Merge branch 'main' into fix/secret-hosted-schedule-from-method

.github/workflows/github-merit-badger.yml

@@ -17,4 +17,4 @@ jobs:
           badges: '[beginning-contributor,repeat-contributor,valued-contributor,admired-contributor,star-contributor,distinguished-contributor]'
           thresholds: '[0,3,6,13,25,50]'
           badge-type: 'achievement'
-          ignore-usernames: '[rix0rrr,MrArnoldPalmer,iliapolo,otaviomacedo,madeline-k,kaizencc,comcalvi,TheRealAmazonKendra,vinayak-kukreja,mrgrain,pahud,cgarvis,kellertk,HBobertz,sumupitchayan,SankyRed,udaypant,colifran,khushail,scanlonp,mikewrighton,moelasmar,paulhcsun,awsmjs,aws-cdk-automation,dependabot[bot],mergify[bot]]'
+          ignore-usernames: '[rix0rrr,MrArnoldPalmer,iliapolo,otaviomacedo,madeline-k,kaizencc,comcalvi,TheRealAmazonKendra,vinayak-kukreja,mrgrain,pahud,cgarvis,kellertk,HBobertz,sumupitchayan,SankyRed,udaypant,colifran,khushail,scanlonp,mikewrighton,moelasmar,paulhcsun,awsmjs,evgenyka,aws-cdk-automation,dependabot[bot],mergify[bot]]'

.github/workflows/pr-linter-trigger.yml

@@ -17,7 +17,7 @@ jobs:
           mkdir -p ./pr
           echo $PR_NUMBER > ./pr/pr_number
           echo $PR_SHA > ./pr/pr_sha
-      - uses: actions/upload-artifact@v3
+      - uses: actions/upload-artifact@v4
         with:
           name: pr_info
           path: pr/

.github/workflows/spec-update.yml

@@ -31,7 +31,7 @@ jobs:
 
       # Upload the current db to be used later
       - name: Upload base database
-        uses: actions/upload-artifact@v3
+        uses: actions/upload-artifact@v4
         with:
           name: db.base.json.gz
           path: node_modules/@aws-cdk/aws-service-spec/db.json.gz
@@ -49,7 +49,7 @@ jobs:
 
       # Now that we have updated the database, upload the new candidate db
       - name: Upload head database
-        uses: actions/upload-artifact@v3
+        uses: actions/upload-artifact@v4
         with:
           name: db.head.json.gz
           path: node_modules/@aws-cdk/aws-service-spec/db.json.gz
@@ -69,7 +69,7 @@ jobs:
           git add .
           git diff --patch --staged > ${{ runner.temp }}/update-spec.patch
       - name: Upload Patch
-        uses: actions/upload-artifact@v3
+        uses: actions/upload-artifact@v4
         with:
           name: update-spec.patch
           path: ${{ runner.temp }}/update-spec.patch
@@ -85,12 +85,12 @@ jobs:
       CI: "true"
     steps:
       - name: Download base database
-        uses: actions/download-artifact@v3
+        uses: actions/download-artifact@v4
         with:
           name: db.base.json.gz
           path: base
       - name: Download head database
-        uses: actions/download-artifact@v3
+        uses: actions/download-artifact@v4
         with:
           name: db.head.json.gz
           path: head
@@ -100,17 +100,17 @@ jobs:
         continue-on-error: true
       - name: Create PR body file
         run: |-
-          echo 'Update AWS Service Spec packages to latest versions' >> PR.md
+          echo 'Updates the L1 CloudFormation resource definitions with the latest changes from `@aws-cdk/aws-service-spec`' >> PR.md
       - name: Add model changelog to PR body file
         if: steps.diff-db.outputs.diff-result
         run: |-
           echo '' >> PR.md
-          echo '**@aws-cdk/aws-service-spec changes:**' >> PR.md
+          echo '**L1 CloudFormation resource definition changes:**' >> PR.md
           echo '```' >> PR.md
           cat DIFF >> PR.md
           echo '```' >> PR.md
       - name: Upload PR body file
-        uses: actions/upload-artifact@v3
+        uses: actions/upload-artifact@v4
         with:
           name: PR.md
           path: PR.md
@@ -128,7 +128,7 @@ jobs:
         uses: actions/checkout@v4
 
       - name: Download patch
-        uses: actions/download-artifact@v3
+        uses: actions/download-artifact@v4
         with:
           name: update-spec.patch
           path: ${{ runner.temp }}
@@ -137,7 +137,7 @@ jobs:
         run: '[ -s ${{ runner.temp }}/update-spec.patch ] && git apply ${{ runner.temp }}/update-spec.patch || echo "Empty patch. Skipping."'
 
       - name: Download PR body file
-        uses: actions/download-artifact@v3
+        uses: actions/download-artifact@v4
         with:
           name: PR.md
           path: ${{ runner.temp }}
@@ -149,10 +149,10 @@ jobs:
           branch: automation/spec-update
           author: aws-cdk-automation <aws-cdk-automation@users.noreply.github.com>
           commit-message: |-
-            feat: update AWS Service Spec
-            Update AWS Service Spec packages to latest versions
+            feat: update L1 CloudFormation resource definitions
+            Updates the L1 CloudFormation resource definitions with the latest changes from `@aws-cdk/aws-service-spec`
           # Pull Request details
-          title: "feat: update AWS Service Spec"
+          title: "feat: update L1 CloudFormation resource definitions"
           body-path: ${{ runner.temp }}/PR.md
           labels: contribution/core,dependencies,auto-approve,pr-linter/exempt-integ-test,pr-linter/exempt-readme,pr-linter/exempt-test
           team-reviewers: aws-cdk-team

.github/workflows/update-metadata-regions.yml

@@ -33,7 +33,7 @@ jobs:
           git add .
           git diff --patch --staged > ${{ runner.temp }}/update-spec.patch
       - name: Upload Patch
-        uses: actions/upload-artifact@v3
+        uses: actions/upload-artifact@v4
         with:
           name: update-spec.patch
           path: ${{ runner.temp }}/update-spec.patch
@@ -50,7 +50,7 @@ jobs:
         uses: actions/checkout@v4
 
       - name: Download patch
-        uses: actions/download-artifact@v3
+        uses: actions/download-artifact@v4
         with:
           name: update-spec.patch
           path: ${{ runner.temp }}

.github/workflows/yarn-upgrade.yml

@@ -89,7 +89,7 @@ jobs:
           git add .
           git diff --patch --staged > ${{ runner.temp }}/upgrade.patch
       - name: Upload Patch
-        uses: actions/upload-artifact@v3
+        uses: actions/upload-artifact@v4
         with:
           name: upgrade.patch
           path: ${{ runner.temp }}/upgrade.patch
@@ -106,7 +106,7 @@ jobs:
         uses: actions/checkout@v4
 
       - name: Download patch
-        uses: actions/download-artifact@v3
+        uses: actions/download-artifact@v4
         with:
           name: upgrade.patch
           path: ${{ runner.temp }}

.mergify.yml

@@ -11,7 +11,7 @@ pull_request_rules:
       label:
         add: [ contribution/core ]
     conditions:
-      - author~=^(rix0rrr|MrArnoldPalmer|iliapolo|otaviomacedo|madeline-k|kaizencc|comcalvi|TheRealAmazonKendra|vinayak-kukreja|mrgrain|pahud|cgarvis|kellertk|HBobertz|sumupitchayan|SankyRed|udaypant|colifran|scanlonp|mikewrighton|moelasmar|paulhcsun|awsmjs)$
+      - author~=^(rix0rrr|MrArnoldPalmer|iliapolo|otaviomacedo|madeline-k|kaizencc|comcalvi|TheRealAmazonKendra|vinayak-kukreja|mrgrain|pahud|cgarvis|kellertk|HBobertz|sumupitchayan|SankyRed|udaypant|colifran|scanlonp|mikewrighton|moelasmar|paulhcsun|awsmjs|evgenyka)$
       - -label~="contribution/core"
   - name: automatic merge
     actions:

ROADMAP.md

@@ -33,6 +33,7 @@ Security and stability of the CDK is a top priority. If you think you’ve found
 * 🚀 [App Staging Synthesizer for Resource Isolation](https://aws.amazon.com/blogs/devops/enhancing-resource-isolation-in-aws-cdk-with-the-app-staging-synthesizer/) - This feature enhances resource isolation and cleanup control by creating separate staging resources for each application
 * 👂🏽 [CDK Refactoring](https://github.com/aws/aws-cdk-rfcs/issues/162) - We’re looking into providing built-in support for builder refactoring work.
 * 🛠️ [Understand deployment progress within CloudFormation](https://github.com/aws/aws-cdk-rfcs/issues/586) - This will help builders understand what CloudFormation is doing as deployments are in progress.
+* 🔍 [Garbage Collection for Assets](https://github.com/aws/aws-cdk-rfcs/issues/64) - Assets which are uploaded to the CDK's S3 bucket and ECR repository are never deleted. 
 
 ### Speed up development and testing 
 * 🚀 [Enable CloudFormation builders to migrate existing infrastructure to CDK](https://github.com/aws/aws-cdk/blob/6004a17c593728e36ad4f5c3dcdd578ff46fa9bb/packages/aws-cdk/README.md#cdk-migrate) - CloudFormation builders can now generate a CDK application using an existing CloudFormation template in JSON or YAML format using cdk migrate!
@@ -49,6 +50,7 @@ Security and stability of the CDK is a top priority. If you think you’ve found
 ### L2 Abstractions
 * 🔍 [CloudFront Origin Access Control L2](https://github.com/aws/aws-cdk-rfcs/issues/491)
 * 🛠️ [Enabling IPv6 on Resources and VPCs](https://github.com/aws/aws-cdk/pull/28366)
+* 🔍 [Rewrite EKS L2](https://github.com/aws/aws-cdk-rfcs/issues/605) - drop the custom resource implementation in favor of the native L1.
 
 We are currently investigating other L2s to build out next. Feel free to create an RFC to request.
 

packages/@aws-cdk-testing/cli-integ/resources/cdk-apps/simple-app/app.js

@@ -14,7 +14,7 @@ class SimpleStack extends cdk.Stack {
       visibilityTimeout: cdk.Duration.seconds(300),
     });
     const role = new iam.Role(this, 'role', {
-      assumedBy: new iam.AnyPrincipal(),
+      assumedBy: new iam.AccountRootPrincipal(),
     });
     queue.grantConsumeMessages(role);
   }

packages/@aws-cdk-testing/framework-integ/test/aws-dynamodb/test/integ.global-replicas-provisioned.js.snapshot/aws-cdk-dynamodb-global-replicas-provisioned.template.json

@@ -291,7 +291,7 @@
        {
         "Fn::Sub": "cdk-hnb659fds-assets-${AWS::AccountId}-${AWS::Region}"
        },
-       "/fac70c98815617bfec29fd3dc3b0a9295dba41bc56daf65deb4ecd6b3a35873d.json"
+       "/21276ea69a4912841ecedfb3a8e1b30a5f4c6414c47885941a6d7b73ba42b5a0.json"
       ]
      ]
     }

packages/@aws-cdk-testing/framework-integ/test/aws-dynamodb/test/integ.global-replicas-provisioned.js.snapshot/awscdkdynamodbglobalreplicasprovisionedawscdkawsdynamodbReplicaProviderEA32CB30.nested.template.json

@@ -676,6 +676,22 @@
          ]
         }
        ]
+      },
+      {
+       "Action": [
+        "logs:CreateLogDelivery",
+        "logs:CreateLogStream",
+        "logs:DeleteLogDelivery",
+        "logs:DescribeLogGroups",
+        "logs:DescribeResourcePolicies",
+        "logs:GetLogDelivery",
+        "logs:ListLogDeliveries",
+        "logs:PutLogEvents",
+        "logs:PutResourcePolicy",
+        "logs:UpdateLogDelivery"
+       ],
+       "Effect": "Allow",
+       "Resource": "*"
       }
      ],
      "Version": "2012-10-17"
@@ -688,6 +704,14 @@
     ]
    }
   },
+  "ProviderwaiterstatemachineLogGroupDD693A98": {
+   "Type": "AWS::Logs::LogGroup",
+   "Properties": {
+    "RetentionInDays": 731
+   },
+   "UpdateReplacePolicy": "Retain",
+   "DeletionPolicy": "Retain"
+  },
   "Providerwaiterstatemachine5D4A9DF0": {
    "Type": "AWS::StepFunctions::StateMachine",
    "Properties": {
@@ -713,6 +737,22 @@
       ]
      ]
     },
+    "LoggingConfiguration": {
+     "Destinations": [
+      {
+       "CloudWatchLogsLogGroup": {
+        "LogGroupArn": {
+         "Fn::GetAtt": [
+          "ProviderwaiterstatemachineLogGroupDD693A98",
+          "Arn"
+         ]
+        }
+       }
+      }
+     ],
+     "IncludeExecutionData": false,
+     "Level": "ERROR"
+    },
     "RoleArn": {
      "Fn::GetAtt": [
       "ProviderwaiterstatemachineRole0C7159F9",