Merge branch 'master' into fix/redshift-key

CHANGELOG.md

@@ -2,6 +2,32 @@
 
 All notable changes to this project will be documented in this file. See [standard-version](https://github.com/conventional-changelog/standard-version) for commit guidelines.
 
+## [1.129.0](https://github.com/aws/aws-cdk/compare/v1.128.0...v1.129.0) (2021-10-21)
+
+
+### Features
+
+* **aws-autoscaling:** add flag and aspect to require imdsv2 ([#16052](https://github.com/aws/aws-cdk/issues/16052)) ([ef7e20d](https://github.com/aws/aws-cdk/commit/ef7e20df08b4321f210bfc050afa42d7b4901931))
+* **codebuild:** add support for small ARM machine type ([#16635](https://github.com/aws/aws-cdk/issues/16635)) ([55fbc86](https://github.com/aws/aws-cdk/commit/55fbc866ef0195fdfc722206e4d69a1f4469cd40)), closes [#16633](https://github.com/aws/aws-cdk/issues/16633)
+* **dynamodb:** add option to skip waiting for global replication to finish ([#16983](https://github.com/aws/aws-cdk/issues/16983)) ([254601f](https://github.com/aws/aws-cdk/commit/254601f477a4da309e81f5384140427f1b958bfd)), closes [#16611](https://github.com/aws/aws-cdk/issues/16611)
+* **ec2:** add aspect to require imdsv2 ([#16051](https://github.com/aws/aws-cdk/issues/16051)) ([0947b21](https://github.com/aws/aws-cdk/commit/0947b21c1e3186042324820ec5ab433237246f58))
+* **eks:** configure serviceIpv4Cidr on the cluster ([#16957](https://github.com/aws/aws-cdk/issues/16957)) ([72102c7](https://github.com/aws/aws-cdk/commit/72102c750bfd6564cd51c1a5d8abc79b1ba1d3ce)), closes [#16541](https://github.com/aws/aws-cdk/issues/16541)
+* **events:** Add DLQ support for SQS target ([#16916](https://github.com/aws/aws-cdk/issues/16916)) ([7fda903](https://github.com/aws/aws-cdk/commit/7fda90318e18b3a5d126b040e35a0146634d5f2d)), closes [#16417](https://github.com/aws/aws-cdk/issues/16417)
+* **msk:** add Kafka version 2.8.1 ([#16881](https://github.com/aws/aws-cdk/issues/16881)) ([7db5c8c](https://github.com/aws/aws-cdk/commit/7db5c8cdafe7b9b22b6b40cb25ed8bd1946301f4))
+* **stepfunctions-tasks:** add `enableNetworkIsolation` property to `SageMakerCreateTrainingJobProps`  ([#16792](https://github.com/aws/aws-cdk/issues/16792)) ([69ac520](https://github.com/aws/aws-cdk/commit/69ac520452b219bf242f2fbb4740f6b1b8b8790f)), closes [#16779](https://github.com/aws/aws-cdk/issues/16779)
+
+
+### Bug Fixes
+
+* **apigatewayv2:** unable to retrieve domain url for default stage ([#16854](https://github.com/aws/aws-cdk/issues/16854)) ([c6db91e](https://github.com/aws/aws-cdk/commit/c6db91eee2cb658ce347c7ac6d6e3c95bc5977dc)), closes [#16638](https://github.com/aws/aws-cdk/issues/16638)
+* **cfn-diff:** correctly handle Date strings in diff ([#16591](https://github.com/aws/aws-cdk/issues/16591)) ([86f2714](https://github.com/aws/aws-cdk/commit/86f2714613f06aaf2bcee27da2f66066c8e863d0)), closes [#16444](https://github.com/aws/aws-cdk/issues/16444)
+* **ecs:** imported services don't have account & region set correctly ([#16997](https://github.com/aws/aws-cdk/issues/16997)) ([dc6f743](https://github.com/aws/aws-cdk/commit/dc6f7433f01b9bc2c8206fb03d72ab8404fe4f6a)), closes [#11199](https://github.com/aws/aws-cdk/issues/11199) [#11199](https://github.com/aws/aws-cdk/issues/11199) [#15944](https://github.com/aws/aws-cdk/issues/15944)
+* **events:** PhysicalName.GENERATE_IF_NEEDED does not work for EventBus ([#17008](https://github.com/aws/aws-cdk/issues/17008)) ([707fa00](https://github.com/aws/aws-cdk/commit/707fa003a458039878a1ae5173b6665a84c1170b)), closes [#14337](https://github.com/aws/aws-cdk/issues/14337)
+* **lambda:** docker image function fails when insightsVersion is specified ([#16781](https://github.com/aws/aws-cdk/issues/16781)) ([d0e15cc](https://github.com/aws/aws-cdk/commit/d0e15ccaca22c5e05b9186aa1a241e744d67c96a)), closes [#16642](https://github.com/aws/aws-cdk/issues/16642)
+* **lambda-layer-node-proxy-agent:** Replace use of package.json with Dockerfile command `npm install [package]@[version]` ([#17078](https://github.com/aws/aws-cdk/issues/17078)) ([a129046](https://github.com/aws/aws-cdk/commit/a129046495a926561f94f5ce1f41c34b1df3afde))
+* **opensearch:** add validation to domainName property ([#17017](https://github.com/aws/aws-cdk/issues/17017)) ([3ec6832](https://github.com/aws/aws-cdk/commit/3ec683283e96159d588797bd46d33c82ff3076f1)), closes [#17016](https://github.com/aws/aws-cdk/issues/17016)
+* **pipelines:** `additionalInputs` fails for deep directory ([#17074](https://github.com/aws/aws-cdk/issues/17074)) ([403d3ce](https://github.com/aws/aws-cdk/commit/403d3ce3bc0f4e30e9694e5c20743f0032009464)), closes [#16936](https://github.com/aws/aws-cdk/issues/16936)
+
 ## [1.128.0](https://github.com/aws/aws-cdk/compare/v1.127.0...v1.128.0) (2021-10-14)
 
 

pack.sh

@@ -92,8 +92,9 @@ cat > ${distdir}/build.json <<HERE
 }
 HERE
 
-# copy CHANGELOG.md to dist/ for github releases
+# copy CHANGELOG.md and RELEASE_NOTES.md to dist/ for github releases
 cp ${changelog_file} ${distdir}/CHANGELOG.md
+cp RELEASE_NOTES.md ${distdir}/RELEASE_NOTES.md
 
 # defensive: make sure our artifacts don't use the version marker (this means
 # that "pack" will always fails when building in a dev environment)

packages/@aws-cdk/aws-amplify/README.md

@@ -55,7 +55,8 @@ const amplifyApp = new amplify.App(this, 'MyApp', {
       },
       artifacts: {
         baseDirectory: 'public',
-        files: '**/*'
+        files:
+        - '**/*'
       }
     }
   })

packages/@aws-cdk/aws-applicationautoscaling/lib/base-scalable-attribute.ts

@@ -86,7 +86,7 @@ export abstract class BaseScalableAttribute extends CoreConstruct {
 }
 
 /**
- * Properties for enabling DynamoDB capacity scaling
+ * Properties for enabling Application Auto Scaling
  */
 export interface EnableScalingProps {
   /**

packages/@aws-cdk/aws-cloudfront/lib/cache-policy.ts

@@ -85,9 +85,13 @@ export interface CachePolicyProps {
  * A Cache Policy configuration.
  *
  * @resource AWS::CloudFront::CachePolicy
+ * @link https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/using-managed-cache-policies.html
  */
 export class CachePolicy extends Resource implements ICachePolicy {
-
+  /**
+   * This policy is designed for use with an origin that is an AWS Amplify web app.
+   */
+  public static readonly AMPLIFY = CachePolicy.fromManagedCachePolicy('2e54312d-136d-493c-8eb9-b001f22f67d2');
   /**
    * Optimize cache efficiency by minimizing the values that CloudFront includes in the cache key.
    * Query strings and cookies are not included in the cache key, and only the normalized 'Accept-Encoding' header is included.

packages/@aws-cdk/aws-codebuild/README.md

@@ -30,7 +30,7 @@ $ npm i @aws-cdk/aws-codebuild
 
 Import it into your code:
 
-```ts
+```ts nofixture
 import * as codebuild from '@aws-cdk/aws-codebuild';
 ```
 
@@ -56,7 +56,6 @@ CodeBuild!`:
 Use an AWS CodeCommit repository as the source of this build:
 
 ```ts
-import * as codebuild from '@aws-cdk/aws-codebuild';
 import * as codecommit from '@aws-cdk/aws-codecommit';
 
 const repository = new codecommit.Repository(this, 'MyRepo', { repositoryName: 'foo' });
@@ -70,10 +69,8 @@ new codebuild.Project(this, 'MyFirstCodeCommitProject', {
 Create a CodeBuild project with an S3 bucket as the source:
 
 ```ts
-import * as codebuild from '@aws-cdk/aws-codebuild';
-import * as s3 from '@aws-cdk/aws-s3';
-
 const bucket = new s3.Bucket(this, 'MyBucket');
+
 new codebuild.Project(this, 'MyProject', {
   source: codebuild.Source.s3({
     bucket: bucket,
@@ -140,7 +137,9 @@ const gitHubSource = codebuild.Source.gitHub({
 CodeBuild Projects can produce Artifacts and upload them to S3. For example:
 
 ```ts
-const project = codebuild.Project(stack, 'MyProject', {
+declare const bucket: s3.Bucket;
+
+const project = new codebuild.Project(this, 'MyProject', {
   buildSpec: codebuild.BuildSpec.fromObject({
     version: '0.2',
   }),
@@ -193,7 +192,7 @@ new codebuild.Project(this, 'Project', {
     owner: 'awslabs',
     repo: 'aws-cdk',
   }),
-  cache: codebuild.Cache.bucket(new Bucket(this, 'Bucket'))
+  cache: codebuild.Cache.bucket(new s3.Bucket(this, 'Bucket'))
 });
 ```
 
@@ -214,7 +213,7 @@ new codebuild.Project(this, 'Project', {
   }),
 
   // Enable Docker AND custom caching
-  cache: codebuild.Cache.local(LocalCacheMode.DOCKER_LAYER, LocalCacheMode.CUSTOM)
+  cache: codebuild.Cache.local(codebuild.LocalCacheMode.DOCKER_LAYER, codebuild.LocalCacheMode.CUSTOM)
 });
 ```
 
@@ -260,6 +259,8 @@ Note that the `WindowsBuildImage` version of the static methods accepts an optio
 which can be either `WindowsImageType.STANDARD`, the default, or `WindowsImageType.SERVER_2019`:
 
 ```ts
+declare const ecrRepository: ecr.Repository;
+
 new codebuild.Project(this, 'Project', {
   environment: {
     buildImage: codebuild.WindowsBuildImage.fromEcrRepository(ecrRepository, 'v1.0', codebuild.WindowsImageType.SERVER_2019),
@@ -269,7 +270,7 @@ new codebuild.Project(this, 'Project', {
       objectKey: 'path/to/cert.pem',
     },
   },
-  ...
+  // ...
 })
 ```
 
@@ -296,7 +297,7 @@ new codebuild.Project(this, 'Project', {
   environment: {
     buildImage: codebuild.LinuxGpuBuildImage.DLC_TENSORFLOW_2_1_0_INFERENCE,
   },
-  ...
+  // ...
 })
 ```
 
@@ -315,7 +316,7 @@ new codebuild.Project(this, 'Project', {
     buildImage: codebuild.LinuxGpuBuildImage.awsDeepLearningContainersImage(
       'tensorflow-inference', '2.1.0-gpu-py36-cu101-ubuntu18.04', '123456789012'),
   },
-  ...
+  // ...
 })
 ```
 
@@ -331,10 +332,9 @@ By default, logs will go to cloudwatch.
 new codebuild.Project(this, 'Project', {
   logging: {
     cloudWatch: {
-      logGroup: new cloudwatch.LogGroup(this, `MyLogGroup`),
+      logGroup: new logs.LogGroup(this, `MyLogGroup`),
     }
   },
-  ...
 })
 ```
 
@@ -347,7 +347,6 @@ new codebuild.Project(this, 'Project', {
       bucket: new s3.Bucket(this, `LogBucket`)
     }
   },
-  ...
 })
 ```
 
@@ -358,7 +357,7 @@ like GitHub:
 
 ```ts
 new codebuild.GitHubSourceCredentials(this, 'CodeBuildGitHubCreds', {
-  accessToken: cdk.SecretValue.secretsManager('my-token'),
+  accessToken: SecretValue.secretsManager('my-token'),
 });
 // GitHub Enterprise is almost the same,
 // except the class is called GitHubEnterpriseSourceCredentials
@@ -368,8 +367,8 @@ and BitBucket:
 
 ```ts
 new codebuild.BitBucketSourceCredentials(this, 'CodeBuildBitBucketCreds', {
-  username: cdk.SecretValue.secretsManager('my-bitbucket-creds', { jsonField: 'username' }),
-  password: cdk.SecretValue.secretsManager('my-bitbucket-creds', { jsonField: 'password' }),
+  username: SecretValue.secretsManager('my-bitbucket-creds', { jsonField: 'username' }),
+  password: SecretValue.secretsManager('my-bitbucket-creds', { jsonField: 'password' }),
 });
 ```
 
@@ -409,8 +408,10 @@ if you'd rather not have those permissions added,
 you can opt out of it when creating the project:
 
 ```ts
+declare const source: codebuild.Source;
+
 const project = new codebuild.Project(this, 'Project', {
-  // ...
+  source,
   grantReportGroupPermissions: false,
 });
 ```
@@ -419,10 +420,13 @@ Alternatively, you can specify an ARN of an existing resource group,
 instead of a simple name, in your buildspec:
 
 ```ts
+declare const source: codebuild.Source;
+
 // create a new ReportGroup
 const reportGroup = new codebuild.ReportGroup(this, 'ReportGroup');
 
 const project = new codebuild.Project(this, 'Project', {
+  source,
   buildSpec: codebuild.BuildSpec.fromObject({
     // ...
     reports: {
@@ -438,6 +442,9 @@ const project = new codebuild.Project(this, 'Project', {
 If you do that, you need to grant the project's role permissions to write reports to that report group:
 
 ```ts
+declare const project: codebuild.Project;
+declare const reportGroup: codebuild.ReportGroup;
+
 reportGroup.grantWrite(project);
 ```
 
@@ -456,8 +463,12 @@ project as a AWS CloudWatch event rule target:
 
 ```ts
 // start build when a commit is pushed
+import * as codecommit from '@aws-cdk/aws-codecommit';
 import * as targets from '@aws-cdk/aws-events-targets';
 
+declare const codeCommitRepository: codecommit.Repository;
+declare const project: codebuild.Project;
+
 codeCommitRepository.onCommit('OnCommit', {
   target: new targets.CodeBuildProject(project),
 });
@@ -469,6 +480,10 @@ To define Amazon CloudWatch event rules for build projects, use one of the `onXx
 methods:
 
 ```ts
+import * as targets from '@aws-cdk/aws-events-targets';
+declare const fn: lambda.Function;
+declare const project: codebuild.Project;
+
 const rule = project.onStateChange('BuildStateChange', {
   target: new targets.LambdaFunction(fn)
 });
@@ -480,7 +495,11 @@ To define CodeStar Notification rules for Projects, use one of the `notifyOnXxx(
 They are very similar to `onXxx()` methods for CloudWatch events:
 
 ```ts
-const target = new chatbot.SlackChannelConfiguration(stack, 'MySlackChannel', {
+import * as chatbot from '@aws-cdk/aws-chatbot';
+
+declare const project: codebuild.Project;
+
+const target = new chatbot.SlackChannelConfiguration(this, 'MySlackChannel', {
   slackChannelConfigurationName: 'YOUR_CHANNEL_NAME',
   slackWorkspaceId: 'YOUR_SLACK_WORKSPACE_ID',
   slackChannelId: 'YOUR_SLACK_CHANNEL_ID',
@@ -495,6 +514,10 @@ CodeBuild Projects can get their sources from multiple places, and produce
 multiple outputs. For example:
 
 ```ts
+import * as codecommit from '@aws-cdk/aws-codecommit';
+declare const repo: codecommit.Repository;
+declare const bucket: s3.Bucket;
+
 const project = new codebuild.Project(this, 'MyProject', {
   secondarySources: [
     codebuild.Source.codeCommit({
@@ -586,6 +609,8 @@ to access the resources that it needs by using the
 For example:
 
 ```ts
+declare const loadBalancer: elbv2.ApplicationLoadBalancer;
+
 const vpc = new ec2.Vpc(this, 'MyVPC');
 const project = new codebuild.Project(this, 'MyProject', {
   vpc: vpc,
@@ -608,7 +633,7 @@ The only supported file system type is `EFS`.
 For example:
 
 ```ts
-new codebuild.Project(stack, 'MyProject', {
+new codebuild.Project(this, 'MyProject', {
   buildSpec: codebuild.BuildSpec.fromObject({
     version: '0.2',
   }),
@@ -635,9 +660,9 @@ It returns an object containing the batch service role that was created,
 or `undefined` if batch builds could not be enabled, for example if the project was imported.
 
 ```ts
-import * as codebuild from '@aws-cdk/aws-codebuild';
+declare const source: codebuild.Source;
 
-const project = new codebuild.Project(this, 'MyProject', { ... });
+const project = new codebuild.Project(this, 'MyProject', { source, });
 
 if (project.enableBatchBuilds()) {
   console.log('Batch builds were enabled');
@@ -652,9 +677,7 @@ The default is 60 minutes.
 An example of overriding the default follows.
 
 ```ts
-import * as codebuild from '@aws-cdk/aws-codebuild';
-
-new codebuild.Project(stack, 'MyProject', {
+new codebuild.Project(this, 'MyProject', {
   timeout: Duration.minutes(90)
 });
 ```
@@ -665,9 +688,7 @@ As an example, to allow your Project to queue for up to thirty (30) minutes befo
 use the following code.
 
 ```ts
-import * as codebuild from '@aws-cdk/aws-codebuild';
-
-new codebuild.Project(stack, 'MyProject', {
+new codebuild.Project(this, 'MyProject', {
   queuedTimeout: Duration.minutes(30)
 });
 ```
@@ -679,9 +700,7 @@ It is possible to limit the maximum concurrent builds to value between 1 and the
 By default there is no explicit limit.
 
 ```ts
-import * as codebuild from '@aws-cdk/aws-codebuild';
-
-new codebuild.Project(stack, 'MyProject', {
+new codebuild.Project(this, 'MyProject', {
   concurrentBuildLimit: 1
 });
 ```

packages/@aws-cdk/aws-codebuild/lib/untrusted-code-boundary-policy.ts

@@ -39,7 +39,8 @@ export interface UntrustedCodeBoundaryPolicyProps {
  *
  * @example
  *
- * iam.PermissionsBoundary.of(project).apply(new UntrustedCodeBoundaryPolicy(this, 'Boundary'));
+ * declare const project: codebuild.Project;
+ * iam.PermissionsBoundary.of(project).apply(new codebuild.UntrustedCodeBoundaryPolicy(this, 'Boundary'));
  */
 export class UntrustedCodeBoundaryPolicy extends iam.ManagedPolicy {
   constructor(scope: Construct, id: string, props: UntrustedCodeBoundaryPolicyProps = {}) {

packages/@aws-cdk/aws-codebuild/rosetta/default.ts-fixture

@@ -0,0 +1,19 @@
+// Fixture with packages imported, but nothing else
+import { Construct } from 'constructs';
+import { Stack, Duration, SecretValue } from '@aws-cdk/core';
+import codebuild = require('@aws-cdk/aws-codebuild');
+import iam = require('@aws-cdk/aws-iam');
+import ec2 = require('@aws-cdk/aws-ec2');
+import lambda = require('@aws-cdk/aws-lambda');
+import * as s3 from '@aws-cdk/aws-s3';
+import * as elbv2 from '@aws-cdk/aws-elasticloadbalancingv2';
+import * as ecr from '@aws-cdk/aws-ecr';
+import * as logs from '@aws-cdk/aws-logs';
+
+class Fixture extends Stack {
+  constructor(scope: Construct, id: string) {
+    super(scope, id);
+
+    /// here
+  }
+}