    const stackOutputs: { [key: string]: any } = { };
+    const stackOutputs: { [key: string]: any } = {};
     const outputsFile = options.outputsFile;
 
     const buildAsset = async (assetNode: AssetBuildNode) => {
-      await this.props.deployments.buildSingleAsset(assetNode.assetManifestArtifact, assetNode.assetManifest, assetNode.asset, {
-        stack: assetNode.parentStack,
-        roleArn: options.roleArn,
-        toolkitStackName: options.toolkitStackName,
-        stackName: assetNode.parentStack.stackName,
-      });
+      await this.props.deployments.buildSingleAsset(
+        assetNode.assetManifestArtifact,
+        assetNode.assetManifest,
+        assetNode.asset,
+        {
+          stack: assetNode.parentStack,
+          roleArn: options.roleArn,
+          toolkitStackName: options.toolkitStackName,
+          stackName: assetNode.parentStack.stackName,
+        },
+      );
     };
 
     const publishAsset = async (assetNode: AssetPublishNode) => {
@@ -262,15 +318,20 @@ export class CdkToolkit {
 
     const deployStack = async (assetNode: StackNode) => {
       const stack = assetNode.stack;
-      if (stackCollection.stackCount !== 1) { highlight(stack.displayName); }
+      if (stackCollection.stackCount !== 1) {
+        highlight(stack.displayName);
+      }
 
       if (!stack.environment) {
         // eslint-disable-next-line max-len
-        throw new Error(`Stack ${stack.displayName} does not define an environment, and AWS credentials could not be obtained from standard locations or no region was configured.`);
+        throw new Error(
+          `Stack ${stack.displayName} does not define an environment, and AWS credentials could not be obtained from standard locations or no region was configured.`,
+        );
       }
 
-      if (Object.keys(stack.template.Resources || {}).length === 0) { // The generated stack has no resources
-        if (!await this.props.deployments.stackExists({ stack })) {
+      if (Object.keys(stack.template.Resources || {}).length === 0) {
+        // The generated stack has no resources
+        if (!(await this.props.deployments.stackExists({ stack }))) {
           warning('%s: stack has no resources, skipping deployment.', chalk.bold(stack.displayName));
         } else {
           warning('%s: stack has no resources, deleting existing stack.', chalk.bold(stack.displayName));
@@ -294,18 +355,22 @@ export class CdkToolkit {
             if (!process.stdin.isTTY) {
               throw new Error(
                 '"--require-approval" is enabled and stack includes security-sensitive updates, ' +
-                'but terminal (TTY) is not attached so we are unable to get a confirmation from the user');
+                  'but terminal (TTY) is not attached so we are unable to get a confirmation from the user',
+              );
             }
 
             // only talk to user if concurrency is 1 (otherwise, fail)
             if (concurrency > 1) {
               throw new Error(
                 '"--require-approval" is enabled and stack includes security-sensitive updates, ' +
-                'but concurrency is greater than 1 so we are unable to get a confirmation from the user');
+                  'but concurrency is greater than 1 so we are unable to get a confirmation from the user',
+              );
             }
 
             const confirmed = await promptly.confirm('Do you wish to deploy these changes (y/n)?');
-            if (!confirmed) { throw new Error('Aborted by user'); }
+            if (!confirmed) {
+              throw new Error('Aborted by user');
+            }
           });
         }
       }
@@ -314,7 +379,7 @@ export class CdkToolkit {
       notificationArns = notificationArns.concat(options.notificationArns ?? []);
       notificationArns = notificationArns.concat(stack.notificationArns);
 
-      notificationArns.map(arn => {
+      notificationArns.map((arn) => {
         if (!validateSnsTopicArn(arn)) {
           throw new Error(`Notification arn ${arn} is not a valid arn for an SNS topic`);
         }
@@ -354,9 +419,7 @@ export class CdkToolkit {
           ignoreNoStacks: options.ignoreNoStacks,
         });
 
-        const message = result.noOp
-          ? ' ✅  %s (no changes)'
-          : ' ✅  %s';
+        const message = result.noOp ? ' ✅  %s (no changes)' : ' ✅  %s';
 
         success('\n' + message, stack.displayName);
         elapsedDeployTime = new Date().getTime() - startDeployTime;
@@ -379,15 +442,17 @@ export class CdkToolkit {
       } catch (e: any) {
         // It has to be exactly this string because an integration test tests for
         // "bold(stackname) failed: ResourceNotReady: <error>"
-        throw new Error([
-          `❌  ${chalk.bold(stack.stackName)} failed:`,
-          ...e.code ? [`${e.code}:`] : [],
-          e.message,
-        ].join(' '));
+        throw new Error(
+          [`❌  ${chalk.bold(stack.stackName)} failed:`, ...(e.code ? [`${e.code}:`] : []), e.message].join(' '),
+        );
       } finally {
         if (options.cloudWatchLogMonitor) {
           const foundLogGroupsResult = await findCloudWatchLogGroups(this.props.sdkProvider, stack);
-          options.cloudWatchLogMonitor.addLogGroups(foundLogGroupsResult.env, foundLogGroupsResult.sdk, foundLogGroupsResult.logGroupNames);
+          options.cloudWatchLogMonitor.addLogGroups(
+            foundLogGroupsResult.env,
+            foundLogGroupsResult.sdk,
+            foundLogGroupsResult.logGroupNames,
+          );
         }
         // If an outputs file has been specified, create the file path and write stack outputs to it once.
         // Outputs are written after all stacks have been deployed. If a stack deployment fails,
@@ -411,7 +476,7 @@ export class CdkToolkit {
       warning('⚠️ The --concurrency flag only supports --progress "events". Switching to "events".');
     }
 
-    const stacksAndTheirAssetManifests = stacks.flatMap(stack => [
+    const stacksAndTheirAssetManifests = stacks.flatMap((stack) => [
       stack,
       ...stack.dependencies.filter(cxapi.AssetManifestArtifact.isAssetManifestArtifact),
     ]);
@@ -483,11 +548,13 @@ export class CdkToolkit {
     const rootDir = path.dirname(path.resolve(PROJECT_CONFIG));
     debug("root directory used for 'watch' is: %s", rootDir);
 
-    const watchSettings: { include?: string | string[]; exclude: string | string [] } | undefined =
-        this.props.configuration.settings.get(['watch']);
+    const watchSettings: { include?: string | string[]; exclude: string | string[] } | undefined =
+      this.props.configuration.settings.get(['watch']);
     if (!watchSettings) {
-      throw new Error("Cannot use the 'watch' command without specifying at least one directory to monitor. " +
-        'Make sure to add a "watch" key to your cdk.json');
+      throw new Error(
+        "Cannot use the 'watch' command without specifying at least one directory to monitor. " +
+          'Make sure to add a "watch" key to your cdk.json',
+      );
     }
 
     // For the "include" subkey under the "watch" key, the behavior is:
@@ -495,7 +562,10 @@ export class CdkToolkit {
     // 2. "watch" setting without an "include" key? We default to observing "./**".
     // 3. "watch" setting with an empty "include" key? We default to observing "./**".
     // 4. Non-empty "include" key? Just use the "include" key.
-    const watchIncludes = this.patternsArrayForWatch(watchSettings.include, { rootDir, returnRootDirIfEmpty: true });
+    const watchIncludes = this.patternsArrayForWatch(watchSettings.include, {
+      rootDir,
+      returnRootDirIfEmpty: true,
+    });
     debug("'include' patterns for 'watch': %s", watchIncludes);
 
     // For the "exclude" subkey under the "watch" key,
@@ -505,12 +575,10 @@ export class CdkToolkit {
     // 3. Any directory's content whose name starts with a dot.
     // 4. Any node_modules and its content (even if it's not a JS/TS project, you might be using a local aws-cli package)
     const outputDir = this.props.configuration.settings.get(['output']);
-    const watchExcludes = this.patternsArrayForWatch(watchSettings.exclude, { rootDir, returnRootDirIfEmpty: false }).concat(
-      `${outputDir}/**`,
-      '**/.*',
-      '**/.*/**',
-      '**/node_modules/**',
-    );
+    const watchExcludes = this.patternsArrayForWatch(watchSettings.exclude, {
+      rootDir,
+      returnRootDirIfEmpty: false,
+    }).concat(`${outputDir}/**`, '**/.*', '**/.*/**', '**/node_modules/**');
     debug("'exclude' patterns for 'watch': %s", watchExcludes);
 
     // Since 'cdk deploy' is a relatively slow operation for a 'watch' process,
@@ -546,34 +614,44 @@ export class CdkToolkit {
       cloudWatchLogMonitor?.activate();
     };
 
-    chokidar.watch(watchIncludes, {
-      ignored: watchExcludes,
-      cwd: rootDir,
-      // ignoreInitial: true,
-    }).on('ready', async () => {
-      latch = 'open';
-      debug("'watch' received the 'ready' event. From now on, all file changes will trigger a deployment");
-      print("Triggering initial 'cdk deploy'");
-      await deployAndWatch();
-    }).on('all', async (event: 'add' | 'addDir' | 'change' | 'unlink' | 'unlinkDir', filePath?: string) => {
-      if (latch === 'pre-ready') {
-        print(`'watch' is observing ${event === 'addDir' ? 'directory' : 'the file'} '%s' for changes`, filePath);
-      } else if (latch === 'open') {
-        print("Detected change to '%s' (type: %s). Triggering 'cdk deploy'", filePath, event);
+    chokidar
+      .watch(watchIncludes, {
+        ignored: watchExcludes,
+        cwd: rootDir,
+        // ignoreInitial: true,
+      })
+      .on('ready', async () => {
+        latch = 'open';
+        debug("'watch' received the 'ready' event. From now on, all file changes will trigger a deployment");
+        print("Triggering initial 'cdk deploy'");
         await deployAndWatch();
-      } else { // this means latch is either 'deploying' or 'queued'
-        latch = 'queued';
-        print("Detected change to '%s' (type: %s) while 'cdk deploy' is still running. " +
-            'Will queue for another deployment after this one finishes', filePath, event);
-      }
-    });
+      })
+      .on('all', async (event: 'add' | 'addDir' | 'change' | 'unlink' | 'unlinkDir', filePath?: string) => {
+        if (latch === 'pre-ready') {
+          print(`'watch' is observing ${event === 'addDir' ? 'directory' : 'the file'} '%s' for changes`, filePath);
+        } else if (latch === 'open') {
+          print("Detected change to '%s' (type: %s). Triggering 'cdk deploy'", filePath, event);
+          await deployAndWatch();
+        } else {
+          // this means latch is either 'deploying' or 'queued'
+          latch = 'queued';
+          print(
+            "Detected change to '%s' (type: %s) while 'cdk deploy' is still running. " +
+              'Will queue for another deployment after this one finishes',
+            filePath,
+            event,
+          );
+        }
+      });
   }
 
   public async import(options: ImportOptions) {
     const stacks = await this.selectStacksForDeploy(options.selector, true, true, false);
 
     if (stacks.stackCount > 1) {
-      throw new Error(`Stack selection is ambiguous, please choose a specific stack for import [${stacks.stackArtifacts.map(x => x.id).join(', ')}]`);
+      throw new Error(
+        `Stack selection is ambiguous, please choose a specific stack for import [${stacks.stackArtifacts.map((x) => x.id).join(', ')}]`,
+      );
     }
 
     if (!process.stdout.isTTY && !options.resourceMappingFile) {
@@ -587,7 +665,10 @@ export class CdkToolkit {
     const resourceImporter = new ResourceImporter(stack, this.props.deployments);
     const { additions, hasNonAdditions } = await resourceImporter.discoverImportableResources(options.force);
     if (additions.length === 0) {
-      warning('%s: no new resources compared to the currently deployed stack, skipping import.', chalk.bold(stack.displayName));
+      warning(
+        '%s: no new resources compared to the currently deployed stack, skipping import.',
+        chalk.bold(stack.displayName),
+      );
       return;
     }
 
@@ -628,15 +709,22 @@ export class CdkToolkit {
 
     // Notify user of next steps
     print(
-      `Import operation complete. We recommend you run a ${chalk.blueBright('drift detection')} operation `
-      + 'to confirm your CDK app resource definitions are up-to-date. Read more here: '
-      + chalk.underline.blueBright('https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/detect-drift-stack.html'));
+      `Import operation complete. We recommend you run a ${chalk.blueBright('drift detection')} operation ` +
+        'to confirm your CDK app resource definitions are up-to-date. Read more here: ' +
+        chalk.underline.blueBright(
+          'https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/detect-drift-stack.html',
+        ),
+    );
     if (actualImport.importResources.length < additions.length) {
       print('');
-      warning(`Some resources were skipped. Run another ${chalk.blueBright('cdk import')} or a ${chalk.blueBright('cdk deploy')} to bring the stack up-to-date with your CDK app definition.`);
+      warning(
+        `Some resources were skipped. Run another ${chalk.blueBright('cdk import')} or a ${chalk.blueBright('cdk deploy')} to bring the stack up-to-date with your CDK app definition.`,
+      );
     } else if (hasNonAdditions) {
       print('');
-      warning(`Your app has pending updates or deletes excluded from this import operation. Run a ${chalk.blueBright('cdk deploy')} to bring the stack up-to-date with your CDK app definition.`);
+      warning(
+        `Your app has pending updates or deletes excluded from this import operation. Run a ${chalk.blueBright('cdk deploy')} to bring the stack up-to-date with your CDK app definition.`,
+      );
     }
   }
 
@@ -648,7 +736,9 @@ export class CdkToolkit {
 
     if (!options.force) {
       // eslint-disable-next-line max-len
-      const confirmed = await promptly.confirm(`Are you sure you want to delete: ${chalk.blue(stacks.stackArtifacts.map(s => s.hierarchicalId).join(', '))} (y/n)?`);
+      const confirmed = await promptly.confirm(
+        `Are you sure you want to delete: ${chalk.blue(stacks.stackArtifacts.map((s) => s.hierarchicalId).join(', '))} (y/n)?`,
+      );
       if (!confirmed) {
         return;
       }
@@ -656,7 +746,7 @@ export class CdkToolkit {
 
     const action = options.fromDeploy ? 'deploy' : 'destroy';
     for (const [index, stack] of stacks.stackArtifacts.entries()) {
-      success('%s: destroying... [%s/%s]', chalk.blue(stack.displayName), index+1, stacks.stackCount);
+      success('%s: destroying... [%s/%s]', chalk.blue(stack.displayName), index + 1, stacks.stackCount);
       try {
         await this.props.deployments.destroyStack({
           stack,
@@ -672,7 +762,10 @@ export class CdkToolkit {
     }
   }
 
-  public async list(selectors: string[], options: { long?: boolean; json?: boolean; showDeps?: boolean } = { }): Promise<number> {
+  public async list(
+    selectors: string[],
+    options: { long?: boolean; json?: boolean; showDeps?: boolean } = {},
+  ): Promise<number> {
     const stacks = await listStacks(this, {
       selectors: selectors,
     });
@@ -727,7 +820,13 @@ export class CdkToolkit {
    * OUTPUT: If more than one stack ends up being selected, an output directory
    * should be supplied, where the templates will be written.
    */
-  public async synth(stackNames: string[], exclusively: boolean, quiet: boolean, autoValidate?: boolean, json?: boolean): Promise<any> {
+  public async synth(
+    stackNames: string[],
+    exclusively: boolean,
+    quiet: boolean,
+    autoValidate?: boolean,
+    json?: boolean,
+  ): Promise<any> {
     const stacks = await this.selectStacksForDiff(stackNames, exclusively, autoValidate);
 
     // if we have a single stack, print it to STDOUT
@@ -747,12 +846,17 @@ export class CdkToolkit {
     // behind an environment variable.
     const isIntegMode = process.env.CDK_INTEG_MODE === '1';
     if (isIntegMode) {
-      printSerializedObject(stacks.stackArtifacts.map(s => obscureTemplate(s.template)), json ?? false);
+      printSerializedObject(
+        stacks.stackArtifacts.map((s) => obscureTemplate(s.template)),
+        json ?? false,
+      );
     }
 
     // not outputting template to stdout, let's explain things to the user a little bit...
     success(`Successfully synthesized to ${chalk.blue(path.resolve(stacks.assembly.directory))}`);
-    print(`Supply a stack id (${stacks.stackArtifacts.map(s => chalk.green(s.hierarchicalId)).join(', ')}) to display its template.`);
+    print(
+      `Supply a stack id (${stacks.stackArtifacts.map((s) => chalk.green(s.hierarchicalId)).join(', ')}) to display its template.`,
+    );
 
     return undefined;
   }
@@ -765,7 +869,11 @@ export class CdkToolkit {
    * @param bootstrapper Legacy or modern.
    * @param options The name, role ARN, bootstrapping parameters, etc. to be used for the CDK Toolkit stack.
    */
-  public async bootstrap(userEnvironmentSpecs: string[], bootstrapper: Bootstrapper, options: BootstrapEnvironmentOptions): Promise<void> {
+  public async bootstrap(
+    userEnvironmentSpecs: string[],
+    bootstrapper: Bootstrapper,
+    options: BootstrapEnvironmentOptions,
+  ): Promise<void> {
     // If there is an '--app' argument and an environment looks like a glob, we
     // select the environments from the app. Otherwise, use what the user said.
 
@@ -777,20 +885,24 @@ export class CdkToolkit {
     if (globSpecs.length > 0 && !this.props.cloudExecutable.hasApp) {
       if (userEnvironmentSpecs.length > 0) {
         // User did request this glob
-        throw new Error(`'${globSpecs}' is not an environment name. Specify an environment name like 'aws://123456789012/us-east-1', or run in a directory with 'cdk.json' to use wildcards.`);
+        throw new Error(
+          `'${globSpecs}' is not an environment name. Specify an environment name like 'aws://123456789012/us-east-1', or run in a directory with 'cdk.json' to use wildcards.`,
+        );
       } else {
         // User did not request anything
-        throw new Error('Specify an environment name like \'aws://123456789012/us-east-1\', or run in a directory with \'cdk.json\'.');
+        throw new Error(
+          "Specify an environment name like 'aws://123456789012/us-east-1', or run in a directory with 'cdk.json'.",
+        );
       }
     }
 
-    const environments: cxapi.Environment[] = [
-      ...environmentsFromDescriptors(environmentSpecs),
-    ];
+    const environments: cxapi.Environment[] = [...environmentsFromDescriptors(environmentSpecs)];
 
     // If there is an '--app' argument, select the environments from the app.
     if (this.props.cloudExecutable.hasApp) {
-      environments.push(...await globEnvironmentsFromStacks(await this.selectStacksForList([]), globSpecs, this.props.sdkProvider));
+      environments.push(
+        ...(await globEnvironmentsFromStacks(await this.selectStacksForList([]), globSpecs, this.props.sdkProvider)),
+      );
     }
 
     const limit = pLimit(20);
@@ -845,7 +957,11 @@ export class CdkToolkit {
           // resource metadata, and template source to generate the template
           cfn = new CfnTemplateGeneratorProvider(await buildCfnClient(this.props.sdkProvider, environment));
           const generatedTemplateSummary = await cfn.describeGeneratedTemplate(templateId);
-          generateTemplateOutput = buildGenertedTemplateOutput(generatedTemplateSummary, templateBody, generatedTemplateSummary.GeneratedTemplateId!);
+          generateTemplateOutput = buildGenertedTemplateOutput(
+            generatedTemplateSummary,
+            templateBody,
+            generatedTemplateSummary.GeneratedTemplateId!,
+          );
         } else {
           generateTemplateOutput = {
             migrateJson: {
@@ -876,8 +992,13 @@ export class CdkToolkit {
         writeMigrateJsonFile(options.outputPath, options.stackName, generateTemplateOutput.migrateJson);
       }
       if (isThereAWarning(generateTemplateOutput)) {
-        warning(' ⚠️  Some resources could not be migrated completely. Please review the README.md file for more information.');
-        appendWarningsToReadme(`${path.join(options.outputPath ?? process.cwd(), options.stackName)}/README.md`, generateTemplateOutput.resources!);
+        warning(
+          ' ⚠️  Some resources could not be migrated completely. Please review the README.md file for more information.',
+        );
+        appendWarningsToReadme(
+          `${path.join(options.outputPath ?? process.cwd(), options.stackName)}/README.md`,
+          generateTemplateOutput.resources!,
+        );
       }
     } catch (e) {
       error(' ❌  Migrate failed for `%s`: %s', options.stackName, (e as Error).message);
@@ -903,8 +1024,12 @@ export class CdkToolkit {
     return stacks;
   }
 
-  private async selectStacksForDeploy(selector: StackSelector, exclusively?: boolean,
-    cacheCloudAssembly?: boolean, ignoreNoStacks?: boolean): Promise<StackCollection> {
+  private async selectStacksForDeploy(
+    selector: StackSelector,
+    exclusively?: boolean,
+    cacheCloudAssembly?: boolean,
+    ignoreNoStacks?: boolean,
+  ): Promise<StackCollection> {
     const assembly = await this.assembly(cacheCloudAssembly);
     const stacks = await assembly.selectStacks(selector, {
       extend: exclusively ? ExtendedStackSelection.None : ExtendedStackSelection.Upstream,
@@ -918,17 +1043,24 @@ export class CdkToolkit {
     return stacks;
   }
 
-  private async selectStacksForDiff(stackNames: string[], exclusively?: boolean, autoValidate?: boolean): Promise<StackCollection> {
+  private async selectStacksForDiff(
+    stackNames: string[],
+    exclusively?: boolean,
+    autoValidate?: boolean,
+  ): Promise<StackCollection> {
     const assembly = await this.assembly();
 
-    const selectedForDiff = await assembly.selectStacks({ patterns: stackNames }, {
-      extend: exclusively ? ExtendedStackSelection.None : ExtendedStackSelection.Upstream,
-      defaultBehavior: DefaultSelection.MainAssembly,
-    });
+    const selectedForDiff = await assembly.selectStacks(
+      { patterns: stackNames },
+      {
+        extend: exclusively ? ExtendedStackSelection.None : ExtendedStackSelection.Upstream,
+        defaultBehavior: DefaultSelection.MainAssembly,
+      },
+    );
 
     const allStacks = await this.selectStacksForList([]);
     const autoValidateStacks = autoValidate
-      ? allStacks.filter(art => art.validateOnSynth ?? false)
+      ? allStacks.filter((art) => art.validateOnSynth ?? false)
       : new StackCollection(assembly, []);
 
     this.validateStacksSelected(selectedForDiff.concat(autoValidateStacks), stackNames);
@@ -975,10 +1107,13 @@ export class CdkToolkit {
   private async selectSingleStackByName(stackName: string) {
     const assembly = await this.assembly();
 
-    const stacks = await assembly.selectStacks({ patterns: [stackName] }, {
-      extend: ExtendedStackSelection.None,
-      defaultBehavior: DefaultSelection.None,
-    });
+    const stacks = await assembly.selectStacks(
+      { patterns: [stackName] },
+      {
+        extend: ExtendedStackSelection.None,
+        defaultBehavior: DefaultSelection.None,
+      },
+    );
 
     // Could have been a glob so check that we evaluated to exactly one
     if (stacks.stackCount > 1) {
@@ -992,16 +1127,18 @@ export class CdkToolkit {
     return this.props.cloudExecutable.synthesize(cacheCloudAssembly);
   }
 
-  private patternsArrayForWatch(patterns: string | string[] | undefined, options: { rootDir: string; returnRootDirIfEmpty: boolean }): string[] {
-    const patternsArray: string[] = patterns !== undefined
-      ? (Array.isArray(patterns) ? patterns : [patterns])
-      : [];
-    return patternsArray.length > 0
-      ? patternsArray
-      : (options.returnRootDirIfEmpty ? [options.rootDir] : []);
+  private patternsArrayForWatch(
+    patterns: string | string[] | undefined,
+    options: { rootDir: string; returnRootDirIfEmpty: boolean },
+  ): string[] {
+    const patternsArray: string[] = patterns !== undefined ? (Array.isArray(patterns) ? patterns : [patterns]) : [];
+    return patternsArray.length > 0 ? patternsArray : options.returnRootDirIfEmpty ? [options.rootDir] : [];
   }
 
-  private async invokeDeployFromWatch(options: WatchOptions, cloudWatchLogMonitor?: CloudWatchLogEventMonitor): Promise<void> {
+  private async invokeDeployFromWatch(
+    options: WatchOptions,
+    cloudWatchLogMonitor?: CloudWatchLogEventMonitor,
+  ): Promise<void> {
     const deployOptions: DeployOptions = {
       ...options,
       requireApproval: RequireApproval.Never,
@@ -1027,12 +1164,14 @@ export class CdkToolkit {
    * Remove the asset publishing and building from the work graph for assets that are already in place
    */
   private async removePublishedAssets(graph: WorkGraph, options: DeployOptions) {
-    await graph.removeUnnecessaryAssets(assetNode => this.props.deployments.isSingleAssetPublished(assetNode.assetManifest, assetNode.asset, {
-      stack: assetNode.parentStack,
-      roleArn: options.roleArn,
-      toolkitStackName: options.toolkitStackName,
-      stackName: assetNode.parentStack.stackName,
-    }));
+    await graph.removeUnnecessaryAssets((assetNode) =>
+      this.props.deployments.isSingleAssetPublished(assetNode.assetManifest, assetNode.asset, {
+        stack: assetNode.parentStack,
+        roleArn: options.roleArn,
+        toolkitStackName: options.toolkitStackName,
+        stackName: assetNode.parentStack.stackName,
+      }),
+    );
   }
 
   /**
@@ -1060,7 +1199,11 @@ export class CdkToolkit {
   /**
    * Creates a new stack with just the resources to be migrated
    */
-  private async performResourceMigration(migrateDeployment: ResourceImporter, resourcesToImport: ResourcesToImport, options: DeployOptions) {
+  private async performResourceMigration(
+    migrateDeployment: ResourceImporter,
+    resourcesToImport: ResourcesToImport,
+    options: DeployOptions,
+  ) {
     const startDeployTime = new Date().getTime();
     let elapsedDeployTime = 0;
 
@@ -1080,10 +1223,14 @@ export class CdkToolkit {
 
   private async tryGetResources(environment: cxapi.Environment): Promise<ResourcesToImport | undefined> {
     try {
-      const migrateFile = fs.readJsonSync('migrate.json', { encoding: 'utf-8' });
+      const migrateFile = fs.readJsonSync('migrate.json', {
+        encoding: 'utf-8',
+      });
       const sourceEnv = (migrateFile.Source as string).split(':');
-      if (sourceEnv[0] === 'localfile' ||
-        (sourceEnv[4] === environment.account && sourceEnv[3] === environment.region)) {
+      if (
+        sourceEnv[0] === 'localfile' ||
+        (sourceEnv[4] === environment.account && sourceEnv[3] === environment.region)
+      ) {
         return migrateFile.Resources;
       }
     } catch (e) {
@@ -1172,10 +1319,10 @@ export interface DiffOptions {
   compareAgainstProcessedTemplate?: boolean;
 
   /*
-  * Run diff in quiet mode without printing the diff statuses
-  *
-  * @default false
-  */
+   * Run diff in quiet mode without printing the diff statuses
+   *
+   * @default false
+   */
   quiet?: boolean;
 
   /**
@@ -1611,10 +1758,16 @@ function millisecondsToSeconds(num: number): number {
   return num / 1000;
 }
 
-function buildParameterMap(parameters: {
-  [name: string]: string | undefined;
-} | undefined): { [name: string]: { [name: string]: string | undefined } } {
-  const parameterMap: { [name: string]: { [name: string]: string | undefined } } = { '*': {} };
+function buildParameterMap(
+  parameters:
+  | {
+    [name: string]: string | undefined;
+  }
+  | undefined,
+): { [name: string]: { [name: string]: string | undefined } } {
+  const parameterMap: {
+    [name: string]: { [name: string]: string | undefined };
+  } = { '*': {} };
   for (const key in parameters) {
     if (parameters.hasOwnProperty(key)) {
       const [stack, parameter] = key.split(':', 2);
diff --git a/packages/aws-cdk/lib/cli.ts b/packages/aws-cdk/lib/cli.ts
index 0e28a41a4c106..eec781e2627ad 100644
--- a/packages/aws-cdk/lib/cli.ts
+++ b/packages/aws-cdk/lib/cli.ts
@@ -76,7 +76,6 @@ async function parseCommandLineArguments(args: string[]) {
     .option('profile', { type: 'string', desc: 'Use the indicated AWS profile as the default environment', requiresArg: true })
     .option('proxy', { type: 'string', desc: 'Use the indicated proxy. Will read from HTTPS_PROXY environment variable if not specified', requiresArg: true })
     .option('ca-bundle-path', { type: 'string', desc: 'Path to CA certificate to use when validating HTTPS requests. Will read from AWS_CA_BUNDLE environment variable if not specified', requiresArg: true })
-    .option('ec2creds', { type: 'boolean', alias: 'i', default: undefined, desc: 'Force trying to fetch EC2 instance credentials. Default: guess EC2 instance status' })
     .option('version-reporting', { type: 'boolean', desc: 'Include the "AWS::CDK::Metadata" resource in synthesized templates (enabled by default)', default: undefined })
     .option('path-metadata', { type: 'boolean', desc: 'Include "aws:cdk:path" CloudFormation metadata for each resource (enabled by default)', default: undefined })
     .option('asset-metadata', { type: 'boolean', desc: 'Include "aws:asset:*" CloudFormation metadata for resources that uses assets (enabled by default)', default: undefined })
@@ -227,18 +226,6 @@ async function parseCommandLineArguments(args: string[]) {
       }),
     )
     .command('watch [STACKS..]', "Shortcut for 'deploy --watch'", (yargs: Argv) => yargs
-      // I'm fairly certain none of these options, present for 'deploy', make sense for 'watch':
-      // .option('all', { type: 'boolean', default: false, desc: 'Deploy all available stacks' })
-      // .option('ci', { type: 'boolean', desc: 'Force CI detection', default: process.env.CI !== undefined })
-      // @deprecated(v2) -- tags are part of the Cloud Assembly and tags specified here will be overwritten on the next deployment
-      // .option('tags', { type: 'array', alias: 't', desc: 'Tags to add to the stack (KEY=VALUE), overrides tags from Cloud Assembly (deprecated)', nargs: 1, requiresArg: true })
-      // .option('execute', { type: 'boolean', desc: 'Whether to execute ChangeSet (--no-execute will NOT execute the ChangeSet)', default: true })
-      // These options, however, are more subtle - I could be convinced some of these should also be available for 'watch':
-      // .option('require-approval', { type: 'string', choices: [RequireApproval.Never, RequireApproval.AnyChange, RequireApproval.Broadening], desc: 'What security-sensitive changes need manual approval' })
-      // .option('parameters', { type: 'array', desc: 'Additional parameters passed to CloudFormation at deploy time (STACK:KEY=VALUE)', nargs: 1, requiresArg: true, default: {} })
-      // .option('previous-parameters', { type: 'boolean', default: true, desc: 'Use previous values for existing parameters (you must specify all parameters on every deployment if this is disabled)' })
-      // .option('outputs-file', { type: 'string', alias: 'O', desc: 'Path to file where stack outputs will be written as JSON', requiresArg: true })
-      // .option('notification-arns', { type: 'array', desc: 'ARNs of SNS topics that CloudFormation will notify with stack related events', nargs: 1, requiresArg: true })
       .option('build-exclude', { type: 'array', alias: 'E', nargs: 1, desc: 'Do not rebuild asset with the given ID. Can be specified multiple times', default: [] })
       .option('exclusively', { type: 'boolean', alias: 'e', desc: 'Only deploy requested stacks, don\'t include dependencies' })
       .option('change-set-name', { type: 'string', desc: 'Name of the CloudFormation change set to create' })
@@ -395,7 +382,6 @@ export async function exec(args: string[], synthesizer?: Synthesizer): Promise<n
 
   const sdkProvider = await SdkProvider.withAwsCliCompatibleDefaults({
     profile: configuration.settings.get(['profile']),
-    ec2creds: argv.ec2creds,
     httpOptions: {
       proxyAddress: argv.proxy,
       caBundlePath: argv['ca-bundle-path'],
@@ -406,15 +392,17 @@ export async function exec(args: string[], synthesizer?: Synthesizer): Promise<n
   const cloudExecutable = new CloudExecutable({
     configuration,
     sdkProvider,
-    synthesizer: synthesizer ?? (async (aws, config) => {
-      // Invoke 'execProgram', and copy the lock for the directory in the global
-      // variable here. It will be released when the CLI exits. Locks are not re-entrant
-      // so release it if we have to synthesize more than once (because of context lookups).
-      await outDirLock?.release();
-      const { assembly, lock } = await execProgram(aws, config);
-      outDirLock = lock;
-      return assembly;
-    }),
+    synthesizer:
+      synthesizer ??
+      (async (aws, config) => {
+        // Invoke 'execProgram', and copy the lock for the directory in the global
+        // variable here. It will be released when the CLI exits. Locks are not re-entrant
+        // so release it if we have to synthesize more than once (because of context lookups).
+        await outDirLock?.release();
+        const { assembly, lock } = await execProgram(aws, config);
+        outDirLock = lock;
+        return assembly;
+      }),
   });
 
   /** Function to load plug-ins, using configurations additively. */
@@ -424,7 +412,9 @@ export async function exec(args: string[], synthesizer?: Synthesizer): Promise<n
       const plugins: string[] = source.get(['plugin']) || [];
       for (const plugin of plugins) {
         const resolved = tryResolve(plugin);
-        if (loaded.has(resolved)) { continue; }
+        if (loaded.has(resolved)) {
+          continue;
+        }
         debug(`Loading plug-in: ${chalk.green(plugin)} from ${chalk.blue(resolved)}`);
         PluginHost.instance.load(plugin);
         loaded.add(resolved);
@@ -510,7 +500,11 @@ export async function exec(args: string[], synthesizer?: Synthesizer): Promise<n
 
       case 'ls':
       case 'list':
-        return cli.list(args.STACKS, { long: args.long, json: argv.json, showDeps: args.showDependencies });
+        return cli.list(args.STACKS, {
+          long: args.long,
+          json: argv.json,
+          showDeps: args.showDependencies,
+        });
 
       case 'diff':
         const enableDiffNoFail = isFeatureEnabled(configuration, cxapi.ENABLE_DIFF_NO_FAIL_CONTEXT);
@@ -582,13 +576,25 @@ export async function exec(args: string[], synthesizer?: Synthesizer): Promise<n
             deploymentMethod = { method: 'direct' };
             break;
           case 'change-set':
-            deploymentMethod = { method: 'change-set', execute: true, changeSetName: args.changeSetName };
+            deploymentMethod = {
+              method: 'change-set',
+              execute: true,
+              changeSetName: args.changeSetName,
+            };
             break;
           case 'prepare-change-set':
-            deploymentMethod = { method: 'change-set', execute: false, changeSetName: args.changeSetName };
+            deploymentMethod = {
+              method: 'change-set',
+              execute: false,
+              changeSetName: args.changeSetName,
+            };
             break;
           case undefined:
-            deploymentMethod = { method: 'change-set', execute: args.execute ?? true, changeSetName: args.changeSetName };
+            deploymentMethod = {
+              method: 'change-set',
+              execute: args.execute ?? true,
+              changeSetName: args.changeSetName,
+            };
             break;
         }
 
@@ -614,7 +620,9 @@ export async function exec(args: string[], synthesizer?: Synthesizer): Promise<n
           traceLogs: args.logs,
           concurrency: args.concurrency,
           assetParallelism: configuration.settings.get(['assetParallelism']),
-          assetBuildTime: configuration.settings.get(['assetPrebuild']) ? AssetBuildTime.ALL_BEFORE_DEPLOY : AssetBuildTime.JUST_IN_TIME,
+          assetBuildTime: configuration.settings.get(['assetPrebuild'])
+            ? AssetBuildTime.ALL_BEFORE_DEPLOY
+            : AssetBuildTime.JUST_IN_TIME,
           ignoreNoStacks: args.ignoreNoStacks,
         });
 
@@ -648,11 +656,6 @@ export async function exec(args: string[], synthesizer?: Synthesizer): Promise<n
       case 'watch':
         return cli.watch({
           selector,
-          // parameters: parameterMap,
-          // usePreviousParameters: args['previous-parameters'],
-          // outputsFile: configuration.settings.get(['outputsFile']),
-          // requireApproval: configuration.settings.get(['requireApproval']),
-          // notificationArns: args.notificationArns,
           exclusively: args.exclusively,
           toolkitStackName,
           roleArn: args.roleArn,
@@ -788,11 +791,16 @@ function isFeatureEnabled(configuration: Configuration, featureFlag: string) {
  *   take to mean they passed an empty array.
  */
 function arrayFromYargs(xs: string[]): string[] | undefined {
-  if (xs.length === 0) { return undefined; }
-  return xs.filter(x => x !== '');
+  if (xs.length === 0) {
+    return undefined;
+  }
+  return xs.filter((x) => x !== '');
 }
 
-function yargsNegativeAlias<T extends { [x in S | L ]: boolean | undefined }, S extends string, L extends string>(shortName: S, longName: L) {
+function yargsNegativeAlias<T extends { [x in S | L]: boolean | undefined }, S extends string, L extends string>(
+  shortName: S,
+  longName: L,
+) {
   return (argv: T) => {
     if (shortName in argv && argv[shortName]) {
       (argv as any)[longName] = false;
@@ -815,7 +823,8 @@ function determineHotswapMode(hotswap?: boolean, hotswapFallback?: boolean, watc
   let hotswapMode: HotswapMode;
   if (hotswap) {
     hotswapMode = HotswapMode.HOTSWAP_ONLY;
-  } else /*if (hotswapFallback)*/ {
+  /*if (hotswapFallback)*/
+  } else {
     hotswapMode = HotswapMode.FALL_BACK;
   }
 
@@ -829,12 +838,11 @@ export function cli(args: string[] = process.argv.slice(2)) {
         process.exitCode = value;
       }
     })
-    .catch(err => {
+    .catch((err) => {
       error(err.message);
       if (err.stack) {
         debug(err.stack);
       }
       process.exitCode = 1;
     });
-
 }
diff --git a/packages/aws-cdk/lib/commands/migrate.ts b/packages/aws-cdk/lib/commands/migrate.ts
index 30e277666b5f7..15a9115efbdc0 100644
--- a/packages/aws-cdk/lib/commands/migrate.ts
+++ b/packages/aws-cdk/lib/commands/migrate.ts
@@ -3,12 +3,24 @@
 import * as fs from 'fs';
 import * as path from 'path';
 import { Environment, UNKNOWN_ACCOUNT, UNKNOWN_REGION } from '@aws-cdk/cx-api';
-import { CloudFormation } from 'aws-sdk';
+import type {
+  DescribeGeneratedTemplateCommandOutput,
+  DescribeResourceScanCommandOutput,
+  GetGeneratedTemplateCommandOutput,
+  ListResourceScanResourcesCommandInput,
+  ResourceDefinition,
+  ResourceDetail,
+  ResourceIdentifierSummary,
+  ResourceScanSummary,
+  ScannedResource,
+  ScannedResourceIdentifier,
+} from '@aws-sdk/client-cloudformation';
 import * as cdk_from_cfn from 'cdk-from-cfn';
 import * as chalk from 'chalk';
 import { cliInit } from '../../lib/init';
 import { print } from '../../lib/logging';
-import { Mode, SdkProvider } from '../api/aws-auth';
+import type { ICloudFormationClient, SdkProvider } from '../api/aws-auth';
+import { Mode } from '../api/plugin';
 import { CloudFormationStack } from '../api/util/cloudformation';
 import { zipDirectory } from '../util/archive';
 const camelCase = require('camelcase');
@@ -24,8 +36,13 @@ export const MIGRATE_SUPPORTED_LANGUAGES: readonly string[] = cdk_from_cfn.suppo
  * @param language The language to generate the CDK app in
  * @param outputPath The path at which to generate the CDK app
  */
-export async function generateCdkApp(stackName: string, stack: string, language: string, outputPath?: string, compress?: boolean)
-  : Promise<void> {
+export async function generateCdkApp(
+  stackName: string,
+  stack: string,
+  language: string,
+  outputPath?: string,
+  compress?: boolean,
+): Promise<void> {
   const resolvedOutputPath = path.join(outputPath ?? process.cwd(), stackName);
   const formattedStackName = decamelize(stackName);
 
@@ -61,7 +78,9 @@ export async function generateCdkApp(stackName: string, stack: string, language:
         stackFileName = `${resolvedOutputPath}/${formattedStackName}.go`;
         break;
       default:
-        throw new Error(`${language} is not supported by CDK Migrate. Please choose from: ${MIGRATE_SUPPORTED_LANGUAGES.join(', ')}`);
+        throw new Error(
+          `${language} is not supported by CDK Migrate. Please choose from: ${MIGRATE_SUPPORTED_LANGUAGES.join(', ')}`,
+        );
     }
     fs.writeFileSync(stackFileName, stack);
     if (compress) {
@@ -117,16 +136,21 @@ export function readFromPath(inputPath: string): string {
  * @param environment The account and region where the stack is deployed
  * @returns A string representation of the template if present, otherwise undefined
  */
-export async function readFromStack(stackName: string, sdkProvider: SdkProvider, environment: Environment): Promise<string | undefined> {
+export async function readFromStack(
+  stackName: string,
+  sdkProvider: SdkProvider,
+  environment: Environment,
+): Promise<string | undefined> {
   const cloudFormation = (await sdkProvider.forEnvironment(environment, Mode.ForReading)).sdk.cloudFormation();
 
   const stack = await CloudFormationStack.lookup(cloudFormation, stackName, true);
   if (stack.stackStatus.isDeploySuccess || stack.stackStatus.isRollbackSuccess) {
     return JSON.stringify(await stack.template());
   } else {
-    throw new Error(`Stack '${stackName}' in account ${environment.account} and region ${environment.region} has a status of '${stack.stackStatus.name}' due to '${stack.stackStatus.reason}'. The stack cannot be migrated until it is in a healthy state.`);
+    throw new Error(
+      `Stack '${stackName}' in account ${environment.account} and region ${environment.region} has a status of '${stack.stackStatus.name}' due to '${stack.stackStatus.reason}'. The stack cannot be migrated until it is in a healthy state.`,
+    );
   }
-  return;
 }
 
 /**
@@ -136,23 +160,21 @@ export async function readFromStack(stackName: string, sdkProvider: SdkProvider,
  * @param GenerateTemplateOptions An object containing the stack name, filters, sdkProvider, environment, and newScan flag
  * @returns a generated cloudformation template
  */
-export async function generateTemplate(
-  options: GenerateTemplateOptions,
-): Promise<GenerateTemplateOutput> {
+export async function generateTemplate(options: GenerateTemplateOptions): Promise<GenerateTemplateOutput> {
   const cfn = new CfnTemplateGeneratorProvider(await buildCfnClient(options.sdkProvider, options.environment));
 
   const scanId = await findLastSuccessfulScan(cfn, options);
 
   // if a customer accidentally ctrl-c's out of the command and runs it again, this will continue the progress bar where it left off
   const curScan = await cfn.describeResourceScan(scanId);
-  if ((curScan.Status == ScanStatus.IN_PROGRESS)) {
+  if (curScan.Status == ScanStatus.IN_PROGRESS) {
     print('Resource scan in progress. Please wait, this can take 10 minutes or longer.');
     await scanProgressBar(scanId, cfn);
   }
 
   displayTimeDiff(new Date(), new Date(curScan.StartTime!));
 
-  let resources: CloudFormation.ScannedResources = await cfn.listResourceScanResources(scanId!, options.filters);
+  let resources: ScannedResource[] = await cfn.listResourceScanResources(scanId!, options.filters);
 
   print('finding related resources.');
   let relatedResources = await cfn.getResourceScanRelatedResources(scanId!, resources);
@@ -171,11 +193,18 @@ export async function generateTemplate(
   }
   print('');
   print('Template successfully generated!');
-  return buildGenertedTemplateOutput(generatedTemplate, (await cfn.getGeneratedTemplate(templateArn)).TemplateBody!, templateArn);
+  return buildGenertedTemplateOutput(
+    generatedTemplate,
+    (await cfn.getGeneratedTemplate(templateArn)).TemplateBody!,
+    templateArn,
+  );
 }
 
-async function findLastSuccessfulScan(cfn: CfnTemplateGeneratorProvider, options: GenerateTemplateOptions): Promise<string> {
-  let resourceScanSummaries: CloudFormation.ResourceScanSummaries | undefined = [];
+async function findLastSuccessfulScan(
+  cfn: CfnTemplateGeneratorProvider,
+  options: GenerateTemplateOptions,
+): Promise<string> {
+  let resourceScanSummaries: ResourceScanSummary[] | undefined = [];
   const clientRequestToken = `cdk-migrate-${options.environment.account}-${options.environment.region}`;
   if (options.fromScan === FromScan.NEW) {
     print(`Starting new scan for account ${options.environment.account} in region ${options.environment.region}`);
@@ -213,7 +242,9 @@ async function findLastSuccessfulScan(cfn: CfnTemplateGeneratorProvider, options
  * @param filters a string of filters in the format of key1=value1,key2=value2
  * @returns a map of the filters
  */
-function parseFilters(filters: string): {[key in FilterType]: string | undefined } {
+function parseFilters(filters: string): {
+  [key in FilterType]: string | undefined;
+} {
   if (!filters) {
     return {
       'resource-identifier': undefined,
@@ -221,7 +252,7 @@ function parseFilters(filters: string): {[key in FilterType]: string | undefined
       'tag-key': undefined,
       'tag-value': undefined,
     };
-  };
+  }
 
   const filterShorthands: { [key: string]: FilterType } = {
     'identifier': FilterType.RESOURCE_IDENTIFIER,
@@ -232,7 +263,7 @@ function parseFilters(filters: string): {[key in FilterType]: string | undefined
 
   const filterList = filters.split(',');
 
-  let filterMap: { [key in FilterType]: string | undefined} = {
+  let filterMap: { [key in FilterType]: string | undefined } = {
     [FilterType.RESOURCE_IDENTIFIER]: undefined,
     [FilterType.RESOURCE_TYPE_PREFIX]: undefined,
     [FilterType.TAG_KEY]: undefined,
@@ -278,7 +309,11 @@ export function chunks(list: any[], chunkSize: number): any[][] {
  * @returns The environment object
  */
 export function setEnvironment(account?: string, region?: string): Environment {
-  return { account: account ?? UNKNOWN_ACCOUNT, region: region ?? UNKNOWN_REGION, name: 'cdk-migrate-env' };
+  return {
+    account: account ?? UNKNOWN_ACCOUNT,
+    region: region ?? UNKNOWN_REGION,
+    name: 'cdk-migrate-env',
+  };
 }
 
 /**
@@ -296,8 +331,7 @@ export enum TemplateSourceOptions {
 type TemplateSource =
   | { source: TemplateSourceOptions.SCAN }
   | { source: TemplateSourceOptions.PATH; templatePath: string }
-  | { source: TemplateSourceOptions.STACK; stackName: string }
-  ;
+  | { source: TemplateSourceOptions.STACK; stackName: string };
 
 /**
  * Enum for the status of a resource scan
@@ -342,11 +376,13 @@ export function parseSourceOptions(fromPath?: string, fromStack?: boolean, stack
  * @param resourceList the list of resources provided by the list scanned resources calls
  * @returns a list of resources not managed by cfn stacks
  */
-function excludeManaged(resourceList: CloudFormation.ScannedResources): CloudFormation.ScannedResourceIdentifiers {
-  return resourceList.filter((r) => !r.ManagedByStack).map((r) => ({
-    ResourceType: r.ResourceType!,
-    ResourceIdentifier: r.ResourceIdentifier!,
-  }));
+function excludeManaged(resourceList: ScannedResource[]): ScannedResourceIdentifier[] {
+  return resourceList
+    .filter((r) => !r.ManagedByStack)
+    .map((r) => ({
+      ResourceType: r.ResourceType!,
+      ResourceIdentifier: r.ResourceIdentifier!,
+    }));
 }
 
 /**
@@ -354,12 +390,12 @@ function excludeManaged(resourceList: CloudFormation.ScannedResources): CloudFor
  * Setting the value of the field to undefined effectively removes it from the object.
  *
  * @param resourceList the list of resources provided by the list scanned resources calls
- * @returns a list of ScannedResourceIdentifiers
+ * @returns a list of ScannedResourceIdentifier[]
  */
-function resourceIdentifiers(resourceList: CloudFormation.ScannedResources): CloudFormation.ScannedResourceIdentifiers {
-  const identifiers: CloudFormation.ScannedResourceIdentifiers = [];
+function resourceIdentifiers(resourceList: ScannedResource[]): ScannedResourceIdentifier[] {
+  const identifiers: ScannedResourceIdentifier[] = [];
   resourceList.forEach((r) => {
-    const identifier: CloudFormation.ScannedResourceIdentifier = {
+    const identifier: ScannedResourceIdentifier = {
       ResourceType: r.ResourceType!,
       ResourceIdentifier: r.ResourceIdentifier!,
     };
@@ -377,12 +413,15 @@ function resourceIdentifiers(resourceList: CloudFormation.ScannedResources): Clo
 export async function scanProgressBar(scanId: string, cfn: CfnTemplateGeneratorProvider) {
   let curProgress = 0.5;
   // we know it's in progress initially since we wouldn't have gotten here if it wasn't
-  let curScan: CloudFormation.DescribeResourceScanOutput = { Status: ScanStatus.IN_PROGRESS };
+  let curScan: DescribeResourceScanCommandOutput = {
+    Status: ScanStatus.IN_PROGRESS,
+    $metadata: {},
+  };
   while (curScan.Status == ScanStatus.IN_PROGRESS) {
     curScan = await cfn.describeResourceScan(scanId);
     curProgress = curScan.PercentageCompleted ?? curProgress;
     printBar(30, curProgress);
-    await new Promise(resolve => setTimeout(resolve, 2000));
+    await new Promise((resolve) => setTimeout(resolve, 2000));
   }
   print('');
   print('✅ Scan Complete!');
@@ -422,21 +461,19 @@ export function printBar(width: number, progress: number) {
  * @param timeoutx4 The amount of time to wait before printing the next period
  */
 export async function printDots(message: string, timeoutx4: number) {
-
   if (!process.env.MIGRATE_INTEG_TEST) {
     rewriteLine(message + ' .');
-    await new Promise(resolve => setTimeout(resolve, timeoutx4));
+    await new Promise((resolve) => setTimeout(resolve, timeoutx4));
 
     rewriteLine(message + ' ..');
-    await new Promise(resolve => setTimeout(resolve, timeoutx4));
+    await new Promise((resolve) => setTimeout(resolve, timeoutx4));
 
     rewriteLine(message + ' ...');
-    await new Promise(resolve => setTimeout(resolve, timeoutx4));
+    await new Promise((resolve) => setTimeout(resolve, timeoutx4));
 
     rewriteLine(message);
-    await new Promise(resolve => setTimeout(resolve, timeoutx4));
+    await new Promise((resolve) => setTimeout(resolve, timeoutx4));
   }
-
 }
 
 /**
@@ -474,13 +511,20 @@ export function displayTimeDiff(time1: Date, time2: Date): void {
  * @param stackName The name of the stack
  * @param generatedOutput The output of the template generator
  */
-export function writeMigrateJsonFile(outputPath: string | undefined, stackName: string, migrateJson: MigrateJsonFormat) {
+export function writeMigrateJsonFile(
+  outputPath: string | undefined,
+  stackName: string,
+  migrateJson: MigrateJsonFormat,
+) {
   const outputToJson = {
     '//': 'This file is generated by cdk migrate. It will be automatically deleted after the first successful deployment of this app to the environment of the original resources.',
     'Source': migrateJson.source,
     'Resources': migrateJson.resources,
   };
-  fs.writeFileSync(`${path.join(outputPath ?? process.cwd(), stackName)}/migrate.json`, JSON.stringify(outputToJson, null, 2));
+  fs.writeFileSync(
+    `${path.join(outputPath ?? process.cwd(), stackName)}/migrate.json`,
+    JSON.stringify(outputToJson, null, 2),
+  );
 }
 
 /**
@@ -528,9 +572,12 @@ export function isThereAWarning(generatedTemplateOutput: GenerateTemplateOutput)
  * @param templateBody The body of the generated template
  * @returns A GenerateTemplateOutput object
  */
-export function buildGenertedTemplateOutput(generatedTemplateSummary: CloudFormation.DescribeGeneratedTemplateOutput,
-  templateBody: string, source: string): GenerateTemplateOutput {
-  const resources: CloudFormation.ResourceDetails | undefined = generatedTemplateSummary.Resources;
+export function buildGenertedTemplateOutput(
+  generatedTemplateSummary: DescribeGeneratedTemplateCommandOutput,
+  templateBody: string,
+  source: string,
+): GenerateTemplateOutput {
+  const resources: ResourceDetail[] | undefined = generatedTemplateSummary.Resources;
   const migrateJson: MigrateJsonFormat = {
     templateBody: templateBody,
     source: source,
@@ -556,11 +603,9 @@ export function buildGenertedTemplateOutput(generatedTemplateSummary: CloudForma
  * @returns A CloudFormation sdk client
  */
 export async function buildCfnClient(sdkProvider: SdkProvider, environment: Environment) {
-  const cloudFormationClient = (await sdkProvider.forEnvironment(environment, Mode.ForReading)).sdk.cloudFormation();
-
-  cloudFormationClient.config.customUserAgent = 'cdk-migrate';
-
-  return cloudFormationClient;
+  const sdk = (await sdkProvider.forEnvironment(environment, Mode.ForReading)).sdk;
+  sdk.appendCustomUserAgent('cdk-migrate');
+  return sdk.cloudFormation();
 }
 
 /**
@@ -569,15 +614,19 @@ export async function buildCfnClient(sdkProvider: SdkProvider, environment: Envi
  * @param filepath The path to the readme file
  * @param resources A list of resources to append warnings for
  */
-export function appendWarningsToReadme(filepath: string, resources: CloudFormation.ResourceDetails) {
+export function appendWarningsToReadme(filepath: string, resources: ResourceDetail[]) {
   const readme = fs.readFileSync(filepath, 'utf8');
   const lines = readme.split('\n');
   const index = lines.findIndex((line) => line.trim() === 'Enjoy!');
   let linesToAdd = ['\n## Warnings'];
   linesToAdd.push('### Write-only properties');
-  linesToAdd.push("Write-only properties are resource property values that can be written to but can't be read by AWS CloudFormation or CDK Migrate. For more information, see [IaC generator and write-only properties](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/generate-IaC-write-only-properties.html).");
+  linesToAdd.push(
+    "Write-only properties are resource property values that can be written to but can't be read by AWS CloudFormation or CDK Migrate. For more information, see [IaC generator and write-only properties](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/generate-IaC-write-only-properties.html).",
+  );
   linesToAdd.push('\n');
-  linesToAdd.push('Write-only properties discovered during migration are organized here by resource ID and categorized by write-only property type. Resolve write-only properties by providing property values in your CDK app. For guidance, see [Resolve write-only properties](https://docs.aws.amazon.com/cdk/v2/guide/migrate.html#migrate-resources-writeonly).');
+  linesToAdd.push(
+    'Write-only properties discovered during migration are organized here by resource ID and categorized by write-only property type. Resolve write-only properties by providing property values in your CDK app. For guidance, see [Resolve write-only properties](https://docs.aws.amazon.com/cdk/v2/guide/migrate.html#migrate-resources-writeonly).',
+  );
   for (const resource of resources) {
     if (resource.Warnings && resource.Warnings.length > 0) {
       linesToAdd.push(`### ${resource.LogicalResourceId}`);
@@ -599,8 +648,8 @@ export function appendWarningsToReadme(filepath: string, resources: CloudFormati
  * @param resources A list of resources to deduplicate
  * @returns A list of unique resources
  */
-function deduplicateResources(resources: CloudFormation.ResourceDetails) {
-  let uniqueResources: {[key: string]: CloudFormation.ResourceDetail} = {};
+function deduplicateResources(resources: ResourceDetail[]) {
+  let uniqueResources: { [key: string]: ResourceDetail } = {};
 
   for (const resource of resources) {
     const key = Object.keys(resource.ResourceIdentifier!)[0];
@@ -612,23 +661,27 @@ function deduplicateResources(resources: CloudFormation.ResourceDetails) {
   }
 
   return Object.values(uniqueResources);
-};
+}
 
 /**
  * Class for making CloudFormation template generator calls
  */
 export class CfnTemplateGeneratorProvider {
-  private cfn: CloudFormation;
-  constructor(cfn: CloudFormation) {
+  private cfn: ICloudFormationClient;
+  constructor(cfn: ICloudFormationClient) {
     this.cfn = cfn;
   }
 
-  async checkForResourceScan(resourceScanSummaries: CloudFormation.ResourceScanSummaries | undefined,
-    options: GenerateTemplateOptions, clientRequestToken: string) {
-
+  async checkForResourceScan(
+    resourceScanSummaries: ResourceScanSummary[] | undefined,
+    options: GenerateTemplateOptions,
+    clientRequestToken: string,
+  ) {
     if (!resourceScanSummaries || resourceScanSummaries.length === 0) {
       if (options.fromScan === FromScan.MOST_RECENT) {
-        throw new Error('No scans found. Please either start a new scan with the `--from-scan` new or do not specify a `--from-scan` option.');
+        throw new Error(
+          'No scans found. Please either start a new scan with the `--from-scan` new or do not specify a `--from-scan` option.',
+        );
       } else {
         print('No scans found. Initiating a new resource scan.');
         await this.startResourceScan(clientRequestToken);
@@ -643,8 +696,10 @@ export class CfnTemplateGeneratorProvider {
    * @param scanId scan id for the to list resources for
    * @param resources A list of resources to find related resources for
    */
-  async getResourceScanRelatedResources(scanId: string, resources: CloudFormation.ScannedResources )
-    : Promise<CloudFormation.ScannedResourceIdentifiers> {
+  async getResourceScanRelatedResources(
+    scanId: string,
+    resources: ScannedResource[],
+  ): Promise<ScannedResourceIdentifier[]> {
     let relatedResourceList = resources;
 
     // break the list of resources into chunks of 100 to avoid hitting the 100 resource limit
@@ -653,7 +708,7 @@ export class CfnTemplateGeneratorProvider {
       const res = await this.cfn.listResourceScanRelatedResources({
         ResourceScanId: scanId,
         Resources: chunk,
-      }).promise();
+      });
 
       // add the first page to the list
       relatedResourceList.push(...(res.RelatedResources ?? []));
@@ -665,7 +720,7 @@ export class CfnTemplateGeneratorProvider {
           ResourceScanId: scanId,
           Resources: resourceIdentifiers(resources),
           NextToken: nextToken,
-        }).promise();
+        });
         nextToken = nextRelatedResources.NextToken;
         relatedResourceList.push(...(nextRelatedResources.RelatedResources ?? []));
       }
@@ -674,7 +729,9 @@ export class CfnTemplateGeneratorProvider {
     relatedResourceList = deduplicateResources(relatedResourceList);
 
     // prune the managedbystack flag off of them again.
-    return process.env.MIGRATE_INTEG_TEST ? resourceIdentifiers(relatedResourceList) : resourceIdentifiers(excludeManaged(relatedResourceList)) ;
+    return process.env.MIGRATE_INTEG_TEST
+      ? resourceIdentifiers(relatedResourceList)
+      : resourceIdentifiers(excludeManaged(relatedResourceList));
   }
 
   /**
@@ -684,10 +741,12 @@ export class CfnTemplateGeneratorProvider {
    *
    * @returns A string representing the scan id
    */
-  async startResourceScan(requestToken: string ) {
-    return (await this.cfn.startResourceScan({
-      ClientRequestToken: requestToken,
-    }).promise()).ResourceScanId;
+  async startResourceScan(requestToken: string) {
+    return (
+      await this.cfn.startResourceScan({
+        ClientRequestToken: requestToken,
+      })
+    ).ResourceScanId;
   }
 
   /**
@@ -696,24 +755,21 @@ export class CfnTemplateGeneratorProvider {
    * @returns a list of resource scan summaries
    */
   async listResourceScans() {
-
-    return this.cfn.listResourceScans().promise();
+    return this.cfn.listResourceScans();
   }
 
   /**
    * Retrieves a tokenized list of resources from a resource scan. If a token is present, this function
-   * will loop through all pages and combine them into a single list of ScannedResources.
+   * will loop through all pages and combine them into a single list of ScannedResource[].
    * Additionally will apply any filters provided by the customer.
    *
    * @param scanId scan id for the to list resources for
    * @param filters a string of filters in the format of key1=value1,key2=value2
    * @returns a combined list of all resources from the scan
    */
-  async listResourceScanResources(scanId: string, filters: string[] = [] )
-    : Promise<CloudFormation.ScannedResourceIdentifiers> {
-
-    let resourceList: CloudFormation.ScannedResources = [];
-    let resourceScanInputs: CloudFormation.ListResourceScanResourcesInput;
+  async listResourceScanResources(scanId: string, filters: string[] = []): Promise<ScannedResourceIdentifier[]> {
+    let resourceList: ScannedResource[] = [];
+    let resourceScanInputs: ListResourceScanResourcesCommandInput;
 
     if (filters.length > 0) {
       print('Applying filters to resource scan.');
@@ -726,14 +782,14 @@ export class CfnTemplateGeneratorProvider {
           TagKey: filterList[FilterType.TAG_KEY],
           TagValue: filterList[FilterType.TAG_VALUE],
         };
-        const resources = await this.cfn.listResourceScanResources(resourceScanInputs).promise();
+        const resources = await this.cfn.listResourceScanResources(resourceScanInputs);
         resourceList = resourceList.concat(resources.Resources ?? []);
         let nextToken = resources.NextToken;
 
         // cycle through the pages adding all resources to the list until we run out of pages
         while (nextToken) {
           resourceScanInputs.NextToken = nextToken;
-          const nextResources = await this.cfn.listResourceScanResources(resourceScanInputs).promise();
+          const nextResources = await this.cfn.listResourceScanResources(resourceScanInputs);
           nextToken = nextResources.NextToken;
           resourceList = resourceList!.concat(nextResources.Resources ?? []);
         }
@@ -743,14 +799,14 @@ export class CfnTemplateGeneratorProvider {
       resourceScanInputs = {
         ResourceScanId: scanId,
       };
-      const resources = await this.cfn.listResourceScanResources(resourceScanInputs).promise();
+      const resources = await this.cfn.listResourceScanResources(resourceScanInputs);
       resourceList = resourceList!.concat(resources.Resources ?? []);
       let nextToken = resources.NextToken;
 
       // cycle through the pages adding all resources to the list until we run out of pages
       while (nextToken) {
         resourceScanInputs.NextToken = nextToken;
-        const nextResources = await this.cfn.listResourceScanResources(resourceScanInputs).promise();
+        const nextResources = await this.cfn.listResourceScanResources(resourceScanInputs);
         nextToken = nextResources.NextToken;
         resourceList = resourceList!.concat(nextResources.Resources ?? []);
       }
@@ -760,7 +816,9 @@ export class CfnTemplateGeneratorProvider {
     }
     resourceList = deduplicateResources(resourceList);
 
-    return process.env.MIGRATE_INTEG_TEST ? resourceIdentifiers(resourceList) : resourceIdentifiers(excludeManaged(resourceList));
+    return process.env.MIGRATE_INTEG_TEST
+      ? resourceIdentifiers(resourceList)
+      : resourceIdentifiers(excludeManaged(resourceList));
   }
 
   /**
@@ -769,12 +827,10 @@ export class CfnTemplateGeneratorProvider {
    * @param scanId scan id for the to list resources for
    * @returns information about the scan
    */
-  async describeResourceScan(scanId: string ):
-  Promise<CloudFormation.DescribeResourceScanOutput> {
-
+  async describeResourceScan(scanId: string): Promise<DescribeResourceScanCommandOutput> {
     return this.cfn.describeResourceScan({
       ResourceScanId: scanId,
-    }).promise();
+    });
   }
 
   /**
@@ -783,12 +839,10 @@ export class CfnTemplateGeneratorProvider {
    * @param templateId A string representing the template id
    * @returns DescribeGeneratedTemplateOutput an object containing the template status and results
    */
-  async describeGeneratedTemplate(templateId: string ):
-  Promise<CloudFormation.DescribeGeneratedTemplateOutput> {
-
+  async describeGeneratedTemplate(templateId: string): Promise<DescribeGeneratedTemplateCommandOutput> {
     const generatedTemplate = await this.cfn.describeGeneratedTemplate({
       GeneratedTemplateName: templateId,
-    }).promise();
+    });
 
     if (generatedTemplate.Status == ScanStatus.FAILED) {
       throw new Error(generatedTemplate.StatusReason);
@@ -798,33 +852,30 @@ export class CfnTemplateGeneratorProvider {
   }
 
   /**
- * Retrieves a completed generated cloudformation template from the template generator.
- *
- * @param templateId A string representing the template id
- * @param cloudFormation The CloudFormation sdk client to use
- * @returns DescribeGeneratedTemplateOutput an object containing the template status and body
- */
-  async getGeneratedTemplate(templateId: string ):
-  Promise<CloudFormation.GetGeneratedTemplateOutput> {
-
+   * Retrieves a completed generated cloudformation template from the template generator.
+   *
+   * @param templateId A string representing the template id
+   * @param cloudFormation The CloudFormation sdk client to use
+   * @returns DescribeGeneratedTemplateOutput an object containing the template status and body
+   */
+  async getGeneratedTemplate(templateId: string): Promise<GetGeneratedTemplateCommandOutput> {
     return this.cfn.getGeneratedTemplate({
       GeneratedTemplateName: templateId,
-    }).promise();
+    });
   }
 
   /**
- * Kicks off a template generation for a set of resources.
- *
- * @param stackName The name of the stack
- * @param resources A list of resources to generate the template from
- * @returns CreateGeneratedTemplateOutput an object containing the template arn to query on later
- */
-  async createGeneratedTemplate(stackName: string, resources: CloudFormation.ResourceDefinitions ) {
-
+   * Kicks off a template generation for a set of resources.
+   *
+   * @param stackName The name of the stack
+   * @param resources A list of resources to generate the template from
+   * @returns CreateGeneratedTemplateOutput an object containing the template arn to query on later
+   */
+  async createGeneratedTemplate(stackName: string, resources: ResourceDefinition[]) {
     const createTemplateOutput = await this.cfn.createGeneratedTemplate({
       Resources: resources,
       GeneratedTemplateName: stackName,
-    }).promise();
+    });
 
     if (createTemplateOutput.GeneratedTemplateId === undefined) {
       throw new Error('CreateGeneratedTemplate failed to return an Arn.');
@@ -841,7 +892,7 @@ export class CfnTemplateGeneratorProvider {
   async deleteGeneratedTemplate(templateArn: string): Promise<void> {
     await this.cfn.deleteGeneratedTemplate({
       GeneratedTemplateName: templateArn,
-    }).promise();
+    });
   }
 }
 
@@ -890,7 +941,7 @@ export interface GenerateTemplateOptions {
  */
 export interface GenerateTemplateOutput {
   migrateJson: MigrateJsonFormat;
-  resources?: CloudFormation.ResourceDetails;
+  resources?: ResourceDetail[];
   templateId?: string;
 }
 
@@ -918,5 +969,5 @@ export interface GeneratedResourceImportIdentifier {
   // cdk deploy expects the migrate.json resource identifiers to be PascalCase, not camelCase.
   ResourceType: string;
   LogicalResourceId: string;
-  ResourceIdentifier: CloudFormation.ResourceIdentifierProperties;
+  ResourceIdentifier: ResourceIdentifierSummary;
 }
diff --git a/packages/aws-cdk/lib/context-providers/ami.ts b/packages/aws-cdk/lib/context-providers/ami.ts
index 9c511cb6569a6..0d9d31753cf53 100644
--- a/packages/aws-cdk/lib/context-providers/ami.ts
+++ b/packages/aws-cdk/lib/context-providers/ami.ts
@@ -1,5 +1,5 @@
-import * as cxschema from '@aws-cdk/cloud-assembly-schema';
-import { SdkProvider, initContextProviderSdk } from '../api/aws-auth/sdk-provider';
+import type { AmiContextQuery } from '@aws-cdk/cloud-assembly-schema';
+import { type SdkProvider, initContextProviderSdk } from '../api/aws-auth/sdk-provider';
 import { ContextProviderPlugin } from '../api/plugin';
 import { debug, print } from '../logging';
 
@@ -7,10 +7,9 @@ import { debug, print } from '../logging';
  * Plugin to search AMIs for the current account
  */
 export class AmiContextProviderPlugin implements ContextProviderPlugin {
-  constructor(private readonly aws: SdkProvider) {
-  }
+  constructor(private readonly aws: SdkProvider) {}
 
-  public async getValue(args: cxschema.AmiContextQuery) {
+  public async getValue(args: AmiContextQuery) {
     const region = args.region;
     const account = args.account;
 
@@ -26,9 +25,9 @@ export class AmiContextProviderPlugin implements ContextProviderPlugin {
         Name: key,
         Values: values,
       })),
-    }).promise();
+    });
 
-    const images = [...response.Images || []].filter(i => i.ImageId !== undefined);
+    const images = [...(response.Images || [])].filter((i) => i.ImageId !== undefined);
 
     if (images.length === 0) {
       throw new Error('No AMI found that matched the search criteria');
@@ -37,7 +36,7 @@ export class AmiContextProviderPlugin implements ContextProviderPlugin {
     // Return the most recent one
     // Note: Date.parse() is not going to respect the timezone of the string,
     // but since we only care about the relative values that is okay.
-    images.sort(descending(i => Date.parse(i.CreationDate || '1970')));
+    images.sort(descending((i) => Date.parse(i.CreationDate || '1970')));
 
     debug(`Selected image '${images[0].ImageId}' created at '${images[0].CreationDate}'`);
     return images[0].ImageId!;
diff --git a/packages/aws-cdk/lib/context-providers/availability-zones.ts b/packages/aws-cdk/lib/context-providers/availability-zones.ts
index f1910c37709f2..935dbad2cfcef 100644
--- a/packages/aws-cdk/lib/context-providers/availability-zones.ts
+++ b/packages/aws-cdk/lib/context-providers/availability-zones.ts
@@ -1,5 +1,6 @@
-import * as cxschema from '@aws-cdk/cloud-assembly-schema';
-import { SdkProvider, initContextProviderSdk } from '../api/aws-auth/sdk-provider';
+import type { AvailabilityZonesContextQuery } from '@aws-cdk/cloud-assembly-schema';
+import type { AvailabilityZone } from '@aws-sdk/client-ec2';
+import { type SdkProvider, initContextProviderSdk } from '../api/aws-auth/sdk-provider';
 import { ContextProviderPlugin } from '../api/plugin';
 import { debug } from '../logging';
 
@@ -7,17 +8,20 @@ import { debug } from '../logging';
  * Plugin to retrieve the Availability Zones for the current account
  */
 export class AZContextProviderPlugin implements ContextProviderPlugin {
-  constructor(private readonly aws: SdkProvider) {
-  }
+  constructor(private readonly aws: SdkProvider) {}
 
-  public async getValue(args: cxschema.AvailabilityZonesContextQuery) {
+  public async getValue(args: AvailabilityZonesContextQuery) {
     const region = args.region;
     const account = args.account;
     debug(`Reading AZs for ${account}:${region}`);
     const ec2 = (await initContextProviderSdk(this.aws, args)).ec2();
-    const response = await ec2.describeAvailabilityZones().promise();
-    if (!response.AvailabilityZones) { return []; }
-    const azs = response.AvailabilityZones.filter(zone => zone.State === 'available').map(zone => zone.ZoneName);
+    const response = await ec2.describeAvailabilityZones({});
+    if (!response.AvailabilityZones) {
+      return [];
+    }
+    const azs = response.AvailabilityZones.filter((zone: AvailabilityZone) => zone.State === 'available').map(
+      (zone: AvailabilityZone) => zone.ZoneName,
+    );
     return azs;
   }
 }
diff --git a/packages/aws-cdk/lib/context-providers/endpoint-service-availability-zones.ts b/packages/aws-cdk/lib/context-providers/endpoint-service-availability-zones.ts
index 79f96d3cb94f4..9fbc441930ad9 100644
--- a/packages/aws-cdk/lib/context-providers/endpoint-service-availability-zones.ts
+++ b/packages/aws-cdk/lib/context-providers/endpoint-service-availability-zones.ts
@@ -1,5 +1,5 @@
-import * as cxschema from '@aws-cdk/cloud-assembly-schema';
-import { SdkProvider, initContextProviderSdk } from '../api/aws-auth/sdk-provider';
+import type { EndpointServiceAvailabilityZonesContextQuery } from '@aws-cdk/cloud-assembly-schema';
+import { type SdkProvider, initContextProviderSdk } from '../api/aws-auth/sdk-provider';
 import { ContextProviderPlugin } from '../api/plugin';
 import { debug } from '../logging';
 
@@ -7,16 +7,17 @@ import { debug } from '../logging';
  * Plugin to retrieve the Availability Zones for an endpoint service
  */
 export class EndpointServiceAZContextProviderPlugin implements ContextProviderPlugin {
-  constructor(private readonly aws: SdkProvider) {
-  }
+  constructor(private readonly aws: SdkProvider) {}
 
-  public async getValue(args: cxschema.EndpointServiceAvailabilityZonesContextQuery) {
+  public async getValue(args: EndpointServiceAvailabilityZonesContextQuery) {
     const region = args.region;
     const account = args.account;
     const serviceName = args.serviceName;
     debug(`Reading AZs for ${account}:${region}:${serviceName}`);
     const ec2 = (await initContextProviderSdk(this.aws, args)).ec2();
-    const response = await ec2.describeVpcEndpointServices({ ServiceNames: [serviceName] }).promise();
+    const response = await ec2.describeVpcEndpointServices({
+      ServiceNames: [serviceName],
+    });
 
     // expect a service in the response
     if (!response.ServiceDetails || response.ServiceDetails.length === 0) {
diff --git a/packages/aws-cdk/lib/context-providers/hosted-zones.ts b/packages/aws-cdk/lib/context-providers/hosted-zones.ts
index fe5a4be52c4a0..9c0fc806251ef 100644
--- a/packages/aws-cdk/lib/context-providers/hosted-zones.ts
+++ b/packages/aws-cdk/lib/context-providers/hosted-zones.ts
@@ -1,14 +1,14 @@
-import * as cxschema from '@aws-cdk/cloud-assembly-schema';
-import { SdkProvider, initContextProviderSdk } from '../api/aws-auth/sdk-provider';
+import { HostedZoneContextQuery } from '@aws-cdk/cloud-assembly-schema';
+import type { HostedZone } from '@aws-sdk/client-route-53';
+import type { IRoute53Client } from '../api';
+import { type SdkProvider, initContextProviderSdk } from '../api/aws-auth/sdk-provider';
 import { ContextProviderPlugin } from '../api/plugin';
 import { debug } from '../logging';
 
 export class HostedZoneContextProviderPlugin implements ContextProviderPlugin {
+  constructor(private readonly aws: SdkProvider) {}
 
-  constructor(private readonly aws: SdkProvider) {
-  }
-
-  public async getValue(args: cxschema.HostedZoneContextQuery): Promise<object> {
+  public async getValue(args: HostedZoneContextQuery): Promise<object> {
     const account = args.account;
     const region = args.region;
     if (!this.isHostedZoneQuery(args)) {
@@ -17,7 +17,7 @@ export class HostedZoneContextProviderPlugin implements ContextProviderPlugin {
     const domainName = args.domainName;
     debug(`Reading hosted zone ${account}:${region}:${domainName}`);
     const r53 = (await initContextProviderSdk(this.aws, args)).route53();
-    const response = await r53.listHostedZonesByName({ DNSName: domainName }).promise();
+    const response = await r53.listHostedZonesByName({ DNSName: domainName });
     if (!response.HostedZones) {
       throw new Error(`Hosted Zone not found in account ${account}, region ${region}: ${domainName}`);
     }
@@ -34,28 +34,29 @@ export class HostedZoneContextProviderPlugin implements ContextProviderPlugin {
   }
 
   private async filterZones(
-    r53: AWS.Route53, zones: AWS.Route53.HostedZone[],
-    props: cxschema.HostedZoneContextQuery): Promise<AWS.Route53.HostedZone[]> {
-
-    let candidates: AWS.Route53.HostedZone[] = [];
+    r53: IRoute53Client,
+    zones: HostedZone[],
+    props: HostedZoneContextQuery,
+  ): Promise<HostedZone[]> {
+    let candidates: HostedZone[] = [];
     const domainName = props.domainName.endsWith('.') ? props.domainName : `${props.domainName}.`;
     debug(`Found the following zones ${JSON.stringify(zones)}`);
-    candidates = zones.filter( zone => zone.Name === domainName);
+    candidates = zones.filter((zone) => zone.Name === domainName);
     debug(`Found the following matched name zones ${JSON.stringify(candidates)}`);
     if (props.privateZone) {
-      candidates = candidates.filter(zone => zone.Config && zone.Config.PrivateZone);
+      candidates = candidates.filter((zone) => zone.Config && zone.Config.PrivateZone);
     } else {
-      candidates = candidates.filter(zone => !zone.Config || !zone.Config.PrivateZone);
+      candidates = candidates.filter((zone) => !zone.Config || !zone.Config.PrivateZone);
     }
     if (props.vpcId) {
-      const vpcZones: AWS.Route53.HostedZone[] = [];
+      const vpcZones: HostedZone[] = [];
       for (const zone of candidates) {
-        const data = await r53.getHostedZone({ Id: zone. Id }).promise();
+        const data = await r53.getHostedZone({ Id: zone.Id });
         if (!data.VPCs) {
           debug(`Expected VPC for private zone but no VPC found ${zone.Id}`);
           continue;
         }
-        if (data.VPCs.map(vpc => vpc.VPCId).includes(props.vpcId)) {
+        if (data.VPCs.map((vpc) => vpc.VPCId).includes(props.vpcId)) {
           vpcZones.push(zone);
         }
       }
@@ -64,7 +65,7 @@ export class HostedZoneContextProviderPlugin implements ContextProviderPlugin {
     return candidates;
   }
 
-  private isHostedZoneQuery(props: cxschema.HostedZoneContextQuery | any): props is cxschema.HostedZoneContextQuery {
-    return (props as cxschema.HostedZoneContextQuery).domainName !== undefined;
+  private isHostedZoneQuery(props: HostedZoneContextQuery | any): props is HostedZoneContextQuery {
+    return (props as HostedZoneContextQuery).domainName !== undefined;
   }
 }
diff --git a/packages/aws-cdk/lib/context-providers/keys.ts b/packages/aws-cdk/lib/context-providers/keys.ts
index 52c5dd08f140d..50a6c61d42625 100644
--- a/packages/aws-cdk/lib/context-providers/keys.ts
+++ b/packages/aws-cdk/lib/context-providers/keys.ts
@@ -1,17 +1,15 @@
-import * as cxschema from '@aws-cdk/cloud-assembly-schema';
-import * as cxapi from '@aws-cdk/cx-api';
-import * as AWS from 'aws-sdk';
-import { PromiseResult } from 'aws-sdk/lib/request';
-import { SdkProvider, initContextProviderSdk } from '../api/aws-auth/sdk-provider';
+import type { KeyContextQuery } from '@aws-cdk/cloud-assembly-schema';
+import type { KeyContextResponse } from '@aws-cdk/cx-api';
+import type { AliasListEntry, ListAliasesCommandOutput } from '@aws-sdk/client-kms';
+import type { IKMSClient } from '../api';
+import { type SdkProvider, initContextProviderSdk } from '../api/aws-auth/sdk-provider';
 import { ContextProviderPlugin } from '../api/plugin';
 import { debug } from '../logging';
 
 export class KeyContextProviderPlugin implements ContextProviderPlugin {
+  constructor(private readonly aws: SdkProvider) {}
 
-  constructor(private readonly aws: SdkProvider) {
-  }
-
-  public async getValue(args: cxschema.KeyContextQuery) {
+  public async getValue(args: KeyContextQuery) {
     const kms = (await initContextProviderSdk(this.aws, args)).kms();
 
     const aliasListEntry = await this.findKey(kms, args);
@@ -19,16 +17,16 @@ export class KeyContextProviderPlugin implements ContextProviderPlugin {
     return this.readKeyProps(aliasListEntry, args);
   }
 
-  private async findKey(kms: AWS.KMS, args: cxschema.KeyContextQuery): Promise<AWS.KMS.AliasListEntry> {
-
+  // TODO: use paginator function
+  private async findKey(kms: IKMSClient, args: KeyContextQuery): Promise<AliasListEntry> {
     debug(`Listing keys in ${args.account}:${args.region}`);
 
-    let response: PromiseResult<AWS.KMS.ListAliasesResponse, AWS.AWSError>;
+    let response: ListAliasesCommandOutput;
     let nextMarker: string | undefined;
     do {
       response = await kms.listAliases({
         Marker: nextMarker,
-      }).promise();
+      });
 
       const aliases = response.Aliases || [];
       for (const alias of aliases) {
@@ -38,12 +36,12 @@ export class KeyContextProviderPlugin implements ContextProviderPlugin {
       }
 
       nextMarker = response.NextMarker;
-    } while (response.Truncated);
+    } while (nextMarker);
 
     throw new Error(`Could not find any key with alias named ${args.aliasName}`);
   }
 
-  private async readKeyProps(alias: AWS.KMS.AliasListEntry, args: cxschema.KeyContextQuery): Promise<cxapi.KeyContextResponse> {
+  private async readKeyProps(alias: AliasListEntry, args: KeyContextQuery): Promise<KeyContextResponse> {
     if (!alias.TargetKeyId) {
       throw new Error(`Could not find any key with alias named ${args.aliasName}`);
     }
@@ -54,5 +52,4 @@ export class KeyContextProviderPlugin implements ContextProviderPlugin {
       keyId: alias.TargetKeyId,
     };
   }
-
 }
diff --git a/packages/aws-cdk/lib/context-providers/load-balancers.ts b/packages/aws-cdk/lib/context-providers/load-balancers.ts
index 0d5095f277e51..5441a118fa210 100644
--- a/packages/aws-cdk/lib/context-providers/load-balancers.ts
+++ b/packages/aws-cdk/lib/context-providers/load-balancers.ts
@@ -1,38 +1,29 @@
-import * as cxschema from '@aws-cdk/cloud-assembly-schema';
-import * as cxapi from '@aws-cdk/cx-api';
-import * as AWS from 'aws-sdk';
-import { SdkProvider, initContextProviderSdk } from '../api/aws-auth/sdk-provider';
+import { LoadBalancerContextQuery, LoadBalancerListenerContextQuery } from '@aws-cdk/cloud-assembly-schema';
+import {
+  LoadBalancerContextResponse,
+  LoadBalancerIpAddressType,
+  LoadBalancerListenerContextResponse,
+} from '@aws-cdk/cx-api';
+import { type Listener, LoadBalancer, type TagDescription } from '@aws-sdk/client-elastic-load-balancing-v2';
+import type { IElasticLoadBalancingV2Client } from '../api';
+import { type SdkProvider, initContextProviderSdk } from '../api/aws-auth/sdk-provider';
 import { ContextProviderPlugin } from '../api/plugin';
 
 /**
  * Provides load balancer context information.
  */
 export class LoadBalancerContextProviderPlugin implements ContextProviderPlugin {
-  constructor(private readonly aws: SdkProvider) {
-  }
-
-  async getValue(query: cxschema.LoadBalancerContextQuery): Promise<cxapi.LoadBalancerContextResponse> {
-    const elbv2 = (await initContextProviderSdk(this.aws, query)).elbv2();
+  constructor(private readonly aws: SdkProvider) {}
 
+  async getValue(query: LoadBalancerContextQuery): Promise<LoadBalancerContextResponse> {
     if (!query.loadBalancerArn && !query.loadBalancerTags) {
       throw new Error('The load balancer lookup query must specify either `loadBalancerArn` or `loadBalancerTags`');
     }
 
-    const loadBalancers = await findLoadBalancers(elbv2, query);
-
-    if (loadBalancers.length === 0) {
-      throw new Error(`No load balancers found matching ${JSON.stringify(query)}`);
-    }
-
-    if (loadBalancers.length > 1) {
-      throw new Error(`Multiple load balancers found matching ${JSON.stringify(query)} - please provide more specific criteria`);
-    }
-
-    const loadBalancer = loadBalancers[0];
+    const loadBalancer = await (await LoadBalancerProvider.getClient(this.aws, query)).getLoadBalancer();
 
-    const ipAddressType = loadBalancer.IpAddressType === 'ipv4'
-      ? cxapi.LoadBalancerIpAddressType.IPV4
-      : cxapi.LoadBalancerIpAddressType.DUAL_STACK;
+    const ipAddressType =
+      loadBalancer.IpAddressType === 'ipv4' ? LoadBalancerIpAddressType.IPV4 : LoadBalancerIpAddressType.DUAL_STACK;
 
     return {
       loadBalancerArn: loadBalancer.LoadBalancerArn!,
@@ -45,258 +36,168 @@ export class LoadBalancerContextProviderPlugin implements ContextProviderPlugin
   }
 }
 
-// Decreases line length
-type LoadBalancerListenerQuery = cxschema.LoadBalancerListenerContextQuery;
-type LoadBalancerListenerResponse = cxapi.LoadBalancerListenerContextResponse;
-
 /**
  * Provides load balancer listener context information
  */
 export class LoadBalancerListenerContextProviderPlugin implements ContextProviderPlugin {
-  constructor(private readonly aws: SdkProvider) {
-  }
-
-  async getValue(query: LoadBalancerListenerQuery): Promise<LoadBalancerListenerResponse> {
-    const elbv2 = (await initContextProviderSdk(this.aws, query)).elbv2();
+  constructor(private readonly aws: SdkProvider) {}
 
+  async getValue(query: LoadBalancerListenerContextQuery): Promise<LoadBalancerListenerContextResponse> {
     if (!query.listenerArn && !query.loadBalancerArn && !query.loadBalancerTags) {
-      throw new Error('The load balancer listener query must specify at least one of: `listenerArn`, `loadBalancerArn` or `loadBalancerTags`');
+      throw new Error(
+        'The load balancer listener query must specify at least one of: `listenerArn`, `loadBalancerArn` or `loadBalancerTags`',
+      );
     }
 
-    return query.listenerArn ? this.getListenerByArn(elbv2, query) : this.getListenerByFilteringLoadBalancers(elbv2, query);
+    return (await LoadBalancerProvider.getClient(this.aws, query)).getListener();
   }
+}
 
-  /**
-   * Look up a listener by querying listeners for query's listener arn and then
-   * resolve its load balancer for the security group information.
-   */
-  private async getListenerByArn(elbv2: AWS.ELBv2, query: LoadBalancerListenerQuery) {
-    const listenerArn = query.listenerArn!;
-    const listenerResults = await elbv2.describeListeners({ ListenerArns: [listenerArn] }).promise();
-    const listeners = (listenerResults.Listeners ?? []);
-
-    if (listeners.length === 0) {
-      throw new Error(`No load balancer listeners found matching arn ${listenerArn}`);
+class LoadBalancerProvider {
+  public static async getClient(
+    aws: SdkProvider,
+    query: LoadBalancerListenerContextQuery,
+  ): Promise<LoadBalancerProvider> {
+    const client = (await initContextProviderSdk(aws, query)).elbv2();
+
+    try {
+      const listener = query.listenerArn
+        ? // Assert we're sure there's at least one so it throws if not
+        (await client.describeListeners({ ListenerArns: [query.listenerArn] })).Listeners![0]!
+        : undefined;
+      return new LoadBalancerProvider(
+        client,
+        { ...query, loadBalancerArn: listener?.LoadBalancerArn || query.loadBalancerArn },
+        listener,
+      );
+    } catch (err) {
+      throw new Error(`No load balancer listeners found matching arn ${query.listenerArn}`);
     }
+  }
 
-    const listener = listeners[0];
+  constructor(
+    private readonly client: IElasticLoadBalancingV2Client,
+    private readonly filter: LoadBalancerListenerContextQuery,
+    private readonly listener?: Listener,
+  ) {}
 
-    const loadBalancers = await findLoadBalancers(elbv2, {
-      ...query,
-      loadBalancerArn: listener.LoadBalancerArn!,
-    });
+  public async getLoadBalancer(): Promise<LoadBalancer> {
+    const loadBalancers = await this.getLoadBalancers();
 
     if (loadBalancers.length === 0) {
-      throw new Error(`No associated load balancer found for listener arn ${listenerArn}`);
+      throw new Error(`No load balancers found matching ${JSON.stringify(this.filter)}`);
     }
 
-    const loadBalancer = loadBalancers[0];
+    if (loadBalancers.length > 1) {
+      throw new Error(
+        `Multiple load balancers found matching ${JSON.stringify(this.filter)} - please provide more specific criteria`,
+      );
+    }
 
-    return {
-      listenerArn: listener.ListenerArn!,
-      listenerPort: listener.Port!,
-      securityGroupIds: loadBalancer.SecurityGroups ?? [],
-    };
+    return loadBalancers[0];
   }
 
-  /**
-   * Look up a listener by starting from load balancers, filtering out
-   * unmatching load balancers, and then by querying the listeners of each load
-   * balancer and filtering out unmatching listeners.
-   */
-  private async getListenerByFilteringLoadBalancers(elbv2: AWS.ELBv2, args: LoadBalancerListenerQuery) {
-    // Find matching load balancers
-    const loadBalancers = await findLoadBalancers(elbv2, args);
+  public async getListener(): Promise<LoadBalancerListenerContextResponse> {
+    if (this.listener) {
+      try {
+        const loadBalancer = await this.getLoadBalancer();
+        return {
+          listenerArn: this.listener.ListenerArn!,
+          listenerPort: this.listener.Port!,
+          securityGroupIds: loadBalancer.SecurityGroups || [],
+        };
+      } catch (err) {
+        throw new Error(`No associated load balancer found for listener arn ${this.filter.listenerArn}`);
+      }
+    }
 
+    const loadBalancers = await this.getLoadBalancers();
     if (loadBalancers.length === 0) {
-      throw new Error(`No associated load balancers found for load balancer listener query ${JSON.stringify(args)}`);
+      throw new Error(
+        `No associated load balancers found for load balancer listener query ${JSON.stringify(this.filter)}`,
+      );
     }
 
-    return this.findMatchingListener(elbv2, loadBalancers, args);
-  }
-
-  /**
-   * Finds the matching listener from the list of load balancers. This will
-   * error unless there is exactly one match so that the user is prompted to
-   * provide more specific criteria rather than us providing a nondeterministic
-   * result.
-   */
-  private async findMatchingListener(elbv2: AWS.ELBv2, loadBalancers: AWS.ELBv2.LoadBalancers, query: LoadBalancerListenerQuery) {
-    const loadBalancersByArn = indexLoadBalancersByArn(loadBalancers);
-    const loadBalancerArns = Object.keys(loadBalancersByArn);
-
-    const matches = Array<cxapi.LoadBalancerListenerContextResponse>();
-
-    for await (const listener of describeListenersByLoadBalancerArn(elbv2, loadBalancerArns)) {
-      const loadBalancer = loadBalancersByArn[listener.LoadBalancerArn!];
-      if (listenerMatchesQueryFilter(listener, query) && loadBalancer) {
-        matches.push({
-          listenerArn: listener.ListenerArn!,
-          listenerPort: listener.Port!,
-          securityGroupIds: loadBalancer.SecurityGroups ?? [],
-        });
-      }
-    }
+    const listeners = (await this.getListenersForLoadBalancers(loadBalancers)).filter((listener) => {
+      return (
+        (!this.filter.listenerPort || listener.Port === this.filter.listenerPort) &&
+        (!this.filter.listenerProtocol || listener.Protocol === this.filter.listenerProtocol)
+      );
+    });
 
-    if (matches.length === 0) {
-      throw new Error(`No load balancer listeners found matching ${JSON.stringify(query)}`);
+    if (listeners.length === 0) {
+      throw new Error(`No load balancer listeners found matching ${JSON.stringify(this.filter)}`);
     }
 
-    if (matches.length > 1) {
-      throw new Error(`Multiple load balancer listeners found matching ${JSON.stringify(query)} - please provide more specific criteria`);
+    if (listeners.length > 1) {
+      throw new Error(
+        `Multiple load balancer listeners found matching ${JSON.stringify(this.filter)} - please provide more specific criteria`,
+      );
     }
 
-    return matches[0];
+    return {
+      listenerArn: listeners[0].ListenerArn!,
+      listenerPort: listeners[0].Port!,
+      securityGroupIds:
+        loadBalancers.find((lb) => listeners[0].LoadBalancerArn === lb.LoadBalancerArn)?.SecurityGroups || [],
+    };
   }
-}
 
-/**
- * Find load balancers by the given filter args.
- */
-async function findLoadBalancers(elbv2: AWS.ELBv2, args: cxschema.LoadBalancerFilter) {
-  // List load balancers
-  let loadBalancers = await describeLoadBalancers(elbv2, {
-    LoadBalancerArns: args.loadBalancerArn ? [args.loadBalancerArn] : undefined,
-  });
+  private async getLoadBalancers() {
+    const loadBalancerArns = this.filter.loadBalancerArn ? [this.filter.loadBalancerArn] : undefined;
+    const loadBalancers = (
+      await this.client.paginateDescribeLoadBalancers({
+        LoadBalancerArns: loadBalancerArns,
+      })
+    ).filter((lb) => lb.Type === this.filter.loadBalancerType);
 
-  // Filter by load balancer type
-  loadBalancers = loadBalancers.filter(lb => lb.Type === args.loadBalancerType);
-
-  // Filter by load balancer tags
-  if (args.loadBalancerTags) {
-    loadBalancers = await filterLoadBalancersByTags(elbv2, loadBalancers, args.loadBalancerTags);
+    return this.filterByTags(loadBalancers);
   }
 
-  return loadBalancers;
-}
-
-/**
- * Helper to paginate over describeLoadBalancers
- * @internal
- */
-export async function describeLoadBalancers(elbv2: AWS.ELBv2, request: AWS.ELBv2.DescribeLoadBalancersInput) {
-  const loadBalancers = Array<AWS.ELBv2.LoadBalancer>();
-  let page: AWS.ELBv2.DescribeLoadBalancersOutput | undefined;
-  do {
-    page = await elbv2.describeLoadBalancers({
-      ...request,
-      Marker: page?.NextMarker,
-    }).promise();
-
-    loadBalancers.push(...Array.from(page.LoadBalancers ?? []));
-  } while (page.NextMarker);
-
-  return loadBalancers;
-}
-
-/**
- * Describes the tags of each load balancer and returns the load balancers that
- * match the given tags.
- */
-async function filterLoadBalancersByTags(elbv2: AWS.ELBv2, loadBalancers: AWS.ELBv2.LoadBalancers, loadBalancerTags: cxschema.Tag[]) {
-  const loadBalancersByArn = indexLoadBalancersByArn(loadBalancers);
-  const loadBalancerArns = Object.keys(loadBalancersByArn);
-  const matchingLoadBalancers = Array<AWS.ELBv2.LoadBalancer>();
-
-  // Consume the items of async generator.
-  for await (const tags of describeTags(elbv2, loadBalancerArns)) {
-    if (tagsMatch(tags, loadBalancerTags) && loadBalancersByArn[tags.ResourceArn!]) {
-      matchingLoadBalancers.push(loadBalancersByArn[tags.ResourceArn!]);
+  private async filterByTags(loadBalancers: LoadBalancer[]): Promise<LoadBalancer[]> {
+    if (!this.filter.loadBalancerTags) {
+      return loadBalancers;
     }
+    return (await this.describeTags(loadBalancers.map((lb) => lb.LoadBalancerArn!)))
+      .filter((tagDescription) => {
+        return (
+          tagDescription.Tags?.length === this.filter.loadBalancerTags?.length &&
+          tagDescription.Tags?.filter(
+            (tag) =>
+              !this.filter.loadBalancerTags!.some((filter) => {
+                return filter.key === tag.Key && filter.value === tag.Value;
+              }),
+          ).length === 0
+        );
+      })
+      .flatMap((tag) => loadBalancers.filter((loadBalancer) => tag.ResourceArn === loadBalancer.LoadBalancerArn));
   }
 
-  return matchingLoadBalancers;
-}
-
-/**
- * Generator function that yields `TagDescriptions`. The API doesn't support
- * pagination, so this generator breaks the resource list into chunks and issues
- * the appropriate requests, yielding each tag description as it receives it.
- * @internal
- */
-export async function* describeTags(elbv2: AWS.ELBv2, resourceArns: string[]) {
-  // Max of 20 resource arns per request.
-  const chunkSize = 20;
-  for (let i = 0; i < resourceArns.length; i += chunkSize) {
-    const chunk = resourceArns.slice(i, Math.min(i + chunkSize, resourceArns.length));
-    const chunkTags = await elbv2.describeTags({
-      ResourceArns: chunk,
-    }).promise();
-
-    for (const tag of chunkTags.TagDescriptions ?? []) {
-      yield tag;
+  /**
+   * Returns tag descriptions associated with the resources. The API doesn't support
+   * pagination, so this function breaks the resource list into chunks and issues
+   * the appropriate requests.
+   */
+  private async describeTags(resourceArns: string[]): Promise<TagDescription[]> {
+    // Max of 20 resource arns per request.
+    const chunkSize = 20;
+    const tags = Array<TagDescription>();
+    for (let i = 0; i < resourceArns.length; i += chunkSize) {
+      const chunk = resourceArns.slice(i, Math.min(i + chunkSize, resourceArns.length));
+      const chunkTags = await this.client.describeTags({
+        ResourceArns: chunk,
+      });
+
+      tags.push(...(chunkTags.TagDescriptions || []));
     }
+    return tags;
   }
-}
 
-/**
- * Determines if the given TagDescription matches the required tags.
- * @internal
- */
-export function tagsMatch(tagDescription: AWS.ELBv2.TagDescription, requiredTags: cxschema.Tag[]) {
-  const tagsByName: Record<string, string | undefined> = {};
-  for (const tag of tagDescription.Tags ?? []) {
-    tagsByName[tag.Key!] = tag.Value;
-  }
-
-  for (const tag of requiredTags) {
-    if (tagsByName[tag.key] !== tag.value) {
-      return false;
+  private async getListenersForLoadBalancers(loadBalancers: LoadBalancer[]): Promise<Listener[]> {
+    const listeners: Listener[] = [];
+    for (const loadBalancer of loadBalancers.map((lb) => lb.LoadBalancerArn)) {
+      listeners.push(...(await this.client.paginateDescribeListeners({ LoadBalancerArn: loadBalancer })));
     }
+    return listeners;
   }
-
-  return true;
-}
-
-/**
- * Async generator that produces listener descriptions by traversing the
- * pagination. Because describeListeners only lets you search by one load
- * balancer arn at a time, we request them individually and yield the listeners
- * as they come in.
- * @internal
- */
-export async function* describeListenersByLoadBalancerArn(elbv2: AWS.ELBv2, loadBalancerArns: string[]) {
-  for (const loadBalancerArn of loadBalancerArns) {
-    let page: AWS.ELBv2.DescribeListenersOutput | undefined;
-    do {
-      page = await elbv2.describeListeners({
-        LoadBalancerArn: loadBalancerArn,
-        Marker: page?.NextMarker,
-      }).promise();
-
-      for (const listener of page.Listeners ?? []) {
-        yield listener;
-      }
-    } while (page.NextMarker);
-  }
-}
-
-/**
- * Determines if a listener matches the query filters.
- */
-function listenerMatchesQueryFilter(listener: AWS.ELBv2.Listener, args: cxschema.LoadBalancerListenerContextQuery): boolean {
-  if (args.listenerPort && listener.Port !== args.listenerPort) {
-    // No match.
-    return false;
-  }
-
-  if (args.listenerProtocol && listener.Protocol !== args.listenerProtocol) {
-    // No match.
-    return false;
-  }
-
-  return true;
-}
-
-/**
- * Returns a record of load balancers indexed by their arns
- */
-function indexLoadBalancersByArn(loadBalancers: AWS.ELBv2.LoadBalancer[]): Record<string, AWS.ELBv2.LoadBalancer> {
-  const loadBalancersByArn: Record<string, AWS.ELBv2.LoadBalancer> = {};
-
-  for (const loadBalancer of loadBalancers) {
-    loadBalancersByArn[loadBalancer.LoadBalancerArn!] = loadBalancer;
-  }
-
-  return loadBalancersByArn;
 }
diff --git a/packages/aws-cdk/lib/context-providers/security-groups.ts b/packages/aws-cdk/lib/context-providers/security-groups.ts
index a801841ca9ecf..f5583d5f867a4 100644
--- a/packages/aws-cdk/lib/context-providers/security-groups.ts
+++ b/packages/aws-cdk/lib/context-providers/security-groups.ts
@@ -1,26 +1,26 @@
-import * as cxschema from '@aws-cdk/cloud-assembly-schema';
-import * as cxapi from '@aws-cdk/cx-api';
-import * as AWS from 'aws-sdk';
-import { SdkProvider, initContextProviderSdk } from '../api/aws-auth/sdk-provider';
-import { ContextProviderPlugin } from '../api/plugin';
+import type { SecurityGroupContextQuery } from '@aws-cdk/cloud-assembly-schema';
+import type { SecurityGroupContextResponse } from '@aws-cdk/cx-api';
+import type { Filter, SecurityGroup } from '@aws-sdk/client-ec2';
+import { type SdkProvider, initContextProviderSdk } from '../api/aws-auth/sdk-provider';
+import type { ContextProviderPlugin } from '../api/plugin';
 
 export class SecurityGroupContextProviderPlugin implements ContextProviderPlugin {
-  constructor(private readonly aws: SdkProvider) {
-  }
-
-  async getValue(args: cxschema.SecurityGroupContextQuery): Promise<cxapi.SecurityGroupContextResponse> {
+  constructor(private readonly aws: SdkProvider) {}
 
+  async getValue(args: SecurityGroupContextQuery): Promise<SecurityGroupContextResponse> {
     if (args.securityGroupId && args.securityGroupName) {
-      throw new Error('\'securityGroupId\' and \'securityGroupName\' can not be specified both when looking up a security group');
+      throw new Error(
+        "'securityGroupId' and 'securityGroupName' can not be specified both when looking up a security group",
+      );
     }
 
-    if (!args.securityGroupId && !args.securityGroupName) {
-      throw new Error('\'securityGroupId\' or \'securityGroupName\' must be specified to look up a security group');
+    if (!args.securityGroupId && !args.securityGroupName) {
+      throw new Error("'securityGroupId' or 'securityGroupName' must be specified to look up a security group");
     }
 
     const ec2 = (await initContextProviderSdk(this.aws, args)).ec2();
 
-    const filters: AWS.EC2.FilterList = [];
+    const filters: Filter[] = [];
     if (args.vpcId) {
       filters.push({
         Name: 'vpc-id',
@@ -37,7 +37,7 @@ export class SecurityGroupContextProviderPlugin implements ContextProviderPlugin
     const response = await ec2.describeSecurityGroups({
       GroupIds: args.securityGroupId ? [args.securityGroupId] : undefined,
       Filters: filters.length > 0 ? filters : undefined,
-    }).promise();
+    });
 
     const securityGroups = response.SecurityGroups ?? [];
     if (securityGroups.length === 0) {
@@ -60,18 +60,18 @@ export class SecurityGroupContextProviderPlugin implements ContextProviderPlugin
 /**
  * @internal
  */
-export function hasAllTrafficEgress(securityGroup: AWS.EC2.SecurityGroup) {
+export function hasAllTrafficEgress(securityGroup: SecurityGroup) {
   let hasAllTrafficCidrV4 = false;
   let hasAllTrafficCidrV6 = false;
 
   for (const ipPermission of securityGroup.IpPermissionsEgress ?? []) {
     const isAllProtocols = ipPermission.IpProtocol === '-1';
 
-    if (isAllProtocols && ipPermission.IpRanges?.some(m => m.CidrIp === '0.0.0.0/0')) {
+    if (isAllProtocols && ipPermission.IpRanges?.some((m) => m.CidrIp === '0.0.0.0/0')) {
       hasAllTrafficCidrV4 = true;
     }
 
-    if (isAllProtocols && ipPermission.Ipv6Ranges?.some(m => m.CidrIpv6 === '::/0')) {
+    if (isAllProtocols && ipPermission.Ipv6Ranges?.some((m) => m.CidrIpv6 === '::/0')) {
       hasAllTrafficCidrV6 = true;
     }
   }
diff --git a/packages/aws-cdk/lib/context-providers/ssm-parameters.ts b/packages/aws-cdk/lib/context-providers/ssm-parameters.ts
index f85fc4c96f117..d2d182d2d50c5 100644
--- a/packages/aws-cdk/lib/context-providers/ssm-parameters.ts
+++ b/packages/aws-cdk/lib/context-providers/ssm-parameters.ts
@@ -1,6 +1,6 @@
-import * as cxschema from '@aws-cdk/cloud-assembly-schema';
-import * as AWS from 'aws-sdk';
-import { SdkProvider, initContextProviderSdk } from '../api/aws-auth/sdk-provider';
+import type { SSMParameterContextQuery } from '@aws-cdk/cloud-assembly-schema';
+import type { GetParameterCommandOutput } from '@aws-sdk/client-ssm';
+import { type SdkProvider, initContextProviderSdk } from '../api/aws-auth/sdk-provider';
 import { ContextProviderPlugin } from '../api/plugin';
 import { debug } from '../logging';
 
@@ -8,10 +8,9 @@ import { debug } from '../logging';
  * Plugin to read arbitrary SSM parameter names
  */
 export class SSMContextProviderPlugin implements ContextProviderPlugin {
-  constructor(private readonly aws: SdkProvider) {
-  }
+  constructor(private readonly aws: SdkProvider) {}
 
-  public async getValue(args: cxschema.SSMParameterContextQuery) {
+  public async getValue(args: SSMParameterContextQuery) {
     const region = args.region;
     const account = args.account;
 
@@ -23,7 +22,7 @@ export class SSMContextProviderPlugin implements ContextProviderPlugin {
 
     const response = await this.getSsmParameterValue(args);
     const parameterNotFound: boolean = !response.Parameter || response.Parameter.Value === undefined;
-    const suppressError = 'ignoreErrorOnMissingContext' in args && args.ignoreErrorOnMissingContext as boolean;
+    const suppressError = 'ignoreErrorOnMissingContext' in args && (args.ignoreErrorOnMissingContext as boolean);
     if (parameterNotFound && suppressError && 'dummyValue' in args) {
       return args.dummyValue;
     }
@@ -45,14 +44,13 @@ export class SSMContextProviderPlugin implements ContextProviderPlugin {
    *
    * @throws Error if a service error (other than ``ParameterNotFound``) occurs.
    */
-  private async getSsmParameterValue(args: cxschema.SSMParameterContextQuery)
-    : Promise<AWS.SSM.GetParameterResult> {
+  private async getSsmParameterValue(args: SSMParameterContextQuery): Promise<GetParameterCommandOutput> {
     const ssm = (await initContextProviderSdk(this.aws, args)).ssm();
     try {
-      return await ssm.getParameter({ Name: args.parameterName }).promise();
+      return await ssm.getParameter({ Name: args.parameterName });
     } catch (e: any) {
-      if (e.code === 'ParameterNotFound') {
-        return {};
+      if (e.name === 'ParameterNotFound') {
+        return { $metadata: {} };
       }
       throw e;
     }
diff --git a/packages/aws-cdk/lib/context-providers/vpcs.ts b/packages/aws-cdk/lib/context-providers/vpcs.ts
index d578df659b4ec..0ad6a277ad574 100644
--- a/packages/aws-cdk/lib/context-providers/vpcs.ts
+++ b/packages/aws-cdk/lib/context-providers/vpcs.ts
@@ -1,16 +1,14 @@
-import * as cxschema from '@aws-cdk/cloud-assembly-schema';
-import * as cxapi from '@aws-cdk/cx-api';
-import * as AWS from 'aws-sdk';
-import { SdkProvider, initContextProviderSdk } from '../api/aws-auth/sdk-provider';
+import type { VpcContextQuery } from '@aws-cdk/cloud-assembly-schema';
+import { type VpcContextResponse, type VpcSubnetGroup, VpcSubnetGroupType } from '@aws-cdk/cx-api';
+import type { Filter, RouteTable, Tag, Vpc } from '@aws-sdk/client-ec2';
+import type { IEC2Client } from '../api';
+import { type SdkProvider, initContextProviderSdk } from '../api/aws-auth/sdk-provider';
 import { ContextProviderPlugin } from '../api/plugin';
 import { debug } from '../logging';
-
 export class VpcNetworkContextProviderPlugin implements ContextProviderPlugin {
+  constructor(private readonly aws: SdkProvider) {}
 
-  constructor(private readonly aws: SdkProvider) {
-  }
-
-  public async getValue(args: cxschema.VpcContextQuery) {
+  public async getValue(args: VpcContextQuery) {
     const ec2 = (await initContextProviderSdk(this.aws, args)).ec2();
 
     const vpcId = await this.findVpc(ec2, args);
@@ -18,12 +16,12 @@ export class VpcNetworkContextProviderPlugin implements ContextProviderPlugin {
     return this.readVpcProps(ec2, vpcId, args);
   }
 
-  private async findVpc(ec2: AWS.EC2, args: cxschema.VpcContextQuery): Promise<AWS.EC2.Vpc> {
+  private async findVpc(ec2: IEC2Client, args: VpcContextQuery): Promise<Vpc> {
     // Build request filter (map { Name -> Value } to list of [{ Name, Values }])
-    const filters: AWS.EC2.Filter[] = Object.entries(args.filter).map(([tag, value]) => ({ Name: tag, Values: [value] }));
+    const filters: Filter[] = Object.entries(args.filter).map(([tag, value]) => ({ Name: tag, Values: [value] }));
 
     debug(`Listing VPCs in ${args.account}:${args.region}`);
-    const response = await ec2.describeVpcs({ Filters: filters }).promise();
+    const response = await ec2.describeVpcs({ Filters: filters });
 
     const vpcs = response.Vpcs || [];
     if (vpcs.length === 0) {
@@ -36,17 +34,17 @@ export class VpcNetworkContextProviderPlugin implements ContextProviderPlugin {
     return vpcs[0];
   }
 
-  private async readVpcProps(ec2: AWS.EC2, vpc: AWS.EC2.Vpc, args: cxschema.VpcContextQuery): Promise<cxapi.VpcContextResponse> {
+  private async readVpcProps(ec2: IEC2Client, vpc: Vpc, args: VpcContextQuery): Promise<VpcContextResponse> {
     const vpcId = vpc.VpcId!;
 
     debug(`Describing VPC ${vpcId}`);
 
     const filters = { Filters: [{ Name: 'vpc-id', Values: [vpcId] }] };
 
-    const subnetsResponse = await ec2.describeSubnets(filters).promise();
+    const subnetsResponse = await ec2.describeSubnets(filters);
     const listedSubnets = subnetsResponse.Subnets || [];
 
-    const routeTablesResponse = await ec2.describeRouteTables(filters).promise();
+    const routeTablesResponse = await ec2.describeRouteTables(filters);
     const routeTables = new RouteTables(routeTablesResponse.RouteTables || []);
 
     // Now comes our job to separate these subnets out into AZs and subnet groups (Public, Private, Isolated)
@@ -61,31 +59,47 @@ export class VpcNetworkContextProviderPlugin implements ContextProviderPlugin {
     // - Name tag, we tag subnets with their subnet group name. In absence of this tag,
     //   we use the type as the name.
 
-    const azs = Array.from(new Set<string>(listedSubnets.map(s => s.AvailabilityZone!)));
+    const azs = Array.from(new Set<string>(listedSubnets.map((s) => s.AvailabilityZone!)));
     azs.sort();
 
-    const subnets: Subnet[] = listedSubnets.map(subnet => {
+    const subnets: Subnet[] = listedSubnets.map((subnet) => {
       let type = getTag('aws-cdk:subnet-type', subnet.Tags);
-      if (type === undefined && subnet.MapPublicIpOnLaunch) { type = SubnetType.Public; }
-      if (type === undefined && routeTables.hasRouteToIgw(subnet.SubnetId)) { type = SubnetType.Public; }
-      if (type === undefined && routeTables.hasRouteToNatGateway(subnet.SubnetId)) { type = SubnetType.Private; }
-      if (type === undefined && routeTables.hasRouteToTransitGateway(subnet.SubnetId)) { type = SubnetType.Private; }
-      if (type === undefined) { type = SubnetType.Isolated; }
+      if (type === undefined && subnet.MapPublicIpOnLaunch) {
+        type = SubnetType.Public;
+      }
+      if (type === undefined && routeTables.hasRouteToIgw(subnet.SubnetId)) {
+        type = SubnetType.Public;
+      }
+      if (type === undefined && routeTables.hasRouteToNatGateway(subnet.SubnetId)) {
+        type = SubnetType.Private;
+      }
+      if (type === undefined && routeTables.hasRouteToTransitGateway(subnet.SubnetId)) {
+        type = SubnetType.Private;
+      }
+      if (type === undefined) {
+        type = SubnetType.Isolated;
+      }
 
       if (!isValidSubnetType(type)) {
         // eslint-disable-next-line max-len
-        throw new Error(`Subnet ${subnet.SubnetArn} has invalid subnet type ${type} (must be ${SubnetType.Public}, ${SubnetType.Private} or ${SubnetType.Isolated})`);
+        throw new Error(
+          `Subnet ${subnet.SubnetArn} has invalid subnet type ${type} (must be ${SubnetType.Public}, ${SubnetType.Private} or ${SubnetType.Isolated})`,
+        );
       }
 
       if (args.subnetGroupNameTag && !getTag(args.subnetGroupNameTag, subnet.Tags)) {
-        throw new Error(`Invalid subnetGroupNameTag: Subnet ${subnet.SubnetArn} does not have an associated tag with Key='${args.subnetGroupNameTag}'`);
+        throw new Error(
+          `Invalid subnetGroupNameTag: Subnet ${subnet.SubnetArn} does not have an associated tag with Key='${args.subnetGroupNameTag}'`,
+        );
       }
 
       const name = getTag(args.subnetGroupNameTag || 'aws-cdk:subnet-name', subnet.Tags) || type;
       const routeTableId = routeTables.routeTableIdForSubnetId(subnet.SubnetId);
 
       if (!routeTableId) {
-        throw new Error(`Subnet ${subnet.SubnetArn} does not have an associated route table (and there is no "main" table)`);
+        throw new Error(
+          `Subnet ${subnet.SubnetArn} does not have an associated route table (and there is no "main" table)`,
+        );
       }
 
       return {
@@ -99,7 +113,7 @@ export class VpcNetworkContextProviderPlugin implements ContextProviderPlugin {
     });
 
     let grouped: SubnetGroups;
-    let assymetricSubnetGroups: cxapi.VpcSubnetGroup[] | undefined;
+    let assymetricSubnetGroups: VpcSubnetGroup[] | undefined;
     if (args.returnAsymmetricSubnets) {
       grouped = { azs: [], groups: [] };
       assymetricSubnetGroups = groupAsymmetricSubnets(subnets);
@@ -109,42 +123,60 @@ export class VpcNetworkContextProviderPlugin implements ContextProviderPlugin {
     }
 
     // Find attached+available VPN gateway for this VPC
-    const vpnGatewayResponse = (args.returnVpnGateways ?? true)
-      ? await ec2.describeVpnGateways({
-        Filters: [
-          {
-            Name: 'attachment.vpc-id',
-            Values: [vpcId],
-          },
-          {
-            Name: 'attachment.state',
-            Values: ['attached'],
-          },
-          {
-            Name: 'state',
-            Values: ['available'],
-          },
-        ],
-      }).promise()
-      : undefined;
-    const vpnGatewayId = vpnGatewayResponse?.VpnGateways?.length === 1
-      ? vpnGatewayResponse.VpnGateways[0].VpnGatewayId
-      : undefined;
+    const vpnGatewayResponse =
+      (args.returnVpnGateways ?? true)
+        ? await ec2.describeVpnGateways({
+          Filters: [
+            {
+              Name: 'attachment.vpc-id',
+              Values: [vpcId],
+            },
+            {
+              Name: 'attachment.state',
+              Values: ['attached'],
+            },
+            {
+              Name: 'state',
+              Values: ['available'],
+            },
+          ],
+        })
+        : undefined;
+    const vpnGatewayId =
+      vpnGatewayResponse?.VpnGateways?.length === 1 ? vpnGatewayResponse.VpnGateways[0].VpnGatewayId : undefined;
 
     return {
       vpcId,
       vpcCidrBlock: vpc.CidrBlock!,
       ownerAccountId: vpc.OwnerId,
       availabilityZones: grouped.azs,
-      isolatedSubnetIds: collapse(flatMap(findGroups(SubnetType.Isolated, grouped), group => group.subnets.map(s => s.subnetId))),
-      isolatedSubnetNames: collapse(flatMap(findGroups(SubnetType.Isolated, grouped), group => group.name ? [group.name] : [])),
-      isolatedSubnetRouteTableIds: collapse(flatMap(findGroups(SubnetType.Isolated, grouped), group => group.subnets.map(s => s.routeTableId))),
-      privateSubnetIds: collapse(flatMap(findGroups(SubnetType.Private, grouped), group => group.subnets.map(s => s.subnetId))),
-      privateSubnetNames: collapse(flatMap(findGroups(SubnetType.Private, grouped), group => group.name ? [group.name] : [])),
-      privateSubnetRouteTableIds: collapse(flatMap(findGroups(SubnetType.Private, grouped), group => group.subnets.map(s => s.routeTableId))),
-      publicSubnetIds: collapse(flatMap(findGroups(SubnetType.Public, grouped), group => group.subnets.map(s => s.subnetId))),
-      publicSubnetNames: collapse(flatMap(findGroups(SubnetType.Public, grouped), group => group.name ? [group.name] : [])),
-      publicSubnetRouteTableIds: collapse(flatMap(findGroups(SubnetType.Public, grouped), group => group.subnets.map(s => s.routeTableId))),
+      isolatedSubnetIds: collapse(
+        flatMap(findGroups(SubnetType.Isolated, grouped), (group) => group.subnets.map((s) => s.subnetId)),
+      ),
+      isolatedSubnetNames: collapse(
+        flatMap(findGroups(SubnetType.Isolated, grouped), (group) => (group.name ? [group.name] : [])),
+      ),
+      isolatedSubnetRouteTableIds: collapse(
+        flatMap(findGroups(SubnetType.Isolated, grouped), (group) => group.subnets.map((s) => s.routeTableId)),
+      ),
+      privateSubnetIds: collapse(
+        flatMap(findGroups(SubnetType.Private, grouped), (group) => group.subnets.map((s) => s.subnetId)),
+      ),
+      privateSubnetNames: collapse(
+        flatMap(findGroups(SubnetType.Private, grouped), (group) => (group.name ? [group.name] : [])),
+      ),
+      privateSubnetRouteTableIds: collapse(
+        flatMap(findGroups(SubnetType.Private, grouped), (group) => group.subnets.map((s) => s.routeTableId)),
+      ),
+      publicSubnetIds: collapse(
+        flatMap(findGroups(SubnetType.Public, grouped), (group) => group.subnets.map((s) => s.subnetId)),
+      ),
+      publicSubnetNames: collapse(
+        flatMap(findGroups(SubnetType.Public, grouped), (group) => (group.name ? [group.name] : [])),
+      ),
+      publicSubnetRouteTableIds: collapse(
+        flatMap(findGroups(SubnetType.Public, grouped), (group) => group.subnets.map((s) => s.routeTableId)),
+      ),
       vpnGatewayId,
       subnetGroups: assymetricSubnetGroups,
     };
@@ -152,10 +184,12 @@ export class VpcNetworkContextProviderPlugin implements ContextProviderPlugin {
 }
 
 class RouteTables {
-  public readonly mainRouteTable?: AWS.EC2.RouteTable;
+  public readonly mainRouteTable?: RouteTable;
 
-  constructor(private readonly tables: AWS.EC2.RouteTable[]) {
-    this.mainRouteTable = this.tables.find(table => !!table.Associations && table.Associations.some(assoc => !!assoc.Main));
+  constructor(private readonly tables: RouteTable[]) {
+    this.mainRouteTable = this.tables.find(
+      (table) => !!table.Associations && table.Associations.some((assoc) => !!assoc.Main),
+    );
   }
 
   public routeTableIdForSubnetId(subnetId: string | undefined): string | undefined {
@@ -169,7 +203,11 @@ class RouteTables {
   public hasRouteToNatGateway(subnetId: string | undefined): boolean {
     const table = this.tableForSubnet(subnetId) || this.mainRouteTable;
 
-    return !!table && !!table.Routes && table.Routes.some(route => !!route.NatGatewayId && route.DestinationCidrBlock === '0.0.0.0/0');
+    return (
+      !!table &&
+      !!table.Routes &&
+      table.Routes.some((route) => !!route.NatGatewayId && route.DestinationCidrBlock === '0.0.0.0/0')
+    );
   }
 
   /**
@@ -178,7 +216,11 @@ class RouteTables {
   public hasRouteToTransitGateway(subnetId: string | undefined): boolean {
     const table = this.tableForSubnet(subnetId) || this.mainRouteTable;
 
-    return !!table && !!table.Routes && table.Routes.some(route => !!route.TransitGatewayId && route.DestinationCidrBlock === '0.0.0.0/0');
+    return (
+      !!table &&
+      !!table.Routes &&
+      table.Routes.some((route) => !!route.TransitGatewayId && route.DestinationCidrBlock === '0.0.0.0/0')
+    );
   }
 
   /**
@@ -187,18 +229,22 @@ class RouteTables {
   public hasRouteToIgw(subnetId: string | undefined): boolean {
     const table = this.tableForSubnet(subnetId) || this.mainRouteTable;
 
-    return !!table && !!table.Routes && table.Routes.some(route => !!route.GatewayId && route.GatewayId.startsWith('igw-'));
+    return (
+      !!table && !!table.Routes && table.Routes.some((route) => !!route.GatewayId && route.GatewayId.startsWith('igw-'))
+    );
   }
 
   public tableForSubnet(subnetId: string | undefined) {
-    return this.tables.find(table => !!table.Associations && table.Associations.some(assoc => assoc.SubnetId === subnetId));
+    return this.tables.find(
+      (table) => !!table.Associations && table.Associations.some((assoc) => assoc.SubnetId === subnetId),
+    );
   }
 }
 
 /**
  * Return the value of a tag from a set of tags
  */
-function getTag(name: string, tags?: AWS.EC2.Tag[]): string | undefined {
+function getTag(name: string, tags?: Tag[]): string | undefined {
   for (const tag of tags || []) {
     if (tag.Key === name) {
       return tag.Value;
@@ -211,14 +257,16 @@ function getTag(name: string, tags?: AWS.EC2.Tag[]): string | undefined {
  * Group subnets of the same type together, and order by AZ
  */
 function groupSubnets(subnets: Subnet[]): SubnetGroups {
-  const grouping: {[key: string]: Subnet[]} = {};
+  const grouping: { [key: string]: Subnet[] } = {};
   for (const subnet of subnets) {
     const key = [subnet.type, subnet.name].toString();
-    if (!(key in grouping)) { grouping[key] = []; }
+    if (!(key in grouping)) {
+      grouping[key] = [];
+    }
     grouping[key].push(subnet);
   }
 
-  const groups = Object.values(grouping).map(sns => {
+  const groups = Object.values(grouping).map((sns) => {
     sns.sort((a: Subnet, b: Subnet) => a.az.localeCompare(b.az));
     return {
       type: sns[0].type,
@@ -227,10 +275,10 @@ function groupSubnets(subnets: Subnet[]): SubnetGroups {
     };
   });
 
-  const azs = groups[0].subnets.map(s => s.az);
+  const azs = groups[0].subnets.map((s) => s.az);
 
   for (const group of groups) {
-    const groupAZs = group.subnets.map(s => s.az);
+    const groupAZs = group.subnets.map((s) => s.az);
     if (!arraysEqual(groupAZs, azs)) {
       throw new Error(`Not all subnets in VPC have the same AZs: ${groupAZs} vs ${azs}`);
     }
@@ -239,7 +287,7 @@ function groupSubnets(subnets: Subnet[]): SubnetGroups {
   return { azs, groups };
 }
 
-function groupAsymmetricSubnets(subnets: Subnet[]): cxapi.VpcSubnetGroup[] {
+function groupAsymmetricSubnets(subnets: Subnet[]): VpcSubnetGroup[] {
   const grouping: { [key: string]: Subnet[] } = {};
   for (const subnet of subnets) {
     const key = [subnet.type, subnet.name].toString();
@@ -249,13 +297,13 @@ function groupAsymmetricSubnets(subnets: Subnet[]): cxapi.VpcSubnetGroup[] {
     grouping[key].push(subnet);
   }
 
-  return Object.values(grouping).map(subnetArray => {
+  return Object.values(grouping).map((subnetArray) => {
     subnetArray.sort((subnet1: Subnet, subnet2: Subnet) => subnet1.az.localeCompare(subnet2.az));
 
     return {
       name: subnetArray[0].name,
       type: subnetTypeToVpcSubnetType(subnetArray[0].type),
-      subnets: subnetArray.map(subnet => ({
+      subnets: subnetArray.map((subnet) => ({
         subnetId: subnet.subnetId,
         cidr: subnet.cidr,
         availabilityZone: subnet.az,
@@ -265,11 +313,14 @@ function groupAsymmetricSubnets(subnets: Subnet[]): cxapi.VpcSubnetGroup[] {
   });
 }
 
-function subnetTypeToVpcSubnetType(type: SubnetType): cxapi.VpcSubnetGroupType {
+function subnetTypeToVpcSubnetType(type: SubnetType): VpcSubnetGroupType {
   switch (type) {
-    case SubnetType.Isolated: return cxapi.VpcSubnetGroupType.ISOLATED;
-    case SubnetType.Private: return cxapi.VpcSubnetGroupType.PRIVATE;
-    case SubnetType.Public: return cxapi.VpcSubnetGroupType.PUBLIC;
+    case SubnetType.Isolated:
+      return VpcSubnetGroupType.ISOLATED;
+    case SubnetType.Private:
+      return VpcSubnetGroupType.PRIVATE;
+    case SubnetType.Public:
+      return VpcSubnetGroupType.PUBLIC;
   }
 }
 
@@ -280,9 +331,7 @@ enum SubnetType {
 }
 
 function isValidSubnetType(val: string): val is SubnetType {
-  return val === SubnetType.Public
-    || val === SubnetType.Private
-    || val === SubnetType.Isolated;
+  return val === SubnetType.Public || val === SubnetType.Private || val === SubnetType.Isolated;
 }
 
 interface Subnet {
@@ -306,7 +355,9 @@ interface SubnetGroups {
 }
 
 function arraysEqual(as: string[], bs: string[]): boolean {
-  if (as.length !== bs.length) { return false; }
+  if (as.length !== bs.length) {
+    return false;
+  }
 
   for (let i = 0; i < as.length; i++) {
     if (as[i] !== bs[i]) {
@@ -318,7 +369,7 @@ function arraysEqual(as: string[], bs: string[]): boolean {
 }
 
 function findGroups(type: SubnetType, groups: SubnetGroups): SubnetGroup[] {
-  return groups.groups.filter(g => g.type === type);
+  return groups.groups.filter((g) => g.type === type);
 }
 
 function flatMap<T, U>(xs: T[], fn: (x: T) => U[]): U[] {
@@ -330,7 +381,8 @@ function flatMap<T, U>(xs: T[], fn: (x: T) => U[]): U[] {
 }
 
 function collapse<T>(xs: T[]): T[] | undefined {
-  if (xs.length > 0) { return xs; }
+  if (xs.length > 0) {
+    return xs;
+  }
   return undefined;
-
 }
diff --git a/packages/aws-cdk/lib/init.ts b/packages/aws-cdk/lib/init.ts
index 9d2fb0b2c920d..a6ab13638accf 100644
--- a/packages/aws-cdk/lib/init.ts
+++ b/packages/aws-cdk/lib/init.ts
@@ -38,21 +38,31 @@ export async function cliInit(options: CliInitOptions) {
 
   const type = options.type || 'default'; // "default" is the default type (and maps to "app")
 
-  const template = (await availableInitTemplates()).find(t => t.hasName(type!));
+  const template = (await availableInitTemplates()).find((t) => t.hasName(type!));
   if (!template) {
     await printAvailableTemplates(options.language);
     throw new Error(`Unknown init template: ${type}`);
   }
   if (!options.language && template.languages.length === 1) {
     const language = template.languages[0];
-    warning(`No --language was provided, but '${type}' supports only '${language}', so defaulting to --language=${language}`);
+    warning(
+      `No --language was provided, but '${type}' supports only '${language}', so defaulting to --language=${language}`,
+    );
   }
   if (!options.language) {
-    print(`Available languages for ${chalk.green(type)}: ${template.languages.map(l => chalk.blue(l)).join(', ')}`);
+    print(`Available languages for ${chalk.green(type)}: ${template.languages.map((l) => chalk.blue(l)).join(', ')}`);
     throw new Error('No language was selected');
   }
 
-  await initializeProject(template, options.language, canUseNetwork, generateOnly, workDir, options.stackName, options.migrate);
+  await initializeProject(
+    template,
+    options.language,
+    canUseNetwork,
+    generateOnly,
+    workDir,
+    options.stackName,
+    options.migrate,
+  );
 }
 
 /**
@@ -70,7 +80,7 @@ const INFO_DOT_JSON = 'info.json';
 export class InitTemplate {
   public static async fromName(templatesDir: string, name: string) {
     const basePath = path.join(templatesDir, name);
-    const languages = (await listDirectory(basePath));
+    const languages = await listDirectory(basePath);
     const info = await fs.readJson(path.join(basePath, INFO_DOT_JSON));
     return new InitTemplate(basePath, name, languages, info);
   }
@@ -82,7 +92,8 @@ export class InitTemplate {
     private readonly basePath: string,
     public readonly name: string,
     public readonly languages: string[],
-    info: any) {
+    info: any,
+  ) {
     this.description = info.description;
     for (const alias of info.aliases || []) {
       this.aliases.add(alias);
@@ -105,8 +116,10 @@ export class InitTemplate {
    */
   public async install(language: string, targetDirectory: string, stackName?: string) {
     if (this.languages.indexOf(language) === -1) {
-      error(`The ${chalk.blue(language)} language is not supported for ${chalk.green(this.name)} `
-          + `(it supports: ${this.languages.map(l => chalk.blue(l)).join(', ')})`);
+      error(
+        `The ${chalk.blue(language)} language is not supported for ${chalk.green(this.name)} ` +
+          `(it supports: ${this.languages.map((l) => chalk.blue(l)).join(', ')})`,
+      );
       throw new Error(`Unsupported language: ${language}`);
     }
 
@@ -119,16 +132,19 @@ export class InitTemplate {
 
     await this.installFiles(sourceDirectory, targetDirectory, language, projectInfo);
     await this.applyFutureFlags(targetDirectory);
-    await invokeBuiltinHooks({ targetDirectory, language, templateName: this.name }, {
-      substitutePlaceholdersIn: async (...fileNames: string[]) => {
-        for (const fileName of fileNames) {
-          const fullPath = path.join(targetDirectory, fileName);
-          const template = await fs.readFile(fullPath, { encoding: 'utf-8' });
-          await fs.writeFile(fullPath, this.expand(template, language, projectInfo));
-        }
+    await invokeBuiltinHooks(
+      { targetDirectory, language, templateName: this.name },
+      {
+        substitutePlaceholdersIn: async (...fileNames: string[]) => {
+          for (const fileName of fileNames) {
+            const fullPath = path.join(targetDirectory, fileName);
+            const template = await fs.readFile(fullPath, { encoding: 'utf-8' });
+            await fs.writeFile(fullPath, this.expand(template, language, projectInfo));
+          }
+        },
+        placeholder: (ph: string) => this.expand(`%${ph}%`, language, projectInfo),
       },
-      placeholder: (ph: string) => this.expand(`%${ph}%`, language, projectInfo),
-    });
+    );
   }
 
   private async installFiles(sourceDirectory: string, targetDirectory: string, language: string, project: ProjectInfo) {
@@ -172,10 +188,17 @@ export class InitTemplate {
         constructsVersion = rangeFromSemver(constructsVersion, 'pep');
         break;
     }
-    return template.replace(/%name%/g, project.name)
+    return template
+      .replace(/%name%/g, project.name)
       .replace(/%stackname%/, project.stackName ?? '%name.PascalCased%Stack')
-      .replace(/%PascalNameSpace%/, project.stackName ? camelCase(project.stackName + 'Stack', { pascalCase: true }) : '%name.PascalCased%')
-      .replace(/%PascalStackProps%/, project.stackName ? (camelCase(project.stackName, { pascalCase: true }) + 'StackProps') : 'StackProps')
+      .replace(
+        /%PascalNameSpace%/,
+        project.stackName ? camelCase(project.stackName + 'Stack', { pascalCase: true }) : '%name.PascalCased%',
+      )
+      .replace(
+        /%PascalStackProps%/,
+        project.stackName ? camelCase(project.stackName, { pascalCase: true }) + 'StackProps' : 'StackProps',
+      )
       .replace(/%name\.camelCased%/g, camelCase(project.name))
       .replace(/%name\.PascalCased%/g, camelCase(project.name, { pascalCase: true }))
       .replace(/%cdk-version%/g, cdkVersion)
@@ -192,7 +215,7 @@ export class InitTemplate {
    */
   private async applyFutureFlags(projectDir: string) {
     const cdkJson = path.join(projectDir, 'cdk.json');
-    if (!await fs.pathExists(cdkJson)) {
+    if (!(await fs.pathExists(cdkJson))) {
       return;
     }
 
@@ -207,7 +230,7 @@ export class InitTemplate {
 
   public async addMigrateContext(projectDir: string) {
     const cdkJson = path.join(projectDir, 'cdk.json');
-    if (!await fs.pathExists(cdkJson)) {
+    if (!(await fs.pathExists(cdkJson))) {
       return;
     }
 
@@ -228,7 +251,7 @@ interface ProjectInfo {
 }
 
 export async function availableInitTemplates(): Promise<InitTemplate[]> {
-  return new Promise(async resolve => {
+  return new Promise(async (resolve) => {
     try {
       const templatesDir = path.join(rootDir(), 'lib', 'init-templates');
       const templateNames = await listDirectory(templatesDir);
@@ -243,7 +266,7 @@ export async function availableInitTemplates(): Promise<InitTemplate[]> {
   });
 }
 export async function availableInitLanguages(): Promise<string[]> {
-  return new Promise(async resolve => {
+  return new Promise(async (resolve) => {
     const templates = await availableInitTemplates();
     const result = new Set<string>();
     for (const template of templates) {
@@ -260,21 +283,27 @@ export async function availableInitLanguages(): Promise<string[]> {
  * @returns the list of file or directory names contained in ``dirPath``, excluding any dot-file, and sorted.
  */
 async function listDirectory(dirPath: string) {
-  return (await fs.readdir(dirPath))
-    .filter(p => !p.startsWith('.'))
-    .filter(p => !(p === 'LICENSE'))
-    // if, for some reason, the temp folder for the hook doesn't get deleted we don't want to display it in this list
-    .filter(p => !(p === INFO_DOT_JSON))
-    .sort();
+  return (
+    (await fs.readdir(dirPath))
+      .filter((p) => !p.startsWith('.'))
+      .filter((p) => !(p === 'LICENSE'))
+      // if, for some reason, the temp folder for the hook doesn't get deleted we don't want to display it in this list
+      .filter((p) => !(p === INFO_DOT_JSON))
+      .sort()
+  );
 }
 
 export async function printAvailableTemplates(language?: string) {
   print('Available templates:');
   for (const template of await availableInitTemplates()) {
-    if (language && template.languages.indexOf(language) === -1) { continue; }
+    if (language && template.languages.indexOf(language) === -1) {
+      continue;
+    }
     print(`* ${chalk.green(template.name)}: ${template.description}`);
-    const languageArg = language ? chalk.bold(language)
-      : template.languages.length > 1 ? `[${template.languages.map(t => chalk.bold(t)).join('|')}]`
+    const languageArg = language
+      ? chalk.bold(language)
+      : template.languages.length > 1
+        ? `[${template.languages.map((t) => chalk.bold(t)).join('|')}]`
         : chalk.bold(template.languages[0]);
     print(`   └─ ${chalk.blue(`cdk init ${chalk.bold(template.name)} --language=${languageArg}`)}`);
   }
@@ -314,13 +343,15 @@ async function initializeProject(
 
 async function assertIsEmptyDirectory(workDir: string) {
   const files = await fs.readdir(workDir);
-  if (files.filter(f => !f.startsWith('.')).length !== 0) {
+  if (files.filter((f) => !f.startsWith('.')).length !== 0) {
     throw new Error('`cdk init` cannot be run in a non-empty directory!');
   }
 }
 
 async function initializeGitRepository(workDir: string) {
-  if (await isInGitRepository(workDir)) { return; }
+  if (await isInGitRepository(workDir)) {
+    return;
+  }
   print('Initializing a new git repository...');
   try {
     await execute('git', ['init'], { cwd: workDir });
@@ -365,20 +396,19 @@ async function postInstallTypescript(canUseNetwork: boolean, cwd: string) {
 }
 
 async function postInstallJava(canUseNetwork: boolean, cwd: string) {
-  const mvnPackageWarning = 'Please run \'mvn package\'!';
+  const mvnPackageWarning = "Please run 'mvn package'!";
   if (!canUseNetwork) {
     warning(mvnPackageWarning);
     return;
   }
 
-  print('Executing \'mvn package\'');
+  print("Executing 'mvn package'");
   try {
     await execute('mvn', ['package'], { cwd });
   } catch {
     warning('Unable to package compiled code as JAR');
     warning(mvnPackageWarning);
   }
-
 }
 
 async function postInstallPython(cwd: string) {
@@ -399,8 +429,12 @@ async function postInstallPython(cwd: string) {
  */
 async function isInGitRepository(dir: string) {
   while (true) {
-    if (await fs.pathExists(path.join(dir, '.git'))) { return true; }
-    if (isRoot(dir)) { return false; }
+    if (await fs.pathExists(path.join(dir, '.git'))) {
+      return true;
+    }
+    if (isRoot(dir)) {
+      return false;
+    }
     dir = path.dirname(dir);
   }
 }
@@ -422,12 +456,16 @@ function isRoot(dir: string) {
  * @returns STDOUT (if successful).
  */
 async function execute(cmd: string, args: string[], { cwd }: { cwd: string }) {
-  const child = childProcess.spawn(cmd, args, { cwd, shell: true, stdio: ['ignore', 'pipe', 'inherit'] });
+  const child = childProcess.spawn(cmd, args, {
+    cwd,
+    shell: true,
+    stdio: ['ignore', 'pipe', 'inherit'],
+  });
   let stdout = '';
-  child.stdout.on('data', chunk => stdout += chunk.toString());
+  child.stdout.on('data', (chunk) => (stdout += chunk.toString()));
   return new Promise<string>((ok, fail) => {
-    child.once('error', err => fail(err));
-    child.once('exit', status => {
+    child.once('error', (err) => fail(err));
+    child.once('exit', (status) => {
       if (status === 0) {
         return ok(stdout);
       } else {
diff --git a/packages/aws-cdk/lib/util/asset-publishing.ts b/packages/aws-cdk/lib/util/asset-publishing.ts
index 1a7c5a0c9fc78..db4cc5c37afc1 100644
--- a/packages/aws-cdk/lib/util/asset-publishing.ts
+++ b/packages/aws-cdk/lib/util/asset-publishing.ts
@@ -1,9 +1,20 @@
-import * as cxapi from '@aws-cdk/cx-api';
-import * as AWS from 'aws-sdk';
-import * as cdk_assets from 'cdk-assets';
-import { Mode } from '../api/aws-auth/credentials';
-import { ISDK } from '../api/aws-auth/sdk';
-import { SdkProvider } from '../api/aws-auth/sdk-provider';
+import { type Environment, UNKNOWN_ACCOUNT, UNKNOWN_REGION } from '@aws-cdk/cx-api';
+import {
+  type Account,
+  type AssetManifest,
+  AssetPublishing,
+  ClientOptions,
+  EventType,
+  type IAws,
+  type IECRClient,
+  type IPublishProgress,
+  type IPublishProgressListener,
+  type IS3Client,
+  type ISecretsManagerClient,
+} from 'cdk-assets';
+import type { SDK } from '../api';
+import type { SdkProvider } from '../api/aws-auth/sdk-provider';
+import { Mode } from '../api/plugin';
 import { debug, error, print } from '../logging';
 
 export interface PublishAssetsOptions {
@@ -31,23 +42,23 @@ export interface PublishAssetsOptions {
  * Use cdk-assets to publish all assets in the given manifest.
  */
 export async function publishAssets(
-  manifest: cdk_assets.AssetManifest,
+  manifest: AssetManifest,
   sdk: SdkProvider,
-  targetEnv: cxapi.Environment,
+  targetEnv: Environment,
   options: PublishAssetsOptions = {},
 ) {
   // This shouldn't really happen (it's a programming error), but we don't have
   // the types here to guide us. Do an runtime validation to be super super sure.
   if (
     targetEnv.account === undefined ||
-    targetEnv.account === cxapi.UNKNOWN_ACCOUNT ||
+    targetEnv.account === UNKNOWN_ACCOUNT ||
     targetEnv.region === undefined ||
-    targetEnv.account === cxapi.UNKNOWN_REGION
+    targetEnv.account === UNKNOWN_REGION
   ) {
     throw new Error(`Asset publishing requires resolved account and region, got ${JSON.stringify(targetEnv)}`);
   }
 
-  const publisher = new cdk_assets.AssetPublishing(manifest, {
+  const publisher = new AssetPublishing(manifest, {
     aws: new PublishingAws(sdk, targetEnv),
     progressListener: new PublishingProgressListener(options.quiet ?? false),
     throwOnError: false,
@@ -80,23 +91,23 @@ export interface BuildAssetsOptions {
  * Use cdk-assets to build all assets in the given manifest.
  */
 export async function buildAssets(
-  manifest: cdk_assets.AssetManifest,
+  manifest: AssetManifest,
   sdk: SdkProvider,
-  targetEnv: cxapi.Environment,
+  targetEnv: Environment,
   options: BuildAssetsOptions = {},
 ) {
   // This shouldn't really happen (it's a programming error), but we don't have
   // the types here to guide us. Do an runtime validation to be super super sure.
   if (
     targetEnv.account === undefined ||
-    targetEnv.account === cxapi.UNKNOWN_ACCOUNT ||
+    targetEnv.account === UNKNOWN_ACCOUNT ||
     targetEnv.region === undefined ||
-    targetEnv.account === cxapi.UNKNOWN_REGION
+    targetEnv.account === UNKNOWN_REGION
   ) {
     throw new Error(`Asset building requires resolved account and region, got ${JSON.stringify(targetEnv)}`);
   }
 
-  const publisher = new cdk_assets.AssetPublishing(manifest, {
+  const publisher = new AssetPublishing(manifest, {
     aws: new PublishingAws(sdk, targetEnv),
     progressListener: new PublishingProgressListener(options.quiet ?? false),
     throwOnError: false,
@@ -110,8 +121,8 @@ export async function buildAssets(
   }
 }
 
-export class PublishingAws implements cdk_assets.IAws {
-  private sdkCache: Map<String, ISDK> = new Map();
+export class PublishingAws implements IAws {
+  private sdkCache: Map<String, SDK> = new Map();
 
   constructor(
     /**
@@ -122,8 +133,8 @@ export class PublishingAws implements cdk_assets.IAws {
     /**
      * Environment where the stack we're deploying is going
      */
-    private readonly targetEnv: cxapi.Environment) {
-  }
+    private readonly targetEnv: Environment,
+  ) {}
 
   public async discoverPartition(): Promise<string> {
     return (await this.aws.baseCredentialsPartition(this.targetEnv, Mode.ForWriting)) ?? 'aws';
@@ -133,34 +144,36 @@ export class PublishingAws implements cdk_assets.IAws {
     return this.targetEnv.region;
   }
 
-  public async discoverCurrentAccount(): Promise<cdk_assets.Account> {
+  public async discoverCurrentAccount(): Promise<Account> {
     const account = await this.aws.defaultAccount();
-    return account ?? {
-      accountId: '<unknown account>',
-      partition: 'aws',
-    };
+    return (
+      account ?? {
+        accountId: '<unknown account>',
+        partition: 'aws',
+      }
+    );
   }
 
-  public async discoverTargetAccount(options: cdk_assets.ClientOptions): Promise<cdk_assets.Account> {
+  public async discoverTargetAccount(options: ClientOptions): Promise<Account> {
     return (await this.sdk(options)).currentAccount();
   }
 
-  public async s3Client(options: cdk_assets.ClientOptions): Promise<AWS.S3> {
+  public async s3Client(options: ClientOptions): Promise<IS3Client> {
     return (await this.sdk(options)).s3();
   }
 
-  public async ecrClient(options: cdk_assets.ClientOptions): Promise<AWS.ECR> {
+  public async ecrClient(options: ClientOptions): Promise<IECRClient> {
     return (await this.sdk(options)).ecr();
   }
 
-  public async secretsManagerClient(options: cdk_assets.ClientOptions): Promise<AWS.SecretsManager> {
+  public async secretsManagerClient(options: ClientOptions): Promise<ISecretsManagerClient> {
     return (await this.sdk(options)).secretsManager();
   }
 
   /**
    * Get an SDK appropriate for the given client options
    */
-  private async sdk(options: cdk_assets.ClientOptions): Promise<ISDK> {
+  private async sdk(options: ClientOptions): Promise<SDK> {
     const env = {
       ...this.targetEnv,
       region: options.region ?? this.targetEnv.region, // Default: same region as the stack
@@ -184,18 +197,25 @@ export class PublishingAws implements cdk_assets.IAws {
       return maybeSdk;
     }
 
-    const sdk = (await this.aws.forEnvironment(env, Mode.ForWriting, {
-      assumeRoleArn: options.assumeRoleArn,
-      assumeRoleExternalId: options.assumeRoleExternalId,
-      assumeRoleAdditionalOptions: options.assumeRoleAdditionalOptions,
-    }, options.quiet)).sdk;
+    const sdk = (
+      await this.aws.forEnvironment(
+        env,
+        Mode.ForWriting,
+        {
+          assumeRoleArn: options.assumeRoleArn,
+          assumeRoleExternalId: options.assumeRoleExternalId,
+          assumeRoleAdditionalOptions: options.assumeRoleAdditionalOptions,
+        },
+        options.quiet,
+      )
+    ).sdk;
     this.sdkCache.set(cacheKey, sdk);
 
     return sdk;
   }
 }
 
-export const EVENT_TO_LOGGER: Record<cdk_assets.EventType, (x: string) => void> = {
+export const EVENT_TO_LOGGER: Record<EventType, (x: string) => void> = {
   build: debug,
   cached: debug,
   check: debug,
@@ -207,12 +227,11 @@ export const EVENT_TO_LOGGER: Record<cdk_assets.EventType, (x: string) => void>
   upload: debug,
 };
 
-class PublishingProgressListener implements cdk_assets.IPublishProgressListener {
-  constructor(private readonly quiet: boolean) {
-  }
+class PublishingProgressListener implements IPublishProgressListener {
+  constructor(private readonly quiet: boolean) {}
 
-  public onPublishEvent(type: cdk_assets.EventType, event: cdk_assets.IPublishProgress): void {
+  public onPublishEvent(type: EventType, event: IPublishProgress): void {
     const handler = this.quiet && type !== 'fail' ? debug : EVENT_TO_LOGGER[type];
     handler(`[${event.percentComplete}%] ${type}: ${event.message}`);
   }
-}
\ No newline at end of file
+}
diff --git a/packages/aws-cdk/test/api/bootstrap.test.ts b/packages/aws-cdk/test/api/bootstrap.test.ts
index 11fdac8cce89e..a91196b17bb0e 100644
--- a/packages/aws-cdk/test/api/bootstrap.test.ts
+++ b/packages/aws-cdk/test/api/bootstrap.test.ts
@@ -1,9 +1,19 @@
-/* eslint-disable import/order */
-import { CreateChangeSetInput } from 'aws-sdk/clients/cloudformation';
+import {
+  CreateChangeSetCommand,
+  CreateStackCommand,
+  DeleteStackCommand,
+  DescribeChangeSetCommand,
+  DescribeStacksCommand,
+  ExecuteChangeSetCommand,
+  GetTemplateCommand,
+  StackStatus,
+  UpdateTerminationProtectionCommand,
+} from '@aws-sdk/client-cloudformation';
 import { parse } from 'yaml';
 import { Bootstrapper } from '../../lib/api/bootstrap';
-import { deserializeStructure } from '../../lib/serialize';
-import { MockSdkProvider, SyncHandlerSubsetOf } from '../util/mock-sdk';
+import { legacyBootstrapTemplate } from '../../lib/api/bootstrap/legacy-template';
+import { deserializeStructure, serializeStructure, toYAML } from '../../lib/serialize';
+import { MockSdkProvider, mockCloudFormationClient, restoreSdkMocksToDefault } from '../util/mock-sdk';
 
 const env = {
   account: '123456789012',
@@ -11,58 +21,48 @@ const env = {
   name: 'mock',
 };
 
+const templateBody = toYAML(deserializeStructure(serializeStructure(legacyBootstrapTemplate({}), true)));
+const changeSetName = 'cdk-deploy-change-set';
+
 let sdk: MockSdkProvider;
-let executed: boolean;
-let protectedTermination: boolean;
-let cfnMocks: jest.Mocked<SyncHandlerSubsetOf<AWS.CloudFormation>>;
 let changeSetTemplate: any | undefined;
 let bootstrapper: Bootstrapper;
 beforeEach(() => {
   sdk = new MockSdkProvider();
-  executed = false;
-  protectedTermination = false;
   bootstrapper = new Bootstrapper({ source: 'legacy' });
-
-  cfnMocks = {
-    describeStackEvents: jest.fn().mockReturnValue({}),
-    describeStacks: jest.fn()
-      // First two calls, no stacks exist (first is for version checking, second is in deploy-stack.ts)
-      .mockImplementationOnce(() => ({ Stacks: [] }))
-      .mockImplementationOnce(() => ({ Stacks: [] }))
-      // Second call, stack has been created
-      .mockImplementationOnce(() => ({
-        Stacks: [
-          {
-            StackStatus: 'CREATE_COMPLETE',
-            StackStatusReason: 'It is magic',
-            EnableTerminationProtection: false,
-          },
-        ],
-      })),
-    createChangeSet: jest.fn((info: CreateChangeSetInput) => {
-      changeSetTemplate = deserializeStructure(info.TemplateBody as string);
-      return {};
-    }),
-    describeChangeSet: jest.fn(() => ({
-      Status: 'CREATE_COMPLETE',
-      Changes: [],
-    })),
-    executeChangeSet: jest.fn(() => {
-      executed = true;
-      return {};
-    }),
-    deleteChangeSet: jest.fn(),
-    getTemplate: jest.fn(() => {
-      executed = true;
-      return {};
-    }),
-    deleteStack: jest.fn(),
-    updateTerminationProtection: jest.fn(() => {
-      protectedTermination = true;
-      return {};
-    }),
-  };
-  sdk.stubCloudFormation(cfnMocks);
+  mockCloudFormationClient.reset();
+  restoreSdkMocksToDefault();
+  // First two calls, no stacks exist (first is for version checking, second is in deploy-stack.ts)
+  mockCloudFormationClient.on(CreateChangeSetCommand).callsFake((input) => {
+    changeSetTemplate = deserializeStructure(input.TemplateBody);
+    return {};
+  });
+  mockCloudFormationClient.on(DescribeChangeSetCommand).callsFake((input) => {
+    return {
+      ChangeSetName: input.ChangeSetName,
+      StackName: input.StackName,
+      Status: StackStatus.CREATE_COMPLETE,
+    };
+  });
+  mockCloudFormationClient
+    .on(DescribeStacksCommand)
+    .resolvesOnce({
+      Stacks: [],
+    })
+    .resolvesOnce({
+      Stacks: [],
+    })
+    .resolvesOnce({
+      Stacks: [
+        {
+          StackStatus: StackStatus.CREATE_COMPLETE,
+          StackStatusReason: 'It is magic',
+          EnableTerminationProtection: false,
+          StackName: 'MagicalStack',
+          CreationTime: new Date(),
+        },
+      ],
+    });
 });
 
 test('do bootstrap', async () => {
@@ -72,11 +72,14 @@ test('do bootstrap', async () => {
   // THEN
   const bucketProperties = changeSetTemplate.Resources.StagingBucket.Properties;
   expect(bucketProperties.BucketName).toBeUndefined();
-  expect(bucketProperties.BucketEncryption.ServerSideEncryptionConfiguration[0].ServerSideEncryptionByDefault.KMSMasterKeyID)
-    .toBeUndefined();
+  expect(
+    bucketProperties.BucketEncryption.ServerSideEncryptionConfiguration[0].ServerSideEncryptionByDefault.KMSMasterKeyID,
+  ).toBeUndefined();
   expect(changeSetTemplate.Conditions.UsePublicAccessBlockConfiguration['Fn::Equals'][0]).toBe('true');
   expect(ret.noOp).toBeFalsy();
-  expect(executed).toBeTruthy();
+  expect(mockCloudFormationClient).toHaveReceivedCommandWith(ExecuteChangeSetCommand, {
+    ChangeSetName: changeSetName,
+  });
 });
 
 test('do bootstrap using custom bucket name', async () => {
@@ -91,11 +94,14 @@ test('do bootstrap using custom bucket name', async () => {
   // THEN
   const bucketProperties = changeSetTemplate.Resources.StagingBucket.Properties;
   expect(bucketProperties.BucketName).toBe('foobar');
-  expect(bucketProperties.BucketEncryption.ServerSideEncryptionConfiguration[0].ServerSideEncryptionByDefault.KMSMasterKeyID)
-    .toBeUndefined();
+  expect(
+    bucketProperties.BucketEncryption.ServerSideEncryptionConfiguration[0].ServerSideEncryptionByDefault.KMSMasterKeyID,
+  ).toBeUndefined();
   expect(changeSetTemplate.Conditions.UsePublicAccessBlockConfiguration['Fn::Equals'][0]).toBe('true');
   expect(ret.noOp).toBeFalsy();
-  expect(executed).toBeTruthy();
+  expect(mockCloudFormationClient).toHaveReceivedCommandWith(ExecuteChangeSetCommand, {
+    ChangeSetName: changeSetName,
+  });
 });
 
 test('do bootstrap using KMS CMK', async () => {
@@ -110,11 +116,14 @@ test('do bootstrap using KMS CMK', async () => {
   // THEN
   const bucketProperties = changeSetTemplate.Resources.StagingBucket.Properties;
   expect(bucketProperties.BucketName).toBeUndefined();
-  expect(bucketProperties.BucketEncryption.ServerSideEncryptionConfiguration[0].ServerSideEncryptionByDefault.KMSMasterKeyID)
-    .toBe('myKmsKey');
+  expect(
+    bucketProperties.BucketEncryption.ServerSideEncryptionConfiguration[0].ServerSideEncryptionByDefault.KMSMasterKeyID,
+  ).toBe('myKmsKey');
   expect(changeSetTemplate.Conditions.UsePublicAccessBlockConfiguration['Fn::Equals'][0]).toBe('true');
   expect(ret.noOp).toBeFalsy();
-  expect(executed).toBeTruthy();
+  expect(mockCloudFormationClient).toHaveReceivedCommandWith(ExecuteChangeSetCommand, {
+    ChangeSetName: changeSetName,
+  });
 });
 
 test('bootstrap disable bucket Public Access Block Configuration', async () => {
@@ -129,11 +138,14 @@ test('bootstrap disable bucket Public Access Block Configuration', async () => {
   // THEN
   const bucketProperties = changeSetTemplate.Resources.StagingBucket.Properties;
   expect(bucketProperties.BucketName).toBeUndefined();
-  expect(bucketProperties.BucketEncryption.ServerSideEncryptionConfiguration[0].ServerSideEncryptionByDefault.KMSMasterKeyID)
-    .toBeUndefined();
+  expect(
+    bucketProperties.BucketEncryption.ServerSideEncryptionConfiguration[0].ServerSideEncryptionByDefault.KMSMasterKeyID,
+  ).toBeUndefined();
   expect(changeSetTemplate.Conditions.UsePublicAccessBlockConfiguration['Fn::Equals'][0]).toBe('false');
   expect(ret.noOp).toBeFalsy();
-  expect(executed).toBeTruthy();
+  expect(mockCloudFormationClient).toHaveReceivedCommandWith(ExecuteChangeSetCommand, {
+    ChangeSetName: changeSetName,
+  });
 });
 
 test('do bootstrap with custom tags for toolkit stack', async () => {
@@ -146,147 +158,183 @@ test('do bootstrap with custom tags for toolkit stack', async () => {
   // THEN
   const bucketProperties = changeSetTemplate.Resources.StagingBucket.Properties;
   expect(bucketProperties.BucketName).toBeUndefined();
-  expect(bucketProperties.BucketEncryption.ServerSideEncryptionConfiguration[0].ServerSideEncryptionByDefault.KMSMasterKeyID)
-    .toBeUndefined();
+  expect(
+    bucketProperties.BucketEncryption.ServerSideEncryptionConfiguration[0].ServerSideEncryptionByDefault.KMSMasterKeyID,
+  ).toBeUndefined();
   expect(changeSetTemplate.Conditions.UsePublicAccessBlockConfiguration['Fn::Equals'][0]).toBe('true');
   expect(ret.noOp).toBeFalsy();
-  expect(executed).toBeTruthy();
+  expect(mockCloudFormationClient).toHaveReceivedCommandWith(ExecuteChangeSetCommand, {
+    ChangeSetName: changeSetName,
+  });
 });
 
 test('passing trusted accounts to the old bootstrapping results in an error', async () => {
-  await expect(bootstrapper.bootstrapEnvironment(env, sdk, {
-    toolkitStackName: 'mockStack',
-    parameters: {
-      trustedAccounts: ['0123456789012'],
-    },
-  }))
-    .rejects
-    .toThrow('--trust can only be passed for the modern bootstrap experience.');
+  await expect(
+    bootstrapper.bootstrapEnvironment(env, sdk, {
+      toolkitStackName: 'mockStack',
+      parameters: {
+        trustedAccounts: ['0123456789012'],
+      },
+    }),
+  ).rejects.toThrow('--trust can only be passed for the modern bootstrap experience.');
 });
 
 test('passing CFN execution policies to the old bootstrapping results in an error', async () => {
-  await expect(bootstrapper.bootstrapEnvironment(env, sdk, {
-    toolkitStackName: 'mockStack',
-    parameters: {
-      cloudFormationExecutionPolicies: ['arn:aws:iam::aws:policy/AdministratorAccess'],
-    },
-  }))
-    .rejects
-    .toThrow('--cloudformation-execution-policies can only be passed for the modern bootstrap experience.');
+  await expect(
+    bootstrapper.bootstrapEnvironment(env, sdk, {
+      toolkitStackName: 'mockStack',
+      parameters: {
+        cloudFormationExecutionPolicies: ['arn:aws:iam::aws:policy/AdministratorAccess'],
+      },
+    }),
+  ).rejects.toThrow('--cloudformation-execution-policies can only be passed for the modern bootstrap experience.');
 });
 
 test('even if the bootstrap stack is in a rollback state, can still retry bootstrapping it', async () => {
-  (cfnMocks.describeStacks! as jest.Mock)
-    .mockReset()
-    // First two calls, the stack exists with a 'rollback complete' status
-    // (first is for version checking, second is in deploy-stack.ts)
-    .mockImplementationOnce(() => ({
+  mockCloudFormationClient
+    .on(DescribeStacksCommand)
+    .resolvesOnce({
       Stacks: [
         {
-          StackStatus: 'UPDATE_ROLLBACK_COMPLETE',
+          StackStatus: StackStatus.UPDATE_ROLLBACK_COMPLETE,
           StackStatusReason: 'It is magic',
           Outputs: [
             { OutputKey: 'BucketName', OutputValue: 'bucket' },
             { OutputKey: 'BucketDomainName', OutputValue: 'aws.com' },
           ],
+          StackName: 'MagicalStack',
+          CreationTime: new Date(),
         },
       ],
-    }))
-    .mockImplementationOnce(() => ({
+    })
+    .resolvesOnce({
       Stacks: [
         {
-          StackStatus: 'UPDATE_ROLLBACK_COMPLETE',
+          StackStatus: StackStatus.UPDATE_ROLLBACK_COMPLETE,
           StackStatusReason: 'It is magic',
           Outputs: [
             { OutputKey: 'BucketName', OutputValue: 'bucket' },
             { OutputKey: 'BucketDomainName', OutputValue: 'aws.com' },
           ],
+          StackName: 'MagicalStack',
+          CreationTime: new Date(),
         },
       ],
-    }))
-    // Third call, stack has been created
-    .mockImplementationOnce(() => ({
+    })
+    .resolvesOnce({
       Stacks: [
         {
-          StackStatus: 'CREATE_COMPLETE',
+          StackStatus: StackStatus.CREATE_COMPLETE,
           StackStatusReason: 'It is magic',
           EnableTerminationProtection: false,
+          StackName: 'MagicalStack',
+          CreationTime: new Date(),
         },
       ],
-    }));
+    });
 
   // WHEN
-  const ret = await bootstrapper.bootstrapEnvironment(env, sdk, { toolkitStackName: 'mockStack' });
+  const ret = await bootstrapper.bootstrapEnvironment(env, sdk, { toolkitStackName: 'MagicalStack' });
 
   // THEN
   const bucketProperties = changeSetTemplate.Resources.StagingBucket.Properties;
   expect(bucketProperties.BucketName).toBeUndefined();
-  expect(bucketProperties.BucketEncryption.ServerSideEncryptionConfiguration[0].ServerSideEncryptionByDefault.KMSMasterKeyID)
-    .toBeUndefined();
+  expect(
+    bucketProperties.BucketEncryption.ServerSideEncryptionConfiguration[0].ServerSideEncryptionByDefault.KMSMasterKeyID,
+  ).toBeUndefined();
   expect(ret.noOp).toBeFalsy();
-  expect(executed).toBeTruthy();
+  expect(mockCloudFormationClient).toHaveReceivedCommandWith(GetTemplateCommand, {
+    StackName: 'MagicalStack',
+  });
+  expect(mockCloudFormationClient).toHaveReceivedCommandWith(ExecuteChangeSetCommand, {
+    ChangeSetName: changeSetName,
+  });
 });
 
 test('even if the bootstrap stack failed to create, can still retry bootstrapping it', async () => {
-  (cfnMocks.describeStacks! as jest.Mock)
-    .mockReset()
-    // First two calls, the stack exists with a 'rollback complete' status
-    // (first is for version checking, second is in deploy-stack.ts)
-    .mockImplementationOnce(() => ({
+  mockCloudFormationClient
+    .on(DescribeStacksCommand)
+    .resolvesOnce({
       Stacks: [
         {
-          StackStatus: 'ROLLBACK_COMPLETE',
+          StackStatus: StackStatus.ROLLBACK_COMPLETE,
           StackStatusReason: 'It is magic',
-          Outputs: [
-            { OutputKey: 'BucketName', OutputValue: 'bucket' },
-          ],
-        } as AWS.CloudFormation.Stack,
+          Outputs: [{ OutputKey: 'BucketName', OutputValue: 'bucket' }],
+          StackName: 'MagicalStack',
+          CreationTime: new Date(),
+        },
       ],
-    }))
-    .mockImplementationOnce(() => ({
+    })
+    .resolvesOnce({
       Stacks: [
         {
-          StackStatus: 'ROLLBACK_COMPLETE',
+          StackStatus: StackStatus.ROLLBACK_COMPLETE,
           StackStatusReason: 'It is magic',
-          Outputs: [
-            { OutputKey: 'BucketName', OutputValue: 'bucket' },
-          ],
+          Outputs: [{ OutputKey: 'BucketName', OutputValue: 'bucket' }],
+          StackName: 'MagicalStack',
+          CreationTime: new Date(),
         },
       ],
-    }))
-    // Third call, we just did a delete and want to see it gone
-    .mockImplementationOnce(() => ({ Stacks: [] }))
-    // Fourth call, stack has been created
-    .mockImplementationOnce(() => ({
+    })
+    .resolvesOnce({
+      Stacks: [],
+    })
+    .resolvesOnce({
       Stacks: [
         {
-          StackStatus: 'CREATE_COMPLETE',
+          StackStatus: StackStatus.CREATE_COMPLETE,
           StackStatusReason: 'It is magic',
           EnableTerminationProtection: false,
+          StackName: 'MagicalStack',
+          CreationTime: new Date(),
         },
       ],
-    }));
+    });
 
   // WHEN
-  const ret = await bootstrapper.bootstrapEnvironment(env, sdk, { toolkitStackName: 'mockStack' });
+  const ret = await bootstrapper.bootstrapEnvironment(env, sdk, { toolkitStackName: 'MagicalStack' });
 
   // THEN
   const bucketProperties = changeSetTemplate.Resources.StagingBucket.Properties;
   expect(bucketProperties.BucketName).toBeUndefined();
-  expect(bucketProperties.BucketEncryption.ServerSideEncryptionConfiguration[0].ServerSideEncryptionByDefault.KMSMasterKeyID)
-    .toBeUndefined();
+  expect(
+    bucketProperties.BucketEncryption.ServerSideEncryptionConfiguration[0].ServerSideEncryptionByDefault.KMSMasterKeyID,
+  ).toBeUndefined();
   expect(ret.noOp).toBeFalsy();
-  expect(executed).toBeTruthy();
-  expect(cfnMocks.deleteStack).toHaveBeenCalled();
+  expect(mockCloudFormationClient).toHaveReceivedCommandWith(ExecuteChangeSetCommand, {
+    ChangeSetName: changeSetName,
+  });
+  expect(mockCloudFormationClient).toHaveReceivedCommandWith(DeleteStackCommand, {
+    StackName: 'MagicalStack',
+  });
 });
 
 test('stack is not termination protected by default', async () => {
   // WHEN
+  // Seems silly, but we process the template multiple times to get the templateBody that goes into the call
   await bootstrapper.bootstrapEnvironment(env, sdk);
 
   // THEN
-  expect(executed).toBeTruthy();
-  expect(protectedTermination).toBeFalsy();
+  // There are only two ways that termination can be set: either through calling CreateStackCommand
+  // or by calling UpdateTerminationProtectionCommand, which is not done by default
+  expect(mockCloudFormationClient).not.toHaveReceivedCommand(CreateStackCommand);
+  expect(mockCloudFormationClient).toHaveReceivedCommandWith(CreateChangeSetCommand, {
+    StackName: 'CDKToolkit',
+    ChangeSetType: 'CREATE',
+    ClientToken: expect.any(String),
+    Description: expect.any(String),
+    Parameters: [],
+    Capabilities: ['CAPABILITY_IAM', 'CAPABILITY_NAMED_IAM', 'CAPABILITY_AUTO_EXPAND'],
+    ChangeSetName: changeSetName,
+    TemplateBody: templateBody,
+  });
+  expect(mockCloudFormationClient).toHaveReceivedCommandWith(ExecuteChangeSetCommand, {
+    ChangeSetName: changeSetName,
+  });
+  expect(mockCloudFormationClient).not.toHaveReceivedCommandWith(UpdateTerminationProtectionCommand, {
+    EnableTerminationProtection: true,
+    StackName: 'CDKToolkit',
+  });
 });
 
 test('stack is termination protected when set', async () => {
@@ -296,14 +344,22 @@ test('stack is termination protected when set', async () => {
   });
 
   // THEN
-  expect(executed).toBeTruthy();
-  expect(protectedTermination).toBeTruthy();
+  expect(mockCloudFormationClient).toHaveReceivedCommandWith(ExecuteChangeSetCommand, {
+    ChangeSetName: changeSetName,
+  });
+  expect(mockCloudFormationClient).toHaveReceivedCommandWith(UpdateTerminationProtectionCommand, {
+    EnableTerminationProtection: true,
+    StackName: 'CDKToolkit',
+  });
 });
 
 test('do showTemplate YAML', async () => {
   process.stdout.write = jest.fn().mockImplementationOnce((template) => {
     // THEN
-    expect(parse(template)).toHaveProperty('Description', 'The CDK Toolkit Stack. It was created by `cdk bootstrap` and manages resources necessary for managing your Cloud Applications with AWS CDK.');
+    expect(parse(template)).toHaveProperty(
+      'Description',
+      'The CDK Toolkit Stack. It was created by `cdk bootstrap` and manages resources necessary for managing your Cloud Applications with AWS CDK.',
+    );
   });
 
   // WHEN
@@ -313,7 +369,10 @@ test('do showTemplate YAML', async () => {
 test('do showTemplate JSON', async () => {
   process.stdout.write = jest.fn().mockImplementationOnce((template) => {
     // THEN
-    expect(JSON.parse(template)).toHaveProperty('Description', 'The CDK Toolkit Stack. It was created by `cdk bootstrap` and manages resources necessary for managing your Cloud Applications with AWS CDK.');
+    expect(JSON.parse(template)).toHaveProperty(
+      'Description',
+      'The CDK Toolkit Stack. It was created by `cdk bootstrap` and manages resources necessary for managing your Cloud Applications with AWS CDK.',
+    );
   });
 
   // WHEN
diff --git a/packages/aws-cdk/test/api/bootstrap2.test.ts b/packages/aws-cdk/test/api/bootstrap2.test.ts
index d9ec9d563768a..b9cc1af886dbd 100644
--- a/packages/aws-cdk/test/api/bootstrap2.test.ts
+++ b/packages/aws-cdk/test/api/bootstrap2.test.ts
@@ -1,32 +1,30 @@
-/* eslint-disable import/order */
-
 const mockDeployStack = jest.fn();
 
 jest.mock('../../lib/api/deploy-stack', () => ({
   deployStack: mockDeployStack,
 }));
 
-import { IAM } from 'aws-sdk';
+import { Stack } from '@aws-sdk/client-cloudformation';
+import { CreatePolicyCommand, GetPolicyCommand } from '@aws-sdk/client-iam';
 import { Bootstrapper, DeployStackOptions, ToolkitInfo } from '../../lib/api';
-import { mockBootstrapStack, MockSdk, MockSdkProvider } from '../util/mock-sdk';
+import { mockBootstrapStack, mockIAMClient, MockSdkProvider, restoreSdkMocksToDefault } from '../util/mock-sdk';
 
 let bootstrapper: Bootstrapper;
-let mockGetPolicyIamCode: (params: IAM.Types.GetPolicyRequest) => IAM.Types.GetPolicyResponse;
-let mockCreatePolicyIamCode: (params: IAM.Types.CreatePolicyRequest) => IAM.Types.CreatePolicyResponse;
 let stderrMock: jest.SpyInstance;
 
 beforeEach(() => {
   bootstrapper = new Bootstrapper({ source: 'default' });
-  stderrMock = jest.spyOn(process.stderr, 'write').mockImplementation(() => { return true; });
+  stderrMock = jest.spyOn(process.stderr, 'write').mockImplementation(() => {
+    return true;
+  });
 });
 
 afterEach(() => {
   stderrMock.mockRestore();
 });
 
-function mockTheToolkitInfo(stackProps: Partial<AWS.CloudFormation.Stack>) {
-  const sdk = new MockSdk();
-  (ToolkitInfo as any).lookup = jest.fn().mockResolvedValue(ToolkitInfo.fromStack(mockBootstrapStack(sdk, stackProps)));
+function mockTheToolkitInfo(stackProps: Partial<Stack>) {
+  (ToolkitInfo as any).lookup = jest.fn().mockResolvedValue(ToolkitInfo.fromStack(mockBootstrapStack(stackProps)));
 }
 
 describe('Bootstrapping v2', () => {
@@ -38,7 +36,7 @@ describe('Bootstrapping v2', () => {
 
   let sdk: MockSdkProvider;
   beforeEach(() => {
-    sdk = new MockSdkProvider({ realSdk: false });
+    sdk = new MockSdkProvider();
     // By default, we'll return a non-found toolkit info
     (ToolkitInfo as any).lookup = jest.fn().mockResolvedValue(ToolkitInfo.bootstrapStackNotFoundInfo('BootstrapStack'));
     const value = {
@@ -47,12 +45,9 @@ describe('Bootstrapping v2', () => {
         Arn: 'arn:aws:iam::0123456789012:policy/my-policy',
       },
     };
-    mockGetPolicyIamCode = jest.fn().mockReturnValue(value);
-    mockCreatePolicyIamCode = jest.fn().mockReturnValue(value);
-    sdk.stubIam({
-      createPolicy: mockCreatePolicyIamCode,
-      getPolicy: mockGetPolicyIamCode,
-    });
+    restoreSdkMocksToDefault();
+    mockIAMClient.on(GetPolicyCommand).resolves(value);
+    mockIAMClient.on(CreatePolicyCommand).resolves(value);
   });
 
   afterEach(() => {
@@ -67,12 +62,14 @@ describe('Bootstrapping v2', () => {
       },
     });
 
-    expect(mockDeployStack).toHaveBeenCalledWith(expect.objectContaining({
-      parameters: expect.objectContaining({
-        FileAssetsBucketName: 'my-bucket-name',
-        PublicAccessBlockConfiguration: 'true',
+    expect(mockDeployStack).toHaveBeenCalledWith(
+      expect.objectContaining({
+        parameters: expect.objectContaining({
+          FileAssetsBucketName: 'my-bucket-name',
+          PublicAccessBlockConfiguration: 'true',
+        }),
       }),
-    }));
+    );
   });
 
   test('passes the KMS key ID as a CFN parameter', async () => {
@@ -83,12 +80,14 @@ describe('Bootstrapping v2', () => {
       },
     });
 
-    expect(mockDeployStack).toHaveBeenCalledWith(expect.objectContaining({
-      parameters: expect.objectContaining({
-        FileAssetsBucketKmsKeyId: 'my-kms-key-id',
-        PublicAccessBlockConfiguration: 'true',
+    expect(mockDeployStack).toHaveBeenCalledWith(
+      expect.objectContaining({
+        parameters: expect.objectContaining({
+          FileAssetsBucketKmsKeyId: 'my-kms-key-id',
+          PublicAccessBlockConfiguration: 'true',
+        }),
       }),
-    }));
+    );
   });
 
   test('passes false to PublicAccessBlockConfiguration', async () => {
@@ -99,11 +98,13 @@ describe('Bootstrapping v2', () => {
       },
     });
 
-    expect(mockDeployStack).toHaveBeenCalledWith(expect.objectContaining({
-      parameters: expect.objectContaining({
-        PublicAccessBlockConfiguration: 'false',
+    expect(mockDeployStack).toHaveBeenCalledWith(
+      expect.objectContaining({
+        parameters: expect.objectContaining({
+          PublicAccessBlockConfiguration: 'false',
+        }),
       }),
-    }));
+    );
   });
 
   test('passes true to PermissionsBoundary', async () => {
@@ -113,11 +114,13 @@ describe('Bootstrapping v2', () => {
       },
     });
 
-    expect(mockDeployStack).toHaveBeenCalledWith(expect.objectContaining({
-      parameters: expect.objectContaining({
-        InputPermissionsBoundary: 'cdk-hnb659fds-permissions-boundary',
+    expect(mockDeployStack).toHaveBeenCalledWith(
+      expect.objectContaining({
+        parameters: expect.objectContaining({
+          InputPermissionsBoundary: 'cdk-hnb659fds-permissions-boundary',
+        }),
       }),
-    }));
+    );
   });
 
   test('passes value to PermissionsBoundary', async () => {
@@ -135,16 +138,20 @@ describe('Bootstrapping v2', () => {
       },
     });
 
-    expect(mockDeployStack).toHaveBeenCalledWith(expect.objectContaining({
-      parameters: expect.objectContaining({
-        InputPermissionsBoundary: 'permissions-boundary-name',
+    expect(mockDeployStack).toHaveBeenCalledWith(
+      expect.objectContaining({
+        parameters: expect.objectContaining({
+          InputPermissionsBoundary: 'permissions-boundary-name',
+        }),
       }),
-    }));
-    expect(stderrMock.mock.calls).toEqual(expect.arrayContaining([
+    );
+    expect(stderrMock.mock.calls).toEqual(
       expect.arrayContaining([
-        expect.stringMatching(/Changing permissions boundary from existing-pb to permissions-boundary-name/),
+        expect.arrayContaining([
+          expect.stringMatching(/Changing permissions boundary from existing-pb to permissions-boundary-name/),
+        ]),
       ]),
-    ]));
+    );
   });
 
   test('permission boundary switch message does not appear', async () => {
@@ -158,11 +165,9 @@ describe('Bootstrapping v2', () => {
     });
     await bootstrapper.bootstrapEnvironment(env, sdk);
 
-    expect(stderrMock.mock.calls).toEqual(expect.arrayContaining([
-      expect.not.arrayContaining([
-        expect.stringMatching(/Changing permissions boundary/),
-      ]),
-    ]));
+    expect(stderrMock.mock.calls).toEqual(
+      expect.arrayContaining([expect.not.arrayContaining([expect.stringMatching(/Changing permissions boundary/)])]),
+    );
   });
 
   test('adding new permissions boundary', async () => {
@@ -180,11 +185,11 @@ describe('Bootstrapping v2', () => {
       },
     });
 
-    expect(stderrMock.mock.calls).toEqual(expect.arrayContaining([
+    expect(stderrMock.mock.calls).toEqual(
       expect.arrayContaining([
-        expect.stringMatching(/Adding new permissions boundary permissions-boundary-name/),
+        expect.arrayContaining([expect.stringMatching(/Adding new permissions boundary permissions-boundary-name/)]),
       ]),
-    ]));
+    );
   });
 
   test('removing existing permissions boundary', async () => {
@@ -200,11 +205,13 @@ describe('Bootstrapping v2', () => {
       parameters: {},
     });
 
-    expect(stderrMock.mock.calls).toEqual(expect.arrayContaining([
+    expect(stderrMock.mock.calls).toEqual(
       expect.arrayContaining([
-        expect.stringMatching(/Removing existing permissions boundary permissions-boundary-name/),
+        expect.arrayContaining([
+          expect.stringMatching(/Removing existing permissions boundary permissions-boundary-name/),
+        ]),
       ]),
-    ]));
+    );
   });
 
   test('adding permission boundary with path in policy name', async () => {
@@ -222,21 +229,23 @@ describe('Bootstrapping v2', () => {
       },
     });
 
-    expect(stderrMock.mock.calls).toEqual(expect.arrayContaining([
+    expect(stderrMock.mock.calls).toEqual(
       expect.arrayContaining([
-        expect.stringMatching(/Adding new permissions boundary permissions-boundary-name\/with\/path/),
+        expect.arrayContaining([
+          expect.stringMatching(/Adding new permissions boundary permissions-boundary-name\/with\/path/),
+        ]),
       ]),
-    ]));
+    );
   });
 
   test('passing trusted accounts without CFN managed policies results in an error', async () => {
-    await expect(bootstrapper.bootstrapEnvironment(env, sdk, {
-      parameters: {
-        trustedAccounts: ['123456789012'],
-      },
-    }))
-      .rejects
-      .toThrow(/--cloudformation-execution-policies/);
+    await expect(
+      bootstrapper.bootstrapEnvironment(env, sdk, {
+        parameters: {
+          trustedAccounts: ['123456789012'],
+        },
+      }),
+    ).rejects.toThrow(/--cloudformation-execution-policies/);
   });
 
   test('passing trusted accounts without CFN managed policies on the existing stack results in an error', async () => {
@@ -249,13 +258,13 @@ describe('Bootstrapping v2', () => {
       ],
     });
 
-    await expect(bootstrapper.bootstrapEnvironment(env, sdk, {
-      parameters: {
-        trustedAccounts: ['123456789012'],
-      },
-    }))
-      .rejects
-      .toThrow(/--cloudformation-execution-policies/);
+    await expect(
+      bootstrapper.bootstrapEnvironment(env, sdk, {
+        parameters: {
+          trustedAccounts: ['123456789012'],
+        },
+      }),
+    ).rejects.toThrow(/--cloudformation-execution-policies/);
   });
 
   test('passing no CFN managed policies without trusted accounts is okay', async () => {
@@ -263,11 +272,13 @@ describe('Bootstrapping v2', () => {
       parameters: {},
     });
 
-    expect(mockDeployStack).toHaveBeenCalledWith(expect.objectContaining({
-      parameters: expect.objectContaining({
-        CloudFormationExecutionPolicies: '',
+    expect(mockDeployStack).toHaveBeenCalledWith(
+      expect.objectContaining({
+        parameters: expect.objectContaining({
+          CloudFormationExecutionPolicies: '',
+        }),
       }),
-    }));
+    );
   });
 
   test('passing trusted accounts for lookup generates the correct stack parameter', async () => {
@@ -278,11 +289,13 @@ describe('Bootstrapping v2', () => {
       },
     });
 
-    expect(mockDeployStack).toHaveBeenCalledWith(expect.objectContaining({
-      parameters: expect.objectContaining({
-        TrustedAccountsForLookup: '123456789012',
+    expect(mockDeployStack).toHaveBeenCalledWith(
+      expect.objectContaining({
+        parameters: expect.objectContaining({
+          TrustedAccountsForLookup: '123456789012',
+        }),
       }),
-    }));
+    );
   });
 
   test('allow adding trusted account if there was already a policy on the stack', async () => {
@@ -315,11 +328,13 @@ describe('Bootstrapping v2', () => {
       ],
     });
 
-    await expect(bootstrapper.bootstrapEnvironment(env, sdk, {
-      parameters: {
-        cloudFormationExecutionPolicies: ['arn:policy'],
-      },
-    })).resolves.toEqual(expect.objectContaining({ noOp: true }));
+    await expect(
+      bootstrapper.bootstrapEnvironment(env, sdk, {
+        parameters: {
+          cloudFormationExecutionPolicies: ['arn:policy'],
+        },
+      }),
+    ).resolves.toEqual(expect.objectContaining({ noOp: true }));
   });
 
   test('Do not allow overwriting bootstrap stack from a different vendor', async () => {
@@ -333,8 +348,9 @@ describe('Bootstrapping v2', () => {
       ],
     });
 
-    await expect(bootstrapper.bootstrapEnvironment(env, sdk, {
-    })).resolves.toEqual(expect.objectContaining({ noOp: true }));
+    await expect(bootstrapper.bootstrapEnvironment(env, sdk, {})).resolves.toEqual(
+      expect.objectContaining({ noOp: true }),
+    );
   });
 
   test('bootstrap template has the right exports', async () => {
@@ -367,11 +383,13 @@ describe('Bootstrapping v2', () => {
         },
       });
 
-      expect(mockDeployStack).toHaveBeenCalledWith(expect.objectContaining({
-        stack: expect.objectContaining({
-          terminationProtection: false,
+      expect(mockDeployStack).toHaveBeenCalledWith(
+        expect.objectContaining({
+          stack: expect.objectContaining({
+            terminationProtection: false,
+          }),
         }),
-      }));
+      );
     });
 
     test('stack is termination protected when option is set', async () => {
@@ -382,11 +400,13 @@ describe('Bootstrapping v2', () => {
         },
       });
 
-      expect(mockDeployStack).toHaveBeenCalledWith(expect.objectContaining({
-        stack: expect.objectContaining({
-          terminationProtection: true,
+      expect(mockDeployStack).toHaveBeenCalledWith(
+        expect.objectContaining({
+          stack: expect.objectContaining({
+            terminationProtection: true,
+          }),
         }),
-      }));
+      );
     });
 
     test('termination protection is left alone when option is not given', async () => {
@@ -400,11 +420,13 @@ describe('Bootstrapping v2', () => {
         },
       });
 
-      expect(mockDeployStack).toHaveBeenCalledWith(expect.objectContaining({
-        stack: expect.objectContaining({
-          terminationProtection: true,
+      expect(mockDeployStack).toHaveBeenCalledWith(
+        expect.objectContaining({
+          stack: expect.objectContaining({
+            terminationProtection: true,
+          }),
         }),
-      }));
+      );
     });
 
     test('termination protection can be switched off', async () => {
@@ -419,11 +441,13 @@ describe('Bootstrapping v2', () => {
         },
       });
 
-      expect(mockDeployStack).toHaveBeenCalledWith(expect.objectContaining({
-        stack: expect.objectContaining({
-          terminationProtection: false,
+      expect(mockDeployStack).toHaveBeenCalledWith(
+        expect.objectContaining({
+          stack: expect.objectContaining({
+            terminationProtection: false,
+          }),
         }),
-      }));
+      );
     });
   });
 
@@ -435,24 +459,29 @@ describe('Bootstrapping v2', () => {
       [true, ''],
       // Don't create a new key
       [false, 'AWS_MANAGED_KEY'],
-    ])('(new stack) createCustomerMasterKey=%p => parameter becomes %p ', async (createCustomerMasterKey, paramKeyId) => {
-      // GIVEN: no existing stack
-
-      // WHEN
-      await bootstrapper.bootstrapEnvironment(env, sdk, {
-        parameters: {
-          createCustomerMasterKey,
-          cloudFormationExecutionPolicies: ['arn:booh'],
-        },
-      });
-
-      // THEN
-      expect(mockDeployStack).toHaveBeenCalledWith(expect.objectContaining({
-        parameters: expect.objectContaining({
-          FileAssetsBucketKmsKeyId: paramKeyId,
-        }),
-      }));
-    });
+    ])(
+      '(new stack) createCustomerMasterKey=%p => parameter becomes %p ',
+      async (createCustomerMasterKey, paramKeyId) => {
+        // GIVEN: no existing stack
+
+        // WHEN
+        await bootstrapper.bootstrapEnvironment(env, sdk, {
+          parameters: {
+            createCustomerMasterKey,
+            cloudFormationExecutionPolicies: ['arn:booh'],
+          },
+        });
+
+        // THEN
+        expect(mockDeployStack).toHaveBeenCalledWith(
+          expect.objectContaining({
+            parameters: expect.objectContaining({
+              FileAssetsBucketKmsKeyId: paramKeyId,
+            }),
+          }),
+        );
+      },
+    );
 
     test.each([
       // Old bootstrap stack being upgraded to new one
@@ -463,31 +492,38 @@ describe('Bootstrapping v2', () => {
       ['arn:aws:key', false, 'AWS_MANAGED_KEY'],
       // Switch on existing key
       ['AWS_MANAGED_KEY', true, ''],
-    ])('(upgrading) current param %p, createCustomerMasterKey=%p => parameter becomes %p ', async (currentKeyId, createCustomerMasterKey, paramKeyId) => {
-      // GIVEN
-      mockTheToolkitInfo({
-        Parameters: currentKeyId ? [
-          {
-            ParameterKey: 'FileAssetsBucketKmsKeyId',
-            ParameterValue: currentKeyId,
+    ])(
+      '(upgrading) current param %p, createCustomerMasterKey=%p => parameter becomes %p ',
+      async (currentKeyId, createCustomerMasterKey, paramKeyId) => {
+        // GIVEN
+        mockTheToolkitInfo({
+          Parameters: currentKeyId
+            ? [
+              {
+                ParameterKey: 'FileAssetsBucketKmsKeyId',
+                ParameterValue: currentKeyId,
+              },
+            ]
+            : undefined,
+        });
+
+        // WHEN
+        await bootstrapper.bootstrapEnvironment(env, sdk, {
+          parameters: {
+            createCustomerMasterKey,
+            cloudFormationExecutionPolicies: ['arn:booh'],
           },
-        ] : undefined,
-      });
-
-      // WHEN
-      await bootstrapper.bootstrapEnvironment(env, sdk, {
-        parameters: {
-          createCustomerMasterKey,
-          cloudFormationExecutionPolicies: ['arn:booh'],
-        },
-      });
-
-      // THEN
-      expect(mockDeployStack).toHaveBeenCalledWith(expect.objectContaining({
-        parameters: expect.objectContaining({
-          FileAssetsBucketKmsKeyId: paramKeyId,
-        }),
-      }));
-    });
+        });
+
+        // THEN
+        expect(mockDeployStack).toHaveBeenCalledWith(
+          expect.objectContaining({
+            parameters: expect.objectContaining({
+              FileAssetsBucketKmsKeyId: paramKeyId,
+            }),
+          }),
+        );
+      },
+    );
   });
 });
diff --git a/packages/aws-cdk/test/api/cloudformation-deployments.test.ts b/packages/aws-cdk/test/api/cloudformation-deployments.test.ts
index 423293922de00..b69ae18055e19 100644
--- a/packages/aws-cdk/test/api/cloudformation-deployments.test.ts
+++ b/packages/aws-cdk/test/api/cloudformation-deployments.test.ts
@@ -1,49 +1,50 @@
-/* eslint-disable import/order */
 jest.mock('../../lib/api/deploy-stack');
 jest.mock('../../lib/util/asset-publishing');
 
-import { CloudFormation } from 'aws-sdk';
+import {
+  DescribeStacksCommand,
+  ListStackResourcesCommand,
+  StackStatus,
+  type StackResourceSummary,
+  RollbackStackCommand,
+  ContinueUpdateRollbackCommand,
+  DescribeStackEventsCommand,
+} from '@aws-sdk/client-cloudformation';
+import { GetParameterCommand } from '@aws-sdk/client-ssm';
 import { FakeCloudformationStack } from './fake-cloudformation-stack';
-import { Deployments } from '../../lib/api/deployments';
 import { deployStack } from '../../lib/api/deploy-stack';
+import { Deployments } from '../../lib/api/deployments';
 import { HotswapMode } from '../../lib/api/hotswap/common';
 import { ToolkitInfo } from '../../lib/api/toolkit-info';
 import { CloudFormationStack } from '../../lib/api/util/cloudformation';
 import { testStack } from '../util';
-import { mockBootstrapStack, MockedHandlerType, MockSdkProvider } from '../util/mock-sdk';
+import {
+  mockBootstrapStack,
+  mockCloudFormationClient,
+  MockSdk,
+  MockSdkProvider,
+  mockSSMClient,
+  restoreSdkMocksToDefault,
+  setDefaultSTSMocks,
+} from '../util/mock-sdk';
 
 let sdkProvider: MockSdkProvider;
+let sdk: MockSdk;
 let deployments: Deployments;
 let mockToolkitInfoLookup: jest.Mock;
-let currentCfnStackResources: { [key: string]: CloudFormation.StackResourceSummary[] };
-let numberOfTimesListStackResourcesWasCalled: number;
-let mockRollbackStack: MockedHandlerType<CloudFormation['rollbackStack']> = jest.fn();
-let mockContinueUpdateRollback: MockedHandlerType<CloudFormation['continueUpdateRollback']> = jest.fn();
-let mockDescribeStackEvents: MockedHandlerType<CloudFormation['describeStackEvents']> = jest.fn();
+let currentCfnStackResources: { [key: string]: StackResourceSummary[] };
 beforeEach(() => {
   jest.resetAllMocks();
   sdkProvider = new MockSdkProvider();
+  sdk = new MockSdk();
   deployments = new Deployments({ sdkProvider });
 
-  numberOfTimesListStackResourcesWasCalled = 0;
   currentCfnStackResources = {};
-  sdkProvider.stubCloudFormation({
-    listStackResources: ({ StackName: stackName }) => {
-      numberOfTimesListStackResourcesWasCalled++;
-      const stackResources = currentCfnStackResources[stackName];
-      if (!stackResources) {
-        throw new Error(`Stack with id ${stackName} does not exist`);
-      }
-      return {
-        StackResourceSummaries: stackResources,
-      };
-    },
-    rollbackStack: mockRollbackStack,
-    continueUpdateRollback: mockContinueUpdateRollback,
-    describeStackEvents: mockDescribeStackEvents,
-  });
-
-  ToolkitInfo.lookup = mockToolkitInfoLookup = jest.fn().mockResolvedValue(ToolkitInfo.bootstrapStackNotFoundInfo('TestBootstrapStack'));
+  restoreSdkMocksToDefault();
+  ToolkitInfo.lookup = mockToolkitInfoLookup = jest
+    .fn()
+    .mockResolvedValue(ToolkitInfo.bootstrapStackNotFoundInfo('TestBootstrapStack'));
+  setDefaultSTSMocks();
 });
 
 function mockSuccessfulBootstrapStackLookup(props?: Record<string, any>) {
@@ -54,7 +55,7 @@ function mockSuccessfulBootstrapStackLookup(props?: Record<string, any>) {
     ...props,
   };
 
-  const fakeStack = mockBootstrapStack(sdkProvider.sdk, {
+  const fakeStack = mockBootstrapStack({
     Outputs: Object.entries(outputs).map(([k, v]) => ({
       OutputKey: k,
       OutputValue: `${v}`,
@@ -74,9 +75,11 @@ test('passes through hotswap=true to deployStack()', async () => {
   });
 
   // THEN
-  expect(deployStack).toHaveBeenCalledWith(expect.objectContaining({
-    hotswap: HotswapMode.FALL_BACK,
-  }));
+  expect(deployStack).toHaveBeenCalledWith(
+    expect.objectContaining({
+      hotswap: HotswapMode.FALL_BACK,
+    }),
+  );
 });
 
 test('placeholders are substituted in CloudFormation execution role', async () => {
@@ -89,13 +92,17 @@ test('placeholders are substituted in CloudFormation execution role', async () =
     }),
   });
 
-  expect(deployStack).toHaveBeenCalledWith(expect.objectContaining({
-    roleArn: 'bloop:here:123456789012',
-  }));
+  expect(deployStack).toHaveBeenCalledWith(
+    expect.objectContaining({
+      roleArn: 'bloop:here:123456789012',
+    }),
+  );
 });
 
 test('role with placeholders is assumed if assumerole is given', async () => {
-  const mockForEnvironment = jest.fn().mockImplementation(() => { return { sdk: sdkProvider.sdk }; });
+  const mockForEnvironment = jest.fn().mockImplementation(() => {
+    return { sdk: new MockSdk() };
+  });
   sdkProvider.forEnvironment = mockForEnvironment;
 
   await deployments.deployStack({
@@ -107,78 +114,109 @@ test('role with placeholders is assumed if assumerole is given', async () => {
     }),
   });
 
-  expect(mockForEnvironment).toHaveBeenCalledWith(expect.anything(), expect.anything(), expect.objectContaining({
-    assumeRoleArn: 'bloop:here:123456789012',
-  }));
+  expect(mockForEnvironment).toHaveBeenCalledWith(
+    expect.anything(),
+    expect.anything(),
+    expect.objectContaining({
+      assumeRoleArn: 'bloop:here:123456789012',
+    }),
+  );
 });
 
 test('deployment fails if bootstrap stack is missing', async () => {
-  await expect(deployments.deployStack({
-    stack: testStack({
-      stackName: 'boop',
-      properties: {
-        assumeRoleArn: 'bloop:${AWS::Region}:${AWS::AccountId}',
-        requiresBootstrapStackVersion: 99,
-      },
+  await expect(
+    deployments.deployStack({
+      stack: testStack({
+        stackName: 'boop',
+        properties: {
+          assumeRoleArn: 'bloop:${AWS::Region}:${AWS::AccountId}',
+          requiresBootstrapStackVersion: 99,
+        },
+      }),
     }),
-  })).rejects.toThrow(/requires a bootstrap stack/);
+  ).rejects.toThrow(/requires a bootstrap stack/);
 });
 
 test('deployment fails if bootstrap stack is too old', async () => {
   mockSuccessfulBootstrapStackLookup({
     BootstrapVersion: 5,
   });
-
-  await expect(deployments.deployStack({
-    stack: testStack({
-      stackName: 'boop',
-      properties: {
-        assumeRoleArn: 'bloop:${AWS::Region}:${AWS::AccountId}',
-        requiresBootstrapStackVersion: 99,
-      },
+  setDefaultSTSMocks();
+
+  await expect(
+    deployments.deployStack({
+      stack: testStack({
+        stackName: 'boop',
+        properties: {
+          assumeRoleArn: 'bloop:${AWS::Region}:${AWS::AccountId}',
+          requiresBootstrapStackVersion: 99,
+        },
+      }),
     }),
-  })).rejects.toThrow(/requires bootstrap stack version '99', found '5'/);
+  ).rejects.toThrow(/requires bootstrap stack version '99', found '5'/);
 });
 
-test.each([false, true])('if toolkit stack be found: %p but SSM parameter name is present deployment succeeds', async (canLookup) => {
-  if (canLookup) {
-    mockSuccessfulBootstrapStackLookup({
-      BootstrapVersion: 2,
+test.each([false, true])(
+  'if toolkit stack be found: %p but SSM parameter name is present deployment succeeds',
+  async (canLookup) => {
+    if (canLookup) {
+      mockSuccessfulBootstrapStackLookup({
+        BootstrapVersion: 2,
+      });
+    }
+    setDefaultSTSMocks();
+
+    mockSSMClient.on(GetParameterCommand).resolves({
+      Parameter: {
+        Value: '99',
+      },
     });
-  }
 
-  let requestedParameterName: string;
-  sdkProvider.stubSSM({
-    getParameter(request) {
-      requestedParameterName = request.Name;
-      return {
-        Parameter: {
-          Value: '99',
+    await deployments.deployStack({
+      stack: testStack({
+        stackName: 'boop',
+        properties: {
+          assumeRoleArn: 'bloop:${AWS::Region}:${AWS::AccountId}',
+          requiresBootstrapStackVersion: 99,
+          bootstrapStackVersionSsmParameter: '/some/parameter',
         },
-      };
-    },
-  });
+      }),
+    });
 
-  await deployments.deployStack({
-    stack: testStack({
-      stackName: 'boop',
-      properties: {
-        assumeRoleArn: 'bloop:${AWS::Region}:${AWS::AccountId}',
-        requiresBootstrapStackVersion: 99,
-        bootstrapStackVersionSsmParameter: '/some/parameter',
+    expect(mockSSMClient).toHaveReceivedCommandWith(GetParameterCommand, {
+      Name: '/some/parameter',
+    });
+  },
+);
+
+test('readCurrentTemplateWithNestedStacks() can handle non-Resources in the template', async () => {
+  const stackSummary = stackSummaryOf(
+    'NestedStack',
+    'AWS::CloudFormation::Stack',
+    'arn:aws:cloudformation:bermuda-triangle-1337:123456789012:stack/NestedStack/abcd',
+  );
+
+  pushStackResourceSummaries('ParentOfStackWithOutputAndParameter', stackSummary);
+
+  mockCloudFormationClient.on(ListStackResourcesCommand).resolvesOnce({
+    StackResourceSummaries: [stackSummary],
+  });
+  mockCloudFormationClient.on(DescribeStacksCommand).resolvesOnce({
+    Stacks: [
+      {
+        StackName: 'NestedStack',
+        RootId: 'StackId',
+        CreationTime: new Date(),
+        StackStatus: StackStatus.CREATE_COMPLETE,
       },
-    }),
+    ],
   });
 
-  expect(requestedParameterName!).toEqual('/some/parameter');
-});
-
-test('readCurrentTemplateWithNestedStacks() can handle non-Resources in the template', async () => {
   const cfnStack = new FakeCloudformationStack({
     stackName: 'ParentOfStackWithOutputAndParameter',
     stackId: 'StackId',
   });
-  CloudFormationStack.lookup = (async (_, stackName: string) => {
+  CloudFormationStack.lookup = async (_, stackName: string) => {
     switch (stackName) {
       case 'ParentOfStackWithOutputAndParameter':
         cfnStack.template = async () => ({
@@ -226,7 +264,7 @@ test('readCurrentTemplateWithNestedStacks() can handle non-Resources in the temp
     }
 
     return cfnStack;
-  });
+  };
 
   const rootStack = testStack({
     stackName: 'ParentOfStackWithOutputAndParameter',
@@ -245,15 +283,10 @@ test('readCurrentTemplateWithNestedStacks() can handle non-Resources in the temp
     },
   });
 
-  pushStackResourceSummaries('ParentOfStackWithOutputAndParameter',
-    stackSummaryOf('NestedStack', 'AWS::CloudFormation::Stack',
-      'arn:aws:cloudformation:bermuda-triangle-1337:123456789012:stack/NestedStack/abcd',
-    ),
-  );
-
   // WHEN
-  const deployedTemplate = (await deployments.readCurrentTemplateWithNestedStacks(rootStack)).deployedRootTemplate;
-  const nestedStacks = (await deployments.readCurrentTemplateWithNestedStacks(rootStack)).nestedStacks;
+  const rootTemplate = await deployments.readCurrentTemplateWithNestedStacks(rootStack);
+  const deployedTemplate = rootTemplate.deployedRootTemplate;
+  const nestedStacks = rootTemplate.nestedStacks;
 
   // THEN
   expect(deployedTemplate).toEqual({
@@ -337,6 +370,91 @@ test('readCurrentTemplateWithNestedStacks() can handle non-Resources in the temp
 });
 
 test('readCurrentTemplateWithNestedStacks() with a 3-level nested + sibling structure works', async () => {
+  const rootSummary = stackSummaryOf(
+    'NestedStack',
+    'AWS::CloudFormation::Stack',
+    'arn:aws:cloudformation:bermuda-triangle-1337:123456789012:stack/NestedStack/abcd',
+  );
+
+  const nestedStackSummary = [
+    stackSummaryOf(
+      'GrandChildStackA',
+      'AWS::CloudFormation::Stack',
+      'arn:aws:cloudformation:bermuda-triangle-1337:123456789012:stack/GrandChildStackA/abcd',
+    ),
+    stackSummaryOf(
+      'GrandChildStackB',
+      'AWS::CloudFormation::Stack',
+      'arn:aws:cloudformation:bermuda-triangle-1337:123456789012:stack/GrandChildStackB/abcd',
+    ),
+  ];
+
+  const grandChildAStackSummary = stackSummaryOf(
+    'GrandChildA',
+    'AWS::CloudFormation::Stack',
+    'arn:aws:cloudformation:bermuda-triangle-1337:123456789012:stack/GrandChildA/abcd',
+  );
+
+  const grandchildBStackSummary = stackSummaryOf(
+    'GrandChildB',
+    'AWS::CloudFormation::Stack',
+    'arn:aws:cloudformation:bermuda-triangle-1337:123456789012:stack/GrandChildB/abcd',
+  );
+
+  pushStackResourceSummaries('MultiLevelRoot', rootSummary);
+  pushStackResourceSummaries('NestedStack', ...nestedStackSummary);
+  pushStackResourceSummaries('GrandChildStackA', grandChildAStackSummary);
+  pushStackResourceSummaries('GrandChildStackB', grandchildBStackSummary);
+
+  mockCloudFormationClient
+    .on(ListStackResourcesCommand)
+    .resolvesOnce({
+      StackResourceSummaries: [rootSummary],
+    })
+    .resolvesOnce({
+      StackResourceSummaries: nestedStackSummary,
+    })
+    .resolvesOnce({
+      StackResourceSummaries: [grandChildAStackSummary],
+    })
+    .resolvesOnce({
+      StackResourceSummaries: [grandchildBStackSummary],
+    });
+
+  mockCloudFormationClient
+    .on(DescribeStacksCommand)
+    .resolvesOnce({
+      Stacks: [
+        {
+          StackName: 'NestedStack',
+          RootId: 'StackId',
+          CreationTime: new Date(),
+          StackStatus: StackStatus.CREATE_COMPLETE,
+        },
+      ],
+    })
+    .resolvesOnce({
+      Stacks: [
+        {
+          StackName: 'GrandChildStackA',
+          RootId: 'StackId',
+          ParentId: 'NestedStack',
+          CreationTime: new Date(),
+          StackStatus: StackStatus.CREATE_COMPLETE,
+        },
+      ],
+    })
+    .resolvesOnce({
+      Stacks: [
+        {
+          StackName: 'GrandChildStackB',
+          RootId: 'StackId',
+          ParentId: 'NestedStack',
+          CreationTime: new Date(),
+          StackStatus: StackStatus.CREATE_COMPLETE,
+        },
+      ],
+    });
   givenStacks({
     MultiLevelRoot: {
       template: {
@@ -426,33 +544,10 @@ test('readCurrentTemplateWithNestedStacks() with a 3-level nested + sibling stru
     },
   });
 
-  pushStackResourceSummaries('MultiLevelRoot',
-    stackSummaryOf('NestedStack', 'AWS::CloudFormation::Stack',
-      'arn:aws:cloudformation:bermuda-triangle-1337:123456789012:stack/NestedStack/abcd',
-    ),
-  );
-  pushStackResourceSummaries('NestedStack',
-    stackSummaryOf('GrandChildStackA', 'AWS::CloudFormation::Stack',
-      'arn:aws:cloudformation:bermuda-triangle-1337:123456789012:stack/GrandChildStackA/abcd',
-    ),
-    stackSummaryOf('GrandChildStackB', 'AWS::CloudFormation::Stack',
-      'arn:aws:cloudformation:bermuda-triangle-1337:123456789012:stack/GrandChildStackB/abcd',
-    ),
-  );
-  pushStackResourceSummaries('GrandChildStackA',
-    stackSummaryOf('NestedStack', 'AWS::CloudFormation::Stack',
-      'arn:aws:cloudformation:bermuda-triangle-1337:123456789012:stack/GrandChildA/abcd',
-    ),
-  );
-  pushStackResourceSummaries('GrandChildStackB',
-    stackSummaryOf('NestedStack', 'AWS::CloudFormation::Stack',
-      'arn:aws:cloudformation:bermuda-triangle-1337:123456789012:stack/GrandChildB/abcd',
-    ),
-  );
-
   // WHEN
-  const deployedTemplate = (await deployments.readCurrentTemplateWithNestedStacks(rootStack)).deployedRootTemplate;
-  const nestedStacks = (await deployments.readCurrentTemplateWithNestedStacks(rootStack)).nestedStacks;
+  const rootTemplate = await deployments.readCurrentTemplateWithNestedStacks(rootStack);
+  const deployedTemplate = rootTemplate.deployedRootTemplate;
+  const nestedStacks = rootTemplate.nestedStacks;
 
   // THEN
   expect(deployedTemplate).toEqual({
@@ -602,11 +697,11 @@ test('readCurrentTemplateWithNestedStacks() on an undeployed parent stack with a
     stackName: 'UndeployedParent',
     stackId: 'StackId',
   });
-  CloudFormationStack.lookup = (async (_cfn, _stackName: string) => {
+  CloudFormationStack.lookup = async (_cfn, _stackName: string) => {
     cfnStack.template = async () => ({});
 
     return cfnStack;
-  });
+  };
   const rootStack = testStack({
     stackName: 'UndeployedParent',
     template: {
@@ -727,11 +822,16 @@ test('readCurrentTemplateWithNestedStacks() caches calls to listStackResources()
     },
   });
 
-  pushStackResourceSummaries('CachingRoot',
-    stackSummaryOf('NestedStackA', 'AWS::CloudFormation::Stack',
+  pushStackResourceSummaries(
+    'CachingRoot',
+    stackSummaryOf(
+      'NestedStackA',
+      'AWS::CloudFormation::Stack',
       'arn:aws:cloudformation:bermuda-triangle-1337:123456789012:stack/one-resource-stack/abcd',
     ),
-    stackSummaryOf('NestedStackB', 'AWS::CloudFormation::Stack',
+    stackSummaryOf(
+      'NestedStackB',
+      'AWS::CloudFormation::Stack',
       'arn:aws:cloudformation:bermuda-triangle-1337:123456789012:stack/one-resource-stack/abcd',
     ),
   );
@@ -740,11 +840,13 @@ test('readCurrentTemplateWithNestedStacks() caches calls to listStackResources()
   await deployments.readCurrentTemplateWithNestedStacks(rootStack);
 
   // THEN
-  expect(numberOfTimesListStackResourcesWasCalled).toEqual(1);
+  expect(mockCloudFormationClient).toHaveReceivedCommandTimes(ListStackResourcesCommand, 1);
 });
 
-test('rollback stack assumes role if necessary', async() => {
-  const mockForEnvironment = jest.fn().mockImplementation(() => { return { sdk: sdkProvider.sdk }; });
+test('rollback stack assumes role if necessary', async () => {
+  const mockForEnvironment = jest.fn().mockImplementation(() => {
+    return { sdk };
+  });
   sdkProvider.forEnvironment = mockForEnvironment;
   givenStacks({
     '*': { template: {} },
@@ -760,12 +862,16 @@ test('rollback stack assumes role if necessary', async() => {
     validateBootstrapStackVersion: false,
   });
 
-  expect(mockForEnvironment).toHaveBeenCalledWith(expect.anything(), expect.anything(), expect.objectContaining({
-    assumeRoleArn: 'bloop:here:123456789012',
-  }));
+  expect(mockForEnvironment).toHaveBeenCalledWith(
+    expect.anything(),
+    expect.anything(),
+    expect.objectContaining({
+      assumeRoleArn: 'bloop:here:123456789012',
+    }),
+  );
 });
 
-test('rollback stack allows rolling back from UPDATE_FAILED', async() => {
+test('rollback stack allows rolling back from UPDATE_FAILED', async () => {
   // GIVEN
   givenStacks({
     '*': { template: {}, stackStatus: 'UPDATE_FAILED' },
@@ -778,10 +884,10 @@ test('rollback stack allows rolling back from UPDATE_FAILED', async() => {
   });
 
   // THEN
-  expect(mockRollbackStack).toHaveBeenCalled();
+  expect(mockCloudFormationClient).toHaveReceivedCommand(RollbackStackCommand);
 });
 
-test('rollback stack allows continue rollback from UPDATE_ROLLBACK_FAILED', async() => {
+test('rollback stack allows continue rollback from UPDATE_ROLLBACK_FAILED', async () => {
   // GIVEN
   givenStacks({
     '*': { template: {}, stackStatus: 'UPDATE_ROLLBACK_FAILED' },
@@ -794,10 +900,10 @@ test('rollback stack allows continue rollback from UPDATE_ROLLBACK_FAILED', asyn
   });
 
   // THEN
-  expect(mockContinueUpdateRollback).toHaveBeenCalled();
+  expect(mockCloudFormationClient).toHaveReceivedCommand(ContinueUpdateRollbackCommand);
 });
 
-test('rollback stack fails in UPDATE_COMPLETE state', async() => {
+test('rollback stack fails in UPDATE_COMPLETE state', async () => {
   // GIVEN
   givenStacks({
     '*': { template: {}, stackStatus: 'UPDATE_COMPLETE' },
@@ -813,12 +919,12 @@ test('rollback stack fails in UPDATE_COMPLETE state', async() => {
   expect(response.notInRollbackableState).toBe(true);
 });
 
-test('continue rollback stack with force ignores any failed resources', async() => {
+test('continue rollback stack with force ignores any failed resources', async () => {
   // GIVEN
   givenStacks({
     '*': { template: {}, stackStatus: 'UPDATE_ROLLBACK_FAILED' },
   });
-  mockDescribeStackEvents.mockReturnValue({
+  mockCloudFormationClient.on(DescribeStackEventsCommand).resolves({
     StackEvents: [
       {
         EventId: 'asdf',
@@ -839,13 +945,26 @@ test('continue rollback stack with force ignores any failed resources', async()
   });
 
   // THEN
-  expect(mockContinueUpdateRollback).toHaveBeenCalledWith(expect.objectContaining({
+  expect(mockCloudFormationClient).toHaveReceivedCommandWith(ContinueUpdateRollbackCommand, {
     ResourcesToSkip: ['Xyz'],
-  }));
+    StackName: 'boop',
+    ClientRequestToken: expect.anything(),
+  });
 });
 
-test('readCurrentTemplateWithNestedStacks() succesfully ignores stacks without metadata', async () => {
+test('readCurrentTemplateWithNestedStacks() successfully ignores stacks without metadata', async () => {
   // GIVEN
+  const rootSummary = stackSummaryOf(
+    'WithMetadata',
+    'AWS::CloudFormation::Stack',
+    'arn:aws:cloudformation:bermuda-triangle-1337:123456789012:stack/one-resource-stack/abcd',
+  );
+
+  pushStackResourceSummaries('MetadataRoot', rootSummary);
+  mockCloudFormationClient.on(ListStackResourcesCommand).resolves({
+    StackResourceSummaries: [rootSummary],
+  });
+
   givenStacks({
     'MetadataRoot': {
       template: {
@@ -906,10 +1025,6 @@ test('readCurrentTemplateWithNestedStacks() succesfully ignores stacks without m
     },
   });
 
-  pushStackResourceSummaries('MetadataRoot', stackSummaryOf('WithMetadata', 'AWS::CloudFormation::Stack',
-    'arn:aws:cloudformation:bermuda-triangle-1337:123456789012:stack/one-resource-stack/abcd',
-  ));
-
   // WHEN
   const deployedTemplate = (await deployments.readCurrentTemplateWithNestedStacks(rootStack)).deployedRootTemplate;
   const nestedStacks = (await deployments.readCurrentTemplateWithNestedStacks(rootStack)).nestedStacks;
@@ -931,20 +1046,23 @@ test('readCurrentTemplateWithNestedStacks() succesfully ignores stacks without m
 
   expect(rootStack.template).toEqual({
     Resources: {
-      WithoutMetadata: { // Unchanged
+      WithoutMetadata: {
+        // Unchanged
         Type: 'AWS::CloudFormation::Stack',
         Properties: {
           TemplateURL: 'https://www.magic-url.com',
         },
       },
-      WithEmptyMetadata: { // Unchanged
+      WithEmptyMetadata: {
+        // Unchanged
         Type: 'AWS::CloudFormation::Stack',
         Properties: {
           TemplateURL: 'https://www.magic-url.com',
         },
         Metadata: {},
       },
-      WithMetadata: { // Changed
+      WithMetadata: {
+        // Changed
         Type: 'AWS::CloudFormation::Stack',
         Properties: {
           TemplateURL: 'https://www.magic-url.com',
@@ -955,6 +1073,7 @@ test('readCurrentTemplateWithNestedStacks() succesfully ignores stacks without m
       },
     },
   });
+
   expect(nestedStacks).toEqual({
     WithMetadata: {
       deployedTemplate: {
@@ -983,7 +1102,7 @@ test('readCurrentTemplateWithNestedStacks() succesfully ignores stacks without m
   });
 });
 
-function pushStackResourceSummaries(stackName: string, ...items: CloudFormation.StackResourceSummary[]) {
+function pushStackResourceSummaries(stackName: string, ...items: StackResourceSummary[]) {
   if (!currentCfnStackResources[stackName]) {
     currentCfnStackResources[stackName] = [];
   }
@@ -991,12 +1110,12 @@ function pushStackResourceSummaries(stackName: string, ...items: CloudFormation.
   currentCfnStackResources[stackName].push(...items);
 }
 
-function stackSummaryOf(logicalId: string, resourceType: string, physicalResourceId: string): CloudFormation.StackResourceSummary {
+function stackSummaryOf(logicalId: string, resourceType: string, physicalResourceId: string): StackResourceSummary {
   return {
     LogicalResourceId: logicalId,
     PhysicalResourceId: physicalResourceId,
     ResourceType: resourceType,
-    ResourceStatus: 'CREATE_COMPLETE',
+    ResourceStatus: StackStatus.CREATE_COMPLETE,
     LastUpdatedTimestamp: new Date(),
   };
 }
@@ -1019,4 +1138,4 @@ function givenStacks(stacks: Record<string, { template: any; stackStatus?: strin
       return new FakeCloudformationStack({ stackName });
     }
   });
-}
\ No newline at end of file
+}
diff --git a/packages/aws-cdk/test/api/deploy-stack.test.ts b/packages/aws-cdk/test/api/deploy-stack.test.ts
index 4aec7cc9ff7d1..81d5d75689d16 100644
--- a/packages/aws-cdk/test/api/deploy-stack.test.ts
+++ b/packages/aws-cdk/test/api/deploy-stack.test.ts
@@ -1,11 +1,34 @@
-/* eslint-disable import/order */
+import {
+  ChangeSetStatus,
+  ChangeSetType,
+  CreateChangeSetCommand,
+  type CreateChangeSetCommandInput,
+  CreateStackCommand,
+  DeleteChangeSetCommand,
+  DeleteStackCommand,
+  DescribeChangeSetCommand,
+  DescribeStacksCommand,
+  ExecuteChangeSetCommand,
+  type ExecuteChangeSetCommandInput,
+  GetTemplateCommand,
+  type Stack,
+  StackStatus,
+  UpdateStackCommand,
+  UpdateTerminationProtectionCommand,
+} from '@aws-sdk/client-cloudformation';
 import { deployStack, DeployStackOptions } from '../../lib/api';
+import { NoBootstrapStackEnvironmentResources } from '../../lib/api/environment-resources';
 import { HotswapMode } from '../../lib/api/hotswap/common';
 import { tryHotswapDeployment } from '../../lib/api/hotswap-deployments';
 import { setCI } from '../../lib/logging';
 import { DEFAULT_FAKE_TEMPLATE, testStack } from '../util';
-import { MockedObject, mockResolvedEnvironment, MockSdk, MockSdkProvider, SyncHandlerSubsetOf } from '../util/mock-sdk';
-import { NoBootstrapStackEnvironmentResources } from '../../lib/api/environment-resources';
+import {
+  mockCloudFormationClient,
+  mockResolvedEnvironment,
+  MockSdk,
+  MockSdkProvider,
+  restoreSdkMocksToDefault,
+} from '../util/mock-sdk';
 
 jest.mock('../../lib/api/hotswap-deployments');
 
@@ -30,50 +53,52 @@ const FAKE_STACK_TERMINATION_PROTECTION = testStack({
   terminationProtection: true,
 });
 
+const baseResponse = {
+  StackName: 'mock-stack-name',
+  StackId: 'mock-stack-id',
+  CreationTime: new Date(),
+  StackStatus: StackStatus.CREATE_COMPLETE,
+  EnableTerminationProtection: false,
+};
+
 let sdk: MockSdk;
 let sdkProvider: MockSdkProvider;
-let cfnMocks: MockedObject<SyncHandlerSubsetOf<AWS.CloudFormation>>;
-let stderrMock: jest.SpyInstance;
-let stdoutMock: jest.SpyInstance;
 
 beforeEach(() => {
-  jest.resetAllMocks();
-  stderrMock = jest.spyOn(process.stderr, 'write').mockImplementation(() => { return true; });
-  stdoutMock = jest.spyOn(process.stdout, 'write').mockImplementation(() => { return true; });
-
   sdkProvider = new MockSdkProvider();
   sdk = new MockSdk();
+  sdk.getUrlSuffix = () => Promise.resolve('amazonaws.com');
+  jest.resetAllMocks();
 
-  cfnMocks = {
-    describeStackEvents: jest.fn().mockReturnValue({}),
-    describeStacks: jest.fn()
-      // First call, no stacks exist
-      .mockImplementationOnce(() => ({ Stacks: [] }))
-      // Second call, stack has been created
-      .mockImplementationOnce(() => ({
-        Stacks: [
-          {
-            StackStatus: 'CREATE_COMPLETE',
-            StackStatusReason: 'It is magic',
-            EnableTerminationProtection: false,
-          },
-        ],
-      })),
-    createChangeSet: jest.fn((_o) => ({})),
-    deleteChangeSet: jest.fn((_o) => ({})),
-    updateStack: jest.fn((_o) => ({})),
-    createStack: jest.fn((_o) => ({})),
-    describeChangeSet: jest.fn((_o) => ({
-      Status: 'CREATE_COMPLETE',
-      Changes: [],
-    })),
-    executeChangeSet: jest.fn((_o) => ({})),
-    deleteStack: jest.fn((_o) => ({})),
-    getTemplate: jest.fn((_o) => ({ TemplateBody: JSON.stringify(DEFAULT_FAKE_TEMPLATE) })),
-    updateTerminationProtection: jest.fn((_o) => ({ StackId: 'stack-id' })),
-  };
-  sdk.stubCloudFormation(cfnMocks as any);
-  sdk.stubGetEndpointSuffix(() => 'amazonaws.com');
+  restoreSdkMocksToDefault();
+  mockCloudFormationClient
+    .on(DescribeStacksCommand)
+    // First call, no stacks exis
+    .resolvesOnce({
+      Stacks: [],
+    })
+    // Second call, stack has been created
+    .resolves({
+      Stacks: [
+        {
+          StackStatus: StackStatus.CREATE_COMPLETE,
+          StackStatusReason: 'It is magic',
+          EnableTerminationProtection: false,
+          StackName: 'MagicalStack',
+          CreationTime: new Date(),
+        },
+      ],
+    });
+  mockCloudFormationClient.on(DescribeChangeSetCommand).resolves({
+    Status: StackStatus.CREATE_COMPLETE,
+    Changes: [],
+  });
+  mockCloudFormationClient.on(GetTemplateCommand).resolves({
+    TemplateBody: JSON.stringify(DEFAULT_FAKE_TEMPLATE),
+  });
+  mockCloudFormationClient.on(UpdateTerminationProtectionCommand).resolves({
+    StackId: 'stack-id',
+  });
 });
 
 function standardDeployStackArguments(): DeployStackOptions {
@@ -89,6 +114,7 @@ function standardDeployStackArguments(): DeployStackOptions {
 
 test("calls tryHotswapDeployment() if 'hotswap' is `HotswapMode.CLASSIC`", async () => {
   // WHEN
+  const spyOnSdk = jest.spyOn(sdk, 'appendCustomUserAgent');
   await deployStack({
     ...standardDeployStackArguments(),
     hotswap: HotswapMode.FALL_BACK,
@@ -98,25 +124,18 @@ test("calls tryHotswapDeployment() if 'hotswap' is `HotswapMode.CLASSIC`", async
   // THEN
   expect(tryHotswapDeployment).toHaveBeenCalled();
   // check that the extra User-Agent is honored
-  expect(sdk.appendCustomUserAgent).toHaveBeenCalledWith('extra-user-agent');
+  expect(spyOnSdk).toHaveBeenCalledWith('extra-user-agent');
   // check that the fallback has been called if hotswapping failed
-  expect(sdk.appendCustomUserAgent).toHaveBeenCalledWith('cdk-hotswap/fallback');
+  expect(spyOnSdk).toHaveBeenCalledWith('cdk-hotswap/fallback');
 });
 
 test("calls tryHotswapDeployment() if 'hotswap' is `HotswapMode.HOTSWAP_ONLY`", async () => {
-  cfnMocks.describeStacks = jest.fn()
-    // we need the first call to return something in the Stacks prop,
-    // otherwise the access to `stackId` will fail
-    .mockImplementation(() => ({
-      Stacks: [
-        {
-          StackStatus: 'CREATE_COMPLETE',
-          StackStatusReason: 'It is magic',
-          EnableTerminationProtection: false,
-        },
-      ],
-    }));
-  sdk.stubCloudFormation(cfnMocks as any);
+  // we need the first call to return something in the Stacks prop,
+  // otherwise the access to `stackId` will fail
+  mockCloudFormationClient.on(DescribeStacksCommand).resolves({
+    Stacks: [{ ...baseResponse }],
+  });
+  const spyOnSdk = jest.spyOn(sdk, 'appendCustomUserAgent');
   // WHEN
   const deployStackResult = await deployStack({
     ...standardDeployStackArguments(),
@@ -129,9 +148,9 @@ test("calls tryHotswapDeployment() if 'hotswap' is `HotswapMode.HOTSWAP_ONLY`",
   expect(deployStackResult.noOp).toEqual(true);
   expect(tryHotswapDeployment).toHaveBeenCalled();
   // check that the extra User-Agent is honored
-  expect(sdk.appendCustomUserAgent).toHaveBeenCalledWith('extra-user-agent');
+  expect(spyOnSdk).toHaveBeenCalledWith('extra-user-agent');
   // check that the fallback has not been called if hotswapping failed
-  expect(sdk.appendCustomUserAgent).not.toHaveBeenCalledWith('cdk-hotswap/fallback');
+  expect(spyOnSdk).not.toHaveBeenCalledWith('cdk-hotswap/fallback');
 });
 
 test('correctly passes CFN parameters when hotswapping', async () => {
@@ -148,14 +167,23 @@ test('correctly passes CFN parameters when hotswapping', async () => {
   });
 
   // THEN
-  expect(tryHotswapDeployment).toHaveBeenCalledWith(expect.anything(), { A: 'A-value', B: 'B=value' }, expect.anything(), expect.anything(), HotswapMode.FALL_BACK);
+  expect(tryHotswapDeployment).toHaveBeenCalledWith(
+    expect.anything(),
+    { A: 'A-value', B: 'B=value' },
+    expect.anything(),
+    expect.anything(),
+    HotswapMode.FALL_BACK,
+  );
 });
 
 test('correctly passes SSM parameters when hotswapping', async () => {
   // GIVEN
-  givenStackExists({
-    Parameters: [
-      { ParameterKey: 'SomeParameter', ParameterValue: 'ParameterName', ResolvedValue: 'SomeValue' },
+  mockCloudFormationClient.on(DescribeStacksCommand).resolves({
+    Stacks: [
+      {
+        ...baseResponse,
+        Parameters: [{ ParameterKey: 'SomeParameter', ParameterValue: 'ParameterName', ResolvedValue: 'SomeValue' }],
+      },
     ],
   });
 
@@ -178,7 +206,13 @@ test('correctly passes SSM parameters when hotswapping', async () => {
   });
 
   // THEN
-  expect(tryHotswapDeployment).toHaveBeenCalledWith(expect.anything(), { SomeParameter: 'SomeValue' }, expect.anything(), expect.anything(), HotswapMode.FALL_BACK);
+  expect(tryHotswapDeployment).toHaveBeenCalledWith(
+    expect.anything(),
+    { SomeParameter: 'SomeValue' },
+    expect.anything(),
+    expect.anything(),
+    HotswapMode.FALL_BACK,
+  );
 });
 
 test('call CreateStack when method=direct and the stack doesnt exist yet', async () => {
@@ -189,12 +223,14 @@ test('call CreateStack when method=direct and the stack doesnt exist yet', async
   });
 
   // THEN
-  expect(cfnMocks.createStack).toHaveBeenCalled();
+  expect(mockCloudFormationClient).toHaveReceivedCommand(CreateStackCommand);
 });
 
 test('call UpdateStack when method=direct and the stack exists already', async () => {
   // WHEN
-  givenStackExists();
+  mockCloudFormationClient.on(DescribeStacksCommand).resolves({
+    Stacks: [{ ...baseResponse }],
+  });
 
   await deployStack({
     ...standardDeployStackArguments(),
@@ -203,17 +239,18 @@ test('call UpdateStack when method=direct and the stack exists already', async (
   });
 
   // THEN
-  expect(cfnMocks.updateStack).toHaveBeenCalled();
+  expect(mockCloudFormationClient).toHaveReceivedCommand(UpdateStackCommand);
 });
 
 test('method=direct and no updates to be performed', async () => {
-  cfnMocks.updateStack?.mockRejectedValueOnce({
-    code: 'ValidationError',
-    message: 'No updates are to be performed.',
-  } as never);
+  const error = new Error('No updates are to be performed.');
+  error.name = 'ValidationError';
+  mockCloudFormationClient.on(UpdateStackCommand).rejectsOnce(error);
 
   // WHEN
-  givenStackExists();
+  mockCloudFormationClient.on(DescribeStacksCommand).resolves({
+    Stacks: [{ ...baseResponse }],
+  });
 
   const ret = await deployStack({
     ...standardDeployStackArguments(),
@@ -245,9 +282,12 @@ test("rollback still defaults to enabled even if 'hotswap' is enabled", async ()
   });
 
   // THEN
-  expect(cfnMocks.executeChangeSet).not.toHaveBeenCalledWith(expect.objectContaining({
-    DisableRollback: true,
-  }));
+  expect(mockCloudFormationClient).not.toHaveReceivedCommandWith(
+    ExecuteChangeSetCommand,
+    expect.objectContaining({
+      DisableRollback: true,
+    }),
+  );
 });
 
 test("rollback defaults to enabled if 'hotswap' is undefined", async () => {
@@ -259,10 +299,13 @@ test("rollback defaults to enabled if 'hotswap' is undefined", async () => {
   });
 
   // THEN
-  expect(cfnMocks.executeChangeSet).toHaveBeenCalledTimes(1);
-  expect(cfnMocks.executeChangeSet).not.toHaveBeenCalledWith(expect.objectContaining({
-    DisableRollback: expect.anything(),
-  }));
+  expect(mockCloudFormationClient).toHaveReceivedCommandTimes(ExecuteChangeSetCommand, 1);
+  expect(mockCloudFormationClient).not.toHaveReceivedCommandWith(
+    ExecuteChangeSetCommand,
+    expect.objectContaining({
+      DisableRollback: true,
+    }),
+  );
 });
 
 test('do deploy executable change set with 0 changes', async () => {
@@ -273,7 +316,7 @@ test('do deploy executable change set with 0 changes', async () => {
 
   // THEN
   expect(ret.noOp).toBeFalsy();
-  expect(cfnMocks.executeChangeSet).toHaveBeenCalled();
+  expect(mockCloudFormationClient).toHaveReceivedCommand(ExecuteChangeSetCommand);
 });
 
 test('correctly passes CFN parameters, ignoring ones with empty values', async () => {
@@ -289,20 +332,27 @@ test('correctly passes CFN parameters, ignoring ones with empty values', async (
   });
 
   // THEN
-  expect(cfnMocks.createChangeSet).toHaveBeenCalledWith(expect.objectContaining({
+  expect(mockCloudFormationClient).toHaveReceivedCommandWith(CreateChangeSetCommand, {
+    ...expect.anything,
     Parameters: [
       { ParameterKey: 'A', ParameterValue: 'A-value' },
       { ParameterKey: 'B', ParameterValue: 'B=value' },
     ],
-  }));
+    TemplateBody: expect.any(String),
+  } as CreateChangeSetCommandInput);
 });
 
 test('reuse previous parameters if requested', async () => {
   // GIVEN
-  givenStackExists({
-    Parameters: [
-      { ParameterKey: 'HasValue', ParameterValue: 'TheValue' },
-      { ParameterKey: 'HasDefault', ParameterValue: 'TheOldValue' },
+  mockCloudFormationClient.on(DescribeStacksCommand).resolves({
+    Stacks: [
+      {
+        ...baseResponse,
+        Parameters: [
+          { ParameterKey: 'HasValue', ParameterValue: 'TheValue' },
+          { ParameterKey: 'HasDefault', ParameterValue: 'TheOldValue' },
+        ],
+      },
     ],
   });
 
@@ -317,18 +367,28 @@ test('reuse previous parameters if requested', async () => {
   });
 
   // THEN
-  expect(cfnMocks.createChangeSet).toHaveBeenCalledWith(expect.objectContaining({
+  expect(mockCloudFormationClient).toHaveReceivedCommandWith(CreateChangeSetCommand, {
+    ...expect.anything,
     Parameters: [
       { ParameterKey: 'HasValue', UsePreviousValue: true },
       { ParameterKey: 'HasDefault', UsePreviousValue: true },
       { ParameterKey: 'OtherParameter', ParameterValue: 'SomeValue' },
     ],
-  }));
+  } as CreateChangeSetCommandInput);
 });
 
 describe('ci=true', () => {
+  let stderrMock: jest.SpyInstance;
+  let stdoutMock: jest.SpyInstance;
   beforeEach(() => {
     setCI(true);
+    jest.resetAllMocks();
+    stderrMock = jest.spyOn(process.stderr, 'write').mockImplementation(() => {
+      return true;
+    });
+    stdoutMock = jest.spyOn(process.stdout, 'write').mockImplementation(() => {
+      return true;
+    });
   });
   afterEach(() => {
     setCI(false);
@@ -348,10 +408,15 @@ describe('ci=true', () => {
 
 test('do not reuse previous parameters if not requested', async () => {
   // GIVEN
-  givenStackExists({
-    Parameters: [
-      { ParameterKey: 'HasValue', ParameterValue: 'TheValue' },
-      { ParameterKey: 'HasDefault', ParameterValue: 'TheOldValue' },
+  mockCloudFormationClient.on(DescribeStacksCommand).resolves({
+    Stacks: [
+      {
+        ...baseResponse,
+        Parameters: [
+          { ParameterKey: 'HasValue', ParameterValue: 'TheValue' },
+          { ParameterKey: 'HasDefault', ParameterValue: 'TheOldValue' },
+        ],
+      },
     ],
   });
 
@@ -366,36 +431,51 @@ test('do not reuse previous parameters if not requested', async () => {
   });
 
   // THEN
-  expect(cfnMocks.createChangeSet).toHaveBeenCalledWith(expect.objectContaining({
+  expect(mockCloudFormationClient).toHaveReceivedCommandWith(CreateChangeSetCommand, {
+    ...expect.anything,
+    ChangeSetType: ChangeSetType.UPDATE,
     Parameters: [
       { ParameterKey: 'HasValue', ParameterValue: 'SomeValue' },
       { ParameterKey: 'OtherParameter', ParameterValue: 'SomeValue' },
     ],
-  }));
+  } as CreateChangeSetCommandInput);
 });
 
 test('throw exception if not enough parameters supplied', async () => {
   // GIVEN
-  givenStackExists({
-    Parameters: [
-      { ParameterKey: 'HasValue', ParameterValue: 'TheValue' },
-      { ParameterKey: 'HasDefault', ParameterValue: 'TheOldValue' },
+  mockCloudFormationClient.on(DescribeStacksCommand).resolves({
+    Stacks: [
+      {
+        ...baseResponse,
+        Parameters: [
+          { ParameterKey: 'HasValue', ParameterValue: 'TheValue' },
+          { ParameterKey: 'HasDefault', ParameterValue: 'TheOldValue' },
+        ],
+      },
     ],
   });
 
   // WHEN
-  await expect(deployStack({
-    ...standardDeployStackArguments(),
-    stack: FAKE_STACK_WITH_PARAMETERS,
-    parameters: {
-      OtherParameter: 'SomeValue',
-    },
-  })).rejects.toThrow(/CloudFormation Parameters are missing a value/);
+  await expect(
+    deployStack({
+      ...standardDeployStackArguments(),
+      stack: FAKE_STACK_WITH_PARAMETERS,
+      parameters: {
+        OtherParameter: 'SomeValue',
+      },
+    }),
+  ).rejects.toThrow(/CloudFormation Parameters are missing a value/);
 });
 
 test('deploy is skipped if template did not change', async () => {
   // GIVEN
-  givenStackExists();
+  mockCloudFormationClient.on(DescribeStacksCommand).resolves({
+    Stacks: [
+      {
+        ...baseResponse,
+      },
+    ],
+  });
 
   // WHEN
   await deployStack({
@@ -403,17 +483,22 @@ test('deploy is skipped if template did not change', async () => {
   });
 
   // THEN
-  expect(cfnMocks.executeChangeSet).not.toBeCalled();
+  expect(mockCloudFormationClient).not.toHaveReceivedCommand(ExecuteChangeSetCommand);
 });
 
 test('deploy is skipped if parameters are the same', async () => {
   // GIVEN
   givenTemplateIs(FAKE_STACK_WITH_PARAMETERS.template);
-  givenStackExists({
-    Parameters: [
-      { ParameterKey: 'HasValue', ParameterValue: 'HasValue' },
-      { ParameterKey: 'HasDefault', ParameterValue: 'HasDefault' },
-      { ParameterKey: 'OtherParameter', ParameterValue: 'OtherParameter' },
+  mockCloudFormationClient.on(DescribeStacksCommand).resolves({
+    Stacks: [
+      {
+        ...baseResponse,
+        Parameters: [
+          { ParameterKey: 'HasValue', ParameterValue: 'TheValue' },
+          { ParameterKey: 'HasDefault', ParameterValue: 'TheOldValue' },
+          { ParameterKey: 'OtherParameter', ParameterValue: 'OtherParameter' },
+        ],
+      },
     ],
   });
 
@@ -426,17 +511,22 @@ test('deploy is skipped if parameters are the same', async () => {
   });
 
   // THEN
-  expect(cfnMocks.createChangeSet).not.toHaveBeenCalled();
+  expect(mockCloudFormationClient).not.toHaveReceivedCommand(CreateChangeSetCommand);
 });
 
 test('deploy is not skipped if parameters are different', async () => {
   // GIVEN
   givenTemplateIs(FAKE_STACK_WITH_PARAMETERS.template);
-  givenStackExists({
-    Parameters: [
-      { ParameterKey: 'HasValue', ParameterValue: 'HasValue' },
-      { ParameterKey: 'HasDefault', ParameterValue: 'HasDefault' },
-      { ParameterKey: 'OtherParameter', ParameterValue: 'OtherParameter' },
+  mockCloudFormationClient.on(DescribeStacksCommand).resolves({
+    Stacks: [
+      {
+        ...baseResponse,
+        Parameters: [
+          { ParameterKey: 'HasValue', ParameterValue: 'TheValue' },
+          { ParameterKey: 'HasDefault', ParameterValue: 'TheOldValue' },
+          { ParameterKey: 'OtherParameter', ParameterValue: 'OtherParameter' },
+        ],
+      },
     ],
   });
 
@@ -451,13 +541,15 @@ test('deploy is not skipped if parameters are different', async () => {
   });
 
   // THEN
-  expect(cfnMocks.createChangeSet).toHaveBeenCalledWith(expect.objectContaining({
+  expect(mockCloudFormationClient).toHaveReceivedCommandWith(CreateChangeSetCommand, {
+    ...expect.anything,
+    ChangeSetType: ChangeSetType.UPDATE,
     Parameters: [
       { ParameterKey: 'HasValue', ParameterValue: 'NewValue' },
       { ParameterKey: 'HasDefault', UsePreviousValue: true },
       { ParameterKey: 'OtherParameter', UsePreviousValue: true },
     ],
-  }));
+  } as CreateChangeSetCommandInput);
 });
 
 test('deploy is skipped if notificationArns are the same', async () => {
@@ -475,7 +567,7 @@ test('deploy is skipped if notificationArns are the same', async () => {
   });
 
   // THEN
-  expect(cfnMocks.createChangeSet).not.toHaveBeenCalled();
+  expect(mockCloudFormationClient).not.toHaveReceivedCommand(CreateChangeSetCommand);
 });
 
 test('deploy is not skipped if notificationArns are different', async () => {
@@ -493,16 +585,37 @@ test('deploy is not skipped if notificationArns are different', async () => {
   });
 
   // THEN
-  expect(cfnMocks.createChangeSet).toHaveBeenCalled();
+  expect(mockCloudFormationClient).toHaveReceivedCommand(CreateChangeSetCommand);
 });
 
 test('if existing stack failed to create, it is deleted and recreated', async () => {
   // GIVEN
-  givenStackExists(
-    { StackStatus: 'ROLLBACK_COMPLETE' }, // This is for the initial check
-    { StackStatus: 'DELETE_COMPLETE' }, // Poll the successful deletion
-    { StackStatus: 'CREATE_COMPLETE' }, // Poll the recreation
-  );
+  mockCloudFormationClient
+    .on(DescribeStacksCommand)
+    .resolvesOnce({
+      Stacks: [
+        {
+          ...baseResponse,
+          StackStatus: StackStatus.ROLLBACK_COMPLETE,
+        },
+      ],
+    })
+    .resolvesOnce({
+      Stacks: [
+        {
+          ...baseResponse,
+          StackStatus: StackStatus.DELETE_COMPLETE,
+        },
+      ],
+    })
+    .resolves({
+      Stacks: [
+        {
+          ...baseResponse,
+          StackStatus: StackStatus.CREATE_COMPLETE,
+        },
+      ],
+    });
   givenTemplateIs({
     DifferentThan: 'TheDefault',
   });
@@ -513,19 +626,41 @@ test('if existing stack failed to create, it is deleted and recreated', async ()
   });
 
   // THEN
-  expect(cfnMocks.deleteStack).toHaveBeenCalled();
-  expect(cfnMocks.createChangeSet).toHaveBeenCalledWith(expect.objectContaining({
-    ChangeSetType: 'CREATE',
-  }));
+  expect(mockCloudFormationClient).toHaveReceivedCommand(DeleteStackCommand);
+  expect(mockCloudFormationClient).toHaveReceivedCommandWith(CreateChangeSetCommand, {
+    ...expect.anything,
+    ChangeSetType: ChangeSetType.CREATE,
+  } as CreateChangeSetCommandInput);
 });
 
 test('if existing stack failed to create, it is deleted and recreated even if the template did not change', async () => {
   // GIVEN
-  givenStackExists(
-    { StackStatus: 'ROLLBACK_COMPLETE' }, // This is for the initial check
-    { StackStatus: 'DELETE_COMPLETE' }, // Poll the successful deletion
-    { StackStatus: 'CREATE_COMPLETE' }, // Poll the recreation
-  );
+  mockCloudFormationClient
+    .on(DescribeStacksCommand)
+    .resolvesOnce({
+      Stacks: [
+        {
+          ...baseResponse,
+          StackStatus: StackStatus.ROLLBACK_COMPLETE,
+        },
+      ],
+    })
+    .resolvesOnce({
+      Stacks: [
+        {
+          ...baseResponse,
+          StackStatus: StackStatus.DELETE_COMPLETE,
+        },
+      ],
+    })
+    .resolves({
+      Stacks: [
+        {
+          ...baseResponse,
+          StackStatus: StackStatus.CREATE_COMPLETE,
+        },
+      ],
+    });
 
   // WHEN
   await deployStack({
@@ -533,15 +668,18 @@ test('if existing stack failed to create, it is deleted and recreated even if th
   });
 
   // THEN
-  expect(cfnMocks.deleteStack).toHaveBeenCalled();
-  expect(cfnMocks.createChangeSet).toHaveBeenCalledWith(expect.objectContaining({
-    ChangeSetType: 'CREATE',
-  }));
+  expect(mockCloudFormationClient).toHaveReceivedCommand(DeleteStackCommand);
+  expect(mockCloudFormationClient).toHaveReceivedCommandWith(CreateChangeSetCommand, {
+    ...expect.anything,
+    ChangeSetType: ChangeSetType.CREATE,
+  } as CreateChangeSetCommandInput);
 });
 
 test('deploy not skipped if template did not change and --force is applied', async () => {
   // GIVEN
-  givenStackExists();
+  mockCloudFormationClient.on(DescribeStacksCommand).resolves({
+    Stacks: [{ ...baseResponse }],
+  });
 
   // WHEN
   await deployStack({
@@ -550,15 +688,20 @@ test('deploy not skipped if template did not change and --force is applied', asy
   });
 
   // THEN
-  expect(cfnMocks.executeChangeSet).toHaveBeenCalled();
+  expect(mockCloudFormationClient).toHaveReceivedCommandTimes(ExecuteChangeSetCommand, 1);
 });
 
 test('deploy is skipped if template and tags did not change', async () => {
   // GIVEN
-  givenStackExists({
-    Tags: [
-      { Key: 'Key1', Value: 'Value1' },
-      { Key: 'Key2', Value: 'Value2' },
+  mockCloudFormationClient.on(DescribeStacksCommand).resolves({
+    Stacks: [
+      {
+        ...baseResponse,
+        Tags: [
+          { Key: 'Key1', Value: 'Value1' },
+          { Key: 'Key2', Value: 'Value2' },
+        ],
+      },
     ],
   });
 
@@ -572,18 +715,21 @@ test('deploy is skipped if template and tags did not change', async () => {
   });
 
   // THEN
-  expect(cfnMocks.createChangeSet).not.toBeCalled();
-  expect(cfnMocks.executeChangeSet).not.toBeCalled();
-  expect(cfnMocks.describeStacks).toHaveBeenCalledWith({ StackName: 'withouterrors' });
-  expect(cfnMocks.getTemplate).toHaveBeenCalledWith({ StackName: 'withouterrors', TemplateStage: 'Original' });
+  expect(mockCloudFormationClient).not.toHaveReceivedCommand(CreateChangeSetCommand);
+  expect(mockCloudFormationClient).not.toHaveReceivedCommand(ExecuteChangeSetCommand);
+  expect(mockCloudFormationClient).toHaveReceivedCommandWith(DescribeStacksCommand, {
+    StackName: 'withouterrors',
+  });
+  expect(mockCloudFormationClient).toHaveReceivedCommandWith(GetTemplateCommand, {
+    StackName: 'withouterrors',
+    TemplateStage: 'Original',
+  });
 });
 
 test('deploy not skipped if template did not change but tags changed', async () => {
   // GIVEN
   givenStackExists({
-    Tags: [
-      { Key: 'Key', Value: 'Value' },
-    ],
+    Tags: [{ Key: 'Key', Value: 'Value' }],
   });
 
   // WHEN
@@ -603,18 +749,23 @@ test('deploy not skipped if template did not change but tags changed', async ()
   });
 
   // THEN
-  expect(cfnMocks.createChangeSet).toHaveBeenCalled();
-  expect(cfnMocks.executeChangeSet).toHaveBeenCalled();
-  expect(cfnMocks.describeChangeSet).toHaveBeenCalled();
-  expect(cfnMocks.describeStacks).toHaveBeenCalledWith({ StackName: 'withouterrors' });
-  expect(cfnMocks.getTemplate).toHaveBeenCalledWith({ StackName: 'withouterrors', TemplateStage: 'Original' });
+  expect(mockCloudFormationClient).toHaveReceivedCommand(CreateChangeSetCommand);
+  expect(mockCloudFormationClient).toHaveReceivedCommand(ExecuteChangeSetCommand);
+  expect(mockCloudFormationClient).toHaveReceivedCommand(DescribeChangeSetCommand);
+  expect(mockCloudFormationClient).toHaveReceivedCommandWith(DescribeStacksCommand, {
+    StackName: 'withouterrors',
+  });
+  expect(mockCloudFormationClient).toHaveReceivedCommandWith(GetTemplateCommand, {
+    StackName: 'withouterrors',
+    TemplateStage: 'Original',
+  });
 });
 
 test('deployStack reports no change if describeChangeSet returns specific error', async () => {
-  cfnMocks.describeChangeSet?.mockImplementation(() => ({
-    Status: 'FAILED',
+  mockCloudFormationClient.on(DescribeChangeSetCommand).resolvesOnce({
+    Status: ChangeSetStatus.FAILED,
     StatusReason: 'No updates are to be performed.',
-  }));
+  });
 
   // WHEN
   const deployResult = await deployStack({
@@ -627,51 +778,79 @@ test('deployStack reports no change if describeChangeSet returns specific error'
 
 test('deploy not skipped if template did not change but one tag removed', async () => {
   // GIVEN
-  givenStackExists({
-    Tags: [
-      { Key: 'Key1', Value: 'Value1' },
-      { Key: 'Key2', Value: 'Value2' },
+  mockCloudFormationClient.on(DescribeStacksCommand).resolves({
+    Stacks: [
+      {
+        ...baseResponse,
+        Tags: [
+          { Key: 'Key1', Value: 'Value1' },
+          { Key: 'Key2', Value: 'Value2' },
+        ],
+      },
     ],
   });
 
   // WHEN
   await deployStack({
     ...standardDeployStackArguments(),
-    tags: [
-      { Key: 'Key1', Value: 'Value1' },
-    ],
+    tags: [{ Key: 'Key1', Value: 'Value1' }],
   });
 
   // THEN
-  expect(cfnMocks.createChangeSet).toHaveBeenCalled();
-  expect(cfnMocks.executeChangeSet).toHaveBeenCalled();
-  expect(cfnMocks.describeChangeSet).toHaveBeenCalled();
-  expect(cfnMocks.describeStacks).toHaveBeenCalledWith({ StackName: 'withouterrors' });
-  expect(cfnMocks.getTemplate).toHaveBeenCalledWith({ StackName: 'withouterrors', TemplateStage: 'Original' });
+  expect(mockCloudFormationClient).toHaveReceivedCommand(CreateChangeSetCommand);
+  expect(mockCloudFormationClient).toHaveReceivedCommand(ExecuteChangeSetCommand);
+  expect(mockCloudFormationClient).toHaveReceivedCommand(DescribeChangeSetCommand);
+  expect(mockCloudFormationClient).toHaveReceivedCommandWith(DescribeStacksCommand, {
+    StackName: 'withouterrors',
+  });
+  expect(mockCloudFormationClient).toHaveReceivedCommandWith(GetTemplateCommand, {
+    StackName: 'withouterrors',
+    TemplateStage: 'Original',
+  });
 });
 
 test('deploy is not skipped if stack is in a _FAILED state', async () => {
   // GIVEN
-  givenStackExists({
-    StackStatus: 'DELETE_FAILED',
+  mockCloudFormationClient.on(DescribeStacksCommand).resolves({
+    Stacks: [
+      {
+        ...baseResponse,
+        StackStatus: StackStatus.DELETE_FAILED,
+      },
+    ],
   });
 
   // WHEN
   await deployStack({
     ...standardDeployStackArguments(),
     usePreviousParameters: true,
-  }).catch(() => { });
+  }).catch(() => {});
 
   // THEN
-  expect(cfnMocks.createChangeSet).toHaveBeenCalled();
+  expect(mockCloudFormationClient).toHaveReceivedCommand(CreateChangeSetCommand);
+  expect(mockCloudFormationClient).toHaveReceivedCommand(ExecuteChangeSetCommand);
 });
 
 test('existing stack in UPDATE_ROLLBACK_COMPLETE state can be updated', async () => {
   // GIVEN
-  givenStackExists(
-    { StackStatus: 'UPDATE_ROLLBACK_COMPLETE' }, // This is for the initial check
-    { StackStatus: 'UPDATE_COMPLETE' }, // Poll the update
-  );
+  mockCloudFormationClient
+    .on(DescribeStacksCommand)
+    .resolvesOnce({
+      Stacks: [
+        {
+          ...baseResponse,
+          StackStatus: StackStatus.UPDATE_ROLLBACK_COMPLETE,
+        },
+      ],
+    })
+    .resolves({
+      Stacks: [
+        {
+          ...baseResponse,
+          StackStatus: StackStatus.UPDATE_COMPLETE,
+        },
+      ],
+    });
   givenTemplateIs({ changed: 123 });
 
   // WHEN
@@ -680,15 +859,18 @@ test('existing stack in UPDATE_ROLLBACK_COMPLETE state can be updated', async ()
   });
 
   // THEN
-  expect(cfnMocks.deleteStack).not.toHaveBeenCalled();
-  expect(cfnMocks.createChangeSet).toHaveBeenCalledWith(expect.objectContaining({
-    ChangeSetType: 'UPDATE',
-  }));
+  expect(mockCloudFormationClient).not.toHaveReceivedCommand(DeleteStackCommand);
+  expect(mockCloudFormationClient).toHaveReceivedCommandWith(CreateChangeSetCommand, {
+    ...expect.anything,
+    ChangeSetType: ChangeSetType.UPDATE,
+  } as CreateChangeSetCommandInput);
 });
 
 test('deploy not skipped if template changed', async () => {
   // GIVEN
-  givenStackExists();
+  mockCloudFormationClient.on(DescribeStacksCommand).resolves({
+    Stacks: [{ ...baseResponse }],
+  });
   givenTemplateIs({ changed: 123 });
 
   // WHEN
@@ -697,7 +879,8 @@ test('deploy not skipped if template changed', async () => {
   });
 
   // THEN
-  expect(cfnMocks.executeChangeSet).toHaveBeenCalled();
+  expect(mockCloudFormationClient).toHaveReceivedCommand(CreateChangeSetCommand);
+  expect(mockCloudFormationClient).toHaveReceivedCommand(ExecuteChangeSetCommand);
 });
 
 test('not executed and no error if --no-execute is given', async () => {
@@ -708,17 +891,19 @@ test('not executed and no error if --no-execute is given', async () => {
   });
 
   // THEN
-  expect(cfnMocks.executeChangeSet).not.toHaveBeenCalled();
+  expect(mockCloudFormationClient).not.toHaveReceivedCommand(ExecuteChangeSetCommand);
 });
 
 test('empty change set is deleted if --execute is given', async () => {
-  cfnMocks.describeChangeSet?.mockImplementation(() => ({
-    Status: 'FAILED',
+  mockCloudFormationClient.on(DescribeChangeSetCommand).resolvesOnce({
+    Status: ChangeSetStatus.FAILED,
     StatusReason: 'No updates are to be performed.',
-  }));
+  });
 
   // GIVEN
-  givenStackExists();
+  mockCloudFormationClient.on(DescribeStacksCommand).resolves({
+    Stacks: [{ ...baseResponse }],
+  });
 
   // WHEN
   await deployStack({
@@ -728,21 +913,23 @@ test('empty change set is deleted if --execute is given', async () => {
   });
 
   // THEN
-  expect(cfnMocks.createChangeSet).toHaveBeenCalled();
-  expect(cfnMocks.executeChangeSet).not.toHaveBeenCalled();
+  expect(mockCloudFormationClient).toHaveReceivedCommand(CreateChangeSetCommand);
+  expect(mockCloudFormationClient).not.toHaveReceivedCommand(ExecuteChangeSetCommand);
 
   //the first deletion is for any existing cdk change sets, the second is for the deleting the new empty change set
-  expect(cfnMocks.deleteChangeSet).toHaveBeenCalledTimes(2);
+  expect(mockCloudFormationClient).toHaveReceivedCommandTimes(DeleteChangeSetCommand, 2);
 });
 
 test('empty change set is not deleted if --no-execute is given', async () => {
-  cfnMocks.describeChangeSet?.mockImplementation(() => ({
-    Status: 'FAILED',
+  mockCloudFormationClient.on(DescribeChangeSetCommand).resolvesOnce({
+    Status: ChangeSetStatus.FAILED,
     StatusReason: 'No updates are to be performed.',
-  }));
+  });
 
   // GIVEN
-  givenStackExists();
+  mockCloudFormationClient.on(DescribeStacksCommand).resolves({
+    Stacks: [{ ...baseResponse }],
+  });
 
   // WHEN
   await deployStack({
@@ -751,11 +938,11 @@ test('empty change set is not deleted if --no-execute is given', async () => {
   });
 
   // THEN
-  expect(cfnMocks.createChangeSet).toHaveBeenCalled();
-  expect(cfnMocks.executeChangeSet).not.toHaveBeenCalled();
+  expect(mockCloudFormationClient).toHaveReceivedCommand(CreateChangeSetCommand);
+  expect(mockCloudFormationClient).not.toHaveReceivedCommand(ExecuteChangeSetCommand);
 
   //the first deletion is for any existing cdk change sets
-  expect(cfnMocks.deleteChangeSet).toHaveBeenCalledTimes(1);
+  expect(mockCloudFormationClient).toHaveReceivedCommandTimes(DeleteChangeSetCommand, 1);
 });
 
 test('use S3 url for stack deployment if present in Stack Artifact', async () => {
@@ -771,10 +958,11 @@ test('use S3 url for stack deployment if present in Stack Artifact', async () =>
   });
 
   // THEN
-  expect(cfnMocks.createChangeSet).toHaveBeenCalledWith(expect.objectContaining({
+  expect(mockCloudFormationClient).toHaveReceivedCommandWith(CreateChangeSetCommand, {
+    ...expect.anything,
     TemplateURL: 'https://use-me-use-me/',
-  }));
-  expect(cfnMocks.executeChangeSet).toHaveBeenCalled();
+  } as CreateChangeSetCommandInput);
+  expect(mockCloudFormationClient).toHaveReceivedCommand(ExecuteChangeSetCommand);
 });
 
 test('use REST API S3 url with substituted placeholders if manifest url starts with s3://', async () => {
@@ -790,19 +978,25 @@ test('use REST API S3 url with substituted placeholders if manifest url starts w
   });
 
   // THEN
-  expect(cfnMocks.createChangeSet).toHaveBeenCalledWith(expect.objectContaining({
+  expect(mockCloudFormationClient).toHaveReceivedCommandWith(CreateChangeSetCommand, {
+    ...expect.anything,
     TemplateURL: 'https://s3.bermuda-triangle-1337.amazonaws.com/use-me-use-me-123456789/object',
-  }));
-  expect(cfnMocks.executeChangeSet).toHaveBeenCalled();
+  } as CreateChangeSetCommandInput);
+  expect(mockCloudFormationClient).toHaveReceivedCommand(ExecuteChangeSetCommand);
 });
 
 test('changeset is created when stack exists in REVIEW_IN_PROGRESS status', async () => {
   // GIVEN
-  givenStackExists({
-    StackStatus: 'REVIEW_IN_PROGRESS',
-    Tags: [
-      { Key: 'Key1', Value: 'Value1' },
-      { Key: 'Key2', Value: 'Value2' },
+  mockCloudFormationClient.on(DescribeStacksCommand).resolves({
+    Stacks: [
+      {
+        ...baseResponse,
+        StackStatus: StackStatus.REVIEW_IN_PROGRESS,
+        Tags: [
+          { Key: 'Key1', Value: 'Value1' },
+          { Key: 'Key2', Value: 'Value2' },
+        ],
+      },
     ],
   });
 
@@ -813,21 +1007,25 @@ test('changeset is created when stack exists in REVIEW_IN_PROGRESS status', asyn
   });
 
   // THEN
-  expect(cfnMocks.createChangeSet).toHaveBeenCalledWith(
-    expect.objectContaining({
-      ChangeSetType: 'CREATE',
-      StackName: 'withouterrors',
-    }),
-  );
-  expect(cfnMocks.executeChangeSet).not.toHaveBeenCalled();
+  expect(mockCloudFormationClient).toHaveReceivedCommandWith(CreateChangeSetCommand, {
+    ...expect.anything,
+    ChangeSetType: ChangeSetType.CREATE,
+    StackName: 'withouterrors',
+  } as CreateChangeSetCommandInput);
+  expect(mockCloudFormationClient).not.toHaveReceivedCommand(ExecuteChangeSetCommand);
 });
 
 test('changeset is updated when stack exists in CREATE_COMPLETE status', async () => {
   // GIVEN
-  givenStackExists({
-    Tags: [
-      { Key: 'Key1', Value: 'Value1' },
-      { Key: 'Key2', Value: 'Value2' },
+  mockCloudFormationClient.on(DescribeStacksCommand).resolves({
+    Stacks: [
+      {
+        ...baseResponse,
+        Tags: [
+          { Key: 'Key1', Value: 'Value1' },
+          { Key: 'Key2', Value: 'Value2' },
+        ],
+      },
     ],
   });
 
@@ -838,13 +1036,12 @@ test('changeset is updated when stack exists in CREATE_COMPLETE status', async (
   });
 
   // THEN
-  expect(cfnMocks.createChangeSet).toHaveBeenCalledWith(
-    expect.objectContaining({
-      ChangeSetType: 'UPDATE',
-      StackName: 'withouterrors',
-    }),
-  );
-  expect(cfnMocks.executeChangeSet).not.toHaveBeenCalled();
+  expect(mockCloudFormationClient).toHaveReceivedCommandWith(CreateChangeSetCommand, {
+    ...expect.anything,
+    ChangeSetType: ChangeSetType.UPDATE,
+    StackName: 'withouterrors',
+  } as CreateChangeSetCommandInput);
+  expect(mockCloudFormationClient).not.toHaveReceivedCommand(ExecuteChangeSetCommand);
 });
 
 test('deploy with termination protection enabled', async () => {
@@ -855,9 +1052,10 @@ test('deploy with termination protection enabled', async () => {
   });
 
   // THEN
-  expect(cfnMocks.updateTerminationProtection).toHaveBeenCalledWith(expect.objectContaining({
+  expect(mockCloudFormationClient).toHaveReceivedCommandWith(UpdateTerminationProtectionCommand, {
+    StackName: 'termination-protection',
     EnableTerminationProtection: true,
-  }));
+  });
 });
 
 test('updateTerminationProtection not called when termination protection is undefined', async () => {
@@ -867,13 +1065,18 @@ test('updateTerminationProtection not called when termination protection is unde
   });
 
   // THEN
-  expect(cfnMocks.updateTerminationProtection).not.toHaveBeenCalled();
+  expect(mockCloudFormationClient).not.toHaveReceivedCommand(UpdateTerminationProtectionCommand);
 });
 
 test('updateTerminationProtection called when termination protection is undefined and stack has termination protection', async () => {
   // GIVEN
-  givenStackExists({
-    EnableTerminationProtection: true,
+  mockCloudFormationClient.on(DescribeStacksCommand).resolves({
+    Stacks: [
+      {
+        ...baseResponse,
+        EnableTerminationProtection: true,
+      },
+    ],
   });
 
   // WHEN
@@ -882,9 +1085,10 @@ test('updateTerminationProtection called when termination protection is undefine
   });
 
   // THEN
-  expect(cfnMocks.updateTerminationProtection).toHaveBeenCalledWith(expect.objectContaining({
+  expect(mockCloudFormationClient).toHaveReceivedCommandWith(UpdateTerminationProtectionCommand, {
+    StackName: 'withouterrors',
     EnableTerminationProtection: false,
-  }));
+  });
 });
 
 describe('disable rollback', () => {
@@ -895,10 +1099,11 @@ describe('disable rollback', () => {
     });
 
     // THEN
-    expect(cfnMocks.executeChangeSet).toHaveBeenCalledTimes(1);
-    expect(cfnMocks.executeChangeSet).not.toHaveBeenCalledWith(expect.objectContaining({
-      DisableRollback: expect.anything(),
-    }));
+    expect(mockCloudFormationClient).toHaveReceivedCommandTimes(ExecuteChangeSetCommand, 1);
+    expect(mockCloudFormationClient).not.toHaveReceivedCommandWith(ExecuteChangeSetCommand, {
+      DisableRollback: expect.anything,
+      ChangeSetName: expect.any(String),
+    });
   });
 
   test('rollback can be disabled by setting rollback: false', async () => {
@@ -909,46 +1114,34 @@ describe('disable rollback', () => {
     });
 
     // THEN
-    expect(cfnMocks.executeChangeSet).toHaveBeenCalledWith(expect.objectContaining({
+    expect(mockCloudFormationClient).toHaveReceivedCommandWith(ExecuteChangeSetCommand, {
+      ...expect.anything,
       DisableRollback: true,
-    }));
+    } as ExecuteChangeSetCommandInput);
   });
-
 });
-
 /**
  * Set up the mocks so that it looks like the stack exists to start with
  *
  * The last element of this array will be continuously repeated.
  */
-function givenStackExists(...overrides: Array<Partial<AWS.CloudFormation.Stack>>) {
-  cfnMocks.describeStacks!.mockReset();
-
+function givenStackExists(...overrides: Array<Partial<Stack>>) {
   if (overrides.length === 0) {
     overrides = [{}];
   }
 
-  const baseResponse = {
-    StackName: 'mock-stack-name',
-    StackId: 'mock-stack-id',
-    CreationTime: new Date(),
-    StackStatus: 'CREATE_COMPLETE',
-    EnableTerminationProtection: false,
-  };
-
   for (const override of overrides.slice(0, overrides.length - 1)) {
-    cfnMocks.describeStacks!.mockImplementationOnce(() => ({
+    mockCloudFormationClient.on(DescribeStacksCommand).resolvesOnce({
       Stacks: [{ ...baseResponse, ...override }],
-    }));
+    });
   }
-  cfnMocks.describeStacks!.mockImplementation(() => ({
+  mockCloudFormationClient.on(DescribeStacksCommand).resolves({
     Stacks: [{ ...baseResponse, ...overrides[overrides.length - 1] }],
-  }));
+  });
 }
 
 function givenTemplateIs(template: any) {
-  cfnMocks.getTemplate!.mockReset();
-  cfnMocks.getTemplate!.mockReturnValue({
+  mockCloudFormationClient.on(GetTemplateCommand).resolves({
     TemplateBody: JSON.stringify(template),
   });
 }
diff --git a/packages/aws-cdk/test/api/environment-resources.test.ts b/packages/aws-cdk/test/api/environment-resources.test.ts
index 2e48b41cebe50..d2ed83ba85658 100644
--- a/packages/aws-cdk/test/api/environment-resources.test.ts
+++ b/packages/aws-cdk/test/api/environment-resources.test.ts
@@ -1,10 +1,10 @@
-/* eslint-disable import/order */
+import { GetParameterCommand } from '@aws-sdk/client-ssm';
 import { ToolkitInfo } from '../../lib/api';
 import { EnvironmentResourcesRegistry } from '../../lib/api/environment-resources';
 import { CachedDataSource, Notices, NoticesFilter } from '../../lib/notices';
 import { Configuration } from '../../lib/settings';
-import { errorWithCode, mockBootstrapStack, MockSdk } from '../util/mock-sdk';
 import * as version from '../../lib/version';
+import { MockSdk, mockBootstrapStack, mockSSMClient } from '../util/mock-sdk';
 import { MockToolkitInfo } from '../util/mock-toolkitinfo';
 
 let mockSdk: MockSdk;
@@ -25,40 +25,49 @@ function mockToolkitInfo(ti: ToolkitInfo) {
 }
 
 function envResources() {
-  return envRegistry.for({
-    account: '11111111',
-    region: 'us-nowhere',
-    name: 'aws://11111111/us-nowhere',
-  }, mockSdk);
+  return envRegistry.for(
+    {
+      account: '11111111',
+      region: 'us-nowhere',
+      name: 'aws://11111111/us-nowhere',
+    },
+    mockSdk,
+  );
 }
 
 test('failure to read SSM parameter results in upgrade message for existing bootstrap stack under v5', async () => {
   // GIVEN
-  mockToolkitInfo(ToolkitInfo.fromStack(mockBootstrapStack(mockSdk, {
-    Outputs: [{ OutputKey: 'BootstrapVersion', OutputValue: '4' }],
-  })));
-
-  mockSdk.stubSsm({
-    getParameter() {
-      throw errorWithCode('AccessDeniedException', 'Computer says no');
-    },
-  });
+  mockToolkitInfo(
+    ToolkitInfo.fromStack(
+      mockBootstrapStack({
+        Outputs: [{ OutputKey: 'BootstrapVersion', OutputValue: '4' }],
+      }),
+    ),
+  );
+
+  const error = new Error('Computer says no');
+  error.name = 'AccessDeniedException';
+  mockSSMClient.on(GetParameterCommand).rejects(error);
 
   // THEN
-  await expect(envResources().validateVersion(99, '/abc')).rejects.toThrow(/This CDK deployment requires bootstrap stack version/);
+  await expect(envResources().validateVersion(99, '/abc')).rejects.toThrow(
+    /This CDK deployment requires bootstrap stack version/,
+  );
 });
 
 test('failure to read SSM parameter results in exception passthrough for existing bootstrap stack v5 or higher', async () => {
   // GIVEN
-  mockToolkitInfo(ToolkitInfo.fromStack(mockBootstrapStack(mockSdk, {
-    Outputs: [{ OutputKey: 'BootstrapVersion', OutputValue: '5' }],
-  })));
-
-  mockSdk.stubSsm({
-    getParameter() {
-      throw errorWithCode('AccessDeniedException', 'Computer says no');
-    },
-  });
+  mockToolkitInfo(
+    ToolkitInfo.fromStack(
+      mockBootstrapStack({
+        Outputs: [{ OutputKey: 'BootstrapVersion', OutputValue: '5' }],
+      }),
+    ),
+  );
+
+  const error = new Error('Computer says no');
+  error.name = 'AccessDeniedException';
+  mockSSMClient.on(GetParameterCommand).rejects(error);
 
   // THEN
   await expect(envResources().validateVersion(99, '/abc')).rejects.toThrow(/Computer says no/);
@@ -75,15 +84,15 @@ describe('validateversion without bootstrap stack', () => {
 
   test('validating version with explicit SSM parameter succeeds', async () => {
     // GIVEN
-    mockSdk.stubSsm({
-      getParameter() {
-        return { Parameter: { Value: '10' } };
-      },
+    mockSSMClient.on(GetParameterCommand).resolves({
+      Parameter: { Value: '10' },
     });
 
     // disable notices caching
     jest.spyOn(CachedDataSource.prototype as any, 'save').mockImplementation((_: any) => Promise.resolve());
-    jest.spyOn(CachedDataSource.prototype as any, 'load').mockImplementation(() => Promise.resolve({ expiration: 0, notices: [] }));
+    jest
+      .spyOn(CachedDataSource.prototype as any, 'load')
+      .mockImplementation(() => Promise.resolve({ expiration: 0, notices: [] }));
 
     // mock cli version number
     jest.spyOn(version, 'versionNumber').mockImplementation(() => '1.0.0');
@@ -98,14 +107,16 @@ describe('validateversion without bootstrap stack', () => {
 
     expect(filter).toHaveBeenCalledTimes(1);
     expect(filter).toHaveBeenCalledWith({
-      bootstrappedEnvironments: [{
-        bootstrapStackVersion: 10,
-        environment: {
-          account: '11111111',
-          region: 'us-nowhere',
-          name: 'aws://11111111/us-nowhere',
+      bootstrappedEnvironments: [
+        {
+          bootstrapStackVersion: 10,
+          environment: {
+            account: '11111111',
+            region: 'us-nowhere',
+            name: 'aws://11111111/us-nowhere',
+          },
         },
-      }],
+      ],
       cliVersion: '1.0.0',
       data: [],
       outDir: 'cdk.out',
@@ -114,30 +125,30 @@ describe('validateversion without bootstrap stack', () => {
 
   test('validating version without explicit SSM parameter fails', async () => {
     // WHEN
-    await expect(envResources().validateVersion(8, undefined)).rejects.toThrow(/This deployment requires a bootstrap stack with a known name/);
+    await expect(envResources().validateVersion(8, undefined)).rejects.toThrow(
+      /This deployment requires a bootstrap stack with a known name/,
+    );
   });
 
   test('validating version with access denied error gives upgrade hint', async () => {
     // GIVEN
-    mockSdk.stubSsm({
-      getParameter() {
-        throw errorWithCode('AccessDeniedException', 'Computer says no');
-      },
-    });
+    const error = new Error('Computer says no');
+    error.name = 'AccessDeniedException';
+    mockSSMClient.on(GetParameterCommand).rejects(error);
 
     // WHEN
-    await expect(envResources().validateVersion(8, '/abc')).rejects.toThrow(/This CDK deployment requires bootstrap stack version/);
+    await expect(envResources().validateVersion(8, '/abc')).rejects.toThrow(
+      /This CDK deployment requires bootstrap stack version/,
+    );
   });
 
   test('validating version with missing parameter gives bootstrap hint', async () => {
     // GIVEN
-    mockSdk.stubSsm({
-      getParameter() {
-        throw errorWithCode('ParameterNotFound', 'Wut?');
-      },
-    });
+    const error = new Error('Wut?');
+    error.name = 'ParameterNotFound';
+    mockSSMClient.on(GetParameterCommand).rejects(error);
 
     // WHEN
     await expect(envResources().validateVersion(8, '/abc')).rejects.toThrow(/Has the environment been bootstrapped?/);
   });
-});
\ No newline at end of file
+});
diff --git a/packages/aws-cdk/test/api/evaluate-cloudformation-template.test.ts b/packages/aws-cdk/test/api/evaluate-cloudformation-template.test.ts
index 4a571838820a2..56c600460d64a 100644
--- a/packages/aws-cdk/test/api/evaluate-cloudformation-template.test.ts
+++ b/packages/aws-cdk/test/api/evaluate-cloudformation-template.test.ts
@@ -1,28 +1,23 @@
+import { ListExportsCommand } from '@aws-sdk/client-cloudformation';
 import {
   CfnEvaluationException,
   EvaluateCloudFormationTemplate,
   Template,
 } from '../../lib/api/evaluate-cloudformation-template';
-import { MockSdk } from '../util/mock-sdk';
+import { MockSdk, mockCloudFormationClient, restoreSdkMocksToDefault } from '../util/mock-sdk';
 
-const listStackResources = jest.fn();
-const listExports: jest.Mock<AWS.CloudFormation.ListExportsOutput, AWS.CloudFormation.ListExportsInput[]> = jest.fn();
 const sdk = new MockSdk();
-sdk.stubCloudFormation({
-  listExports,
-  listStackResources,
-});
 
-const createEvaluateCloudFormationTemplate = (template: Template) => new EvaluateCloudFormationTemplate({
-  template,
-  parameters: {},
-  account: '0123456789',
-  region: 'ap-south-east-2',
-  partition: 'aws',
-  urlSuffix: (region) => sdk.getEndpointSuffix(region),
-  sdk,
-  stackName: 'test-stack',
-});
+const createEvaluateCloudFormationTemplate = (template: Template) =>
+  new EvaluateCloudFormationTemplate({
+    template,
+    parameters: {},
+    account: '0123456789',
+    region: 'ap-south-east-2',
+    partition: 'aws',
+    sdk,
+    stackName: 'test-stack',
+  });
 
 describe('evaluateCfnExpression', () => {
   describe('simple literal expressions', () => {
@@ -49,7 +44,9 @@ describe('evaluateCfnExpression', () => {
 
     test('resolves Fn::Select correctly', async () => {
       // WHEN
-      const result = await evaluateCfnTemplate.evaluateCfnExpression({ 'Fn::Select': ['1', ['apples', 'grapes', 'oranges', 'mangoes']] });
+      const result = await evaluateCfnTemplate.evaluateCfnExpression({
+        'Fn::Select': ['1', ['apples', 'grapes', 'oranges', 'mangoes']],
+      });
 
       // THEN
       expect(result).toEqual('grapes');
@@ -57,7 +54,9 @@ describe('evaluateCfnExpression', () => {
 
     test('resolves Fn::Sub correctly', async () => {
       // WHEN
-      const result = await evaluateCfnTemplate.evaluateCfnExpression({ 'Fn::Sub': ['Testing Fn::Sub Foo=${Foo} Bar=${Bar}', { Foo: 'testing', Bar: 1 }] });
+      const result = await evaluateCfnTemplate.evaluateCfnExpression({
+        'Fn::Sub': ['Testing Fn::Sub Foo=${Foo} Bar=${Bar}', { Foo: 'testing', Bar: 1 }],
+      });
 
       // THEN
       expect(result).toEqual('Testing Fn::Sub Foo=testing Bar=1');
@@ -75,22 +74,15 @@ describe('evaluateCfnExpression', () => {
     });
 
     beforeEach(async () => {
-      listExports.mockReset();
-      listExports
-        .mockReturnValueOnce({
-          Exports: [
-            createMockExport(1),
-            createMockExport(2),
-            createMockExport(3),
-          ],
+      restoreSdkMocksToDefault();
+      mockCloudFormationClient
+        .on(ListExportsCommand)
+        .resolvesOnce({
+          Exports: [createMockExport(1), createMockExport(2), createMockExport(3)],
           NextToken: 'next-token-1',
         })
-        .mockReturnValueOnce({
-          Exports: [
-            createMockExport(4),
-            createMockExport(5),
-            createMockExport(6),
-          ],
+        .resolvesOnce({
+          Exports: [createMockExport(4), createMockExport(5), createMockExport(6)],
           NextToken: undefined,
         });
     });
@@ -101,9 +93,10 @@ describe('evaluateCfnExpression', () => {
     });
 
     test('throws error when Fn::ImportValue cannot be resolved', async () => {
-      const evaluate = () => evaluateCfnTemplate.evaluateCfnExpression({
-        'Fn::ImportValue': 'blah',
-      });
+      const evaluate = () =>
+        evaluateCfnTemplate.evaluateCfnExpression({
+          'Fn::ImportValue': 'blah',
+        });
       await expect(evaluate).rejects.toBeInstanceOf(CfnEvaluationException);
     });
   });
diff --git a/packages/aws-cdk/test/api/fake-cloudformation-stack.ts b/packages/aws-cdk/test/api/fake-cloudformation-stack.ts
index 918d6c4d5bb37..925dd9576106e 100644
--- a/packages/aws-cdk/test/api/fake-cloudformation-stack.ts
+++ b/packages/aws-cdk/test/api/fake-cloudformation-stack.ts
@@ -1,8 +1,7 @@
-/* eslint-disable import/order */
-import { CloudFormation } from 'aws-sdk';
+import { ICloudFormationClient } from '../../lib';
 import { CloudFormationStack, Template } from '../../lib/api/util/cloudformation';
-import { instanceMockFrom } from '../util';
 import { StackStatus } from '../../lib/api/util/cloudformation/stack-status';
+import { MockSdk } from '../util/mock-sdk';
 
 export interface FakeCloudFormationStackProps {
   readonly stackName: string;
@@ -10,15 +9,15 @@ export interface FakeCloudFormationStackProps {
   readonly stackStatus?: string;
 }
 
+const client = new MockSdk().cloudFormation();
 export class FakeCloudformationStack extends CloudFormationStack {
-  public readonly cfnMock: jest.Mocked<CloudFormation>;
+  public readonly client: ICloudFormationClient;
   private readonly props: FakeCloudFormationStackProps;
   private __template: Template;
 
   public constructor(props: FakeCloudFormationStackProps) {
-    const cfnMock = instanceMockFrom(CloudFormation);
-    super(cfnMock, props.stackName);
-    this.cfnMock = cfnMock;
+    super(client, props.stackName);
+    this.client = client;
     this.props = props;
     this.__template = {};
   }
diff --git a/packages/aws-cdk/test/api/fake-sts.ts b/packages/aws-cdk/test/api/fake-sts.ts
index 26447de20cf02..160253c642b83 100644
--- a/packages/aws-cdk/test/api/fake-sts.ts
+++ b/packages/aws-cdk/test/api/fake-sts.ts
@@ -1,7 +1,8 @@
-/* eslint-disable import/order */
+import { AssumeRoleCommand, GetCallerIdentityCommand, Tag } from '@aws-sdk/client-sts';
 import * as nock from 'nock';
 import * as uuid from 'uuid';
 import * as xmlJs from 'xml-js';
+import { mockSTSClient } from '../util/mock-sdk';
 
 interface RegisteredIdentity {
   readonly account: string;
@@ -21,7 +22,7 @@ interface AssumedRole {
   readonly serialNumber: string;
   readonly tokenCode: string;
   readonly roleSessionName: string;
-  readonly tags?: AWS.STS.Tag[];
+  readonly tags?: Tag[];
   readonly transitiveTagKeys?: string[];
 }
 
@@ -35,6 +36,8 @@ interface AssumedRole {
  * Instead, we want to validate how we're setting up credentials for the
  * SDK, so we pretend to be the STS server and have an in-memory database
  * of users and roles.
+ *
+ * With the v3 upgrade, this is only now half way being used as
  */
 export class FakeSts {
   public readonly assumedRoles = new Array<AssumedRole>();
@@ -42,8 +45,7 @@ export class FakeSts {
   private identities: Record<string, RegisteredIdentity> = {};
   private roles: Record<string, RegisteredRole> = {};
 
-  constructor() {
-  }
+  constructor() {}
 
   /**
    * Begin mocking
@@ -55,31 +57,40 @@ export class FakeSts {
     if (!nock.isActive()) {
       nock.activate();
     }
-    nock(/.*/).persist().post(/.*/).reply(function (this, uri, body, cb) {
-      const parsedBody = typeof body === 'string' ? urldecode(body) : body;
-
-      try {
-        const response = self.handleRequest({
-          uri,
-          host: this.req.headers.host,
-          parsedBody,
-          headers: this.req.headers,
-        });
-        cb(null, [200, xmlJs.js2xml(response, { compact: true })]);
-      } catch (e: any) {
-        cb(null, [400, xmlJs.js2xml({
-          ErrorResponse: {
-            _attributes: { xmlns: 'https://sts.amazonaws.com/doc/2011-06-15/' },
-            Error: {
-              Type: 'Sender',
-              Code: e.code ?? 'Error',
-              Message: e.message,
-            },
-            RequestId: '1',
-          },
-        }, { compact: true })]);
-      }
-    });
+    nock(/.*/)
+      .persist()
+      .post(/.*/)
+      .reply(function (this, uri, body, cb) {
+        const parsedBody = typeof body === 'string' ? urldecode(body) : body;
+
+        try {
+          const response = self.handleRequest({
+            uri,
+            host: this.req.headers.host,
+            parsedBody,
+            headers: this.req.headers,
+          });
+          cb(null, [200, xmlJs.js2xml(response, { compact: true })]);
+        } catch (e: any) {
+          cb(null, [
+            400,
+            xmlJs.js2xml(
+              {
+                ErrorResponse: {
+                  _attributes: { xmlns: 'https://sts.amazonaws.com/doc/2011-06-15/' },
+                  Error: {
+                    Type: 'Sender',
+                    Code: e.name ?? 'Error',
+                    Message: e.message,
+                  },
+                  RequestId: '1',
+                },
+              },
+              { compact: true },
+            ),
+          ]);
+        }
+      });
 
     // Scrub some environment variables that might be set if we're running on CodeBuild which will interfere with the tests.
     delete process.env.AWS_PROFILE;
@@ -103,20 +114,24 @@ export class FakeSts {
    * Register a user
    */
   public registerUser(account: string, accessKey: string, options: RegisterUserOptions = {}) {
-    const userName = options.name ?? `User${Object.keys(this.identities).length + 1 }`;
+    const userName = options.name ?? `User${Object.keys(this.identities).length + 1}`;
+    const arn = `arn:${options.partition ?? 'aws'}:sts::${account}:user/${userName}`;
+    const userId = `${accessKey}:${userName}`;
 
     this.identities[accessKey] = {
-      account: account,
-      arn: `arn:${options.partition ?? 'aws'}:sts::${account}:user/${userName}`,
-      userId: `${accessKey}:${userName}`,
+      account,
+      arn,
+      userId,
     };
+
+    this.setSTSMocks(account, arn, userName, accessKey);
   }
 
   /**
    * Register an assumable role
    */
   public registerRole(account: string, roleArn: string, options: RegisterRoleOptions = {}) {
-    const roleName = options.name ?? `Role${Object.keys(this.roles).length + 1 }`;
+    const roleName = options.name ?? `Role${Object.keys(this.roles).length + 1}`;
 
     this.roles[roleArn] = {
       allowedAccounts: options.allowedAccounts ?? [account],
@@ -124,6 +139,33 @@ export class FakeSts {
       roleName,
       account,
     };
+
+    this.setSTSMocks(account, roleArn, roleArn);
+  }
+
+  private setSTSMocks(account: string, roleArn: string, name: string, accessKey?: string) {
+    const accessKeyId = accessKey ?? uuid.v4();
+    mockSTSClient
+      .on(GetCallerIdentityCommand)
+      .resolves({
+        Account: account,
+        Arn: roleArn,
+        UserId: name,
+      })
+      .on(AssumeRoleCommand)
+      .resolves({
+        AssumedRoleUser: {
+          Arn: roleArn,
+          AssumedRoleId: `${accessKeyId}:${name}`,
+        },
+        Credentials: {
+          AccessKeyId: accessKeyId,
+          SecretAccessKey: 'Secret',
+          SessionToken: 'Token',
+          Expiration: new Date(Date.now() + 3600 * 1000),
+        },
+        PackedPolicySize: 6,
+      });
   }
 
   private handleRequest(mockRequest: MockRequest): Record<string, any> {
@@ -131,16 +173,15 @@ export class FakeSts {
       const identity = this.identity(mockRequest);
 
       switch (mockRequest.parsedBody.Action) {
-        case 'GetCallerIdentity':
+        case 'GetCallerIdentityCommand':
           return this.handleGetCallerIdentity(identity);
 
-        case 'AssumeRole':
+        case 'AssumeRoleCommand':
           return this.handleAssumeRole(identity, mockRequest);
       }
 
       throw new Error(`Unrecognized Action in MockAwsHttp: ${mockRequest.parsedBody.Action}`);
     })();
-    // console.log(mockRequest.parsedBody, '->', response);
     return response;
   }
 
@@ -165,7 +206,7 @@ export class FakeSts {
    *
    * @see https://docs.aws.amazon.com/STS/latest/APIReference/API_AssumeRole.html
    */
-  private decodeMapFromRequestBody(parameter: string, body: Record<string, string>): AWS.STS.Tag[] {
+  private decodeMapFromRequestBody(parameter: string, body: Record<string, string>): Tag[] {
     return Object.entries(body)
       .filter(([key, _]) => key.startsWith(`${parameter}.member.`) && key.endsWith('.Key'))
       .map(([key, tagKey]) => ({ Key: tagKey, Value: body[`${parameter}.member.${key.split('.')[2]}.Value`] }));
@@ -201,7 +242,9 @@ export class FakeSts {
     }
 
     if (!targetRole.allowedAccounts.includes(identity.account)) {
-      throw new Error(`Identity from account: ${identity.account} not allowed to assume ${roleArn}, must be one of: ${targetRole.allowedAccounts}`);
+      throw new Error(
+        `Identity from account: ${identity.account} not allowed to assume ${roleArn}, must be one of: ${targetRole.allowedAccounts}`,
+      );
     }
 
     const freshAccessKey = uuid.v4();
@@ -248,7 +291,9 @@ export class FakeSts {
     this.checkForFailure(keyId);
 
     const ret = this.identities[keyId];
-    if (!ret) { throw new Error(`Unrecognized access key used: ${keyId}`); }
+    if (!ret) {
+      throw new Error(`Unrecognized access key used: ${keyId}`);
+    }
     return ret;
   }
 
@@ -260,7 +305,9 @@ export class FakeSts {
     const auth = mockRequest.headers.authorization;
 
     const m = auth?.match(/Credential=([^\/]+)/);
-    if (!m) { throw new Error(`No correct authorization header: ${auth}`); }
+    if (!m) {
+      throw new Error(`No correct authorization header: ${auth}`);
+    }
     return m[1];
   }
 }
@@ -273,7 +320,10 @@ export interface RegisterUserOptions {
 export interface RegisterRoleOptions {
   readonly allowedAccounts?: string[];
   readonly name?: string;
-  readonly partition?: string;
+}
+
+export interface STSMocksOptions {
+  readonly accessKey?: string;
 }
 
 interface MockRequest {
diff --git a/packages/aws-cdk/test/api/hotswap/appsync-mapping-templates-hotswap-deployments.test.ts b/packages/aws-cdk/test/api/hotswap/appsync-mapping-templates-hotswap-deployments.test.ts
index 700924c69f906..909345ec2f729 100644
--- a/packages/aws-cdk/test/api/hotswap/appsync-mapping-templates-hotswap-deployments.test.ts
+++ b/packages/aws-cdk/test/api/hotswap/appsync-mapping-templates-hotswap-deployments.test.ts
@@ -1,91 +1,70 @@
-/* eslint-disable import/order */
-import { AppSync, S3 } from 'aws-sdk';
+import { Readable } from 'stream';
+import {
+  GetSchemaCreationStatusCommand,
+  ListFunctionsCommand,
+  StartSchemaCreationCommand,
+  UpdateApiKeyCommand,
+  UpdateFunctionCommand,
+  UpdateResolverCommand,
+} from '@aws-sdk/client-appsync';
+import { GetObjectCommand } from '@aws-sdk/client-s3';
+import { sdkStreamMixin } from '@smithy/util-stream';
 import * as setup from './hotswap-test-setup';
 import { HotswapMode } from '../../../lib/api/hotswap/common';
+import { mockAppSyncClient, mockS3Client } from '../../util/mock-sdk';
 import { silentTest } from '../../util/silent';
 
 let hotswapMockSdkProvider: setup.HotswapMockSdkProvider;
-let mockUpdateResolver: (params: AppSync.UpdateResolverRequest) => AppSync.UpdateResolverResponse;
-let mockUpdateFunction: (params: AppSync.UpdateFunctionRequest) => AppSync.UpdateFunctionResponse;
-let mockUpdateApiKey: (params: AppSync.UpdateApiKeyRequest) => AppSync.UpdateApiKeyResponse;
-let mockStartSchemaCreation: (params: AppSync.StartSchemaCreationRequest) => AppSync.StartSchemaCreationResponse;
-let mockS3GetObject: (params: S3.GetObjectRequest) => S3.GetObjectOutput;
 
 beforeEach(() => {
   hotswapMockSdkProvider = setup.setupHotswapTests();
-  mockUpdateResolver = jest.fn();
-  mockUpdateFunction = jest.fn();
-  mockUpdateApiKey = jest.fn();
-  mockStartSchemaCreation = jest.fn();
-  hotswapMockSdkProvider.stubAppSync({
-    updateResolver: mockUpdateResolver,
-    updateFunction: mockUpdateFunction,
-    updateApiKey: mockUpdateApiKey,
-    startSchemaCreation: mockStartSchemaCreation,
-  });
 });
 
+const getBodyStream = (input: string) => {
+  const stream = new Readable();
+  stream._read = () => {};
+  stream.push(input);
+  stream.push(null); // close the stream
+  return sdkStreamMixin(stream);
+};
+
 describe.each([HotswapMode.FALL_BACK, HotswapMode.HOTSWAP_ONLY])('%p mode', (hotswapMode) => {
-  silentTest(`A new Resolver being added to the Stack returns undefined in CLASSIC mode and
+  silentTest(
+    `A new Resolver being added to the Stack returns undefined in CLASSIC mode and
         returns a noOp in HOTSWAP_ONLY mode`,
-  async () => {
-    // GIVEN
-    const cdkStackArtifact = setup.cdkStackArtifactOf({
-      template: {
-        Resources: {
-          AppSyncResolver: {
-            Type: 'AWS::AppSync::Resolver',
+    async () => {
+      // GIVEN
+      const cdkStackArtifact = setup.cdkStackArtifactOf({
+        template: {
+          Resources: {
+            AppSyncResolver: {
+              Type: 'AWS::AppSync::Resolver',
+            },
           },
         },
-      },
-    });
-
-    // WHEN
-    const deployStackResult = await hotswapMockSdkProvider.tryHotswapDeployment(hotswapMode, cdkStackArtifact);
-
-    // THEN
-    if (hotswapMode === HotswapMode.FALL_BACK) {
-      expect(deployStackResult).toBeUndefined();
-      expect(mockUpdateFunction).not.toHaveBeenCalled();
-      expect(mockUpdateResolver).not.toHaveBeenCalled();
-    } else if (hotswapMode === HotswapMode.HOTSWAP_ONLY) {
-      expect(deployStackResult).not.toBeUndefined();
-      expect(deployStackResult?.noOp).toEqual(true);
-      expect(mockUpdateFunction).not.toHaveBeenCalled();
-      expect(mockUpdateResolver).not.toHaveBeenCalled();
-    }
-  });
+      });
 
-  silentTest('calls the updateResolver() API when it receives only a mapping template difference in a Unit Resolver', async () => {
-    // GIVEN
-    setup.setCurrentCfnStackTemplate({
-      Resources: {
-        AppSyncResolver: {
-          Type: 'AWS::AppSync::Resolver',
-          Properties: {
-            ApiId: 'apiId',
-            FieldName: 'myField',
-            TypeName: 'Query',
-            DataSourceName: 'my-datasource',
-            Kind: 'UNIT',
-            RequestMappingTemplate: '## original request template',
-            ResponseMappingTemplate: '## original response template',
-          },
-          Metadata: {
-            'aws:asset:path': 'old-path',
-          },
-        },
-      },
-    });
-    setup.pushStackResourceSummaries(
-      setup.stackSummaryOf(
-        'AppSyncResolver',
-        'AWS::AppSync::Resolver',
-        'arn:aws:appsync:us-east-1:111111111111:apis/apiId/types/Query/resolvers/myField',
-      ),
-    );
-    const cdkStackArtifact = setup.cdkStackArtifactOf({
-      template: {
+      // WHEN
+      const deployStackResult = await hotswapMockSdkProvider.tryHotswapDeployment(hotswapMode, cdkStackArtifact);
+
+      // THEN
+      if (hotswapMode === HotswapMode.FALL_BACK) {
+        expect(deployStackResult).toBeUndefined();
+      } else if (hotswapMode === HotswapMode.HOTSWAP_ONLY) {
+        expect(deployStackResult).not.toBeUndefined();
+        expect(deployStackResult?.noOp).toEqual(true);
+      }
+
+      expect(mockAppSyncClient).not.toHaveReceivedCommand(UpdateFunctionCommand);
+      expect(mockAppSyncClient).not.toHaveReceivedCommand(UpdateResolverCommand);
+    },
+  );
+
+  silentTest(
+    'calls the updateResolver() API when it receives only a mapping template difference in a Unit Resolver',
+    async () => {
+      // GIVEN
+      setup.setCurrentCfnStackTemplate({
         Resources: {
           AppSyncResolver: {
             Type: 'AWS::AppSync::Resolver',
@@ -95,67 +74,70 @@ describe.each([HotswapMode.FALL_BACK, HotswapMode.HOTSWAP_ONLY])('%p mode', (hot
               TypeName: 'Query',
               DataSourceName: 'my-datasource',
               Kind: 'UNIT',
-              RequestMappingTemplate: '## new request template',
+              RequestMappingTemplate: '## original request template',
               ResponseMappingTemplate: '## original response template',
             },
             Metadata: {
-              'aws:asset:path': 'new-path',
+              'aws:asset:path': 'old-path',
             },
           },
         },
-      },
-    });
-
-    // WHEN
-    const deployStackResult = await hotswapMockSdkProvider.tryHotswapDeployment(hotswapMode, cdkStackArtifact);
-
-    // THEN
-    expect(deployStackResult).not.toBeUndefined();
-    expect(mockUpdateResolver).toHaveBeenCalledWith({
-      apiId: 'apiId',
-      dataSourceName: 'my-datasource',
-      typeName: 'Query',
-      fieldName: 'myField',
-      kind: 'UNIT',
-      requestMappingTemplate: '## new request template',
-      responseMappingTemplate: '## original response template',
-    });
-  });
-
-  silentTest('calls the updateResolver() API when it receives only a mapping template difference s3 location in a Unit Resolver', async () => {
-    // GIVEN
-    mockS3GetObject = jest.fn().mockImplementation(async () => {
-      return { Body: 'template defined in s3' };
-    });
-    hotswapMockSdkProvider.stubS3({ getObject: mockS3GetObject });
-    setup.setCurrentCfnStackTemplate({
-      Resources: {
-        AppSyncResolver: {
-          Type: 'AWS::AppSync::Resolver',
-          Properties: {
-            ApiId: 'apiId',
-            FieldName: 'myField',
-            TypeName: 'Query',
-            DataSourceName: 'my-datasource',
-            Kind: 'UNIT',
-            RequestMappingTemplateS3Location: 's3://test-bucket/old_location',
-            ResponseMappingTemplate: '## original response template',
-          },
-          Metadata: {
-            'aws:asset:path': 'old-path',
+      });
+      setup.pushStackResourceSummaries(
+        setup.stackSummaryOf(
+          'AppSyncResolver',
+          'AWS::AppSync::Resolver',
+          'arn:aws:appsync:us-east-1:111111111111:apis/apiId/types/Query/resolvers/myField',
+        ),
+      );
+      const cdkStackArtifact = setup.cdkStackArtifactOf({
+        template: {
+          Resources: {
+            AppSyncResolver: {
+              Type: 'AWS::AppSync::Resolver',
+              Properties: {
+                ApiId: 'apiId',
+                FieldName: 'myField',
+                TypeName: 'Query',
+                DataSourceName: 'my-datasource',
+                Kind: 'UNIT',
+                RequestMappingTemplate: '## new request template',
+                ResponseMappingTemplate: '## original response template',
+              },
+              Metadata: {
+                'aws:asset:path': 'new-path',
+              },
+            },
           },
         },
-      },
-    });
-    setup.pushStackResourceSummaries(
-      setup.stackSummaryOf(
-        'AppSyncResolver',
-        'AWS::AppSync::Resolver',
-        'arn:aws:appsync:us-east-1:111111111111:apis/apiId/types/Query/resolvers/myField',
-      ),
-    );
-    const cdkStackArtifact = setup.cdkStackArtifactOf({
-      template: {
+      });
+
+      // WHEN
+      const deployStackResult = await hotswapMockSdkProvider.tryHotswapDeployment(hotswapMode, cdkStackArtifact);
+
+      // THEN
+      expect(deployStackResult).not.toBeUndefined();
+      expect(mockAppSyncClient).toHaveReceivedCommandWith(UpdateResolverCommand, {
+        apiId: 'apiId',
+        dataSourceName: 'my-datasource',
+        typeName: 'Query',
+        fieldName: 'myField',
+        kind: 'UNIT',
+        requestMappingTemplate: '## new request template',
+        responseMappingTemplate: '## original response template',
+      });
+    },
+  );
+
+  silentTest(
+    'calls the updateResolver() API when it receives only a mapping template difference s3 location in a Unit Resolver',
+    async () => {
+      // GIVEN
+      const body = getBodyStream('template defined in s3');
+      mockS3Client.on(GetObjectCommand).resolves({
+        Body: body,
+      });
+      setup.setCurrentCfnStackTemplate({
         Resources: {
           AppSyncResolver: {
             Type: 'AWS::AppSync::Resolver',
@@ -165,70 +147,74 @@ describe.each([HotswapMode.FALL_BACK, HotswapMode.HOTSWAP_ONLY])('%p mode', (hot
               TypeName: 'Query',
               DataSourceName: 'my-datasource',
               Kind: 'UNIT',
-              RequestMappingTemplateS3Location: 's3://test-bucket/path/to/key',
+              RequestMappingTemplateS3Location: 's3://test-bucket/old_location',
               ResponseMappingTemplate: '## original response template',
             },
             Metadata: {
-              'aws:asset:path': 'new-path',
+              'aws:asset:path': 'old-path',
             },
           },
         },
-      },
-    });
-
-    // WHEN
-    const deployStackResult = await hotswapMockSdkProvider.tryHotswapDeployment(hotswapMode, cdkStackArtifact);
-
-    // THEN
-    expect(deployStackResult).not.toBeUndefined();
-    expect(mockUpdateResolver).toHaveBeenCalledWith({
-      apiId: 'apiId',
-      dataSourceName: 'my-datasource',
-      typeName: 'Query',
-      fieldName: 'myField',
-      kind: 'UNIT',
-      requestMappingTemplate: 'template defined in s3',
-      responseMappingTemplate: '## original response template',
-    });
-    expect(mockS3GetObject).toHaveBeenCalledWith({
-      Bucket: 'test-bucket',
-      Key: 'path/to/key',
-    });
-  });
-
-  silentTest('calls the updateResolver() API when it receives only a code s3 location in a Pipeline Resolver', async () => {
-    // GIVEN
-    mockS3GetObject = jest.fn().mockImplementation(async () => {
-      return { Body: 'code defined in s3' };
-    });
-    hotswapMockSdkProvider.stubS3({ getObject: mockS3GetObject });
-    setup.setCurrentCfnStackTemplate({
-      Resources: {
-        AppSyncResolver: {
-          Type: 'AWS::AppSync::Resolver',
-          Properties: {
-            ApiId: 'apiId',
-            FieldName: 'myField',
-            TypeName: 'Query',
-            DataSourceName: 'my-datasource',
-            PipelineConfig: ['function1'],
-            CodeS3Location: 's3://test-bucket/old_location',
-          },
-          Metadata: {
-            'aws:asset:path': 'old-path',
+      });
+      setup.pushStackResourceSummaries(
+        setup.stackSummaryOf(
+          'AppSyncResolver',
+          'AWS::AppSync::Resolver',
+          'arn:aws:appsync:us-east-1:111111111111:apis/apiId/types/Query/resolvers/myField',
+        ),
+      );
+      const cdkStackArtifact = setup.cdkStackArtifactOf({
+        template: {
+          Resources: {
+            AppSyncResolver: {
+              Type: 'AWS::AppSync::Resolver',
+              Properties: {
+                ApiId: 'apiId',
+                FieldName: 'myField',
+                TypeName: 'Query',
+                DataSourceName: 'my-datasource',
+                Kind: 'UNIT',
+                RequestMappingTemplateS3Location: 's3://test-bucket/path/to/key',
+                ResponseMappingTemplate: '## original response template',
+              },
+              Metadata: {
+                'aws:asset:path': 'new-path',
+              },
+            },
           },
         },
-      },
-    });
-    setup.pushStackResourceSummaries(
-      setup.stackSummaryOf(
-        'AppSyncResolver',
-        'AWS::AppSync::Resolver',
-        'arn:aws:appsync:us-east-1:111111111111:apis/apiId/types/Query/resolvers/myField',
-      ),
-    );
-    const cdkStackArtifact = setup.cdkStackArtifactOf({
-      template: {
+      });
+
+      // WHEN
+      const deployStackResult = await hotswapMockSdkProvider.tryHotswapDeployment(hotswapMode, cdkStackArtifact);
+
+      // THEN
+      expect(deployStackResult).not.toBeUndefined();
+      expect(mockAppSyncClient).toHaveReceivedCommandWith(UpdateResolverCommand, {
+        apiId: 'apiId',
+        dataSourceName: 'my-datasource',
+        typeName: 'Query',
+        fieldName: 'myField',
+        kind: 'UNIT',
+        requestMappingTemplate: 'template defined in s3',
+        responseMappingTemplate: '## original response template',
+      });
+      expect(mockS3Client).toHaveReceivedCommandWith(GetObjectCommand, {
+        Bucket: 'test-bucket',
+        Key: 'path/to/key',
+      });
+    },
+  );
+
+  silentTest(
+    'calls the updateResolver() API when it receives only a code s3 location in a Pipeline Resolver',
+    async () => {
+      // GIVEN
+      const body = getBodyStream('code defined in s3');
+      mockS3Client.on(GetObjectCommand).resolves({
+        Body: body,
+      });
+      setup.setCurrentCfnStackTemplate({
         Resources: {
           AppSyncResolver: {
             Type: 'AWS::AppSync::Resolver',
@@ -238,65 +224,67 @@ describe.each([HotswapMode.FALL_BACK, HotswapMode.HOTSWAP_ONLY])('%p mode', (hot
               TypeName: 'Query',
               DataSourceName: 'my-datasource',
               PipelineConfig: ['function1'],
-              CodeS3Location: 's3://test-bucket/path/to/key',
+              CodeS3Location: 's3://test-bucket/old_location',
             },
             Metadata: {
-              'aws:asset:path': 'new-path',
+              'aws:asset:path': 'old-path',
             },
           },
         },
-      },
-    });
-
-    // WHEN
-    const deployStackResult = await hotswapMockSdkProvider.tryHotswapDeployment(hotswapMode, cdkStackArtifact);
-
-    // THEN
-    expect(deployStackResult).not.toBeUndefined();
-    expect(mockUpdateResolver).toHaveBeenCalledWith({
-      apiId: 'apiId',
-      dataSourceName: 'my-datasource',
-      typeName: 'Query',
-      fieldName: 'myField',
-      pipelineConfig: ['function1'],
-      code: 'code defined in s3',
-    });
-    expect(mockS3GetObject).toHaveBeenCalledWith({
-      Bucket: 'test-bucket',
-      Key: 'path/to/key',
-    });
-  });
-
-  silentTest('calls the updateResolver() API when it receives only a code difference in a Pipeline Resolver', async () => {
-    // GIVEN
-    hotswapMockSdkProvider.stubS3({ getObject: mockS3GetObject });
-    setup.setCurrentCfnStackTemplate({
-      Resources: {
-        AppSyncResolver: {
-          Type: 'AWS::AppSync::Resolver',
-          Properties: {
-            ApiId: 'apiId',
-            FieldName: 'myField',
-            TypeName: 'Query',
-            DataSourceName: 'my-datasource',
-            PipelineConfig: ['function1'],
-            Code: 'old code',
-          },
-          Metadata: {
-            'aws:asset:path': 'old-path',
+      });
+      setup.pushStackResourceSummaries(
+        setup.stackSummaryOf(
+          'AppSyncResolver',
+          'AWS::AppSync::Resolver',
+          'arn:aws:appsync:us-east-1:111111111111:apis/apiId/types/Query/resolvers/myField',
+        ),
+      );
+      const cdkStackArtifact = setup.cdkStackArtifactOf({
+        template: {
+          Resources: {
+            AppSyncResolver: {
+              Type: 'AWS::AppSync::Resolver',
+              Properties: {
+                ApiId: 'apiId',
+                FieldName: 'myField',
+                TypeName: 'Query',
+                DataSourceName: 'my-datasource',
+                PipelineConfig: ['function1'],
+                CodeS3Location: 's3://test-bucket/path/to/key',
+              },
+              Metadata: {
+                'aws:asset:path': 'new-path',
+              },
+            },
           },
         },
-      },
-    });
-    setup.pushStackResourceSummaries(
-      setup.stackSummaryOf(
-        'AppSyncResolver',
-        'AWS::AppSync::Resolver',
-        'arn:aws:appsync:us-east-1:111111111111:apis/apiId/types/Query/resolvers/myField',
-      ),
-    );
-    const cdkStackArtifact = setup.cdkStackArtifactOf({
-      template: {
+      });
+
+      // WHEN
+      const deployStackResult = await hotswapMockSdkProvider.tryHotswapDeployment(hotswapMode, cdkStackArtifact);
+
+      // THEN
+      expect(deployStackResult).not.toBeUndefined();
+      expect(mockAppSyncClient).toHaveReceivedCommandWith(UpdateResolverCommand, {
+        apiId: 'apiId',
+        dataSourceName: 'my-datasource',
+        typeName: 'Query',
+        fieldName: 'myField',
+        pipelineConfig: ['function1'],
+        code: 'code defined in s3',
+      });
+      expect(mockS3Client).toHaveReceivedCommandWith(GetObjectCommand, {
+        Bucket: 'test-bucket',
+        Key: 'path/to/key',
+      });
+    },
+  );
+
+  silentTest(
+    'calls the updateResolver() API when it receives only a code difference in a Pipeline Resolver',
+    async () => {
+      // GIVEN
+      setup.setCurrentCfnStackTemplate({
         Resources: {
           AppSyncResolver: {
             Type: 'AWS::AppSync::Resolver',
@@ -306,62 +294,63 @@ describe.each([HotswapMode.FALL_BACK, HotswapMode.HOTSWAP_ONLY])('%p mode', (hot
               TypeName: 'Query',
               DataSourceName: 'my-datasource',
               PipelineConfig: ['function1'],
-              Code: 'new code',
+              Code: 'old code',
             },
             Metadata: {
-              'aws:asset:path': 'new-path',
+              'aws:asset:path': 'old-path',
             },
           },
         },
-      },
-    });
-
-    // WHEN
-    const deployStackResult = await hotswapMockSdkProvider.tryHotswapDeployment(hotswapMode, cdkStackArtifact);
-
-    // THEN
-    expect(deployStackResult).not.toBeUndefined();
-    expect(mockUpdateResolver).toHaveBeenCalledWith({
-      apiId: 'apiId',
-      dataSourceName: 'my-datasource',
-      typeName: 'Query',
-      fieldName: 'myField',
-      pipelineConfig: ['function1'],
-      code: 'new code',
-    });
-  });
-
-  silentTest('calls the updateResolver() API when it receives only a mapping template difference in a Pipeline Resolver', async () => {
-    // GIVEN
-    setup.setCurrentCfnStackTemplate({
-      Resources: {
-        AppSyncResolver: {
-          Type: 'AWS::AppSync::Resolver',
-          Properties: {
-            ApiId: 'apiId',
-            FieldName: 'myField',
-            TypeName: 'Query',
-            DataSourceName: 'my-datasource',
-            Kind: 'PIPELINE',
-            PipelineConfig: ['function1'],
-            RequestMappingTemplate: '## original request template',
-            ResponseMappingTemplate: '## original response template',
-          },
-          Metadata: {
-            'aws:asset:path': 'old-path',
+      });
+      setup.pushStackResourceSummaries(
+        setup.stackSummaryOf(
+          'AppSyncResolver',
+          'AWS::AppSync::Resolver',
+          'arn:aws:appsync:us-east-1:111111111111:apis/apiId/types/Query/resolvers/myField',
+        ),
+      );
+      const cdkStackArtifact = setup.cdkStackArtifactOf({
+        template: {
+          Resources: {
+            AppSyncResolver: {
+              Type: 'AWS::AppSync::Resolver',
+              Properties: {
+                ApiId: 'apiId',
+                FieldName: 'myField',
+                TypeName: 'Query',
+                DataSourceName: 'my-datasource',
+                PipelineConfig: ['function1'],
+                Code: 'new code',
+              },
+              Metadata: {
+                'aws:asset:path': 'new-path',
+              },
+            },
           },
         },
-      },
-    });
-    setup.pushStackResourceSummaries(
-      setup.stackSummaryOf(
-        'AppSyncResolver',
-        'AWS::AppSync::Resolver',
-        'arn:aws:appsync:us-east-1:111111111111:apis/apiId/types/Query/resolvers/myField',
-      ),
-    );
-    const cdkStackArtifact = setup.cdkStackArtifactOf({
-      template: {
+      });
+
+      // WHEN
+      const deployStackResult = await hotswapMockSdkProvider.tryHotswapDeployment(hotswapMode, cdkStackArtifact);
+
+      // THEN
+      expect(deployStackResult).not.toBeUndefined();
+      expect(mockAppSyncClient).toHaveReceivedCommandWith(UpdateResolverCommand, {
+        apiId: 'apiId',
+        dataSourceName: 'my-datasource',
+        typeName: 'Query',
+        fieldName: 'myField',
+        pipelineConfig: ['function1'],
+        code: 'new code',
+      });
+    },
+  );
+
+  silentTest(
+    'calls the updateResolver() API when it receives only a mapping template difference in a Pipeline Resolver',
+    async () => {
+      // GIVEN
+      setup.setCurrentCfnStackTemplate({
         Resources: {
           AppSyncResolver: {
             Type: 'AWS::AppSync::Resolver',
@@ -372,170 +361,187 @@ describe.each([HotswapMode.FALL_BACK, HotswapMode.HOTSWAP_ONLY])('%p mode', (hot
               DataSourceName: 'my-datasource',
               Kind: 'PIPELINE',
               PipelineConfig: ['function1'],
-              RequestMappingTemplate: '## new request template',
+              RequestMappingTemplate: '## original request template',
               ResponseMappingTemplate: '## original response template',
             },
             Metadata: {
-              'aws:asset:path': 'new-path',
+              'aws:asset:path': 'old-path',
             },
           },
         },
-      },
-    });
+      });
+      setup.pushStackResourceSummaries(
+        setup.stackSummaryOf(
+          'AppSyncResolver',
+          'AWS::AppSync::Resolver',
+          'arn:aws:appsync:us-east-1:111111111111:apis/apiId/types/Query/resolvers/myField',
+        ),
+      );
+      const cdkStackArtifact = setup.cdkStackArtifactOf({
+        template: {
+          Resources: {
+            AppSyncResolver: {
+              Type: 'AWS::AppSync::Resolver',
+              Properties: {
+                ApiId: 'apiId',
+                FieldName: 'myField',
+                TypeName: 'Query',
+                DataSourceName: 'my-datasource',
+                Kind: 'PIPELINE',
+                PipelineConfig: ['function1'],
+                RequestMappingTemplate: '## new request template',
+                ResponseMappingTemplate: '## original response template',
+              },
+              Metadata: {
+                'aws:asset:path': 'new-path',
+              },
+            },
+          },
+        },
+      });
 
-    const deployStackResult = await hotswapMockSdkProvider.tryHotswapDeployment(hotswapMode, cdkStackArtifact);
+      const deployStackResult = await hotswapMockSdkProvider.tryHotswapDeployment(hotswapMode, cdkStackArtifact);
 
-    // THEN
-    expect(deployStackResult).not.toBeUndefined();
-    expect(mockUpdateResolver).toHaveBeenCalledWith({
-      apiId: 'apiId',
-      dataSourceName: 'my-datasource',
-      typeName: 'Query',
-      fieldName: 'myField',
-      kind: 'PIPELINE',
-      pipelineConfig: ['function1'],
-      requestMappingTemplate: '## new request template',
-      responseMappingTemplate: '## original response template',
-    });
-  });
+      // THEN
+      expect(deployStackResult).not.toBeUndefined();
+      expect(mockAppSyncClient).toHaveReceivedCommandWith(UpdateResolverCommand, {
+        apiId: 'apiId',
+        dataSourceName: 'my-datasource',
+        typeName: 'Query',
+        fieldName: 'myField',
+        kind: 'PIPELINE',
+        pipelineConfig: ['function1'],
+        requestMappingTemplate: '## new request template',
+        responseMappingTemplate: '## original response template',
+      });
+    },
+  );
 
-  silentTest(`when it receives a change that is not a mapping template difference in a Resolver, it does not call the updateResolver() API in CLASSIC mode
+  silentTest(
+    `when it receives a change that is not a mapping template difference in a Resolver, it does not call the updateResolver() API in CLASSIC mode
         but does call the updateResolver() API in HOTSWAP_ONLY mode`,
-  async () => {
-    // GIVEN
-    setup.setCurrentCfnStackTemplate({
-      Resources: {
-        AppSyncResolver: {
-          Type: 'AWS::AppSync::Resolver',
-          Properties: {
-            ResponseMappingTemplate: '## original response template',
-            RequestMappingTemplate: '## original request template',
-            FieldName: 'oldField',
-            ApiId: 'apiId',
-            TypeName: 'Query',
-          },
-          Metadata: {
-            'aws:asset:path': 'old-path',
-          },
-        },
-      },
-    });
-    setup.pushStackResourceSummaries(
-      setup.stackSummaryOf(
-        'AppSyncResolver',
-        'AWS::AppSync::Resolver',
-        'arn:aws:appsync:us-east-1:111111111111:apis/apiId/types/Query/resolvers/myField',
-      ),
-    );
-    const cdkStackArtifact = setup.cdkStackArtifactOf({
-      template: {
+    async () => {
+      // GIVEN
+      setup.setCurrentCfnStackTemplate({
         Resources: {
           AppSyncResolver: {
             Type: 'AWS::AppSync::Resolver',
             Properties: {
               ResponseMappingTemplate: '## original response template',
-              RequestMappingTemplate: '## new request template',
-              FieldName: 'newField',
+              RequestMappingTemplate: '## original request template',
+              FieldName: 'oldField',
               ApiId: 'apiId',
               TypeName: 'Query',
             },
+            Metadata: {
+              'aws:asset:path': 'old-path',
+            },
           },
         },
-      },
-    });
-
-    // WHEN
-    const deployStackResult = await hotswapMockSdkProvider.tryHotswapDeployment(hotswapMode, cdkStackArtifact);
-
-    // THEN
-    if (hotswapMode === HotswapMode.FALL_BACK) {
-      expect(deployStackResult).toBeUndefined();
-      expect(mockUpdateFunction).not.toHaveBeenCalled();
-      expect(mockUpdateResolver).not.toHaveBeenCalled();
-    } else if (hotswapMode === HotswapMode.HOTSWAP_ONLY) {
-      expect(deployStackResult).not.toBeUndefined();
-      expect(mockUpdateFunction).not.toHaveBeenCalled();
-      expect(mockUpdateResolver).toHaveBeenCalledWith({
-        apiId: 'apiId',
-        typeName: 'Query',
-        fieldName: 'oldField',
-        requestMappingTemplate: '## new request template',
-        responseMappingTemplate: '## original response template',
       });
-    }
-  });
-
-  silentTest('does not call the updateResolver() API when a resource with type that is not AWS::AppSync::Resolver but has the same properties is changed', async () => {
-    // GIVEN
-    setup.setCurrentCfnStackTemplate({
-      Resources: {
-        AppSyncResolver: {
-          Type: 'AWS::AppSync::NotAResolver',
-          Properties: {
-            RequestMappingTemplate: '## original template',
-            FieldName: 'oldField',
-          },
-          Metadata: {
-            'aws:asset:path': 'old-path',
+      setup.pushStackResourceSummaries(
+        setup.stackSummaryOf(
+          'AppSyncResolver',
+          'AWS::AppSync::Resolver',
+          'arn:aws:appsync:us-east-1:111111111111:apis/apiId/types/Query/resolvers/myField',
+        ),
+      );
+      const cdkStackArtifact = setup.cdkStackArtifactOf({
+        template: {
+          Resources: {
+            AppSyncResolver: {
+              Type: 'AWS::AppSync::Resolver',
+              Properties: {
+                ResponseMappingTemplate: '## original response template',
+                RequestMappingTemplate: '## new request template',
+                FieldName: 'newField',
+                ApiId: 'apiId',
+                TypeName: 'Query',
+              },
+            },
           },
         },
-      },
-    });
-    const cdkStackArtifact = setup.cdkStackArtifactOf({
-      template: {
+      });
+
+      // WHEN
+      const deployStackResult = await hotswapMockSdkProvider.tryHotswapDeployment(hotswapMode, cdkStackArtifact);
+
+      // THEN
+      if (hotswapMode === HotswapMode.FALL_BACK) {
+        expect(deployStackResult).toBeUndefined();
+        expect(mockAppSyncClient).not.toHaveReceivedCommand(UpdateResolverCommand);
+      } else if (hotswapMode === HotswapMode.HOTSWAP_ONLY) {
+        expect(deployStackResult).not.toBeUndefined();
+        expect(mockAppSyncClient).toHaveReceivedCommandWith(UpdateResolverCommand, {
+          apiId: 'apiId',
+          typeName: 'Query',
+          fieldName: 'oldField',
+          requestMappingTemplate: '## new request template',
+          responseMappingTemplate: '## original response template',
+        });
+      }
+
+      expect(mockAppSyncClient).not.toHaveReceivedCommand(UpdateFunctionCommand);
+    },
+  );
+
+  silentTest(
+    'does not call the updateResolver() API when a resource with type that is not AWS::AppSync::Resolver but has the same properties is changed',
+    async () => {
+      // GIVEN
+      setup.setCurrentCfnStackTemplate({
         Resources: {
           AppSyncResolver: {
             Type: 'AWS::AppSync::NotAResolver',
             Properties: {
-              RequestMappingTemplate: '## new template',
-              FieldName: 'newField',
+              RequestMappingTemplate: '## original template',
+              FieldName: 'oldField',
+            },
+            Metadata: {
+              'aws:asset:path': 'old-path',
             },
           },
         },
-      },
-    });
-
-    // WHEN
-    const deployStackResult = await hotswapMockSdkProvider.tryHotswapDeployment(hotswapMode, cdkStackArtifact);
-
-    // THEN
-    if (hotswapMode === HotswapMode.FALL_BACK) {
-      expect(deployStackResult).toBeUndefined();
-      expect(mockUpdateFunction).not.toHaveBeenCalled();
-      expect(mockUpdateResolver).not.toHaveBeenCalled();
-    } else if (hotswapMode === HotswapMode.HOTSWAP_ONLY) {
-      expect(deployStackResult).not.toBeUndefined();
-      expect(deployStackResult?.noOp).toEqual(true);
-      expect(mockUpdateFunction).not.toHaveBeenCalled();
-      expect(mockUpdateResolver).not.toHaveBeenCalled();
-    }
-  });
-
-  silentTest('calls the updateFunction() API when it receives only a mapping template difference in a Function', async () => {
-    // GIVEN
-    const mockListFunctions = jest.fn().mockReturnValue({ functions: [{ name: 'my-function', functionId: 'functionId' }] });
-    hotswapMockSdkProvider.stubAppSync({ listFunctions: mockListFunctions, updateFunction: mockUpdateFunction });
-
-    setup.setCurrentCfnStackTemplate({
-      Resources: {
-        AppSyncFunction: {
-          Type: 'AWS::AppSync::FunctionConfiguration',
-          Properties: {
-            Name: 'my-function',
-            ApiId: 'apiId',
-            DataSourceName: 'my-datasource',
-            FunctionVersion: '2018-05-29',
-            RequestMappingTemplate: '## original request template',
-            ResponseMappingTemplate: '## original response template',
-          },
-          Metadata: {
-            'aws:asset:path': 'old-path',
+      });
+      const cdkStackArtifact = setup.cdkStackArtifactOf({
+        template: {
+          Resources: {
+            AppSyncResolver: {
+              Type: 'AWS::AppSync::NotAResolver',
+              Properties: {
+                RequestMappingTemplate: '## new template',
+                FieldName: 'newField',
+              },
+            },
           },
         },
-      },
-    });
-    const cdkStackArtifact = setup.cdkStackArtifactOf({
-      template: {
+      });
+
+      // WHEN
+      const deployStackResult = await hotswapMockSdkProvider.tryHotswapDeployment(hotswapMode, cdkStackArtifact);
+
+      // THEN
+      if (hotswapMode === HotswapMode.FALL_BACK) {
+        expect(deployStackResult).toBeUndefined();
+      } else if (hotswapMode === HotswapMode.HOTSWAP_ONLY) {
+        expect(deployStackResult).not.toBeUndefined();
+        expect(deployStackResult?.noOp).toEqual(true);
+      }
+
+      expect(mockAppSyncClient).not.toHaveReceivedCommand(UpdateFunctionCommand);
+      expect(mockAppSyncClient).not.toHaveReceivedCommand(UpdateResolverCommand);
+    },
+  );
+
+  silentTest(
+    'calls the updateFunction() API when it receives only a mapping template difference in a Function',
+    async () => {
+      // GIVEN
+      mockAppSyncClient
+        .on(ListFunctionsCommand)
+        .resolves({ functions: [{ name: 'my-function', functionId: 'functionId' }] });
+
+      setup.setCurrentCfnStackTemplate({
         Resources: {
           AppSyncFunction: {
             Type: 'AWS::AppSync::FunctionConfiguration',
@@ -545,58 +551,61 @@ describe.each([HotswapMode.FALL_BACK, HotswapMode.HOTSWAP_ONLY])('%p mode', (hot
               DataSourceName: 'my-datasource',
               FunctionVersion: '2018-05-29',
               RequestMappingTemplate: '## original request template',
-              ResponseMappingTemplate: '## new response template',
+              ResponseMappingTemplate: '## original response template',
             },
             Metadata: {
-              'aws:asset:path': 'new-path',
+              'aws:asset:path': 'old-path',
             },
           },
         },
-      },
-    });
-
-    // WHEN
-    const deployStackResult = await hotswapMockSdkProvider.tryHotswapDeployment(hotswapMode, cdkStackArtifact);
-
-    // THEN
-    expect(deployStackResult).not.toBeUndefined();
-    expect(mockUpdateFunction).toHaveBeenCalledWith({
-      apiId: 'apiId',
-      dataSourceName: 'my-datasource',
-      functionId: 'functionId',
-      functionVersion: '2018-05-29',
-      name: 'my-function',
-      requestMappingTemplate: '## original request template',
-      responseMappingTemplate: '## new response template',
-    });
-  });
-
-  silentTest('calls the updateFunction() API with function version when it receives both function version and runtime with a mapping template in a Function', async () => {
-    // GIVEN
-    const mockListFunctions = jest.fn().mockReturnValue({ functions: [{ name: 'my-function', functionId: 'functionId' }] });
-    hotswapMockSdkProvider.stubAppSync({ listFunctions: mockListFunctions, updateFunction: mockUpdateFunction });
-
-    setup.setCurrentCfnStackTemplate({
-      Resources: {
-        AppSyncFunction: {
-          Type: 'AWS::AppSync::FunctionConfiguration',
-          Properties: {
-            Name: 'my-function',
-            ApiId: 'apiId',
-            DataSourceName: 'my-datasource',
-            FunctionVersion: '2018-05-29',
-            Runtime: 'APPSYNC_JS',
-            RequestMappingTemplate: '## original request template',
-            ResponseMappingTemplate: '## original response template',
-          },
-          Metadata: {
-            'aws:asset:path': 'old-path',
+      });
+      const cdkStackArtifact = setup.cdkStackArtifactOf({
+        template: {
+          Resources: {
+            AppSyncFunction: {
+              Type: 'AWS::AppSync::FunctionConfiguration',
+              Properties: {
+                Name: 'my-function',
+                ApiId: 'apiId',
+                DataSourceName: 'my-datasource',
+                FunctionVersion: '2018-05-29',
+                RequestMappingTemplate: '## original request template',
+                ResponseMappingTemplate: '## new response template',
+              },
+              Metadata: {
+                'aws:asset:path': 'new-path',
+              },
+            },
           },
         },
-      },
-    });
-    const cdkStackArtifact = setup.cdkStackArtifactOf({
-      template: {
+      });
+
+      // WHEN
+      const deployStackResult = await hotswapMockSdkProvider.tryHotswapDeployment(hotswapMode, cdkStackArtifact);
+
+      // THEN
+      expect(deployStackResult).not.toBeUndefined();
+      expect(mockAppSyncClient).toHaveReceivedCommandWith(UpdateFunctionCommand, {
+        apiId: 'apiId',
+        dataSourceName: 'my-datasource',
+        functionId: 'functionId',
+        functionVersion: '2018-05-29',
+        name: 'my-function',
+        requestMappingTemplate: '## original request template',
+        responseMappingTemplate: '## new response template',
+      });
+    },
+  );
+
+  silentTest(
+    'calls the updateFunction() API with function version when it receives both function version and runtime with a mapping template in a Function',
+    async () => {
+      // GIVEN
+      mockAppSyncClient
+        .on(ListFunctionsCommand)
+        .resolves({ functions: [{ name: 'my-function', functionId: 'functionId' }] });
+
+      setup.setCurrentCfnStackTemplate({
         Resources: {
           AppSyncFunction: {
             Type: 'AWS::AppSync::FunctionConfiguration',
@@ -607,57 +616,62 @@ describe.each([HotswapMode.FALL_BACK, HotswapMode.HOTSWAP_ONLY])('%p mode', (hot
               FunctionVersion: '2018-05-29',
               Runtime: 'APPSYNC_JS',
               RequestMappingTemplate: '## original request template',
-              ResponseMappingTemplate: '## new response template',
+              ResponseMappingTemplate: '## original response template',
             },
             Metadata: {
-              'aws:asset:path': 'new-path',
+              'aws:asset:path': 'old-path',
             },
           },
         },
-      },
-    });
-
-    // WHEN
-    const deployStackResult = await hotswapMockSdkProvider.tryHotswapDeployment(hotswapMode, cdkStackArtifact);
-
-    // THEN
-    expect(deployStackResult).not.toBeUndefined();
-    expect(mockUpdateFunction).toHaveBeenCalledWith({
-      apiId: 'apiId',
-      dataSourceName: 'my-datasource',
-      functionId: 'functionId',
-      functionVersion: '2018-05-29',
-      name: 'my-function',
-      requestMappingTemplate: '## original request template',
-      responseMappingTemplate: '## new response template',
-    });
-  });
-
-  silentTest('calls the updateFunction() API with runtime when it receives both function version and runtime with code in a Function', async () => {
-    // GIVEN
-    const mockListFunctions = jest.fn().mockReturnValue({ functions: [{ name: 'my-function', functionId: 'functionId' }] });
-    hotswapMockSdkProvider.stubAppSync({ listFunctions: mockListFunctions, updateFunction: mockUpdateFunction });
-
-    setup.setCurrentCfnStackTemplate({
-      Resources: {
-        AppSyncFunction: {
-          Type: 'AWS::AppSync::FunctionConfiguration',
-          Properties: {
-            Name: 'my-function',
-            ApiId: 'apiId',
-            DataSourceName: 'my-datasource',
-            FunctionVersion: '2018-05-29',
-            Runtime: 'APPSYNC_JS',
-            Code: 'old test code',
-          },
-          Metadata: {
-            'aws:asset:path': 'old-path',
+      });
+      const cdkStackArtifact = setup.cdkStackArtifactOf({
+        template: {
+          Resources: {
+            AppSyncFunction: {
+              Type: 'AWS::AppSync::FunctionConfiguration',
+              Properties: {
+                Name: 'my-function',
+                ApiId: 'apiId',
+                DataSourceName: 'my-datasource',
+                FunctionVersion: '2018-05-29',
+                Runtime: 'APPSYNC_JS',
+                RequestMappingTemplate: '## original request template',
+                ResponseMappingTemplate: '## new response template',
+              },
+              Metadata: {
+                'aws:asset:path': 'new-path',
+              },
+            },
           },
         },
-      },
-    });
-    const cdkStackArtifact = setup.cdkStackArtifactOf({
-      template: {
+      });
+
+      // WHEN
+      const deployStackResult = await hotswapMockSdkProvider.tryHotswapDeployment(hotswapMode, cdkStackArtifact);
+
+      // THEN
+      expect(deployStackResult).not.toBeUndefined();
+      expect(mockAppSyncClient).toHaveReceivedCommandWith(UpdateFunctionCommand, {
+        apiId: 'apiId',
+        dataSourceName: 'my-datasource',
+        functionId: 'functionId',
+        functionVersion: '2018-05-29',
+        name: 'my-function',
+        requestMappingTemplate: '## original request template',
+        responseMappingTemplate: '## new response template',
+      });
+    },
+  );
+
+  silentTest(
+    'calls the updateFunction() API with runtime when it receives both function version and runtime with code in a Function',
+    async () => {
+      // GIVEN
+      mockAppSyncClient
+        .on(ListFunctionsCommand)
+        .resolves({ functions: [{ name: 'my-function', functionId: 'functionId' }] });
+
+      setup.setCurrentCfnStackTemplate({
         Resources: {
           AppSyncFunction: {
             Type: 'AWS::AppSync::FunctionConfiguration',
@@ -667,60 +681,63 @@ describe.each([HotswapMode.FALL_BACK, HotswapMode.HOTSWAP_ONLY])('%p mode', (hot
               DataSourceName: 'my-datasource',
               FunctionVersion: '2018-05-29',
               Runtime: 'APPSYNC_JS',
-              Code: 'new test code',
+              Code: 'old test code',
             },
             Metadata: {
-              'aws:asset:path': 'new-path',
+              'aws:asset:path': 'old-path',
             },
           },
         },
-      },
-    });
-
-    // WHEN
-    const deployStackResult = await hotswapMockSdkProvider.tryHotswapDeployment(hotswapMode, cdkStackArtifact);
+      });
+      const cdkStackArtifact = setup.cdkStackArtifactOf({
+        template: {
+          Resources: {
+            AppSyncFunction: {
+              Type: 'AWS::AppSync::FunctionConfiguration',
+              Properties: {
+                Name: 'my-function',
+                ApiId: 'apiId',
+                DataSourceName: 'my-datasource',
+                FunctionVersion: '2018-05-29',
+                Runtime: 'APPSYNC_JS',
+                Code: 'new test code',
+              },
+              Metadata: {
+                'aws:asset:path': 'new-path',
+              },
+            },
+          },
+        },
+      });
 
-    // THEN
-    expect(deployStackResult).not.toBeUndefined();
-    expect(mockUpdateFunction).toHaveBeenCalledWith({
-      apiId: 'apiId',
-      dataSourceName: 'my-datasource',
-      functionId: 'functionId',
-      runtime: 'APPSYNC_JS',
-      name: 'my-function',
-      code: 'new test code',
-    });
-  });
+      // WHEN
+      const deployStackResult = await hotswapMockSdkProvider.tryHotswapDeployment(hotswapMode, cdkStackArtifact);
 
-  silentTest('calls the updateFunction() API when it receives only a mapping template s3 location difference in a Function', async () => {
-    // GIVEN
-    mockS3GetObject = jest.fn().mockImplementation(async () => {
-      return { Body: 'template defined in s3' };
-    });
-    hotswapMockSdkProvider.stubS3({ getObject: mockS3GetObject });
-    const mockListFunctions = jest.fn().mockReturnValue({ functions: [{ name: 'my-function', functionId: 'functionId' }] });
-    hotswapMockSdkProvider.stubAppSync({ listFunctions: mockListFunctions, updateFunction: mockUpdateFunction });
+      // THEN
+      expect(deployStackResult).not.toBeUndefined();
+      expect(mockAppSyncClient).toHaveReceivedCommandWith(UpdateFunctionCommand, {
+        apiId: 'apiId',
+        dataSourceName: 'my-datasource',
+        functionId: 'functionId',
+        runtime: 'APPSYNC_JS',
+        name: 'my-function',
+        code: 'new test code',
+      });
+    },
+  );
+
+  silentTest(
+    'calls the updateFunction() API when it receives only a mapping template s3 location difference in a Function',
+    async () => {
+      // GIVEN
+      mockS3Client.on(GetObjectCommand).resolves({
+        Body: getBodyStream('template defined in s3'),
+      });
+      mockAppSyncClient
+        .on(ListFunctionsCommand)
+        .resolves({ functions: [{ name: 'my-function', functionId: 'functionId' }] });
 
-    setup.setCurrentCfnStackTemplate({
-      Resources: {
-        AppSyncFunction: {
-          Type: 'AWS::AppSync::FunctionConfiguration',
-          Properties: {
-            Name: 'my-function',
-            ApiId: 'apiId',
-            DataSourceName: 'my-datasource',
-            FunctionVersion: '2018-05-29',
-            RequestMappingTemplate: '## original request template',
-            ResponseMappingTemplateS3Location: 's3://test-bucket/old_location',
-          },
-          Metadata: {
-            'aws:asset:path': 'old-path',
-          },
-        },
-      },
-    });
-    const cdkStackArtifact = setup.cdkStackArtifactOf({
-      template: {
+      setup.setCurrentCfnStackTemplate({
         Resources: {
           AppSyncFunction: {
             Type: 'AWS::AppSync::FunctionConfiguration',
@@ -730,300 +747,251 @@ describe.each([HotswapMode.FALL_BACK, HotswapMode.HOTSWAP_ONLY])('%p mode', (hot
               DataSourceName: 'my-datasource',
               FunctionVersion: '2018-05-29',
               RequestMappingTemplate: '## original request template',
-              ResponseMappingTemplateS3Location: 's3://test-bucket/path/to/key',
+              ResponseMappingTemplateS3Location: 's3://test-bucket/old_location',
             },
             Metadata: {
-              'aws:asset:path': 'new-path',
+              'aws:asset:path': 'old-path',
             },
           },
         },
-      },
-    });
-
-    // WHEN
-    const deployStackResult = await hotswapMockSdkProvider.tryHotswapDeployment(hotswapMode, cdkStackArtifact);
-
-    // THEN
-    expect(deployStackResult).not.toBeUndefined();
-    expect(mockUpdateFunction).toHaveBeenCalledWith({
-      apiId: 'apiId',
-      dataSourceName: 'my-datasource',
-      functionId: 'functionId',
-      functionVersion: '2018-05-29',
-      name: 'my-function',
-      requestMappingTemplate: '## original request template',
-      responseMappingTemplate: 'template defined in s3',
-    });
-    expect(mockS3GetObject).toHaveBeenCalledWith({
-      Bucket: 'test-bucket',
-      Key: 'path/to/key',
-    });
-  });
-
-  silentTest(`when it receives a change that is not a mapping template difference in a Function, it does not call the updateFunction() API in CLASSIC mode
-        but does in HOTSWAP_ONLY mode`,
-  async () => {
-    // GIVEN
-    const mockListFunctions = jest.fn().mockReturnValue({ functions: [{ name: 'my-function', functionId: 'functionId' }] });
-    hotswapMockSdkProvider.stubAppSync({ listFunctions: mockListFunctions, updateFunction: mockUpdateFunction });
-
-    setup.setCurrentCfnStackTemplate({
-      Resources: {
-        AppSyncFunction: {
-          Type: 'AWS::AppSync::FunctionConfiguration',
-          Properties: {
-            RequestMappingTemplate: '## original request template',
-            ResponseMappingTemplate: '## original response template',
-            Name: 'my-function',
-            ApiId: 'apiId',
-            DataSourceName: 'my-datasource',
-          },
-          Metadata: {
-            'aws:asset:path': 'old-path',
-          },
-        },
-      },
-    });
-    const cdkStackArtifact = setup.cdkStackArtifactOf({
-      template: {
-        Resources: {
-          AppSyncFunction: {
-            Type: 'AWS::AppSync::FunctionConfiguration',
-            Properties: {
-              RequestMappingTemplate: '## new request template',
-              ResponseMappingTemplate: '## original response template',
-              ApiId: 'apiId',
-              Name: 'my-function',
-              DataSourceName: 'new-datasource',
+      });
+      const cdkStackArtifact = setup.cdkStackArtifactOf({
+        template: {
+          Resources: {
+            AppSyncFunction: {
+              Type: 'AWS::AppSync::FunctionConfiguration',
+              Properties: {
+                Name: 'my-function',
+                ApiId: 'apiId',
+                DataSourceName: 'my-datasource',
+                FunctionVersion: '2018-05-29',
+                RequestMappingTemplate: '## original request template',
+                ResponseMappingTemplateS3Location: 's3://test-bucket/path/to/key',
+              },
+              Metadata: {
+                'aws:asset:path': 'new-path',
+              },
             },
           },
         },
-      },
-    });
+      });
 
-    // WHEN
-    const deployStackResult = await hotswapMockSdkProvider.tryHotswapDeployment(hotswapMode, cdkStackArtifact);
+      // WHEN
+      const deployStackResult = await hotswapMockSdkProvider.tryHotswapDeployment(hotswapMode, cdkStackArtifact);
 
-    // THEN
-    if (hotswapMode === HotswapMode.FALL_BACK) {
-      expect(deployStackResult).toBeUndefined();
-      expect(mockUpdateFunction).not.toHaveBeenCalled();
-      expect(mockUpdateResolver).not.toHaveBeenCalled();
-    } else if (hotswapMode === HotswapMode.HOTSWAP_ONLY) {
+      // THEN
       expect(deployStackResult).not.toBeUndefined();
-      expect(mockUpdateFunction).toHaveBeenCalledWith({
+      expect(mockAppSyncClient).toHaveReceivedCommandWith(UpdateFunctionCommand, {
         apiId: 'apiId',
         dataSourceName: 'my-datasource',
         functionId: 'functionId',
+        functionVersion: '2018-05-29',
         name: 'my-function',
-        requestMappingTemplate: '## new request template',
-        responseMappingTemplate: '## original response template',
+        requestMappingTemplate: '## original request template',
+        responseMappingTemplate: 'template defined in s3',
       });
-      expect(mockUpdateResolver).not.toHaveBeenCalled();
-    }
-  });
+      expect(mockS3Client).toHaveReceivedCommandWith(GetObjectCommand, {
+        Bucket: 'test-bucket',
+        Key: 'path/to/key',
+      });
+    },
+  );
 
-  silentTest('does not call the updateFunction() API when a resource with type that is not AWS::AppSync::FunctionConfiguration but has the same properties is changed', async () => {
-    // GIVEN
-    setup.setCurrentCfnStackTemplate({
-      Resources: {
-        AppSyncFunction: {
-          Type: 'AWS::AppSync::NotAFunctionConfiguration',
-          Properties: {
-            RequestMappingTemplate: '## original template',
-            Name: 'my-function',
-            DataSourceName: 'my-datasource',
-          },
-          Metadata: {
-            'aws:asset:path': 'old-path',
-          },
-        },
-      },
-    });
-    const cdkStackArtifact = setup.cdkStackArtifactOf({
-      template: {
+  silentTest(
+    `when it receives a change that is not a mapping template difference in a Function, it does not call the updateFunction() API in CLASSIC mode
+        but does in HOTSWAP_ONLY mode`,
+    async () => {
+      // GIVEN
+      mockAppSyncClient
+        .on(ListFunctionsCommand)
+        .resolves({ functions: [{ name: 'my-function', functionId: 'functionId' }] });
+
+      setup.setCurrentCfnStackTemplate({
         Resources: {
           AppSyncFunction: {
-            Type: 'AWS::AppSync::NotAFunctionConfiguration',
+            Type: 'AWS::AppSync::FunctionConfiguration',
             Properties: {
-              RequestMappingTemplate: '## new template',
-              Name: 'my-resolver',
+              RequestMappingTemplate: '## original request template',
+              ResponseMappingTemplate: '## original response template',
+              Name: 'my-function',
+              ApiId: 'apiId',
               DataSourceName: 'my-datasource',
             },
+            Metadata: {
+              'aws:asset:path': 'old-path',
+            },
           },
         },
-      },
-    });
-
-    // WHEN
-    const deployStackResult = await hotswapMockSdkProvider.tryHotswapDeployment(hotswapMode, cdkStackArtifact);
-
-    // THEN
-    if (hotswapMode === HotswapMode.FALL_BACK) {
-      expect(deployStackResult).toBeUndefined();
-      expect(mockUpdateFunction).not.toHaveBeenCalled();
-      expect(mockUpdateResolver).not.toHaveBeenCalled();
-    } else if (hotswapMode === HotswapMode.HOTSWAP_ONLY) {
-      expect(deployStackResult).not.toBeUndefined();
-      expect(deployStackResult?.noOp).toEqual(true);
-      expect(mockUpdateFunction).not.toHaveBeenCalled();
-      expect(mockUpdateResolver).not.toHaveBeenCalled();
-    }
-  });
-
-  silentTest('calls the updateFunction() API with functionId when function is listed on second page', async () => {
-    // GIVEN
-    const mockListFunctions = jest
-      .fn()
-      .mockReturnValueOnce({
-        functions: [{ name: 'other-function', functionId: 'other-functionId' }],
-        nextToken: 'nexttoken',
-      })
-      .mockReturnValueOnce({
-        functions: [{ name: 'my-function', functionId: 'functionId' }],
       });
-    hotswapMockSdkProvider.stubAppSync({
-      listFunctions: mockListFunctions,
-      updateFunction: mockUpdateFunction,
-    });
-
-    setup.setCurrentCfnStackTemplate({
-      Resources: {
-        AppSyncFunction: {
-          Type: 'AWS::AppSync::FunctionConfiguration',
-          Properties: {
-            Name: 'my-function',
-            ApiId: 'apiId',
-            DataSourceName: 'my-datasource',
-            FunctionVersion: '2018-05-29',
-            Runtime: 'APPSYNC_JS',
-            Code: 'old test code',
-          },
-          Metadata: {
-            'aws:asset:path': 'old-path',
+      const cdkStackArtifact = setup.cdkStackArtifactOf({
+        template: {
+          Resources: {
+            AppSyncFunction: {
+              Type: 'AWS::AppSync::FunctionConfiguration',
+              Properties: {
+                RequestMappingTemplate: '## new request template',
+                ResponseMappingTemplate: '## original response template',
+                ApiId: 'apiId',
+                Name: 'my-function',
+                DataSourceName: 'new-datasource',
+              },
+            },
           },
         },
-      },
-    });
-    const cdkStackArtifact = setup.cdkStackArtifactOf({
-      template: {
+      });
+
+      // WHEN
+      const deployStackResult = await hotswapMockSdkProvider.tryHotswapDeployment(hotswapMode, cdkStackArtifact);
+
+      // THEN
+      if (hotswapMode === HotswapMode.FALL_BACK) {
+        expect(deployStackResult).toBeUndefined();
+      } else if (hotswapMode === HotswapMode.HOTSWAP_ONLY) {
+        expect(deployStackResult).not.toBeUndefined();
+        expect(mockAppSyncClient).toHaveReceivedCommandWith(UpdateFunctionCommand, {
+          apiId: 'apiId',
+          dataSourceName: 'my-datasource',
+          functionId: 'functionId',
+          name: 'my-function',
+          requestMappingTemplate: '## new request template',
+          responseMappingTemplate: '## original response template',
+        });
+        expect(mockAppSyncClient).not.toHaveReceivedCommand(UpdateResolverCommand);
+      }
+    },
+  );
+
+  silentTest(
+    'does not call the updateFunction() API when a resource with type that is not AWS::AppSync::FunctionConfiguration but has the same properties is changed',
+    async () => {
+      // GIVEN
+      setup.setCurrentCfnStackTemplate({
         Resources: {
           AppSyncFunction: {
-            Type: 'AWS::AppSync::FunctionConfiguration',
+            Type: 'AWS::AppSync::NotAFunctionConfiguration',
             Properties: {
+              RequestMappingTemplate: '## original template',
               Name: 'my-function',
-              ApiId: 'apiId',
               DataSourceName: 'my-datasource',
-              FunctionVersion: '2018-05-29',
-              Runtime: 'APPSYNC_JS',
-              Code: 'new test code',
             },
             Metadata: {
-              'aws:asset:path': 'new-path',
+              'aws:asset:path': 'old-path',
             },
           },
         },
-      },
-    });
-
-    // WHEN
-    const deployStackResult =
-      await hotswapMockSdkProvider.tryHotswapDeployment(
-        hotswapMode,
-        cdkStackArtifact,
-      );
-
-    // THEN
-    expect(deployStackResult).not.toBeUndefined();
-    expect(mockListFunctions).toHaveBeenCalledTimes(2);
-    expect(mockListFunctions).toHaveBeenCalledWith({
-      apiId: 'apiId',
-      nextToken: undefined,
-    });
-    expect(mockListFunctions).toHaveBeenCalledWith({
-      apiId: 'apiId',
-      nextToken: 'nexttoken',
-    });
-    expect(mockUpdateFunction).toHaveBeenCalledWith({
-      apiId: 'apiId',
-      dataSourceName: 'my-datasource',
-      functionId: 'functionId',
-      runtime: 'APPSYNC_JS',
-      name: 'my-function',
-      code: 'new test code',
-    });
-  });
-
-  silentTest('calls the startSchemaCreation() API when it receives only a definition difference in a graphql schema', async () => {
-    // GIVEN
-    mockStartSchemaCreation = jest.fn().mockReturnValueOnce({ status: 'SUCCESS' });
-    hotswapMockSdkProvider.stubAppSync({ startSchemaCreation: mockStartSchemaCreation });
-
-    setup.setCurrentCfnStackTemplate({
-      Resources: {
-        AppSyncGraphQLSchema: {
-          Type: 'AWS::AppSync::GraphQLSchema',
-          Properties: {
-            ApiId: 'apiId',
-            Definition: 'original graphqlSchema',
-          },
-          Metadata: {
-            'aws:asset:path': 'old-path',
+      });
+      const cdkStackArtifact = setup.cdkStackArtifactOf({
+        template: {
+          Resources: {
+            AppSyncFunction: {
+              Type: 'AWS::AppSync::NotAFunctionConfiguration',
+              Properties: {
+                RequestMappingTemplate: '## new template',
+                Name: 'my-resolver',
+                DataSourceName: 'my-datasource',
+              },
+            },
           },
         },
-      },
-    });
-    setup.pushStackResourceSummaries(
-      setup.stackSummaryOf(
-        'AppSyncGraphQLSchema',
-        'AWS::AppSync::GraphQLSchema',
-        'arn:aws:appsync:us-east-1:111111111111:apis/apiId/schema/my-schema',
-      ),
-    );
-    const cdkStackArtifact = setup.cdkStackArtifactOf({
-      template: {
+      });
+
+      // WHEN
+      const deployStackResult = await hotswapMockSdkProvider.tryHotswapDeployment(hotswapMode, cdkStackArtifact);
+
+      // THEN
+      if (hotswapMode === HotswapMode.FALL_BACK) {
+        expect(deployStackResult).toBeUndefined();
+      } else if (hotswapMode === HotswapMode.HOTSWAP_ONLY) {
+        expect(deployStackResult).not.toBeUndefined();
+        expect(deployStackResult?.noOp).toEqual(true);
+      }
+
+      expect(mockAppSyncClient).not.toHaveReceivedCommand(UpdateFunctionCommand);
+      expect(mockAppSyncClient).not.toHaveReceivedCommand(UpdateResolverCommand);
+    },
+  );
+
+  silentTest(
+    'calls the startSchemaCreation() API when it receives only a definition difference in a graphql schema',
+    async () => {
+      // GIVEN
+      mockAppSyncClient.on(StartSchemaCreationCommand).resolvesOnce({
+        status: 'SUCCESS',
+      });
+
+      setup.setCurrentCfnStackTemplate({
         Resources: {
           AppSyncGraphQLSchema: {
             Type: 'AWS::AppSync::GraphQLSchema',
             Properties: {
               ApiId: 'apiId',
-              Definition: 'new graphqlSchema',
+              Definition: 'original graphqlSchema',
             },
             Metadata: {
-              'aws:asset:path': 'new-path',
+              'aws:asset:path': 'old-path',
             },
           },
         },
-      },
-    });
+      });
+      setup.pushStackResourceSummaries(
+        setup.stackSummaryOf(
+          'AppSyncGraphQLSchema',
+          'AWS::AppSync::GraphQLSchema',
+          'arn:aws:appsync:us-east-1:111111111111:apis/apiId/schema/my-schema',
+        ),
+      );
+      const cdkStackArtifact = setup.cdkStackArtifactOf({
+        template: {
+          Resources: {
+            AppSyncGraphQLSchema: {
+              Type: 'AWS::AppSync::GraphQLSchema',
+              Properties: {
+                ApiId: 'apiId',
+                Definition: 'new graphqlSchema',
+              },
+              Metadata: {
+                'aws:asset:path': 'new-path',
+              },
+            },
+          },
+        },
+      });
 
-    // WHEN
-    const deployStackResult = await hotswapMockSdkProvider.tryHotswapDeployment(hotswapMode, cdkStackArtifact);
+      // WHEN
+      const deployStackResult = await hotswapMockSdkProvider.tryHotswapDeployment(hotswapMode, cdkStackArtifact);
 
-    // THEN
-    expect(deployStackResult).not.toBeUndefined();
-    expect(mockStartSchemaCreation).toHaveBeenCalledWith({
-      apiId: 'apiId',
-      definition: 'new graphqlSchema',
-    });
-  });
+      // THEN
+      expect(deployStackResult).not.toBeUndefined();
+      expect(mockAppSyncClient).toHaveReceivedCommandWith(StartSchemaCreationCommand, {
+        apiId: 'apiId',
+        definition: 'new graphqlSchema',
+      });
+    },
+  );
 
-  silentTest('calls the startSchemaCreation() API when it receives only a definition s3 location difference in a graphql schema', async () => {
+  silentTest('calls the updateFunction() API with functionId when function is listed on second page', async () => {
     // GIVEN
-    mockS3GetObject = jest.fn().mockImplementation(async () => {
-      return { Body: 'schema defined in s3' };
-    });
-    hotswapMockSdkProvider.stubS3({ getObject: mockS3GetObject });
-    mockStartSchemaCreation = jest.fn().mockReturnValueOnce({ status: 'SUCCESS' });
-    hotswapMockSdkProvider.stubAppSync({ startSchemaCreation: mockStartSchemaCreation });
+    mockAppSyncClient
+      .on(ListFunctionsCommand)
+      .resolvesOnce({
+        functions: [{ name: 'other-function', functionId: 'other-functionId' }],
+        nextToken: 'nextToken',
+      })
+      .resolvesOnce({
+        functions: [{ name: 'my-function', functionId: 'functionId' }],
+      });
 
     setup.setCurrentCfnStackTemplate({
       Resources: {
-        AppSyncGraphQLSchema: {
-          Type: 'AWS::AppSync::GraphQLSchema',
+        AppSyncFunction: {
+          Type: 'AWS::AppSync::FunctionConfiguration',
           Properties: {
+            Name: 'my-function',
             ApiId: 'apiId',
-            DefinitionS3Location: 's3://test-bucket/old_location',
+            DataSourceName: 'my-datasource',
+            FunctionVersion: '2018-05-29',
+            Runtime: 'APPSYNC_JS',
+            Code: 'old test code',
           },
           Metadata: {
             'aws:asset:path': 'old-path',
@@ -1031,21 +999,18 @@ describe.each([HotswapMode.FALL_BACK, HotswapMode.HOTSWAP_ONLY])('%p mode', (hot
         },
       },
     });
-    setup.pushStackResourceSummaries(
-      setup.stackSummaryOf(
-        'AppSyncGraphQLSchema',
-        'AWS::AppSync::GraphQLSchema',
-        'arn:aws:appsync:us-east-1:111111111111:apis/apiId/schema/my-schema',
-      ),
-    );
     const cdkStackArtifact = setup.cdkStackArtifactOf({
       template: {
         Resources: {
-          AppSyncGraphQLSchema: {
-            Type: 'AWS::AppSync::GraphQLSchema',
+          AppSyncFunction: {
+            Type: 'AWS::AppSync::FunctionConfiguration',
             Properties: {
+              Name: 'my-function',
               ApiId: 'apiId',
-              DefinitionS3Location: 's3://test-bucket/path/to/key',
+              DataSourceName: 'my-datasource',
+              FunctionVersion: '2018-05-29',
+              Runtime: 'APPSYNC_JS',
+              Code: 'new test code',
             },
             Metadata: {
               'aws:asset:path': 'new-path',
@@ -1060,135 +1025,262 @@ describe.each([HotswapMode.FALL_BACK, HotswapMode.HOTSWAP_ONLY])('%p mode', (hot
 
     // THEN
     expect(deployStackResult).not.toBeUndefined();
-    expect(mockStartSchemaCreation).toHaveBeenCalledWith({
+    expect(mockAppSyncClient).toHaveReceivedCommandTimes(ListFunctionsCommand, 2);
+    expect(mockAppSyncClient).toHaveReceivedNthCommandWith(1, ListFunctionsCommand, {
+      apiId: 'apiId',
+      nextToken: 'nextToken',
+    });
+    expect(mockAppSyncClient).toHaveReceivedNthCommandWith(2, ListFunctionsCommand, {
       apiId: 'apiId',
-      definition: 'schema defined in s3',
     });
 
-    expect(mockS3GetObject).toHaveBeenCalledWith({
-      Bucket: 'test-bucket',
-      Key: 'path/to/key',
+    expect(mockAppSyncClient).toHaveReceivedCommandWith(UpdateFunctionCommand, {
+      apiId: 'apiId',
+      dataSourceName: 'my-datasource',
+      functionId: 'functionId',
+      runtime: 'APPSYNC_JS',
+      name: 'my-function',
+      code: 'new test code',
     });
   });
 
-  silentTest('does not call startSchemaCreation() API when a resource with type that is not AWS::AppSync::GraphQLSchema but has the same properties is change', async () => {
-    // GIVEN
-    setup.setCurrentCfnStackTemplate({
-      Resources: {
-        AppSyncGraphQLSchema: {
-          Type: 'AWS::AppSync::NotGraphQLSchema',
-          Properties: {
-            ApiId: 'apiId',
-            Definition: 'original graphqlSchema',
+  silentTest(
+    'calls the startSchemaCreation() API when it receives only a definition difference in a graphql schema',
+    async () => {
+      // GIVEN
+      mockAppSyncClient.on(StartSchemaCreationCommand).resolves({ status: 'SUCCESS' });
+
+      setup.setCurrentCfnStackTemplate({
+        Resources: {
+          AppSyncGraphQLSchema: {
+            Type: 'AWS::AppSync::GraphQLSchema',
+            Properties: {
+              ApiId: 'apiId',
+              Definition: 'original graphqlSchema',
+            },
+            Metadata: {
+              'aws:asset:path': 'old-path',
+            },
           },
-          Metadata: {
-            'aws:asset:path': 'old-path',
+        },
+      });
+      setup.pushStackResourceSummaries(
+        setup.stackSummaryOf(
+          'AppSyncGraphQLSchema',
+          'AWS::AppSync::GraphQLSchema',
+          'arn:aws:appsync:us-east-1:111111111111:apis/apiId/schema/my-schema',
+        ),
+      );
+      const cdkStackArtifact = setup.cdkStackArtifactOf({
+        template: {
+          Resources: {
+            AppSyncGraphQLSchema: {
+              Type: 'AWS::AppSync::GraphQLSchema',
+              Properties: {
+                ApiId: 'apiId',
+                Definition: 'new graphqlSchema',
+              },
+              Metadata: {
+                'aws:asset:path': 'new-path',
+              },
+            },
           },
         },
-      },
-    });
-    setup.pushStackResourceSummaries(
-      setup.stackSummaryOf(
-        'AppSyncGraphQLSchema',
-        'AWS::AppSync::GraphQLSchema',
-        'arn:aws:appsync:us-east-1:111111111111:apis/apiId/schema/my-schema',
-      ),
-    );
-    const cdkStackArtifact = setup.cdkStackArtifactOf({
-      template: {
+      });
+
+      // WHEN
+      const deployStackResult = await hotswapMockSdkProvider.tryHotswapDeployment(hotswapMode, cdkStackArtifact);
+
+      // THEN
+      expect(deployStackResult).not.toBeUndefined();
+      expect(mockAppSyncClient).toHaveReceivedCommandWith(StartSchemaCreationCommand, {
+        apiId: 'apiId',
+        definition: 'new graphqlSchema',
+      });
+    },
+  );
+  silentTest(
+    'calls the startSchemaCreation() API when it receives only a definition s3 location difference in a graphql schema',
+    async () => {
+      // GIVEN
+      mockS3Client.on(GetObjectCommand).resolves({
+        Body: getBodyStream('schema defined in s3'),
+      });
+      setup.setCurrentCfnStackTemplate({
         Resources: {
           AppSyncGraphQLSchema: {
-            Type: 'AWS::AppSync::NotGraphQLSchema',
+            Type: 'AWS::AppSync::GraphQLSchema',
             Properties: {
               ApiId: 'apiId',
-              Definition: 'new graphqlSchema',
+              DefinitionS3Location: 's3://test-bucket/old_location',
             },
             Metadata: {
-              'aws:asset:path': 'new-path',
+              'aws:asset:path': 'old-path',
             },
           },
         },
-      },
-    });
+      });
+      setup.pushStackResourceSummaries(
+        setup.stackSummaryOf(
+          'AppSyncGraphQLSchema',
+          'AWS::AppSync::GraphQLSchema',
+          'arn:aws:appsync:us-east-1:111111111111:apis/apiId/schema/my-schema',
+        ),
+      );
+      const cdkStackArtifact = setup.cdkStackArtifactOf({
+        template: {
+          Resources: {
+            AppSyncGraphQLSchema: {
+              Type: 'AWS::AppSync::GraphQLSchema',
+              Properties: {
+                ApiId: 'apiId',
+                DefinitionS3Location: 's3://test-bucket/path/to/key',
+              },
+              Metadata: {
+                'aws:asset:path': 'new-path',
+              },
+            },
+          },
+        },
+      });
 
-    // WHEN
-    const deployStackResult = await hotswapMockSdkProvider.tryHotswapDeployment(hotswapMode, cdkStackArtifact);
+      // WHEN
+      const deployStackResult = await hotswapMockSdkProvider.tryHotswapDeployment(hotswapMode, cdkStackArtifact);
 
-    // THEN
-    if (hotswapMode === HotswapMode.FALL_BACK) {
-      expect(deployStackResult).toBeUndefined();
-      expect(mockStartSchemaCreation).not.toHaveBeenCalled();
-    } else if (hotswapMode === HotswapMode.HOTSWAP_ONLY) {
+      // THEN
       expect(deployStackResult).not.toBeUndefined();
-      expect(deployStackResult?.noOp).toEqual(true);
-      expect(mockStartSchemaCreation).not.toHaveBeenCalled();
-    }
-  });
-
-  silentTest('calls the startSchemaCreation() and waits for schema creation to stabilize before finishing', async () => {
-    // GIVEN
-    mockStartSchemaCreation = jest.fn().mockReturnValueOnce({ status: 'PROCESSING' });
-    const mockGetSchemaCreation = jest.fn().mockReturnValueOnce({ status: 'SUCCESS' });
-    hotswapMockSdkProvider.stubAppSync({ startSchemaCreation: mockStartSchemaCreation, getSchemaCreationStatus: mockGetSchemaCreation });
+      expect(mockAppSyncClient).toHaveReceivedCommandWith(StartSchemaCreationCommand, {
+        apiId: 'apiId',
+        definition: 'schema defined in s3',
+      });
 
-    setup.setCurrentCfnStackTemplate({
-      Resources: {
-        AppSyncGraphQLSchema: {
-          Type: 'AWS::AppSync::GraphQLSchema',
-          Properties: {
-            ApiId: 'apiId',
-            Definition: 'original graphqlSchema',
+      expect(mockS3Client).toHaveReceivedCommandWith(GetObjectCommand, {
+        Bucket: 'test-bucket',
+        Key: 'path/to/key',
+      });
+    },
+  );
+
+  silentTest(
+    'does not call startSchemaCreation() API when a resource with type that is not AWS::AppSync::GraphQLSchema but has the same properties is change',
+    async () => {
+      // GIVEN
+      setup.setCurrentCfnStackTemplate({
+        Resources: {
+          AppSyncGraphQLSchema: {
+            Type: 'AWS::AppSync::NotGraphQLSchema',
+            Properties: {
+              ApiId: 'apiId',
+              Definition: 'original graphqlSchema',
+            },
+            Metadata: {
+              'aws:asset:path': 'old-path',
+            },
           },
-          Metadata: {
-            'aws:asset:path': 'old-path',
+        },
+      });
+      setup.pushStackResourceSummaries(
+        setup.stackSummaryOf(
+          'AppSyncGraphQLSchema',
+          'AWS::AppSync::GraphQLSchema',
+          'arn:aws:appsync:us-east-1:111111111111:apis/apiId/schema/my-schema',
+        ),
+      );
+      const cdkStackArtifact = setup.cdkStackArtifactOf({
+        template: {
+          Resources: {
+            AppSyncGraphQLSchema: {
+              Type: 'AWS::AppSync::NotGraphQLSchema',
+              Properties: {
+                ApiId: 'apiId',
+                Definition: 'new graphqlSchema',
+              },
+              Metadata: {
+                'aws:asset:path': 'new-path',
+              },
+            },
           },
         },
-      },
-    });
-    setup.pushStackResourceSummaries(
-      setup.stackSummaryOf(
-        'AppSyncGraphQLSchema',
-        'AWS::AppSync::GraphQLSchema',
-        'arn:aws:appsync:us-east-1:111111111111:apis/apiId/schema/my-schema',
-      ),
-    );
-    const cdkStackArtifact = setup.cdkStackArtifactOf({
-      template: {
+      });
+
+      // WHEN
+      const deployStackResult = await hotswapMockSdkProvider.tryHotswapDeployment(hotswapMode, cdkStackArtifact);
+
+      // THEN
+      if (hotswapMode === HotswapMode.FALL_BACK) {
+        expect(deployStackResult).toBeUndefined();
+      } else if (hotswapMode === HotswapMode.HOTSWAP_ONLY) {
+        expect(deployStackResult).not.toBeUndefined();
+        expect(deployStackResult?.noOp).toEqual(true);
+      }
+
+      expect(mockAppSyncClient).not.toHaveReceivedCommand(StartSchemaCreationCommand);
+    },
+  );
+
+  silentTest(
+    'calls the startSchemaCreation() and waits for schema creation to stabilize before finishing',
+    async () => {
+      // GIVEN
+      mockAppSyncClient.on(StartSchemaCreationCommand).resolvesOnce({ status: 'PROCESSING' });
+      mockAppSyncClient.on(GetSchemaCreationStatusCommand).resolvesOnce({ status: 'SUCCESS' });
+      setup.setCurrentCfnStackTemplate({
         Resources: {
           AppSyncGraphQLSchema: {
             Type: 'AWS::AppSync::GraphQLSchema',
             Properties: {
               ApiId: 'apiId',
-              Definition: 'new graphqlSchema',
+              Definition: 'original graphqlSchema',
             },
             Metadata: {
-              'aws:asset:path': 'new-path',
+              'aws:asset:path': 'old-path',
             },
           },
         },
-      },
-    });
+      });
+      setup.pushStackResourceSummaries(
+        setup.stackSummaryOf(
+          'AppSyncGraphQLSchema',
+          'AWS::AppSync::GraphQLSchema',
+          'arn:aws:appsync:us-east-1:111111111111:apis/apiId/schema/my-schema',
+        ),
+      );
+      const cdkStackArtifact = setup.cdkStackArtifactOf({
+        template: {
+          Resources: {
+            AppSyncGraphQLSchema: {
+              Type: 'AWS::AppSync::GraphQLSchema',
+              Properties: {
+                ApiId: 'apiId',
+                Definition: 'new graphqlSchema',
+              },
+              Metadata: {
+                'aws:asset:path': 'new-path',
+              },
+            },
+          },
+        },
+      });
 
-    // WHEN
-    const deployStackResult = await hotswapMockSdkProvider.tryHotswapDeployment(hotswapMode, cdkStackArtifact);
+      // WHEN
+      const deployStackResult = await hotswapMockSdkProvider.tryHotswapDeployment(hotswapMode, cdkStackArtifact);
 
-    // THEN
-    expect(deployStackResult).not.toBeUndefined();
-    expect(mockStartSchemaCreation).toHaveBeenCalledWith({
-      apiId: 'apiId',
-      definition: 'new graphqlSchema',
-    });
-    expect(mockGetSchemaCreation).toHaveBeenCalledWith({
-      apiId: 'apiId',
-    });
-  });
+      // THEN
+      expect(deployStackResult).not.toBeUndefined();
+      expect(mockAppSyncClient).toHaveReceivedCommandWith(StartSchemaCreationCommand, {
+        apiId: 'apiId',
+        definition: 'new graphqlSchema',
+      });
+      expect(mockAppSyncClient).toHaveReceivedCommandWith(GetSchemaCreationStatusCommand, {
+        apiId: 'apiId',
+      });
+    },
+  );
 
   silentTest('calls the startSchemaCreation() and throws if schema creation fails', async () => {
     // GIVEN
-    mockStartSchemaCreation = jest.fn().mockReturnValueOnce({ status: 'PROCESSING' });
-    const mockGetSchemaCreation = jest.fn().mockReturnValueOnce({ status: 'FAILED', details: 'invalid schema' });
-    hotswapMockSdkProvider.stubAppSync({ startSchemaCreation: mockStartSchemaCreation, getSchemaCreationStatus: mockGetSchemaCreation });
-
+    mockAppSyncClient.on(StartSchemaCreationCommand).resolvesOnce({ status: 'PROCESSING' });
+    mockAppSyncClient.on(GetSchemaCreationStatusCommand).resolvesOnce({ status: 'FAILED', details: 'invalid schema' });
     setup.setCurrentCfnStackTemplate({
       Resources: {
         AppSyncGraphQLSchema: {
@@ -1228,121 +1320,129 @@ describe.each([HotswapMode.FALL_BACK, HotswapMode.HOTSWAP_ONLY])('%p mode', (hot
     });
 
     // WHEN
-    await expect(() => hotswapMockSdkProvider.tryHotswapDeployment(hotswapMode, cdkStackArtifact)).rejects.toThrow('invalid schema');
+    await expect(() => hotswapMockSdkProvider.tryHotswapDeployment(hotswapMode, cdkStackArtifact)).rejects.toThrow(
+      'invalid schema',
+    );
 
     // THEN
-    expect(mockStartSchemaCreation).toHaveBeenCalledWith({
+    expect(mockAppSyncClient).toHaveReceivedCommandWith(StartSchemaCreationCommand, {
       apiId: 'apiId',
       definition: 'new graphqlSchema',
     });
-    expect(mockGetSchemaCreation).toHaveBeenCalledWith({
+    expect(mockAppSyncClient).toHaveReceivedCommandWith(GetSchemaCreationStatusCommand, {
       apiId: 'apiId',
     });
   });
 
-  silentTest('calls the updateApiKey() API when it receives only a expires property difference in an AppSync ApiKey', async () => {
-    // GIVEN
-    setup.setCurrentCfnStackTemplate({
-      Resources: {
-        AppSyncApiKey: {
-          Type: 'AWS::AppSync::ApiKey',
-          Properties: {
-            ApiId: 'apiId',
-            Expires: 1000,
-            Id: 'key-id',
-          },
-          Metadata: {
-            'aws:asset:path': 'old-path',
-          },
-        },
-      },
-    });
-    setup.pushStackResourceSummaries(
-      setup.stackSummaryOf(
-        'AppSyncApiKey',
-        'AWS::AppSync::ApiKey',
-        'arn:aws:appsync:us-east-1:111111111111:apis/apiId/apikeys/api-key-id',
-      ),
-    );
-    const cdkStackArtifact = setup.cdkStackArtifactOf({
-      template: {
+  silentTest(
+    'calls the updateApiKey() API when it receives only a expires property difference in an AppSync ApiKey',
+    async () => {
+      // GIVEN
+      setup.setCurrentCfnStackTemplate({
         Resources: {
           AppSyncApiKey: {
             Type: 'AWS::AppSync::ApiKey',
             Properties: {
               ApiId: 'apiId',
-              Expires: 1001,
+              Expires: 1000,
               Id: 'key-id',
             },
             Metadata: {
-              'aws:asset:path': 'new-path',
+              'aws:asset:path': 'old-path',
             },
           },
         },
-      },
-    });
-
-    // WHEN
-    const deployStackResult = await hotswapMockSdkProvider.tryHotswapDeployment(hotswapMode, cdkStackArtifact);
-
-    // THEN
-    expect(deployStackResult).not.toBeUndefined();
-    expect(mockUpdateApiKey).toHaveBeenCalledWith({
-      apiId: 'apiId',
-      expires: 1001,
-      id: 'key-id',
-    });
-  });
-
-  silentTest('calls the updateApiKey() API when it receives only a expires property difference and no api-key-id in an AppSync ApiKey', async () => {
-    // GIVEN
-    setup.setCurrentCfnStackTemplate({
-      Resources: {
-        AppSyncApiKey: {
-          Type: 'AWS::AppSync::ApiKey',
-          Properties: {
-            ApiId: 'apiId',
-            Expires: 1000,
-          },
-          Metadata: {
-            'aws:asset:path': 'old-path',
+      });
+      setup.pushStackResourceSummaries(
+        setup.stackSummaryOf(
+          'AppSyncApiKey',
+          'AWS::AppSync::ApiKey',
+          'arn:aws:appsync:us-east-1:111111111111:apis/apiId/apikeys/api-key-id',
+        ),
+      );
+      const cdkStackArtifact = setup.cdkStackArtifactOf({
+        template: {
+          Resources: {
+            AppSyncApiKey: {
+              Type: 'AWS::AppSync::ApiKey',
+              Properties: {
+                ApiId: 'apiId',
+                Expires: 1001,
+                Id: 'key-id',
+              },
+              Metadata: {
+                'aws:asset:path': 'new-path',
+              },
+            },
           },
         },
-      },
-    });
-    setup.pushStackResourceSummaries(
-      setup.stackSummaryOf(
-        'AppSyncApiKey',
-        'AWS::AppSync::ApiKey',
-        'arn:aws:appsync:us-east-1:111111111111:apis/apiId/apikeys/api-key-id',
-      ),
-    );
-    const cdkStackArtifact = setup.cdkStackArtifactOf({
-      template: {
+      });
+
+      // WHEN
+      const deployStackResult = await hotswapMockSdkProvider.tryHotswapDeployment(hotswapMode, cdkStackArtifact);
+
+      // THEN
+      expect(deployStackResult).not.toBeUndefined();
+      expect(mockAppSyncClient).toHaveReceivedCommandWith(UpdateApiKeyCommand, {
+        apiId: 'apiId',
+        expires: 1001,
+        id: 'key-id',
+      });
+    },
+  );
+
+  silentTest(
+    'calls the updateApiKey() API when it receives only a expires property difference and no api-key-id in an AppSync ApiKey',
+    async () => {
+      // GIVEN
+      setup.setCurrentCfnStackTemplate({
         Resources: {
           AppSyncApiKey: {
             Type: 'AWS::AppSync::ApiKey',
             Properties: {
               ApiId: 'apiId',
-              Expires: 1001,
+              Expires: 1000,
             },
             Metadata: {
-              'aws:asset:path': 'new-path',
+              'aws:asset:path': 'old-path',
             },
           },
         },
-      },
-    });
+      });
+      setup.pushStackResourceSummaries(
+        setup.stackSummaryOf(
+          'AppSyncApiKey',
+          'AWS::AppSync::ApiKey',
+          'arn:aws:appsync:us-east-1:111111111111:apis/apiId/apikeys/api-key-id',
+        ),
+      );
+      const cdkStackArtifact = setup.cdkStackArtifactOf({
+        template: {
+          Resources: {
+            AppSyncApiKey: {
+              Type: 'AWS::AppSync::ApiKey',
+              Properties: {
+                ApiId: 'apiId',
+                Expires: 1001,
+              },
+              Metadata: {
+                'aws:asset:path': 'new-path',
+              },
+            },
+          },
+        },
+      });
 
-    // WHEN
-    const deployStackResult = await hotswapMockSdkProvider.tryHotswapDeployment(hotswapMode, cdkStackArtifact);
+      // WHEN
+      const deployStackResult = await hotswapMockSdkProvider.tryHotswapDeployment(hotswapMode, cdkStackArtifact);
 
-    // THEN
-    expect(deployStackResult).not.toBeUndefined();
-    expect(mockUpdateApiKey).toHaveBeenCalledWith({
-      apiId: 'apiId',
-      expires: 1001,
-      id: 'api-key-id',
-    });
-  });
+      // THEN
+      expect(deployStackResult).not.toBeUndefined();
+      expect(mockAppSyncClient).toHaveReceivedCommandWith(UpdateApiKeyCommand, {
+        apiId: 'apiId',
+        expires: 1001,
+        id: 'api-key-id',
+      });
+    },
+  );
 });
diff --git a/packages/aws-cdk/test/api/hotswap/code-build-projects-hotswap-deployments.test.ts b/packages/aws-cdk/test/api/hotswap/code-build-projects-hotswap-deployments.test.ts
index aafb28db07a7b..42bf66af284c2 100644
--- a/packages/aws-cdk/test/api/hotswap/code-build-projects-hotswap-deployments.test.ts
+++ b/packages/aws-cdk/test/api/hotswap/code-build-projects-hotswap-deployments.test.ts
@@ -1,15 +1,13 @@
-import { CodeBuild } from 'aws-sdk';
+import { UpdateProjectCommand } from '@aws-sdk/client-codebuild';
 import * as setup from './hotswap-test-setup';
 import { HotswapMode } from '../../../lib/api/hotswap/common';
+import { mockCodeBuildClient } from '../../util/mock-sdk';
 import { silentTest } from '../../util/silent';
 
 let hotswapMockSdkProvider: setup.HotswapMockSdkProvider;
-let mockUpdateProject: (params: CodeBuild.UpdateProjectInput) => CodeBuild.UpdateProjectOutput;
 
 beforeEach(() => {
   hotswapMockSdkProvider = setup.setupHotswapTests();
-  mockUpdateProject = jest.fn();
-  hotswapMockSdkProvider.setUpdateProjectMock(mockUpdateProject);
 });
 
 describe.each([HotswapMode.FALL_BACK, HotswapMode.HOTSWAP_ONLY])('%p mode', (hotswapMode) => {
@@ -31,7 +29,7 @@ describe.each([HotswapMode.FALL_BACK, HotswapMode.HOTSWAP_ONLY])('%p mode', (hot
 
       // THEN
       expect(deployStackResult).toBeUndefined();
-      expect(mockUpdateProject).not.toHaveBeenCalled();
+      expect(mockCodeBuildClient).not.toHaveReceivedCommand(UpdateProjectCommand);
     } else if (hotswapMode === HotswapMode.HOTSWAP_ONLY) {
       // WHEN
       const deployStackResult = await hotswapMockSdkProvider.tryHotswapDeployment(hotswapMode, cdkStackArtifact);
@@ -39,85 +37,71 @@ describe.each([HotswapMode.FALL_BACK, HotswapMode.HOTSWAP_ONLY])('%p mode', (hot
       // THEN
       expect(deployStackResult).not.toBeUndefined();
       expect(deployStackResult?.noOp).toEqual(true);
-      expect(mockUpdateProject).not.toHaveBeenCalled();
+      expect(mockCodeBuildClient).not.toHaveReceivedCommand(UpdateProjectCommand);
     }
   });
 
-  silentTest('calls the updateProject() API when it receives only a source difference in a CodeBuild project', async () => {
-    // GIVEN
-    setup.setCurrentCfnStackTemplate({
-      Resources: {
-        CodeBuildProject: {
-          Type: 'AWS::CodeBuild::Project',
-          Properties: {
-            Source: {
-              BuildSpec: 'current-spec',
-              Type: 'NO_SOURCE',
-            },
-            Name: 'my-project',
-          },
-          Metadata: {
-            'aws:asset:path': 'old-path',
-          },
-        },
-      },
-    });
-    const cdkStackArtifact = setup.cdkStackArtifactOf({
-      template: {
+  silentTest(
+    'calls the updateProject() API when it receives only a source difference in a CodeBuild project',
+    async () => {
+      // GIVEN
+      setup.setCurrentCfnStackTemplate({
         Resources: {
           CodeBuildProject: {
             Type: 'AWS::CodeBuild::Project',
             Properties: {
               Source: {
-                BuildSpec: 'new-spec',
+                BuildSpec: 'current-spec',
                 Type: 'NO_SOURCE',
               },
               Name: 'my-project',
             },
             Metadata: {
-              'aws:asset:path': 'new-path',
+              'aws:asset:path': 'old-path',
             },
           },
         },
-      },
-    });
-
-    // WHEN
-    const deployStackResult = await hotswapMockSdkProvider.tryHotswapDeployment(hotswapMode, cdkStackArtifact);
+      });
+      const cdkStackArtifact = setup.cdkStackArtifactOf({
+        template: {
+          Resources: {
+            CodeBuildProject: {
+              Type: 'AWS::CodeBuild::Project',
+              Properties: {
+                Source: {
+                  BuildSpec: 'new-spec',
+                  Type: 'NO_SOURCE',
+                },
+                Name: 'my-project',
+              },
+              Metadata: {
+                'aws:asset:path': 'new-path',
+              },
+            },
+          },
+        },
+      });
 
-    // THEN
-    expect(deployStackResult).not.toBeUndefined();
-    expect(mockUpdateProject).toHaveBeenCalledWith({
-      name: 'my-project',
-      source: {
-        type: 'NO_SOURCE',
-        buildspec: 'new-spec',
-      },
-    });
-  });
+      // WHEN
+      const deployStackResult = await hotswapMockSdkProvider.tryHotswapDeployment(hotswapMode, cdkStackArtifact);
 
-  silentTest('calls the updateProject() API when it receives only a source version difference in a CodeBuild project', async () => {
-    // GIVEN
-    setup.setCurrentCfnStackTemplate({
-      Resources: {
-        CodeBuildProject: {
-          Type: 'AWS::CodeBuild::Project',
-          Properties: {
-            Source: {
-              BuildSpec: 'current-spec',
-              Type: 'NO_SOURCE',
-            },
-            Name: 'my-project',
-            SourceVersion: 'v1',
-          },
-          Metadata: {
-            'aws:asset:path': 'old-path',
-          },
+      // THEN
+      expect(deployStackResult).not.toBeUndefined();
+      expect(mockCodeBuildClient).toHaveReceivedCommandWith(UpdateProjectCommand, {
+        name: 'my-project',
+        source: {
+          type: 'NO_SOURCE',
+          buildspec: 'new-spec',
         },
-      },
-    });
-    const cdkStackArtifact = setup.cdkStackArtifactOf({
-      template: {
+      });
+    },
+  );
+
+  silentTest(
+    'calls the updateProject() API when it receives only a source version difference in a CodeBuild project',
+    async () => {
+      // GIVEN
+      setup.setCurrentCfnStackTemplate({
         Resources: {
           CodeBuildProject: {
             Type: 'AWS::CodeBuild::Project',
@@ -127,67 +111,52 @@ describe.each([HotswapMode.FALL_BACK, HotswapMode.HOTSWAP_ONLY])('%p mode', (hot
                 Type: 'NO_SOURCE',
               },
               Name: 'my-project',
-              SourceVersion: 'v2',
+              SourceVersion: 'v1',
             },
             Metadata: {
-              'aws:asset:path': 'new-path',
+              'aws:asset:path': 'old-path',
             },
           },
         },
-      },
-    });
-
-    // WHEN
-    const deployStackResult = await hotswapMockSdkProvider.tryHotswapDeployment(hotswapMode, cdkStackArtifact);
-
-    // THEN
-    expect(deployStackResult).not.toBeUndefined();
-    expect(mockUpdateProject).toHaveBeenCalledWith({
-      name: 'my-project',
-      sourceVersion: 'v2',
-    });
-  });
-
-  silentTest('calls the updateProject() API when it receives only an environment difference in a CodeBuild project', async () => {
-    // GIVEN
-    setup.setCurrentCfnStackTemplate({
-      Resources: {
-        CodeBuildProject: {
-          Type: 'AWS::CodeBuild::Project',
-          Properties: {
-            Source: {
-              BuildSpec: 'current-spec',
-              Type: 'NO_SOURCE',
-            },
-            Name: 'my-project',
-            Environment: {
-              ComputeType: 'BUILD_GENERAL1_SMALL',
-              EnvironmentVariables: [
-                {
-                  Name: 'SUPER_IMPORTANT_ENV_VAR',
-                  Type: 'PLAINTEXT',
-                  Value: 'super cool value',
-                },
-                {
-                  Name: 'SECOND_IMPORTANT_ENV_VAR',
-                  Type: 'PLAINTEXT',
-                  Value: 'yet another super cool value',
+      });
+      const cdkStackArtifact = setup.cdkStackArtifactOf({
+        template: {
+          Resources: {
+            CodeBuildProject: {
+              Type: 'AWS::CodeBuild::Project',
+              Properties: {
+                Source: {
+                  BuildSpec: 'current-spec',
+                  Type: 'NO_SOURCE',
                 },
-              ],
-              Image: 'aws/codebuild/standard:1.0',
-              ImagePullCredentialsType: 'CODEBUILD',
-              PrivilegedMode: false,
-              Type: 'LINUX_CONTAINER',
+                Name: 'my-project',
+                SourceVersion: 'v2',
+              },
+              Metadata: {
+                'aws:asset:path': 'new-path',
+              },
             },
           },
-          Metadata: {
-            'aws:asset:path': 'old-path',
-          },
         },
-      },
-    });
-    const cdkStackArtifact = setup.cdkStackArtifactOf({
-      template: {
+      });
+
+      // WHEN
+      const deployStackResult = await hotswapMockSdkProvider.tryHotswapDeployment(hotswapMode, cdkStackArtifact);
+
+      // THEN
+      expect(deployStackResult).not.toBeUndefined();
+      expect(mockCodeBuildClient).toHaveReceivedCommandWith(UpdateProjectCommand, {
+        name: 'my-project',
+        sourceVersion: 'v2',
+      });
+    },
+  );
+
+  silentTest(
+    'calls the updateProject() API when it receives only an environment difference in a CodeBuild project',
+    async () => {
+      // GIVEN
+      setup.setCurrentCfnStackTemplate({
         Resources: {
           CodeBuildProject: {
             Type: 'AWS::CodeBuild::Project',
@@ -203,12 +172,12 @@ describe.each([HotswapMode.FALL_BACK, HotswapMode.HOTSWAP_ONLY])('%p mode', (hot
                   {
                     Name: 'SUPER_IMPORTANT_ENV_VAR',
                     Type: 'PLAINTEXT',
-                    Value: 'changed value',
+                    Value: 'super cool value',
                   },
                   {
-                    Name: 'NEW_IMPORTANT_ENV_VAR',
+                    Name: 'SECOND_IMPORTANT_ENV_VAR',
                     Type: 'PLAINTEXT',
-                    Value: 'new value',
+                    Value: 'yet another super cool value',
                   },
                 ],
                 Image: 'aws/codebuild/standard:1.0',
@@ -218,72 +187,85 @@ describe.each([HotswapMode.FALL_BACK, HotswapMode.HOTSWAP_ONLY])('%p mode', (hot
               },
             },
             Metadata: {
-              'aws:asset:path': 'new-path',
+              'aws:asset:path': 'old-path',
             },
           },
         },
-      },
-    });
-
-    // WHEN
-    const deployStackResult = await hotswapMockSdkProvider.tryHotswapDeployment(hotswapMode, cdkStackArtifact);
-
-    // THEN
-    expect(deployStackResult).not.toBeUndefined();
-    expect(mockUpdateProject).toHaveBeenCalledWith({
-      name: 'my-project',
-      environment: {
-        computeType: 'BUILD_GENERAL1_SMALL',
-        environmentVariables: [
-          {
-            name: 'SUPER_IMPORTANT_ENV_VAR',
-            type: 'PLAINTEXT',
-            value: 'changed value',
-          },
-          {
-            name: 'NEW_IMPORTANT_ENV_VAR',
-            type: 'PLAINTEXT',
-            value: 'new value',
-          },
-        ],
-        image: 'aws/codebuild/standard:1.0',
-        imagePullCredentialsType: 'CODEBUILD',
-        privilegedMode: false,
-        type: 'LINUX_CONTAINER',
-      },
-    });
-  });
-
-  silentTest("correctly evaluates the project's name when it references a different resource from the template", async () => {
-    // GIVEN
-    setup.setCurrentCfnStackTemplate({
-      Resources: {
-        Bucket: {
-          Type: 'AWS::S3::Bucket',
-        },
-        CodeBuildProject: {
-          Type: 'AWS::CodeBuild::Project',
-          Properties: {
-            Source: {
-              BuildSpec: 'current-spec',
-              Type: 'NO_SOURCE',
-            },
-            Name: {
-              'Fn::Join': ['-', [
-                { Ref: 'Bucket' },
-                'project',
-              ]],
+      });
+      const cdkStackArtifact = setup.cdkStackArtifactOf({
+        template: {
+          Resources: {
+            CodeBuildProject: {
+              Type: 'AWS::CodeBuild::Project',
+              Properties: {
+                Source: {
+                  BuildSpec: 'current-spec',
+                  Type: 'NO_SOURCE',
+                },
+                Name: 'my-project',
+                Environment: {
+                  ComputeType: 'BUILD_GENERAL1_SMALL',
+                  EnvironmentVariables: [
+                    {
+                      Name: 'SUPER_IMPORTANT_ENV_VAR',
+                      Type: 'PLAINTEXT',
+                      Value: 'changed value',
+                    },
+                    {
+                      Name: 'NEW_IMPORTANT_ENV_VAR',
+                      Type: 'PLAINTEXT',
+                      Value: 'new value',
+                    },
+                  ],
+                  Image: 'aws/codebuild/standard:1.0',
+                  ImagePullCredentialsType: 'CODEBUILD',
+                  PrivilegedMode: false,
+                  Type: 'LINUX_CONTAINER',
+                },
+              },
+              Metadata: {
+                'aws:asset:path': 'new-path',
+              },
             },
           },
-          Metadata: {
-            'aws:asset:path': 'old-path',
-          },
         },
-      },
-    });
-    setup.pushStackResourceSummaries(setup.stackSummaryOf('Bucket', 'AWS::S3::Bucket', 'mybucket'));
-    const cdkStackArtifact = setup.cdkStackArtifactOf({
-      template: {
+      });
+
+      // WHEN
+      const deployStackResult = await hotswapMockSdkProvider.tryHotswapDeployment(hotswapMode, cdkStackArtifact);
+
+      // THEN
+      expect(deployStackResult).not.toBeUndefined();
+      expect(mockCodeBuildClient).toHaveReceivedCommandWith(UpdateProjectCommand, {
+        name: 'my-project',
+        environment: {
+          computeType: 'BUILD_GENERAL1_SMALL',
+          environmentVariables: [
+            {
+              name: 'SUPER_IMPORTANT_ENV_VAR',
+              type: 'PLAINTEXT',
+              value: 'changed value',
+            },
+            {
+              name: 'NEW_IMPORTANT_ENV_VAR',
+              type: 'PLAINTEXT',
+              value: 'new value',
+            },
+          ],
+          image: 'aws/codebuild/standard:1.0',
+          imagePullCredentialsType: 'CODEBUILD',
+          privilegedMode: false,
+          type: 'LINUX_CONTAINER',
+        },
+      });
+    },
+  );
+
+  silentTest(
+    "correctly evaluates the project's name when it references a different resource from the template",
+    async () => {
+      // GIVEN
+      setup.setCurrentCfnStackTemplate({
         Resources: {
           Bucket: {
             Type: 'AWS::S3::Bucket',
@@ -292,14 +274,11 @@ describe.each([HotswapMode.FALL_BACK, HotswapMode.HOTSWAP_ONLY])('%p mode', (hot
             Type: 'AWS::CodeBuild::Project',
             Properties: {
               Source: {
-                BuildSpec: 'new-spec',
+                BuildSpec: 'current-spec',
                 Type: 'NO_SOURCE',
               },
               Name: {
-                'Fn::Join': ['-', [
-                  { Ref: 'Bucket' },
-                  'project',
-                ]],
+                'Fn::Join': ['-', [{ Ref: 'Bucket' }, 'project']],
               },
             },
             Metadata: {
@@ -307,49 +286,53 @@ describe.each([HotswapMode.FALL_BACK, HotswapMode.HOTSWAP_ONLY])('%p mode', (hot
             },
           },
         },
-      },
-    });
-
-    // WHEN
-    const deployStackResult = await hotswapMockSdkProvider.tryHotswapDeployment(hotswapMode, cdkStackArtifact);
+      });
+      setup.pushStackResourceSummaries(setup.stackSummaryOf('Bucket', 'AWS::S3::Bucket', 'mybucket'));
+      const cdkStackArtifact = setup.cdkStackArtifactOf({
+        template: {
+          Resources: {
+            Bucket: {
+              Type: 'AWS::S3::Bucket',
+            },
+            CodeBuildProject: {
+              Type: 'AWS::CodeBuild::Project',
+              Properties: {
+                Source: {
+                  BuildSpec: 'new-spec',
+                  Type: 'NO_SOURCE',
+                },
+                Name: {
+                  'Fn::Join': ['-', [{ Ref: 'Bucket' }, 'project']],
+                },
+              },
+              Metadata: {
+                'aws:asset:path': 'old-path',
+              },
+            },
+          },
+        },
+      });
 
-    // THEN
-    expect(deployStackResult).not.toBeUndefined();
-    expect(mockUpdateProject).toHaveBeenCalledWith({
-      name: 'mybucket-project',
-      source: {
-        type: 'NO_SOURCE',
-        buildspec: 'new-spec',
-      },
-    });
-  });
+      // WHEN
+      const deployStackResult = await hotswapMockSdkProvider.tryHotswapDeployment(hotswapMode, cdkStackArtifact);
 
-  silentTest("correctly falls back to taking the project's name from the current stack if it can't evaluate it in the template", async () => {
-    // GIVEN
-    setup.setCurrentCfnStackTemplate({
-      Parameters: {
-        Param1: { Type: 'String' },
-        AssetBucketParam: { Type: 'String' },
-      },
-      Resources: {
-        CodeBuildProject: {
-          Type: 'AWS::CodeBuild::Project',
-          Properties: {
-            Source: {
-              BuildSpec: 'current-spec',
-              Type: 'NO_SOURCE',
-            },
-            Name: { Ref: 'Param1' },
-          },
-          Metadata: {
-            'aws:asset:path': 'old-path',
-          },
+      // THEN
+      expect(deployStackResult).not.toBeUndefined();
+      expect(mockCodeBuildClient).toHaveReceivedCommandWith(UpdateProjectCommand, {
+        name: 'mybucket-project',
+        source: {
+          type: 'NO_SOURCE',
+          buildspec: 'new-spec',
         },
-      },
-    });
-    setup.pushStackResourceSummaries(setup.stackSummaryOf('CodeBuildProject', 'AWS::CodeBuild::Project', 'my-project'));
-    const cdkStackArtifact = setup.cdkStackArtifactOf({
-      template: {
+      });
+    },
+  );
+
+  silentTest(
+    "correctly falls back to taking the project's name from the current stack if it can't evaluate it in the template",
+    async () => {
+      // GIVEN
+      setup.setCurrentCfnStackTemplate({
         Parameters: {
           Param1: { Type: 'String' },
           AssetBucketParam: { Type: 'String' },
@@ -359,57 +342,66 @@ describe.each([HotswapMode.FALL_BACK, HotswapMode.HOTSWAP_ONLY])('%p mode', (hot
             Type: 'AWS::CodeBuild::Project',
             Properties: {
               Source: {
-                BuildSpec: 'new-spec',
+                BuildSpec: 'current-spec',
                 Type: 'NO_SOURCE',
               },
               Name: { Ref: 'Param1' },
             },
             Metadata: {
-              'aws:asset:path': 'new-path',
+              'aws:asset:path': 'old-path',
             },
           },
         },
-      },
-    });
-
-    // WHEN
-    const deployStackResult = await hotswapMockSdkProvider.tryHotswapDeployment(hotswapMode, cdkStackArtifact, { AssetBucketParam: 'asset-bucket' });
-
-    // THEN
-    expect(deployStackResult).not.toBeUndefined();
-    expect(mockUpdateProject).toHaveBeenCalledWith({
-      name: 'my-project',
-      source: {
-        type: 'NO_SOURCE',
-        buildspec: 'new-spec',
-      },
-    });
-  });
-
-  silentTest("will not perform a hotswap deployment if it cannot find a Ref target (outside the project's name)", async () => {
-    // GIVEN
-    setup.setCurrentCfnStackTemplate({
-      Parameters: {
-        Param1: { Type: 'String' },
-      },
-      Resources: {
-        CodeBuildProject: {
-          Type: 'AWS::CodeBuild::Project',
-          Properties: {
-            Source: {
-              BuildSpec: { 'Fn::Sub': '${Param1}' },
-              Type: 'NO_SOURCE',
+      });
+      setup.pushStackResourceSummaries(
+        setup.stackSummaryOf('CodeBuildProject', 'AWS::CodeBuild::Project', 'my-project'),
+      );
+      const cdkStackArtifact = setup.cdkStackArtifactOf({
+        template: {
+          Parameters: {
+            Param1: { Type: 'String' },
+            AssetBucketParam: { Type: 'String' },
+          },
+          Resources: {
+            CodeBuildProject: {
+              Type: 'AWS::CodeBuild::Project',
+              Properties: {
+                Source: {
+                  BuildSpec: 'new-spec',
+                  Type: 'NO_SOURCE',
+                },
+                Name: { Ref: 'Param1' },
+              },
+              Metadata: {
+                'aws:asset:path': 'new-path',
+              },
             },
           },
-          Metadata: {
-            'aws:asset:path': 'old-path',
-          },
         },
-      },
-    });
-    setup.pushStackResourceSummaries(setup.stackSummaryOf('CodeBuildProject', 'AWS::CodeBuild::Project', 'my-project'));
-    const cdkStackArtifact = setup.cdkStackArtifactOf({
-      template: {
+      });
+
+      // WHEN
+      const deployStackResult = await hotswapMockSdkProvider.tryHotswapDeployment(hotswapMode, cdkStackArtifact, {
+        AssetBucketParam: 'asset-bucket',
+      });
+
+      // THEN
+      expect(deployStackResult).not.toBeUndefined();
+      expect(mockCodeBuildClient).toHaveReceivedCommandWith(UpdateProjectCommand, {
+        name: 'my-project',
+        source: {
+          type: 'NO_SOURCE',
+          buildspec: 'new-spec',
+        },
+      });
+    },
+  );
+
+  silentTest(
+    "will not perform a hotswap deployment if it cannot find a Ref target (outside the project's name)",
+    async () => {
+      // GIVEN
+      setup.setCurrentCfnStackTemplate({
         Parameters: {
           Param1: { Type: 'String' },
         },
@@ -419,50 +411,52 @@ describe.each([HotswapMode.FALL_BACK, HotswapMode.HOTSWAP_ONLY])('%p mode', (hot
             Properties: {
               Source: {
                 BuildSpec: { 'Fn::Sub': '${Param1}' },
-                Type: 'CODEPIPELINE',
+                Type: 'NO_SOURCE',
               },
             },
             Metadata: {
-              'aws:asset:path': 'new-path',
+              'aws:asset:path': 'old-path',
             },
           },
         },
-      },
-    });
-
-    // THEN
-    await expect(() =>
-      hotswapMockSdkProvider.tryHotswapDeployment(hotswapMode, cdkStackArtifact),
-    ).rejects.toThrow(/Parameter or resource 'Param1' could not be found for evaluation/);
-  });
-
-  silentTest("will not perform a hotswap deployment if it doesn't know how to handle a specific attribute (outside the project's name)", async () => {
-    // GIVEN
-    setup.setCurrentCfnStackTemplate({
-      Resources: {
-        Bucket: {
-          Type: 'AWS::S3::Bucket',
-        },
-        CodeBuildProject: {
-          Type: 'AWS::CodeBuild::Project',
-          Properties: {
-            Source: {
-              BuildSpec: { 'Fn::GetAtt': ['Bucket', 'UnknownAttribute'] },
-              Type: 'NO_SOURCE',
+      });
+      setup.pushStackResourceSummaries(
+        setup.stackSummaryOf('CodeBuildProject', 'AWS::CodeBuild::Project', 'my-project'),
+      );
+      const cdkStackArtifact = setup.cdkStackArtifactOf({
+        template: {
+          Parameters: {
+            Param1: { Type: 'String' },
+          },
+          Resources: {
+            CodeBuildProject: {
+              Type: 'AWS::CodeBuild::Project',
+              Properties: {
+                Source: {
+                  BuildSpec: { 'Fn::Sub': '${Param1}' },
+                  Type: 'CODEPIPELINE',
+                },
+              },
+              Metadata: {
+                'aws:asset:path': 'new-path',
+              },
             },
           },
-          Metadata: {
-            'aws:asset:path': 'old-path',
-          },
         },
-      },
-    });
-    setup.pushStackResourceSummaries(
-      setup.stackSummaryOf('CodeBuildProject', 'AWS::CodeBuild::Project', 'my-project'),
-      setup.stackSummaryOf('Bucket', 'AWS::S3::Bucket', 'my-bucket'),
-    );
-    const cdkStackArtifact = setup.cdkStackArtifactOf({
-      template: {
+      });
+
+      // THEN
+      await expect(() => hotswapMockSdkProvider.tryHotswapDeployment(hotswapMode, cdkStackArtifact)).rejects.toThrow(
+        /Parameter or resource 'Param1' could not be found for evaluation/,
+      );
+    },
+  );
+
+  silentTest(
+    "will not perform a hotswap deployment if it doesn't know how to handle a specific attribute (outside the project's name)",
+    async () => {
+      // GIVEN
+      setup.setCurrentCfnStackTemplate({
         Resources: {
           Bucket: {
             Type: 'AWS::S3::Bucket',
@@ -472,49 +466,59 @@ describe.each([HotswapMode.FALL_BACK, HotswapMode.HOTSWAP_ONLY])('%p mode', (hot
             Properties: {
               Source: {
                 BuildSpec: { 'Fn::GetAtt': ['Bucket', 'UnknownAttribute'] },
-                Type: 'S3',
+                Type: 'NO_SOURCE',
               },
             },
             Metadata: {
-              'aws:asset:path': 'new-path',
+              'aws:asset:path': 'old-path',
             },
           },
         },
-      },
-    });
-
-    // THEN
-    await expect(() =>
-      hotswapMockSdkProvider.tryHotswapDeployment(hotswapMode, cdkStackArtifact),
-    ).rejects.toThrow("We don't support the 'UnknownAttribute' attribute of the 'AWS::S3::Bucket' resource. This is a CDK limitation. Please report it at https://github.com/aws/aws-cdk/issues/new/choose");
-  });
-
-  silentTest('calls the updateProject() API when it receives a difference in a CodeBuild project with no name', async () => {
-    // GIVEN
-    setup.setCurrentCfnStackTemplate({
-      Resources: {
-        CodeBuildProject: {
-          Type: 'AWS::CodeBuild::Project',
-          Properties: {
-            Source: {
-              BuildSpec: 'current-spec',
-              Type: 'NO_SOURCE',
+      });
+      setup.pushStackResourceSummaries(
+        setup.stackSummaryOf('CodeBuildProject', 'AWS::CodeBuild::Project', 'my-project'),
+        setup.stackSummaryOf('Bucket', 'AWS::S3::Bucket', 'my-bucket'),
+      );
+      const cdkStackArtifact = setup.cdkStackArtifactOf({
+        template: {
+          Resources: {
+            Bucket: {
+              Type: 'AWS::S3::Bucket',
+            },
+            CodeBuildProject: {
+              Type: 'AWS::CodeBuild::Project',
+              Properties: {
+                Source: {
+                  BuildSpec: { 'Fn::GetAtt': ['Bucket', 'UnknownAttribute'] },
+                  Type: 'S3',
+                },
+              },
+              Metadata: {
+                'aws:asset:path': 'new-path',
+              },
             },
           },
-          Metadata: {
-            'aws:asset:path': 'current-path',
-          },
         },
-      },
-    });
-    const cdkStackArtifact = setup.cdkStackArtifactOf({
-      template: {
+      });
+
+      // THEN
+      await expect(() => hotswapMockSdkProvider.tryHotswapDeployment(hotswapMode, cdkStackArtifact)).rejects.toThrow(
+        "We don't support the 'UnknownAttribute' attribute of the 'AWS::S3::Bucket' resource. This is a CDK limitation. Please report it at https://github.com/aws/aws-cdk/issues/new/choose",
+      );
+    },
+  );
+
+  silentTest(
+    'calls the updateProject() API when it receives a difference in a CodeBuild project with no name',
+    async () => {
+      // GIVEN
+      setup.setCurrentCfnStackTemplate({
         Resources: {
           CodeBuildProject: {
             Type: 'AWS::CodeBuild::Project',
             Properties: {
               Source: {
-                BuildSpec: 'new-spec',
+                BuildSpec: 'current-spec',
                 Type: 'NO_SOURCE',
               },
             },
@@ -523,42 +527,49 @@ describe.each([HotswapMode.FALL_BACK, HotswapMode.HOTSWAP_ONLY])('%p mode', (hot
             },
           },
         },
-      },
-    });
+      });
+      const cdkStackArtifact = setup.cdkStackArtifactOf({
+        template: {
+          Resources: {
+            CodeBuildProject: {
+              Type: 'AWS::CodeBuild::Project',
+              Properties: {
+                Source: {
+                  BuildSpec: 'new-spec',
+                  Type: 'NO_SOURCE',
+                },
+              },
+              Metadata: {
+                'aws:asset:path': 'current-path',
+              },
+            },
+          },
+        },
+      });
 
-    // WHEN
-    setup.pushStackResourceSummaries(setup.stackSummaryOf('CodeBuildProject', 'AWS::CodeBuild::Project', 'mock-project-resource-id'));
-    const deployStackResult = await hotswapMockSdkProvider.tryHotswapDeployment(hotswapMode, cdkStackArtifact);
-
-    // THEN
-    expect(deployStackResult).not.toBeUndefined();
-    expect(mockUpdateProject).toHaveBeenCalledWith({
-      name: 'mock-project-resource-id',
-      source: {
-        type: 'NO_SOURCE',
-        buildspec: 'new-spec',
-      },
-    });
-  });
+      // WHEN
+      setup.pushStackResourceSummaries(
+        setup.stackSummaryOf('CodeBuildProject', 'AWS::CodeBuild::Project', 'mock-project-resource-id'),
+      );
+      const deployStackResult = await hotswapMockSdkProvider.tryHotswapDeployment(hotswapMode, cdkStackArtifact);
 
-  silentTest('does not call the updateProject() API when it receives a change that is not Source, SourceVersion, or Environment difference in a CodeBuild project', async () => {
-    // GIVEN
-    setup.setCurrentCfnStackTemplate({
-      Resources: {
-        CodeBuildProject: {
-          Type: 'AWS::CodeBuild::Project',
-          Properties: {
-            Source: {
-              BuildSpec: 'current-spec',
-              Type: 'NO_SOURCE',
-            },
-            ConcurrentBuildLimit: 1,
-          },
+      // THEN
+      expect(deployStackResult).not.toBeUndefined();
+      expect(mockCodeBuildClient).toHaveReceivedCommandWith(UpdateProjectCommand, {
+        name: 'mock-project-resource-id',
+        source: {
+          type: 'NO_SOURCE',
+          buildspec: 'new-spec',
         },
-      },
-    });
-    const cdkStackArtifact = setup.cdkStackArtifactOf({
-      template: {
+      });
+    },
+  );
+
+  silentTest(
+    'does not call the updateProject() API when it receives a change that is not Source, SourceVersion, or Environment difference in a CodeBuild project',
+    async () => {
+      // GIVEN
+      setup.setCurrentCfnStackTemplate({
         Resources: {
           CodeBuildProject: {
             Type: 'AWS::CodeBuild::Project',
@@ -567,115 +578,120 @@ describe.each([HotswapMode.FALL_BACK, HotswapMode.HOTSWAP_ONLY])('%p mode', (hot
                 BuildSpec: 'current-spec',
                 Type: 'NO_SOURCE',
               },
-              ConcurrentBuildLimit: 2,
+              ConcurrentBuildLimit: 1,
             },
           },
         },
-      },
-    });
-
-    if (hotswapMode === HotswapMode.FALL_BACK) {
-      // WHEN
-      const deployStackResult = await hotswapMockSdkProvider.tryHotswapDeployment(hotswapMode, cdkStackArtifact);
-
-      // THEN
-      expect(deployStackResult).toBeUndefined();
-      expect(mockUpdateProject).not.toHaveBeenCalled();
-    } else if (hotswapMode === HotswapMode.HOTSWAP_ONLY) {
-      // WHEN
-      const deployStackResult = await hotswapMockSdkProvider.tryHotswapDeployment(hotswapMode, cdkStackArtifact);
-
-      // THEN
-      expect(deployStackResult).not.toBeUndefined();
-      expect(deployStackResult?.noOp).toEqual(true);
-      expect(mockUpdateProject).not.toHaveBeenCalled();
-    }
-  });
-
-  silentTest(`when it receives a change that is not Source, SourceVersion, or Environment difference in a CodeBuild project alongside a hotswappable change,
-        it does not call the updateProject() API in CLASSIC mode, but it does in HOTSWAP_ONLY mode`,
-  async () => {
-    // GIVEN
-    setup.setCurrentCfnStackTemplate({
-      Resources: {
-        CodeBuildProject: {
-          Type: 'AWS::CodeBuild::Project',
-          Properties: {
-            Source: {
-              BuildSpec: 'current-spec',
-              Type: 'NO_SOURCE',
-            },
-            ConcurrentBuildLimit: 1,
+      });
+      const cdkStackArtifact = setup.cdkStackArtifactOf({
+        template: {
+          Resources: {
+            CodeBuildProject: {
+              Type: 'AWS::CodeBuild::Project',
+              Properties: {
+                Source: {
+                  BuildSpec: 'current-spec',
+                  Type: 'NO_SOURCE',
+                },
+                ConcurrentBuildLimit: 2,
+              },
+            },
           },
         },
-      },
-    });
-    const cdkStackArtifact = setup.cdkStackArtifactOf({
-      template: {
+      });
+
+      if (hotswapMode === HotswapMode.FALL_BACK) {
+        // WHEN
+        const deployStackResult = await hotswapMockSdkProvider.tryHotswapDeployment(hotswapMode, cdkStackArtifact);
+
+        // THEN
+        expect(deployStackResult).toBeUndefined();
+        expect(mockCodeBuildClient).not.toHaveReceivedCommand(UpdateProjectCommand);
+      } else if (hotswapMode === HotswapMode.HOTSWAP_ONLY) {
+        // WHEN
+        const deployStackResult = await hotswapMockSdkProvider.tryHotswapDeployment(hotswapMode, cdkStackArtifact);
+
+        // THEN
+        expect(deployStackResult).not.toBeUndefined();
+        expect(deployStackResult?.noOp).toEqual(true);
+        expect(mockCodeBuildClient).not.toHaveReceivedCommand(UpdateProjectCommand);
+      }
+    },
+  );
+
+  silentTest(
+    `when it receives a change that is not Source, SourceVersion, or Environment difference in a CodeBuild project alongside a hotswappable change,
+        it does not call the updateProject() API in CLASSIC mode, but it does in HOTSWAP_ONLY mode`,
+    async () => {
+      // GIVEN
+      setup.setCurrentCfnStackTemplate({
         Resources: {
           CodeBuildProject: {
             Type: 'AWS::CodeBuild::Project',
             Properties: {
               Source: {
-                BuildSpec: 'new-spec',
+                BuildSpec: 'current-spec',
                 Type: 'NO_SOURCE',
               },
-              ConcurrentBuildLimit: 2,
+              ConcurrentBuildLimit: 1,
             },
           },
         },
-      },
-    });
-
-    setup.pushStackResourceSummaries(setup.stackSummaryOf('CodeBuildProject', 'AWS::CodeBuild::Project', 'mock-project-resource-id'));
-    if (hotswapMode === HotswapMode.FALL_BACK) {
-      // WHEN
-      const deployStackResult = await hotswapMockSdkProvider.tryHotswapDeployment(hotswapMode, cdkStackArtifact);
-
-      // THEN
-      expect(deployStackResult).toBeUndefined();
-      expect(mockUpdateProject).not.toHaveBeenCalled();
-    } else if (hotswapMode === HotswapMode.HOTSWAP_ONLY) {
-      // WHEN
-      const deployStackResult = await hotswapMockSdkProvider.tryHotswapDeployment(hotswapMode, cdkStackArtifact);
-
-      // THEN
-      expect(deployStackResult).not.toBeUndefined();
-      expect(mockUpdateProject).toHaveBeenCalledWith({
-        name: 'mock-project-resource-id',
-        source: {
-          type: 'NO_SOURCE',
-          buildspec: 'new-spec',
-        },
       });
-    }
-  });
-  silentTest('does not call the updateProject() API when a resource with type that is not AWS::CodeBuild::Project but has the same properties is changed', async () => {
-    // GIVEN
-    setup.setCurrentCfnStackTemplate({
-      Resources: {
-        CodeBuildProject: {
-          Type: 'AWS::NotCodeBuild::NotAProject',
-          Properties: {
-            Source: {
-              BuildSpec: 'current-spec',
-              Type: 'NO_SOURCE',
+      const cdkStackArtifact = setup.cdkStackArtifactOf({
+        template: {
+          Resources: {
+            CodeBuildProject: {
+              Type: 'AWS::CodeBuild::Project',
+              Properties: {
+                Source: {
+                  BuildSpec: 'new-spec',
+                  Type: 'NO_SOURCE',
+                },
+                ConcurrentBuildLimit: 2,
+              },
             },
           },
-          Metadata: {
-            'aws:asset:path': 'old-path',
-          },
         },
-      },
-    });
-    const cdkStackArtifact = setup.cdkStackArtifactOf({
-      template: {
+      });
+
+      setup.pushStackResourceSummaries(
+        setup.stackSummaryOf('CodeBuildProject', 'AWS::CodeBuild::Project', 'mock-project-resource-id'),
+      );
+      if (hotswapMode === HotswapMode.FALL_BACK) {
+        // WHEN
+        const deployStackResult = await hotswapMockSdkProvider.tryHotswapDeployment(hotswapMode, cdkStackArtifact);
+
+        // THEN
+        expect(deployStackResult).toBeUndefined();
+        expect(mockCodeBuildClient).not.toHaveReceivedCommand(UpdateProjectCommand);
+      } else if (hotswapMode === HotswapMode.HOTSWAP_ONLY) {
+        // WHEN
+        const deployStackResult = await hotswapMockSdkProvider.tryHotswapDeployment(hotswapMode, cdkStackArtifact);
+
+        // THEN
+        expect(deployStackResult).not.toBeUndefined();
+        expect(mockCodeBuildClient).toHaveReceivedCommandWith(UpdateProjectCommand, {
+          name: 'mock-project-resource-id',
+          source: {
+            type: 'NO_SOURCE',
+            buildspec: 'new-spec',
+          },
+        });
+      }
+    },
+  );
+  silentTest(
+    'does not call the updateProject() API when a resource with type that is not AWS::CodeBuild::Project but has the same properties is changed',
+    async () => {
+      // GIVEN
+      setup.setCurrentCfnStackTemplate({
         Resources: {
           CodeBuildProject: {
             Type: 'AWS::NotCodeBuild::NotAProject',
             Properties: {
               Source: {
-                BuildSpec: 'new-spec',
+                BuildSpec: 'current-spec',
                 Type: 'NO_SOURCE',
               },
             },
@@ -684,24 +700,42 @@ describe.each([HotswapMode.FALL_BACK, HotswapMode.HOTSWAP_ONLY])('%p mode', (hot
             },
           },
         },
-      },
-    });
-
-    if (hotswapMode === HotswapMode.FALL_BACK) {
-      // WHEN
-      const deployStackResult = await hotswapMockSdkProvider.tryHotswapDeployment(hotswapMode, cdkStackArtifact);
-
-      // THEN
-      expect(deployStackResult).toBeUndefined();
-      expect(mockUpdateProject).not.toHaveBeenCalled();
-    } else if (hotswapMode === HotswapMode.HOTSWAP_ONLY) {
-      // WHEN
-      const deployStackResult = await hotswapMockSdkProvider.tryHotswapDeployment(hotswapMode, cdkStackArtifact);
+      });
+      const cdkStackArtifact = setup.cdkStackArtifactOf({
+        template: {
+          Resources: {
+            CodeBuildProject: {
+              Type: 'AWS::NotCodeBuild::NotAProject',
+              Properties: {
+                Source: {
+                  BuildSpec: 'new-spec',
+                  Type: 'NO_SOURCE',
+                },
+              },
+              Metadata: {
+                'aws:asset:path': 'old-path',
+              },
+            },
+          },
+        },
+      });
 
-      // THEN
-      expect(deployStackResult).not.toBeUndefined();
-      expect(deployStackResult?.noOp).toEqual(true);
-      expect(mockUpdateProject).not.toHaveBeenCalled();
-    }
-  });
+      if (hotswapMode === HotswapMode.FALL_BACK) {
+        // WHEN
+        const deployStackResult = await hotswapMockSdkProvider.tryHotswapDeployment(hotswapMode, cdkStackArtifact);
+
+        // THEN
+        expect(deployStackResult).toBeUndefined();
+        expect(mockCodeBuildClient).not.toHaveReceivedCommand(UpdateProjectCommand);
+      } else if (hotswapMode === HotswapMode.HOTSWAP_ONLY) {
+        // WHEN
+        const deployStackResult = await hotswapMockSdkProvider.tryHotswapDeployment(hotswapMode, cdkStackArtifact);
+
+        // THEN
+        expect(deployStackResult).not.toBeUndefined();
+        expect(deployStackResult?.noOp).toEqual(true);
+        expect(mockCodeBuildClient).not.toHaveReceivedCommand(UpdateProjectCommand);
+      }
+    },
+  );
 });
diff --git a/packages/aws-cdk/test/api/hotswap/ecs-services-hotswap-deployments.test.ts b/packages/aws-cdk/test/api/hotswap/ecs-services-hotswap-deployments.test.ts
index d1ef496819328..6db4575cdc388 100644
--- a/packages/aws-cdk/test/api/hotswap/ecs-services-hotswap-deployments.test.ts
+++ b/packages/aws-cdk/test/api/hotswap/ecs-services-hotswap-deployments.test.ts
@@ -1,76 +1,48 @@
-import * as AWS from 'aws-sdk';
+import { DescribeServicesCommand, RegisterTaskDefinitionCommand, UpdateServiceCommand } from '@aws-sdk/client-ecs';
 import * as setup from './hotswap-test-setup';
 import { HotswapMode } from '../../../lib/api/hotswap/common';
+import { mockECSClient } from '../../util/mock-sdk';
 import { silentTest } from '../../util/silent';
 
 let hotswapMockSdkProvider: setup.HotswapMockSdkProvider;
-let mockRegisterTaskDef: jest.Mock<AWS.ECS.RegisterTaskDefinitionResponse, AWS.ECS.RegisterTaskDefinitionRequest[]>;
-let mockUpdateService: (params: AWS.ECS.UpdateServiceRequest) => AWS.ECS.UpdateServiceResponse;
 
 beforeEach(() => {
   hotswapMockSdkProvider = setup.setupHotswapTests();
-
-  mockRegisterTaskDef = jest.fn();
-  mockUpdateService = jest.fn();
-  hotswapMockSdkProvider.stubEcs({
-    registerTaskDefinition: mockRegisterTaskDef,
-    updateService: mockUpdateService,
-  }, {
-    // these are needed for the waiter API that the ECS service hotswap uses
-    api: {
-      waiters: {},
-    },
-    makeRequest() {
-      return {
-        promise: () => Promise.resolve({}),
-        response: {},
-        addListeners: () => {},
-      };
-    },
-  });
+  mockECSClient
+    .on(UpdateServiceCommand)
+    .resolves({
+      service: {
+        clusterArn: 'arn:aws:ecs:region:account:service/my-cluster',
+        serviceArn: 'arn:aws:ecs:region:account:service/my-cluster/my-service',
+      },
+    })
+    .on(DescribeServicesCommand)
+    .resolves({
+      services: [
+        {
+          deployments: [
+            {
+              desiredCount: 1,
+              runningCount: 1,
+            },
+          ],
+        },
+      ],
+    });
 });
 
 describe.each([HotswapMode.FALL_BACK, HotswapMode.HOTSWAP_ONLY])('%p mode', (hotswapMode) => {
-  silentTest('should call registerTaskDefinition and updateService for a difference only in the TaskDefinition with a Family property', async () => {
-    // GIVEN
-    setup.setCurrentCfnStackTemplate({
-      Resources: {
-        TaskDef: {
-          Type: 'AWS::ECS::TaskDefinition',
-          Properties: {
-            Family: 'my-task-def',
-            ContainerDefinitions: [
-              { Image: 'image1' },
-            ],
-          },
-        },
-        Service: {
-          Type: 'AWS::ECS::Service',
-          Properties: {
-            TaskDefinition: { Ref: 'TaskDef' },
-          },
-        },
-      },
-    });
-    setup.pushStackResourceSummaries(
-      setup.stackSummaryOf('Service', 'AWS::ECS::Service',
-        'arn:aws:ecs:region:account:service/my-cluster/my-service'),
-    );
-    mockRegisterTaskDef.mockReturnValue({
-      taskDefinition: {
-        taskDefinitionArn: 'arn:aws:ecs:region:account:task-definition/my-task-def:3',
-      },
-    });
-    const cdkStackArtifact = setup.cdkStackArtifactOf({
-      template: {
+  silentTest(
+    'should call registerTaskDefinition and updateService for a difference only in the TaskDefinition with a Family property',
+    async () => {
+      // GIVEN
+      setup.setCurrentCfnStackTemplate({
         Resources: {
           TaskDef: {
             Type: 'AWS::ECS::TaskDefinition',
             Properties: {
               Family: 'my-task-def',
-              ContainerDefinitions: [
-                { Image: 'image2' },
-              ],
+              ContainerDefinitions: [{ Image: 'image1' }],
             },
           },
           Service: {
@@ -80,107 +52,50 @@ describe.each([HotswapMode.FALL_BACK, HotswapMode.HOTSWAP_ONLY])('%p mode', (hot
             },
           },
         },
-      },
-    });
-
-    // WHEN
-    const deployStackResult = await hotswapMockSdkProvider.tryHotswapDeployment(hotswapMode, cdkStackArtifact);
-
-    // THEN
-    expect(deployStackResult).not.toBeUndefined();
-    expect(mockRegisterTaskDef).toBeCalledWith({
-      family: 'my-task-def',
-      containerDefinitions: [
-        { image: 'image2' },
-      ],
-    });
-    expect(mockUpdateService).toBeCalledWith({
-      service: 'arn:aws:ecs:region:account:service/my-cluster/my-service',
-      cluster: 'my-cluster',
-      taskDefinition: 'arn:aws:ecs:region:account:task-definition/my-task-def:3',
-      deploymentConfiguration: {
-        minimumHealthyPercent: 0,
-      },
-      forceNewDeployment: true,
-    });
-  });
-
-  silentTest('any other TaskDefinition property change besides ContainerDefinition cannot be hotswapped in CLASSIC mode but does not block HOTSWAP_ONLY mode deployments', async () => {
-    // GIVEN
-    setup.setCurrentCfnStackTemplate({
-      Resources: {
-        TaskDef: {
-          Type: 'AWS::ECS::TaskDefinition',
-          Properties: {
-            Family: 'my-task-def',
-            ContainerDefinitions: [
-              { Image: 'image1' },
-            ],
-            Cpu: '256',
-          },
-        },
-        Service: {
-          Type: 'AWS::ECS::Service',
-          Properties: {
-            TaskDefinition: { Ref: 'TaskDef' },
-          },
+      });
+      setup.pushStackResourceSummaries(
+        setup.stackSummaryOf(
+          'Service',
+          'AWS::ECS::Service',
+          'arn:aws:ecs:region:account:service/my-cluster/my-service',
+        ),
+      );
+      mockECSClient.on(RegisterTaskDefinitionCommand).resolves({
+        taskDefinition: {
+          taskDefinitionArn: 'arn:aws:ecs:region:account:task-definition/my-task-def:3',
         },
-      },
-    });
-    setup.pushStackResourceSummaries(
-      setup.stackSummaryOf('Service', 'AWS::ECS::Service',
-        'arn:aws:ecs:region:account:service/my-cluster/my-service'),
-    );
-    mockRegisterTaskDef.mockReturnValue({
-      taskDefinition: {
-        taskDefinitionArn: 'arn:aws:ecs:region:account:task-definition/my-task-def:3',
-      },
-    });
-    const cdkStackArtifact = setup.cdkStackArtifactOf({
-      template: {
-        Resources: {
-          TaskDef: {
-            Type: 'AWS::ECS::TaskDefinition',
-            Properties: {
-              Family: 'my-task-def',
-              ContainerDefinitions: [
-                { Image: 'image2' },
-              ],
-              Cpu: '512',
+      });
+      const cdkStackArtifact = setup.cdkStackArtifactOf({
+        template: {
+          Resources: {
+            TaskDef: {
+              Type: 'AWS::ECS::TaskDefinition',
+              Properties: {
+                Family: 'my-task-def',
+                ContainerDefinitions: [{ Image: 'image2' }],
+              },
             },
-          },
-          Service: {
-            Type: 'AWS::ECS::Service',
-            Properties: {
-              TaskDefinition: { Ref: 'TaskDef' },
+            Service: {
+              Type: 'AWS::ECS::Service',
+              Properties: {
+                TaskDefinition: { Ref: 'TaskDef' },
+              },
             },
           },
         },
-      },
-    });
+      });
 
-    if (hotswapMode === HotswapMode.FALL_BACK) {
-      // WHEN
-      const deployStackResult = await hotswapMockSdkProvider.tryHotswapDeployment(hotswapMode, cdkStackArtifact);
-
-      // THEN
-      expect(deployStackResult).toBeUndefined();
-      expect(mockRegisterTaskDef).not.toHaveBeenCalled();
-      expect(mockUpdateService).not.toHaveBeenCalled();
-    } else if (hotswapMode === HotswapMode.HOTSWAP_ONLY) {
       // WHEN
       const deployStackResult = await hotswapMockSdkProvider.tryHotswapDeployment(hotswapMode, cdkStackArtifact);
 
       // THEN
       expect(deployStackResult).not.toBeUndefined();
-      expect(mockRegisterTaskDef).toBeCalledWith({
+      expect(mockECSClient).toHaveReceivedCommandWith(RegisterTaskDefinitionCommand, {
         family: 'my-task-def',
-        containerDefinitions: [
-          { image: 'image2' },
-        ],
-        cpu: '256', // this uses the old value because a new value could cause a service replacement
+        containerDefinitions: [{ image: 'image2' }],
       });
-      expect(mockUpdateService).toBeCalledWith({
+
+      expect(mockECSClient).toHaveReceivedCommandWith(UpdateServiceCommand, {
         service: 'arn:aws:ecs:region:account:service/my-cluster/my-service',
         cluster: 'my-cluster',
         taskDefinition: 'arn:aws:ecs:region:account:task-definition/my-task-def:3',
@@ -189,50 +104,21 @@ describe.each([HotswapMode.FALL_BACK, HotswapMode.HOTSWAP_ONLY])('%p mode', (hot
         },
         forceNewDeployment: true,
       });
-    }
-  });
+    },
+  );
 
-  silentTest('deleting any other TaskDefinition property besides ContainerDefinition results in a full deployment in CLASSIC mode and a hotswap deployment in HOTSWAP_ONLY mode', async () => {
-    // GIVEN
-    setup.setCurrentCfnStackTemplate({
-      Resources: {
-        TaskDef: {
-          Type: 'AWS::ECS::TaskDefinition',
-          Properties: {
-            Family: 'my-task-def',
-            ContainerDefinitions: [
-              { Image: 'image1' },
-            ],
-            Cpu: '256',
-          },
-        },
-        Service: {
-          Type: 'AWS::ECS::Service',
-          Properties: {
-            TaskDefinition: { Ref: 'TaskDef' },
-          },
-        },
-      },
-    });
-    setup.pushStackResourceSummaries(
-      setup.stackSummaryOf('Service', 'AWS::ECS::Service',
-        'arn:aws:ecs:region:account:service/my-cluster/my-service'),
-    );
-    mockRegisterTaskDef.mockReturnValue({
-      taskDefinition: {
-        taskDefinitionArn: 'arn:aws:ecs:region:account:task-definition/my-task-def:3',
-      },
-    });
-    const cdkStackArtifact = setup.cdkStackArtifactOf({
-      template: {
+  silentTest(
+    'any other TaskDefinition property change besides ContainerDefinition cannot be hotswapped in CLASSIC mode but does not block HOTSWAP_ONLY mode deployments',
+    async () => {
+      // GIVEN
+      setup.setCurrentCfnStackTemplate({
         Resources: {
           TaskDef: {
             Type: 'AWS::ECS::TaskDefinition',
             Properties: {
               Family: 'my-task-def',
-              ContainerDefinitions: [
-                { Image: 'image2' },
-              ],
+              ContainerDefinitions: [{ Image: 'image1' }],
+              Cpu: '256',
             },
           },
           Service: {
@@ -242,82 +128,84 @@ describe.each([HotswapMode.FALL_BACK, HotswapMode.HOTSWAP_ONLY])('%p mode', (hot
             },
           },
         },
-      },
-    });
-
-    if (hotswapMode === HotswapMode.FALL_BACK) {
-      // WHEN
-      const deployStackResult = await hotswapMockSdkProvider.tryHotswapDeployment(hotswapMode, cdkStackArtifact);
-
-      // THEN
-      expect(deployStackResult).toBeUndefined();
-      expect(mockRegisterTaskDef).not.toHaveBeenCalled();
-      expect(mockUpdateService).not.toHaveBeenCalled();
-    } else if (hotswapMode === HotswapMode.HOTSWAP_ONLY) {
-      // WHEN
-      const deployStackResult = await hotswapMockSdkProvider.tryHotswapDeployment(hotswapMode, cdkStackArtifact);
-
-      // THEN
-      expect(deployStackResult).not.toBeUndefined();
-      expect(mockRegisterTaskDef).toBeCalledWith({
-        family: 'my-task-def',
-        containerDefinitions: [
-          { image: 'image2' },
-        ],
-        cpu: '256', // this uses the old value because a new value could cause a service replacement
       });
-      expect(mockUpdateService).toBeCalledWith({
-        service: 'arn:aws:ecs:region:account:service/my-cluster/my-service',
-        cluster: 'my-cluster',
-        taskDefinition: 'arn:aws:ecs:region:account:task-definition/my-task-def:3',
-        deploymentConfiguration: {
-          minimumHealthyPercent: 0,
+      setup.pushStackResourceSummaries(
+        setup.stackSummaryOf(
+          'Service',
+          'AWS::ECS::Service',
+          'arn:aws:ecs:region:account:service/my-cluster/my-service',
+        ),
+      );
+      mockECSClient.on(RegisterTaskDefinitionCommand).resolves({
+        taskDefinition: {
+          taskDefinitionArn: 'arn:aws:ecs:region:account:task-definition/my-task-def:3',
         },
-        forceNewDeployment: true,
       });
-    }
-  });
-
-  silentTest('should call registerTaskDefinition and updateService for a difference only in the TaskDefinition without a Family property', async () => {
-    // GIVEN
-    setup.setCurrentCfnStackTemplate({
-      Resources: {
-        TaskDef: {
-          Type: 'AWS::ECS::TaskDefinition',
-          Properties: {
-            ContainerDefinitions: [
-              { Image: 'image1' },
-            ],
+      const cdkStackArtifact = setup.cdkStackArtifactOf({
+        template: {
+          Resources: {
+            TaskDef: {
+              Type: 'AWS::ECS::TaskDefinition',
+              Properties: {
+                Family: 'my-task-def',
+                ContainerDefinitions: [{ Image: 'image2' }],
+                Cpu: '512',
+              },
+            },
+            Service: {
+              Type: 'AWS::ECS::Service',
+              Properties: {
+                TaskDefinition: { Ref: 'TaskDef' },
+              },
+            },
           },
         },
-        Service: {
-          Type: 'AWS::ECS::Service',
-          Properties: {
-            TaskDefinition: { Ref: 'TaskDef' },
+      });
+
+      if (hotswapMode === HotswapMode.FALL_BACK) {
+        // WHEN
+        const deployStackResult = await hotswapMockSdkProvider.tryHotswapDeployment(hotswapMode, cdkStackArtifact);
+
+        // THEN
+        expect(deployStackResult).toBeUndefined();
+        expect(mockECSClient).not.toHaveReceivedCommand(RegisterTaskDefinitionCommand);
+        expect(mockECSClient).not.toHaveReceivedCommand(UpdateServiceCommand);
+      } else if (hotswapMode === HotswapMode.HOTSWAP_ONLY) {
+        // WHEN
+        const deployStackResult = await hotswapMockSdkProvider.tryHotswapDeployment(hotswapMode, cdkStackArtifact);
+
+        // THEN
+        expect(deployStackResult).not.toBeUndefined();
+        expect(mockECSClient).toHaveReceivedCommandWith(RegisterTaskDefinitionCommand, {
+          family: 'my-task-def',
+          containerDefinitions: [{ image: 'image2' }],
+          cpu: '256', // this uses the old value because a new value could cause a service replacement
+        });
+        expect(mockECSClient).toHaveReceivedCommandWith(UpdateServiceCommand, {
+          service: 'arn:aws:ecs:region:account:service/my-cluster/my-service',
+          cluster: 'my-cluster',
+          taskDefinition: 'arn:aws:ecs:region:account:task-definition/my-task-def:3',
+          deploymentConfiguration: {
+            minimumHealthyPercent: 0,
           },
-        },
-      },
-    });
-    setup.pushStackResourceSummaries(
-      setup.stackSummaryOf('TaskDef', 'AWS::ECS::TaskDefinition',
-        'arn:aws:ecs:region:account:task-definition/my-task-def:2'),
-      setup.stackSummaryOf('Service', 'AWS::ECS::Service',
-        'arn:aws:ecs:region:account:service/my-cluster/my-service'),
-    );
-    mockRegisterTaskDef.mockReturnValue({
-      taskDefinition: {
-        taskDefinitionArn: 'arn:aws:ecs:region:account:task-definition/my-task-def:3',
-      },
-    });
-    const cdkStackArtifact = setup.cdkStackArtifactOf({
-      template: {
+          forceNewDeployment: true,
+        });
+      }
+    },
+  );
+
+  silentTest(
+    'deleting any other TaskDefinition property besides ContainerDefinition results in a full deployment in CLASSIC mode and a hotswap deployment in HOTSWAP_ONLY mode',
+    async () => {
+      // GIVEN
+      setup.setCurrentCfnStackTemplate({
         Resources: {
           TaskDef: {
             Type: 'AWS::ECS::TaskDefinition',
             Properties: {
-              ContainerDefinitions: [
-                { Image: 'image2' },
-              ],
+              Family: 'my-task-def',
+              ContainerDefinitions: [{ Image: 'image1' }],
+              Cpu: '256',
             },
           },
           Service: {
@@ -327,144 +215,222 @@ describe.each([HotswapMode.FALL_BACK, HotswapMode.HOTSWAP_ONLY])('%p mode', (hot
             },
           },
         },
-      },
-    });
+      });
+      setup.pushStackResourceSummaries(
+        setup.stackSummaryOf(
+          'Service',
+          'AWS::ECS::Service',
+          'arn:aws:ecs:region:account:service/my-cluster/my-service',
+        ),
+      );
+      mockECSClient.on(RegisterTaskDefinitionCommand).resolves({
+        taskDefinition: {
+          taskDefinitionArn: 'arn:aws:ecs:region:account:task-definition/my-task-def:3',
+        },
+      });
+      const cdkStackArtifact = setup.cdkStackArtifactOf({
+        template: {
+          Resources: {
+            TaskDef: {
+              Type: 'AWS::ECS::TaskDefinition',
+              Properties: {
+                Family: 'my-task-def',
+                ContainerDefinitions: [{ Image: 'image2' }],
+              },
+            },
+            Service: {
+              Type: 'AWS::ECS::Service',
+              Properties: {
+                TaskDefinition: { Ref: 'TaskDef' },
+              },
+            },
+          },
+        },
+      });
 
-    // WHEN
-    const deployStackResult = await hotswapMockSdkProvider.tryHotswapDeployment(hotswapMode, cdkStackArtifact);
+      if (hotswapMode === HotswapMode.FALL_BACK) {
+        // WHEN
+        const deployStackResult = await hotswapMockSdkProvider.tryHotswapDeployment(hotswapMode, cdkStackArtifact);
 
-    // THEN
-    expect(deployStackResult).not.toBeUndefined();
-    expect(mockRegisterTaskDef).toBeCalledWith({
-      family: 'my-task-def',
-      containerDefinitions: [
-        { image: 'image2' },
-      ],
-    });
-    expect(mockUpdateService).toBeCalledWith({
-      service: 'arn:aws:ecs:region:account:service/my-cluster/my-service',
-      cluster: 'my-cluster',
-      taskDefinition: 'arn:aws:ecs:region:account:task-definition/my-task-def:3',
-      deploymentConfiguration: {
-        minimumHealthyPercent: 0,
-      },
-      forceNewDeployment: true,
-    });
-  });
+        // THEN
+        expect(deployStackResult).toBeUndefined();
+        expect(mockECSClient).not.toHaveReceivedCommand(RegisterTaskDefinitionCommand);
+        expect(mockECSClient).not.toHaveReceivedCommand(UpdateServiceCommand);
+      } else if (hotswapMode === HotswapMode.HOTSWAP_ONLY) {
+        // WHEN
+        const deployStackResult = await hotswapMockSdkProvider.tryHotswapDeployment(hotswapMode, cdkStackArtifact);
 
-  silentTest('a difference just in a TaskDefinition, without any services using it, is not hotswappable in FALL_BACK mode', async () => {
-    // GIVEN
-    setup.setCurrentCfnStackTemplate({
-      Resources: {
-        TaskDef: {
-          Type: 'AWS::ECS::TaskDefinition',
-          Properties: {
-            ContainerDefinitions: [
-              { Image: 'image1' },
-            ],
+        // THEN
+        expect(deployStackResult).not.toBeUndefined();
+        expect(mockECSClient).toHaveReceivedCommandWith(RegisterTaskDefinitionCommand, {
+          family: 'my-task-def',
+          containerDefinitions: [{ image: 'image2' }],
+          cpu: '256', // this uses the old value because a new value could cause a service replacement
+        });
+        expect(mockECSClient).toHaveReceivedCommandWith(UpdateServiceCommand, {
+          service: 'arn:aws:ecs:region:account:service/my-cluster/my-service',
+          cluster: 'my-cluster',
+          taskDefinition: 'arn:aws:ecs:region:account:task-definition/my-task-def:3',
+          deploymentConfiguration: {
+            minimumHealthyPercent: 0,
           },
-        },
-      },
-    });
-    setup.pushStackResourceSummaries(
-      setup.stackSummaryOf('TaskDef', 'AWS::ECS::TaskDefinition',
-        'arn:aws:ecs:region:account:task-definition/my-task-def:2'),
-    );
-    mockRegisterTaskDef.mockReturnValue({
-      taskDefinition: {
-        taskDefinitionArn: 'arn:aws:ecs:region:account:task-definition/my-task-def:3',
-      },
-    });
-    const cdkStackArtifact = setup.cdkStackArtifactOf({
-      template: {
+          forceNewDeployment: true,
+        });
+      }
+    },
+  );
+
+  silentTest(
+    'should call registerTaskDefinition and updateService for a difference only in the TaskDefinition without a Family property',
+    async () => {
+      // GIVEN
+      setup.setCurrentCfnStackTemplate({
         Resources: {
           TaskDef: {
             Type: 'AWS::ECS::TaskDefinition',
             Properties: {
-              ContainerDefinitions: [
-                { Image: 'image2' },
-              ],
+              ContainerDefinitions: [{ Image: 'image1' }],
+            },
+          },
+          Service: {
+            Type: 'AWS::ECS::Service',
+            Properties: {
+              TaskDefinition: { Ref: 'TaskDef' },
             },
           },
         },
-      },
-    });
-
-    if (hotswapMode === HotswapMode.FALL_BACK) {
-      // WHEN
-      const deployStackResult = await hotswapMockSdkProvider.tryHotswapDeployment(hotswapMode, cdkStackArtifact);
+      });
+      setup.pushStackResourceSummaries(
+        setup.stackSummaryOf(
+          'TaskDef',
+          'AWS::ECS::TaskDefinition',
+          'arn:aws:ecs:region:account:task-definition/my-task-def:2',
+        ),
+        setup.stackSummaryOf(
+          'Service',
+          'AWS::ECS::Service',
+          'arn:aws:ecs:region:account:service/my-cluster/my-service',
+        ),
+      );
+      mockECSClient.on(RegisterTaskDefinitionCommand).resolves({
+        taskDefinition: {
+          taskDefinitionArn: 'arn:aws:ecs:region:account:task-definition/my-task-def:3',
+        },
+      });
+      const cdkStackArtifact = setup.cdkStackArtifactOf({
+        template: {
+          Resources: {
+            TaskDef: {
+              Type: 'AWS::ECS::TaskDefinition',
+              Properties: {
+                ContainerDefinitions: [{ Image: 'image2' }],
+              },
+            },
+            Service: {
+              Type: 'AWS::ECS::Service',
+              Properties: {
+                TaskDefinition: { Ref: 'TaskDef' },
+              },
+            },
+          },
+        },
+      });
 
-      // THEN
-      expect(deployStackResult).toBeUndefined();
-      expect(mockRegisterTaskDef).not.toHaveBeenCalled();
-      expect(mockUpdateService).not.toHaveBeenCalled();
-    } else if (hotswapMode === HotswapMode.HOTSWAP_ONLY) {
       // WHEN
       const deployStackResult = await hotswapMockSdkProvider.tryHotswapDeployment(hotswapMode, cdkStackArtifact);
 
       // THEN
       expect(deployStackResult).not.toBeUndefined();
-      expect(mockRegisterTaskDef).toBeCalledWith({
+      expect(mockECSClient).toHaveReceivedCommandWith(RegisterTaskDefinitionCommand, {
         family: 'my-task-def',
-        containerDefinitions: [
-          { image: 'image2' },
-        ],
+        containerDefinitions: [{ image: 'image2' }],
       });
+      expect(mockECSClient).toHaveReceivedCommandWith(UpdateServiceCommand, {
+        service: 'arn:aws:ecs:region:account:service/my-cluster/my-service',
+        cluster: 'my-cluster',
+        taskDefinition: 'arn:aws:ecs:region:account:task-definition/my-task-def:3',
+        deploymentConfiguration: {
+          minimumHealthyPercent: 0,
+        },
+        forceNewDeployment: true,
+      });
+    },
+  );
 
-      expect(mockUpdateService).not.toHaveBeenCalledWith();
-    }
-  });
-
-  silentTest('if anything besides an ECS Service references the changed TaskDefinition, hotswapping is not possible in CLASSIC mode but is possible in HOTSWAP_ONLY', async () => {
-    // GIVEN
-    setup.setCurrentCfnStackTemplate({
-      Resources: {
-        TaskDef: {
-          Type: 'AWS::ECS::TaskDefinition',
-          Properties: {
-            Family: 'my-task-def',
-            ContainerDefinitions: [
-              { Image: 'image1' },
-            ],
+  silentTest(
+    'a difference just in a TaskDefinition, without any services using it, is not hotswappable in FALL_BACK mode',
+    async () => {
+      // GIVEN
+      setup.setCurrentCfnStackTemplate({
+        Resources: {
+          TaskDef: {
+            Type: 'AWS::ECS::TaskDefinition',
+            Properties: {
+              ContainerDefinitions: [{ Image: 'image1' }],
+            },
           },
         },
-        Service: {
-          Type: 'AWS::ECS::Service',
-          Properties: {
-            TaskDefinition: { Ref: 'TaskDef' },
-          },
+      });
+      setup.pushStackResourceSummaries(
+        setup.stackSummaryOf(
+          'TaskDef',
+          'AWS::ECS::TaskDefinition',
+          'arn:aws:ecs:region:account:task-definition/my-task-def:2',
+        ),
+      );
+      mockECSClient.on(RegisterTaskDefinitionCommand).resolves({
+        taskDefinition: {
+          taskDefinitionArn: 'arn:aws:ecs:region:account:task-definition/my-task-def:3',
         },
-        Function: {
-          Type: 'AWS::Lambda::Function',
-          Properties: {
-            Environment: {
-              Variables: {
-                TaskDefRevArn: { Ref: 'TaskDef' },
+      });
+      const cdkStackArtifact = setup.cdkStackArtifactOf({
+        template: {
+          Resources: {
+            TaskDef: {
+              Type: 'AWS::ECS::TaskDefinition',
+              Properties: {
+                ContainerDefinitions: [{ Image: 'image2' }],
               },
             },
           },
         },
-      },
-    });
-    setup.pushStackResourceSummaries(
-      setup.stackSummaryOf('Service', 'AWS::ECS::Service',
-        'arn:aws:ecs:region:account:service/my-cluster/my-service'),
-    );
-    mockRegisterTaskDef.mockReturnValue({
-      taskDefinition: {
-        taskDefinitionArn: 'arn:aws:ecs:region:account:task-definition/my-task-def:3',
-      },
-    });
-    const cdkStackArtifact = setup.cdkStackArtifactOf({
-      template: {
+      });
+
+      if (hotswapMode === HotswapMode.FALL_BACK) {
+        // WHEN
+        const deployStackResult = await hotswapMockSdkProvider.tryHotswapDeployment(hotswapMode, cdkStackArtifact);
+
+        // THEN
+        expect(deployStackResult).toBeUndefined();
+        expect(mockECSClient).not.toHaveReceivedCommand(RegisterTaskDefinitionCommand);
+        expect(mockECSClient).not.toHaveReceivedCommand(UpdateServiceCommand);
+      } else if (hotswapMode === HotswapMode.HOTSWAP_ONLY) {
+        // WHEN
+        const deployStackResult = await hotswapMockSdkProvider.tryHotswapDeployment(hotswapMode, cdkStackArtifact);
+
+        // THEN
+        expect(deployStackResult).not.toBeUndefined();
+        expect(mockECSClient).toHaveReceivedCommandWith(RegisterTaskDefinitionCommand, {
+          family: 'my-task-def',
+          containerDefinitions: [{ image: 'image2' }],
+        });
+
+        expect(mockECSClient).not.toHaveReceivedCommand(UpdateServiceCommand);
+      }
+    },
+  );
+
+  silentTest(
+    'if anything besides an ECS Service references the changed TaskDefinition, hotswapping is not possible in CLASSIC mode but is possible in HOTSWAP_ONLY',
+    async () => {
+      // GIVEN
+      setup.setCurrentCfnStackTemplate({
         Resources: {
           TaskDef: {
             Type: 'AWS::ECS::TaskDefinition',
             Properties: {
               Family: 'my-task-def',
-              ContainerDefinitions: [
-                { Image: 'image2' },
-              ],
+              ContainerDefinitions: [{ Image: 'image1' }],
             },
           },
           Service: {
@@ -484,40 +450,79 @@ describe.each([HotswapMode.FALL_BACK, HotswapMode.HOTSWAP_ONLY])('%p mode', (hot
             },
           },
         },
-      },
-    });
-
-    if (hotswapMode === HotswapMode.FALL_BACK) {
-      // WHEN
-      const deployStackResult = await hotswapMockSdkProvider.tryHotswapDeployment(hotswapMode, cdkStackArtifact);
-
-      // THEN
-      expect(deployStackResult).toBeUndefined();
-      expect(mockRegisterTaskDef).not.toHaveBeenCalled();
-      expect(mockUpdateService).not.toHaveBeenCalled();
-    } else if (hotswapMode === HotswapMode.HOTSWAP_ONLY) {
-      // WHEN
-      const deployStackResult = await hotswapMockSdkProvider.tryHotswapDeployment(hotswapMode, cdkStackArtifact);
-
-      // THEN
-      expect(deployStackResult).not.toBeUndefined();
-      expect(mockRegisterTaskDef).toBeCalledWith({
-        family: 'my-task-def',
-        containerDefinitions: [
-          { image: 'image2' },
-        ],
       });
-      expect(mockUpdateService).toBeCalledWith({
-        service: 'arn:aws:ecs:region:account:service/my-cluster/my-service',
-        cluster: 'my-cluster',
-        taskDefinition: 'arn:aws:ecs:region:account:task-definition/my-task-def:3',
-        deploymentConfiguration: {
-          minimumHealthyPercent: 0,
+      setup.pushStackResourceSummaries(
+        setup.stackSummaryOf(
+          'Service',
+          'AWS::ECS::Service',
+          'arn:aws:ecs:region:account:service/my-cluster/my-service',
+        ),
+      );
+      mockECSClient.on(RegisterTaskDefinitionCommand).resolves({
+        taskDefinition: {
+          taskDefinitionArn: 'arn:aws:ecs:region:account:task-definition/my-task-def:3',
         },
-        forceNewDeployment: true,
       });
-    }
-  });
+      const cdkStackArtifact = setup.cdkStackArtifactOf({
+        template: {
+          Resources: {
+            TaskDef: {
+              Type: 'AWS::ECS::TaskDefinition',
+              Properties: {
+                Family: 'my-task-def',
+                ContainerDefinitions: [{ Image: 'image2' }],
+              },
+            },
+            Service: {
+              Type: 'AWS::ECS::Service',
+              Properties: {
+                TaskDefinition: { Ref: 'TaskDef' },
+              },
+            },
+            Function: {
+              Type: 'AWS::Lambda::Function',
+              Properties: {
+                Environment: {
+                  Variables: {
+                    TaskDefRevArn: { Ref: 'TaskDef' },
+                  },
+                },
+              },
+            },
+          },
+        },
+      });
+
+      if (hotswapMode === HotswapMode.FALL_BACK) {
+        // WHEN
+        const deployStackResult = await hotswapMockSdkProvider.tryHotswapDeployment(hotswapMode, cdkStackArtifact);
+
+        // THEN
+        expect(deployStackResult).toBeUndefined();
+        expect(mockECSClient).not.toHaveReceivedCommand(RegisterTaskDefinitionCommand);
+        expect(mockECSClient).not.toHaveReceivedCommand(UpdateServiceCommand);
+      } else if (hotswapMode === HotswapMode.HOTSWAP_ONLY) {
+        // WHEN
+        const deployStackResult = await hotswapMockSdkProvider.tryHotswapDeployment(hotswapMode, cdkStackArtifact);
+
+        // THEN
+        expect(deployStackResult).not.toBeUndefined();
+        expect(mockECSClient).toHaveReceivedCommandWith(RegisterTaskDefinitionCommand, {
+          family: 'my-task-def',
+          containerDefinitions: [{ image: 'image2' }],
+        });
+        expect(mockECSClient).toHaveReceivedCommandWith(UpdateServiceCommand, {
+          service: 'arn:aws:ecs:region:account:service/my-cluster/my-service',
+          cluster: 'my-cluster',
+          taskDefinition: 'arn:aws:ecs:region:account:task-definition/my-task-def:3',
+          deploymentConfiguration: {
+            minimumHealthyPercent: 0,
+          },
+          forceNewDeployment: true,
+        });
+      }
+    },
+  );
 
   silentTest('should call registerTaskDefinition with certain properties not lowercased', async () => {
     // GIVEN
@@ -527,9 +532,7 @@ describe.each([HotswapMode.FALL_BACK, HotswapMode.HOTSWAP_ONLY])('%p mode', (hot
           Type: 'AWS::ECS::TaskDefinition',
           Properties: {
             Family: 'my-task-def',
-            ContainerDefinitions: [
-              { Image: 'image1' },
-            ],
+            ContainerDefinitions: [{ Image: 'image1' }],
             Volumes: [
               {
                 DockerVolumeConfiguration: {
@@ -549,10 +552,9 @@ describe.each([HotswapMode.FALL_BACK, HotswapMode.HOTSWAP_ONLY])('%p mode', (hot
       },
     });
     setup.pushStackResourceSummaries(
-      setup.stackSummaryOf('Service', 'AWS::ECS::Service',
-        'arn:aws:ecs:region:account:service/my-cluster/my-service'),
+      setup.stackSummaryOf('Service', 'AWS::ECS::Service', 'arn:aws:ecs:region:account:service/my-cluster/my-service'),
     );
-    mockRegisterTaskDef.mockReturnValue({
+    mockECSClient.on(RegisterTaskDefinitionCommand).resolves({
       taskDefinition: {
         taskDefinitionArn: 'arn:aws:ecs:region:account:task-definition/my-task-def:3',
       },
@@ -601,7 +603,7 @@ describe.each([HotswapMode.FALL_BACK, HotswapMode.HOTSWAP_ONLY])('%p mode', (hot
 
     // THEN
     expect(deployStackResult).not.toBeUndefined();
-    expect(mockRegisterTaskDef).toBeCalledWith({
+    expect(mockECSClient).toHaveReceivedCommandWith(RegisterTaskDefinitionCommand, {
       family: 'my-task-def',
       containerDefinitions: [
         {
@@ -626,7 +628,7 @@ describe.each([HotswapMode.FALL_BACK, HotswapMode.HOTSWAP_ONLY])('%p mode', (hot
         },
       ],
     });
-    expect(mockUpdateService).toBeCalledWith({
+    expect(mockECSClient).toHaveReceivedCommandWith(UpdateServiceCommand, {
       service: 'arn:aws:ecs:region:account:service/my-cluster/my-service',
       cluster: 'my-cluster',
       taskDefinition: 'arn:aws:ecs:region:account:task-definition/my-task-def:3',
diff --git a/packages/aws-cdk/test/api/hotswap/hotswap-deployments.test.ts b/packages/aws-cdk/test/api/hotswap/hotswap-deployments.test.ts
index a2c7a65424712..a20e3eebe39e1 100644
--- a/packages/aws-cdk/test/api/hotswap/hotswap-deployments.test.ts
+++ b/packages/aws-cdk/test/api/hotswap/hotswap-deployments.test.ts
@@ -1,30 +1,38 @@
-import { Lambda, StepFunctions } from 'aws-sdk';
+import { ListExportsCommand } from '@aws-sdk/client-cloudformation';
+import { UpdateFunctionCodeCommand } from '@aws-sdk/client-lambda';
+import { UpdateStateMachineCommand } from '@aws-sdk/client-sfn';
 import * as setup from './hotswap-test-setup';
 import { CfnEvaluationException } from '../../../lib/api/evaluate-cloudformation-template';
 import { HotswapMode } from '../../../lib/api/hotswap/common';
+import { MockSdk, mockCloudFormationClient, mockLambdaClient, mockStepFunctionsClient } from '../../util/mock-sdk';
 import { silentTest } from '../../util/silent';
 
+jest.mock('@aws-sdk/client-lambda', () => {
+  const original = jest.requireActual('@aws-sdk/client-lambda');
+
+  return {
+    ...original,
+    waitUntilFunctionUpdated: jest.fn(),
+  };
+});
+
 let hotswapMockSdkProvider: setup.HotswapMockSdkProvider;
-let mockUpdateLambdaCode: (params: Lambda.Types.UpdateFunctionCodeRequest) => Lambda.Types.FunctionConfiguration;
-let mockUpdateMachineDefinition: (params: StepFunctions.Types.UpdateStateMachineInput) => StepFunctions.Types.UpdateStateMachineOutput;
-let mockGetEndpointSuffix: () => string;
+let sdk: MockSdk;
 
 beforeEach(() => {
   hotswapMockSdkProvider = setup.setupHotswapTests();
-  mockUpdateLambdaCode = jest.fn().mockReturnValue({});
-  mockUpdateMachineDefinition = jest.fn();
-  mockGetEndpointSuffix = jest.fn(() => 'amazonaws.com');
-  hotswapMockSdkProvider.stubLambda({
-    updateFunctionCode: mockUpdateLambdaCode,
-  });
-  hotswapMockSdkProvider.setUpdateStateMachineMock(mockUpdateMachineDefinition);
-  hotswapMockSdkProvider.stubGetEndpointSuffix(mockGetEndpointSuffix);
+  sdk = new MockSdk();
+  sdk.getUrlSuffix = () => Promise.resolve('amazonaws.com');
+  jest.resetAllMocks();
 });
 
 describe.each([HotswapMode.FALL_BACK, HotswapMode.HOTSWAP_ONLY])('%p mode', (hotswapMode) => {
   silentTest('returns a deployStackResult with noOp=true when it receives an empty set of changes', async () => {
     // WHEN
-    const deployStackResult = await hotswapMockSdkProvider.tryHotswapDeployment(hotswapMode, setup.cdkStackArtifactOf());
+    const deployStackResult = await hotswapMockSdkProvider.tryHotswapDeployment(
+      hotswapMode,
+      setup.cdkStackArtifactOf(),
+    );
 
     // THEN
     expect(deployStackResult).not.toBeUndefined();
@@ -32,124 +40,130 @@ describe.each([HotswapMode.FALL_BACK, HotswapMode.HOTSWAP_ONLY])('%p mode', (hot
     expect(deployStackResult?.stackArn).toEqual(setup.STACK_ID);
   });
 
-  silentTest('A change to only a non-hotswappable resource results in a full deployment for HOTSWAP and a noOp for HOTSWAP_ONLY', async () => {
-    // GIVEN
-    setup.setCurrentCfnStackTemplate({
-      Resources: {
-        SomethingElse: {
-          Type: 'AWS::CloudFormation::SomethingElse',
-          Properties: {
-            Prop: 'old-value',
-          },
-        },
-      },
-    });
-    const cdkStackArtifact = setup.cdkStackArtifactOf({
-      template: {
+  silentTest(
+    'A change to only a non-hotswappable resource results in a full deployment for HOTSWAP and a noOp for HOTSWAP_ONLY',
+    async () => {
+      // GIVEN
+      setup.setCurrentCfnStackTemplate({
         Resources: {
           SomethingElse: {
             Type: 'AWS::CloudFormation::SomethingElse',
             Properties: {
-              Prop: 'new-value',
+              Prop: 'old-value',
             },
           },
         },
-      },
-    });
-
-    if (hotswapMode === HotswapMode.FALL_BACK) {
-      // WHEN
-      const deployStackResult = await hotswapMockSdkProvider.tryHotswapDeployment(hotswapMode, cdkStackArtifact);
-
-      // THEN
-      expect(deployStackResult).toBeUndefined();
-      expect(mockUpdateMachineDefinition).not.toHaveBeenCalled();
-      expect(mockUpdateLambdaCode).not.toHaveBeenCalled();
-    } else if (hotswapMode === HotswapMode.HOTSWAP_ONLY) {
-      // WHEN
-      const deployStackResult = await hotswapMockSdkProvider.tryHotswapDeployment(hotswapMode, cdkStackArtifact);
-
-      // THEN
-      expect(deployStackResult).not.toBeUndefined();
-      expect(deployStackResult?.noOp).toEqual(true);
-      expect(mockUpdateMachineDefinition).not.toHaveBeenCalled();
-      expect(mockUpdateLambdaCode).not.toHaveBeenCalled();
-    }
-  });
-
-  silentTest('A change to both a hotswappable resource and a non-hotswappable resource results in a full deployment for HOTSWAP and a noOp for HOTSWAP_ONLY', async () => {
-    // GIVEN
-    setup.setCurrentCfnStackTemplate({
-      Resources: {
-        Func: {
-          Type: 'AWS::Lambda::Function',
-          Properties: {
-            Code: {
-              S3Bucket: 'current-bucket',
-              S3Key: 'current-key',
+      });
+      const cdkStackArtifact = setup.cdkStackArtifactOf({
+        template: {
+          Resources: {
+            SomethingElse: {
+              Type: 'AWS::CloudFormation::SomethingElse',
+              Properties: {
+                Prop: 'new-value',
+              },
             },
-            FunctionName: 'my-function',
-          },
-          Metadata: {
-            'aws:asset:path': 'old-path',
-          },
-        },
-        SomethingElse: {
-          Type: 'AWS::CloudFormation::SomethingElse',
-          Properties: {
-            Prop: 'old-value',
           },
         },
-      },
-    });
-    const cdkStackArtifact = setup.cdkStackArtifactOf({
-      template: {
+      });
+
+      if (hotswapMode === HotswapMode.FALL_BACK) {
+        // WHEN
+        const deployStackResult = await hotswapMockSdkProvider.tryHotswapDeployment(hotswapMode, cdkStackArtifact);
+
+        // THEN
+        expect(deployStackResult).toBeUndefined();
+        expect(mockStepFunctionsClient).not.toHaveReceivedCommand(UpdateStateMachineCommand);
+        expect(mockLambdaClient).not.toHaveReceivedCommand(UpdateFunctionCodeCommand);
+      } else if (hotswapMode === HotswapMode.HOTSWAP_ONLY) {
+        // WHEN
+        const deployStackResult = await hotswapMockSdkProvider.tryHotswapDeployment(hotswapMode, cdkStackArtifact);
+
+        // THEN
+        expect(deployStackResult).not.toBeUndefined();
+        expect(deployStackResult?.noOp).toEqual(true);
+        expect(mockStepFunctionsClient).not.toHaveReceivedCommand(UpdateStateMachineCommand);
+        expect(mockLambdaClient).not.toHaveReceivedCommand(UpdateFunctionCodeCommand);
+      }
+    },
+  );
+
+  silentTest(
+    'A change to both a hotswappable resource and a non-hotswappable resource results in a full deployment for HOTSWAP and a noOp for HOTSWAP_ONLY',
+    async () => {
+      // GIVEN
+      setup.setCurrentCfnStackTemplate({
         Resources: {
           Func: {
             Type: 'AWS::Lambda::Function',
             Properties: {
               Code: {
                 S3Bucket: 'current-bucket',
-                S3Key: 'new-key',
+                S3Key: 'current-key',
               },
               FunctionName: 'my-function',
             },
             Metadata: {
-              'aws:asset:path': 'new-path',
+              'aws:asset:path': 'old-path',
             },
           },
           SomethingElse: {
             Type: 'AWS::CloudFormation::SomethingElse',
             Properties: {
-              Prop: 'new-value',
+              Prop: 'old-value',
             },
           },
         },
-      },
-    });
-
-    if (hotswapMode === HotswapMode.FALL_BACK) {
-      // WHEN
-      const deployStackResult = await hotswapMockSdkProvider.tryHotswapDeployment(hotswapMode, cdkStackArtifact);
-
-      // THEN
-      expect(deployStackResult).toBeUndefined();
-      expect(mockUpdateMachineDefinition).not.toHaveBeenCalled();
-      expect(mockUpdateLambdaCode).not.toHaveBeenCalled();
-    } else if (hotswapMode === HotswapMode.HOTSWAP_ONLY) {
-      // WHEN
-      const deployStackResult = await hotswapMockSdkProvider.tryHotswapDeployment(hotswapMode, cdkStackArtifact);
-
-      // THEN
-      expect(deployStackResult).not.toBeUndefined();
-      expect(mockUpdateLambdaCode).toHaveBeenCalledWith({
-        FunctionName: 'my-function',
-        S3Bucket: 'current-bucket',
-        S3Key: 'new-key',
       });
-      expect(mockUpdateMachineDefinition).not.toHaveBeenCalled();
-    }
-  });
+      const cdkStackArtifact = setup.cdkStackArtifactOf({
+        template: {
+          Resources: {
+            Func: {
+              Type: 'AWS::Lambda::Function',
+              Properties: {
+                Code: {
+                  S3Bucket: 'current-bucket',
+                  S3Key: 'new-key',
+                },
+                FunctionName: 'my-function',
+              },
+              Metadata: {
+                'aws:asset:path': 'new-path',
+              },
+            },
+            SomethingElse: {
+              Type: 'AWS::CloudFormation::SomethingElse',
+              Properties: {
+                Prop: 'new-value',
+              },
+            },
+          },
+        },
+      });
+
+      if (hotswapMode === HotswapMode.FALL_BACK) {
+        // WHEN
+        const deployStackResult = await hotswapMockSdkProvider.tryHotswapDeployment(hotswapMode, cdkStackArtifact);
+
+        // THEN
+        expect(deployStackResult).toBeUndefined();
+        expect(mockStepFunctionsClient).not.toHaveReceivedCommand(UpdateStateMachineCommand);
+        expect(mockLambdaClient).not.toHaveReceivedCommand(UpdateFunctionCodeCommand);
+      } else if (hotswapMode === HotswapMode.HOTSWAP_ONLY) {
+        // WHEN
+        const deployStackResult = await hotswapMockSdkProvider.tryHotswapDeployment(hotswapMode, cdkStackArtifact);
+
+        // THEN
+        expect(deployStackResult).not.toBeUndefined();
+        expect(mockLambdaClient).toHaveReceivedCommandWith(UpdateFunctionCodeCommand, {
+          FunctionName: 'my-function',
+          S3Bucket: 'current-bucket',
+          S3Key: 'new-key',
+        });
+        expect(mockStepFunctionsClient).not.toHaveReceivedCommand(UpdateStateMachineCommand);
+      }
+    },
+  );
 
   silentTest('changes only to CDK::Metadata result in a noOp', async () => {
     // GIVEN
@@ -182,8 +196,8 @@ describe.each([HotswapMode.FALL_BACK, HotswapMode.HOTSWAP_ONLY])('%p mode', (hot
     // THEN
     expect(deployStackResult).not.toBeUndefined();
     expect(deployStackResult?.noOp).toEqual(true);
-    expect(mockUpdateMachineDefinition).not.toHaveBeenCalled();
-    expect(mockUpdateLambdaCode).not.toHaveBeenCalled();
+    expect(mockStepFunctionsClient).not.toHaveReceivedCommand(UpdateStateMachineCommand);
+    expect(mockLambdaClient).not.toHaveReceivedCommand(UpdateFunctionCodeCommand);
   });
 
   silentTest('resource deletions require full deployments for HOTSWAP and a noOp for HOTSWAP_ONLY', async () => {
@@ -203,8 +217,8 @@ describe.each([HotswapMode.FALL_BACK, HotswapMode.HOTSWAP_ONLY])('%p mode', (hot
 
       // THEN
       expect(deployStackResult).toBeUndefined();
-      expect(mockUpdateMachineDefinition).not.toHaveBeenCalled();
-      expect(mockUpdateLambdaCode).not.toHaveBeenCalled();
+      expect(mockStepFunctionsClient).not.toHaveReceivedCommand(UpdateStateMachineCommand);
+      expect(mockLambdaClient).not.toHaveReceivedCommand(UpdateFunctionCodeCommand);
     } else if (hotswapMode === HotswapMode.HOTSWAP_ONLY) {
       // WHEN
       const deployStackResult = await hotswapMockSdkProvider.tryHotswapDeployment(hotswapMode, cdkStackArtifact);
@@ -212,8 +226,8 @@ describe.each([HotswapMode.FALL_BACK, HotswapMode.HOTSWAP_ONLY])('%p mode', (hot
       // THEN
       expect(deployStackResult).not.toBeUndefined();
       expect(deployStackResult?.noOp).toEqual(true);
-      expect(mockUpdateMachineDefinition).not.toHaveBeenCalled();
-      expect(mockUpdateLambdaCode).not.toHaveBeenCalled();
+      expect(mockStepFunctionsClient).not.toHaveReceivedCommand(UpdateStateMachineCommand);
+      expect(mockLambdaClient).not.toHaveReceivedCommand(UpdateFunctionCodeCommand);
     }
   });
 
@@ -229,14 +243,7 @@ describe.each([HotswapMode.FALL_BACK, HotswapMode.HOTSWAP_ONLY])('%p mode', (hot
               S3Key: 'current-key',
             },
             FunctionName: {
-              'Fn::Join': [
-                '',
-                [
-                  { Ref: 'AWS::Partition' },
-                  '-',
-                  'my-function',
-                ],
-              ],
+              'Fn::Join': ['', [{ Ref: 'AWS::Partition' }, '-', 'my-function']],
             },
           },
           Metadata: {
@@ -256,14 +263,7 @@ describe.each([HotswapMode.FALL_BACK, HotswapMode.HOTSWAP_ONLY])('%p mode', (hot
                 S3Key: 'new-key',
               },
               FunctionName: {
-                'Fn::Join': [
-                  '',
-                  [
-                    { Ref: 'AWS::Partition' },
-                    '-',
-                    'my-function',
-                  ],
-                ],
+                'Fn::Join': ['', [{ Ref: 'AWS::Partition' }, '-', 'my-function']],
               },
             },
             Metadata: {
@@ -279,8 +279,8 @@ describe.each([HotswapMode.FALL_BACK, HotswapMode.HOTSWAP_ONLY])('%p mode', (hot
 
     // THEN
     expect(deployStackResult).not.toBeUndefined();
-    expect(mockUpdateLambdaCode).toHaveBeenCalledWith({
-      FunctionName: 'aws-my-function',
+    expect(mockLambdaClient).toHaveReceivedCommandWith(UpdateFunctionCodeCommand, {
+      FunctionName: 'swa-my-function',
       S3Bucket: 'current-bucket',
       S3Key: 'new-key',
     });
@@ -298,12 +298,7 @@ describe.each([HotswapMode.FALL_BACK, HotswapMode.HOTSWAP_ONLY])('%p mode', (hot
               S3Key: 'current-key',
             },
             FunctionName: {
-              'Fn::Join': ['', [
-                'my-function-',
-                { Ref: 'AWS::URLSuffix' },
-                '-',
-                { Ref: 'AWS::URLSuffix' },
-              ]],
+              'Fn::Join': ['', ['my-function-', { Ref: 'AWS::URLSuffix' }, '-', { Ref: 'AWS::URLSuffix' }]],
             },
           },
           Metadata: {
@@ -323,12 +318,7 @@ describe.each([HotswapMode.FALL_BACK, HotswapMode.HOTSWAP_ONLY])('%p mode', (hot
                 S3Key: 'new-key',
               },
               FunctionName: {
-                'Fn::Join': ['', [
-                  'my-function-',
-                  { Ref: 'AWS::URLSuffix' },
-                  '-',
-                  { Ref: 'AWS::URLSuffix' },
-                ]],
+                'Fn::Join': ['', ['my-function-', { Ref: 'AWS::URLSuffix' }, '-', { Ref: 'AWS::URLSuffix' }]],
               },
             },
             Metadata: {
@@ -344,141 +334,140 @@ describe.each([HotswapMode.FALL_BACK, HotswapMode.HOTSWAP_ONLY])('%p mode', (hot
 
     // THEN
     expect(deployStackResult).not.toBeUndefined();
-    expect(mockUpdateLambdaCode).toHaveBeenCalledWith({
+    expect(mockLambdaClient).toHaveReceivedCommandWith(UpdateFunctionCodeCommand, {
       FunctionName: 'my-function-amazonaws.com-amazonaws.com',
       S3Bucket: 'current-bucket',
       S3Key: 'new-key',
     });
-    expect(mockGetEndpointSuffix).toHaveBeenCalledTimes(1);
-
-    // the User-Agent is set correctly
-    expect(hotswapMockSdkProvider.mockSdkProvider.sdk.appendCustomUserAgent)
-      .toHaveBeenCalledWith('cdk-hotswap/success-lambda');
-    expect(hotswapMockSdkProvider.mockSdkProvider.sdk.removeCustomUserAgent)
-      .toHaveBeenCalledWith('cdk-hotswap/success-lambda');
   });
 
-  silentTest('changing the type of a deployed resource always results in a full deployment for HOTSWAP and a noOp for HOTSWAP_ONLY', async () => {
-    // GIVEN
-    setup.setCurrentCfnStackTemplate({
-      Resources: {
-        SharedLogicalId: {
-          Type: 'AWS::Lambda::Function',
-          Properties: {
-            Code: {
-              S3Bucket: 'current-bucket',
-              S3Key: 'new-key',
-            },
-            FunctionName: 'my-function',
-          },
-        },
-      },
-    });
-    const cdkStackArtifact = setup.cdkStackArtifactOf({
-      template: {
+  silentTest(
+    'changing the type of a deployed resource always results in a full deployment for HOTSWAP and a noOp for HOTSWAP_ONLY',
+    async () => {
+      // GIVEN
+      setup.setCurrentCfnStackTemplate({
         Resources: {
           SharedLogicalId: {
-            Type: 'AWS::StepFunctions::StateMachine',
+            Type: 'AWS::Lambda::Function',
             Properties: {
-              DefinitionString: '{ Prop: "new-value" }',
-              StateMachineName: 'my-machine',
+              Code: {
+                S3Bucket: 'current-bucket',
+                S3Key: 'new-key',
+              },
+              FunctionName: 'my-function',
             },
           },
         },
-      },
-    });
-
-    if (hotswapMode === HotswapMode.FALL_BACK) {
-      // WHEN
-      const deployStackResult = await hotswapMockSdkProvider.tryHotswapDeployment(hotswapMode, cdkStackArtifact);
-
-      // THEN
-      expect(deployStackResult).toBeUndefined();
-      expect(mockUpdateMachineDefinition).not.toHaveBeenCalled();
-      expect(mockUpdateLambdaCode).not.toHaveBeenCalled();
-    } else if (hotswapMode === HotswapMode.HOTSWAP_ONLY) {
-      // WHEN
-      const deployStackResult = await hotswapMockSdkProvider.tryHotswapDeployment(hotswapMode, cdkStackArtifact);
-
-      // THEN
-      expect(deployStackResult).not.toBeUndefined();
-      expect(deployStackResult?.noOp).toEqual(true);
-      expect(mockUpdateMachineDefinition).not.toHaveBeenCalled();
-      expect(mockUpdateLambdaCode).not.toHaveBeenCalled();
-    }
-  });
-
-  silentTest('A change to both a hotswappable resource and a stack output results in a full deployment for HOTSWAP and a hotswap deployment for HOTSWAP_ONLY', async () => {
-    // GIVEN
-    setup.setCurrentCfnStackTemplate({
-      Resources: {
-        Func: {
-          Type: 'AWS::Lambda::Function',
-          Properties: {
-            Code: {
-              S3Bucket: 'current-bucket',
-              S3Key: 'current-key',
+      });
+      const cdkStackArtifact = setup.cdkStackArtifactOf({
+        template: {
+          Resources: {
+            SharedLogicalId: {
+              Type: 'AWS::StepFunctions::StateMachine',
+              Properties: {
+                DefinitionString: '{ Prop: "new-value" }',
+                StateMachineName: 'my-machine',
+              },
             },
-            FunctionName: 'my-function',
           },
-          Metadata: {
-            'aws:asset:path': 'old-path',
-          },
-        },
-      },
-      Outputs: {
-        SomeOutput: {
-          Value: 'old-value',
         },
-      },
-    });
-    const cdkStackArtifact = setup.cdkStackArtifactOf({
-      template: {
+      });
+
+      if (hotswapMode === HotswapMode.FALL_BACK) {
+        // WHEN
+        const deployStackResult = await hotswapMockSdkProvider.tryHotswapDeployment(hotswapMode, cdkStackArtifact);
+
+        // THEN
+        expect(deployStackResult).toBeUndefined();
+        expect(mockStepFunctionsClient).not.toHaveReceivedCommand(UpdateStateMachineCommand);
+        expect(mockLambdaClient).not.toHaveReceivedCommand(UpdateFunctionCodeCommand);
+      } else if (hotswapMode === HotswapMode.HOTSWAP_ONLY) {
+        // WHEN
+        const deployStackResult = await hotswapMockSdkProvider.tryHotswapDeployment(hotswapMode, cdkStackArtifact);
+
+        // THEN
+        expect(deployStackResult).not.toBeUndefined();
+        expect(deployStackResult?.noOp).toEqual(true);
+        expect(mockStepFunctionsClient).not.toHaveReceivedCommand(UpdateStateMachineCommand);
+        expect(mockLambdaClient).not.toHaveReceivedCommand(UpdateFunctionCodeCommand);
+      }
+    },
+  );
+
+  silentTest(
+    'A change to both a hotswappable resource and a stack output results in a full deployment for HOTSWAP and a hotswap deployment for HOTSWAP_ONLY',
+    async () => {
+      // GIVEN
+      setup.setCurrentCfnStackTemplate({
         Resources: {
           Func: {
             Type: 'AWS::Lambda::Function',
             Properties: {
               Code: {
                 S3Bucket: 'current-bucket',
-                S3Key: 'new-key',
+                S3Key: 'current-key',
               },
               FunctionName: 'my-function',
             },
             Metadata: {
-              'aws:asset:path': 'new-path',
+              'aws:asset:path': 'old-path',
             },
           },
         },
         Outputs: {
           SomeOutput: {
-            Value: 'new-value',
+            Value: 'old-value',
+          },
+        },
+      });
+      const cdkStackArtifact = setup.cdkStackArtifactOf({
+        template: {
+          Resources: {
+            Func: {
+              Type: 'AWS::Lambda::Function',
+              Properties: {
+                Code: {
+                  S3Bucket: 'current-bucket',
+                  S3Key: 'new-key',
+                },
+                FunctionName: 'my-function',
+              },
+              Metadata: {
+                'aws:asset:path': 'new-path',
+              },
+            },
+          },
+          Outputs: {
+            SomeOutput: {
+              Value: 'new-value',
+            },
           },
         },
-      },
-    });
-
-    if (hotswapMode === HotswapMode.FALL_BACK) {
-      // WHEN
-      const deployStackResult = await hotswapMockSdkProvider.tryHotswapDeployment(hotswapMode, cdkStackArtifact);
-
-      // THEN
-      expect(deployStackResult).toBeUndefined();
-      expect(mockUpdateMachineDefinition).not.toHaveBeenCalled();
-      expect(mockUpdateLambdaCode).not.toHaveBeenCalled();
-    } else if (hotswapMode === HotswapMode.HOTSWAP_ONLY) {
-      // WHEN
-      const deployStackResult = await hotswapMockSdkProvider.tryHotswapDeployment(hotswapMode, cdkStackArtifact);
-
-      // THEN
-      expect(deployStackResult).not.toBeUndefined();
-      expect(mockUpdateLambdaCode).toHaveBeenCalledWith({
-        FunctionName: 'my-function',
-        S3Bucket: 'current-bucket',
-        S3Key: 'new-key',
       });
-      expect(mockUpdateMachineDefinition).not.toHaveBeenCalled();
-    }
-  });
+
+      if (hotswapMode === HotswapMode.FALL_BACK) {
+        // WHEN
+        const deployStackResult = await hotswapMockSdkProvider.tryHotswapDeployment(hotswapMode, cdkStackArtifact);
+
+        // THEN
+        expect(deployStackResult).toBeUndefined();
+        expect(mockStepFunctionsClient).not.toHaveReceivedCommand(UpdateStateMachineCommand);
+        expect(mockLambdaClient).not.toHaveReceivedCommand(UpdateFunctionCodeCommand);
+      } else if (hotswapMode === HotswapMode.HOTSWAP_ONLY) {
+        // WHEN
+        const deployStackResult = await hotswapMockSdkProvider.tryHotswapDeployment(hotswapMode, cdkStackArtifact);
+
+        // THEN
+        expect(deployStackResult).not.toBeUndefined();
+        expect(mockLambdaClient).toHaveReceivedCommandWith(UpdateFunctionCodeCommand, {
+          FunctionName: 'my-function',
+          S3Bucket: 'current-bucket',
+          S3Key: 'new-key',
+        });
+        expect(mockStepFunctionsClient).not.toHaveReceivedCommand(UpdateStateMachineCommand);
+      }
+    },
+  );
 
   silentTest('Multiple CfnEvaluationException will not cause unhandled rejections', async () => {
     // GIVEN
@@ -562,77 +551,89 @@ describe.each([HotswapMode.FALL_BACK, HotswapMode.HOTSWAP_ONLY])('%p mode', (hot
 
     // THEN
     await expect(deployStackResult).rejects.toThrowError(CfnEvaluationException);
-    expect(mockUpdateMachineDefinition).not.toHaveBeenCalled();
-    expect(mockUpdateLambdaCode).not.toHaveBeenCalled();
+    expect(mockStepFunctionsClient).not.toHaveReceivedCommand(UpdateStateMachineCommand);
+    expect(mockLambdaClient).not.toHaveReceivedCommand(UpdateFunctionCodeCommand);
   });
 
-  silentTest('deleting a resource and making a hotswappable change results in full deployments for HOTSWAP and a hotswap deployment for HOTSWAP_ONLY', async () => {
-    // GIVEN
-    setup.setCurrentCfnStackTemplate({
-      Resources: {
-        Machine: {
-          Type: 'AWS::StepFunctions::StateMachine',
-        },
-        Func: {
-          Type: 'AWS::Lambda::Function',
-          Properties: {
-            Code: {
-              S3Bucket: 'current-bucket',
-              S3Key: 'current-key',
-            },
-            FunctionName: 'my-function',
-          },
-          Metadata: {
-            'aws:asset:path': 'old-path',
-          },
-        },
-      },
-    });
-    const cdkStackArtifact = setup.cdkStackArtifactOf({
-      template: {
+  silentTest(
+    'deleting a resource and making a hotswappable change results in full deployments for HOTSWAP and a hotswap deployment for HOTSWAP_ONLY',
+    async () => {
+      // GIVEN
+      setup.setCurrentCfnStackTemplate({
         Resources: {
+          Machine: {
+            Type: 'AWS::StepFunctions::StateMachine',
+          },
           Func: {
             Type: 'AWS::Lambda::Function',
             Properties: {
               Code: {
                 S3Bucket: 'current-bucket',
-                S3Key: 'new-key',
+                S3Key: 'current-key',
               },
               FunctionName: 'my-function',
             },
             Metadata: {
-              'aws:asset:path': 'new-path',
+              'aws:asset:path': 'old-path',
             },
           },
         },
-      },
-    });
-
-    if (hotswapMode === HotswapMode.FALL_BACK) {
-      // WHEN
-      const deployStackResult = await hotswapMockSdkProvider.tryHotswapDeployment(hotswapMode, cdkStackArtifact);
-
-      // THEN
-      expect(deployStackResult).toBeUndefined();
-      expect(mockUpdateMachineDefinition).not.toHaveBeenCalled();
-      expect(mockUpdateLambdaCode).not.toHaveBeenCalled();
-    } else if (hotswapMode === HotswapMode.HOTSWAP_ONLY) {
-      // WHEN
-      const deployStackResult = await hotswapMockSdkProvider.tryHotswapDeployment(hotswapMode, cdkStackArtifact);
-
-      // THEN
-      expect(deployStackResult).not.toBeUndefined();
-      expect(mockUpdateMachineDefinition).not.toHaveBeenCalled();
-      expect(mockUpdateLambdaCode).toHaveBeenCalledWith({
-        FunctionName: 'my-function',
-        S3Bucket: 'current-bucket',
-        S3Key: 'new-key',
       });
-    }
-  });
+      const cdkStackArtifact = setup.cdkStackArtifactOf({
+        template: {
+          Resources: {
+            Func: {
+              Type: 'AWS::Lambda::Function',
+              Properties: {
+                Code: {
+                  S3Bucket: 'current-bucket',
+                  S3Key: 'new-key',
+                },
+                FunctionName: 'my-function',
+              },
+              Metadata: {
+                'aws:asset:path': 'new-path',
+              },
+            },
+          },
+        },
+      });
+
+      if (hotswapMode === HotswapMode.FALL_BACK) {
+        // WHEN
+        const deployStackResult = await hotswapMockSdkProvider.tryHotswapDeployment(hotswapMode, cdkStackArtifact);
+
+        // THEN
+        expect(deployStackResult).toBeUndefined();
+        expect(mockStepFunctionsClient).not.toHaveReceivedCommand(UpdateStateMachineCommand);
+        expect(mockLambdaClient).not.toHaveReceivedCommand(UpdateFunctionCodeCommand);
+      } else if (hotswapMode === HotswapMode.HOTSWAP_ONLY) {
+        // WHEN
+        const deployStackResult = await hotswapMockSdkProvider.tryHotswapDeployment(hotswapMode, cdkStackArtifact);
+
+        // THEN
+        expect(deployStackResult).not.toBeUndefined();
+        expect(mockStepFunctionsClient).not.toHaveReceivedCommand(UpdateStateMachineCommand);
+        expect(mockLambdaClient).toHaveReceivedCommandWith(UpdateFunctionCodeCommand, {
+          FunctionName: 'my-function',
+          S3Bucket: 'current-bucket',
+          S3Key: 'new-key',
+        });
+      }
+    },
+  );
 
   silentTest('can correctly reference Fn::ImportValue in hotswappable changes', async () => {
     // GIVEN
+    mockCloudFormationClient.on(ListExportsCommand).resolves({
+      Exports: [
+        {
+          ExportingStackId: 'test-exporting-stack-id',
+          Name: 'test-import',
+          Value: 'new-key',
+        },
+      ],
+    });
     setup.setCurrentCfnStackTemplate({
       Resources: {
         Func: {
@@ -642,7 +643,7 @@ describe.each([HotswapMode.FALL_BACK, HotswapMode.HOTSWAP_ONLY])('%p mode', (hot
               S3Bucket: 'current-bucket',
               S3Key: 'old-key',
             },
-            FunctionName: 'aws-my-function',
+            FunctionName: 'swa-my-function',
           },
           Metadata: {
             'aws:asset:path': 'new-path',
@@ -662,7 +663,7 @@ describe.each([HotswapMode.FALL_BACK, HotswapMode.HOTSWAP_ONLY])('%p mode', (hot
                   'Fn::ImportValue': 'test-import',
                 },
               },
-              FunctionName: 'aws-my-function',
+              FunctionName: 'swa-my-function',
             },
             Metadata: {
               'aws:asset:path': 'new-path',
@@ -672,26 +673,13 @@ describe.each([HotswapMode.FALL_BACK, HotswapMode.HOTSWAP_ONLY])('%p mode', (hot
       },
     });
 
-    const listExports = jest.fn().mockReturnValue({
-      Exports: [
-        {
-          ExportingStackId: 'test-exporting-stack-id',
-          Name: 'test-import',
-          Value: 'new-key',
-        },
-      ],
-    });
-    hotswapMockSdkProvider.mockSdkProvider.stubCloudFormation({
-      listExports,
-    });
-
     // WHEN
     const deployStackResult = await hotswapMockSdkProvider.tryHotswapDeployment(hotswapMode, cdkStackArtifact);
 
     // THEN
     expect(deployStackResult).not.toBeUndefined();
-    expect(mockUpdateLambdaCode).toHaveBeenCalledWith({
-      FunctionName: 'aws-my-function',
+    expect(mockLambdaClient).toHaveReceivedCommandWith(UpdateFunctionCodeCommand, {
+      FunctionName: 'swa-my-function',
       S3Bucket: 'current-bucket',
       S3Key: 'new-key',
     });
diff --git a/packages/aws-cdk/test/api/hotswap/hotswap-test-setup.ts b/packages/aws-cdk/test/api/hotswap/hotswap-test-setup.ts
index 505f128a0dee2..8716253b41284 100644
--- a/packages/aws-cdk/test/api/hotswap/hotswap-test-setup.ts
+++ b/packages/aws-cdk/test/api/hotswap/hotswap-test-setup.ts
@@ -1,14 +1,18 @@
 import * as cxapi from '@aws-cdk/cx-api';
-import * as AWS from 'aws-sdk';
-import * as codebuild from 'aws-sdk/clients/codebuild';
-import * as lambda from 'aws-sdk/clients/lambda';
-import * as stepfunctions from 'aws-sdk/clients/stepfunctions';
-import { DeployStackResult } from '../../../lib/api';
+import { ListStackResourcesCommand, StackResourceSummary, StackStatus } from '@aws-sdk/client-cloudformation';
+import { GetFunctionConfigurationCommand } from '@aws-sdk/client-lambda';
+import { DeployStackResult, ICloudFormationClient } from '../../../lib/api';
 import { HotswapMode } from '../../../lib/api/hotswap/common';
 import * as deployments from '../../../lib/api/hotswap-deployments';
 import { CloudFormationStack, Template } from '../../../lib/api/util/cloudformation';
 import { testStack, TestStackArtifact } from '../../util';
-import { MockSdkProvider, SyncHandlerSubsetOf } from '../../util/mock-sdk';
+import {
+  MockSdkProvider,
+  mockCloudFormationClient,
+  mockLambdaClient,
+  restoreSdkMocksToDefault,
+  setDefaultSTSMocks,
+} from '../../util/mock-sdk';
 import { FakeCloudformationStack } from '../fake-cloudformation-stack';
 
 const STACK_NAME = 'withouterrors';
@@ -16,11 +20,13 @@ export const STACK_ID = 'stackId';
 
 let hotswapMockSdkProvider: HotswapMockSdkProvider;
 let currentCfnStack: FakeCloudformationStack;
-const currentCfnStackResources: AWS.CloudFormation.StackResourceSummary[] = [];
+const currentCfnStackResources: StackResourceSummary[] = [];
 let stackTemplates: { [stackName: string]: any };
-let currentNestedCfnStackResources: { [stackName: string]: AWS.CloudFormation.StackResourceSummary[] };
+let currentNestedCfnStackResources: { [stackName: string]: StackResourceSummary[] };
 
 export function setupHotswapTests(): HotswapMockSdkProvider {
+  restoreSdkMocksToDefault();
+  setDefaultSTSMocks();
   jest.resetAllMocks();
   // clear the array
   currentCfnStackResources.splice(0);
@@ -29,7 +35,7 @@ export function setupHotswapTests(): HotswapMockSdkProvider {
     stackName: STACK_NAME,
     stackId: STACK_ID,
   });
-  CloudFormationStack.lookup = async (_: AWS.CloudFormation, _stackName: string) => {
+  CloudFormationStack.lookup = async (_: ICloudFormationClient, _stackName: string) => {
     return currentCfnStack;
   };
 
@@ -37,6 +43,8 @@ export function setupHotswapTests(): HotswapMockSdkProvider {
 }
 
 export function setupHotswapNestedStackTests(rootStackName: string) {
+  restoreSdkMocksToDefault();
+  setDefaultSTSMocks();
   jest.resetAllMocks();
   currentNestedCfnStackResources = {};
   hotswapMockSdkProvider = new HotswapMockSdkProvider(rootStackName);
@@ -45,7 +53,7 @@ export function setupHotswapNestedStackTests(rootStackName: string) {
     stackId: STACK_ID,
   });
   stackTemplates = {};
-  CloudFormationStack.lookup = async (_: AWS.CloudFormation, stackName: string) => {
+  CloudFormationStack.lookup = async (_: ICloudFormationClient, stackName: string) => {
     currentCfnStack.template = async () => stackTemplates[stackName];
     return currentCfnStack;
   };
@@ -53,18 +61,20 @@ export function setupHotswapNestedStackTests(rootStackName: string) {
   return hotswapMockSdkProvider;
 }
 
-export function cdkStackArtifactOf(testStackArtifact: Partial<TestStackArtifact> = {}): cxapi.CloudFormationStackArtifact {
+export function cdkStackArtifactOf(
+  testStackArtifact: Partial<TestStackArtifact> = {},
+): cxapi.CloudFormationStackArtifact {
   return testStack({
     stackName: STACK_NAME,
     ...testStackArtifact,
   });
 }
 
-export function pushStackResourceSummaries(...items: AWS.CloudFormation.StackResourceSummary[]) {
+export function pushStackResourceSummaries(...items: StackResourceSummary[]) {
   currentCfnStackResources.push(...items);
 }
 
-export function pushNestedStackResourceSummaries(stackName: string, ...items: AWS.CloudFormation.StackResourceSummary[]) {
+export function pushNestedStackResourceSummaries(stackName: string, ...items: StackResourceSummary[]) {
   if (!currentNestedCfnStackResources[stackName]) {
     currentNestedCfnStackResources[stackName] = [];
   }
@@ -81,105 +91,54 @@ export function addTemplateToCloudFormationLookupMock(stackArtifact: cxapi.Cloud
   stackTemplates[stackArtifact.stackName] = templateDeepCopy;
 }
 
-export function stackSummaryOf(logicalId: string, resourceType: string, physicalResourceId: string): AWS.CloudFormation.StackResourceSummary {
+export function stackSummaryOf(
+  logicalId: string,
+  resourceType: string,
+  physicalResourceId: string,
+): StackResourceSummary {
   return {
     LogicalResourceId: logicalId,
     PhysicalResourceId: physicalResourceId,
     ResourceType: resourceType,
-    ResourceStatus: 'CREATE_COMPLETE',
+    ResourceStatus: StackStatus.CREATE_COMPLETE,
     LastUpdatedTimestamp: new Date(),
   };
 }
 
-export class HotswapMockSdkProvider {
-  public readonly mockSdkProvider: MockSdkProvider;
-
+export class HotswapMockSdkProvider extends MockSdkProvider {
   constructor(rootStackName?: string) {
-    this.mockSdkProvider = new MockSdkProvider({ realSdk: false });
-
-    this.mockSdkProvider.stubCloudFormation({
-      listStackResources: ({ StackName: stackName }) => {
-        if (rootStackName) {
-          const knownStackNames = Object.keys(currentNestedCfnStackResources);
-          if (stackName !== rootStackName && !knownStackNames.includes(stackName)) {
-            throw new Error(`Expected Stack name in listStackResources() call to be a member of ['${rootStackName}, ${knownStackNames}'], but received: '${stackName}'`);
-          }
-        } else if (stackName !== STACK_NAME) {
-          throw new Error(`Expected Stack name in listStackResources() call to be: '${STACK_NAME}', but received: '${stackName}'`);
-        }
-        return {
-          StackResourceSummaries: rootStackName ? currentNestedCfnStackResources[stackName] : currentCfnStackResources,
-        };
-      },
-    });
-  }
-
-  public setUpdateStateMachineMock(
-    mockUpdateMachineDefinition: (input: stepfunctions.UpdateStateMachineInput) => stepfunctions.UpdateStateMachineOutput,
-  ) {
-    this.mockSdkProvider.stubStepFunctions({
-      updateStateMachine: mockUpdateMachineDefinition,
-    });
-  }
-
-  public stubLambda(
-    stubs: SyncHandlerSubsetOf<AWS.Lambda>,
-    serviceStubs?: SyncHandlerSubsetOf<AWS.Service>,
-    additionalProperties: { [key: string]: any } = {},
-  ): void {
-    this.mockSdkProvider.stubLambda(stubs, {
-      api: {
-        waiters: {},
-      },
-      makeRequest() {
-        return {
-          promise: () => Promise.resolve({}),
-          response: {},
-          addListeners: () => {},
-        };
-      },
-      ...serviceStubs,
-      ...additionalProperties,
-    });
-  }
-
-  public getLambdaApiWaiters(): { [key: string]: any } {
-    return (this.mockSdkProvider.sdk.lambda() as any).api.waiters;
-  }
+    super();
 
-  public setUpdateProjectMock(mockUpdateProject: (input: codebuild.UpdateProjectInput) => codebuild.UpdateProjectOutput) {
-    this.mockSdkProvider.stubCodeBuild({
-      updateProject: mockUpdateProject,
+    mockLambdaClient.on(GetFunctionConfigurationCommand).resolves({
+      LastUpdateStatus: 'Successful',
     });
-  }
-
-  public stubAppSync(stubs: SyncHandlerSubsetOf<AWS.AppSync>) {
-    this.mockSdkProvider.stubAppSync(stubs);
-  }
 
-  public setInvokeLambdaMock(mockInvokeLambda: (input: lambda.InvocationRequest) => lambda.InvocationResponse) {
-    this.mockSdkProvider.stubLambda({
-      invoke: mockInvokeLambda,
+    mockCloudFormationClient.on(ListStackResourcesCommand).callsFake((input) => {
+      if (rootStackName) {
+        const knownStackNames = Object.keys(currentNestedCfnStackResources);
+        if (input.StackName !== rootStackName && !knownStackNames.includes(input.StackName)) {
+          throw new Error(
+            `Expected Stack name in listStackResources() call to be a member of ['${rootStackName}, ${knownStackNames}'], but received: '${input.StackName}'`,
+          );
+        }
+      } else if (input.StackName !== STACK_NAME) {
+        throw new Error(
+          `Expected Stack name in listStackResources() call to be: '${STACK_NAME}', but received: '${input.StackName}'`,
+        );
+      }
+      return {
+        StackResourceSummaries: rootStackName
+          ? currentNestedCfnStackResources[input.StackName]
+          : currentCfnStackResources,
+      };
     });
   }
 
-  public stubEcs(stubs: SyncHandlerSubsetOf<AWS.ECS>, additionalProperties: { [key: string]: any } = {}): void {
-    this.mockSdkProvider.stubEcs(stubs, additionalProperties);
-  }
-
-  public stubGetEndpointSuffix(stub: () => string) {
-    this.mockSdkProvider.stubGetEndpointSuffix(stub);
-  }
-
-  public stubS3(stubs: SyncHandlerSubsetOf<AWS.S3>) {
-    this.mockSdkProvider.stubS3(stubs);
-  }
-
   public tryHotswapDeployment(
     hotswapMode: HotswapMode,
     stackArtifact: cxapi.CloudFormationStackArtifact,
     assetParams: { [key: string]: string } = {},
   ): Promise<DeployStackResult | undefined> {
-    return deployments.tryHotswapDeployment(this.mockSdkProvider, assetParams, currentCfnStack, stackArtifact, hotswapMode);
+    return deployments.tryHotswapDeployment(this, assetParams, currentCfnStack, stackArtifact, hotswapMode);
   }
 }
diff --git a/packages/aws-cdk/test/api/hotswap/iam-policy-hotswap-deployment.test.ts b/packages/aws-cdk/test/api/hotswap/iam-policy-hotswap-deployment.test.ts
index 4847ff6718bc2..ee454ec403f84 100644
--- a/packages/aws-cdk/test/api/hotswap/iam-policy-hotswap-deployment.test.ts
+++ b/packages/aws-cdk/test/api/hotswap/iam-policy-hotswap-deployment.test.ts
@@ -1,4 +1,4 @@
-/* eslint-disable import/order */
+import { StackStatus } from '@aws-sdk/client-cloudformation';
 import * as setup from './hotswap-test-setup';
 import { HotswapMode } from '../../../lib/api/hotswap/common';
 import { silentTest } from '../../util/silent';
@@ -10,65 +10,11 @@ beforeEach(() => {
 });
 
 describe.each([HotswapMode.FALL_BACK, HotswapMode.HOTSWAP_ONLY])('%p mode', (hotswapMode) => {
-  silentTest('A change to an IAM Policy results in a full deployment for HOTSWAP and a noOp for HOTSWAP_ONLY', async () => {
-    // GIVEN
-    setup.setCurrentCfnStackTemplate({
-      Resources: {
-        RoleOne: {
-          Type: 'AWS::IAM::Role',
-          Properties: {
-            AssumeRolePolicyDocument: {
-              Statement: [
-                {
-                  Action: 'sts:AssumeRole',
-                  Effect: 'Allow',
-                  Principal: {
-                    Service: 'sqs.amazonaws.com',
-                  },
-                },
-              ],
-              Version: '2012-10-17',
-            },
-          },
-        },
-        RoleDefaultPolicy: {
-          Type: 'AWS::IAM::Policy',
-          Properties: {
-            PolicyDocument: {
-              Statement: [
-                {
-                  Action: [
-                    'sqs:ChangeMessageVisibility',
-                    'sqs:DeleteMessage',
-                    'sqs:GetQueueAttributes',
-                    'sqs:GetQueueUrl',
-                    'sqs:ReceiveMessage',
-                  ],
-                  Effect: 'Allow',
-                  Resource: '*',
-                },
-              ],
-              Version: '2012-10-17',
-            },
-            PolicyName: 'roleDefaultPolicy',
-            Roles: [
-              {
-                Ref: 'RoleOne',
-              },
-            ],
-          },
-        },
-      },
-    });
-    setup.pushStackResourceSummaries({
-      LogicalResourceId: 'RoleOne',
-      PhysicalResourceId: 'RoleOne',
-      ResourceType: 'AWS::IAM::Role',
-      ResourceStatus: 'CREATE_COMPLETE',
-      LastUpdatedTimestamp: new Date(),
-    });
-    const cdkStackArtifact = setup.cdkStackArtifactOf({
-      template: {
+  silentTest(
+    'A change to an IAM Policy results in a full deployment for HOTSWAP and a noOp for HOTSWAP_ONLY',
+    async () => {
+      // GIVEN
+      setup.setCurrentCfnStackTemplate({
         Resources: {
           RoleOne: {
             Type: 'AWS::IAM::Role',
@@ -94,7 +40,11 @@ describe.each([HotswapMode.FALL_BACK, HotswapMode.HOTSWAP_ONLY])('%p mode', (hot
                 Statement: [
                   {
                     Action: [
+                      'sqs:ChangeMessageVisibility',
                       'sqs:DeleteMessage',
+                      'sqs:GetQueueAttributes',
+                      'sqs:GetQueueUrl',
+                      'sqs:ReceiveMessage',
                     ],
                     Effect: 'Allow',
                     Resource: '*',
@@ -111,22 +61,73 @@ describe.each([HotswapMode.FALL_BACK, HotswapMode.HOTSWAP_ONLY])('%p mode', (hot
             },
           },
         },
-      },
-    });
+      });
+      setup.pushStackResourceSummaries({
+        LogicalResourceId: 'RoleOne',
+        PhysicalResourceId: 'RoleOne',
+        ResourceType: 'AWS::IAM::Role',
+        ResourceStatus: StackStatus.CREATE_COMPLETE,
+        LastUpdatedTimestamp: new Date(),
+      });
+      const cdkStackArtifact = setup.cdkStackArtifactOf({
+        template: {
+          Resources: {
+            RoleOne: {
+              Type: 'AWS::IAM::Role',
+              Properties: {
+                AssumeRolePolicyDocument: {
+                  Statement: [
+                    {
+                      Action: 'sts:AssumeRole',
+                      Effect: 'Allow',
+                      Principal: {
+                        Service: 'sqs.amazonaws.com',
+                      },
+                    },
+                  ],
+                  Version: '2012-10-17',
+                },
+              },
+            },
+            RoleDefaultPolicy: {
+              Type: 'AWS::IAM::Policy',
+              Properties: {
+                PolicyDocument: {
+                  Statement: [
+                    {
+                      Action: ['sqs:DeleteMessage'],
+                      Effect: 'Allow',
+                      Resource: '*',
+                    },
+                  ],
+                  Version: '2012-10-17',
+                },
+                PolicyName: 'roleDefaultPolicy',
+                Roles: [
+                  {
+                    Ref: 'RoleOne',
+                  },
+                ],
+              },
+            },
+          },
+        },
+      });
 
-    if (hotswapMode === HotswapMode.FALL_BACK) {
-      // WHEN
-      const deployStackResult = await hotswapMockSdkProvider.tryHotswapDeployment(hotswapMode, cdkStackArtifact);
+      if (hotswapMode === HotswapMode.FALL_BACK) {
+        // WHEN
+        const deployStackResult = await hotswapMockSdkProvider.tryHotswapDeployment(hotswapMode, cdkStackArtifact);
 
-      // THEN
-      expect(deployStackResult).toBeUndefined();
-    } else if (hotswapMode === HotswapMode.HOTSWAP_ONLY) {
-      // WHEN
-      const deployStackResult = await hotswapMockSdkProvider.tryHotswapDeployment(hotswapMode, cdkStackArtifact);
+        // THEN
+        expect(deployStackResult).toBeUndefined();
+      } else if (hotswapMode === HotswapMode.HOTSWAP_ONLY) {
+        // WHEN
+        const deployStackResult = await hotswapMockSdkProvider.tryHotswapDeployment(hotswapMode, cdkStackArtifact);
 
-      // THEN
-      expect(deployStackResult).not.toBeUndefined();
-      expect(deployStackResult?.noOp).toEqual(true);
-    }
-  });
+        // THEN
+        expect(deployStackResult).not.toBeUndefined();
+        expect(deployStackResult?.noOp).toEqual(true);
+      }
+    },
+  );
 });
diff --git a/packages/aws-cdk/test/api/hotswap/lambda-functions-docker-hotswap-deployments.test.ts b/packages/aws-cdk/test/api/hotswap/lambda-functions-docker-hotswap-deployments.test.ts
index adabd260cd1ff..bf42795ae497f 100644
--- a/packages/aws-cdk/test/api/hotswap/lambda-functions-docker-hotswap-deployments.test.ts
+++ b/packages/aws-cdk/test/api/hotswap/lambda-functions-docker-hotswap-deployments.test.ts
@@ -1,85 +1,81 @@
-import { Lambda } from 'aws-sdk';
+import { UpdateFunctionCodeCommand, waitUntilFunctionUpdated } from '@aws-sdk/client-lambda';
 import * as setup from './hotswap-test-setup';
 import { HotswapMode } from '../../../lib/api/hotswap/common';
+import { mockLambdaClient } from '../../util/mock-sdk';
 import { silentTest } from '../../util/silent';
 
-let mockUpdateLambdaCode: (params: Lambda.Types.UpdateFunctionCodeRequest) => Lambda.Types.FunctionConfiguration;
-let mockTagResource: (params: Lambda.Types.TagResourceRequest) => {};
-let mockUntagResource: (params: Lambda.Types.UntagResourceRequest) => {};
+jest.mock('@aws-sdk/client-lambda', () => {
+  const original = jest.requireActual('@aws-sdk/client-lambda');
+
+  return {
+    ...original,
+    waitUntilFunctionUpdated: jest.fn(),
+  };
+});
+
 let hotswapMockSdkProvider: setup.HotswapMockSdkProvider;
-let mockMakeRequest: (operation: string, params: any) => AWS.Request<any, AWS.AWSError>;
 
 beforeEach(() => {
+  jest.restoreAllMocks();
   hotswapMockSdkProvider = setup.setupHotswapTests();
-  mockUpdateLambdaCode = jest.fn().mockReturnValue({
+  mockLambdaClient.on(UpdateFunctionCodeCommand).resolves({
     PackageType: 'Image',
   });
-  mockTagResource = jest.fn();
-  mockUntagResource = jest.fn();
-  mockMakeRequest = jest.fn().mockReturnValue({
-    promise: () => Promise.resolve({}),
-    response: {},
-    addListeners: () => {},
-  });
-  hotswapMockSdkProvider.stubLambda({
-    updateFunctionCode: mockUpdateLambdaCode,
-    tagResource: mockTagResource,
-    untagResource: mockUntagResource,
-  }, {
-    makeRequest: mockMakeRequest,
-  });
 });
 
 describe.each([HotswapMode.FALL_BACK, HotswapMode.HOTSWAP_ONLY])('%p mode', (hotswapMode) => {
-  silentTest('calls the updateLambdaCode() API when it receives only a code difference in a Lambda function', async () => {
-    // GIVEN
-    setup.setCurrentCfnStackTemplate({
-      Resources: {
-        Func: {
-          Type: 'AWS::Lambda::Function',
-          Properties: {
-            Code: {
-              ImageUri: 'current-image',
-            },
-            FunctionName: 'my-function',
-          },
-          Metadata: {
-            'aws:asset:path': 'old-path',
-          },
-        },
-      },
-    });
-    const cdkStackArtifact = setup.cdkStackArtifactOf({
-      template: {
+  silentTest(
+    'calls the updateLambdaCode() API when it receives only a code difference in a Lambda function',
+    async () => {
+      // GIVEN
+      setup.setCurrentCfnStackTemplate({
         Resources: {
           Func: {
             Type: 'AWS::Lambda::Function',
             Properties: {
               Code: {
-                ImageUri: 'new-image',
+                ImageUri: 'current-image',
               },
               FunctionName: 'my-function',
             },
             Metadata: {
-              'aws:asset:path': 'new-path',
+              'aws:asset:path': 'old-path',
             },
           },
         },
-      },
-    });
+      });
+      const cdkStackArtifact = setup.cdkStackArtifactOf({
+        template: {
+          Resources: {
+            Func: {
+              Type: 'AWS::Lambda::Function',
+              Properties: {
+                Code: {
+                  ImageUri: 'new-image',
+                },
+                FunctionName: 'my-function',
+              },
+              Metadata: {
+                'aws:asset:path': 'new-path',
+              },
+            },
+          },
+        },
+      });
 
-    // WHEN
-    const deployStackResult = await hotswapMockSdkProvider.tryHotswapDeployment(hotswapMode, cdkStackArtifact);
+      // WHEN
+      const deployStackResult = await hotswapMockSdkProvider.tryHotswapDeployment(hotswapMode, cdkStackArtifact);
 
-    // THEN
-    expect(deployStackResult).not.toBeUndefined();
-    expect(mockUpdateLambdaCode).toHaveBeenCalledWith({
-      FunctionName: 'my-function',
-      ImageUri: 'new-image',
-    });
-  });
+      // THEN
+      expect(deployStackResult).not.toBeUndefined();
+      expect(mockLambdaClient).toHaveReceivedCommandWith(UpdateFunctionCodeCommand, {
+        FunctionName: 'my-function',
+        ImageUri: 'new-image',
+      });
+    },
+  );
 
-  silentTest('calls the getFunction() API with a delay of 5', async () => {
+  silentTest('calls the waiter with a delay of 5', async () => {
     // GIVEN
     setup.setCurrentCfnStackTemplate({
       Resources: {
@@ -120,12 +116,13 @@ describe.each([HotswapMode.FALL_BACK, HotswapMode.HOTSWAP_ONLY])('%p mode', (hot
     await hotswapMockSdkProvider.tryHotswapDeployment(hotswapMode, cdkStackArtifact);
 
     // THEN
-    expect(mockMakeRequest).toHaveBeenCalledWith('getFunction', { FunctionName: 'my-function' });
-    expect(hotswapMockSdkProvider.getLambdaApiWaiters()).toEqual(expect.objectContaining({
-      updateFunctionPropertiesToFinish: expect.objectContaining({
-        name: 'UpdateFunctionPropertiesToFinish',
-        delay: 5,
+    expect(waitUntilFunctionUpdated).toHaveBeenCalledWith(
+      expect.objectContaining({
+        minDelay: 5,
+        maxDelay: 5,
+        maxWaitTime: 5 * 60,
       }),
-    }));
+      { FunctionName: 'my-function' },
+    );
   });
 });
diff --git a/packages/aws-cdk/test/api/hotswap/lambda-functions-hotswap-deployments.test.ts b/packages/aws-cdk/test/api/hotswap/lambda-functions-hotswap-deployments.test.ts
index 85c3601f73e68..a180e89d8d741 100644
--- a/packages/aws-cdk/test/api/hotswap/lambda-functions-hotswap-deployments.test.ts
+++ b/packages/aws-cdk/test/api/hotswap/lambda-functions-hotswap-deployments.test.ts
@@ -1,30 +1,26 @@
-import { Lambda } from 'aws-sdk';
+import {
+  UpdateFunctionCodeCommand,
+  UpdateFunctionConfigurationCommand,
+  waitUntilFunctionUpdated,
+} from '@aws-sdk/client-lambda';
 import * as setup from './hotswap-test-setup';
 import { HotswapMode } from '../../../lib/api/hotswap/common';
+import { mockLambdaClient } from '../../util/mock-sdk';
 import { silentTest } from '../../util/silent';
 
-let mockUpdateLambdaCode: (params: Lambda.Types.UpdateFunctionCodeRequest) => Lambda.Types.FunctionConfiguration;
-let mockUpdateLambdaConfiguration: (
-  params: Lambda.Types.UpdateFunctionConfigurationRequest
-) => Lambda.Types.FunctionConfiguration;
-let mockMakeRequest: (operation: string, params: any) => AWS.Request<any, AWS.AWSError>;
+jest.mock('@aws-sdk/client-lambda', () => {
+  const original = jest.requireActual('@aws-sdk/client-lambda');
+
+  return {
+    ...original,
+    waitUntilFunctionUpdated: jest.fn(),
+  };
+});
+
 let hotswapMockSdkProvider: setup.HotswapMockSdkProvider;
 
 beforeEach(() => {
   hotswapMockSdkProvider = setup.setupHotswapTests();
-  mockUpdateLambdaCode = jest.fn().mockReturnValue({});
-  mockUpdateLambdaConfiguration = jest.fn().mockReturnValue({});
-  mockMakeRequest = jest.fn().mockReturnValue({
-    promise: () => Promise.resolve({}),
-    response: {},
-    addListeners: () => {},
-  });
-  hotswapMockSdkProvider.stubLambda({
-    updateFunctionCode: mockUpdateLambdaCode,
-    updateFunctionConfiguration: mockUpdateLambdaConfiguration,
-  }, {
-    makeRequest: mockMakeRequest,
-  });
 });
 
 describe.each([HotswapMode.FALL_BACK, HotswapMode.HOTSWAP_ONLY])('%p mode', (hotswapMode) => {
@@ -53,92 +49,69 @@ describe.each([HotswapMode.FALL_BACK, HotswapMode.HOTSWAP_ONLY])('%p mode', (hot
       // THEN
       expect(deployStackResult).not.toBeUndefined();
       expect(deployStackResult?.noOp).toEqual(true);
-      expect(mockUpdateLambdaCode).not.toHaveBeenCalled();
+      expect(mockLambdaClient).not.toHaveReceivedCommand(UpdateFunctionCodeCommand);
     }
   });
 
-  silentTest('calls the updateLambdaCode() API when it receives only a code difference in a Lambda function', async () => {
-    // GIVEN
-    setup.setCurrentCfnStackTemplate({
-      Resources: {
-        Func: {
-          Type: 'AWS::Lambda::Function',
-          Properties: {
-            Code: {
-              S3Bucket: 'current-bucket',
-              S3Key: 'current-key',
-            },
-            FunctionName: 'my-function',
-          },
-          Metadata: {
-            'aws:asset:path': 'old-path',
-          },
-        },
-      },
-    });
-    const cdkStackArtifact = setup.cdkStackArtifactOf({
-      template: {
+  silentTest(
+    'calls the updateLambdaCode() API when it receives only a code difference in a Lambda function',
+    async () => {
+      // GIVEN
+      setup.setCurrentCfnStackTemplate({
         Resources: {
           Func: {
             Type: 'AWS::Lambda::Function',
             Properties: {
               Code: {
                 S3Bucket: 'current-bucket',
-                S3Key: 'new-key',
+                S3Key: 'current-key',
               },
               FunctionName: 'my-function',
             },
             Metadata: {
-              'aws:asset:path': 'new-path',
+              'aws:asset:path': 'old-path',
             },
           },
         },
-      },
-    });
-
-    // WHEN
-    const deployStackResult = await hotswapMockSdkProvider.tryHotswapDeployment(hotswapMode, cdkStackArtifact);
-
-    // THEN
-    expect(deployStackResult).not.toBeUndefined();
-    expect(mockUpdateLambdaCode).toHaveBeenCalledWith({
-      FunctionName: 'my-function',
-      S3Bucket: 'current-bucket',
-      S3Key: 'new-key',
-    });
-  });
-
-  silentTest("correctly evaluates the function's name when it references a different resource from the template", async () => {
-    // GIVEN
-    setup.setCurrentCfnStackTemplate({
-      Resources: {
-        Bucket: {
-          Type: 'AWS::S3::Bucket',
-        },
-        Func: {
-          Type: 'AWS::Lambda::Function',
-          Properties: {
-            Code: {
-              S3Bucket: 'current-bucket',
-              S3Key: 'current-key',
-            },
-            FunctionName: {
-              'Fn::Join': ['-', [
-                'lambda',
-                { Ref: 'Bucket' },
-                'function',
-              ]],
+      });
+      const cdkStackArtifact = setup.cdkStackArtifactOf({
+        template: {
+          Resources: {
+            Func: {
+              Type: 'AWS::Lambda::Function',
+              Properties: {
+                Code: {
+                  S3Bucket: 'current-bucket',
+                  S3Key: 'new-key',
+                },
+                FunctionName: 'my-function',
+              },
+              Metadata: {
+                'aws:asset:path': 'new-path',
+              },
             },
           },
-          Metadata: {
-            'aws:asset:path': 'old-path',
-          },
         },
-      },
-    });
-    setup.pushStackResourceSummaries(setup.stackSummaryOf('Bucket', 'AWS::S3::Bucket', 'mybucket'));
-    const cdkStackArtifact = setup.cdkStackArtifactOf({
-      template: {
+      });
+
+      // WHEN
+      const deployStackResult = await hotswapMockSdkProvider.tryHotswapDeployment(hotswapMode, cdkStackArtifact);
+
+      // THEN
+      expect(deployStackResult).not.toBeUndefined();
+      expect(mockLambdaClient).toHaveReceivedCommandWith(UpdateFunctionCodeCommand, {
+        FunctionName: 'my-function',
+        S3Bucket: 'current-bucket',
+        S3Key: 'new-key',
+      });
+    },
+  );
+
+  silentTest(
+    "correctly evaluates the function's name when it references a different resource from the template",
+    async () => {
+      // GIVEN
+      setup.setCurrentCfnStackTemplate({
         Resources: {
           Bucket: {
             Type: 'AWS::S3::Bucket',
@@ -148,14 +121,10 @@ describe.each([HotswapMode.FALL_BACK, HotswapMode.HOTSWAP_ONLY])('%p mode', (hot
             Properties: {
               Code: {
                 S3Bucket: 'current-bucket',
-                S3Key: 'new-key',
+                S3Key: 'current-key',
               },
               FunctionName: {
-                'Fn::Join': ['-', [
-                  'lambda',
-                  { Ref: 'Bucket' },
-                  'function',
-                ]],
+                'Fn::Join': ['-', ['lambda', { Ref: 'Bucket' }, 'function']],
               },
             },
             Metadata: {
@@ -163,47 +132,51 @@ describe.each([HotswapMode.FALL_BACK, HotswapMode.HOTSWAP_ONLY])('%p mode', (hot
             },
           },
         },
-      },
-    });
-
-    // WHEN
-    const deployStackResult = await hotswapMockSdkProvider.tryHotswapDeployment(hotswapMode, cdkStackArtifact);
-
-    // THEN
-    expect(deployStackResult).not.toBeUndefined();
-    expect(mockUpdateLambdaCode).toHaveBeenCalledWith({
-      FunctionName: 'lambda-mybucket-function',
-      S3Bucket: 'current-bucket',
-      S3Key: 'new-key',
-    });
-  });
-
-  silentTest("correctly falls back to taking the function's name from the current stack if it can't evaluate it in the template", async () => {
-    // GIVEN
-    setup.setCurrentCfnStackTemplate({
-      Parameters: {
-        Param1: { Type: 'String' },
-        AssetBucketParam: { Type: 'String' },
-      },
-      Resources: {
-        Func: {
-          Type: 'AWS::Lambda::Function',
-          Properties: {
-            Code: {
-              S3Bucket: { Ref: 'AssetBucketParam' },
-              S3Key: 'current-key',
+      });
+      setup.pushStackResourceSummaries(setup.stackSummaryOf('Bucket', 'AWS::S3::Bucket', 'mybucket'));
+      const cdkStackArtifact = setup.cdkStackArtifactOf({
+        template: {
+          Resources: {
+            Bucket: {
+              Type: 'AWS::S3::Bucket',
+            },
+            Func: {
+              Type: 'AWS::Lambda::Function',
+              Properties: {
+                Code: {
+                  S3Bucket: 'current-bucket',
+                  S3Key: 'new-key',
+                },
+                FunctionName: {
+                  'Fn::Join': ['-', ['lambda', { Ref: 'Bucket' }, 'function']],
+                },
+              },
+              Metadata: {
+                'aws:asset:path': 'old-path',
+              },
             },
-            FunctionName: { Ref: 'Param1' },
-          },
-          Metadata: {
-            'aws:asset:path': 'old-path',
           },
         },
-      },
-    });
-    setup.pushStackResourceSummaries(setup.stackSummaryOf('Func', 'AWS::Lambda::Function', 'my-function'));
-    const cdkStackArtifact = setup.cdkStackArtifactOf({
-      template: {
+      });
+
+      // WHEN
+      const deployStackResult = await hotswapMockSdkProvider.tryHotswapDeployment(hotswapMode, cdkStackArtifact);
+
+      // THEN
+      expect(deployStackResult).not.toBeUndefined();
+      expect(mockLambdaClient).toHaveReceivedCommandWith(UpdateFunctionCodeCommand, {
+        FunctionName: 'lambda-mybucket-function',
+        S3Bucket: 'current-bucket',
+        S3Key: 'new-key',
+      });
+    },
+  );
+
+  silentTest(
+    "correctly falls back to taking the function's name from the current stack if it can't evaluate it in the template",
+    async () => {
+      // GIVEN
+      setup.setCurrentCfnStackTemplate({
         Parameters: {
           Param1: { Type: 'String' },
           AssetBucketParam: { Type: 'String' },
@@ -214,54 +187,61 @@ describe.each([HotswapMode.FALL_BACK, HotswapMode.HOTSWAP_ONLY])('%p mode', (hot
             Properties: {
               Code: {
                 S3Bucket: { Ref: 'AssetBucketParam' },
-                S3Key: 'new-key',
+                S3Key: 'current-key',
               },
               FunctionName: { Ref: 'Param1' },
             },
             Metadata: {
-              'aws:asset:path': 'new-path',
+              'aws:asset:path': 'old-path',
             },
           },
         },
-      },
-    });
-
-    // WHEN
-    const deployStackResult = await hotswapMockSdkProvider.tryHotswapDeployment(hotswapMode, cdkStackArtifact, { AssetBucketParam: 'asset-bucket' });
-
-    // THEN
-    expect(deployStackResult).not.toBeUndefined();
-    expect(mockUpdateLambdaCode).toHaveBeenCalledWith({
-      FunctionName: 'my-function',
-      S3Bucket: 'asset-bucket',
-      S3Key: 'new-key',
-    });
-  });
-
-  silentTest("will not perform a hotswap deployment if it cannot find a Ref target (outside the function's name)", async () => {
-    // GIVEN
-    setup.setCurrentCfnStackTemplate({
-      Parameters: {
-        Param1: { Type: 'String' },
-      },
-      Resources: {
-        Func: {
-          Type: 'AWS::Lambda::Function',
-          Properties: {
-            Code: {
-              S3Bucket: { 'Fn::Sub': '${Param1}' },
-              S3Key: 'current-key',
-            },
+      });
+      setup.pushStackResourceSummaries(setup.stackSummaryOf('Func', 'AWS::Lambda::Function', 'my-function'));
+      const cdkStackArtifact = setup.cdkStackArtifactOf({
+        template: {
+          Parameters: {
+            Param1: { Type: 'String' },
+            AssetBucketParam: { Type: 'String' },
           },
-          Metadata: {
-            'aws:asset:path': 'old-path',
+          Resources: {
+            Func: {
+              Type: 'AWS::Lambda::Function',
+              Properties: {
+                Code: {
+                  S3Bucket: { Ref: 'AssetBucketParam' },
+                  S3Key: 'new-key',
+                },
+                FunctionName: { Ref: 'Param1' },
+              },
+              Metadata: {
+                'aws:asset:path': 'new-path',
+              },
+            },
           },
         },
-      },
-    });
-    setup.pushStackResourceSummaries(setup.stackSummaryOf('Func', 'AWS::Lambda::Function', 'my-func'));
-    const cdkStackArtifact = setup.cdkStackArtifactOf({
-      template: {
+      });
+
+      // WHEN
+      const deployStackResult = await hotswapMockSdkProvider.tryHotswapDeployment(hotswapMode, cdkStackArtifact, {
+        AssetBucketParam: 'asset-bucket',
+      });
+
+      // THEN
+      expect(deployStackResult).not.toBeUndefined();
+      expect(mockLambdaClient).toHaveReceivedCommandWith(UpdateFunctionCodeCommand, {
+        FunctionName: 'my-function',
+        S3Bucket: 'asset-bucket',
+        S3Key: 'new-key',
+      });
+    },
+  );
+
+  silentTest(
+    "will not perform a hotswap deployment if it cannot find a Ref target (outside the function's name)",
+    async () => {
+      // GIVEN
+      setup.setCurrentCfnStackTemplate({
         Parameters: {
           Param1: { Type: 'String' },
         },
@@ -271,50 +251,50 @@ describe.each([HotswapMode.FALL_BACK, HotswapMode.HOTSWAP_ONLY])('%p mode', (hot
             Properties: {
               Code: {
                 S3Bucket: { 'Fn::Sub': '${Param1}' },
-                S3Key: 'new-key',
+                S3Key: 'current-key',
               },
             },
             Metadata: {
-              'aws:asset:path': 'new-path',
+              'aws:asset:path': 'old-path',
             },
           },
         },
-      },
-    });
-
-    // THEN
-    await expect(() =>
-      hotswapMockSdkProvider.tryHotswapDeployment(hotswapMode, cdkStackArtifact),
-    ).rejects.toThrow(/Parameter or resource 'Param1' could not be found for evaluation/);
-  });
-
-  silentTest("will not perform a hotswap deployment if it doesn't know how to handle a specific attribute (outside the function's name)", async () => {
-    // GIVEN
-    setup.setCurrentCfnStackTemplate({
-      Resources: {
-        Bucket: {
-          Type: 'AWS::S3::Bucket',
-        },
-        Func: {
-          Type: 'AWS::Lambda::Function',
-          Properties: {
-            Code: {
-              S3Bucket: { 'Fn::GetAtt': ['Bucket', 'UnknownAttribute'] },
-              S3Key: 'current-key',
-            },
+      });
+      setup.pushStackResourceSummaries(setup.stackSummaryOf('Func', 'AWS::Lambda::Function', 'my-func'));
+      const cdkStackArtifact = setup.cdkStackArtifactOf({
+        template: {
+          Parameters: {
+            Param1: { Type: 'String' },
           },
-          Metadata: {
-            'aws:asset:path': 'old-path',
+          Resources: {
+            Func: {
+              Type: 'AWS::Lambda::Function',
+              Properties: {
+                Code: {
+                  S3Bucket: { 'Fn::Sub': '${Param1}' },
+                  S3Key: 'new-key',
+                },
+              },
+              Metadata: {
+                'aws:asset:path': 'new-path',
+              },
+            },
           },
         },
-      },
-    });
-    setup.pushStackResourceSummaries(
-      setup.stackSummaryOf('Func', 'AWS::Lambda::Function', 'my-func'),
-      setup.stackSummaryOf('Bucket', 'AWS::S3::Bucket', 'my-bucket'),
-    );
-    const cdkStackArtifact = setup.cdkStackArtifactOf({
-      template: {
+      });
+
+      // THEN
+      await expect(() => hotswapMockSdkProvider.tryHotswapDeployment(hotswapMode, cdkStackArtifact)).rejects.toThrow(
+        /Parameter or resource 'Param1' could not be found for evaluation/,
+      );
+    },
+  );
+
+  silentTest(
+    "will not perform a hotswap deployment if it doesn't know how to handle a specific attribute (outside the function's name)",
+    async () => {
+      // GIVEN
+      setup.setCurrentCfnStackTemplate({
         Resources: {
           Bucket: {
             Type: 'AWS::S3::Bucket',
@@ -324,50 +304,60 @@ describe.each([HotswapMode.FALL_BACK, HotswapMode.HOTSWAP_ONLY])('%p mode', (hot
             Properties: {
               Code: {
                 S3Bucket: { 'Fn::GetAtt': ['Bucket', 'UnknownAttribute'] },
-                S3Key: 'new-key',
+                S3Key: 'current-key',
               },
             },
             Metadata: {
-              'aws:asset:path': 'new-path',
+              'aws:asset:path': 'old-path',
             },
           },
         },
-      },
-    });
-
-    // THEN
-    await expect(() =>
-      hotswapMockSdkProvider.tryHotswapDeployment(hotswapMode, cdkStackArtifact),
-    ).rejects.toThrow("We don't support the 'UnknownAttribute' attribute of the 'AWS::S3::Bucket' resource. This is a CDK limitation. Please report it at https://github.com/aws/aws-cdk/issues/new/choose");
-  });
-
-  silentTest('calls the updateLambdaCode() API when it receives a code difference in a Lambda function with no name', async () => {
-    // GIVEN
-    setup.setCurrentCfnStackTemplate({
-      Resources: {
-        Func: {
-          Type: 'AWS::Lambda::Function',
-          Properties: {
-            Code: {
-              S3Bucket: 'current-bucket',
-              S3Key: 'current-key',
+      });
+      setup.pushStackResourceSummaries(
+        setup.stackSummaryOf('Func', 'AWS::Lambda::Function', 'my-func'),
+        setup.stackSummaryOf('Bucket', 'AWS::S3::Bucket', 'my-bucket'),
+      );
+      const cdkStackArtifact = setup.cdkStackArtifactOf({
+        template: {
+          Resources: {
+            Bucket: {
+              Type: 'AWS::S3::Bucket',
+            },
+            Func: {
+              Type: 'AWS::Lambda::Function',
+              Properties: {
+                Code: {
+                  S3Bucket: { 'Fn::GetAtt': ['Bucket', 'UnknownAttribute'] },
+                  S3Key: 'new-key',
+                },
+              },
+              Metadata: {
+                'aws:asset:path': 'new-path',
+              },
             },
-          },
-          Metadata: {
-            'aws:asset:path': 'current-path',
           },
         },
-      },
-    });
-    const cdkStackArtifact = setup.cdkStackArtifactOf({
-      template: {
+      });
+
+      // THEN
+      await expect(() => hotswapMockSdkProvider.tryHotswapDeployment(hotswapMode, cdkStackArtifact)).rejects.toThrow(
+        "We don't support the 'UnknownAttribute' attribute of the 'AWS::S3::Bucket' resource. This is a CDK limitation. Please report it at https://github.com/aws/aws-cdk/issues/new/choose",
+      );
+    },
+  );
+
+  silentTest(
+    'calls the updateLambdaCode() API when it receives a code difference in a Lambda function with no name',
+    async () => {
+      // GIVEN
+      setup.setCurrentCfnStackTemplate({
         Resources: {
           Func: {
             Type: 'AWS::Lambda::Function',
             Properties: {
               Code: {
                 S3Bucket: 'current-bucket',
-                S3Key: 'new-key',
+                S3Key: 'current-key',
               },
             },
             Metadata: {
@@ -375,40 +365,47 @@ describe.each([HotswapMode.FALL_BACK, HotswapMode.HOTSWAP_ONLY])('%p mode', (hot
             },
           },
         },
-      },
-    });
-
-    // WHEN
-    setup.pushStackResourceSummaries(setup.stackSummaryOf('Func', 'AWS::Lambda::Function', 'mock-function-resource-id'));
-    const deployStackResult = await hotswapMockSdkProvider.tryHotswapDeployment(hotswapMode, cdkStackArtifact);
-
-    // THEN
-    expect(deployStackResult).not.toBeUndefined();
-    expect(mockUpdateLambdaCode).toHaveBeenCalledWith({
-      FunctionName: 'mock-function-resource-id',
-      S3Bucket: 'current-bucket',
-      S3Key: 'new-key',
-    });
-  });
-
-  silentTest('does not call the updateLambdaCode() API when it receives a change that is not a code difference in a Lambda function', async () => {
-    // GIVEN
-    setup.setCurrentCfnStackTemplate({
-      Resources: {
-        Func: {
-          Type: 'AWS::Lambda::Function',
-          Properties: {
-            Code: {
-              S3Bucket: 'current-bucket',
-              S3Key: 'current-key',
+      });
+      const cdkStackArtifact = setup.cdkStackArtifactOf({
+        template: {
+          Resources: {
+            Func: {
+              Type: 'AWS::Lambda::Function',
+              Properties: {
+                Code: {
+                  S3Bucket: 'current-bucket',
+                  S3Key: 'new-key',
+                },
+              },
+              Metadata: {
+                'aws:asset:path': 'current-path',
+              },
             },
-            PackageType: 'Zip',
           },
         },
-      },
-    });
-    const cdkStackArtifact = setup.cdkStackArtifactOf({
-      template: {
+      });
+
+      // WHEN
+      setup.pushStackResourceSummaries(
+        setup.stackSummaryOf('Func', 'AWS::Lambda::Function', 'mock-function-resource-id'),
+      );
+      const deployStackResult = await hotswapMockSdkProvider.tryHotswapDeployment(hotswapMode, cdkStackArtifact);
+
+      // THEN
+      expect(deployStackResult).not.toBeUndefined();
+      expect(mockLambdaClient).toHaveReceivedCommandWith(UpdateFunctionCodeCommand, {
+        FunctionName: 'mock-function-resource-id',
+        S3Bucket: 'current-bucket',
+        S3Key: 'new-key',
+      });
+    },
+  );
+
+  silentTest(
+    'does not call the updateLambdaCode() API when it receives a change that is not a code difference in a Lambda function',
+    async () => {
+      // GIVEN
+      setup.setCurrentCfnStackTemplate({
         Resources: {
           Func: {
             Type: 'AWS::Lambda::Function',
@@ -417,116 +414,119 @@ describe.each([HotswapMode.FALL_BACK, HotswapMode.HOTSWAP_ONLY])('%p mode', (hot
                 S3Bucket: 'current-bucket',
                 S3Key: 'current-key',
               },
-              PackageType: 'Image',
+              PackageType: 'Zip',
             },
           },
         },
-      },
-    });
+      });
+      const cdkStackArtifact = setup.cdkStackArtifactOf({
+        template: {
+          Resources: {
+            Func: {
+              Type: 'AWS::Lambda::Function',
+              Properties: {
+                Code: {
+                  S3Bucket: 'current-bucket',
+                  S3Key: 'current-key',
+                },
+                PackageType: 'Image',
+              },
+            },
+          },
+        },
+      });
 
-    if (hotswapMode === HotswapMode.FALL_BACK) {
-      // WHEN
-      const deployStackResult = await hotswapMockSdkProvider.tryHotswapDeployment(hotswapMode, cdkStackArtifact);
+      if (hotswapMode === HotswapMode.FALL_BACK) {
+        // WHEN
+        const deployStackResult = await hotswapMockSdkProvider.tryHotswapDeployment(hotswapMode, cdkStackArtifact);
 
-      // THEN
-      expect(deployStackResult).toBeUndefined();
-      expect(mockUpdateLambdaCode).not.toHaveBeenCalled();
-    } else if (hotswapMode === HotswapMode.HOTSWAP_ONLY) {
-      // WHEN
-      const deployStackResult = await hotswapMockSdkProvider.tryHotswapDeployment(hotswapMode, cdkStackArtifact);
+        // THEN
+        expect(deployStackResult).toBeUndefined();
+        expect(mockLambdaClient).not.toHaveReceivedCommand(UpdateFunctionCodeCommand);
+      } else if (hotswapMode === HotswapMode.HOTSWAP_ONLY) {
+        // WHEN
+        const deployStackResult = await hotswapMockSdkProvider.tryHotswapDeployment(hotswapMode, cdkStackArtifact);
 
-      // THEN
-      expect(deployStackResult).not.toBeUndefined();
-      expect(deployStackResult?.noOp).toEqual(true);
-      expect(mockUpdateLambdaCode).not.toHaveBeenCalled();
-    }
-  });
+        // THEN
+        expect(deployStackResult).not.toBeUndefined();
+        expect(deployStackResult?.noOp).toEqual(true);
+        expect(mockLambdaClient).not.toHaveReceivedCommand(UpdateFunctionCodeCommand);
+      }
+    },
+  );
 
-  silentTest(`when it receives a non-hotswappable change that includes a code difference in a Lambda function, it does not call the updateLambdaCode()
+  silentTest(
+    `when it receives a non-hotswappable change that includes a code difference in a Lambda function, it does not call the updateLambdaCode()
         API in CLASSIC mode but does in HOTSWAP_ONLY mode`,
-  async () => {
-    // GIVEN
-    setup.setCurrentCfnStackTemplate({
-      Resources: {
-        Func: {
-          Type: 'AWS::Lambda::Function',
-          Properties: {
-            Code: {
-              S3Bucket: 'current-bucket',
-              S3Key: 'current-key',
-            },
-            FunctionName: 'my-function',
-            PackageType: 'Zip',
-          },
-        },
-      },
-    });
-    const cdkStackArtifact = setup.cdkStackArtifactOf({
-      template: {
+    async () => {
+      // GIVEN
+      setup.setCurrentCfnStackTemplate({
         Resources: {
           Func: {
             Type: 'AWS::Lambda::Function',
             Properties: {
               Code: {
                 S3Bucket: 'current-bucket',
-                S3Key: 'new-key',
+                S3Key: 'current-key',
+              },
+              FunctionName: 'my-function',
+              PackageType: 'Zip',
+            },
+          },
+        },
+      });
+      const cdkStackArtifact = setup.cdkStackArtifactOf({
+        template: {
+          Resources: {
+            Func: {
+              Type: 'AWS::Lambda::Function',
+              Properties: {
+                Code: {
+                  S3Bucket: 'current-bucket',
+                  S3Key: 'new-key',
+                },
+                FunctionName: 'my-function',
+                PackageType: 'Image',
               },
-              FunctionName: 'my-function',
-              PackageType: 'Image',
             },
           },
         },
-      },
-    });
+      });
 
-    if (hotswapMode === HotswapMode.FALL_BACK) {
-      // WHEN
-      const deployStackResult = await hotswapMockSdkProvider.tryHotswapDeployment(hotswapMode, cdkStackArtifact);
+      if (hotswapMode === HotswapMode.FALL_BACK) {
+        // WHEN
+        const deployStackResult = await hotswapMockSdkProvider.tryHotswapDeployment(hotswapMode, cdkStackArtifact);
 
-      // THEN
-      expect(deployStackResult).toBeUndefined();
-      expect(mockUpdateLambdaCode).not.toHaveBeenCalled();
-    } else if (hotswapMode === HotswapMode.HOTSWAP_ONLY) {
-      // WHEN
-      const deployStackResult = await hotswapMockSdkProvider.tryHotswapDeployment(hotswapMode, cdkStackArtifact);
+        // THEN
+        expect(deployStackResult).toBeUndefined();
+        expect(mockLambdaClient).not.toHaveReceivedCommand(UpdateFunctionCodeCommand);
+      } else if (hotswapMode === HotswapMode.HOTSWAP_ONLY) {
+        // WHEN
+        const deployStackResult = await hotswapMockSdkProvider.tryHotswapDeployment(hotswapMode, cdkStackArtifact);
 
-      // THEN
-      expect(deployStackResult).not.toBeUndefined();
-      expect(mockUpdateLambdaCode).toHaveBeenCalledWith({
-        FunctionName: 'my-function',
-        S3Bucket: 'current-bucket',
-        S3Key: 'new-key',
-      });
-    }
-  });
+        // THEN
+        expect(deployStackResult).not.toBeUndefined();
+        expect(mockLambdaClient).toHaveReceivedCommandWith(UpdateFunctionCodeCommand, {
+          FunctionName: 'my-function',
+          S3Bucket: 'current-bucket',
+          S3Key: 'new-key',
+        });
+      }
+    },
+  );
 
-  silentTest('does not call the updateLambdaCode() API when a resource with type that is not AWS::Lambda::Function but has the same properties is changed', async () => {
-    // GIVEN
-    setup.setCurrentCfnStackTemplate({
-      Resources: {
-        Func: {
-          Type: 'AWS::NotLambda::NotAFunction',
-          Properties: {
-            Code: {
-              S3Bucket: 'current-bucket',
-              S3Key: 'current-key',
-            },
-          },
-          Metadata: {
-            'aws:asset:path': 'old-path',
-          },
-        },
-      },
-    });
-    const cdkStackArtifact = setup.cdkStackArtifactOf({
-      template: {
+  silentTest(
+    'does not call the updateLambdaCode() API when a resource with type that is not AWS::Lambda::Function but has the same properties is changed',
+    async () => {
+      // GIVEN
+      setup.setCurrentCfnStackTemplate({
         Resources: {
           Func: {
             Type: 'AWS::NotLambda::NotAFunction',
             Properties: {
               Code: {
                 S3Bucket: 'current-bucket',
-                S3Key: 'new-key',
+                S3Key: 'current-key',
               },
             },
             Metadata: {
@@ -534,28 +534,46 @@ describe.each([HotswapMode.FALL_BACK, HotswapMode.HOTSWAP_ONLY])('%p mode', (hot
             },
           },
         },
-      },
-    });
+      });
+      const cdkStackArtifact = setup.cdkStackArtifactOf({
+        template: {
+          Resources: {
+            Func: {
+              Type: 'AWS::NotLambda::NotAFunction',
+              Properties: {
+                Code: {
+                  S3Bucket: 'current-bucket',
+                  S3Key: 'new-key',
+                },
+              },
+              Metadata: {
+                'aws:asset:path': 'old-path',
+              },
+            },
+          },
+        },
+      });
 
-    if (hotswapMode === HotswapMode.FALL_BACK) {
-      // WHEN
-      const deployStackResult = await hotswapMockSdkProvider.tryHotswapDeployment(hotswapMode, cdkStackArtifact);
+      if (hotswapMode === HotswapMode.FALL_BACK) {
+        // WHEN
+        const deployStackResult = await hotswapMockSdkProvider.tryHotswapDeployment(hotswapMode, cdkStackArtifact);
 
-      // THEN
-      expect(deployStackResult).toBeUndefined();
-      expect(mockUpdateLambdaCode).not.toHaveBeenCalled();
-    } else if (hotswapMode === HotswapMode.HOTSWAP_ONLY) {
-      // WHEN
-      const deployStackResult = await hotswapMockSdkProvider.tryHotswapDeployment(hotswapMode, cdkStackArtifact);
+        // THEN
+        expect(deployStackResult).toBeUndefined();
+        expect(mockLambdaClient).not.toHaveReceivedCommand(UpdateFunctionCodeCommand);
+      } else if (hotswapMode === HotswapMode.HOTSWAP_ONLY) {
+        // WHEN
+        const deployStackResult = await hotswapMockSdkProvider.tryHotswapDeployment(hotswapMode, cdkStackArtifact);
 
-      // THEN
-      expect(deployStackResult).not.toBeUndefined();
-      expect(deployStackResult?.noOp).toEqual(true);
-      expect(mockUpdateLambdaCode).not.toHaveBeenCalled();
-    }
-  });
+        // THEN
+        expect(deployStackResult).not.toBeUndefined();
+        expect(deployStackResult?.noOp).toEqual(true);
+        expect(mockLambdaClient).not.toHaveReceivedCommand(UpdateFunctionCodeCommand);
+      }
+    },
+  );
 
-  silentTest('calls getFunction() after function code is updated with delay 1', async () => {
+  silentTest('calls waiter after function code is updated with delay 1', async () => {
     // GIVEN
     setup.setCurrentCfnStackTemplate({
       Resources: {
@@ -598,25 +616,24 @@ describe.each([HotswapMode.FALL_BACK, HotswapMode.HOTSWAP_ONLY])('%p mode', (hot
     await hotswapMockSdkProvider.tryHotswapDeployment(hotswapMode, cdkStackArtifact);
 
     // THEN
-    expect(mockMakeRequest).toHaveBeenCalledWith('getFunction', { FunctionName: 'my-function' });
-    expect(hotswapMockSdkProvider.getLambdaApiWaiters()).toEqual(expect.objectContaining({
-      updateFunctionPropertiesToFinish: expect.objectContaining({
-        name: 'UpdateFunctionPropertiesToFinish',
-        delay: 1,
+    expect(mockLambdaClient).toHaveReceivedCommand(UpdateFunctionCodeCommand);
+    expect(waitUntilFunctionUpdated).toHaveBeenCalledWith(
+      expect.objectContaining({
+        minDelay: 1,
+        maxDelay: 1,
+        maxWaitTime: 1 * 60,
       }),
-    }));
+      { FunctionName: 'my-function' },
+    );
   });
 
-  silentTest('calls getFunction() after function code is updated and VpcId is empty string with delay 1', async () => {
+  silentTest('calls waiter after function code is updated and VpcId is empty string with delay 1', async () => {
     // GIVEN
-    mockUpdateLambdaCode = jest.fn().mockReturnValue({
+    mockLambdaClient.on(UpdateFunctionCodeCommand).resolves({
       VpcConfig: {
         VpcId: '',
       },
     });
-    hotswapMockSdkProvider.stubLambda({
-      updateFunctionCode: mockUpdateLambdaCode,
-    });
     setup.setCurrentCfnStackTemplate({
       Resources: {
         Func: {
@@ -658,24 +675,23 @@ describe.each([HotswapMode.FALL_BACK, HotswapMode.HOTSWAP_ONLY])('%p mode', (hot
     await hotswapMockSdkProvider.tryHotswapDeployment(hotswapMode, cdkStackArtifact);
 
     // THEN
-    expect(hotswapMockSdkProvider.getLambdaApiWaiters()).toEqual(expect.objectContaining({
-      updateFunctionPropertiesToFinish: expect.objectContaining({
-        name: 'UpdateFunctionPropertiesToFinish',
-        delay: 1,
+    expect(waitUntilFunctionUpdated).toHaveBeenCalledWith(
+      expect.objectContaining({
+        minDelay: 1,
+        maxDelay: 1,
+        maxWaitTime: 1 * 60,
       }),
-    }));
+      { FunctionName: 'my-function' },
+    );
   });
 
   silentTest('calls getFunction() after function code is updated on a VPC function with delay 5', async () => {
     // GIVEN
-    mockUpdateLambdaCode = jest.fn().mockReturnValue({
+    mockLambdaClient.on(UpdateFunctionCodeCommand).resolves({
       VpcConfig: {
         VpcId: 'abc',
       },
     });
-    hotswapMockSdkProvider.stubLambda({
-      updateFunctionCode: mockUpdateLambdaCode,
-    });
     setup.setCurrentCfnStackTemplate({
       Resources: {
         Func: {
@@ -717,36 +733,21 @@ describe.each([HotswapMode.FALL_BACK, HotswapMode.HOTSWAP_ONLY])('%p mode', (hot
     await hotswapMockSdkProvider.tryHotswapDeployment(hotswapMode, cdkStackArtifact);
 
     // THEN
-    expect(hotswapMockSdkProvider.getLambdaApiWaiters()).toEqual(expect.objectContaining({
-      updateFunctionPropertiesToFinish: expect.objectContaining({
-        name: 'UpdateFunctionPropertiesToFinish',
-        delay: 5,
+    expect(waitUntilFunctionUpdated).toHaveBeenCalledWith(
+      expect.objectContaining({
+        minDelay: 5,
+        maxDelay: 5,
+        maxWaitTime: 5 * 60,
       }),
-    }));
+      { FunctionName: 'my-function' },
+    );
   });
 
-  silentTest('calls the updateLambdaConfiguration() API when it receives difference in Description field of a Lambda function', async () => {
-    // GIVEN
-    setup.setCurrentCfnStackTemplate({
-      Resources: {
-        Func: {
-          Type: 'AWS::Lambda::Function',
-          Properties: {
-            Code: {
-              S3Bucket: 's3-bucket',
-              S3Key: 's3-key',
-            },
-            FunctionName: 'my-function',
-            Description: 'Old Description',
-          },
-          Metadata: {
-            'aws:asset:path': 'asset-path',
-          },
-        },
-      },
-    });
-    const cdkStackArtifact = setup.cdkStackArtifactOf({
-      template: {
+  silentTest(
+    'calls the updateLambdaConfiguration() API when it receives difference in Description field of a Lambda function',
+    async () => {
+      // GIVEN
+      setup.setCurrentCfnStackTemplate({
         Resources: {
           Func: {
             Type: 'AWS::Lambda::Function',
@@ -756,54 +757,52 @@ describe.each([HotswapMode.FALL_BACK, HotswapMode.HOTSWAP_ONLY])('%p mode', (hot
                 S3Key: 's3-key',
               },
               FunctionName: 'my-function',
-              Description: 'New Description',
+              Description: 'Old Description',
             },
             Metadata: {
               'aws:asset:path': 'asset-path',
             },
           },
         },
-      },
-    });
-
-    // WHEN
-    const deployStackResult = await hotswapMockSdkProvider.tryHotswapDeployment(hotswapMode, cdkStackArtifact);
-
-    // THEN
-    expect(deployStackResult).not.toBeUndefined();
-    expect(mockUpdateLambdaConfiguration).toHaveBeenCalledWith({
-      FunctionName: 'my-function',
-      Description: 'New Description',
-    });
-  });
-
-  silentTest('calls the updateLambdaConfiguration() API when it receives difference in Environment field of a Lambda function', async () => {
-    // GIVEN
-    setup.setCurrentCfnStackTemplate({
-      Resources: {
-        Func: {
-          Type: 'AWS::Lambda::Function',
-          Properties: {
-            Code: {
-              S3Bucket: 's3-bucket',
-              S3Key: 's3-key',
-            },
-            FunctionName: 'my-function',
-            Environment: {
-              Variables: {
-                Key1: 'Value1',
-                Key2: 'Value2',
+      });
+      const cdkStackArtifact = setup.cdkStackArtifactOf({
+        template: {
+          Resources: {
+            Func: {
+              Type: 'AWS::Lambda::Function',
+              Properties: {
+                Code: {
+                  S3Bucket: 's3-bucket',
+                  S3Key: 's3-key',
+                },
+                FunctionName: 'my-function',
+                Description: 'New Description',
+              },
+              Metadata: {
+                'aws:asset:path': 'asset-path',
               },
             },
           },
-          Metadata: {
-            'aws:asset:path': 'asset-path',
-          },
         },
-      },
-    });
-    const cdkStackArtifact = setup.cdkStackArtifactOf({
-      template: {
+      });
+
+      // WHEN
+      const deployStackResult = await hotswapMockSdkProvider.tryHotswapDeployment(hotswapMode, cdkStackArtifact);
+
+      // THEN
+      expect(deployStackResult).not.toBeUndefined();
+      expect(mockLambdaClient).toHaveReceivedCommandWith(UpdateFunctionConfigurationCommand, {
+        FunctionName: 'my-function',
+        Description: 'New Description',
+      });
+    },
+  );
+
+  silentTest(
+    'calls the updateLambdaConfiguration() API when it receives difference in Environment field of a Lambda function',
+    async () => {
+      // GIVEN
+      setup.setCurrentCfnStackTemplate({
         Resources: {
           Func: {
             Type: 'AWS::Lambda::Function',
@@ -817,7 +816,6 @@ describe.each([HotswapMode.FALL_BACK, HotswapMode.HOTSWAP_ONLY])('%p mode', (hot
                 Variables: {
                   Key1: 'Value1',
                   Key2: 'Value2',
-                  NewKey: 'NewValue',
                 },
               },
             },
@@ -826,127 +824,117 @@ describe.each([HotswapMode.FALL_BACK, HotswapMode.HOTSWAP_ONLY])('%p mode', (hot
             },
           },
         },
-      },
-    });
-
-    // WHEN
-    const deployStackResult = await hotswapMockSdkProvider.tryHotswapDeployment(hotswapMode, cdkStackArtifact);
-
-    // THEN
-    expect(deployStackResult).not.toBeUndefined();
-    expect(mockUpdateLambdaConfiguration).toHaveBeenCalledWith({
-      FunctionName: 'my-function',
-      Environment: {
-        Variables: {
-          Key1: 'Value1',
-          Key2: 'Value2',
-          NewKey: 'NewValue',
-        },
-      },
-    });
-  });
-
-  silentTest('calls both updateLambdaCode() and updateLambdaConfiguration() API when it receives both code and configuration change', async () => {
-    // GIVEN
-    setup.setCurrentCfnStackTemplate({
-      Resources: {
-        Func: {
-          Type: 'AWS::Lambda::Function',
-          Properties: {
-            Code: {
-              S3Bucket: 'current-bucket',
-              S3Key: 'current-key',
+      });
+      const cdkStackArtifact = setup.cdkStackArtifactOf({
+        template: {
+          Resources: {
+            Func: {
+              Type: 'AWS::Lambda::Function',
+              Properties: {
+                Code: {
+                  S3Bucket: 's3-bucket',
+                  S3Key: 's3-key',
+                },
+                FunctionName: 'my-function',
+                Environment: {
+                  Variables: {
+                    Key1: 'Value1',
+                    Key2: 'Value2',
+                    NewKey: 'NewValue',
+                  },
+                },
+              },
+              Metadata: {
+                'aws:asset:path': 'asset-path',
+              },
             },
-            FunctionName: 'my-function',
-            Description: 'Old Description',
           },
-          Metadata: {
-            'aws:asset:path': 'asset-path',
+        },
+      });
+
+      // WHEN
+      const deployStackResult = await hotswapMockSdkProvider.tryHotswapDeployment(hotswapMode, cdkStackArtifact);
+
+      // THEN
+      expect(deployStackResult).not.toBeUndefined();
+      expect(mockLambdaClient).toHaveReceivedCommandWith(UpdateFunctionConfigurationCommand, {
+        FunctionName: 'my-function',
+        Environment: {
+          Variables: {
+            Key1: 'Value1',
+            Key2: 'Value2',
+            NewKey: 'NewValue',
           },
         },
-      },
-    });
-    const cdkStackArtifact = setup.cdkStackArtifactOf({
-      template: {
+      });
+    },
+  );
+
+  silentTest(
+    'calls both updateLambdaCode() and updateLambdaConfiguration() API when it receives both code and configuration change',
+    async () => {
+      // GIVEN
+      setup.setCurrentCfnStackTemplate({
         Resources: {
           Func: {
             Type: 'AWS::Lambda::Function',
             Properties: {
               Code: {
-                S3Bucket: 'new-bucket',
-                S3Key: 'new-key',
+                S3Bucket: 'current-bucket',
+                S3Key: 'current-key',
               },
               FunctionName: 'my-function',
-              Description: 'New Description',
+              Description: 'Old Description',
             },
             Metadata: {
               'aws:asset:path': 'asset-path',
             },
           },
         },
-      },
-    });
-
-    // WHEN
-    const deployStackResult = await hotswapMockSdkProvider.tryHotswapDeployment(hotswapMode, cdkStackArtifact);
-
-    // THEN
-    expect(deployStackResult).not.toBeUndefined();
-    expect(mockUpdateLambdaConfiguration).toHaveBeenCalledWith({
-      FunctionName: 'my-function',
-      Description: 'New Description',
-    });
-    expect(mockUpdateLambdaCode).toHaveBeenCalledWith({
-      FunctionName: 'my-function',
-      S3Bucket: 'new-bucket',
-      S3Key: 'new-key',
-    });
-  });
-
-  silentTest('Lambda hotswap works properly with changes of environment variables and description with tokens', async () => {
-    // GIVEN
-    setup.setCurrentCfnStackTemplate({
-      Resources: {
-        EventBus: {
-          Type: 'AWS::Events::EventBus',
-          Properties: {
-            Name: 'my-event-bus',
-          },
-        },
-        Func: {
-          Type: 'AWS::Lambda::Function',
-          Properties: {
-            Code: {
-              S3Bucket: 's3-bucket',
-              S3Key: 's3-key',
-            },
-            FunctionName: 'my-function',
-            Environment: {
-              Variables: {
-                token: { 'Fn::GetAtt': ['EventBus', 'Arn'] },
-                literal: 'oldValue',
+      });
+      const cdkStackArtifact = setup.cdkStackArtifactOf({
+        template: {
+          Resources: {
+            Func: {
+              Type: 'AWS::Lambda::Function',
+              Properties: {
+                Code: {
+                  S3Bucket: 'new-bucket',
+                  S3Key: 'new-key',
+                },
+                FunctionName: 'my-function',
+                Description: 'New Description',
+              },
+              Metadata: {
+                'aws:asset:path': 'asset-path',
               },
             },
-            Description: {
-              'Fn::Join': ['', [
-                'oldValue',
-                { 'Fn::GetAtt': ['EventBus', 'Arn'] },
-              ]],
-            },
-          },
-          Metadata: {
-            'aws:asset:path': 'asset-path',
           },
         },
-      },
-    });
+      });
 
-    setup.pushStackResourceSummaries(
-      setup.stackSummaryOf('EventBus', 'AWS::Events::EventBus', 'my-event-bus'),
-    );
+      // WHEN
+      const deployStackResult = await hotswapMockSdkProvider.tryHotswapDeployment(hotswapMode, cdkStackArtifact);
 
-    const cdkStackArtifact = setup.cdkStackArtifactOf({
-      template: {
+      // THEN
+      expect(deployStackResult).not.toBeUndefined();
+      expect(mockLambdaClient).toHaveReceivedCommandWith(UpdateFunctionConfigurationCommand, {
+        FunctionName: 'my-function',
+        Description: 'New Description',
+      });
+      expect(mockLambdaClient).toHaveReceivedCommandWith(UpdateFunctionCodeCommand, {
+        FunctionName: 'my-function',
+        S3Bucket: 'new-bucket',
+        S3Key: 'new-key',
+      });
+    },
+  );
+
+  silentTest(
+    'Lambda hotswap works properly with changes of environment variables and description with tokens',
+    async () => {
+      // GIVEN
+      setup.setCurrentCfnStackTemplate({
         Resources: {
           EventBus: {
             Type: 'AWS::Events::EventBus',
@@ -965,14 +953,11 @@ describe.each([HotswapMode.FALL_BACK, HotswapMode.HOTSWAP_ONLY])('%p mode', (hot
               Environment: {
                 Variables: {
                   token: { 'Fn::GetAtt': ['EventBus', 'Arn'] },
-                  literal: 'newValue',
+                  literal: 'oldValue',
                 },
               },
               Description: {
-                'Fn::Join': ['', [
-                  'newValue',
-                  { 'Fn::GetAtt': ['EventBus', 'Arn'] },
-                ]],
+                'Fn::Join': ['', ['oldValue', { 'Fn::GetAtt': ['EventBus', 'Arn'] }]],
               },
             },
             Metadata: {
@@ -980,25 +965,62 @@ describe.each([HotswapMode.FALL_BACK, HotswapMode.HOTSWAP_ONLY])('%p mode', (hot
             },
           },
         },
-      },
-    });
+      });
 
-    // WHEN
-    const deployStackResult = await hotswapMockSdkProvider.tryHotswapDeployment(hotswapMode, cdkStackArtifact);
+      setup.pushStackResourceSummaries(setup.stackSummaryOf('EventBus', 'AWS::Events::EventBus', 'my-event-bus'));
 
-    // THEN
-    expect(deployStackResult).not.toBeUndefined();
-    expect(mockUpdateLambdaConfiguration).toHaveBeenCalledWith({
-      FunctionName: 'my-function',
-      Environment: {
-        Variables: {
-          token: 'arn:aws:events:here:123456789012:event-bus/my-event-bus',
-          literal: 'newValue',
+      const cdkStackArtifact = setup.cdkStackArtifactOf({
+        template: {
+          Resources: {
+            EventBus: {
+              Type: 'AWS::Events::EventBus',
+              Properties: {
+                Name: 'my-event-bus',
+              },
+            },
+            Func: {
+              Type: 'AWS::Lambda::Function',
+              Properties: {
+                Code: {
+                  S3Bucket: 's3-bucket',
+                  S3Key: 's3-key',
+                },
+                FunctionName: 'my-function',
+                Environment: {
+                  Variables: {
+                    token: { 'Fn::GetAtt': ['EventBus', 'Arn'] },
+                    literal: 'newValue',
+                  },
+                },
+                Description: {
+                  'Fn::Join': ['', ['newValue', { 'Fn::GetAtt': ['EventBus', 'Arn'] }]],
+                },
+              },
+              Metadata: {
+                'aws:asset:path': 'asset-path',
+              },
+            },
+          },
         },
-      },
-      Description: 'newValuearn:aws:events:here:123456789012:event-bus/my-event-bus',
-    });
-  });
+      });
+
+      // WHEN
+      const deployStackResult = await hotswapMockSdkProvider.tryHotswapDeployment(hotswapMode, cdkStackArtifact);
+
+      // THEN
+      expect(deployStackResult).not.toBeUndefined();
+      expect(mockLambdaClient).toHaveReceivedCommandWith(UpdateFunctionConfigurationCommand, {
+        FunctionName: 'my-function',
+        Environment: {
+          Variables: {
+            token: 'arn:swa:events:here:123456789012:event-bus/my-event-bus',
+            literal: 'newValue',
+          },
+        },
+        Description: 'newValuearn:swa:events:here:123456789012:event-bus/my-event-bus',
+      });
+    },
+  );
 
   silentTest('S3ObjectVersion is hotswappable', async () => {
     // GIVEN
@@ -1038,7 +1060,7 @@ describe.each([HotswapMode.FALL_BACK, HotswapMode.HOTSWAP_ONLY])('%p mode', (hot
 
     // THEN
     expect(deployStackResult).not.toBeUndefined();
-    expect(mockUpdateLambdaCode).toHaveBeenCalledWith({
+    expect(mockLambdaClient).toHaveReceivedCommandWith(UpdateFunctionCodeCommand, {
       FunctionName: 'my-function',
       S3Key: 'new-key',
       S3ObjectVersion: 'new-obj',
diff --git a/packages/aws-cdk/test/api/hotswap/lambda-functions-inline-hotswap-deployments.test.ts b/packages/aws-cdk/test/api/hotswap/lambda-functions-inline-hotswap-deployments.test.ts
index fc3b78c8c5190..7c9cfdbe3af68 100644
--- a/packages/aws-cdk/test/api/hotswap/lambda-functions-inline-hotswap-deployments.test.ts
+++ b/packages/aws-cdk/test/api/hotswap/lambda-functions-inline-hotswap-deployments.test.ts
@@ -1,153 +1,163 @@
+import { UpdateFunctionCodeCommand } from '@aws-sdk/client-lambda';
 import { Runtime } from 'aws-cdk-lib/aws-lambda';
-import { Lambda } from 'aws-sdk';
 import * as setup from './hotswap-test-setup';
 import { HotswapMode } from '../../../lib/api/hotswap/common';
+import { mockLambdaClient } from '../../util/mock-sdk';
 import { silentTest } from '../../util/silent';
 
-let mockUpdateLambdaCode: (params: Lambda.Types.UpdateFunctionCodeRequest) => Lambda.Types.FunctionConfiguration;
-let mockTagResource: (params: Lambda.Types.TagResourceRequest) => {};
-let mockUntagResource: (params: Lambda.Types.UntagResourceRequest) => {};
+jest.mock('@aws-sdk/client-lambda', () => {
+  const original = jest.requireActual('@aws-sdk/client-lambda');
+
+  return {
+    ...original,
+    waitUntilFunctionUpdated: jest.fn(),
+  };
+});
+
 let hotswapMockSdkProvider: setup.HotswapMockSdkProvider;
 
 beforeEach(() => {
   hotswapMockSdkProvider = setup.setupHotswapTests();
-  mockUpdateLambdaCode = jest.fn().mockReturnValue({});
-  mockTagResource = jest.fn();
-  mockUntagResource = jest.fn();
-  hotswapMockSdkProvider.stubLambda({
-    updateFunctionCode: mockUpdateLambdaCode,
-    tagResource: mockTagResource,
-    untagResource: mockUntagResource,
-  });
 });
 
-describe.each([HotswapMode.FALL_BACK, HotswapMode.HOTSWAP_ONLY])('these tests do not depend on the hotswap type', (hotswapMode) => {
-  silentTest('calls the updateLambdaCode() API when it receives only a code difference in a Lambda function (Inline Node.js code)', async () => {
-    // GIVEN
-    setup.setCurrentCfnStackTemplate({
-      Resources: {
-        Func: {
-          Type: 'AWS::Lambda::Function',
-          Properties: {
-            Code: {
-              ZipFile: 'exports.handler = () => {return true}',
+describe.each([HotswapMode.FALL_BACK, HotswapMode.HOTSWAP_ONLY])(
+  'these tests do not depend on the hotswap type',
+  (hotswapMode) => {
+    silentTest(
+      'calls the updateLambdaCode() API when it receives only a code difference in a Lambda function (Inline Node.js code)',
+      async () => {
+        // GIVEN
+        setup.setCurrentCfnStackTemplate({
+          Resources: {
+            Func: {
+              Type: 'AWS::Lambda::Function',
+              Properties: {
+                Code: {
+                  ZipFile: 'exports.handler = () => {return true}',
+                },
+                Runtime: Runtime.NODEJS_LATEST.name,
+                FunctionName: 'my-function',
+              },
             },
-            Runtime: Runtime.NODEJS_LATEST.name,
-            FunctionName: 'my-function',
           },
-        },
-      },
-    });
-    const newCode = 'exports.handler = () => {return false}';
-    const cdkStackArtifact = setup.cdkStackArtifactOf({
-      template: {
-        Resources: {
-          Func: {
-            Type: 'AWS::Lambda::Function',
-            Properties: {
-              Code: {
-                ZipFile: newCode,
+        });
+        const newCode = 'exports.handler = () => {return false}';
+        const cdkStackArtifact = setup.cdkStackArtifactOf({
+          template: {
+            Resources: {
+              Func: {
+                Type: 'AWS::Lambda::Function',
+                Properties: {
+                  Code: {
+                    ZipFile: newCode,
+                  },
+                  Runtime: Runtime.NODEJS_LATEST.name,
+                  FunctionName: 'my-function',
+                },
               },
-              Runtime: Runtime.NODEJS_LATEST.name,
-              FunctionName: 'my-function',
             },
           },
-        },
-      },
-    });
+        });
 
-    // WHEN
-    const deployStackResult = await hotswapMockSdkProvider.tryHotswapDeployment(hotswapMode, cdkStackArtifact);
+        // WHEN
+        const deployStackResult = await hotswapMockSdkProvider.tryHotswapDeployment(hotswapMode, cdkStackArtifact);
 
-    // THEN
-    expect(deployStackResult).not.toBeUndefined();
-    expect(mockUpdateLambdaCode).toHaveBeenCalledWith({
-      FunctionName: 'my-function',
-      ZipFile: expect.any(Buffer),
-    });
-  });
+        // THEN
+        expect(deployStackResult).not.toBeUndefined();
+        expect(mockLambdaClient).toHaveReceivedCommandWith(UpdateFunctionCodeCommand, {
+          FunctionName: 'my-function',
+          ZipFile: expect.any(Buffer),
+        });
+      },
+    );
 
-  silentTest('calls the updateLambdaCode() API when it receives only a code difference in a Lambda function (Inline Python code)', async () => {
-    // GIVEN
-    setup.setCurrentCfnStackTemplate({
-      Resources: {
-        Func: {
-          Type: 'AWS::Lambda::Function',
-          Properties: {
-            Code: {
-              ZipFile: 'def handler(event, context):\n  return True',
+    silentTest(
+      'calls the updateLambdaCode() API when it receives only a code difference in a Lambda function (Inline Python code)',
+      async () => {
+        // GIVEN
+        setup.setCurrentCfnStackTemplate({
+          Resources: {
+            Func: {
+              Type: 'AWS::Lambda::Function',
+              Properties: {
+                Code: {
+                  ZipFile: 'def handler(event, context):\n  return True',
+                },
+                Runtime: 'python3.9',
+                FunctionName: 'my-function',
+              },
             },
-            Runtime: 'python3.9',
-            FunctionName: 'my-function',
           },
-        },
-      },
-    });
-    const cdkStackArtifact = setup.cdkStackArtifactOf({
-      template: {
-        Resources: {
-          Func: {
-            Type: 'AWS::Lambda::Function',
-            Properties: {
-              Code: {
-                ZipFile: 'def handler(event, context):\n  return False',
+        });
+        const cdkStackArtifact = setup.cdkStackArtifactOf({
+          template: {
+            Resources: {
+              Func: {
+                Type: 'AWS::Lambda::Function',
+                Properties: {
+                  Code: {
+                    ZipFile: 'def handler(event, context):\n  return False',
+                  },
+                  Runtime: 'python3.9',
+                  FunctionName: 'my-function',
+                },
               },
-              Runtime: 'python3.9',
-              FunctionName: 'my-function',
             },
           },
-        },
-      },
-    });
-
-    // WHEN
-    const deployStackResult = await hotswapMockSdkProvider.tryHotswapDeployment(hotswapMode, cdkStackArtifact);
+        });
 
-    // THEN
-    expect(deployStackResult).not.toBeUndefined();
-    expect(mockUpdateLambdaCode).toHaveBeenCalledWith({
-      FunctionName: 'my-function',
-      ZipFile: expect.any(Buffer),
-    });
-  });
+        // WHEN
+        const deployStackResult = await hotswapMockSdkProvider.tryHotswapDeployment(hotswapMode, cdkStackArtifact);
 
-  silentTest('throw a CfnEvaluationException when it receives an unsupported function runtime', async () => {
-    // GIVEN
-    setup.setCurrentCfnStackTemplate({
-      Resources: {
-        Func: {
-          Type: 'AWS::Lambda::Function',
-          Properties: {
-            Code: {
-              ZipFile: 'def handler(event:, context:) true end',
-            },
-            Runtime: 'ruby2.7',
-            FunctionName: 'my-function',
-          },
-        },
+        // THEN
+        expect(deployStackResult).not.toBeUndefined();
+        expect(mockLambdaClient).toHaveReceivedCommandWith(UpdateFunctionCodeCommand, {
+          FunctionName: 'my-function',
+          ZipFile: expect.any(Buffer),
+        });
       },
-    });
-    const cdkStackArtifact = setup.cdkStackArtifactOf({
-      template: {
+    );
+
+    silentTest('throw a CfnEvaluationException when it receives an unsupported function runtime', async () => {
+      // GIVEN
+      setup.setCurrentCfnStackTemplate({
         Resources: {
           Func: {
             Type: 'AWS::Lambda::Function',
             Properties: {
               Code: {
-                ZipFile: 'def handler(event:, context:) false end',
+                ZipFile: 'def handler(event:, context:) true end',
               },
               Runtime: 'ruby2.7',
               FunctionName: 'my-function',
             },
           },
         },
-      },
-    });
+      });
+      const cdkStackArtifact = setup.cdkStackArtifactOf({
+        template: {
+          Resources: {
+            Func: {
+              Type: 'AWS::Lambda::Function',
+              Properties: {
+                Code: {
+                  ZipFile: 'def handler(event:, context:) false end',
+                },
+                Runtime: 'ruby2.7',
+                FunctionName: 'my-function',
+              },
+            },
+          },
+        },
+      });
 
-    // WHEN
-    const tryHotswap = hotswapMockSdkProvider.tryHotswapDeployment(hotswapMode, cdkStackArtifact);
+      // WHEN
+      const tryHotswap = hotswapMockSdkProvider.tryHotswapDeployment(hotswapMode, cdkStackArtifact);
 
-    // THEN
-    await expect(tryHotswap).rejects.toThrow('runtime ruby2.7 is unsupported, only node.js and python runtimes are currently supported.');
-  });
-});
+      // THEN
+      await expect(tryHotswap).rejects.toThrow(
+        'runtime ruby2.7 is unsupported, only node.js and python runtimes are currently supported.',
+      );
+    });
+  },
+);
diff --git a/packages/aws-cdk/test/api/hotswap/lambda-versions-aliases-hotswap-deployments.test.ts b/packages/aws-cdk/test/api/hotswap/lambda-versions-aliases-hotswap-deployments.test.ts
index 7840227e255a7..4356124de46d7 100644
--- a/packages/aws-cdk/test/api/hotswap/lambda-versions-aliases-hotswap-deployments.test.ts
+++ b/packages/aws-cdk/test/api/hotswap/lambda-versions-aliases-hotswap-deployments.test.ts
@@ -1,24 +1,22 @@
-import { Lambda } from 'aws-sdk';
+import { PublishVersionCommand, UpdateAliasCommand } from '@aws-sdk/client-lambda';
 import * as setup from './hotswap-test-setup';
 import { HotswapMode } from '../../../lib/api/hotswap/common';
+import { mockLambdaClient } from '../../util/mock-sdk';
 import { silentTest } from '../../util/silent';
 
-let mockUpdateLambdaCode: (params: Lambda.Types.UpdateFunctionCodeRequest) => Lambda.Types.FunctionConfiguration;
-let mockPublishVersion: jest.Mock<Lambda.FunctionConfiguration, Lambda.PublishVersionRequest[]>;
-let mockUpdateAlias: (params: Lambda.UpdateAliasRequest) => Lambda.AliasConfiguration;
+jest.mock('@aws-sdk/client-lambda', () => {
+  const original = jest.requireActual('@aws-sdk/client-lambda');
+
+  return {
+    ...original,
+    waitUntilFunctionUpdated: jest.fn(),
+  };
+});
+
 let hotswapMockSdkProvider: setup.HotswapMockSdkProvider;
 
 beforeEach(() => {
   hotswapMockSdkProvider = setup.setupHotswapTests();
-  mockUpdateLambdaCode = jest.fn().mockReturnValue({});
-  mockPublishVersion = jest.fn();
-  mockUpdateAlias = jest.fn();
-  hotswapMockSdkProvider.stubLambda({
-    updateFunctionCode: mockUpdateLambdaCode,
-    publishVersion: mockPublishVersion,
-    updateAlias: mockUpdateAlias,
-    waitFor: jest.fn(),
-  });
 });
 
 describe.each([HotswapMode.FALL_BACK, HotswapMode.HOTSWAP_ONLY])('%p mode', (hotswapMode) => {
@@ -72,7 +70,7 @@ describe.each([HotswapMode.FALL_BACK, HotswapMode.HOTSWAP_ONLY])('%p mode', (hot
 
     // THEN
     expect(deployStackResult).not.toBeUndefined();
-    expect(mockPublishVersion).toHaveBeenCalledWith({
+    expect(mockLambdaClient).toHaveReceivedCommandWith(PublishVersionCommand, {
       FunctionName: 'my-function',
     });
   });
@@ -127,13 +125,16 @@ describe.each([HotswapMode.FALL_BACK, HotswapMode.HOTSWAP_ONLY])('%p mode', (hot
 
     // THEN
     expect(deployStackResult).not.toBeUndefined();
-    expect(mockPublishVersion).toHaveBeenCalledWith({
+    expect(mockLambdaClient).toHaveReceivedCommandWith(PublishVersionCommand, {
       FunctionName: 'my-function',
     });
   });
 
   silentTest('hotswaps a Version and an Alias if the Function they point to changed', async () => {
     // GIVEN
+    mockLambdaClient.on(PublishVersionCommand).resolves({
+      Version: 'v2',
+    });
     setup.setCurrentCfnStackTemplate({
       Resources: {
         Func: {
@@ -192,16 +193,13 @@ describe.each([HotswapMode.FALL_BACK, HotswapMode.HOTSWAP_ONLY])('%p mode', (hot
         },
       },
     });
-    mockPublishVersion.mockReturnValue({
-      Version: 'v2',
-    });
 
     // WHEN
     const deployStackResult = await hotswapMockSdkProvider.tryHotswapDeployment(hotswapMode, cdkStackArtifact);
 
     // THEN
     expect(deployStackResult).not.toBeUndefined();
-    expect(mockUpdateAlias).toHaveBeenCalledWith({
+    expect(mockLambdaClient).toHaveReceivedCommandWith(UpdateAliasCommand, {
       FunctionName: 'my-function',
       FunctionVersion: 'v2',
       Name: 'dev',
diff --git a/packages/aws-cdk/test/api/hotswap/nested-stacks-hotswap.test.ts b/packages/aws-cdk/test/api/hotswap/nested-stacks-hotswap.test.ts
index 53d11b79d6db7..37c142996fd62 100644
--- a/packages/aws-cdk/test/api/hotswap/nested-stacks-hotswap.test.ts
+++ b/packages/aws-cdk/test/api/hotswap/nested-stacks-hotswap.test.ts
@@ -1,21 +1,16 @@
-import { Lambda } from 'aws-sdk';
+import { PublishVersionCommand, UpdateFunctionCodeCommand } from '@aws-sdk/client-lambda';
 import * as setup from './hotswap-test-setup';
 import { HotswapMode } from '../../../lib/api/hotswap/common';
 import { testStack } from '../../util';
+import { mockLambdaClient } from '../../util/mock-sdk';
 import { silentTest } from '../../util/silent';
 
-let mockUpdateLambdaCode: (params: Lambda.Types.UpdateFunctionCodeRequest) => Lambda.Types.FunctionConfiguration;
-let mockPublishVersion: jest.Mock<Lambda.FunctionConfiguration, Lambda.PublishVersionRequest[]>;
 let hotswapMockSdkProvider: setup.HotswapMockSdkProvider;
 
 describe.each([HotswapMode.FALL_BACK, HotswapMode.HOTSWAP_ONLY])('%p mode', (hotswapMode) => {
   silentTest('can hotswap a lambda function in a 1-level nested stack', async () => {
     // GIVEN
     hotswapMockSdkProvider = setup.setupHotswapNestedStackTests('LambdaRoot');
-    mockUpdateLambdaCode = jest.fn().mockReturnValue({});
-    hotswapMockSdkProvider.stubLambda({
-      updateFunctionCode: mockUpdateLambdaCode,
-    });
 
     const oldRootStack = testStack({
       stackName: 'LambdaRoot',
@@ -35,29 +30,34 @@ describe.each([HotswapMode.FALL_BACK, HotswapMode.HOTSWAP_ONLY])('%p mode', (hot
     });
 
     setup.addTemplateToCloudFormationLookupMock(oldRootStack);
-    setup.addTemplateToCloudFormationLookupMock(testStack({
-      stackName: 'NestedStack',
-      template: {
-        Resources: {
-          Func: {
-            Type: 'AWS::Lambda::Function',
-            Properties: {
-              Code: {
-                S3Bucket: 'current-bucket',
-                S3Key: 'current-key',
+    setup.addTemplateToCloudFormationLookupMock(
+      testStack({
+        stackName: 'NestedStack',
+        template: {
+          Resources: {
+            Func: {
+              Type: 'AWS::Lambda::Function',
+              Properties: {
+                Code: {
+                  S3Bucket: 'current-bucket',
+                  S3Key: 'current-key',
+                },
+                FunctionName: 'my-function',
+              },
+              Metadata: {
+                'aws:asset:path': 'old-lambda-path',
               },
-              FunctionName: 'my-function',
-            },
-            Metadata: {
-              'aws:asset:path': 'old-lambda-path',
             },
           },
         },
-      },
-    }));
+      }),
+    );
 
-    setup.pushNestedStackResourceSummaries('LambdaRoot',
-      setup.stackSummaryOf('NestedStack', 'AWS::CloudFormation::Stack',
+    setup.pushNestedStackResourceSummaries(
+      'LambdaRoot',
+      setup.stackSummaryOf(
+        'NestedStack',
+        'AWS::CloudFormation::Stack',
         'arn:aws:cloudformation:bermuda-triangle-1337:123456789012:stack/NestedStack/abcd',
       ),
     );
@@ -69,7 +69,7 @@ describe.each([HotswapMode.FALL_BACK, HotswapMode.HOTSWAP_ONLY])('%p mode', (hot
 
     // THEN
     expect(deployStackResult).not.toBeUndefined();
-    expect(mockUpdateLambdaCode).toHaveBeenCalledWith({
+    expect(mockLambdaClient).toHaveReceivedCommandWith(UpdateFunctionCodeCommand, {
       FunctionName: 'my-function',
       S3Bucket: 'current-bucket',
       S3Key: 'new-key',
@@ -79,10 +79,6 @@ describe.each([HotswapMode.FALL_BACK, HotswapMode.HOTSWAP_ONLY])('%p mode', (hot
   silentTest('hotswappable changes do not override hotswappable changes in their ancestors', async () => {
     // GIVEN
     hotswapMockSdkProvider = setup.setupHotswapNestedStackTests('TwoLevelLambdaRoot');
-    mockUpdateLambdaCode = jest.fn().mockReturnValue({});
-    hotswapMockSdkProvider.stubLambda({
-      updateFunctionCode: mockUpdateLambdaCode,
-    });
 
     const oldRootStack = testStack({
       stackName: 'TwoLevelLambdaRoot',
@@ -134,34 +130,42 @@ describe.each([HotswapMode.FALL_BACK, HotswapMode.HOTSWAP_ONLY])('%p mode', (hot
     });
     setup.addTemplateToCloudFormationLookupMock(oldChildStack);
 
-    setup.addTemplateToCloudFormationLookupMock(testStack({
-      stackName: 'GrandChildStack',
-      template: {
-        Resources: {
-          Func: {
-            Type: 'AWS::Lambda::Function',
-            Properties: {
-              Code: {
-                S3Bucket: 'current-bucket',
-                S3Key: 'current-key',
+    setup.addTemplateToCloudFormationLookupMock(
+      testStack({
+        stackName: 'GrandChildStack',
+        template: {
+          Resources: {
+            Func: {
+              Type: 'AWS::Lambda::Function',
+              Properties: {
+                Code: {
+                  S3Bucket: 'current-bucket',
+                  S3Key: 'current-key',
+                },
+                FunctionName: 'my-function',
+              },
+              Metadata: {
+                'aws:asset:path': 'old-lambda-path',
               },
-              FunctionName: 'my-function',
-            },
-            Metadata: {
-              'aws:asset:path': 'old-lambda-path',
             },
           },
         },
-      },
-    }));
+      }),
+    );
 
-    setup.pushNestedStackResourceSummaries('TwoLevelLambdaRoot',
-      setup.stackSummaryOf('ChildStack', 'AWS::CloudFormation::Stack',
+    setup.pushNestedStackResourceSummaries(
+      'TwoLevelLambdaRoot',
+      setup.stackSummaryOf(
+        'ChildStack',
+        'AWS::CloudFormation::Stack',
         'arn:aws:cloudformation:bermuda-triangle-1337:123456789012:stack/ChildStack/abcd',
       ),
     );
-    setup.pushNestedStackResourceSummaries('ChildStack',
-      setup.stackSummaryOf('GrandChildStack', 'AWS::CloudFormation::Stack',
+    setup.pushNestedStackResourceSummaries(
+      'ChildStack',
+      setup.stackSummaryOf(
+        'GrandChildStack',
+        'AWS::CloudFormation::Stack',
         'arn:aws:cloudformation:bermuda-triangle-1337:123456789012:stack/GrandChildStack/abcd',
       ),
     );
@@ -178,449 +182,448 @@ describe.each([HotswapMode.FALL_BACK, HotswapMode.HOTSWAP_ONLY])('%p mode', (hot
 
     // THEN
     expect(deployStackResult).not.toBeUndefined();
-    expect(mockUpdateLambdaCode).toHaveBeenCalledWith({
+    expect(mockLambdaClient).toHaveReceivedCommandWith(UpdateFunctionCodeCommand, {
       FunctionName: 'child-function',
       S3Bucket: 'new-bucket',
       S3Key: 'current-key',
     });
-    expect(mockUpdateLambdaCode).toHaveBeenCalledWith({
+    expect(mockLambdaClient).toHaveReceivedCommandWith(UpdateFunctionCodeCommand, {
       FunctionName: 'my-function',
       S3Bucket: 'current-bucket',
       S3Key: 'new-key',
     });
   });
 
-  silentTest('hotswappable changes in nested stacks do not override hotswappable changes in their parent stack', async () => {
-    // GIVEN
-    hotswapMockSdkProvider = setup.setupHotswapNestedStackTests('SiblingLambdaRoot');
-    mockUpdateLambdaCode = jest.fn().mockReturnValue({});
-    hotswapMockSdkProvider.stubLambda({
-      updateFunctionCode: mockUpdateLambdaCode,
-    });
-
-    const oldRootStack = testStack({
-      stackName: 'SiblingLambdaRoot',
-      template: {
-        Resources: {
-          NestedStack: {
-            Type: 'AWS::CloudFormation::Stack',
-            Properties: {
-              TemplateURL: 'https://www.magic-url.com',
-            },
-            Metadata: {
-              'aws:asset:path': 'one-lambda-stack.nested.template.json',
-            },
-          },
-          Func: {
-            Type: 'AWS::Lambda::Function',
-            Properties: {
-              Code: {
-                S3Bucket: 'current-bucket',
-                S3Key: 'current-key',
+  silentTest(
+    'hotswappable changes in nested stacks do not override hotswappable changes in their parent stack',
+    async () => {
+      // GIVEN
+      hotswapMockSdkProvider = setup.setupHotswapNestedStackTests('SiblingLambdaRoot');
+
+      const oldRootStack = testStack({
+        stackName: 'SiblingLambdaRoot',
+        template: {
+          Resources: {
+            NestedStack: {
+              Type: 'AWS::CloudFormation::Stack',
+              Properties: {
+                TemplateURL: 'https://www.magic-url.com',
               },
-              FunctionName: 'root-function',
-            },
-            Metadata: {
-              'aws:asset:path': 'old-lambda-path',
-            },
-          },
-        },
-      },
-    });
-
-    setup.addTemplateToCloudFormationLookupMock(oldRootStack);
-    setup.addTemplateToCloudFormationLookupMock(testStack({
-      stackName: 'NestedStack',
-      template: {
-        Resources: {
-          Func: {
-            Type: 'AWS::Lambda::Function',
-            Properties: {
-              Code: {
-                S3Bucket: 'current-bucket',
-                S3Key: 'current-key',
+              Metadata: {
+                'aws:asset:path': 'one-lambda-stack.nested.template.json',
               },
-              FunctionName: 'my-function',
-            },
-            Metadata: {
-              'aws:asset:path': 'old-lambda-path',
-            },
-          },
-        },
-      },
-    }));
-
-    setup.pushNestedStackResourceSummaries('SiblingLambdaRoot',
-      setup.stackSummaryOf('NestedStack', 'AWS::CloudFormation::Stack',
-        'arn:aws:cloudformation:bermuda-triangle-1337:123456789012:stack/NestedStack/abcd',
-      ),
-    );
-
-    // WHEN
-    oldRootStack.template.Resources.Func.Properties.Code.S3Bucket = 'new-bucket';
-    oldRootStack.template.Resources.NestedStack.Properties.TemplateURL = 'https://www.amazon.com';
-    // write the updated templates to disk
-    const newRootStack = testStack({ stackName: oldRootStack.stackName, template: oldRootStack.template });
-    const deployStackResult = await hotswapMockSdkProvider.tryHotswapDeployment(hotswapMode, newRootStack);
-
-    // THEN
-    expect(deployStackResult).not.toBeUndefined();
-    expect(mockUpdateLambdaCode).toHaveBeenCalledWith({
-      FunctionName: 'root-function',
-      S3Bucket: 'new-bucket',
-      S3Key: 'current-key',
-    });
-    expect(mockUpdateLambdaCode).toHaveBeenCalledWith({
-      FunctionName: 'my-function',
-      S3Bucket: 'current-bucket',
-      S3Key: 'new-key',
-    });
-  });
-
-  silentTest(`non-hotswappable changes in nested stacks result in a full deployment, even if their parent contains a hotswappable change in CLASSIC mode,
-        but perform a hotswap deployment in HOTSWAP_ONLY`,
-  async () => {
-    // GIVEN
-    hotswapMockSdkProvider = setup.setupHotswapNestedStackTests('NonHotswappableRoot');
-    mockUpdateLambdaCode = jest.fn().mockReturnValue({});
-    hotswapMockSdkProvider.stubLambda({
-      updateFunctionCode: mockUpdateLambdaCode,
-    });
-
-    const oldRootStack = testStack({
-      stackName: 'NonHotswappableRoot',
-      template: {
-        Resources: {
-          NestedStack: {
-            Type: 'AWS::CloudFormation::Stack',
-            Properties: {
-              TemplateURL: 'https://www.magic-url.com',
             },
-            Metadata: {
-              'aws:asset:path': 'one-lambda-stack.nested.template.json',
-            },
-          },
-          Func: {
-            Type: 'AWS::Lambda::Function',
-            Properties: {
-              Code: {
-                S3Bucket: 'current-bucket',
-                S3Key: 'current-key',
+            Func: {
+              Type: 'AWS::Lambda::Function',
+              Properties: {
+                Code: {
+                  S3Bucket: 'current-bucket',
+                  S3Key: 'current-key',
+                },
+                FunctionName: 'root-function',
+              },
+              Metadata: {
+                'aws:asset:path': 'old-lambda-path',
               },
-              FunctionName: 'root-function',
-            },
-            Metadata: {
-              'aws:asset:path': 'old-lambda-path',
             },
           },
         },
-      },
-    });
+      });
 
-    setup.addTemplateToCloudFormationLookupMock(oldRootStack);
-    setup.addTemplateToCloudFormationLookupMock(testStack({
-      stackName: 'NestedStack',
-      template: {
-        Resources: {
-          Func: {
-            Type: 'AWS::Lambda::Function',
-            Properties: {
-              Code: {
-                S3Bucket: 'current-bucket',
-                S3Key: 'current-key',
+      setup.addTemplateToCloudFormationLookupMock(oldRootStack);
+      setup.addTemplateToCloudFormationLookupMock(
+        testStack({
+          stackName: 'NestedStack',
+          template: {
+            Resources: {
+              Func: {
+                Type: 'AWS::Lambda::Function',
+                Properties: {
+                  Code: {
+                    S3Bucket: 'current-bucket',
+                    S3Key: 'current-key',
+                  },
+                  FunctionName: 'my-function',
+                },
+                Metadata: {
+                  'aws:asset:path': 'old-lambda-path',
+                },
               },
-              PackageType: 'Image',
-              FunctionName: 'my-function',
-            },
-            Metadata: {
-              'aws:asset:path': 'old-lambda-path',
             },
           },
-        },
-      },
-    }));
-
-    setup.pushNestedStackResourceSummaries('NonHotswappableRoot',
-      setup.stackSummaryOf('NestedStack', 'AWS::CloudFormation::Stack',
-        'arn:aws:cloudformation:bermuda-triangle-1337:123456789012:stack/NestedStack/abcd',
-      ),
-    );
-
-    oldRootStack.template.Resources.Func.Properties.Code.S3Bucket = 'new-bucket';
-    oldRootStack.template.Resources.NestedStack.Properties.TemplateURL = 'https://www.amazon.com';
-    const newRootStack = testStack({ stackName: oldRootStack.stackName, template: oldRootStack.template });
-
-    if (hotswapMode === HotswapMode.FALL_BACK) {
-      // WHEN
-      const deployStackResult = await hotswapMockSdkProvider.tryHotswapDeployment(hotswapMode, newRootStack);
-
-      // THEN
-      expect(deployStackResult).toBeUndefined();
-      expect(mockUpdateLambdaCode).not.toHaveBeenCalled();
+        }),
+      );
+
+      setup.pushNestedStackResourceSummaries(
+        'SiblingLambdaRoot',
+        setup.stackSummaryOf(
+          'NestedStack',
+          'AWS::CloudFormation::Stack',
+          'arn:aws:cloudformation:bermuda-triangle-1337:123456789012:stack/NestedStack/abcd',
+        ),
+      );
 
-    } else if (hotswapMode === HotswapMode.HOTSWAP_ONLY) {
       // WHEN
+      oldRootStack.template.Resources.Func.Properties.Code.S3Bucket = 'new-bucket';
+      oldRootStack.template.Resources.NestedStack.Properties.TemplateURL = 'https://www.amazon.com';
+      // write the updated templates to disk
+      const newRootStack = testStack({ stackName: oldRootStack.stackName, template: oldRootStack.template });
       const deployStackResult = await hotswapMockSdkProvider.tryHotswapDeployment(hotswapMode, newRootStack);
 
       // THEN
       expect(deployStackResult).not.toBeUndefined();
-      expect(mockUpdateLambdaCode).toHaveBeenCalledWith({
+      expect(mockLambdaClient).toHaveReceivedCommandWith(UpdateFunctionCodeCommand, {
         FunctionName: 'root-function',
         S3Bucket: 'new-bucket',
         S3Key: 'current-key',
       });
-    }
-  });
-
-  silentTest(`deleting a nested stack results in a full deployment in CLASSIC mode, even if their parent contains a hotswappable change,
-        but results in a hotswap deployment in HOTSWAP_ONLY mode`,
-  async () => {
-    // GIVEN
-    hotswapMockSdkProvider = setup.setupHotswapNestedStackTests('NestedStackDeletionRoot');
-    mockUpdateLambdaCode = jest.fn().mockReturnValue({});
-    hotswapMockSdkProvider.stubLambda({
-      updateFunctionCode: mockUpdateLambdaCode,
-    });
+      expect(mockLambdaClient).toHaveReceivedCommandWith(UpdateFunctionCodeCommand, {
+        FunctionName: 'my-function',
+        S3Bucket: 'current-bucket',
+        S3Key: 'new-key',
+      });
+    },
+  );
 
-    const oldRootStack = testStack({
-      stackName: 'NestedStackDeletionRoot',
-      template: {
-        Resources: {
-          NestedStack: {
-            Type: 'AWS::CloudFormation::Stack',
-            Properties: {
-              TemplateURL: 'https://www.magic-url.com',
+  silentTest(
+    `non-hotswappable changes in nested stacks result in a full deployment, even if their parent contains a hotswappable change in CLASSIC mode,
+        but perform a hotswap deployment in HOTSWAP_ONLY`,
+    async () => {
+      // GIVEN
+      hotswapMockSdkProvider = setup.setupHotswapNestedStackTests('NonHotswappableRoot');
+
+      const oldRootStack = testStack({
+        stackName: 'NonHotswappableRoot',
+        template: {
+          Resources: {
+            NestedStack: {
+              Type: 'AWS::CloudFormation::Stack',
+              Properties: {
+                TemplateURL: 'https://www.magic-url.com',
+              },
+              Metadata: {
+                'aws:asset:path': 'one-lambda-stack.nested.template.json',
+              },
             },
-            Metadata: {
-              'aws:asset:path': 'one-lambda-stack.nested.template.json',
+            Func: {
+              Type: 'AWS::Lambda::Function',
+              Properties: {
+                Code: {
+                  S3Bucket: 'current-bucket',
+                  S3Key: 'current-key',
+                },
+                FunctionName: 'root-function',
+              },
+              Metadata: {
+                'aws:asset:path': 'old-lambda-path',
+              },
             },
           },
-          Func: {
-            Type: 'AWS::Lambda::Function',
-            Properties: {
-              Code: {
-                S3Bucket: 'current-bucket',
-                S3Key: 'current-key',
+        },
+      });
+
+      setup.addTemplateToCloudFormationLookupMock(oldRootStack);
+      setup.addTemplateToCloudFormationLookupMock(
+        testStack({
+          stackName: 'NestedStack',
+          template: {
+            Resources: {
+              Func: {
+                Type: 'AWS::Lambda::Function',
+                Properties: {
+                  Code: {
+                    S3Bucket: 'current-bucket',
+                    S3Key: 'current-key',
+                  },
+                  PackageType: 'Image',
+                  FunctionName: 'my-function',
+                },
+                Metadata: {
+                  'aws:asset:path': 'old-lambda-path',
+                },
               },
-              FunctionName: 'root-function',
-            },
-            Metadata: {
-              'aws:asset:path': 'old-lambda-path',
             },
           },
-        },
-      },
-    });
+        }),
+      );
+
+      setup.pushNestedStackResourceSummaries(
+        'NonHotswappableRoot',
+        setup.stackSummaryOf(
+          'NestedStack',
+          'AWS::CloudFormation::Stack',
+          'arn:aws:cloudformation:bermuda-triangle-1337:123456789012:stack/NestedStack/abcd',
+        ),
+      );
+
+      oldRootStack.template.Resources.Func.Properties.Code.S3Bucket = 'new-bucket';
+      oldRootStack.template.Resources.NestedStack.Properties.TemplateURL = 'https://www.amazon.com';
+      const newRootStack = testStack({ stackName: oldRootStack.stackName, template: oldRootStack.template });
+
+      if (hotswapMode === HotswapMode.FALL_BACK) {
+        // WHEN
+        const deployStackResult = await hotswapMockSdkProvider.tryHotswapDeployment(hotswapMode, newRootStack);
+
+        // THEN
+        expect(deployStackResult).toBeUndefined();
+        expect(mockLambdaClient).not.toHaveReceivedCommand(UpdateFunctionCodeCommand);
+      } else if (hotswapMode === HotswapMode.HOTSWAP_ONLY) {
+        // WHEN
+        const deployStackResult = await hotswapMockSdkProvider.tryHotswapDeployment(hotswapMode, newRootStack);
+
+        // THEN
+        expect(deployStackResult).not.toBeUndefined();
+        expect(mockLambdaClient).toHaveReceivedCommandWith(UpdateFunctionCodeCommand, {
+          FunctionName: 'root-function',
+          S3Bucket: 'new-bucket',
+          S3Key: 'current-key',
+        });
+      }
+    },
+  );
 
-    setup.addTemplateToCloudFormationLookupMock(oldRootStack);
-    setup.addTemplateToCloudFormationLookupMock(testStack({
-      stackName: 'NestedStack',
-      template: {
-        Resources: {
-          Func: {
-            Type: 'AWS::Lambda::Function',
-            Properties: {
-              Code: {
-                S3Bucket: 'current-bucket',
-                S3Key: 'current-key',
+  silentTest(
+    `deleting a nested stack results in a full deployment in CLASSIC mode, even if their parent contains a hotswappable change,
+        but results in a hotswap deployment in HOTSWAP_ONLY mode`,
+    async () => {
+      // GIVEN
+      hotswapMockSdkProvider = setup.setupHotswapNestedStackTests('NestedStackDeletionRoot');
+
+      const oldRootStack = testStack({
+        stackName: 'NestedStackDeletionRoot',
+        template: {
+          Resources: {
+            NestedStack: {
+              Type: 'AWS::CloudFormation::Stack',
+              Properties: {
+                TemplateURL: 'https://www.magic-url.com',
+              },
+              Metadata: {
+                'aws:asset:path': 'one-lambda-stack.nested.template.json',
               },
-              FunctionName: 'my-function',
             },
-            Metadata: {
-              'aws:asset:path': 'old-lambda-path',
+            Func: {
+              Type: 'AWS::Lambda::Function',
+              Properties: {
+                Code: {
+                  S3Bucket: 'current-bucket',
+                  S3Key: 'current-key',
+                },
+                FunctionName: 'root-function',
+              },
+              Metadata: {
+                'aws:asset:path': 'old-lambda-path',
+              },
             },
           },
         },
-      },
-    }));
-
-    setup.pushNestedStackResourceSummaries('NestedStackDeletionRoot',
-      setup.stackSummaryOf('NestedStack', 'AWS::CloudFormation::Stack',
-        'arn:aws:cloudformation:bermuda-triangle-1337:123456789012:stack/NestedStack/abcd',
-      ),
-    );
-
-    oldRootStack.template.Resources.Func.Properties.Code.S3Bucket = 'new-bucket';
-    delete oldRootStack.template.Resources.NestedStack;
-    const newRootStack = testStack({ stackName: oldRootStack.stackName, template: oldRootStack.template });
-
-    if (hotswapMode === HotswapMode.FALL_BACK) {
-      // WHEN
-      const deployStackResult = await hotswapMockSdkProvider.tryHotswapDeployment(hotswapMode, newRootStack);
-
-      // THEN
-      expect(deployStackResult).toBeUndefined();
-      expect(mockUpdateLambdaCode).not.toHaveBeenCalled();
-    } else if (hotswapMode === HotswapMode.HOTSWAP_ONLY) {
-      // WHEN
-      const deployStackResult = await hotswapMockSdkProvider.tryHotswapDeployment(hotswapMode, newRootStack);
-
-      // THEN
-      expect(deployStackResult).not.toBeUndefined();
-      expect(mockUpdateLambdaCode).toHaveBeenCalledWith({
-        FunctionName: 'root-function',
-        S3Bucket: 'new-bucket',
-        S3Key: 'current-key',
       });
-    }
-  });
-
-  silentTest(`creating a nested stack results in a full deployment in CLASSIC mode, even if their parent contains a hotswappable change,
-        but results in a hotswap deployment in HOTSWAP_ONLY mode`,
-  async () => {
-    // GIVEN
-    hotswapMockSdkProvider = setup.setupHotswapNestedStackTests('NestedStackCreationRoot');
-    mockUpdateLambdaCode = jest.fn().mockReturnValue({});
-    hotswapMockSdkProvider.stubLambda({
-      updateFunctionCode: mockUpdateLambdaCode,
-    });
 
-    const oldRootStack = testStack({
-      stackName: 'NestedStackCreationRoot',
-      template: {
-        Resources: {
-          Func: {
-            Type: 'AWS::Lambda::Function',
-            Properties: {
-              Code: {
-                S3Bucket: 'current-bucket',
-                S3Key: 'current-key',
+      setup.addTemplateToCloudFormationLookupMock(oldRootStack);
+      setup.addTemplateToCloudFormationLookupMock(
+        testStack({
+          stackName: 'NestedStack',
+          template: {
+            Resources: {
+              Func: {
+                Type: 'AWS::Lambda::Function',
+                Properties: {
+                  Code: {
+                    S3Bucket: 'current-bucket',
+                    S3Key: 'current-key',
+                  },
+                  FunctionName: 'my-function',
+                },
+                Metadata: {
+                  'aws:asset:path': 'old-lambda-path',
+                },
               },
-              FunctionName: 'root-function',
             },
-            Metadata: {
-              'aws:asset:path': 'old-lambda-path',
+          },
+        }),
+      );
+
+      setup.pushNestedStackResourceSummaries(
+        'NestedStackDeletionRoot',
+        setup.stackSummaryOf(
+          'NestedStack',
+          'AWS::CloudFormation::Stack',
+          'arn:aws:cloudformation:bermuda-triangle-1337:123456789012:stack/NestedStack/abcd',
+        ),
+      );
+
+      oldRootStack.template.Resources.Func.Properties.Code.S3Bucket = 'new-bucket';
+      delete oldRootStack.template.Resources.NestedStack;
+      const newRootStack = testStack({ stackName: oldRootStack.stackName, template: oldRootStack.template });
+
+      if (hotswapMode === HotswapMode.FALL_BACK) {
+        // WHEN
+        const deployStackResult = await hotswapMockSdkProvider.tryHotswapDeployment(hotswapMode, newRootStack);
+
+        // THEN
+        expect(deployStackResult).toBeUndefined();
+        expect(mockLambdaClient).not.toHaveReceivedCommand(UpdateFunctionCodeCommand);
+      } else if (hotswapMode === HotswapMode.HOTSWAP_ONLY) {
+        // WHEN
+        const deployStackResult = await hotswapMockSdkProvider.tryHotswapDeployment(hotswapMode, newRootStack);
+
+        // THEN
+        expect(deployStackResult).not.toBeUndefined();
+        expect(mockLambdaClient).toHaveReceivedCommandWith(UpdateFunctionCodeCommand, {
+          FunctionName: 'root-function',
+          S3Bucket: 'new-bucket',
+          S3Key: 'current-key',
+        });
+      }
+    },
+  );
+
+  silentTest(
+    `creating a nested stack results in a full deployment in CLASSIC mode, even if their parent contains a hotswappable change,
+        but results in a hotswap deployment in HOTSWAP_ONLY mode`,
+    async () => {
+      // GIVEN
+      hotswapMockSdkProvider = setup.setupHotswapNestedStackTests('NestedStackCreationRoot');
+
+      const oldRootStack = testStack({
+        stackName: 'NestedStackCreationRoot',
+        template: {
+          Resources: {
+            Func: {
+              Type: 'AWS::Lambda::Function',
+              Properties: {
+                Code: {
+                  S3Bucket: 'current-bucket',
+                  S3Key: 'current-key',
+                },
+                FunctionName: 'root-function',
+              },
+              Metadata: {
+                'aws:asset:path': 'old-lambda-path',
+              },
             },
           },
         },
-      },
-    });
-
-    setup.addTemplateToCloudFormationLookupMock(oldRootStack);
-
-    oldRootStack.template.Resources.Func.Properties.Code.S3Bucket = 'new-bucket';
-    oldRootStack.template.Resources.NestedStack = {
-      Type: 'AWS::CloudFormation::Stack',
-      Properties: {
-        TemplateURL: 'https://www.amazon.com',
-      },
-      Metadata: {
-        'aws:asset:path': 'one-lambda-stack.nested.template.json',
-      },
-    };
-    // we need this because testStack() immediately writes the template to disk, so changing the template afterwards is not going to update the file.
-    const newRootStack = testStack({ stackName: oldRootStack.stackName, template: oldRootStack.template });
-
-    if (hotswapMode === HotswapMode.FALL_BACK) {
-      // WHEN
-      const deployStackResult = await hotswapMockSdkProvider.tryHotswapDeployment(hotswapMode, newRootStack);
-
-      // THEN
-      expect(deployStackResult).toBeUndefined();
-      expect(mockUpdateLambdaCode).not.toHaveBeenCalled();
+      });
 
-    } else if (hotswapMode === HotswapMode.HOTSWAP_ONLY) {
-      // WHEN
-      const deployStackResult = await hotswapMockSdkProvider.tryHotswapDeployment(hotswapMode, newRootStack);
+      setup.addTemplateToCloudFormationLookupMock(oldRootStack);
 
-      // THEN
-      expect(deployStackResult).not.toBeUndefined();
-      expect(mockUpdateLambdaCode).toHaveBeenCalledWith({
-        FunctionName: 'root-function',
-        S3Bucket: 'new-bucket',
-        S3Key: 'current-key',
-      });
-    }
-  });
+      oldRootStack.template.Resources.Func.Properties.Code.S3Bucket = 'new-bucket';
+      oldRootStack.template.Resources.NestedStack = {
+        Type: 'AWS::CloudFormation::Stack',
+        Properties: {
+          TemplateURL: 'https://www.amazon.com',
+        },
+        Metadata: {
+          'aws:asset:path': 'one-lambda-stack.nested.template.json',
+        },
+      };
+      // we need this because testStack() immediately writes the template to disk, so changing the template afterwards is not going to update the file.
+      const newRootStack = testStack({ stackName: oldRootStack.stackName, template: oldRootStack.template });
+
+      if (hotswapMode === HotswapMode.FALL_BACK) {
+        // WHEN
+        const deployStackResult = await hotswapMockSdkProvider.tryHotswapDeployment(hotswapMode, newRootStack);
+
+        // THEN
+        expect(deployStackResult).toBeUndefined();
+        expect(mockLambdaClient).not.toHaveReceivedCommand(UpdateFunctionCodeCommand);
+      } else if (hotswapMode === HotswapMode.HOTSWAP_ONLY) {
+        // WHEN
+        const deployStackResult = await hotswapMockSdkProvider.tryHotswapDeployment(hotswapMode, newRootStack);
+
+        // THEN
+        expect(deployStackResult).not.toBeUndefined();
+        expect(mockLambdaClient).toHaveReceivedCommandWith(UpdateFunctionCodeCommand, {
+          FunctionName: 'root-function',
+          S3Bucket: 'new-bucket',
+          S3Key: 'current-key',
+        });
+      }
+    },
+  );
 
-  silentTest(`attempting to hotswap a newly created nested stack with the same logical ID as a resource with a different type results in a full deployment in CLASSIC mode
+  silentTest(
+    `attempting to hotswap a newly created nested stack with the same logical ID as a resource with a different type results in a full deployment in CLASSIC mode
         and a hotswap deployment in HOTSWAP_ONLY mode`,
-  async () => {
-    // GIVEN
-    hotswapMockSdkProvider = setup.setupHotswapNestedStackTests('NestedStackTypeChangeRoot');
-    mockUpdateLambdaCode = jest.fn().mockReturnValue({});
-    hotswapMockSdkProvider.stubLambda({
-      updateFunctionCode: mockUpdateLambdaCode,
-    });
-
-    const oldRootStack = testStack({
-      stackName: 'NestedStackTypeChangeRoot',
-      template: {
-        Resources: {
-          Func: {
-            Type: 'AWS::Lambda::Function',
-            Properties: {
-              Code: {
-                S3Bucket: 'current-bucket',
-                S3Key: 'current-key',
+    async () => {
+      // GIVEN
+      hotswapMockSdkProvider = setup.setupHotswapNestedStackTests('NestedStackTypeChangeRoot');
+
+      const oldRootStack = testStack({
+        stackName: 'NestedStackTypeChangeRoot',
+        template: {
+          Resources: {
+            Func: {
+              Type: 'AWS::Lambda::Function',
+              Properties: {
+                Code: {
+                  S3Bucket: 'current-bucket',
+                  S3Key: 'current-key',
+                },
+                FunctionName: 'root-function',
+              },
+              Metadata: {
+                'aws:asset:path': 'old-lambda-path',
               },
-              FunctionName: 'root-function',
-            },
-            Metadata: {
-              'aws:asset:path': 'old-lambda-path',
             },
-          },
-          FutureNestedStack: {
-            Type: 'AWS::Lambda::Function',
-            Properties: {
-              Code: {
-                S3Bucket: 'current-bucket',
-                S3Key: 'new-key',
+            FutureNestedStack: {
+              Type: 'AWS::Lambda::Function',
+              Properties: {
+                Code: {
+                  S3Bucket: 'current-bucket',
+                  S3Key: 'new-key',
+                },
+                FunctionName: 'spooky-function',
+              },
+              Metadata: {
+                'aws:asset:path': 'old-lambda-path',
               },
-              FunctionName: 'spooky-function',
-            },
-            Metadata: {
-              'aws:asset:path': 'old-lambda-path',
             },
           },
         },
-      },
-    });
-
-    setup.addTemplateToCloudFormationLookupMock(oldRootStack);
-
-    oldRootStack.template.Resources.Func.Properties.Code.S3Bucket = 'new-bucket';
-    oldRootStack.template.Resources.FutureNestedStack = {
-      Type: 'AWS::CloudFormation::Stack',
-      Properties: {
-        TemplateURL: 'https://www.amazon.com',
-      },
-      Metadata: {
-        'aws:asset:path': 'one-lambda-stack.nested.template.json',
-      },
-    };
-    // write the updated template to disk
-    const newRootStack = testStack({ stackName: oldRootStack.stackName, template: oldRootStack.template });
-
-    if (hotswapMode === HotswapMode.FALL_BACK) {
-      // WHEN
-      const deployStackResult = await hotswapMockSdkProvider.tryHotswapDeployment(hotswapMode, newRootStack);
-
-      // THEN
-      expect(deployStackResult).toBeUndefined();
-      expect(mockUpdateLambdaCode).not.toHaveBeenCalled();
+      });
 
-    } else if (hotswapMode === HotswapMode.HOTSWAP_ONLY) {
-      // WHEN
-      const deployStackResult = await hotswapMockSdkProvider.tryHotswapDeployment(hotswapMode, newRootStack);
+      setup.addTemplateToCloudFormationLookupMock(oldRootStack);
 
-      // THEN
-      expect(deployStackResult).not.toBeUndefined();
-      expect(mockUpdateLambdaCode).toHaveBeenCalledWith({
-        FunctionName: 'root-function',
-        S3Bucket: 'new-bucket',
-        S3Key: 'current-key',
-      });
-    }
-  });
+      oldRootStack.template.Resources.Func.Properties.Code.S3Bucket = 'new-bucket';
+      oldRootStack.template.Resources.FutureNestedStack = {
+        Type: 'AWS::CloudFormation::Stack',
+        Properties: {
+          TemplateURL: 'https://www.amazon.com',
+        },
+        Metadata: {
+          'aws:asset:path': 'one-lambda-stack.nested.template.json',
+        },
+      };
+      // write the updated template to disk
+      const newRootStack = testStack({ stackName: oldRootStack.stackName, template: oldRootStack.template });
+
+      if (hotswapMode === HotswapMode.FALL_BACK) {
+        // WHEN
+        const deployStackResult = await hotswapMockSdkProvider.tryHotswapDeployment(hotswapMode, newRootStack);
+
+        // THEN
+        expect(deployStackResult).toBeUndefined();
+        expect(mockLambdaClient).not.toHaveReceivedCommand(UpdateFunctionCodeCommand);
+      } else if (hotswapMode === HotswapMode.HOTSWAP_ONLY) {
+        // WHEN
+        const deployStackResult = await hotswapMockSdkProvider.tryHotswapDeployment(hotswapMode, newRootStack);
+
+        // THEN
+        expect(deployStackResult).not.toBeUndefined();
+        expect(mockLambdaClient).toHaveReceivedCommandWith(UpdateFunctionCodeCommand, {
+          FunctionName: 'root-function',
+          S3Bucket: 'new-bucket',
+          S3Key: 'current-key',
+        });
+      }
+    },
+  );
 
   silentTest('multi-sibling + 3-layer nested stack structure is hotswappable', async () => {
     // GIVEN
     hotswapMockSdkProvider = setup.setupHotswapNestedStackTests('MultiLayerRoot');
-    mockUpdateLambdaCode = jest.fn().mockReturnValue({});
-    hotswapMockSdkProvider.stubLambda({
-      updateFunctionCode: mockUpdateLambdaCode,
-    });
 
     const lambdaFunctionResource = {
       Type: 'AWS::Lambda::Function',
@@ -683,42 +686,56 @@ describe.each([HotswapMode.FALL_BACK, HotswapMode.HOTSWAP_ONLY])('%p mode', (hot
     });
     setup.addTemplateToCloudFormationLookupMock(oldChildStack);
 
-    setup.addTemplateToCloudFormationLookupMock(testStack({
-      stackName: 'GrandChildStackA',
-      template: {
-        Resources: {
-          Func: lambdaFunctionResource,
+    setup.addTemplateToCloudFormationLookupMock(
+      testStack({
+        stackName: 'GrandChildStackA',
+        template: {
+          Resources: {
+            Func: lambdaFunctionResource,
+          },
         },
-      },
-    }));
-    setup.addTemplateToCloudFormationLookupMock(testStack({
-      stackName: 'GrandChildStackB',
-      template: {
-        Resources: {
-          Func: lambdaFunctionResource,
+      }),
+    );
+    setup.addTemplateToCloudFormationLookupMock(
+      testStack({
+        stackName: 'GrandChildStackB',
+        template: {
+          Resources: {
+            Func: lambdaFunctionResource,
+          },
         },
-      },
-    }));
+      }),
+    );
 
-    setup.pushNestedStackResourceSummaries('MultiLayerRoot',
-      setup.stackSummaryOf('ChildStack', 'AWS::CloudFormation::Stack',
+    setup.pushNestedStackResourceSummaries(
+      'MultiLayerRoot',
+      setup.stackSummaryOf(
+        'ChildStack',
+        'AWS::CloudFormation::Stack',
         'arn:aws:cloudformation:bermuda-triangle-1337:123456789012:stack/ChildStack/abcd',
       ),
       setup.stackSummaryOf('Func', 'AWS::Lambda::Function', 'root-function'),
     );
-    setup.pushNestedStackResourceSummaries('ChildStack',
-      setup.stackSummaryOf('GrandChildStackA', 'AWS::CloudFormation::Stack',
+    setup.pushNestedStackResourceSummaries(
+      'ChildStack',
+      setup.stackSummaryOf(
+        'GrandChildStackA',
+        'AWS::CloudFormation::Stack',
         'arn:aws:cloudformation:bermuda-triangle-1337:123456789012:stack/GrandChildStackA/abcd',
       ),
-      setup.stackSummaryOf('GrandChildStackB', 'AWS::CloudFormation::Stack',
+      setup.stackSummaryOf(
+        'GrandChildStackB',
+        'AWS::CloudFormation::Stack',
         'arn:aws:cloudformation:bermuda-triangle-1337:123456789012:stack/GrandChildStackB/abcd',
       ),
       setup.stackSummaryOf('Func', 'AWS::Lambda::Function', 'child-function'),
     );
-    setup.pushNestedStackResourceSummaries('GrandChildStackA',
+    setup.pushNestedStackResourceSummaries(
+      'GrandChildStackA',
       setup.stackSummaryOf('Func', 'AWS::Lambda::Function', 'grandchild-A-function'),
     );
-    setup.pushNestedStackResourceSummaries('GrandChildStackB',
+    setup.pushNestedStackResourceSummaries(
+      'GrandChildStackB',
       setup.stackSummaryOf('Func', 'AWS::Lambda::Function', 'grandchild-B-function'),
     );
 
@@ -735,22 +752,22 @@ describe.each([HotswapMode.FALL_BACK, HotswapMode.HOTSWAP_ONLY])('%p mode', (hot
 
     // THEN
     expect(deployStackResult).not.toBeUndefined();
-    expect(mockUpdateLambdaCode).toHaveBeenCalledWith({
+    expect(mockLambdaClient).toHaveReceivedCommandWith(UpdateFunctionCodeCommand, {
       FunctionName: 'root-function',
       S3Bucket: 'current-bucket',
       S3Key: 'new-key',
     });
-    expect(mockUpdateLambdaCode).toHaveBeenCalledWith({
+    expect(mockLambdaClient).toHaveReceivedCommandWith(UpdateFunctionCodeCommand, {
       FunctionName: 'child-function',
       S3Bucket: 'current-bucket',
       S3Key: 'new-key',
     });
-    expect(mockUpdateLambdaCode).toHaveBeenCalledWith({
+    expect(mockLambdaClient).toHaveReceivedCommandWith(UpdateFunctionCodeCommand, {
       FunctionName: 'grandchild-A-function',
       S3Bucket: 'current-bucket',
       S3Key: 'new-key',
     });
-    expect(mockUpdateLambdaCode).toHaveBeenCalledWith({
+    expect(mockLambdaClient).toHaveReceivedCommandWith(UpdateFunctionCodeCommand, {
       FunctionName: 'grandchild-B-function',
       S3Bucket: 'current-bucket',
       S3Key: 'new-key',
@@ -760,10 +777,6 @@ describe.each([HotswapMode.FALL_BACK, HotswapMode.HOTSWAP_ONLY])('%p mode', (hot
   silentTest('can hotswap a lambda function in a 1-level nested stack with asset parameters', async () => {
     // GIVEN
     hotswapMockSdkProvider = setup.setupHotswapNestedStackTests('LambdaRoot');
-    mockUpdateLambdaCode = jest.fn().mockReturnValue({});
-    hotswapMockSdkProvider.stubLambda({
-      updateFunctionCode: mockUpdateLambdaCode,
-    });
 
     const rootStack = testStack({
       stackName: 'LambdaRoot',
@@ -801,29 +814,34 @@ describe.each([HotswapMode.FALL_BACK, HotswapMode.HOTSWAP_ONLY])('%p mode', (hot
     });
 
     setup.addTemplateToCloudFormationLookupMock(rootStack);
-    setup.addTemplateToCloudFormationLookupMock(testStack({
-      stackName: 'NestedStack',
-      template: {
-        Resources: {
-          Func: {
-            Type: 'AWS::Lambda::Function',
-            Properties: {
-              Code: {
-                S3Bucket: 'current-bucket',
-                S3Key: 'current-key',
+    setup.addTemplateToCloudFormationLookupMock(
+      testStack({
+        stackName: 'NestedStack',
+        template: {
+          Resources: {
+            Func: {
+              Type: 'AWS::Lambda::Function',
+              Properties: {
+                Code: {
+                  S3Bucket: 'current-bucket',
+                  S3Key: 'current-key',
+                },
+                FunctionName: 'my-function',
+              },
+              Metadata: {
+                'aws:asset:path': 'old-lambda-path',
               },
-              FunctionName: 'my-function',
-            },
-            Metadata: {
-              'aws:asset:path': 'old-lambda-path',
             },
           },
         },
-      },
-    }));
+      }),
+    );
 
-    setup.pushNestedStackResourceSummaries('LambdaRoot',
-      setup.stackSummaryOf('NestedStack', 'AWS::CloudFormation::Stack',
+    setup.pushNestedStackResourceSummaries(
+      'LambdaRoot',
+      setup.stackSummaryOf(
+        'NestedStack',
+        'AWS::CloudFormation::Stack',
         'arn:aws:cloudformation:bermuda-triangle-1337:123456789012:stack/NestedStack/abcd',
       ),
     );
@@ -838,266 +856,271 @@ describe.each([HotswapMode.FALL_BACK, HotswapMode.HOTSWAP_ONLY])('%p mode', (hot
 
     // THEN
     expect(deployStackResult).not.toBeUndefined();
-    expect(mockUpdateLambdaCode).toHaveBeenCalledWith({
+    expect(mockLambdaClient).toHaveReceivedCommandWith(UpdateFunctionCodeCommand, {
       FunctionName: 'my-function',
       S3Bucket: 'bucket-param-value',
       S3Key: 'key-param-value',
     });
   });
 
-  silentTest('can hotswap a lambda function in a 2-level nested stack with dependency on an output of 2nd level sibling stack', async () => {
-    // GIVEN: RootStack has one child stack `FirstLevelNestedStack` which further has two child stacks
-    // `NestedLambdaStack` and `NestedSiblingStack`. `NestedLambdaStack` takes two parameters s3Key
-    // and s3Bucket and use them for a Lambda function.
-    // RootStack resolves s3Bucket from a root template parameter and passed to FirstLevelRootStack which
-    // resolves s3Key through output of `NestedSiblingStack`
-    hotswapMockSdkProvider = setup.setupHotswapNestedStackTests('RootStack');
-    mockUpdateLambdaCode = jest.fn().mockReturnValue({});
-    hotswapMockSdkProvider.stubLambda({
-      updateFunctionCode: mockUpdateLambdaCode,
-    });
-
-    const oldRootStack = testStack({
-      stackName: 'RootStack',
-      template: {
-        Resources: {
-          FirstLevelNestedStack: {
-            Type: 'AWS::CloudFormation::Stack',
-            Properties: {
-              TemplateURL: 'https://www.magic-url.com',
-              Parameters: {
-                S3BucketParam: {
-                  Ref: 'S3BucketParam',
+  silentTest(
+    'can hotswap a lambda function in a 2-level nested stack with dependency on an output of 2nd level sibling stack',
+    async () => {
+      // GIVEN: RootStack has one child stack `FirstLevelNestedStack` which further has two child stacks
+      // `NestedLambdaStack` and `NestedSiblingStack`. `NestedLambdaStack` takes two parameters s3Key
+      // and s3Bucket and use them for a Lambda function.
+      // RootStack resolves s3Bucket from a root template parameter and passed to FirstLevelRootStack which
+      // resolves s3Key through output of `NestedSiblingStack`
+      hotswapMockSdkProvider = setup.setupHotswapNestedStackTests('RootStack');
+
+      const oldRootStack = testStack({
+        stackName: 'RootStack',
+        template: {
+          Resources: {
+            FirstLevelNestedStack: {
+              Type: 'AWS::CloudFormation::Stack',
+              Properties: {
+                TemplateURL: 'https://www.magic-url.com',
+                Parameters: {
+                  S3BucketParam: {
+                    Ref: 'S3BucketParam',
+                  },
                 },
               },
-            },
-            Metadata: {
-              'aws:asset:path': 'one-stack-with-two-nested-stacks-stack.template.json',
+              Metadata: {
+                'aws:asset:path': 'one-stack-with-two-nested-stacks-stack.template.json',
+              },
             },
           },
-        },
-        Parameters: {
-          S3BucketParam: {
-            Type: 'String',
-            Description: 'S3 bucket for asset',
+          Parameters: {
+            S3BucketParam: {
+              Type: 'String',
+              Description: 'S3 bucket for asset',
+            },
           },
         },
-      },
-    });
+      });
 
-    const oldFirstLevelNestedStack = testStack({
-      stackName: 'FirstLevelNestedStack',
-      template: {
-        Resources: {
-          NestedLambdaStack: {
-            Type: 'AWS::CloudFormation::Stack',
-            Properties: {
-              TemplateURL: 'https://www.magic-url.com',
-              Parameters: {
-                referenceToS3BucketParam: {
-                  Ref: 'S3BucketParam',
-                },
-                referenceToS3StackKeyOutput: {
-                  'Fn::GetAtt': [
-                    'NestedSiblingStack',
-                    'Outputs.NestedOutput',
-                  ],
+      const oldFirstLevelNestedStack = testStack({
+        stackName: 'FirstLevelNestedStack',
+        template: {
+          Resources: {
+            NestedLambdaStack: {
+              Type: 'AWS::CloudFormation::Stack',
+              Properties: {
+                TemplateURL: 'https://www.magic-url.com',
+                Parameters: {
+                  referenceToS3BucketParam: {
+                    Ref: 'S3BucketParam',
+                  },
+                  referenceToS3StackKeyOutput: {
+                    'Fn::GetAtt': ['NestedSiblingStack', 'Outputs.NestedOutput'],
+                  },
                 },
               },
+              Metadata: {
+                'aws:asset:path': 'one-lambda-stack-with-dependency-on-sibling-stack-output.nested.template.json',
+              },
             },
-            Metadata: {
-              'aws:asset:path': 'one-lambda-stack-with-dependency-on-sibling-stack-output.nested.template.json',
+            NestedSiblingStack: {
+              Type: 'AWS::CloudFormation::Stack',
+              Properties: {
+                TemplateURL: 'https://www.magic-url.com',
+              },
+              Metadata: {
+                'aws:asset:path': 'one-output-stack.nested.template.json',
+              },
             },
           },
-          NestedSiblingStack: {
-            Type: 'AWS::CloudFormation::Stack',
-            Properties: {
-              TemplateURL: 'https://www.magic-url.com',
+          Parameters: {
+            S3BucketParam: {
+              Type: 'String',
+              Description: 'S3 bucket for asset',
             },
-            Metadata: {
-              'aws:asset:path': 'one-output-stack.nested.template.json',
-            },
-          },
-        },
-        Parameters: {
-          S3BucketParam: {
-            Type: 'String',
-            Description: 'S3 bucket for asset',
           },
         },
-      },
-    });
+      });
 
-    const nestedLambdaStack = testStack({
-      stackName: 'NestedLambdaStack',
-      template: {
-        Resources: {
-          Func: {
-            Type: 'AWS::Lambda::Function',
-            Properties: {
-              Code: {
-                S3Bucket: 'current-bucket',
-                S3Key: 'current-key',
+      const nestedLambdaStack = testStack({
+        stackName: 'NestedLambdaStack',
+        template: {
+          Resources: {
+            Func: {
+              Type: 'AWS::Lambda::Function',
+              Properties: {
+                Code: {
+                  S3Bucket: 'current-bucket',
+                  S3Key: 'current-key',
+                },
+                FunctionName: 'my-function',
               },
-              FunctionName: 'my-function',
             },
           },
+          Metadata: {
+            'aws:asset:path': 'old-lambda-path',
+          },
         },
-        Metadata: {
-          'aws:asset:path': 'old-lambda-path',
-        },
-      },
-    });
+      });
 
-    const nestedSiblingStack = testStack({
-      stackName: 'NestedSiblingStack',
-      template: {
-        Outputs: {
-          NestedOutput: { Value: 's3-key-value-from-output' },
+      const nestedSiblingStack = testStack({
+        stackName: 'NestedSiblingStack',
+        template: {
+          Outputs: {
+            NestedOutput: { Value: 's3-key-value-from-output' },
+          },
         },
-      },
-    });
-
-    setup.addTemplateToCloudFormationLookupMock(oldRootStack);
-    setup.addTemplateToCloudFormationLookupMock(oldFirstLevelNestedStack);
-    setup.addTemplateToCloudFormationLookupMock(nestedLambdaStack);
-    setup.addTemplateToCloudFormationLookupMock(nestedSiblingStack);
-
-    setup.pushNestedStackResourceSummaries(oldRootStack.stackName,
-      setup.stackSummaryOf(oldFirstLevelNestedStack.stackName, 'AWS::CloudFormation::Stack',
-        `arn:aws:cloudformation:bermuda-triangle-1337:123456789012:stack/${oldFirstLevelNestedStack.stackName}/abcd`,
-      ),
-    );
-    setup.pushNestedStackResourceSummaries(oldFirstLevelNestedStack.stackName,
-      setup.stackSummaryOf(nestedLambdaStack.stackName, 'AWS::CloudFormation::Stack',
-        `arn:aws:cloudformation:bermuda-triangle-1337:123456789012:stack/${nestedLambdaStack.stackName}/abcd`,
-      ),
-      setup.stackSummaryOf(nestedSiblingStack.stackName, 'AWS::CloudFormation::Stack',
-        `arn:aws:cloudformation:bermuda-triangle-1337:123456789012:stack/${nestedSiblingStack.stackName}/abcd`,
-      ),
-    );
-    setup.pushNestedStackResourceSummaries(nestedLambdaStack.stackName,
-      setup.stackSummaryOf('Func', 'AWS::Lambda::Function', 'nested-lambda-function'),
-    );
-    setup.pushNestedStackResourceSummaries(nestedSiblingStack.stackName);
-    oldRootStack.template.Resources.FirstLevelNestedStack.Properties.TemplateURL = 'https://www.amazon.com';
-    oldFirstLevelNestedStack.template.Resources.NestedLambdaStack.Properties.TemplateURL = 'https://www.amazon.com';
-    oldFirstLevelNestedStack.template.Resources.NestedSiblingStack.Properties.TemplateURL = 'https://www.amazon.com';
-    const newRootStack = testStack({ stackName: oldRootStack.stackName, template: oldRootStack.template });
-    testStack({ stackName: oldFirstLevelNestedStack.stackName, template: oldFirstLevelNestedStack.template });
-
-    // WHEN
-    const deployStackResult = await hotswapMockSdkProvider.tryHotswapDeployment(hotswapMode, newRootStack, {
-      S3BucketParam: 'new-bucket',
-    });
+      });
 
-    // THEN
-    expect(deployStackResult).not.toBeUndefined();
-    expect(mockUpdateLambdaCode).toHaveBeenCalledWith({
-      FunctionName: 'my-function',
-      S3Bucket: 'new-bucket',
-      S3Key: 's3-key-value-from-output',
-    });
-  });
+      setup.addTemplateToCloudFormationLookupMock(oldRootStack);
+      setup.addTemplateToCloudFormationLookupMock(oldFirstLevelNestedStack);
+      setup.addTemplateToCloudFormationLookupMock(nestedLambdaStack);
+      setup.addTemplateToCloudFormationLookupMock(nestedSiblingStack);
+
+      setup.pushNestedStackResourceSummaries(
+        oldRootStack.stackName,
+        setup.stackSummaryOf(
+          oldFirstLevelNestedStack.stackName,
+          'AWS::CloudFormation::Stack',
+          `arn:aws:cloudformation:bermuda-triangle-1337:123456789012:stack/${oldFirstLevelNestedStack.stackName}/abcd`,
+        ),
+      );
+      setup.pushNestedStackResourceSummaries(
+        oldFirstLevelNestedStack.stackName,
+        setup.stackSummaryOf(
+          nestedLambdaStack.stackName,
+          'AWS::CloudFormation::Stack',
+          `arn:aws:cloudformation:bermuda-triangle-1337:123456789012:stack/${nestedLambdaStack.stackName}/abcd`,
+        ),
+        setup.stackSummaryOf(
+          nestedSiblingStack.stackName,
+          'AWS::CloudFormation::Stack',
+          `arn:aws:cloudformation:bermuda-triangle-1337:123456789012:stack/${nestedSiblingStack.stackName}/abcd`,
+        ),
+      );
+      setup.pushNestedStackResourceSummaries(
+        nestedLambdaStack.stackName,
+        setup.stackSummaryOf('Func', 'AWS::Lambda::Function', 'nested-lambda-function'),
+      );
+      setup.pushNestedStackResourceSummaries(nestedSiblingStack.stackName);
+      oldRootStack.template.Resources.FirstLevelNestedStack.Properties.TemplateURL = 'https://www.amazon.com';
+      oldFirstLevelNestedStack.template.Resources.NestedLambdaStack.Properties.TemplateURL = 'https://www.amazon.com';
+      oldFirstLevelNestedStack.template.Resources.NestedSiblingStack.Properties.TemplateURL = 'https://www.amazon.com';
+      const newRootStack = testStack({ stackName: oldRootStack.stackName, template: oldRootStack.template });
+      testStack({ stackName: oldFirstLevelNestedStack.stackName, template: oldFirstLevelNestedStack.template });
 
-  silentTest('can hotswap a lambda function in a 1-level nested stack and read default parameters value if not provided', async () => {
-    // GIVEN: RootStack has one child stack `NestedStack`. `NestedStack` takes two
-    // parameters s3Key and s3Bucket and use them for a Lambda function.
-    // RootStack resolves both parameters from root template parameters. Current/old change
-    // has hardcoded resolved values and the new change doesn't provide parameters through
-    // root stack forcing the evaluation of default parameter values.
-    hotswapMockSdkProvider = setup.setupHotswapNestedStackTests('LambdaRoot');
-    mockUpdateLambdaCode = jest.fn().mockReturnValue({});
-    hotswapMockSdkProvider.stubLambda({
-      updateFunctionCode: mockUpdateLambdaCode,
-    });
+      // WHEN
+      const deployStackResult = await hotswapMockSdkProvider.tryHotswapDeployment(hotswapMode, newRootStack, {
+        S3BucketParam: 'new-bucket',
+      });
 
-    const rootStack = testStack({
-      stackName: 'LambdaRoot',
-      template: {
-        Resources: {
-          NestedStack: {
-            Type: 'AWS::CloudFormation::Stack',
-            Properties: {
-              TemplateURL: 'https://www.magic-url.com',
-              Parameters: {
-                referencetoS3BucketParam: {
-                  Ref: 'S3BucketParam',
-                },
-                referencetoS3KeyParam: {
-                  Ref: 'S3KeyParam',
+      // THEN
+      expect(deployStackResult).not.toBeUndefined();
+      expect(mockLambdaClient).toHaveReceivedCommandWith(UpdateFunctionCodeCommand, {
+        FunctionName: 'my-function',
+        S3Bucket: 'new-bucket',
+        S3Key: 's3-key-value-from-output',
+      });
+    },
+  );
+
+  silentTest(
+    'can hotswap a lambda function in a 1-level nested stack and read default parameters value if not provided',
+    async () => {
+      // GIVEN: RootStack has one child stack `NestedStack`. `NestedStack` takes two
+      // parameters s3Key and s3Bucket and use them for a Lambda function.
+      // RootStack resolves both parameters from root template parameters. Current/old change
+      // has hardcoded resolved values and the new change doesn't provide parameters through
+      // root stack forcing the evaluation of default parameter values.
+      hotswapMockSdkProvider = setup.setupHotswapNestedStackTests('LambdaRoot');
+
+      const rootStack = testStack({
+        stackName: 'LambdaRoot',
+        template: {
+          Resources: {
+            NestedStack: {
+              Type: 'AWS::CloudFormation::Stack',
+              Properties: {
+                TemplateURL: 'https://www.magic-url.com',
+                Parameters: {
+                  referencetoS3BucketParam: {
+                    Ref: 'S3BucketParam',
+                  },
+                  referencetoS3KeyParam: {
+                    Ref: 'S3KeyParam',
+                  },
                 },
               },
+              Metadata: {
+                'aws:asset:path': 'one-lambda-stack-with-asset-parameters.nested.template.json',
+              },
             },
-            Metadata: {
-              'aws:asset:path': 'one-lambda-stack-with-asset-parameters.nested.template.json',
-            },
-          },
-        },
-        Parameters: {
-          S3BucketParam: {
-            Type: 'String',
-            Description: 'S3 bucket for asset',
-            Default: 'default-s3-bucket',
           },
-          S3KeyParam: {
-            Type: 'String',
-            Description: 'S3 bucket for asset',
-            Default: 'default-s3-key',
+          Parameters: {
+            S3BucketParam: {
+              Type: 'String',
+              Description: 'S3 bucket for asset',
+              Default: 'default-s3-bucket',
+            },
+            S3KeyParam: {
+              Type: 'String',
+              Description: 'S3 bucket for asset',
+              Default: 'default-s3-key',
+            },
           },
         },
-      },
-    });
+      });
 
-    setup.addTemplateToCloudFormationLookupMock(rootStack);
-    setup.addTemplateToCloudFormationLookupMock(testStack({
-      stackName: 'NestedStack',
-      template: {
-        Resources: {
-          Func: {
-            Type: 'AWS::Lambda::Function',
-            Properties: {
-              Code: {
-                S3Bucket: 'current-bucket',
-                S3Key: 'current-key',
+      setup.addTemplateToCloudFormationLookupMock(rootStack);
+      setup.addTemplateToCloudFormationLookupMock(
+        testStack({
+          stackName: 'NestedStack',
+          template: {
+            Resources: {
+              Func: {
+                Type: 'AWS::Lambda::Function',
+                Properties: {
+                  Code: {
+                    S3Bucket: 'current-bucket',
+                    S3Key: 'current-key',
+                  },
+                  FunctionName: 'my-function',
+                },
+                Metadata: {
+                  'aws:asset:path': 'old-lambda-path',
+                },
               },
-              FunctionName: 'my-function',
-            },
-            Metadata: {
-              'aws:asset:path': 'old-lambda-path',
             },
           },
-        },
-      },
-    }));
+        }),
+      );
 
-    setup.pushNestedStackResourceSummaries('LambdaRoot',
-      setup.stackSummaryOf('NestedStack', 'AWS::CloudFormation::Stack',
-        'arn:aws:cloudformation:bermuda-triangle-1337:123456789012:stack/NestedStack/abcd',
-      ),
-    );
+      setup.pushNestedStackResourceSummaries(
+        'LambdaRoot',
+        setup.stackSummaryOf(
+          'NestedStack',
+          'AWS::CloudFormation::Stack',
+          'arn:aws:cloudformation:bermuda-triangle-1337:123456789012:stack/NestedStack/abcd',
+        ),
+      );
 
-    rootStack.template.Resources.NestedStack.Properties.TemplateURL = 'https://www.amazon.com';
+      rootStack.template.Resources.NestedStack.Properties.TemplateURL = 'https://www.amazon.com';
 
-    // WHEN
-    const deployStackResult = await hotswapMockSdkProvider.tryHotswapDeployment(hotswapMode, rootStack);
+      // WHEN
+      const deployStackResult = await hotswapMockSdkProvider.tryHotswapDeployment(hotswapMode, rootStack);
 
-    // THEN
-    expect(deployStackResult).not.toBeUndefined();
-    expect(mockUpdateLambdaCode).toHaveBeenCalledWith({
-      FunctionName: 'my-function',
-      S3Bucket: 'default-s3-bucket',
-      S3Key: 'default-s3-key',
-    });
-  });
+      // THEN
+      expect(deployStackResult).not.toBeUndefined();
+      expect(mockLambdaClient).toHaveReceivedCommandWith(UpdateFunctionCodeCommand, {
+        FunctionName: 'my-function',
+        S3Bucket: 'default-s3-bucket',
+        S3Key: 'default-s3-key',
+      });
+    },
+  );
 
   silentTest('can hotswap a lambda function in a 2-level nested stack with asset parameters', async () => {
     // GIVEN
     hotswapMockSdkProvider = setup.setupHotswapNestedStackTests('LambdaRoot');
-    mockUpdateLambdaCode = jest.fn().mockReturnValue({});
-    hotswapMockSdkProvider.stubLambda({
-      updateFunctionCode: mockUpdateLambdaCode,
-    });
 
     const rootStack = testStack({
       stackName: 'LambdaRoot',
@@ -1180,35 +1203,43 @@ describe.each([HotswapMode.FALL_BACK, HotswapMode.HOTSWAP_ONLY])('%p mode', (hot
     });
     setup.addTemplateToCloudFormationLookupMock(childStack);
 
-    setup.addTemplateToCloudFormationLookupMock(testStack({
-      stackName: 'GrandChildStack',
-      template: {
-        Resources: {
-          Func: {
-            Type: 'AWS::Lambda::Function',
-            Properties: {
-              Code: {
-                S3Bucket: 'current-bucket',
-                S3Key: 'current-key',
+    setup.addTemplateToCloudFormationLookupMock(
+      testStack({
+        stackName: 'GrandChildStack',
+        template: {
+          Resources: {
+            Func: {
+              Type: 'AWS::Lambda::Function',
+              Properties: {
+                Code: {
+                  S3Bucket: 'current-bucket',
+                  S3Key: 'current-key',
+                },
+                FunctionName: 'my-function',
+              },
+              Metadata: {
+                'aws:asset:path': 'old-lambda-path',
               },
-              FunctionName: 'my-function',
-            },
-            Metadata: {
-              'aws:asset:path': 'old-lambda-path',
             },
           },
         },
-      },
-    }));
+      }),
+    );
 
-    setup.pushNestedStackResourceSummaries('LambdaRoot',
-      setup.stackSummaryOf('ChildStack', 'AWS::CloudFormation::Stack',
+    setup.pushNestedStackResourceSummaries(
+      'LambdaRoot',
+      setup.stackSummaryOf(
+        'ChildStack',
+        'AWS::CloudFormation::Stack',
         'arn:aws:cloudformation:bermuda-triangle-1337:123456789012:stack/ChildStack/abcd',
       ),
     );
 
-    setup.pushNestedStackResourceSummaries('ChildStack',
-      setup.stackSummaryOf('GrandChildStack', 'AWS::CloudFormation::Stack',
+    setup.pushNestedStackResourceSummaries(
+      'ChildStack',
+      setup.stackSummaryOf(
+        'GrandChildStack',
+        'AWS::CloudFormation::Stack',
         'arn:aws:cloudformation:bermuda-triangle-1337:123456789012:stack/GrandChildStack/abcd',
       ),
     );
@@ -1226,12 +1257,12 @@ describe.each([HotswapMode.FALL_BACK, HotswapMode.HOTSWAP_ONLY])('%p mode', (hot
 
     // THEN
     expect(deployStackResult).not.toBeUndefined();
-    expect(mockUpdateLambdaCode).toHaveBeenCalledWith({
+    expect(mockLambdaClient).toHaveReceivedCommandWith(UpdateFunctionCodeCommand, {
       FunctionName: 'my-function',
       S3Bucket: 'bucket-param-value',
       S3Key: 'key-param-value',
     });
-    expect(mockUpdateLambdaCode).toHaveBeenCalledWith({
+    expect(mockLambdaClient).toHaveReceivedCommandWith(UpdateFunctionCodeCommand, {
       FunctionName: 'my-function',
       S3Bucket: 'child-bucket-param-value',
       S3Key: 'child-key-param-value',
@@ -1240,12 +1271,6 @@ describe.each([HotswapMode.FALL_BACK, HotswapMode.HOTSWAP_ONLY])('%p mode', (hot
 
   silentTest('looking up objects in nested stacks works', async () => {
     hotswapMockSdkProvider = setup.setupHotswapNestedStackTests('LambdaRoot');
-    mockUpdateLambdaCode = jest.fn().mockReturnValue({});
-    mockPublishVersion = jest.fn();
-    hotswapMockSdkProvider.stubLambda({
-      updateFunctionCode: mockUpdateLambdaCode,
-      publishVersion: mockPublishVersion,
-    });
 
     const rootStack = testStack({
       stackName: 'LambdaRoot',
@@ -1265,32 +1290,37 @@ describe.each([HotswapMode.FALL_BACK, HotswapMode.HOTSWAP_ONLY])('%p mode', (hot
     });
 
     setup.addTemplateToCloudFormationLookupMock(rootStack);
-    setup.addTemplateToCloudFormationLookupMock(testStack({
-      stackName: 'NestedStack',
-      template: {
-        Resources: {
-          Func: {
-            Type: 'AWS::Lambda::Function',
-            Properties: {
-              Code: {
-                S3Bucket: 'current-bucket',
-                S3Key: 'current-key',
+    setup.addTemplateToCloudFormationLookupMock(
+      testStack({
+        stackName: 'NestedStack',
+        template: {
+          Resources: {
+            Func: {
+              Type: 'AWS::Lambda::Function',
+              Properties: {
+                Code: {
+                  S3Bucket: 'current-bucket',
+                  S3Key: 'current-key',
+                },
+                FunctionName: 'my-function',
               },
-              FunctionName: 'my-function',
             },
-          },
-          Version: {
-            Type: 'AWS::Lambda::Version',
-            Properties: {
-              FunctionName: { Ref: 'Func' },
+            Version: {
+              Type: 'AWS::Lambda::Version',
+              Properties: {
+                FunctionName: { Ref: 'Func' },
+              },
             },
           },
         },
-      },
-    }));
+      }),
+    );
 
-    setup.pushNestedStackResourceSummaries('LambdaRoot',
-      setup.stackSummaryOf('NestedStack', 'AWS::CloudFormation::Stack',
+    setup.pushNestedStackResourceSummaries(
+      'LambdaRoot',
+      setup.stackSummaryOf(
+        'NestedStack',
+        'AWS::CloudFormation::Stack',
         'arn:aws:cloudformation:bermuda-triangle-1337:123456789012:stack/NestedStack/abcd',
       ),
     );
@@ -1301,7 +1331,7 @@ describe.each([HotswapMode.FALL_BACK, HotswapMode.HOTSWAP_ONLY])('%p mode', (hot
 
     // THEN
     expect(deployStackResult).not.toBeUndefined();
-    expect(mockPublishVersion).toHaveBeenCalledWith({
+    expect(mockLambdaClient).toHaveReceivedCommandWith(PublishVersionCommand, {
       FunctionName: 'my-function',
     });
   });
diff --git a/packages/aws-cdk/test/api/hotswap/s3-bucket-hotswap-deployments.test.ts b/packages/aws-cdk/test/api/hotswap/s3-bucket-hotswap-deployments.test.ts
index 56432fcb6f603..e27c92062f979 100644
--- a/packages/aws-cdk/test/api/hotswap/s3-bucket-hotswap-deployments.test.ts
+++ b/packages/aws-cdk/test/api/hotswap/s3-bucket-hotswap-deployments.test.ts
@@ -1,10 +1,10 @@
-import { Lambda } from 'aws-sdk';
+import { InvokeCommand } from '@aws-sdk/client-lambda';
 import * as setup from './hotswap-test-setup';
 import { HotswapMode } from '../../../lib/api/hotswap/common';
 import { REQUIRED_BY_CFN } from '../../../lib/api/hotswap/s3-bucket-deployments';
+import { mockLambdaClient } from '../../util/mock-sdk';
 import { silentTest } from '../../util/silent';
 
-let mockLambdaInvoke: (params: Lambda.Types.InvocationRequest) => Lambda.Types.InvocationResponse;
 let hotswapMockSdkProvider: setup.HotswapMockSdkProvider;
 
 const payloadWithoutCustomResProps = {
@@ -18,150 +18,117 @@ const payloadWithoutCustomResProps = {
 
 beforeEach(() => {
   hotswapMockSdkProvider = setup.setupHotswapTests();
-  mockLambdaInvoke = jest.fn();
-  hotswapMockSdkProvider.setInvokeLambdaMock(mockLambdaInvoke);
 });
 
 describe.each([HotswapMode.FALL_BACK, HotswapMode.HOTSWAP_ONLY])('%p mode', (hotswapMode) => {
-  silentTest('calls the lambdaInvoke() API when it receives only an asset difference in an S3 bucket deployment and evaluates CFN expressions in S3 Deployment Properties', async () => {
-    // GIVEN
-    setup.setCurrentCfnStackTemplate({
-      Resources: {
-        S3Deployment: {
-          Type: 'Custom::CDKBucketDeployment',
-          Properties: {
-            ServiceToken: 'a-lambda-arn',
-            SourceBucketNames: ['src-bucket'],
-            SourceObjectKeys: ['src-key-old'],
-            DestinationBucketName: 'dest-bucket',
-            DestinationBucketKeyPrefix: 'my-key/some-old-prefix',
-          },
-        },
-      },
-    });
-    const cdkStackArtifact = setup.cdkStackArtifactOf({
-      template: {
+  silentTest(
+    'calls the lambdaInvoke() API when it receives only an asset difference in an S3 bucket deployment and evaluates CFN expressions in S3 Deployment Properties',
+    async () => {
+      // GIVEN
+      setup.setCurrentCfnStackTemplate({
         Resources: {
           S3Deployment: {
             Type: 'Custom::CDKBucketDeployment',
             Properties: {
               ServiceToken: 'a-lambda-arn',
               SourceBucketNames: ['src-bucket'],
-              SourceObjectKeys: {
-                'Fn::Split': [
-                  '-',
-                  'key1-key2-key3',
-                ],
-              },
+              SourceObjectKeys: ['src-key-old'],
               DestinationBucketName: 'dest-bucket',
-              DestinationBucketKeyPrefix: 'my-key/some-new-prefix',
+              DestinationBucketKeyPrefix: 'my-key/some-old-prefix',
             },
           },
         },
-      },
-    });
-
-    // WHEN
-    const deployStackResult = await hotswapMockSdkProvider.tryHotswapDeployment(hotswapMode, cdkStackArtifact);
-
-    // THEN
-    expect(deployStackResult).not.toBeUndefined();
-
-    expect(mockLambdaInvoke).toHaveBeenCalledWith({
-      FunctionName: 'a-lambda-arn',
-      Payload: JSON.stringify({
-        ...payloadWithoutCustomResProps,
-        ResourceProperties: {
-          SourceBucketNames: ['src-bucket'],
-          SourceObjectKeys: ['key1', 'key2', 'key3'],
-          DestinationBucketName: 'dest-bucket',
-          DestinationBucketKeyPrefix: 'my-key/some-new-prefix',
-        },
-      }),
-    });
-  });
-
-  silentTest('does not call the invoke() API when a resource with type that is not Custom::CDKBucketDeployment but has the same properties is changed', async () => {
-    // GIVEN
-    setup.setCurrentCfnStackTemplate({
-      Resources: {
-        S3Deployment: {
-          Type: 'Custom::NotCDKBucketDeployment',
-          Properties: {
-            SourceObjectKeys: ['src-key-old'],
-          },
-        },
-      },
-    });
-    const cdkStackArtifact = setup.cdkStackArtifactOf({
-      template: {
-        Resources: {
-          S3Deployment: {
-            Type: 'Custom::NotCDKBucketDeployment',
-            Properties: {
-              SourceObjectKeys: ['src-key-new'],
+      });
+      const cdkStackArtifact = setup.cdkStackArtifactOf({
+        template: {
+          Resources: {
+            S3Deployment: {
+              Type: 'Custom::CDKBucketDeployment',
+              Properties: {
+                ServiceToken: 'a-lambda-arn',
+                SourceBucketNames: ['src-bucket'],
+                SourceObjectKeys: {
+                  'Fn::Split': ['-', 'key1-key2-key3'],
+                },
+                DestinationBucketName: 'dest-bucket',
+                DestinationBucketKeyPrefix: 'my-key/some-new-prefix',
+              },
             },
           },
         },
-      },
-    });
-
-    if (hotswapMode === HotswapMode.FALL_BACK) {
-      // WHEN
-      const deployStackResult = await hotswapMockSdkProvider.tryHotswapDeployment(hotswapMode, cdkStackArtifact);
+      });
 
-      // THEN
-      expect(deployStackResult).toBeUndefined();
-      expect(mockLambdaInvoke).not.toHaveBeenCalled();
-    } else if (hotswapMode === HotswapMode.HOTSWAP_ONLY) {
       // WHEN
       const deployStackResult = await hotswapMockSdkProvider.tryHotswapDeployment(hotswapMode, cdkStackArtifact);
 
       // THEN
       expect(deployStackResult).not.toBeUndefined();
-      expect(deployStackResult?.noOp).toEqual(true);
-      expect(mockLambdaInvoke).not.toHaveBeenCalled();
-    }
-  });
-
-  silentTest('does not call the invokeLambda() api if the updated Policy has no Roles in CLASSIC mode but does in HOTSWAP_ONLY mode', async () => {
-    // GIVEN
-    setup.setCurrentCfnStackTemplate({
-      Parameters: {
-        WebsiteBucketParamOld: { Type: 'String' },
-        WebsiteBucketParamNew: { Type: 'String' },
-      },
-      Resources: {
-        S3Deployment: {
-          Type: 'Custom::CDKBucketDeployment',
-          Properties: {
-            ServiceToken: 'a-lambda-arn',
-            SourceObjectKeys: ['src-key-old'],
+      expect(mockLambdaClient).toHaveReceivedCommandWith(InvokeCommand, {
+        FunctionName: 'a-lambda-arn',
+        Payload: JSON.stringify({
+          ...payloadWithoutCustomResProps,
+          ResourceProperties: {
             SourceBucketNames: ['src-bucket'],
+            SourceObjectKeys: ['key1', 'key2', 'key3'],
             DestinationBucketName: 'dest-bucket',
+            DestinationBucketKeyPrefix: 'my-key/some-new-prefix',
+          },
+        }),
+      });
+    },
+  );
+
+  silentTest(
+    'does not call the invoke() API when a resource with type that is not Custom::CDKBucketDeployment but has the same properties is changed',
+    async () => {
+      // GIVEN
+      setup.setCurrentCfnStackTemplate({
+        Resources: {
+          S3Deployment: {
+            Type: 'Custom::NotCDKBucketDeployment',
+            Properties: {
+              SourceObjectKeys: ['src-key-old'],
+            },
           },
         },
-        Policy: {
-          Type: 'AWS::IAM::Policy',
-          Properties: {
-            PolicyName: 'my-policy',
-            PolicyDocument: {
-              Statement: [
-                {
-                  Action: ['s3:GetObject*'],
-                  Effect: 'Allow',
-                  Resource: {
-                    Ref: 'WebsiteBucketParamOld',
-                  },
-                },
-              ],
+      });
+      const cdkStackArtifact = setup.cdkStackArtifactOf({
+        template: {
+          Resources: {
+            S3Deployment: {
+              Type: 'Custom::NotCDKBucketDeployment',
+              Properties: {
+                SourceObjectKeys: ['src-key-new'],
+              },
             },
           },
         },
-      },
-    });
-    const cdkStackArtifact = setup.cdkStackArtifactOf({
-      template: {
+      });
+
+      if (hotswapMode === HotswapMode.FALL_BACK) {
+        // WHEN
+        const deployStackResult = await hotswapMockSdkProvider.tryHotswapDeployment(hotswapMode, cdkStackArtifact);
+
+        // THEN
+        expect(deployStackResult).toBeUndefined();
+        expect(mockLambdaClient).not.toHaveReceivedCommand(InvokeCommand);
+      } else if (hotswapMode === HotswapMode.HOTSWAP_ONLY) {
+        // WHEN
+        const deployStackResult = await hotswapMockSdkProvider.tryHotswapDeployment(hotswapMode, cdkStackArtifact);
+
+        // THEN
+        expect(deployStackResult).not.toBeUndefined();
+        expect(deployStackResult?.noOp).toEqual(true);
+        expect(mockLambdaClient).not.toHaveReceivedCommand(InvokeCommand);
+      }
+    },
+  );
+
+  silentTest(
+    'does not call the invokeLambda() api if the updated Policy has no Roles in CLASSIC mode but does in HOTSWAP_ONLY mode',
+    async () => {
+      // GIVEN
+      setup.setCurrentCfnStackTemplate({
         Parameters: {
           WebsiteBucketParamOld: { Type: 'String' },
           WebsiteBucketParamNew: { Type: 'String' },
@@ -171,7 +138,7 @@ describe.each([HotswapMode.FALL_BACK, HotswapMode.HOTSWAP_ONLY])('%p mode', (hot
             Type: 'Custom::CDKBucketDeployment',
             Properties: {
               ServiceToken: 'a-lambda-arn',
-              SourceObjectKeys: ['src-key-new'],
+              SourceObjectKeys: ['src-key-old'],
               SourceBucketNames: ['src-bucket'],
               DestinationBucketName: 'dest-bucket',
             },
@@ -186,7 +153,7 @@ describe.each([HotswapMode.FALL_BACK, HotswapMode.HOTSWAP_ONLY])('%p mode', (hot
                     Action: ['s3:GetObject*'],
                     Effect: 'Allow',
                     Resource: {
-                      Ref: 'WebsiteBucketParamNew',
+                      Ref: 'WebsiteBucketParamOld',
                     },
                   },
                 ],
@@ -194,35 +161,71 @@ describe.each([HotswapMode.FALL_BACK, HotswapMode.HOTSWAP_ONLY])('%p mode', (hot
             },
           },
         },
-      },
-    });
+      });
+      const cdkStackArtifact = setup.cdkStackArtifactOf({
+        template: {
+          Parameters: {
+            WebsiteBucketParamOld: { Type: 'String' },
+            WebsiteBucketParamNew: { Type: 'String' },
+          },
+          Resources: {
+            S3Deployment: {
+              Type: 'Custom::CDKBucketDeployment',
+              Properties: {
+                ServiceToken: 'a-lambda-arn',
+                SourceObjectKeys: ['src-key-new'],
+                SourceBucketNames: ['src-bucket'],
+                DestinationBucketName: 'dest-bucket',
+              },
+            },
+            Policy: {
+              Type: 'AWS::IAM::Policy',
+              Properties: {
+                PolicyName: 'my-policy',
+                PolicyDocument: {
+                  Statement: [
+                    {
+                      Action: ['s3:GetObject*'],
+                      Effect: 'Allow',
+                      Resource: {
+                        Ref: 'WebsiteBucketParamNew',
+                      },
+                    },
+                  ],
+                },
+              },
+            },
+          },
+        },
+      });
 
-    if (hotswapMode === HotswapMode.FALL_BACK) {
-      // WHEN
-      const deployStackResult = await hotswapMockSdkProvider.tryHotswapDeployment(hotswapMode, cdkStackArtifact);
+      if (hotswapMode === HotswapMode.FALL_BACK) {
+        // WHEN
+        const deployStackResult = await hotswapMockSdkProvider.tryHotswapDeployment(hotswapMode, cdkStackArtifact);
 
-      // THEN
-      expect(deployStackResult).toBeUndefined();
-      expect(mockLambdaInvoke).not.toHaveBeenCalled();
-    } else if (hotswapMode === HotswapMode.HOTSWAP_ONLY) {
-      // WHEN
-      const deployStackResult = await hotswapMockSdkProvider.tryHotswapDeployment(hotswapMode, cdkStackArtifact);
+        // THEN
+        expect(deployStackResult).toBeUndefined();
+        expect(mockLambdaClient).not.toHaveReceivedCommand(InvokeCommand);
+      } else if (hotswapMode === HotswapMode.HOTSWAP_ONLY) {
+        // WHEN
+        const deployStackResult = await hotswapMockSdkProvider.tryHotswapDeployment(hotswapMode, cdkStackArtifact);
 
-      // THEN
-      expect(deployStackResult).not.toBeUndefined();
-      expect(mockLambdaInvoke).toHaveBeenCalledWith({
-        FunctionName: 'a-lambda-arn',
-        Payload: JSON.stringify({
-          ...payloadWithoutCustomResProps,
-          ResourceProperties: {
-            SourceObjectKeys: ['src-key-new'],
-            SourceBucketNames: ['src-bucket'],
-            DestinationBucketName: 'dest-bucket',
-          },
-        }),
-      });
-    }
-  });
+        // THEN
+        expect(deployStackResult).not.toBeUndefined();
+        expect(mockLambdaClient).toHaveReceivedCommandWith(InvokeCommand, {
+          FunctionName: 'a-lambda-arn',
+          Payload: JSON.stringify({
+            ...payloadWithoutCustomResProps,
+            ResourceProperties: {
+              SourceObjectKeys: ['src-key-new'],
+              SourceBucketNames: ['src-bucket'],
+              DestinationBucketName: 'dest-bucket',
+            },
+          }),
+        });
+      }
+    },
+  );
 
   silentTest('throws an error when the serviceToken fails evaluation in the template', async () => {
     // GIVEN
@@ -260,11 +263,11 @@ describe.each([HotswapMode.FALL_BACK, HotswapMode.HOTSWAP_ONLY])('%p mode', (hot
     });
 
     // WHEN
-    await expect(() =>
-      hotswapMockSdkProvider.tryHotswapDeployment(hotswapMode, cdkStackArtifact),
-    ).rejects.toThrow(/Parameter or resource 'BadLamba' could not be found for evaluation/);
+    await expect(() => hotswapMockSdkProvider.tryHotswapDeployment(hotswapMode, cdkStackArtifact)).rejects.toThrow(
+      /Parameter or resource 'BadLamba' could not be found for evaluation/,
+    );
 
-    expect(mockLambdaInvoke).not.toHaveBeenCalled();
+    expect(mockLambdaClient).not.toHaveReceivedCommand(InvokeCommand);
   });
 
   describe('old-style synthesis', () => {
@@ -296,9 +299,7 @@ describe.each([HotswapMode.FALL_BACK, HotswapMode.HOTSWAP_ONLY])('%p mode', (hot
       Type: 'AWS::IAM::Policy',
       Properties: {
         PolicyName: 'my-policy-old',
-        Roles: [
-          { Ref: 'ServiceRole' },
-        ],
+        Roles: [{ Ref: 'ServiceRole' }],
         PolicyDocument: {
           Statement: [
             {
@@ -317,9 +318,7 @@ describe.each([HotswapMode.FALL_BACK, HotswapMode.HOTSWAP_ONLY])('%p mode', (hot
       Type: 'AWS::IAM::Policy',
       Properties: {
         PolicyName: 'my-policy-new',
-        Roles: [
-          { Ref: 'ServiceRole' },
-        ],
+        Roles: [{ Ref: 'ServiceRole' }],
         PolicyDocument: {
           Statement: [
             {
@@ -338,9 +337,7 @@ describe.each([HotswapMode.FALL_BACK, HotswapMode.HOTSWAP_ONLY])('%p mode', (hot
       Type: 'AWS::IAM::Policy',
       Properties: {
         PolicyName: 'my-policy-old-2',
-        Roles: [
-          { Ref: 'ServiceRole' },
-        ],
+        Roles: [{ Ref: 'ServiceRole' }],
         PolicyDocument: {
           Statement: [
             {
@@ -359,9 +356,7 @@ describe.each([HotswapMode.FALL_BACK, HotswapMode.HOTSWAP_ONLY])('%p mode', (hot
       Type: 'AWS::IAM::Policy',
       Properties: {
         PolicyName: 'my-policy-new-2',
-        Roles: [
-          { Ref: 'ServiceRole2' },
-        ],
+        Roles: [{ Ref: 'ServiceRole2' }],
         PolicyDocument: {
           Statement: [
             {
@@ -379,10 +374,7 @@ describe.each([HotswapMode.FALL_BACK, HotswapMode.HOTSWAP_ONLY])('%p mode', (hot
     const deploymentLambda = {
       Type: 'AWS::Lambda::Function',
       Role: {
-        'Fn::GetAtt': [
-          'ServiceRole',
-          'Arn',
-        ],
+        'Fn::GetAtt': ['ServiceRole', 'Arn'],
       },
     };
 
@@ -390,10 +382,7 @@ describe.each([HotswapMode.FALL_BACK, HotswapMode.HOTSWAP_ONLY])('%p mode', (hot
       Type: 'Custom::CDKBucketDeployment',
       Properties: {
         ServiceToken: {
-          'Fn::GetAtt': [
-            'S3DeploymentLambda',
-            'Arn',
-          ],
+          'Fn::GetAtt': ['S3DeploymentLambda', 'Arn'],
         },
         SourceBucketNames: ['src-bucket-old'],
         SourceObjectKeys: ['src-key-old'],
@@ -405,10 +394,7 @@ describe.each([HotswapMode.FALL_BACK, HotswapMode.HOTSWAP_ONLY])('%p mode', (hot
       Type: 'Custom::CDKBucketDeployment',
       Properties: {
         ServiceToken: {
-          'Fn::GetAtt': [
-            'S3DeploymentLambda',
-            'Arn',
-          ],
+          'Fn::GetAtt': ['S3DeploymentLambda', 'Arn'],
         },
         SourceBucketNames: ['src-bucket-new'],
         SourceObjectKeys: ['src-key-new'],
@@ -423,110 +409,42 @@ describe.each([HotswapMode.FALL_BACK, HotswapMode.HOTSWAP_ONLY])('%p mode', (hot
       );
     });
 
-    silentTest('calls the lambdaInvoke() API when it receives an asset difference in an S3 bucket deployment and an IAM Policy difference using old-style synthesis', async () => {
-      // GIVEN
-      setup.setCurrentCfnStackTemplate({
-        Resources: {
-          Parameters: parameters,
-          ServiceRole: serviceRole,
-          Policy: policyOld,
-          S3DeploymentLambda: deploymentLambda,
-          S3Deployment: s3DeploymentOld,
-        },
-      });
-
-      const cdkStackArtifact = setup.cdkStackArtifactOf({
-        template: {
+    silentTest(
+      'calls the lambdaInvoke() API when it receives an asset difference in an S3 bucket deployment and an IAM Policy difference using old-style synthesis',
+      async () => {
+        // GIVEN
+        setup.setCurrentCfnStackTemplate({
           Resources: {
             Parameters: parameters,
             ServiceRole: serviceRole,
-            Policy: policyNew,
+            Policy: policyOld,
             S3DeploymentLambda: deploymentLambda,
-            S3Deployment: s3DeploymentNew,
-          },
-        },
-      });
-
-      // WHEN
-      const deployStackResult = await hotswapMockSdkProvider.tryHotswapDeployment(hotswapMode, cdkStackArtifact, { WebsiteBucketParamOld: 'WebsiteBucketOld', WebsiteBucketParamNew: 'WebsiteBucketNew' });
-
-      // THEN
-      expect(deployStackResult).not.toBeUndefined();
-      expect(mockLambdaInvoke).toHaveBeenCalledWith({
-        FunctionName: 'arn:aws:lambda:here:123456789012:function:my-deployment-lambda',
-        Payload: JSON.stringify({
-          ...payloadWithoutCustomResProps,
-          ResourceProperties: {
-            SourceBucketNames: ['src-bucket-new'],
-            SourceObjectKeys: ['src-key-new'],
-            DestinationBucketName: 'WebsiteBucketNew',
+            S3Deployment: s3DeploymentOld,
           },
-        }),
-      });
-    });
-
-    silentTest(`does not call the lambdaInvoke() API when the difference in the S3 deployment is referred to in one IAM policy change but not another
-          in CLASSIC mode but does in HOTSWAP_ONLY`,
-    async () => {
-      // GIVEN
-      setup.setCurrentCfnStackTemplate({
-        Resources: {
-          ServiceRole: serviceRole,
-          Policy1: policyOld,
-          Policy2: policy2Old,
-          S3DeploymentLambda: deploymentLambda,
-          S3Deployment: s3DeploymentOld,
-        },
-      });
+        });
 
-      const cdkStackArtifact = setup.cdkStackArtifactOf({
-        template: {
-          Resources: {
-            ServiceRole: serviceRole,
-            Policy1: policyNew,
-            Policy2: {
-              Properties: {
-                Roles: [
-                  { Ref: 'ServiceRole' },
-                  'different-role',
-                ],
-                PolicyDocument: {
-                  Statement: [
-                    {
-                      Action: ['s3:GetObject*'],
-                      Effect: 'Allow',
-                      Resource: {
-                        'Fn::GetAtt': [
-                          'DifferentBucketNew',
-                          'Arn',
-                        ],
-                      },
-                    },
-                  ],
-                },
-              },
+        const cdkStackArtifact = setup.cdkStackArtifactOf({
+          template: {
+            Resources: {
+              Parameters: parameters,
+              ServiceRole: serviceRole,
+              Policy: policyNew,
+              S3DeploymentLambda: deploymentLambda,
+              S3Deployment: s3DeploymentNew,
             },
-            S3DeploymentLambda: deploymentLambda,
-            S3Deployment: s3DeploymentNew,
           },
-        },
-      });
-
-      if (hotswapMode === HotswapMode.FALL_BACK) {
-        // WHEN
-        const deployStackResult = await hotswapMockSdkProvider.tryHotswapDeployment(hotswapMode, cdkStackArtifact);
+        });
 
-        // THEN
-        expect(deployStackResult).toBeUndefined();
-        expect(mockLambdaInvoke).not.toHaveBeenCalled();
-      } else if (hotswapMode === HotswapMode.HOTSWAP_ONLY) {
         // WHEN
-        const deployStackResult = await hotswapMockSdkProvider.tryHotswapDeployment(hotswapMode, cdkStackArtifact);
+        const deployStackResult = await hotswapMockSdkProvider.tryHotswapDeployment(hotswapMode, cdkStackArtifact, {
+          WebsiteBucketParamOld: 'WebsiteBucketOld',
+          WebsiteBucketParamNew: 'WebsiteBucketNew',
+        });
 
         // THEN
         expect(deployStackResult).not.toBeUndefined();
-        expect(mockLambdaInvoke).toHaveBeenCalledWith({
-          FunctionName: 'arn:aws:lambda:here:123456789012:function:my-deployment-lambda',
+        expect(mockLambdaClient).toHaveReceivedCommandWith(InvokeCommand, {
+          FunctionName: 'arn:swa:lambda:here:123456789012:function:my-deployment-lambda',
           Payload: JSON.stringify({
             ...payloadWithoutCustomResProps,
             ResourceProperties: {
@@ -536,267 +454,239 @@ describe.each([HotswapMode.FALL_BACK, HotswapMode.HOTSWAP_ONLY])('%p mode', (hot
             },
           }),
         });
-      }
-    });
+      },
+    );
 
-    silentTest(`does not call the lambdaInvoke() API when the lambda that references the role is referred to by something other than an S3 deployment
-          in CLASSIC mode but does in HOTSWAP_ONLY mode`,
-    async () => {
-      // GIVEN
-      setup.setCurrentCfnStackTemplate({
-        Resources: {
-          ServiceRole: serviceRole,
-          Policy: policyOld,
-          S3DeploymentLambda: deploymentLambda,
-          S3Deployment: s3DeploymentOld,
-          Endpoint: {
-            Type: 'AWS::Lambda::Permission',
-            Properties: {
-              Action: 'lambda:InvokeFunction',
-              FunctionName: {
-                'Fn::GetAtt': [
-                  'S3DeploymentLambda',
-                  'Arn',
-                ],
+    silentTest(
+      `does not call the lambdaInvoke() API when the difference in the S3 deployment is referred to in one IAM policy change but not another
+          in CLASSIC mode but does in HOTSWAP_ONLY`,
+      async () => {
+        // GIVEN
+        setup.setCurrentCfnStackTemplate({
+          Resources: {
+            ServiceRole: serviceRole,
+            Policy1: policyOld,
+            Policy2: policy2Old,
+            S3DeploymentLambda: deploymentLambda,
+            S3Deployment: s3DeploymentOld,
+          },
+        });
+
+        const cdkStackArtifact = setup.cdkStackArtifactOf({
+          template: {
+            Resources: {
+              ServiceRole: serviceRole,
+              Policy1: policyNew,
+              Policy2: {
+                Properties: {
+                  Roles: [{ Ref: 'ServiceRole' }, 'different-role'],
+                  PolicyDocument: {
+                    Statement: [
+                      {
+                        Action: ['s3:GetObject*'],
+                        Effect: 'Allow',
+                        Resource: {
+                          'Fn::GetAtt': ['DifferentBucketNew', 'Arn'],
+                        },
+                      },
+                    ],
+                  },
+                },
               },
-              Principal: 'apigateway.amazonaws.com',
+              S3DeploymentLambda: deploymentLambda,
+              S3Deployment: s3DeploymentNew,
             },
           },
-        },
-      });
+        });
 
-      const cdkStackArtifact = setup.cdkStackArtifactOf({
-        template: {
+        if (hotswapMode === HotswapMode.FALL_BACK) {
+          // WHEN
+          const deployStackResult = await hotswapMockSdkProvider.tryHotswapDeployment(hotswapMode, cdkStackArtifact);
+
+          // THEN
+          expect(deployStackResult).toBeUndefined();
+          expect(mockLambdaClient).not.toHaveReceivedCommand(InvokeCommand);
+        } else if (hotswapMode === HotswapMode.HOTSWAP_ONLY) {
+          // WHEN
+          const deployStackResult = await hotswapMockSdkProvider.tryHotswapDeployment(hotswapMode, cdkStackArtifact);
+
+          // THEN
+          expect(deployStackResult).not.toBeUndefined();
+          expect(mockLambdaClient).toHaveReceivedCommandWith(InvokeCommand, {
+            FunctionName: 'arn:swa:lambda:here:123456789012:function:my-deployment-lambda',
+            Payload: JSON.stringify({
+              ...payloadWithoutCustomResProps,
+              ResourceProperties: {
+                SourceBucketNames: ['src-bucket-new'],
+                SourceObjectKeys: ['src-key-new'],
+                DestinationBucketName: 'WebsiteBucketNew',
+              },
+            }),
+          });
+        }
+      },
+    );
+
+    silentTest(
+      `does not call the lambdaInvoke() API when the lambda that references the role is referred to by something other than an S3 deployment
+          in CLASSIC mode but does in HOTSWAP_ONLY mode`,
+      async () => {
+        // GIVEN
+        setup.setCurrentCfnStackTemplate({
           Resources: {
             ServiceRole: serviceRole,
-            Policy: policyNew,
+            Policy: policyOld,
             S3DeploymentLambda: deploymentLambda,
-            S3Deployment: s3DeploymentNew,
+            S3Deployment: s3DeploymentOld,
             Endpoint: {
               Type: 'AWS::Lambda::Permission',
               Properties: {
                 Action: 'lambda:InvokeFunction',
                 FunctionName: {
-                  'Fn::GetAtt': [
-                    'S3DeploymentLambda',
-                    'Arn',
-                  ],
+                  'Fn::GetAtt': ['S3DeploymentLambda', 'Arn'],
                 },
                 Principal: 'apigateway.amazonaws.com',
               },
             },
           },
-        },
-      });
-
-      if (hotswapMode === HotswapMode.FALL_BACK) {
-        // WHEN
-        const deployStackResult = await hotswapMockSdkProvider.tryHotswapDeployment(hotswapMode, cdkStackArtifact);
-
-        // THEN
-        expect(deployStackResult).toBeUndefined();
-        expect(mockLambdaInvoke).not.toHaveBeenCalled();
-      } else if (hotswapMode === HotswapMode.HOTSWAP_ONLY) {
-        // WHEN
-        const deployStackResult = await hotswapMockSdkProvider.tryHotswapDeployment(hotswapMode, cdkStackArtifact);
+        });
 
-        // THEN
-        expect(deployStackResult).not.toBeUndefined();
-        expect(mockLambdaInvoke).toHaveBeenCalledWith({
-          FunctionName: 'arn:aws:lambda:here:123456789012:function:my-deployment-lambda',
-          Payload: JSON.stringify({
-            ...payloadWithoutCustomResProps,
-            ResourceProperties: {
-              SourceBucketNames: ['src-bucket-new'],
-              SourceObjectKeys: ['src-key-new'],
-              DestinationBucketName: 'WebsiteBucketNew',
+        const cdkStackArtifact = setup.cdkStackArtifactOf({
+          template: {
+            Resources: {
+              ServiceRole: serviceRole,
+              Policy: policyNew,
+              S3DeploymentLambda: deploymentLambda,
+              S3Deployment: s3DeploymentNew,
+              Endpoint: {
+                Type: 'AWS::Lambda::Permission',
+                Properties: {
+                  Action: 'lambda:InvokeFunction',
+                  FunctionName: {
+                    'Fn::GetAtt': ['S3DeploymentLambda', 'Arn'],
+                  },
+                  Principal: 'apigateway.amazonaws.com',
+                },
+              },
             },
-          }),
+          },
         });
-      }
-    });
 
-    silentTest('calls the lambdaInvoke() API when it receives an asset difference in two S3 bucket deployments and IAM Policy differences using old-style synthesis', async () => {
-      // GIVEN
-      const deploymentLambda2Old = {
-        Type: 'AWS::Lambda::Function',
-        Role: {
-          'Fn::GetAtt': [
-            'ServiceRole',
-            'Arn',
-          ],
-        },
-      };
-
-      const deploymentLambda2New = {
-        Type: 'AWS::Lambda::Function',
-        Role: {
-          'Fn::GetAtt': [
-            'ServiceRole2',
-            'Arn',
-          ],
-        },
-      };
-
-      const s3Deployment2Old = {
-        Type: 'Custom::CDKBucketDeployment',
-        Properties: {
-          ServiceToken: {
-            'Fn::GetAtt': [
-              'S3DeploymentLambda2',
-              'Arn',
-            ],
-          },
-          SourceBucketNames: ['src-bucket-old'],
-          SourceObjectKeys: ['src-key-old'],
-          DestinationBucketName: 'DifferentBucketOld',
-        },
-      };
-
-      const s3Deployment2New = {
-        Type: 'Custom::CDKBucketDeployment',
-        Properties: {
-          ServiceToken: {
-            'Fn::GetAtt': [
-              'S3DeploymentLambda2',
-              'Arn',
-            ],
+        if (hotswapMode === HotswapMode.FALL_BACK) {
+          // WHEN
+          const deployStackResult = await hotswapMockSdkProvider.tryHotswapDeployment(hotswapMode, cdkStackArtifact);
+
+          // THEN
+          expect(deployStackResult).toBeUndefined();
+          expect(mockLambdaClient).not.toHaveReceivedCommand(InvokeCommand);
+        } else if (hotswapMode === HotswapMode.HOTSWAP_ONLY) {
+          // WHEN
+          const deployStackResult = await hotswapMockSdkProvider.tryHotswapDeployment(hotswapMode, cdkStackArtifact);
+
+          // THEN
+          expect(deployStackResult).not.toBeUndefined();
+          expect(mockLambdaClient).toHaveReceivedCommandWith(InvokeCommand, {
+            FunctionName: 'arn:swa:lambda:here:123456789012:function:my-deployment-lambda',
+            Payload: JSON.stringify({
+              ...payloadWithoutCustomResProps,
+              ResourceProperties: {
+                SourceBucketNames: ['src-bucket-new'],
+                SourceObjectKeys: ['src-key-new'],
+                DestinationBucketName: 'WebsiteBucketNew',
+              },
+            }),
+          });
+        }
+      },
+    );
+
+    silentTest(
+      'calls the lambdaInvoke() API when it receives an asset difference in two S3 bucket deployments and IAM Policy differences using old-style synthesis',
+      async () => {
+        // GIVEN
+        const deploymentLambda2Old = {
+          Type: 'AWS::Lambda::Function',
+          Role: {
+            'Fn::GetAtt': ['ServiceRole', 'Arn'],
           },
-          SourceBucketNames: ['src-bucket-new'],
-          SourceObjectKeys: ['src-key-new'],
-          DestinationBucketName: 'DifferentBucketNew',
-        },
-      };
-
-      setup.setCurrentCfnStackTemplate({
-        Resources: {
-          ServiceRole: serviceRole,
-          ServiceRole2: serviceRole,
-          Policy1: policyOld,
-          Policy2: policy2Old,
-          S3DeploymentLambda: deploymentLambda,
-          S3DeploymentLambda2: deploymentLambda2Old,
-          S3Deployment: s3DeploymentOld,
-          S3Deployment2: s3Deployment2Old,
-        },
-      });
+        };
 
-      const cdkStackArtifact = setup.cdkStackArtifactOf({
-        template: {
-          Resources: {
-            Parameters: parameters,
-            ServiceRole: serviceRole,
-            ServiceRole2: serviceRole,
-            Policy1: policyNew,
-            Policy2: policy2New,
-            S3DeploymentLambda: deploymentLambda,
-            S3DeploymentLambda2: deploymentLambda2New,
-            S3Deployment: s3DeploymentNew,
-            S3Deployment2: s3Deployment2New,
+        const deploymentLambda2New = {
+          Type: 'AWS::Lambda::Function',
+          Role: {
+            'Fn::GetAtt': ['ServiceRole2', 'Arn'],
           },
-        },
-      });
+        };
 
-      // WHEN
-      setup.pushStackResourceSummaries(
-        setup.stackSummaryOf('S3DeploymentLambda2', 'AWS::Lambda::Function', 'my-deployment-lambda-2'),
-        setup.stackSummaryOf('ServiceRole2', 'AWS::IAM::Role', 'my-service-role-2'),
-      );
-
-      const deployStackResult = await hotswapMockSdkProvider.tryHotswapDeployment(hotswapMode, cdkStackArtifact, {
-        WebsiteBucketParamOld: 'WebsiteBucketOld',
-        WebsiteBucketParamNew: 'WebsiteBucketNew',
-        DifferentBucketParamNew: 'WebsiteBucketNew',
-      });
-
-      // THEN
-      expect(deployStackResult).not.toBeUndefined();
-      expect(mockLambdaInvoke).toHaveBeenCalledWith({
-        FunctionName: 'arn:aws:lambda:here:123456789012:function:my-deployment-lambda',
-        Payload: JSON.stringify({
-          ...payloadWithoutCustomResProps,
-          ResourceProperties: {
-            SourceBucketNames: ['src-bucket-new'],
-            SourceObjectKeys: ['src-key-new'],
-            DestinationBucketName: 'WebsiteBucketNew',
+        const s3Deployment2Old = {
+          Type: 'Custom::CDKBucketDeployment',
+          Properties: {
+            ServiceToken: {
+              'Fn::GetAtt': ['S3DeploymentLambda2', 'Arn'],
+            },
+            SourceBucketNames: ['src-bucket-old'],
+            SourceObjectKeys: ['src-key-old'],
+            DestinationBucketName: 'DifferentBucketOld',
           },
-        }),
-      });
+        };
 
-      expect(mockLambdaInvoke).toHaveBeenCalledWith({
-        FunctionName: 'arn:aws:lambda:here:123456789012:function:my-deployment-lambda-2',
-        Payload: JSON.stringify({
-          ...payloadWithoutCustomResProps,
-          ResourceProperties: {
+        const s3Deployment2New = {
+          Type: 'Custom::CDKBucketDeployment',
+          Properties: {
+            ServiceToken: {
+              'Fn::GetAtt': ['S3DeploymentLambda2', 'Arn'],
+            },
             SourceBucketNames: ['src-bucket-new'],
             SourceObjectKeys: ['src-key-new'],
             DestinationBucketName: 'DifferentBucketNew',
           },
-        }),
-      });
-    });
+        };
 
-    silentTest(`does not call the lambdaInvoke() API when it receives an asset difference in an S3 bucket deployment that references two different policies
-          in CLASSIC mode but does in HOTSWAP_ONLY mode`,
-    async () => {
-      // GIVEN
-      setup.setCurrentCfnStackTemplate({
-        Resources: {
-          ServiceRole: serviceRole,
-          Policy1: policyOld,
-          Policy2: policy2Old,
-          S3DeploymentLambda: deploymentLambda,
-          S3Deployment: s3DeploymentOld,
-        },
-      });
-
-      const cdkStackArtifact = setup.cdkStackArtifactOf({
-        template: {
+        setup.setCurrentCfnStackTemplate({
           Resources: {
             ServiceRole: serviceRole,
-            Policy1: policyNew,
-            Policy2: {
-              Properties: {
-                Roles: [
-                  { Ref: 'ServiceRole' },
-                ],
-                PolicyDocument: {
-                  Statement: [
-                    {
-                      Action: ['s3:GetObject*'],
-                      Effect: 'Allow',
-                      Resource: {
-                        'Fn::GetAtt': [
-                          'DifferentBucketNew',
-                          'Arn',
-                        ],
-                      },
-                    },
-                  ],
-                },
-              },
-            },
+            ServiceRole2: serviceRole,
+            Policy1: policyOld,
+            Policy2: policy2Old,
             S3DeploymentLambda: deploymentLambda,
-            S3Deployment: s3DeploymentNew,
+            S3DeploymentLambda2: deploymentLambda2Old,
+            S3Deployment: s3DeploymentOld,
+            S3Deployment2: s3Deployment2Old,
           },
-        },
-      });
+        });
 
-      if (hotswapMode === HotswapMode.FALL_BACK) {
-        // WHEN
-        const deployStackResult = await hotswapMockSdkProvider.tryHotswapDeployment(hotswapMode, cdkStackArtifact);
+        const cdkStackArtifact = setup.cdkStackArtifactOf({
+          template: {
+            Resources: {
+              Parameters: parameters,
+              ServiceRole: serviceRole,
+              ServiceRole2: serviceRole,
+              Policy1: policyNew,
+              Policy2: policy2New,
+              S3DeploymentLambda: deploymentLambda,
+              S3DeploymentLambda2: deploymentLambda2New,
+              S3Deployment: s3DeploymentNew,
+              S3Deployment2: s3Deployment2New,
+            },
+          },
+        });
 
-        // THEN
-        expect(deployStackResult).toBeUndefined();
-        expect(mockLambdaInvoke).not.toHaveBeenCalled();
-      } else if (hotswapMode === HotswapMode.HOTSWAP_ONLY) {
         // WHEN
-        const deployStackResult = await hotswapMockSdkProvider.tryHotswapDeployment(hotswapMode, cdkStackArtifact);
+        setup.pushStackResourceSummaries(
+          setup.stackSummaryOf('S3DeploymentLambda2', 'AWS::Lambda::Function', 'my-deployment-lambda-2'),
+          setup.stackSummaryOf('ServiceRole2', 'AWS::IAM::Role', 'my-service-role-2'),
+        );
+
+        const deployStackResult = await hotswapMockSdkProvider.tryHotswapDeployment(hotswapMode, cdkStackArtifact, {
+          WebsiteBucketParamOld: 'WebsiteBucketOld',
+          WebsiteBucketParamNew: 'WebsiteBucketNew',
+          DifferentBucketParamNew: 'WebsiteBucketNew',
+        });
 
         // THEN
         expect(deployStackResult).not.toBeUndefined();
-        expect(mockLambdaInvoke).toHaveBeenCalledWith({
-          FunctionName: 'arn:aws:lambda:here:123456789012:function:my-deployment-lambda',
+        expect(mockLambdaClient).toHaveReceivedCommandWith(InvokeCommand, {
+          FunctionName: 'arn:swa:lambda:here:123456789012:function:my-deployment-lambda',
           Payload: JSON.stringify({
             ...payloadWithoutCustomResProps,
             ResourceProperties: {
@@ -806,37 +696,102 @@ describe.each([HotswapMode.FALL_BACK, HotswapMode.HOTSWAP_ONLY])('%p mode', (hot
             },
           }),
         });
-      }
-    });
 
-    silentTest(`does not call the lambdaInvoke() API when a policy is referenced by a resource that is not an S3 deployment
+        expect(mockLambdaClient).toHaveReceivedCommandWith(InvokeCommand, {
+          FunctionName: 'arn:swa:lambda:here:123456789012:function:my-deployment-lambda-2',
+          Payload: JSON.stringify({
+            ...payloadWithoutCustomResProps,
+            ResourceProperties: {
+              SourceBucketNames: ['src-bucket-new'],
+              SourceObjectKeys: ['src-key-new'],
+              DestinationBucketName: 'DifferentBucketNew',
+            },
+          }),
+        });
+      },
+    );
+
+    silentTest(
+      `does not call the lambdaInvoke() API when it receives an asset difference in an S3 bucket deployment that references two different policies
           in CLASSIC mode but does in HOTSWAP_ONLY mode`,
-    async () => {
-      // GIVEN
-      setup.setCurrentCfnStackTemplate({
-        Resources: {
-          ServiceRole: serviceRole,
-          Policy1: policyOld,
-          S3DeploymentLambda: deploymentLambda,
-          S3Deployment: s3DeploymentOld,
-          NotADeployment: {
-            Type: 'AWS::Not::S3Deployment',
-            Properties: {
-              Prop: {
-                Ref: 'ServiceRole',
+      async () => {
+        // GIVEN
+        setup.setCurrentCfnStackTemplate({
+          Resources: {
+            ServiceRole: serviceRole,
+            Policy1: policyOld,
+            Policy2: policy2Old,
+            S3DeploymentLambda: deploymentLambda,
+            S3Deployment: s3DeploymentOld,
+          },
+        });
+
+        const cdkStackArtifact = setup.cdkStackArtifactOf({
+          template: {
+            Resources: {
+              ServiceRole: serviceRole,
+              Policy1: policyNew,
+              Policy2: {
+                Properties: {
+                  Roles: [{ Ref: 'ServiceRole' }],
+                  PolicyDocument: {
+                    Statement: [
+                      {
+                        Action: ['s3:GetObject*'],
+                        Effect: 'Allow',
+                        Resource: {
+                          'Fn::GetAtt': ['DifferentBucketNew', 'Arn'],
+                        },
+                      },
+                    ],
+                  },
+                },
               },
+              S3DeploymentLambda: deploymentLambda,
+              S3Deployment: s3DeploymentNew,
             },
           },
-        },
-      });
+        });
 
-      const cdkStackArtifact = setup.cdkStackArtifactOf({
-        template: {
+        if (hotswapMode === HotswapMode.FALL_BACK) {
+          // WHEN
+          const deployStackResult = await hotswapMockSdkProvider.tryHotswapDeployment(hotswapMode, cdkStackArtifact);
+
+          // THEN
+          expect(deployStackResult).toBeUndefined();
+          expect(mockLambdaClient).not.toHaveReceivedCommand(InvokeCommand);
+        } else if (hotswapMode === HotswapMode.HOTSWAP_ONLY) {
+          // WHEN
+          const deployStackResult = await hotswapMockSdkProvider.tryHotswapDeployment(hotswapMode, cdkStackArtifact);
+
+          // THEN
+          expect(deployStackResult).not.toBeUndefined();
+          expect(mockLambdaClient).toHaveReceivedCommandWith(InvokeCommand, {
+            FunctionName: 'arn:swa:lambda:here:123456789012:function:my-deployment-lambda',
+            Payload: JSON.stringify({
+              ...payloadWithoutCustomResProps,
+              ResourceProperties: {
+                SourceBucketNames: ['src-bucket-new'],
+                SourceObjectKeys: ['src-key-new'],
+                DestinationBucketName: 'WebsiteBucketNew',
+              },
+            }),
+          });
+        }
+      },
+    );
+
+    silentTest(
+      `does not call the lambdaInvoke() API when a policy is referenced by a resource that is not an S3 deployment
+          in CLASSIC mode but does in HOTSWAP_ONLY mode`,
+      async () => {
+        // GIVEN
+        setup.setCurrentCfnStackTemplate({
           Resources: {
             ServiceRole: serviceRole,
-            Policy1: policyNew,
+            Policy1: policyOld,
             S3DeploymentLambda: deploymentLambda,
-            S3Deployment: s3DeploymentNew,
+            S3Deployment: s3DeploymentOld,
             NotADeployment: {
               Type: 'AWS::Not::S3Deployment',
               Properties: {
@@ -846,34 +801,53 @@ describe.each([HotswapMode.FALL_BACK, HotswapMode.HOTSWAP_ONLY])('%p mode', (hot
               },
             },
           },
-        },
-      });
-
-      if (hotswapMode === HotswapMode.FALL_BACK) {
-        // WHEN
-        const deployStackResult = await hotswapMockSdkProvider.tryHotswapDeployment(hotswapMode, cdkStackArtifact);
-
-        // THEN
-        expect(deployStackResult).toBeUndefined();
-        expect(mockLambdaInvoke).not.toHaveBeenCalled();
-      } else if (hotswapMode === HotswapMode.HOTSWAP_ONLY) {
-        // WHEN
-        const deployStackResult = await hotswapMockSdkProvider.tryHotswapDeployment(hotswapMode, cdkStackArtifact);
+        });
 
-        // THEN
-        expect(deployStackResult).not.toBeUndefined();
-        expect(mockLambdaInvoke).toHaveBeenCalledWith({
-          FunctionName: 'arn:aws:lambda:here:123456789012:function:my-deployment-lambda',
-          Payload: JSON.stringify({
-            ...payloadWithoutCustomResProps,
-            ResourceProperties: {
-              SourceBucketNames: ['src-bucket-new'],
-              SourceObjectKeys: ['src-key-new'],
-              DestinationBucketName: 'WebsiteBucketNew',
+        const cdkStackArtifact = setup.cdkStackArtifactOf({
+          template: {
+            Resources: {
+              ServiceRole: serviceRole,
+              Policy1: policyNew,
+              S3DeploymentLambda: deploymentLambda,
+              S3Deployment: s3DeploymentNew,
+              NotADeployment: {
+                Type: 'AWS::Not::S3Deployment',
+                Properties: {
+                  Prop: {
+                    Ref: 'ServiceRole',
+                  },
+                },
+              },
             },
-          }),
+          },
         });
-      }
-    });
+
+        if (hotswapMode === HotswapMode.FALL_BACK) {
+          // WHEN
+          const deployStackResult = await hotswapMockSdkProvider.tryHotswapDeployment(hotswapMode, cdkStackArtifact);
+
+          // THEN
+          expect(deployStackResult).toBeUndefined();
+          expect(mockLambdaClient).not.toHaveReceivedCommand(InvokeCommand);
+        } else if (hotswapMode === HotswapMode.HOTSWAP_ONLY) {
+          // WHEN
+          const deployStackResult = await hotswapMockSdkProvider.tryHotswapDeployment(hotswapMode, cdkStackArtifact);
+
+          // THEN
+          expect(deployStackResult).not.toBeUndefined();
+          expect(mockLambdaClient).toHaveReceivedCommandWith(InvokeCommand, {
+            FunctionName: 'arn:swa:lambda:here:123456789012:function:my-deployment-lambda',
+            Payload: JSON.stringify({
+              ...payloadWithoutCustomResProps,
+              ResourceProperties: {
+                SourceBucketNames: ['src-bucket-new'],
+                SourceObjectKeys: ['src-key-new'],
+                DestinationBucketName: 'WebsiteBucketNew',
+              },
+            }),
+          });
+        }
+      },
+    );
   });
 });
diff --git a/packages/aws-cdk/test/api/hotswap/state-machine-hotswap-deployments.test.ts b/packages/aws-cdk/test/api/hotswap/state-machine-hotswap-deployments.test.ts
index f5c31bc2cee87..bff830e00e972 100644
--- a/packages/aws-cdk/test/api/hotswap/state-machine-hotswap-deployments.test.ts
+++ b/packages/aws-cdk/test/api/hotswap/state-machine-hotswap-deployments.test.ts
@@ -1,15 +1,13 @@
-import { StepFunctions } from 'aws-sdk';
+import { UpdateStateMachineCommand } from '@aws-sdk/client-sfn';
 import * as setup from './hotswap-test-setup';
 import { HotswapMode } from '../../../lib/api/hotswap/common';
+import { mockStepFunctionsClient } from '../../util/mock-sdk';
 import { silentTest } from '../../util/silent';
 
-let mockUpdateMachineDefinition: (params: StepFunctions.Types.UpdateStateMachineInput) => StepFunctions.Types.UpdateStateMachineOutput;
 let hotswapMockSdkProvider: setup.HotswapMockSdkProvider;
 
 beforeEach(() => {
   hotswapMockSdkProvider = setup.setupHotswapTests();
-  mockUpdateMachineDefinition = jest.fn();
-  hotswapMockSdkProvider.setUpdateStateMachineMock(mockUpdateMachineDefinition);
 });
 
 describe.each([HotswapMode.FALL_BACK, HotswapMode.HOTSWAP_ONLY])('%p mode', (hotswapMode) => {
@@ -31,7 +29,7 @@ describe.each([HotswapMode.FALL_BACK, HotswapMode.HOTSWAP_ONLY])('%p mode', (hot
 
       // THEN
       expect(deployStackResult).toBeUndefined();
-      expect(mockUpdateMachineDefinition).not.toHaveBeenCalled();
+      expect(mockStepFunctionsClient).not.toHaveReceivedCommand(UpdateStateMachineCommand);
     } else if (hotswapMode === HotswapMode.HOTSWAP_ONLY) {
       // WHEN
       const deployStackResult = await hotswapMockSdkProvider.tryHotswapDeployment(hotswapMode, cdkStackArtifact);
@@ -39,79 +37,56 @@ describe.each([HotswapMode.FALL_BACK, HotswapMode.HOTSWAP_ONLY])('%p mode', (hot
       // THEN
       expect(deployStackResult).not.toBeUndefined();
       expect(deployStackResult?.noOp).toEqual(true);
-      expect(mockUpdateMachineDefinition).not.toHaveBeenCalled();
+      expect(mockStepFunctionsClient).not.toHaveReceivedCommand(UpdateStateMachineCommand);
     }
   });
 
-  silentTest('calls the updateStateMachine() API when it receives only a definitionString change without Fn::Join in a state machine', async () => {
-    // GIVEN
-    setup.setCurrentCfnStackTemplate({
-      Resources: {
-        Machine: {
-          Type: 'AWS::StepFunctions::StateMachine',
-          Properties: {
-            DefinitionString: '{ Prop: "old-value" }',
-            StateMachineName: 'my-machine',
-          },
-        },
-      },
-    });
-    const cdkStackArtifact = setup.cdkStackArtifactOf({
-      template: {
+  silentTest(
+    'calls the updateStateMachine() API when it receives only a definitionString change without Fn::Join in a state machine',
+    async () => {
+      // GIVEN
+      setup.setCurrentCfnStackTemplate({
         Resources: {
           Machine: {
             Type: 'AWS::StepFunctions::StateMachine',
             Properties: {
-              DefinitionString: '{ Prop: "new-value" }',
+              DefinitionString: '{ Prop: "old-value" }',
               StateMachineName: 'my-machine',
             },
           },
         },
-      },
-    });
-
-    // WHEN
-    const deployStackResult = await hotswapMockSdkProvider.tryHotswapDeployment(hotswapMode, cdkStackArtifact);
-
-    // THEN
-    expect(deployStackResult).not.toBeUndefined();
-    expect(mockUpdateMachineDefinition).toHaveBeenCalledWith({
-      definition: '{ Prop: "new-value" }',
-      stateMachineArn: 'arn:aws:states:here:123456789012:stateMachine:my-machine',
-    });
-  });
-
-  silentTest('calls the updateStateMachine() API when it receives only a definitionString change with Fn::Join in a state machine', async () => {
-    // GIVEN
-    setup.setCurrentCfnStackTemplate({
-      Resources: {
-        Machine: {
-          Type: 'AWS::StepFunctions::StateMachine',
-          Properties: {
-            DefinitionString: {
-              'Fn::Join': [
-                '\n',
-                [
-                  '{',
-                  '  "StartAt" : "SuccessState"',
-                  '  "States" : {',
-                  '    "SuccessState": {',
-                  '      "Type": "Pass"',
-                  '      "Result": "Success"',
-                  '      "End": true',
-                  '    }',
-                  '  }',
-                  '}',
-                ],
-              ],
+      });
+      const cdkStackArtifact = setup.cdkStackArtifactOf({
+        template: {
+          Resources: {
+            Machine: {
+              Type: 'AWS::StepFunctions::StateMachine',
+              Properties: {
+                DefinitionString: '{ Prop: "new-value" }',
+                StateMachineName: 'my-machine',
+              },
             },
-            StateMachineName: 'my-machine',
           },
         },
-      },
-    });
-    const cdkStackArtifact = setup.cdkStackArtifactOf({
-      template: {
+      });
+
+      // WHEN
+      const deployStackResult = await hotswapMockSdkProvider.tryHotswapDeployment(hotswapMode, cdkStackArtifact);
+
+      // THEN
+      expect(deployStackResult).not.toBeUndefined();
+      expect(mockStepFunctionsClient).toHaveReceivedCommandWith(UpdateStateMachineCommand, {
+        definition: '{ Prop: "new-value" }',
+        stateMachineArn: 'arn:swa:states:here:123456789012:stateMachine:my-machine',
+      });
+    },
+  );
+
+  silentTest(
+    'calls the updateStateMachine() API when it receives only a definitionString change with Fn::Join in a state machine',
+    async () => {
+      // GIVEN
+      setup.setCurrentCfnStackTemplate({
         Resources: {
           Machine: {
             Type: 'AWS::StepFunctions::StateMachine',
@@ -121,10 +96,12 @@ describe.each([HotswapMode.FALL_BACK, HotswapMode.HOTSWAP_ONLY])('%p mode', (hot
                   '\n',
                   [
                     '{',
-                    '  "StartAt": "SuccessState",',
-                    '  "States": {',
+                    '  "StartAt" : "SuccessState"',
+                    '  "States" : {',
                     '    "SuccessState": {',
-                    '      "Type": "Succeed"',
+                    '      "Type": "Pass"',
+                    '      "Result": "Success"',
+                    '      "End": true',
                     '    }',
                     '  }',
                     '}',
@@ -135,160 +112,212 @@ describe.each([HotswapMode.FALL_BACK, HotswapMode.HOTSWAP_ONLY])('%p mode', (hot
             },
           },
         },
-      },
-    });
-
-    // WHEN
-    const deployStackResult = await hotswapMockSdkProvider.tryHotswapDeployment(hotswapMode, cdkStackArtifact);
-
-    // THEN
-    expect(deployStackResult).not.toBeUndefined();
-    expect(mockUpdateMachineDefinition).toHaveBeenCalledWith({
-      definition: JSON.stringify({
-        StartAt: 'SuccessState',
-        States: {
-          SuccessState: {
-            Type: 'Succeed',
+      });
+      const cdkStackArtifact = setup.cdkStackArtifactOf({
+        template: {
+          Resources: {
+            Machine: {
+              Type: 'AWS::StepFunctions::StateMachine',
+              Properties: {
+                DefinitionString: {
+                  'Fn::Join': [
+                    '\n',
+                    [
+                      '{',
+                      '  "StartAt": "SuccessState",',
+                      '  "States": {',
+                      '    "SuccessState": {',
+                      '      "Type": "Succeed"',
+                      '    }',
+                      '  }',
+                      '}',
+                    ],
+                  ],
+                },
+                StateMachineName: 'my-machine',
+              },
+            },
           },
         },
-      }, null, 2),
-      stateMachineArn: 'arn:aws:states:here:123456789012:stateMachine:my-machine',
-    });
-  });
+      });
 
-  silentTest('calls the updateStateMachine() API when it receives a change to the definitionString in a state machine that has no name', async () => {
-    // GIVEN
-    setup.setCurrentCfnStackTemplate({
-      Resources: {
-        Machine: {
-          Type: 'AWS::StepFunctions::StateMachine',
-          Properties: {
-            DefinitionString: '{ "Prop" : "old-value" }',
+      // WHEN
+      const deployStackResult = await hotswapMockSdkProvider.tryHotswapDeployment(hotswapMode, cdkStackArtifact);
+
+      // THEN
+      expect(deployStackResult).not.toBeUndefined();
+      expect(mockStepFunctionsClient).toHaveReceivedCommandWith(UpdateStateMachineCommand, {
+        definition: JSON.stringify(
+          {
+            StartAt: 'SuccessState',
+            States: {
+              SuccessState: {
+                Type: 'Succeed',
+              },
+            },
           },
-        },
-      },
-    });
-    const cdkStackArtifact = setup.cdkStackArtifactOf({
-      template: {
+          null,
+          2,
+        ),
+        stateMachineArn: 'arn:swa:states:here:123456789012:stateMachine:my-machine',
+      });
+    },
+  );
+
+  silentTest(
+    'calls the updateStateMachine() API when it receives a change to the definitionString in a state machine that has no name',
+    async () => {
+      // GIVEN
+      setup.setCurrentCfnStackTemplate({
         Resources: {
           Machine: {
             Type: 'AWS::StepFunctions::StateMachine',
             Properties: {
-              DefinitionString: '{ "Prop" : "new-value" }',
+              DefinitionString: '{ "Prop" : "old-value" }',
             },
           },
         },
-      },
-    });
+      });
+      const cdkStackArtifact = setup.cdkStackArtifactOf({
+        template: {
+          Resources: {
+            Machine: {
+              Type: 'AWS::StepFunctions::StateMachine',
+              Properties: {
+                DefinitionString: '{ "Prop" : "new-value" }',
+              },
+            },
+          },
+        },
+      });
 
-    // WHEN
-    setup.pushStackResourceSummaries(setup.stackSummaryOf('Machine', 'AWS::StepFunctions::StateMachine', 'arn:aws:states:here:123456789012:stateMachine:my-machine'));
-    const deployStackResult = await hotswapMockSdkProvider.tryHotswapDeployment(hotswapMode, cdkStackArtifact);
+      // WHEN
+      setup.pushStackResourceSummaries(
+        setup.stackSummaryOf(
+          'Machine',
+          'AWS::StepFunctions::StateMachine',
+          'arn:swa:states:here:123456789012:stateMachine:my-machine',
+        ),
+      );
+      const deployStackResult = await hotswapMockSdkProvider.tryHotswapDeployment(hotswapMode, cdkStackArtifact);
 
-    // THEN
-    expect(deployStackResult).not.toBeUndefined();
-    expect(mockUpdateMachineDefinition).toHaveBeenCalledWith({
-      definition: '{ "Prop" : "new-value" }',
-      stateMachineArn: 'arn:aws:states:here:123456789012:stateMachine:my-machine',
-    });
-  });
+      // THEN
+      expect(deployStackResult).not.toBeUndefined();
+      expect(mockStepFunctionsClient).toHaveReceivedCommandWith(UpdateStateMachineCommand, {
+        definition: '{ "Prop" : "new-value" }',
+        stateMachineArn: 'arn:swa:states:here:123456789012:stateMachine:my-machine',
+      });
+    },
+  );
 
-  silentTest(`does not call the updateStateMachine() API when it receives a change to a property that is not the definitionString in a state machine
+  silentTest(
+    `does not call the updateStateMachine() API when it receives a change to a property that is not the definitionString in a state machine
         alongside a hotswappable change in CLASSIC mode but does in HOTSWAP_ONLY mode`,
-  async () => {
-    // GIVEN
-    setup.setCurrentCfnStackTemplate({
-      Resources: {
-        Machine: {
-          Type: 'AWS::StepFunctions::StateMachine',
-          Properties: {
-            DefinitionString: '{ "Prop" : "old-value" }',
-            LoggingConfiguration: { // non-definitionString property
-              IncludeExecutionData: true,
-            },
-          },
-        },
-      },
-    });
-    const cdkStackArtifact = setup.cdkStackArtifactOf({
-      template: {
+    async () => {
+      // GIVEN
+      setup.setCurrentCfnStackTemplate({
         Resources: {
           Machine: {
             Type: 'AWS::StepFunctions::StateMachine',
             Properties: {
-              DefinitionString: '{ "Prop" : "new-value" }',
+              DefinitionString: '{ "Prop" : "old-value" }',
               LoggingConfiguration: {
-                IncludeExecutionData: false,
+                // non-definitionString property
+                IncludeExecutionData: true,
               },
             },
           },
         },
-      },
-    });
-
-    setup.pushStackResourceSummaries(setup.stackSummaryOf('Machine', 'AWS::StepFunctions::StateMachine', 'arn:aws:states:here:123456789012:stateMachine:my-machine'));
-    if (hotswapMode === HotswapMode.FALL_BACK) {
-      // WHEN
-      const deployStackResult = await hotswapMockSdkProvider.tryHotswapDeployment(hotswapMode, cdkStackArtifact);
-
-      // THEN
-      expect(deployStackResult).toBeUndefined();
-      expect(mockUpdateMachineDefinition).not.toHaveBeenCalled();
-    } else if (hotswapMode === HotswapMode.HOTSWAP_ONLY) {
-      // WHEN
-      const deployStackResult = await hotswapMockSdkProvider.tryHotswapDeployment(hotswapMode, cdkStackArtifact);
-
-      // THEN
-      expect(deployStackResult).not.toBeUndefined();
-      expect(mockUpdateMachineDefinition).toHaveBeenCalledWith({
-        definition: '{ "Prop" : "new-value" }',
-        stateMachineArn: 'arn:aws:states:here:123456789012:stateMachine:my-machine',
       });
-    }
-  });
-
-  silentTest('does not call the updateStateMachine() API when a resource has a DefinitionString property but is not an AWS::StepFunctions::StateMachine is changed', async () => {
-    // GIVEN
-    setup.setCurrentCfnStackTemplate({
-      Resources: {
-        Machine: {
-          Type: 'AWS::NotStepFunctions::NotStateMachine',
-          Properties: {
-            DefinitionString: '{ Prop: "old-value" }',
+      const cdkStackArtifact = setup.cdkStackArtifactOf({
+        template: {
+          Resources: {
+            Machine: {
+              Type: 'AWS::StepFunctions::StateMachine',
+              Properties: {
+                DefinitionString: '{ "Prop" : "new-value" }',
+                LoggingConfiguration: {
+                  IncludeExecutionData: false,
+                },
+              },
+            },
           },
         },
-      },
-    });
-    const cdkStackArtifact = setup.cdkStackArtifactOf({
-      template: {
+      });
+
+      setup.pushStackResourceSummaries(
+        setup.stackSummaryOf(
+          'Machine',
+          'AWS::StepFunctions::StateMachine',
+          'arn:swa:states:here:123456789012:stateMachine:my-machine',
+        ),
+      );
+      if (hotswapMode === HotswapMode.FALL_BACK) {
+        // WHEN
+        const deployStackResult = await hotswapMockSdkProvider.tryHotswapDeployment(hotswapMode, cdkStackArtifact);
+
+        // THEN
+        expect(deployStackResult).toBeUndefined();
+        expect(mockStepFunctionsClient).not.toHaveReceivedCommand(UpdateStateMachineCommand);
+      } else if (hotswapMode === HotswapMode.HOTSWAP_ONLY) {
+        // WHEN
+        const deployStackResult = await hotswapMockSdkProvider.tryHotswapDeployment(hotswapMode, cdkStackArtifact);
+
+        // THEN
+        expect(deployStackResult).not.toBeUndefined();
+        expect(mockStepFunctionsClient).toHaveReceivedCommandWith(UpdateStateMachineCommand, {
+          definition: '{ "Prop" : "new-value" }',
+          stateMachineArn: 'arn:swa:states:here:123456789012:stateMachine:my-machine',
+        });
+      }
+    },
+  );
+
+  silentTest(
+    'does not call the updateStateMachine() API when a resource has a DefinitionString property but is not an AWS::StepFunctions::StateMachine is changed',
+    async () => {
+      // GIVEN
+      setup.setCurrentCfnStackTemplate({
         Resources: {
           Machine: {
             Type: 'AWS::NotStepFunctions::NotStateMachine',
             Properties: {
-              DefinitionString: '{ Prop: "new-value" }',
+              DefinitionString: '{ Prop: "old-value" }',
             },
           },
         },
-      },
-    });
-
-    if (hotswapMode === HotswapMode.FALL_BACK) {
-      // WHEN
-      const deployStackResult = await hotswapMockSdkProvider.tryHotswapDeployment(hotswapMode, cdkStackArtifact);
-
-      // THEN
-      expect(deployStackResult).toBeUndefined();
-      expect(mockUpdateMachineDefinition).not.toHaveBeenCalled();
-    } else if (hotswapMode === HotswapMode.HOTSWAP_ONLY) {
-      // WHEN
-      const deployStackResult = await hotswapMockSdkProvider.tryHotswapDeployment(hotswapMode, cdkStackArtifact);
+      });
+      const cdkStackArtifact = setup.cdkStackArtifactOf({
+        template: {
+          Resources: {
+            Machine: {
+              Type: 'AWS::NotStepFunctions::NotStateMachine',
+              Properties: {
+                DefinitionString: '{ Prop: "new-value" }',
+              },
+            },
+          },
+        },
+      });
 
-      // THEN
-      expect(deployStackResult).not.toBeUndefined();
-      expect(deployStackResult?.noOp).toEqual(true);
-      expect(mockUpdateMachineDefinition).not.toHaveBeenCalled();
-    }
-  });
+      if (hotswapMode === HotswapMode.FALL_BACK) {
+        // WHEN
+        const deployStackResult = await hotswapMockSdkProvider.tryHotswapDeployment(hotswapMode, cdkStackArtifact);
+
+        // THEN
+        expect(deployStackResult).toBeUndefined();
+        expect(mockStepFunctionsClient).not.toHaveReceivedCommand(UpdateStateMachineCommand);
+      } else if (hotswapMode === HotswapMode.HOTSWAP_ONLY) {
+        // WHEN
+        const deployStackResult = await hotswapMockSdkProvider.tryHotswapDeployment(hotswapMode, cdkStackArtifact);
+
+        // THEN
+        expect(deployStackResult).not.toBeUndefined();
+        expect(deployStackResult?.noOp).toEqual(true);
+        expect(mockStepFunctionsClient).not.toHaveReceivedCommand(UpdateStateMachineCommand);
+      }
+    },
+  );
 
   silentTest('can correctly hotswap old style synth changes', async () => {
     // GIVEN
@@ -320,49 +349,30 @@ describe.each([HotswapMode.FALL_BACK, HotswapMode.HOTSWAP_ONLY])('%p mode', (hot
     });
 
     // WHEN
-    setup.pushStackResourceSummaries(setup.stackSummaryOf('Machine', 'AWS::StepFunctions::StateMachine', 'arn:aws:states:here:123456789012:stateMachine:my-machine'));
-    const deployStackResult = await hotswapMockSdkProvider.tryHotswapDeployment(hotswapMode, cdkStackArtifact, { AssetParam2: 'asset-param-2' });
+    setup.pushStackResourceSummaries(
+      setup.stackSummaryOf(
+        'Machine',
+        'AWS::StepFunctions::StateMachine',
+        'arn:swa:states:here:123456789012:stateMachine:my-machine',
+      ),
+    );
+    const deployStackResult = await hotswapMockSdkProvider.tryHotswapDeployment(hotswapMode, cdkStackArtifact, {
+      AssetParam2: 'asset-param-2',
+    });
 
     // THEN
     expect(deployStackResult).not.toBeUndefined();
-    expect(mockUpdateMachineDefinition).toHaveBeenCalledWith({
+    expect(mockStepFunctionsClient).toHaveReceivedCommandWith(UpdateStateMachineCommand, {
       definition: 'asset-param-2',
-      stateMachineArn: 'arn:aws:states:here:123456789012:stateMachine:machine-name',
+      stateMachineArn: 'arn:swa:states:here:123456789012:stateMachine:machine-name',
     });
   });
 
-  silentTest('calls the updateStateMachine() API when it receives a change to the definitionString that uses Attributes in a state machine', async () => {
-    // GIVEN
-    setup.setCurrentCfnStackTemplate({
-      Resources: {
-        Func: {
-          Type: 'AWS::Lambda::Function',
-        },
-        Machine: {
-          Type: 'AWS::StepFunctions::StateMachine',
-          Properties: {
-            DefinitionString: {
-              'Fn::Join': [
-                '\n',
-                [
-                  '{',
-                  '  "StartAt" : "SuccessState"',
-                  '  "States" : {',
-                  '    "SuccessState": {',
-                  '      "Type": "Succeed"',
-                  '    }',
-                  '  }',
-                  '}',
-                ],
-              ],
-            },
-            StateMachineName: 'my-machine',
-          },
-        },
-      },
-    });
-    const cdkStackArtifact = setup.cdkStackArtifactOf({
-      template: {
+  silentTest(
+    'calls the updateStateMachine() API when it receives a change to the definitionString that uses Attributes in a state machine',
+    async () => {
+      // GIVEN
+      setup.setCurrentCfnStackTemplate({
         Resources: {
           Func: {
             Type: 'AWS::Lambda::Function',
@@ -372,10 +382,16 @@ describe.each([HotswapMode.FALL_BACK, HotswapMode.HOTSWAP_ONLY])('%p mode', (hot
             Properties: {
               DefinitionString: {
                 'Fn::Join': [
-                  '',
+                  '\n',
                   [
-                    '"Resource": ',
-                    { 'Fn::GetAtt': ['Func', 'Arn'] },
+                    '{',
+                    '  "StartAt" : "SuccessState"',
+                    '  "States" : {',
+                    '    "SuccessState": {',
+                    '      "Type": "Succeed"',
+                    '    }',
+                    '  }',
+                    '}',
                   ],
                 ],
               },
@@ -383,52 +399,51 @@ describe.each([HotswapMode.FALL_BACK, HotswapMode.HOTSWAP_ONLY])('%p mode', (hot
             },
           },
         },
-      },
-    });
-
-    // WHEN
-    setup.pushStackResourceSummaries(
-      setup.stackSummaryOf('Machine', 'AWS::StepFunctions::StateMachine', 'arn:aws:states:here:123456789012:stateMachine:my-machine'),
-      setup.stackSummaryOf('Func', 'AWS::Lambda::Function', 'my-func'),
-    );
-    const deployStackResult = await hotswapMockSdkProvider.tryHotswapDeployment(hotswapMode, cdkStackArtifact);
-
-    // THEN
-    expect(deployStackResult).not.toBeUndefined();
-    expect(mockUpdateMachineDefinition).toHaveBeenCalledWith({
-      definition: '"Resource": arn:aws:lambda:here:123456789012:function:my-func',
-      stateMachineArn: 'arn:aws:states:here:123456789012:stateMachine:my-machine',
-    });
-  });
-
-  silentTest("will not perform a hotswap deployment if it cannot find a Ref target (outside the state machine's name)", async () => {
-    // GIVEN
-    setup.setCurrentCfnStackTemplate({
-      Parameters: {
-        Param1: { Type: 'String' },
-      },
-      Resources: {
-        Machine: {
-          Type: 'AWS::StepFunctions::StateMachine',
-          Properties: {
-            DefinitionString: {
-              'Fn::Join': [
-                '',
-                [
-                  '{ Prop: "old-value" }, ',
-                  '{ "Param" : ',
-                  { 'Fn::Sub': '${Param1}' },
-                  ' }',
-                ],
-              ],
+      });
+      const cdkStackArtifact = setup.cdkStackArtifactOf({
+        template: {
+          Resources: {
+            Func: {
+              Type: 'AWS::Lambda::Function',
+            },
+            Machine: {
+              Type: 'AWS::StepFunctions::StateMachine',
+              Properties: {
+                DefinitionString: {
+                  'Fn::Join': ['', ['"Resource": ', { 'Fn::GetAtt': ['Func', 'Arn'] }]],
+                },
+                StateMachineName: 'my-machine',
+              },
             },
           },
         },
-      },
-    });
-    setup.pushStackResourceSummaries(setup.stackSummaryOf('Machine', 'AWS::StepFunctions::StateMachine', 'my-machine'));
-    const cdkStackArtifact = setup.cdkStackArtifactOf({
-      template: {
+      });
+
+      // WHEN
+      setup.pushStackResourceSummaries(
+        setup.stackSummaryOf(
+          'Machine',
+          'AWS::StepFunctions::StateMachine',
+          'arn:swa:states:here:123456789012:stateMachine:my-machine',
+        ),
+        setup.stackSummaryOf('Func', 'AWS::Lambda::Function', 'my-func'),
+      );
+      const deployStackResult = await hotswapMockSdkProvider.tryHotswapDeployment(hotswapMode, cdkStackArtifact);
+
+      // THEN
+      expect(deployStackResult).not.toBeUndefined();
+      expect(mockStepFunctionsClient).toHaveReceivedCommandWith(UpdateStateMachineCommand, {
+        definition: '"Resource": arn:swa:lambda:here:123456789012:function:my-func',
+        stateMachineArn: 'arn:swa:states:here:123456789012:stateMachine:my-machine',
+      });
+    },
+  );
+
+  silentTest(
+    "will not perform a hotswap deployment if it cannot find a Ref target (outside the state machine's name)",
+    async () => {
+      // GIVEN
+      setup.setCurrentCfnStackTemplate({
         Parameters: {
           Param1: { Type: 'String' },
         },
@@ -437,60 +452,45 @@ describe.each([HotswapMode.FALL_BACK, HotswapMode.HOTSWAP_ONLY])('%p mode', (hot
             Type: 'AWS::StepFunctions::StateMachine',
             Properties: {
               DefinitionString: {
-                'Fn::Join': [
-                  '',
-                  [
-                    '{ Prop: "new-value" }, ',
-                    '{ "Param" : ',
-                    { 'Fn::Sub': '${Param1}' },
-                    ' }',
-                  ],
-                ],
+                'Fn::Join': ['', ['{ Prop: "old-value" }, ', '{ "Param" : ', { 'Fn::Sub': '${Param1}' }, ' }']],
               },
             },
           },
         },
-      },
-    });
-
-    // THEN
-    await expect(() =>
-      hotswapMockSdkProvider.tryHotswapDeployment(hotswapMode, cdkStackArtifact),
-    ).rejects.toThrow(/Parameter or resource 'Param1' could not be found for evaluation/);
-  });
-
-  silentTest("will not perform a hotswap deployment if it doesn't know how to handle a specific attribute (outside the state machines's name)", async () => {
-    // GIVEN
-    setup.setCurrentCfnStackTemplate({
-      Resources: {
-        Bucket: {
-          Type: 'AWS::S3::Bucket',
-        },
-        Machine: {
-          Type: 'AWS::StepFunctions::StateMachine',
-          Properties: {
-            DefinitionString: {
-              'Fn::Join': [
-                '',
-                [
-                  '{ Prop: "old-value" }, ',
-                  '{ "S3Bucket" : ',
-                  { 'Fn::GetAtt': ['Bucket', 'UnknownAttribute'] },
-                  ' }',
-                ],
-              ],
+      });
+      setup.pushStackResourceSummaries(
+        setup.stackSummaryOf('Machine', 'AWS::StepFunctions::StateMachine', 'my-machine'),
+      );
+      const cdkStackArtifact = setup.cdkStackArtifactOf({
+        template: {
+          Parameters: {
+            Param1: { Type: 'String' },
+          },
+          Resources: {
+            Machine: {
+              Type: 'AWS::StepFunctions::StateMachine',
+              Properties: {
+                DefinitionString: {
+                  'Fn::Join': ['', ['{ Prop: "new-value" }, ', '{ "Param" : ', { 'Fn::Sub': '${Param1}' }, ' }']],
+                },
+              },
             },
-            StateMachineName: 'my-machine',
           },
         },
-      },
-    });
-    setup.pushStackResourceSummaries(
-      setup.stackSummaryOf('Machine', 'AWS::StepFunctions::StateMachine', 'arn:aws:states:here:123456789012:stateMachine:my-machine'),
-      setup.stackSummaryOf('Bucket', 'AWS::S3::Bucket', 'my-bucket'),
-    );
-    const cdkStackArtifact = setup.cdkStackArtifactOf({
-      template: {
+      });
+
+      // THEN
+      await expect(() => hotswapMockSdkProvider.tryHotswapDeployment(hotswapMode, cdkStackArtifact)).rejects.toThrow(
+        /Parameter or resource 'Param1' could not be found for evaluation/,
+      );
+    },
+  );
+
+  silentTest(
+    "will not perform a hotswap deployment if it doesn't know how to handle a specific attribute (outside the state machines's name)",
+    async () => {
+      // GIVEN
+      setup.setCurrentCfnStackTemplate({
         Resources: {
           Bucket: {
             Type: 'AWS::S3::Bucket',
@@ -502,7 +502,7 @@ describe.each([HotswapMode.FALL_BACK, HotswapMode.HOTSWAP_ONLY])('%p mode', (hot
                 'Fn::Join': [
                   '',
                   [
-                    '{ Prop: "new-value" }, ',
+                    '{ Prop: "old-value" }, ',
                     '{ "S3Bucket" : ',
                     { 'Fn::GetAtt': ['Bucket', 'UnknownAttribute'] },
                     ' }',
@@ -513,14 +513,48 @@ describe.each([HotswapMode.FALL_BACK, HotswapMode.HOTSWAP_ONLY])('%p mode', (hot
             },
           },
         },
-      },
-    });
+      });
+      setup.pushStackResourceSummaries(
+        setup.stackSummaryOf(
+          'Machine',
+          'AWS::StepFunctions::StateMachine',
+          'arn:swa:states:here:123456789012:stateMachine:my-machine',
+        ),
+        setup.stackSummaryOf('Bucket', 'AWS::S3::Bucket', 'my-bucket'),
+      );
+      const cdkStackArtifact = setup.cdkStackArtifactOf({
+        template: {
+          Resources: {
+            Bucket: {
+              Type: 'AWS::S3::Bucket',
+            },
+            Machine: {
+              Type: 'AWS::StepFunctions::StateMachine',
+              Properties: {
+                DefinitionString: {
+                  'Fn::Join': [
+                    '',
+                    [
+                      '{ Prop: "new-value" }, ',
+                      '{ "S3Bucket" : ',
+                      { 'Fn::GetAtt': ['Bucket', 'UnknownAttribute'] },
+                      ' }',
+                    ],
+                  ],
+                },
+                StateMachineName: 'my-machine',
+              },
+            },
+          },
+        },
+      });
 
-    // THEN
-    await expect(() =>
-      hotswapMockSdkProvider.tryHotswapDeployment(hotswapMode, cdkStackArtifact),
-    ).rejects.toThrow("We don't support the 'UnknownAttribute' attribute of the 'AWS::S3::Bucket' resource. This is a CDK limitation. Please report it at https://github.com/aws/aws-cdk/issues/new/choose");
-  });
+      // THEN
+      await expect(() => hotswapMockSdkProvider.tryHotswapDeployment(hotswapMode, cdkStackArtifact)).rejects.toThrow(
+        "We don't support the 'UnknownAttribute' attribute of the 'AWS::S3::Bucket' resource. This is a CDK limitation. Please report it at https://github.com/aws/aws-cdk/issues/new/choose",
+      );
+    },
+  );
 
   silentTest('knows how to handle attributes of the AWS::Events::EventBus resource', async () => {
     // GIVEN
@@ -536,24 +570,25 @@ describe.each([HotswapMode.FALL_BACK, HotswapMode.HOTSWAP_ONLY])('%p mode', (hot
           Type: 'AWS::StepFunctions::StateMachine',
           Properties: {
             DefinitionString: {
-              'Fn::Join': ['', [
-                '{"EventBus1Arn":"',
-                { 'Fn::GetAtt': ['EventBus', 'Arn'] },
-                '","EventBus1Name":"',
-                { 'Fn::GetAtt': ['EventBus', 'Name'] },
-                '","EventBus1Ref":"',
-                { Ref: 'EventBus' },
-                '"}',
-              ]],
+              'Fn::Join': [
+                '',
+                [
+                  '{"EventBus1Arn":"',
+                  { 'Fn::GetAtt': ['EventBus', 'Arn'] },
+                  '","EventBus1Name":"',
+                  { 'Fn::GetAtt': ['EventBus', 'Name'] },
+                  '","EventBus1Ref":"',
+                  { Ref: 'EventBus' },
+                  '"}',
+                ],
+              ],
             },
             StateMachineName: 'my-machine',
           },
         },
       },
     });
-    setup.pushStackResourceSummaries(
-      setup.stackSummaryOf('EventBus', 'AWS::Events::EventBus', 'my-event-bus'),
-    );
+    setup.pushStackResourceSummaries(setup.stackSummaryOf('EventBus', 'AWS::Events::EventBus', 'my-event-bus'));
     const cdkStackArtifact = setup.cdkStackArtifactOf({
       template: {
         Resources: {
@@ -567,15 +602,18 @@ describe.each([HotswapMode.FALL_BACK, HotswapMode.HOTSWAP_ONLY])('%p mode', (hot
             Type: 'AWS::StepFunctions::StateMachine',
             Properties: {
               DefinitionString: {
-                'Fn::Join': ['', [
-                  '{"EventBus2Arn":"',
-                  { 'Fn::GetAtt': ['EventBus', 'Arn'] },
-                  '","EventBus2Name":"',
-                  { 'Fn::GetAtt': ['EventBus', 'Name'] },
-                  '","EventBus2Ref":"',
-                  { Ref: 'EventBus' },
-                  '"}',
-                ]],
+                'Fn::Join': [
+                  '',
+                  [
+                    '{"EventBus2Arn":"',
+                    { 'Fn::GetAtt': ['EventBus', 'Arn'] },
+                    '","EventBus2Name":"',
+                    { 'Fn::GetAtt': ['EventBus', 'Name'] },
+                    '","EventBus2Ref":"',
+                    { Ref: 'EventBus' },
+                    '"}',
+                  ],
+                ],
               },
               StateMachineName: 'my-machine',
             },
@@ -588,10 +626,10 @@ describe.each([HotswapMode.FALL_BACK, HotswapMode.HOTSWAP_ONLY])('%p mode', (hot
     const result = await hotswapMockSdkProvider.tryHotswapDeployment(hotswapMode, cdkStackArtifact);
 
     expect(result).not.toBeUndefined();
-    expect(mockUpdateMachineDefinition).toHaveBeenCalledWith({
-      stateMachineArn: 'arn:aws:states:here:123456789012:stateMachine:my-machine',
+    expect(mockStepFunctionsClient).toHaveReceivedCommandWith(UpdateStateMachineCommand, {
+      stateMachineArn: 'arn:swa:states:here:123456789012:stateMachine:my-machine',
       definition: JSON.stringify({
-        EventBus2Arn: 'arn:aws:events:here:123456789012:event-bus/my-event-bus',
+        EventBus2Arn: 'arn:swa:events:here:123456789012:event-bus/my-event-bus',
         EventBus2Name: 'my-event-bus',
         EventBus2Ref: 'my-event-bus',
       }),
@@ -605,14 +643,18 @@ describe.each([HotswapMode.FALL_BACK, HotswapMode.HOTSWAP_ONLY])('%p mode', (hot
         Table: {
           Type: 'AWS::DynamoDB::Table',
           Properties: {
-            KeySchema: [{
-              AttributeName: 'name',
-              KeyType: 'HASH',
-            }],
-            AttributeDefinitions: [{
-              AttributeName: 'name',
-              AttributeType: 'S',
-            }],
+            KeySchema: [
+              {
+                AttributeName: 'name',
+                KeyType: 'HASH',
+              },
+            ],
+            AttributeDefinitions: [
+              {
+                AttributeName: 'name',
+                AttributeType: 'S',
+              },
+            ],
             BillingMode: 'PAY_PER_REQUEST',
           },
         },
@@ -625,23 +667,25 @@ describe.each([HotswapMode.FALL_BACK, HotswapMode.HOTSWAP_ONLY])('%p mode', (hot
         },
       },
     });
-    setup.pushStackResourceSummaries(
-      setup.stackSummaryOf('Table', 'AWS::DynamoDB::Table', 'my-dynamodb-table'),
-    );
+    setup.pushStackResourceSummaries(setup.stackSummaryOf('Table', 'AWS::DynamoDB::Table', 'my-dynamodb-table'));
     const cdkStackArtifact = setup.cdkStackArtifactOf({
       template: {
         Resources: {
           Table: {
             Type: 'AWS::DynamoDB::Table',
             Properties: {
-              KeySchema: [{
-                AttributeName: 'name',
-                KeyType: 'HASH',
-              }],
-              AttributeDefinitions: [{
-                AttributeName: 'name',
-                AttributeType: 'S',
-              }],
+              KeySchema: [
+                {
+                  AttributeName: 'name',
+                  KeyType: 'HASH',
+                },
+              ],
+              AttributeDefinitions: [
+                {
+                  AttributeName: 'name',
+                  AttributeType: 'S',
+                },
+              ],
               BillingMode: 'PAY_PER_REQUEST',
             },
           },
@@ -649,13 +693,10 @@ describe.each([HotswapMode.FALL_BACK, HotswapMode.HOTSWAP_ONLY])('%p mode', (hot
             Type: 'AWS::StepFunctions::StateMachine',
             Properties: {
               DefinitionString: {
-                'Fn::Join': ['', [
-                  '{"TableName":"',
-                  { Ref: 'Table' },
-                  '","TableArn":"',
-                  { 'Fn::GetAtt': ['Table', 'Arn'] },
-                  '"}',
-                ]],
+                'Fn::Join': [
+                  '',
+                  ['{"TableName":"', { Ref: 'Table' }, '","TableArn":"', { 'Fn::GetAtt': ['Table', 'Arn'] }, '"}'],
+                ],
               },
               StateMachineName: 'my-machine',
             },
@@ -668,11 +709,11 @@ describe.each([HotswapMode.FALL_BACK, HotswapMode.HOTSWAP_ONLY])('%p mode', (hot
     const result = await hotswapMockSdkProvider.tryHotswapDeployment(hotswapMode, cdkStackArtifact);
 
     expect(result).not.toBeUndefined();
-    expect(mockUpdateMachineDefinition).toHaveBeenCalledWith({
-      stateMachineArn: 'arn:aws:states:here:123456789012:stateMachine:my-machine',
+    expect(mockStepFunctionsClient).toHaveReceivedCommandWith(UpdateStateMachineCommand, {
+      stateMachineArn: 'arn:swa:states:here:123456789012:stateMachine:my-machine',
       definition: JSON.stringify({
         TableName: 'my-dynamodb-table',
-        TableArn: 'arn:aws:dynamodb:here:123456789012:table/my-dynamodb-table',
+        TableArn: 'arn:swa:dynamodb:here:123456789012:table/my-dynamodb-table',
       }),
     });
   });
@@ -696,9 +737,7 @@ describe.each([HotswapMode.FALL_BACK, HotswapMode.HOTSWAP_ONLY])('%p mode', (hot
         },
       },
     });
-    setup.pushStackResourceSummaries(
-      setup.stackSummaryOf('Key', 'AWS::KMS::Key', 'a-key'),
-    );
+    setup.pushStackResourceSummaries(setup.stackSummaryOf('Key', 'AWS::KMS::Key', 'a-key'));
     const cdkStackArtifact = setup.cdkStackArtifactOf({
       template: {
         Resources: {
@@ -712,13 +751,10 @@ describe.each([HotswapMode.FALL_BACK, HotswapMode.HOTSWAP_ONLY])('%p mode', (hot
             Type: 'AWS::StepFunctions::StateMachine',
             Properties: {
               DefinitionString: {
-                'Fn::Join': ['', [
-                  '{"KeyId":"',
-                  { Ref: 'Key' },
-                  '","KeyArn":"',
-                  { 'Fn::GetAtt': ['Key', 'Arn'] },
-                  '"}',
-                ]],
+                'Fn::Join': [
+                  '',
+                  ['{"KeyId":"', { Ref: 'Key' }, '","KeyArn":"', { 'Fn::GetAtt': ['Key', 'Arn'] }, '"}'],
+                ],
               },
               StateMachineName: 'my-machine',
             },
@@ -731,11 +767,11 @@ describe.each([HotswapMode.FALL_BACK, HotswapMode.HOTSWAP_ONLY])('%p mode', (hot
     const result = await hotswapMockSdkProvider.tryHotswapDeployment(hotswapMode, cdkStackArtifact);
 
     expect(result).not.toBeUndefined();
-    expect(mockUpdateMachineDefinition).toHaveBeenCalledWith({
-      stateMachineArn: 'arn:aws:states:here:123456789012:stateMachine:my-machine',
+    expect(mockStepFunctionsClient).toHaveReceivedCommandWith(UpdateStateMachineCommand, {
+      stateMachineArn: 'arn:swa:states:here:123456789012:stateMachine:my-machine',
       definition: JSON.stringify({
         KeyId: 'a-key',
-        KeyArn: 'arn:aws:kms:here:123456789012:key/a-key',
+        KeyArn: 'arn:swa:kms:here:123456789012:key/a-key',
       }),
     });
   });
@@ -775,6 +811,6 @@ describe.each([HotswapMode.FALL_BACK, HotswapMode.HOTSWAP_ONLY])('%p mode', (hot
     // THEN
     expect(deployStackResult).not.toBeUndefined();
     expect(deployStackResult?.noOp).toEqual(true);
-    expect(mockUpdateMachineDefinition).not.toHaveBeenCalled();
+    expect(mockStepFunctionsClient).not.toHaveReceivedCommand(UpdateStateMachineCommand);
   });
 });
diff --git a/packages/aws-cdk/test/api/lazy-list-stack-resources.test.ts b/packages/aws-cdk/test/api/lazy-list-stack-resources.test.ts
index ee41a07366a4f..f71fbab3d7aef 100644
--- a/packages/aws-cdk/test/api/lazy-list-stack-resources.test.ts
+++ b/packages/aws-cdk/test/api/lazy-list-stack-resources.test.ts
@@ -1,17 +1,14 @@
-/* eslint-disable import/order */
-import * as AWS from 'aws-sdk';
+import 'aws-sdk-client-mock-jest';
+
+import { ListStackResourcesCommand } from '@aws-sdk/client-cloudformation';
 import { LazyListStackResources } from '../../lib/api/evaluate-cloudformation-template';
-import { MockSdk } from '../util/mock-sdk';
+import { MockSdk, mockCloudFormationClient } from '../util/mock-sdk';
 
 describe('Lazy ListStackResources', () => {
   test('correctly caches calls to the CloudFormation API', async () => {
     // GIVEN
-    const listStackResMock: jest.Mock<AWS.CloudFormation.ListStackResourcesOutput, AWS.CloudFormation.ListStackResourcesInput[]> = jest.fn();
     const mockSdk = new MockSdk();
-    mockSdk.stubCloudFormation({
-      listStackResources: listStackResMock,
-    });
-    listStackResMock.mockReturnValue({
+    mockCloudFormationClient.on(ListStackResourcesCommand).resolves({
       StackResourceSummaries: [],
       NextToken: undefined,
     });
@@ -25,6 +22,6 @@ describe('Lazy ListStackResources', () => {
 
     // THEN
     expect(result.length).toBe(0);
-    expect(listStackResMock).toHaveBeenCalledTimes(1);
+    expect(mockCloudFormationClient).toHaveReceivedCommandTimes(ListStackResourcesCommand, 1);
   });
 });
diff --git a/packages/aws-cdk/test/api/lazy-lookup-export.test.ts b/packages/aws-cdk/test/api/lazy-lookup-export.test.ts
index 86a04de7167cb..177f4aa32c88c 100644
--- a/packages/aws-cdk/test/api/lazy-lookup-export.test.ts
+++ b/packages/aws-cdk/test/api/lazy-lookup-export.test.ts
@@ -1,12 +1,12 @@
-import * as AWS from 'aws-sdk';
+import { ListExportsCommand } from '@aws-sdk/client-cloudformation';
 import { LazyLookupExport } from '../../lib/api/evaluate-cloudformation-template';
-import { MockSdk } from '../util/mock-sdk';
+import { MockSdk, mockCloudFormationClient, restoreSdkMocksToDefault } from '../util/mock-sdk';
 
 describe('LazyLookupExport', () => {
-  const listExports: jest.Mock<AWS.CloudFormation.ListExportsOutput, AWS.CloudFormation.ListExportsInput[]> = jest.fn();
   const mockSdk = new MockSdk();
-  mockSdk.stubCloudFormation({
-    listExports,
+
+  beforeEach(() => {
+    restoreSdkMocksToDefault();
   });
 
   const createExport = (num: number) => ({
@@ -16,7 +16,7 @@ describe('LazyLookupExport', () => {
   });
 
   it('skips over any results that omit Name property', async () => {
-    listExports.mockReturnValueOnce({
+    mockCloudFormationClient.on(ListExportsCommand).resolvesOnce({
       Exports: [
         createExport(1),
         createExport(2),
@@ -27,6 +27,7 @@ describe('LazyLookupExport', () => {
       ],
       NextToken: undefined,
     });
+
     const lookup = new LazyLookupExport(mockSdk);
 
     const result = await lookup.lookupExport('test-name-3');
@@ -37,29 +38,18 @@ describe('LazyLookupExport', () => {
     let lookup: LazyLookupExport;
     beforeEach(() => {
       lookup = new LazyLookupExport(mockSdk);
-      listExports
-        .mockReset()
-        .mockReturnValueOnce({
-          Exports: [
-            createExport(1),
-            createExport(2),
-            createExport(3),
-          ],
+      mockCloudFormationClient
+        .on(ListExportsCommand)
+        .resolvesOnce({
+          Exports: [createExport(1), createExport(2), createExport(3)],
           NextToken: 'next-token-1',
         })
-        .mockReturnValueOnce({
-          Exports: [
-            createExport(4),
-            createExport(5),
-            createExport(6),
-          ],
+        .resolvesOnce({
+          Exports: [createExport(4), createExport(5), createExport(6)],
           NextToken: 'next-token-2',
         })
-        .mockReturnValueOnce({
-          Exports: [
-            createExport(7),
-            createExport(8),
-          ],
+        .resolvesOnce({
+          Exports: [createExport(7), createExport(8)],
           NextToken: undefined,
         });
     });
@@ -73,16 +63,16 @@ describe('LazyLookupExport', () => {
 
     it('stops fetching once export is found', async () => {
       await lookup.lookupExport('test-name-3');
-      expect(listExports).toHaveBeenCalledTimes(1);
+      expect(mockCloudFormationClient).toHaveReceivedCommandTimes(ListExportsCommand, 1);
     });
 
     it('paginates', async () => {
       await lookup.lookupExport('test-name-7');
-      expect(listExports).toHaveBeenCalledTimes(3);
-      expect(listExports).toHaveBeenCalledWith({
+      expect(mockCloudFormationClient).toHaveReceivedCommandTimes(ListExportsCommand, 3);
+      expect(mockCloudFormationClient).toHaveReceivedCommandWith(ListExportsCommand, {
         NextToken: 'next-token-1',
       });
-      expect(listExports).toHaveBeenCalledWith({
+      expect(mockCloudFormationClient).toHaveReceivedCommandWith(ListExportsCommand, {
         NextToken: 'next-token-2',
       });
     });
@@ -91,7 +81,7 @@ describe('LazyLookupExport', () => {
       await lookup.lookupExport('test-name-3');
       await lookup.lookupExport('test-name-3');
       await lookup.lookupExport('test-name-3');
-      expect(listExports).toHaveBeenCalledTimes(1);
+      expect(mockCloudFormationClient).toHaveReceivedCommandTimes(ListExportsCommand, 1);
     });
 
     it('returns undefined if the export does not exist', async () => {
diff --git a/packages/aws-cdk/test/api/logs/find-cloudwatch-logs.test.ts b/packages/aws-cdk/test/api/logs/find-cloudwatch-logs.test.ts
index c54eccd73ed47..d12104ed4f730 100644
--- a/packages/aws-cdk/test/api/logs/find-cloudwatch-logs.test.ts
+++ b/packages/aws-cdk/test/api/logs/find-cloudwatch-logs.test.ts
@@ -1,19 +1,35 @@
-/* eslint-disable import/order */
 import * as cxapi from '@aws-cdk/cx-api';
-import { CloudFormation } from 'aws-sdk';
+import {
+  ListStackResourcesCommand,
+  ListStackResourcesCommandInput,
+  StackResourceSummary,
+  StackStatus,
+} from '@aws-sdk/client-cloudformation';
+import { SdkProvider } from '../../../lib';
 import { findCloudWatchLogGroups } from '../../../lib/api/logs/find-cloudwatch-logs';
 import { testStack, TestStackArtifact } from '../../util';
-import { MockSdkProvider } from '../../util/mock-sdk';
+import { mockCloudFormationClient, MockSdk, MockSdkProvider } from '../../util/mock-sdk';
 
-let logsMockSdkProvider: LogsMockSdkProvider;
-let mockGetEndpointSuffix: () => string;
+let sdk: MockSdk;
+let logsMockSdkProvider: SdkProvider;
 
 beforeEach(() => {
-  logsMockSdkProvider = new LogsMockSdkProvider();
-  mockGetEndpointSuffix = jest.fn(() => 'amazonaws.com');
-  logsMockSdkProvider.stubGetEndpointSuffix(mockGetEndpointSuffix);
+  logsMockSdkProvider = new MockSdkProvider();
+  sdk = new MockSdk();
+  sdk.getUrlSuffix = () => Promise.resolve('amazonaws.com');
+  jest.resetAllMocks();
   // clear the array
   currentCfnStackResources.splice(0);
+  mockCloudFormationClient.on(ListStackResourcesCommand).callsFake((input: ListStackResourcesCommandInput) => {
+    if (input.StackName !== STACK_NAME) {
+      throw new Error(
+        `Expected Stack name in listStackResources() call to be: '${STACK_NAME}', but received: ${input.StackName}'`,
+      );
+    }
+    return {
+      StackResourceSummaries: currentCfnStackResources,
+    };
+  });
 });
 
 test('add log groups from lambda function', async () => {
@@ -33,7 +49,7 @@ test('add log groups from lambda function', async () => {
   pushStackResourceSummaries(stackSummaryOf('Func', 'AWS::Lambda::Function', 'my-function'));
 
   // WHEN
-  const result = await findCloudWatchLogGroups(logsMockSdkProvider.mockSdkProvider, cdkStackArtifact);
+  const result = await findCloudWatchLogGroups(logsMockSdkProvider, cdkStackArtifact);
 
   // THEN
   expect(result.logGroupNames).toEqual(['/aws/lambda/my-function']);
@@ -59,7 +75,7 @@ test('add log groups from lambda function when using custom LoggingConfig', asyn
   pushStackResourceSummaries(stackSummaryOf('Func', 'AWS::Lambda::Function', 'my-function'));
 
   // WHEN
-  const result = await findCloudWatchLogGroups(logsMockSdkProvider.mockSdkProvider, cdkStackArtifact);
+  const result = await findCloudWatchLogGroups(logsMockSdkProvider, cdkStackArtifact);
 
   // THEN
   expect(result.logGroupNames).toEqual(['/this/custom/my-custom-log-group']);
@@ -93,7 +109,7 @@ test('add log groups from lambda function when using custom LoggingConfig using
   pushStackResourceSummaries(stackSummaryOf('Func', 'AWS::Lambda::Function', 'my-function'));
 
   // WHEN
-  const result = await findCloudWatchLogGroups(logsMockSdkProvider.mockSdkProvider, cdkStackArtifact);
+  const result = await findCloudWatchLogGroups(logsMockSdkProvider, cdkStackArtifact);
 
   // THEN
   expect(result.logGroupNames).toEqual(['/this/custom/my-custom-log-group']);
@@ -113,7 +129,7 @@ test('add log groups from lambda function without physical name', async () => {
   pushStackResourceSummaries(stackSummaryOf('Func', 'AWS::Lambda::Function', 'my-function'));
 
   // WHEN
-  const result = await findCloudWatchLogGroups(logsMockSdkProvider.mockSdkProvider, cdkStackArtifact);
+  const result = await findCloudWatchLogGroups(logsMockSdkProvider, cdkStackArtifact);
 
   // THEN
   expect(result.logGroupNames).toEqual(['/aws/lambda/my-function']);
@@ -126,7 +142,7 @@ test('empty template', async () => {
   });
 
   // WHEN
-  const result = await findCloudWatchLogGroups(logsMockSdkProvider.mockSdkProvider, cdkStackArtifact);
+  const result = await findCloudWatchLogGroups(logsMockSdkProvider, cdkStackArtifact);
 
   // THEN
   expect(result.logGroupNames).toEqual([]);
@@ -165,7 +181,7 @@ test('add log groups from ECS Task Definitions', async () => {
   pushStackResourceSummaries(stackSummaryOf('LogGroup', 'AWS::Logs::LogGroup', 'log_group'));
 
   // WHEN
-  const result = await findCloudWatchLogGroups(logsMockSdkProvider.mockSdkProvider, cdkStackArtifact);
+  const result = await findCloudWatchLogGroups(logsMockSdkProvider, cdkStackArtifact);
 
   // THEN
   expect(result.logGroupNames).toEqual(['log_group']);
@@ -204,7 +220,7 @@ test('add log groups from State Machines', async () => {
   pushStackResourceSummaries(stackSummaryOf('LogGroup', 'AWS::Logs::LogGroup', 'log_group'));
 
   // WHEN
-  const result = await findCloudWatchLogGroups(logsMockSdkProvider.mockSdkProvider, cdkStackArtifact);
+  const result = await findCloudWatchLogGroups(logsMockSdkProvider, cdkStackArtifact);
 
   // THEN
   expect(result.logGroupNames).toEqual(['log_group']);
@@ -262,7 +278,7 @@ test('excluded log groups are not added', async () => {
   pushStackResourceSummaries(stackSummaryOf('Def', 'AWS::CodeBuild:Project', 'project'));
 
   // WHEN
-  const result = await findCloudWatchLogGroups(logsMockSdkProvider.mockSdkProvider, cdkStackArtifact);
+  const result = await findCloudWatchLogGroups(logsMockSdkProvider, cdkStackArtifact);
 
   // THEN
   expect(result.logGroupNames).toEqual([]);
@@ -285,7 +301,7 @@ test('unassociated log groups are added', async () => {
   pushStackResourceSummaries(stackSummaryOf('LogGroup', 'AWS::Logs::LogGroup', 'log_group'));
 
   // WHEN
-  const result = await findCloudWatchLogGroups(logsMockSdkProvider.mockSdkProvider, cdkStackArtifact);
+  const result = await findCloudWatchLogGroups(logsMockSdkProvider, cdkStackArtifact);
 
   // THEN
   expect(result.logGroupNames).toEqual(['log_group']);
@@ -305,25 +321,25 @@ test('log groups without physical names are added', async () => {
   pushStackResourceSummaries(stackSummaryOf('LogGroup', 'AWS::Logs::LogGroup', 'log_group'));
 
   // WHEN
-  const result = await findCloudWatchLogGroups(logsMockSdkProvider.mockSdkProvider, cdkStackArtifact);
+  const result = await findCloudWatchLogGroups(logsMockSdkProvider, cdkStackArtifact);
 
   // THEN
   expect(result.logGroupNames).toEqual(['log_group']);
 });
 
 const STACK_NAME = 'withouterrors';
-const currentCfnStackResources: CloudFormation.StackResourceSummary[] = [];
+const currentCfnStackResources: StackResourceSummary[] = [];
 
-function pushStackResourceSummaries(...items: CloudFormation.StackResourceSummary[]) {
+function pushStackResourceSummaries(...items: StackResourceSummary[]) {
   currentCfnStackResources.push(...items);
 }
 
-function stackSummaryOf(logicalId: string, resourceType: string, physicalResourceId: string): CloudFormation.StackResourceSummary {
+function stackSummaryOf(logicalId: string, resourceType: string, physicalResourceId: string): StackResourceSummary {
   return {
     LogicalResourceId: logicalId,
     PhysicalResourceId: physicalResourceId,
     ResourceType: resourceType,
-    ResourceStatus: 'CREATE_COMPLETE',
+    ResourceStatus: StackStatus.CREATE_COMPLETE,
     LastUpdatedTimestamp: new Date(),
   };
 }
@@ -334,26 +350,3 @@ function cdkStackArtifactOf(testStackArtifact: Partial<TestStackArtifact> = {}):
     ...testStackArtifact,
   });
 }
-
-class LogsMockSdkProvider {
-  public readonly mockSdkProvider: MockSdkProvider;
-
-  constructor() {
-    this.mockSdkProvider = new MockSdkProvider({ realSdk: false });
-
-    this.mockSdkProvider.stubCloudFormation({
-      listStackResources: ({ StackName: stackName }) => {
-        if (stackName !== STACK_NAME) {
-          throw new Error(`Expected Stack name in listStackResources() call to be: '${STACK_NAME}', but received: ${stackName}'`);
-        }
-        return {
-          StackResourceSummaries: currentCfnStackResources,
-        };
-      },
-    });
-  }
-
-  public stubGetEndpointSuffix(stub: () => string) {
-    this.mockSdkProvider.stubGetEndpointSuffix(stub);
-  }
-}
diff --git a/packages/aws-cdk/test/api/logs/logs-monitor.test.ts b/packages/aws-cdk/test/api/logs/logs-monitor.test.ts
index 5d35455b0c846..85f903e7681a8 100644
--- a/packages/aws-cdk/test/api/logs/logs-monitor.test.ts
+++ b/packages/aws-cdk/test/api/logs/logs-monitor.test.ts
@@ -1,15 +1,17 @@
-/* eslint-disable import/order */
+import { FilterLogEventsCommand, type FilteredLogEvent } from '@aws-sdk/client-cloudwatch-logs';
 import { blue, yellow } from 'chalk';
 import { CloudWatchLogEventMonitor } from '../../../lib/api/logs/logs-monitor';
 import { sleep } from '../../util';
-import { MockSdk } from '../../util/mock-sdk';
+import { MockSdk, mockCloudWatchClient } from '../../util/mock-sdk';
 
 let sdk: MockSdk;
 let stderrMock: jest.SpyInstance;
 let monitor: CloudWatchLogEventMonitor;
 beforeEach(() => {
   monitor = new CloudWatchLogEventMonitor(new Date(T100));
-  stderrMock = jest.spyOn(process.stderr, 'write').mockImplementation(() => { return true; });
+  stderrMock = jest.spyOn(process.stderr, 'write').mockImplementation(() => {
+    return true;
+  });
   sdk = new MockSdk();
 });
 
@@ -21,13 +23,10 @@ afterEach(() => {
 test('process events', async () => {
   // GIVEN
   const eventDate = new Date(T0 + 102 * 1000);
-  sdk.stubCloudWatchLogs({
-    filterLogEvents() {
-      return {
-        events: [event(102, 'message', eventDate)],
-      };
-    },
+  mockCloudWatchClient.on(FilterLogEventsCommand).resolves({
+    events: [event(102, 'message', eventDate)],
   });
+
   monitor.addLogGroups(
     {
       name: 'name',
@@ -45,26 +44,20 @@ test('process events', async () => {
   // THEN
   const expectedLocaleTimeString = eventDate.toLocaleTimeString();
   expect(stderrMock).toHaveBeenCalledTimes(1);
-  expect(stderrMock.mock.calls[0][0]).toContain(
-    `[${blue('loggroup')}] ${yellow(expectedLocaleTimeString)} message`,
-  );
+  expect(stderrMock.mock.calls[0][0]).toContain(`[${blue('loggroup')}] ${yellow(expectedLocaleTimeString)} message`);
 });
 
 test('process truncated events', async () => {
   // GIVEN
   const eventDate = new Date(T0 + 102 * 1000);
-  const events: AWS.CloudWatchLogs.FilteredLogEvents = [];
+  const events: FilteredLogEvent[] = [];
   for (let i = 0; i < 100; i++) {
-    events.push(event(102+i, 'message' + i, eventDate));
+    events.push(event(102 + i, 'message' + i, eventDate));
   }
 
-  sdk.stubCloudWatchLogs({
-    filterLogEvents() {
-      return {
-        events,
-        nextToken: 'some-token',
-      };
-    },
+  mockCloudWatchClient.on(FilterLogEventsCommand).resolves({
+    events,
+    nextToken: 'some-token',
   });
   monitor.addLogGroups(
     {
@@ -83,9 +76,7 @@ test('process truncated events', async () => {
   // THEN
   const expectedLocaleTimeString = eventDate.toLocaleTimeString();
   expect(stderrMock).toHaveBeenCalledTimes(101);
-  expect(stderrMock.mock.calls[0][0]).toContain(
-    `[${blue('loggroup')}] ${yellow(expectedLocaleTimeString)} message`,
-  );
+  expect(stderrMock.mock.calls[0][0]).toContain(`[${blue('loggroup')}] ${yellow(expectedLocaleTimeString)} message`);
   expect(stderrMock.mock.calls[100][0]).toContain(
     `[${blue('loggroup')}] ${yellow(expectedLocaleTimeString)} >>> \`watch\` shows only the first 100 log messages - the rest have been truncated...`,
   );
@@ -93,7 +84,7 @@ test('process truncated events', async () => {
 
 const T0 = 1597837230504;
 const T100 = T0 + 100 * 1000;
-function event(nr: number, message: string, timestamp: Date): AWS.CloudWatchLogs.FilteredLogEvent {
+function event(nr: number, message: string, timestamp: Date): FilteredLogEvent {
   return {
     eventId: `${nr}`,
     message,
diff --git a/packages/aws-cdk/test/api/sdk-provider.test.ts b/packages/aws-cdk/test/api/sdk-provider.test.ts
index 05f3cba57b4bf..7078955f75d89 100644
--- a/packages/aws-cdk/test/api/sdk-provider.test.ts
+++ b/packages/aws-cdk/test/api/sdk-provider.test.ts
@@ -1,26 +1,36 @@
-/* eslint-disable import/order */
 import * as os from 'os';
 import { bockfs } from '@aws-cdk/cdk-build-tools';
 import * as cxapi from '@aws-cdk/cx-api';
-import * as AWS from 'aws-sdk';
-import type { ConfigurationOptions } from 'aws-sdk/lib/config-base';
+import { AssumeRoleCommand, GetCallerIdentityCommand } from '@aws-sdk/client-sts';
 import * as promptly from 'promptly';
 import * as uuid from 'uuid';
 import { FakeSts, RegisterRoleOptions, RegisterUserOptions } from './fake-sts';
-import { ISDK, Mode, SDK, SdkProvider, defaultCliUserAgent } from '../../lib/api/aws-auth';
-import { PluginHost } from '../../lib/api/plugin';
+import { ConfigurationOptions, SDK, SdkProvider } from '../../lib/api/aws-auth';
+import { AwsCliCompatible } from '../../lib/api/aws-auth/awscli-compatible';
+import { defaultCliUserAgent } from '../../lib/api/aws-auth/user-agent';
+import { Mode, PluginHost } from '../../lib/api/plugin';
 import * as logging from '../../lib/logging';
 import { withMocked } from '../util';
+import { mockSTSClient, restoreSdkMocksToDefault } from '../util/mock-sdk';
+
+let mockFetchMetadataToken = jest.fn();
+let mockRequest = jest.fn();
+
+jest.mock('@aws-sdk/ec2-metadata-service', () => {
+  return {
+    MetadataService: jest.fn().mockImplementation(() => {
+      return {
+        fetchMetadataToken: mockFetchMetadataToken,
+        request: mockRequest,
+      };
+    }),
+  };
+});
 
 jest.mock('promptly', () => ({
   prompt: jest.fn().mockResolvedValue('1234'),
 }));
 
-const defaultCredOptions = {
-  ec2creds: false,
-  containerCreds: false,
-};
-
 let uid: string;
 let pluginQueried = false;
 
@@ -36,15 +46,19 @@ beforeEach(() => {
 
   PluginHost.instance.credentialProviderSources.splice(0);
   PluginHost.instance.credentialProviderSources.push({
-    isAvailable() { return Promise.resolve(true); },
-    canProvideCredentials(account) { return Promise.resolve(account === uniq('99999')); },
+    isAvailable() {
+      return Promise.resolve(true);
+    },
+    canProvideCredentials(account) {
+      return Promise.resolve(account === uniq('99999'));
+    },
     getProvider() {
       pluginQueried = true;
-      return Promise.resolve(new AWS.Credentials({
+      return Promise.resolve({
         accessKeyId: `${uid}plugin_key`,
         secretAccessKey: 'plugin_secret',
         sessionToken: 'plugin_token',
-      }));
+      });
     },
     name: 'test plugin',
   });
@@ -53,10 +67,13 @@ beforeEach(() => {
   // prepare() then we don't accidentally want to fall back to system config.
   process.env.AWS_CONFIG_FILE = '/dev/null';
   process.env.AWS_SHARED_CREDENTIALS_FILE = '/dev/null';
+
+  restoreSdkMocksToDefault();
 });
 
 afterEach(() => {
   bockfs.restore();
+  jest.restoreAllMocks();
 });
 
 function uniq(account: string) {
@@ -78,6 +95,7 @@ describe('with intercepted network calls', () => {
 
     // Make sure the KeyID returned by the plugin is recognized
     fakeSts.registerUser(uniq('99999'), uniq('plugin_key'));
+    mockRequest = jest.fn().mockResolvedValue(JSON.stringify({ region: undefined }));
   });
 
   afterEach(() => {
@@ -89,8 +107,12 @@ describe('with intercepted network calls', () => {
   describe('when CDK does not AssumeRole', () => {
     test('uses default credentials by default', async () => {
       // WHEN
+      const account = uniq('11111');
+      mockSTSClient.on(GetCallerIdentityCommand).resolves({
+        Account: account,
+        Arn: 'arn:aws-here',
+      });
       prepareCreds({
-        fakeSts,
         credentials: {
           default: { aws_access_key_id: 'access', $account: '11111', $fakeStsOptions: { partition: 'aws-here' } },
         },
@@ -102,16 +124,17 @@ describe('with intercepted network calls', () => {
 
       // THEN
       expect(provider.defaultRegion).toEqual('eu-bla-5');
-      await expect(provider.defaultAccount()).resolves.toEqual({ accountId: uniq('11111'), partition: 'aws-here' });
+      await expect(provider.defaultAccount()).resolves.toEqual({ accountId: account, partition: 'aws-here' });
 
       // Ask for a different region
-      const sdk = (await provider.forEnvironment({ ...env(uniq('11111')), region: 'rgn' }, Mode.ForReading)).sdk;
+      const sdk = (await provider.forEnvironment({ ...env(account), region: 'rgn' }, Mode.ForReading)).sdk;
       expect(sdkConfig(sdk).credentials!.accessKeyId).toEqual(uniq('access'));
       expect(sdk.currentRegion).toEqual('rgn');
     });
 
     test('throws if profile credentials are not for the right account', async () => {
       // WHEN
+      jest.spyOn(AwsCliCompatible, 'region').mockResolvedValue('us-east-123');
       prepareCreds({
         fakeSts,
         config: {
@@ -120,7 +143,9 @@ describe('with intercepted network calls', () => {
       });
       const provider = await providerFromProfile('boo');
 
-      await expect(provider.forEnvironment(env(uniq('some_account_#')), Mode.ForReading)).rejects.toThrow('Need to perform AWS calls');
+      await expect(provider.forEnvironment(env(uniq('some_account_#')), Mode.ForReading)).rejects.toThrow(
+        'Need to perform AWS calls',
+      );
     });
 
     test('use profile acct/region if agnostic env requested', async () => {
@@ -137,7 +162,12 @@ describe('with intercepted network calls', () => {
       const provider = await providerFromProfile(undefined);
 
       // THEN
-      const sdk = (await provider.forEnvironment(cxapi.EnvironmentUtils.make(cxapi.UNKNOWN_ACCOUNT, cxapi.UNKNOWN_REGION), Mode.ForReading)).sdk;
+      const sdk = (
+        await provider.forEnvironment(
+          cxapi.EnvironmentUtils.make(cxapi.UNKNOWN_ACCOUNT, cxapi.UNKNOWN_REGION),
+          Mode.ForReading,
+        )
+      ).sdk;
       expect(sdkConfig(sdk).credentials!.accessKeyId).toEqual(uniq('access'));
       expect((await sdk.currentAccount()).accountId).toEqual(uniq('11111'));
       expect(sdk.currentRegion).toEqual('eu-bla-5');
@@ -145,6 +175,7 @@ describe('with intercepted network calls', () => {
 
     test('passing profile skips EnvironmentCredentials', async () => {
       // GIVEN
+      const calls = jest.spyOn(console, 'debug');
       prepareCreds({
         fakeSts,
         credentials: {
@@ -152,17 +183,11 @@ describe('with intercepted network calls', () => {
         },
       });
       const provider = await providerFromProfile('foo');
-
-      const environmentCredentialsPrototype = (new AWS.EnvironmentCredentials('AWS')).constructor.prototype;
-
-      await withMocked(environmentCredentialsPrototype, 'refresh', async (refresh) => {
-        refresh.mockImplementation((callback: (err?: Error) => void) => callback(new Error('This function should not have been called')));
-
-        // WHEN
-        expect((await provider.defaultAccount())?.accountId).toEqual(uniq('11111'));
-
-        expect(refresh).not.toHaveBeenCalled();
-      });
+      await provider.defaultAccount();
+      // Only credential-provider-ini is used.
+      expect(calls).toHaveBeenCalledTimes(2);
+      expect(calls.mock.calls[0]).toEqual(['@aws-sdk/credential-provider-ini - fromIni']);
+      expect(calls.mock.calls[1]).toEqual(['@aws-sdk/credential-provider-ini - resolveStaticCredentials']);
     });
 
     test('supports profile spread over config_file and credentials_file', async () => {
@@ -177,7 +202,7 @@ describe('with intercepted network calls', () => {
           'profile foo': { region: 'eu-west-1' },
         },
       });
-      const provider = await SdkProvider.withAwsCliCompatibleDefaults({ ...defaultCredOptions, profile: 'foo' });
+      const provider = await providerFromProfile('foo');
 
       // THEN
       expect(provider.defaultRegion).toEqual('eu-west-1');
@@ -208,6 +233,7 @@ describe('with intercepted network calls', () => {
 
     test('can assume-role configured in config', async () => {
       // GIVEN
+      jest.spyOn(console, 'debug');
       prepareCreds({
         fakeSts,
         credentials: {
@@ -239,7 +265,11 @@ describe('with intercepted network calls', () => {
         fakeSts,
         credentials: {
           assumer: { aws_access_key_id: 'assumer', $account: '22222' },
-          assumable: { role_arn: 'arn:aws:iam::12356789012:role/Assumable', source_profile: 'assumer', $account: '22222' },
+          assumable: {
+            role_arn: 'arn:aws:iam::12356789012:role/Assumable',
+            source_profile: 'assumer',
+            $account: '22222',
+          },
         },
         config: {
           'profile assumable': { region: 'eu-bla-5' },
@@ -278,11 +308,12 @@ describe('with intercepted network calls', () => {
       // THEN
       const sdk = (await provider.forEnvironment(env(uniq('66666')), Mode.ForReading)).sdk;
       expect((await sdk.currentAccount()).accountId).toEqual(uniq('66666'));
-      expect(fakeSts.assumedRoles[0]).toEqual(expect.objectContaining({
-        roleArn: 'arn:aws:iam::66666:role/Assumable',
-        serialNumber: 'arn:aws:iam::account:mfa/user',
-        tokenCode: '1234',
-      }));
+      expect(mockSTSClient).toHaveReceivedCommandWith(AssumeRoleCommand, {
+        RoleArn: 'arn:aws:iam::66666:role/Assumable',
+        SerialNumber: 'arn:aws:iam::account:mfa/user',
+        TokenCode: '1234',
+        RoleSessionName: expect.anything(),
+      });
 
       // Mock response was set to fail to make sure we don't call STS
       // Make sure the MFA mock was called during this test
@@ -300,11 +331,11 @@ describe('with intercepted network calls', () => {
     test('error we get from assuming a role is useful', async () => {
       // GIVEN
       prepareCreds({
-        fakeSts,
         config: {
           default: { aws_access_key_id: 'foo' },
         },
       });
+      mockSTSClient.on(AssumeRoleCommand).rejectsOnce('doesnotexist.role.arn');
       const provider = await providerFromProfile(undefined);
 
       // WHEN
@@ -320,7 +351,7 @@ describe('with intercepted network calls', () => {
     test('assuming a role sanitizes the username into the session name', async () => {
       // GIVEN
       prepareCreds({
-        fakeSts,
+        // fakeSts,
         config: {
           default: { aws_access_key_id: 'foo', $account: '11111' },
         },
@@ -332,13 +363,16 @@ describe('with intercepted network calls', () => {
         // WHEN
         const provider = await providerFromProfile(undefined);
 
-        const sdk = (await provider.forEnvironment(env(uniq('88888')), Mode.ForReading, { assumeRoleArn: 'arn:aws:role' })).sdk as SDK;
+        const sdk = (
+          await provider.forEnvironment(env(uniq('88888')), Mode.ForReading, { assumeRoleArn: 'arn:aws:role' })
+        ).sdk as SDK;
         await sdk.currentAccount();
 
         // THEN
-        expect(fakeSts.assumedRoles[0]).toEqual(expect.objectContaining({
-          roleSessionName: 'aws-cdk-sk@l',
-        }));
+        expect(mockSTSClient).toHaveReceivedCommandWith(AssumeRoleCommand, {
+          RoleArn: 'arn:aws:role',
+          RoleSessionName: 'aws-cdk-sk@l',
+        });
       });
     });
 
@@ -357,28 +391,32 @@ describe('with intercepted network calls', () => {
         // WHEN
         const provider = await providerFromProfile(undefined);
 
-        const sdk = (await provider.forEnvironment(env(uniq('88888')), Mode.ForReading,
-          {
+        const sdk = (
+          await provider.forEnvironment(env(uniq('88888')), Mode.ForReading, {
             assumeRoleArn: 'arn:aws:role',
             assumeRoleExternalId: 'bruh',
             assumeRoleAdditionalOptions: {
               Tags: [{ Key: 'Department', Value: 'Engineering' }],
             },
-          })).sdk as SDK;
+          })
+        ).sdk as SDK;
         await sdk.currentAccount();
 
         // THEN
-        expect(fakeSts.assumedRoles[0]).toEqual(expect.objectContaining({
-          tags: [{ Key: 'Department', Value: 'Engineering' }],
-          transitiveTagKeys: ['Department'],
-        }));
+        expect(mockSTSClient).toHaveReceivedCommandWith(AssumeRoleCommand, {
+          Tags: [{ Key: 'Department', Value: 'Engineering' }],
+          TransitiveTagKeys: ['Department'],
+          RoleArn: 'arn:aws:role',
+          ExternalId: 'bruh',
+          RoleSessionName: 'aws-cdk-sk@l',
+        });
       });
     });
 
     test('assuming a role does not fail when OS username cannot be read', async () => {
       // GIVEN
       prepareCreds({
-        fakeSts,
+        // fakeSts,
         config: {
           default: { aws_access_key_id: 'foo', $account: '11111' },
         },
@@ -393,20 +431,23 @@ describe('with intercepted network calls', () => {
         // WHEN
         const provider = await providerFromProfile(undefined);
 
-        const sdk = (await provider.forEnvironment(env(uniq('88888')), Mode.ForReading, { assumeRoleArn: 'arn:aws:role' })).sdk as SDK;
+        const sdk = (
+          await provider.forEnvironment(env(uniq('88888')), Mode.ForReading, { assumeRoleArn: 'arn:aws:role' })
+        ).sdk as SDK;
         await sdk.currentAccount();
 
         // THEN
-        expect(fakeSts.assumedRoles[0]).toEqual(expect.objectContaining({
-          roleSessionName: 'aws-cdk-noname',
-        }));
+        expect(mockSTSClient).toHaveReceivedCommandWith(AssumeRoleCommand, {
+          RoleArn: 'arn:aws:role',
+          RoleSessionName: 'aws-cdk-noname',
+        });
       });
     });
 
     test('even if current credentials are for the wrong account, we will still use them to AssumeRole', async () => {
       // GIVEN
       prepareCreds({
-        fakeSts,
+        // fakeSts,
         config: {
           default: { aws_access_key_id: 'foo', $account: '11111' },
         },
@@ -414,7 +455,9 @@ describe('with intercepted network calls', () => {
       const provider = await providerFromProfile(undefined);
 
       // WHEN
-      const sdk = (await provider.forEnvironment(env(uniq('88888')), Mode.ForReading, { assumeRoleArn: 'arn:aws:role' })).sdk as SDK;
+      const sdk = (
+        await provider.forEnvironment(env(uniq('88888')), Mode.ForReading, { assumeRoleArn: 'arn:aws:role' })
+      ).sdk as SDK;
 
       // THEN
       expect((await sdk.currentAccount()).accountId).toEqual(uniq('88888'));
@@ -423,7 +466,7 @@ describe('with intercepted network calls', () => {
     test('if AssumeRole fails but current credentials are for the right account, we will still use them', async () => {
       // GIVEN
       prepareCreds({
-        fakeSts,
+        // fakeSts,
         config: {
           default: { aws_access_key_id: 'foo', $account: '88888' },
         },
@@ -431,7 +474,9 @@ describe('with intercepted network calls', () => {
       const provider = await providerFromProfile(undefined);
 
       // WHEN - assumeRole fails because the role can only be assumed from account 11111
-      const sdk = (await provider.forEnvironment(env(uniq('88888')), Mode.ForReading, { assumeRoleArn: 'arn:aws:role' })).sdk as SDK;
+      const sdk = (
+        await provider.forEnvironment(env(uniq('88888')), Mode.ForReading, { assumeRoleArn: 'arn:aws:role' })
+      ).sdk as SDK;
 
       // THEN
       expect((await sdk.currentAccount()).accountId).toEqual(uniq('88888'));
@@ -440,17 +485,20 @@ describe('with intercepted network calls', () => {
     test('if AssumeRole fails because of ExpiredToken, then fail completely', async () => {
       // GIVEN
       prepareCreds({
-        fakeSts,
+        // fakeSts,
         config: {
           default: { aws_access_key_id: 'foo', $account: '88888' },
         },
       });
+      const error = new Error('Too late');
+      error.name = 'ExpiredToken';
+      mockSTSClient.on(AssumeRoleCommand).rejectsOnce(error);
       const provider = await providerFromProfile(undefined);
 
       // WHEN - assumeRole fails with a specific error
       await expect(async () => {
         await provider.forEnvironment(env(uniq('88888')), Mode.ForReading, { assumeRoleArn: '<FAIL:ExpiredToken>' });
-      }).rejects.toThrow(/ExpiredToken/);
+      }).rejects.toThrow(error);
     });
   });
 
@@ -481,15 +529,18 @@ describe('with intercepted network calls', () => {
         assumeRoleArn: 'arn:aws:iam::99999:role/Assumable',
       });
 
-      expect(fakeSts.assumedRoles[0]).toEqual(expect.objectContaining({
-        roleArn: 'arn:aws:iam::99999:role/Assumable',
-      }));
+      expect(mockSTSClient).toHaveReceivedCommandWith(AssumeRoleCommand, {
+        RoleArn: 'arn:aws:iam::99999:role/Assumable',
+        RoleSessionName: expect.anything(),
+      });
       expect(pluginQueried).toEqual(true);
     });
 
     test('even if AssumeRole fails but current credentials are from a plugin, we will still use them', async () => {
       const provider = await providerFromProfile(undefined);
-      const sdk = (await provider.forEnvironment(env(uniq('99999')), Mode.ForReading, { assumeRoleArn: 'does:not:exist' })).sdk;
+      const sdk = (
+        await provider.forEnvironment(env(uniq('99999')), Mode.ForReading, { assumeRoleArn: 'does:not:exist' })
+      ).sdk;
 
       // THEN
       expect((await sdk.currentAccount()).accountId).toEqual(uniq('99999'));
@@ -511,67 +562,88 @@ describe('with intercepted network calls', () => {
 
   describe('support for credential_source', () => {
     test('can assume role with ecs credentials', async () => {
-      return withMocked(AWS.ECSCredentials.prototype, 'needsRefresh', async (needsRefresh) => {
-        // GIVEN
-        prepareCreds({
-          config: {
-            'profile ecs': { role_arn: 'arn:aws:iam::12356789012:role/Assumable', credential_source: 'EcsContainer', $account: '22222' },
+      // GIVEN
+      const calls = jest.spyOn(console, 'debug');
+      prepareCreds({
+        config: {
+          'profile ecs': {
+            role_arn: 'arn:aws:iam::12356789012:role/Assumable',
+            credential_source: 'EcsContainer',
+            $account: '22222',
           },
-        });
-        const provider = await providerFromProfile('ecs');
-
-        // WHEN
-        await provider.defaultAccount();
-
-        // THEN
-        expect(needsRefresh).toHaveBeenCalled();
+        },
       });
 
+      // WHEN
+      const provider = await providerFromProfile('ecs');
+      await provider.defaultAccount();
+
+      // THEN
+      expect(calls.mock.calls).toContainEqual([
+        '@aws-sdk/credential-provider-ini - finding credential resolver using profile=[ecs]',
+      ]);
+      expect(calls.mock.calls).toContainEqual(['@aws-sdk/credential-provider-ini - credential_source is EcsContainer']);
     });
 
     test('can assume role with ec2 credentials', async () => {
-      return withMocked(AWS.EC2MetadataCredentials.prototype, 'needsRefresh', async (needsRefresh) => {
-        // GIVEN
-        prepareCreds({
-          config: {
-            'profile ecs': { role_arn: 'arn:aws:iam::12356789012:role/Assumable', credential_source: 'Ec2InstanceMetadata', $account: '22222' },
+      // GIVEN
+      const calls = jest.spyOn(console, 'debug');
+      prepareCreds({
+        config: {
+          'profile ecs': {
+            role_arn: 'arn:aws:iam::12356789012:role/Assumable',
+            credential_source: 'Ec2InstanceMetadata',
+            $account: '22222',
           },
-        });
-        const provider = await providerFromProfile('ecs');
-
-        // WHEN
-        await provider.defaultAccount();
-
-        // THEN
-        expect(needsRefresh).toHaveBeenCalled();
-
+        },
       });
 
+      // WHEN
+      const provider = await providerFromProfile('ecs');
+      await provider.defaultAccount();
+
+      // THEN
+      expect(calls.mock.calls).toContainEqual([
+        '@aws-sdk/credential-provider-ini - finding credential resolver using profile=[ecs]',
+      ]);
+      expect(calls.mock.calls).toContainEqual([
+        '@aws-sdk/credential-provider-ini - credential_source is Ec2InstanceMetadata',
+      ]);
     });
 
     test('can assume role with env credentials', async () => {
-      return withMocked(AWS.EnvironmentCredentials.prototype, 'needsRefresh', async (needsRefresh) => {
-        // GIVEN
-        prepareCreds({
-          config: {
-            'profile ecs': { role_arn: 'arn:aws:iam::12356789012:role/Assumable', credential_source: 'Environment', $account: '22222' },
+      // GIVEN
+      const calls = jest.spyOn(console, 'debug');
+      prepareCreds({
+        config: {
+          'profile ecs': {
+            role_arn: 'arn:aws:iam::12356789012:role/Assumable',
+            credential_source: 'Environment',
+            $account: '22222',
           },
-        });
-        const provider = await providerFromProfile('ecs');
+        },
+      });
 
-        // WHEN
-        await provider.defaultAccount();
+      // WHEN
+      const provider = await providerFromProfile('ecs');
+      await provider.defaultAccount();
 
-        // THEN
-        expect(needsRefresh).toHaveBeenCalled();
-      });
+      // THEN
+      expect(calls.mock.calls).toContainEqual([
+        '@aws-sdk/credential-provider-ini - finding credential resolver using profile=[ecs]',
+      ]);
+      expect(calls.mock.calls).toContainEqual(['@aws-sdk/credential-provider-ini - credential_source is Environment']);
     });
 
     test('assume fails with unsupported credential_source', async () => {
       // GIVEN
       prepareCreds({
         config: {
-          'profile ecs': { role_arn: 'arn:aws:iam::12356789012:role/Assumable', credential_source: 'unsupported', $account: '22222' },
+          'profile ecs': {
+            role_arn: 'arn:aws:iam::12356789012:role/Assumable',
+            credential_source: 'unsupported',
+            $account: '22222',
+          },
         },
       });
       const provider = await providerFromProfile('ecs');
@@ -586,8 +658,7 @@ describe('with intercepted network calls', () => {
 
   test('defaultAccount returns undefined if STS call fails', async () => {
     // GIVEN
-    process.env.AWS_ACCESS_KEY_ID = `${uid}akid`;
-    process.env.AWS_SECRET_ACCESS_KEY = 'sekrit';
+    mockSTSClient.on(AssumeRoleCommand).rejectsOnce('Oops, bad sekrit');
 
     // WHEN
     const provider = await providerFromProfile(undefined);
@@ -598,8 +669,9 @@ describe('with intercepted network calls', () => {
 
   test('defaultAccount returns undefined, event if STS call fails with ExpiredToken', async () => {
     // GIVEN
-    process.env.AWS_ACCESS_KEY_ID = `${uid}'<FAIL:ExpiredToken>'`;
-    process.env.AWS_SECRET_ACCESS_KEY = 'sekrit';
+    const error = new Error('Too late');
+    error.name = 'ExpiredToken';
+    mockSTSClient.on(AssumeRoleCommand).rejectsOnce(error);
 
     // WHEN
     const provider = await providerFromProfile(undefined);
@@ -609,54 +681,6 @@ describe('with intercepted network calls', () => {
   });
 });
 
-test('even when using a profile to assume another profile, STS calls goes through the proxy', async () => {
-  prepareCreds({
-    credentials: {
-      assumer: { aws_access_key_id: 'assumer' },
-    },
-    config: {
-      'default': { region: 'eu-bla-5' },
-      'profile assumable': { role_arn: 'arn:aws:iam::66666:role/Assumable', source_profile: 'assumer', $account: '66666' },
-      'profile assumer': { region: 'us-east-2' },
-    },
-  });
-
-  // Messy mocking
-  let called = false;
-  jest.mock('proxy-agent', () => {
-    // eslint-disable-next-line @typescript-eslint/no-require-imports
-    class FakeAgent extends require('https').Agent {
-      public addRequest(_: any, __: any) {
-        // FIXME: this error takes 6 seconds to be completely handled. It
-        // might be retries in the SDK somewhere, or something about the Node
-        // event loop. I've spent an hour trying to figure it out and I can't,
-        // and I gave up. We'll just have to live with this until someone gets
-        // inspired.
-        const error = new Error('ABORTED BY TEST');
-        (error as any).code = 'RequestAbortedError';
-        (error as any).retryable = false;
-        called = true;
-        throw error;
-      }
-    }
-    return { ProxyAgent: FakeAgent };
-  });
-
-  // WHEN
-  const provider = await SdkProvider.withAwsCliCompatibleDefaults({
-    ...defaultCredOptions,
-    profile: 'assumable',
-    httpOptions: {
-      proxyAddress: 'http://DOESNTMATTER/',
-    },
-  });
-
-  await provider.defaultAccount();
-
-  // THEN -- the fake proxy agent got called, we don't care about the result
-  expect(called).toEqual(true);
-});
-
 test('default useragent is reasonable', () => {
   expect(defaultCliUserAgent()).toContain('aws-cdk/');
 });
@@ -664,7 +688,7 @@ test('default useragent is reasonable', () => {
 /**
  * Use object hackery to get the credentials out of the SDK object
  */
-function sdkConfig(sdk: ISDK): ConfigurationOptions {
+function sdkConfig(sdk: SDK): ConfigurationOptions {
   return (sdk as any).config;
 }
 
@@ -699,7 +723,11 @@ function prepareCreds(options: PrepareCredsOptions) {
         if (user.aws_access_key_id) {
           ret.push(`aws_access_key_id=${uniq(user.aws_access_key_id)}`);
           ret.push('aws_secret_access_key=secret');
-          options.fakeSts?.registerUser(uniq(user.$account ?? '00000'), uniq(user.aws_access_key_id), user.$fakeStsOptions);
+          options.fakeSts?.registerUser(
+            uniq(user.$account ?? '00000'),
+            uniq(user.aws_access_key_id),
+            user.$fakeStsOptions,
+          );
         }
       }
 
@@ -756,6 +784,6 @@ function isProfileRole(x: ProfileUser | ProfileRole): x is ProfileRole {
   return 'role_arn' in x;
 }
 
-function providerFromProfile(profile: string | undefined) {
-  return SdkProvider.withAwsCliCompatibleDefaults({ ...defaultCredOptions, profile });
+async function providerFromProfile(profile: string | undefined) {
+  return SdkProvider.withAwsCliCompatibleDefaults({ profile, logger: console });
 }
diff --git a/packages/aws-cdk/test/api/stack-activity-monitor.test.ts b/packages/aws-cdk/test/api/stack-activity-monitor.test.ts
index a07ec99e40b38..a5cf50df7ec25 100644
--- a/packages/aws-cdk/test/api/stack-activity-monitor.test.ts
+++ b/packages/aws-cdk/test/api/stack-activity-monitor.test.ts
@@ -2,6 +2,7 @@
 import { bold, reset, green, yellow, red } from 'chalk';
 import { stderr } from './console-listener';
 import { HistoryActivityPrinter } from '../../lib/api/util/cloudformation/stack-activity-monitor';
+import { ResourceStatus } from '@aws-sdk/client-cloudformation';
 
 let TIMESTAMP: number;
 let HUMAN_TIME: string;
@@ -22,7 +23,7 @@ test('prints 0/4 progress report, when addActivity is called with an "IN_PROGRES
     historyActivityPrinter.addActivity({
       event: {
         LogicalResourceId: 'stack1',
-        ResourceStatus: 'IN_PROGRESS',
+        ResourceStatus: ResourceStatus.CREATE_IN_PROGRESS,
         Timestamp: new Date(TIMESTAMP),
         ResourceType: 'AWS::CloudFormation::Stack',
         StackId: '',
@@ -33,7 +34,9 @@ test('prints 0/4 progress report, when addActivity is called with an "IN_PROGRES
     });
   });
 
-  expect(output[0].trim()).toStrictEqual(`stack-name | 0/4 | ${HUMAN_TIME} | ${reset('IN_PROGRESS         ')} | AWS::CloudFormation::Stack | ${reset(bold('stack1'))}`);
+  expect(output[0].trim()).toStrictEqual(
+    `stack-name | 0/4 | ${HUMAN_TIME} | ${reset('CREATE_IN_PROGRESS  ')} | AWS::CloudFormation::Stack | ${reset(bold('stack1'))}`,
+  );
 });
 
 test('prints 1/4 progress report, when addActivity is called with an "UPDATE_COMPLETE" ResourceStatus', () => {
@@ -47,7 +50,7 @@ test('prints 1/4 progress report, when addActivity is called with an "UPDATE_COM
     historyActivityPrinter.addActivity({
       event: {
         LogicalResourceId: 'stack1',
-        ResourceStatus: 'UPDATE_COMPLETE',
+        ResourceStatus: ResourceStatus.UPDATE_COMPLETE,
         Timestamp: new Date(TIMESTAMP),
         ResourceType: 'AWS::CloudFormation::Stack',
         StackId: '',
@@ -58,10 +61,12 @@ test('prints 1/4 progress report, when addActivity is called with an "UPDATE_COM
     });
   });
 
-  expect(output[0].trim()).toStrictEqual(`stack-name | 1/4 | ${HUMAN_TIME} | ${green('UPDATE_COMPLETE     ')} | AWS::CloudFormation::Stack | ${green(bold('stack1'))}`);
+  expect(output[0].trim()).toStrictEqual(
+    `stack-name | 1/4 | ${HUMAN_TIME} | ${green('UPDATE_COMPLETE     ')} | AWS::CloudFormation::Stack | ${green(bold('stack1'))}`,
+  );
 });
 
-test('prints 1/4 progress report, when addActivity is called with an "UPDATE_COMPLETE_CLEAN_IN_PROGRESS" ResourceStatus', () => {
+test('prints 1/4 progress report, when addActivity is called with an "UPDATE_COMPLETE" ResourceStatus', () => {
   const historyActivityPrinter = new HistoryActivityPrinter({
     resourceTypeColumnWidth: 23,
     resourcesTotal: 3,
@@ -72,7 +77,7 @@ test('prints 1/4 progress report, when addActivity is called with an "UPDATE_COM
     historyActivityPrinter.addActivity({
       event: {
         LogicalResourceId: 'stack1',
-        ResourceStatus: 'UPDATE_COMPLETE_CLEANUP_IN_PROGRESS',
+        ResourceStatus: ResourceStatus.UPDATE_COMPLETE,
         Timestamp: new Date(TIMESTAMP),
         ResourceType: 'AWS::CloudFormation::Stack',
         StackId: '',
@@ -83,10 +88,12 @@ test('prints 1/4 progress report, when addActivity is called with an "UPDATE_COM
     });
   });
 
-  expect(output[0].trim()).toStrictEqual(`stack-name | 1/4 | ${HUMAN_TIME} | ${green('UPDATE_COMPLETE_CLEA')} | AWS::CloudFormation::Stack | ${green(bold('stack1'))}`);
+  expect(output[0].trim()).toStrictEqual(
+    `stack-name | 1/4 | ${HUMAN_TIME} | ${green('UPDATE_COMPLETE     ')} | AWS::CloudFormation::Stack | ${green(bold('stack1'))}`,
+  );
 });
 
-test('prints 1/4 progress report, when addActivity is called with an "ROLLBACK_COMPLETE_CLEAN_IN_PROGRESS" ResourceStatus', () => {
+test('prints 1/4 progress report, when addActivity is called with an "ROLLBACK_COMPLETE" ResourceStatus', () => {
   const historyActivityPrinter = new HistoryActivityPrinter({
     resourceTypeColumnWidth: 23,
     resourcesTotal: 3,
@@ -97,7 +104,7 @@ test('prints 1/4 progress report, when addActivity is called with an "ROLLBACK_C
     historyActivityPrinter.addActivity({
       event: {
         LogicalResourceId: 'stack1',
-        ResourceStatus: 'ROLLBACK_COMPLETE_CLEANUP_IN_PROGRESS',
+        ResourceStatus: ResourceStatus.ROLLBACK_COMPLETE,
         Timestamp: new Date(TIMESTAMP),
         ResourceType: 'AWS::CloudFormation::Stack',
         StackId: '',
@@ -108,7 +115,9 @@ test('prints 1/4 progress report, when addActivity is called with an "ROLLBACK_C
     });
   });
 
-  expect(output[0].trim()).toStrictEqual(`stack-name | 1/4 | ${HUMAN_TIME} | ${yellow('ROLLBACK_COMPLETE_CL')} | AWS::CloudFormation::Stack | ${yellow(bold('stack1'))}`);
+  expect(output[0].trim()).toStrictEqual(
+    `stack-name | 1/4 | ${HUMAN_TIME} | ${yellow('ROLLBACK_COMPLETE   ')} | AWS::CloudFormation::Stack | ${yellow(bold('stack1'))}`,
+  );
 });
 
 test('prints 0/4 progress report, when addActivity is called with an "UPDATE_FAILED" ResourceStatus', () => {
@@ -122,7 +131,7 @@ test('prints 0/4 progress report, when addActivity is called with an "UPDATE_FAI
     historyActivityPrinter.addActivity({
       event: {
         LogicalResourceId: 'stack1',
-        ResourceStatus: 'UPDATE_FAILED',
+        ResourceStatus: ResourceStatus.UPDATE_FAILED,
         Timestamp: new Date(TIMESTAMP),
         ResourceType: 'AWS::CloudFormation::Stack',
         StackId: '',
@@ -133,7 +142,9 @@ test('prints 0/4 progress report, when addActivity is called with an "UPDATE_FAI
     });
   });
 
-  expect(output[0].trim()).toStrictEqual(`stack-name | 0/4 | ${HUMAN_TIME} | ${red('UPDATE_FAILED       ')} | AWS::CloudFormation::Stack | ${red(bold('stack1'))}`);
+  expect(output[0].trim()).toStrictEqual(
+    `stack-name | 0/4 | ${HUMAN_TIME} | ${red('UPDATE_FAILED       ')} | AWS::CloudFormation::Stack | ${red(bold('stack1'))}`,
+  );
 });
 
 test('does not print "Failed Resources:" list, when all deployments are successful', () => {
@@ -147,7 +158,7 @@ test('does not print "Failed Resources:" list, when all deployments are successf
     historyActivityPrinter.addActivity({
       event: {
         LogicalResourceId: 'stack1',
-        ResourceStatus: 'IN_PROGRESS',
+        ResourceStatus: ResourceStatus.UPDATE_IN_PROGRESS,
         Timestamp: new Date(TIMESTAMP),
         ResourceType: 'AWS::CloudFormation::Stack',
         StackId: '',
@@ -159,7 +170,7 @@ test('does not print "Failed Resources:" list, when all deployments are successf
     historyActivityPrinter.addActivity({
       event: {
         LogicalResourceId: 'stack1',
-        ResourceStatus: 'UPDATE_COMPLETE',
+        ResourceStatus: ResourceStatus.UPDATE_COMPLETE,
         Timestamp: new Date(TIMESTAMP),
         ResourceType: 'AWS::CloudFormation::Stack',
         StackId: '',
@@ -171,7 +182,7 @@ test('does not print "Failed Resources:" list, when all deployments are successf
     historyActivityPrinter.addActivity({
       event: {
         LogicalResourceId: 'stack2',
-        ResourceStatus: 'UPDATE_COMPLETE',
+        ResourceStatus: ResourceStatus.UPDATE_COMPLETE,
         Timestamp: new Date(TIMESTAMP),
         ResourceType: 'AWS::CloudFormation::Stack',
         StackId: '',
@@ -184,9 +195,15 @@ test('does not print "Failed Resources:" list, when all deployments are successf
   });
 
   expect(output.length).toStrictEqual(3);
-  expect(output[0].trim()).toStrictEqual(`stack-name | 0/2 | ${HUMAN_TIME} | ${reset('IN_PROGRESS         ')} | AWS::CloudFormation::Stack | ${reset(bold('stack1'))}`);
-  expect(output[1].trim()).toStrictEqual(`stack-name | 1/2 | ${HUMAN_TIME} | ${green('UPDATE_COMPLETE     ')} | AWS::CloudFormation::Stack | ${green(bold('stack1'))}`);
-  expect(output[2].trim()).toStrictEqual(`stack-name | 2/2 | ${HUMAN_TIME} | ${green('UPDATE_COMPLETE     ')} | AWS::CloudFormation::Stack | ${green(bold('stack2'))}`);
+  expect(output[0].trim()).toStrictEqual(
+    `stack-name | 0/2 | ${HUMAN_TIME} | ${reset('UPDATE_IN_PROGRESS  ')} | AWS::CloudFormation::Stack | ${reset(bold('stack1'))}`,
+  );
+  expect(output[1].trim()).toStrictEqual(
+    `stack-name | 1/2 | ${HUMAN_TIME} | ${green('UPDATE_COMPLETE     ')} | AWS::CloudFormation::Stack | ${green(bold('stack1'))}`,
+  );
+  expect(output[2].trim()).toStrictEqual(
+    `stack-name | 2/2 | ${HUMAN_TIME} | ${green('UPDATE_COMPLETE     ')} | AWS::CloudFormation::Stack | ${green(bold('stack2'))}`,
+  );
 });
 
 test('prints "Failed Resources:" list, when at least one deployment fails', () => {
@@ -200,7 +217,7 @@ test('prints "Failed Resources:" list, when at least one deployment fails', () =
     historyActivityPrinter.addActivity({
       event: {
         LogicalResourceId: 'stack1',
-        ResourceStatus: 'IN_PROGRESS',
+        ResourceStatus: ResourceStatus.UPDATE_IN_PROGRESS,
         Timestamp: new Date(TIMESTAMP),
         ResourceType: 'AWS::CloudFormation::Stack',
         StackId: '',
@@ -212,7 +229,7 @@ test('prints "Failed Resources:" list, when at least one deployment fails', () =
     historyActivityPrinter.addActivity({
       event: {
         LogicalResourceId: 'stack1',
-        ResourceStatus: 'UPDATE_FAILED',
+        ResourceStatus: ResourceStatus.UPDATE_FAILED,
         Timestamp: new Date(TIMESTAMP),
         ResourceType: 'AWS::CloudFormation::Stack',
         StackId: '',
@@ -225,10 +242,16 @@ test('prints "Failed Resources:" list, when at least one deployment fails', () =
   });
 
   expect(output.length).toStrictEqual(4);
-  expect(output[0].trim()).toStrictEqual(`stack-name | 0/2 | ${HUMAN_TIME} | ${reset('IN_PROGRESS         ')} | AWS::CloudFormation::Stack | ${reset(bold('stack1'))}`);
-  expect(output[1].trim()).toStrictEqual(`stack-name | 0/2 | ${HUMAN_TIME} | ${red('UPDATE_FAILED       ')} | AWS::CloudFormation::Stack | ${red(bold('stack1'))}`);
+  expect(output[0].trim()).toStrictEqual(
+    `stack-name | 0/2 | ${HUMAN_TIME} | ${reset('UPDATE_IN_PROGRESS  ')} | AWS::CloudFormation::Stack | ${reset(bold('stack1'))}`,
+  );
+  expect(output[1].trim()).toStrictEqual(
+    `stack-name | 0/2 | ${HUMAN_TIME} | ${red('UPDATE_FAILED       ')} | AWS::CloudFormation::Stack | ${red(bold('stack1'))}`,
+  );
   expect(output[2].trim()).toStrictEqual('Failed resources:');
-  expect(output[3].trim()).toStrictEqual(`stack-name | ${HUMAN_TIME} | ${red('UPDATE_FAILED       ')} | AWS::CloudFormation::Stack | ${red(bold('stack1'))}`);
+  expect(output[3].trim()).toStrictEqual(
+    `stack-name | ${HUMAN_TIME} | ${red('UPDATE_FAILED       ')} | AWS::CloudFormation::Stack | ${red(bold('stack1'))}`,
+  );
 });
 
 test('print failed resources because of hook failures', () => {
@@ -242,7 +265,7 @@ test('print failed resources because of hook failures', () => {
     historyActivityPrinter.addActivity({
       event: {
         LogicalResourceId: 'stack1',
-        ResourceStatus: 'IN_PROGRESS',
+        ResourceStatus: ResourceStatus.UPDATE_IN_PROGRESS,
         Timestamp: new Date(TIMESTAMP),
         ResourceType: 'AWS::CloudFormation::Stack',
         StackId: '',
@@ -257,7 +280,7 @@ test('print failed resources because of hook failures', () => {
     historyActivityPrinter.addActivity({
       event: {
         LogicalResourceId: 'stack1',
-        ResourceStatus: 'UPDATE_FAILED',
+        ResourceStatus: ResourceStatus.UPDATE_FAILED,
         Timestamp: new Date(TIMESTAMP),
         ResourceType: 'AWS::CloudFormation::Stack',
         StackId: '',
@@ -271,9 +294,14 @@ test('print failed resources because of hook failures', () => {
   });
 
   expect(output.length).toStrictEqual(4);
-  expect(output[0].trim()).toStrictEqual(`stack-name | 0/2 | ${HUMAN_TIME} | ${reset('IN_PROGRESS         ')} | AWS::CloudFormation::Stack | ${reset(bold('stack1'))}`);
-  expect(output[1].trim()).toStrictEqual(`stack-name | 0/2 | ${HUMAN_TIME} | ${red('UPDATE_FAILED       ')} | AWS::CloudFormation::Stack | ${red(bold('stack1'))} ${red(bold('The following hook(s) failed: hook1 : stack1 must obey certain rules'))}`);
+  expect(output[0].trim()).toStrictEqual(
+    `stack-name | 0/2 | ${HUMAN_TIME} | ${reset('UPDATE_IN_PROGRESS  ')} | AWS::CloudFormation::Stack | ${reset(bold('stack1'))}`,
+  );
+  expect(output[1].trim()).toStrictEqual(
+    `stack-name | 0/2 | ${HUMAN_TIME} | ${red('UPDATE_FAILED       ')} | AWS::CloudFormation::Stack | ${red(bold('stack1'))} ${red(bold('The following hook(s) failed: hook1 : stack1 must obey certain rules'))}`,
+  );
   expect(output[2].trim()).toStrictEqual('Failed resources:');
-  expect(output[3].trim()).toStrictEqual(`stack-name | ${HUMAN_TIME} | ${red('UPDATE_FAILED       ')} | AWS::CloudFormation::Stack | ${red(bold('stack1'))} ${red(bold('The following hook(s) failed: hook1 : stack1 must obey certain rules'))}`);
+  expect(output[3].trim()).toStrictEqual(
+    `stack-name | ${HUMAN_TIME} | ${red('UPDATE_FAILED       ')} | AWS::CloudFormation::Stack | ${red(bold('stack1'))} ${red(bold('The following hook(s) failed: hook1 : stack1 must obey certain rules'))}`,
+  );
 });
-
diff --git a/packages/aws-cdk/test/aws-sdk-non-public-apis.test.ts b/packages/aws-cdk/test/aws-sdk-non-public-apis.test.ts
deleted file mode 100644
index 5ea8284690f7d..0000000000000
--- a/packages/aws-cdk/test/aws-sdk-non-public-apis.test.ts
+++ /dev/null
@@ -1,26 +0,0 @@
-/* eslint-disable import/order */
-// The ECS hotswapping functionality in lib/api/hotswap/ecs-services.ts
-// uses some non-public APIs of the JS AWS SDK for waiting on the deployment to finish.
-// These unit tests are here to confirm the non-public elements are present and working as expected,
-// and do not get changed in a new version of the aws-sdk package
-
-import * as AWS from 'aws-sdk';
-
-let ecsService: AWS.ECS;
-beforeEach(() => {
-  ecsService = new AWS.ECS();
-});
-
-test("the 'waiters' API is available in the current AWS SDK", () => {
-  const waiters = (ecsService as any).api?.waiters;
-
-  expect(waiters).not.toBeUndefined();
-  expect(typeof waiters).toBe('object');
-});
-
-test("the 'ResourceWaiter' API is available in the current AWS SDK", () => {
-  const resourceWaiter = new (AWS as any).ResourceWaiter(ecsService, 'servicesStable');
-
-  // make sure the 'wait' method is available
-  expect(typeof resourceWaiter.wait).toBe('function');
-});
diff --git a/packages/aws-cdk/test/cdk-toolkit.test.ts b/packages/aws-cdk/test/cdk-toolkit.test.ts
index 248f6d615dfe7..027b968bbf106 100644
--- a/packages/aws-cdk/test/cdk-toolkit.test.ts
+++ b/packages/aws-cdk/test/cdk-toolkit.test.ts
@@ -17,7 +17,10 @@ const fakeChokidarWatcherOn = {
     return firstCall[1];
   },
 
-  get fileEventCallback(): (event: 'add' | 'addDir' | 'change' | 'unlink' | 'unlinkDir', path: string) => Promise<void> {
+  get fileEventCallback(): (
+    event: 'add' | 'addDir' | 'change' | 'unlink' | 'unlinkDir',
+    path: string,
+  ) => Promise<void> {
     expect(mockChokidarWatcherOn.mock.calls.length).toBeGreaterThanOrEqual(2);
     const secondCall = mockChokidarWatcherOn.mock.calls[1];
     // let's make sure the first argument is not the 'ready' event,
@@ -54,17 +57,33 @@ jest.mock('../lib/logging', () => ({
 }));
 jest.setTimeout(30_000);
 
+import 'aws-sdk-client-mock';
 import * as os from 'os';
 import * as path from 'path';
 import * as cxschema from '@aws-cdk/cloud-assembly-schema';
 import { Manifest } from '@aws-cdk/cloud-assembly-schema';
 import * as cxapi from '@aws-cdk/cx-api';
+import { DescribeStacksCommand, GetTemplateCommand, StackStatus } from '@aws-sdk/client-cloudformation';
+import { GetParameterCommand } from '@aws-sdk/client-ssm';
 import * as fs from 'fs-extra';
 import { instanceMockFrom, MockCloudExecutable, TestStackArtifact } from './util';
-import { MockSdkProvider } from './util/mock-sdk';
+import { SdkProvider } from '../lib';
+import {
+  mockCloudFormationClient,
+  MockSdk,
+  MockSdkProvider,
+  mockSSMClient,
+  restoreSdkMocksToDefault,
+} from './util/mock-sdk';
 import { Bootstrapper } from '../lib/api/bootstrap';
 import { DeployStackResult } from '../lib/api/deploy-stack';
-import { Deployments, DeployStackOptions, DestroyStackOptions, RollbackStackOptions, RollbackStackResult } from '../lib/api/deployments';
+import {
+  Deployments,
+  DeployStackOptions,
+  DestroyStackOptions,
+  RollbackStackOptions,
+  RollbackStackResult,
+} from '../lib/api/deployments';
 import { HotswapMode } from '../lib/api/hotswap/common';
 import { Template } from '../lib/api/util/cloudformation';
 import { CdkToolkit, Tag } from '../lib/cdk-toolkit';
@@ -79,25 +98,30 @@ let bootstrapper: jest.Mocked<Bootstrapper>;
 let stderrMock: jest.SpyInstance;
 beforeEach(() => {
   jest.resetAllMocks();
+  restoreSdkMocksToDefault();
 
   mockChokidarWatch.mockReturnValue(fakeChokidarWatcher);
   // on() in chokidar's Watcher returns 'this'
   mockChokidarWatcherOn.mockReturnValue(fakeChokidarWatcher);
 
   bootstrapper = instanceMockFrom(Bootstrapper);
-  bootstrapper.bootstrapEnvironment.mockResolvedValue({ noOp: false, outputs: {} } as any);
+  bootstrapper.bootstrapEnvironment.mockResolvedValue({
+    noOp: false,
+    outputs: {},
+  } as any);
 
   cloudExecutable = new MockCloudExecutable({
-    stacks: [
-      MockStack.MOCK_STACK_A,
-      MockStack.MOCK_STACK_B,
+    stacks: [MockStack.MOCK_STACK_A, MockStack.MOCK_STACK_B],
+    nestedAssemblies: [
+      {
+        stacks: [MockStack.MOCK_STACK_C],
+      },
     ],
-    nestedAssemblies: [{
-      stacks: [MockStack.MOCK_STACK_C],
-    }],
   });
 
-  stderrMock = jest.spyOn(process.stderr, 'write').mockImplementation(() => { return true; });
+  stderrMock = jest.spyOn(process.stderr, 'write').mockImplementation(() => {
+    return true;
+  });
 });
 
 function defaultToolkitSetup() {
@@ -113,11 +137,15 @@ function defaultToolkitSetup() {
   });
 }
 
+const mockSdk = new MockSdk();
+
 describe('readCurrentTemplate', () => {
   let template: any;
-  let mockForEnvironment = jest.fn();
   let mockCloudExecutable: MockCloudExecutable;
+  let sdkProvider: SdkProvider;
+  let mockForEnvironment: any;
   beforeEach(() => {
+    jest.resetAllMocks();
     template = {
       Resources: {
         Func: {
@@ -151,53 +179,43 @@ describe('readCurrentTemplate', () => {
         },
       ],
     });
-    mockForEnvironment = jest.fn().mockImplementation(() => {
-      return { sdk: mockCloudExecutable.sdkProvider.sdk, didAssumeRole: true };
-    });
-    mockCloudExecutable.sdkProvider.forEnvironment = mockForEnvironment;
-    mockCloudExecutable.sdkProvider.stubCloudFormation({
-      getTemplate() {
-        return {
-          TemplateBody: JSON.stringify(template),
-        };
-      },
-      describeStacks() {
-        return {
-          Stacks: [
-            {
-              StackName: 'Test-Stack-C',
-              StackStatus: 'CREATE_COMPLETE',
-              CreationTime: new Date(),
-            },
-            {
-              StackName: 'Test-Stack-A',
-              StackStatus: 'CREATE_COMPLETE',
-              CreationTime: new Date(),
-            },
-          ],
-        };
-      },
-    });
+    sdkProvider = mockCloudExecutable.sdkProvider;
+    mockForEnvironment = jest
+      .spyOn(sdkProvider, 'forEnvironment')
+      .mockResolvedValue({ sdk: mockSdk, didAssumeRole: true });
+    mockCloudFormationClient
+      .on(GetTemplateCommand)
+      .resolves({
+        TemplateBody: JSON.stringify(template),
+      })
+      .on(DescribeStacksCommand)
+      .resolves({
+        Stacks: [
+          {
+            StackName: 'Test-Stack-C',
+            StackStatus: StackStatus.CREATE_COMPLETE,
+            CreationTime: new Date(),
+          },
+          {
+            StackName: 'Test-Stack-A',
+            StackStatus: StackStatus.CREATE_COMPLETE,
+            CreationTime: new Date(),
+          },
+        ],
+      });
   });
 
   test('lookup role is used', async () => {
     // GIVEN
-    let requestedParameterName: string;
-    mockCloudExecutable.sdkProvider.stubSSM({
-      getParameter(request) {
-        requestedParameterName = request.Name;
-        return {
-          Parameter: {
-            Value: '6',
-          },
-        };
-      },
-    });
+    mockSSMClient.on(GetParameterCommand).resolves({ Parameter: { Value: '6' } });
+
     const cdkToolkit = new CdkToolkit({
       cloudExecutable: mockCloudExecutable,
       configuration: mockCloudExecutable.configuration,
       sdkProvider: mockCloudExecutable.sdkProvider,
-      deployments: new Deployments({ sdkProvider: mockCloudExecutable.sdkProvider }),
+      deployments: new Deployments({
+        sdkProvider: mockCloudExecutable.sdkProvider,
+      }),
     });
 
     // WHEN
@@ -207,31 +225,36 @@ describe('readCurrentTemplate', () => {
     });
 
     // THEN
-    expect(requestedParameterName!).toEqual('/bootstrap/parameter');
-    expect(mockForEnvironment.mock.calls.length).toEqual(2);
-    expect(mockForEnvironment.mock.calls[0][2]).toEqual({
-      assumeRoleArn: 'bloop-lookup:here:123456789012',
-    });
+    expect(mockSSMClient).toHaveReceivedCommandWith(GetParameterCommand, {
+      Name: '/bootstrap/parameter',
+    });
+    expect(mockForEnvironment).toHaveBeenCalledTimes(2);
+    expect(mockForEnvironment).toHaveBeenNthCalledWith(
+      1,
+      {
+        account: '123456789012',
+        name: 'aws://123456789012/here',
+        region: 'here',
+      },
+      0,
+      {
+        assumeRoleArn: 'bloop-lookup:here:123456789012',
+        assumeRoleExternalId: undefined,
+      },
+    );
   });
 
   test('fallback to deploy role if bootstrap stack version is not valid', async () => {
     // GIVEN
-    let requestedParameterName: string;
-    mockCloudExecutable.sdkProvider.stubSSM({
-      getParameter(request) {
-        requestedParameterName = request.Name;
-        return {
-          Parameter: {
-            Value: '1',
-          },
-        };
-      },
-    });
+    mockSSMClient.on(GetParameterCommand).resolves({ Parameter: { Value: '1' } });
+
     const cdkToolkit = new CdkToolkit({
       cloudExecutable: mockCloudExecutable,
       configuration: mockCloudExecutable.configuration,
       sdkProvider: mockCloudExecutable.sdkProvider,
-      deployments: new Deployments({ sdkProvider: mockCloudExecutable.sdkProvider }),
+      deployments: new Deployments({
+        sdkProvider: mockCloudExecutable.sdkProvider,
+      }),
     });
 
     // WHEN
@@ -241,32 +264,56 @@ describe('readCurrentTemplate', () => {
     });
 
     // THEN
-    expect(flatten(stderrMock.mock.calls)).toEqual(expect.arrayContaining([
-      expect.stringMatching(/Could not assume bloop-lookup:here:123456789012/),
-      expect.stringContaining("Bootstrap stack version '5' is required, found version '1'. To get rid of this error, please upgrade to bootstrap version >= 5"),
-    ]));
-    expect(requestedParameterName!).toEqual('/bootstrap/parameter');
-    expect(mockForEnvironment.mock.calls.length).toEqual(3);
-    expect(mockForEnvironment.mock.calls[0][2]).toEqual({
-      assumeRoleArn: 'bloop-lookup:here:123456789012',
-    });
-    expect(mockForEnvironment.mock.calls[1][2]).toEqual({
-      assumeRoleArn: 'bloop:here:123456789012',
-    });
+    expect(flatten(stderrMock.mock.calls)).toEqual(
+      expect.arrayContaining([
+        expect.stringMatching(/Could not assume bloop-lookup:here:123456789012/),
+        expect.stringContaining(
+          "Bootstrap stack version '5' is required, found version '1'. To get rid of this error, please upgrade to bootstrap version >= 5",
+        ),
+      ]),
+    );
+    expect(mockSSMClient).toHaveReceivedCommandWith(GetParameterCommand, {
+      Name: '/bootstrap/parameter',
+    });
+    expect(mockForEnvironment).toHaveBeenCalledTimes(3);
+    expect(mockForEnvironment).toHaveBeenNthCalledWith(
+      1,
+      {
+        account: '123456789012',
+        name: 'aws://123456789012/here',
+        region: 'here',
+      },
+      0,
+      {
+        assumeRoleArn: 'bloop-lookup:here:123456789012',
+        assumeRoleExternalId: undefined,
+      },
+    );
+    expect(mockForEnvironment).toHaveBeenNthCalledWith(
+      2,
+      {
+        account: '123456789012',
+        name: 'aws://123456789012/here',
+        region: 'here',
+      },
+      0,
+      {
+        assumeRoleArn: 'bloop:here:123456789012',
+        assumeRoleExternalId: undefined,
+      },
+    );
   });
 
   test('fallback to deploy role if bootstrap version parameter not found', async () => {
     // GIVEN
-    mockCloudExecutable.sdkProvider.stubSSM({
-      getParameter() {
-        throw new Error('not found');
-      },
-    });
+    mockSSMClient.on(GetParameterCommand).rejects('not found');
     const cdkToolkit = new CdkToolkit({
       cloudExecutable: mockCloudExecutable,
       configuration: mockCloudExecutable.configuration,
       sdkProvider: mockCloudExecutable.sdkProvider,
-      deployments: new Deployments({ sdkProvider: mockCloudExecutable.sdkProvider }),
+      deployments: new Deployments({
+        sdkProvider: mockCloudExecutable.sdkProvider,
+      }),
     });
 
     // WHEN
@@ -276,34 +323,52 @@ describe('readCurrentTemplate', () => {
     });
 
     // THEN
-    expect(flatten(stderrMock.mock.calls)).toEqual(expect.arrayContaining([
-      expect.stringMatching(/Could not assume bloop-lookup:here:123456789012/),
-    ]));
-    expect(mockForEnvironment.mock.calls.length).toEqual(3);
-    expect(mockForEnvironment.mock.calls[0][2]).toEqual({
-      assumeRoleArn: 'bloop-lookup:here:123456789012',
-    });
-    expect(mockForEnvironment.mock.calls[1][2]).toEqual({
-      assumeRoleArn: 'bloop:here:123456789012',
-    });
+    expect(flatten(stderrMock.mock.calls)).toEqual(
+      expect.arrayContaining([expect.stringMatching(/Could not assume bloop-lookup:here:123456789012/)]),
+    );
+    expect(mockForEnvironment).toHaveBeenCalledTimes(3);
+    expect(mockForEnvironment).toHaveBeenNthCalledWith(
+      1,
+      {
+        account: '123456789012',
+        name: 'aws://123456789012/here',
+        region: 'here',
+      },
+      0,
+      {
+        assumeRoleArn: 'bloop-lookup:here:123456789012',
+        assumeRoleExternalId: undefined,
+      },
+    );
+    expect(mockForEnvironment).toHaveBeenNthCalledWith(
+      2,
+      {
+        account: '123456789012',
+        name: 'aws://123456789012/here',
+        region: 'here',
+      },
+      0,
+      {
+        assumeRoleArn: 'bloop:here:123456789012',
+        assumeRoleExternalId: undefined,
+      },
+    );
   });
 
   test('fallback to deploy role if forEnvironment throws', async () => {
     // GIVEN
     // throw error first for the 'prepareSdkWithLookupRoleFor' call and succeed for the rest
-    mockForEnvironment = jest.fn().mockImplementationOnce(() => { throw new Error('error'); })
-      .mockImplementation(() => { return { sdk: mockCloudExecutable.sdkProvider.sdk, didAssumeRole: true }; });
-    mockCloudExecutable.sdkProvider.forEnvironment = mockForEnvironment;
-    mockCloudExecutable.sdkProvider.stubSSM({
-      getParameter() {
-        return {};
-      },
+    mockForEnvironment = jest.spyOn(sdkProvider, 'forEnvironment').mockImplementationOnce(() => {
+      throw new Error('error');
     });
+
     const cdkToolkit = new CdkToolkit({
       cloudExecutable: mockCloudExecutable,
       configuration: mockCloudExecutable.configuration,
       sdkProvider: mockCloudExecutable.sdkProvider,
-      deployments: new Deployments({ sdkProvider: mockCloudExecutable.sdkProvider }),
+      deployments: new Deployments({
+        sdkProvider: mockCloudExecutable.sdkProvider,
+      }),
     });
 
     // WHEN
@@ -313,33 +378,52 @@ describe('readCurrentTemplate', () => {
     });
 
     // THEN
-    expect(mockCloudExecutable.sdkProvider.sdk.ssm).not.toHaveBeenCalled();
-    expect(flatten(stderrMock.mock.calls)).toEqual(expect.arrayContaining([
-      expect.stringMatching(/Could not assume bloop-lookup:here:123456789012/),
-    ]));
-    expect(mockForEnvironment.mock.calls.length).toEqual(3);
-    expect(mockForEnvironment.mock.calls[0][2]).toEqual({
-      assumeRoleArn: 'bloop-lookup:here:123456789012',
-    });
-    expect(mockForEnvironment.mock.calls[1][2]).toEqual({
-      assumeRoleArn: 'bloop:here:123456789012',
-    });
+    expect(mockSSMClient).not.toHaveReceivedAnyCommand();
+    expect(flatten(stderrMock.mock.calls)).toEqual(
+      expect.arrayContaining([expect.stringMatching(/Could not assume bloop-lookup:here:123456789012/)]),
+    );
+    expect(mockForEnvironment).toHaveBeenCalledTimes(3);
+    expect(mockForEnvironment).toHaveBeenNthCalledWith(
+      1,
+      {
+        account: '123456789012',
+        name: 'aws://123456789012/here',
+        region: 'here',
+      },
+      0,
+      {
+        assumeRoleArn: 'bloop-lookup:here:123456789012',
+        assumeRoleExternalId: undefined,
+      },
+    );
+    expect(mockForEnvironment).toHaveBeenNthCalledWith(
+      2,
+      {
+        account: '123456789012',
+        name: 'aws://123456789012/here',
+        region: 'here',
+      },
+      0,
+      {
+        assumeRoleArn: 'bloop:here:123456789012',
+        assumeRoleExternalId: undefined,
+      },
+    );
   });
 
   test('dont lookup bootstrap version parameter if default credentials are used', async () => {
     // GIVEN
-    mockForEnvironment = jest.fn().mockImplementation(() => { return { sdk: mockCloudExecutable.sdkProvider.sdk, didAssumeRole: false }; });
+    mockForEnvironment = jest.fn().mockImplementation(() => {
+      return { sdk: mockSdk, didAssumeRole: false };
+    });
     mockCloudExecutable.sdkProvider.forEnvironment = mockForEnvironment;
     const cdkToolkit = new CdkToolkit({
       cloudExecutable: mockCloudExecutable,
       configuration: mockCloudExecutable.configuration,
       sdkProvider: mockCloudExecutable.sdkProvider,
-      deployments: new Deployments({ sdkProvider: mockCloudExecutable.sdkProvider }),
-    });
-    mockCloudExecutable.sdkProvider.stubSSM({
-      getParameter() {
-        return {};
-      },
+      deployments: new Deployments({
+        sdkProvider: mockCloudExecutable.sdkProvider,
+      }),
     });
 
     // WHEN
@@ -349,31 +433,50 @@ describe('readCurrentTemplate', () => {
     });
 
     // THEN
-    expect(flatten(stderrMock.mock.calls)).toEqual(expect.arrayContaining([
-      expect.stringMatching(/Lookup role exists but was not assumed. Proceeding with default credentials./),
-    ]));
-    expect(mockCloudExecutable.sdkProvider.sdk.ssm).not.toHaveBeenCalled();
-    expect(mockForEnvironment.mock.calls.length).toEqual(3);
-    expect(mockForEnvironment.mock.calls[0][2]).toEqual({
-      assumeRoleArn: 'bloop-lookup:here:123456789012',
-    });
-    expect(mockForEnvironment.mock.calls[1][2]).toEqual({
-      assumeRoleArn: 'bloop:here:123456789012',
-    });
+    expect(flatten(stderrMock.mock.calls)).toEqual(
+      expect.arrayContaining([
+        expect.stringMatching(/Lookup role exists but was not assumed. Proceeding with default credentials./),
+      ]),
+    );
+    expect(mockSSMClient).not.toHaveReceivedAnyCommand();
+    expect(mockForEnvironment).toHaveBeenCalledTimes(3);
+    expect(mockForEnvironment).toHaveBeenNthCalledWith(
+      1,
+      {
+        account: '123456789012',
+        name: 'aws://123456789012/here',
+        region: 'here',
+      },
+      0,
+      {
+        assumeRoleArn: 'bloop-lookup:here:123456789012',
+        assumeRoleExternalId: undefined,
+      },
+    );
+    expect(mockForEnvironment).toHaveBeenNthCalledWith(
+      2,
+      {
+        account: '123456789012',
+        name: 'aws://123456789012/here',
+        region: 'here',
+      },
+      0,
+      {
+        assumeRoleArn: 'bloop:here:123456789012',
+        assumeRoleExternalId: undefined,
+      },
+    );
   });
 
   test('do not print warnings if lookup role not provided in stack artifact', async () => {
     // GIVEN
-    mockCloudExecutable.sdkProvider.stubSSM({
-      getParameter() {
-        return {};
-      },
-    });
     const cdkToolkit = new CdkToolkit({
       cloudExecutable: mockCloudExecutable,
       configuration: mockCloudExecutable.configuration,
       sdkProvider: mockCloudExecutable.sdkProvider,
-      deployments: new Deployments({ sdkProvider: mockCloudExecutable.sdkProvider }),
+      deployments: new Deployments({
+        sdkProvider: mockCloudExecutable.sdkProvider,
+      }),
     });
 
     // WHEN
@@ -383,16 +486,40 @@ describe('readCurrentTemplate', () => {
     });
 
     // THEN
-    expect(flatten(stderrMock.mock.calls)).not.toEqual(expect.arrayContaining([
-      expect.stringMatching(/Could not assume/),
-      expect.stringMatching(/please upgrade to bootstrap version/),
-    ]));
-    expect(mockCloudExecutable.sdkProvider.sdk.ssm).not.toHaveBeenCalled();
-    expect(mockForEnvironment.mock.calls.length).toEqual(2);
-    expect(mockForEnvironment.mock.calls[0][2]).toEqual({
-      assumeRoleArn: undefined,
-      assumeRoleExternalId: undefined,
-    });
+    expect(flatten(stderrMock.mock.calls)).not.toEqual(
+      expect.arrayContaining([
+        expect.stringMatching(/Could not assume/),
+        expect.stringMatching(/please upgrade to bootstrap version/),
+      ]),
+    );
+    expect(mockSSMClient).not.toHaveReceivedAnyCommand();
+    expect(mockForEnvironment).toHaveBeenCalledTimes(2);
+    expect(mockForEnvironment).toHaveBeenNthCalledWith(
+      1,
+      {
+        account: '123456789012',
+        name: 'aws://123456789012/here',
+        region: 'here',
+      },
+      0,
+      {
+        assumeRoleArn: undefined,
+        assumeRoleExternalId: undefined,
+      },
+    );
+    expect(mockForEnvironment).toHaveBeenNthCalledWith(
+      2,
+      {
+        account: '123456789012',
+        name: 'aws://123456789012/here',
+        region: 'here',
+      },
+      1,
+      {
+        assumeRoleArn: 'bloop:here:123456789012',
+        assumeRoleExternalId: undefined,
+      },
+    );
   });
 });
 
@@ -425,22 +552,26 @@ describe('deploy', () => {
     const toolkit = defaultToolkitSetup();
 
     // WHEN
-    await expect(() => toolkit.deploy({
-      selector: { patterns: ['Test-Stack-D'] },
-      hotswap: HotswapMode.FULL_DEPLOYMENT,
-    })).rejects.toThrow('No stacks match the name(s) Test-Stack-D');
+    await expect(() =>
+      toolkit.deploy({
+        selector: { patterns: ['Test-Stack-D'] },
+        hotswap: HotswapMode.FULL_DEPLOYMENT,
+      }),
+    ).rejects.toThrow('No stacks match the name(s) Test-Stack-D');
   });
 
   describe('with hotswap deployment', () => {
     test("passes through the 'hotswap' option to CloudFormationDeployments.deployStack()", async () => {
       // GIVEN
       const mockCfnDeployments = instanceMockFrom(Deployments);
-      mockCfnDeployments.deployStack.mockReturnValue(Promise.resolve({
-        noOp: false,
-        outputs: {},
-        stackArn: 'stackArn',
-        stackArtifact: instanceMockFrom(cxapi.CloudFormationStackArtifact),
-      }));
+      mockCfnDeployments.deployStack.mockReturnValue(
+        Promise.resolve({
+          noOp: false,
+          outputs: {},
+          stackArn: 'stackArn',
+          stackArtifact: instanceMockFrom(cxapi.CloudFormationStackArtifact),
+        }),
+      );
       const cdkToolkit = new CdkToolkit({
         cloudExecutable,
         configuration: cloudExecutable.configuration,
@@ -456,9 +587,11 @@ describe('deploy', () => {
       });
 
       // THEN
-      expect(mockCfnDeployments.deployStack).toHaveBeenCalledWith(expect.objectContaining({
-        hotswap: HotswapMode.FALL_BACK,
-      }));
+      expect(mockCfnDeployments.deployStack).toHaveBeenCalledWith(
+        expect.objectContaining({
+          hotswap: HotswapMode.FALL_BACK,
+        }),
+      );
     });
   });
 
@@ -529,9 +662,12 @@ describe('deploy', () => {
           cloudExecutable,
           configuration: cloudExecutable.configuration,
           sdkProvider: cloudExecutable.sdkProvider,
-          deployments: new FakeCloudFormation({
-            'Test-Stack-A': { Foo: 'Bar' },
-          }, notificationArns),
+          deployments: new FakeCloudFormation(
+            {
+              'Test-Stack-A': { Foo: 'Bar' },
+            },
+            notificationArns,
+          ),
         });
 
         // WHEN
@@ -550,9 +686,12 @@ describe('deploy', () => {
           cloudExecutable,
           configuration: cloudExecutable.configuration,
           sdkProvider: cloudExecutable.sdkProvider,
-          deployments: new FakeCloudFormation({
-            'Test-Stack-A': { Foo: 'Bar' },
-          }, notificationArns),
+          deployments: new FakeCloudFormation(
+            {
+              'Test-Stack-A': { Foo: 'Bar' },
+            },
+            notificationArns,
+          ),
         });
 
         // WHEN
@@ -568,16 +707,17 @@ describe('deploy', () => {
 
       test('with sns notification arns in the executable', async () => {
         // GIVEN
-        const expectedNotificationArns = [
-          'arn:aws:sns:bermuda-triangle-1337:123456789012:MyTopic',
-        ];
+        const expectedNotificationArns = ['arn:aws:sns:bermuda-triangle-1337:123456789012:MyTopic'];
         const toolkit = new CdkToolkit({
           cloudExecutable,
           configuration: cloudExecutable.configuration,
           sdkProvider: cloudExecutable.sdkProvider,
-          deployments: new FakeCloudFormation({
-            'Test-Stack-Notification-Arns': { Foo: 'Bar' },
-          }, expectedNotificationArns),
+          deployments: new FakeCloudFormation(
+            {
+              'Test-Stack-Notification-Arns': { Foo: 'Bar' },
+            },
+            expectedNotificationArns,
+          ),
         });
 
         // WHEN
@@ -614,14 +754,19 @@ describe('deploy', () => {
           'arn:aws:sns:eu-west-1:111155556666:my-great-topic',
         ];
 
-        const expectedNotificationArns = notificationArns.concat(['arn:aws:sns:bermuda-triangle-1337:123456789012:MyTopic']);
+        const expectedNotificationArns = notificationArns.concat([
+          'arn:aws:sns:bermuda-triangle-1337:123456789012:MyTopic',
+        ]);
         const toolkit = new CdkToolkit({
           cloudExecutable,
           configuration: cloudExecutable.configuration,
           sdkProvider: cloudExecutable.sdkProvider,
-          deployments: new FakeCloudFormation({
-            'Test-Stack-Notification-Arns': { Foo: 'Bar' },
-          }, expectedNotificationArns),
+          deployments: new FakeCloudFormation(
+            {
+              'Test-Stack-Notification-Arns': { Foo: 'Bar' },
+            },
+            expectedNotificationArns,
+          ),
         });
 
         // WHEN
@@ -639,9 +784,12 @@ describe('deploy', () => {
           cloudExecutable,
           configuration: cloudExecutable.configuration,
           sdkProvider: cloudExecutable.sdkProvider,
-          deployments: new FakeCloudFormation({
-            'Test-Stack-Bad-Notification-Arns': { Foo: 'Bar' },
-          }, notificationArns),
+          deployments: new FakeCloudFormation(
+            {
+              'Test-Stack-Bad-Notification-Arns': { Foo: 'Bar' },
+            },
+            notificationArns,
+          ),
         });
 
         // WHEN
@@ -661,9 +809,12 @@ describe('deploy', () => {
           cloudExecutable,
           configuration: cloudExecutable.configuration,
           sdkProvider: cloudExecutable.sdkProvider,
-          deployments: new FakeCloudFormation({
-            'Test-Stack-Bad-Notification-Arns': { Foo: 'Bar' },
-          }, notificationArns),
+          deployments: new FakeCloudFormation(
+            {
+              'Test-Stack-Bad-Notification-Arns': { Foo: 'Bar' },
+            },
+            notificationArns,
+          ),
         });
 
         // WHEN
@@ -683,9 +834,12 @@ describe('deploy', () => {
           cloudExecutable,
           configuration: cloudExecutable.configuration,
           sdkProvider: cloudExecutable.sdkProvider,
-          deployments: new FakeCloudFormation({
-            'Test-Stack-Notification-Arns': { Foo: 'Bar' },
-          }, notificationArns),
+          deployments: new FakeCloudFormation(
+            {
+              'Test-Stack-Notification-Arns': { Foo: 'Bar' },
+            },
+            notificationArns,
+          ),
         });
 
         // WHEN
@@ -708,11 +862,15 @@ describe('deploy', () => {
     await toolkit.bootstrap(['aws://56789/south-pole'], bootstrapper, {});
 
     // THEN
-    expect(bootstrapper.bootstrapEnvironment).toHaveBeenCalledWith({
-      account: '56789',
-      region: 'south-pole',
-      name: 'aws://56789/south-pole',
-    }, expect.anything(), expect.anything());
+    expect(bootstrapper.bootstrapEnvironment).toHaveBeenCalledWith(
+      {
+        account: '56789',
+        region: 'south-pole',
+        name: 'aws://56789/south-pole',
+      },
+      expect.anything(),
+      expect.anything(),
+    );
     expect(bootstrapper.bootstrapEnvironment).toHaveBeenCalledTimes(1);
   });
 
@@ -725,11 +883,15 @@ describe('deploy', () => {
     await toolkit.bootstrap(['aws://*/bermuda-triangle-1'], bootstrapper, {});
 
     // THEN
-    expect(bootstrapper.bootstrapEnvironment).toHaveBeenCalledWith({
-      account: '123456789012',
-      region: 'bermuda-triangle-1',
-      name: 'aws://123456789012/bermuda-triangle-1',
-    }, expect.anything(), expect.anything());
+    expect(bootstrapper.bootstrapEnvironment).toHaveBeenCalledWith(
+      {
+        account: '123456789012',
+        region: 'bermuda-triangle-1',
+        name: 'aws://123456789012/bermuda-triangle-1',
+      },
+      expect.anything(),
+      expect.anything(),
+    );
     expect(bootstrapper.bootstrapEnvironment).toHaveBeenCalledTimes(1);
   });
 
@@ -745,11 +907,15 @@ describe('deploy', () => {
     await toolkit.bootstrap(['aws://123456789012/west-pole'], bootstrapper, {});
 
     // THEN
-    expect(bootstrapper.bootstrapEnvironment).toHaveBeenCalledWith({
-      account: '123456789012',
-      region: 'west-pole',
-      name: 'aws://123456789012/west-pole',
-    }, expect.anything(), expect.anything());
+    expect(bootstrapper.bootstrapEnvironment).toHaveBeenCalledWith(
+      {
+        account: '123456789012',
+        region: 'west-pole',
+        name: 'aws://123456789012/west-pole',
+      },
+      expect.anything(),
+      expect.anything(),
+    );
     expect(bootstrapper.bootstrapEnvironment).toHaveBeenCalledTimes(1);
 
     expect(cloudExecutable.hasApp).toEqual(false);
@@ -781,8 +947,10 @@ describe('watch', () => {
         selector: { patterns: [] },
         hotswap: HotswapMode.HOTSWAP_ONLY,
       });
-    }).rejects.toThrow("Cannot use the 'watch' command without specifying at least one directory to monitor. " +
-      'Make sure to add a "watch" key to your cdk.json');
+    }).rejects.toThrow(
+      "Cannot use the 'watch' command without specifying at least one directory to monitor. " +
+        'Make sure to add a "watch" key to your cdk.json',
+    );
   });
 
   test('observes only the root directory by default', async () => {
@@ -836,12 +1004,7 @@ describe('watch', () => {
       hotswap: HotswapMode.HOTSWAP_ONLY,
     });
 
-    expect(fakeChokidarWatch.excludeArgs).toStrictEqual([
-      'cdk.out/**',
-      '**/.*',
-      '**/.*/**',
-      '**/node_modules/**',
-    ]);
+    expect(fakeChokidarWatch.excludeArgs).toStrictEqual(['cdk.out/**', '**/.*', '**/.*/**', '**/node_modules/**']);
   });
 
   test("allows providing a single string in 'watch.exclude'", async () => {
@@ -900,7 +1063,10 @@ describe('watch', () => {
       const cdkDeployMock = jest.fn();
       toolkit.deploy = cdkDeployMock;
 
-      await toolkit.watch({ selector: { patterns: [] }, hotswap: hotswapMode });
+      await toolkit.watch({
+        selector: { patterns: [] },
+        hotswap: hotswapMode,
+      });
       fakeChokidarWatcherOn.readyCallback();
 
       expect(cdkDeployMock).toBeCalledWith(expect.objectContaining({ hotswap: hotswapMode }));
@@ -913,7 +1079,10 @@ describe('watch', () => {
     const cdkDeployMock = jest.fn();
     toolkit.deploy = cdkDeployMock;
 
-    await toolkit.watch({ selector: { patterns: [] }, hotswap: HotswapMode.HOTSWAP_ONLY });
+    await toolkit.watch({
+      selector: { patterns: [] },
+      hotswap: HotswapMode.HOTSWAP_ONLY,
+    });
     fakeChokidarWatcherOn.readyCallback();
 
     expect(cdkDeployMock).toBeCalledWith(expect.objectContaining({ hotswap: HotswapMode.HOTSWAP_ONLY }));
@@ -925,7 +1094,10 @@ describe('watch', () => {
     const cdkDeployMock = jest.fn();
     toolkit.deploy = cdkDeployMock;
 
-    await toolkit.watch({ selector: { patterns: [] }, hotswap: HotswapMode.FALL_BACK });
+    await toolkit.watch({
+      selector: { patterns: [] },
+      hotswap: HotswapMode.FALL_BACK,
+    });
     fakeChokidarWatcherOn.readyCallback();
 
     expect(cdkDeployMock).toBeCalledWith(expect.objectContaining({ hotswap: HotswapMode.FALL_BACK }));
@@ -937,7 +1109,10 @@ describe('watch', () => {
     const cdkDeployMock = jest.fn();
     toolkit.deploy = cdkDeployMock;
 
-    await toolkit.watch({ selector: { patterns: [] }, hotswap: HotswapMode.FULL_DEPLOYMENT });
+    await toolkit.watch({
+      selector: { patterns: [] },
+      hotswap: HotswapMode.FULL_DEPLOYMENT,
+    });
     fakeChokidarWatcherOn.readyCallback();
 
     expect(cdkDeployMock).toBeCalledWith(expect.objectContaining({ hotswap: HotswapMode.FULL_DEPLOYMENT }));
@@ -1035,30 +1210,34 @@ describe('synth', () => {
 
     test('migrate fails when both --from-path and --from-stack are provided', async () => {
       const toolkit = defaultToolkitSetup();
-      await expect(() => toolkit.migrate({
-        stackName: 'no-source',
-        fromPath: './here/template.yml',
-        fromStack: true,
-      })).rejects.toThrow('Only one of `--from-path` or `--from-stack` may be provided.');
-      expect(stderrMock.mock.calls[1][0]).toContain(' ❌  Migrate failed for `no-source`: Only one of `--from-path` or `--from-stack` may be provided.');
+      await expect(() =>
+        toolkit.migrate({
+          stackName: 'no-source',
+          fromPath: './here/template.yml',
+          fromStack: true,
+        }),
+      ).rejects.toThrow('Only one of `--from-path` or `--from-stack` may be provided.');
+      expect(stderrMock.mock.calls[1][0]).toContain(
+        ' ❌  Migrate failed for `no-source`: Only one of `--from-path` or `--from-stack` may be provided.',
+      );
     });
 
     test('migrate fails when --from-path is invalid', async () => {
       const toolkit = defaultToolkitSetup();
-      await expect(() => toolkit.migrate({
-        stackName: 'bad-local-source',
-        fromPath: './here/template.yml',
-      })).rejects.toThrow('\'./here/template.yml\' is not a valid path.');
-      expect(stderrMock.mock.calls[1][0]).toContain(' ❌  Migrate failed for `bad-local-source`: \'./here/template.yml\' is not a valid path.');
+      await expect(() =>
+        toolkit.migrate({
+          stackName: 'bad-local-source',
+          fromPath: './here/template.yml',
+        }),
+      ).rejects.toThrow("'./here/template.yml' is not a valid path.");
+      expect(stderrMock.mock.calls[1][0]).toContain(
+        " ❌  Migrate failed for `bad-local-source`: './here/template.yml' is not a valid path.",
+      );
     });
 
     test('migrate fails when --from-stack is used and stack does not exist in account', async () => {
       const mockSdkProvider = new MockSdkProvider();
-      mockSdkProvider.stubCloudFormation({
-        describeStacks(_request) {
-          throw new Error('Stack does not exist in this environment');
-        },
-      });
+      mockCloudFormationClient.on(DescribeStacksCommand).rejects(new Error('Stack does not exist in this environment'));
 
       const mockCloudExecutable = new MockCloudExecutable({
         stacks: [],
@@ -1071,21 +1250,31 @@ describe('synth', () => {
         configuration: mockCloudExecutable.configuration,
       });
 
-      await expect(() => cdkToolkit.migrate({
-        stackName: 'bad-cloudformation-source',
-        fromStack: true,
-      })).rejects.toThrowError('Stack does not exist in this environment');
-      expect(stderrMock.mock.calls[1][0]).toContain(' ❌  Migrate failed for `bad-cloudformation-source`: Stack does not exist in this environment');
+      await expect(() =>
+        cdkToolkit.migrate({
+          stackName: 'bad-cloudformation-source',
+          fromStack: true,
+        }),
+      ).rejects.toThrowError('Stack does not exist in this environment');
+      expect(stderrMock.mock.calls[1][0]).toContain(
+        ' ❌  Migrate failed for `bad-cloudformation-source`: Stack does not exist in this environment',
+      );
     });
 
     test('migrate fails when stack cannot be generated', async () => {
       const toolkit = defaultToolkitSetup();
-      await expect(() => toolkit.migrate({
-        stackName: 'cannot-generate-template',
-        fromPath: path.join(__dirname, 'commands', 'test-resources', 'templates', 'sqs-template.json'),
-        language: 'rust',
-      })).rejects.toThrowError('CannotGenerateTemplateStack could not be generated because rust is not a supported language');
-      expect(stderrMock.mock.calls[1][0]).toContain(' ❌  Migrate failed for `cannot-generate-template`: CannotGenerateTemplateStack could not be generated because rust is not a supported language');
+      await expect(() =>
+        toolkit.migrate({
+          stackName: 'cannot-generate-template',
+          fromPath: path.join(__dirname, 'commands', 'test-resources', 'templates', 'sqs-template.json'),
+          language: 'rust',
+        }),
+      ).rejects.toThrowError(
+        'CannotGenerateTemplateStack could not be generated because rust is not a supported language',
+      );
+      expect(stderrMock.mock.calls[1][0]).toContain(
+        ' ❌  Migrate failed for `cannot-generate-template`: CannotGenerateTemplateStack could not be generated because rust is not a supported language',
+      );
     });
 
     cliTest('migrate succeeds for valid template from local path when no lanugage is provided', async (workDir) => {
@@ -1128,8 +1317,14 @@ describe('synth', () => {
 
       // Packages created for typescript
       expect(fs.pathExistsSync(path.join(workDir, 'AutoscalingCSharp', 'src', 'AutoscalingCSharp.sln'))).toBeTruthy();
-      expect(fs.pathExistsSync(path.join(workDir, 'AutoscalingCSharp', 'src', 'AutoscalingCSharp', 'Program.cs'))).toBeTruthy();
-      expect(fs.pathExistsSync(path.join(workDir, 'AutoscalingCSharp', 'src', 'AutoscalingCSharp', 'AutoscalingCSharpStack.cs'))).toBeTruthy();
+      expect(
+        fs.pathExistsSync(path.join(workDir, 'AutoscalingCSharp', 'src', 'AutoscalingCSharp', 'Program.cs')),
+      ).toBeTruthy();
+      expect(
+        fs.pathExistsSync(
+          path.join(workDir, 'AutoscalingCSharp', 'src', 'AutoscalingCSharp', 'AutoscalingCSharpStack.cs'),
+        ),
+      ).toBeTruthy();
 
       // One more time
       await toolkit.migrate({
@@ -1141,23 +1336,31 @@ describe('synth', () => {
 
       // Packages created for typescript
       expect(fs.pathExistsSync(path.join(workDir, 'AutoscalingCSharp', 'src', 'AutoscalingCSharp.sln'))).toBeTruthy();
-      expect(fs.pathExistsSync(path.join(workDir, 'AutoscalingCSharp', 'src', 'AutoscalingCSharp', 'Program.cs'))).toBeTruthy();
-      expect(fs.pathExistsSync(path.join(workDir, 'AutoscalingCSharp', 'src', 'AutoscalingCSharp', 'AutoscalingCSharpStack.cs'))).toBeTruthy();
+      expect(
+        fs.pathExistsSync(path.join(workDir, 'AutoscalingCSharp', 'src', 'AutoscalingCSharp', 'Program.cs')),
+      ).toBeTruthy();
+      expect(
+        fs.pathExistsSync(
+          path.join(workDir, 'AutoscalingCSharp', 'src', 'AutoscalingCSharp', 'AutoscalingCSharpStack.cs'),
+        ),
+      ).toBeTruthy();
     });
   });
 
   describe('stack with error and flagged for validation', () => {
     beforeEach(() => {
       cloudExecutable = new MockCloudExecutable({
-        stacks: [
-          MockStack.MOCK_STACK_A,
-          MockStack.MOCK_STACK_B,
+        stacks: [MockStack.MOCK_STACK_A, MockStack.MOCK_STACK_B],
+        nestedAssemblies: [
+          {
+            stacks: [
+              {
+                properties: { validateOnSynth: true },
+                ...MockStack.MOCK_STACK_WITH_ERROR,
+              },
+            ],
+          },
         ],
-        nestedAssemblies: [{
-          stacks: [
-            { properties: { validateOnSynth: true }, ...MockStack.MOCK_STACK_WITH_ERROR },
-          ],
-        }],
       });
     });
 
@@ -1177,15 +1380,17 @@ describe('synth', () => {
 
   test('stack has error and was explicitly selected', async () => {
     cloudExecutable = new MockCloudExecutable({
-      stacks: [
-        MockStack.MOCK_STACK_A,
-        MockStack.MOCK_STACK_B,
+      stacks: [MockStack.MOCK_STACK_A, MockStack.MOCK_STACK_B],
+      nestedAssemblies: [
+        {
+          stacks: [
+            {
+              properties: { validateOnSynth: false },
+              ...MockStack.MOCK_STACK_WITH_ERROR,
+            },
+          ],
+        },
       ],
-      nestedAssemblies: [{
-        stacks: [
-          { properties: { validateOnSynth: false }, ...MockStack.MOCK_STACK_WITH_ERROR },
-        ],
-      }],
     });
 
     const toolkit = defaultToolkitSetup();
@@ -1195,15 +1400,17 @@ describe('synth', () => {
 
   test('stack has error, is not flagged for validation and was not explicitly selected', async () => {
     cloudExecutable = new MockCloudExecutable({
-      stacks: [
-        MockStack.MOCK_STACK_A,
-        MockStack.MOCK_STACK_B,
+      stacks: [MockStack.MOCK_STACK_A, MockStack.MOCK_STACK_B],
+      nestedAssemblies: [
+        {
+          stacks: [
+            {
+              properties: { validateOnSynth: false },
+              ...MockStack.MOCK_STACK_WITH_ERROR,
+            },
+          ],
+        },
       ],
-      nestedAssemblies: [{
-        stacks: [
-          { properties: { validateOnSynth: false }, ...MockStack.MOCK_STACK_WITH_ERROR },
-        ],
-      }],
     });
 
     const toolkit = defaultToolkitSetup();
@@ -1213,10 +1420,7 @@ describe('synth', () => {
 
   test('stack has dependency and was explicitly selected', async () => {
     cloudExecutable = new MockCloudExecutable({
-      stacks: [
-        MockStack.MOCK_STACK_C,
-        MockStack.MOCK_STACK_D,
-      ],
+      stacks: [MockStack.MOCK_STACK_C, MockStack.MOCK_STACK_D],
     });
 
     const toolkit = defaultToolkitSetup();
@@ -1229,9 +1433,7 @@ describe('synth', () => {
 
   test('rollback uses deployment role', async () => {
     cloudExecutable = new MockCloudExecutable({
-      stacks: [
-        MockStack.MOCK_STACK_C,
-      ],
+      stacks: [MockStack.MOCK_STACK_C],
     });
 
     const mockedRollback = jest.spyOn(Deployments.prototype, 'rollbackStack').mockResolvedValue({
@@ -1262,9 +1464,7 @@ class MockStack {
       '/Test-Stack-A': [
         {
           type: cxschema.ArtifactMetadataEntryType.STACK_TAGS,
-          data: [
-            { key: 'Foo', value: 'Bar' },
-          ],
+          data: [{ key: 'Foo', value: 'Bar' }],
         },
       ],
     },
@@ -1278,9 +1478,7 @@ class MockStack {
       '/Test-Stack-B': [
         {
           type: cxschema.ArtifactMetadataEntryType.STACK_TAGS,
-          data: [
-            { key: 'Baz', value: 'Zinga!' },
-          ],
+          data: [{ key: 'Baz', value: 'Zinga!' }],
         },
       ],
     },
@@ -1293,9 +1491,7 @@ class MockStack {
       '/Test-Stack-C': [
         {
           type: cxschema.ArtifactMetadataEntryType.STACK_TAGS,
-          data: [
-            { key: 'Baz', value: 'Zinga!' },
-          ],
+          data: [{ key: 'Baz', value: 'Zinga!' }],
         },
       ],
     },
@@ -1309,15 +1505,12 @@ class MockStack {
       '/Test-Stack-D': [
         {
           type: cxschema.ArtifactMetadataEntryType.STACK_TAGS,
-          data: [
-            { key: 'Baz', value: 'Zinga!' },
-          ],
+          data: [{ key: 'Baz', value: 'Zinga!' }],
         },
       ],
     },
     depends: [MockStack.MOCK_STACK_C.stackName],
   };
-
   public static readonly MOCK_STACK_WITH_ERROR: TestStackArtifact = {
     stackName: 'witherrors',
     env: 'aws://123456789012/bermuda-triangle-1',
@@ -1331,7 +1524,7 @@ class MockStack {
       ],
     },
     displayName: 'Test-Stack-A/witherrors',
-  }
+  };
   public static readonly MOCK_STACK_WITH_ASSET: TestStackArtifact = {
     stackName: 'Test-Stack-Asset',
     template: { Resources: { TemplateName: 'Test-Stack-Asset' } },
@@ -1343,12 +1536,11 @@ class MockStack {
           source: {
             path: path.resolve(__dirname, '..', 'LICENSE'),
           },
-          destinations: {
-          },
+          destinations: {},
         },
       },
     },
-  }
+  };
   public static readonly MOCK_STACK_WITH_NOTIFICATION_ARNS: TestStackArtifact = {
     stackName: 'Test-Stack-Notification-Arns',
     notificationArns: ['arn:aws:sns:bermuda-triangle-1337:123456789012:MyTopic'],
@@ -1358,13 +1550,11 @@ class MockStack {
       '/Test-Stack-Notification-Arns': [
         {
           type: cxschema.ArtifactMetadataEntryType.STACK_TAGS,
-          data: [
-            { key: 'Foo', value: 'Bar' },
-          ],
+          data: [{ key: 'Foo', value: 'Bar' }],
         },
       ],
     },
-  }
+  };
 
   public static readonly MOCK_STACK_WITH_BAD_NOTIFICATION_ARNS: TestStackArtifact = {
     stackName: 'Test-Stack-Bad-Notification-Arns',
@@ -1375,13 +1565,11 @@ class MockStack {
       '/Test-Stack-Bad-Notification-Arns': [
         {
           type: cxschema.ArtifactMetadataEntryType.STACK_TAGS,
-          data: [
-            { key: 'Foo', value: 'Bar' },
-          ],
+          data: [{ key: 'Foo', value: 'Bar' }],
         },
       ],
     },
-  }
+  };
 }
 
 class FakeCloudFormation extends Deployments {
@@ -1395,9 +1583,9 @@ class FakeCloudFormation extends Deployments {
     super({ sdkProvider: new MockSdkProvider() });
 
     for (const [stackName, tags] of Object.entries(expectedTags)) {
-      this.expectedTags[stackName] =
-        Object.entries(tags).map(([Key, Value]) => ({ Key, Value }))
-          .sort((l, r) => l.Key.localeCompare(r.Key));
+      this.expectedTags[stackName] = Object.entries(tags)
+        .map(([Key, Value]) => ({ Key, Value }))
+        .sort((l, r) => l.Key.localeCompare(r.Key));
     }
     this.expectedNotificationArns = expectedNotificationArns ?? [];
   }
diff --git a/packages/aws-cdk/test/commands/migrate.test.ts b/packages/aws-cdk/test/commands/migrate.test.ts
index 780811eac790d..af1943f5b0373 100644
--- a/packages/aws-cdk/test/commands/migrate.test.ts
+++ b/packages/aws-cdk/test/commands/migrate.test.ts
@@ -2,18 +2,39 @@ import { exec as _exec } from 'child_process';
 import * as os from 'os';
 import * as path from 'path';
 import { promisify } from 'util';
-import { CloudFormation } from 'aws-sdk';
+import {
+  CreateGeneratedTemplateCommand,
+  DescribeGeneratedTemplateCommand,
+  DescribeResourceScanCommand,
+  DescribeStacksCommand,
+  GetGeneratedTemplateCommand,
+  GetTemplateCommand,
+  ListResourceScanRelatedResourcesCommand,
+  ListResourceScanResourcesCommand,
+  ListResourceScansCommand,
+  ResourceScanStatus,
+  StackStatus,
+  StartResourceScanCommand,
+} from '@aws-sdk/client-cloudformation';
 import * as fs from 'fs-extra';
-import { generateCdkApp, generateStack, readFromPath, readFromStack, setEnvironment, parseSourceOptions, generateTemplate, TemplateSourceOptions, GenerateTemplateOptions, FromScan } from '../../lib/commands/migrate';
-import { MockSdkProvider, MockedObject, SyncHandlerSubsetOf } from '../util/mock-sdk';
+import {
+  generateCdkApp,
+  generateStack,
+  readFromPath,
+  readFromStack,
+  setEnvironment,
+  parseSourceOptions,
+  generateTemplate,
+  TemplateSourceOptions,
+  GenerateTemplateOptions,
+  FromScan,
+} from '../../lib/commands/migrate';
+import { MockSdkProvider, mockCloudFormationClient, restoreSdkMocksToDefault } from '../util/mock-sdk';
 
 const exec = promisify(_exec);
 
 describe('Migrate Function Tests', () => {
   let sdkProvider: MockSdkProvider;
-  let getTemplateMock: jest.Mock;
-  let describeStacksMock: jest.Mock;
-  let cfnMocks: MockedObject<SyncHandlerSubsetOf<AWS.CloudFormation>>;
 
   const testResourcePath = [__dirname, 'test-resources'];
   const templatePath = [...testResourcePath, 'templates'];
@@ -27,26 +48,32 @@ describe('Migrate Function Tests', () => {
 
   beforeEach(async () => {
     sdkProvider = new MockSdkProvider();
-    getTemplateMock = jest.fn();
-    describeStacksMock = jest.fn();
-    cfnMocks = { getTemplate: getTemplateMock, describeStacks: describeStacksMock };
-    sdkProvider.stubCloudFormation(cfnMocks as any);
   });
 
   test('parseSourceOptions throws if both --from-path and --from-stack is provided', () => {
-    expect(() => parseSourceOptions('any-value', true, 'my-awesome-stack')).toThrowError('Only one of `--from-path` or `--from-stack` may be provided.');
+    expect(() => parseSourceOptions('any-value', true, 'my-awesome-stack')).toThrowError(
+      'Only one of `--from-path` or `--from-stack` may be provided.',
+    );
   });
 
   test('parseSourceOptions returns from-scan when neither --from-path or --from-stack are provided', () => {
-    expect(parseSourceOptions(undefined, undefined, 'my-stack-name')).toStrictEqual({ source: TemplateSourceOptions.SCAN });
+    expect(parseSourceOptions(undefined, undefined, 'my-stack-name')).toStrictEqual({
+      source: TemplateSourceOptions.SCAN,
+    });
   });
 
   test('parseSourceOptions does not throw when only --from-path is supplied', () => {
-    expect(parseSourceOptions('my-file-path', undefined, 'my-stack-name')).toStrictEqual({ source: TemplateSourceOptions.PATH, templatePath: 'my-file-path' });
+    expect(parseSourceOptions('my-file-path', undefined, 'my-stack-name')).toStrictEqual({
+      source: TemplateSourceOptions.PATH,
+      templatePath: 'my-file-path',
+    });
   });
 
   test('parseSourceOptions does now throw when only --from-stack is provided', () => {
-    expect(parseSourceOptions(undefined, true, 'my-stack-name')).toStrictEqual({ source: TemplateSourceOptions.STACK, stackName: 'my-stack-name' });
+    expect(parseSourceOptions(undefined, true, 'my-stack-name')).toStrictEqual({
+      source: TemplateSourceOptions.STACK,
+      stackName: 'my-stack-name',
+    });
   });
 
   test('readFromPath produces a string representation of the template at a given path', () => {
@@ -64,43 +91,72 @@ describe('Migrate Function Tests', () => {
 
   test('readFromStack produces a string representation of the template retrieved from CloudFormation', async () => {
     const template = fs.readFileSync(validTemplatePath, { encoding: 'utf-8' });
-    getTemplateMock.mockImplementation(() => ({
-      TemplateBody: template,
-    }));
-
-    describeStacksMock.mockImplementation(() => ({
-      Stacks: [
-        {
-          StackName: 'this-one',
-          StackStatus: 'CREATE_COMPLETE',
-        },
-      ],
-    }));
-
-    expect(await readFromStack('this-one', sdkProvider, { account: 'num', region: 'here', name: 'hello-my-name-is-what...' })).toEqual(JSON.stringify(JSON.parse(template)));
+    mockCloudFormationClient
+      .on(GetTemplateCommand)
+      .resolves({
+        TemplateBody: template,
+      })
+      .on(DescribeStacksCommand)
+      .resolves({
+        Stacks: [
+          {
+            StackName: 'this-one',
+            StackStatus: StackStatus.CREATE_COMPLETE,
+            CreationTime: new Date(),
+          },
+        ],
+      });
+
+    expect(
+      await readFromStack('this-one', sdkProvider, {
+        account: '123456789012',
+        region: 'here',
+        name: 'hello-my-name-is-what...',
+      }),
+    ).toEqual(JSON.stringify(JSON.parse(template)));
   });
 
   test('readFromStack throws error when no stack exists with the stack name in the account and region', async () => {
-    describeStacksMock.mockImplementation(() => { throw new Error('No stack. This did not go well.'); });
-    await expect(() => readFromStack('that-one', sdkProvider, { account: 'num', region: 'here', name: 'hello-my-name-is-who...' })).rejects.toThrow('No stack. This did not go well.');
+    const error = new Error('No stack. This did not go well.');
+    mockCloudFormationClient.on(DescribeStacksCommand).rejects(error);
+    await expect(() =>
+      readFromStack('that-one', sdkProvider, {
+        account: '123456789012',
+        region: 'here',
+        name: 'hello-my-name-is-who...',
+      }),
+    ).rejects.toThrow('No stack. This did not go well.');
   });
 
   test('readFromStack throws error when stack exists but the status is not healthy', async () => {
-    describeStacksMock.mockImplementation(() => ({
+    mockCloudFormationClient.on(DescribeStacksCommand).resolves({
       Stacks: [
         {
           StackName: 'this-one',
-          StackStatus: 'CREATE_FAILED',
+          StackStatus: StackStatus.CREATE_FAILED,
           StackStatusReason: 'Something went wrong',
+          CreationTime: new Date(),
         },
       ],
-    }));
+    });
 
-    await expect(() => readFromStack('that-one', sdkProvider, { account: 'num', region: 'here', name: 'hello-my-name-is-chicka-chicka...' })).rejects.toThrow('Stack \'that-one\' in account num and region here has a status of \'CREATE_FAILED\' due to \'Something went wrong\'. The stack cannot be migrated until it is in a healthy state.');
+    await expect(() =>
+      readFromStack('that-one', sdkProvider, {
+        account: '123456789012',
+        region: 'here',
+        name: 'hello-my-name-is-chicka-chicka...',
+      }),
+    ).rejects.toThrow(
+      "Stack 'that-one' in account 123456789012 and region here has a status of 'CREATE_FAILED' due to 'Something went wrong'. The stack cannot be migrated until it is in a healthy state.",
+    );
   });
 
   test('setEnvironment sets account and region when provided', () => {
-    expect(setEnvironment('my-account', 'somewhere')).toEqual({ account: 'my-account', region: 'somewhere', name: 'cdk-migrate-env' });
+    expect(setEnvironment('my-account', 'somewhere')).toEqual({
+      account: 'my-account',
+      region: 'somewhere',
+      name: 'cdk-migrate-env',
+    });
   });
 
   test('serEnvironment uses default account and region when not provided', () => {
@@ -134,11 +190,15 @@ describe('Migrate Function Tests', () => {
   });
 
   test('generateStack throws error when called for other language', () => {
-    expect(() => generateStack(validTemplate, 'BadBadBad', 'php')).toThrowError('BadBadBadStack could not be generated because php is not a supported language');
+    expect(() => generateStack(validTemplate, 'BadBadBad', 'php')).toThrowError(
+      'BadBadBadStack could not be generated because php is not a supported language',
+    );
   });
 
   test('generateStack throws error for invalid resource property', () => {
-    expect(() => generateStack(invalidTemplate, 'VeryBad', 'typescript')).toThrow('VeryBadStack could not be generated because ReadEndpoint is not a valid property for resource RDSCluster of type AWS::RDS::DBCluster');
+    expect(() => generateStack(invalidTemplate, 'VeryBad', 'typescript')).toThrow(
+      'VeryBadStack could not be generated because ReadEndpoint is not a valid property for resource RDSCluster of type AWS::RDS::DBCluster',
+    );
   });
 
   cliTest('generateCdkApp generates the expected cdk app when called for typescript', async (workDir) => {
@@ -152,11 +212,21 @@ describe('Migrate Function Tests', () => {
 
     // Replaced stack file is referenced correctly in app file
     const app = fs.readFileSync(path.join(workDir, 'GoodTypeScript', 'bin', 'good_type_script.ts'), 'utf8').split('\n');
-    expect(app.map(line => line.match('import { GoodTypeScriptStack } from \'../lib/good_type_script-stack\';')).filter(line => line).length).toEqual(1);
-    expect(app.map(line => line.match(/new GoodTypeScriptStack\(app, \'GoodTypeScript\', \{/)).filter(line => line).length).toEqual(1);
+    expect(
+      app
+        .map((line) => line.match("import { GoodTypeScriptStack } from '../lib/good_type_script-stack';"))
+        .filter((line) => line).length,
+    ).toEqual(1);
+    expect(
+      app.map((line) => line.match(/new GoodTypeScriptStack\(app, \'GoodTypeScript\', \{/)).filter((line) => line)
+        .length,
+    ).toEqual(1);
 
     // Replaced stack file is correctly generated
-    const replacedStack = fs.readFileSync(path.join(workDir, 'GoodTypeScript', 'lib', 'good_type_script-stack.ts'), 'utf8');
+    const replacedStack = fs.readFileSync(
+      path.join(workDir, 'GoodTypeScript', 'lib', 'good_type_script-stack.ts'),
+      'utf8',
+    );
     expect(replacedStack).toEqual(fs.readFileSync(path.join(...stackPath, 's3-stack.ts'), 'utf8'));
   });
 
@@ -183,11 +253,19 @@ describe('Migrate Function Tests', () => {
 
     // Replaced stack file is referenced correctly in app file
     const app = fs.readFileSync(path.join(workDir, 'GoodPython', 'app.py'), 'utf8').split('\n');
-    expect(app.map(line => line.match('from good_python.good_python_stack import GoodPythonStack')).filter(line => line).length).toEqual(1);
-    expect(app.map(line => line.match(/GoodPythonStack\(app, "GoodPython",/)).filter(line => line).length).toEqual(1);
+    expect(
+      app.map((line) => line.match('from good_python.good_python_stack import GoodPythonStack')).filter((line) => line)
+        .length,
+    ).toEqual(1);
+    expect(app.map((line) => line.match(/GoodPythonStack\(app, "GoodPython",/)).filter((line) => line).length).toEqual(
+      1,
+    );
 
     // Replaced stack file is correctly generated
-    const replacedStack = fs.readFileSync(path.join(workDir, 'GoodPython', 'good_python', 'good_python_stack.py'), 'utf8');
+    const replacedStack = fs.readFileSync(
+      path.join(workDir, 'GoodPython', 'good_python', 'good_python_stack.py'),
+      'utf8',
+    );
     expect(replacedStack).toEqual(fs.readFileSync(path.join(...stackPath, 's3_stack.py'), 'utf8'));
   });
 
@@ -197,16 +275,29 @@ describe('Migrate Function Tests', () => {
 
     // Packages exist in the correct spot
     expect(fs.pathExistsSync(path.join(workDir, 'GoodJava', 'pom.xml'))).toBeTruthy();
-    expect(fs.pathExistsSync(path.join(workDir, 'GoodJava', 'src', 'main', 'java', 'com', 'myorg', 'GoodJavaApp.java'))).toBeTruthy();
-    expect(fs.pathExistsSync(path.join(workDir, 'GoodJava', 'src', 'main', 'java', 'com', 'myorg', 'GoodJavaStack.java'))).toBeTruthy();
+    expect(
+      fs.pathExistsSync(path.join(workDir, 'GoodJava', 'src', 'main', 'java', 'com', 'myorg', 'GoodJavaApp.java')),
+    ).toBeTruthy();
+    expect(
+      fs.pathExistsSync(path.join(workDir, 'GoodJava', 'src', 'main', 'java', 'com', 'myorg', 'GoodJavaStack.java')),
+    ).toBeTruthy();
 
     // Replaced stack file is referenced correctly in app file
-    const app = fs.readFileSync(path.join(workDir, 'GoodJava', 'src', 'main', 'java', 'com', 'myorg', 'GoodJavaApp.java'), 'utf8').split('\n');
-    expect(app.map(line => line.match('public class GoodJavaApp {')).filter(line => line).length).toEqual(1);
-    expect(app.map(line => line.match(/        new GoodJavaStack\(app, "GoodJava", StackProps.builder()/)).filter(line => line).length).toEqual(1);
+    const app = fs
+      .readFileSync(path.join(workDir, 'GoodJava', 'src', 'main', 'java', 'com', 'myorg', 'GoodJavaApp.java'), 'utf8')
+      .split('\n');
+    expect(app.map((line) => line.match('public class GoodJavaApp {')).filter((line) => line).length).toEqual(1);
+    expect(
+      app
+        .map((line) => line.match(/        new GoodJavaStack\(app, "GoodJava", StackProps.builder()/))
+        .filter((line) => line).length,
+    ).toEqual(1);
 
     // Replaced stack file is correctly generated
-    const replacedStack = fs.readFileSync(path.join(workDir, 'GoodJava', 'src', 'main', 'java', 'com', 'myorg', 'GoodJavaStack.java'), 'utf8');
+    const replacedStack = fs.readFileSync(
+      path.join(workDir, 'GoodJava', 'src', 'main', 'java', 'com', 'myorg', 'GoodJavaStack.java'),
+      'utf8',
+    );
     expect(replacedStack).toEqual(fs.readFileSync(path.join(...stackPath, 'S3Stack.java'), 'utf8'));
   });
 
@@ -220,12 +311,21 @@ describe('Migrate Function Tests', () => {
     expect(fs.pathExistsSync(path.join(workDir, 'GoodCSharp', 'src', 'GoodCSharp', 'GoodCSharpStack.cs'))).toBeTruthy();
 
     // Replaced stack file is referenced correctly in app file
-    const app = fs.readFileSync(path.join(workDir, 'GoodCSharp', 'src', 'GoodCSharp', 'Program.cs'), 'utf8').split('\n');
-    expect(app.map(line => line.match('namespace GoodCSharp')).filter(line => line).length).toEqual(1);
-    expect(app.map(line => line.match(/        new GoodCSharpStack\(app, "GoodCSharp", new GoodCSharpStackProps/)).filter(line => line).length).toEqual(1);
+    const app = fs
+      .readFileSync(path.join(workDir, 'GoodCSharp', 'src', 'GoodCSharp', 'Program.cs'), 'utf8')
+      .split('\n');
+    expect(app.map((line) => line.match('namespace GoodCSharp')).filter((line) => line).length).toEqual(1);
+    expect(
+      app
+        .map((line) => line.match(/        new GoodCSharpStack\(app, "GoodCSharp", new GoodCSharpStackProps/))
+        .filter((line) => line).length,
+    ).toEqual(1);
 
     // Replaced stack file is correctly generated
-    const replacedStack = fs.readFileSync(path.join(workDir, 'GoodCSharp', 'src', 'GoodCSharp', 'GoodCSharpStack.cs'), 'utf8');
+    const replacedStack = fs.readFileSync(
+      path.join(workDir, 'GoodCSharp', 'src', 'GoodCSharp', 'GoodCSharpStack.cs'),
+      'utf8',
+    );
     expect(replacedStack).toEqual(fs.readFileSync(path.join(...stackPath, 'S3Stack.cs'), 'utf8'));
   });
 
@@ -235,8 +335,16 @@ describe('Migrate Function Tests', () => {
 
     expect(fs.pathExists(path.join(workDir, 's3.go'))).toBeTruthy();
     const app = fs.readFileSync(path.join(workDir, 'GoodGo', 'good_go.go'), 'utf8').split('\n');
-    expect(app.map(line => line.match(/func NewGoodGoStack\(scope constructs.Construct, id string, props \*GoodGoStackProps\) \*GoodGoStack \{/)).filter(line => line).length).toEqual(1);
-    expect(app.map(line => line.match(/    NewGoodGoStack\(app, "GoodGo", &GoodGoStackProps\{/)));
+    expect(
+      app
+        .map((line) =>
+          line.match(
+            /func NewGoodGoStack\(scope constructs.Construct, id string, props \*GoodGoStackProps\) \*GoodGoStack \{/,
+          ),
+        )
+        .filter((line) => line).length,
+    ).toEqual(1);
+    expect(app.map((line) => line.match(/    NewGoodGoStack\(app, "GoodGo", &GoodGoStackProps\{/)));
   });
 
   cliTest('generatedCdkApp generates a zip file when --compress is used', async (workDir) => {
@@ -276,7 +384,7 @@ async function withTempDir(cb: (dir: string) => void | Promise<any>) {
 
 describe('generateTemplate', () => {
   let sdkProvider: MockSdkProvider;
-  let cloudFormationMocks: MockedObject<SyncHandlerSubsetOf<AWS.CloudFormation>>;
+  restoreSdkMocksToDefault();
   const sampleResource = {
     ResourceType: 'AWS::S3::Bucket',
     ManagedByStack: true,
@@ -333,41 +441,45 @@ describe('generateTemplate', () => {
 
   beforeEach(() => {
     sdkProvider = new MockSdkProvider();
-    cloudFormationMocks = {
-      startResourceScan: jest.fn(),
-      listResourceScans: jest.fn(),
-      describeResourceScan: jest.fn(),
-      listResourceScanResources: jest.fn(),
-      createGeneratedTemplate: jest.fn(),
-      describeGeneratedTemplate: jest.fn(),
-      getGeneratedTemplate: jest.fn(),
-      listResourceScanRelatedResources: jest.fn(),
-      config: {
-        getCredentials: jest.fn(),
-        getToken: jest.fn(),
-        loadFromPath: jest.fn(),
-        update: jest.fn(),
-        getPromisesDependency: jest.fn(),
-        setPromisesDependency: jest.fn(),
-        customUserAgent: 'cdk-migrate',
-      },
-    };
-
-    sdkProvider.stubCloudFormation(cloudFormationMocks as any);
+    mockCloudFormationClient
+      .on(StartResourceScanCommand)
+      .resolves({
+        ResourceScanId: scanId,
+      })
+      .on(ListResourceScansCommand)
+      .resolves({
+        ResourceScanSummaries: [
+          { ResourceScanId: scanId, Status: ResourceScanStatus.COMPLETE, PercentageCompleted: 100 },
+        ],
+      })
+      .on(DescribeResourceScanCommand)
+      .resolves({
+        Status: 'COMPLETE',
+      })
+      .on(ListResourceScanResourcesCommand)
+      .resolves({
+        Resources: [sampleResource2],
+      })
+      .on(CreateGeneratedTemplateCommand)
+      .resolves({
+        GeneratedTemplateId: 'template-arn',
+      })
+      .on(DescribeGeneratedTemplateCommand)
+      .resolves({
+        Status: 'COMPLETE',
+        Resources: [sampleResource, sampleResource2],
+      })
+      .on(GetGeneratedTemplateCommand)
+      .resolves({
+        TemplateBody: 'template-body',
+      })
+      .on(ListResourceScanRelatedResourcesCommand)
+      .resolves({
+        RelatedResources: [sampleResource],
+      });
   });
 
   test('generateTemplate successfully generates template with a new scan', async () => {
-    const resourceScanSummaries = [{ ResourceScanId: scanId, Status: 'COMPLETE', PercentageCompleted: 100 }];
-
-    cloudFormationMocks.startResourceScan!.mockReturnValue({ ResourceScanId: scanId });
-    cloudFormationMocks.listResourceScans!.mockReturnValue({ ResourceScanSummaries: resourceScanSummaries });
-    cloudFormationMocks.describeResourceScan!.mockReturnValue({ Status: 'COMPLETED' });
-    cloudFormationMocks.listResourceScanResources!.mockReturnValue({ Resources: [sampleResource2] });
-    cloudFormationMocks.createGeneratedTemplate!.mockReturnValue({ GeneratedTemplateId: 'template-arn' });
-    cloudFormationMocks.describeGeneratedTemplate!.mockReturnValue({ Status: 'COMPLETE', Resources: [sampleResource, sampleResource2] });
-    cloudFormationMocks.getGeneratedTemplate!.mockReturnValue({ TemplateBody: 'template-body' });
-    cloudFormationMocks.listResourceScanRelatedResources!.mockReturnValue({ RelatedResources: [sampleResource] });
-
     const opts: GenerateTemplateOptions = {
       stackName: stackName,
       filters: [],
@@ -381,18 +493,16 @@ describe('generateTemplate', () => {
   });
 
   test('generateTemplate successfully defaults to latest scan instead of starting a new one', async () => {
-    const resourceScanSummaryComplete = [{ ResourceScanId: scanId, Status: 'COMPLETE', PercentageCompleted: 100 }];
-    const resourceScanSummaryInProgress = [{ ResourceScanId: scanId, Status: 'IN_PROGRESS', PercentageCompleted: 50 }];
-
-    cloudFormationMocks.startResourceScan!.mockImplementation(() => { throw new Error('No >:('); });
-    cloudFormationMocks.listResourceScans!.mockReturnValueOnce({ ResourceScanSummaries: resourceScanSummaryInProgress });
-    cloudFormationMocks.listResourceScans!.mockReturnValueOnce({ ResourceScanSummaries: resourceScanSummaryComplete });
-    cloudFormationMocks.describeResourceScan!.mockReturnValue({ Status: 'COMPLETED' });
-    cloudFormationMocks.listResourceScanResources!.mockReturnValue({ Resources: [sampleResource2] });
-    cloudFormationMocks.createGeneratedTemplate!.mockReturnValue({ GeneratedTemplateId: 'template-arn' });
-    cloudFormationMocks.describeGeneratedTemplate!.mockReturnValue({ Status: 'COMPLETE', Resources: [sampleResource, sampleResource2] });
-    cloudFormationMocks.getGeneratedTemplate!.mockReturnValue({ TemplateBody: 'template-body' });
-    cloudFormationMocks.listResourceScanRelatedResources!.mockReturnValue({ RelatedResources: [sampleResource2] });
+    mockCloudFormationClient
+      .on(StartResourceScanCommand)
+      .rejects('No >:(')
+      .on(ListResourceScansCommand)
+      .resolvesOnce({
+        ResourceScanSummaries: [{ ResourceScanId: scanId, Status: 'IN_PROGRESS', PercentageCompleted: 50 }],
+      })
+      .resolves({
+        ResourceScanSummaries: [{ ResourceScanId: scanId, Status: 'COMPLETE', PercentageCompleted: 100 }],
+      });
 
     const opts = {
       stackName: stackName,
@@ -406,9 +516,9 @@ describe('generateTemplate', () => {
   });
 
   test('generateTemplate throws an error when from-scan most-recent is passed but no scans are found.', async () => {
-    const resourceScanSummaries: CloudFormation.ResourceScanSummary[] = [];
-
-    cloudFormationMocks.listResourceScans!.mockReturnValue({ ResourceScanSummaries: resourceScanSummaries });
+    mockCloudFormationClient.on(ListResourceScansCommand).resolves({
+      ResourceScanSummaries: [],
+    });
 
     const opts: GenerateTemplateOptions = {
       stackName: stackName,
@@ -417,21 +527,12 @@ describe('generateTemplate', () => {
       sdkProvider: sdkProvider,
       environment: environment,
     };
-    await expect(generateTemplate(opts)).rejects.toThrow('No scans found. Please either start a new scan with the `--from-scan` new or do not specify a `--from-scan` option.');
+    await expect(generateTemplate(opts)).rejects.toThrow(
+      'No scans found. Please either start a new scan with the `--from-scan` new or do not specify a `--from-scan` option.',
+    );
   });
 
   test('generateTemplate throws an error when an invalid key is passed in the filters', async () => {
-    const resourceScanSummaries = [{ ResourceScanId: scanId, Status: 'COMPLETE', PercentageCompleted: 100 }];
-
-    cloudFormationMocks.startResourceScan!.mockReturnValue({ ResourceScanId: scanId });
-    cloudFormationMocks.listResourceScans!.mockReturnValue({ ResourceScanSummaries: resourceScanSummaries });
-    cloudFormationMocks.describeResourceScan!.mockReturnValue({ Status: 'COMPLETED' });
-    cloudFormationMocks.listResourceScanResources!.mockReturnValue({ Resources: [sampleResource2] });
-    cloudFormationMocks.createGeneratedTemplate!.mockReturnValue({ GeneratedTemplateId: 'template-arn' });
-    cloudFormationMocks.describeGeneratedTemplate!.mockReturnValue({ Status: 'COMPLETE' });
-    cloudFormationMocks.getGeneratedTemplate!.mockReturnValue({ TemplateBody: 'template-body' });
-    cloudFormationMocks.listResourceScanRelatedResources!.mockReturnValue({ RelatedResources: [sampleResource] });
-
     const opts: GenerateTemplateOptions = {
       stackName: stackName,
       filters: ['invalid-key=invalid-value'],
@@ -443,20 +544,6 @@ describe('generateTemplate', () => {
   });
 
   test('generateTemplate defaults to starting a new scan when no options are provided', async () => {
-    const resourceScanSummaryComplete = [{ ResourceScanId: scanId, Status: 'COMPLETE', PercentageCompleted: 100 }];
-    const resourceScanSummaryInProgress = [{ ResourceScanId: scanId, Status: 'IN_PROGRESS', PercentageCompleted: 50 }];
-
-    cloudFormationMocks.startResourceScan!.mockReturnValue({ ResourceScanId: scanId });
-    cloudFormationMocks.listResourceScans!.mockReturnValueOnce({ ResourceScanSummaries: undefined });
-    cloudFormationMocks.listResourceScans!.mockReturnValueOnce({ ResourceScanSummaries: resourceScanSummaryInProgress });
-    cloudFormationMocks.listResourceScans!.mockReturnValueOnce({ ResourceScanSummaries: resourceScanSummaryComplete });
-    cloudFormationMocks.describeResourceScan!.mockReturnValue({ Status: 'COMPLETED' });
-    cloudFormationMocks.listResourceScanResources!.mockReturnValue({ Resources: [sampleResource2] });
-    cloudFormationMocks.createGeneratedTemplate!.mockReturnValue({ GeneratedTemplateId: 'template-arn' });
-    cloudFormationMocks.describeGeneratedTemplate!.mockReturnValue({ Status: 'COMPLETE', Resources: [sampleResource, sampleResource2] });
-    cloudFormationMocks.getGeneratedTemplate!.mockReturnValue({ TemplateBody: 'template-body' });
-    cloudFormationMocks.listResourceScanRelatedResources!.mockReturnValue({ RelatedResources: [sampleResource] });
-
     const opts: GenerateTemplateOptions = {
       stackName: stackName,
       sdkProvider: sdkProvider,
@@ -464,21 +551,10 @@ describe('generateTemplate', () => {
     };
     const template = await generateTemplate(opts);
     expect(template).toEqual(defaultExpectedResult);
-    expect(cloudFormationMocks.startResourceScan).toHaveBeenCalled();
+    expect(mockCloudFormationClient).toHaveReceivedCommand(StartResourceScanCommand);
   });
 
   test('generateTemplate successfully generates templates with valid filter options', async () => {
-    const resourceScanSummaries = [{ ResourceScanId: scanId, Status: 'COMPLETE', PercentageCompleted: 100 }];
-
-    cloudFormationMocks.startResourceScan!.mockReturnValue({ ResourceScanId: scanId });
-    cloudFormationMocks.listResourceScans!.mockReturnValue({ ResourceScanSummaries: resourceScanSummaries });
-    cloudFormationMocks.describeResourceScan!.mockReturnValue({ Status: 'COMPLETED' });
-    cloudFormationMocks.listResourceScanResources!.mockReturnValue({ Resources: [sampleResource2] });
-    cloudFormationMocks.createGeneratedTemplate!.mockReturnValue({ GeneratedTemplateId: 'template-arn' });
-    cloudFormationMocks.describeGeneratedTemplate!.mockReturnValue({ Status: 'COMPLETE', Resources: [sampleResource, sampleResource2] });
-    cloudFormationMocks.getGeneratedTemplate!.mockReturnValue({ TemplateBody: 'template-body' });
-    cloudFormationMocks.listResourceScanRelatedResources!.mockReturnValue({ RelatedResources: [sampleResource] });
-
     const opts: GenerateTemplateOptions = {
       stackName: stackName,
       filters: ['type=AWS::S3::Bucket,identifier={"my-key":"my-bucket"}', 'type=AWS::EC2::Instance'],
@@ -488,5 +564,4 @@ describe('generateTemplate', () => {
     const template = await generateTemplate(opts);
     expect(template).toEqual(defaultExpectedResult);
   });
-
-});
\ No newline at end of file
+});
diff --git a/packages/aws-cdk/test/context-providers/amis.test.ts b/packages/aws-cdk/test/context-providers/amis.test.ts
index 70018ed8eaf84..9f41e7774c202 100644
--- a/packages/aws-cdk/test/context-providers/amis.test.ts
+++ b/packages/aws-cdk/test/context-providers/amis.test.ts
@@ -1,30 +1,19 @@
-/* eslint-disable import/order */
-import * as aws from 'aws-sdk';
-import * as AWS from 'aws-sdk-mock';
+import 'aws-sdk-client-mock';
+import { DescribeImagesCommand } from '@aws-sdk/client-ec2';
+import { SDK, SdkForEnvironment } from '../../lib';
 import { AmiContextProviderPlugin } from '../../lib/context-providers/ami';
-import { MockSdkProvider } from '../util/mock-sdk';
+import { FAKE_CREDENTIALS, MockSdkProvider, mockEC2Client } from '../util/mock-sdk';
 
-// If the 'aws-sdk' package imported here and the 'aws-sdk' package imported by 'aws-sdk-mock' aren't
-// the same physical package on disk (if version mismatches cause hoisting/deduping to not happen),
-// the type check here takes too long and makes the TypeScript compiler fail.
-// Suppress the type check using 'as any' to make this more robust.
-AWS.setSDKInstance(aws as any);
-
-afterEach(done => {
-  AWS.restore();
-  done();
-});
-
-const mockSDK = new MockSdkProvider();
-
-type AwsCallback<T> = (err: Error | null, val: T) => void;
+const mockSDK = new (class extends MockSdkProvider {
+  public forEnvironment(): Promise<SdkForEnvironment> {
+    return Promise.resolve({ sdk: new SDK(FAKE_CREDENTIALS, mockSDK.defaultRegion, {}), didAssumeRole: false });
+  }
+})();
 
 test('calls DescribeImages on the request', async () => {
   // GIVEN
-  let request: aws.EC2.DescribeImagesRequest;
-  AWS.mock('EC2', 'describeImages', (params: aws.EC2.DescribeImagesRequest, cb: AwsCallback<aws.EC2.DescribeImagesResult>) => {
-    request = params;
-    return cb(null, { Images: [{ ImageId: 'ami-1234' }] });
+  mockEC2Client.on(DescribeImagesCommand).resolves({
+    Images: [{ ImageId: 'ami-1234' }],
   });
 
   // WHEN
@@ -38,7 +27,7 @@ test('calls DescribeImages on the request', async () => {
   });
 
   // THEN
-  expect(request!).toEqual({
+  expect(mockEC2Client).toHaveReceivedCommandWith(DescribeImagesCommand, {
     Owners: ['some-owner'],
     Filters: [
       {
@@ -46,24 +35,22 @@ test('calls DescribeImages on the request', async () => {
         Values: ['filtered'],
       },
     ],
-  } as aws.EC2.DescribeImagesRequest);
+  });
 });
 
 test('returns the most recent AMI matching the criteria', async () => {
   // GIVEN
-  AWS.mock('EC2', 'describeImages', (_: aws.EC2.DescribeImagesRequest, cb: AwsCallback<aws.EC2.DescribeImagesResult>) => {
-    return cb(null, {
-      Images: [
-        {
-          ImageId: 'ami-1234',
-          CreationDate: '2016-06-22T08:39:59.000Z',
-        },
-        {
-          ImageId: 'ami-5678',
-          CreationDate: '2019-06-22T08:39:59.000Z',
-        },
-      ],
-    });
+  mockEC2Client.on(DescribeImagesCommand).resolves({
+    Images: [
+      {
+        ImageId: 'ami-1234',
+        CreationDate: '2016-06-22T08:39:59.000Z',
+      },
+      {
+        ImageId: 'ami-5678',
+        CreationDate: '2019-06-22T08:39:59.000Z',
+      },
+    ],
   });
 
   // WHEN
diff --git a/packages/aws-cdk/test/context-providers/asymmetric-vpcs.test.ts b/packages/aws-cdk/test/context-providers/asymmetric-vpcs.test.ts
index 7d572685f0343..3892ebc77255b 100644
--- a/packages/aws-cdk/test/context-providers/asymmetric-vpcs.test.ts
+++ b/packages/aws-cdk/test/context-providers/asymmetric-vpcs.test.ts
@@ -1,91 +1,115 @@
-/* eslint-disable import/order */
-import * as aws from 'aws-sdk';
-import * as AWS from 'aws-sdk-mock';
+import {
+  DescribeRouteTablesCommand,
+  DescribeSubnetsCommand,
+  DescribeVpcsCommand,
+  DescribeVpnGatewaysCommand,
+} from '@aws-sdk/client-ec2';
 import { VpcNetworkContextProviderPlugin } from '../../lib/context-providers/vpcs';
-import { MockSdkProvider } from '../util/mock-sdk';
-
-// If the 'aws-sdk' package imported here and the 'aws-sdk' package imported by 'aws-sdk-mock' aren't
-// the same physical package on disk (if version mismatches cause hoisting/deduping to not happen),
-// the type check here takes too long and makes the TypeScript compiler fail.
-// Suppress the type check using 'as any' to make this more robust.
-AWS.setSDKInstance(aws as any);
-
-afterEach(done => {
-  AWS.restore();
-  done();
+import { MockSdkProvider, mockEC2Client, restoreSdkMocksToDefault } from '../util/mock-sdk';
+
+beforeEach(() => {
+  restoreSdkMocksToDefault();
+  mockEC2Client
+    .on(DescribeVpcsCommand)
+    .resolves({
+      Vpcs: [{ VpcId: 'vpc-1234567', CidrBlock: '1.1.1.1/16' }],
+    })
+    .on(DescribeSubnetsCommand)
+    .resolves({
+      Subnets: [{ SubnetId: 'sub-123456', AvailabilityZone: 'bermuda-triangle-1337', MapPublicIpOnLaunch: false }],
+    })
+    .on(DescribeRouteTablesCommand)
+    .resolves({
+      RouteTables: [
+        {
+          Associations: [{ SubnetId: 'sub-123456' }],
+          RouteTableId: 'rtb-123456',
+          Routes: [
+            {
+              DestinationCidrBlock: '1.1.1.1/24',
+              GatewayId: 'local',
+              Origin: 'CreateRouteTable',
+              State: 'active',
+            },
+            {
+              DestinationCidrBlock: '0.0.0.0/0',
+              GatewayId: 'igw-xxxxxx',
+              Origin: 'CreateRoute',
+              State: 'active',
+            },
+          ],
+        },
+        {
+          Associations: [{ SubnetId: 'sub-789012' }],
+          RouteTableId: 'rtb-789012',
+          Routes: [
+            {
+              DestinationCidrBlock: '1.1.2.1/24',
+              GatewayId: 'local',
+              Origin: 'CreateRouteTable',
+              State: 'active',
+            },
+            {
+              DestinationCidrBlock: '0.0.0.0/0',
+              NatGatewayId: 'nat-xxxxxx',
+              Origin: 'CreateRoute',
+              State: 'active',
+            },
+          ],
+        },
+      ],
+    });
 });
 
 const mockSDK = new MockSdkProvider();
 
-type AwsCallback<T> = (err: Error | null, val: T) => void;
-
 test('looks up the requested (symmetric) VPC', async () => {
-  mockVpcLookup({
-    subnets: [
-      { SubnetId: 'sub-123456', AvailabilityZone: 'bermuda-triangle-1337', MapPublicIpOnLaunch: true, CidrBlock: '1.1.1.1/24' },
-      { SubnetId: 'sub-789012', AvailabilityZone: 'bermuda-triangle-1337', MapPublicIpOnLaunch: false, CidrBlock: '1.1.2.1/24' },
-    ],
-    routeTables: [
-      {
-        Associations: [{ SubnetId: 'sub-123456' }],
-        RouteTableId: 'rtb-123456',
-        Routes: [
-          {
-            DestinationCidrBlock: '1.1.1.1/24',
-            GatewayId: 'local',
-            Origin: 'CreateRouteTable',
-            State: 'active',
-          },
-          {
-            DestinationCidrBlock: '0.0.0.0/0',
-            GatewayId: 'igw-xxxxxx',
-            Origin: 'CreateRoute',
-            State: 'active',
-          },
-        ],
-      },
-      {
-        Associations: [{ SubnetId: 'sub-789012' }],
-        RouteTableId: 'rtb-789012',
-        Routes: [
-          {
-            DestinationCidrBlock: '1.1.2.1/24',
-            GatewayId: 'local',
-            Origin: 'CreateRouteTable',
-            State: 'active',
-          },
-          {
-            DestinationCidrBlock: '0.0.0.0/0',
-            NatGatewayId: 'nat-xxxxxx',
-            Origin: 'CreateRoute',
-            State: 'active',
-          },
-        ],
-      },
-    ],
-    vpnGateways: [{ VpnGatewayId: 'gw-abcdef' }],
-
-  });
-
+  mockEC2Client
+    .on(DescribeSubnetsCommand)
+    .resolves({
+      Subnets: [
+        {
+          SubnetId: 'sub-123456',
+          AvailabilityZone: 'bermuda-triangle-1337',
+          MapPublicIpOnLaunch: true,
+          CidrBlock: '1.1.1.1/24',
+        },
+        {
+          SubnetId: 'sub-789012',
+          AvailabilityZone: 'bermuda-triangle-1337',
+          MapPublicIpOnLaunch: false,
+          CidrBlock: '1.1.2.1/24',
+        },
+      ],
+    })
+    .on(DescribeVpnGatewaysCommand)
+    .resolves({ VpnGateways: [{ VpnGatewayId: 'gw-abcdef' }] });
   const result = await new VpcNetworkContextProviderPlugin(mockSDK).getValue({
-    account: '1234',
+    account: '123456789012',
     region: 'us-east-1',
     filter: { foo: 'bar' },
     returnAsymmetricSubnets: true,
   });
 
+  expect(mockEC2Client).toHaveReceivedCommandWith(DescribeVpcsCommand, {
+    Filters: [{ Name: 'foo', Values: ['bar'] }],
+  });
+  expect(mockEC2Client).toHaveReceivedCommandWith(DescribeSubnetsCommand, {
+    Filters: [{ Name: 'vpc-id', Values: ['vpc-1234567'] }],
+  });
+  expect(mockEC2Client).toHaveReceivedCommandWith(DescribeRouteTablesCommand, {
+    Filters: [{ Name: 'vpc-id', Values: ['vpc-1234567'] }],
+  });
+  expect(mockEC2Client).toHaveReceivedCommandWith(DescribeVpnGatewaysCommand, {
+    Filters: [
+      { Name: 'attachment.vpc-id', Values: ['vpc-1234567'] },
+      { Name: 'attachment.state', Values: ['attached'] },
+      { Name: 'state', Values: ['available'] },
+    ],
+  });
   expect(result).toEqual({
     availabilityZones: [],
     vpcCidrBlock: '1.1.1.1/16',
-    isolatedSubnetIds: undefined,
-    isolatedSubnetNames: undefined,
-    isolatedSubnetRouteTableIds: undefined,
-    privateSubnetIds: undefined,
-    privateSubnetNames: undefined,
-    privateSubnetRouteTableIds: undefined,
-    publicSubnetIds: undefined,
-    publicSubnetNames: undefined,
-    publicSubnetRouteTableIds: undefined,
     subnetGroups: [
       {
         name: 'Public',
@@ -118,101 +142,131 @@ test('looks up the requested (symmetric) VPC', async () => {
 });
 
 test('throws when no such VPC is found', async () => {
-  AWS.mock('EC2', 'describeVpcs', (params: aws.EC2.DescribeVpcsRequest, cb: AwsCallback<aws.EC2.DescribeVpcsResult>) => {
-    expect(params.Filters).toEqual([{ Name: 'foo', Values: ['bar'] }]);
-    return cb(null, {});
+  mockEC2Client.on(DescribeVpcsCommand).resolves({});
+  await expect(
+    new VpcNetworkContextProviderPlugin(mockSDK).getValue({
+      account: '123456789012',
+      region: 'us-east-1',
+      filter: { foo: 'bar' },
+      returnAsymmetricSubnets: true,
+    }),
+  ).rejects.toThrow(/Could not find any VPCs matching/);
+  expect(mockEC2Client).toHaveReceivedCommandWith(DescribeVpcsCommand, {
+    Filters: [{ Name: 'foo', Values: ['bar'] }],
   });
-
-  await expect(new VpcNetworkContextProviderPlugin(mockSDK).getValue({
-    account: '1234',
-    region: 'us-east-1',
-    filter: { foo: 'bar' },
-    returnAsymmetricSubnets: true,
-  })).rejects.toThrow(/Could not find any VPCs matching/);
 });
 
 test('throws when multiple VPCs are found', async () => {
   // GIVEN
-  AWS.mock('EC2', 'describeVpcs', (params: aws.EC2.DescribeVpcsRequest, cb: AwsCallback<aws.EC2.DescribeVpcsResult>) => {
-    expect(params.Filters).toEqual([{ Name: 'foo', Values: ['bar'] }]);
-    return cb(null, { Vpcs: [{ VpcId: 'vpc-1' }, { VpcId: 'vpc-2' }] });
+  mockEC2Client.on(DescribeVpcsCommand).resolves({
+    Vpcs: [{ VpcId: 'vpc-1' }, { VpcId: 'vpc-2' }],
   });
 
   // WHEN
-  await expect(new VpcNetworkContextProviderPlugin(mockSDK).getValue({
-    account: '1234',
-    region: 'us-east-1',
-    filter: { foo: 'bar' },
-    returnAsymmetricSubnets: true,
-  })).rejects.toThrow(/Found 2 VPCs matching/);
+  await expect(
+    new VpcNetworkContextProviderPlugin(mockSDK).getValue({
+      account: '123456789012',
+      region: 'us-east-1',
+      filter: { foo: 'bar' },
+      returnAsymmetricSubnets: true,
+    }),
+  ).rejects.toThrow(/Found 2 VPCs matching/);
+  expect(mockEC2Client).toHaveReceivedCommandWith(DescribeVpcsCommand, {
+    Filters: [{ Name: 'foo', Values: ['bar'] }],
+  });
 });
 
 test('uses the VPC main route table when a subnet has no specific association', async () => {
-  mockVpcLookup({
-    subnets: [
-      { SubnetId: 'sub-123456', AvailabilityZone: 'bermuda-triangle-1337', MapPublicIpOnLaunch: true, CidrBlock: '1.1.1.1/24' },
-      { SubnetId: 'sub-789012', AvailabilityZone: 'bermuda-triangle-1337', MapPublicIpOnLaunch: false, CidrBlock: '1.1.2.1/24' },
-    ],
-    routeTables: [
-      {
-        Associations: [{ SubnetId: 'sub-123456' }],
-        RouteTableId: 'rtb-123456',
-        Routes: [
-          {
-            DestinationCidrBlock: '1.1.1.1/24',
-            GatewayId: 'local',
-            Origin: 'CreateRouteTable',
-            State: 'active',
-          },
-          {
-            DestinationCidrBlock: '0.0.0.0/0',
-            GatewayId: 'igw-xxxxxx',
-            Origin: 'CreateRoute',
-            State: 'active',
-          },
-        ],
-      },
-      {
-        Associations: [{ Main: true }],
-        RouteTableId: 'rtb-789012',
-        Routes: [
-          {
-            DestinationCidrBlock: '1.1.2.1/24',
-            GatewayId: 'local',
-            Origin: 'CreateRouteTable',
-            State: 'active',
-          },
-          {
-            DestinationCidrBlock: '0.0.0.0/0',
-            NatGatewayId: 'nat-xxxxxx',
-            Origin: 'CreateRoute',
-            State: 'active',
-          },
-        ],
-      },
-    ],
-    vpnGateways: [{ VpnGatewayId: 'gw-abcdef' }],
-  });
+  mockEC2Client
+    .on(DescribeSubnetsCommand)
+    .resolves({
+      Subnets: [
+        {
+          SubnetId: 'sub-123456',
+          AvailabilityZone: 'bermuda-triangle-1337',
+          MapPublicIpOnLaunch: true,
+          CidrBlock: '1.1.1.1/24',
+        },
+        {
+          SubnetId: 'sub-789012',
+          AvailabilityZone: 'bermuda-triangle-1337',
+          MapPublicIpOnLaunch: false,
+          CidrBlock: '1.1.2.1/24',
+        },
+      ],
+    })
+    .on(DescribeRouteTablesCommand)
+    .resolves({
+      RouteTables: [
+        {
+          Associations: [{ SubnetId: 'sub-123456' }],
+          RouteTableId: 'rtb-123456',
+          Routes: [
+            {
+              DestinationCidrBlock: '1.1.1.1/24',
+              GatewayId: 'local',
+              Origin: 'CreateRouteTable',
+              State: 'active',
+            },
+            {
+              DestinationCidrBlock: '0.0.0.0/0',
+              GatewayId: 'igw-xxxxxx',
+              Origin: 'CreateRoute',
+              State: 'active',
+            },
+          ],
+        },
+        {
+          Associations: [{ Main: true }],
+          RouteTableId: 'rtb-789012',
+          Routes: [
+            {
+              DestinationCidrBlock: '1.1.2.1/24',
+              GatewayId: 'local',
+              Origin: 'CreateRouteTable',
+              State: 'active',
+            },
+            {
+              DestinationCidrBlock: '0.0.0.0/0',
+              NatGatewayId: 'nat-xxxxxx',
+              Origin: 'CreateRoute',
+              State: 'active',
+            },
+          ],
+        },
+      ],
+    })
+    .on(DescribeVpnGatewaysCommand)
+    .resolves({
+      VpnGateways: [{ VpnGatewayId: 'gw-abcdef' }],
+    });
 
   const result = await new VpcNetworkContextProviderPlugin(mockSDK).getValue({
-    account: '1234',
+    account: '123456789012',
     region: 'us-east-1',
     filter: { foo: 'bar' },
     returnAsymmetricSubnets: true,
   });
 
+  expect(mockEC2Client).toHaveReceivedCommandWith(DescribeVpcsCommand, {
+    Filters: [{ Name: 'foo', Values: ['bar'] }],
+  });
+  expect(mockEC2Client).toHaveReceivedCommandWith(DescribeSubnetsCommand, {
+    Filters: [{ Name: 'vpc-id', Values: ['vpc-1234567'] }],
+  });
+  expect(mockEC2Client).toHaveReceivedCommandWith(DescribeRouteTablesCommand, {
+    Filters: [{ Name: 'vpc-id', Values: ['vpc-1234567'] }],
+  });
+  expect(mockEC2Client).toHaveReceivedCommandWith(DescribeVpnGatewaysCommand, {
+    Filters: [
+      { Name: 'attachment.vpc-id', Values: ['vpc-1234567'] },
+      { Name: 'attachment.state', Values: ['attached'] },
+      { Name: 'state', Values: ['available'] },
+    ],
+  });
   expect(result).toEqual({
     availabilityZones: [],
     vpcCidrBlock: '1.1.1.1/16',
-    isolatedSubnetIds: undefined,
-    isolatedSubnetNames: undefined,
-    isolatedSubnetRouteTableIds: undefined,
-    privateSubnetIds: undefined,
-    privateSubnetNames: undefined,
-    privateSubnetRouteTableIds: undefined,
-    publicSubnetIds: undefined,
-    publicSubnetNames: undefined,
-    publicSubnetRouteTableIds: undefined,
     subnetGroups: [
       {
         name: 'Public',
@@ -246,11 +300,8 @@ test('uses the VPC main route table when a subnet has no specific association',
 
 test('Recognize public subnet by route table', async () => {
   // GIVEN
-  mockVpcLookup({
-    subnets: [
-      { SubnetId: 'sub-123456', AvailabilityZone: 'bermuda-triangle-1337', MapPublicIpOnLaunch: false },
-    ],
-    routeTables: [
+  mockEC2Client.on(DescribeRouteTablesCommand).resolves({
+    RouteTables: [
       {
         Associations: [{ SubnetId: 'sub-123456' }],
         RouteTableId: 'rtb-123456',
@@ -280,25 +331,32 @@ test('Recognize public subnet by route table', async () => {
 
   // WHEN
   const result = await new VpcNetworkContextProviderPlugin(mockSDK).getValue({
-    account: '1234',
+    account: '123456789012',
     region: 'us-east-1',
     filter: { foo: 'bar' },
     returnAsymmetricSubnets: true,
   });
 
   // THEN
+  expect(mockEC2Client).toHaveReceivedCommandWith(DescribeVpcsCommand, {
+    Filters: [{ Name: 'foo', Values: ['bar'] }],
+  });
+  expect(mockEC2Client).toHaveReceivedCommandWith(DescribeSubnetsCommand, {
+    Filters: [{ Name: 'vpc-id', Values: ['vpc-1234567'] }],
+  });
+  expect(mockEC2Client).toHaveReceivedCommandWith(DescribeRouteTablesCommand, {
+    Filters: [{ Name: 'vpc-id', Values: ['vpc-1234567'] }],
+  });
+  expect(mockEC2Client).toHaveReceivedCommandWith(DescribeVpnGatewaysCommand, {
+    Filters: [
+      { Name: 'attachment.vpc-id', Values: ['vpc-1234567'] },
+      { Name: 'attachment.state', Values: ['attached'] },
+      { Name: 'state', Values: ['available'] },
+    ],
+  });
   expect(result).toEqual({
     availabilityZones: [],
     vpcCidrBlock: '1.1.1.1/16',
-    isolatedSubnetIds: undefined,
-    isolatedSubnetNames: undefined,
-    isolatedSubnetRouteTableIds: undefined,
-    privateSubnetIds: undefined,
-    privateSubnetNames: undefined,
-    privateSubnetRouteTableIds: undefined,
-    publicSubnetIds: undefined,
-    publicSubnetNames: undefined,
-    publicSubnetRouteTableIds: undefined,
     subnetGroups: [
       {
         name: 'Public',
@@ -320,11 +378,8 @@ test('Recognize public subnet by route table', async () => {
 
 test('Recognize isolated subnet by route table', async () => {
   // GIVEN
-  mockVpcLookup({
-    subnets: [
-      { SubnetId: 'sub-123456', AvailabilityZone: 'bermuda-triangle-1337', MapPublicIpOnLaunch: false },
-    ],
-    routeTables: [
+  mockEC2Client.on(DescribeRouteTablesCommand).resolves({
+    RouteTables: [
       {
         Associations: [{ SubnetId: 'sub-123456' }],
         RouteTableId: 'rtb-123456',
@@ -342,7 +397,7 @@ test('Recognize isolated subnet by route table', async () => {
 
   // WHEN
   const result = await new VpcNetworkContextProviderPlugin(mockSDK).getValue({
-    account: '1234',
+    account: '123456789012',
     region: 'us-east-1',
     filter: { foo: 'bar' },
     returnAsymmetricSubnets: true,
@@ -352,15 +407,6 @@ test('Recognize isolated subnet by route table', async () => {
   expect(result).toEqual({
     availabilityZones: [],
     vpcCidrBlock: '1.1.1.1/16',
-    isolatedSubnetIds: undefined,
-    isolatedSubnetNames: undefined,
-    isolatedSubnetRouteTableIds: undefined,
-    privateSubnetIds: undefined,
-    privateSubnetNames: undefined,
-    privateSubnetRouteTableIds: undefined,
-    publicSubnetIds: undefined,
-    publicSubnetNames: undefined,
-    publicSubnetRouteTableIds: undefined,
     subnetGroups: [
       {
         name: 'Isolated',
@@ -382,11 +428,8 @@ test('Recognize isolated subnet by route table', async () => {
 
 test('Recognize private subnet by route table', async () => {
   // GIVEN
-  mockVpcLookup({
-    subnets: [
-      { SubnetId: 'sub-123456', AvailabilityZone: 'bermuda-triangle-1337', MapPublicIpOnLaunch: false },
-    ],
-    routeTables: [
+  mockEC2Client.on(DescribeRouteTablesCommand).resolves({
+    RouteTables: [
       {
         Associations: [{ SubnetId: 'sub-123456' }],
         RouteTableId: 'rtb-123456',
@@ -416,7 +459,7 @@ test('Recognize private subnet by route table', async () => {
 
   // WHEN
   const result = await new VpcNetworkContextProviderPlugin(mockSDK).getValue({
-    account: '1234',
+    account: '123456789012',
     region: 'us-east-1',
     filter: { foo: 'bar' },
     returnAsymmetricSubnets: true,
@@ -426,15 +469,6 @@ test('Recognize private subnet by route table', async () => {
   expect(result).toEqual({
     availabilityZones: [],
     vpcCidrBlock: '1.1.1.1/16',
-    isolatedSubnetIds: undefined,
-    isolatedSubnetNames: undefined,
-    isolatedSubnetRouteTableIds: undefined,
-    privateSubnetIds: undefined,
-    privateSubnetNames: undefined,
-    privateSubnetRouteTableIds: undefined,
-    publicSubnetIds: undefined,
-    publicSubnetNames: undefined,
-    publicSubnetRouteTableIds: undefined,
     subnetGroups: [
       {
         name: 'Private',
@@ -456,44 +490,69 @@ test('Recognize private subnet by route table', async () => {
 
 test('works for asymmetric subnets (not spanning the same Availability Zones)', async () => {
   // GIVEN
-  mockVpcLookup({
-    subnets: [
-      { SubnetId: 'pri-sub-in-1b', AvailabilityZone: 'us-west-1b', MapPublicIpOnLaunch: false, CidrBlock: '1.1.1.1/24' },
-      { SubnetId: 'pub-sub-in-1c', AvailabilityZone: 'us-west-1c', MapPublicIpOnLaunch: true, CidrBlock: '1.1.2.1/24' },
-      { SubnetId: 'pub-sub-in-1b', AvailabilityZone: 'us-west-1b', MapPublicIpOnLaunch: true, CidrBlock: '1.1.3.1/24' },
-      { SubnetId: 'pub-sub-in-1a', AvailabilityZone: 'us-west-1a', MapPublicIpOnLaunch: true, CidrBlock: '1.1.4.1/24' },
-    ],
-    routeTables: [
-      {
-        Associations: [{ SubnetId: 'pri-sub-in-1b' }],
-        RouteTableId: 'rtb-123456',
-        Routes: [
-          {
-            DestinationCidrBlock: '0.0.0.0/0',
-            NatGatewayId: 'nat-xxxxxx',
-            Origin: 'CreateRoute',
-            State: 'active',
-          },
-        ],
-      },
-      {
-        Associations: [{ Main: true }],
-        RouteTableId: 'rtb-789012',
-        Routes: [
-          {
-            DestinationCidrBlock: '0.0.0.0/0',
-            GatewayId: 'igw-xxxxxx',
-            Origin: 'CreateRoute',
-            State: 'active',
-          },
-        ],
-      },
-    ],
-  });
+  mockEC2Client
+    .on(DescribeSubnetsCommand)
+    .resolves({
+      Subnets: [
+        {
+          SubnetId: 'pri-sub-in-1b',
+          AvailabilityZone: 'us-west-1b',
+          MapPublicIpOnLaunch: false,
+          CidrBlock: '1.1.1.1/24',
+        },
+        {
+          SubnetId: 'pub-sub-in-1c',
+          AvailabilityZone: 'us-west-1c',
+          MapPublicIpOnLaunch: true,
+          CidrBlock: '1.1.2.1/24',
+        },
+        {
+          SubnetId: 'pub-sub-in-1b',
+          AvailabilityZone: 'us-west-1b',
+          MapPublicIpOnLaunch: true,
+          CidrBlock: '1.1.3.1/24',
+        },
+        {
+          SubnetId: 'pub-sub-in-1a',
+          AvailabilityZone: 'us-west-1a',
+          MapPublicIpOnLaunch: true,
+          CidrBlock: '1.1.4.1/24',
+        },
+      ],
+    })
+    .on(DescribeRouteTablesCommand)
+    .resolves({
+      RouteTables: [
+        {
+          Associations: [{ SubnetId: 'pri-sub-in-1b' }],
+          RouteTableId: 'rtb-123456',
+          Routes: [
+            {
+              DestinationCidrBlock: '0.0.0.0/0',
+              NatGatewayId: 'nat-xxxxxx',
+              Origin: 'CreateRoute',
+              State: 'active',
+            },
+          ],
+        },
+        {
+          Associations: [{ Main: true }],
+          RouteTableId: 'rtb-789012',
+          Routes: [
+            {
+              DestinationCidrBlock: '0.0.0.0/0',
+              GatewayId: 'igw-xxxxxx',
+              Origin: 'CreateRoute',
+              State: 'active',
+            },
+          ],
+        },
+      ],
+    });
 
   // WHEN
   const result = await new VpcNetworkContextProviderPlugin(mockSDK).getValue({
-    account: '1234',
+    account: '123456789012',
     region: 'us-east-1',
     filter: { foo: 'bar' },
     returnAsymmetricSubnets: true,
@@ -503,15 +562,6 @@ test('works for asymmetric subnets (not spanning the same Availability Zones)',
   expect(result).toEqual({
     availabilityZones: [],
     vpcCidrBlock: '1.1.1.1/16',
-    isolatedSubnetIds: undefined,
-    isolatedSubnetNames: undefined,
-    isolatedSubnetRouteTableIds: undefined,
-    privateSubnetIds: undefined,
-    privateSubnetNames: undefined,
-    privateSubnetRouteTableIds: undefined,
-    publicSubnetIds: undefined,
-    publicSubnetNames: undefined,
-    publicSubnetRouteTableIds: undefined,
     subnetGroups: [
       {
         name: 'Private',
@@ -557,71 +607,68 @@ test('works for asymmetric subnets (not spanning the same Availability Zones)',
 
 test('allows specifying the subnet group name tag', async () => {
   // GIVEN
-  mockVpcLookup({
-    subnets: [
-      {
-        SubnetId: 'pri-sub-in-1b',
-        AvailabilityZone: 'us-west-1b',
-        MapPublicIpOnLaunch: false,
-        Tags: [
-          { Key: 'Tier', Value: 'restricted' },
-        ],
-      },
-      {
-        SubnetId: 'pub-sub-in-1c',
-        AvailabilityZone: 'us-west-1c',
-        MapPublicIpOnLaunch: true,
-        Tags: [
-          { Key: 'Tier', Value: 'connectivity' },
-        ],
-      },
-      {
-        SubnetId: 'pub-sub-in-1b',
-        AvailabilityZone: 'us-west-1b',
-        MapPublicIpOnLaunch: true,
-        Tags: [
-          { Key: 'Tier', Value: 'connectivity' },
-        ],
-      },
-      {
-        SubnetId: 'pub-sub-in-1a',
-        AvailabilityZone: 'us-west-1a',
-        MapPublicIpOnLaunch: true,
-        Tags: [
-          { Key: 'Tier', Value: 'connectivity' },
-        ],
-      },
-    ],
-    routeTables: [
-      {
-        Associations: [{ SubnetId: 'pri-sub-in-1b' }],
-        RouteTableId: 'rtb-123456',
-        Routes: [
-          {
-            DestinationCidrBlock: '0.0.0.0/0',
-            NatGatewayId: 'nat-xxxxxx',
-            Origin: 'CreateRoute',
-            State: 'active',
-          },
-        ],
-      },
-      {
-        Associations: [{ Main: true }],
-        RouteTableId: 'rtb-789012',
-        Routes: [
-          {
-            DestinationCidrBlock: '0.0.0.0/0',
-            GatewayId: 'igw-xxxxxx',
-            Origin: 'CreateRoute',
-            State: 'active',
-          },
-        ],
-      },
-    ],
-  });
+  mockEC2Client
+    .on(DescribeSubnetsCommand)
+    .resolves({
+      Subnets: [
+        {
+          SubnetId: 'pri-sub-in-1b',
+          AvailabilityZone: 'us-west-1b',
+          MapPublicIpOnLaunch: false,
+          Tags: [{ Key: 'Tier', Value: 'restricted' }],
+        },
+        {
+          SubnetId: 'pub-sub-in-1c',
+          AvailabilityZone: 'us-west-1c',
+          MapPublicIpOnLaunch: true,
+          Tags: [{ Key: 'Tier', Value: 'connectivity' }],
+        },
+        {
+          SubnetId: 'pub-sub-in-1b',
+          AvailabilityZone: 'us-west-1b',
+          MapPublicIpOnLaunch: true,
+          Tags: [{ Key: 'Tier', Value: 'connectivity' }],
+        },
+        {
+          SubnetId: 'pub-sub-in-1a',
+          AvailabilityZone: 'us-west-1a',
+          MapPublicIpOnLaunch: true,
+          Tags: [{ Key: 'Tier', Value: 'connectivity' }],
+        },
+      ],
+    })
+    .on(DescribeRouteTablesCommand)
+    .resolves({
+      RouteTables: [
+        {
+          Associations: [{ SubnetId: 'pri-sub-in-1b' }],
+          RouteTableId: 'rtb-123456',
+          Routes: [
+            {
+              DestinationCidrBlock: '0.0.0.0/0',
+              NatGatewayId: 'nat-xxxxxx',
+              Origin: 'CreateRoute',
+              State: 'active',
+            },
+          ],
+        },
+        {
+          Associations: [{ Main: true }],
+          RouteTableId: 'rtb-789012',
+          Routes: [
+            {
+              DestinationCidrBlock: '0.0.0.0/0',
+              GatewayId: 'igw-xxxxxx',
+              Origin: 'CreateRoute',
+              State: 'active',
+            },
+          ],
+        },
+      ],
+    });
 
   const result = await new VpcNetworkContextProviderPlugin(mockSDK).getValue({
-    account: '1234',
+    account: '123456789012',
     region: 'us-east-1',
     filter: { foo: 'bar' },
     returnAsymmetricSubnets: true,
@@ -631,15 +678,6 @@ test('allows specifying the subnet group name tag', async () => {
   expect(result).toEqual({
     availabilityZones: [],
     vpcCidrBlock: '1.1.1.1/16',
-    isolatedSubnetIds: undefined,
-    isolatedSubnetNames: undefined,
-    isolatedSubnetRouteTableIds: undefined,
-    privateSubnetIds: undefined,
-    privateSubnetNames: undefined,
-    privateSubnetRouteTableIds: undefined,
-    publicSubnetIds: undefined,
-    publicSubnetNames: undefined,
-    publicSubnetRouteTableIds: undefined,
     subnetGroups: [
       {
         name: 'restricted',
@@ -682,37 +720,3 @@ test('allows specifying the subnet group name tag', async () => {
     vpnGatewayId: undefined,
   });
 });
-
-interface VpcLookupOptions {
-  subnets: aws.EC2.Subnet[];
-  routeTables: aws.EC2.RouteTable[];
-  vpnGateways?: aws.EC2.VpnGateway[];
-}
-
-function mockVpcLookup(options: VpcLookupOptions) {
-  const VpcId = 'vpc-1234567';
-
-  AWS.mock('EC2', 'describeVpcs', (params: aws.EC2.DescribeVpcsRequest, cb: AwsCallback<aws.EC2.DescribeVpcsResult>) => {
-    expect(params.Filters).toEqual([{ Name: 'foo', Values: ['bar'] }]);
-    return cb(null, { Vpcs: [{ VpcId, CidrBlock: '1.1.1.1/16' }] });
-  });
-
-  AWS.mock('EC2', 'describeSubnets', (params: aws.EC2.DescribeSubnetsRequest, cb: AwsCallback<aws.EC2.DescribeSubnetsResult>) => {
-    expect(params.Filters).toEqual([{ Name: 'vpc-id', Values: [VpcId] }]);
-    return cb(null, { Subnets: options.subnets });
-  });
-
-  AWS.mock('EC2', 'describeRouteTables', (params: aws.EC2.DescribeRouteTablesRequest, cb: AwsCallback<aws.EC2.DescribeRouteTablesResult>) => {
-    expect(params.Filters).toEqual([{ Name: 'vpc-id', Values: [VpcId] }]);
-    return cb(null, { RouteTables: options.routeTables });
-  });
-
-  AWS.mock('EC2', 'describeVpnGateways', (params: aws.EC2.DescribeVpnGatewaysRequest, cb: AwsCallback<aws.EC2.DescribeVpnGatewaysResult>) => {
-    expect(params.Filters).toEqual([
-      { Name: 'attachment.vpc-id', Values: [VpcId] },
-      { Name: 'attachment.state', Values: ['attached'] },
-      { Name: 'state', Values: ['available'] },
-    ]);
-    return cb(null, { VpnGateways: options.vpnGateways });
-  });
-}
diff --git a/packages/aws-cdk/test/context-providers/keys.test.ts b/packages/aws-cdk/test/context-providers/keys.test.ts
index 2503110745963..d31204eca1739 100644
--- a/packages/aws-cdk/test/context-providers/keys.test.ts
+++ b/packages/aws-cdk/test/context-providers/keys.test.ts
@@ -1,37 +1,28 @@
-/* eslint-disable import/order */
-import * as aws from 'aws-sdk';
-import * as AWS from 'aws-sdk-mock';
+import { ListAliasesCommand } from '@aws-sdk/client-kms';
 import { KeyContextProviderPlugin } from '../../lib/context-providers/keys';
-import { MockSdkProvider } from '../util/mock-sdk';
+import { MockSdkProvider, mockKMSClient, restoreSdkMocksToDefault } from '../util/mock-sdk';
 
-AWS.setSDK(require.resolve('aws-sdk'));
-const mockSDK = new MockSdkProvider();
-type AwsCallback<T> = (err: Error | null, val: T) => void;
+let provider: KeyContextProviderPlugin;
 
-afterEach(done => {
-  AWS.restore();
-  done();
+beforeEach(() => {
+  provider = new KeyContextProviderPlugin(new MockSdkProvider());
+  restoreSdkMocksToDefault();
 });
 
 test('looks up the requested Key - single result', async () => {
   // GIVEN
-  const provider = new KeyContextProviderPlugin(mockSDK);
-
-  AWS.mock('KMS', 'listAliases', (params: aws.KMS.ListAliasesRequest, cb: AwsCallback<aws.KMS.ListAliasesResponse>) => {
-    expect(params.KeyId).toBeUndefined();
-    return cb(null, {
-      Aliases: [
-        {
-          AliasName: 'alias/foo',
-          TargetKeyId: '1234abcd-12ab-34cd-56ef-123456789000',
-        },
-      ],
-    });
+  mockKMSClient.on(ListAliasesCommand).resolves({
+    Aliases: [
+      {
+        AliasName: 'alias/foo',
+        TargetKeyId: '1234abcd-12ab-34cd-56ef-123456789000',
+      },
+    ],
   });
 
   // WHEN
   const result = await provider.getValue({
-    account: '1234',
+    account: '123456789012',
     region: 'us-east-1',
     aliasName: 'alias/foo',
   });
@@ -44,31 +35,26 @@ test('looks up the requested Key - single result', async () => {
 
 test('looks up the requested Key - multiple results', async () => {
   // GIVEN
-  const provider = new KeyContextProviderPlugin(mockSDK);
-
-  AWS.mock('KMS', 'listAliases', (params: aws.KMS.ListAliasesRequest, cb: AwsCallback<aws.KMS.ListAliasesResponse>) => {
-    expect(params.KeyId).toBeUndefined();
-    return cb(null, {
-      Aliases: [
-        {
-          AliasName: 'alias/bar',
-          TargetKeyId: '1234abcd-12ab-34cd-56ef-123456789000',
-        },
-        {
-          AliasName: 'alias/foo',
-          TargetKeyId: '1234abcd-12ab-34cd-56ef-123456789001',
-        },
-        {
-          AliasName: 'alias/fooBar',
-          TargetKeyId: '1234abcd-12ab-34cd-56ef-123456789002',
-        },
-      ],
-    });
+  mockKMSClient.on(ListAliasesCommand).resolves({
+    Aliases: [
+      {
+        AliasName: 'alias/bar',
+        TargetKeyId: '1234abcd-12ab-34cd-56ef-123456789000',
+      },
+      {
+        AliasName: 'alias/foo',
+        TargetKeyId: '1234abcd-12ab-34cd-56ef-123456789001',
+      },
+      {
+        AliasName: 'alias/fooBar',
+        TargetKeyId: '1234abcd-12ab-34cd-56ef-123456789002',
+      },
+    ],
   });
 
   // WHEN
   const result = await provider.getValue({
-    account: '1234',
+    account: '123456789012',
     region: 'us-east-1',
     aliasName: 'alias/foo',
   });
@@ -81,51 +67,46 @@ test('looks up the requested Key - multiple results', async () => {
 
 test('looks up the requested Key - multiple results with pagination', async () => {
   // GIVEN
-  const provider = new KeyContextProviderPlugin(mockSDK);
-
-  AWS.mock('KMS', 'listAliases', (params: aws.KMS.ListAliasesRequest, cb: AwsCallback<aws.KMS.ListAliasesResponse>) => {
-    if (!params.Marker) {
-      return cb(null, {
-        Truncated: true,
-        NextMarker: 'nextMarker',
-        Aliases: [
-          {
-            AliasName: 'alias/key1',
-            TargetKeyId: '1234abcd-12ab-34cd-56ef-123456789000',
-          },
-          {
-            AliasName: 'alias/key2',
-            TargetKeyId: '1234abcd-12ab-34cd-56ef-123456789001',
-          },
-          {
-            AliasName: 'alias/key3',
-            TargetKeyId: '1234abcd-12ab-34cd-56ef-123456789002',
-          },
-        ],
-      });
-    } else if (params.Marker == 'nextMarker') {
-      return cb(null, {
-        Aliases: [
-          {
-            AliasName: 'alias/key4',
-            TargetKeyId: '1234abcd-12ab-34cd-56ef-123456789003',
-          },
-          {
-            AliasName: 'alias/foo',
-            TargetKeyId: '1234abcd-12ab-34cd-56ef-123456789004',
-          },
-          {
-            AliasName: 'alias/key5',
-            TargetKeyId: '1234abcd-12ab-34cd-56ef-123456789005',
-          },
-        ],
-      });
-    }
-  });
+  mockKMSClient
+    .on(ListAliasesCommand)
+    .resolvesOnce({
+      NextMarker: 'nextMarker',
+      Truncated: true,
+      Aliases: [
+        {
+          AliasName: 'alias/key1',
+          TargetKeyId: '1234abcd-12ab-34cd-56ef-123456789000',
+        },
+        {
+          AliasName: 'alias/key2',
+          TargetKeyId: '1234abcd-12ab-34cd-56ef-123456789001',
+        },
+        {
+          AliasName: 'alias/key3',
+          TargetKeyId: '1234abcd-12ab-34cd-56ef-123456789002',
+        },
+      ],
+    })
+    .resolvesOnce({
+      Aliases: [
+        {
+          AliasName: 'alias/key4',
+          TargetKeyId: '1234abcd-12ab-34cd-56ef-123456789003',
+        },
+        {
+          AliasName: 'alias/foo',
+          TargetKeyId: '1234abcd-12ab-34cd-56ef-123456789004',
+        },
+        {
+          AliasName: 'alias/key5',
+          TargetKeyId: '1234abcd-12ab-34cd-56ef-123456789005',
+        },
+      ],
+    });
 
   // WHEN
   const result = await provider.getValue({
-    account: '1234',
+    account: '123456789012',
     region: 'us-east-1',
     aliasName: 'alias/foo',
   });
@@ -138,19 +119,16 @@ test('looks up the requested Key - multiple results with pagination', async () =
 
 test('throw exception - no key found', async () => {
   // GIVEN
-  const provider = new KeyContextProviderPlugin(mockSDK);
-
-  AWS.mock('KMS', 'listAliases', (params: aws.KMS.ListAliasesRequest, cb: AwsCallback<aws.KMS.ListAliasesResponse>) => {
-    expect(params.KeyId).toBeUndefined();
-    return cb(null, {
-    });
+  mockKMSClient.on(ListAliasesCommand).resolves({
+    Aliases: [],
   });
 
   // WHEN
-  await expect(provider.getValue({
-    account: '1234',
-    region: 'us-east-1',
-    aliasName: 'alias/foo',
-  })).rejects.toThrow(/Could not find any key with alias named/);
-
-});
\ No newline at end of file
+  await expect(
+    provider.getValue({
+      account: '123456789012',
+      region: 'us-east-1',
+      aliasName: 'alias/foo',
+    }),
+  ).rejects.toThrow(/Could not find any key with alias named/);
+});
diff --git a/packages/aws-cdk/test/context-providers/load-balancers.test.ts b/packages/aws-cdk/test/context-providers/load-balancers.test.ts
index a6a3a61b50264..7ccb952a75ee1 100644
--- a/packages/aws-cdk/test/context-providers/load-balancers.test.ts
+++ b/packages/aws-cdk/test/context-providers/load-balancers.test.ts
@@ -1,174 +1,29 @@
-/* eslint-disable import/order */
-import * as cxschema from '@aws-cdk/cloud-assembly-schema';
-import * as aws from 'aws-sdk';
-import * as AWS from 'aws-sdk-mock';
-import { LoadBalancerListenerContextProviderPlugin, LoadBalancerContextProviderPlugin, tagsMatch, describeListenersByLoadBalancerArn, describeTags, describeLoadBalancers } from '../../lib/context-providers/load-balancers';
-import { MockSdkProvider } from '../util/mock-sdk';
-
-AWS.setSDK(require.resolve('aws-sdk'));
-
-const mockSDK = new MockSdkProvider();
-
-type AwsCallback<T> = (err: Error | null, val: T) => void;
-
-afterEach(done => {
-  AWS.restore();
-  done();
-});
-
-describe('utilities', () => {
-  test('describeTags yields tags by chunk', async () => {
-    const resourceTags: Record<string, aws.ELBv2.TagDescription> = {};
-    for (const resourceArn of [...Array(100)].map((_, i) => `arn:load-balancer-${i}`)) {
-      resourceTags[resourceArn] = {
-        ResourceArn: resourceArn,
-        Tags: [
-          { Key: 'name', Value: resourceArn },
-        ],
-      };
-    };
-
-    AWS.mock('ELBv2', 'describeTags', (_params: aws.ELBv2.DescribeTagsInput, cb: AwsCallback<aws.ELBv2.DescribeTagsOutput>) => {
-      expect(_params.ResourceArns.length).toBeLessThanOrEqual(20);
-
-      cb(null, {
-        TagDescriptions: _params.ResourceArns.map(resourceArn => ({
-          ResourceArn: resourceArn,
-          Tags: [
-            { Key: 'name', Value: resourceArn },
-          ],
-        })),
-      });
-    });
-
-    const elbv2 = (await mockSDK.forEnvironment()).sdk.elbv2();
-
-    const resourceTagsOut: Record<string, aws.ELBv2.TagDescription> = {};
-    for await (const tagDescription of describeTags(elbv2, Object.keys(resourceTags))) {
-      resourceTagsOut[tagDescription.ResourceArn!] = tagDescription;
-    }
-
-    expect(resourceTagsOut).toEqual(resourceTags);
-  });
-
-  test('describeListenersByLoadBalancerArn traverses pages', async () => {
-    // arn:listener-0, arn:listener-1, ..., arn:listener-99
-    const listenerArns = [...Array(100)].map((_, i) => `arn:listener-${i}`);
-    expect(listenerArns[0]).toEqual('arn:listener-0');
-
-    AWS.mock('ELBv2', 'describeListeners', (_params: aws.ELBv2.DescribeListenersInput, cb: AwsCallback<aws.ELBv2.DescribeListenersOutput>) => {
-      const start = parseInt(_params.Marker ?? '0');
-      const end = start + 10;
-      const slice = listenerArns.slice(start, end);
-
-      cb(null, {
-        Listeners: slice.map(arn => ({
-          ListenerArn: arn,
-        })),
-        NextMarker: end < listenerArns.length ? end.toString() : undefined,
-      });
-    });
-
-    const elbv2 = (await mockSDK.forEnvironment()).sdk.elbv2();
-
-    const listenerArnsFromPages = Array<string>();
-    for await (const listener of describeListenersByLoadBalancerArn(elbv2, ['arn:load-balancer'])) {
-      listenerArnsFromPages.push(listener.ListenerArn!);
-    }
-
-    expect(listenerArnsFromPages).toEqual(listenerArns);
-  });
-
-  test('describeLoadBalancers traverses pages', async () => {
-    const loadBalancerArns = [...Array(100)].map((_, i) => `arn:load-balancer-${i}`);
-    expect(loadBalancerArns[0]).toEqual('arn:load-balancer-0');
-
-    AWS.mock('ELBv2', 'describeLoadBalancers', (_params: aws.ELBv2.DescribeLoadBalancersInput, cb: AwsCallback<aws.ELBv2.DescribeLoadBalancersOutput>) => {
-      const start = parseInt(_params.Marker ?? '0');
-      const end = start + 10;
-      const slice = loadBalancerArns.slice(start, end);
-
-      cb(null, {
-        LoadBalancers: slice.map(loadBalancerArn => ({
-          LoadBalancerArn: loadBalancerArn,
-        })),
-        NextMarker: end < loadBalancerArns.length ? end.toString() : undefined,
-      });
-    });
-
-    const elbv2 = (await mockSDK.forEnvironment()).sdk.elbv2();
-    const loadBalancerArnsFromPages = (await describeLoadBalancers(elbv2, {})).map(l => l.LoadBalancerArn!);
-
-    expect(loadBalancerArnsFromPages).toEqual(loadBalancerArns);
-  });
-
-  describe('tagsMatch', () => {
-    test('all tags match', () => {
-      const tagDescription = {
-        ResourceArn: 'arn:whatever',
-        Tags: [{ Key: 'some', Value: 'tag' }],
-      };
-
-      const requiredTags = [
-        { key: 'some', value: 'tag' },
-      ];
-
-      expect(tagsMatch(tagDescription, requiredTags)).toEqual(true);
-    });
-
-    test('extra tags match', () => {
-      const tagDescription = {
-        ResourceArn: 'arn:whatever',
-        Tags: [
-          { Key: 'some', Value: 'tag' },
-          { Key: 'other', Value: 'tag2' },
-        ],
-      };
-
-      const requiredTags = [
-        { key: 'some', value: 'tag' },
-      ];
-
-      expect(tagsMatch(tagDescription, requiredTags)).toEqual(true);
-    });
-
-    test('no tags matches no tags', () => {
-      const tagDescription = {
-        ResourceArn: 'arn:whatever',
-        Tags: [],
-      };
-
-      expect(tagsMatch(tagDescription, [])).toEqual(true);
-    });
-
-    test('one tag matches of several', () => {
-      const tagDescription = {
-        ResourceArn: 'arn:whatever',
-        Tags: [{ Key: 'some', Value: 'tag' }],
-      };
-
-      const requiredTags = [
-        { key: 'some', value: 'tag' },
-        { key: 'other', value: 'value' },
-      ];
-
-      expect(tagsMatch(tagDescription, requiredTags)).toEqual(false);
-    });
-
-    test('undefined tag does not error', () => {
-      const tagDescription = {
-        ResourceArn: 'arn:whatever',
-        Tags: [{ Key: 'some' }],
-      };
-
-      const requiredTags = [
-        { key: 'some', value: 'tag' },
-        { key: 'other', value: 'value' },
-      ];
-
-      expect(tagsMatch(tagDescription, requiredTags)).toEqual(false);
-    });
-  });
+import { LoadBalancerListenerProtocol, LoadBalancerType } from '@aws-cdk/cloud-assembly-schema';
+import {
+  DescribeListenersCommand,
+  DescribeLoadBalancersCommand,
+  DescribeTagsCommand,
+} from '@aws-sdk/client-elastic-load-balancing-v2';
+import { SDK, SdkForEnvironment } from '../../lib';
+import {
+  LoadBalancerListenerContextProviderPlugin,
+  LoadBalancerContextProviderPlugin,
+} from '../../lib/context-providers/load-balancers';
+import {
+  FAKE_CREDENTIALS,
+  MockSdkProvider,
+  mockElasticLoadBalancingV2Client,
+  restoreSdkMocksToDefault,
+} from '../util/mock-sdk';
+
+const mockSDK = new (class extends MockSdkProvider {
+  public forEnvironment(): Promise<SdkForEnvironment> {
+    return Promise.resolve({ sdk: new SDK(FAKE_CREDENTIALS, mockSDK.defaultRegion, {}), didAssumeRole: false });
+  }
+})();
+
+beforeEach(() => {
+  restoreSdkMocksToDefault();
 });
 
 describe('load balancer context provider plugin', () => {
@@ -176,83 +31,80 @@ describe('load balancer context provider plugin', () => {
     // GIVEN
     const provider = new LoadBalancerContextProviderPlugin(mockSDK);
 
-    mockALBLookup({
-      loadBalancers: [],
-    });
-
     // WHEN
     await expect(
       provider.getValue({
         account: '1234',
         region: 'us-east-1',
-        loadBalancerType: cxschema.LoadBalancerType.APPLICATION,
+        loadBalancerType: LoadBalancerType.APPLICATION,
         loadBalancerArn: 'arn:load-balancer1',
       }),
-    ).rejects.toThrow(/No load balancers found/i);
+    ).rejects.toThrow(
+      'No load balancers found matching {"account":"1234","region":"us-east-1","loadBalancerType":"application","loadBalancerArn":"arn:load-balancer1"}',
+    );
   });
 
   test('errors when multiple load balancers match', async () => {
     // GIVEN
+    mockElasticLoadBalancingV2Client
+      .on(DescribeLoadBalancersCommand)
+      .resolves({
+        LoadBalancers: [
+          {
+            IpAddressType: 'ipv4',
+            LoadBalancerArn: 'arn:load-balancer1',
+            DNSName: 'dns1.example.com',
+            CanonicalHostedZoneId: 'Z1234',
+            SecurityGroups: ['sg-1234'],
+            VpcId: 'vpc-1234',
+            Type: 'application',
+          },
+          {
+            IpAddressType: 'ipv4',
+            LoadBalancerArn: 'arn:load-balancer2',
+            DNSName: 'dns2.example.com',
+            CanonicalHostedZoneId: 'Z1234',
+            SecurityGroups: ['sg-1234'],
+            VpcId: 'vpc-1234',
+            Type: 'application',
+          },
+        ],
+      })
+      .on(DescribeTagsCommand)
+      .resolves({
+        TagDescriptions: [
+          {
+            ResourceArn: 'arn:load-balancer1',
+            Tags: [{ Key: 'some', Value: 'tag' }],
+          },
+          {
+            ResourceArn: 'arn:load-balancer2',
+            Tags: [{ Key: 'some', Value: 'tag' }],
+          },
+        ],
+      });
     const provider = new LoadBalancerContextProviderPlugin(mockSDK);
 
-    mockALBLookup({
-      loadBalancers: [
-        {
-          IpAddressType: 'ipv4',
-          LoadBalancerArn: 'arn:load-balancer1',
-          DNSName: 'dns1.example.com',
-          CanonicalHostedZoneId: 'Z1234',
-          SecurityGroups: ['sg-1234'],
-          VpcId: 'vpc-1234',
-          Type: 'application',
-        },
-        {
-          IpAddressType: 'ipv4',
-          LoadBalancerArn: 'arn:load-balancer2',
-          DNSName: 'dns2.example.com',
-          CanonicalHostedZoneId: 'Z1234',
-          SecurityGroups: ['sg-1234'],
-          VpcId: 'vpc-1234',
-          Type: 'application',
-        },
-      ],
-      describeTagsExpected: { ResourceArns: ['arn:load-balancer1', 'arn:load-balancer2'] },
-      tagDescriptions: [
-        {
-          ResourceArn: 'arn:load-balancer1',
-          Tags: [
-            { Key: 'some', Value: 'tag' },
-          ],
-        },
-        {
-          ResourceArn: 'arn:load-balancer2',
-          Tags: [
-            { Key: 'some', Value: 'tag' },
-          ],
-        },
-      ],
-    });
-
     // WHEN
     await expect(
       provider.getValue({
         account: '1234',
         region: 'us-east-1',
-        loadBalancerType: cxschema.LoadBalancerType.APPLICATION,
-        loadBalancerTags: [
-          { key: 'some', value: 'tag' },
-        ],
+        loadBalancerType: LoadBalancerType.APPLICATION,
+        loadBalancerTags: [{ key: 'some', value: 'tag' }],
       }),
-    ).rejects.toThrow(/Multiple load balancers found/i);
+    ).rejects.toThrow(
+      'Multiple load balancers found matching {"account":"1234","region":"us-east-1","loadBalancerType":"application","loadBalancerTags":[{"key":"some","value":"tag"}]} - please provide more specific criteria',
+    );
+    expect(mockElasticLoadBalancingV2Client).toHaveReceivedCommandWith(DescribeTagsCommand, {
+      ResourceArns: ['arn:load-balancer1', 'arn:load-balancer2'],
+    });
   });
 
   test('looks up by arn', async () => {
     // GIVEN
-    const provider = new LoadBalancerContextProviderPlugin(mockSDK);
-
-    mockALBLookup({
-      describeLoadBalancersExpected: { LoadBalancerArns: ['arn:load-balancer1'] },
-      loadBalancers: [
+    mockElasticLoadBalancingV2Client.on(DescribeLoadBalancersCommand).resolves({
+      LoadBalancers: [
         {
           IpAddressType: 'ipv4',
           LoadBalancerArn: 'arn:load-balancer1',
@@ -264,12 +116,13 @@ describe('load balancer context provider plugin', () => {
         },
       ],
     });
+    const provider = new LoadBalancerContextProviderPlugin(mockSDK);
 
     // WHEN
     const result = await provider.getValue({
       account: '1234',
       region: 'us-east-1',
-      loadBalancerType: cxschema.LoadBalancerType.APPLICATION,
+      loadBalancerType: LoadBalancerType.APPLICATION,
       loadBalancerArn: 'arn:load-balancer1',
     });
 
@@ -280,56 +133,60 @@ describe('load balancer context provider plugin', () => {
     expect(result.loadBalancerDnsName).toEqual('dns.example.com');
     expect(result.securityGroupIds).toEqual(['sg-1234']);
     expect(result.vpcId).toEqual('vpc-1234');
+    expect(mockElasticLoadBalancingV2Client).toHaveReceivedCommandWith(DescribeLoadBalancersCommand, {
+      LoadBalancerArns: ['arn:load-balancer1'],
+    });
   });
 
-  test('looks up by tags', async() => {
+  test('looks up by tags', async () => {
     // GIVEN
+    mockElasticLoadBalancingV2Client
+      .on(DescribeLoadBalancersCommand)
+      .resolves({
+        LoadBalancers: [
+          {
+            IpAddressType: 'ipv4',
+            LoadBalancerArn: 'arn:load-balancer1',
+            DNSName: 'dns1.example.com',
+            CanonicalHostedZoneId: 'Z1234',
+            SecurityGroups: ['sg-1234'],
+            VpcId: 'vpc-1234',
+            Type: 'application',
+          },
+          {
+            IpAddressType: 'ipv4',
+            LoadBalancerArn: 'arn:load-balancer2',
+            DNSName: 'dns2.example.com',
+            CanonicalHostedZoneId: 'Z1234',
+            SecurityGroups: ['sg-1234'],
+            VpcId: 'vpc-1234',
+            Type: 'application',
+          },
+        ],
+      })
+      .on(DescribeTagsCommand)
+      .resolves({
+        TagDescriptions: [
+          {
+            ResourceArn: 'arn:load-balancer1',
+            Tags: [{ Key: 'some', Value: 'tag' }],
+          },
+          {
+            ResourceArn: 'arn:load-balancer2',
+            Tags: [
+              { Key: 'some', Value: 'tag' },
+              { Key: 'second', Value: 'tag2' },
+            ],
+          },
+        ],
+      });
     const provider = new LoadBalancerContextProviderPlugin(mockSDK);
 
-    mockALBLookup({
-      loadBalancers: [
-        {
-          IpAddressType: 'ipv4',
-          LoadBalancerArn: 'arn:load-balancer1',
-          DNSName: 'dns1.example.com',
-          CanonicalHostedZoneId: 'Z1234',
-          SecurityGroups: ['sg-1234'],
-          VpcId: 'vpc-1234',
-          Type: 'application',
-        },
-        {
-          IpAddressType: 'ipv4',
-          LoadBalancerArn: 'arn:load-balancer2',
-          DNSName: 'dns2.example.com',
-          CanonicalHostedZoneId: 'Z1234',
-          SecurityGroups: ['sg-1234'],
-          VpcId: 'vpc-1234',
-          Type: 'application',
-        },
-      ],
-      describeTagsExpected: { ResourceArns: ['arn:load-balancer1', 'arn:load-balancer2'] },
-      tagDescriptions: [
-        {
-          ResourceArn: 'arn:load-balancer1',
-          Tags: [
-            { Key: 'some', Value: 'tag' },
-          ],
-        },
-        {
-          ResourceArn: 'arn:load-balancer2',
-          Tags: [
-            { Key: 'some', Value: 'tag' },
-            { Key: 'second', Value: 'tag2' },
-          ],
-        },
-      ],
-    });
-
     // WHEN
     const result = await provider.getValue({
       account: '1234',
       region: 'us-east-1',
-      loadBalancerType: cxschema.LoadBalancerType.APPLICATION,
+      loadBalancerType: LoadBalancerType.APPLICATION,
       loadBalancerTags: [
         { key: 'some', value: 'tag' },
         { key: 'second', value: 'tag2' },
@@ -337,52 +194,58 @@ describe('load balancer context provider plugin', () => {
     });
 
     expect(result.loadBalancerArn).toEqual('arn:load-balancer2');
+    expect(mockElasticLoadBalancingV2Client).toHaveReceivedCommandWith(DescribeTagsCommand, {
+      ResourceArns: ['arn:load-balancer1', 'arn:load-balancer2'],
+    });
   });
 
   test('filters by type', async () => {
     // GIVEN
+    mockElasticLoadBalancingV2Client
+      .on(DescribeLoadBalancersCommand)
+      .resolves({
+        LoadBalancers: [
+          {
+            IpAddressType: 'ipv4',
+            Type: 'network',
+            LoadBalancerArn: 'arn:load-balancer1',
+            DNSName: 'dns1.example.com',
+            CanonicalHostedZoneId: 'Z1234',
+            SecurityGroups: ['sg-1234'],
+            VpcId: 'vpc-1234',
+          },
+          {
+            IpAddressType: 'ipv4',
+            Type: 'application',
+            LoadBalancerArn: 'arn:load-balancer2',
+            DNSName: 'dns2.example.com',
+            CanonicalHostedZoneId: 'Z1234',
+            SecurityGroups: ['sg-1234'],
+            VpcId: 'vpc-1234',
+          },
+        ],
+      })
+      .on(DescribeTagsCommand)
+      .resolves({
+        TagDescriptions: [
+          {
+            ResourceArn: 'arn:load-balancer1',
+            Tags: [{ Key: 'some', Value: 'tag' }],
+          },
+          {
+            ResourceArn: 'arn:load-balancer2',
+            Tags: [{ Key: 'some', Value: 'tag' }],
+          },
+        ],
+      });
     const provider = new LoadBalancerContextProviderPlugin(mockSDK);
 
-    mockALBLookup({
-      loadBalancers: [
-        {
-          IpAddressType: 'ipv4',
-          Type: 'network',
-          LoadBalancerArn: 'arn:load-balancer1',
-          DNSName: 'dns1.example.com',
-          CanonicalHostedZoneId: 'Z1234',
-          SecurityGroups: ['sg-1234'],
-          VpcId: 'vpc-1234',
-        },
-        {
-          IpAddressType: 'ipv4',
-          Type: 'application',
-          LoadBalancerArn: 'arn:load-balancer2',
-          DNSName: 'dns2.example.com',
-          CanonicalHostedZoneId: 'Z1234',
-          SecurityGroups: ['sg-1234'],
-          VpcId: 'vpc-1234',
-        },
-      ],
-
-      tagDescriptions: [
-        {
-          ResourceArn: 'arn:load-balancer1',
-          Tags: [{ Key: 'some', Value: 'tag' }],
-        },
-        {
-          ResourceArn: 'arn:load-balancer2',
-          Tags: [{ Key: 'some', Value: 'tag' }],
-        },
-      ],
-    });
-
     // WHEN
     const loadBalancer = await provider.getValue({
       account: '1234',
       region: 'us-east-1',
       loadBalancerTags: [{ key: 'some', value: 'tag' }],
-      loadBalancerType: cxschema.LoadBalancerType.APPLICATION,
+      loadBalancerType: LoadBalancerType.APPLICATION,
     });
 
     expect(loadBalancer.loadBalancerArn).toEqual('arn:load-balancer2');
@@ -394,137 +257,152 @@ describe('load balancer listener context provider plugin', () => {
     // GIVEN
     const provider = new LoadBalancerListenerContextProviderPlugin(mockSDK);
 
-    mockALBLookup({
-      loadBalancers: [],
-    });
-
     // WHEN
     await expect(
       provider.getValue({
         account: '1234',
         region: 'us-east-1',
-        loadBalancerType: cxschema.LoadBalancerType.APPLICATION,
+        loadBalancerType: LoadBalancerType.APPLICATION,
         loadBalancerTags: [{ key: 'some', value: 'tag' }],
       }),
-    ).rejects.toThrow(/No associated load balancers found/i);
+    ).rejects.toThrow(
+      'No associated load balancers found for load balancer listener query {"account":"1234","region":"us-east-1","loadBalancerType":"application","loadBalancerTags":[{"key":"some","value":"tag"}]}',
+    );
   });
 
   test('errors when no listeners match', async () => {
     // GIVEN
+    mockElasticLoadBalancingV2Client
+      .on(DescribeLoadBalancersCommand)
+      .resolves({
+        LoadBalancers: [
+          {
+            LoadBalancerArn: 'arn:load-balancer',
+            Type: 'application',
+          },
+        ],
+      })
+      .on(DescribeListenersCommand)
+      .resolves({
+        Listeners: [
+          {
+            LoadBalancerArn: 'arn:load-balancer',
+            ListenerArn: 'arn:listener',
+            Port: 80,
+            Protocol: 'HTTP',
+          },
+        ],
+      });
     const provider = new LoadBalancerListenerContextProviderPlugin(mockSDK);
 
-    mockALBLookup({
-      loadBalancers: [
-        {
-          LoadBalancerArn: 'arn:load-balancer',
-          Type: 'application',
-        },
-      ],
-      listeners: [
-        {
-          LoadBalancerArn: 'arn:load-balancer',
-          ListenerArn: 'arn:listener',
-          Port: 80,
-          Protocol: 'HTTP',
-        },
-      ],
-    });
-
     // WHEN
     await expect(
       provider.getValue({
         account: '1234',
         region: 'us-east-1',
-        loadBalancerType: cxschema.LoadBalancerType.APPLICATION,
+        loadBalancerType: LoadBalancerType.APPLICATION,
         loadBalancerArn: 'arn:load-balancer',
         listenerPort: 443,
-        listenerProtocol: cxschema.LoadBalancerListenerProtocol.HTTPS,
+        listenerProtocol: LoadBalancerListenerProtocol.HTTPS,
       }),
-    ).rejects.toThrow(/No load balancer listeners found/i);
+    ).rejects.toThrow(
+      'No load balancer listeners found matching {"account":"1234","region":"us-east-1","loadBalancerType":"application","loadBalancerArn":"arn:load-balancer","listenerPort":443,"listenerProtocol":"HTTPS"}',
+    );
   });
 
   test('errors when multiple listeners match', async () => {
     // GIVEN
+    mockElasticLoadBalancingV2Client
+      .on(DescribeLoadBalancersCommand)
+      .resolves({
+        LoadBalancers: [
+          {
+            LoadBalancerArn: 'arn:load-balancer',
+            Type: 'application',
+          },
+          {
+            LoadBalancerArn: 'arn:load-balancer2',
+            Type: 'application',
+          },
+        ],
+      })
+      .on(DescribeTagsCommand)
+      .resolves({
+        TagDescriptions: [
+          {
+            ResourceArn: 'arn:load-balancer',
+            Tags: [{ Key: 'some', Value: 'tag' }],
+          },
+          {
+            ResourceArn: 'arn:load-balancer2',
+            Tags: [{ Key: 'some', Value: 'tag' }],
+          },
+        ],
+      })
+      .on(DescribeListenersCommand)
+      .resolves({
+        Listeners: [
+          {
+            LoadBalancerArn: 'arn:load-balancer',
+            ListenerArn: 'arn:listener',
+            Port: 80,
+            Protocol: 'HTTP',
+          },
+          {
+            LoadBalancerArn: 'arn:load-balancer2',
+            ListenerArn: 'arn:listener2',
+            Port: 80,
+            Protocol: 'HTTP',
+          },
+        ],
+      });
     const provider = new LoadBalancerListenerContextProviderPlugin(mockSDK);
 
-    mockALBLookup({
-      loadBalancers: [
-        {
-          LoadBalancerArn: 'arn:load-balancer',
-          Type: 'application',
-        },
-        {
-          LoadBalancerArn: 'arn:load-balancer2',
-          Type: 'application',
-        },
-      ],
-      tagDescriptions: [
-        {
-          ResourceArn: 'arn:load-balancer',
-          Tags: [{ Key: 'some', Value: 'tag' }],
-        },
-        {
-          ResourceArn: 'arn:load-balancer2',
-          Tags: [{ Key: 'some', Value: 'tag' }],
-        },
-      ],
-      listeners: [
-        {
-          LoadBalancerArn: 'arn:load-balancer',
-          ListenerArn: 'arn:listener',
-          Port: 80,
-          Protocol: 'HTTP',
-        },
-        {
-          LoadBalancerArn: 'arn:load-balancer2',
-          ListenerArn: 'arn:listener2',
-          Port: 80,
-          Protocol: 'HTTP',
-        },
-      ],
-    });
-
     // WHEN
     await expect(
       provider.getValue({
         account: '1234',
         region: 'us-east-1',
-        loadBalancerType: cxschema.LoadBalancerType.APPLICATION,
+        loadBalancerType: LoadBalancerType.APPLICATION,
         loadBalancerTags: [{ key: 'some', value: 'tag' }],
         listenerPort: 80,
-        listenerProtocol: cxschema.LoadBalancerListenerProtocol.HTTP,
+        listenerProtocol: LoadBalancerListenerProtocol.HTTP,
       }),
-    ).rejects.toThrow(/Multiple load balancer listeners/i);
+    ).rejects.toThrow(
+      'Multiple load balancer listeners found matching {"account":"1234","region":"us-east-1","loadBalancerType":"application","loadBalancerTags":[{"key":"some","value":"tag"}],"listenerPort":80,"listenerProtocol":"HTTP"} - please provide more specific criteria',
+    );
   });
 
   test('looks up by listener arn', async () => {
     // GIVEN
+    mockElasticLoadBalancingV2Client
+      .on(DescribeLoadBalancersCommand)
+      .resolves({
+        LoadBalancers: [
+          {
+            LoadBalancerArn: 'arn:load-balancer-arn',
+            SecurityGroups: ['sg-1234', 'sg-2345'],
+            Type: 'application',
+          },
+        ],
+      })
+      .on(DescribeListenersCommand)
+      .resolves({
+        Listeners: [
+          {
+            ListenerArn: 'arn:listener-arn',
+            LoadBalancerArn: 'arn:load-balancer-arn',
+            Port: 999,
+          },
+        ],
+      });
     const provider = new LoadBalancerListenerContextProviderPlugin(mockSDK);
 
-    mockALBLookup({
-      describeListenersExpected: { ListenerArns: ['arn:listener-arn'] },
-      listeners: [
-        {
-          ListenerArn: 'arn:listener-arn',
-          LoadBalancerArn: 'arn:load-balancer-arn',
-          Port: 999,
-        },
-      ],
-      describeLoadBalancersExpected: { LoadBalancerArns: ['arn:load-balancer-arn'] },
-      loadBalancers: [
-        {
-          LoadBalancerArn: 'arn:load-balancer-arn',
-          SecurityGroups: ['sg-1234', 'sg-2345'],
-          Type: 'application',
-        },
-      ],
-    });
-
     // WHEN
     const listener = await provider.getValue({
       account: '1234',
       region: 'us-east-1',
-      loadBalancerType: cxschema.LoadBalancerType.APPLICATION,
+      loadBalancerType: LoadBalancerType.APPLICATION,
       listenerArn: 'arn:listener-arn',
     });
 
@@ -532,38 +410,45 @@ describe('load balancer listener context provider plugin', () => {
     expect(listener.listenerArn).toEqual('arn:listener-arn');
     expect(listener.listenerPort).toEqual(999);
     expect(listener.securityGroupIds).toEqual(['sg-1234', 'sg-2345']);
+    expect(mockElasticLoadBalancingV2Client).toHaveReceivedCommandWith(DescribeLoadBalancersCommand, {
+      LoadBalancerArns: ['arn:load-balancer-arn'],
+    });
+    expect(mockElasticLoadBalancingV2Client).toHaveReceivedCommandWith(DescribeListenersCommand, {
+      ListenerArns: ['arn:listener-arn'],
+    });
   });
 
   test('looks up by associated load balancer arn', async () => {
     // GIVEN
+    mockElasticLoadBalancingV2Client
+      .on(DescribeLoadBalancersCommand)
+      .resolves({
+        LoadBalancers: [
+          {
+            LoadBalancerArn: 'arn:load-balancer-arn1',
+            SecurityGroups: ['sg-1234'],
+            Type: 'application',
+          },
+        ],
+      })
+      .on(DescribeListenersCommand)
+      .resolves({
+        Listeners: [
+          {
+            // This one
+            ListenerArn: 'arn:listener-arn1',
+            LoadBalancerArn: 'arn:load-balancer-arn1',
+            Port: 80,
+          },
+        ],
+      });
     const provider = new LoadBalancerListenerContextProviderPlugin(mockSDK);
 
-    mockALBLookup({
-      describeLoadBalancersExpected: { LoadBalancerArns: ['arn:load-balancer-arn1'] },
-      loadBalancers: [
-        {
-          LoadBalancerArn: 'arn:load-balancer-arn1',
-          SecurityGroups: ['sg-1234'],
-          Type: 'application',
-        },
-      ],
-
-      describeListenersExpected: { LoadBalancerArn: 'arn:load-balancer-arn1' },
-      listeners: [
-        {
-          // This one
-          ListenerArn: 'arn:listener-arn1',
-          LoadBalancerArn: 'arn:load-balancer-arn1',
-          Port: 80,
-        },
-      ],
-    });
-
     // WHEN
     const listener = await provider.getValue({
       account: '1234',
       region: 'us-east-1',
-      loadBalancerType: cxschema.LoadBalancerType.APPLICATION,
+      loadBalancerType: LoadBalancerType.APPLICATION,
       loadBalancerArn: 'arn:load-balancer-arn1',
     });
 
@@ -571,68 +456,72 @@ describe('load balancer listener context provider plugin', () => {
     expect(listener.listenerArn).toEqual('arn:listener-arn1');
     expect(listener.listenerPort).toEqual(80);
     expect(listener.securityGroupIds).toEqual(['sg-1234']);
+    expect(mockElasticLoadBalancingV2Client).toHaveReceivedCommandWith(DescribeLoadBalancersCommand, {
+      LoadBalancerArns: ['arn:load-balancer-arn1'],
+    });
+    expect(mockElasticLoadBalancingV2Client).toHaveReceivedCommandWith(DescribeListenersCommand, {
+      LoadBalancerArn: 'arn:load-balancer-arn1',
+    });
   });
 
   test('looks up by associated load balancer tags', async () => {
     // GIVEN
+    mockElasticLoadBalancingV2Client
+      .on(DescribeLoadBalancersCommand)
+      .resolves({
+        LoadBalancers: [
+          {
+            // This one should have the wrong tags
+            LoadBalancerArn: 'arn:load-balancer-arn1',
+            SecurityGroups: ['sg-1234', 'sg-2345'],
+            Type: 'application',
+          },
+          {
+            // Expecting this one
+            LoadBalancerArn: 'arn:load-balancer-arn2',
+            SecurityGroups: ['sg-3456', 'sg-4567'],
+            Type: 'application',
+          },
+        ],
+      })
+      .on(DescribeListenersCommand)
+      .resolves({
+        Listeners: [
+          {
+            // This one
+            ListenerArn: 'arn:listener-arn1',
+            LoadBalancerArn: 'arn:load-balancer-arn2',
+            Port: 80,
+          },
+          {
+            ListenerArn: 'arn:listener-arn2',
+            LoadBalancerArn: 'arn:load-balancer-arn2',
+            Port: 999,
+          },
+        ],
+      })
+      .on(DescribeTagsCommand)
+      .resolves({
+        TagDescriptions: [
+          {
+            ResourceArn: 'arn:load-balancer-arn1',
+            Tags: [],
+          },
+          {
+            // Expecting this one
+            ResourceArn: 'arn:load-balancer-arn2',
+            Tags: [{ Key: 'some', Value: 'tag' }],
+          },
+        ],
+      });
     const provider = new LoadBalancerListenerContextProviderPlugin(mockSDK);
 
-    mockALBLookup({
-      describeLoadBalancersExpected: { LoadBalancerArns: undefined },
-      loadBalancers: [
-        {
-          // This one should have the wrong tags
-          LoadBalancerArn: 'arn:load-balancer-arn1',
-          SecurityGroups: ['sg-1234', 'sg-2345'],
-          Type: 'application',
-        },
-        {
-          // Expecting this one
-          LoadBalancerArn: 'arn:load-balancer-arn2',
-          SecurityGroups: ['sg-3456', 'sg-4567'],
-          Type: 'application',
-        },
-      ],
-
-      describeTagsExpected: { ResourceArns: ['arn:load-balancer-arn1', 'arn:load-balancer-arn2'] },
-      tagDescriptions: [
-        {
-          ResourceArn: 'arn:load-balancer-arn1',
-          Tags: [],
-        },
-        {
-          // Expecting this one
-          ResourceArn: 'arn:load-balancer-arn2',
-          Tags: [
-            { Key: 'some', Value: 'tag' },
-          ],
-        },
-      ],
-
-      describeListenersExpected: { LoadBalancerArn: 'arn:load-balancer-arn2' },
-      listeners: [
-        {
-          // This one
-          ListenerArn: 'arn:listener-arn1',
-          LoadBalancerArn: 'arn:load-balancer-arn2',
-          Port: 80,
-        },
-        {
-          ListenerArn: 'arn:listener-arn2',
-          LoadBalancerArn: 'arn:load-balancer-arn2',
-          Port: 999,
-        },
-      ],
-    });
-
     // WHEN
     const listener = await provider.getValue({
       account: '1234',
       region: 'us-east-1',
-      loadBalancerType: cxschema.LoadBalancerType.APPLICATION,
-      loadBalancerTags: [
-        { key: 'some', value: 'tag' },
-      ],
+      loadBalancerType: LoadBalancerType.APPLICATION,
+      loadBalancerTags: [{ key: 'some', value: 'tag' }],
       listenerPort: 999,
     });
 
@@ -640,15 +529,22 @@ describe('load balancer listener context provider plugin', () => {
     expect(listener.listenerArn).toEqual('arn:listener-arn2');
     expect(listener.listenerPort).toEqual(999);
     expect(listener.securityGroupIds).toEqual(['sg-3456', 'sg-4567']);
+    expect(mockElasticLoadBalancingV2Client).toHaveReceivedCommandWith(DescribeLoadBalancersCommand, {
+      LoadBalancerArns: undefined,
+    });
+    expect(mockElasticLoadBalancingV2Client).toHaveReceivedCommandWith(DescribeListenersCommand, {
+      LoadBalancerArn: 'arn:load-balancer-arn2',
+    });
+    expect(mockElasticLoadBalancingV2Client).toHaveReceivedCommandWith(DescribeTagsCommand, {
+      ResourceArns: ['arn:load-balancer-arn1', 'arn:load-balancer-arn2'],
+    });
   });
 
-  test('looks up by listener port and proto', async () => {
+  test('looks up by listener port and protocol', async () => {
     // GIVEN
-    const provider = new LoadBalancerListenerContextProviderPlugin(mockSDK);
-
-    AWS.mock('ELBv2', 'describeLoadBalancers', (_params: aws.ELBv2.DescribeLoadBalancersInput, cb: AwsCallback<aws.ELBv2.DescribeLoadBalancersOutput>) => {
-      expect(_params).toEqual({});
-      cb(null, {
+    mockElasticLoadBalancingV2Client
+      .on(DescribeLoadBalancersCommand)
+      .resolves({
         LoadBalancers: [
           {
             // Shouldn't have any matching listeners
@@ -671,11 +567,9 @@ describe('load balancer listener context provider plugin', () => {
             Type: 'application',
           },
         ],
-      });
-    });
-
-    AWS.mock('ELBv2', 'describeTags', (_params: aws.ELBv2.DescribeTagsInput, cb: AwsCallback<aws.ELBv2.DescribeTagsOutput>) => {
-      cb(null, {
+      })
+      .on(DescribeTagsCommand)
+      .resolves({
         TagDescriptions: [
           {
             ResourceArn: 'arn:load-balancer1',
@@ -686,67 +580,72 @@ describe('load balancer listener context provider plugin', () => {
             Tags: [{ Key: 'some', Value: 'tag' }],
           },
         ],
-      });
-    });
-
-    AWS.mock('ELBv2', 'describeListeners', (params: aws.ELBv2.DescribeListenersInput, cb: AwsCallback<aws.ELBv2.DescribeListenersOutput>) => {
-      if (params.LoadBalancerArn === 'arn:load-balancer1') {
-        cb(null, {
-          Listeners: [
-            {
+      })
+      .on(DescribeListenersCommand)
+      .resolvesOnce({
+        Listeners: [
+          {
             // Wrong port, wrong protocol => no match
-              ListenerArn: 'arn:listener-arn1',
-              LoadBalancerArn: 'arn:load-balancer1',
-              Protocol: 'HTTP',
-              Port: 80,
-            },
-            {
+            ListenerArn: 'arn:listener-arn1',
+            LoadBalancerArn: 'arn:load-balancer1',
+            Protocol: 'HTTP',
+            Port: 80,
+          },
+          {
             // Wrong protocol, right port => no match
-              ListenerArn: 'arn:listener-arn3',
-              LoadBalancerArn: 'arn:load-balancer1',
-              Protocol: 'HTTPS',
-              Port: 443,
-            },
-            {
+            ListenerArn: 'arn:listener-arn3',
+            LoadBalancerArn: 'arn:load-balancer1',
+            Protocol: 'HTTPS',
+            Port: 443,
+          },
+          {
             // Wrong port, right protocol => no match
-              ListenerArn: 'arn:listener-arn4',
-              LoadBalancerArn: 'arn:load-balancer1',
-              Protocol: 'TCP',
-              Port: 999,
-            },
-          ],
-        });
-      } else if (params.LoadBalancerArn === 'arn:load-balancer2') {
-        cb(null, {
-          Listeners: [
-            {
+            ListenerArn: 'arn:listener-arn4',
+            LoadBalancerArn: 'arn:load-balancer1',
+            Protocol: 'TCP',
+            Port: 999,
+          },
+        ],
+      })
+      .resolvesOnce({
+        Listeners: [
+          {
             // Wrong port, wrong protocol => no match
-              ListenerArn: 'arn:listener-arn5',
-              LoadBalancerArn: 'arn:load-balancer2',
-              Protocol: 'HTTP',
-              Port: 80,
-            },
-            {
+            ListenerArn: 'arn:listener-arn5',
+            LoadBalancerArn: 'arn:load-balancer2',
+            Protocol: 'HTTP',
+            Port: 80,
+          },
+          {
             // Right port, right protocol => match
-              ListenerArn: 'arn:listener-arn6',
-              LoadBalancerArn: 'arn:load-balancer2',
-              Port: 443,
-              Protocol: 'TCP',
-            },
-          ],
-        });
-      } else {
-        cb(new Error(`Unexpected request: ${JSON.stringify(params)}'`), {});
-      }
+            ListenerArn: 'arn:listener-arn6',
+            LoadBalancerArn: 'arn:load-balancer2',
+            Port: 443,
+            Protocol: 'TCP',
+          },
+        ],
+      });
+    mockElasticLoadBalancingV2Client.on(DescribeTagsCommand).resolves({
+      TagDescriptions: [
+        {
+          ResourceArn: 'arn:load-balancer1',
+          Tags: [{ Key: 'some', Value: 'tag' }],
+        },
+        {
+          ResourceArn: 'arn:load-balancer2',
+          Tags: [{ Key: 'some', Value: 'tag' }],
+        },
+      ],
     });
+    const provider = new LoadBalancerListenerContextProviderPlugin(mockSDK);
 
     // WHEN
     const listener = await provider.getValue({
       account: '1234',
       region: 'us-east-1',
-      loadBalancerType: cxschema.LoadBalancerType.APPLICATION,
+      loadBalancerType: LoadBalancerType.APPLICATION,
       loadBalancerTags: [{ key: 'some', value: 'tag' }],
-      listenerProtocol: cxschema.LoadBalancerListenerProtocol.TCP,
+      listenerProtocol: LoadBalancerListenerProtocol.TCP,
       listenerPort: 443,
     });
 
@@ -758,51 +657,54 @@ describe('load balancer listener context provider plugin', () => {
 
   test('filters by associated load balancer type', async () => {
     // GIVEN
+    mockElasticLoadBalancingV2Client
+      .on(DescribeLoadBalancersCommand)
+      .resolves({
+        LoadBalancers: [
+          {
+            // This one has wrong type => no match
+            LoadBalancerArn: 'arn:load-balancer-arn1',
+            SecurityGroups: [],
+            Type: 'application',
+          },
+          {
+            // Right type => match
+            LoadBalancerArn: 'arn:load-balancer-arn2',
+            SecurityGroups: [],
+            Type: 'network',
+          },
+        ],
+      })
+      .on(DescribeListenersCommand)
+      .resolves({
+        Listeners: [
+          {
+            ListenerArn: 'arn:listener-arn2',
+            LoadBalancerArn: 'arn:load-balancer-arn2',
+            Port: 443,
+          },
+        ],
+      })
+      .on(DescribeTagsCommand)
+      .resolves({
+        TagDescriptions: [
+          {
+            ResourceArn: 'arn:load-balancer-arn1',
+            Tags: [{ Key: 'some', Value: 'tag' }],
+          },
+          {
+            ResourceArn: 'arn:load-balancer-arn2',
+            Tags: [{ Key: 'some', Value: 'tag' }],
+          },
+        ],
+      });
     const provider = new LoadBalancerListenerContextProviderPlugin(mockSDK);
 
-    mockALBLookup({
-      describeLoadBalancersExpected: { LoadBalancerArns: undefined },
-      loadBalancers: [
-        {
-          // This one has wrong type => no match
-          LoadBalancerArn: 'arn:load-balancer-arn1',
-          SecurityGroups: [],
-          Type: 'application',
-        },
-        {
-          // Right type => match
-          LoadBalancerArn: 'arn:load-balancer-arn2',
-          SecurityGroups: [],
-          Type: 'network',
-        },
-      ],
-
-      tagDescriptions: [
-        {
-          ResourceArn: 'arn:load-balancer-arn1',
-          Tags: [{ Key: 'some', Value: 'tag' }],
-        },
-        {
-          ResourceArn: 'arn:load-balancer-arn2',
-          Tags: [{ Key: 'some', Value: 'tag' }],
-        },
-      ],
-
-      describeListenersExpected: { LoadBalancerArn: 'arn:load-balancer-arn2' },
-      listeners: [
-        {
-          ListenerArn: 'arn:listener-arn2',
-          LoadBalancerArn: 'arn:load-balancer-arn2',
-          Port: 443,
-        },
-      ],
-    });
-
     // WHEN
     const listener = await provider.getValue({
       account: '1234',
       region: 'us-east-1',
-      loadBalancerType: cxschema.LoadBalancerType.NETWORK,
+      loadBalancerType: LoadBalancerType.NETWORK,
       loadBalancerTags: [{ key: 'some', value: 'tag' }],
       listenerPort: 443,
     });
@@ -810,73 +712,54 @@ describe('load balancer listener context provider plugin', () => {
     // THEN
     expect(listener.listenerArn).toEqual('arn:listener-arn2');
     expect(listener.listenerPort).toEqual(443);
+    expect(mockElasticLoadBalancingV2Client).toHaveReceivedCommandWith(DescribeLoadBalancersCommand, {
+      LoadBalancerArns: undefined,
+    });
+    expect(mockElasticLoadBalancingV2Client).toHaveReceivedCommandWith(DescribeListenersCommand, {
+      LoadBalancerArn: 'arn:load-balancer-arn2',
+    });
   });
 
   test('errors when associated load balancer is wrong type', async () => {
     // GIVEN
+    mockElasticLoadBalancingV2Client
+      .on(DescribeLoadBalancersCommand)
+      .resolves({
+        LoadBalancers: [
+          {
+            // This one has wrong type => no match
+            LoadBalancerArn: 'arn:load-balancer-arn1',
+            SecurityGroups: [],
+            Type: 'application',
+          },
+        ],
+      })
+      .on(DescribeListenersCommand)
+      .resolves({
+        Listeners: [
+          {
+            ListenerArn: 'arn:listener-arn1',
+            LoadBalancerArn: 'arn:load-balancer-arn1',
+            Port: 443,
+          },
+        ],
+      });
     const provider = new LoadBalancerListenerContextProviderPlugin(mockSDK);
 
-    mockALBLookup({
-      describeListenersExpected: { ListenerArns: ['arn:listener-arn1'] },
-      listeners: [
-        {
-          ListenerArn: 'arn:listener-arn1',
-          LoadBalancerArn: 'arn:load-balancer-arn1',
-          Port: 443,
-        },
-      ],
-
-      describeLoadBalancersExpected: { LoadBalancerArns: ['arn:load-balancer-arn1'] },
-      loadBalancers: [
-        {
-          // This one has wrong type => no match
-          LoadBalancerArn: 'arn:load-balancer-arn1',
-          SecurityGroups: [],
-          Type: 'application',
-        },
-      ],
-    });
-
     // WHEN
     await expect(
       provider.getValue({
         account: '1234',
         region: 'us-east-1',
-        loadBalancerType: cxschema.LoadBalancerType.NETWORK,
+        loadBalancerType: LoadBalancerType.NETWORK,
         listenerArn: 'arn:listener-arn1',
       }),
-    ).rejects.toThrow(/no associated load balancer found/i);
+    ).rejects.toThrow('No associated load balancer found for listener arn arn:listener-arn1');
+    expect(mockElasticLoadBalancingV2Client).toHaveReceivedCommandWith(DescribeLoadBalancersCommand, {
+      LoadBalancerArns: ['arn:load-balancer-arn1'],
+    });
+    expect(mockElasticLoadBalancingV2Client).toHaveReceivedCommandWith(DescribeListenersCommand, {
+      ListenerArns: ['arn:listener-arn1'],
+    });
   });
 });
-
-interface ALBLookupOptions {
-  describeLoadBalancersExpected?: any;
-  loadBalancers?: aws.ELBv2.LoadBalancers;
-  describeTagsExpected?: any;
-  tagDescriptions?: aws.ELBv2.TagDescriptions;
-  describeListenersExpected?: any;
-  listeners?: aws.ELBv2.Listeners;
-}
-
-function mockALBLookup(options: ALBLookupOptions) {
-  AWS.mock('ELBv2', 'describeLoadBalancers', (_params: aws.ELBv2.DescribeLoadBalancersInput, cb: AwsCallback<aws.ELBv2.DescribeLoadBalancersOutput>) => {
-    if (options.describeLoadBalancersExpected !== undefined) {
-      expect(_params).toEqual(options.describeLoadBalancersExpected);
-    }
-    cb(null, { LoadBalancers: options.loadBalancers });
-  });
-
-  AWS.mock('ELBv2', 'describeTags', (_params: aws.ELBv2.DescribeTagsInput, cb: AwsCallback<aws.ELBv2.DescribeTagsOutput>) => {
-    if (options.describeTagsExpected !== undefined) {
-      expect(_params).toEqual(options.describeTagsExpected);
-    }
-    cb(null, { TagDescriptions: options.tagDescriptions });
-  });
-
-  AWS.mock('ELBv2', 'describeListeners', (_params: aws.ELBv2.DescribeListenersInput, cb: AwsCallback<aws.ELBv2.DescribeListenersOutput>) => {
-    if (options.describeListenersExpected !== undefined) {
-      expect(_params).toEqual(options.describeListenersExpected);
-    }
-    cb(null, { Listeners: options.listeners });
-  });
-}
diff --git a/packages/aws-cdk/test/context-providers/security-groups.test.ts b/packages/aws-cdk/test/context-providers/security-groups.test.ts
index c7bdc586ad7bc..6f2882a2f4031 100644
--- a/packages/aws-cdk/test/context-providers/security-groups.test.ts
+++ b/packages/aws-cdk/test/context-providers/security-groups.test.ts
@@ -1,29 +1,41 @@
-/* eslint-disable import/order */
-import * as aws from 'aws-sdk';
-import * as AWS from 'aws-sdk-mock';
+import { DescribeSecurityGroupsCommand } from '@aws-sdk/client-ec2';
+import { SDK, type SdkForEnvironment } from '../../lib';
 import { hasAllTrafficEgress, SecurityGroupContextProviderPlugin } from '../../lib/context-providers/security-groups';
-import { MockSdkProvider } from '../util/mock-sdk';
-
-AWS.setSDK(require.resolve('aws-sdk'));
-
-const mockSDK = new MockSdkProvider();
-
-type AwsCallback<T> = (err: Error | null, val: T) => void;
-
-afterEach(done => {
-  AWS.restore();
-  done();
+import { FAKE_CREDENTIALS, MockSdkProvider, mockEC2Client, restoreSdkMocksToDefault } from '../util/mock-sdk';
+
+const mockSDK = new (class extends MockSdkProvider {
+  public forEnvironment(): Promise<SdkForEnvironment> {
+    return Promise.resolve({ sdk: new SDK(FAKE_CREDENTIALS, mockSDK.defaultRegion, {}), didAssumeRole: false });
+  }
+})();
+
+beforeEach(() => {
+  restoreSdkMocksToDefault();
+  mockEC2Client.on(DescribeSecurityGroupsCommand).resolves({
+    SecurityGroups: [
+      {
+        GroupId: 'sg-1234',
+        IpPermissionsEgress: [
+          {
+            IpProtocol: '-1',
+            IpRanges: [{ CidrIp: '0.0.0.0/0' }],
+          },
+          {
+            IpProtocol: '-1',
+            Ipv6Ranges: [{ CidrIpv6: '::/0' }],
+          },
+        ],
+      },
+    ],
+  });
 });
 
 describe('security group context provider plugin', () => {
   test('errors when no matches are found', async () => {
     // GIVEN
+    restoreSdkMocksToDefault();
     const provider = new SecurityGroupContextProviderPlugin(mockSDK);
 
-    AWS.mock('EC2', 'describeSecurityGroups', (_params: aws.EC2.DescribeSecurityGroupsRequest, cb: AwsCallback<aws.EC2.DescribeSecurityGroupsResult>) => {
-      cb(null, { SecurityGroups: [] });
-    });
-
     // WHEN
     await expect(
       provider.getValue({
@@ -38,31 +50,6 @@ describe('security group context provider plugin', () => {
     // GIVEN
     const provider = new SecurityGroupContextProviderPlugin(mockSDK);
 
-    AWS.mock('EC2', 'describeSecurityGroups', (_params: aws.EC2.DescribeSecurityGroupsRequest, cb: AwsCallback<aws.EC2.DescribeSecurityGroupsResult>) => {
-      expect(_params).toEqual({ GroupIds: ['sg-1234'] });
-      cb(null, {
-        SecurityGroups: [
-          {
-            GroupId: 'sg-1234',
-            IpPermissionsEgress: [
-              {
-                IpProtocol: '-1',
-                IpRanges: [
-                  { CidrIp: '0.0.0.0/0' },
-                ],
-              },
-              {
-                IpProtocol: '-1',
-                Ipv6Ranges: [
-                  { CidrIpv6: '::/0' },
-                ],
-              },
-            ],
-          },
-        ],
-      });
-    });
-
     // WHEN
     const res = await provider.getValue({
       account: '1234',
@@ -73,45 +60,15 @@ describe('security group context provider plugin', () => {
     // THEN
     expect(res.securityGroupId).toEqual('sg-1234');
     expect(res.allowAllOutbound).toEqual(true);
+    expect(mockEC2Client).toHaveReceivedCommandWith(DescribeSecurityGroupsCommand, {
+      GroupIds: ['sg-1234'],
+    });
   });
 
   test('looks up by security group id and vpc id', async () => {
     // GIVEN
     const provider = new SecurityGroupContextProviderPlugin(mockSDK);
 
-    AWS.mock('EC2', 'describeSecurityGroups', (_params: aws.EC2.DescribeSecurityGroupsRequest, cb: AwsCallback<aws.EC2.DescribeSecurityGroupsResult>) => {
-      expect(_params).toEqual({
-        GroupIds: ['sg-1234'],
-        Filters: [
-          {
-            Name: 'vpc-id',
-            Values: ['vpc-1234567'],
-          },
-        ],
-      });
-      cb(null, {
-        SecurityGroups: [
-          {
-            GroupId: 'sg-1234',
-            IpPermissionsEgress: [
-              {
-                IpProtocol: '-1',
-                IpRanges: [
-                  { CidrIp: '0.0.0.0/0' },
-                ],
-              },
-              {
-                IpProtocol: '-1',
-                Ipv6Ranges: [
-                  { CidrIpv6: '::/0' },
-                ],
-              },
-            ],
-          },
-        ],
-      });
-    });
-
     // WHEN
     const res = await provider.getValue({
       account: '1234',
@@ -123,44 +80,21 @@ describe('security group context provider plugin', () => {
     // THEN
     expect(res.securityGroupId).toEqual('sg-1234');
     expect(res.allowAllOutbound).toEqual(true);
+    expect(mockEC2Client).toHaveReceivedCommandWith(DescribeSecurityGroupsCommand, {
+      GroupIds: ['sg-1234'],
+      Filters: [
+        {
+          Name: 'vpc-id',
+          Values: ['vpc-1234567'],
+        },
+      ],
+    });
   });
 
   test('looks up by security group name', async () => {
     // GIVEN
     const provider = new SecurityGroupContextProviderPlugin(mockSDK);
 
-    AWS.mock('EC2', 'describeSecurityGroups', (_params: aws.EC2.DescribeSecurityGroupsRequest, cb: AwsCallback<aws.EC2.DescribeSecurityGroupsResult>) => {
-      expect(_params).toEqual({
-        Filters: [
-          {
-            Name: 'group-name',
-            Values: ['my-security-group'],
-          },
-        ],
-      });
-      cb(null, {
-        SecurityGroups: [
-          {
-            GroupId: 'sg-1234',
-            IpPermissionsEgress: [
-              {
-                IpProtocol: '-1',
-                IpRanges: [
-                  { CidrIp: '0.0.0.0/0' },
-                ],
-              },
-              {
-                IpProtocol: '-1',
-                Ipv6Ranges: [
-                  { CidrIpv6: '::/0' },
-                ],
-              },
-            ],
-          },
-        ],
-      });
-    });
-
     // WHEN
     const res = await provider.getValue({
       account: '1234',
@@ -171,48 +105,20 @@ describe('security group context provider plugin', () => {
     // THEN
     expect(res.securityGroupId).toEqual('sg-1234');
     expect(res.allowAllOutbound).toEqual(true);
+    expect(mockEC2Client).toHaveReceivedCommandWith(DescribeSecurityGroupsCommand, {
+      Filters: [
+        {
+          Name: 'group-name',
+          Values: ['my-security-group'],
+        },
+      ],
+    });
   });
 
   test('looks up by security group name and vpc id', async () => {
     // GIVEN
     const provider = new SecurityGroupContextProviderPlugin(mockSDK);
 
-    AWS.mock('EC2', 'describeSecurityGroups', (_params: aws.EC2.DescribeSecurityGroupsRequest, cb: AwsCallback<aws.EC2.DescribeSecurityGroupsResult>) => {
-      expect(_params).toEqual({
-        Filters: [
-          {
-            Name: 'vpc-id',
-            Values: ['vpc-1234567'],
-          },
-          {
-            Name: 'group-name',
-            Values: ['my-security-group'],
-          },
-        ],
-      });
-      cb(null, {
-        SecurityGroups: [
-          {
-            GroupId: 'sg-1234',
-            IpPermissionsEgress: [
-              {
-                IpProtocol: '-1',
-                IpRanges: [
-                  { CidrIp: '0.0.0.0/0' },
-                ],
-              },
-              {
-                IpProtocol: '-1',
-                Ipv6Ranges: [
-                  { CidrIpv6: '::/0' },
-                ],
-              },
-            ],
-          },
-        ],
-      });
-    });
-
     // WHEN
     const res = await provider.getValue({
       account: '1234',
@@ -224,30 +130,36 @@ describe('security group context provider plugin', () => {
     // THEN
     expect(res.securityGroupId).toEqual('sg-1234');
     expect(res.allowAllOutbound).toEqual(true);
+    expect(mockEC2Client).toHaveReceivedCommandWith(DescribeSecurityGroupsCommand, {
+      Filters: [
+        {
+          Name: 'vpc-id',
+          Values: ['vpc-1234567'],
+        },
+        {
+          Name: 'group-name',
+          Values: ['my-security-group'],
+        },
+      ],
+    });
   });
 
   test('detects non all-outbound egress', async () => {
     // GIVEN
-    const provider = new SecurityGroupContextProviderPlugin(mockSDK);
-
-    AWS.mock('EC2', 'describeSecurityGroups', (_params: aws.EC2.DescribeSecurityGroupsRequest, cb: AwsCallback<aws.EC2.DescribeSecurityGroupsResult>) => {
-      expect(_params).toEqual({ GroupIds: ['sg-1234'] });
-      cb(null, {
-        SecurityGroups: [
-          {
-            GroupId: 'sg-1234',
-            IpPermissionsEgress: [
-              {
-                IpProtocol: '-1',
-                IpRanges: [
-                  { CidrIp: '10.0.0.0/16' },
-                ],
-              },
-            ],
-          },
-        ],
-      });
+    mockEC2Client.on(DescribeSecurityGroupsCommand).resolves({
+      SecurityGroups: [
+        {
+          GroupId: 'sg-1234',
+          IpPermissionsEgress: [
+            {
+              IpProtocol: '-1',
+              IpRanges: [{ CidrIp: '10.0.0.0/16' }],
+            },
+          ],
+        },
+      ],
     });
+    const provider = new SecurityGroupContextProviderPlugin(mockSDK);
 
     // WHEN
     const res = await provider.getValue({
@@ -259,41 +171,37 @@ describe('security group context provider plugin', () => {
     // THEN
     expect(res.securityGroupId).toEqual('sg-1234');
     expect(res.allowAllOutbound).toEqual(false);
+    expect(mockEC2Client).toHaveReceivedCommandWith(DescribeSecurityGroupsCommand, {
+      GroupIds: ['sg-1234'],
+    });
   });
 
   test('errors when more than one security group is found', async () => {
     // GIVEN
+    mockEC2Client.on(DescribeSecurityGroupsCommand).resolves({
+      SecurityGroups: [
+        {
+          GroupId: 'sg-1234',
+          IpPermissionsEgress: [
+            {
+              IpProtocol: '-1',
+              IpRanges: [{ CidrIp: '10.0.0.0/16' }],
+            },
+          ],
+        },
+        {
+          GroupId: 'sg-1234',
+          IpPermissionsEgress: [
+            {
+              IpProtocol: '-1',
+              IpRanges: [{ CidrIp: '10.0.0.0/16' }],
+            },
+          ],
+        },
+      ],
+    });
     const provider = new SecurityGroupContextProviderPlugin(mockSDK);
 
-    AWS.mock('EC2', 'describeSecurityGroups', (_params: aws.EC2.DescribeSecurityGroupsRequest, cb: AwsCallback<aws.EC2.DescribeSecurityGroupsResult>) => {
-      expect(_params).toEqual({ GroupIds: ['sg-1234'] });
-      cb(null, {
-        SecurityGroups: [
-          {
-            GroupId: 'sg-1234',
-            IpPermissionsEgress: [
-              {
-                IpProtocol: '-1',
-                IpRanges: [
-                  { CidrIp: '10.0.0.0/16' },
-                ],
-              },
-            ],
-          },
-          {
-            GroupId: 'sg-1234',
-            IpPermissionsEgress: [
-              {
-                IpProtocol: '-1',
-                IpRanges: [
-                  { CidrIp: '10.0.0.0/16' },
-                ],
-              },
-            ],
-          },
-        ],
-      });
-    });
     // WHEN
     await expect(
       provider.getValue({
@@ -302,6 +210,9 @@ describe('security group context provider plugin', () => {
         securityGroupId: 'sg-1234',
       }),
     ).rejects.toThrow(/\More than one security groups found matching/i);
+    expect(mockEC2Client).toHaveReceivedCommandWith(DescribeSecurityGroupsCommand, {
+      GroupIds: ['sg-1234'],
+    });
   });
 
   test('errors when securityGroupId and securityGroupName are specified both', async () => {
@@ -316,7 +227,9 @@ describe('security group context provider plugin', () => {
         securityGroupId: 'sg-1234',
         securityGroupName: 'my-security-group',
       }),
-    ).rejects.toThrow(/\'securityGroupId\' and \'securityGroupName\' can not be specified both when looking up a security group/i);
+    ).rejects.toThrow(
+      /\'securityGroupId\' and \'securityGroupName\' can not be specified both when looking up a security group/i,
+    );
   });
 
   test('errors when neither securityGroupId nor securityGroupName are specified', async () => {
@@ -338,15 +251,11 @@ describe('security group context provider plugin', () => {
         IpPermissionsEgress: [
           {
             IpProtocol: '-1',
-            IpRanges: [
-              { CidrIp: '0.0.0.0/0' },
-            ],
+            IpRanges: [{ CidrIp: '0.0.0.0/0' }],
           },
           {
             IpProtocol: '-1',
-            Ipv6Ranges: [
-              { CidrIpv6: '::/0' },
-            ],
+            Ipv6Ranges: [{ CidrIpv6: '::/0' }],
           },
         ],
       }),
@@ -359,12 +268,8 @@ describe('security group context provider plugin', () => {
         IpPermissionsEgress: [
           {
             IpProtocol: '-1',
-            IpRanges: [
-              { CidrIp: '0.0.0.0/0' },
-            ],
-            Ipv6Ranges: [
-              { CidrIpv6: '::/0' },
-            ],
+            IpRanges: [{ CidrIp: '0.0.0.0/0' }],
+            Ipv6Ranges: [{ CidrIpv6: '::/0' }],
           },
         ],
       }),
@@ -377,9 +282,7 @@ describe('security group context provider plugin', () => {
         IpPermissionsEgress: [
           {
             IpProtocol: '-1',
-            IpRanges: [
-              { CidrIp: '10.0.0.0/16' },
-            ],
+            IpRanges: [{ CidrIp: '10.0.0.0/16' }],
           },
         ],
       }),
@@ -390,9 +293,7 @@ describe('security group context provider plugin', () => {
         IpPermissions: [
           {
             IpProtocol: 'TCP',
-            IpRanges: [
-              { CidrIp: '0.0.0.0/0' },
-            ],
+            IpRanges: [{ CidrIp: '0.0.0.0/0' }],
           },
         ],
       }),
diff --git a/packages/aws-cdk/test/context-providers/vpcs.test.ts b/packages/aws-cdk/test/context-providers/vpcs.test.ts
index d9472126baaa1..84ddf88a0c5a0 100644
--- a/packages/aws-cdk/test/context-providers/vpcs.test.ts
+++ b/packages/aws-cdk/test/context-providers/vpcs.test.ts
@@ -1,18 +1,73 @@
-/* eslint-disable import/order */
-import * as aws from 'aws-sdk';
-import * as AWS from 'aws-sdk-mock';
+import {
+  DescribeRouteTablesCommand,
+  DescribeSubnetsCommand,
+  DescribeVpcsCommand,
+  DescribeVpnGatewaysCommand,
+} from '@aws-sdk/client-ec2';
 import { VpcNetworkContextProviderPlugin } from '../../lib/context-providers/vpcs';
-import { MockSdkProvider } from '../util/mock-sdk';
-
-AWS.setSDK(require.resolve('aws-sdk'));
+import { MockSdkProvider, mockEC2Client, restoreSdkMocksToDefault } from '../util/mock-sdk';
 
 const mockSDK = new MockSdkProvider();
 
-type AwsCallback<T> = (err: Error | null, val: T) => void;
-
-afterEach(done => {
-  AWS.restore();
-  done();
+beforeEach(() => {
+  restoreSdkMocksToDefault();
+  mockEC2Client
+    .on(DescribeVpcsCommand)
+    .resolves({
+      Vpcs: [{ VpcId: 'vpc-1234567', CidrBlock: '1.1.1.1/16', OwnerId: '123456789012' }],
+    })
+    .on(DescribeSubnetsCommand)
+    .resolves({
+      Subnets: [
+        { SubnetId: 'sub-123456', AvailabilityZone: 'bermuda-triangle-1337', MapPublicIpOnLaunch: true },
+        { SubnetId: 'sub-789012', AvailabilityZone: 'bermuda-triangle-1337', MapPublicIpOnLaunch: false },
+      ],
+    })
+    .on(DescribeRouteTablesCommand)
+    .resolves({
+      RouteTables: [
+        {
+          Associations: [{ SubnetId: 'sub-123456' }],
+          RouteTableId: 'rtb-123456',
+          Routes: [
+            {
+              DestinationCidrBlock: '1.1.1.1/24',
+              GatewayId: 'local',
+              Origin: 'CreateRouteTable',
+              State: 'active',
+            },
+            {
+              DestinationCidrBlock: '0.0.0.0/0',
+              GatewayId: 'igw-xxxxxx',
+              Origin: 'CreateRoute',
+              State: 'active',
+            },
+          ],
+        },
+        {
+          Associations: [{ SubnetId: 'sub-789012' }],
+          RouteTableId: 'rtb-789012',
+          Routes: [
+            {
+              DestinationCidrBlock: '1.1.2.1/24',
+              GatewayId: 'local',
+              Origin: 'CreateRouteTable',
+              State: 'active',
+            },
+            {
+              DestinationCidrBlock: '0.0.0.0/0',
+              NatGatewayId: 'nat-xxxxxx',
+              Origin: 'CreateRoute',
+              State: 'active',
+            },
+          ],
+        },
+      ],
+    })
+    .on(DescribeVpnGatewaysCommand)
+    .resolves({
+      VpnGateways: [{ VpnGatewayId: 'gw-abcdef' }],
+    });
 });
 
 test('looks up the requested VPC', async () => {
@@ -20,56 +75,9 @@ test('looks up the requested VPC', async () => {
   const filter = { foo: 'bar' };
   const provider = new VpcNetworkContextProviderPlugin(mockSDK);
 
-  mockVpcLookup({
-    subnets: [
-      { SubnetId: 'sub-123456', AvailabilityZone: 'bermuda-triangle-1337', MapPublicIpOnLaunch: true },
-      { SubnetId: 'sub-789012', AvailabilityZone: 'bermuda-triangle-1337', MapPublicIpOnLaunch: false },
-    ],
-    routeTables: [
-      {
-        Associations: [{ SubnetId: 'sub-123456' }],
-        RouteTableId: 'rtb-123456',
-        Routes: [
-          {
-            DestinationCidrBlock: '1.1.1.1/24',
-            GatewayId: 'local',
-            Origin: 'CreateRouteTable',
-            State: 'active',
-          },
-          {
-            DestinationCidrBlock: '0.0.0.0/0',
-            GatewayId: 'igw-xxxxxx',
-            Origin: 'CreateRoute',
-            State: 'active',
-          },
-        ],
-      },
-      {
-        Associations: [{ SubnetId: 'sub-789012' }],
-        RouteTableId: 'rtb-789012',
-        Routes: [
-          {
-            DestinationCidrBlock: '1.1.2.1/24',
-            GatewayId: 'local',
-            Origin: 'CreateRouteTable',
-            State: 'active',
-          },
-          {
-            DestinationCidrBlock: '0.0.0.0/0',
-            NatGatewayId: 'nat-xxxxxx',
-            Origin: 'CreateRoute',
-            State: 'active',
-          },
-        ],
-      },
-    ],
-    vpnGateways: [{ VpnGatewayId: 'gw-abcdef' }],
-
-  });
-
   // WHEN
   const result = await provider.getValue({
-    account: '1234',
+    account: '123456789012',
     region: 'us-east-1',
     filter,
   });
@@ -80,9 +88,6 @@ test('looks up the requested VPC', async () => {
     vpcCidrBlock: '1.1.1.1/16',
     ownerAccountId: '123456789012',
     availabilityZones: ['bermuda-triangle-1337'],
-    isolatedSubnetIds: undefined,
-    isolatedSubnetNames: undefined,
-    isolatedSubnetRouteTableIds: undefined,
     privateSubnetIds: ['sub-789012'],
     privateSubnetNames: ['Private'],
     privateSubnetRouteTableIds: ['rtb-789012'],
@@ -90,7 +95,22 @@ test('looks up the requested VPC', async () => {
     publicSubnetNames: ['Public'],
     publicSubnetRouteTableIds: ['rtb-123456'],
     vpnGatewayId: 'gw-abcdef',
-    subnetGroups: undefined,
+  });
+  expect(mockEC2Client).toHaveReceivedCommandWith(DescribeVpcsCommand, {
+    Filters: [{ Name: 'foo', Values: ['bar'] }],
+  });
+  expect(mockEC2Client).toHaveReceivedCommandWith(DescribeSubnetsCommand, {
+    Filters: [{ Name: 'vpc-id', Values: ['vpc-1234567'] }],
+  });
+  expect(mockEC2Client).toHaveReceivedCommandWith(DescribeRouteTablesCommand, {
+    Filters: [{ Name: 'vpc-id', Values: ['vpc-1234567'] }],
+  });
+  expect(mockEC2Client).toHaveReceivedCommandWith(DescribeVpnGatewaysCommand, {
+    Filters: [
+      { Name: 'attachment.vpc-id', Values: ['vpc-1234567'] },
+      { Name: 'attachment.state', Values: ['attached'] },
+      { Name: 'state', Values: ['available'] },
+    ],
   });
 });
 
@@ -98,18 +118,19 @@ test('throws when no such VPC is found', async () => {
   // GIVEN
   const filter = { foo: 'bar' };
   const provider = new VpcNetworkContextProviderPlugin(mockSDK);
-
-  AWS.mock('EC2', 'describeVpcs', (params: aws.EC2.DescribeVpcsRequest, cb: AwsCallback<aws.EC2.DescribeVpcsResult>) => {
-    expect(params.Filters).toEqual([{ Name: 'foo', Values: ['bar'] }]);
-    return cb(null, {});
-  });
+  mockEC2Client.on(DescribeVpcsCommand).resolves({});
 
   // WHEN
-  await expect(provider.getValue({
-    account: '1234',
-    region: 'us-east-1',
-    filter,
-  })).rejects.toThrow(/Could not find any VPCs matching/);
+  await expect(
+    provider.getValue({
+      account: '123456789012',
+      region: 'us-east-1',
+      filter,
+    }),
+  ).rejects.toThrow(/Could not find any VPCs matching/);
+  expect(mockEC2Client).toHaveReceivedCommandWith(DescribeVpcsCommand, {
+    Filters: [{ Name: 'foo', Values: ['bar'] }],
+  });
 });
 
 test('throws when subnet with subnetGroupNameTag not found', async () => {
@@ -117,115 +138,50 @@ test('throws when subnet with subnetGroupNameTag not found', async () => {
   const filter = { foo: 'bar' };
   const provider = new VpcNetworkContextProviderPlugin(mockSDK);
 
-  mockVpcLookup({
-    subnets: [
-      { SubnetId: 'sub-123456', AvailabilityZone: 'bermuda-triangle-1337', MapPublicIpOnLaunch: true },
-      { SubnetId: 'sub-789012', AvailabilityZone: 'bermuda-triangle-1337', MapPublicIpOnLaunch: false },
-    ],
-    routeTables: [
-      {
-        Associations: [{ SubnetId: 'sub-123456' }],
-        RouteTableId: 'rtb-123456',
-        Routes: [
-          {
-            DestinationCidrBlock: '1.1.1.1/24',
-            GatewayId: 'local',
-            Origin: 'CreateRouteTable',
-            State: 'active',
-          },
-          {
-            DestinationCidrBlock: '0.0.0.0/0',
-            GatewayId: 'igw-xxxxxx',
-            Origin: 'CreateRoute',
-            State: 'active',
-          },
-        ],
-      },
-      {
-        Associations: [{ SubnetId: 'sub-789012' }],
-        RouteTableId: 'rtb-789012',
-        Routes: [
-          {
-            DestinationCidrBlock: '1.1.2.1/24',
-            GatewayId: 'local',
-            Origin: 'CreateRouteTable',
-            State: 'active',
-          },
-          {
-            DestinationCidrBlock: '0.0.0.0/0',
-            NatGatewayId: 'nat-xxxxxx',
-            Origin: 'CreateRoute',
-            State: 'active',
-          },
-        ],
-      },
-    ],
-    vpnGateways: [{ VpnGatewayId: 'gw-abcdef' }],
-  });
-
   // WHEN
-  await expect(provider.getValue({
-    account: '1234',
-    region: 'us-east-1',
-    subnetGroupNameTag: 'DOES_NOT_EXIST',
-    filter,
-  })).rejects.toThrow(/Invalid subnetGroupNameTag: Subnet .* does not have an associated tag with Key='DOES_NOT_EXIST'/);
+  await expect(
+    provider.getValue({
+      account: '123456789012',
+      region: 'us-east-1',
+      subnetGroupNameTag: 'DOES_NOT_EXIST',
+      filter,
+    }),
+  ).rejects.toThrow(/Invalid subnetGroupNameTag: Subnet .* does not have an associated tag with Key='DOES_NOT_EXIST'/);
+  expect(mockEC2Client).toHaveReceivedCommandWith(DescribeVpcsCommand, {
+    Filters: [{ Name: 'foo', Values: ['bar'] }],
+  });
+  expect(mockEC2Client).toHaveReceivedCommandWith(DescribeSubnetsCommand, {
+    Filters: [{ Name: 'vpc-id', Values: ['vpc-1234567'] }],
+  });
+  expect(mockEC2Client).toHaveReceivedCommandWith(DescribeRouteTablesCommand, {
+    Filters: [{ Name: 'vpc-id', Values: ['vpc-1234567'] }],
+  });
 });
 
 test('does not throw when subnet with subnetGroupNameTag is found', async () => {
   // GIVEN
-  const filter = { foo: 'bar' };
-  const provider = new VpcNetworkContextProviderPlugin(mockSDK);
-
-  mockVpcLookup({
-    subnets: [
-      { SubnetId: 'sub-123456', AvailabilityZone: 'bermuda-triangle-1337', MapPublicIpOnLaunch: true, Tags: [{ Key: 'DOES_EXIST', Value: 'SubnetName1' }] },
-      { SubnetId: 'sub-789012', AvailabilityZone: 'bermuda-triangle-1337', MapPublicIpOnLaunch: false, Tags: [{ Key: 'DOES_EXIST', Value: 'SubnetName2' }] },
-    ],
-    routeTables: [
+  mockEC2Client.on(DescribeSubnetsCommand).resolves({
+    Subnets: [
       {
-        Associations: [{ SubnetId: 'sub-123456' }],
-        RouteTableId: 'rtb-123456',
-        Routes: [
-          {
-            DestinationCidrBlock: '1.1.1.1/24',
-            GatewayId: 'local',
-            Origin: 'CreateRouteTable',
-            State: 'active',
-          },
-          {
-            DestinationCidrBlock: '0.0.0.0/0',
-            GatewayId: 'igw-xxxxxx',
-            Origin: 'CreateRoute',
-            State: 'active',
-          },
-        ],
+        SubnetId: 'sub-123456',
+        AvailabilityZone: 'bermuda-triangle-1337',
+        MapPublicIpOnLaunch: true,
+        Tags: [{ Key: 'DOES_EXIST', Value: 'SubnetName1' }],
       },
       {
-        Associations: [{ SubnetId: 'sub-789012' }],
-        RouteTableId: 'rtb-789012',
-        Routes: [
-          {
-            DestinationCidrBlock: '1.1.2.1/24',
-            GatewayId: 'local',
-            Origin: 'CreateRouteTable',
-            State: 'active',
-          },
-          {
-            DestinationCidrBlock: '0.0.0.0/0',
-            NatGatewayId: 'nat-xxxxxx',
-            Origin: 'CreateRoute',
-            State: 'active',
-          },
-        ],
+        SubnetId: 'sub-789012',
+        AvailabilityZone: 'bermuda-triangle-1337',
+        MapPublicIpOnLaunch: false,
+        Tags: [{ Key: 'DOES_EXIST', Value: 'SubnetName2' }],
       },
     ],
-    vpnGateways: [{ VpnGatewayId: 'gw-abcdef' }],
   });
+  const filter = { foo: 'bar' };
+  const provider = new VpcNetworkContextProviderPlugin(mockSDK);
 
   // WHEN
   const result = await provider.getValue({
-    account: '1234',
+    account: '123456789012',
     region: 'us-east-1',
     subnetGroupNameTag: 'DOES_EXIST',
     filter,
@@ -237,9 +193,6 @@ test('does not throw when subnet with subnetGroupNameTag is found', async () =>
     vpcCidrBlock: '1.1.1.1/16',
     ownerAccountId: '123456789012',
     availabilityZones: ['bermuda-triangle-1337'],
-    isolatedSubnetIds: undefined,
-    isolatedSubnetNames: undefined,
-    isolatedSubnetRouteTableIds: undefined,
     privateSubnetIds: ['sub-789012'],
     privateSubnetNames: ['SubnetName2'],
     privateSubnetRouteTableIds: ['rtb-789012'],
@@ -247,39 +200,50 @@ test('does not throw when subnet with subnetGroupNameTag is found', async () =>
     publicSubnetNames: ['SubnetName1'],
     publicSubnetRouteTableIds: ['rtb-123456'],
     vpnGatewayId: 'gw-abcdef',
-    subnetGroups: undefined,
+  });
+  expect(mockEC2Client).toHaveReceivedCommandWith(DescribeVpcsCommand, {
+    Filters: [{ Name: 'foo', Values: ['bar'] }],
+  });
+  expect(mockEC2Client).toHaveReceivedCommandWith(DescribeSubnetsCommand, {
+    Filters: [{ Name: 'vpc-id', Values: ['vpc-1234567'] }],
+  });
+  expect(mockEC2Client).toHaveReceivedCommandWith(DescribeRouteTablesCommand, {
+    Filters: [{ Name: 'vpc-id', Values: ['vpc-1234567'] }],
+  });
+  expect(mockEC2Client).toHaveReceivedCommandWith(DescribeVpnGatewaysCommand, {
+    Filters: [
+      { Name: 'attachment.vpc-id', Values: ['vpc-1234567'] },
+      { Name: 'attachment.state', Values: ['attached'] },
+      { Name: 'state', Values: ['available'] },
+    ],
   });
 });
 
 test('throws when multiple VPCs are found', async () => {
   // GIVEN
+  mockEC2Client.on(DescribeVpcsCommand).resolves({
+    Vpcs: [{ VpcId: 'vpc-1' }, { VpcId: 'vpc-2' }],
+  });
   const filter = { foo: 'bar' };
   const provider = new VpcNetworkContextProviderPlugin(mockSDK);
 
-  AWS.mock('EC2', 'describeVpcs', (params: aws.EC2.DescribeVpcsRequest, cb: AwsCallback<aws.EC2.DescribeVpcsResult>) => {
-    expect(params.Filters).toEqual([{ Name: 'foo', Values: ['bar'] }]);
-    return cb(null, { Vpcs: [{ VpcId: 'vpc-1' }, { VpcId: 'vpc-2' }] });
-  });
-
   // WHEN
-  await expect(provider.getValue({
-    account: '1234',
-    region: 'us-east-1',
-    filter,
-  })).rejects.toThrow(/Found 2 VPCs matching/);
+  await expect(
+    provider.getValue({
+      account: '123456789012',
+      region: 'us-east-1',
+      filter,
+    }),
+  ).rejects.toThrow(/Found 2 VPCs matching/);
+  expect(mockEC2Client).toHaveReceivedCommandWith(DescribeVpcsCommand, {
+    Filters: [{ Name: 'foo', Values: ['bar'] }],
+  });
 });
 
 test('uses the VPC main route table when a subnet has no specific association', async () => {
   // GIVEN
-  const filter = { foo: 'bar' };
-  const provider = new VpcNetworkContextProviderPlugin(mockSDK);
-
-  mockVpcLookup({
-    subnets: [
-      { SubnetId: 'sub-123456', AvailabilityZone: 'bermuda-triangle-1337', MapPublicIpOnLaunch: true },
-      { SubnetId: 'sub-789012', AvailabilityZone: 'bermuda-triangle-1337', MapPublicIpOnLaunch: false },
-    ],
-    routeTables: [
+  mockEC2Client.on(DescribeRouteTablesCommand).resolves({
+    RouteTables: [
       {
         Associations: [{ SubnetId: 'sub-123456' }],
         RouteTableId: 'rtb-123456',
@@ -317,12 +281,13 @@ test('uses the VPC main route table when a subnet has no specific association',
         ],
       },
     ],
-    vpnGateways: [{ VpnGatewayId: 'gw-abcdef' }],
   });
+  const filter = { foo: 'bar' };
+  const provider = new VpcNetworkContextProviderPlugin(mockSDK);
 
   // WHEN
   const result = await provider.getValue({
-    account: '1234',
+    account: '123456789012',
     region: 'us-east-1',
     filter,
   });
@@ -333,9 +298,6 @@ test('uses the VPC main route table when a subnet has no specific association',
     vpcCidrBlock: '1.1.1.1/16',
     ownerAccountId: '123456789012',
     availabilityZones: ['bermuda-triangle-1337'],
-    isolatedSubnetIds: undefined,
-    isolatedSubnetNames: undefined,
-    isolatedSubnetRouteTableIds: undefined,
     privateSubnetIds: ['sub-789012'],
     privateSubnetNames: ['Private'],
     privateSubnetRouteTableIds: ['rtb-789012'],
@@ -343,50 +305,70 @@ test('uses the VPC main route table when a subnet has no specific association',
     publicSubnetNames: ['Public'],
     publicSubnetRouteTableIds: ['rtb-123456'],
     vpnGatewayId: 'gw-abcdef',
-    subnetGroups: undefined,
+  });
+
+  expect(mockEC2Client).toHaveReceivedCommandWith(DescribeVpcsCommand, {
+    Filters: [{ Name: 'foo', Values: ['bar'] }],
+  });
+  expect(mockEC2Client).toHaveReceivedCommandWith(DescribeSubnetsCommand, {
+    Filters: [{ Name: 'vpc-id', Values: ['vpc-1234567'] }],
+  });
+  expect(mockEC2Client).toHaveReceivedCommandWith(DescribeRouteTablesCommand, {
+    Filters: [{ Name: 'vpc-id', Values: ['vpc-1234567'] }],
+  });
+  expect(mockEC2Client).toHaveReceivedCommandWith(DescribeVpnGatewaysCommand, {
+    Filters: [
+      { Name: 'attachment.vpc-id', Values: ['vpc-1234567'] },
+      { Name: 'attachment.state', Values: ['attached'] },
+      { Name: 'state', Values: ['available'] },
+    ],
   });
 });
 
 test('Recognize public subnet by route table', async () => {
   // GIVEN
+  mockEC2Client
+    .on(DescribeSubnetsCommand)
+    .resolves({
+      Subnets: [{ SubnetId: 'sub-123456', AvailabilityZone: 'bermuda-triangle-1337', MapPublicIpOnLaunch: false }],
+    })
+    .on(DescribeRouteTablesCommand)
+    .resolves({
+      RouteTables: [
+        {
+          Associations: [{ SubnetId: 'sub-123456' }],
+          RouteTableId: 'rtb-123456',
+          Routes: [
+            {
+              DestinationCidrBlock: '10.0.2.0/26',
+              Origin: 'CreateRoute',
+              State: 'active',
+              VpcPeeringConnectionId: 'pcx-xxxxxx',
+            },
+            {
+              DestinationCidrBlock: '10.0.1.0/24',
+              GatewayId: 'local',
+              Origin: 'CreateRouteTable',
+              State: 'active',
+            },
+            {
+              DestinationCidrBlock: '0.0.0.0/0',
+              GatewayId: 'igw-xxxxxx',
+              Origin: 'CreateRoute',
+              State: 'active',
+            },
+          ],
+        },
+      ],
+    })
+    .on(DescribeVpnGatewaysCommand)
+    .resolves({});
   const filter = { foo: 'bar' };
   const provider = new VpcNetworkContextProviderPlugin(mockSDK);
 
-  mockVpcLookup({
-    subnets: [
-      { SubnetId: 'sub-123456', AvailabilityZone: 'bermuda-triangle-1337', MapPublicIpOnLaunch: false },
-    ],
-    routeTables: [
-      {
-        Associations: [{ SubnetId: 'sub-123456' }],
-        RouteTableId: 'rtb-123456',
-        Routes: [
-          {
-            DestinationCidrBlock: '10.0.2.0/26',
-            Origin: 'CreateRoute',
-            State: 'active',
-            VpcPeeringConnectionId: 'pcx-xxxxxx',
-          },
-          {
-            DestinationCidrBlock: '10.0.1.0/24',
-            GatewayId: 'local',
-            Origin: 'CreateRouteTable',
-            State: 'active',
-          },
-          {
-            DestinationCidrBlock: '0.0.0.0/0',
-            GatewayId: 'igw-xxxxxx',
-            Origin: 'CreateRoute',
-            State: 'active',
-          },
-        ],
-      },
-    ],
-  });
-
   // WHEN
   const result = await provider.getValue({
-    account: '1234',
+    account: '123456789012',
     region: 'us-east-1',
     filter,
   });
@@ -397,60 +379,72 @@ test('Recognize public subnet by route table', async () => {
     vpcCidrBlock: '1.1.1.1/16',
     ownerAccountId: '123456789012',
     availabilityZones: ['bermuda-triangle-1337'],
-    isolatedSubnetIds: undefined,
-    isolatedSubnetNames: undefined,
-    isolatedSubnetRouteTableIds: undefined,
-    privateSubnetIds: undefined,
-    privateSubnetNames: undefined,
-    privateSubnetRouteTableIds: undefined,
     publicSubnetIds: ['sub-123456'],
     publicSubnetNames: ['Public'],
     publicSubnetRouteTableIds: ['rtb-123456'],
-    vpnGatewayId: undefined,
-    subnetGroups: undefined,
+  });
+  expect(mockEC2Client).toHaveReceivedCommandWith(DescribeVpcsCommand, {
+    Filters: [{ Name: 'foo', Values: ['bar'] }],
+  });
+  expect(mockEC2Client).toHaveReceivedCommandWith(DescribeSubnetsCommand, {
+    Filters: [{ Name: 'vpc-id', Values: ['vpc-1234567'] }],
+  });
+  expect(mockEC2Client).toHaveReceivedCommandWith(DescribeRouteTablesCommand, {
+    Filters: [{ Name: 'vpc-id', Values: ['vpc-1234567'] }],
+  });
+  expect(mockEC2Client).toHaveReceivedCommandWith(DescribeVpnGatewaysCommand, {
+    Filters: [
+      { Name: 'attachment.vpc-id', Values: ['vpc-1234567'] },
+      { Name: 'attachment.state', Values: ['attached'] },
+      { Name: 'state', Values: ['available'] },
+    ],
   });
 });
 
 test('Recognize private subnet by route table with NAT Gateway', async () => {
   // GIVEN
+  mockEC2Client
+    .on(DescribeSubnetsCommand)
+    .resolves({
+      Subnets: [{ SubnetId: 'sub-123456', AvailabilityZone: 'bermuda-triangle-1337', MapPublicIpOnLaunch: false }],
+    })
+    .on(DescribeRouteTablesCommand)
+    .resolves({
+      RouteTables: [
+        {
+          Associations: [{ SubnetId: 'sub-123456' }],
+          RouteTableId: 'rtb-123456',
+          Routes: [
+            {
+              DestinationCidrBlock: '10.0.2.0/26',
+              Origin: 'CreateRoute',
+              State: 'active',
+              VpcPeeringConnectionId: 'pcx-xxxxxx',
+            },
+            {
+              DestinationCidrBlock: '10.0.1.0/24',
+              GatewayId: 'local',
+              Origin: 'CreateRouteTable',
+              State: 'active',
+            },
+            {
+              DestinationCidrBlock: '0.0.0.0/0',
+              NatGatewayId: 'nat-xxxxxx',
+              Origin: 'CreateRoute',
+              State: 'active',
+            },
+          ],
+        },
+      ],
+    })
+    .on(DescribeVpnGatewaysCommand)
+    .resolves({});
   const filter = { foo: 'bar' };
   const provider = new VpcNetworkContextProviderPlugin(mockSDK);
 
-  mockVpcLookup({
-    subnets: [
-      { SubnetId: 'sub-123456', AvailabilityZone: 'bermuda-triangle-1337', MapPublicIpOnLaunch: false },
-    ],
-    routeTables: [
-      {
-        Associations: [{ SubnetId: 'sub-123456' }],
-        RouteTableId: 'rtb-123456',
-        Routes: [
-          {
-            DestinationCidrBlock: '10.0.2.0/26',
-            Origin: 'CreateRoute',
-            State: 'active',
-            VpcPeeringConnectionId: 'pcx-xxxxxx',
-          },
-          {
-            DestinationCidrBlock: '10.0.1.0/24',
-            GatewayId: 'local',
-            Origin: 'CreateRouteTable',
-            State: 'active',
-          },
-          {
-            DestinationCidrBlock: '0.0.0.0/0',
-            NatGatewayId: 'nat-xxxxxx',
-            Origin: 'CreateRoute',
-            State: 'active',
-          },
-        ],
-      },
-    ],
-  });
-
   // WHEN
   const result = await provider.getValue({
-    account: '1234',
+    account: '123456789012',
     region: 'us-east-1',
     filter,
   });
@@ -461,60 +455,72 @@ test('Recognize private subnet by route table with NAT Gateway', async () => {
     vpcCidrBlock: '1.1.1.1/16',
     ownerAccountId: '123456789012',
     availabilityZones: ['bermuda-triangle-1337'],
-    isolatedSubnetIds: undefined,
-    isolatedSubnetNames: undefined,
-    isolatedSubnetRouteTableIds: undefined,
     privateSubnetIds: ['sub-123456'],
     privateSubnetNames: ['Private'],
     privateSubnetRouteTableIds: ['rtb-123456'],
-    publicSubnetIds: undefined,
-    publicSubnetNames: undefined,
-    publicSubnetRouteTableIds: undefined,
-    vpnGatewayId: undefined,
-    subnetGroups: undefined,
+  });
+  expect(mockEC2Client).toHaveReceivedCommandWith(DescribeVpcsCommand, {
+    Filters: [{ Name: 'foo', Values: ['bar'] }],
+  });
+  expect(mockEC2Client).toHaveReceivedCommandWith(DescribeSubnetsCommand, {
+    Filters: [{ Name: 'vpc-id', Values: ['vpc-1234567'] }],
+  });
+  expect(mockEC2Client).toHaveReceivedCommandWith(DescribeRouteTablesCommand, {
+    Filters: [{ Name: 'vpc-id', Values: ['vpc-1234567'] }],
+  });
+  expect(mockEC2Client).toHaveReceivedCommandWith(DescribeVpnGatewaysCommand, {
+    Filters: [
+      { Name: 'attachment.vpc-id', Values: ['vpc-1234567'] },
+      { Name: 'attachment.state', Values: ['attached'] },
+      { Name: 'state', Values: ['available'] },
+    ],
   });
 });
 
 test('Recognize private subnet by route table with Transit Gateway', async () => {
   // GIVEN
+  mockEC2Client
+    .on(DescribeSubnetsCommand)
+    .resolves({
+      Subnets: [{ SubnetId: 'sub-123456', AvailabilityZone: 'bermuda-triangle-1337', MapPublicIpOnLaunch: false }],
+    })
+    .on(DescribeRouteTablesCommand)
+    .resolves({
+      RouteTables: [
+        {
+          Associations: [{ SubnetId: 'sub-123456' }],
+          RouteTableId: 'rtb-123456',
+          Routes: [
+            {
+              DestinationCidrBlock: '10.0.2.0/26',
+              Origin: 'CreateRoute',
+              State: 'active',
+              VpcPeeringConnectionId: 'pcx-xxxxxx',
+            },
+            {
+              DestinationCidrBlock: '10.0.1.0/24',
+              GatewayId: 'local',
+              Origin: 'CreateRouteTable',
+              State: 'active',
+            },
+            {
+              DestinationCidrBlock: '0.0.0.0/0',
+              TransitGatewayId: 'tgw-xxxxxx',
+              Origin: 'CreateRoute',
+              State: 'active',
+            },
+          ],
+        },
+      ],
+    })
+    .on(DescribeVpnGatewaysCommand)
+    .resolves({});
   const filter = { foo: 'bar' };
   const provider = new VpcNetworkContextProviderPlugin(mockSDK);
 
-  mockVpcLookup({
-    subnets: [
-      { SubnetId: 'sub-123456', AvailabilityZone: 'bermuda-triangle-1337', MapPublicIpOnLaunch: false },
-    ],
-    routeTables: [
-      {
-        Associations: [{ SubnetId: 'sub-123456' }],
-        RouteTableId: 'rtb-123456',
-        Routes: [
-          {
-            DestinationCidrBlock: '10.0.2.0/26',
-            Origin: 'CreateRoute',
-            State: 'active',
-            VpcPeeringConnectionId: 'pcx-xxxxxx',
-          },
-          {
-            DestinationCidrBlock: '10.0.1.0/24',
-            GatewayId: 'local',
-            Origin: 'CreateRouteTable',
-            State: 'active',
-          },
-          {
-            DestinationCidrBlock: '0.0.0.0/0',
-            TransitGatewayId: 'tgw-xxxxxx',
-            Origin: 'CreateRoute',
-            State: 'active',
-          },
-        ],
-      },
-    ],
-  });
-
   // WHEN
   const result = await provider.getValue({
-    account: '1234',
+    account: '123456789012',
     region: 'us-east-1',
     filter,
   });
@@ -525,48 +531,60 @@ test('Recognize private subnet by route table with Transit Gateway', async () =>
     vpcCidrBlock: '1.1.1.1/16',
     ownerAccountId: '123456789012',
     availabilityZones: ['bermuda-triangle-1337'],
-    isolatedSubnetIds: undefined,
-    isolatedSubnetNames: undefined,
-    isolatedSubnetRouteTableIds: undefined,
     privateSubnetIds: ['sub-123456'],
     privateSubnetNames: ['Private'],
     privateSubnetRouteTableIds: ['rtb-123456'],
-    publicSubnetIds: undefined,
-    publicSubnetNames: undefined,
-    publicSubnetRouteTableIds: undefined,
-    vpnGatewayId: undefined,
-    subnetGroups: undefined,
+  });
+  expect(mockEC2Client).toHaveReceivedCommandWith(DescribeVpcsCommand, {
+    Filters: [{ Name: 'foo', Values: ['bar'] }],
+  });
+  expect(mockEC2Client).toHaveReceivedCommandWith(DescribeSubnetsCommand, {
+    Filters: [{ Name: 'vpc-id', Values: ['vpc-1234567'] }],
+  });
+  expect(mockEC2Client).toHaveReceivedCommandWith(DescribeRouteTablesCommand, {
+    Filters: [{ Name: 'vpc-id', Values: ['vpc-1234567'] }],
+  });
+  expect(mockEC2Client).toHaveReceivedCommandWith(DescribeVpnGatewaysCommand, {
+    Filters: [
+      { Name: 'attachment.vpc-id', Values: ['vpc-1234567'] },
+      { Name: 'attachment.state', Values: ['attached'] },
+      { Name: 'state', Values: ['available'] },
+    ],
   });
 });
 
 test('Recognize isolated subnet by route table', async () => {
   // GIVEN
+  mockEC2Client
+    .on(DescribeSubnetsCommand)
+    .resolves({
+      Subnets: [{ SubnetId: 'sub-123456', AvailabilityZone: 'bermuda-triangle-1337', MapPublicIpOnLaunch: false }],
+    })
+    .on(DescribeRouteTablesCommand)
+    .resolves({
+      RouteTables: [
+        {
+          Associations: [{ SubnetId: 'sub-123456' }],
+          RouteTableId: 'rtb-123456',
+          Routes: [
+            {
+              DestinationCidrBlock: '10.0.1.0/24',
+              GatewayId: 'local',
+              Origin: 'CreateRouteTable',
+              State: 'active',
+            },
+          ],
+        },
+      ],
+    })
+    .on(DescribeVpnGatewaysCommand)
+    .resolves({});
   const filter = { foo: 'bar' };
   const provider = new VpcNetworkContextProviderPlugin(mockSDK);
 
-  mockVpcLookup({
-    subnets: [
-      { SubnetId: 'sub-123456', AvailabilityZone: 'bermuda-triangle-1337', MapPublicIpOnLaunch: false },
-    ],
-    routeTables: [
-      {
-        Associations: [{ SubnetId: 'sub-123456' }],
-        RouteTableId: 'rtb-123456',
-        Routes: [
-          {
-            DestinationCidrBlock: '10.0.1.0/24',
-            GatewayId: 'local',
-            Origin: 'CreateRouteTable',
-            State: 'active',
-          },
-        ],
-      },
-    ],
-  });
-
   // WHEN
   const result = await provider.getValue({
-    account: '1234',
+    account: '123456789012',
     region: 'us-east-1',
     filter,
   });
@@ -580,47 +598,21 @@ test('Recognize isolated subnet by route table', async () => {
     isolatedSubnetIds: ['sub-123456'],
     isolatedSubnetNames: ['Isolated'],
     isolatedSubnetRouteTableIds: ['rtb-123456'],
-    privateSubnetIds: undefined,
-    privateSubnetNames: undefined,
-    privateSubnetRouteTableIds: undefined,
-    publicSubnetIds: undefined,
-    publicSubnetNames: undefined,
-    publicSubnetRouteTableIds: undefined,
-    vpnGatewayId: undefined,
-    subnetGroups: undefined,
   });
-});
-
-interface VpcLookupOptions {
-  subnets: aws.EC2.Subnet[];
-  routeTables: aws.EC2.RouteTable[];
-  vpnGateways?: aws.EC2.VpnGateway[];
-}
-
-function mockVpcLookup(options: VpcLookupOptions) {
-  const VpcId = 'vpc-1234567';
-
-  AWS.mock('EC2', 'describeVpcs', (params: aws.EC2.DescribeVpcsRequest, cb: AwsCallback<aws.EC2.DescribeVpcsResult>) => {
-    expect(params.Filters).toEqual([{ Name: 'foo', Values: ['bar'] }]);
-    return cb(null, { Vpcs: [{ VpcId, CidrBlock: '1.1.1.1/16', OwnerId: '123456789012' }] });
+  expect(mockEC2Client).toHaveReceivedCommandWith(DescribeVpcsCommand, {
+    Filters: [{ Name: 'foo', Values: ['bar'] }],
   });
-
-  AWS.mock('EC2', 'describeSubnets', (params: aws.EC2.DescribeSubnetsRequest, cb: AwsCallback<aws.EC2.DescribeSubnetsResult>) => {
-    expect(params.Filters).toEqual([{ Name: 'vpc-id', Values: [VpcId] }]);
-    return cb(null, { Subnets: options.subnets });
+  expect(mockEC2Client).toHaveReceivedCommandWith(DescribeSubnetsCommand, {
+    Filters: [{ Name: 'vpc-id', Values: ['vpc-1234567'] }],
   });
-
-  AWS.mock('EC2', 'describeRouteTables', (params: aws.EC2.DescribeRouteTablesRequest, cb: AwsCallback<aws.EC2.DescribeRouteTablesResult>) => {
-    expect(params.Filters).toEqual([{ Name: 'vpc-id', Values: [VpcId] }]);
-    return cb(null, { RouteTables: options.routeTables });
+  expect(mockEC2Client).toHaveReceivedCommandWith(DescribeRouteTablesCommand, {
+    Filters: [{ Name: 'vpc-id', Values: ['vpc-1234567'] }],
   });
-
-  AWS.mock('EC2', 'describeVpnGateways', (params: aws.EC2.DescribeVpnGatewaysRequest, cb: AwsCallback<aws.EC2.DescribeVpnGatewaysResult>) => {
-    expect(params.Filters).toEqual([
-      { Name: 'attachment.vpc-id', Values: [VpcId] },
+  expect(mockEC2Client).toHaveReceivedCommandWith(DescribeVpnGatewaysCommand, {
+    Filters: [
+      { Name: 'attachment.vpc-id', Values: ['vpc-1234567'] },
       { Name: 'attachment.state', Values: ['attached'] },
       { Name: 'state', Values: ['available'] },
-    ]);
-    return cb(null, { VpnGateways: options.vpnGateways });
+    ],
   });
-}
+});
diff --git a/packages/aws-cdk/test/diff.test.ts b/packages/aws-cdk/test/diff.test.ts
index 7267f746b1af9..96a477d8854ab 100644
--- a/packages/aws-cdk/test/diff.test.ts
+++ b/packages/aws-cdk/test/diff.test.ts
@@ -1,14 +1,13 @@
-/* eslint-disable import/order */
+import * as fs from 'fs';
 import { Writable } from 'stream';
 import { StringDecoder } from 'string_decoder';
 import * as cxschema from '@aws-cdk/cloud-assembly-schema';
 import { CloudFormationStackArtifact } from '@aws-cdk/cx-api';
 import { instanceMockFrom, MockCloudExecutable } from './util';
 import { Deployments } from '../lib/api/deployments';
-import { CdkToolkit } from '../lib/cdk-toolkit';
-import * as cfn from '../lib/api/util/cloudformation';
 import { NestedStackTemplates } from '../lib/api/nested-stack-helpers';
-import * as fs from 'fs';
+import * as cfn from '../lib/api/util/cloudformation';
+import { CdkToolkit } from '../lib/cdk-toolkit';
 
 let cloudExecutable: MockCloudExecutable;
 let cloudFormation: jest.Mocked<Deployments>;
@@ -29,19 +28,21 @@ describe('fixed template', () => {
     };
 
     cloudExecutable = new MockCloudExecutable({
-      stacks: [{
-        stackName: 'A',
-        template: {
-          Resources: {
-            SomeResource: {
-              Type: 'AWS::SomeService::SomeResource',
-              Properties: {
-                Something: 'new-value',
+      stacks: [
+        {
+          stackName: 'A',
+          template: {
+            Resources: {
+              SomeResource: {
+                Type: 'AWS::SomeService::SomeResource',
+                Properties: {
+                  Something: 'new-value',
+                },
               },
             },
           },
         },
-      }],
+      ],
     });
 
     toolkit = new CdkToolkit({
@@ -91,9 +92,9 @@ describe('imports', () => {
       'Resources': [],
     };
     fs.writeFileSync('migrate.json', JSON.stringify(outputToJson, null, 2));
-
     jest.spyOn(cfn, 'createDiffChangeSet').mockImplementationOnce(async () => {
       return {
+        $metadata: {},
         Changes: [
           {
             ResourceChange: {
@@ -117,22 +118,24 @@ describe('imports', () => {
       };
     });
     cloudExecutable = new MockCloudExecutable({
-      stacks: [{
-        stackName: 'A',
-        template: {
-          Resources: {
-            Queue: {
-              Type: 'AWS::SQS::Queue',
-            },
-            Queue2: {
-              Type: 'AWS::SQS::Queue',
-            },
-            Bucket: {
-              Type: 'AWS::S3::Bucket',
+      stacks: [
+        {
+          stackName: 'A',
+          template: {
+            Resources: {
+              Queue: {
+                Type: 'AWS::SQS::Queue',
+              },
+              Queue2: {
+                Type: 'AWS::SQS::Queue',
+              },
+              Bucket: {
+                Type: 'AWS::S3::Bucket',
+              },
             },
           },
         },
-      }],
+      ],
     });
 
     cloudFormation = instanceMockFrom(Deployments);
@@ -145,18 +148,22 @@ describe('imports', () => {
     });
 
     // Default implementations
-    cloudFormation.readCurrentTemplateWithNestedStacks.mockImplementation((_stackArtifact: CloudFormationStackArtifact) => {
-      return Promise.resolve({
-        deployedRootTemplate: {},
-        nestedStacks: {},
-      });
-    });
-    cloudFormation.deployStack.mockImplementation((options) => Promise.resolve({
-      noOp: true,
-      outputs: {},
-      stackArn: '',
-      stackArtifact: options.stack,
-    }));
+    cloudFormation.readCurrentTemplateWithNestedStacks.mockImplementation(
+      (_stackArtifact: CloudFormationStackArtifact) => {
+        return Promise.resolve({
+          deployedRootTemplate: {},
+          nestedStacks: {},
+        });
+      },
+    );
+    cloudFormation.deployStack.mockImplementation((options) =>
+      Promise.resolve({
+        noOp: true,
+        outputs: {},
+        stackArn: '',
+        stackArtifact: options.stack,
+      }),
+    );
   });
 
   afterEach(() => {
@@ -221,32 +228,34 @@ Resources
 describe('non-nested stacks', () => {
   beforeEach(() => {
     cloudExecutable = new MockCloudExecutable({
-      stacks: [{
-        stackName: 'A',
-        template: { resource: 'A' },
-      },
-      {
-        stackName: 'B',
-        depends: ['A'],
-        template: { resource: 'B' },
-      },
-      {
-        stackName: 'C',
-        depends: ['A'],
-        template: { resource: 'C' },
-        metadata: {
-          '/resource': [
-            {
-              type: cxschema.ArtifactMetadataEntryType.ERROR,
-              data: 'this is an error',
-            },
-          ],
+      stacks: [
+        {
+          stackName: 'A',
+          template: { resource: 'A' },
         },
-      },
-      {
-        stackName: 'D',
-        template: { resource: 'D' },
-      }],
+        {
+          stackName: 'B',
+          depends: ['A'],
+          template: { resource: 'B' },
+        },
+        {
+          stackName: 'C',
+          depends: ['A'],
+          template: { resource: 'C' },
+          metadata: {
+            '/resource': [
+              {
+                type: cxschema.ArtifactMetadataEntryType.ERROR,
+                data: 'this is an error',
+              },
+            ],
+          },
+        },
+        {
+          stackName: 'D',
+          template: { resource: 'D' },
+        },
+      ],
     });
 
     cloudFormation = instanceMockFrom(Deployments);
@@ -259,24 +268,28 @@ describe('non-nested stacks', () => {
     });
 
     // Default implementations
-    cloudFormation.readCurrentTemplateWithNestedStacks.mockImplementation((stackArtifact: CloudFormationStackArtifact) => {
-      if (stackArtifact.stackName === 'D') {
+    cloudFormation.readCurrentTemplateWithNestedStacks.mockImplementation(
+      (stackArtifact: CloudFormationStackArtifact) => {
+        if (stackArtifact.stackName === 'D') {
+          return Promise.resolve({
+            deployedRootTemplate: { resource: 'D' },
+            nestedStacks: {},
+          });
+        }
         return Promise.resolve({
-          deployedRootTemplate: { resource: 'D' },
+          deployedRootTemplate: {},
           nestedStacks: {},
         });
-      }
-      return Promise.resolve({
-        deployedRootTemplate: {},
-        nestedStacks: {},
-      });
-    });
-    cloudFormation.deployStack.mockImplementation((options) => Promise.resolve({
-      noOp: true,
-      outputs: {},
-      stackArn: '',
-      stackArtifact: options.stack,
-    }));
+      },
+    );
+    cloudFormation.deployStack.mockImplementation((options) =>
+      Promise.resolve({
+        noOp: true,
+        outputs: {},
+        stackArn: '',
+        stackArtifact: options.stack,
+      }),
+    );
   });
 
   test('diff can diff multiple stacks', async () => {
@@ -301,14 +314,16 @@ describe('non-nested stacks', () => {
   test('diff number of stack diffs, not resource diffs', async () => {
     // GIVEN
     cloudExecutable = new MockCloudExecutable({
-      stacks: [{
-        stackName: 'A',
-        template: { resourceA: 'A', resourceB: 'B' },
-      },
-      {
-        stackName: 'B',
-        template: { resourceC: 'C' },
-      }],
+      stacks: [
+        {
+          stackName: 'A',
+          template: { resourceA: 'A', resourceB: 'B' },
+        },
+        {
+          stackName: 'B',
+          template: { resourceC: 'C' },
+        },
+      ],
     });
 
     toolkit = new CdkToolkit({
@@ -355,10 +370,12 @@ describe('non-nested stacks', () => {
     const buffer = new StringWritable();
 
     // WHEN
-    await expect(() => toolkit.diff({
-      stackNames: ['X', 'Y', 'Z'],
-      stream: buffer,
-    })).rejects.toThrow('No stacks match the name(s) X,Y,Z');
+    await expect(() =>
+      toolkit.diff({
+        stackNames: ['X', 'Y', 'Z'],
+        stream: buffer,
+      }),
+    ).rejects.toThrow('No stacks match the name(s) X,Y,Z');
   });
 
   test('exits with 1 with diff in first stack, but not in second stack and fail set to true', async () => {
@@ -381,10 +398,12 @@ describe('non-nested stacks', () => {
     const buffer = new StringWritable();
 
     // WHEN
-    await expect(() => toolkit.diff({
-      stackNames: ['C'],
-      stream: buffer,
-    })).rejects.toThrow(/Found errors/);
+    await expect(() =>
+      toolkit.diff({
+        stackNames: ['C'],
+        stream: buffer,
+      }),
+    ).rejects.toThrow(/Found errors/);
   });
 
   test('when quiet mode is enabled, stacks with no diffs should not print stack name & no differences to stdout', async () => {
@@ -430,36 +449,37 @@ describe('non-nested stacks', () => {
 
 describe('stack exists checks', () => {
   beforeEach(() => {
-
     jest.resetAllMocks();
 
     cloudExecutable = new MockCloudExecutable({
-      stacks: [{
-        stackName: 'A',
-        template: { resource: 'A' },
-      },
-      {
-        stackName: 'B',
-        depends: ['A'],
-        template: { resource: 'B' },
-      },
-      {
-        stackName: 'C',
-        depends: ['A'],
-        template: { resource: 'C' },
-        metadata: {
-          '/resource': [
-            {
-              type: cxschema.ArtifactMetadataEntryType.ERROR,
-              data: 'this is an error',
-            },
-          ],
+      stacks: [
+        {
+          stackName: 'A',
+          template: { resource: 'A' },
         },
-      },
-      {
-        stackName: 'D',
-        template: { resource: 'D' },
-      }],
+        {
+          stackName: 'B',
+          depends: ['A'],
+          template: { resource: 'B' },
+        },
+        {
+          stackName: 'C',
+          depends: ['A'],
+          template: { resource: 'C' },
+          metadata: {
+            '/resource': [
+              {
+                type: cxschema.ArtifactMetadataEntryType.ERROR,
+                data: 'this is an error',
+              },
+            ],
+          },
+        },
+        {
+          stackName: 'D',
+          template: { resource: 'D' },
+        },
+      ],
     });
 
     cloudFormation = instanceMockFrom(Deployments);
@@ -472,37 +492,28 @@ describe('stack exists checks', () => {
     });
 
     // Default implementations
-    cloudFormation.readCurrentTemplateWithNestedStacks.mockImplementation((stackArtifact: CloudFormationStackArtifact) => {
-      if (stackArtifact.stackName === 'D') {
+    cloudFormation.readCurrentTemplateWithNestedStacks.mockImplementation(
+      (stackArtifact: CloudFormationStackArtifact) => {
+        if (stackArtifact.stackName === 'D') {
+          return Promise.resolve({
+            deployedRootTemplate: { resource: 'D' },
+            nestedStacks: {},
+          });
+        }
         return Promise.resolve({
-          deployedRootTemplate: { resource: 'D' },
+          deployedRootTemplate: {},
           nestedStacks: {},
         });
-      }
-      return Promise.resolve({
-        deployedRootTemplate: {},
-        nestedStacks: {},
-      });
-    });
-    cloudFormation.deployStack.mockImplementation((options) => Promise.resolve({
-      noOp: true,
-      outputs: {},
-      stackArn: '',
-      stackArtifact: options.stack,
-    }));
-
-    jest.spyOn(cfn, 'createDiffChangeSet').mockImplementationOnce(async () => {
-      return {
-        Changes: [
-          {
-            ResourceChange: {
-              Action: 'Add',
-              LogicalResourceId: 'Object',
-            },
-          },
-        ],
-      };
-    });
+      },
+    );
+    cloudFormation.deployStack.mockImplementation((options) =>
+      Promise.resolve({
+        noOp: true,
+        outputs: {},
+        stackArn: '',
+        stackArtifact: options.stack,
+      }),
+    );
   });
 
   test('diff does not check for stack existence when --no-change-set is passed', async () => {
@@ -591,241 +602,243 @@ describe('nested stacks', () => {
       sdkProvider: cloudExecutable.sdkProvider,
     });
 
-    cloudFormation.readCurrentTemplateWithNestedStacks.mockImplementation((stackArtifact: CloudFormationStackArtifact) => {
-      if (stackArtifact.stackName === 'Parent') {
-        stackArtifact.template.Resources = {
-          AdditionChild: {
-            Type: 'AWS::CloudFormation::Stack',
-            Properties: {
-              TemplateURL: 'addition-child-url-old',
+    cloudFormation.readCurrentTemplateWithNestedStacks.mockImplementation(
+      (stackArtifact: CloudFormationStackArtifact) => {
+        if (stackArtifact.stackName === 'Parent') {
+          stackArtifact.template.Resources = {
+            AdditionChild: {
+              Type: 'AWS::CloudFormation::Stack',
+              Properties: {
+                TemplateURL: 'addition-child-url-old',
+              },
             },
-          },
-          DeletionChild: {
-            Type: 'AWS::CloudFormation::Stack',
-            Properties: {
-              TemplateURL: 'deletion-child-url-old',
+            DeletionChild: {
+              Type: 'AWS::CloudFormation::Stack',
+              Properties: {
+                TemplateURL: 'deletion-child-url-old',
+              },
             },
-          },
-          ChangedChild: {
-            Type: 'AWS::CloudFormation::Stack',
-            Properties: {
-              TemplateURL: 'changed-child-url-old',
+            ChangedChild: {
+              Type: 'AWS::CloudFormation::Stack',
+              Properties: {
+                TemplateURL: 'changed-child-url-old',
+              },
             },
-          },
-          UnchangedChild: {
-            Type: 'AWS::CloudFormation::Stack',
-            Properties: {
-              TemplateURL: 'changed-child-url-constant',
+            UnchangedChild: {
+              Type: 'AWS::CloudFormation::Stack',
+              Properties: {
+                TemplateURL: 'changed-child-url-constant',
+              },
             },
-          },
-        };
-        return Promise.resolve({
-          deployedRootTemplate: {
-            Resources: {
-              AdditionChild: {
-                Type: 'AWS::CloudFormation::Stack',
-                Properties: {
-                  TemplateURL: 'addition-child-url-new',
+          };
+          return Promise.resolve({
+            deployedRootTemplate: {
+              Resources: {
+                AdditionChild: {
+                  Type: 'AWS::CloudFormation::Stack',
+                  Properties: {
+                    TemplateURL: 'addition-child-url-new',
+                  },
                 },
-              },
-              DeletionChild: {
-                Type: 'AWS::CloudFormation::Stack',
-                Properties: {
-                  TemplateURL: 'deletion-child-url-new',
+                DeletionChild: {
+                  Type: 'AWS::CloudFormation::Stack',
+                  Properties: {
+                    TemplateURL: 'deletion-child-url-new',
+                  },
                 },
-              },
-              ChangedChild: {
-                Type: 'AWS::CloudFormation::Stack',
-                Properties: {
-                  TemplateURL: 'changed-child-url-new',
+                ChangedChild: {
+                  Type: 'AWS::CloudFormation::Stack',
+                  Properties: {
+                    TemplateURL: 'changed-child-url-new',
+                  },
                 },
-              },
-              UnchangedChild: {
-                Type: 'AWS::CloudFormation::Stack',
-                Properties: {
-                  TemplateURL: 'changed-child-url-constant',
+                UnchangedChild: {
+                  Type: 'AWS::CloudFormation::Stack',
+                  Properties: {
+                    TemplateURL: 'changed-child-url-constant',
+                  },
                 },
               },
             },
-          },
-          nestedStacks: {
-            AdditionChild: {
-              deployedTemplate: {
-                Resources: {
-                  SomeResource: {
-                    Type: 'AWS::Something',
+            nestedStacks: {
+              AdditionChild: {
+                deployedTemplate: {
+                  Resources: {
+                    SomeResource: {
+                      Type: 'AWS::Something',
+                    },
                   },
                 },
-              },
-              generatedTemplate: {
-                Resources: {
-                  SomeResource: {
-                    Type: 'AWS::Something',
-                    Properties: {
-                      Prop: 'added-value',
+                generatedTemplate: {
+                  Resources: {
+                    SomeResource: {
+                      Type: 'AWS::Something',
+                      Properties: {
+                        Prop: 'added-value',
+                      },
                     },
                   },
                 },
+                nestedStackTemplates: {},
+                physicalName: 'AdditionChild',
               },
-              nestedStackTemplates: {},
-              physicalName: 'AdditionChild',
-            },
-            DeletionChild: {
-              deployedTemplate: {
-                Resources: {
-                  SomeResource: {
-                    Type: 'AWS::Something',
-                    Properties: {
-                      Prop: 'value-to-be-removed',
+              DeletionChild: {
+                deployedTemplate: {
+                  Resources: {
+                    SomeResource: {
+                      Type: 'AWS::Something',
+                      Properties: {
+                        Prop: 'value-to-be-removed',
+                      },
                     },
                   },
                 },
-              },
-              generatedTemplate: {
-                Resources: {
-                  SomeResource: {
-                    Type: 'AWS::Something',
+                generatedTemplate: {
+                  Resources: {
+                    SomeResource: {
+                      Type: 'AWS::Something',
+                    },
                   },
                 },
+                nestedStackTemplates: {},
+                physicalName: 'DeletionChild',
               },
-              nestedStackTemplates: {},
-              physicalName: 'DeletionChild',
-            },
-            ChangedChild: {
-              deployedTemplate: {
-                Resources: {
-                  SomeResource: {
-                    Type: 'AWS::Something',
-                    Properties: {
-                      Prop: 'old-value',
+              ChangedChild: {
+                deployedTemplate: {
+                  Resources: {
+                    SomeResource: {
+                      Type: 'AWS::Something',
+                      Properties: {
+                        Prop: 'old-value',
+                      },
                     },
                   },
                 },
-              },
-              generatedTemplate: {
-                Resources: {
-                  SomeResource: {
-                    Type: 'AWS::Something',
-                    Properties: {
-                      Prop: 'new-value',
+                generatedTemplate: {
+                  Resources: {
+                    SomeResource: {
+                      Type: 'AWS::Something',
+                      Properties: {
+                        Prop: 'new-value',
+                      },
                     },
                   },
                 },
+                nestedStackTemplates: {},
+                physicalName: 'ChangedChild',
               },
-              nestedStackTemplates: {},
-              physicalName: 'ChangedChild',
-            },
-            newChild: {
-              deployedTemplate: {},
-              generatedTemplate: {
-                Resources: {
-                  SomeResource: {
-                    Type: 'AWS::Something',
-                    Properties: {
-                      Prop: 'new-value',
+              newChild: {
+                deployedTemplate: {},
+                generatedTemplate: {
+                  Resources: {
+                    SomeResource: {
+                      Type: 'AWS::Something',
+                      Properties: {
+                        Prop: 'new-value',
+                      },
                     },
                   },
                 },
-              },
-              nestedStackTemplates: {
-                newGrandChild: {
-                  deployedTemplate: {},
-                  generatedTemplate: {
-                    Resources: {
-                      SomeResource: {
-                        Type: 'AWS::Something',
-                        Properties: {
-                          Prop: 'new-value',
+                nestedStackTemplates: {
+                  newGrandChild: {
+                    deployedTemplate: {},
+                    generatedTemplate: {
+                      Resources: {
+                        SomeResource: {
+                          Type: 'AWS::Something',
+                          Properties: {
+                            Prop: 'new-value',
+                          },
                         },
                       },
                     },
-                  },
-                  physicalName: undefined,
-                  nestedStackTemplates: {},
-                } as NestedStackTemplates,
+                    physicalName: undefined,
+                    nestedStackTemplates: {},
+                  } as NestedStackTemplates,
+                },
+                physicalName: undefined,
               },
-              physicalName: undefined,
-            },
-            UnChangedChild: {
-              deployedTemplate: {
-                Resources: {
-                  SomeResource: {
-                    Type: 'AWS::Something',
-                    Properties: {
-                      Prop: 'unchanged',
+              UnChangedChild: {
+                deployedTemplate: {
+                  Resources: {
+                    SomeResource: {
+                      Type: 'AWS::Something',
+                      Properties: {
+                        Prop: 'unchanged',
+                      },
                     },
                   },
                 },
-              },
-              generatedTemplate: {
-                Resources: {
-                  SomeResource: {
-                    Type: 'AWS::Something',
-                    Properties: {
-                      Prop: 'unchanged',
+                generatedTemplate: {
+                  Resources: {
+                    SomeResource: {
+                      Type: 'AWS::Something',
+                      Properties: {
+                        Prop: 'unchanged',
+                      },
                     },
                   },
                 },
+                nestedStackTemplates: {},
+                physicalName: 'UnChangedChild',
               },
-              nestedStackTemplates: {},
-              physicalName: 'UnChangedChild',
             },
-          },
-        });
-      }
-      if (stackArtifact.stackName === 'UnchangedParent') {
-        stackArtifact.template.Resources = {
-          UnchangedChild: {
-            Type: 'AWS::CloudFormation::Stack',
-            Properties: {
-              TemplateURL: 'child-url',
+          });
+        }
+        if (stackArtifact.stackName === 'UnchangedParent') {
+          stackArtifact.template.Resources = {
+            UnchangedChild: {
+              Type: 'AWS::CloudFormation::Stack',
+              Properties: {
+                TemplateURL: 'child-url',
+              },
             },
-          },
-        };
-        return Promise.resolve({
-          deployedRootTemplate: {
-            Resources: {
-              UnchangedChild: {
-                Type: 'AWS::CloudFormation::Stack',
-                Properties: {
-                  TemplateURL: 'child-url',
+          };
+          return Promise.resolve({
+            deployedRootTemplate: {
+              Resources: {
+                UnchangedChild: {
+                  Type: 'AWS::CloudFormation::Stack',
+                  Properties: {
+                    TemplateURL: 'child-url',
+                  },
                 },
               },
             },
-          },
-          nestedStacks: {
-            UnchangedChild: {
-              deployedTemplate: {
-                Resources: {
-                  SomeResource: {
-                    Type: 'AWS::Something',
-                    Properties: {
-                      Prop: 'unchanged',
+            nestedStacks: {
+              UnchangedChild: {
+                deployedTemplate: {
+                  Resources: {
+                    SomeResource: {
+                      Type: 'AWS::Something',
+                      Properties: {
+                        Prop: 'unchanged',
+                      },
                     },
                   },
                 },
-              },
-              generatedTemplate: {
-                Resources: {
-                  SomeResource: {
-                    Type: 'AWS::Something',
-                    Properties: {
-                      Prop: 'unchanged',
+                generatedTemplate: {
+                  Resources: {
+                    SomeResource: {
+                      Type: 'AWS::Something',
+                      Properties: {
+                        Prop: 'unchanged',
+                      },
                     },
                   },
                 },
+                nestedStackTemplates: {},
+                physicalName: 'UnchangedChild',
               },
-              nestedStackTemplates: {},
-              physicalName: 'UnchangedChild',
             },
-          },
+          });
+        }
+        return Promise.resolve({
+          deployedRootTemplate: {},
+          nestedStacks: {},
         });
-      }
-      return Promise.resolve({
-        deployedRootTemplate: {},
-        nestedStacks: {},
-      });
-    });
+      },
+    );
   });
 
   test('diff can diff nested stacks and display the nested stack logical ID if has not been deployed or otherwise has no physical name', async () => {
@@ -840,8 +853,7 @@ describe('nested stacks', () => {
     });
 
     // THEN
-    const plainTextOutput = buffer.data.replace(/\x1B\[[0-?]*[ -/]*[@-~]/g, '')
-      .replace(/[ \t]+$/mg, '');
+    const plainTextOutput = buffer.data.replace(/\x1B\[[0-?]*[ -/]*[@-~]/g, '').replace(/[ \t]+$/gm, '');
     expect(plainTextOutput.trim()).toEqual(`Stack Parent
 Resources
 [~] AWS::CloudFormation::Stack AdditionChild
@@ -904,8 +916,7 @@ Stack UnChangedChild
     });
 
     // THEN
-    const plainTextOutput = buffer.data.replace(/\x1B\[[0-?]*[ -/]*[@-~]/g, '')
-      .replace(/[ \t]+$/mg, '');
+    const plainTextOutput = buffer.data.replace(/\x1B\[[0-?]*[ -/]*[@-~]/g, '').replace(/[ \t]+$/gm, '');
     expect(plainTextOutput.trim()).toEqual(`Stack Parent
 Resources
 [~] AWS::CloudFormation::Stack AdditionChild
@@ -969,7 +980,7 @@ Stack UnChangedChild
     });
 
     // THEN
-    const plainTextOutput = buffer.data.replace(/\x1B\[[0-?]*[ -/]*[@-~]/g, '').replace(/[ \t]+$/mg, '');
+    const plainTextOutput = buffer.data.replace(/\x1B\[[0-?]*[ -/]*[@-~]/g, '').replace(/[ \t]+$/gm, '');
     expect(plainTextOutput).not.toContain('Stack UnchangedParent');
     expect(plainTextOutput).not.toContain('There were no differences');
     expect(buffer.data.trim()).toContain('✨  Number of stacks with differences: 0');
@@ -989,7 +1000,7 @@ Stack UnChangedChild
     });
 
     // THEN
-    const plainTextOutput = buffer.data.replace(/\x1B\[[0-?]*[ -/]*[@-~]/g, '').replace(/[ \t]+$/mg, '');
+    const plainTextOutput = buffer.data.replace(/\x1B\[[0-?]*[ -/]*[@-~]/g, '').replace(/[ \t]+$/gm, '');
     expect(plainTextOutput).toContain(`Stack Parent
 Resources
 [~] AWS::CloudFormation::Stack AdditionChild
@@ -1045,27 +1056,29 @@ describe('--strict', () => {
     const oldTemplate = {};
 
     cloudExecutable = new MockCloudExecutable({
-      stacks: [{
-        stackName: 'A',
-        template: {
-          Resources: {
-            MetadataResource: {
-              Type: 'AWS::CDK::Metadata',
-              Properties: {
-                newMeta: 'newData',
+      stacks: [
+        {
+          stackName: 'A',
+          template: {
+            Resources: {
+              MetadataResource: {
+                Type: 'AWS::CDK::Metadata',
+                Properties: {
+                  newMeta: 'newData',
+                },
+              },
+              SomeOtherResource: {
+                Type: 'AWS::Something::Amazing',
               },
             },
-            SomeOtherResource: {
-              Type: 'AWS::Something::Amazing',
-            },
-          },
-          Rules: {
-            CheckBootstrapVersion: {
-              newCheck: 'newBootstrapVersion',
+            Rules: {
+              CheckBootstrapVersion: {
+                newCheck: 'newBootstrapVersion',
+              },
             },
           },
         },
-      }],
+      ],
     });
 
     toolkit = new CdkToolkit({
diff --git a/packages/aws-cdk/test/import.test.ts b/packages/aws-cdk/test/import.test.ts
index 6a4e95487a832..65aef0e50bc48 100644
--- a/packages/aws-cdk/test/import.test.ts
+++ b/packages/aws-cdk/test/import.test.ts
@@ -1,4 +1,3 @@
-/* eslint-disable import/order */
 jest.mock('promptly', () => {
   return {
     ...jest.requireActual('promptly'),
@@ -7,17 +6,23 @@ jest.mock('promptly', () => {
   };
 });
 
+import {
+  CreateChangeSetCommand,
+  DescribeChangeSetCommand,
+  DescribeStacksCommand,
+  GetTemplateCommand,
+  GetTemplateSummaryCommand,
+  StackStatus,
+} from '@aws-sdk/client-cloudformation';
 import * as promptly from 'promptly';
 import { testStack } from './util';
-import { MockSdkProvider } from './util/mock-sdk';
+import { MockSdkProvider, mockCloudFormationClient, restoreSdkMocksToDefault } from './util/mock-sdk';
 import { Deployments } from '../lib/api/deployments';
 import { ResourceImporter, ImportMap } from '../lib/import';
 
 const promptlyConfirm = promptly.confirm as jest.Mock;
 const promptlyPrompt = promptly.prompt as jest.Mock;
 
-let createChangeSetInput: AWS.CloudFormation.CreateChangeSetInput | undefined;
-
 function stackWithQueue(props: Record<string, unknown>) {
   return testStack({
     stackName: 'StackWithQueue',
@@ -69,10 +74,10 @@ function stackWithKeySigningKey(props: Record<string, unknown>) {
 let sdkProvider: MockSdkProvider;
 let deployments: Deployments;
 beforeEach(() => {
+  restoreSdkMocksToDefault();
   jest.resetAllMocks();
-  sdkProvider = new MockSdkProvider({ realSdk: false });
+  sdkProvider = new MockSdkProvider();
   deployments = new Deployments({ sdkProvider });
-  createChangeSetInput = undefined;
 });
 
 test('discovers importable resources', async () => {
@@ -166,13 +171,19 @@ test('asks human to confirm automic import if identifier is in template', async
   // WHEN
   await importer.importResourcesFromMap(importMap, {});
 
-  expect(createChangeSetInput?.ResourcesToImport).toEqual([
-    {
-      LogicalResourceId: 'MyQueue',
-      ResourceIdentifier: { QueueName: 'TheQueueName' },
-      ResourceType: 'AWS::SQS::Queue',
-    },
-  ]);
+  expect(mockCloudFormationClient).toHaveReceivedCommandWith(CreateChangeSetCommand, {
+    ChangeSetName: expect.any(String),
+    StackName: STACK_WITH_QUEUE.stackName,
+    TemplateBody: expect.any(String),
+    ChangeSetType: 'IMPORT',
+    ResourcesToImport: [
+      {
+        LogicalResourceId: 'MyQueue',
+        ResourceIdentifier: { QueueName: 'TheQueueName' },
+        ResourceType: 'AWS::SQS::Queue',
+      },
+    ],
+  });
 });
 
 test('importing resources from migrate strips cdk metadata and outputs', async () => {
@@ -205,18 +216,31 @@ test('importing resources from migrate strips cdk metadata and outputs', async (
 
   givenCurrentStack(stack.stackName, stack);
   const importer = new ResourceImporter(testStack(stack), deployments);
-  const migrateMap = [{
-    LogicalResourceId: 'MyQueue',
-    ResourceIdentifier: { QueueName: 'TheQueueName' },
-    ResourceType: 'AWS::SQS::Queue',
-  }];
+  const migrateMap = [
+    {
+      LogicalResourceId: 'MyQueue',
+      ResourceIdentifier: { QueueName: 'TheQueueName' },
+      ResourceType: 'AWS::SQS::Queue',
+    },
+  ];
 
   // WHEN
   await importer.importResourcesFromMigrate(migrateMap, STACK_WITH_QUEUE.template);
 
   // THEN
-  expect(createChangeSetInput?.ResourcesToImport).toEqual(migrateMap);
-  expect(createChangeSetInput?.TemplateBody).toEqual('Resources:\n  MyQueue:\n    Type: AWS::SQS::Queue\n    Properties: {}\n');
+  expect(mockCloudFormationClient).toHaveReceivedCommandWith(CreateChangeSetCommand, {
+    ChangeSetName: expect.any(String),
+    StackName: STACK_WITH_QUEUE.stackName,
+    TemplateBody: expect.any(String),
+    ChangeSetType: 'IMPORT',
+    ResourcesToImport: [
+      {
+        LogicalResourceId: 'MyQueue',
+        ResourceIdentifier: { QueueName: 'TheQueueName' },
+        ResourceType: 'AWS::SQS::Queue',
+      },
+    ],
+  });
 });
 
 test('only use one identifier if multiple are in template', async () => {
@@ -232,13 +256,19 @@ test('only use one identifier if multiple are in template', async () => {
   await importTemplateFromClean(stack);
 
   // THEN
-  expect(createChangeSetInput?.ResourcesToImport).toEqual([
-    {
-      LogicalResourceId: 'MyTable',
-      ResourceIdentifier: { TableName: 'TheTableName' },
-      ResourceType: 'AWS::DynamoDB::GlobalTable',
-    },
-  ]);
+  expect(mockCloudFormationClient).toHaveReceivedCommandWith(CreateChangeSetCommand, {
+    ChangeSetName: expect.any(String),
+    StackName: stack.stackName,
+    TemplateBody: expect.any(String),
+    ChangeSetType: 'IMPORT',
+    ResourcesToImport: [
+      {
+        LogicalResourceId: 'MyTable',
+        ResourceIdentifier: { TableName: 'TheTableName' },
+        ResourceType: 'AWS::DynamoDB::GlobalTable',
+      },
+    ],
+  });
 });
 
 test('only ask user for one identifier if multiple possible ones are possible', async () => {
@@ -284,13 +314,19 @@ test('take compound identifiers from the template if found', async () => {
   await importTemplateFromClean(stack);
 
   // THEN
-  expect(createChangeSetInput?.ResourcesToImport).toEqual([
-    {
-      LogicalResourceId: 'MyKSK',
-      ResourceIdentifier: { HostedZoneId: 'z-123', Name: 'KeyName' },
-      ResourceType: 'AWS::Route53::KeySigningKey',
-    },
-  ]);
+  expect(mockCloudFormationClient).toHaveReceivedCommandWith(CreateChangeSetCommand, {
+    ChangeSetName: expect.any(String),
+    StackName: stack.stackName,
+    TemplateBody: expect.any(String),
+    ChangeSetType: 'IMPORT',
+    ResourcesToImport: [
+      {
+        LogicalResourceId: 'MyKSK',
+        ResourceIdentifier: { HostedZoneId: 'z-123', Name: 'KeyName' },
+        ResourceType: 'AWS::Route53::KeySigningKey',
+      },
+    ],
+  });
 });
 
 test('ask user for compound identifiers if not found', async () => {
@@ -302,13 +338,19 @@ test('ask user for compound identifiers if not found', async () => {
   await importTemplateFromClean(stack);
 
   // THEN
-  expect(createChangeSetInput?.ResourcesToImport).toEqual([
-    {
-      LogicalResourceId: 'MyKSK',
-      ResourceIdentifier: { HostedZoneId: 'Banana', Name: 'Banana' },
-      ResourceType: 'AWS::Route53::KeySigningKey',
-    },
-  ]);
+  expect(mockCloudFormationClient).toHaveReceivedCommandWith(CreateChangeSetCommand, {
+    ChangeSetName: expect.any(String),
+    StackName: stack.stackName,
+    TemplateBody: expect.any(String),
+    ChangeSetType: 'IMPORT',
+    ResourcesToImport: [
+      {
+        LogicalResourceId: 'MyKSK',
+        ResourceIdentifier: { HostedZoneId: 'Banana', Name: 'Banana' },
+        ResourceType: 'AWS::Route53::KeySigningKey',
+      },
+    ],
+  });
 });
 
 test('do not ask for second part of compound identifier if the user skips the first', async () => {
@@ -336,61 +378,39 @@ async function importTemplateFromClean(stack: ReturnType<typeof testStack>) {
 }
 
 function givenCurrentStack(stackName: string, template: any) {
-  sdkProvider.stubCloudFormation({
-    describeStacks() {
-      return {
-        Stacks: [
-          {
-            StackName: stackName,
-            CreationTime: new Date(),
-            StackStatus: 'UPDATE_COMPLETE',
-            StackStatusReason: 'It is magic',
-            Outputs: [],
-          },
-        ],
-      };
-    },
-    getTemplate() {
-      return {
-        TemplateBody: JSON.stringify(template),
-      };
-    },
-    getTemplateSummary() {
-      return {
-        ResourceIdentifierSummaries: [
-          {
-            ResourceType: 'AWS::SQS::Queue',
-            ResourceIdentifiers: ['QueueName'],
-          },
-          {
-            ResourceType: 'AWS::DynamoDB::GlobalTable',
-            ResourceIdentifiers: ['TableName', 'TableArn', 'TableStreamArn'],
-          },
-          {
-            ResourceType: 'AWS::Route53::KeySigningKey',
-            ResourceIdentifiers: ['HostedZoneId,Name'],
-          },
-        ],
-      };
-    },
-    deleteChangeSet() {
-      return {};
-    },
-    createChangeSet(request) {
-      createChangeSetInput = request;
-      return {};
-    },
-    describeChangeSet() {
-      return {
-        Status: 'CREATE_COMPLETE',
-        Changes: [],
-      };
-    },
-    executeChangeSet() {
-      return {};
-    },
-    describeStackEvents() {
-      return {};
-    },
+  mockCloudFormationClient.on(DescribeStacksCommand).resolves({
+    Stacks: [
+      {
+        StackName: stackName,
+        CreationTime: new Date(),
+        StackStatus: StackStatus.UPDATE_COMPLETE,
+        StackStatusReason: 'It is magic',
+        Outputs: [],
+      },
+    ],
+  });
+  mockCloudFormationClient.on(GetTemplateCommand).resolves({
+    TemplateBody: JSON.stringify(template),
+  });
+  mockCloudFormationClient.on(GetTemplateSummaryCommand).resolves({
+    ResourceIdentifierSummaries: [
+      {
+        ResourceType: 'AWS::SQS::Queue',
+        ResourceIdentifiers: ['QueueName'],
+      },
+      {
+        ResourceType: 'AWS::DynamoDB::GlobalTable',
+        ResourceIdentifiers: ['TableName', 'TableArn', 'TableStreamArn'],
+      },
+      {
+        ResourceType: 'AWS::Route53::KeySigningKey',
+        ResourceIdentifiers: ['HostedZoneId,Name'],
+      },
+    ],
+  });
+  
+  mockCloudFormationClient.on(DescribeChangeSetCommand).resolves({
+    Status: StackStatus.CREATE_COMPLETE,
+    Changes: [],
   });
 }
diff --git a/packages/aws-cdk/test/util.ts b/packages/aws-cdk/test/util.ts
index 1f059836d670d..60eacd08662fb 100644
--- a/packages/aws-cdk/test/util.ts
+++ b/packages/aws-cdk/test/util.ts
@@ -1,12 +1,10 @@
-/* eslint-disable import/order */
 import * as fs from 'fs';
 import * as path from 'path';
-import * as cxschema from '@aws-cdk/cloud-assembly-schema';
-import { AssetManifest } from '@aws-cdk/cloud-assembly-schema';
-import * as cxapi from '@aws-cdk/cx-api';
+import { ArtifactMetadataEntryType, ArtifactType, type AssetManifest, type AssetMetadataEntry, type AwsCloudFormationStackProperties, type MetadataEntry, type MissingContext } from '@aws-cdk/cloud-assembly-schema';
 import { MockSdkProvider } from './util/mock-sdk';
 import { CloudExecutable } from '../lib/api/cxapp/cloud-executable';
 import { Configuration } from '../lib/settings';
+import { type CloudAssembly, CloudAssemblyBuilder, type CloudFormationStackArtifact, type StackMetadata } from '@aws-cdk/cx-api';
 
 export const DEFAULT_FAKE_TEMPLATE = { No: 'Resources' };
 
@@ -15,12 +13,12 @@ export interface TestStackArtifact {
   template?: any;
   env?: string;
   depends?: string[];
-  metadata?: cxapi.StackMetadata;
+  metadata?: StackMetadata;
   notificationArns?: string[];
 
   /** Old-style assets */
-  assets?: cxschema.AssetMetadataEntry[];
-  properties?: Partial<cxschema.AwsCloudFormationStackProperties>;
+  assets?: AssetMetadataEntry[];
+  properties?: Partial<AwsCloudFormationStackProperties>;
   terminationProtection?: boolean;
   displayName?: string;
 
@@ -30,7 +28,7 @@ export interface TestStackArtifact {
 
 export interface TestAssembly {
   stacks: TestStackArtifact[];
-  missing?: cxschema.MissingContext[];
+  missing?: MissingContext[];
   nestedAssemblies?: TestAssembly[];
 }
 
@@ -57,7 +55,7 @@ function clone(obj: any) {
   return JSON.parse(JSON.stringify(obj));
 }
 
-function addAttributes(assembly: TestAssembly, builder: cxapi.CloudAssemblyBuilder) {
+function addAttributes(assembly: TestAssembly, builder: CloudAssemblyBuilder) {
   for (const stack of assembly.stacks) {
     const templateFile = `${stack.stackName}.template.json`;
     const template = stack.template ?? DEFAULT_FAKE_TEMPLATE;
@@ -66,25 +64,23 @@ function addAttributes(assembly: TestAssembly, builder: cxapi.CloudAssemblyBuild
 
     // we call patchStackTags here to simulate the tags formatter
     // that is used when building real manifest files.
-    const metadata: { [path: string]: cxschema.MetadataEntry[] } = patchStackTags({ ...stack.metadata });
+    const metadata: { [path: string]: MetadataEntry[] } = patchStackTags({ ...stack.metadata });
     for (const asset of stack.assets || []) {
-      metadata[asset.id] = [
-        { type: cxschema.ArtifactMetadataEntryType.ASSET, data: asset },
-      ];
+      metadata[asset.id] = [{ type: ArtifactMetadataEntryType.ASSET, data: asset }];
     }
 
     for (const missing of assembly.missing || []) {
       builder.addMissing(missing);
     }
 
-    const dependencies = [...stack.depends ?? []];
+    const dependencies = [...(stack.depends ?? [])];
 
     if (stack.assetManifest) {
       const manifestFile = `${stack.stackName}.assets.json`;
       fs.writeFileSync(path.join(builder.outdir, manifestFile), JSON.stringify(stack.assetManifest, undefined, 2));
       dependencies.push(`${stack.stackName}.assets`);
       builder.addArtifact(`${stack.stackName}.assets`, {
-        type: cxschema.ArtifactType.ASSET_MANIFEST,
+        type: ArtifactType.ASSET_MANIFEST,
         environment: stack.env || 'aws://123456789012/here',
         properties: {
           file: manifestFile,
@@ -93,7 +89,7 @@ function addAttributes(assembly: TestAssembly, builder: cxapi.CloudAssemblyBuild
     }
 
     builder.addArtifact(stack.stackName, {
-      type: cxschema.ArtifactType.AWS_CLOUDFORMATION_STACK,
+      type: ArtifactType.AWS_CLOUDFORMATION_STACK,
       environment: stack.env || 'aws://123456789012/here',
 
       dependencies,
@@ -106,7 +102,6 @@ function addAttributes(assembly: TestAssembly, builder: cxapi.CloudAssemblyBuild
       },
       displayName: stack.displayName,
     });
-
   }
 }
 
@@ -129,8 +124,8 @@ function addNestedStacks(templatePath: string, outdir: string, rootStackTemplate
   }
 }
 
-export function testAssembly(assembly: TestAssembly): cxapi.CloudAssembly {
-  const builder = new cxapi.CloudAssemblyBuilder();
+export function testAssembly(assembly: TestAssembly): CloudAssembly {
+  const builder = new CloudAssemblyBuilder();
   addAttributes(assembly, builder);
 
   if (assembly.nestedAssemblies != null && assembly.nestedAssemblies.length > 0) {
@@ -151,14 +146,14 @@ export function testAssembly(assembly: TestAssembly): cxapi.CloudAssembly {
  *
  * @see aws-cdk-lib/lib/stack.ts
  */
-function patchStackTags(metadata: { [path: string]: cxschema.MetadataEntry[] }): { [path: string]: cxschema.MetadataEntry[] } {
-
-  const cloned = clone(metadata) as { [path: string]: cxschema.MetadataEntry[] };
+function patchStackTags(metadata: { [path: string]: MetadataEntry[] }): {
+  [path: string]: MetadataEntry[];
+} {
+  const cloned = clone(metadata) as { [path: string]: MetadataEntry[] };
 
   for (const metadataEntries of Object.values(cloned)) {
     for (const metadataEntry of metadataEntries) {
-      if (metadataEntry.type === cxschema.ArtifactMetadataEntryType.STACK_TAGS && metadataEntry.data) {
-
+      if (metadataEntry.type === ArtifactMetadataEntryType.STACK_TAGS && metadataEntry.data) {
         const metadataAny = metadataEntry as any;
 
         metadataAny.data = metadataAny.data.map((t: any) => {
@@ -170,7 +165,7 @@ function patchStackTags(metadata: { [path: string]: cxschema.MetadataEntry[] }):
   return cloned;
 }
 
-export function testStack(stack: TestStackArtifact): cxapi.CloudFormationStackArtifact {
+export function testStack(stack: TestStackArtifact): CloudFormationStackArtifact {
   const assembly = testAssembly({ stacks: [stack] });
   return assembly.getStackByName(stack.stackName);
 }
@@ -193,34 +188,11 @@ export function instanceMockFrom<A>(ctr: new (...args: any[]) => A): jest.Mocked
   return ret;
 }
 
-/**
- * Run an async block with a class (constructor) replaced with a mock
- *
- * The class constructor will be replaced with a constructor that returns
- * a singleton, and the singleton will be passed to the block so that its
- * methods can be mocked individually.
- *
- * Uses `instanceMockFrom` so is subject to the same limitations that hold
- * for that function.
- */
-export async function withMockedClassSingleton<A extends object, K extends keyof A, B>(
+export function withMocked<A extends object, K extends keyof A, B>(
   obj: A,
   key: K,
-  cb: (mock: A[K] extends jest.Constructable ? jest.Mocked<InstanceType<A[K]>> : never) => Promise<B>,
-): Promise<B> {
-
-  const original = obj[key];
-  try {
-    const mock = instanceMockFrom(original as any);
-    obj[key] = jest.fn().mockReturnValue(mock) as any;
-    const ret = await cb(mock as any);
-    return ret;
-  } finally {
-    obj[key] = original;
-  }
-}
-
-export function withMocked<A extends object, K extends keyof A, B>(obj: A, key: K, block: (fn: jest.Mocked<A>[K]) => B): B {
+  block: (fn: jest.Mocked<A>[K]) => B,
+): B {
   const original = obj[key];
   const mockFn = jest.fn();
   (obj as any)[key] = mockFn;
@@ -228,10 +200,14 @@ export function withMocked<A extends object, K extends keyof A, B>(obj: A, key:
   let asyncFinally: boolean = false;
   try {
     const ret = block(mockFn as any);
-    if (!isPromise(ret)) { return ret; }
+    if (!isPromise(ret)) {
+      return ret;
+    }
 
     asyncFinally = true;
-    return ret.finally(() => { obj[key] = original; }) as any;
+    return ret.finally(() => {
+      obj[key] = original;
+    }) as any;
   } finally {
     if (!asyncFinally) {
       obj[key] = original;
@@ -244,5 +220,5 @@ function isPromise<A>(object: any): object is Promise<A> {
 }
 
 export async function sleep(ms: number) {
-  return new Promise(ok => setTimeout(ok, ms));
+  return new Promise((ok) => setTimeout(ok, ms));
 }
diff --git a/packages/aws-cdk/test/util/awscli-compatible.test.ts b/packages/aws-cdk/test/util/awscli-compatible.test.ts
deleted file mode 100644
index 3970cc9d9181b..0000000000000
--- a/packages/aws-cdk/test/util/awscli-compatible.test.ts
+++ /dev/null
@@ -1,48 +0,0 @@
-/* eslint-disable import/order */
-import * as AWS from 'aws-sdk';
-import { AwsCliCompatible } from '../../lib/api/aws-auth/awscli-compatible';
-import { withMockedClassSingleton } from '../util';
-
-beforeEach(() => {
-  // Set to paths that don't exist so the SDK doesn't accidentally load this config
-  process.env.AWS_CONFIG_FILE = '/home/dummydummy/.bxt/config';
-  process.env.AWS_SHARED_CREDENTIALS_FILE = '/home/dummydummy/.bxt/credentials';
-  // Scrub some environment variables that might be set if we're running on CodeBuild which will interfere with the tests.
-  delete process.env.AWS_REGION;
-  delete process.env.AWS_DEFAULT_REGION;
-  delete process.env.AWS_ACCESS_KEY_ID;
-  delete process.env.AWS_SECRET_ACCESS_KEY;
-  delete process.env.AWS_SESSION_TOKEN;
-});
-
-test('on an EC2 instance, region lookup queries IMDS', async () => {
-  return withMockedClassSingleton(AWS, 'MetadataService', async (mdService) => {
-    mdService.request
-      // First call for a token
-      .mockImplementationOnce((_1, _2, cb) => { cb(undefined as any, 'token'); })
-      // Second call for the region
-      .mockImplementationOnce((_1, _2, cb) => { cb(undefined as any, JSON.stringify({ region: 'some-region' })); });
-
-    const region = await AwsCliCompatible.region({ ec2instance: true });
-    expect(region).toEqual('some-region');
-  });
-});
-
-test('Use web identity when available', async () => {
-
-  // Scrub some environment variables that are maybe set for Ecs Credentials
-  delete process.env.ECS_CONTAINER_METADATA_URI_V4;
-  delete process.env.ECS_CONTAINER_METADATA_URI;
-  delete process.env.AWS_CONTAINER_CREDENTIALS_RELATIVE_URI;
-
-  // create and configure the web identity token file
-  process.env.AWS_WEB_IDENTITY_TOKEN_FILE = 'some-value';
-  process.env.AWS_ROLE_ARN = 'some-value';
-
-  // create the chain
-  const providers = (await AwsCliCompatible.credentialChain()).providers;
-
-  // make sure the web identity provider is in the chain
-  const webIdentify = (providers[5] as Function)();
-  expect(webIdentify).toBeInstanceOf(AWS.TokenFileWebIdentityCredentials);
-});
diff --git a/packages/aws-cdk/test/util/cloudformation.test.ts b/packages/aws-cdk/test/util/cloudformation.test.ts
index 81aab7eb93549..b42de6fe1da41 100644
--- a/packages/aws-cdk/test/util/cloudformation.test.ts
+++ b/packages/aws-cdk/test/util/cloudformation.test.ts
@@ -1,6 +1,7 @@
-/* eslint-disable import/order */
 import { SSMPARAM_NO_INVALIDATE } from '@aws-cdk/cx-api';
-import { MockedObject, MockSdkProvider, SyncHandlerSubsetOf } from './mock-sdk';
+import { DescribeStacksCommand, GetTemplateCommand, StackStatus } from '@aws-sdk/client-cloudformation';
+import { MockSdk, mockCloudFormationClient } from './mock-sdk';
+import type { ICloudFormationClient } from '../../lib';
 import { CloudFormationStack, TemplateParameters } from '../../lib/api/util/cloudformation';
 
 const PARAM = 'TheParameter';
@@ -10,27 +11,17 @@ const OVERRIDE = 'TheOverride';
 const USE_OVERRIDE = { ParameterKey: PARAM, ParameterValue: OVERRIDE };
 const USE_PREVIOUS = { ParameterKey: PARAM, UsePreviousValue: true };
 
-let sdkProvider: MockSdkProvider;
-let describeStackMock: jest.Mock;
-let getTemplateMock: jest.Mock;
-let cfnMocks: MockedObject<SyncHandlerSubsetOf<AWS.CloudFormation>>;
-let cfn: AWS.CloudFormation;
+let cfn: ICloudFormationClient;
+
 beforeEach(async () => {
-  sdkProvider = new MockSdkProvider();
-
-  describeStackMock = jest.fn();
-  getTemplateMock = jest.fn();
-  cfnMocks = {
-    describeStacks: describeStackMock,
-    getTemplate: getTemplateMock,
-  };
-  sdkProvider.stubCloudFormation(cfnMocks as any);
-  cfn = (await sdkProvider.forEnvironment()).sdk.cloudFormation();
+  cfn = new MockSdk().cloudFormation();
 });
 
 test('A non-existent stack pretends to have an empty template', async () => {
   // GIVEN
-  describeStackMock.mockImplementation(() => ({ Stacks: [] })); // No stacks exist
+  mockCloudFormationClient.on(DescribeStacksCommand).resolves({
+    Stacks: [],
+  });
 
   // WHEN
   const stack = await CloudFormationStack.lookup(cfn, 'Dummy');
@@ -41,16 +32,21 @@ test('A non-existent stack pretends to have an empty template', async () => {
 
 test("Retrieving a processed template passes 'Processed' to CloudFormation", async () => {
   // GIVEN
-  describeStackMock.mockImplementation(() => ({
-    Stacks: [
-      {
-        StackName: 'Dummy',
-      },
-    ],
-  }));
-  getTemplateMock.mockImplementation(() => ({
-    TemplateBody: '{}',
-  }));
+  mockCloudFormationClient
+    .on(DescribeStacksCommand)
+    .resolves({
+      Stacks: [
+        {
+          StackName: 'Dummy',
+          StackStatus: StackStatus.CREATE_COMPLETE,
+          CreationTime: new Date(),
+        },
+      ],
+    })
+    .on(GetTemplateCommand)
+    .resolves({
+      TemplateBody: '',
+    });
 
   // WHEN
   const retrieveProcessedTemplate = true;
@@ -58,7 +54,7 @@ test("Retrieving a processed template passes 'Processed' to CloudFormation", asy
   await cloudFormationStack.template();
 
   // THEN
-  expect(getTemplateMock).toHaveBeenCalledWith({
+  expect(mockCloudFormationClient).toHaveReceivedCommandWith(GetTemplateCommand, {
     StackName: 'Dummy',
     TemplateStage: 'Processed',
   });
@@ -69,13 +65,15 @@ test.each([
   [false, true],
   [true, false],
   [true, true],
-])('given override, always use the override (parameter has a default: %p, parameter previously supplied: %p)',
+])(
+  'given override, always use the override (parameter has a default: %p, parameter previously supplied: %p)',
   (haveDefault, havePrevious) => {
     expect(makeParams(haveDefault, havePrevious, true)).toEqual({
       apiParameters: [USE_OVERRIDE],
       changed: true,
     });
-  });
+  },
+);
 
 test('no default, no prev, no override => error', () => {
   expect(() => makeParams(false, false, false)).toThrow(/missing a value: TheParameter/);
diff --git a/packages/aws-cdk/test/util/mock-sdk.ts b/packages/aws-cdk/test/util/mock-sdk.ts
index d280ef9f02942..1bbbc55091941 100644
--- a/packages/aws-cdk/test/util/mock-sdk.ts
+++ b/packages/aws-cdk/test/util/mock-sdk.ts
@@ -1,343 +1,160 @@
-/* eslint-disable import/order */
-import * as cxapi from '@aws-cdk/cx-api';
-import * as AWS from 'aws-sdk';
-import { Account, ISDK, SDK, SdkProvider, SdkForEnvironment } from '../../lib/api/aws-auth';
-import { Mode } from '../../lib/api/aws-auth/credentials';
-import { ToolkitInfo } from '../../lib/api/toolkit-info';
+import 'aws-sdk-client-mock-jest';
+import { Environment } from '@aws-cdk/cx-api';
+import { AppSyncClient } from '@aws-sdk/client-appsync';
+import { CloudFormationClient, Stack, StackStatus } from '@aws-sdk/client-cloudformation';
+import { CloudWatchLogsClient } from '@aws-sdk/client-cloudwatch-logs';
+import { CodeBuildClient } from '@aws-sdk/client-codebuild';
+import { EC2Client } from '@aws-sdk/client-ec2';
+import { ECRClient } from '@aws-sdk/client-ecr';
+import { ECSClient } from '@aws-sdk/client-ecs';
+import { ElasticLoadBalancingV2Client } from '@aws-sdk/client-elastic-load-balancing-v2';
+import { IAMClient } from '@aws-sdk/client-iam';
+import { KMSClient } from '@aws-sdk/client-kms';
+import { LambdaClient } from '@aws-sdk/client-lambda';
+import { Route53Client } from '@aws-sdk/client-route-53';
+import { S3Client } from '@aws-sdk/client-s3';
+import { SecretsManagerClient } from '@aws-sdk/client-secrets-manager';
+import { SFNClient } from '@aws-sdk/client-sfn';
+import { SSMClient } from '@aws-sdk/client-ssm';
+import { AssumeRoleCommand, GetCallerIdentityCommand, STSClient } from '@aws-sdk/client-sts';
+import { createCredentialChain } from '@aws-sdk/credential-providers';
+import { AwsCredentialIdentity } from '@smithy/types';
+import { mockClient } from 'aws-sdk-client-mock';
+import { Account } from 'cdk-assets';
+import { SDK, SdkProvider } from '../../lib';
 import { CloudFormationStack } from '../../lib/api/util/cloudformation';
 
-const FAKE_CREDENTIALS = new AWS.Credentials({ accessKeyId: 'ACCESS', secretAccessKey: 'SECRET', sessionToken: 'TOKEN ' });
+export const FAKE_CREDENTIALS: AwsCredentialIdentity = {
+  accessKeyId: 'ACCESS',
+  secretAccessKey: 'SECRET',
+  sessionToken: 'TOKEN ',
+};
+
+const FAKE_CREDENTIAL_CHAIN = createCredentialChain(() => Promise.resolve(FAKE_CREDENTIALS));
+
+// Default implementations
+export const mockAppSyncClient = mockClient(AppSyncClient);
+export const mockCloudFormationClient = mockClient(CloudFormationClient);
+export const mockCloudWatchClient = mockClient(CloudWatchLogsClient);
+export const mockCodeBuildClient = mockClient(CodeBuildClient);
+export const mockEC2Client = mockClient(EC2Client);
+export const mockECRClient = mockClient(ECRClient);
+export const mockECSClient = mockClient(ECSClient);
+export const mockElasticLoadBalancingV2Client = mockClient(ElasticLoadBalancingV2Client);
+export const mockIAMClient = mockClient(IAMClient);
+export const mockKMSClient = mockClient(KMSClient);
+export const mockLambdaClient = mockClient(LambdaClient);
+export const mockRoute53Client = mockClient(Route53Client);
+export const mockS3Client = mockClient(S3Client);
+export const mockSecretsManagerClient = mockClient(SecretsManagerClient);
+export const mockSSMClient = mockClient(SSMClient);
+export const mockStepFunctionsClient = mockClient(SFNClient);
+export const mockSTSClient = mockClient(STSClient);
 
-const FAKE_CREDENTIAL_CHAIN = new AWS.CredentialProviderChain([
-  () => FAKE_CREDENTIALS,
-]);
-
-export interface MockSdkProviderOptions {
-  /**
-   * Whether the mock provider should produce a real SDK
-   *
-   * Some tests require a real SDK because they use `AWS-mock` to replace
-   * the underlying calls. Other tests do their work completely using jest-mocks.
-   *
-   * @default true
-   */
-  readonly realSdk?: boolean;
-}
+/**
+ * Resets clients back to defaults and resets the history
+ * of usage of the mock.
+ */
+export const restoreSdkMocksToDefault = () => {
+  mockAppSyncClient.reset();
+  mockAppSyncClient.onAnyCommand().resolves({});
+  mockCloudFormationClient.reset();
+  mockCloudFormationClient.onAnyCommand().resolves({});
+  mockCloudWatchClient.reset();
+  mockCloudWatchClient.onAnyCommand().resolves({});
+  mockCodeBuildClient.reset();
+  mockCodeBuildClient.onAnyCommand().resolves({});
+  mockEC2Client.reset();
+  mockEC2Client.onAnyCommand().resolves({});
+  mockECRClient.reset();
+  mockECRClient.onAnyCommand().resolves({});
+  mockECSClient.reset();
+  mockECSClient.onAnyCommand().resolves({});
+  mockElasticLoadBalancingV2Client.reset();
+  mockElasticLoadBalancingV2Client.onAnyCommand().resolves({});
+  mockIAMClient.reset();
+  mockIAMClient.onAnyCommand().resolves({});
+  mockKMSClient.reset();
+  mockKMSClient.onAnyCommand().resolves({});
+  mockLambdaClient.reset();
+  mockLambdaClient.onAnyCommand().resolves({});
+  mockRoute53Client.reset();
+  mockRoute53Client.onAnyCommand().resolves({});
+  mockS3Client.reset();
+  mockS3Client.onAnyCommand().resolves({});
+  mockSecretsManagerClient.reset();
+  mockSecretsManagerClient.onAnyCommand().resolves({});
+  mockSSMClient.reset();
+  mockSSMClient.onAnyCommand().resolves({});
+  mockStepFunctionsClient.reset();
+  mockSSMClient.onAnyCommand().resolves({});
+  mockSTSClient.reset();
+};
+
+export const setDefaultSTSMocks = () => {
+  mockSTSClient.on(GetCallerIdentityCommand).resolves({
+    Account: '123456789012',
+    Arn: 'aws:swa:123456789012:some-other-stuff',
+  });
+  mockSTSClient.on(AssumeRoleCommand).resolves({
+    Credentials: {
+      AccessKeyId: FAKE_CREDENTIALS.accessKeyId,
+      SecretAccessKey: FAKE_CREDENTIALS.secretAccessKey,
+      SessionToken: FAKE_CREDENTIALS.sessionToken,
+      Expiration: new Date(Date.now() + 3600 * 1000),
+    },
+  });
+};
 
 /**
- * An SDK that allows replacing (some of) the clients
+ * MockSdkProvider that is mostly SdkProvider but
+ * with fake credentials and account information.
  *
- * It's the responsibility of the consumer to replace all calls that
- * actually will be called.
+ * For mocking the actual clients, the above mocking
+ * clients may be used.
  */
 export class MockSdkProvider extends SdkProvider {
-  public readonly sdk: ISDK;
-  private readonly _mockSdk?: MockSdk;
-
-  constructor(options: MockSdkProviderOptions = {}) {
-    super(FAKE_CREDENTIAL_CHAIN, 'bermuda-triangle-1337', { customUserAgent: 'aws-cdk/jest' });
-
-    // SDK contains a real SDK, since some test use 'AWS-mock' to replace the underlying
-    // AWS calls which a real SDK would do, and some tests use the 'stub' functionality below.
-    if (options.realSdk ?? true) {
-      this.sdk = new SDK(FAKE_CREDENTIALS, this.defaultRegion, { customUserAgent: 'aws-cdk/jest' });
-    } else {
-      this.sdk = this._mockSdk = new MockSdk();
-    }
-  }
-
-  public get mockSdk(): MockSdk {
-    if (!this._mockSdk) {
-      throw new Error('MockSdkProvider was not created with \'realSdk: false\'');
-    }
-    return this._mockSdk;
-  }
-
-  async baseCredentialsPartition(_environment: cxapi.Environment, _mode: Mode): Promise<string | undefined> {
-    return undefined;
+  constructor() {
+    super(FAKE_CREDENTIAL_CHAIN, 'bermuda-triangle-1337');
   }
 
   public defaultAccount(): Promise<Account | undefined> {
     return Promise.resolve({ accountId: '123456789012', partition: 'aws' });
   }
-
-  public forEnvironment(): Promise<SdkForEnvironment> {
-    return Promise.resolve({ sdk: this.sdk, didAssumeRole: true });
-  }
-
-  /**
-   * Replace the CloudFormation client with the given object
-   */
-  public stubCloudFormation(stubs: SyncHandlerSubsetOf<AWS.CloudFormation>) {
-    (this.sdk as any).cloudFormation = jest.fn().mockReturnValue(partialAwsService<AWS.CloudFormation>(stubs));
-  }
-
-  /**
-   * Replace the ECR client with the given object
-   */
-  public stubEcr(stubs: SyncHandlerSubsetOf<AWS.ECR>) {
-    (this.sdk as any).ecr = jest.fn().mockReturnValue(partialAwsService<AWS.ECR>(stubs));
-  }
-
-  public stubEcs(stubs: SyncHandlerSubsetOf<AWS.ECS>, additionalProperties: { [key: string]: any } = {}) {
-    (this.sdk as any).ecs = jest.fn().mockReturnValue(partialAwsService<AWS.ECS>(stubs, additionalProperties));
-  }
-
-  /**
-   * Replace the S3 client with the given object
-   */
-  public stubS3(stubs: SyncHandlerSubsetOf<AWS.S3>) {
-    (this.sdk as any).s3 = jest.fn().mockReturnValue(partialAwsService<AWS.S3>(stubs));
-  }
-
-  /**
-   * Replace the STS client with the given object
-   */
-  public stubSTS(stubs: SyncHandlerSubsetOf<AWS.STS>) {
-    (this.sdk as any).sts = jest.fn().mockReturnValue(partialAwsService<AWS.STS>(stubs));
-  }
-
-  /**
-   * Replace the ELBv2 client with the given object
-   */
-  public stubELBv2(stubs: SyncHandlerSubsetOf<AWS.ELBv2>) {
-    (this.sdk as any).elbv2 = jest.fn().mockReturnValue(partialAwsService<AWS.ELBv2>(stubs));
-  }
-
-  /**
-   * Replace the SSM client with the given object
-   */
-  public stubSSM(stubs: SyncHandlerSubsetOf<AWS.SSM>) {
-    (this.sdk as any).ssm = jest.fn().mockReturnValue(partialAwsService<AWS.SSM>(stubs));
-  }
-
-  public stubLambda(stubs: SyncHandlerSubsetOf<AWS.Lambda>, additionalProperties: { [key: string]: any } = {}) {
-    (this.sdk as any).lambda = jest.fn().mockReturnValue(partialAwsService<AWS.Lambda>(stubs, additionalProperties));
-  }
-
-  public stubIam(stubs: SyncHandlerSubsetOf<AWS.IAM>, additionalProperties: { [key: string]: any } = {}) {
-    (this.sdk as any).iam = jest.fn().mockReturnValue(partialAwsService<AWS.IAM>(stubs, additionalProperties));
-  }
-
-  public stubStepFunctions(stubs: SyncHandlerSubsetOf<AWS.StepFunctions>) {
-    (this.sdk as any).stepFunctions = jest.fn().mockReturnValue(partialAwsService<AWS.StepFunctions>(stubs));
-  }
-
-  public stubCodeBuild(stubs: SyncHandlerSubsetOf<AWS.CodeBuild>) {
-    (this.sdk as any).codeBuild = jest.fn().mockReturnValue(partialAwsService<AWS.CodeBuild>(stubs));
-  }
-
-  public stubCloudWatchLogs(stubs: SyncHandlerSubsetOf<AWS.CloudWatchLogs>) {
-    (this.sdk as any).cloudWatchLogs = jest.fn().mockReturnValue(partialAwsService<AWS.CloudWatchLogs>(stubs));
-  }
-
-  public stubAppSync(stubs: SyncHandlerSubsetOf<AWS.AppSync>) {
-    (this.sdk as any).appsync = jest.fn().mockReturnValue(partialAwsService<AWS.AppSync>(stubs));
-  }
-
-  public stubGetEndpointSuffix(stub: () => string) {
-    this.sdk.getEndpointSuffix = stub;
-  }
-}
-
-export class MockSdk implements ISDK {
-  public readonly currentRegion: string = 'bermuda-triangle-1337';
-  public readonly lambda = jest.fn();
-  public readonly iam = jest.fn();
-  public readonly cloudFormation = jest.fn();
-  public readonly ec2 = jest.fn();
-  public readonly ssm = jest.fn();
-  public readonly s3 = jest.fn();
-  public readonly route53 = jest.fn();
-  public readonly ecr = jest.fn();
-  public readonly ecs = jest.fn();
-  public readonly elbv2 = jest.fn();
-  public readonly secretsManager = jest.fn();
-  public readonly kms = jest.fn();
-  public readonly stepFunctions = jest.fn();
-  public readonly codeBuild = jest.fn();
-  public readonly cloudWatchLogs = jest.fn();
-  public readonly appsync = jest.fn();
-  public readonly getEndpointSuffix = jest.fn();
-  public readonly appendCustomUserAgent = jest.fn();
-  public readonly removeCustomUserAgent = jest.fn();
-
-  public currentAccount(): Promise<Account> {
-    return Promise.resolve({ accountId: '123456789012', partition: 'aws' });
-  }
-
-  /**
-   * Replace the CloudFormation client with the given object
-   */
-  public stubCloudFormation(stubs: SyncHandlerSubsetOf<AWS.CloudFormation>) {
-    this.cloudFormation.mockReturnValue(partialAwsService<AWS.CloudFormation>(stubs));
-  }
-
-  /**
-   * Replace the CloudWatch client with the given object
-   */
-  public stubCloudWatchLogs(stubs: SyncHandlerSubsetOf<AWS.CloudWatchLogs>) {
-    this.cloudWatchLogs.mockReturnValue(partialAwsService<AWS.CloudWatchLogs>(stubs));
-  }
-
-  /**
-   * Replace the AppSync client with the given object
-   */
-  public stubAppSync(stubs: SyncHandlerSubsetOf<AWS.AppSync>) {
-    this.appsync.mockReturnValue(partialAwsService<AWS.AppSync>(stubs));
-  }
-
-  /**
-   * Replace the ECR client with the given object
-   */
-  public stubEcr(stubs: SyncHandlerSubsetOf<AWS.ECR>) {
-    this.ecr.mockReturnValue(partialAwsService<AWS.ECR>(stubs));
-  }
-
-  /**
-   * Replace the SSM client with the given object
-   */
-  public stubSsm(stubs: SyncHandlerSubsetOf<AWS.SSM>) {
-    this.ssm.mockReturnValue(partialAwsService<AWS.SSM>(stubs));
-  }
-
-  /**
-   * Replace the getEndpointSuffix client with the given object
-   */
-  public stubGetEndpointSuffix(stub: () => string) {
-    this.getEndpointSuffix.mockReturnValue(stub());
-  }
 }
 
 /**
- * Wrap synchronous fake handlers so that they sort-of function like a real AWS client
- *
- * For example, turns an object like this:
- *
- * ```ts
- * {
- *   someCall(opts: AWS.Service.SomeCallInput): AWS.Service.SomeCallOutput {
- *     return {...whatever...};
- *   }
- * }
- * ```
- *
- * Into an object that in the type system pretends to be an 'AWS.Service'
- * class (even though it really isn't) and can be called like this:
- *
- * ```ts
- * const service = await sdk.someService(...);
- * const response = await service.someCall(...).promise();
- * ```
- *
- * We only implement the narrow subset of the AWS SDK API that the CDK actually
- * uses, and we cheat on the types to make TypeScript happy on the rest of the API.
- *
- * Most important feature of this class is that it will derive the input and output
- * types of the handlers on the input object from the ACTUAL AWS Service class,
- * so that you don't have to declare them.
+ * MockSdk that is mostly just the SDK but with fake
+ * credentials and a full set of default client mocks.
+ * These individual functions within those clients can be
+ * customized in the test file that uses it.
  */
-function partialAwsService<S>(fns: SyncHandlerSubsetOf<S>, additionalProperties: { [key: string]: any } = {}): S {
-  // Super unsafe in here because I don't know how to make TypeScript happy,
-  // but at least the outer types make sure everything that happens in here works out.
-  const ret: any = {};
-
-  for (const [key, handler] of Object.entries(fns)) {
-    ret[key] = (args: any) => new FakeAWSResponse((handler as any)(args));
+export class MockSdk extends SDK {
+  constructor() {
+    restoreSdkMocksToDefault();
+    super(FAKE_CREDENTIALS, 'bermuda-triangle-1337', {});
   }
-  for (const [key, value] of Object.entries(additionalProperties)) {
-    ret[key] = value;
-  }
-
-  return ret;
 }
 
-// Because of the overloads an AWS handler type looks like this:
-//
-//   {
-//      (params: INPUTSTRUCT, callback?: ((err: AWSError, data: {}) => void) | undefined): Request<OUTPUT, ...>;
-//      (callback?: ((err: AWS.AWSError, data: {}) => void) | undefined): AWS.Request<...>;
-//   }
-//
-// Get the first overload and extract the input and output struct types
-type AwsCallInputOutput<T> =
-    T extends {
-      (args: infer INPUT, callback?: ((err: AWS.AWSError, data: any) => void) | undefined): AWS.Request<infer OUTPUT, AWS.AWSError>;
-      (callback?: ((err: AWS.AWSError, data: {}) => void) | undefined): AWS.Request<any, any>;
-    } ? [INPUT, OUTPUT] : T;
-
-// Determine the type of the mock handler from the type of the Input/Output type pair.
-// Don't need to worry about the 'never', TypeScript will propagate it upwards making it
-// impossible to specify the field that has 'never' anywhere in its type.
-type HandlerType<AI> =
-    AI extends [any, any] ? (input: AI[0]) => AI[1] : AI;
-
-// Any subset of the full type that synchronously returns the output structure is okay
-export type SyncHandlerSubsetOf<S> = {[K in keyof S]?: HandlerType<AwsCallInputOutput<S[K]>>};
-
-/**
- * A jest Mock function we can pass into SdkProvider.stubXXX
- *
- * Use as follows:
- *
- * ```ts
- * const mockDescribeStackEvents: MockedHandlerType<CloudFormation['describeStackEvents']> = jest.fn();
- */
-export type MockedHandlerType<F> = AwsCallInputOutput<F> extends [infer IN, infer OUT] ? jest.Mock<OUT, [IN]> : never;
-
-/**
- * Fake AWS response.
- *
- * We only ever 'await response.promise()' so that's the only thing we implement here.
- */
-class FakeAWSResponse<T> {
-  constructor(private readonly x: T) {
-  }
-
-  public promise(): Promise<T> {
-    return Promise.resolve(this.x);
-  }
-}
-
-export function mockBootstrapStack(sdk: ISDK | undefined, stack?: Partial<AWS.CloudFormation.Stack>) {
-  return CloudFormationStack.fromStaticInformation((sdk ?? new MockSdk()).cloudFormation(), 'CDKToolkit', {
+export function mockBootstrapStack(stack?: Partial<Stack>) {
+  return CloudFormationStack.fromStaticInformation(new MockSdk().cloudFormation(), 'CDKToolkit', {
     CreationTime: new Date(),
     StackName: 'CDKToolkit',
-    StackStatus: 'CREATE_COMPLETE',
+    StackStatus: StackStatus.CREATE_COMPLETE,
     ...stack,
     Outputs: [
       { OutputKey: 'BucketName', OutputValue: 'BUCKET_NAME' },
       { OutputKey: 'BucketDomainName', OutputValue: 'BUCKET_ENDPOINT' },
       { OutputKey: 'BootstrapVersion', OutputValue: '1' },
-      ...stack?.Outputs ?? [],
+      ...(stack?.Outputs ?? []),
     ],
   });
 }
 
-export function mockToolkitInfo(stack?: Partial<AWS.CloudFormation.Stack>) {
-  const sdk = new MockSdk();
-  return ToolkitInfo.fromStack(mockBootstrapStack(sdk, stack));
-}
-
-export function mockResolvedEnvironment(): cxapi.Environment {
+export function mockResolvedEnvironment(): Environment {
   return {
     account: '123456789',
     region: 'bermuda-triangle-1337',
     name: 'aws://123456789/bermuda-triangle-1337',
   };
 }
-
-// Jest helpers
-
-// An object on which all callables are Jest Mocks
-export type MockedObject<S extends object> = {[K in keyof S]: MockedFunction<Required<S>[K]>};
-
-// If a function, then a mocked version of it, otherwise just T
-type MockedFunction<T> = T extends (...args: any[]) => any
-  ? jest.MockInstance<ReturnType<T>, jest.ArgsType<T>>
-  : T;
-export function errorWithCode(code: string, message: string) {
-  const ret = new Error(message);
-  (ret as any).code = code;
-  return ret;
-}
diff --git a/packages/aws-cdk/test/util/stack-monitor.test.ts b/packages/aws-cdk/test/util/stack-monitor.test.ts
index 49e513c88109a..85faf16f26e92 100644
--- a/packages/aws-cdk/test/util/stack-monitor.test.ts
+++ b/packages/aws-cdk/test/util/stack-monitor.test.ts
@@ -1,225 +1,203 @@
-/* eslint-disable import/order */
-import { MockSdk } from './mock-sdk';
-import { StackActivityMonitor, IActivityPrinter, StackActivity } from '../../lib/api/util/cloudformation/stack-activity-monitor';
-import { sleep } from '../util';
+import {
+  DescribeStackEventsCommand,
+  ResourceStatus,
+  type StackEvent,
+  StackStatus,
+} from '@aws-sdk/client-cloudformation';
+import { MockSdk, mockCloudFormationClient } from './mock-sdk';
+import {
+  StackActivityMonitor,
+  type IActivityPrinter,
+  type StackActivity,
+} from '../../lib/api/util/cloudformation/stack-activity-monitor';
 
 let sdk: MockSdk;
 let printer: FakePrinter;
+let monitor: StackActivityMonitor;
 beforeEach(() => {
   sdk = new MockSdk();
+
   printer = new FakePrinter();
+  monitor = new StackActivityMonitor(sdk.cloudFormation(), 'StackName', printer, undefined, new Date(T100)).start();
 });
 
 describe('stack monitor event ordering and pagination', () => {
   test('continue to the next page if it exists', async () => {
-    await testMonitorWithEventCalls([
-      (request) => {
-        expect(request.NextToken).toBeUndefined();
-        return {
-          StackEvents: [event(102)],
-          NextToken: 'some-token',
-        };
-      },
-      (request) => {
-        expect(request.NextToken).toBe('some-token');
-        return {
-          StackEvents: [event(101)],
-        };
-      },
-    ]);
+    mockCloudFormationClient.on(DescribeStackEventsCommand).resolvesOnce({
+      StackEvents: [event(102), event(101)],
+    });
+
+    await eventually(() => expect(mockCloudFormationClient).toHaveReceivedCommand(DescribeStackEventsCommand), 2);
+    await monitor.stop();
 
     // Printer sees them in chronological order
     expect(printer.eventIds).toEqual(['101', '102']);
   });
 
   test('do not page further if we already saw the last event', async () => {
-    await testMonitorWithEventCalls([
-      (request) => {
-        expect(request.NextToken).toBeUndefined();
-        return {
-          StackEvents: [event(101)],
-        };
-      },
-      (request) => {
-        expect(request.NextToken).toBeUndefined();
-        return {
-          StackEvents: [event(102), event(101)],
-          NextToken: 'some-token',
-        };
-      },
-      (request) => {
-        // Did not use the token
-        expect(request.NextToken).toBeUndefined();
-        return {};
-      },
-    ]);
+    mockCloudFormationClient
+      .on(DescribeStackEventsCommand)
+      .resolvesOnce({
+        StackEvents: [event(101)],
+      })
+      .resolvesOnce({
+        StackEvents: [event(102), event(101)],
+      })
+      .resolvesOnce({});
+
+    await eventually(() => expect(mockCloudFormationClient).toHaveReceivedCommand(DescribeStackEventsCommand), 2);
+    await monitor.stop();
 
     // Seen in chronological order
     expect(printer.eventIds).toEqual(['101', '102']);
   });
 
   test('do not page further if the last event is too old', async () => {
-    await testMonitorWithEventCalls([
-      (request) => {
-        expect(request.NextToken).toBeUndefined();
-        return {
-          StackEvents: [event(101), event(95)],
-          NextToken: 'some-token',
-        };
-      },
-      (request) => {
-        // Start again from the top
-        expect(request.NextToken).toBeUndefined();
-        return {};
-      },
-    ]);
+    mockCloudFormationClient
+      .on(DescribeStackEventsCommand)
+      .resolvesOnce({
+        StackEvents: [event(101), event(95)],
+      })
+      .resolvesOnce({
+        StackEvents: [],
+      });
+
+    await eventually(() => expect(mockCloudFormationClient).toHaveReceivedCommand(DescribeStackEventsCommand), 2);
+    await monitor.stop();
 
     // Seen only the new one
     expect(printer.eventIds).toEqual(['101']);
   });
 
   test('do a final request after the monitor is stopped', async () => {
-    await testMonitorWithEventCalls([
-      // Before stop
-      (request) => {
-        expect(request.NextToken).toBeUndefined();
-        return {
-          StackEvents: [event(101)],
-        };
-      },
-    ],
-    // After stop
-    [
-      (request) => {
-        expect(request.NextToken).toBeUndefined();
-        return {
-          StackEvents: [event(102), event(101)],
-        };
-      },
-    ]);
-
-    // Seen both
-    expect(printer.eventIds).toEqual(['101', '102']);
+    mockCloudFormationClient.on(DescribeStackEventsCommand).resolves({
+      StackEvents: [event(101)],
+    });
+    // Establish that we've received events prior to stop and then reset the mock
+    await eventually(() => expect(mockCloudFormationClient).toHaveReceivedCommand(DescribeStackEventsCommand), 2);
+    mockCloudFormationClient.resetHistory();
+    await monitor.stop();
+    mockCloudFormationClient.on(DescribeStackEventsCommand).resolves({
+      StackEvents: [event(102), event(101)],
+    });
+    // Since we can't reset the mock to a new value before calling stop, we'll have to check
+    // and make sure it's called again instead.
+    expect(mockCloudFormationClient).toHaveReceivedCommand(DescribeStackEventsCommand);
   });
 });
 
 describe('stack monitor, collecting errors from events', () => {
   test('return errors from the root stack', async () => {
-    const monitor = await testMonitorWithEventCalls([
-      (request) => {
-        expect(request.NextToken).toBeUndefined();
-        return {
-          StackEvents: [addErrorToStackEvent(event(100))],
-        };
-      },
-    ]);
+    mockCloudFormationClient.on(DescribeStackEventsCommand).resolvesOnce({
+      StackEvents: [addErrorToStackEvent(event(100))],
+    });
 
+    await eventually(() => expect(mockCloudFormationClient).toHaveReceivedCommand(DescribeStackEventsCommand), 2);
+    await monitor.stop();
     expect(monitor.errors).toStrictEqual(['Test Error']);
   });
 
   test('return errors from the nested stack', async () => {
-    const monitor = await testMonitorWithEventCalls([
-      (request) => {
-        expect(request.StackName).toStrictEqual('StackName');
-        return {
-          StackEvents: [
-            addErrorToStackEvent(
-              event(102), {
-                logicalResourceId: 'nestedStackLogicalResourceId',
-                physicalResourceId: 'nestedStackPhysicalResourceId',
-                resourceType: 'AWS::CloudFormation::Stack',
-                resourceStatusReason: 'nested stack failed',
-                resourceStatus: 'UPDATE_FAILED',
-              },
-            ),
-            addErrorToStackEvent(
-              event(100), {
-                logicalResourceId: 'nestedStackLogicalResourceId',
-                physicalResourceId: 'nestedStackPhysicalResourceId',
-                resourceType: 'AWS::CloudFormation::Stack',
-                resourceStatus: 'UPDATE_IN_PROGRESS',
-              },
-            ),
-          ],
-        };
-      },
-      (request) => {
-        expect(request.StackName).toStrictEqual('nestedStackPhysicalResourceId');
-        return {
-          StackEvents: [
-            addErrorToStackEvent(
-              event(101), {
-                logicalResourceId: 'nestedResource',
-                resourceType: 'Some::Nested::Resource',
-                resourceStatusReason: 'actual failure error message',
-              },
-            ),
-          ],
-        };
-      },
-    ]);
+    mockCloudFormationClient
+      .on(DescribeStackEventsCommand)
+      .resolvesOnce({
+        StackEvents: [
+          addErrorToStackEvent(event(102), {
+            logicalResourceId: 'nestedStackLogicalResourceId',
+            physicalResourceId: 'nestedStackPhysicalResourceId',
+            resourceType: 'AWS::CloudFormation::Stack',
+            resourceStatusReason: 'nested stack failed',
+            resourceStatus: ResourceStatus.UPDATE_FAILED,
+          }),
+          addErrorToStackEvent(event(100), {
+            logicalResourceId: 'nestedStackLogicalResourceId',
+            physicalResourceId: 'nestedStackPhysicalResourceId',
+            resourceType: 'AWS::CloudFormation::Stack',
+            resourceStatus: ResourceStatus.UPDATE_IN_PROGRESS,
+          }),
+        ],
+      })
+      .resolvesOnce({
+        StackEvents: [
+          addErrorToStackEvent(event(101), {
+            logicalResourceId: 'nestedResource',
+            resourceType: 'Some::Nested::Resource',
+            resourceStatusReason: 'actual failure error message',
+          }),
+        ],
+      });
 
+    await eventually(
+      () =>
+        expect(mockCloudFormationClient).toHaveReceivedNthCommandWith(1, DescribeStackEventsCommand, {
+          StackName: 'StackName',
+        }),
+      2,
+    );
+
+    await eventually(
+      () =>
+        expect(mockCloudFormationClient).toHaveReceivedNthCommandWith(2, DescribeStackEventsCommand, {
+          StackName: 'nestedStackPhysicalResourceId',
+        }),
+      2,
+    );
+    await monitor.stop();
     expect(monitor.errors).toStrictEqual(['actual failure error message', 'nested stack failed']);
   });
 
   test('does not consider events without physical resource id for monitoring nested stacks', async () => {
-    const monitor = await testMonitorWithEventCalls([
-      (request) => {
-        expect(request.StackName).toStrictEqual('StackName');
-        return {
-          StackEvents: [
-            addErrorToStackEvent(
-              event(100), {
-                logicalResourceId: 'nestedStackLogicalResourceId',
-                physicalResourceId: '',
-                resourceType: 'AWS::CloudFormation::Stack',
-                resourceStatusReason: 'nested stack failed',
-                resourceStatus: 'CREATE_IN_PROGRESS',
-              },
-            ),
-          ],
-        };
-      },
-      (request) => {
-        // Note that the second call happened for the top level stack instead of a nested stack
-        expect(request.StackName).toStrictEqual('StackName');
-        return {
-          StackEvents: [
-            addErrorToStackEvent(
-              event(101), {
-                logicalResourceId: 'OtherResource',
-                resourceType: 'Some::Other::Resource',
-                resourceStatusReason: 'some failure',
-              },
-            ),
-          ],
-        };
-      },
-    ]);
-
-    expect(monitor.errors).not.toContain('nested stack failed');
-    expect(monitor.errors).toContain('some failure');
+    mockCloudFormationClient
+      .on(DescribeStackEventsCommand)
+      .resolvesOnce({
+        StackEvents: [
+          addErrorToStackEvent(event(100), {
+            logicalResourceId: 'nestedStackLogicalResourceId',
+            physicalResourceId: '',
+            resourceType: 'AWS::CloudFormation::Stack',
+            resourceStatusReason: 'nested stack failed',
+          }),
+        ],
+        NextToken: 'nextToken',
+      })
+      .resolvesOnce({
+        StackEvents: [
+          addErrorToStackEvent(event(101), {
+            logicalResourceId: 'OtherResource',
+            resourceType: 'Some::Other::Resource',
+            resourceStatusReason: 'some failure',
+          }),
+        ],
+      });
+
+    await eventually(() => expect(mockCloudFormationClient).toHaveReceivedCommand(DescribeStackEventsCommand), 2);
+    await monitor.stop();
+
+    expect(monitor.errors).toStrictEqual(['nested stack failed', 'some failure']);
+    expect(mockCloudFormationClient).toHaveReceivedNthCommandWith(1, DescribeStackEventsCommand, {
+      StackName: 'StackName',
+    });
+    // Note that the second call happened for the top level stack instead of a nested stack
+    expect(mockCloudFormationClient).toHaveReceivedNthCommandWith(2, DescribeStackEventsCommand, {
+      StackName: 'StackName',
+    });
   });
 
   test('does not check for nested stacks that have already completed successfully', async () => {
-    const monitor = await testMonitorWithEventCalls([
-      (request) => {
-        expect(request.StackName).toStrictEqual('StackName');
-        return {
-          StackEvents: [
-            addErrorToStackEvent(
-              event(100), {
-                logicalResourceId: 'nestedStackLogicalResourceId',
-                physicalResourceId: 'nestedStackPhysicalResourceId',
-                resourceType: 'AWS::CloudFormation::Stack',
-                resourceStatusReason: 'nested stack status reason',
-                resourceStatus: 'CREATE_COMPLETE',
-              },
-            ),
-          ],
-        };
-      },
-    ]);
+    mockCloudFormationClient.on(DescribeStackEventsCommand).resolvesOnce({
+      StackEvents: [
+        addErrorToStackEvent(event(100), {
+          logicalResourceId: 'nestedStackLogicalResourceId',
+          physicalResourceId: 'nestedStackPhysicalResourceId',
+          resourceType: 'AWS::CloudFormation::Stack',
+          resourceStatusReason: 'nested stack status reason',
+          resourceStatus: StackStatus.CREATE_COMPLETE,
+        }),
+      ],
+    });
+
+    await eventually(() => expect(mockCloudFormationClient).toHaveReceivedCommand(DescribeStackEventsCommand), 2);
+    await monitor.stop();
 
     expect(monitor.errors).toStrictEqual([]);
   });
@@ -230,7 +208,7 @@ const T0 = 1597837230504;
 // Events 0-99 are before we started paying attention
 const T100 = T0 + 100 * 1000;
 
-function event(nr: number): AWS.CloudFormation.StackEvent {
+function event(nr: number): StackEvent {
   return {
     EventId: `${nr}`,
     StackId: 'StackId',
@@ -240,16 +218,16 @@ function event(nr: number): AWS.CloudFormation.StackEvent {
 }
 
 function addErrorToStackEvent(
-  eventToUpdate: AWS.CloudFormation.StackEvent,
+  eventToUpdate: StackEvent,
   props: {
-    resourceStatus?: string;
+    resourceStatus?: ResourceStatus;
     resourceType?: string;
     resourceStatusReason?: string;
     logicalResourceId?: string;
     physicalResourceId?: string;
   } = {},
-): AWS.CloudFormation.StackEvent {
-  eventToUpdate.ResourceStatus = props.resourceStatus ?? 'UPDATE_FAILED';
+): StackEvent {
+  eventToUpdate.ResourceStatus = props.resourceStatus ?? ResourceStatus.UPDATE_FAILED;
   eventToUpdate.ResourceType = props.resourceType ?? 'Test::Resource::Type';
   eventToUpdate.ResourceStatusReason = props.resourceStatusReason ?? 'Test Error';
   eventToUpdate.LogicalResourceId = props.logicalResourceId ?? 'testLogicalId';
@@ -257,67 +235,35 @@ function addErrorToStackEvent(
   return eventToUpdate;
 }
 
-async function testMonitorWithEventCalls(
-  beforeStopInvocations: Array<(x: AWS.CloudFormation.DescribeStackEventsInput) => AWS.CloudFormation.DescribeStackEventsOutput>,
-  afterStopInvocations: Array<(x: AWS.CloudFormation.DescribeStackEventsInput) => AWS.CloudFormation.DescribeStackEventsOutput> = [],
-): Promise<StackActivityMonitor> {
-  let describeStackEvents = (jest.fn() as jest.Mock<AWS.CloudFormation.DescribeStackEventsOutput, [AWS.CloudFormation.DescribeStackEventsInput]>);
-
-  let finished = false;
-  let error: Error | undefined = undefined;
-
-  for (const invocation of beforeStopInvocations) {
-    const invocation_ = invocation; // Capture loop variable in local because of closure semantics
-    const isLast = invocation === beforeStopInvocations[beforeStopInvocations.length - 1];
-    describeStackEvents = describeStackEvents.mockImplementationOnce(request => {
-      try {
-        const ret = invocation_(request);
-        if (isLast) {
-          finished = true;
-        }
-        return ret;
-      } catch (e: any) {
-        finished = true;
-        error = e;
-        throw e;
-      }
-    });
-  }
-  if (error) {
-    throw error;
-  }
-  for (const invocation of afterStopInvocations) {
-    describeStackEvents = describeStackEvents.mockImplementationOnce(invocation);
-  }
-  describeStackEvents.mockImplementation(() => { return {}; });
-
-  sdk.stubCloudFormation({ describeStackEvents });
-
-  const monitor = new StackActivityMonitor(sdk.cloudFormation(), 'StackName', printer, undefined, new Date(T100)).start();
-  await waitForCondition(() => finished);
-  await monitor.stop();
-  return monitor;
-}
-
 class FakePrinter implements IActivityPrinter {
   public updateSleep: number = 0;
   public readonly activities: StackActivity[] = [];
 
   public get eventIds() {
-    return this.activities.map(a => a.event.EventId);
+    return this.activities.map((a) => a.event.EventId);
   }
 
   public addActivity(activity: StackActivity): void {
     this.activities.push(activity);
   }
 
-  public print(): void { }
-  public start(): void { }
-  public stop(): void { }
+  public print(): void {}
+  public start(): void {}
+  public stop(): void {}
 }
 
-async function waitForCondition(cb: () => boolean): Promise<void> {
-  while (!cb()) {
-    await sleep(10);
+const wait = (): Promise<void> => new Promise((resolve) => setTimeout(resolve, 5));
+
+// Using the eventually function to ensure these functions have had sufficient time to execute.
+const eventually = async (call: () => void, attempts: number): Promise<void> => {
+  while (attempts-- >= 0) {
+    try {
+      return call();
+    } catch (err) {
+      if (attempts <= 0) throw err;
+    }
+    await wait();
   }
-}
+
+  throw new Error('An unexpected error has occurred.');
+};