chore: duplicate enum values not usable

There is an outstanding bug with `jsii`
(aws/jsii#2782) where duplicate enum values are not
available to the non-JS/TS languages. In these cases, only the first enum value
defined is present in the assembly.

For these cases, the first value was the deprecated one. This meant that only
the deprecated values were present, and once we stripped the deprecated
elements, we were left without values. For *v2 only*, we can reorder these enums
so the non-deprecated values appear in the assembly. Note that we *cannot*
backport this to `master` (v1), because it would introduce breaking changes to
our Java/Go/Dotnet/Python customers.

packages/@aws-cdk/aws-ec2/lib/vpc.ts

@@ -170,10 +170,8 @@ export enum SubnetType {
    *
    * This can be good for subnets with RDS or Elasticache instances,
    * or which route Internet traffic through a peer VPC.
-   *
-   * @deprecated use `SubnetType.PRIVATE_ISOLATED`
    */
-  ISOLATED = 'Isolated',
+  PRIVATE_ISOLATED = 'Isolated',
 
   /**
    * Isolated Subnets do not route traffic to the Internet (in this VPC),
@@ -185,11 +183,13 @@ export enum SubnetType {
    *
    * This can be good for subnets with RDS or Elasticache instances,
    * or which route Internet traffic through a peer VPC.
+   *
+   * @deprecated use `SubnetType.PRIVATE_ISOLATED`
    */
-  PRIVATE_ISOLATED = 'Isolated',
+  ISOLATED = 'Isolated',
 
   /**
-   * Subnet that routes to the internet, but not vice versa.
+   * Subnet that routes to the internet (via a NAT gateway), but not vice versa.
    *
    * Instances in a private subnet can connect to the Internet, but will not
    * allow connections to be initiated from the Internet. NAT Gateway(s) are
@@ -202,13 +202,11 @@ export enum SubnetType {
    * Normally a Private subnet will use a NAT gateway in the same AZ, but
    * if `natGateways` is used to reduce the number of NAT gateways, a NAT
    * gateway from another AZ will be used instead.
-   *
-   * @deprecated use `PRIVATE_WITH_NAT`
    */
-  PRIVATE = 'Private',
+  PRIVATE_WITH_NAT = 'Private',
 
   /**
-   * Subnet that routes to the internet (via a NAT gateway), but not vice versa.
+   * Subnet that routes to the internet, but not vice versa.
    *
    * Instances in a private subnet can connect to the Internet, but will not
    * allow connections to be initiated from the Internet. NAT Gateway(s) are
@@ -221,8 +219,10 @@ export enum SubnetType {
    * Normally a Private subnet will use a NAT gateway in the same AZ, but
    * if `natGateways` is used to reduce the number of NAT gateways, a NAT
    * gateway from another AZ will be used instead.
+   *
+   * @deprecated use `PRIVATE_WITH_NAT`
    */
-  PRIVATE_WITH_NAT = 'Private',
+  PRIVATE = 'Private',
 
   /**
    * Subnet connected to the Internet

packages/@aws-cdk/aws-secretsmanager/lib/secret.ts

@@ -542,30 +542,30 @@ export interface ISecretAttachmentTarget {
  * The type of service or database that's being associated with the secret.
  */
 export enum AttachmentTargetType {
+  /**
+   * AWS::RDS::DBInstance
+   */
+  RDS_DB_INSTANCE = 'AWS::RDS::DBInstance',
+
   /**
    * A database instance
    *
    * @deprecated use RDS_DB_INSTANCE instead
    */
   INSTANCE = 'AWS::RDS::DBInstance',
 
+  /**
+   * AWS::RDS::DBCluster
+   */
+  RDS_DB_CLUSTER = 'AWS::RDS::DBCluster',
+
   /**
    * A database cluster
    *
    * @deprecated use RDS_DB_CLUSTER instead
    */
   CLUSTER = 'AWS::RDS::DBCluster',
 
-  /**
-   * AWS::RDS::DBInstance
-   */
-  RDS_DB_INSTANCE = 'AWS::RDS::DBInstance',
-
-  /**
-   * AWS::RDS::DBCluster
-   */
-  RDS_DB_CLUSTER = 'AWS::RDS::DBCluster',
-
   /**
    * AWS::RDS::DBProxy
    */