From fdf612a45b3d3c0f8c972bd2736cb9f93e2e7057 Mon Sep 17 00:00:00 2001
From: Rico Huijbers <rix0rrr@gmail.com>
Date: Tue, 24 Aug 2021 11:26:24 +0200
Subject: [PATCH 01/91] docs(pipelines): should use 'lookup' tag instead of
 'deploy' tag (#15984)

The code example was using the wrong condition.


----

*By submitting this pull request, I confirm that my contribution is made under the terms of the Apache-2.0 license*
---
 packages/@aws-cdk/pipelines/README.md | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/packages/@aws-cdk/pipelines/README.md b/packages/@aws-cdk/pipelines/README.md
index f17a35e3a9990..bab41842c2316 100644
--- a/packages/@aws-cdk/pipelines/README.md
+++ b/packages/@aws-cdk/pipelines/README.md
@@ -955,7 +955,7 @@ new CodePipeline(this, 'Pipeline', {
         resources: ['*'],
         conditions: {
           StringEquals: {
-            'iam:ResourceTag/aws-cdk:bootstrap-role': 'deploy',
+            'iam:ResourceTag/aws-cdk:bootstrap-role': 'lookup',
           },
         },
       }),

From 0d0db38e3cdb557b4a641c5993068400847cc7df Mon Sep 17 00:00:00 2001
From: Yihui Han <53243835+readybuilderone@users.noreply.github.com>
Date: Tue, 24 Aug 2021 18:09:03 +0800
Subject: [PATCH 02/91] fix: (aws-ec2): fix vpc endpoint incorrect issue in
 China region (#16139)

fix:(aws-ec2): fix vpc endpoint incorrect issue in China region

This PR fix the issue that can't create interface vpc endpoint for 40+ services like ecr, ec2, athena etc

Closes: #9864


----

# Considerations
1. In cn-north-1 region, there are:
  - 2 services whose endpoint service begin with "aws.sagemaker" prefix;
  - 41 services whose endpoint service begin with "cn.com.amazonaws" prefix;
  - 21 services whose endpoint service begin with "com.amazonaws" prefix;
    Details: https://gist.github.com/readybuilderone/d355f9f8f0f2b66379a10742b3c67cc7
2. in cn-northwest-1 region, there are:
  - 2 services whose endpoint service begin with "aws.sagemaker" prefix;
  - 44 services whose endpoint service begin with "cn.com.amazonaws" prefix;
  - 21 services whose endpoint service begin with "com.amazonaws" prefix;
    Details: https://gist.github.com/readybuilderone/a79f2c5e6fa02aae1699bf674b08be7c

So, In cn-north-1 and cn-northwest-1, the vpc endpoint prefix is both region and service related.

At first, I found the vpc endpoint prefix could be fetched via [AWS API](https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_DescribeVpcEndpoints.html) , however  the javascript sdk supports only asynchronous call, currently I didn't find any pattern in CDK to make live calls in object construction.  Since the exception rules won't ever change ( only be added to), and the rate of change should be small in the grand scheme, I just kept the exception prefix lists  in a map as fact data.

# Known Issues
Since the interface vpc endpoints prefixs are not region agnostic, it requires to set the {region} in the environment to create stacks in cn-north-1, and cn-northwest-1. The methods could be found in the [offical guide](https://docs.aws.amazon.com/cdk/latest/guide/environments.html).

*By submitting this pull request, I confirm that my contribution is made under the terms of the Apache-2.0 license*
---
 packages/@aws-cdk/aws-ec2/lib/vpc-endpoint.ts |  63 +++++++++-
 .../aws-ec2/test/vpc-endpoint.test.ts         | 119 ++++++++++++++++++
 2 files changed, 181 insertions(+), 1 deletion(-)

diff --git a/packages/@aws-cdk/aws-ec2/lib/vpc-endpoint.ts b/packages/@aws-cdk/aws-ec2/lib/vpc-endpoint.ts
index dd28d74e84ea1..69ad4aab88404 100644
--- a/packages/@aws-cdk/aws-ec2/lib/vpc-endpoint.ts
+++ b/packages/@aws-cdk/aws-ec2/lib/vpc-endpoint.ts
@@ -326,9 +326,70 @@ export class InterfaceVpcEndpointAwsService implements IInterfaceVpcEndpointServ
     const region = Lazy.uncachedString({
       produce: (context) => Stack.of(context.scope).region,
     });
-    this.name = `${prefix || 'com.amazonaws'}.${region}.${name}`;
+    const defaultEndpointPrefix = Lazy.uncachedString({
+      produce: (context) => {
+        const regionName = Stack.of(context.scope).region;
+        return this.getDefaultEndpointPrefix(name, regionName);
+      },
+    });
+    const defaultEndpointSuffix = Lazy.uncachedString({
+      produce: (context) => {
+        const regionName = Stack.of(context.scope).region;
+        return this.getDefaultEndpointSuffix(name, regionName);
+      },
+    });
+
+    this.name = `${prefix || defaultEndpointPrefix}.${region}.${name}${defaultEndpointSuffix}`;
     this.port = port || 443;
   }
+
+  /**
+   * Get the endpoint prefix for the service in the specified region
+   * because the prefix for some of the services in cn-north-1 and cn-northwest-1 are different
+   *
+   * For future maintenance， the vpc endpoint services could be fetched using AWS CLI Commmand:
+   * aws ec2 describe-vpc-endpoint-services
+   */
+  private getDefaultEndpointPrefix(name: string, region: string) {
+    const VPC_ENDPOINT_SERVICE_EXCEPTIONS: { [region: string]: string[] } = {
+      'cn-north-1': ['application-autoscaling', 'athena', 'autoscaling', 'awsconnector', 'cassandra',
+        'cloudformation', 'codedeploy-commands-secure', 'databrew', 'dms', 'ebs', 'ec2', 'ecr.api', 'ecr.dkr',
+        'elasticbeanstalk', 'elasticfilesystem', 'elasticfilesystem-fips', 'execute-api', 'imagebuilder',
+        'iotsitewise.api', 'iotsitewise.data', 'kinesis-streams', 'lambda', 'license-manager', 'monitoring',
+        'rds', 'redshift', 'redshift-data', 's3', 'sagemaker.api', 'sagemaker.featurestore-runtime',
+        'sagemaker.runtime', 'servicecatalog', 'sms', 'sqs', 'states', 'sts', 'synthetics', 'transcribe',
+        'transcribestreaming', 'transfer', 'xray'],
+      'cn-northwest-1': ['application-autoscaling', 'athena', 'autoscaling', 'awsconnector', 'cassandra',
+        'cloudformation', 'codedeploy-commands-secure', 'databrew', 'dms', 'ebs', 'ec2', 'ecr.api', 'ecr.dkr',
+        'elasticbeanstalk', 'elasticfilesystem', 'elasticfilesystem-fips', 'execute-api', 'imagebuilder',
+        'kinesis-streams', 'lambda', 'license-manager', 'monitoring', 'rds', 'redshift', 'redshift-data', 's3',
+        'sagemaker.api', 'sagemaker.featurestore-runtime', 'sagemaker.runtime', 'servicecatalog', 'sms', 'sqs',
+        'states', 'sts', 'synthetics', 'transcribe', 'transcribestreaming', 'transfer', 'workspaces', 'xray'],
+    };
+    if (VPC_ENDPOINT_SERVICE_EXCEPTIONS[region]?.includes(name)) {
+      return 'cn.com.amazonaws';
+    } else {
+      return 'com.amazonaws';
+    }
+  }
+
+  /**
+   * Get the endpoint suffix for the service in the specified region.
+   * In cn-north-1 and cn-northwest-1, the vpc endpoint of transcribe is:
+   *   cn.com.amazonaws.cn-north-1.transcribe.cn
+   *   cn.com.amazonaws.cn-northwest-1.transcribe.cn
+   * so suffix '.cn' should be return in these scenarios.
+   *
+   * For future maintenance， the vpc endpoint services could be fetched using AWS CLI Commmand:
+   * aws ec2 describe-vpc-endpoint-services
+   */
+  private getDefaultEndpointSuffix(name: string, region: string) {
+    const VPC_ENDPOINT_SERVICE_EXCEPTIONS: { [region: string]: string[] } = {
+      'cn-north-1': ['transcribe'],
+      'cn-northwest-1': ['transcribe'],
+    };
+    return VPC_ENDPOINT_SERVICE_EXCEPTIONS[region]?.includes(name) ? '.cn' : '';
+  }
 }
 
 /**
diff --git a/packages/@aws-cdk/aws-ec2/test/vpc-endpoint.test.ts b/packages/@aws-cdk/aws-ec2/test/vpc-endpoint.test.ts
index a59dfbbca07eb..267c48a9e4145 100644
--- a/packages/@aws-cdk/aws-ec2/test/vpc-endpoint.test.ts
+++ b/packages/@aws-cdk/aws-ec2/test/vpc-endpoint.test.ts
@@ -607,5 +607,124 @@ nodeunitShim({
       }));
       test.done();
     },
+    'test vpc interface endpoint with cn.com.amazonaws prefix can be created correctly in cn-north-1'(test: Test) {
+      //GIVEN
+      const stack = new Stack(undefined, 'TestStack', { env: { account: '123456789012', region: 'cn-north-1' } });
+      const vpc = new Vpc(stack, 'VPC');
+
+      //WHEN
+      vpc.addInterfaceEndpoint('ECR Endpoint', {
+        service: InterfaceVpcEndpointAwsService.ECR,
+      });
+
+      //THEN
+      expect(stack).to(haveResource('AWS::EC2::VPCEndpoint', {
+        ServiceName: 'cn.com.amazonaws.cn-north-1.ecr.api',
+      }));
+
+      test.done();
+    },
+    'test vpc interface endpoint with cn.com.amazonaws prefix can be created correctly in cn-northwest-1'(test: Test) {
+      //GIVEN
+      const stack = new Stack(undefined, 'TestStack', { env: { account: '123456789012', region: 'cn-northwest-1' } });
+      const vpc = new Vpc(stack, 'VPC');
+
+      //WHEN
+      vpc.addInterfaceEndpoint('Lambda Endpoint', {
+        service: InterfaceVpcEndpointAwsService.LAMBDA,
+      });
+
+      //THEN
+      expect(stack).to(haveResource('AWS::EC2::VPCEndpoint', {
+        ServiceName: 'cn.com.amazonaws.cn-northwest-1.lambda',
+      }));
+
+      test.done();
+    },
+    'test vpc interface endpoint without cn.com.amazonaws prefix can be created correctly in cn-north-1'(test: Test) {
+      //GIVEN
+      const stack = new Stack(undefined, 'TestStack', { env: { account: '123456789012', region: 'cn-north-1' } });
+      const vpc = new Vpc(stack, 'VPC');
+
+      //WHEN
+      vpc.addInterfaceEndpoint('ECS Endpoint', {
+        service: InterfaceVpcEndpointAwsService.ECS,
+      });
+
+      //THEN
+      expect(stack).to(haveResource('AWS::EC2::VPCEndpoint', {
+        ServiceName: 'com.amazonaws.cn-north-1.ecs',
+      }));
+
+      test.done();
+    },
+    'test vpc interface endpoint without cn.com.amazonaws prefix can be created correctly in cn-northwest-1'(test: Test) {
+      //GIVEN
+      const stack = new Stack(undefined, 'TestStack', { env: { account: '123456789012', region: 'cn-northwest-1' } });
+      const vpc = new Vpc(stack, 'VPC');
+
+      //WHEN
+      vpc.addInterfaceEndpoint('Glue Endpoint', {
+        service: InterfaceVpcEndpointAwsService.GLUE,
+      });
+
+      //THEN
+      expect(stack).to(haveResource('AWS::EC2::VPCEndpoint', {
+        ServiceName: 'com.amazonaws.cn-northwest-1.glue',
+      }));
+
+      test.done();
+    },
+    'test vpc interface endpoint for transcribe can be created correctly in non-china regions'(test: Test) {
+      //GIVEN
+      const stack = new Stack(undefined, 'TestStack', { env: { account: '123456789012', region: 'us-east-1' } });
+      const vpc = new Vpc(stack, 'VPC');
+
+      //WHEN
+      vpc.addInterfaceEndpoint('Transcribe Endpoint', {
+        service: InterfaceVpcEndpointAwsService.TRANSCRIBE,
+      });
+
+      //THEN
+      expect(stack).to(haveResource('AWS::EC2::VPCEndpoint', {
+        ServiceName: 'com.amazonaws.us-east-1.transcribe',
+      }));
+
+      test.done();
+    },
+    'test vpc interface endpoint for transcribe can be created correctly in cn-north-1'(test: Test) {
+      //GIVEN
+      const stack = new Stack(undefined, 'TestStack', { env: { account: '123456789012', region: 'cn-north-1' } });
+      const vpc = new Vpc(stack, 'VPC');
+
+      //WHEN
+      vpc.addInterfaceEndpoint('Transcribe Endpoint', {
+        service: InterfaceVpcEndpointAwsService.TRANSCRIBE,
+      });
+
+      //THEN
+      expect(stack).to(haveResource('AWS::EC2::VPCEndpoint', {
+        ServiceName: 'cn.com.amazonaws.cn-north-1.transcribe.cn',
+      }));
+
+      test.done();
+    },
+    'test vpc interface endpoint for transcribe can be created correctly in cn-northwest-1'(test: Test) {
+      //GIVEN
+      const stack = new Stack(undefined, 'TestStack', { env: { account: '123456789012', region: 'cn-northwest-1' } });
+      const vpc = new Vpc(stack, 'VPC');
+
+      //WHEN
+      vpc.addInterfaceEndpoint('Transcribe Endpoint', {
+        service: InterfaceVpcEndpointAwsService.TRANSCRIBE,
+      });
+
+      //THEN
+      expect(stack).to(haveResource('AWS::EC2::VPCEndpoint', {
+        ServiceName: 'cn.com.amazonaws.cn-northwest-1.transcribe.cn',
+      }));
+
+      test.done();
+    },
   },
 });

From 1be373c14350e2fade0874579f6196384dc8d3d2 Mon Sep 17 00:00:00 2001
From: Rico Huijbers <rix0rrr@gmail.com>
Date: Tue, 24 Aug 2021 12:54:25 +0200
Subject: [PATCH 03/91] =?UTF-8?q?chore:=20`publishInParallel=3Dfalse`=20wi?=
 =?UTF-8?q?th=20tokens=20produces=20useless=20error=20m=E2=80=A6=20(#16196?=
 =?UTF-8?q?)?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

…essage

When a buildspec is written to disk at synth time and the BuildSpec
contains CFN references, the error produced is:

```
The "data" argument must be of type string or an instance of Buffer, TypedArray, or DataView. Received an instance of Object
```

Because it's trying to write the `{ Fn::Join }` instead of a plain
string. This error message is pretty useless.

Supporting the feature correctly is a lot more complicated, but at
least we can detect this situation and give a more readable error
message.

Relates to #16164.


----

*By submitting this pull request, I confirm that my contribution is made under the terms of the Apache-2.0 license*
---
 .../lib/codepipeline/_codebuild-factory.ts    | 10 +++++++-
 .../pipelines/test/docker-credentials.test.ts | 24 +++++++++++++++++--
 2 files changed, 31 insertions(+), 3 deletions(-)

diff --git a/packages/@aws-cdk/pipelines/lib/codepipeline/_codebuild-factory.ts b/packages/@aws-cdk/pipelines/lib/codepipeline/_codebuild-factory.ts
index ac125aee29f0d..59abcbe8e287d 100644
--- a/packages/@aws-cdk/pipelines/lib/codepipeline/_codebuild-factory.ts
+++ b/packages/@aws-cdk/pipelines/lib/codepipeline/_codebuild-factory.ts
@@ -241,7 +241,15 @@ export class CodeBuildFactory implements ICodePipelineActionFactory {
       // Write to disk and replace with a reference
       const relativeSpecFile = `buildspec-${Node.of(scope).addr}-${this.constructId}.yaml`;
       const absSpecFile = path.join(cloudAssemblyBuildSpecDir(scope), relativeSpecFile);
-      fs.writeFileSync(absSpecFile, Stack.of(scope).resolve(actualBuildSpec.toBuildSpec()), { encoding: 'utf-8' });
+
+      // This should resolve to a pure JSON string. If it resolves to an object, it's a CFN
+      // expression, and we can't support that yet. Maybe someday if we think really hard about it.
+      const fileContents = Stack.of(scope).resolve(actualBuildSpec.toBuildSpec());
+
+      if (typeof fileContents !== 'string') {
+        throw new Error(`This BuildSpec contains CloudFormation references and is supported by publishInParallel=false: ${JSON.stringify(fileContents, undefined, 2)}`);
+      }
+      fs.writeFileSync(absSpecFile, fileContents, { encoding: 'utf-8' });
       projectBuildSpec = codebuild.BuildSpec.fromSourceFilename(relativeSpecFile);
     } else {
       projectBuildSpec = actualBuildSpec;
diff --git a/packages/@aws-cdk/pipelines/test/docker-credentials.test.ts b/packages/@aws-cdk/pipelines/test/docker-credentials.test.ts
index de9d7efa54852..9e3559242e04c 100644
--- a/packages/@aws-cdk/pipelines/test/docker-credentials.test.ts
+++ b/packages/@aws-cdk/pipelines/test/docker-credentials.test.ts
@@ -6,12 +6,14 @@ import * as iam from '@aws-cdk/aws-iam';
 import * as secretsmanager from '@aws-cdk/aws-secretsmanager';
 import * as cdk from '@aws-cdk/core';
 import * as cdkp from '../lib';
+import { ShellStep } from '../lib';
+import { DockerAssetApp, TestApp } from './testhelpers';
 
 let app: cdk.App;
 let stack: cdk.Stack;
 
 beforeEach(() => {
-  app = new cdk.App();
+  app = new TestApp();
   stack = new cdk.Stack(app, 'Stack', {
     env: { account: '0123456789012', region: 'eu-west-1' },
   });
@@ -299,9 +301,27 @@ describe('EcrDockerCredential', () => {
 
       expect(stack).not.toHaveResource('AWS::IAM::Policy');
     });
-
   });
 
+  // This test doesn't actually work yet. See https://github.com/aws/aws-cdk/issues/16164
+  // eslint-disable-next-line jest/no-disabled-tests
+  test.skip('with non-parallel publishing', () => {
+    const pipelines = new cdkp.CodePipeline(stack, 'Pipeline', {
+      synth: new ShellStep('Build', {
+        input: cdkp.CodePipelineSource.gitHub('test/test', 'test'),
+        commands: ['cdk synth'],
+      }),
+
+      publishAssetsInParallel: false,
+      dockerCredentials: [
+        cdkp.DockerCredential.ecr([repo]),
+      ],
+    });
+    pipelines.addStage(new DockerAssetApp(stack, 'AssetApp'));
+
+    // Should not throw
+    app.synth();
+  });
 });
 
 describe('dockerCredentialsInstallCommands', () => {

From 9c39bcb970fc791e94d199b962cc006fca1a3320 Mon Sep 17 00:00:00 2001
From: Sam Wilson <samtwil@live.com>
Date: Tue, 24 Aug 2021 06:56:44 -0500
Subject: [PATCH 04/91] fix(apigatewayv2): http api - disallow empty string as
 domain name (#16044)

Currently, empty strings are allowed for custom domain name values despite other tools such as the AWS CLI not allowing empty string values. This effort brings the `DomainName` construct up to date with other tooling.

----

*By submitting this pull request, I confirm that my contribution is made under the terms of the Apache-2.0 license*
---
 .../aws-apigatewayv2/lib/common/domain-name.ts   |  4 ++++
 .../test/http/domain-name.test.ts                | 16 ++++++++++++++++
 2 files changed, 20 insertions(+)

diff --git a/packages/@aws-cdk/aws-apigatewayv2/lib/common/domain-name.ts b/packages/@aws-cdk/aws-apigatewayv2/lib/common/domain-name.ts
index 94d284c7f16c6..dca1a60bd4548 100644
--- a/packages/@aws-cdk/aws-apigatewayv2/lib/common/domain-name.ts
+++ b/packages/@aws-cdk/aws-apigatewayv2/lib/common/domain-name.ts
@@ -84,6 +84,10 @@ export class DomainName extends Resource implements IDomainName {
   constructor(scope: Construct, id: string, props: DomainNameProps) {
     super(scope, id);
 
+    if (props.domainName === '') {
+      throw new Error('empty string for domainName not allowed');
+    }
+
     const domainNameProps: CfnDomainNameProps = {
       domainName: props.domainName,
       domainNameConfigurations: [
diff --git a/packages/@aws-cdk/aws-apigatewayv2/test/http/domain-name.test.ts b/packages/@aws-cdk/aws-apigatewayv2/test/http/domain-name.test.ts
index dc64fbf5bf7c9..30c981a1da1d5 100644
--- a/packages/@aws-cdk/aws-apigatewayv2/test/http/domain-name.test.ts
+++ b/packages/@aws-cdk/aws-apigatewayv2/test/http/domain-name.test.ts
@@ -29,6 +29,22 @@ describe('DomainName', () => {
     });
   });
 
+  test('throws when domainName is empty string', () => {
+    // GIVEN
+    const stack = new Stack();
+
+    // WHEN
+    const t = () => {
+      new DomainName(stack, 'DomainName', {
+        domainName: '',
+        certificate: Certificate.fromCertificateArn(stack, 'cert', certArn),
+      });
+    };
+
+    // THEN
+    expect(t).toThrow(/empty string for domainName not allowed/);
+  });
+
   test('import domain name correctly', () => {
     // GIVEN
     const stack = new Stack();

From 305f683e86cca221705c0138572faa38043396eb Mon Sep 17 00:00:00 2001
From: Giedrius Kaskonas <57504623+gkaskonas@users.noreply.github.com>
Date: Tue, 24 Aug 2021 15:47:49 +0100
Subject: [PATCH 05/91] feat(lambda): nodejs14.x supports inline code (#16131)

Cloudformation now supports Inline code for NodeJS14 runtime. Updating CDK to reflect that

----

*By submitting this pull request, I confirm that my contribution is made under the terms of the Apache-2.0 license*
---
 packages/@aws-cdk/aws-lambda/lib/runtime.ts   |  2 +-
 .../integ.runtime.inlinecode.expected.json    | 55 +++++++++++++++++++
 .../test/integ.runtime.inlinecode.ts          |  7 +++
 3 files changed, 63 insertions(+), 1 deletion(-)

diff --git a/packages/@aws-cdk/aws-lambda/lib/runtime.ts b/packages/@aws-cdk/aws-lambda/lib/runtime.ts
index e354e5862cc6e..ae26ca066e1c9 100644
--- a/packages/@aws-cdk/aws-lambda/lib/runtime.ts
+++ b/packages/@aws-cdk/aws-lambda/lib/runtime.ts
@@ -77,7 +77,7 @@ export class Runtime {
   /**
    * The NodeJS 14.x runtime (nodejs14.x)
    */
-  public static readonly NODEJS_14_X = new Runtime('nodejs14.x', RuntimeFamily.NODEJS, { supportsInlineCode: false });
+  public static readonly NODEJS_14_X = new Runtime('nodejs14.x', RuntimeFamily.NODEJS, { supportsInlineCode: true });
 
   /**
    * The Python 2.7 runtime (python2.7)
diff --git a/packages/@aws-cdk/aws-lambda/test/integ.runtime.inlinecode.expected.json b/packages/@aws-cdk/aws-lambda/test/integ.runtime.inlinecode.expected.json
index 30d39828cc39d..59961a0755b84 100644
--- a/packages/@aws-cdk/aws-lambda/test/integ.runtime.inlinecode.expected.json
+++ b/packages/@aws-cdk/aws-lambda/test/integ.runtime.inlinecode.expected.json
@@ -299,6 +299,56 @@
       "DependsOn": [
         "PYTHON38ServiceRole3EA86BBE"
       ]
+    },
+    "NODEJS14XServiceRole4523ECDB": {
+      "Type": "AWS::IAM::Role",
+      "Properties": {
+        "AssumeRolePolicyDocument": {
+          "Statement": [
+            {
+              "Action": "sts:AssumeRole",
+              "Effect": "Allow",
+              "Principal": {
+                "Service": "lambda.amazonaws.com"
+              }
+            }
+          ],
+          "Version": "2012-10-17"
+        },
+        "ManagedPolicyArns": [
+          {
+            "Fn::Join": [
+              "",
+              [
+                "arn:",
+                {
+                  "Ref": "AWS::Partition"
+                },
+                ":iam::aws:policy/service-role/AWSLambdaBasicExecutionRole"
+              ]
+            ]
+          }
+        ]
+      }
+    },
+    "NODEJS14X930214A3": {
+      "Type": "AWS::Lambda::Function",
+      "Properties": {
+        "Code": {
+          "ZipFile": "exports.handler = async function(event) { return \"success\" }"
+        },
+        "Role": {
+          "Fn::GetAtt": [
+            "NODEJS14XServiceRole4523ECDB",
+            "Arn"
+          ]
+        },
+        "Handler": "index.handler",
+        "Runtime": "nodejs14.x"
+      },
+      "DependsOn": [
+        "NODEJS14XServiceRole4523ECDB"
+      ]
     }
   },
   "Outputs": {
@@ -331,6 +381,11 @@
       "Value": {
         "Ref": "PYTHON38A180AE47"
       }
+    },
+    "NODEJS14XfunctionName": {
+      "Value": {
+        "Ref": "NODEJS14X930214A3"
+      }
     }
   }
 }
\ No newline at end of file
diff --git a/packages/@aws-cdk/aws-lambda/test/integ.runtime.inlinecode.ts b/packages/@aws-cdk/aws-lambda/test/integ.runtime.inlinecode.ts
index 56f5bd27f7746..3bde19e5cd22b 100644
--- a/packages/@aws-cdk/aws-lambda/test/integ.runtime.inlinecode.ts
+++ b/packages/@aws-cdk/aws-lambda/test/integ.runtime.inlinecode.ts
@@ -57,4 +57,11 @@ const python38 = new Function(stack, 'PYTHON_3_8', {
 });
 new CfnOutput(stack, 'PYTHON_3_8-functionName', { value: python38.functionName });
 
+const node14xfn = new Function(stack, 'NODEJS_14_X', {
+  code: new InlineCode('exports.handler = async function(event) { return "success" }'),
+  handler: 'index.handler',
+  runtime: Runtime.NODEJS_14_X,
+});
+new CfnOutput(stack, 'NODEJS_14_X-functionName', { value: node14xfn.functionName });
+
 app.synth();

From 64019bbf090e156261feb626a5a4bd7ff4f26545 Mon Sep 17 00:00:00 2001
From: Emil Rowland <rowland.emil@gmail.com>
Date: Tue, 24 Aug 2021 17:28:27 +0200
Subject: [PATCH 06/91] feat(cognito): user pools - device tracking (#16055)

fixes #15013

This pull request adds the support of device configuration for Cognito user pools. [DeviceConfiguration](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-cognito-userpool-deviceconfiguration.html)

----

*By submitting this pull request, I confirm that my contribution is made under the terms of the Apache-2.0 license*
---
 packages/@aws-cdk/aws-cognito/README.md       | 18 +++++++++++++
 .../@aws-cdk/aws-cognito/lib/user-pool.ts     | 27 +++++++++++++++++++
 .../aws-cognito/test/user-pool.test.ts        | 21 +++++++++++++++
 3 files changed, 66 insertions(+)

diff --git a/packages/@aws-cdk/aws-cognito/README.md b/packages/@aws-cdk/aws-cognito/README.md
index bdb93fc24d566..b015607589652 100644
--- a/packages/@aws-cdk/aws-cognito/README.md
+++ b/packages/@aws-cdk/aws-cognito/README.md
@@ -45,6 +45,7 @@ This module is part of the [AWS Cloud Development Kit](https://github.com/aws/aw
     - [Multi-factor Authentication](#multi-factor-authentication-mfa)
     - [Account Recovery Settings](#account-recovery-settings)
   - [Emails](#emails)
+  - [Device Tracking](#device-tracking)
   - [Lambda Triggers](#lambda-triggers)
     - [Trigger Permissions](#trigger-permissions)
   - [Import](#importing-user-pools)
@@ -337,6 +338,23 @@ layer](https://docs.aws.amazon.com/cdk/latest/guide/cfn_layer.html) to configure
 If an email address contains non-ASCII characters, it will be encoded using the [punycode
 encoding](https://en.wikipedia.org/wiki/Punycode) when generating the template for Cloudformation.
 
+### Device Tracking
+
+User pools can be configured to track devices that users have logged in to.
+Read more at [Device Tracking](https://docs.aws.amazon.com/cognito/latest/developerguide/amazon-cognito-user-pools-device-tracking.html)
+
+```ts
+new cognito.UserPool(this, 'myuserpool', {
+  // ...
+  deviceTracking: {
+    challengeRequiredOnNewDevice: true,
+    deviceOnlyRememberedOnUserPrompt: true,
+  },
+});
+```
+
+The default is to not track devices.
+
 ### Lambda Triggers
 
 User pools can be configured such that AWS Lambda functions can be triggered when certain user operations or actions
diff --git a/packages/@aws-cdk/aws-cognito/lib/user-pool.ts b/packages/@aws-cdk/aws-cognito/lib/user-pool.ts
index 9f598761ee843..6277ee0f467ee 100644
--- a/packages/@aws-cdk/aws-cognito/lib/user-pool.ts
+++ b/packages/@aws-cdk/aws-cognito/lib/user-pool.ts
@@ -429,6 +429,26 @@ export enum AccountRecovery {
   NONE,
 }
 
+/**
+ * Device tracking settings
+ * @see https://docs.aws.amazon.com/cognito/latest/developerguide/amazon-cognito-user-pools-device-tracking.html
+ */
+export interface DeviceTracking {
+  /**
+   * Indicates whether a challenge is required on a new device. Only applicable to a new device.
+   * @see https://docs.aws.amazon.com/cognito/latest/developerguide/amazon-cognito-user-pools-device-tracking.html
+   * @default false
+   */
+  readonly challengeRequiredOnNewDevice: boolean;
+
+  /**
+   * If true, a device is only remembered on user prompt.
+   * @see https://docs.aws.amazon.com/cognito/latest/developerguide/amazon-cognito-user-pools-device-tracking.html
+   * @default false
+   */
+  readonly deviceOnlyRememberedOnUserPrompt: boolean;
+}
+
 /**
  * Props for the UserPool construct
  */
@@ -581,6 +601,12 @@ export interface UserPoolProps {
    * @default RemovalPolicy.RETAIN
    */
   readonly removalPolicy?: RemovalPolicy;
+
+  /**
+   * Device tracking settings
+   * @default - see defaults on each property of DeviceTracking.
+   */
+  readonly deviceTracking?: DeviceTracking;
 }
 
 /**
@@ -787,6 +813,7 @@ export class UserPool extends UserPoolBase {
         caseSensitive: props.signInCaseSensitive,
       }),
       accountRecoverySetting: this.accountRecovery(props),
+      deviceConfiguration: props.deviceTracking,
     });
     userPool.applyRemovalPolicy(props.removalPolicy);
 
diff --git a/packages/@aws-cdk/aws-cognito/test/user-pool.test.ts b/packages/@aws-cdk/aws-cognito/test/user-pool.test.ts
index 75ed3dcfa1a2d..0c61312222355 100644
--- a/packages/@aws-cdk/aws-cognito/test/user-pool.test.ts
+++ b/packages/@aws-cdk/aws-cognito/test/user-pool.test.ts
@@ -1390,6 +1390,27 @@ describe('User Pool', () => {
   });
 });
 
+test('device tracking is configured correctly', () => {
+  // GIVEN
+  const stack = new Stack();
+
+  // WHEN
+  new UserPool(stack, 'Pool', {
+    deviceTracking: {
+      challengeRequiredOnNewDevice: true,
+      deviceOnlyRememberedOnUserPrompt: true,
+    },
+  });
+
+  // THEN
+  Template.fromStack(stack).hasResourceProperties('AWS::Cognito::UserPool', {
+    DeviceConfiguration: {
+      ChallengeRequiredOnNewDevice: true,
+      DeviceOnlyRememberedOnUserPrompt: true,
+    },
+  });
+});
+
 
 function fooFunction(scope: Construct, name: string): lambda.IFunction {
   return new lambda.Function(scope, name, {

From 90f95e10f4dd9e4992731d6262dcfc767b65ab3f Mon Sep 17 00:00:00 2001
From: Niranjan Jayakar <nija@amazon.com>
Date: Tue, 24 Aug 2021 17:08:35 +0100
Subject: [PATCH 07/91] feat(assertions): queries and assertions against the
 Outputs and Mappings sections (#15892)

Introduce APIs `hasOutput()`, `findOutputs()`, `hasMapping()`
and `findMappings()` to assert the `Mappings` and `Outputs`
section of the CloudFormation template.

Also, refactored the implementation of `hasResource()` to
increase re-usability of its implementation across these new APIs.

Migrated the modules `aws-kinesisfirehose` and `aws-neptune`
that use these new APIs.

----

*By submitting this pull request, I confirm that my contribution is made under the terms of the Apache-2.0 license*
---
 packages/@aws-cdk/assertions/README.md        |  18 +-
 packages/@aws-cdk/assertions/lib/match.ts     |  12 +-
 packages/@aws-cdk/assertions/lib/matcher.ts   |   8 +
 .../assertions/lib/private/mappings.ts        |  31 ++++
 .../assertions/lib/private/outputs.ts         |  31 ++++
 .../assertions/lib/private/resource.ts        |  82 ---------
 .../assertions/lib/private/resources.ts       |  42 +++++
 .../assertions/lib/private/section.ts         |  58 ++++++
 packages/@aws-cdk/assertions/lib/template.ts  |  50 +++++-
 .../assertions/test/private/section.test.ts   |  43 +++++
 .../@aws-cdk/assertions/test/template.test.ts | 166 +++++++++++++++++-
 .../@aws-cdk/aws-kinesisfirehose/package.json |   2 +-
 .../test/delivery-stream.test.ts              | 153 +++++++---------
 packages/@aws-cdk/aws-neptune/package.json    |   4 +-
 .../@aws-cdk/aws-neptune/test/cluster.test.ts |  49 +++---
 .../aws-neptune/test/instance.test.ts         |  30 ++--
 .../aws-neptune/test/parameter-group.test.ts  |  10 +-
 .../aws-neptune/test/subnet-group.test.ts     |  10 +-
 18 files changed, 566 insertions(+), 233 deletions(-)
 create mode 100644 packages/@aws-cdk/assertions/lib/private/mappings.ts
 create mode 100644 packages/@aws-cdk/assertions/lib/private/outputs.ts
 delete mode 100644 packages/@aws-cdk/assertions/lib/private/resource.ts
 create mode 100644 packages/@aws-cdk/assertions/lib/private/resources.ts
 create mode 100644 packages/@aws-cdk/assertions/lib/private/section.ts
 create mode 100644 packages/@aws-cdk/assertions/test/private/section.test.ts

diff --git a/packages/@aws-cdk/assertions/README.md b/packages/@aws-cdk/assertions/README.md
index bfeb893417c31..67109b1156964 100644
--- a/packages/@aws-cdk/assertions/README.md
+++ b/packages/@aws-cdk/assertions/README.md
@@ -107,11 +107,23 @@ By default, the `hasResource()` and `hasResourceProperties()` APIs perform deep
 partial object matching. This behavior can be configured using matchers.
 See subsequent section on [special matchers](#special-matchers).
 
+## Other Sections
+
+Similar to the `hasResource()` and `findResources()`, we have equivalent methods
+to check and find other sections of the CloudFormation resources.
+
+* Outputs - `hasOutput()` and `findOutputs()`
+* Mapping - `hasMapping()` and `findMappings()`
+
+All of the defaults and behaviour documented for `hasResource()` and
+`findResources()` apply to these methods.
+
 ## Special Matchers
 
-The expectation provided to the `hasResourceXXX()` methods, besides carrying
-literal values, as seen in the above examples, can also have special matchers
-encoded. 
+The expectation provided to the `hasXXX()` and `findXXX()` methods, besides
+carrying literal values, as seen in the above examples, also accept special
+matchers. 
+
 They are available as part of the `Match` class.
 
 ### Object Matchers
diff --git a/packages/@aws-cdk/assertions/lib/match.ts b/packages/@aws-cdk/assertions/lib/match.ts
index 0272f344efcbc..2a88bada59bac 100644
--- a/packages/@aws-cdk/assertions/lib/match.ts
+++ b/packages/@aws-cdk/assertions/lib/match.ts
@@ -99,7 +99,7 @@ class LiteralMatch extends Matcher {
       return new ObjectMatch(this.name, this.pattern, { partial: this.partialObjects }).test(actual);
     }
 
-    const result = new MatchResult();
+    const result = new MatchResult(actual);
     if (typeof this.pattern !== typeof actual) {
       result.push(this, [], `Expected type ${typeof this.pattern} but received ${getType(actual)}`);
       return result;
@@ -152,16 +152,16 @@ class ArrayMatch extends Matcher {
 
   public test(actual: any): MatchResult {
     if (!Array.isArray(actual)) {
-      return new MatchResult().push(this, [], `Expected type array but received ${getType(actual)}`);
+      return new MatchResult(actual).push(this, [], `Expected type array but received ${getType(actual)}`);
     }
     if (!this.partial && this.pattern.length !== actual.length) {
-      return new MatchResult().push(this, [], `Expected array of length ${this.pattern.length} but received ${actual.length}`);
+      return new MatchResult(actual).push(this, [], `Expected array of length ${this.pattern.length} but received ${actual.length}`);
     }
 
     let patternIdx = 0;
     let actualIdx = 0;
 
-    const result = new MatchResult();
+    const result = new MatchResult(actual);
     while (patternIdx < this.pattern.length && actualIdx < actual.length) {
       const patternElement = this.pattern[patternIdx];
       const matcher = Matcher.isMatcher(patternElement) ? patternElement : new LiteralMatch(this.name, patternElement);
@@ -220,10 +220,10 @@ class ObjectMatch extends Matcher {
 
   public test(actual: any): MatchResult {
     if (typeof actual !== 'object' || Array.isArray(actual)) {
-      return new MatchResult().push(this, [], `Expected type object but received ${getType(actual)}`);
+      return new MatchResult(actual).push(this, [], `Expected type object but received ${getType(actual)}`);
     }
 
-    const result = new MatchResult();
+    const result = new MatchResult(actual);
     if (!this.partial) {
       for (const a of Object.keys(actual)) {
         if (!(a in this.pattern)) {
diff --git a/packages/@aws-cdk/assertions/lib/matcher.ts b/packages/@aws-cdk/assertions/lib/matcher.ts
index 0495b72d25c5a..a3263d6f00829 100644
--- a/packages/@aws-cdk/assertions/lib/matcher.ts
+++ b/packages/@aws-cdk/assertions/lib/matcher.ts
@@ -27,8 +27,16 @@ export abstract class Matcher {
  * The result of `Match.test()`.
  */
 export class MatchResult {
+  /**
+   * The target for which this result was generated.
+   */
+  public readonly target: any;
   private readonly failures: MatchFailure[] = [];
 
+  constructor(target: any) {
+    this.target = target;
+  }
+
   /**
    * Push a new failure into this result at a specific path.
    * If the failure occurred at root of the match tree, set the path to an empty list.
diff --git a/packages/@aws-cdk/assertions/lib/private/mappings.ts b/packages/@aws-cdk/assertions/lib/private/mappings.ts
new file mode 100644
index 0000000000000..0def435cc0e1d
--- /dev/null
+++ b/packages/@aws-cdk/assertions/lib/private/mappings.ts
@@ -0,0 +1,31 @@
+import { StackInspector } from '../vendored/assert';
+import { formatFailure, matchSection } from './section';
+
+export function findMappings(inspector: StackInspector, props: any = {}): { [key: string]: any }[] {
+  const section: { [key: string] : {} } = inspector.value.Mappings;
+  const result = matchSection(section, props);
+
+  if (!result.match) {
+    return [];
+  }
+
+  return result.matches;
+}
+
+export function hasMapping(inspector: StackInspector, props: any): string | void {
+  const section: { [key: string]: {} } = inspector.value.Mappings;
+  const result = matchSection(section, props);
+
+  if (result.match) {
+    return;
+  }
+
+  if (result.closestResult === undefined) {
+    return 'No mappings found in the template';
+  }
+
+  return [
+    `Template has ${result.analyzedCount} mappings, but none match as expected.`,
+    formatFailure(result.closestResult),
+  ].join('\n');
+}
\ No newline at end of file
diff --git a/packages/@aws-cdk/assertions/lib/private/outputs.ts b/packages/@aws-cdk/assertions/lib/private/outputs.ts
new file mode 100644
index 0000000000000..46e5a6cb1d52b
--- /dev/null
+++ b/packages/@aws-cdk/assertions/lib/private/outputs.ts
@@ -0,0 +1,31 @@
+import { StackInspector } from '../vendored/assert';
+import { formatFailure, matchSection } from './section';
+
+export function findOutputs(inspector: StackInspector, props: any = {}): { [key: string]: any }[] {
+  const section: { [key: string] : {} } = inspector.value.Outputs;
+  const result = matchSection(section, props);
+
+  if (!result.match) {
+    return [];
+  }
+
+  return result.matches;
+}
+
+export function hasOutput(inspector: StackInspector, props: any): string | void {
+  const section: { [key: string]: {} } = inspector.value.Outputs;
+  const result = matchSection(section, props);
+
+  if (result.match) {
+    return;
+  }
+
+  if (result.closestResult === undefined) {
+    return 'No outputs found in the template';
+  }
+
+  return [
+    `Template has ${result.analyzedCount} outputs, but none match as expected.`,
+    formatFailure(result.closestResult),
+  ].join('\n');
+}
\ No newline at end of file
diff --git a/packages/@aws-cdk/assertions/lib/private/resource.ts b/packages/@aws-cdk/assertions/lib/private/resource.ts
deleted file mode 100644
index 22a2b01734b70..0000000000000
--- a/packages/@aws-cdk/assertions/lib/private/resource.ts
+++ /dev/null
@@ -1,82 +0,0 @@
-import { Match } from '../match';
-import { Matcher, MatchResult } from '../matcher';
-import { StackInspector } from '../vendored/assert';
-
-export function findResources(inspector: StackInspector, type: string, props: any = {}): { [key: string]: any }[] {
-  const matcher = Matcher.isMatcher(props) ? props : Match.objectLike(props);
-  let results: { [key: string]: any }[] = [];
-
-  eachResourceWithType(inspector, type, (resource) => {
-    const result = matcher.test(resource);
-    if (!result.hasFailed()) {
-      results.push(resource);
-    }
-  });
-
-  return results;
-}
-
-export function hasResource(inspector: StackInspector, type: string, props: any): string | void {
-  const matcher = Matcher.isMatcher(props) ? props : Match.objectLike(props);
-  let closestResult: MatchResult | undefined = undefined;
-  let closestResource: { [key: string]: any } | undefined = undefined;
-  let count: number = 0;
-
-  let match = false;
-  eachResourceWithType(inspector, type, (resource) => {
-    if (match) { return; }
-    count++;
-    const result = matcher.test(resource);
-    if (!result.hasFailed()) {
-      match = true;
-    }
-    if (closestResult === undefined || closestResult.failCount > result.failCount) {
-      closestResult = result;
-      closestResource = resource;
-    }
-  });
-
-  if (match) {
-    return;
-  }
-
-  if (closestResult === undefined) {
-    return `No resource with type ${type} found`;
-  }
-
-  if (!closestResource) {
-    throw new Error('unexpected: closestResult is null');
-  }
-
-  return [
-    `${count} resources with type ${type} found, but none match as expected.`,
-    formatMessage(closestResult, closestResource),
-  ].join('\n');
-}
-
-function eachResourceWithType(
-  inspector: StackInspector,
-  type: string,
-  cb: (resource: {[key: string]: any}) => void): void {
-
-  for (const logicalId of Object.keys(inspector.value.Resources ?? {})) {
-    const resource: { [key: string]: any } = inspector.value.Resources[logicalId];
-    if (resource.Type === type) {
-      cb(resource);
-    }
-  }
-}
-
-function formatMessage(closestResult: MatchResult, closestResource: {}): string {
-  return [
-    'The closest result is:',
-    reindent(JSON.stringify(closestResource, undefined, 2)),
-    'with the following mismatches:',
-    ...closestResult.toHumanStrings().map(s => `\t${s}`),
-  ].join('\n');
-}
-
-function reindent(x: string, indent: number = 2): string {
-  const pad = ' '.repeat(indent);
-  return pad + x.split('\n').join(`\n${pad}`);
-}
\ No newline at end of file
diff --git a/packages/@aws-cdk/assertions/lib/private/resources.ts b/packages/@aws-cdk/assertions/lib/private/resources.ts
new file mode 100644
index 0000000000000..31286a8a6f1a4
--- /dev/null
+++ b/packages/@aws-cdk/assertions/lib/private/resources.ts
@@ -0,0 +1,42 @@
+import { StackInspector } from '../vendored/assert';
+import { formatFailure, matchSection } from './section';
+
+// Partial type for CloudFormation Resource
+type Resource = {
+  Type: string;
+}
+
+export function findResources(inspector: StackInspector, type: string, props: any = {}): { [key: string]: any }[] {
+  const section: { [key: string] : Resource } = inspector.value.Resources;
+  const result = matchSection(filterType(section, type), props);
+
+  if (!result.match) {
+    return [];
+  }
+
+  return result.matches;
+}
+
+export function hasResource(inspector: StackInspector, type: string, props: any): string | void {
+  const section: { [key: string]: Resource } = inspector.value.Resources;
+  const result = matchSection(filterType(section, type), props);
+
+  if (result.match) {
+    return;
+  }
+
+  if (result.closestResult === undefined) {
+    return `No resource with type ${type} found`;
+  }
+
+  return [
+    `Template has ${result.analyzedCount} resources with type ${type}, but none match as expected.`,
+    formatFailure(result.closestResult),
+  ].join('\n');
+}
+
+function filterType(section: { [key: string]: Resource }, type: string): { [key: string]: Resource } {
+  return Object.entries(section ?? {})
+    .filter(([_, v]) => v.Type === type)
+    .reduce((agg, [k, v]) => { return { ...agg, [k]: v }; }, {});
+}
\ No newline at end of file
diff --git a/packages/@aws-cdk/assertions/lib/private/section.ts b/packages/@aws-cdk/assertions/lib/private/section.ts
new file mode 100644
index 0000000000000..d8f0123de20d6
--- /dev/null
+++ b/packages/@aws-cdk/assertions/lib/private/section.ts
@@ -0,0 +1,58 @@
+import { Match } from '../match';
+import { Matcher, MatchResult } from '../matcher';
+
+export type MatchSuccess = { match: true, matches: any[] };
+export type MatchFailure = { match: false, closestResult?: MatchResult, analyzedCount: number };
+
+export function matchSection(section: any, props: any): MatchSuccess | MatchFailure {
+  const matcher = Matcher.isMatcher(props) ? props : Match.objectLike(props);
+  let closestResult: MatchResult | undefined = undefined;
+  let matching: any[] = [];
+  let count = 0;
+
+  eachEntryInSection(
+    section,
+
+    (entry) => {
+      const result = matcher.test(entry);
+      if (!result.hasFailed()) {
+        matching.push(entry);
+      } else {
+        count++;
+        if (closestResult === undefined || closestResult.failCount > result.failCount) {
+          closestResult = result;
+        }
+      }
+    },
+  );
+
+  if (matching.length > 0) {
+    return { match: true, matches: matching };
+  } else {
+    return { match: false, closestResult, analyzedCount: count };
+  }
+}
+
+function eachEntryInSection(
+  section: any,
+  cb: (entry: {[key: string]: any}) => void): void {
+
+  for (const logicalId of Object.keys(section ?? {})) {
+    const resource: { [key: string]: any } = section[logicalId];
+    cb(resource);
+  }
+}
+
+export function formatFailure(closestResult: MatchResult): string {
+  return [
+    'The closest result is:',
+    leftPad(JSON.stringify(closestResult.target, undefined, 2)),
+    'with the following mismatches:',
+    ...closestResult.toHumanStrings().map(s => `\t${s}`),
+  ].join('\n');
+}
+
+function leftPad(x: string, indent: number = 2): string {
+  const pad = ' '.repeat(indent);
+  return pad + x.split('\n').join(`\n${pad}`);
+}
\ No newline at end of file
diff --git a/packages/@aws-cdk/assertions/lib/template.ts b/packages/@aws-cdk/assertions/lib/template.ts
index 480290bc45b04..848c46bcc295a 100644
--- a/packages/@aws-cdk/assertions/lib/template.ts
+++ b/packages/@aws-cdk/assertions/lib/template.ts
@@ -1,7 +1,9 @@
 import { Stack, Stage } from '@aws-cdk/core';
 import { Match } from './match';
 import { Matcher } from './matcher';
-import { findResources, hasResource } from './private/resource';
+import { findMappings, hasMapping } from './private/mappings';
+import { findOutputs, hasOutput } from './private/outputs';
+import { findResources, hasResource } from './private/resources';
 import * as assert from './vendored/assert';
 
 /**
@@ -103,6 +105,52 @@ export class Template {
     return findResources(this.inspector, type, props);
   }
 
+  /**
+   * Assert that an Output with the given properties exists in the CloudFormation template.
+   * By default, performs partial matching on the resource, via the `Match.objectLike()`.
+   * To configure different behavour, use other matchers in the `Match` class.
+   * @param props the output as should be expected in the template.
+   */
+  public hasOutput(props: any): void {
+    const matchError = hasOutput(this.inspector, props);
+    if (matchError) {
+      throw new Error(matchError);
+    }
+  }
+
+  /**
+   * Get the set of matching Outputs that match the given properties in the CloudFormation template.
+   * @param props by default, matches all Outputs in the template.
+   * When a literal object is provided, performs a partial match via `Match.objectLike()`.
+   * Use the `Match` APIs to configure a different behaviour.
+   */
+  public findOutputs(props: any = {}): { [key: string]: any }[] {
+    return findOutputs(this.inspector, props);
+  }
+
+  /**
+   * Assert that a Mapping with the given properties exists in the CloudFormation template.
+   * By default, performs partial matching on the resource, via the `Match.objectLike()`.
+   * To configure different behavour, use other matchers in the `Match` class.
+   * @param props the output as should be expected in the template.
+   */
+  public hasMapping(props: any): void {
+    const matchError = hasMapping(this.inspector, props);
+    if (matchError) {
+      throw new Error(matchError);
+    }
+  }
+
+  /**
+   * Get the set of matching Mappings that match the given properties in the CloudFormation template.
+   * @param props by default, matches all Mappings in the template.
+   * When a literal object is provided, performs a partial match via `Match.objectLike()`.
+   * Use the `Match` APIs to configure a different behaviour.
+   */
+  public findMappings(props: any = {}): { [key: string]: any }[] {
+    return findMappings(this.inspector, props);
+  }
+
   /**
    * Assert that the CloudFormation template matches the given value
    * @param expected the expected CloudFormation template as key-value pairs.
diff --git a/packages/@aws-cdk/assertions/test/private/section.test.ts b/packages/@aws-cdk/assertions/test/private/section.test.ts
new file mode 100644
index 0000000000000..20cc2d5d14e0b
--- /dev/null
+++ b/packages/@aws-cdk/assertions/test/private/section.test.ts
@@ -0,0 +1,43 @@
+import { Match } from '../../lib';
+import { MatchFailure, matchSection, MatchSuccess } from '../../lib/private/section';
+
+describe('section', () => {
+  describe('matchSection', () => {
+    test('success', () => {
+      // GIVEN
+      const matcher = Match.objectLike({ foo: 'bar' });
+      const section = {
+        Entry1: { foo: 'bar' },
+        Entry2: { foo: 'bar', baz: 'qux' },
+        Entry3: { fred: 'waldo' },
+      };
+
+      // WHEN
+      const result = matchSection(section, matcher);
+
+      // THEN
+      expect(result.match).toEqual(true);
+      const success = result as MatchSuccess;
+      expect(success.matches.length).toEqual(2);
+    });
+
+    test('failure', () => {
+      // GIVEN
+      const matcher = Match.objectLike({ foo: 'bar' });
+      const section = {
+        Entry1: { foo: 'qux' },
+        Entry3: { fred: 'waldo' },
+      };
+
+      // WHEN
+      const result = matchSection(section, matcher);
+
+      // THEN
+      expect(result.match).toEqual(false);
+      const success = result as MatchFailure;
+      expect(success.analyzedCount).toEqual(2);
+      expect(success.closestResult).toBeDefined();
+      expect(success.closestResult?.target).toEqual({ foo: 'qux' });
+    });
+  });
+});
\ No newline at end of file
diff --git a/packages/@aws-cdk/assertions/test/template.test.ts b/packages/@aws-cdk/assertions/test/template.test.ts
index fcbc199f1f2da..50fb60a1a27f7 100644
--- a/packages/@aws-cdk/assertions/test/template.test.ts
+++ b/packages/@aws-cdk/assertions/test/template.test.ts
@@ -1,4 +1,4 @@
-import { App, CfnResource, Stack } from '@aws-cdk/core';
+import { App, CfnMapping, CfnOutput, CfnResource, Stack } from '@aws-cdk/core';
 import { Construct } from 'constructs';
 import { Match, Template } from '../lib';
 
@@ -330,6 +330,170 @@ describe('Template', () => {
       expect(inspect.findResources('Foo::Bar').length).toEqual(2);
     });
   });
+
+  describe('hasOutput', () => {
+    test('matching', () => {
+      const stack = new Stack();
+      new CfnOutput(stack, 'Foo', {
+        value: 'Bar',
+      });
+      new CfnOutput(stack, 'Fred', {
+        value: 'Waldo',
+      });
+
+      const inspect = Template.fromStack(stack);
+      expect(() => inspect.hasOutput({ Value: 'Bar' })).not.toThrow();
+    });
+
+    test('not matching', (done) => {
+      const stack = new Stack();
+      new CfnOutput(stack, 'Foo', {
+        value: 'Bar',
+        exportName: 'ExportBar',
+      });
+      new CfnOutput(stack, 'Fred', {
+        value: 'Waldo',
+      });
+
+      const inspect = Template.fromStack(stack);
+      expectToThrow(
+        () => inspect.hasOutput({
+          Value: 'Bar',
+          Export: { Name: 'ExportBaz' },
+        }),
+        [
+          /2 outputs/,
+          /Expected ExportBaz but received ExportBar/,
+        ],
+        done,
+      );
+      done();
+    });
+  });
+
+  describe('findOutputs', () => {
+    test('matching', () => {
+      const stack = new Stack();
+      new CfnOutput(stack, 'Foo', {
+        value: 'Fred',
+        description: 'FooFred',
+      });
+      new CfnOutput(stack, 'Bar', {
+        value: 'Fred',
+        description: 'BarFred',
+      });
+      new CfnOutput(stack, 'Baz', {
+        value: 'Waldo',
+        description: 'BazWaldo',
+      });
+
+      const inspect = Template.fromStack(stack);
+      const result = inspect.findOutputs({ Value: 'Fred' });
+      expect(result).toEqual([
+        { Value: 'Fred', Description: 'FooFred' },
+        { Value: 'Fred', Description: 'BarFred' },
+      ]);
+    });
+
+    test('not matching', () => {
+      const stack = new Stack();
+      new CfnOutput(stack, 'Foo', {
+        value: 'Fred',
+      });
+
+      const inspect = Template.fromStack(stack);
+      const result = inspect.findOutputs({ Value: 'Waldo' });
+      expect(result.length).toEqual(0);
+    });
+  });
+
+  describe('hasMapping', () => {
+    test('matching', () => {
+      const stack = new Stack();
+      new CfnMapping(stack, 'Foo', {
+        mapping: {
+          Foo: { Bar: 'Lightning', Fred: 'Waldo' },
+          Baz: { Bar: 'Qux' },
+        },
+      });
+      new CfnMapping(stack, 'Fred', {
+        mapping: {
+          Foo: { Bar: 'Lightning' },
+        },
+      });
+
+      const inspect = Template.fromStack(stack);
+      expect(() => inspect.hasMapping({ Foo: { Bar: 'Lightning' } })).not.toThrow();
+    });
+
+    test('not matching', (done) => {
+      const stack = new Stack();
+      new CfnMapping(stack, 'Foo', {
+        mapping: {
+          Foo: { Bar: 'Fred', Baz: 'Waldo' },
+          Qux: { Bar: 'Fred' },
+        },
+      });
+      new CfnMapping(stack, 'Fred', {
+        mapping: {
+          Foo: { Baz: 'Baz' },
+        },
+      });
+
+      const inspect = Template.fromStack(stack);
+      expectToThrow(
+        () => inspect.hasMapping({
+          Foo: { Bar: 'Qux' },
+        }),
+        [
+          /2 mappings/,
+          /Expected Qux but received Fred/,
+        ],
+        done,
+      );
+      done();
+    });
+  });
+
+  describe('findMappings', () => {
+    test('matching', () => {
+      const stack = new Stack();
+      new CfnMapping(stack, 'Foo', {
+        mapping: {
+          Foo: { Bar: 'Lightning', Fred: 'Waldo' },
+          Baz: { Bar: 'Qux' },
+        },
+      });
+      new CfnMapping(stack, 'Fred', {
+        mapping: {
+          Foo: { Bar: 'Lightning' },
+        },
+      });
+
+      const inspect = Template.fromStack(stack);
+      const result = inspect.findMappings({ Foo: { Bar: 'Lightning' } });
+      expect(result).toEqual([
+        {
+          Foo: { Bar: 'Lightning', Fred: 'Waldo' },
+          Baz: { Bar: 'Qux' },
+        },
+        { Foo: { Bar: 'Lightning' } },
+      ]);
+    });
+
+    test('not matching', () => {
+      const stack = new Stack();
+      new CfnMapping(stack, 'Foo', {
+        mapping: {
+          Foo: { Bar: 'Fred', Baz: 'Waldo' },
+        },
+      });
+
+      const inspect = Template.fromStack(stack);
+      const result = inspect.findMappings({ Foo: { Bar: 'Waldo' } });
+      expect(result.length).toEqual(0);
+    });
+  });
 });
 
 function expectToThrow(fn: () => void, msgs: (RegExp | string)[], done: jest.DoneCallback): void {
diff --git a/packages/@aws-cdk/aws-kinesisfirehose/package.json b/packages/@aws-cdk/aws-kinesisfirehose/package.json
index 58c5568c8c299..fe73affa84c97 100644
--- a/packages/@aws-cdk/aws-kinesisfirehose/package.json
+++ b/packages/@aws-cdk/aws-kinesisfirehose/package.json
@@ -73,7 +73,7 @@
   },
   "license": "Apache-2.0",
   "devDependencies": {
-    "@aws-cdk/assert-internal": "0.0.0",
+    "@aws-cdk/assertions": "0.0.0",
     "@aws-cdk/aws-s3": "0.0.0",
     "@types/jest": "^26.0.24",
     "cdk-build-tools": "0.0.0",
diff --git a/packages/@aws-cdk/aws-kinesisfirehose/test/delivery-stream.test.ts b/packages/@aws-cdk/aws-kinesisfirehose/test/delivery-stream.test.ts
index 345e7feb0774a..7c36a29e379b5 100644
--- a/packages/@aws-cdk/aws-kinesisfirehose/test/delivery-stream.test.ts
+++ b/packages/@aws-cdk/aws-kinesisfirehose/test/delivery-stream.test.ts
@@ -1,5 +1,4 @@
-import '@aws-cdk/assert-internal/jest';
-import { ABSENT, ResourcePart, SynthUtils, anything, arrayWith } from '@aws-cdk/assert-internal';
+import { Match, Template } from '@aws-cdk/assertions';
 import * as cloudwatch from '@aws-cdk/aws-cloudwatch';
 import * as ec2 from '@aws-cdk/aws-ec2';
 import * as iam from '@aws-cdk/aws-iam';
@@ -47,11 +46,11 @@ describe('delivery stream', () => {
       destinations: [mockS3Destination],
     });
 
-    expect(stack).toHaveResource('AWS::KinesisFirehose::DeliveryStream', {
-      DeliveryStreamEncryptionConfigurationInput: ABSENT,
-      DeliveryStreamName: ABSENT,
+    Template.fromStack(stack).hasResourceProperties('AWS::KinesisFirehose::DeliveryStream', {
+      DeliveryStreamEncryptionConfigurationInput: Match.absentProperty(),
+      DeliveryStreamName: Match.absentProperty(),
       DeliveryStreamType: 'DirectPut',
-      KinesisStreamSourceConfiguration: ABSENT,
+      KinesisStreamSourceConfiguration: Match.absentProperty(),
       ExtendedS3DestinationConfiguration: {
         BucketARN: bucketArn,
         RoleARN: roleArn,
@@ -77,14 +76,14 @@ describe('delivery stream', () => {
       destinations: [mockS3Destination],
     });
 
-    expect(stack).toHaveResourceLike('AWS::IAM::Role', {
+    Template.fromStack(stack).hasResourceProperties('AWS::IAM::Role', {
       AssumeRolePolicyDocument: {
         Statement: [
-          {
+          Match.objectLike({
             Principal: {
               Service: 'firehose.amazonaws.com',
             },
-          },
+          }),
         ],
       },
     });
@@ -99,32 +98,33 @@ describe('delivery stream', () => {
       role: deliveryStreamRole,
     });
 
-    expect(stack).toHaveResourceLike('AWS::IAM::Policy', {
+    Template.fromStack(stack).hasResourceProperties('AWS::IAM::Policy', {
       PolicyDocument: {
         Statement: [
           {
-            Action: arrayWith(
-              'kinesis:DescribeStream',
+            Effect: 'Allow',
+            Action: Match.arrayWith([
               'kinesis:GetRecords',
               'kinesis:GetShardIterator',
               'kinesis:ListShards',
-            ),
+              'kinesis:DescribeStream',
+            ]),
             Resource: stack.resolve(sourceStream.streamArn),
           },
         ],
       },
       Roles: [stack.resolve(deliveryStreamRole.roleName)],
     });
-    expect(stack).toHaveResource('AWS::KinesisFirehose::DeliveryStream', {
+    Template.fromStack(stack).hasResourceProperties('AWS::KinesisFirehose::DeliveryStream', {
       DeliveryStreamType: 'KinesisStreamAsSource',
       KinesisStreamSourceConfiguration: {
         KinesisStreamARN: stack.resolve(sourceStream.streamArn),
         RoleARN: stack.resolve(deliveryStreamRole.roleArn),
       },
     });
-    expect(stack).toHaveResourceLike('AWS::KinesisFirehose::DeliveryStream', {
-      DependsOn: arrayWith('DeliveryStreamRoleDefaultPolicy2759968B'),
-    }, ResourcePart.CompleteDefinition);
+    Template.fromStack(stack).hasResource('AWS::KinesisFirehose::DeliveryStream', {
+      DependsOn: Match.arrayWith(['DeliveryStreamRoleDefaultPolicy2759968B']),
+    });
   });
 
   test('requesting customer-owned encryption creates key and configuration', () => {
@@ -134,21 +134,21 @@ describe('delivery stream', () => {
       role: deliveryStreamRole,
     });
 
-    expect(stack).toHaveResource('AWS::KMS::Key');
-    expect(stack).toHaveResourceLike('AWS::IAM::Policy', {
+    Template.fromStack(stack).resourceCountIs('AWS::KMS::Key', 1);
+    Template.fromStack(stack).hasResourceProperties('AWS::IAM::Policy', {
       PolicyDocument: {
         Statement: [
-          {
-            Action: arrayWith(
-              'kms:Encrypt',
+          Match.objectLike({
+            Action: Match.arrayWith([
               'kms:Decrypt',
-            ),
-          },
+              'kms:Encrypt',
+            ]),
+          }),
         ],
       },
       Roles: [stack.resolve(deliveryStreamRole.roleName)],
     });
-    expect(stack).toHaveResourceLike('AWS::KinesisFirehose::DeliveryStream', {
+    Template.fromStack(stack).hasResourceProperties('AWS::KinesisFirehose::DeliveryStream', {
       DeliveryStreamEncryptionConfigurationInput: {
         KeyARN: {
           'Fn::GetAtt': [
@@ -170,22 +170,22 @@ describe('delivery stream', () => {
       role: deliveryStreamRole,
     });
 
-    expect(stack).toHaveResource('AWS::KMS::Key');
-    expect(stack).toHaveResourceLike('AWS::IAM::Policy', {
+    Template.fromStack(stack).resourceCountIs('AWS::KMS::Key', 1);
+    Template.fromStack(stack).hasResourceProperties('AWS::IAM::Policy', {
       PolicyDocument: {
         Statement: [
-          {
-            Action: arrayWith(
-              'kms:Encrypt',
+          Match.objectLike({
+            Action: Match.arrayWith([
               'kms:Decrypt',
-            ),
+              'kms:Encrypt',
+            ]),
             Resource: stack.resolve(key.keyArn),
-          },
+          }),
         ],
       },
       Roles: [stack.resolve(deliveryStreamRole.roleName)],
     });
-    expect(stack).toHaveResourceLike('AWS::KinesisFirehose::DeliveryStream', {
+    Template.fromStack(stack).hasResourceProperties('AWS::KinesisFirehose::DeliveryStream', {
       DeliveryStreamEncryptionConfigurationInput: {
         KeyARN: stack.resolve(key.keyArn),
         KeyType: 'CUSTOMER_MANAGED_CMK',
@@ -200,24 +200,12 @@ describe('delivery stream', () => {
       role: deliveryStreamRole,
     });
 
-    expect(stack).not.toHaveResource('AWS::KMS::Key');
-    expect(stack).not.toHaveResourceLike('AWS::IAM::Policy', {
-      PolicyDocument: {
-        Statement: [
-          {
-            Action: arrayWith(
-              'kms:Encrypt',
-              'kms:Decrypt',
-            ),
-          },
-        ],
-      },
-      Roles: [stack.resolve(deliveryStreamRole.roleName)],
-    });
-    expect(stack).toHaveResourceLike('AWS::KinesisFirehose::DeliveryStream', {
+    Template.fromStack(stack).resourceCountIs('AWS::KMS::Key', 0);
+    Template.fromStack(stack).resourceCountIs('AWS::IAM::Policy', 0);
+    Template.fromStack(stack).hasResourceProperties('AWS::KinesisFirehose::DeliveryStream', {
       DeliveryStreamType: 'DirectPut',
       DeliveryStreamEncryptionConfigurationInput: {
-        KeyARN: ABSENT,
+        KeyARN: Match.absentProperty(),
         KeyType: 'AWS_OWNED_CMK',
       },
     });
@@ -230,23 +218,11 @@ describe('delivery stream', () => {
       role: deliveryStreamRole,
     });
 
-    expect(stack).not.toHaveResource('AWS::KMS::Key');
-    expect(stack).not.toHaveResourceLike('AWS::IAM::Policy', {
-      PolicyDocument: {
-        Statement: [
-          {
-            Action: arrayWith(
-              'kms:Encrypt',
-              'kms:Decrypt',
-            ),
-          },
-        ],
-      },
-      Roles: [stack.resolve(deliveryStreamRole.roleName)],
-    });
-    expect(stack).toHaveResourceLike('AWS::KinesisFirehose::DeliveryStream', {
+    Template.fromStack(stack).resourceCountIs('AWS::KMS::Key', 0);
+    Template.fromStack(stack).resourceCountIs('AWS::IAM::Policy', 0);
+    Template.fromStack(stack).hasResourceProperties('AWS::KinesisFirehose::DeliveryStream', {
       DeliveryStreamType: 'DirectPut',
-      DeliveryStreamEncryptionConfigurationInput: ABSENT,
+      DeliveryStreamEncryptionConfigurationInput: Match.absentProperty(),
     });
   });
 
@@ -300,13 +276,13 @@ describe('delivery stream', () => {
 
     deliveryStream.grant(role, 'firehose:PutRecord');
 
-    expect(stack).toHaveResourceLike('AWS::IAM::Policy', {
+    Template.fromStack(stack).hasResourceProperties('AWS::IAM::Policy', {
       PolicyDocument: {
         Statement: [
-          {
+          Match.objectLike({
             Action: 'firehose:PutRecord',
             Resource: stack.resolve(deliveryStream.deliveryStreamArn),
-          },
+          }),
         ],
       },
       Roles: [stack.resolve(role.roleName)],
@@ -323,16 +299,16 @@ describe('delivery stream', () => {
 
     deliveryStream.grantPutRecords(role);
 
-    expect(stack).toHaveResourceLike('AWS::IAM::Policy', {
+    Template.fromStack(stack).hasResourceProperties('AWS::IAM::Policy', {
       PolicyDocument: {
         Statement: [
-          {
+          Match.objectLike({
             Action: [
               'firehose:PutRecord',
               'firehose:PutRecordBatch',
             ],
             Resource: stack.resolve(deliveryStream.deliveryStreamArn),
-          },
+          }),
         ],
       },
       Roles: [stack.resolve(role.roleName)],
@@ -346,12 +322,12 @@ describe('delivery stream', () => {
       destinations: [mockS3Destination],
     });
 
-    expect(stack).toHaveResourceLike('AWS::KinesisFirehose::DeliveryStream', {
+    Template.fromStack(stack).hasResource('AWS::KinesisFirehose::DeliveryStream', {
       DependsOn: [dependableId],
-    }, ResourcePart.CompleteDefinition);
-    expect(stack).toHaveResourceLike('AWS::IAM::Role', {
-      DependsOn: ABSENT,
-    }, ResourcePart.CompleteDefinition);
+    });
+    Template.fromStack(stack).hasResource('AWS::IAM::Role', {
+      DependsOn: Match.absentProperty(),
+    });
   });
 
   test('supplying 0 or multiple destinations throws', () => {
@@ -472,19 +448,18 @@ describe('delivery stream', () => {
 
     securityGroup.connections.allowFrom(deliveryStream, ec2.Port.allTcp());
 
-    expect(stack).toHaveResourceLike('AWS::EC2::SecurityGroup', {
+    Template.fromStack(stack).hasResourceProperties('AWS::EC2::SecurityGroup', {
       SecurityGroupIngress: [
-        {
+        Match.objectLike({
           CidrIp: {
-            'Fn::FindInMap': [
-              anything(),
+            'Fn::FindInMap': Match.arrayWith([
               {
                 Ref: 'AWS::Region',
               },
               'FirehoseCidrBlock',
-            ],
+            ]),
           },
-        },
+        }),
       ],
     });
   });
@@ -499,11 +474,11 @@ describe('delivery stream', () => {
 
     securityGroup.connections.allowFrom(deliveryStream, ec2.Port.allTcp());
 
-    expect(stack).toHaveResourceLike('AWS::EC2::SecurityGroup', {
+    Template.fromStack(stack).hasResourceProperties('AWS::EC2::SecurityGroup', {
       SecurityGroupIngress: [
-        {
+        Match.objectLike({
           CidrIp: '13.57.135.192/27',
-        },
+        }),
       ],
     });
   });
@@ -516,7 +491,11 @@ describe('delivery stream', () => {
       destinations: [mockS3Destination],
     });
 
-    expect(Object.keys(SynthUtils.toCloudFormation(stack).Mappings).length).toBe(1);
+    Template.fromStack(stack).hasMapping({
+      'af-south-1': {
+        FirehoseCidrBlock: '13.244.121.224/27',
+      },
+    });
   });
 
   test('can add tags', () => {
@@ -526,7 +505,7 @@ describe('delivery stream', () => {
 
     cdk.Tags.of(deliveryStream).add('tagKey', 'tagValue');
 
-    expect(stack).toHaveResource('AWS::KinesisFirehose::DeliveryStream', {
+    Template.fromStack(stack).hasResourceProperties('AWS::KinesisFirehose::DeliveryStream', {
       Tags: [
         {
           Key: 'tagKey',
diff --git a/packages/@aws-cdk/aws-neptune/package.json b/packages/@aws-cdk/aws-neptune/package.json
index dfc50d27ac70d..b3a429fb6642a 100644
--- a/packages/@aws-cdk/aws-neptune/package.json
+++ b/packages/@aws-cdk/aws-neptune/package.json
@@ -74,12 +74,12 @@
   },
   "license": "Apache-2.0",
   "devDependencies": {
+    "@aws-cdk/assertions": "0.0.0",
     "@types/jest": "^26.0.24",
     "cdk-build-tools": "0.0.0",
     "cdk-integ-tools": "0.0.0",
     "cfn2ts": "0.0.0",
-    "pkglint": "0.0.0",
-    "@aws-cdk/assert-internal": "0.0.0"
+    "pkglint": "0.0.0"
   },
   "dependencies": {
     "@aws-cdk/aws-ec2": "0.0.0",
diff --git a/packages/@aws-cdk/aws-neptune/test/cluster.test.ts b/packages/@aws-cdk/aws-neptune/test/cluster.test.ts
index 24e61c8be34a1..74f4770a8a74c 100644
--- a/packages/@aws-cdk/aws-neptune/test/cluster.test.ts
+++ b/packages/@aws-cdk/aws-neptune/test/cluster.test.ts
@@ -1,5 +1,4 @@
-import '@aws-cdk/assert-internal/jest';
-import { ABSENT, ResourcePart } from '@aws-cdk/assert-internal';
+import { Match, Template } from '@aws-cdk/assertions';
 import * as ec2 from '@aws-cdk/aws-ec2';
 import * as iam from '@aws-cdk/aws-iam';
 import * as kms from '@aws-cdk/aws-kms';
@@ -21,7 +20,7 @@ describe('DatabaseCluster', () => {
     });
 
     // THEN
-    expect(stack).toHaveResource('AWS::Neptune::DBCluster', {
+    Template.fromStack(stack).hasResource('AWS::Neptune::DBCluster', {
       Properties: {
         DBSubnetGroupName: { Ref: 'DatabaseSubnets3C9252C9' },
         VpcSecurityGroupIds: [{ 'Fn::GetAtt': ['DatabaseSecurityGroup5C91FDCB', 'GroupId'] }],
@@ -29,14 +28,14 @@ describe('DatabaseCluster', () => {
       },
       DeletionPolicy: 'Retain',
       UpdateReplacePolicy: 'Retain',
-    }, ResourcePart.CompleteDefinition);
+    });
 
-    expect(stack).toHaveResource('AWS::Neptune::DBInstance', {
+    Template.fromStack(stack).hasResource('AWS::Neptune::DBInstance', {
       DeletionPolicy: 'Retain',
       UpdateReplacePolicy: 'Retain',
-    }, ResourcePart.CompleteDefinition);
+    });
 
-    expect(stack).toHaveResource('AWS::Neptune::DBSubnetGroup', {
+    Template.fromStack(stack).hasResourceProperties('AWS::Neptune::DBSubnetGroup', {
       SubnetIds: [
         { Ref: 'VPCPrivateSubnet1Subnet8BCA10E0' },
         { Ref: 'VPCPrivateSubnet2SubnetCFCDAA7A' },
@@ -58,7 +57,7 @@ describe('DatabaseCluster', () => {
     });
 
     // THEN
-    expect(stack).toHaveResource('AWS::Neptune::DBCluster', {
+    Template.fromStack(stack).hasResourceProperties('AWS::Neptune::DBCluster', {
       DBSubnetGroupName: { Ref: 'DatabaseSubnets3C9252C9' },
       VpcSecurityGroupIds: [{ 'Fn::GetAtt': ['DatabaseSecurityGroup5C91FDCB', 'GroupId'] }],
     });
@@ -112,7 +111,7 @@ describe('DatabaseCluster', () => {
     });
 
     // THEN
-    expect(stack).toHaveResource('AWS::Neptune::DBCluster', {
+    Template.fromStack(stack).hasResourceProperties('AWS::Neptune::DBCluster', {
       EngineVersion: '1.0.4.1',
       DBSubnetGroupName: { Ref: 'DatabaseSubnets3C9252C9' },
       VpcSecurityGroupIds: [{ 'Fn::GetAtt': ['DatabaseSecurityGroup5C91FDCB', 'GroupId'] }],
@@ -136,7 +135,7 @@ describe('DatabaseCluster', () => {
     });
 
     // THEN
-    expect(stack).toHaveResource('AWS::Neptune::DBCluster', {
+    Template.fromStack(stack).hasResourceProperties('AWS::Neptune::DBCluster', {
       DBSubnetGroupName: { Ref: 'DatabaseSubnets3C9252C9' },
       VpcSecurityGroupIds: ['SecurityGroupId12345'],
     });
@@ -161,7 +160,7 @@ describe('DatabaseCluster', () => {
     });
 
     // THEN
-    expect(stack).toHaveResource('AWS::Neptune::DBCluster', {
+    Template.fromStack(stack).hasResourceProperties('AWS::Neptune::DBCluster', {
       DBClusterParameterGroupName: { Ref: 'ParamsA8366201' },
     });
   });
@@ -184,7 +183,7 @@ describe('DatabaseCluster', () => {
     });
 
     // THEN
-    expect(stack).toHaveResource('AWS::Neptune::DBCluster', {
+    Template.fromStack(stack).hasResourceProperties('AWS::Neptune::DBCluster', {
       AssociatedRoles: [
         {
           RoleArn: {
@@ -213,7 +212,7 @@ describe('DatabaseCluster', () => {
     });
 
     // THEN
-    expect(stack).toHaveResource('AWS::Neptune::DBCluster', {
+    Template.fromStack(stack).hasResourceProperties('AWS::Neptune::DBCluster', {
       DBClusterParameterGroupName: 'ParamGroupName',
     });
   });
@@ -231,7 +230,7 @@ describe('DatabaseCluster', () => {
     });
 
     // THEN
-    expect(stack).toHaveResource('AWS::Neptune::DBCluster', {
+    Template.fromStack(stack).hasResourceProperties('AWS::Neptune::DBCluster', {
       KmsKeyId: {
         'Fn::GetAtt': [
           'Key961B73FD',
@@ -254,7 +253,7 @@ describe('DatabaseCluster', () => {
     });
 
     // THEN
-    expect(stack).toHaveResource('AWS::Neptune::DBCluster', {
+    Template.fromStack(stack).hasResourceProperties('AWS::Neptune::DBCluster', {
       StorageEncrypted: true,
     });
   });
@@ -307,7 +306,7 @@ describe('DatabaseCluster', () => {
     });
 
     // THEN
-    expect(stack).toHaveResource('AWS::Neptune::DBInstance', {
+    Template.fromStack(stack).hasResourceProperties('AWS::Neptune::DBInstance', {
       DBInstanceIdentifier: `${instanceIdentifierBase}1`,
     });
   });
@@ -326,7 +325,7 @@ describe('DatabaseCluster', () => {
     });
 
     // THEN
-    expect(stack).toHaveResource('AWS::Neptune::DBInstance', {
+    Template.fromStack(stack).hasResourceProperties('AWS::Neptune::DBInstance', {
       DBInstanceIdentifier: `${clusterIdentifier}instance1`,
     });
   });
@@ -373,7 +372,7 @@ describe('DatabaseCluster', () => {
     cluster.connections.allowToAnyIpv4(ec2.Port.tcp(443));
 
     // THEN
-    expect(stack).toHaveResource('AWS::EC2::SecurityGroupEgress', {
+    Template.fromStack(stack).hasResourceProperties('AWS::EC2::SecurityGroupEgress', {
       GroupId: 'sg-123456789',
     });
   });
@@ -391,7 +390,7 @@ describe('DatabaseCluster', () => {
     });
 
     // THEN
-    expect(stack).toHaveResource('AWS::Neptune::DBCluster', {
+    Template.fromStack(stack).hasResourceProperties('AWS::Neptune::DBCluster', {
       BackupRetentionPeriod: 20,
     });
   });
@@ -410,7 +409,7 @@ describe('DatabaseCluster', () => {
     });
 
     // THEN
-    expect(stack).toHaveResource('AWS::Neptune::DBCluster', {
+    Template.fromStack(stack).hasResourceProperties('AWS::Neptune::DBCluster', {
       BackupRetentionPeriod: 20,
       PreferredBackupWindow: '07:34-08:04',
     });
@@ -429,7 +428,7 @@ describe('DatabaseCluster', () => {
     });
 
     // THEN
-    expect(stack).toHaveResource('AWS::Neptune::DBCluster', {
+    Template.fromStack(stack).hasResourceProperties('AWS::Neptune::DBCluster', {
       PreferredMaintenanceWindow: '07:34-08:04',
     });
   });
@@ -446,8 +445,8 @@ describe('DatabaseCluster', () => {
     });
 
     // THEN
-    expect(stack).toHaveResourceLike('AWS::Neptune::DBCluster', {
-      IamAuthEnabled: ABSENT,
+    Template.fromStack(stack).hasResourceProperties('AWS::Neptune::DBCluster', {
+      IamAuthEnabled: Match.absentProperty(),
     });
   });
 
@@ -467,10 +466,10 @@ describe('DatabaseCluster', () => {
     cluster.grantConnect(role);
 
     // THEN
-    expect(stack).toHaveResourceLike('AWS::Neptune::DBCluster', {
+    Template.fromStack(stack).hasResourceProperties('AWS::Neptune::DBCluster', {
       IamAuthEnabled: true,
     });
-    expect(stack).toHaveResource('AWS::IAM::Policy', {
+    Template.fromStack(stack).hasResourceProperties('AWS::IAM::Policy', {
       PolicyDocument: {
         Statement: [{
           Effect: 'Allow',
diff --git a/packages/@aws-cdk/aws-neptune/test/instance.test.ts b/packages/@aws-cdk/aws-neptune/test/instance.test.ts
index dff005199ffc7..38a6981ab2a78 100644
--- a/packages/@aws-cdk/aws-neptune/test/instance.test.ts
+++ b/packages/@aws-cdk/aws-neptune/test/instance.test.ts
@@ -1,4 +1,4 @@
-import { expect as expectCDK, haveOutput, haveResource, ResourcePart } from '@aws-cdk/assert-internal';
+import { Template } from '@aws-cdk/assertions';
 import * as ec2 from '@aws-cdk/aws-ec2';
 import * as cdk from '@aws-cdk/core';
 import * as constructs from 'constructs';
@@ -17,14 +17,14 @@ describe('DatabaseInstance', () => {
     });
 
     // THEN
-    expectCDK(stack).to(haveResource('AWS::Neptune::DBInstance', {
+    Template.fromStack(stack).hasResource('AWS::Neptune::DBInstance', {
       Properties: {
         DBClusterIdentifier: { Ref: 'DatabaseB269D8BB' },
         DBInstanceClass: 'db.r5.large',
       },
       DeletionPolicy: 'Retain',
       UpdateReplacePolicy: 'Retain',
-    }, ResourcePart.CompleteDefinition));
+    });
   });
 
   test('check that the endpoint works', () => {
@@ -43,9 +43,9 @@ describe('DatabaseInstance', () => {
     });
 
     // THEN
-    expectCDK(stack).to(haveOutput({
-      exportName,
-      outputValue: {
+    Template.fromStack(stack).hasOutput({
+      Export: { Name: exportName },
+      Value: {
         'Fn::Join': [
           '',
           [
@@ -55,7 +55,7 @@ describe('DatabaseInstance', () => {
           ],
         ],
       },
-    }));
+    });
   });
 
   test('check importing works as expected', () => {
@@ -78,10 +78,10 @@ describe('DatabaseInstance', () => {
     });
 
     // THEN
-    expectCDK(stack).to(haveOutput({
-      exportName: endpointExportName,
-      outputValue: `${instanceEndpointAddress}:${port}`,
-    }));
+    Template.fromStack(stack).hasOutput({
+      Export: { Name: endpointExportName },
+      Value: `${instanceEndpointAddress}:${port}`,
+    });
   });
 
   test('instance with parameter group', () => {
@@ -102,9 +102,9 @@ describe('DatabaseInstance', () => {
     });
 
     // THEN
-    expectCDK(stack).to(haveResource('AWS::Neptune::DBInstance', {
+    Template.fromStack(stack).hasResourceProperties('AWS::Neptune::DBInstance', {
       DBParameterGroupName: { Ref: 'ParamsA8366201' },
-    }));
+    });
   });
 
   test('instance type from CfnParameter', () => {
@@ -130,11 +130,11 @@ describe('DatabaseInstance', () => {
     });
 
     // THEN
-    expectCDK(stack).to(haveResource('AWS::Neptune::DBInstance', {
+    Template.fromStack(stack).hasResourceProperties('AWS::Neptune::DBInstance', {
       DBInstanceClass: {
         Ref: 'NeptuneInstaneType',
       },
-    }));
+    });
   });
 
   test('instance type from string throws if missing db prefix', () => {
diff --git a/packages/@aws-cdk/aws-neptune/test/parameter-group.test.ts b/packages/@aws-cdk/aws-neptune/test/parameter-group.test.ts
index 3267f70aed062..57d71b1767734 100644
--- a/packages/@aws-cdk/aws-neptune/test/parameter-group.test.ts
+++ b/packages/@aws-cdk/aws-neptune/test/parameter-group.test.ts
@@ -1,4 +1,4 @@
-import { expect, haveResource } from '@aws-cdk/assert-internal';
+import { Template } from '@aws-cdk/assertions';
 import { Stack } from '@aws-cdk/core';
 import { ClusterParameterGroup, ParameterGroup } from '../lib';
 
@@ -17,12 +17,12 @@ describe('ClusterParameterGroup', () => {
     });
 
     // THEN
-    expect(stack).to(haveResource('AWS::Neptune::DBClusterParameterGroup', {
+    Template.fromStack(stack).hasResourceProperties('AWS::Neptune::DBClusterParameterGroup', {
       Description: 'desc',
       Parameters: {
         key: 'value',
       },
-    }));
+    });
 
   });
 
@@ -39,12 +39,12 @@ describe('ClusterParameterGroup', () => {
     });
 
     // THEN
-    expect(stack).to(haveResource('AWS::Neptune::DBParameterGroup', {
+    Template.fromStack(stack).hasResourceProperties('AWS::Neptune::DBParameterGroup', {
       Description: 'desc',
       Parameters: {
         key: 'value',
       },
-    }));
+    });
 
   });
 });
diff --git a/packages/@aws-cdk/aws-neptune/test/subnet-group.test.ts b/packages/@aws-cdk/aws-neptune/test/subnet-group.test.ts
index 675b2cf89a920..5e736d212a12e 100644
--- a/packages/@aws-cdk/aws-neptune/test/subnet-group.test.ts
+++ b/packages/@aws-cdk/aws-neptune/test/subnet-group.test.ts
@@ -1,4 +1,4 @@
-import '@aws-cdk/assert-internal/jest';
+import { Template } from '@aws-cdk/assertions';
 import * as ec2 from '@aws-cdk/aws-ec2';
 import { Stack } from '@aws-cdk/core';
 import { SubnetGroup } from '../lib';
@@ -17,7 +17,7 @@ test('creates a subnet group from minimal properties', () => {
     vpc,
   });
 
-  expect(stack).toHaveResource('AWS::Neptune::DBSubnetGroup', {
+  Template.fromStack(stack).hasResourceProperties('AWS::Neptune::DBSubnetGroup', {
     DBSubnetGroupDescription: 'MyGroup',
     SubnetIds: [
       { Ref: 'VPCPrivateSubnet1Subnet8BCA10E0' },
@@ -34,7 +34,7 @@ test('creates a subnet group from all properties', () => {
     vpcSubnets: { subnetType: ec2.SubnetType.PRIVATE },
   });
 
-  expect(stack).toHaveResource('AWS::Neptune::DBSubnetGroup', {
+  Template.fromStack(stack).hasResourceProperties('AWS::Neptune::DBSubnetGroup', {
     DBSubnetGroupDescription: 'My Shared Group',
     DBSubnetGroupName: 'SharedGroup',
     SubnetIds: [
@@ -51,7 +51,7 @@ describe('subnet selection', () => {
       vpc,
     });
 
-    expect(stack).toHaveResource('AWS::Neptune::DBSubnetGroup', {
+    Template.fromStack(stack).hasResourceProperties('AWS::Neptune::DBSubnetGroup', {
       DBSubnetGroupDescription: 'MyGroup',
       SubnetIds: [
         { Ref: 'VPCPrivateSubnet1Subnet8BCA10E0' },
@@ -67,7 +67,7 @@ describe('subnet selection', () => {
       vpcSubnets: { subnetType: ec2.SubnetType.PUBLIC },
     });
 
-    expect(stack).toHaveResource('AWS::Neptune::DBSubnetGroup', {
+    Template.fromStack(stack).hasResourceProperties('AWS::Neptune::DBSubnetGroup', {
       DBSubnetGroupDescription: 'MyGroup',
       SubnetIds: [
         { Ref: 'VPCPublicSubnet1SubnetB4246D30' },

From c06b161636425801de67f2f95166359ff0dd5dd6 Mon Sep 17 00:00:00 2001
From: Madeline Kusters <80541297+madeline-k@users.noreply.github.com>
Date: Tue, 24 Aug 2021 09:48:31 -0700
Subject: [PATCH 08/91] chore(cli): Add node 10 deprecation warning (#16205)

Testing: Downgraded to node 10.24.1 on my laptop, and saw the warning banner "Node v10.24.1 has reached end-of-life and will no longer be supported in new releases after 2021-09-01..." when running cli commands on a CDK app linked to this repo.

----

*By submitting this pull request, I confirm that my contribution is made under the terms of the Apache-2.0 license*
---
 packages/aws-cdk/bin/cdk.ts   |  1 +
 packages/aws-cdk/package.json |  1 +
 yarn.lock                     | 16 ++++++++++++++++
 3 files changed, 18 insertions(+)

diff --git a/packages/aws-cdk/bin/cdk.ts b/packages/aws-cdk/bin/cdk.ts
index 1103b6354bf67..29f217360355f 100644
--- a/packages/aws-cdk/bin/cdk.ts
+++ b/packages/aws-cdk/bin/cdk.ts
@@ -1,6 +1,7 @@
 #!/usr/bin/env node
 import 'source-map-support/register';
 import * as cxapi from '@aws-cdk/cx-api';
+import '@jsii/check-node/run';
 import * as colors from 'colors/safe';
 import * as yargs from 'yargs';
 
diff --git a/packages/aws-cdk/package.json b/packages/aws-cdk/package.json
index 4485c964c105e..497afb2e2ec92 100644
--- a/packages/aws-cdk/package.json
+++ b/packages/aws-cdk/package.json
@@ -73,6 +73,7 @@
     "@aws-cdk/cloudformation-diff": "0.0.0",
     "@aws-cdk/cx-api": "0.0.0",
     "@aws-cdk/region-info": "0.0.0",
+    "@jsii/check-node": "1.33.0",
     "archiver": "^5.3.0",
     "aws-sdk": "^2.848.0",
     "camelcase": "^6.2.0",
diff --git a/yarn.lock b/yarn.lock
index 431e3492b2be6..dc35a18bf0134 100644
--- a/yarn.lock
+++ b/yarn.lock
@@ -557,6 +557,14 @@
     "@types/yargs" "^15.0.0"
     chalk "^4.0.0"
 
+"@jsii/check-node@1.33.0":
+  version "1.33.0"
+  resolved "https://registry.yarnpkg.com/@jsii/check-node/-/check-node-1.33.0.tgz#55d75cbef1c84e2012c67ab8d6de63f773be4a9b"
+  integrity sha512-Bajxa09dhkuQ8bM1ve6qtm2oFNhW9/+GaKRh4Deewsk/G86ovLXI/rRS6TfCsSw4E0TGPFWzWy0tBeJuEDo7sw==
+  dependencies:
+    chalk "^4.1.2"
+    semver "^7.3.5"
+
 "@jsii/spec@^1.31.0":
   version "1.31.0"
   resolved "https://registry.yarnpkg.com/@jsii/spec/-/spec-1.31.0.tgz#9298dc163fdae0bab4006b817592235a29922871"
@@ -2686,6 +2694,14 @@ chalk@^4.0.0, chalk@^4.1.0:
     ansi-styles "^4.1.0"
     supports-color "^7.1.0"
 
+chalk@^4.1.2:
+  version "4.1.2"
+  resolved "https://registry.yarnpkg.com/chalk/-/chalk-4.1.2.tgz#aac4e2b7734a740867aeb16bf02aad556a1e7a01"
+  integrity sha512-oKnbhFyRIXpUuez8iBMmyEa4nbj4IOQyuhc/wy9kY7/WVPcwIO9VA668Pu8RkO7+0G76SLROeyw9CpQ061i4mA==
+  dependencies:
+    ansi-styles "^4.1.0"
+    supports-color "^7.1.0"
+
 char-regex@^1.0.2:
   version "1.0.2"
   resolved "https://registry.yarnpkg.com/char-regex/-/char-regex-1.0.2.tgz#d744358226217f981ed58f479b1d6bcc29545dcf"

From a1a65bc9a38b06ec51dff462e52b1beb8d421a56 Mon Sep 17 00:00:00 2001
From: Julian Michel <mail@julianmichel.de>
Date: Tue, 24 Aug 2021 19:37:21 +0200
Subject: [PATCH 09/91] fix(sqs): unable to import a FIFO queue when the queue
 ARN is a token (#15976)

The fifo property of a SQS queue is determined based on the queue name. The suffix `.fifo` indicates that it is a fifo queue.
When the queue is imported from a token, the name is not known on synthesis time. Therefore, the name of the queue can't be used to initialize the queue as a FIFO queue.

In some constructs, CDK checks during synthesis if the given queue is a FIFIO queue. Because of that, an additional option is necessary to specify a FIFO queue.

A new boolean property `fifo` is introduced which can be used to specify a FIFO queue that is imported from a token. The property is optional and is only necessary when a FIFO queue should be imported from a token.

Closes #12466.

----

*By submitting this pull request, I confirm that my contribution is made under the terms of the Apache-2.0 license*
---
 packages/@aws-cdk/aws-sqs/lib/queue-base.ts |  9 +++
 packages/@aws-cdk/aws-sqs/lib/queue.ts      | 25 ++++++-
 packages/@aws-cdk/aws-sqs/test/test.sqs.ts  | 83 ++++++++++++++++++++-
 3 files changed, 113 insertions(+), 4 deletions(-)

diff --git a/packages/@aws-cdk/aws-sqs/lib/queue-base.ts b/packages/@aws-cdk/aws-sqs/lib/queue-base.ts
index 162c149aec2ad..23cf09218cc58 100644
--- a/packages/@aws-cdk/aws-sqs/lib/queue-base.ts
+++ b/packages/@aws-cdk/aws-sqs/lib/queue-base.ts
@@ -275,4 +275,13 @@ export interface QueueAttributes {
    * @default - None
    */
   readonly keyArn?: string;
+
+  /**
+   * Whether this queue is an Amazon SQS FIFO queue. If false, this is a standard queue.
+   *
+   * In case of a FIFO queue which is imported from a token, this value has to be explicitly set to true.
+   *
+   * @default - if fifo is not specified, the property will be determined based on the queue name (not possible for FIFO queues imported from a token)
+   */
+  readonly fifo?: boolean;
 }
diff --git a/packages/@aws-cdk/aws-sqs/lib/queue.ts b/packages/@aws-cdk/aws-sqs/lib/queue.ts
index 414ddaaf8a919..db2992630aa63 100644
--- a/packages/@aws-cdk/aws-sqs/lib/queue.ts
+++ b/packages/@aws-cdk/aws-sqs/lib/queue.ts
@@ -1,5 +1,5 @@
 import * as kms from '@aws-cdk/aws-kms';
-import { Duration, RemovalPolicy, Stack, Token } from '@aws-cdk/core';
+import { Duration, RemovalPolicy, Stack, Token, ArnFormat } from '@aws-cdk/core';
 import { Construct } from 'constructs';
 import { IQueue, QueueAttributes, QueueBase } from './queue-base';
 import { CfnQueue } from './sqs.generated';
@@ -257,7 +257,7 @@ export class Queue extends QueueBase {
    */
   public static fromQueueAttributes(scope: Construct, id: string, attrs: QueueAttributes): IQueue {
     const stack = Stack.of(scope);
-    const parsedArn = stack.parseArn(attrs.queueArn);
+    const parsedArn = stack.splitArn(attrs.queueArn, ArnFormat.NO_RESOURCE_NAME);
     const queueName = attrs.queueName || parsedArn.resource;
     const queueUrl = attrs.queueUrl || `https://sqs.${parsedArn.region}.${stack.urlSuffix}/${parsedArn.account}/${queueName}`;
 
@@ -268,9 +268,28 @@ export class Queue extends QueueBase {
       public readonly encryptionMasterKey = attrs.keyArn
         ? kms.Key.fromKeyArn(this, 'Key', attrs.keyArn)
         : undefined;
-      public readonly fifo = queueName.endsWith('.fifo') ? true : false;
+      public readonly fifo: boolean = this.determineFifo();;
 
       protected readonly autoCreatePolicy = false;
+
+      /**
+       * Determine fifo flag based on queueName and fifo attribute
+       */
+      private determineFifo(): boolean {
+        if (Token.isUnresolved(this.queueArn)) {
+          return attrs.fifo || false;
+        } else {
+          if (typeof attrs.fifo !== 'undefined') {
+            if (attrs.fifo && !queueName.endsWith('.fifo')) {
+              throw new Error("FIFO queue names must end in '.fifo'");
+            }
+            if (!attrs.fifo && queueName.endsWith('.fifo')) {
+              throw new Error("Non-FIFO queue name may not end in '.fifo'");
+            }
+          }
+          return queueName.endsWith('.fifo') ? true : false;
+        }
+      }
     }
 
     return new Import(scope, id);
diff --git a/packages/@aws-cdk/aws-sqs/test/test.sqs.ts b/packages/@aws-cdk/aws-sqs/test/test.sqs.ts
index da8637ba5d4f5..ae334e5fcd4d3 100644
--- a/packages/@aws-cdk/aws-sqs/test/test.sqs.ts
+++ b/packages/@aws-cdk/aws-sqs/test/test.sqs.ts
@@ -1,7 +1,7 @@
 import { expect, haveResource, ResourcePart } from '@aws-cdk/assert-internal';
 import * as iam from '@aws-cdk/aws-iam';
 import * as kms from '@aws-cdk/aws-kms';
-import { CfnParameter, Duration, Stack, App } from '@aws-cdk/core';
+import { CfnParameter, Duration, Stack, App, Token } from '@aws-cdk/core';
 import { Test } from 'nodeunit';
 import * as sqs from '../lib';
 
@@ -191,6 +191,87 @@ export = {
       test.done();
     },
 
+    'import queueArn from token, fifo and standard queues can be defined'(test: Test) {
+      // GIVEN
+      const stack = new Stack();
+
+      // WHEN
+      const stdQueue1 = sqs.Queue.fromQueueAttributes(stack, 'StdQueue1', {
+        queueArn: Token.asString({ Ref: 'ARN' }),
+      });
+      const stdQueue2 = sqs.Queue.fromQueueAttributes(stack, 'StdQueue2', {
+        queueArn: Token.asString({ Ref: 'ARN' }),
+        fifo: false,
+      });
+      const fifoQueue = sqs.Queue.fromQueueAttributes(stack, 'FifoQueue', {
+        queueArn: Token.asString({ Ref: 'ARN' }),
+        fifo: true,
+      });
+
+      // THEN
+      test.deepEqual(stdQueue1.fifo, false);
+      test.deepEqual(stdQueue2.fifo, false);
+      test.deepEqual(fifoQueue.fifo, true);
+      test.done();
+    },
+
+    'import queueArn from token, check attributes'(test: Test) {
+      // GIVEN
+      const stack = new Stack();
+
+      // WHEN
+      const stdQueue1 = sqs.Queue.fromQueueArn(stack, 'StdQueue', Token.asString({ Ref: 'ARN' }));
+
+      // THEN
+      test.deepEqual(stack.resolve(stdQueue1.queueArn), {
+        Ref: 'ARN',
+      });
+      test.deepEqual(stack.resolve(stdQueue1.queueName), {
+        'Fn::Select': [5, { 'Fn::Split': [':', { Ref: 'ARN' }] }],
+      });
+      test.deepEqual(stack.resolve(stdQueue1.queueUrl), {
+        'Fn::Join':
+          ['',
+            ['https://sqs.',
+              { 'Fn::Select': [3, { 'Fn::Split': [':', { Ref: 'ARN' }] }] },
+              '.',
+              { Ref: 'AWS::URLSuffix' },
+              '/',
+              { 'Fn::Select': [4, { 'Fn::Split': [':', { Ref: 'ARN' }] }] },
+              '/',
+              { 'Fn::Select': [5, { 'Fn::Split': [':', { Ref: 'ARN' }] }] }]],
+      });
+      test.deepEqual(stdQueue1.fifo, false);
+      test.done();
+    },
+
+    'fails if fifo flag is set for non fifo queue name'(test: Test) {
+      // GIVEN
+      const app = new App();
+      const stack = new Stack(app, 'my-stack');
+
+      // THEN
+      test.throws(() => sqs.Queue.fromQueueAttributes(stack, 'ImportedStdQueue', {
+        queueArn: 'arn:aws:sqs:us-west-2:123456789012:queue1',
+        fifo: true,
+      }), /FIFO queue names must end in '.fifo'/);
+      test.done();
+    },
+
+
+    'fails if fifo flag is false for fifo queue name'(test: Test) {
+      // GIVEN
+      const app = new App();
+      const stack = new Stack(app, 'my-stack');
+
+      // THEN
+      test.throws(() => sqs.Queue.fromQueueAttributes(stack, 'ImportedFifoQueue', {
+        queueArn: 'arn:aws:sqs:us-west-2:123456789012:queue1.fifo',
+        fifo: false,
+      }), /Non-FIFO queue name may not end in '.fifo'/);
+      test.done();
+    },
+
     'importing works correctly for cross region queue'(test: Test) {
       // GIVEN
       const stack = new Stack(undefined, 'Stack', { env: { region: 'us-east-1' } });

From eb54cd416a48708898e30986058491e21125b2f7 Mon Sep 17 00:00:00 2001
From: Julian Michel <mail@julianmichel.de>
Date: Tue, 24 Aug 2021 20:17:15 +0200
Subject: [PATCH 10/91] fix(ssm): StringParameter.fromStringParameterAttributes
 cannot accept version as a numeric Token (#16048)

In `StringParameter.fromStringParameterAttributes()` and `StringParameter.fromSecureStringParameterAttributes()` the version of a parameter can be specified using data type number.
If a token value (e.g. CloudFormation Parameter) was used here, the token was not resolved correctly.

The conversion of property `version` was corrected by using method `Tokenization.stringifyNumber()`.

Fixes #11913.

----

*By submitting this pull request, I confirm that my contribution is made under the terms of the Apache-2.0 license*
---
 packages/@aws-cdk/aws-ssm/lib/parameter.ts    |  5 +-
 ...g.parameter-store-string.lit.expected.json | 18 +++++
 .../test/integ.parameter-store-string.lit.ts  | 20 ++++++
 .../@aws-cdk/aws-ssm/test/test.parameter.ts   | 68 +++++++++++++++++++
 4 files changed, 109 insertions(+), 2 deletions(-)

diff --git a/packages/@aws-cdk/aws-ssm/lib/parameter.ts b/packages/@aws-cdk/aws-ssm/lib/parameter.ts
index 416454c1ef8cc..df30c8197cf91 100644
--- a/packages/@aws-cdk/aws-ssm/lib/parameter.ts
+++ b/packages/@aws-cdk/aws-ssm/lib/parameter.ts
@@ -4,6 +4,7 @@ import * as cxschema from '@aws-cdk/cloud-assembly-schema';
 import {
   CfnDynamicReference, CfnDynamicReferenceService, CfnParameter,
   Construct as CompatConstruct, ContextProvider, Fn, IResource, Resource, Stack, Token,
+  Tokenization,
 } from '@aws-cdk/core';
 import { Construct } from 'constructs';
 import * as ssm from './ssm.generated';
@@ -324,7 +325,7 @@ export class StringParameter extends ParameterBase implements IStringParameter {
     const type = attrs.type || ParameterType.STRING;
 
     const stringValue = attrs.version
-      ? new CfnDynamicReference(CfnDynamicReferenceService.SSM, `${attrs.parameterName}:${attrs.version}`).toString()
+      ? new CfnDynamicReference(CfnDynamicReferenceService.SSM, `${attrs.parameterName}:${Tokenization.stringifyNumber(attrs.version)}`).toString()
       : new CfnParameter(scope as CompatConstruct, `${id}.Parameter`, { type: `AWS::SSM::Parameter::Value<${type}>`, default: attrs.parameterName }).valueAsString;
 
     class Import extends ParameterBase {
@@ -341,7 +342,7 @@ export class StringParameter extends ParameterBase implements IStringParameter {
    * Imports a secure string parameter from the SSM parameter store.
    */
   public static fromSecureStringParameterAttributes(scope: Construct, id: string, attrs: SecureStringParameterAttributes): IStringParameter {
-    const stringValue = new CfnDynamicReference(CfnDynamicReferenceService.SSM_SECURE, `${attrs.parameterName}:${attrs.version}`).toString();
+    const stringValue = new CfnDynamicReference(CfnDynamicReferenceService.SSM_SECURE, `${attrs.parameterName}:${Tokenization.stringifyNumber(attrs.version)}`).toString();
 
     class Import extends ParameterBase {
       public readonly parameterName = attrs.parameterName;
diff --git a/packages/@aws-cdk/aws-ssm/test/integ.parameter-store-string.lit.expected.json b/packages/@aws-cdk/aws-ssm/test/integ.parameter-store-string.lit.expected.json
index 1d3d7baba28e0..074f6694ac41b 100644
--- a/packages/@aws-cdk/aws-ssm/test/integ.parameter-store-string.lit.expected.json
+++ b/packages/@aws-cdk/aws-ssm/test/integ.parameter-store-string.lit.expected.json
@@ -13,6 +13,10 @@
   },
   {
     "Parameters": {
+      "MyParameterVersion": {
+        "Type": "Number",
+        "Default": 1
+      },
       "MyValueParameter": {
         "Type": "AWS::SSM::Parameter::Value<String>",
         "Default": "/My/Public/Parameter"
@@ -28,6 +32,20 @@
         "Value": {
           "Ref": "MyValueParameter"
         }
+      },
+      "TheValueVersionFromToken": {
+        "Value": {
+          "Fn::Join": [
+            "",
+            [
+              "{{resolve:ssm:/My/Public/Parameter:",
+              {
+                "Ref": "MyParameterVersion"
+              },
+              "}}"
+            ]
+          ]
+        }
       }
     }
   }
diff --git a/packages/@aws-cdk/aws-ssm/test/integ.parameter-store-string.lit.ts b/packages/@aws-cdk/aws-ssm/test/integ.parameter-store-string.lit.ts
index 7c4604fa79c9e..09e0f6f17f01f 100644
--- a/packages/@aws-cdk/aws-ssm/test/integ.parameter-store-string.lit.ts
+++ b/packages/@aws-cdk/aws-ssm/test/integ.parameter-store-string.lit.ts
@@ -17,6 +17,13 @@ class UsingStack extends cdk.Stack {
   constructor(scope: cdk.App, id: string) {
     super(scope, id);
 
+    // Parameter that contains version number, will be used to pass
+    // version value from token.
+    const parameterVersion = new cdk.CfnParameter(this, 'MyParameterVersion', {
+      type: 'Number',
+      default: 1,
+    }).valueAsNumber;
+
     /// !show
     // Retrieve the latest value of the non-secret parameter
     // with name "/My/String/Parameter".
@@ -24,6 +31,11 @@ class UsingStack extends cdk.Stack {
       parameterName: '/My/Public/Parameter',
       // 'version' can be specified but is optional.
     }).stringValue;
+    const stringValueVersionFromToken = ssm.StringParameter.fromStringParameterAttributes(this, 'MyValueVersionFromToken', {
+      parameterName: '/My/Public/Parameter',
+      // parameter version from token
+      version: parameterVersion,
+    }).stringValue;
 
     // Retrieve a specific version of the secret (SecureString) parameter.
     // 'version' is always required.
@@ -31,13 +43,21 @@ class UsingStack extends cdk.Stack {
       parameterName: '/My/Secret/Parameter',
       version: 5,
     });
+    const secretValueVersionFromToken = ssm.StringParameter.fromSecureStringParameterAttributes(this, 'MySecureValueVersionFromToken', {
+      parameterName: '/My/Secret/Parameter',
+      // parameter version from token
+      version: parameterVersion,
+    });
+
     /// !hide
 
     new cdk.CfnResource(this, 'Dummy', { type: 'AWS::SNS::Topic' });
     new cdk.CfnOutput(this, 'TheValue', { value: stringValue });
+    new cdk.CfnOutput(this, 'TheValueVersionFromToken', { value: stringValueVersionFromToken });
 
     // Cannot be provisioned so cannot be actually used
     Array.isArray(secretValue);
+    Array.isArray(secretValueVersionFromToken);
   }
 }
 
diff --git a/packages/@aws-cdk/aws-ssm/test/test.parameter.ts b/packages/@aws-cdk/aws-ssm/test/test.parameter.ts
index 8ce26dd03a0c5..83b68eda4a508 100644
--- a/packages/@aws-cdk/aws-ssm/test/test.parameter.ts
+++ b/packages/@aws-cdk/aws-ssm/test/test.parameter.ts
@@ -344,6 +344,40 @@ export = {
     test.done();
   },
 
+  'StringParameter.fromStringParameterAttributes with version from token'(test: Test) {
+    // GIVEN
+    const stack = new cdk.Stack();
+
+    // WHEN
+    const param = ssm.StringParameter.fromStringParameterAttributes(stack, 'MyParamName', {
+      parameterName: 'MyParamName',
+      version: cdk.Token.asNumber({ Ref: 'version' }),
+    });
+
+    // THEN
+    test.deepEqual(stack.resolve(param.parameterArn), {
+      'Fn::Join': ['', [
+        'arn:',
+        { Ref: 'AWS::Partition' },
+        ':ssm:',
+        { Ref: 'AWS::Region' },
+        ':',
+        { Ref: 'AWS::AccountId' },
+        ':parameter/MyParamName',
+      ]],
+    });
+    test.deepEqual(stack.resolve(param.parameterName), 'MyParamName');
+    test.deepEqual(stack.resolve(param.parameterType), 'String');
+    test.deepEqual(stack.resolve(param.stringValue), {
+      'Fn::Join': ['', [
+        '{{resolve:ssm:MyParamName:',
+        { Ref: 'version' },
+        '}}',
+      ]],
+    });
+    test.done();
+  },
+
   'StringParameter.fromSecureStringParameterAttributes'(test: Test) {
     // GIVEN
     const stack = new cdk.Stack();
@@ -372,6 +406,40 @@ export = {
     test.done();
   },
 
+  'StringParameter.fromSecureStringParameterAttributes with version from token'(test: Test) {
+    // GIVEN
+    const stack = new cdk.Stack();
+
+    // WHEN
+    const param = ssm.StringParameter.fromSecureStringParameterAttributes(stack, 'MyParamName', {
+      parameterName: 'MyParamName',
+      version: cdk.Token.asNumber({ Ref: 'version' }),
+    });
+
+    // THEN
+    test.deepEqual(stack.resolve(param.parameterArn), {
+      'Fn::Join': ['', [
+        'arn:',
+        { Ref: 'AWS::Partition' },
+        ':ssm:',
+        { Ref: 'AWS::Region' },
+        ':',
+        { Ref: 'AWS::AccountId' },
+        ':parameter/MyParamName',
+      ]],
+    });
+    test.deepEqual(stack.resolve(param.parameterName), 'MyParamName');
+    test.deepEqual(stack.resolve(param.parameterType), 'SecureString');
+    test.deepEqual(stack.resolve(param.stringValue), {
+      'Fn::Join': ['', [
+        '{{resolve:ssm-secure:MyParamName:',
+        { Ref: 'version' },
+        '}}',
+      ]],
+    });
+    test.done();
+  },
+
   'StringParameter.fromSecureStringParameterAttributes with encryption key creates the correct policy for grantRead'(test: Test) {
     // GIVEN
     const stack = new cdk.Stack();

From 0f7beb29be18d809052f4d46e415a0394c9299ab Mon Sep 17 00:00:00 2001
From: Colin Ihrig <cjihrig@gmail.com>
Date: Tue, 24 Aug 2021 14:59:05 -0400
Subject: [PATCH 11/91] feat(docdb): cluster - deletion protection (#15216)

This commit adds support for `deletionProtection` on docdb `DatabaseCluster`s.

Fixes: https://github.com/aws/aws-cdk/issues/15170

----

*By submitting this pull request, I confirm that my contribution is made under the terms of the Apache-2.0 license*
---
 packages/@aws-cdk/aws-docdb/README.md         | 18 ++++++++++++++++
 packages/@aws-cdk/aws-docdb/lib/cluster.ts    | 11 ++++++++++
 .../@aws-cdk/aws-docdb/test/cluster.test.ts   | 21 +++++++++++++++++++
 3 files changed, 50 insertions(+)

diff --git a/packages/@aws-cdk/aws-docdb/README.md b/packages/@aws-cdk/aws-docdb/README.md
index fb1c4eeb270ee..6f7ed89e28e11 100644
--- a/packages/@aws-cdk/aws-docdb/README.md
+++ b/packages/@aws-cdk/aws-docdb/README.md
@@ -60,6 +60,24 @@ const securityGroup = new ec2.SecurityGroup(stack, 'SecurityGroup', {
 cluster.addSecurityGroups(securityGroup);
 ```
 
+## Deletion protection
+
+Deletion protection can be enabled on an Amazon DocumentDB cluster to prevent accidental deletion of the cluster:
+
+```ts
+const cluster = new DatabaseCluster(this, 'Database', {
+    masterUser: {
+        username: 'myuser'
+    },
+    instanceType: ec2.InstanceType.of(ec2.InstanceClass.R5, ec2.InstanceSize.LARGE),
+    vpcSubnets: {
+        subnetType: ec2.SubnetType.PUBLIC,
+    },
+    vpc,
+    deletionProtection: true  // Enable deletion protection.
+});
+```
+
 ## Rotating credentials
 
 When the master password is generated and stored in AWS Secrets Manager, it can be rotated automatically:
diff --git a/packages/@aws-cdk/aws-docdb/lib/cluster.ts b/packages/@aws-cdk/aws-docdb/lib/cluster.ts
index f90e976db8798..56b5a724dd439 100644
--- a/packages/@aws-cdk/aws-docdb/lib/cluster.ts
+++ b/packages/@aws-cdk/aws-docdb/lib/cluster.ts
@@ -136,6 +136,16 @@ export interface DatabaseClusterProps {
    * @default - Retain cluster.
    */
   readonly removalPolicy?: RemovalPolicy
+
+  /**
+   * Specifies whether this cluster can be deleted. If deletionProtection is
+   * enabled, the cluster cannot be deleted unless it is modified and
+   * deletionProtection is disabled. deletionProtection protects clusters from
+   * being accidentally deleted.
+   *
+   * @default - false
+   */
+  readonly deletionProtection?: boolean;
 }
 
 /**
@@ -361,6 +371,7 @@ export class DatabaseCluster extends DatabaseClusterBase {
       port: props.port,
       vpcSecurityGroupIds: [this.securityGroupId],
       dbClusterParameterGroupName: props.parameterGroup?.parameterGroupName,
+      deletionProtection: props.deletionProtection,
       // Admin
       masterUsername: secret ? secret.secretValueFromJson('username').toString() : props.masterUser.username,
       masterUserPassword: secret
diff --git a/packages/@aws-cdk/aws-docdb/test/cluster.test.ts b/packages/@aws-cdk/aws-docdb/test/cluster.test.ts
index beb564ed738e5..cb1f8653509df 100644
--- a/packages/@aws-cdk/aws-docdb/test/cluster.test.ts
+++ b/packages/@aws-cdk/aws-docdb/test/cluster.test.ts
@@ -167,6 +167,27 @@ describe('DatabaseCluster', () => {
     }));
   });
 
+  test('can configure cluster deletion protection', () => {
+    // GIVEN
+    const stack = testStack();
+    const vpc = new ec2.Vpc(stack, 'VPC');
+
+    // WHEN
+    new DatabaseCluster(stack, 'Database', {
+      masterUser: {
+        username: 'admin',
+      },
+      instanceType: ec2.InstanceType.of(ec2.InstanceClass.BURSTABLE2, ec2.InstanceSize.SMALL),
+      vpc,
+      deletionProtection: true,
+    });
+
+    // THEN
+    expectCDK(stack).to(haveResource('AWS::DocDB::DBCluster', {
+      DeletionProtection: true,
+    }));
+  });
+
   test('cluster with parameter group', () => {
     // GIVEN
     const stack = testStack();

From cdee1af03c34a1c08988e672bae6edc2538a8877 Mon Sep 17 00:00:00 2001
From: Madeline Kusters <80541297+madeline-k@users.noreply.github.com>
Date: Tue, 24 Aug 2021 13:12:06 -0700
Subject: [PATCH 12/91] fix(resourcegroups): ResourceGroup not using
 TagType.STANDARD, causes deploy failure (#16211)

This PR removes a patch to the cloudformation spec that is no longer necessary. Without the patch, the correct tag type of STANDARD is generated for CfnResourceGroup.

PR where the patch was introduced: https://github.com/aws/aws-cdk/pull/6995

Closes #12986

----

*By submitting this pull request, I confirm that my contribution is made under the terms of the Apache-2.0 license*
---
 .../530_ResourceGroups_Tags_patch.json        | 24 -------------------
 1 file changed, 24 deletions(-)
 delete mode 100644 packages/@aws-cdk/cfnspec/spec-source/530_ResourceGroups_Tags_patch.json

diff --git a/packages/@aws-cdk/cfnspec/spec-source/530_ResourceGroups_Tags_patch.json b/packages/@aws-cdk/cfnspec/spec-source/530_ResourceGroups_Tags_patch.json
deleted file mode 100644
index da2d3c603ddbd..0000000000000
--- a/packages/@aws-cdk/cfnspec/spec-source/530_ResourceGroups_Tags_patch.json
+++ /dev/null
@@ -1,24 +0,0 @@
-{
-  "ResourceTypes": {
-    "AWS::ResourceGroups::Group": {
-      "patch": {
-        "description": "Sets AWS::ResourceGroups::Group#Tags to Json",
-        "operations": [
-          {
-            "op": "remove",
-            "path": "/Properties/Tags/ItemType"
-          },
-          {
-            "op": "remove",
-            "path": "/Properties/Tags/Type"
-          },
-          {
-            "op": "add",
-            "path": "/Properties/Tags/PrimitiveType",
-            "value": "Json"
-          }
-        ]
-      }
-    }
-  }
-}

From 27a37ac26172301178a87fda93370b1554f5d513 Mon Sep 17 00:00:00 2001
From: Eli Polonsky <epolon@amazon.com>
Date: Tue, 24 Aug 2021 16:17:26 -0700
Subject: [PATCH 13/91] chore(integ): node check breaks cli integ tests
 (#16216)

The Node runtime check performed by jsii and introduced in this [PR](https://github.com/aws/aws-cdk/pull/16205) breaks the CLI integration tests since it changes the output of the `synth` command.

This PR makes it so the test asserts on the content of the template rather than the output of the CLI.

----

*By submitting this pull request, I confirm that my contribution is made under the terms of the Apache-2.0 license*
---
 .../aws-cdk/test/integ/cli/cli.integtest.ts   | 47 ++++++++++++-------
 packages/aws-cdk/test/integ/helpers/cdk.ts    |  6 +++
 2 files changed, 36 insertions(+), 17 deletions(-)

diff --git a/packages/aws-cdk/test/integ/cli/cli.integtest.ts b/packages/aws-cdk/test/integ/cli/cli.integtest.ts
index 957d04bf09fd9..873e3a1787ee5 100644
--- a/packages/aws-cdk/test/integ/cli/cli.integtest.ts
+++ b/packages/aws-cdk/test/integ/cli/cli.integtest.ts
@@ -39,23 +39,36 @@ integTest('Termination protection', withDefaultFixture(async (fixture) => {
 }));
 
 integTest('cdk synth', withDefaultFixture(async (fixture) => {
-  await expect(fixture.cdk(['synth', fixture.fullStackName('test-1')], { verbose: false })).resolves.toEqual(
-    `Resources:
-  topic69831491:
-    Type: AWS::SNS::Topic
-    Metadata:
-      aws:cdk:path: ${fixture.stackNamePrefix}-test-1/topic/Resource`);
-
-  await expect(fixture.cdk(['synth', fixture.fullStackName('test-2')], { verbose: false })).resolves.toEqual(
-    `Resources:
-  topic152D84A37:
-    Type: AWS::SNS::Topic
-    Metadata:
-      aws:cdk:path: ${fixture.stackNamePrefix}-test-2/topic1/Resource
-  topic2A4FB547F:
-    Type: AWS::SNS::Topic
-    Metadata:
-      aws:cdk:path: ${fixture.stackNamePrefix}-test-2/topic2/Resource`);
+  await fixture.cdk(['synth', fixture.fullStackName('test-1')]);
+  expect(fixture.template('test-1')).toEqual({
+    Resources: {
+      topic69831491: {
+        Type: 'AWS::SNS::Topic',
+        Metadata: {
+          'aws:cdk:path': `${fixture.stackNamePrefix}-test-1/topic/Resource`,
+        },
+      },
+    },
+  });
+
+  await fixture.cdk(['synth', fixture.fullStackName('test-2')], { verbose: false });
+  expect(fixture.template('test-2')).toEqual({
+    Resources: {
+      topic152D84A37: {
+        Type: 'AWS::SNS::Topic',
+        Metadata: {
+          'aws:cdk:path': `${fixture.stackNamePrefix}-test-2/topic1/Resource`,
+        },
+      },
+      topic2A4FB547F: {
+        Type: 'AWS::SNS::Topic',
+        Metadata: {
+          'aws:cdk:path': `${fixture.stackNamePrefix}-test-2/topic2/Resource`,
+        },
+      },
+    },
+  });
+
 }));
 
 integTest('ssm parameter provider error', withDefaultFixture(async (fixture) => {
diff --git a/packages/aws-cdk/test/integ/helpers/cdk.ts b/packages/aws-cdk/test/integ/helpers/cdk.ts
index 8bf256140d13b..4a09f43063600 100644
--- a/packages/aws-cdk/test/integ/helpers/cdk.ts
+++ b/packages/aws-cdk/test/integ/helpers/cdk.ts
@@ -382,6 +382,12 @@ export class TestFixture {
     });
   }
 
+  public template(stackName: string): any {
+    const fullStackName = this.fullStackName(stackName);
+    const templatePath = path.join(this.integTestDir, 'cdk.out', `${fullStackName}.template.json`);
+    return JSON.parse(fs.readFileSync(templatePath, { encoding: 'utf-8' }).toString());
+  }
+
   public get bootstrapStackName() {
     return this.fullStackName('bootstrap-stack');
   }

From e547ba0d1491af0abe703132fa06fe786ffd7070 Mon Sep 17 00:00:00 2001
From: kaizen3031593 <36202692+kaizen3031593@users.noreply.github.com>
Date: Tue, 24 Aug 2021 20:16:53 -0400
Subject: [PATCH 14/91] feat(cloudwatch): add support for cross-account alarms
 (#16007)

Allows `accountId` to be specified in a CloudWatch Alarm. This opens up the ability to create cross-account alarms, which was just [announced](https://aws.amazon.com/about-aws/whats-new/2021/08/announcing-amazon-cloudwatch-cross-account-alarms/).

closes #15959.

----

*By submitting this pull request, I confirm that my contribution is made under the terms of the Apache-2.0 license*
---
 packages/@aws-cdk/aws-cloudwatch/README.md    |  4 ++
 packages/@aws-cdk/aws-cloudwatch/lib/alarm.ts | 11 +--
 .../test/cross-environment.test.ts            | 67 ++++++++++++++++++-
 3 files changed, 76 insertions(+), 6 deletions(-)

diff --git a/packages/@aws-cdk/aws-cloudwatch/README.md b/packages/@aws-cdk/aws-cloudwatch/README.md
index ff1f1997489f4..bdcf58e61024f 100644
--- a/packages/@aws-cdk/aws-cloudwatch/README.md
+++ b/packages/@aws-cdk/aws-cloudwatch/README.md
@@ -28,6 +28,8 @@ represents the amount of errors reported by that Lambda function:
 const errors = fn.metricErrors();
 ```
 
+`Metric` objects can be account and region aware. You can specify `account` and `region` as properties of the metric, or use the `metric.attachTo(Construct)` method. `metric.attachTo()` will automatically copy the `region` and `account` fields of the `Construct`, which can come from anywhere in the Construct tree.
+
 You can also instantiate `Metric` objects to reference any
 [published metric](https://docs.aws.amazon.com/AmazonCloudWatch/latest/monitoring/aws-services-cloudwatch-metrics.html)
 that's not exposed using a convenience method on the CDK construct.
@@ -160,6 +162,8 @@ The most important properties to set while creating an Alarms are:
 - `evaluationPeriods`: how many consecutive periods the metric has to be
   breaching the the threshold for the alarm to trigger.
 
+To create a cross-account alarm, make sure you have enabled [cross-account functionality](https://docs.aws.amazon.com/AmazonCloudWatch/latest/monitoring/Cross-Account-Cross-Region.html) in CloudWatch. Then, set the `account` property in the `Metric` object either manually or via the `metric.attachTo()` method.
+
 ### Alarm Actions
 
 To add actions to an alarm, use the integration classes from the
diff --git a/packages/@aws-cdk/aws-cloudwatch/lib/alarm.ts b/packages/@aws-cdk/aws-cloudwatch/lib/alarm.ts
index 6b102d567125f..41928d0af7193 100644
--- a/packages/@aws-cdk/aws-cloudwatch/lib/alarm.ts
+++ b/packages/@aws-cdk/aws-cloudwatch/lib/alarm.ts
@@ -257,7 +257,10 @@ export class Alarm extends AlarmBase {
     return dispatchMetric(metric, {
       withStat(stat, conf) {
         self.validateMetricStat(stat, metric);
-        if (conf.renderingProperties?.label == undefined) {
+        const canRenderAsLegacyMetric = conf.renderingProperties?.label == undefined &&
+          (stat.account == undefined || Stack.of(self).account == stat.account);
+        // Do this to disturb existing templates as little as possible
+        if (canRenderAsLegacyMetric) {
           return dropUndefined({
             dimensions: stat.dimensions,
             namespace: stat.namespace,
@@ -283,6 +286,7 @@ export class Alarm extends AlarmBase {
                 unit: stat.unitFilter,
               },
               id: 'm1',
+              accountId: stat.account,
               label: conf.renderingProperties?.label,
               returnData: true,
             } as CfnAlarm.MetricDataQueryProperty,
@@ -344,7 +348,7 @@ export class Alarm extends AlarmBase {
   }
 
   /**
-   * Validate that if a region and account are in the given stat config, they match the Alarm
+   * Validate that if a region is in the given stat config, they match the Alarm
    */
   private validateMetricStat(stat: MetricStatConfig, metric: IMetric) {
     const stack = Stack.of(this);
@@ -352,9 +356,6 @@ export class Alarm extends AlarmBase {
     if (definitelyDifferent(stat.region, stack.region)) {
       throw new Error(`Cannot create an Alarm in region '${stack.region}' based on metric '${metric}' in '${stat.region}'`);
     }
-    if (definitelyDifferent(stat.account, stack.account)) {
-      throw new Error(`Cannot create an Alarm in account '${stack.account}' based on metric '${metric}' in '${stat.account}'`);
-    }
   }
 }
 
diff --git a/packages/@aws-cdk/aws-cloudwatch/test/cross-environment.test.ts b/packages/@aws-cdk/aws-cloudwatch/test/cross-environment.test.ts
index 7c7ed7d04bf6f..f17391591a8c5 100644
--- a/packages/@aws-cdk/aws-cloudwatch/test/cross-environment.test.ts
+++ b/packages/@aws-cdk/aws-cloudwatch/test/cross-environment.test.ts
@@ -6,11 +6,12 @@ const a = new Metric({ namespace: 'Test', metricName: 'ACount' });
 
 let stack1: Stack;
 let stack2: Stack;
+let stack3: Stack;
 describe('cross environment', () => {
   beforeEach(() => {
     stack1 = new Stack(undefined, undefined, { env: { region: 'pluto', account: '1234' } });
     stack2 = new Stack(undefined, undefined, { env: { region: 'mars', account: '5678' } });
-
+    stack3 = new Stack(undefined, undefined, { env: { region: 'pluto', account: '0000' } });
   });
 
   describe('in graphs', () => {
@@ -112,6 +113,70 @@ describe('cross environment', () => {
 
 
     });
+
+    test('metric attached to stack3 will render in stack1', () => {
+      //Cross-account metrics are supported in Alarms
+
+      // GIVEN
+      new Alarm(stack1, 'Alarm', {
+        threshold: 1,
+        evaluationPeriods: 1,
+        metric: a.attachTo(stack3),
+      });
+
+      // THEN
+      Template.fromStack(stack1).hasResourceProperties('AWS::CloudWatch::Alarm', {
+        Metrics: [
+          {
+            AccountId: '0000',
+            Id: 'm1',
+            MetricStat: {
+              Metric: {
+                MetricName: 'ACount',
+                Namespace: 'Test',
+              },
+              Period: 300,
+              Stat: 'Average',
+            },
+            ReturnData: true,
+          },
+        ],
+      });
+    });
+
+    test('metric can render in a different account', () => {
+      // GIVEN
+      const b = new Metric({
+        namespace: 'Test',
+        metricName: 'ACount',
+        account: '0000',
+      });
+
+      new Alarm(stack1, 'Alarm', {
+        threshold: 1,
+        evaluationPeriods: 1,
+        metric: b,
+      });
+
+      // THEN
+      Template.fromStack(stack1).hasResourceProperties('AWS::CloudWatch::Alarm', {
+        Metrics: [
+          {
+            AccountId: '0000',
+            Id: 'm1',
+            MetricStat: {
+              Metric: {
+                MetricName: 'ACount',
+                Namespace: 'Test',
+              },
+              Period: 300,
+              Stat: 'Average',
+            },
+            ReturnData: true,
+          },
+        ],
+      });
+    });
   });
 });
 

From e678f104df4fb0377c6ad5c8abc4132433363871 Mon Sep 17 00:00:00 2001
From: Ben Chaimberg <chaimber@amazon.com>
Date: Wed, 25 Aug 2021 05:51:34 -0700
Subject: [PATCH 15/91] revert: temporarily transfer @skinny85 module ownership
 (#16206)

This reverts commit 77dfa2f8546d03671b3304d2910a9c7e387ff6a8.
---
 .github/workflows/issue-label-assign.yml | 116 +++++++++++------------
 1 file changed, 58 insertions(+), 58 deletions(-)

diff --git a/.github/workflows/issue-label-assign.yml b/.github/workflows/issue-label-assign.yml
index 618de4693571f..64e3daf97887b 100644
--- a/.github/workflows/issue-label-assign.yml
+++ b/.github/workflows/issue-label-assign.yml
@@ -21,23 +21,23 @@ jobs:
            [
            {"keywords":["(cli)","(command line)"],"labels":["package/tools"],"assignees":["rix0rrr"]},
            {"keywords":["(@aws-cdk/alexa-ask)","(alexa-ask)","(alexa ask)"],"labels":["@aws-cdk/alexa-ask"],"assignees":["madeline-k"]},
-           {"keywords":["(@aws-cdk/app-delivery)","(app-delivery)","(app delivery)"],"labels":["@aws-cdk/app-delivery"],"assignees":["madeline-k"]},
+           {"keywords":["(@aws-cdk/app-delivery)","(app-delivery)","(app delivery)"],"labels":["@aws-cdk/app-delivery"],"assignees":["skinny85"]},
            {"keywords":["(@aws-cdk/assert)","(assert)"],"labels":["@aws-cdk/assert"],"assignees":["nija-at"]},
            {"keywords":["(@aws-cdk/assets)","(assets)"],"labels":["@aws-cdk/assets"],"assignees":["eladb"]},
-           {"keywords":["(@aws-cdk/aws-accessanalyzer)","(aws-accessanalyzer)","(accessanalyzer)","(access analyzer)"],"labels":["@aws-cdk/aws-accessanalyzer"],"assignees":["BenChaimberg"]},
-           {"keywords":["(@aws-cdk/aws-acmpca)","(aws-acmpca)","(acmpca)"],"labels":["@aws-cdk/aws-acmpca"],"assignees":["BenChaimberg"]},
+           {"keywords":["(@aws-cdk/aws-accessanalyzer)","(aws-accessanalyzer)","(accessanalyzer)","(access analyzer)"],"labels":["@aws-cdk/aws-accessanalyzer"],"assignees":["skinny85"]},
+           {"keywords":["(@aws-cdk/aws-acmpca)","(aws-acmpca)","(acmpca)"],"labels":["@aws-cdk/aws-acmpca"],"assignees":["skinny85"]},
            {"keywords":["(@aws-cdk/aws-amazonmq)","(aws-amazonmq)","(amazonmq)","(amazon mq)","(amazon-mq)"],"labels":["@aws-cdk/aws-amazonmq"],"assignees":["otaviomacedo"]},
-           {"keywords":["(@aws-cdk/aws-amplify)","(aws-amplify)","(amplify)"],"labels":["@aws-cdk/aws-amplify"],"assignees":["madeline-k"]},
+           {"keywords":["(@aws-cdk/aws-amplify)","(aws-amplify)","(amplify)"],"labels":["@aws-cdk/aws-amplify"],"assignees":["skinny85"]},
            {"keywords":["(@aws-cdk/aws-apigateway)","(aws-apigateway)","(apigateway)","(api gateway)","(api-gateway)"],"labels":["@aws-cdk/aws-apigateway"],"assignees":["nija-at"]},
            {"keywords":["(@aws-cdk/aws-apigatewayv2)","(aws-apigatewayv2)","(apigatewayv2)","(apigateway v2)","(api-gateway-v2)"],"labels":["@aws-cdk/aws-apigatewayv2"],"assignees":["nija-at"]},
            {"keywords":["(@aws-cdk/aws-apigatewayv2-authorizers)","(aws-apigatewayv2-authorizers)","(apigatewayv2-authorizers)"],"labels":["@aws-cdk/aws-apigatewayv2-authorizers"],"assignees":["nija-at"]},
            {"keywords":["(@aws-cdk/aws-apigatewayv2-integrations)","(aws-apigatewayv2-integrations)","(apigatewayv2-integrations)","(apigateway v2 integrations)","(api-gateway-v2-integrations)"],"labels":["@aws-cdk/aws-apigatewayv2-integrations"],"assignees":["nija-at"]},
            {"keywords":["(@aws-cdk/aws-appconfig)","(aws-appconfig)","(appconfig)","(app config)","(app-config)"],"labels":["@aws-cdk/aws-appconfig"],"assignees":["rix0rrr"]},
-           {"keywords":["(@aws-cdk/aws-appflow)","(aws-appflow)","(appflow)","(app flow)","(app-flow)"],"labels":["@aws-cdk/aws-appflow"],"assignees":["BenChaimberg"]},
-           {"keywords":["(@aws-cdk/aws-appintegrations)","(aws-appintegrations)","(appintegrations)"],"labels":["@aws-cdk/aws-appintegrations"],"assignees":["BenChaimberg"]},
+           {"keywords":["(@aws-cdk/aws-appflow)","(aws-appflow)","(appflow)","(app flow)","(app-flow)"],"labels":["@aws-cdk/aws-appflow"],"assignees":["skinny85"]},
+           {"keywords":["(@aws-cdk/aws-appintegrations)","(aws-appintegrations)","(appintegrations)"],"labels":["@aws-cdk/aws-appintegrations"],"assignees":["skinny85"]},
            {"keywords":["(@aws-cdk/aws-applicationautoscaling)","(aws-applicationautoscaling)","(applicationautoscaling)","(application autoscaling)","(application-autoscaling)"],"labels":["@aws-cdk/aws-applicationautoscaling"],"assignees":["comcalvi"]},
            {"keywords":["(@aws-cdk/aws-applicationinsights)","(aws-applicationinsights)","(applicationinsights)","(application insights)","(application-insights)"],"labels":["@aws-cdk/aws-applicationinsights"],"assignees":["njlynch"]},
-           {"keywords":["(@aws-cdk/aws-appmesh)","(aws-appmesh)","(appmesh)","(app mesh)","(app-mesh)"],"labels":["@aws-cdk/aws-appmesh"],"assignees":["BenChaimberg"]},
+           {"keywords":["(@aws-cdk/aws-appmesh)","(aws-appmesh)","(appmesh)","(app mesh)","(app-mesh)"],"labels":["@aws-cdk/aws-appmesh"],"assignees":["skinny85"]},
            {"keywords":["(@aws-cdk/aws-appstream)","(aws-appstream)","(appstream)","(app stream)","(app-stream)"],"labels":["@aws-cdk/aws-appstream"],"assignees":["madeline-k"]},
            {"keywords":["(@aws-cdk/aws-appsync)","(aws-appsync)","(appsync)","(app sync)","(app-sync)"],"labels":["@aws-cdk/aws-appsync"],"assignees":["otaviomacedo"]},
            {"keywords":["(@aws-cdk/aws-athena)","(aws-athena)","(athena)"],"labels":["@aws-cdk/aws-athena"],"assignees":["BenChaimberg"]},
@@ -54,7 +54,7 @@ jobs:
            {"keywords":["(@aws-cdk/aws-ce)","(aws-ce)","(ce)"],"labels":["@aws-cdk/aws-ce"],"assignees":["njlynch"]},
            {"keywords":["(@aws-cdk/aws-certificatemanager)","(aws-certificatemanager)","(certificatemanager)","(certificate manager)","(certificate-manager)","(acm)"],"labels":["@aws-cdk/aws-certificatemanager"],"assignees":["njlynch"]},
            {"keywords":["(@aws-cdk/aws-chatbot)","(aws-chatbot)","(chatbot)"],"labels":["@aws-cdk/aws-chatbot"],"assignees":["BenChaimberg"]},
-           {"keywords":["(@aws-cdk/aws-cloud9)","(aws-cloud9)","(cloud9)","(cloud 9)"],"labels":["@aws-cdk/aws-cloud9"],"assignees":["BenChaimberg"]},
+           {"keywords":["(@aws-cdk/aws-cloud9)","(aws-cloud9)","(cloud9)","(cloud 9)"],"labels":["@aws-cdk/aws-cloud9"],"assignees":["skinny85"]},
            {"keywords":["(@aws-cdk/aws-cloudformation)","(aws-cloudformation)","(cloudformation)","(cloud formation)"],"labels":["@aws-cdk/aws-cloudformation"],"assignees":["rix0rrr"]},
            {"keywords":["(@aws-cdk/aws-cloudfront)","(aws-cloudfront)","(cloudfront)","(cloud front)"],"labels":["@aws-cdk/aws-cloudfront"],"assignees":["njlynch"]},
            {"keywords":["(@aws-cdk/aws-cloudfront-origins)","(aws-cloudfront-origins)","(cloudfront-origins)","(cloudfront origins)"],"labels":["@aws-cdk/aws-cloudfront-origins"],"assignees":["njlynch"]},
@@ -62,31 +62,31 @@ jobs:
            {"keywords":["(@aws-cdk/aws-cloudwatch)","(aws-cloudwatch)","(cloudwatch)","(cloud watch)"],"labels":["@aws-cdk/aws-cloudwatch"],"assignees":["madeline-k"]},
            {"keywords":["(@aws-cdk/aws-cloudwatch-actions)","(aws-cloudwatch-actions)","(cloudwatch-actions)","(cloudwatch actions)"],"labels":["@aws-cdk/aws-cloudwatch-actions"],"assignees":["madeline-k"]},
            {"keywords":["(@aws-cdk/aws-codeartifact)","(aws-codeartifact)","(codeartifact)","(code artifact)","(code-artifact)"],"labels":["@aws-cdk/aws-codeartifact"],"assignees":["njlynch"]},
-           {"keywords":["(@aws-cdk/aws-codebuild)","(aws-codebuild)","(codebuild)","(code build)","(code-build)"],"labels":["@aws-cdk/aws-codebuild"],"assignees":["BenChaimberg"]},
-           {"keywords":["(@aws-cdk/aws-codecommit)","(aws-codecommit)","(codecommit)","(code commit)", "(code-commit)"],"labels":["@aws-cdk/aws-codecommit"],"assignees":["BenChaimberg"]},
-           {"keywords":["(@aws-cdk/aws-codedeploy)","(aws-codedeploy)","(codedeploy)","(code deploy)","(code-deploy)"],"labels":["@aws-cdk/aws-codedeploy"],"assignees":["BenChaimberg"]},
-           {"keywords":["(@aws-cdk/aws-codeguruprofiler)","(aws-codeguruprofiler)","(codeguruprofiler)","(codeguru profiler)","(codeguru-profiler)"],"labels":["@aws-cdk/aws-codeguruprofiler"],"assignees":["BenChaimberg"]},
-           {"keywords":["(@aws-cdk/aws-codegurureviewer)","(aws-codegurureviewer)","(codegurureviewer)","(codeguru reviewer)","(codeguru-reviewer)"],"labels":["@aws-cdk/aws-codegurureviewer"],"assignees":["BenChaimberg"]},
-           {"keywords":["(@aws-cdk/aws-codepipeline)","(aws-codepipeline)","(codepipeline)","(code pipeline)","(code-pipeline)"],"labels":["@aws-cdk/aws-codepipeline"],"assignees":["BenChaimberg"]},
-           {"keywords":["(@aws-cdk/aws-codepipeline-actions)","(aws-codepipeline-actions)","(codepipeline-actions)","(codepipeline actions)"],"labels":["@aws-cdk/aws-codepipeline-actions"],"assignees":["BenChaimberg"]},
-           {"keywords":["(@aws-cdk/aws-codestar)","(aws-codestar)","(codestar)"],"labels":["@aws-cdk/aws-codestar"],"assignees":["BenChaimberg"]},
-           {"keywords":["(@aws-cdk/aws-codestarconnections)","(aws-codestarconnections)","(codestarconnections)","(codestar connections)","(codestar-connections)"],"labels":["@aws-cdk/aws-codestarconnections"],"assignees":["BenChaimberg"]},
-           {"keywords":["(@aws-cdk/aws-codestarnotifications)","(aws-codestarnotifications)","(codestarnotifications)","(codestar notifications)","(codestar-notifications)"],"labels":["@aws-cdk/aws-codestarnotifications"],"assignees":["BenChaimberg"]},
+           {"keywords":["(@aws-cdk/aws-codebuild)","(aws-codebuild)","(codebuild)","(code build)","(code-build)"],"labels":["@aws-cdk/aws-codebuild"],"assignees":["skinny85"]},
+           {"keywords":["(@aws-cdk/aws-codecommit)","(aws-codecommit)","(codecommit)","(code commit)", "(code-commit)"],"labels":["@aws-cdk/aws-codecommit"],"assignees":["skinny85"]},
+           {"keywords":["(@aws-cdk/aws-codedeploy)","(aws-codedeploy)","(codedeploy)","(code deploy)","(code-deploy)"],"labels":["@aws-cdk/aws-codedeploy"],"assignees":["skinny85"]},
+           {"keywords":["(@aws-cdk/aws-codeguruprofiler)","(aws-codeguruprofiler)","(codeguruprofiler)","(codeguru profiler)","(codeguru-profiler)"],"labels":["@aws-cdk/aws-codeguruprofiler"],"assignees":["skinny85"]},
+           {"keywords":["(@aws-cdk/aws-codegurureviewer)","(aws-codegurureviewer)","(codegurureviewer)","(codeguru reviewer)","(codeguru-reviewer)"],"labels":["@aws-cdk/aws-codegurureviewer"],"assignees":["skinny85"]},
+           {"keywords":["(@aws-cdk/aws-codepipeline)","(aws-codepipeline)","(codepipeline)","(code pipeline)","(code-pipeline)"],"labels":["@aws-cdk/aws-codepipeline"],"assignees":["skinny85"]},
+           {"keywords":["(@aws-cdk/aws-codepipeline-actions)","(aws-codepipeline-actions)","(codepipeline-actions)","(codepipeline actions)"],"labels":["@aws-cdk/aws-codepipeline-actions"],"assignees":["skinny85"]},
+           {"keywords":["(@aws-cdk/aws-codestar)","(aws-codestar)","(codestar)"],"labels":["@aws-cdk/aws-codestar"],"assignees":["skinny85"]},
+           {"keywords":["(@aws-cdk/aws-codestarconnections)","(aws-codestarconnections)","(codestarconnections)","(codestar connections)","(codestar-connections)"],"labels":["@aws-cdk/aws-codestarconnections"],"assignees":["skinny85"]},
+           {"keywords":["(@aws-cdk/aws-codestarnotifications)","(aws-codestarnotifications)","(codestarnotifications)","(codestar notifications)","(codestar-notifications)"],"labels":["@aws-cdk/aws-codestarnotifications"],"assignees":["skinny85"]},
            {"keywords":["(@aws-cdk/aws-cognito)","(aws-cognito)","(cognito)"],"labels":["@aws-cdk/aws-cognito"],"assignees":["nija-at"]},
            {"keywords":["(@aws-cdk/aws-config)","(aws-config)","(config)"],"labels":["@aws-cdk/aws-config"],"assignees":["rix0rrr"]},
            {"keywords":["(@aws-cdk/aws-customerprofiles)","(aws-customerprofiles)","(customerprofiles)"],"labels":["@aws-cdk/aws-customerprofiles"],"assignees":["otaviomacedo"]},
            {"keywords":["(@aws-cdk/aws-databrew)","(aws-databrew)","(databrew)"],"labels":["@aws-cdk/aws-databrew"],"assignees":["BenChaimberg"]},
            {"keywords":["(@aws-cdk/aws-datapipeline)","(aws-datapipeline)","(datapipeline)","(data pipeline)","(data-pipeline)"],"labels":["@aws-cdk/aws-datapipeline"],"assignees":["BenChaimberg"]},
            {"keywords":["(@aws-cdk/aws-datasync)","(aws-datasync)","(datasync)"],"labels":["@aws-cdk/aws-datasync"],"assignees":["BenChaimberg"]},
-           {"keywords":["(@aws-cdk/aws-dax)","(aws-dax)","(dax)"],"labels":["@aws-cdk/aws-dax"],"assignees":["BenChaimberg"]},
-           {"keywords":["(@aws-cdk/aws-detective)","(aws-detective)","(detective)"],"labels":["@aws-cdk/aws-detective"],"assignees":["BenChaimberg"]},
+           {"keywords":["(@aws-cdk/aws-dax)","(aws-dax)","(dax)"],"labels":["@aws-cdk/aws-dax"],"assignees":["skinny85"]},
+           {"keywords":["(@aws-cdk/aws-detective)","(aws-detective)","(detective)"],"labels":["@aws-cdk/aws-detective"],"assignees":["skinny85"]},
            {"keywords":["(@aws-cdk/aws-devopsguru)","(aws-devopsguru)","(devopsguru)"],"labels":["@aws-cdk/aws-devopsguru"],"assignees":["nija-at"]},
            {"keywords":["(@aws-cdk/aws-directoryservice)","(aws-directoryservice)","(directoryservice)","(directory service)","(directory-service)"],"labels":["@aws-cdk/aws-directoryservice"],"assignees":["rix0rrr"]},
            {"keywords":["(@aws-cdk/aws-dlm)","(aws-dlm)","(dlm)"],"labels":["@aws-cdk/aws-dlm"],"assignees":["njlynch"]},
            {"keywords":["(@aws-cdk/aws-dms)","(aws-dms)","(dms)"],"labels":["@aws-cdk/aws-dms"],"assignees":["njlynch"]},
-           {"keywords":["(@aws-cdk/aws-docdb)","(aws-docdb)","(docdb)","(doc db)","(doc-db)"],"labels":["@aws-cdk/aws-docdb"],"assignees":["madeline-k"]},
-           {"keywords":["(@aws-cdk/aws-dynamodb)","(aws-dynamodb)","(dynamodb)","(dynamo db)","(dynamo-db)"],"labels":["@aws-cdk/aws-dynamodb"],"assignees":["madeline-k"]},
-           {"keywords":["(@aws-cdk/aws-dynamodb-global)","(aws-dynamodb-global)","(dynamodb-global)","(dynamodb global)"],"labels":["@aws-cdk/aws-dynamodb-global"],"assignees":["madeline-k"]},
+           {"keywords":["(@aws-cdk/aws-docdb)","(aws-docdb)","(docdb)","(doc db)","(doc-db)"],"labels":["@aws-cdk/aws-docdb"],"assignees":["skinny85"]},
+           {"keywords":["(@aws-cdk/aws-dynamodb)","(aws-dynamodb)","(dynamodb)","(dynamo db)","(dynamo-db)"],"labels":["@aws-cdk/aws-dynamodb"],"assignees":["skinny85"]},
+           {"keywords":["(@aws-cdk/aws-dynamodb-global)","(aws-dynamodb-global)","(dynamodb-global)","(dynamodb global)"],"labels":["@aws-cdk/aws-dynamodb-global"],"assignees":["skinny85"]},
            {"keywords":["(@aws-cdk/aws-ec2)","(aws-ec2)","(ec2)","(vpc)"],"labels":["@aws-cdk/aws-ec2"],"assignees":["njlynch"]},
            {"keywords":["(@aws-cdk/aws-ecr)","(aws-ecr)","(ecr)"],"labels":["@aws-cdk/aws-ecr"],"assignees":["madeline-k"]},
            {"keywords":["(@aws-cdk/aws-ecr-assets)","(aws-ecr-assets)","(ecr-assets)","(ecr assets)","(ecrassets)"],"labels":["@aws-cdk/aws-ecr-assets"],"assignees":["eladb"]},
@@ -96,7 +96,7 @@ jobs:
            {"keywords":["(@aws-cdk/aws-eks)","(aws-eks)","(eks)"],"labels":["@aws-cdk/aws-eks"],"assignees":["otaviomacedo"]},
            {"keywords":["(@aws-cdk/aws-eks-legacy)","(aws-eks-legacy)","(eks-legacy)"],"labels":["@aws-cdk/aws-eks-legacy"],"assignees":["otaviomacedo"]},
            {"keywords":["(@aws-cdk/aws-elasticache)","(aws-elasticache)","(elasticache)","(elastic cache)","(elastic-cache)"],"labels":["@aws-cdk/aws-elasticache"],"assignees":["otaviomacedo"]},
-           {"keywords":["(@aws-cdk/aws-elasticbeanstalk)","(aws-elasticbeanstalk)","(elasticbeanstalk)","(elastic beanstalk)","(elastic-beanstalk)"],"labels":["@aws-cdk/aws-elasticbeanstalk"],"assignees":["madeline-k"]},
+           {"keywords":["(@aws-cdk/aws-elasticbeanstalk)","(aws-elasticbeanstalk)","(elasticbeanstalk)","(elastic beanstalk)","(elastic-beanstalk)"],"labels":["@aws-cdk/aws-elasticbeanstalk"],"assignees":["skinny85"]},
            {"keywords":["(@aws-cdk/aws-elasticloadbalancing)","(aws-elasticloadbalancing)","(elasticloadbalancing)","(elastic loadbalancing)","(elastic-loadbalancing)","(elb)"],"labels":["@aws-cdk/aws-elasticloadbalancing"],"assignees":["njlynch"]},
            {"keywords":["(@aws-cdk/aws-elasticloadbalancingv2)","(aws-elasticloadbalancingv2)","(elasticloadbalancingv2)","(elastic-loadbalancing-v2)","(elbv2)","(elb v2)"],"labels":["@aws-cdk/aws-elasticloadbalancingv2"],"assignees":["njlynch"]},
            {"keywords":["(@aws-cdk/aws-elasticloadbalancingv2-actions)","(aws-elasticloadbalancingv2-actions)","(elasticloadbalancingv2-actions)"],"labels":["@aws-cdk/aws-elasticloadbalancingv2-actions"],"assignees":["njlynch"]},
@@ -106,7 +106,7 @@ jobs:
            {"keywords":["(@aws-cdk/aws-emrcontainers)","(aws-emrcontainers)","(emrcontainers)"],"labels":["@aws-cdk/aws-emrcontainers"],"assignees":["BenChaimberg"]},
            {"keywords":["(@aws-cdk/aws-events)","(aws-events)","(events)","(eventbridge)","(event-bridge)"],"labels":["@aws-cdk/aws-events"],"assignees":["rix0rrr"]},
            {"keywords":["(@aws-cdk/aws-events-targets)","(aws-events-targets)","(events-targets)","(events targets)"],"labels":["@aws-cdk/aws-events-targets"],"assignees":["rix0rrr"]},
-           {"keywords":["(@aws-cdk/aws-eventschemas)","(aws-eventschemas)","(eventschemas)","(event schemas)"],"labels":["@aws-cdk/aws-eventschemas"],"assignees":["BenChaimberg"]},
+           {"keywords":["(@aws-cdk/aws-eventschemas)","(aws-eventschemas)","(eventschemas)","(event schemas)"],"labels":["@aws-cdk/aws-eventschemas"],"assignees":["skinny85"]},
            {"keywords":["(@aws-cdk/aws-finspace)","(aws-finspace)","(finspace)"],"labels":["@aws-cdk/aws-finspace"],"assignees":["njlynch"]},
            {"keywords":["(@aws-cdk/aws-fis)","(aws-fis)","(fis)"],"labels":["@aws-cdk/aws-fis"],"assignees":["njlynch"]},
            {"keywords":["(@aws-cdk/aws-fms)","(aws-fms)","(fms)"],"labels":["@aws-cdk/aws-fms"],"assignees":["rix0rrr"]},
@@ -116,23 +116,23 @@ jobs:
            {"keywords":["(@aws-cdk/aws-globalaccelerator)","(aws-globalaccelerator)","(globalaccelerator)","(global accelerator)","(global-accelerator)"],"labels":["@aws-cdk/aws-globalaccelerator"],"assignees":["rix0rrr"]},
            {"keywords":["(@aws-cdk/aws-globalaccelerator-endpoints)","(aws-globalaccelerator-endpoints)","(globalaccelerator-endpoints)"],"labels":["@aws-cdk/aws-globalaccelerator-endpoints"],"assignees":["rix0rrr"]},
            {"keywords":["(@aws-cdk/aws-glue)","(aws-glue)","(glue)"],"labels":["@aws-cdk/aws-glue"],"assignees":["BenChaimberg"]},
-           {"keywords":["(@aws-cdk/aws-greengrass)","(aws-greengrass)","(greengrass)","(green grass)","(green-grass)"],"labels":["@aws-cdk/aws-greengrass"],"assignees":["BenChaimberg"]},
-           {"keywords":["(@aws-cdk/aws-greengrassv2)","(aws-greengrassv2)","(greengrassv2)"],"labels":["@aws-cdk/aws-greengrassv2"],"assignees":["BenChaimberg"]},
+           {"keywords":["(@aws-cdk/aws-greengrass)","(aws-greengrass)","(greengrass)","(green grass)","(green-grass)"],"labels":["@aws-cdk/aws-greengrass"],"assignees":["skinny85"]},
+           {"keywords":["(@aws-cdk/aws-greengrassv2)","(aws-greengrassv2)","(greengrassv2)"],"labels":["@aws-cdk/aws-greengrassv2"],"assignees":["skinny85"]},
            {"keywords":["(@aws-cdk/aws-groundstation)","(aws-groundstation)","(groundstation)"],"labels":["@aws-cdk/aws-groundstation"],"assignees":["rix0rrr"]},
            {"keywords":["(@aws-cdk/aws-guardduty)","(aws-guardduty)","(guardduty)","(guard duty)","(guard-duty)"],"labels":["@aws-cdk/aws-guardduty"],"assignees":["rix0rrr"]},
            {"keywords":["(@aws-cdk/aws-iam)","(aws-iam)","(iam)"],"labels":["@aws-cdk/aws-iam"],"assignees":["rix0rrr"]},
-           {"keywords":["(@aws-cdk/aws-imagebuilder)","(aws-imagebuilder)","(imagebuilder)","(image builder)","(image-builder)"],"labels":["@aws-cdk/aws-imagebuilder"],"assignees":["BenChaimberg"]},
-           {"keywords":["(@aws-cdk/aws-inspector)","(aws-inspector)","(inspector)"],"labels":["@aws-cdk/aws-inspector"],"assignees":["BenChaimberg"]},
-           {"keywords":["(@aws-cdk/aws-iot)","(aws-iot)","(iot)"],"labels":["@aws-cdk/aws-iot"],"assignees":["BenChaimberg"]},
-           {"keywords":["(@aws-cdk/aws-iot1click)","(aws-iot1click)","(iot1click)","(iot 1click)"],"labels":["@aws-cdk/aws-iot1click"],"assignees":["BenChaimberg"]},
-           {"keywords":["(@aws-cdk/aws-iotanalytics)","(aws-iotanalytics)","(iotanalytics)","(iot analytics)","(iot-analytics)"],"labels":["@aws-cdk/aws-iotanalytics"],"assignees":["BenChaimberg"]},
-           {"keywords":["(@aws-cdk/aws-iotevents)","(aws-iotevents)","(iotevents)","(iot events)","(iot-events)"],"labels":["@aws-cdk/aws-iotevents"],"assignees":["BenChaimberg"]},
-           {"keywords":["(@aws-cdk/aws-iotfleethub)","(aws-iotfleethub)","(iotfleethub)"],"labels":["@aws-cdk/aws-iotfleethub"],"assignees":["BenChaimberg"]},
-           {"keywords":["(@aws-cdk/aws-iotsitewise)","(aws-iotsitewise)","(iotsitewise)","(iot sitewise)","(iot-sitewise)","(iot-site-wise)","(iot site wise)"],"labels":["@aws-cdk/aws-iotsitewise"],"assignees":["BenChaimberg"]},
-           {"keywords":["(@aws-cdk/aws-iotthingsgraph)","(aws-iotthingsgraph)","(iotthingsgraph)","(iot things graph)","(iot-things-graph)"],"labels":["@aws-cdk/aws-iotthingsgraph"],"assignees":["BenChaimberg"]},
-           {"keywords":["(@aws-cdk/aws-iotwireless)","(aws-iotwireless)","(iotwireless)"],"labels":["@aws-cdk/aws-iotwireless"],"assignees":["BenChaimberg"]},
-           {"keywords":["(@aws-cdk/aws-ivs)","(aws-ivs)","(Interactive Video Service)","(ivs)"],"labels":["@aws-cdk/aws-ivs"],"assignees":["BenChaimberg"]},
-           {"keywords":["(@aws-cdk/aws-kendra)","(aws-kendra)","(kendra)"],"labels":["@aws-cdk/aws-kendra"],"assignees":["BenChaimberg"]},
+           {"keywords":["(@aws-cdk/aws-imagebuilder)","(aws-imagebuilder)","(imagebuilder)","(image builder)","(image-builder)"],"labels":["@aws-cdk/aws-imagebuilder"],"assignees":["skinny85"]},
+           {"keywords":["(@aws-cdk/aws-inspector)","(aws-inspector)","(inspector)"],"labels":["@aws-cdk/aws-inspector"],"assignees":["skinny85"]},
+           {"keywords":["(@aws-cdk/aws-iot)","(aws-iot)","(iot)"],"labels":["@aws-cdk/aws-iot"],"assignees":["skinny85"]},
+           {"keywords":["(@aws-cdk/aws-iot1click)","(aws-iot1click)","(iot1click)","(iot 1click)"],"labels":["@aws-cdk/aws-iot1click"],"assignees":["skinny85"]},
+           {"keywords":["(@aws-cdk/aws-iotanalytics)","(aws-iotanalytics)","(iotanalytics)","(iot analytics)","(iot-analytics)"],"labels":["@aws-cdk/aws-iotanalytics"],"assignees":["skinny85"]},
+           {"keywords":["(@aws-cdk/aws-iotevents)","(aws-iotevents)","(iotevents)","(iot events)","(iot-events)"],"labels":["@aws-cdk/aws-iotevents"],"assignees":["skinny85"]},
+           {"keywords":["(@aws-cdk/aws-iotfleethub)","(aws-iotfleethub)","(iotfleethub)"],"labels":["@aws-cdk/aws-iotfleethub"],"assignees":["skinny85"]},
+           {"keywords":["(@aws-cdk/aws-iotsitewise)","(aws-iotsitewise)","(iotsitewise)","(iot sitewise)","(iot-sitewise)","(iot-site-wise)","(iot site wise)"],"labels":["@aws-cdk/aws-iotsitewise"],"assignees":["skinny85"]},
+           {"keywords":["(@aws-cdk/aws-iotthingsgraph)","(aws-iotthingsgraph)","(iotthingsgraph)","(iot things graph)","(iot-things-graph)"],"labels":["@aws-cdk/aws-iotthingsgraph"],"assignees":["skinny85"]},
+           {"keywords":["(@aws-cdk/aws-iotwireless)","(aws-iotwireless)","(iotwireless)"],"labels":["@aws-cdk/aws-iotwireless"],"assignees":["skinny85"]},
+           {"keywords":["(@aws-cdk/aws-ivs)","(aws-ivs)","(Interactive Video Service)","(ivs)"],"labels":["@aws-cdk/aws-ivs"],"assignees":["skinny85"]},
+           {"keywords":["(@aws-cdk/aws-kendra)","(aws-kendra)","(kendra)"],"labels":["@aws-cdk/aws-kendra"],"assignees":["skinny85"]},
            {"keywords":["(@aws-cdk/aws-kinesis)","(aws-kinesis)","(kinesis)"],"labels":["@aws-cdk/aws-kinesis"],"assignees":["otaviomacedo"]},
            {"keywords":["(@aws-cdk/aws-kinesisanalytics)","(aws-kinesisanalytics)","(kinesisanalytics)","(kinesis analytics)","(kinesis-analytics)"],"labels":["@aws-cdk/aws-kinesisanalytics"],"assignees":["otaviomacedo"]},
            {"keywords":["(@aws-cdk/aws-kinesisanalytics-flink)","(aws-kinesisanalytics-flink)","(kinesisanalytics-flink)"],"labels":["@aws-cdk/aws-kinesisanalytics-flink"],"assignees":["otaviomacedo"]},
@@ -151,27 +151,27 @@ jobs:
            {"keywords":["(@aws-cdk/aws-lookoutmetrics)","(aws-lookoutmetrics)","(lookoutmetrics)"],"labels":["@aws-cdk/aws-lookoutmetrics"],"assignees":["BenChaimberg"]},
            {"keywords":["(@aws-cdk/aws-lookoutvision)","(aws-lookoutvision)","(lookoutvision)"],"labels":["@aws-cdk/aws-lookoutvision"],"assignees":["BenChaimberg"]},
            {"keywords":["(@aws-cdk/aws-macie)","(aws-macie)","(macie)"],"labels":["@aws-cdk/aws-macie"],"assignees":["njlynch"]},
-           {"keywords":["(@aws-cdk/aws-managedblockchain)","(aws-managedblockchain)","(managedblockchain)","(managed blockchain)","(managed-blockchain)"],"labels":["@aws-cdk/aws-managedblockchain"],"assignees":["BenChaimberg"]},
-           {"keywords":["(@aws-cdk/aws-mediaconnect)","(aws-mediaconnect)","(mediaconnect)"],"labels":["@aws-cdk/aws-mediaconnect"],"assignees":["BenChaimberg"]},
-           {"keywords":["(@aws-cdk/aws-mediaconvert)","(aws-mediaconvert)","(mediaconvert)","(media convert)","(media-convert)"],"labels":["@aws-cdk/aws-mediaconvert"],"assignees":["BenChaimberg"]},
-           {"keywords":["(@aws-cdk/aws-medialive)","(aws-medialive)","(medialive)","(media live)","(media-live)"],"labels":["@aws-cdk/aws-medialive"],"assignees":["BenChaimberg"]},
-           {"keywords":["(@aws-cdk/aws-mediastore)","(aws-mediastore)","(mediastore)","(media store)","(media-store)"],"labels":["@aws-cdk/aws-mediastore"],"assignees":["BenChaimberg"]},
-           {"keywords":["(@aws-cdk/aws-mediapackage)","(aws-mediapackage)","(mediapackage)","(media package)","(media-package)"],"labels":["@aws-cdk/aws-mediapackage"],"assignees":["BenChaimberg"]},
+           {"keywords":["(@aws-cdk/aws-managedblockchain)","(aws-managedblockchain)","(managedblockchain)","(managed blockchain)","(managed-blockchain)"],"labels":["@aws-cdk/aws-managedblockchain"],"assignees":["skinny85"]},
+           {"keywords":["(@aws-cdk/aws-mediaconnect)","(aws-mediaconnect)","(mediaconnect)"],"labels":["@aws-cdk/aws-mediaconnect"],"assignees":["skinny85"]},
+           {"keywords":["(@aws-cdk/aws-mediaconvert)","(aws-mediaconvert)","(mediaconvert)","(media convert)","(media-convert)"],"labels":["@aws-cdk/aws-mediaconvert"],"assignees":["skinny85"]},
+           {"keywords":["(@aws-cdk/aws-medialive)","(aws-medialive)","(medialive)","(media live)","(media-live)"],"labels":["@aws-cdk/aws-medialive"],"assignees":["skinny85"]},
+           {"keywords":["(@aws-cdk/aws-mediastore)","(aws-mediastore)","(mediastore)","(media store)","(media-store)"],"labels":["@aws-cdk/aws-mediastore"],"assignees":["skinny85"]},
+           {"keywords":["(@aws-cdk/aws-mediapackage)","(aws-mediapackage)","(mediapackage)","(media package)","(media-package)"],"labels":["@aws-cdk/aws-mediapackage"],"assignees":["skinny85"]},
            {"keywords":["(@aws-cdk/aws-msk)","(aws-msk)","(msk)"],"labels":["@aws-cdk/aws-msk"],"assignees":["otaviomacedo"]},
            {"keywords":["(@aws-cdk/aws-mwaa)","(aws-mwaa)","(mwaa)"],"labels":["@aws-cdk/aws-mwaa"],"assignees":["rix0rrr"]},
            {"keywords":["(@aws-cdk/aws-neptune)","(aws-neptune)","(neptune)"],"labels":["@aws-cdk/aws-neptune"],"assignees":["njlynch"]},
-           {"keywords":["(@aws-cdk/aws-networkfirewall)","(aws-networkfirewall)","(networkfirewall)"],"labels":["@aws-cdk/aws-networkfirewall"],"assignees":["BenChaimberg"]},
-           {"keywords":["(@aws-cdk/aws-networkmanager)","(aws-networkmanager)","(networkmanager)","(network manager)","(network-manager)"],"labels":["@aws-cdk/aws-networkmanager"],"assignees":["BenChaimberg"]},
+           {"keywords":["(@aws-cdk/aws-networkfirewall)","(aws-networkfirewall)","(networkfirewall)"],"labels":["@aws-cdk/aws-networkfirewall"],"assignees":["skinny85"]},
+           {"keywords":["(@aws-cdk/aws-networkmanager)","(aws-networkmanager)","(networkmanager)","(network manager)","(network-manager)"],"labels":["@aws-cdk/aws-networkmanager"],"assignees":["skinny85"]},
            {"keywords":["(@aws-cdk/aws-nimblestudio)","(aws-nimblestudio)","(nimblestudio)"],"labels":["@aws-cdk/aws-nimblestudio"],"assignees":["madeline-k"]},
            {"keywords":["(@aws-cdk/aws-opsworks)","(aws-opsworks)","(opsworks)","(ops works)","(ops-works)"],"labels":["@aws-cdk/aws-opsworks"],"assignees":["madeline-k"]},
            {"keywords":["(@aws-cdk/aws-opsworkscm)","(aws-opsworkscm)","(opsworkscm)","(opsworks cm)","(opsworks-cm)"],"labels":["@aws-cdk/aws-opsworkscm"],"assignees":["madeline-k"]},
            {"keywords":["(@aws-cdk/aws-personalize)","(aws-personalize)","(personalize)"],"labels":["@aws-cdk/aws-personalize"],"assignees":["njlynch"]},
            {"keywords":["(@aws-cdk/aws-pinpoint)","(aws-pinpoint)","(pinpoint)"],"labels":["@aws-cdk/aws-pinpoint"],"assignees":["otaviomacedo"]},
            {"keywords":["(@aws-cdk/aws-pinpointemail)","(aws-pinpointemail)","(pinpointemail)","(pinpoint email)","(pinpoint-email)"],"labels":["@aws-cdk/aws-pinpointemail"],"assignees":["otaviomacedo"]},
-           {"keywords":["(@aws-cdk/aws-qldb)","(aws-qldb)","(qldb)"],"labels":["@aws-cdk/aws-qldb"],"assignees":["BenChaimberg"]},
+           {"keywords":["(@aws-cdk/aws-qldb)","(aws-qldb)","(qldb)"],"labels":["@aws-cdk/aws-qldb"],"assignees":["skinny85"]},
            {"keywords":["(@aws-cdk/aws-quicksight)","(aws-quicksight)","(quicksight)"],"labels":["@aws-cdk/aws-quicksight"],"assignees":["BenChaimberg"]},
            {"keywords":["(@aws-cdk/aws-ram)","(aws-ram)","(ram)"],"labels":["@aws-cdk/aws-ram"],"assignees":["madeline-k"]},
-           {"keywords":["(@aws-cdk/aws-rds)","(aws-rds)","(rds)"],"labels":["@aws-cdk/aws-rds"],"assignees":["BenChaimberg"]},
+           {"keywords":["(@aws-cdk/aws-rds)","(aws-rds)","(rds)"],"labels":["@aws-cdk/aws-rds"],"assignees":["skinny85"]},
            {"keywords":["(@aws-cdk/aws-redshift)","(aws-redshift)","(redshift)","(red shift)","(red-shift)"],"labels":["@aws-cdk/aws-redshift"],"assignees":["njlynch"]},
            {"keywords":["(@aws-cdk/aws-resourcegroups)","(aws-resourcegroups)","(resourcegroups)","(resource groups)","(resource-groups)"],"labels":["@aws-cdk/aws-resourcegroups"],"assignees":["madeline-k"]},
            {"keywords":["(@aws-cdk/aws-robomaker)","(aws-robomaker)","(robomaker)","(robo maker)","(robo-maker)"],"labels":["@aws-cdk/aws-robomaker"],"assignees":["njlynch"]},
@@ -189,9 +189,9 @@ jobs:
            {"keywords":["(@aws-cdk/aws-sam)","(aws-sam)","(sam)"],"labels":["@aws-cdk/aws-sam"],"assignees":["njlynch"]},
            {"keywords":["(@aws-cdk/aws-sdb)","(aws-sdb)","(sdb)"],"labels":["@aws-cdk/aws-sdb"],"assignees":["njlynch"]},
            {"keywords":["(@aws-cdk/aws-secretsmanager)","(aws-secretsmanager)","(secretsmanager)","(secrets manager)","(secrets-manager)"],"labels":["@aws-cdk/aws-secretsmanager"],"assignees":["njlynch"]},
-           {"keywords":["(@aws-cdk/aws-securityhub)","(aws-securityhub)","(securityhub)","(security hub)","(security-hub)"],"labels":["@aws-cdk/aws-securityhub"],"assignees":["BenChaimberg"]},
-           {"keywords":["(@aws-cdk/aws-servicecatalog)","(aws-servicecatalog)","(servicecatalog)","(service catalog)","(service-catalog)"],"labels":["@aws-cdk/aws-servicecatalog"],"assignees":["BenChaimberg"]},
-           {"keywords":["(@aws-cdk/aws-servicecatalogappregistry)","(aws-servicecatalogappregistry)","(servicecatalogappregistry)"],"labels":["@aws-cdk/aws-servicecatalogappregistry"],"assignees":["BenChaimberg"]},
+           {"keywords":["(@aws-cdk/aws-securityhub)","(aws-securityhub)","(securityhub)","(security hub)","(security-hub)"],"labels":["@aws-cdk/aws-securityhub"],"assignees":["skinny85"]},
+           {"keywords":["(@aws-cdk/aws-servicecatalog)","(aws-servicecatalog)","(servicecatalog)","(service catalog)","(service-catalog)"],"labels":["@aws-cdk/aws-servicecatalog"],"assignees":["skinny85"]},
+           {"keywords":["(@aws-cdk/aws-servicecatalogappregistry)","(aws-servicecatalogappregistry)","(servicecatalogappregistry)"],"labels":["@aws-cdk/aws-servicecatalogappregistry"],"assignees":["skinny85"]},
            {"keywords":["(@aws-cdk/aws-servicediscovery)","(aws-servicediscovery)","(servicediscovery)","(service discovery)","(service-discovery)"],"labels":["@aws-cdk/aws-servicediscovery"],"assignees":["madeline-k"]},
            {"keywords":["(@aws-cdk/aws-ses)","(aws-ses)","(ses)"],"labels":["@aws-cdk/aws-ses"],"assignees":["otaviomacedo"]},
            {"keywords":["(@aws-cdk/aws-ses-actions)","(aws-ses-actions)","(ses-actions)","(ses actions)"],"labels":["@aws-cdk/aws-ses-actions"],"assignees":["otaviomacedo"]},
@@ -200,11 +200,11 @@ jobs:
            {"keywords":["(@aws-cdk/aws-sns-subscriptions)","(aws-sns-subscriptions)","(sns-subscriptions)","(sns subscriptions)"],"labels":["@aws-cdk/aws-sns-subscriptions"],"assignees":["njlynch"]},
            {"keywords":["(@aws-cdk/aws-sqs)","(aws-sqs)","(sqs)"],"labels":["@aws-cdk/aws-sqs"],"assignees":["njlynch"]},
            {"keywords":["(@aws-cdk/aws-ssm)","(aws-ssm)","(ssm)"],"labels":["@aws-cdk/aws-ssm"],"assignees":["njlynch"]},
-           {"keywords":["(@aws-cdk/aws-sso)","(aws-sso)","(sso)"],"labels":["@aws-cdk/aws-sso"],"assignees":["BenChaimberg"]},
+           {"keywords":["(@aws-cdk/aws-sso)","(aws-sso)","(sso)"],"labels":["@aws-cdk/aws-sso"],"assignees":["skinny85"]},
            {"keywords":["(@aws-cdk/aws-stepfunctions)","(aws-stepfunctions)","(stepfunctions)","(step functions)","(step-functions)"],"labels":["@aws-cdk/aws-stepfunctions"],"assignees":["BenChaimberg"]},
            {"keywords":["(@aws-cdk/aws-stepfunctions-tasks)","(aws-stepfunctions-tasks)","(stepfunctions-tasks)","(stepfunctions tasks)"],"labels":["@aws-cdk/aws-stepfunctions-tasks"],"assignees":["BenChaimberg"]},
            {"keywords":["(@aws-cdk/aws-synthetics)","(aws-synthetics)","(synthetics)"],"labels":["@aws-cdk/aws-synthetics"],"assignees":["BenChaimberg"]},
-           {"keywords":["(@aws-cdk/aws-timestream)","(aws-timestream)","(timestream)"],"labels":["@aws-cdk/aws-timestream"],"assignees":["BenChaimberg"]},
+           {"keywords":["(@aws-cdk/aws-timestream)","(aws-timestream)","(timestream)"],"labels":["@aws-cdk/aws-timestream"],"assignees":["skinny85"]},
            {"keywords":["(@aws-cdk/aws-transfer)","(aws-transfer)","(transfer)"],"labels":["@aws-cdk/aws-transfer"],"assignees":["otaviomacedo"]},
            {"keywords":["(@aws-cdk/aws-waf)","(aws-waf)","(waf)"],"labels":["@aws-cdk/aws-waf"],"assignees":["njlynch"]},
            {"keywords":["(@aws-cdk/aws-wafregional)","(aws-wafregional)","(wafregional)","(waf regional)","(waf-regional)"],"labels":["@aws-cdk/aws-wafregional"],"assignees":["njlynch"]},
@@ -213,16 +213,16 @@ jobs:
            {"keywords":["(@aws-cdk/aws-xray)","(aws-xray)","(xray)"],"labels":["@aws-cdk/aws-xray"],"assignees":["nija-at"]},
            {"keywords":["(@aws-cdk/cfnspec)","(cfnspec)","(cfn spec)","(cfn-spec)"],"labels":["@aws-cdk/cfnspec"],"assignees":["rix0rrr"]},
            {"keywords":["(@aws-cdk/cloud-assembly-schema)","(cloud-assembly-schema)","(cloud assembly schema)"],"labels":["@aws-cdk/cloud-assembly-schema"],"assignees":["rix0rrr"]},
-           {"keywords":["(@aws-cdk/cloudformation-diff)","(cloudformation-diff)","(cloudformation diff)","(cfn diff)"],"labels":["@aws-cdk/cloudformation-diff"],"assignees":["BenChaimberg"]},
-           {"keywords":["(@aws-cdk/cloudformation-include)","(cloudformation-include)","(cloudformation include)","(cfn include)","(cfn-include)"],"labels":["@aws-cdk/cloudformation-include"],"assignees":["BenChaimberg"]},
+           {"keywords":["(@aws-cdk/cloudformation-diff)","(cloudformation-diff)","(cloudformation diff)","(cfn diff)"],"labels":["@aws-cdk/cloudformation-diff"],"assignees":["skinny85"]},
+           {"keywords":["(@aws-cdk/cloudformation-include)","(cloudformation-include)","(cloudformation include)","(cfn include)","(cfn-include)"],"labels":["@aws-cdk/cloudformation-include"],"assignees":["skinny85"]},
            {"keywords":["(@aws-cdk/core)","(core)"],"labels":["@aws-cdk/core"],"assignees":["rix0rrr"]},
            {"keywords":["(@aws-cdk/custom-resources)","(custom-resources)","(custom resources)"],"labels":["@aws-cdk/custom-resources"],"assignees":["rix0rrr"]},
            {"keywords":["(@aws-cdk/cx-api)","(cx-api)","(cx api)"],"labels":["@aws-cdk/cx-api"],"assignees":["rix0rrr"]},
            {"keywords":["(@aws-cdk/aws-lambda-layer-awscli)","(aws-lambda-layer-awscli)","(lambda-layer-awscli)"],"labels":["@aws-cdk/aws-lambda-layer-awscli"],"assignees":["rix0rrr"]},
            {"keywords":["(@aws-cdk/aws-lambda-layer-kubectl)","(aws-lambda-layer-kubectl)","(lambda-layer-kubectl)"],"labels":["@aws-cdk/aws-lambda-layer-kubectl"],"assignees":["eladb"]},
            {"keywords":["(@aws-cdk/pipelines)","(pipelines)","(cdk pipelines)","(cdk-pipelines)"],"labels":["@aws-cdk/pipelines"],"assignees":["rix0rrr"]},
-           {"keywords":["(@aws-cdk/region-info)","(region-info)","(region info)"],"labels":["@aws-cdk/region-info"],"assignees":["BenChaimberg"]},
+           {"keywords":["(@aws-cdk/region-info)","(region-info)","(region info)"],"labels":["@aws-cdk/region-info"],"assignees":["skinny85"]},
            {"keywords":["(aws-cdk-lib)","(cdk-v2)", "(v2)", "(ubergen)"],"labels":["aws-cdk-lib"],"assignees":["nija-at"]},
            {"keywords":["(monocdk)","(monocdk-experiment)"],"labels":["monocdk"],"assignees":["nija-at"]},
-           {"keywords":["(@aws-cdk/yaml-cfn)","(aws-yaml-cfn)","(yaml-cfn)"],"labels":["@aws-cdk/aws-yaml-cfn"],"assignees":["BenChaimberg"]}
+           {"keywords":["(@aws-cdk/yaml-cfn)","(aws-yaml-cfn)","(yaml-cfn)"],"labels":["@aws-cdk/aws-yaml-cfn"],"assignees":["skinny85"]}
            ]

From b1d69d7b06cd2a2ae8f578e217bdf7fef50a0163 Mon Sep 17 00:00:00 2001
From: Otavio Macedo <otaviomacedo@protonmail.com>
Date: Wed, 25 Aug 2021 17:53:28 +0100
Subject: [PATCH 16/91] fix(s3): bucket is not emptied before update when the
 name changes (#16203)

Changing the bucket name leads CloudFormation to try to delete the bucket and create a new one with the new name. If the bucket is not empty, the deployment will fail. With this change, the custom resource will clear the old bucket when it detects that there has been a name change.

NB: this custom resource is created only when `autoDeleteObjects: true` is passed to the bucket.

Fixes #14011.

----

*By submitting this pull request, I confirm that my contribution is made under the terms of the Apache-2.0 license*
---
 .../test/integ.s3-bucket.lit.expected.json    |  18 +--
 .../lib/auto-delete-objects-handler/index.ts  |  24 +++-
 .../test/auto-delete-objects-handler.test.ts  | 103 +++++++++++++++++-
 ...g.bucket-auto-delete-objects.expected.json |  18 +--
 4 files changed, 139 insertions(+), 24 deletions(-)

diff --git a/packages/@aws-cdk/aws-kinesisfirehose-destinations/test/integ.s3-bucket.lit.expected.json b/packages/@aws-cdk/aws-kinesisfirehose-destinations/test/integ.s3-bucket.lit.expected.json
index 2a85e28a6984d..ba6e2aecacda8 100644
--- a/packages/@aws-cdk/aws-kinesisfirehose-destinations/test/integ.s3-bucket.lit.expected.json
+++ b/packages/@aws-cdk/aws-kinesisfirehose-destinations/test/integ.s3-bucket.lit.expected.json
@@ -102,7 +102,7 @@
       "Properties": {
         "Code": {
           "S3Bucket": {
-            "Ref": "AssetParameters1a8becf42c48697a059094af1e94aa6bc6df0512d30433db8c22618ca02dfca1S3BucketF01ADF6B"
+            "Ref": "AssetParametersfe5df38824187483182e1459db47adfae2a515aa4caedd437fc4033a0c5b3de9S3BucketD715D8B0"
           },
           "S3Key": {
             "Fn::Join": [
@@ -115,7 +115,7 @@
                       "Fn::Split": [
                         "||",
                         {
-                          "Ref": "AssetParameters1a8becf42c48697a059094af1e94aa6bc6df0512d30433db8c22618ca02dfca1S3VersionKey6FC34F51"
+                          "Ref": "AssetParametersfe5df38824187483182e1459db47adfae2a515aa4caedd437fc4033a0c5b3de9S3VersionKey6E76822C"
                         }
                       ]
                     }
@@ -128,7 +128,7 @@
                       "Fn::Split": [
                         "||",
                         {
-                          "Ref": "AssetParameters1a8becf42c48697a059094af1e94aa6bc6df0512d30433db8c22618ca02dfca1S3VersionKey6FC34F51"
+                          "Ref": "AssetParametersfe5df38824187483182e1459db47adfae2a515aa4caedd437fc4033a0c5b3de9S3VersionKey6E76822C"
                         }
                       ]
                     }
@@ -751,17 +751,17 @@
     }
   },
   "Parameters": {
-    "AssetParameters1a8becf42c48697a059094af1e94aa6bc6df0512d30433db8c22618ca02dfca1S3BucketF01ADF6B": {
+    "AssetParametersfe5df38824187483182e1459db47adfae2a515aa4caedd437fc4033a0c5b3de9S3BucketD715D8B0": {
       "Type": "String",
-      "Description": "S3 bucket for asset \"1a8becf42c48697a059094af1e94aa6bc6df0512d30433db8c22618ca02dfca1\""
+      "Description": "S3 bucket for asset \"fe5df38824187483182e1459db47adfae2a515aa4caedd437fc4033a0c5b3de9\""
     },
-    "AssetParameters1a8becf42c48697a059094af1e94aa6bc6df0512d30433db8c22618ca02dfca1S3VersionKey6FC34F51": {
+    "AssetParametersfe5df38824187483182e1459db47adfae2a515aa4caedd437fc4033a0c5b3de9S3VersionKey6E76822C": {
       "Type": "String",
-      "Description": "S3 key for asset version \"1a8becf42c48697a059094af1e94aa6bc6df0512d30433db8c22618ca02dfca1\""
+      "Description": "S3 key for asset version \"fe5df38824187483182e1459db47adfae2a515aa4caedd437fc4033a0c5b3de9\""
     },
-    "AssetParameters1a8becf42c48697a059094af1e94aa6bc6df0512d30433db8c22618ca02dfca1ArtifactHash9ECACDFD": {
+    "AssetParametersfe5df38824187483182e1459db47adfae2a515aa4caedd437fc4033a0c5b3de9ArtifactHash9AE3702B": {
       "Type": "String",
-      "Description": "Artifact hash for asset \"1a8becf42c48697a059094af1e94aa6bc6df0512d30433db8c22618ca02dfca1\""
+      "Description": "Artifact hash for asset \"fe5df38824187483182e1459db47adfae2a515aa4caedd437fc4033a0c5b3de9\""
     },
     "AssetParameters5ee078f2a1957fe672d6cfd84faf49e07b8460758b5cd2669b3df1212a14cd19S3BucketFEDDFB43": {
       "Type": "String",
diff --git a/packages/@aws-cdk/aws-s3/lib/auto-delete-objects-handler/index.ts b/packages/@aws-cdk/aws-s3/lib/auto-delete-objects-handler/index.ts
index 5dd144b446e8e..f431aacf3fca2 100644
--- a/packages/@aws-cdk/aws-s3/lib/auto-delete-objects-handler/index.ts
+++ b/packages/@aws-cdk/aws-s3/lib/auto-delete-objects-handler/index.ts
@@ -6,10 +6,25 @@ const s3 = new S3();
 export async function handler(event: AWSLambda.CloudFormationCustomResourceEvent) {
   switch (event.RequestType) {
     case 'Create':
-    case 'Update':
       return;
+    case 'Update':
+      return onUpdate(event);
     case 'Delete':
-      return onDelete(event);
+      return onDelete(event.ResourceProperties?.BucketName);
+  }
+}
+
+async function onUpdate(event: AWSLambda.CloudFormationCustomResourceEvent) {
+  const updateEvent = event as AWSLambda.CloudFormationCustomResourceUpdateEvent;
+  const oldBucketName = updateEvent.OldResourceProperties?.BucketName;
+  const newBucketName = updateEvent.ResourceProperties?.BucketName;
+  const bucketNameHasChanged = newBucketName != null && oldBucketName != null && newBucketName !== oldBucketName;
+
+  /* If the name of the bucket has changed, CloudFormation will try to delete the bucket
+     and create a new one with the new name. So we have to delete the contents of the
+     bucket so that this operation does not fail. */
+  if (bucketNameHasChanged) {
+    return onDelete(oldBucketName);
   }
 }
 
@@ -23,7 +38,7 @@ async function emptyBucket(bucketName: string) {
   const contents = [...listedObjects.Versions ?? [], ...listedObjects.DeleteMarkers ?? []];
   if (contents.length === 0) {
     return;
-  };
+  }
 
   const records = contents.map((record: any) => ({ Key: record.Key, VersionId: record.VersionId }));
   await s3.deleteObjects({ Bucket: bucketName, Delete: { Objects: records } }).promise();
@@ -33,8 +48,7 @@ async function emptyBucket(bucketName: string) {
   }
 }
 
-async function onDelete(deleteEvent: AWSLambda.CloudFormationCustomResourceDeleteEvent) {
-  const bucketName = deleteEvent.ResourceProperties?.BucketName;
+async function onDelete(bucketName?: string) {
   if (!bucketName) {
     throw new Error('No BucketName was provided.');
   }
diff --git a/packages/@aws-cdk/aws-s3/test/auto-delete-objects-handler.test.ts b/packages/@aws-cdk/aws-s3/test/auto-delete-objects-handler.test.ts
index e5a7072441974..b09b9e5e4f5b3 100644
--- a/packages/@aws-cdk/aws-s3/test/auto-delete-objects-handler.test.ts
+++ b/packages/@aws-cdk/aws-s3/test/auto-delete-objects-handler.test.ts
@@ -37,7 +37,51 @@ test('does nothing on create event', async () => {
   expect(mockS3Client.deleteObjects).toHaveBeenCalledTimes(0);
 });
 
-test('does nothing on update event', async () => {
+test('does nothing on update event when everything remains the same', async () => {
+  // GIVEN
+  const event: Partial<AWSLambda.CloudFormationCustomResourceUpdateEvent> = {
+    RequestType: 'Update',
+    ResourceProperties: {
+      ServiceToken: 'Foo',
+      BucketName: 'MyBucket',
+    },
+    OldResourceProperties: {
+      ServiceToken: 'Foo',
+      BucketName: 'MyBucket',
+    },
+  };
+
+  // WHEN
+  await invokeHandler(event);
+
+  // THEN
+  expect(mockS3Client.listObjectVersions).toHaveBeenCalledTimes(0);
+  expect(mockS3Client.deleteObjects).toHaveBeenCalledTimes(0);
+});
+
+test('does nothing on update event when the bucket name remains the same but the service token changes', async () => {
+  // GIVEN
+  const event: Partial<AWSLambda.CloudFormationCustomResourceUpdateEvent> = {
+    RequestType: 'Update',
+    ResourceProperties: {
+      ServiceToken: 'Foo',
+      BucketName: 'MyBucket',
+    },
+    OldResourceProperties: {
+      ServiceToken: 'Bar',
+      BucketName: 'MyBucket',
+    },
+  };
+
+  // WHEN
+  await invokeHandler(event);
+
+  // THEN
+  expect(mockS3Client.listObjectVersions).toHaveBeenCalledTimes(0);
+  expect(mockS3Client.deleteObjects).toHaveBeenCalledTimes(0);
+});
+
+test('does nothing on update event when the old resource properties are absent', async () => {
   // GIVEN
   const event: Partial<AWSLambda.CloudFormationCustomResourceUpdateEvent> = {
     RequestType: 'Update',
@@ -55,6 +99,63 @@ test('does nothing on update event', async () => {
   expect(mockS3Client.deleteObjects).toHaveBeenCalledTimes(0);
 });
 
+test('does nothing on update event when the new resource properties are absent', async () => {
+  // GIVEN
+  const event: Partial<AWSLambda.CloudFormationCustomResourceUpdateEvent> = {
+    RequestType: 'Update',
+    OldResourceProperties: {
+      ServiceToken: 'Foo',
+      BucketName: 'MyBucket',
+    },
+  };
+
+  // WHEN
+  await invokeHandler(event);
+
+  // THEN
+  expect(mockS3Client.listObjectVersions).toHaveBeenCalledTimes(0);
+  expect(mockS3Client.deleteObjects).toHaveBeenCalledTimes(0);
+});
+
+test('deletes all objects when the name changes on update event', async () => {
+  // GIVEN
+  mockS3Client.promise.mockResolvedValue({ // listObjectVersions() call
+    Versions: [
+      { Key: 'Key1', VersionId: 'VersionId1' },
+      { Key: 'Key2', VersionId: 'VersionId2' },
+    ],
+  });
+
+  const event: Partial<AWSLambda.CloudFormationCustomResourceUpdateEvent> = {
+    RequestType: 'Update',
+    OldResourceProperties: {
+      ServiceToken: 'Foo',
+      BucketName: 'MyBucket',
+    },
+    ResourceProperties: {
+      ServiceToken: 'Foo',
+      BucketName: 'MyBucket-renamed',
+    },
+  };
+
+  // WHEN
+  await invokeHandler(event);
+
+  // THEN
+  expect(mockS3Client.listObjectVersions).toHaveBeenCalledTimes(1);
+  expect(mockS3Client.listObjectVersions).toHaveBeenCalledWith({ Bucket: 'MyBucket' });
+  expect(mockS3Client.deleteObjects).toHaveBeenCalledTimes(1);
+  expect(mockS3Client.deleteObjects).toHaveBeenCalledWith({
+    Bucket: 'MyBucket',
+    Delete: {
+      Objects: [
+        { Key: 'Key1', VersionId: 'VersionId1' },
+        { Key: 'Key2', VersionId: 'VersionId2' },
+      ],
+    },
+  });
+});
+
 test('deletes no objects on delete event when bucket has no objects', async () => {
   // GIVEN
   mockS3Client.promise.mockResolvedValue({ Versions: [] }); // listObjectVersions() call
diff --git a/packages/@aws-cdk/aws-s3/test/integ.bucket-auto-delete-objects.expected.json b/packages/@aws-cdk/aws-s3/test/integ.bucket-auto-delete-objects.expected.json
index 107132c1cd2dd..6623d9d3e7a8c 100644
--- a/packages/@aws-cdk/aws-s3/test/integ.bucket-auto-delete-objects.expected.json
+++ b/packages/@aws-cdk/aws-s3/test/integ.bucket-auto-delete-objects.expected.json
@@ -102,7 +102,7 @@
       "Properties": {
         "Code": {
           "S3Bucket": {
-            "Ref": "AssetParameters1a8becf42c48697a059094af1e94aa6bc6df0512d30433db8c22618ca02dfca1S3BucketF01ADF6B"
+            "Ref": "AssetParametersfe5df38824187483182e1459db47adfae2a515aa4caedd437fc4033a0c5b3de9S3BucketD715D8B0"
           },
           "S3Key": {
             "Fn::Join": [
@@ -115,7 +115,7 @@
                       "Fn::Split": [
                         "||",
                         {
-                          "Ref": "AssetParameters1a8becf42c48697a059094af1e94aa6bc6df0512d30433db8c22618ca02dfca1S3VersionKey6FC34F51"
+                          "Ref": "AssetParametersfe5df38824187483182e1459db47adfae2a515aa4caedd437fc4033a0c5b3de9S3VersionKey6E76822C"
                         }
                       ]
                     }
@@ -128,7 +128,7 @@
                       "Fn::Split": [
                         "||",
                         {
-                          "Ref": "AssetParameters1a8becf42c48697a059094af1e94aa6bc6df0512d30433db8c22618ca02dfca1S3VersionKey6FC34F51"
+                          "Ref": "AssetParametersfe5df38824187483182e1459db47adfae2a515aa4caedd437fc4033a0c5b3de9S3VersionKey6E76822C"
                         }
                       ]
                     }
@@ -289,17 +289,17 @@
     }
   },
   "Parameters": {
-    "AssetParameters1a8becf42c48697a059094af1e94aa6bc6df0512d30433db8c22618ca02dfca1S3BucketF01ADF6B": {
+    "AssetParametersfe5df38824187483182e1459db47adfae2a515aa4caedd437fc4033a0c5b3de9S3BucketD715D8B0": {
       "Type": "String",
-      "Description": "S3 bucket for asset \"1a8becf42c48697a059094af1e94aa6bc6df0512d30433db8c22618ca02dfca1\""
+      "Description": "S3 bucket for asset \"fe5df38824187483182e1459db47adfae2a515aa4caedd437fc4033a0c5b3de9\""
     },
-    "AssetParameters1a8becf42c48697a059094af1e94aa6bc6df0512d30433db8c22618ca02dfca1S3VersionKey6FC34F51": {
+    "AssetParametersfe5df38824187483182e1459db47adfae2a515aa4caedd437fc4033a0c5b3de9S3VersionKey6E76822C": {
       "Type": "String",
-      "Description": "S3 key for asset version \"1a8becf42c48697a059094af1e94aa6bc6df0512d30433db8c22618ca02dfca1\""
+      "Description": "S3 key for asset version \"fe5df38824187483182e1459db47adfae2a515aa4caedd437fc4033a0c5b3de9\""
     },
-    "AssetParameters1a8becf42c48697a059094af1e94aa6bc6df0512d30433db8c22618ca02dfca1ArtifactHash9ECACDFD": {
+    "AssetParametersfe5df38824187483182e1459db47adfae2a515aa4caedd437fc4033a0c5b3de9ArtifactHash9AE3702B": {
       "Type": "String",
-      "Description": "Artifact hash for asset \"1a8becf42c48697a059094af1e94aa6bc6df0512d30433db8c22618ca02dfca1\""
+      "Description": "Artifact hash for asset \"fe5df38824187483182e1459db47adfae2a515aa4caedd437fc4033a0c5b3de9\""
     },
     "AssetParametersf7ee44e9b6217d201200d9abd42c6493b0b11e86be8a7f36163c3ea049c54653S3BucketDB5FAF47": {
       "Type": "String",

From 5812340bfaebfef2bc41d5e7fbd0d45af92e0e49 Mon Sep 17 00:00:00 2001
From: Eli Polonsky <epolon@amazon.com>
Date: Wed, 25 Aug 2021 11:05:24 -0700
Subject: [PATCH 17/91] chore(integ): fix regression suite failures (#16226)

Follow up to https://github.com/aws/aws-cdk/pull/16216

We need to apply a patch for the regression suite to pass because its running the older tests which still make the wrong assertion.

See `NOTES.md` for more details.

----

*By submitting this pull request, I confirm that my contribution is made under the terms of the Apache-2.0 license*
---
 .../cli-regression-patches/v1.119.0/NOTES.md  |   5 +
 .../v1.119.0/cli.integtest.js                 | 659 ++++++++++++++++++
 2 files changed, 664 insertions(+)
 create mode 100644 packages/aws-cdk/test/integ/cli-regression-patches/v1.119.0/NOTES.md
 create mode 100644 packages/aws-cdk/test/integ/cli-regression-patches/v1.119.0/cli.integtest.js

diff --git a/packages/aws-cdk/test/integ/cli-regression-patches/v1.119.0/NOTES.md b/packages/aws-cdk/test/integ/cli-regression-patches/v1.119.0/NOTES.md
new file mode 100644
index 0000000000000..5ca96b632f75a
--- /dev/null
+++ b/packages/aws-cdk/test/integ/cli-regression-patches/v1.119.0/NOTES.md
@@ -0,0 +1,5 @@
+This [PR](https://github.com/aws/aws-cdk/pull/16205) added a node version check to our CLI courtesy of [`@jsii/check-node/run`](https://github.com/aws/jsii/tree/main/packages/%40jsii/check-node).
+
+This check now causes the CLI to print a deprecation warning that changes the output of the `synth` command. We don't consider this a breaking change since we have no guarantess for CLI output, but it did break some our integ tests (namely `cdk synth`) that used to rely on a specific output.
+
+This patch brings the [fix](https://github.com/aws/aws-cdk/pull/16216) into the regression suite.
\ No newline at end of file
diff --git a/packages/aws-cdk/test/integ/cli-regression-patches/v1.119.0/cli.integtest.js b/packages/aws-cdk/test/integ/cli-regression-patches/v1.119.0/cli.integtest.js
new file mode 100644
index 0000000000000..b8009dcaab00e
--- /dev/null
+++ b/packages/aws-cdk/test/integ/cli-regression-patches/v1.119.0/cli.integtest.js
@@ -0,0 +1,659 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+const fs_1 = require("fs");
+const os = require("os");
+const path = require("path");
+const aws_1 = require("../helpers/aws");
+const cdk_1 = require("../helpers/cdk");
+const test_helpers_1 = require("../helpers/test-helpers");
+jest.setTimeout(600 * 1000);
+test_helpers_1.integTest('VPC Lookup', cdk_1.withDefaultFixture(async (fixture) => {
+    fixture.log('Making sure we are clean before starting.');
+    await fixture.cdkDestroy('define-vpc', { modEnv: { ENABLE_VPC_TESTING: 'DEFINE' } });
+    fixture.log('Setting up: creating a VPC with known tags');
+    await fixture.cdkDeploy('define-vpc', { modEnv: { ENABLE_VPC_TESTING: 'DEFINE' } });
+    fixture.log('Setup complete!');
+    fixture.log('Verifying we can now import that VPC');
+    await fixture.cdkDeploy('import-vpc', { modEnv: { ENABLE_VPC_TESTING: 'IMPORT' } });
+}));
+test_helpers_1.integTest('Two ways of shoing the version', cdk_1.withDefaultFixture(async (fixture) => {
+    const version1 = await fixture.cdk(['version'], { verbose: false });
+    const version2 = await fixture.cdk(['--version'], { verbose: false });
+    expect(version1).toEqual(version2);
+}));
+test_helpers_1.integTest('Termination protection', cdk_1.withDefaultFixture(async (fixture) => {
+    const stackName = 'termination-protection';
+    await fixture.cdkDeploy(stackName);
+    // Try a destroy that should fail
+    await expect(fixture.cdkDestroy(stackName)).rejects.toThrow('exited with error');
+    // Can update termination protection even though the change set doesn't contain changes
+    await fixture.cdkDeploy(stackName, { modEnv: { TERMINATION_PROTECTION: 'FALSE' } });
+    await fixture.cdkDestroy(stackName);
+}));
+test_helpers_1.integTest('cdk synth', cdk_1.withDefaultFixture(async (fixture) => {
+    await fixture.cdk(['synth', fixture.fullStackName('test-1')]);
+    const template1 = await readTemplate(fixture, 'test-1');
+    expect(template1).toEqual({
+        Resources: {
+            topic69831491: {
+                Type: 'AWS::SNS::Topic',
+                Metadata: {
+                    'aws:cdk:path': `${fixture.stackNamePrefix}-test-1/topic/Resource`,
+                },
+            },
+        },
+    });
+    await fixture.cdk(['synth', fixture.fullStackName('test-2')], { verbose: false });
+    const template2 = await readTemplate(fixture, 'test-2');
+    expect(template2).toEqual({
+        Resources: {
+            topic152D84A37: {
+                Type: 'AWS::SNS::Topic',
+                Metadata: {
+                    'aws:cdk:path': `${fixture.stackNamePrefix}-test-2/topic1/Resource`,
+                },
+            },
+            topic2A4FB547F: {
+                Type: 'AWS::SNS::Topic',
+                Metadata: {
+                    'aws:cdk:path': `${fixture.stackNamePrefix}-test-2/topic2/Resource`,
+                },
+            },
+        },
+    });
+}));
+test_helpers_1.integTest('ssm parameter provider error', cdk_1.withDefaultFixture(async (fixture) => {
+    await expect(fixture.cdk(['synth',
+        fixture.fullStackName('missing-ssm-parameter'),
+        '-c', 'test:ssm-parameter-name=/does/not/exist'], {
+        allowErrExit: true,
+    })).resolves.toContain('SSM parameter not available in account');
+}));
+test_helpers_1.integTest('automatic ordering', cdk_1.withDefaultFixture(async (fixture) => {
+    // Deploy the consuming stack which will include the producing stack
+    await fixture.cdkDeploy('order-consuming');
+    // Destroy the providing stack which will include the consuming stack
+    await fixture.cdkDestroy('order-providing');
+}));
+test_helpers_1.integTest('context setting', cdk_1.withDefaultFixture(async (fixture) => {
+    await fs_1.promises.writeFile(path.join(fixture.integTestDir, 'cdk.context.json'), JSON.stringify({
+        contextkey: 'this is the context value',
+    }));
+    try {
+        await expect(fixture.cdk(['context'])).resolves.toContain('this is the context value');
+        // Test that deleting the contextkey works
+        await fixture.cdk(['context', '--reset', 'contextkey']);
+        await expect(fixture.cdk(['context'])).resolves.not.toContain('this is the context value');
+        // Test that forced delete of the context key does not throw
+        await fixture.cdk(['context', '-f', '--reset', 'contextkey']);
+    }
+    finally {
+        await fs_1.promises.unlink(path.join(fixture.integTestDir, 'cdk.context.json'));
+    }
+}));
+test_helpers_1.integTest('context in stage propagates to top', cdk_1.withDefaultFixture(async (fixture) => {
+    await expect(fixture.cdkSynth({
+        // This will make it error to prove that the context bubbles up, and also that we can fail on command
+        options: ['--no-lookups'],
+        modEnv: {
+            INTEG_STACK_SET: 'stage-using-context',
+        },
+        allowErrExit: true,
+    })).resolves.toContain('Context lookups have been disabled');
+}));
+test_helpers_1.integTest('deploy', cdk_1.withDefaultFixture(async (fixture) => {
+    var _a;
+    const stackArn = await fixture.cdkDeploy('test-2', { captureStderr: false });
+    // verify the number of resources in the stack
+    const response = await fixture.aws.cloudFormation('describeStackResources', {
+        StackName: stackArn,
+    });
+    expect((_a = response.StackResources) === null || _a === void 0 ? void 0 : _a.length).toEqual(2);
+}));
+test_helpers_1.integTest('deploy all', cdk_1.withDefaultFixture(async (fixture) => {
+    const arns = await fixture.cdkDeploy('test-*', { captureStderr: false });
+    // verify that we only deployed a single stack (there's a single ARN in the output)
+    expect(arns.split('\n').length).toEqual(2);
+}));
+test_helpers_1.integTest('nested stack with parameters', cdk_1.withDefaultFixture(async (fixture) => {
+    var _a;
+    // STACK_NAME_PREFIX is used in MyTopicParam to allow multiple instances
+    // of this test to run in parallel, othewise they will attempt to create the same SNS topic.
+    const stackArn = await fixture.cdkDeploy('with-nested-stack-using-parameters', {
+        options: ['--parameters', `MyTopicParam=${fixture.stackNamePrefix}ThereIsNoSpoon`],
+        captureStderr: false,
+    });
+    // verify that we only deployed a single stack (there's a single ARN in the output)
+    expect(stackArn.split('\n').length).toEqual(1);
+    // verify the number of resources in the stack
+    const response = await fixture.aws.cloudFormation('describeStackResources', {
+        StackName: stackArn,
+    });
+    expect((_a = response.StackResources) === null || _a === void 0 ? void 0 : _a.length).toEqual(1);
+}));
+test_helpers_1.integTest('deploy without execute a named change set', cdk_1.withDefaultFixture(async (fixture) => {
+    var _a;
+    const changeSetName = 'custom-change-set-name';
+    const stackArn = await fixture.cdkDeploy('test-2', {
+        options: ['--no-execute', '--change-set-name', changeSetName],
+        captureStderr: false,
+    });
+    // verify that we only deployed a single stack (there's a single ARN in the output)
+    expect(stackArn.split('\n').length).toEqual(1);
+    const response = await fixture.aws.cloudFormation('describeStacks', {
+        StackName: stackArn,
+    });
+    expect((_a = response.Stacks) === null || _a === void 0 ? void 0 : _a[0].StackStatus).toEqual('REVIEW_IN_PROGRESS');
+    //verify a change set was created with the provided name
+    const changeSetResponse = await fixture.aws.cloudFormation('listChangeSets', {
+        StackName: stackArn,
+    });
+    const changeSets = changeSetResponse.Summaries || [];
+    expect(changeSets.length).toEqual(1);
+    expect(changeSets[0].ChangeSetName).toEqual(changeSetName);
+    expect(changeSets[0].Status).toEqual('CREATE_COMPLETE');
+}));
+test_helpers_1.integTest('security related changes without a CLI are expected to fail', cdk_1.withDefaultFixture(async (fixture) => {
+    // redirect /dev/null to stdin, which means there will not be tty attached
+    // since this stack includes security-related changes, the deployment should
+    // immediately fail because we can't confirm the changes
+    const stackName = 'iam-test';
+    await expect(fixture.cdkDeploy(stackName, {
+        options: ['<', '/dev/null'],
+        neverRequireApproval: false,
+    })).rejects.toThrow('exited with error');
+    // Ensure stack was not deployed
+    await expect(fixture.aws.cloudFormation('describeStacks', {
+        StackName: fixture.fullStackName(stackName),
+    })).rejects.toThrow('does not exist');
+}));
+test_helpers_1.integTest('deploy wildcard with outputs', cdk_1.withDefaultFixture(async (fixture) => {
+    const outputsFile = path.join(fixture.integTestDir, 'outputs', 'outputs.json');
+    await fs_1.promises.mkdir(path.dirname(outputsFile), { recursive: true });
+    await fixture.cdkDeploy(['outputs-test-*'], {
+        options: ['--outputs-file', outputsFile],
+    });
+    const outputs = JSON.parse((await fs_1.promises.readFile(outputsFile, { encoding: 'utf-8' })).toString());
+    expect(outputs).toEqual({
+        [`${fixture.stackNamePrefix}-outputs-test-1`]: {
+            TopicName: `${fixture.stackNamePrefix}-outputs-test-1MyTopic`,
+        },
+        [`${fixture.stackNamePrefix}-outputs-test-2`]: {
+            TopicName: `${fixture.stackNamePrefix}-outputs-test-2MyOtherTopic`,
+        },
+    });
+}));
+test_helpers_1.integTest('deploy with parameters', cdk_1.withDefaultFixture(async (fixture) => {
+    var _a;
+    const stackArn = await fixture.cdkDeploy('param-test-1', {
+        options: [
+            '--parameters', `TopicNameParam=${fixture.stackNamePrefix}bazinga`,
+        ],
+        captureStderr: false,
+    });
+    const response = await fixture.aws.cloudFormation('describeStacks', {
+        StackName: stackArn,
+    });
+    expect((_a = response.Stacks) === null || _a === void 0 ? void 0 : _a[0].Parameters).toEqual([
+        {
+            ParameterKey: 'TopicNameParam',
+            ParameterValue: `${fixture.stackNamePrefix}bazinga`,
+        },
+    ]);
+}));
+test_helpers_1.integTest('update to stack in ROLLBACK_COMPLETE state will delete stack and create a new one', cdk_1.withDefaultFixture(async (fixture) => {
+    var _a, _b, _c, _d;
+    // GIVEN
+    await expect(fixture.cdkDeploy('param-test-1', {
+        options: [
+            '--parameters', `TopicNameParam=${fixture.stackNamePrefix}@aww`,
+        ],
+        captureStderr: false,
+    })).rejects.toThrow('exited with error');
+    const response = await fixture.aws.cloudFormation('describeStacks', {
+        StackName: fixture.fullStackName('param-test-1'),
+    });
+    const stackArn = (_a = response.Stacks) === null || _a === void 0 ? void 0 : _a[0].StackId;
+    expect((_b = response.Stacks) === null || _b === void 0 ? void 0 : _b[0].StackStatus).toEqual('ROLLBACK_COMPLETE');
+    // WHEN
+    const newStackArn = await fixture.cdkDeploy('param-test-1', {
+        options: [
+            '--parameters', `TopicNameParam=${fixture.stackNamePrefix}allgood`,
+        ],
+        captureStderr: false,
+    });
+    const newStackResponse = await fixture.aws.cloudFormation('describeStacks', {
+        StackName: newStackArn,
+    });
+    // THEN
+    expect(stackArn).not.toEqual(newStackArn); // new stack was created
+    expect((_c = newStackResponse.Stacks) === null || _c === void 0 ? void 0 : _c[0].StackStatus).toEqual('CREATE_COMPLETE');
+    expect((_d = newStackResponse.Stacks) === null || _d === void 0 ? void 0 : _d[0].Parameters).toEqual([
+        {
+            ParameterKey: 'TopicNameParam',
+            ParameterValue: `${fixture.stackNamePrefix}allgood`,
+        },
+    ]);
+}));
+test_helpers_1.integTest('stack in UPDATE_ROLLBACK_COMPLETE state can be updated', cdk_1.withDefaultFixture(async (fixture) => {
+    var _a, _b, _c, _d;
+    // GIVEN
+    const stackArn = await fixture.cdkDeploy('param-test-1', {
+        options: [
+            '--parameters', `TopicNameParam=${fixture.stackNamePrefix}nice`,
+        ],
+        captureStderr: false,
+    });
+    let response = await fixture.aws.cloudFormation('describeStacks', {
+        StackName: stackArn,
+    });
+    expect((_a = response.Stacks) === null || _a === void 0 ? void 0 : _a[0].StackStatus).toEqual('CREATE_COMPLETE');
+    // bad parameter name with @ will put stack into UPDATE_ROLLBACK_COMPLETE
+    await expect(fixture.cdkDeploy('param-test-1', {
+        options: [
+            '--parameters', `TopicNameParam=${fixture.stackNamePrefix}@aww`,
+        ],
+        captureStderr: false,
+    })).rejects.toThrow('exited with error');
+    ;
+    response = await fixture.aws.cloudFormation('describeStacks', {
+        StackName: stackArn,
+    });
+    expect((_b = response.Stacks) === null || _b === void 0 ? void 0 : _b[0].StackStatus).toEqual('UPDATE_ROLLBACK_COMPLETE');
+    // WHEN
+    await fixture.cdkDeploy('param-test-1', {
+        options: [
+            '--parameters', `TopicNameParam=${fixture.stackNamePrefix}allgood`,
+        ],
+        captureStderr: false,
+    });
+    response = await fixture.aws.cloudFormation('describeStacks', {
+        StackName: stackArn,
+    });
+    // THEN
+    expect((_c = response.Stacks) === null || _c === void 0 ? void 0 : _c[0].StackStatus).toEqual('UPDATE_COMPLETE');
+    expect((_d = response.Stacks) === null || _d === void 0 ? void 0 : _d[0].Parameters).toEqual([
+        {
+            ParameterKey: 'TopicNameParam',
+            ParameterValue: `${fixture.stackNamePrefix}allgood`,
+        },
+    ]);
+}));
+test_helpers_1.integTest('deploy with wildcard and parameters', cdk_1.withDefaultFixture(async (fixture) => {
+    await fixture.cdkDeploy('param-test-*', {
+        options: [
+            '--parameters', `${fixture.stackNamePrefix}-param-test-1:TopicNameParam=${fixture.stackNamePrefix}bazinga`,
+            '--parameters', `${fixture.stackNamePrefix}-param-test-2:OtherTopicNameParam=${fixture.stackNamePrefix}ThatsMySpot`,
+            '--parameters', `${fixture.stackNamePrefix}-param-test-3:DisplayNameParam=${fixture.stackNamePrefix}HeyThere`,
+            '--parameters', `${fixture.stackNamePrefix}-param-test-3:OtherDisplayNameParam=${fixture.stackNamePrefix}AnotherOne`,
+        ],
+    });
+}));
+test_helpers_1.integTest('deploy with parameters multi', cdk_1.withDefaultFixture(async (fixture) => {
+    var _a;
+    const paramVal1 = `${fixture.stackNamePrefix}bazinga`;
+    const paramVal2 = `${fixture.stackNamePrefix}=jagshemash`;
+    const stackArn = await fixture.cdkDeploy('param-test-3', {
+        options: [
+            '--parameters', `DisplayNameParam=${paramVal1}`,
+            '--parameters', `OtherDisplayNameParam=${paramVal2}`,
+        ],
+        captureStderr: false,
+    });
+    const response = await fixture.aws.cloudFormation('describeStacks', {
+        StackName: stackArn,
+    });
+    expect((_a = response.Stacks) === null || _a === void 0 ? void 0 : _a[0].Parameters).toEqual([
+        {
+            ParameterKey: 'DisplayNameParam',
+            ParameterValue: paramVal1,
+        },
+        {
+            ParameterKey: 'OtherDisplayNameParam',
+            ParameterValue: paramVal2,
+        },
+    ]);
+}));
+test_helpers_1.integTest('deploy with notification ARN', cdk_1.withDefaultFixture(async (fixture) => {
+    var _a;
+    const topicName = `${fixture.stackNamePrefix}-test-topic`;
+    const response = await fixture.aws.sns('createTopic', { Name: topicName });
+    const topicArn = response.TopicArn;
+    try {
+        await fixture.cdkDeploy('test-2', {
+            options: ['--notification-arns', topicArn],
+        });
+        // verify that the stack we deployed has our notification ARN
+        const describeResponse = await fixture.aws.cloudFormation('describeStacks', {
+            StackName: fixture.fullStackName('test-2'),
+        });
+        expect((_a = describeResponse.Stacks) === null || _a === void 0 ? void 0 : _a[0].NotificationARNs).toEqual([topicArn]);
+    }
+    finally {
+        await fixture.aws.sns('deleteTopic', {
+            TopicArn: topicArn,
+        });
+    }
+}));
+test_helpers_1.integTest('deploy with role', cdk_1.withDefaultFixture(async (fixture) => {
+    const roleName = `${fixture.stackNamePrefix}-test-role`;
+    await deleteRole();
+    const createResponse = await fixture.aws.iam('createRole', {
+        RoleName: roleName,
+        AssumeRolePolicyDocument: JSON.stringify({
+            Version: '2012-10-17',
+            Statement: [{
+                    Action: 'sts:AssumeRole',
+                    Principal: { Service: 'cloudformation.amazonaws.com' },
+                    Effect: 'Allow',
+                }, {
+                    Action: 'sts:AssumeRole',
+                    Principal: { AWS: (await fixture.aws.sts('getCallerIdentity', {})).Arn },
+                    Effect: 'Allow',
+                }],
+        }),
+    });
+    const roleArn = createResponse.Role.Arn;
+    try {
+        await fixture.aws.iam('putRolePolicy', {
+            RoleName: roleName,
+            PolicyName: 'DefaultPolicy',
+            PolicyDocument: JSON.stringify({
+                Version: '2012-10-17',
+                Statement: [{
+                        Action: '*',
+                        Resource: '*',
+                        Effect: 'Allow',
+                    }],
+            }),
+        });
+        await aws_1.retry(fixture.output, 'Trying to assume fresh role', aws_1.retry.forSeconds(300), async () => {
+            await fixture.aws.sts('assumeRole', {
+                RoleArn: roleArn,
+                RoleSessionName: 'testing',
+            });
+        });
+        // In principle, the role has replicated from 'us-east-1' to wherever we're testing.
+        // Give it a little more sleep to make sure CloudFormation is not hitting a box
+        // that doesn't have it yet.
+        await aws_1.sleep(5000);
+        await fixture.cdkDeploy('test-2', {
+            options: ['--role-arn', roleArn],
+        });
+        // Immediately delete the stack again before we delete the role.
+        //
+        // Since roles are sticky, if we delete the role before the stack, subsequent DeleteStack
+        // operations will fail when CloudFormation tries to assume the role that's already gone.
+        await fixture.cdkDestroy('test-2');
+    }
+    finally {
+        await deleteRole();
+    }
+    async function deleteRole() {
+        try {
+            for (const policyName of (await fixture.aws.iam('listRolePolicies', { RoleName: roleName })).PolicyNames) {
+                await fixture.aws.iam('deleteRolePolicy', {
+                    RoleName: roleName,
+                    PolicyName: policyName,
+                });
+            }
+            await fixture.aws.iam('deleteRole', { RoleName: roleName });
+        }
+        catch (e) {
+            if (e.message.indexOf('cannot be found') > -1) {
+                return;
+            }
+            throw e;
+        }
+    }
+}));
+test_helpers_1.integTest('cdk diff', cdk_1.withDefaultFixture(async (fixture) => {
+    const diff1 = await fixture.cdk(['diff', fixture.fullStackName('test-1')]);
+    expect(diff1).toContain('AWS::SNS::Topic');
+    const diff2 = await fixture.cdk(['diff', fixture.fullStackName('test-2')]);
+    expect(diff2).toContain('AWS::SNS::Topic');
+    // We can make it fail by passing --fail
+    await expect(fixture.cdk(['diff', '--fail', fixture.fullStackName('test-1')]))
+        .rejects.toThrow('exited with error');
+}));
+test_helpers_1.integTest('cdk diff --fail on multiple stacks exits with error if any of the stacks contains a diff', cdk_1.withDefaultFixture(async (fixture) => {
+    // GIVEN
+    const diff1 = await fixture.cdk(['diff', fixture.fullStackName('test-1')]);
+    expect(diff1).toContain('AWS::SNS::Topic');
+    await fixture.cdkDeploy('test-2');
+    const diff2 = await fixture.cdk(['diff', fixture.fullStackName('test-2')]);
+    expect(diff2).toContain('There were no differences');
+    // WHEN / THEN
+    await expect(fixture.cdk(['diff', '--fail', fixture.fullStackName('test-1'), fixture.fullStackName('test-2')])).rejects.toThrow('exited with error');
+}));
+test_helpers_1.integTest('cdk diff --fail with multiple stack exits with if any of the stacks contains a diff', cdk_1.withDefaultFixture(async (fixture) => {
+    // GIVEN
+    await fixture.cdkDeploy('test-1');
+    const diff1 = await fixture.cdk(['diff', fixture.fullStackName('test-1')]);
+    expect(diff1).toContain('There were no differences');
+    const diff2 = await fixture.cdk(['diff', fixture.fullStackName('test-2')]);
+    expect(diff2).toContain('AWS::SNS::Topic');
+    // WHEN / THEN
+    await expect(fixture.cdk(['diff', '--fail', fixture.fullStackName('test-1'), fixture.fullStackName('test-2')])).rejects.toThrow('exited with error');
+}));
+test_helpers_1.integTest('cdk diff --security-only --fail exits when security changes are present', cdk_1.withDefaultFixture(async (fixture) => {
+    const stackName = 'iam-test';
+    await expect(fixture.cdk(['diff', '--security-only', '--fail', fixture.fullStackName(stackName)])).rejects.toThrow('exited with error');
+}));
+test_helpers_1.integTest('deploy stack with docker asset', cdk_1.withDefaultFixture(async (fixture) => {
+    await fixture.cdkDeploy('docker');
+}));
+test_helpers_1.integTest('deploy and test stack with lambda asset', cdk_1.withDefaultFixture(async (fixture) => {
+    var _a, _b;
+    const stackArn = await fixture.cdkDeploy('lambda', { captureStderr: false });
+    const response = await fixture.aws.cloudFormation('describeStacks', {
+        StackName: stackArn,
+    });
+    const lambdaArn = (_b = (_a = response.Stacks) === null || _a === void 0 ? void 0 : _a[0].Outputs) === null || _b === void 0 ? void 0 : _b[0].OutputValue;
+    if (lambdaArn === undefined) {
+        throw new Error('Stack did not have expected Lambda ARN output');
+    }
+    const output = await fixture.aws.lambda('invoke', {
+        FunctionName: lambdaArn,
+    });
+    expect(JSON.stringify(output.Payload)).toContain('dear asset');
+}));
+test_helpers_1.integTest('cdk ls', cdk_1.withDefaultFixture(async (fixture) => {
+    const listing = await fixture.cdk(['ls'], { captureStderr: false });
+    const expectedStacks = [
+        'conditional-resource',
+        'docker',
+        'docker-with-custom-file',
+        'failed',
+        'iam-test',
+        'lambda',
+        'missing-ssm-parameter',
+        'order-providing',
+        'outputs-test-1',
+        'outputs-test-2',
+        'param-test-1',
+        'param-test-2',
+        'param-test-3',
+        'termination-protection',
+        'test-1',
+        'test-2',
+        'with-nested-stack',
+        'with-nested-stack-using-parameters',
+        'order-consuming',
+    ];
+    for (const stack of expectedStacks) {
+        expect(listing).toContain(fixture.fullStackName(stack));
+    }
+}));
+test_helpers_1.integTest('synthing a stage with errors leads to failure', cdk_1.withDefaultFixture(async (fixture) => {
+    const output = await fixture.cdk(['synth'], {
+        allowErrExit: true,
+        modEnv: {
+            INTEG_STACK_SET: 'stage-with-errors',
+        },
+    });
+    expect(output).toContain('This is an error');
+}));
+test_helpers_1.integTest('synthing a stage with errors can be suppressed', cdk_1.withDefaultFixture(async (fixture) => {
+    await fixture.cdk(['synth', '--no-validation'], {
+        modEnv: {
+            INTEG_STACK_SET: 'stage-with-errors',
+        },
+    });
+}));
+test_helpers_1.integTest('deploy stack without resource', cdk_1.withDefaultFixture(async (fixture) => {
+    // Deploy the stack without resources
+    await fixture.cdkDeploy('conditional-resource', { modEnv: { NO_RESOURCE: 'TRUE' } });
+    // This should have succeeded but not deployed the stack.
+    await expect(fixture.aws.cloudFormation('describeStacks', { StackName: fixture.fullStackName('conditional-resource') }))
+        .rejects.toThrow('conditional-resource does not exist');
+    // Deploy the stack with resources
+    await fixture.cdkDeploy('conditional-resource');
+    // Then again WITHOUT resources (this should destroy the stack)
+    await fixture.cdkDeploy('conditional-resource', { modEnv: { NO_RESOURCE: 'TRUE' } });
+    await expect(fixture.aws.cloudFormation('describeStacks', { StackName: fixture.fullStackName('conditional-resource') }))
+        .rejects.toThrow('conditional-resource does not exist');
+}));
+test_helpers_1.integTest('IAM diff', cdk_1.withDefaultFixture(async (fixture) => {
+    const output = await fixture.cdk(['diff', fixture.fullStackName('iam-test')]);
+    // Roughly check for a table like this:
+    //
+    // ┌───┬─────────────────┬────────┬────────────────┬────────────────────────────-──┬───────────┐
+    // │   │ Resource        │ Effect │ Action         │ Principal                     │ Condition │
+    // ├───┼─────────────────┼────────┼────────────────┼───────────────────────────────┼───────────┤
+    // │ + │ ${SomeRole.Arn} │ Allow  │ sts:AssumeRole │ Service:ec2.amazonaws.com     │           │
+    // └───┴─────────────────┴────────┴────────────────┴───────────────────────────────┴───────────┘
+    expect(output).toContain('${SomeRole.Arn}');
+    expect(output).toContain('sts:AssumeRole');
+    expect(output).toContain('ec2.amazonaws.com');
+}));
+test_helpers_1.integTest('fast deploy', cdk_1.withDefaultFixture(async (fixture) => {
+    // we are using a stack with a nested stack because CFN will always attempt to
+    // update a nested stack, which will allow us to verify that updates are actually
+    // skipped unless --force is specified.
+    const stackArn = await fixture.cdkDeploy('with-nested-stack', { captureStderr: false });
+    const changeSet1 = await getLatestChangeSet();
+    // Deploy the same stack again, there should be no new change set created
+    await fixture.cdkDeploy('with-nested-stack');
+    const changeSet2 = await getLatestChangeSet();
+    expect(changeSet2.ChangeSetId).toEqual(changeSet1.ChangeSetId);
+    // Deploy the stack again with --force, now we should create a changeset
+    await fixture.cdkDeploy('with-nested-stack', { options: ['--force'] });
+    const changeSet3 = await getLatestChangeSet();
+    expect(changeSet3.ChangeSetId).not.toEqual(changeSet2.ChangeSetId);
+    // Deploy the stack again with tags, expected to create a new changeset
+    // even though the resources didn't change.
+    await fixture.cdkDeploy('with-nested-stack', { options: ['--tags', 'key=value'] });
+    const changeSet4 = await getLatestChangeSet();
+    expect(changeSet4.ChangeSetId).not.toEqual(changeSet3.ChangeSetId);
+    async function getLatestChangeSet() {
+        var _a, _b, _c;
+        const response = await fixture.aws.cloudFormation('describeStacks', { StackName: stackArn });
+        if (!((_a = response.Stacks) === null || _a === void 0 ? void 0 : _a[0])) {
+            throw new Error('Did not get a ChangeSet at all');
+        }
+        fixture.log(`Found Change Set ${(_b = response.Stacks) === null || _b === void 0 ? void 0 : _b[0].ChangeSetId}`);
+        return (_c = response.Stacks) === null || _c === void 0 ? void 0 : _c[0];
+    }
+}));
+test_helpers_1.integTest('failed deploy does not hang', cdk_1.withDefaultFixture(async (fixture) => {
+    // this will hang if we introduce https://github.com/aws/aws-cdk/issues/6403 again.
+    await expect(fixture.cdkDeploy('failed')).rejects.toThrow('exited with error');
+}));
+test_helpers_1.integTest('can still load old assemblies', cdk_1.withDefaultFixture(async (fixture) => {
+    const cxAsmDir = path.join(os.tmpdir(), 'cdk-integ-cx');
+    const testAssembliesDirectory = path.join(__dirname, 'cloud-assemblies');
+    for (const asmdir of await listChildDirs(testAssembliesDirectory)) {
+        fixture.log(`ASSEMBLY ${asmdir}`);
+        await cdk_1.cloneDirectory(asmdir, cxAsmDir);
+        // Some files in the asm directory that have a .js extension are
+        // actually treated as templates. Evaluate them using NodeJS.
+        const templates = await listChildren(cxAsmDir, fullPath => Promise.resolve(fullPath.endsWith('.js')));
+        for (const template of templates) {
+            const targetName = template.replace(/.js$/, '');
+            await cdk_1.shell([process.execPath, template, '>', targetName], {
+                cwd: cxAsmDir,
+                output: fixture.output,
+                modEnv: {
+                    TEST_ACCOUNT: await fixture.aws.account(),
+                    TEST_REGION: fixture.aws.region,
+                },
+            });
+        }
+        // Use this directory as a Cloud Assembly
+        const output = await fixture.cdk([
+            '--app', cxAsmDir,
+            '-v',
+            'synth',
+        ]);
+        // Assert that there was no providerError in CDK's stderr
+        // Because we rely on the app/framework to actually error in case the
+        // provider fails, we inspect the logs here.
+        expect(output).not.toContain('$providerError');
+    }
+}));
+test_helpers_1.integTest('generating and loading assembly', cdk_1.withDefaultFixture(async (fixture) => {
+    const asmOutputDir = `${fixture.integTestDir}-cdk-integ-asm`;
+    await fixture.shell(['rm', '-rf', asmOutputDir]);
+    // Synthesize a Cloud Assembly tothe default directory (cdk.out) and a specific directory.
+    await fixture.cdk(['synth']);
+    await fixture.cdk(['synth', '--output', asmOutputDir]);
+    // cdk.out in the current directory and the indicated --output should be the same
+    await fixture.shell(['diff', 'cdk.out', asmOutputDir]);
+    // Check that we can 'ls' the synthesized asm.
+    // Change to some random directory to make sure we're not accidentally loading cdk.json
+    const list = await fixture.cdk(['--app', asmOutputDir, 'ls'], { cwd: os.tmpdir() });
+    // Same stacks we know are in the app
+    expect(list).toContain(`${fixture.stackNamePrefix}-lambda`);
+    expect(list).toContain(`${fixture.stackNamePrefix}-test-1`);
+    expect(list).toContain(`${fixture.stackNamePrefix}-test-2`);
+    // Check that we can use '.' and just synth ,the generated asm
+    const stackTemplate = await fixture.cdk(['--app', '.', 'synth', fixture.fullStackName('test-2')], {
+        cwd: asmOutputDir,
+    });
+    expect(stackTemplate).toContain('topic152D84A37');
+    // Deploy a Lambda from the copied asm
+    await fixture.cdkDeploy('lambda', { options: ['-a', '.'], cwd: asmOutputDir });
+    // Remove (rename) the original custom docker file that was used during synth.
+    // this verifies that the assemly has a copy of it and that the manifest uses
+    // relative paths to reference to it.
+    const customDockerFile = path.join(fixture.integTestDir, 'docker', 'Dockerfile.Custom');
+    await fs_1.promises.rename(customDockerFile, `${customDockerFile}~`);
+    try {
+        // deploy a docker image with custom file without synth (uses assets)
+        await fixture.cdkDeploy('docker-with-custom-file', { options: ['-a', '.'], cwd: asmOutputDir });
+    }
+    finally {
+        // Rename back to restore fixture to original state
+        await fs_1.promises.rename(`${customDockerFile}~`, customDockerFile);
+    }
+}));
+test_helpers_1.integTest('templates on disk contain metadata resource, also in nested assemblies', cdk_1.withDefaultFixture(async (fixture) => {
+    // Synth first, and switch on version reporting because cdk.json is disabling it
+    await fixture.cdk(['synth', '--version-reporting=true']);
+    // Load template from disk from root assembly
+    const templateContents = await fixture.shell(['cat', 'cdk.out/*-lambda.template.json']);
+    expect(JSON.parse(templateContents).Resources.CDKMetadata).toBeTruthy();
+    // Load template from nested assembly
+    const nestedTemplateContents = await fixture.shell(['cat', 'cdk.out/assembly-*-stage/*-stage-StackInStage.template.json']);
+    expect(JSON.parse(nestedTemplateContents).Resources.CDKMetadata).toBeTruthy();
+}));
+async function listChildren(parent, pred) {
+    const ret = new Array();
+    for (const child of await fs_1.promises.readdir(parent, { encoding: 'utf-8' })) {
+        const fullPath = path.join(parent, child.toString());
+        if (await pred(fullPath)) {
+            ret.push(fullPath);
+        }
+    }
+    return ret;
+}
+async function listChildDirs(parent) {
+    return listChildren(parent, async (fullPath) => (await fs_1.promises.stat(fullPath)).isDirectory());
+}
+async function readTemplate(fixture, stackName) {
+    const fullStackName = fixture.fullStackName(stackName);
+    const templatePath = path.join(fixture.integTestDir, 'cdk.out', `${fullStackName}.template.json`);
+    return JSON.parse((await fs_1.promises.readFile(templatePath, { encoding: 'utf-8' })).toString());
+}
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiY2xpLmludGVndGVzdC5qcyIsInNvdXJjZVJvb3QiOiIiLCJzb3VyY2VzIjpbImNsaS5pbnRlZ3Rlc3QudHMiXSwibmFtZXMiOltdLCJtYXBwaW5ncyI6Ijs7QUFBQSwyQkFBb0M7QUFDcEMseUJBQXlCO0FBQ3pCLDZCQUE2QjtBQUM3Qix3Q0FBOEM7QUFDOUMsd0NBQXdGO0FBQ3hGLDBEQUFvRDtBQUVwRCxJQUFJLENBQUMsVUFBVSxDQUFDLEdBQUcsR0FBRyxJQUFJLENBQUMsQ0FBQztBQUU1Qix3QkFBUyxDQUFDLFlBQVksRUFBRSx3QkFBa0IsQ0FBQyxLQUFLLEVBQUUsT0FBTyxFQUFFLEVBQUU7SUFDM0QsT0FBTyxDQUFDLEdBQUcsQ0FBQywyQ0FBMkMsQ0FBQyxDQUFDO0lBQ3pELE1BQU0sT0FBTyxDQUFDLFVBQVUsQ0FBQyxZQUFZLEVBQUUsRUFBRSxNQUFNLEVBQUUsRUFBRSxrQkFBa0IsRUFBRSxRQUFRLEVBQUUsRUFBRSxDQUFDLENBQUM7SUFFckYsT0FBTyxDQUFDLEdBQUcsQ0FBQyw0Q0FBNEMsQ0FBQyxDQUFDO0lBQzFELE1BQU0sT0FBTyxDQUFDLFNBQVMsQ0FBQyxZQUFZLEVBQUUsRUFBRSxNQUFNLEVBQUUsRUFBRSxrQkFBa0IsRUFBRSxRQUFRLEVBQUUsRUFBRSxDQUFDLENBQUM7SUFDcEYsT0FBTyxDQUFDLEdBQUcsQ0FBQyxpQkFBaUIsQ0FBQyxDQUFDO0lBRS9CLE9BQU8sQ0FBQyxHQUFHLENBQUMsc0NBQXNDLENBQUMsQ0FBQztJQUNwRCxNQUFNLE9BQU8sQ0FBQyxTQUFTLENBQUMsWUFBWSxFQUFFLEVBQUUsTUFBTSxFQUFFLEVBQUUsa0JBQWtCLEVBQUUsUUFBUSxFQUFFLEVBQUUsQ0FBQyxDQUFDO0FBQ3RGLENBQUMsQ0FBQyxDQUFDLENBQUM7QUFFSix3QkFBUyxDQUFDLGdDQUFnQyxFQUFFLHdCQUFrQixDQUFDLEtBQUssRUFBRSxPQUFPLEVBQUUsRUFBRTtJQUMvRSxNQUFNLFFBQVEsR0FBRyxNQUFNLE9BQU8sQ0FBQyxHQUFHLENBQUMsQ0FBQyxTQUFTLENBQUMsRUFBRSxFQUFFLE9BQU8sRUFBRSxLQUFLLEVBQUUsQ0FBQyxDQUFDO0lBQ3BFLE1BQU0sUUFBUSxHQUFHLE1BQU0sT0FBTyxDQUFDLEdBQUcsQ0FBQyxDQUFDLFdBQVcsQ0FBQyxFQUFFLEVBQUUsT0FBTyxFQUFFLEtBQUssRUFBRSxDQUFDLENBQUM7SUFFdEUsTUFBTSxDQUFDLFFBQVEsQ0FBQyxDQUFDLE9BQU8sQ0FBQyxRQUFRLENBQUMsQ0FBQztBQUNyQyxDQUFDLENBQUMsQ0FBQyxDQUFDO0FBRUosd0JBQVMsQ0FBQyx3QkFBd0IsRUFBRSx3QkFBa0IsQ0FBQyxLQUFLLEVBQUUsT0FBTyxFQUFFLEVBQUU7SUFDdkUsTUFBTSxTQUFTLEdBQUcsd0JBQXdCLENBQUM7SUFDM0MsTUFBTSxPQUFPLENBQUMsU0FBUyxDQUFDLFNBQVMsQ0FBQyxDQUFDO0lBRW5DLGlDQUFpQztJQUNqQyxNQUFNLE1BQU0sQ0FBQyxPQUFPLENBQUMsVUFBVSxDQUFDLFNBQVMsQ0FBQyxDQUFDLENBQUMsT0FBTyxDQUFDLE9BQU8sQ0FBQyxtQkFBbUIsQ0FBQyxDQUFDO0lBRWpGLHVGQUF1RjtJQUN2RixNQUFNLE9BQU8sQ0FBQyxTQUFTLENBQUMsU0FBUyxFQUFFLEVBQUUsTUFBTSxFQUFFLEVBQUUsc0JBQXNCLEVBQUUsT0FBTyxFQUFFLEVBQUUsQ0FBQyxDQUFDO0lBQ3BGLE1BQU0sT0FBTyxDQUFDLFVBQVUsQ0FBQyxTQUFTLENBQUMsQ0FBQztBQUN0QyxDQUFDLENBQUMsQ0FBQyxDQUFDO0FBRUosd0JBQVMsQ0FBQyxXQUFXLEVBQUUsd0JBQWtCLENBQUMsS0FBSyxFQUFFLE9BQU8sRUFBRSxFQUFFO0lBQzFELE1BQU0sT0FBTyxDQUFDLEdBQUcsQ0FBQyxDQUFDLE9BQU8sRUFBRSxPQUFPLENBQUMsYUFBYSxDQUFDLFFBQVEsQ0FBQyxDQUFDLENBQUMsQ0FBQztJQUM5RCxNQUFNLFNBQVMsR0FBRyxNQUFNLFlBQVksQ0FBQyxPQUFPLEVBQUUsUUFBUSxDQUFDLENBQUM7SUFDeEQsTUFBTSxDQUFDLFNBQVMsQ0FBQyxDQUFDLE9BQU8sQ0FBQztRQUN4QixTQUFTLEVBQUU7WUFDVCxhQUFhLEVBQUU7Z0JBQ2IsSUFBSSxFQUFFLGlCQUFpQjtnQkFDdkIsUUFBUSxFQUFFO29CQUNSLGNBQWMsRUFBRSxHQUFHLE9BQU8sQ0FBQyxlQUFlLHdCQUF3QjtpQkFDbkU7YUFDRjtTQUNGO0tBQ0YsQ0FBQyxDQUFDO0lBRUgsTUFBTSxPQUFPLENBQUMsR0FBRyxDQUFDLENBQUMsT0FBTyxFQUFFLE9BQU8sQ0FBQyxhQUFhLENBQUMsUUFBUSxDQUFDLENBQUMsRUFBRSxFQUFFLE9BQU8sRUFBRSxLQUFLLEVBQUUsQ0FBQyxDQUFDO0lBQ2xGLE1BQU0sU0FBUyxHQUFHLE1BQU0sWUFBWSxDQUFDLE9BQU8sRUFBRSxRQUFRLENBQUMsQ0FBQztJQUN4RCxNQUFNLENBQUMsU0FBUyxDQUFDLENBQUMsT0FBTyxDQUFDO1FBQ3hCLFNBQVMsRUFBRTtZQUNULGNBQWMsRUFBRTtnQkFDZCxJQUFJLEVBQUUsaUJBQWlCO2dCQUN2QixRQUFRLEVBQUU7b0JBQ1IsY0FBYyxFQUFFLEdBQUcsT0FBTyxDQUFDLGVBQWUseUJBQXlCO2lCQUNwRTthQUNGO1lBQ0QsY0FBYyxFQUFFO2dCQUNkLElBQUksRUFBRSxpQkFBaUI7Z0JBQ3ZCLFFBQVEsRUFBRTtvQkFDUixjQUFjLEVBQUUsR0FBRyxPQUFPLENBQUMsZUFBZSx5QkFBeUI7aUJBQ3BFO2FBQ0Y7U0FDRjtLQUNGLENBQUMsQ0FBQztBQUVMLENBQUMsQ0FBQyxDQUFDLENBQUM7QUFFSix3QkFBUyxDQUFDLDhCQUE4QixFQUFFLHdCQUFrQixDQUFDLEtBQUssRUFBRSxPQUFPLEVBQUUsRUFBRTtJQUM3RSxNQUFNLE1BQU0sQ0FBQyxPQUFPLENBQUMsR0FBRyxDQUFDLENBQUMsT0FBTztRQUMvQixPQUFPLENBQUMsYUFBYSxDQUFDLHVCQUF1QixDQUFDO1FBQzlDLElBQUksRUFBRSx5Q0FBeUMsQ0FBQyxFQUFFO1FBQ2xELFlBQVksRUFBRSxJQUFJO0tBQ25CLENBQUMsQ0FBQyxDQUFDLFFBQVEsQ0FBQyxTQUFTLENBQUMsd0NBQXdDLENBQUMsQ0FBQztBQUNuRSxDQUFDLENBQUMsQ0FBQyxDQUFDO0FBRUosd0JBQVMsQ0FBQyxvQkFBb0IsRUFBRSx3QkFBa0IsQ0FBQyxLQUFLLEVBQUUsT0FBTyxFQUFFLEVBQUU7SUFDbkUsb0VBQW9FO0lBQ3BFLE1BQU0sT0FBTyxDQUFDLFNBQVMsQ0FBQyxpQkFBaUIsQ0FBQyxDQUFDO0lBRTNDLHFFQUFxRTtJQUNyRSxNQUFNLE9BQU8sQ0FBQyxVQUFVLENBQUMsaUJBQWlCLENBQUMsQ0FBQztBQUM5QyxDQUFDLENBQUMsQ0FBQyxDQUFDO0FBRUosd0JBQVMsQ0FBQyxpQkFBaUIsRUFBRSx3QkFBa0IsQ0FBQyxLQUFLLEVBQUUsT0FBTyxFQUFFLEVBQUU7SUFDaEUsTUFBTSxhQUFFLENBQUMsU0FBUyxDQUFDLElBQUksQ0FBQyxJQUFJLENBQUMsT0FBTyxDQUFDLFlBQVksRUFBRSxrQkFBa0IsQ0FBQyxFQUFFLElBQUksQ0FBQyxTQUFTLENBQUM7UUFDckYsVUFBVSxFQUFFLDJCQUEyQjtLQUN4QyxDQUFDLENBQUMsQ0FBQztJQUNKLElBQUk7UUFDRixNQUFNLE1BQU0sQ0FBQyxPQUFPLENBQUMsR0FBRyxDQUFDLENBQUMsU0FBUyxDQUFDLENBQUMsQ0FBQyxDQUFDLFFBQVEsQ0FBQyxTQUFTLENBQUMsMkJBQTJCLENBQUMsQ0FBQztRQUV2RiwwQ0FBMEM7UUFDMUMsTUFBTSxPQUFPLENBQUMsR0FBRyxDQUFDLENBQUMsU0FBUyxFQUFFLFNBQVMsRUFBRSxZQUFZLENBQUMsQ0FBQyxDQUFDO1FBQ3hELE1BQU0sTUFBTSxDQUFDLE9BQU8sQ0FBQyxHQUFHLENBQUMsQ0FBQyxTQUFTLENBQUMsQ0FBQyxDQUFDLENBQUMsUUFBUSxDQUFDLEdBQUcsQ0FBQyxTQUFTLENBQUMsMkJBQTJCLENBQUMsQ0FBQztRQUUzRiw0REFBNEQ7UUFDNUQsTUFBTSxPQUFPLENBQUMsR0FBRyxDQUFDLENBQUMsU0FBUyxFQUFFLElBQUksRUFBRSxTQUFTLEVBQUUsWUFBWSxDQUFDLENBQUMsQ0FBQztLQUUvRDtZQUFTO1FBQ1IsTUFBTSxhQUFFLENBQUMsTUFBTSxDQUFDLElBQUksQ0FBQyxJQUFJLENBQUMsT0FBTyxDQUFDLFlBQVksRUFBRSxrQkFBa0IsQ0FBQyxDQUFDLENBQUM7S0FDdEU7QUFDSCxDQUFDLENBQUMsQ0FBQyxDQUFDO0FBRUosd0JBQVMsQ0FBQyxvQ0FBb0MsRUFBRSx3QkFBa0IsQ0FBQyxLQUFLLEVBQUUsT0FBTyxFQUFFLEVBQUU7SUFDbkYsTUFBTSxNQUFNLENBQUMsT0FBTyxDQUFDLFFBQVEsQ0FBQztRQUM1QixxR0FBcUc7UUFDckcsT0FBTyxFQUFFLENBQUMsY0FBYyxDQUFDO1FBQ3pCLE1BQU0sRUFBRTtZQUNOLGVBQWUsRUFBRSxxQkFBcUI7U0FDdkM7UUFDRCxZQUFZLEVBQUUsSUFBSTtLQUNuQixDQUFDLENBQUMsQ0FBQyxRQUFRLENBQUMsU0FBUyxDQUFDLG9DQUFvQyxDQUFDLENBQUM7QUFDL0QsQ0FBQyxDQUFDLENBQUMsQ0FBQztBQUVKLHdCQUFTLENBQUMsUUFBUSxFQUFFLHdCQUFrQixDQUFDLEtBQUssRUFBRSxPQUFPLEVBQUUsRUFBRTs7SUFDdkQsTUFBTSxRQUFRLEdBQUcsTUFBTSxPQUFPLENBQUMsU0FBUyxDQUFDLFFBQVEsRUFBRSxFQUFFLGFBQWEsRUFBRSxLQUFLLEVBQUUsQ0FBQyxDQUFDO0lBRTdFLDhDQUE4QztJQUM5QyxNQUFNLFFBQVEsR0FBRyxNQUFNLE9BQU8sQ0FBQyxHQUFHLENBQUMsY0FBYyxDQUFDLHdCQUF3QixFQUFFO1FBQzFFLFNBQVMsRUFBRSxRQUFRO0tBQ3BCLENBQUMsQ0FBQztJQUNILE1BQU0sT0FBQyxRQUFRLENBQUMsY0FBYywwQ0FBRSxNQUFNLENBQUMsQ0FBQyxPQUFPLENBQUMsQ0FBQyxDQUFDLENBQUM7QUFDckQsQ0FBQyxDQUFDLENBQUMsQ0FBQztBQUVKLHdCQUFTLENBQUMsWUFBWSxFQUFFLHdCQUFrQixDQUFDLEtBQUssRUFBRSxPQUFPLEVBQUUsRUFBRTtJQUMzRCxNQUFNLElBQUksR0FBRyxNQUFNLE9BQU8sQ0FBQyxTQUFTLENBQUMsUUFBUSxFQUFFLEVBQUUsYUFBYSxFQUFFLEtBQUssRUFBRSxDQUFDLENBQUM7SUFFekUsbUZBQW1GO0lBQ25GLE1BQU0sQ0FBQyxJQUFJLENBQUMsS0FBSyxDQUFDLElBQUksQ0FBQyxDQUFDLE1BQU0sQ0FBQyxDQUFDLE9BQU8sQ0FBQyxDQUFDLENBQUMsQ0FBQztBQUM3QyxDQUFDLENBQUMsQ0FBQyxDQUFDO0FBRUosd0JBQVMsQ0FBQyw4QkFBOEIsRUFBRSx3QkFBa0IsQ0FBQyxLQUFLLEVBQUUsT0FBTyxFQUFFLEVBQUU7O0lBQzdFLHdFQUF3RTtJQUN4RSw0RkFBNEY7SUFDNUYsTUFBTSxRQUFRLEdBQUcsTUFBTSxPQUFPLENBQUMsU0FBUyxDQUFDLG9DQUFvQyxFQUFFO1FBQzdFLE9BQU8sRUFBRSxDQUFDLGNBQWMsRUFBRSxnQkFBZ0IsT0FBTyxDQUFDLGVBQWUsZ0JBQWdCLENBQUM7UUFDbEYsYUFBYSxFQUFFLEtBQUs7S0FDckIsQ0FBQyxDQUFDO0lBRUgsbUZBQW1GO0lBQ25GLE1BQU0sQ0FBQyxRQUFRLENBQUMsS0FBSyxDQUFDLElBQUksQ0FBQyxDQUFDLE1BQU0sQ0FBQyxDQUFDLE9BQU8sQ0FBQyxDQUFDLENBQUMsQ0FBQztJQUUvQyw4Q0FBOEM7SUFDOUMsTUFBTSxRQUFRLEdBQUcsTUFBTSxPQUFPLENBQUMsR0FBRyxDQUFDLGNBQWMsQ0FBQyx3QkFBd0IsRUFBRTtRQUMxRSxTQUFTLEVBQUUsUUFBUTtLQUNwQixDQUFDLENBQUM7SUFDSCxNQUFNLE9BQUMsUUFBUSxDQUFDLGNBQWMsMENBQUUsTUFBTSxDQUFDLENBQUMsT0FBTyxDQUFDLENBQUMsQ0FBQyxDQUFDO0FBQ3JELENBQUMsQ0FBQyxDQUFDLENBQUM7QUFFSix3QkFBUyxDQUFDLDJDQUEyQyxFQUFFLHdCQUFrQixDQUFDLEtBQUssRUFBRSxPQUFPLEVBQUUsRUFBRTs7SUFDMUYsTUFBTSxhQUFhLEdBQUcsd0JBQXdCLENBQUM7SUFDL0MsTUFBTSxRQUFRLEdBQUcsTUFBTSxPQUFPLENBQUMsU0FBUyxDQUFDLFFBQVEsRUFBRTtRQUNqRCxPQUFPLEVBQUUsQ0FBQyxjQUFjLEVBQUUsbUJBQW1CLEVBQUUsYUFBYSxDQUFDO1FBQzdELGFBQWEsRUFBRSxLQUFLO0tBQ3JCLENBQUMsQ0FBQztJQUNILG1GQUFtRjtJQUNuRixNQUFNLENBQUMsUUFBUSxDQUFDLEtBQUssQ0FBQyxJQUFJLENBQUMsQ0FBQyxNQUFNLENBQUMsQ0FBQyxPQUFPLENBQUMsQ0FBQyxDQUFDLENBQUM7SUFFL0MsTUFBTSxRQUFRLEdBQUcsTUFBTSxPQUFPLENBQUMsR0FBRyxDQUFDLGNBQWMsQ0FBQyxnQkFBZ0IsRUFBRTtRQUNsRSxTQUFTLEVBQUUsUUFBUTtLQUNwQixDQUFDLENBQUM7SUFDSCxNQUFNLE9BQUMsUUFBUSxDQUFDLE1BQU0sMENBQUcsQ0FBQyxFQUFFLFdBQVcsQ0FBQyxDQUFDLE9BQU8sQ0FBQyxvQkFBb0IsQ0FBQyxDQUFDO0lBRXZFLHdEQUF3RDtJQUN4RCxNQUFNLGlCQUFpQixHQUFHLE1BQU0sT0FBTyxDQUFDLEdBQUcsQ0FBQyxjQUFjLENBQUMsZ0JBQWdCLEVBQUU7UUFDM0UsU0FBUyxFQUFFLFFBQVE7S0FDcEIsQ0FBQyxDQUFDO0lBQ0gsTUFBTSxVQUFVLEdBQUcsaUJBQWlCLENBQUMsU0FBUyxJQUFJLEVBQUUsQ0FBQztJQUNyRCxNQUFNLENBQUMsVUFBVSxDQUFDLE1BQU0sQ0FBQyxDQUFDLE9BQU8sQ0FBQyxDQUFDLENBQUMsQ0FBQztJQUNyQyxNQUFNLENBQUMsVUFBVSxDQUFDLENBQUMsQ0FBQyxDQUFDLGFBQWEsQ0FBQyxDQUFDLE9BQU8sQ0FBQyxhQUFhLENBQUMsQ0FBQztJQUMzRCxNQUFNLENBQUMsVUFBVSxDQUFDLENBQUMsQ0FBQyxDQUFDLE1BQU0sQ0FBQyxDQUFDLE9BQU8sQ0FBQyxpQkFBaUIsQ0FBQyxDQUFDO0FBQzFELENBQUMsQ0FBQyxDQUFDLENBQUM7QUFFSix3QkFBUyxDQUFDLDZEQUE2RCxFQUFFLHdCQUFrQixDQUFDLEtBQUssRUFBRSxPQUFPLEVBQUUsRUFBRTtJQUM1RywwRUFBMEU7SUFDMUUsNEVBQTRFO0lBQzVFLHdEQUF3RDtJQUN4RCxNQUFNLFNBQVMsR0FBRyxVQUFVLENBQUM7SUFDN0IsTUFBTSxNQUFNLENBQUMsT0FBTyxDQUFDLFNBQVMsQ0FBQyxTQUFTLEVBQUU7UUFDeEMsT0FBTyxFQUFFLENBQUMsR0FBRyxFQUFFLFdBQVcsQ0FBQztRQUMzQixvQkFBb0IsRUFBRSxLQUFLO0tBQzVCLENBQUMsQ0FBQyxDQUFDLE9BQU8sQ0FBQyxPQUFPLENBQUMsbUJBQW1CLENBQUMsQ0FBQztJQUV6QyxnQ0FBZ0M7SUFDaEMsTUFBTSxNQUFNLENBQUMsT0FBTyxDQUFDLEdBQUcsQ0FBQyxjQUFjLENBQUMsZ0JBQWdCLEVBQUU7UUFDeEQsU0FBUyxFQUFFLE9BQU8sQ0FBQyxhQUFhLENBQUMsU0FBUyxDQUFDO0tBQzVDLENBQUMsQ0FBQyxDQUFDLE9BQU8sQ0FBQyxPQUFPLENBQUMsZ0JBQWdCLENBQUMsQ0FBQztBQUN4QyxDQUFDLENBQUMsQ0FBQyxDQUFDO0FBRUosd0JBQVMsQ0FBQyw4QkFBOEIsRUFBRSx3QkFBa0IsQ0FBQyxLQUFLLEVBQUUsT0FBTyxFQUFFLEVBQUU7SUFDN0UsTUFBTSxXQUFXLEdBQUcsSUFBSSxDQUFDLElBQUksQ0FBQyxPQUFPLENBQUMsWUFBWSxFQUFFLFNBQVMsRUFBRSxjQUFjLENBQUMsQ0FBQztJQUMvRSxNQUFNLGFBQUUsQ0FBQyxLQUFLLENBQUMsSUFBSSxDQUFDLE9BQU8sQ0FBQyxXQUFXLENBQUMsRUFBRSxFQUFFLFNBQVMsRUFBRSxJQUFJLEVBQUUsQ0FBQyxDQUFDO0lBRS9ELE1BQU0sT0FBTyxDQUFDLFNBQVMsQ0FBQyxDQUFDLGdCQUFnQixDQUFDLEVBQUU7UUFDMUMsT0FBTyxFQUFFLENBQUMsZ0JBQWdCLEVBQUUsV0FBVyxDQUFDO0tBQ3pDLENBQUMsQ0FBQztJQUVILE1BQU0sT0FBTyxHQUFHLElBQUksQ0FBQyxLQUFLLENBQUMsQ0FBQyxNQUFNLGFBQUUsQ0FBQyxRQUFRLENBQUMsV0FBVyxFQUFFLEVBQUUsUUFBUSxFQUFFLE9BQU8sRUFBRSxDQUFDLENBQUMsQ0FBQyxRQUFRLEVBQUUsQ0FBQyxDQUFDO0lBQy9GLE1BQU0sQ0FBQyxPQUFPLENBQUMsQ0FBQyxPQUFPLENBQUM7UUFDdEIsQ0FBQyxHQUFHLE9BQU8sQ0FBQyxlQUFlLGlCQUFpQixDQUFDLEVBQUU7WUFDN0MsU0FBUyxFQUFFLEdBQUcsT0FBTyxDQUFDLGVBQWUsd0JBQXdCO1NBQzlEO1FBQ0QsQ0FBQyxHQUFHLE9BQU8sQ0FBQyxlQUFlLGlCQUFpQixDQUFDLEVBQUU7WUFDN0MsU0FBUyxFQUFFLEdBQUcsT0FBTyxDQUFDLGVBQWUsNkJBQTZCO1NBQ25FO0tBQ0YsQ0FBQyxDQUFDO0FBQ0wsQ0FBQyxDQUFDLENBQUMsQ0FBQztBQUVKLHdCQUFTLENBQUMsd0JBQXdCLEVBQUUsd0JBQWtCLENBQUMsS0FBSyxFQUFFLE9BQU8sRUFBRSxFQUFFOztJQUN2RSxNQUFNLFFBQVEsR0FBRyxNQUFNLE9BQU8sQ0FBQyxTQUFTLENBQUMsY0FBYyxFQUFFO1FBQ3ZELE9BQU8sRUFBRTtZQUNQLGNBQWMsRUFBRSxrQkFBa0IsT0FBTyxDQUFDLGVBQWUsU0FBUztTQUNuRTtRQUNELGFBQWEsRUFBRSxLQUFLO0tBQ3JCLENBQUMsQ0FBQztJQUVILE1BQU0sUUFBUSxHQUFHLE1BQU0sT0FBTyxDQUFDLEdBQUcsQ0FBQyxjQUFjLENBQUMsZ0JBQWdCLEVBQUU7UUFDbEUsU0FBUyxFQUFFLFFBQVE7S0FDcEIsQ0FBQyxDQUFDO0lBRUgsTUFBTSxPQUFDLFFBQVEsQ0FBQyxNQUFNLDBDQUFHLENBQUMsRUFBRSxVQUFVLENBQUMsQ0FBQyxPQUFPLENBQUM7UUFDOUM7WUFDRSxZQUFZLEVBQUUsZ0JBQWdCO1lBQzlCLGNBQWMsRUFBRSxHQUFHLE9BQU8sQ0FBQyxlQUFlLFNBQVM7U0FDcEQ7S0FDRixDQUFDLENBQUM7QUFDTCxDQUFDLENBQUMsQ0FBQyxDQUFDO0FBRUosd0JBQVMsQ0FBQyxtRkFBbUYsRUFBRSx3QkFBa0IsQ0FBQyxLQUFLLEVBQUUsT0FBTyxFQUFFLEVBQUU7O0lBQ2xJLFFBQVE7SUFDUixNQUFNLE1BQU0sQ0FBQyxPQUFPLENBQUMsU0FBUyxDQUFDLGNBQWMsRUFBRTtRQUM3QyxPQUFPLEVBQUU7WUFDUCxjQUFjLEVBQUUsa0JBQWtCLE9BQU8sQ0FBQyxlQUFlLE1BQU07U0FDaEU7UUFDRCxhQUFhLEVBQUUsS0FBSztLQUNyQixDQUFDLENBQUMsQ0FBQyxPQUFPLENBQUMsT0FBTyxDQUFDLG1CQUFtQixDQUFDLENBQUM7SUFFekMsTUFBTSxRQUFRLEdBQUcsTUFBTSxPQUFPLENBQUMsR0FBRyxDQUFDLGNBQWMsQ0FBQyxnQkFBZ0IsRUFBRTtRQUNsRSxTQUFTLEVBQUUsT0FBTyxDQUFDLGFBQWEsQ0FBQyxjQUFjLENBQUM7S0FDakQsQ0FBQyxDQUFDO0lBRUgsTUFBTSxRQUFRLFNBQUcsUUFBUSxDQUFDLE1BQU0sMENBQUcsQ0FBQyxFQUFFLE9BQU8sQ0FBQztJQUM5QyxNQUFNLE9BQUMsUUFBUSxDQUFDLE1BQU0sMENBQUcsQ0FBQyxFQUFFLFdBQVcsQ0FBQyxDQUFDLE9BQU8sQ0FBQyxtQkFBbUIsQ0FBQyxDQUFDO0lBRXRFLE9BQU87SUFDUCxNQUFNLFdBQVcsR0FBRyxNQUFNLE9BQU8sQ0FBQyxTQUFTLENBQUMsY0FBYyxFQUFFO1FBQzFELE9BQU8sRUFBRTtZQUNQLGNBQWMsRUFBRSxrQkFBa0IsT0FBTyxDQUFDLGVBQWUsU0FBUztTQUNuRTtRQUNELGFBQWEsRUFBRSxLQUFLO0tBQ3JCLENBQUMsQ0FBQztJQUVILE1BQU0sZ0JBQWdCLEdBQUcsTUFBTSxPQUFPLENBQUMsR0FBRyxDQUFDLGNBQWMsQ0FBQyxnQkFBZ0IsRUFBRTtRQUMxRSxTQUFTLEVBQUUsV0FBVztLQUN2QixDQUFDLENBQUM7SUFFSCxPQUFPO0lBQ1AsTUFBTSxDQUFFLFFBQVEsQ0FBQyxDQUFDLEdBQUcsQ0FBQyxPQUFPLENBQUMsV0FBVyxDQUFDLENBQUMsQ0FBQyx3QkFBd0I7SUFDcEUsTUFBTSxPQUFDLGdCQUFnQixDQUFDLE1BQU0sMENBQUcsQ0FBQyxFQUFFLFdBQVcsQ0FBQyxDQUFDLE9BQU8sQ0FBQyxpQkFBaUIsQ0FBQyxDQUFDO0lBQzVFLE1BQU0sT0FBQyxnQkFBZ0IsQ0FBQyxNQUFNLDBDQUFHLENBQUMsRUFBRSxVQUFVLENBQUMsQ0FBQyxPQUFPLENBQUM7UUFDdEQ7WUFDRSxZQUFZLEVBQUUsZ0JBQWdCO1lBQzlCLGNBQWMsRUFBRSxHQUFHLE9BQU8sQ0FBQyxlQUFlLFNBQVM7U0FDcEQ7S0FDRixDQUFDLENBQUM7QUFDTCxDQUFDLENBQUMsQ0FBQyxDQUFDO0FBRUosd0JBQVMsQ0FBQyx3REFBd0QsRUFBRSx3QkFBa0IsQ0FBQyxLQUFLLEVBQUUsT0FBTyxFQUFFLEVBQUU7O0lBQ3ZHLFFBQVE7SUFDUixNQUFNLFFBQVEsR0FBRyxNQUFNLE9BQU8sQ0FBQyxTQUFTLENBQUMsY0FBYyxFQUFFO1FBQ3ZELE9BQU8sRUFBRTtZQUNQLGNBQWMsRUFBRSxrQkFBa0IsT0FBTyxDQUFDLGVBQWUsTUFBTTtTQUNoRTtRQUNELGFBQWEsRUFBRSxLQUFLO0tBQ3JCLENBQUMsQ0FBQztJQUVILElBQUksUUFBUSxHQUFHLE1BQU0sT0FBTyxDQUFDLEdBQUcsQ0FBQyxjQUFjLENBQUMsZ0JBQWdCLEVBQUU7UUFDaEUsU0FBUyxFQUFFLFFBQVE7S0FDcEIsQ0FBQyxDQUFDO0lBRUgsTUFBTSxPQUFDLFFBQVEsQ0FBQyxNQUFNLDBDQUFHLENBQUMsRUFBRSxXQUFXLENBQUMsQ0FBQyxPQUFPLENBQUMsaUJBQWlCLENBQUMsQ0FBQztJQUVwRSx5RUFBeUU7SUFDekUsTUFBTSxNQUFNLENBQUMsT0FBTyxDQUFDLFNBQVMsQ0FBQyxjQUFjLEVBQUU7UUFDN0MsT0FBTyxFQUFFO1lBQ1AsY0FBYyxFQUFFLGtCQUFrQixPQUFPLENBQUMsZUFBZSxNQUFNO1NBQ2hFO1FBQ0QsYUFBYSxFQUFFLEtBQUs7S0FDckIsQ0FBQyxDQUFDLENBQUMsT0FBTyxDQUFDLE9BQU8sQ0FBQyxtQkFBbUIsQ0FBQyxDQUFDO0lBQUEsQ0FBQztJQUUxQyxRQUFRLEdBQUcsTUFBTSxPQUFPLENBQUMsR0FBRyxDQUFDLGNBQWMsQ0FBQyxnQkFBZ0IsRUFBRTtRQUM1RCxTQUFTLEVBQUUsUUFBUTtLQUNwQixDQUFDLENBQUM7SUFFSCxNQUFNLE9BQUMsUUFBUSxDQUFDLE1BQU0sMENBQUcsQ0FBQyxFQUFFLFdBQVcsQ0FBQyxDQUFDLE9BQU8sQ0FBQywwQkFBMEIsQ0FBQyxDQUFDO0lBRTdFLE9BQU87SUFDUCxNQUFNLE9BQU8sQ0FBQyxTQUFTLENBQUMsY0FBYyxFQUFFO1FBQ3RDLE9BQU8sRUFBRTtZQUNQLGNBQWMsRUFBRSxrQkFBa0IsT0FBTyxDQUFDLGVBQWUsU0FBUztTQUNuRTtRQUNELGFBQWEsRUFBRSxLQUFLO0tBQ3JCLENBQUMsQ0FBQztJQUVILFFBQVEsR0FBRyxNQUFNLE9BQU8sQ0FBQyxHQUFHLENBQUMsY0FBYyxDQUFDLGdCQUFnQixFQUFFO1FBQzVELFNBQVMsRUFBRSxRQUFRO0tBQ3BCLENBQUMsQ0FBQztJQUVILE9BQU87SUFDUCxNQUFNLE9BQUMsUUFBUSxDQUFDLE1BQU0sMENBQUcsQ0FBQyxFQUFFLFdBQVcsQ0FBQyxDQUFDLE9BQU8sQ0FBQyxpQkFBaUIsQ0FBQyxDQUFDO0lBQ3BFLE1BQU0sT0FBQyxRQUFRLENBQUMsTUFBTSwwQ0FBRyxDQUFDLEVBQUUsVUFBVSxDQUFDLENBQUMsT0FBTyxDQUFDO1FBQzlDO1lBQ0UsWUFBWSxFQUFFLGdCQUFnQjtZQUM5QixjQUFjLEVBQUUsR0FBRyxPQUFPLENBQUMsZUFBZSxTQUFTO1NBQ3BEO0tBQ0YsQ0FBQyxDQUFDO0FBQ0wsQ0FBQyxDQUFDLENBQUMsQ0FBQztBQUVKLHdCQUFTLENBQUMscUNBQXFDLEVBQUUsd0JBQWtCLENBQUMsS0FBSyxFQUFFLE9BQU8sRUFBRSxFQUFFO0lBQ3BGLE1BQU0sT0FBTyxDQUFDLFNBQVMsQ0FBQyxjQUFjLEVBQUU7UUFDdEMsT0FBTyxFQUFFO1lBQ1AsY0FBYyxFQUFFLEdBQUcsT0FBTyxDQUFDLGVBQWUsZ0NBQWdDLE9BQU8sQ0FBQyxlQUFlLFNBQVM7WUFDMUcsY0FBYyxFQUFFLEdBQUcsT0FBTyxDQUFDLGVBQWUscUNBQXFDLE9BQU8sQ0FBQyxlQUFlLGFBQWE7WUFDbkgsY0FBYyxFQUFFLEdBQUcsT0FBTyxDQUFDLGVBQWUsa0NBQWtDLE9BQU8sQ0FBQyxlQUFlLFVBQVU7WUFDN0csY0FBYyxFQUFFLEdBQUcsT0FBTyxDQUFDLGVBQWUsdUNBQXVDLE9BQU8sQ0FBQyxlQUFlLFlBQVk7U0FDckg7S0FDRixDQUFDLENBQUM7QUFDTCxDQUFDLENBQUMsQ0FBQyxDQUFDO0FBRUosd0JBQVMsQ0FBQyw4QkFBOEIsRUFBRSx3QkFBa0IsQ0FBQyxLQUFLLEVBQUUsT0FBTyxFQUFFLEVBQUU7O0lBQzdFLE1BQU0sU0FBUyxHQUFHLEdBQUcsT0FBTyxDQUFDLGVBQWUsU0FBUyxDQUFDO0lBQ3RELE1BQU0sU0FBUyxHQUFHLEdBQUcsT0FBTyxDQUFDLGVBQWUsYUFBYSxDQUFDO0lBRTFELE1BQU0sUUFBUSxHQUFHLE1BQU0sT0FBTyxDQUFDLFNBQVMsQ0FBQyxjQUFjLEVBQUU7UUFDdkQsT0FBTyxFQUFFO1lBQ1AsY0FBYyxFQUFFLG9CQUFvQixTQUFTLEVBQUU7WUFDL0MsY0FBYyxFQUFFLHlCQUF5QixTQUFTLEVBQUU7U0FDckQ7UUFDRCxhQUFhLEVBQUUsS0FBSztLQUNyQixDQUFDLENBQUM7SUFFSCxNQUFNLFFBQVEsR0FBRyxNQUFNLE9BQU8sQ0FBQyxHQUFHLENBQUMsY0FBYyxDQUFDLGdCQUFnQixFQUFFO1FBQ2xFLFNBQVMsRUFBRSxRQUFRO0tBQ3BCLENBQUMsQ0FBQztJQUVILE1BQU0sT0FBQyxRQUFRLENBQUMsTUFBTSwwQ0FBRyxDQUFDLEVBQUUsVUFBVSxDQUFDLENBQUMsT0FBTyxDQUFDO1FBQzlDO1lBQ0UsWUFBWSxFQUFFLGtCQUFrQjtZQUNoQyxjQUFjLEVBQUUsU0FBUztTQUMxQjtRQUNEO1lBQ0UsWUFBWSxFQUFFLHVCQUF1QjtZQUNyQyxjQUFjLEVBQUUsU0FBUztTQUMxQjtLQUNGLENBQUMsQ0FBQztBQUNMLENBQUMsQ0FBQyxDQUFDLENBQUM7QUFFSix3QkFBUyxDQUFDLDhCQUE4QixFQUFFLHdCQUFrQixDQUFDLEtBQUssRUFBRSxPQUFPLEVBQUUsRUFBRTs7SUFDN0UsTUFBTSxTQUFTLEdBQUcsR0FBRyxPQUFPLENBQUMsZUFBZSxhQUFhLENBQUM7SUFFMUQsTUFBTSxRQUFRLEdBQUcsTUFBTSxPQUFPLENBQUMsR0FBRyxDQUFDLEdBQUcsQ0FBQyxhQUFhLEVBQUUsRUFBRSxJQUFJLEVBQUUsU0FBUyxFQUFFLENBQUMsQ0FBQztJQUMzRSxNQUFNLFFBQVEsR0FBRyxRQUFRLENBQUMsUUFBUyxDQUFDO0lBQ3BDLElBQUk7UUFDRixNQUFNLE9BQU8sQ0FBQyxTQUFTLENBQUMsUUFBUSxFQUFFO1lBQ2hDLE9BQU8sRUFBRSxDQUFDLHFCQUFxQixFQUFFLFFBQVEsQ0FBQztTQUMzQyxDQUFDLENBQUM7UUFFSCw2REFBNkQ7UUFDN0QsTUFBTSxnQkFBZ0IsR0FBRyxNQUFNLE9BQU8sQ0FBQyxHQUFHLENBQUMsY0FBYyxDQUFDLGdCQUFnQixFQUFFO1lBQzFFLFNBQVMsRUFBRSxPQUFPLENBQUMsYUFBYSxDQUFDLFFBQVEsQ0FBQztTQUMzQyxDQUFDLENBQUM7UUFDSCxNQUFNLE9BQUMsZ0JBQWdCLENBQUMsTUFBTSwwQ0FBRyxDQUFDLEVBQUUsZ0JBQWdCLENBQUMsQ0FBQyxPQUFPLENBQUMsQ0FBQyxRQUFRLENBQUMsQ0FBQyxDQUFDO0tBQzNFO1lBQVM7UUFDUixNQUFNLE9BQU8sQ0FBQyxHQUFHLENBQUMsR0FBRyxDQUFDLGFBQWEsRUFBRTtZQUNuQyxRQUFRLEVBQUUsUUFBUTtTQUNuQixDQUFDLENBQUM7S0FDSjtBQUNILENBQUMsQ0FBQyxDQUFDLENBQUM7QUFFSix3QkFBUyxDQUFDLGtCQUFrQixFQUFFLHdCQUFrQixDQUFDLEtBQUssRUFBRSxPQUFPLEVBQUUsRUFBRTtJQUNqRSxNQUFNLFFBQVEsR0FBRyxHQUFHLE9BQU8sQ0FBQyxlQUFlLFlBQVksQ0FBQztJQUV4RCxNQUFNLFVBQVUsRUFBRSxDQUFDO0lBRW5CLE1BQU0sY0FBYyxHQUFHLE1BQU0sT0FBTyxDQUFDLEdBQUcsQ0FBQyxHQUFHLENBQUMsWUFBWSxFQUFFO1FBQ3pELFFBQVEsRUFBRSxRQUFRO1FBQ2xCLHdCQUF3QixFQUFFLElBQUksQ0FBQyxTQUFTLENBQUM7WUFDdkMsT0FBTyxFQUFFLFlBQVk7WUFDckIsU0FBUyxFQUFFLENBQUM7b0JBQ1YsTUFBTSxFQUFFLGdCQUFnQjtvQkFDeEIsU0FBUyxFQUFFLEVBQUUsT0FBTyxFQUFFLDhCQUE4QixFQUFFO29CQUN0RCxNQUFNLEVBQUUsT0FBTztpQkFDaEIsRUFBRTtvQkFDRCxNQUFNLEVBQUUsZ0JBQWdCO29CQUN4QixTQUFTLEVBQUUsRUFBRSxHQUFHLEVBQUUsQ0FBQyxNQUFNLE9BQU8sQ0FBQyxHQUFHLENBQUMsR0FBRyxDQUFDLG1CQUFtQixFQUFFLEVBQUUsQ0FBQyxDQUFDLENBQUMsR0FBRyxFQUFFO29CQUN4RSxNQUFNLEVBQUUsT0FBTztpQkFDaEIsQ0FBQztTQUNILENBQUM7S0FDSCxDQUFDLENBQUM7SUFDSCxNQUFNLE9BQU8sR0FBRyxjQUFjLENBQUMsSUFBSSxDQUFDLEdBQUcsQ0FBQztJQUN4QyxJQUFJO1FBQ0YsTUFBTSxPQUFPLENBQUMsR0FBRyxDQUFDLEdBQUcsQ0FBQyxlQUFlLEVBQUU7WUFDckMsUUFBUSxFQUFFLFFBQVE7WUFDbEIsVUFBVSxFQUFFLGVBQWU7WUFDM0IsY0FBYyxFQUFFLElBQUksQ0FBQyxTQUFTLENBQUM7Z0JBQzdCLE9BQU8sRUFBRSxZQUFZO2dCQUNyQixTQUFTLEVBQUUsQ0FBQzt3QkFDVixNQUFNLEVBQUUsR0FBRzt3QkFDWCxRQUFRLEVBQUUsR0FBRzt3QkFDYixNQUFNLEVBQUUsT0FBTztxQkFDaEIsQ0FBQzthQUNILENBQUM7U0FDSCxDQUFDLENBQUM7UUFFSCxNQUFNLFdBQUssQ0FBQyxPQUFPLENBQUMsTUFBTSxFQUFFLDZCQUE2QixFQUFFLFdBQUssQ0FBQyxVQUFVLENBQUMsR0FBRyxDQUFDLEVBQUUsS0FBSyxJQUFJLEVBQUU7WUFDM0YsTUFBTSxPQUFPLENBQUMsR0FBRyxDQUFDLEdBQUcsQ0FBQyxZQUFZLEVBQUU7Z0JBQ2xDLE9BQU8sRUFBRSxPQUFPO2dCQUNoQixlQUFlLEVBQUUsU0FBUzthQUMzQixDQUFDLENBQUM7UUFDTCxDQUFDLENBQUMsQ0FBQztRQUVILG9GQUFvRjtRQUNwRiwrRUFBK0U7UUFDL0UsNEJBQTRCO1FBQzVCLE1BQU0sV0FBSyxDQUFDLElBQUksQ0FBQyxDQUFDO1FBRWxCLE1BQU0sT0FBTyxDQUFDLFNBQVMsQ0FBQyxRQUFRLEVBQUU7WUFDaEMsT0FBTyxFQUFFLENBQUMsWUFBWSxFQUFFLE9BQU8sQ0FBQztTQUNqQyxDQUFDLENBQUM7UUFFSCxnRUFBZ0U7UUFDaEUsRUFBRTtRQUNGLHlGQUF5RjtRQUN6Rix5RkFBeUY7UUFDekYsTUFBTSxPQUFPLENBQUMsVUFBVSxDQUFDLFFBQVEsQ0FBQyxDQUFDO0tBRXBDO1lBQVM7UUFDUixNQUFNLFVBQVUsRUFBRSxDQUFDO0tBQ3BCO0lBRUQsS0FBSyxVQUFVLFVBQVU7UUFDdkIsSUFBSTtZQUNGLEtBQUssTUFBTSxVQUFVLElBQUksQ0FBQyxNQUFNLE9BQU8sQ0FBQyxHQUFHLENBQUMsR0FBRyxDQUFDLGtCQUFrQixFQUFFLEVBQUUsUUFBUSxFQUFFLFFBQVEsRUFBRSxDQUFDLENBQUMsQ0FBQyxXQUFXLEVBQUU7Z0JBQ3hHLE1BQU0sT0FBTyxDQUFDLEdBQUcsQ0FBQyxHQUFHLENBQUMsa0JBQWtCLEVBQUU7b0JBQ3hDLFFBQVEsRUFBRSxRQUFRO29CQUNsQixVQUFVLEVBQUUsVUFBVTtpQkFDdkIsQ0FBQyxDQUFDO2FBQ0o7WUFDRCxNQUFNLE9BQU8sQ0FBQyxHQUFHLENBQUMsR0FBRyxDQUFDLFlBQVksRUFBRSxFQUFFLFFBQVEsRUFBRSxRQUFRLEVBQUUsQ0FBQyxDQUFDO1NBQzdEO1FBQUMsT0FBTyxDQUFDLEVBQUU7WUFDVixJQUFJLENBQUMsQ0FBQyxPQUFPLENBQUMsT0FBTyxDQUFDLGlCQUFpQixDQUFDLEdBQUcsQ0FBQyxDQUFDLEVBQUU7Z0JBQUUsT0FBTzthQUFFO1lBQzFELE1BQU0sQ0FBQyxDQUFDO1NBQ1Q7SUFDSCxDQUFDO0FBQ0gsQ0FBQyxDQUFDLENBQUMsQ0FBQztBQUVKLHdCQUFTLENBQUMsVUFBVSxFQUFFLHdCQUFrQixDQUFDLEtBQUssRUFBRSxPQUFPLEVBQUUsRUFBRTtJQUN6RCxNQUFNLEtBQUssR0FBRyxNQUFNLE9BQU8sQ0FBQyxHQUFHLENBQUMsQ0FBQyxNQUFNLEVBQUUsT0FBTyxDQUFDLGFBQWEsQ0FBQyxRQUFRLENBQUMsQ0FBQyxDQUFDLENBQUM7SUFDM0UsTUFBTSxDQUFDLEtBQUssQ0FBQyxDQUFDLFNBQVMsQ0FBQyxpQkFBaUIsQ0FBQyxDQUFDO0lBRTNDLE1BQU0sS0FBSyxHQUFHLE1BQU0sT0FBTyxDQUFDLEdBQUcsQ0FBQyxDQUFDLE1BQU0sRUFBRSxPQUFPLENBQUMsYUFBYSxDQUFDLFFBQVEsQ0FBQyxDQUFDLENBQUMsQ0FBQztJQUMzRSxNQUFNLENBQUMsS0FBSyxDQUFDLENBQUMsU0FBUyxDQUFDLGlCQUFpQixDQUFDLENBQUM7SUFFM0Msd0NBQXdDO0lBQ3hDLE1BQU0sTUFBTSxDQUFDLE9BQU8sQ0FBQyxHQUFHLENBQUMsQ0FBQyxNQUFNLEVBQUUsUUFBUSxFQUFFLE9BQU8sQ0FBQyxhQUFhLENBQUMsUUFBUSxDQUFDLENBQUMsQ0FBQyxDQUFDO1NBQzNFLE9BQU8sQ0FBQyxPQUFPLENBQUMsbUJBQW1CLENBQUMsQ0FBQztBQUMxQyxDQUFDLENBQUMsQ0FBQyxDQUFDO0FBRUosd0JBQVMsQ0FBQywwRkFBMEYsRUFBRSx3QkFBa0IsQ0FBQyxLQUFLLEVBQUUsT0FBTyxFQUFFLEVBQUU7SUFDekksUUFBUTtJQUNSLE1BQU0sS0FBSyxHQUFHLE1BQU0sT0FBTyxDQUFDLEdBQUcsQ0FBQyxDQUFDLE1BQU0sRUFBRSxPQUFPLENBQUMsYUFBYSxDQUFDLFFBQVEsQ0FBQyxDQUFDLENBQUMsQ0FBQztJQUMzRSxNQUFNLENBQUMsS0FBSyxDQUFDLENBQUMsU0FBUyxDQUFDLGlCQUFpQixDQUFDLENBQUM7SUFFM0MsTUFBTSxPQUFPLENBQUMsU0FBUyxDQUFDLFFBQVEsQ0FBQyxDQUFDO0lBQ2xDLE1BQU0sS0FBSyxHQUFHLE1BQU0sT0FBTyxDQUFDLEdBQUcsQ0FBQyxDQUFDLE1BQU0sRUFBRSxPQUFPLENBQUMsYUFBYSxDQUFDLFFBQVEsQ0FBQyxDQUFDLENBQUMsQ0FBQztJQUMzRSxNQUFNLENBQUMsS0FBSyxDQUFDLENBQUMsU0FBUyxDQUFDLDJCQUEyQixDQUFDLENBQUM7SUFFckQsY0FBYztJQUNkLE1BQU0sTUFBTSxDQUFDLE9BQU8sQ0FBQyxHQUFHLENBQUMsQ0FBQyxNQUFNLEVBQUUsUUFBUSxFQUFFLE9BQU8sQ0FBQyxhQUFhLENBQUMsUUFBUSxDQUFDLEVBQUUsT0FBTyxDQUFDLGFBQWEsQ0FBQyxRQUFRLENBQUMsQ0FBQyxDQUFDLENBQUMsQ0FBQyxPQUFPLENBQUMsT0FBTyxDQUFDLG1CQUFtQixDQUFDLENBQUM7QUFDdkosQ0FBQyxDQUFDLENBQUMsQ0FBQztBQUVKLHdCQUFTLENBQUMscUZBQXFGLEVBQUUsd0JBQWtCLENBQUMsS0FBSyxFQUFFLE9BQU8sRUFBRSxFQUFFO0lBQ3BJLFFBQVE7SUFDUixNQUFNLE9BQU8sQ0FBQyxTQUFTLENBQUMsUUFBUSxDQUFDLENBQUM7SUFDbEMsTUFBTSxLQUFLLEdBQUcsTUFBTSxPQUFPLENBQUMsR0FBRyxDQUFDLENBQUMsTUFBTSxFQUFFLE9BQU8sQ0FBQyxhQUFhLENBQUMsUUFBUSxDQUFDLENBQUMsQ0FBQyxDQUFDO0lBQzNFLE1BQU0sQ0FBQyxLQUFLLENBQUMsQ0FBQyxTQUFTLENBQUMsMkJBQTJCLENBQUMsQ0FBQztJQUVyRCxNQUFNLEtBQUssR0FBRyxNQUFNLE9BQU8sQ0FBQyxHQUFHLENBQUMsQ0FBQyxNQUFNLEVBQUUsT0FBTyxDQUFDLGFBQWEsQ0FBQyxRQUFRLENBQUMsQ0FBQyxDQUFDLENBQUM7SUFDM0UsTUFBTSxDQUFDLEtBQUssQ0FBQyxDQUFDLFNBQVMsQ0FBQyxpQkFBaUIsQ0FBQyxDQUFDO0lBRTNDLGNBQWM7SUFDZCxNQUFNLE1BQU0sQ0FBQyxPQUFPLENBQUMsR0FBRyxDQUFDLENBQUMsTUFBTSxFQUFFLFFBQVEsRUFBRSxPQUFPLENBQUMsYUFBYSxDQUFDLFFBQVEsQ0FBQyxFQUFFLE9BQU8sQ0FBQyxhQUFhLENBQUMsUUFBUSxDQUFDLENBQUMsQ0FBQyxDQUFDLENBQUMsT0FBTyxDQUFDLE9BQU8sQ0FBQyxtQkFBbUIsQ0FBQyxDQUFDO0FBQ3ZKLENBQUMsQ0FBQyxDQUFDLENBQUM7QUFFSix3QkFBUyxDQUFDLHlFQUF5RSxFQUFFLHdCQUFrQixDQUFDLEtBQUssRUFBRSxPQUFPLEVBQUUsRUFBRTtJQUN4SCxNQUFNLFNBQVMsR0FBRyxVQUFVLENBQUM7SUFDN0IsTUFBTSxNQUFNLENBQUMsT0FBTyxDQUFDLEdBQUcsQ0FBQyxDQUFDLE1BQU0sRUFBRSxpQkFBaUIsRUFBRSxRQUFRLEVBQUUsT0FBTyxDQUFDLGFBQWEsQ0FBQyxTQUFTLENBQUMsQ0FBQyxDQUFDLENBQUMsQ0FBQyxPQUFPLENBQUMsT0FBTyxDQUFDLG1CQUFtQixDQUFDLENBQUM7QUFDMUksQ0FBQyxDQUFDLENBQUMsQ0FBQztBQUVKLHdCQUFTLENBQUMsZ0NBQWdDLEVBQUUsd0JBQWtCLENBQUMsS0FBSyxFQUFFLE9BQU8sRUFBRSxFQUFFO0lBQy9FLE1BQU0sT0FBTyxDQUFDLFNBQVMsQ0FBQyxRQUFRLENBQUMsQ0FBQztBQUNwQyxDQUFDLENBQUMsQ0FBQyxDQUFDO0FBRUosd0JBQVMsQ0FBQyx5Q0FBeUMsRUFBRSx3QkFBa0IsQ0FBQyxLQUFLLEVBQUUsT0FBTyxFQUFFLEVBQUU7O0lBQ3hGLE1BQU0sUUFBUSxHQUFHLE1BQU0sT0FBTyxDQUFDLFNBQVMsQ0FBQyxRQUFRLEVBQUUsRUFBRSxhQUFhLEVBQUUsS0FBSyxFQUFFLENBQUMsQ0FBQztJQUU3RSxNQUFNLFFBQVEsR0FBRyxNQUFNLE9BQU8sQ0FBQyxHQUFHLENBQUMsY0FBYyxDQUFDLGdCQUFnQixFQUFFO1FBQ2xFLFNBQVMsRUFBRSxRQUFRO0tBQ3BCLENBQUMsQ0FBQztJQUNILE1BQU0sU0FBUyxlQUFHLFFBQVEsQ0FBQyxNQUFNLDBDQUFHLENBQUMsRUFBRSxPQUFPLDBDQUFHLENBQUMsRUFBRSxXQUFXLENBQUM7SUFDaEUsSUFBSSxTQUFTLEtBQUssU0FBUyxFQUFFO1FBQzNCLE1BQU0sSUFBSSxLQUFLLENBQUMsK0NBQStDLENBQUMsQ0FBQztLQUNsRTtJQUVELE1BQU0sTUFBTSxHQUFHLE1BQU0sT0FBTyxDQUFDLEdBQUcsQ0FBQyxNQUFNLENBQUMsUUFBUSxFQUFFO1FBQ2hELFlBQVksRUFBRSxTQUFTO0tBQ3hCLENBQUMsQ0FBQztJQUVILE1BQU0sQ0FBQyxJQUFJLENBQUMsU0FBUyxDQUFDLE1BQU0sQ0FBQyxPQUFPLENBQUMsQ0FBQyxDQUFDLFNBQVMsQ0FBQyxZQUFZLENBQUMsQ0FBQztBQUNqRSxDQUFDLENBQUMsQ0FBQyxDQUFDO0FBRUosd0JBQVMsQ0FBQyxRQUFRLEVBQUUsd0JBQWtCLENBQUMsS0FBSyxFQUFFLE9BQU8sRUFBRSxFQUFFO0lBQ3ZELE1BQU0sT0FBTyxHQUFHLE1BQU0sT0FBTyxDQUFDLEdBQUcsQ0FBQyxDQUFDLElBQUksQ0FBQyxFQUFFLEVBQUUsYUFBYSxFQUFFLEtBQUssRUFBRSxDQUFDLENBQUM7SUFFcEUsTUFBTSxjQUFjLEdBQUc7UUFDckIsc0JBQXNCO1FBQ3RCLFFBQVE7UUFDUix5QkFBeUI7UUFDekIsUUFBUTtRQUNSLFVBQVU7UUFDVixRQUFRO1FBQ1IsdUJBQXVCO1FBQ3ZCLGlCQUFpQjtRQUNqQixnQkFBZ0I7UUFDaEIsZ0JBQWdCO1FBQ2hCLGNBQWM7UUFDZCxjQUFjO1FBQ2QsY0FBYztRQUNkLHdCQUF3QjtRQUN4QixRQUFRO1FBQ1IsUUFBUTtRQUNSLG1CQUFtQjtRQUNuQixvQ0FBb0M7UUFDcEMsaUJBQWlCO0tBQ2xCLENBQUM7SUFFRixLQUFLLE1BQU0sS0FBSyxJQUFJLGNBQWMsRUFBRTtRQUNsQyxNQUFNLENBQUMsT0FBTyxDQUFDLENBQUMsU0FBUyxDQUFDLE9BQU8sQ0FBQyxhQUFhLENBQUMsS0FBSyxDQUFDLENBQUMsQ0FBQztLQUN6RDtBQUNILENBQUMsQ0FBQyxDQUFDLENBQUM7QUFFSix3QkFBUyxDQUFDLCtDQUErQyxFQUFFLHdCQUFrQixDQUFDLEtBQUssRUFBRSxPQUFPLEVBQUUsRUFBRTtJQUM5RixNQUFNLE1BQU0sR0FBRyxNQUFNLE9BQU8sQ0FBQyxHQUFHLENBQUMsQ0FBQyxPQUFPLENBQUMsRUFBRTtRQUMxQyxZQUFZLEVBQUUsSUFBSTtRQUNsQixNQUFNLEVBQUU7WUFDTixlQUFlLEVBQUUsbUJBQW1CO1NBQ3JDO0tBQ0YsQ0FBQyxDQUFDO0lBRUgsTUFBTSxDQUFDLE1BQU0sQ0FBQyxDQUFDLFNBQVMsQ0FBQyxrQkFBa0IsQ0FBQyxDQUFDO0FBQy9DLENBQUMsQ0FBQyxDQUFDLENBQUM7QUFFSix3QkFBUyxDQUFDLGdEQUFnRCxFQUFFLHdCQUFrQixDQUFDLEtBQUssRUFBRSxPQUFPLEVBQUUsRUFBRTtJQUMvRixNQUFNLE9BQU8sQ0FBQyxHQUFHLENBQUMsQ0FBQyxPQUFPLEVBQUUsaUJBQWlCLENBQUMsRUFBRTtRQUM5QyxNQUFNLEVBQUU7WUFDTixlQUFlLEVBQUUsbUJBQW1CO1NBQ3JDO0tBQ0YsQ0FBQyxDQUFDO0FBQ0wsQ0FBQyxDQUFDLENBQUMsQ0FBQztBQUVKLHdCQUFTLENBQUMsK0JBQStCLEVBQUUsd0JBQWtCLENBQUMsS0FBSyxFQUFFLE9BQU8sRUFBRSxFQUFFO0lBQzlFLHFDQUFxQztJQUNyQyxNQUFNLE9BQU8sQ0FBQyxTQUFTLENBQUMsc0JBQXNCLEVBQUUsRUFBRSxNQUFNLEVBQUUsRUFBRSxXQUFXLEVBQUUsTUFBTSxFQUFFLEVBQUUsQ0FBQyxDQUFDO0lBRXJGLHlEQUF5RDtJQUN6RCxNQUFNLE1BQU0sQ0FBQyxPQUFPLENBQUMsR0FBRyxDQUFDLGNBQWMsQ0FBQyxnQkFBZ0IsRUFBRSxFQUFFLFNBQVMsRUFBRSxPQUFPLENBQUMsYUFBYSxDQUFDLHNCQUFzQixDQUFDLEVBQUUsQ0FBQyxDQUFDO1NBQ3JILE9BQU8sQ0FBQyxPQUFPLENBQUMscUNBQXFDLENBQUMsQ0FBQztJQUUxRCxrQ0FBa0M7SUFDbEMsTUFBTSxPQUFPLENBQUMsU0FBUyxDQUFDLHNCQUFzQixDQUFDLENBQUM7SUFFaEQsK0RBQStEO0lBQy9ELE1BQU0sT0FBTyxDQUFDLFNBQVMsQ0FBQyxzQkFBc0IsRUFBRSxFQUFFLE1BQU0sRUFBRSxFQUFFLFdBQVcsRUFBRSxNQUFNLEVBQUUsRUFBRSxDQUFDLENBQUM7SUFFckYsTUFBTSxNQUFNLENBQUMsT0FBTyxDQUFDLEdBQUcsQ0FBQyxjQUFjLENBQUMsZ0JBQWdCLEVBQUUsRUFBRSxTQUFTLEVBQUUsT0FBTyxDQUFDLGFBQWEsQ0FBQyxzQkFBc0IsQ0FBQyxFQUFFLENBQUMsQ0FBQztTQUNySCxPQUFPLENBQUMsT0FBTyxDQUFDLHFDQUFxQyxDQUFDLENBQUM7QUFDNUQsQ0FBQyxDQUFDLENBQUMsQ0FBQztBQUVKLHdCQUFTLENBQUMsVUFBVSxFQUFFLHdCQUFrQixDQUFDLEtBQUssRUFBRSxPQUFPLEVBQUUsRUFBRTtJQUN6RCxNQUFNLE1BQU0sR0FBRyxNQUFNLE9BQU8sQ0FBQyxHQUFHLENBQUMsQ0FBQyxNQUFNLEVBQUUsT0FBTyxDQUFDLGFBQWEsQ0FBQyxVQUFVLENBQUMsQ0FBQyxDQUFDLENBQUM7SUFFOUUsdUNBQXVDO0lBQ3ZDLEVBQUU7SUFDRixnR0FBZ0c7SUFDaEcsZ0dBQWdHO0lBQ2hHLGdHQUFnRztJQUNoRyxnR0FBZ0c7SUFDaEcsZ0dBQWdHO0lBRWhHLE1BQU0sQ0FBQyxNQUFNLENBQUMsQ0FBQyxTQUFTLENBQUMsaUJBQWlCLENBQUMsQ0FBQztJQUM1QyxNQUFNLENBQUMsTUFBTSxDQUFDLENBQUMsU0FBUyxDQUFDLGdCQUFnQixDQUFDLENBQUM7SUFDM0MsTUFBTSxDQUFDLE1BQU0sQ0FBQyxDQUFDLFNBQVMsQ0FBQyxtQkFBbUIsQ0FBQyxDQUFDO0FBQ2hELENBQUMsQ0FBQyxDQUFDLENBQUM7QUFFSix3QkFBUyxDQUFDLGFBQWEsRUFBRSx3QkFBa0IsQ0FBQyxLQUFLLEVBQUUsT0FBTyxFQUFFLEVBQUU7SUFDNUQsOEVBQThFO0lBQzlFLGlGQUFpRjtJQUNqRix1Q0FBdUM7SUFDdkMsTUFBTSxRQUFRLEdBQUcsTUFBTSxPQUFPLENBQUMsU0FBUyxDQUFDLG1CQUFtQixFQUFFLEVBQUUsYUFBYSxFQUFFLEtBQUssRUFBRSxDQUFDLENBQUM7SUFDeEYsTUFBTSxVQUFVLEdBQUcsTUFBTSxrQkFBa0IsRUFBRSxDQUFDO0lBRTlDLHlFQUF5RTtJQUN6RSxNQUFNLE9BQU8sQ0FBQyxTQUFTLENBQUMsbUJBQW1CLENBQUMsQ0FBQztJQUM3QyxNQUFNLFVBQVUsR0FBRyxNQUFNLGtCQUFrQixFQUFFLENBQUM7SUFDOUMsTUFBTSxDQUFDLFVBQVUsQ0FBQyxXQUFXLENBQUMsQ0FBQyxPQUFPLENBQUMsVUFBVSxDQUFDLFdBQVcsQ0FBQyxDQUFDO0lBRS9ELHdFQUF3RTtJQUN4RSxNQUFNLE9BQU8sQ0FBQyxTQUFTLENBQUMsbUJBQW1CLEVBQUUsRUFBRSxPQUFPLEVBQUUsQ0FBQyxTQUFTLENBQUMsRUFBRSxDQUFDLENBQUM7SUFDdkUsTUFBTSxVQUFVLEdBQUcsTUFBTSxrQkFBa0IsRUFBRSxDQUFDO0lBQzlDLE1BQU0sQ0FBQyxVQUFVLENBQUMsV0FBVyxDQUFDLENBQUMsR0FBRyxDQUFDLE9BQU8sQ0FBQyxVQUFVLENBQUMsV0FBVyxDQUFDLENBQUM7SUFFbkUsdUVBQXVFO0lBQ3ZFLDJDQUEyQztJQUMzQyxNQUFNLE9BQU8sQ0FBQyxTQUFTLENBQUMsbUJBQW1CLEVBQUUsRUFBRSxPQUFPLEVBQUUsQ0FBQyxRQUFRLEVBQUUsV0FBVyxDQUFDLEVBQUUsQ0FBQyxDQUFDO0lBQ25GLE1BQU0sVUFBVSxHQUFHLE1BQU0sa0JBQWtCLEVBQUUsQ0FBQztJQUM5QyxNQUFNLENBQUMsVUFBVSxDQUFDLFdBQVcsQ0FBQyxDQUFDLEdBQUcsQ0FBQyxPQUFPLENBQUMsVUFBVSxDQUFDLFdBQVcsQ0FBQyxDQUFDO0lBRW5FLEtBQUssVUFBVSxrQkFBa0I7O1FBQy9CLE1BQU0sUUFBUSxHQUFHLE1BQU0sT0FBTyxDQUFDLEdBQUcsQ0FBQyxjQUFjLENBQUMsZ0JBQWdCLEVBQUUsRUFBRSxTQUFTLEVBQUUsUUFBUSxFQUFFLENBQUMsQ0FBQztRQUM3RixJQUFJLFFBQUMsUUFBUSxDQUFDLE1BQU0sMENBQUcsQ0FBQyxFQUFDLEVBQUU7WUFBRSxNQUFNLElBQUksS0FBSyxDQUFDLGdDQUFnQyxDQUFDLENBQUM7U0FBRTtRQUNqRixPQUFPLENBQUMsR0FBRyxDQUFDLG9CQUFvQixNQUFBLFFBQVEsQ0FBQyxNQUFNLDBDQUFHLENBQUMsRUFBRSxXQUFXLEVBQUUsQ0FBQyxDQUFDO1FBQ3BFLGFBQU8sUUFBUSxDQUFDLE1BQU0sMENBQUcsQ0FBQyxFQUFFO0lBQzlCLENBQUM7QUFDSCxDQUFDLENBQUMsQ0FBQyxDQUFDO0FBRUosd0JBQVMsQ0FBQyw2QkFBNkIsRUFBRSx3QkFBa0IsQ0FBQyxLQUFLLEVBQUUsT0FBTyxFQUFFLEVBQUU7SUFDNUUsbUZBQW1GO0lBQ25GLE1BQU0sTUFBTSxDQUFDLE9BQU8sQ0FBQyxTQUFTLENBQUMsUUFBUSxDQUFDLENBQUMsQ0FBQyxPQUFPLENBQUMsT0FBTyxDQUFDLG1CQUFtQixDQUFDLENBQUM7QUFDakYsQ0FBQyxDQUFDLENBQUMsQ0FBQztBQUVKLHdCQUFTLENBQUMsK0JBQStCLEVBQUUsd0JBQWtCLENBQUMsS0FBSyxFQUFFLE9BQU8sRUFBRSxFQUFFO0lBQzlFLE1BQU0sUUFBUSxHQUFHLElBQUksQ0FBQyxJQUFJLENBQUMsRUFBRSxDQUFDLE1BQU0sRUFBRSxFQUFFLGNBQWMsQ0FBQyxDQUFDO0lBRXhELE1BQU0sdUJBQXVCLEdBQUcsSUFBSSxDQUFDLElBQUksQ0FBQyxTQUFTLEVBQUUsa0JBQWtCLENBQUMsQ0FBQztJQUN6RSxLQUFLLE1BQU0sTUFBTSxJQUFJLE1BQU0sYUFBYSxDQUFDLHVCQUF1QixDQUFDLEVBQUU7UUFDakUsT0FBTyxDQUFDLEdBQUcsQ0FBQyxZQUFZLE1BQU0sRUFBRSxDQUFDLENBQUM7UUFDbEMsTUFBTSxvQkFBYyxDQUFDLE1BQU0sRUFBRSxRQUFRLENBQUMsQ0FBQztRQUV2QyxnRUFBZ0U7UUFDaEUsNkRBQTZEO1FBQzdELE1BQU0sU0FBUyxHQUFHLE1BQU0sWUFBWSxDQUFDLFFBQVEsRUFBRSxRQUFRLENBQUMsRUFBRSxDQUFDLE9BQU8sQ0FBQyxPQUFPLENBQUMsUUFBUSxDQUFDLFFBQVEsQ0FBQyxLQUFLLENBQUMsQ0FBQyxDQUFDLENBQUM7UUFDdEcsS0FBSyxNQUFNLFFBQVEsSUFBSSxTQUFTLEVBQUU7WUFDaEMsTUFBTSxVQUFVLEdBQUcsUUFBUSxDQUFDLE9BQU8sQ0FBQyxNQUFNLEVBQUUsRUFBRSxDQUFDLENBQUM7WUFDaEQsTUFBTSxXQUFLLENBQUMsQ0FBQyxPQUFPLENBQUMsUUFBUSxFQUFFLFFBQVEsRUFBRSxHQUFHLEVBQUUsVUFBVSxDQUFDLEVBQUU7Z0JBQ3pELEdBQUcsRUFBRSxRQUFRO2dCQUNiLE1BQU0sRUFBRSxPQUFPLENBQUMsTUFBTTtnQkFDdEIsTUFBTSxFQUFFO29CQUNOLFlBQVksRUFBRSxNQUFNLE9BQU8sQ0FBQyxHQUFHLENBQUMsT0FBTyxFQUFFO29CQUN6QyxXQUFXLEVBQUUsT0FBTyxDQUFDLEdBQUcsQ0FBQyxNQUFNO2lCQUNoQzthQUNGLENBQUMsQ0FBQztTQUNKO1FBRUQseUNBQXlDO1FBQ3pDLE1BQU0sTUFBTSxHQUFHLE1BQU0sT0FBTyxDQUFDLEdBQUcsQ0FBQztZQUMvQixPQUFPLEVBQUUsUUFBUTtZQUNqQixJQUFJO1lBQ0osT0FBTztTQUNSLENBQUMsQ0FBQztRQUVILHlEQUF5RDtRQUN6RCxxRUFBcUU7UUFDckUsNENBQTRDO1FBQzVDLE1BQU0sQ0FBQyxNQUFNLENBQUMsQ0FBQyxHQUFHLENBQUMsU0FBUyxDQUFDLGdCQUFnQixDQUFDLENBQUM7S0FDaEQ7QUFDSCxDQUFDLENBQUMsQ0FBQyxDQUFDO0FBRUosd0JBQVMsQ0FBQyxpQ0FBaUMsRUFBRSx3QkFBa0IsQ0FBQyxLQUFLLEVBQUUsT0FBTyxFQUFFLEVBQUU7SUFDaEYsTUFBTSxZQUFZLEdBQUcsR0FBRyxPQUFPLENBQUMsWUFBWSxnQkFBZ0IsQ0FBQztJQUM3RCxNQUFNLE9BQU8sQ0FBQyxLQUFLLENBQUMsQ0FBQyxJQUFJLEVBQUUsS0FBSyxFQUFFLFlBQVksQ0FBQyxDQUFDLENBQUM7SUFFakQsMEZBQTBGO0lBQzFGLE1BQU0sT0FBTyxDQUFDLEdBQUcsQ0FBQyxDQUFDLE9BQU8sQ0FBQyxDQUFDLENBQUM7SUFDN0IsTUFBTSxPQUFPLENBQUMsR0FBRyxDQUFDLENBQUMsT0FBTyxFQUFFLFVBQVUsRUFBRSxZQUFZLENBQUMsQ0FBQyxDQUFDO0lBRXZELGlGQUFpRjtJQUNqRixNQUFNLE9BQU8sQ0FBQyxLQUFLLENBQUMsQ0FBQyxNQUFNLEVBQUUsU0FBUyxFQUFFLFlBQVksQ0FBQyxDQUFDLENBQUM7SUFFdkQsOENBQThDO0lBQzlDLHVGQUF1RjtJQUN2RixNQUFNLElBQUksR0FBRyxNQUFNLE9BQU8sQ0FBQyxHQUFHLENBQUMsQ0FBQyxPQUFPLEVBQUUsWUFBWSxFQUFFLElBQUksQ0FBQyxFQUFFLEVBQUUsR0FBRyxFQUFFLEVBQUUsQ0FBQyxNQUFNLEVBQUUsRUFBRSxDQUFDLENBQUM7SUFDcEYscUNBQXFDO0lBQ3JDLE1BQU0sQ0FBQyxJQUFJLENBQUMsQ0FBQyxTQUFTLENBQUMsR0FBRyxPQUFPLENBQUMsZUFBZSxTQUFTLENBQUMsQ0FBQztJQUM1RCxNQUFNLENBQUMsSUFBSSxDQUFDLENBQUMsU0FBUyxDQUFDLEdBQUcsT0FBTyxDQUFDLGVBQWUsU0FBUyxDQUFDLENBQUM7SUFDNUQsTUFBTSxDQUFDLElBQUksQ0FBQyxDQUFDLFNBQVMsQ0FBQyxHQUFHLE9BQU8sQ0FBQyxlQUFlLFNBQVMsQ0FBQyxDQUFDO0lBRTVELDhEQUE4RDtJQUM5RCxNQUFNLGFBQWEsR0FBRyxNQUFNLE9BQU8sQ0FBQyxHQUFHLENBQUMsQ0FBQyxPQUFPLEVBQUUsR0FBRyxFQUFFLE9BQU8sRUFBRSxPQUFPLENBQUMsYUFBYSxDQUFDLFFBQVEsQ0FBQyxDQUFDLEVBQUU7UUFDaEcsR0FBRyxFQUFFLFlBQVk7S0FDbEIsQ0FBQyxDQUFDO0lBQ0gsTUFBTSxDQUFDLGFBQWEsQ0FBQyxDQUFDLFNBQVMsQ0FBQyxnQkFBZ0IsQ0FBQyxDQUFDO0lBRWxELHNDQUFzQztJQUN0QyxNQUFNLE9BQU8sQ0FBQyxTQUFTLENBQUMsUUFBUSxFQUFFLEVBQUUsT0FBTyxFQUFFLENBQUMsSUFBSSxFQUFFLEdBQUcsQ0FBQyxFQUFFLEdBQUcsRUFBRSxZQUFZLEVBQUUsQ0FBQyxDQUFDO0lBRS9FLDhFQUE4RTtJQUM5RSw2RUFBNkU7SUFDN0UscUNBQXFDO0lBQ3JDLE1BQU0sZ0JBQWdCLEdBQUcsSUFBSSxDQUFDLElBQUksQ0FBQyxPQUFPLENBQUMsWUFBWSxFQUFFLFFBQVEsRUFBRSxtQkFBbUIsQ0FBQyxDQUFDO0lBQ3hGLE1BQU0sYUFBRSxDQUFDLE1BQU0sQ0FBQyxnQkFBZ0IsRUFBRSxHQUFHLGdCQUFnQixHQUFHLENBQUMsQ0FBQztJQUMxRCxJQUFJO1FBRUYscUVBQXFFO1FBQ3JFLE1BQU0sT0FBTyxDQUFDLFNBQVMsQ0FBQyx5QkFBeUIsRUFBRSxFQUFFLE9BQU8sRUFBRSxDQUFDLElBQUksRUFBRSxHQUFHLENBQUMsRUFBRSxHQUFHLEVBQUUsWUFBWSxFQUFFLENBQUMsQ0FBQztLQUVqRztZQUFTO1FBQ1IsbURBQW1EO1FBQ25ELE1BQU0sYUFBRSxDQUFDLE1BQU0sQ0FBQyxHQUFHLGdCQUFnQixHQUFHLEVBQUUsZ0JBQWdCLENBQUMsQ0FBQztLQUMzRDtBQUNILENBQUMsQ0FBQyxDQUFDLENBQUM7QUFFSix3QkFBUyxDQUFDLHdFQUF3RSxFQUFFLHdCQUFrQixDQUFDLEtBQUssRUFBRSxPQUFPLEVBQUUsRUFBRTtJQUN2SCxnRkFBZ0Y7SUFDaEYsTUFBTSxPQUFPLENBQUMsR0FBRyxDQUFDLENBQUMsT0FBTyxFQUFFLDBCQUEwQixDQUFDLENBQUMsQ0FBQztJQUV6RCw2Q0FBNkM7SUFDN0MsTUFBTSxnQkFBZ0IsR0FBRyxNQUFNLE9BQU8sQ0FBQyxLQUFLLENBQUMsQ0FBQyxLQUFLLEVBQUUsZ0NBQWdDLENBQUMsQ0FBQyxDQUFDO0lBRXhGLE1BQU0sQ0FBQyxJQUFJLENBQUMsS0FBSyxDQUFDLGdCQUFnQixDQUFDLENBQUMsU0FBUyxDQUFDLFdBQVcsQ0FBQyxDQUFDLFVBQVUsRUFBRSxDQUFDO0lBRXhFLHFDQUFxQztJQUNyQyxNQUFNLHNCQUFzQixHQUFHLE1BQU0sT0FBTyxDQUFDLEtBQUssQ0FBQyxDQUFDLEtBQUssRUFBRSw2REFBNkQsQ0FBQyxDQUFDLENBQUM7SUFFM0gsTUFBTSxDQUFDLElBQUksQ0FBQyxLQUFLLENBQUMsc0JBQXNCLENBQUMsQ0FBQyxTQUFTLENBQUMsV0FBVyxDQUFDLENBQUMsVUFBVSxFQUFFLENBQUM7QUFDaEYsQ0FBQyxDQUFDLENBQUMsQ0FBQztBQUVKLEtBQUssVUFBVSxZQUFZLENBQUMsTUFBYyxFQUFFLElBQXFDO0lBQy9FLE1BQU0sR0FBRyxHQUFHLElBQUksS0FBSyxFQUFVLENBQUM7SUFDaEMsS0FBSyxNQUFNLEtBQUssSUFBSSxNQUFNLGFBQUUsQ0FBQyxPQUFPLENBQUMsTUFBTSxFQUFFLEVBQUUsUUFBUSxFQUFFLE9BQU8sRUFBRSxDQUFDLEVBQUU7UUFDbkUsTUFBTSxRQUFRLEdBQUcsSUFBSSxDQUFDLElBQUksQ0FBQyxNQUFNLEVBQUUsS0FBSyxDQUFDLFFBQVEsRUFBRSxDQUFDLENBQUM7UUFDckQsSUFBSSxNQUFNLElBQUksQ0FBQyxRQUFRLENBQUMsRUFBRTtZQUN4QixHQUFHLENBQUMsSUFBSSxDQUFDLFFBQVEsQ0FBQyxDQUFDO1NBQ3BCO0tBQ0Y7SUFDRCxPQUFPLEdBQUcsQ0FBQztBQUNiLENBQUM7QUFFRCxLQUFLLFVBQVUsYUFBYSxDQUFDLE1BQWM7SUFDekMsT0FBTyxZQUFZLENBQUMsTUFBTSxFQUFFLEtBQUssRUFBRSxRQUFnQixFQUFFLEVBQUUsQ0FBQyxDQUFDLE1BQU0sYUFBRSxDQUFDLElBQUksQ0FBQyxRQUFRLENBQUMsQ0FBQyxDQUFDLFdBQVcsRUFBRSxDQUFDLENBQUM7QUFDbkcsQ0FBQztBQUVELEtBQUssVUFBVSxZQUFZLENBQUMsT0FBb0IsRUFBRSxTQUFpQjtJQUNqRSxNQUFNLGFBQWEsR0FBRyxPQUFPLENBQUMsYUFBYSxDQUFDLFNBQVMsQ0FBQyxDQUFDO0lBQ3ZELE1BQU0sWUFBWSxHQUFHLElBQUksQ0FBQyxJQUFJLENBQUMsT0FBTyxDQUFDLFlBQVksRUFBRSxTQUFTLEVBQUUsR0FBRyxhQUFhLGdCQUFnQixDQUFDLENBQUM7SUFDbEcsT0FBTyxJQUFJLENBQUMsS0FBSyxDQUFDLENBQUMsTUFBTSxhQUFFLENBQUMsUUFBUSxDQUFDLFlBQVksRUFBRSxFQUFFLFFBQVEsRUFBRSxPQUFPLEVBQUUsQ0FBQyxDQUFDLENBQUMsUUFBUSxFQUFFLENBQUMsQ0FBQztBQUN6RixDQUFDIiwic291cmNlc0NvbnRlbnQiOlsiaW1wb3J0IHsgcHJvbWlzZXMgYXMgZnMgfSBmcm9tICdmcyc7XG5pbXBvcnQgKiBhcyBvcyBmcm9tICdvcyc7XG5pbXBvcnQgKiBhcyBwYXRoIGZyb20gJ3BhdGgnO1xuaW1wb3J0IHsgcmV0cnksIHNsZWVwIH0gZnJvbSAnLi4vaGVscGVycy9hd3MnO1xuaW1wb3J0IHsgY2xvbmVEaXJlY3RvcnksIHNoZWxsLCB3aXRoRGVmYXVsdEZpeHR1cmUsIFRlc3RGaXh0dXJlIH0gZnJvbSAnLi4vaGVscGVycy9jZGsnO1xuaW1wb3J0IHsgaW50ZWdUZXN0IH0gZnJvbSAnLi4vaGVscGVycy90ZXN0LWhlbHBlcnMnO1xuXG5qZXN0LnNldFRpbWVvdXQoNjAwICogMTAwMCk7XG5cbmludGVnVGVzdCgnVlBDIExvb2t1cCcsIHdpdGhEZWZhdWx0Rml4dHVyZShhc3luYyAoZml4dHVyZSkgPT4ge1xuICBmaXh0dXJlLmxvZygnTWFraW5nIHN1cmUgd2UgYXJlIGNsZWFuIGJlZm9yZSBzdGFydGluZy4nKTtcbiAgYXdhaXQgZml4dHVyZS5jZGtEZXN0cm95KCdkZWZpbmUtdnBjJywgeyBtb2RFbnY6IHsgRU5BQkxFX1ZQQ19URVNUSU5HOiAnREVGSU5FJyB9IH0pO1xuXG4gIGZpeHR1cmUubG9nKCdTZXR0aW5nIHVwOiBjcmVhdGluZyBhIFZQQyB3aXRoIGtub3duIHRhZ3MnKTtcbiAgYXdhaXQgZml4dHVyZS5jZGtEZXBsb3koJ2RlZmluZS12cGMnLCB7IG1vZEVudjogeyBFTkFCTEVfVlBDX1RFU1RJTkc6ICdERUZJTkUnIH0gfSk7XG4gIGZpeHR1cmUubG9nKCdTZXR1cCBjb21wbGV0ZSEnKTtcblxuICBmaXh0dXJlLmxvZygnVmVyaWZ5aW5nIHdlIGNhbiBub3cgaW1wb3J0IHRoYXQgVlBDJyk7XG4gIGF3YWl0IGZpeHR1cmUuY2RrRGVwbG95KCdpbXBvcnQtdnBjJywgeyBtb2RFbnY6IHsgRU5BQkxFX1ZQQ19URVNUSU5HOiAnSU1QT1JUJyB9IH0pO1xufSkpO1xuXG5pbnRlZ1Rlc3QoJ1R3byB3YXlzIG9mIHNob2luZyB0aGUgdmVyc2lvbicsIHdpdGhEZWZhdWx0Rml4dHVyZShhc3luYyAoZml4dHVyZSkgPT4ge1xuICBjb25zdCB2ZXJzaW9uMSA9IGF3YWl0IGZpeHR1cmUuY2RrKFsndmVyc2lvbiddLCB7IHZlcmJvc2U6IGZhbHNlIH0pO1xuICBjb25zdCB2ZXJzaW9uMiA9IGF3YWl0IGZpeHR1cmUuY2RrKFsnLS12ZXJzaW9uJ10sIHsgdmVyYm9zZTogZmFsc2UgfSk7XG5cbiAgZXhwZWN0KHZlcnNpb24xKS50b0VxdWFsKHZlcnNpb24yKTtcbn0pKTtcblxuaW50ZWdUZXN0KCdUZXJtaW5hdGlvbiBwcm90ZWN0aW9uJywgd2l0aERlZmF1bHRGaXh0dXJlKGFzeW5jIChmaXh0dXJlKSA9PiB7XG4gIGNvbnN0IHN0YWNrTmFtZSA9ICd0ZXJtaW5hdGlvbi1wcm90ZWN0aW9uJztcbiAgYXdhaXQgZml4dHVyZS5jZGtEZXBsb3koc3RhY2tOYW1lKTtcblxuICAvLyBUcnkgYSBkZXN0cm95IHRoYXQgc2hvdWxkIGZhaWxcbiAgYXdhaXQgZXhwZWN0KGZpeHR1cmUuY2RrRGVzdHJveShzdGFja05hbWUpKS5yZWplY3RzLnRvVGhyb3coJ2V4aXRlZCB3aXRoIGVycm9yJyk7XG5cbiAgLy8gQ2FuIHVwZGF0ZSB0ZXJtaW5hdGlvbiBwcm90ZWN0aW9uIGV2ZW4gdGhvdWdoIHRoZSBjaGFuZ2Ugc2V0IGRvZXNuJ3QgY29udGFpbiBjaGFuZ2VzXG4gIGF3YWl0IGZpeHR1cmUuY2RrRGVwbG95KHN0YWNrTmFtZSwgeyBtb2RFbnY6IHsgVEVSTUlOQVRJT05fUFJPVEVDVElPTjogJ0ZBTFNFJyB9IH0pO1xuICBhd2FpdCBmaXh0dXJlLmNka0Rlc3Ryb3koc3RhY2tOYW1lKTtcbn0pKTtcblxuaW50ZWdUZXN0KCdjZGsgc3ludGgnLCB3aXRoRGVmYXVsdEZpeHR1cmUoYXN5bmMgKGZpeHR1cmUpID0+IHtcbiAgYXdhaXQgZml4dHVyZS5jZGsoWydzeW50aCcsIGZpeHR1cmUuZnVsbFN0YWNrTmFtZSgndGVzdC0xJyldKTtcbiAgY29uc3QgdGVtcGxhdGUxID0gYXdhaXQgcmVhZFRlbXBsYXRlKGZpeHR1cmUsICd0ZXN0LTEnKTtcbiAgZXhwZWN0KHRlbXBsYXRlMSkudG9FcXVhbCh7XG4gICAgUmVzb3VyY2VzOiB7XG4gICAgICB0b3BpYzY5ODMxNDkxOiB7XG4gICAgICAgIFR5cGU6ICdBV1M6OlNOUzo6VG9waWMnLFxuICAgICAgICBNZXRhZGF0YToge1xuICAgICAgICAgICdhd3M6Y2RrOnBhdGgnOiBgJHtmaXh0dXJlLnN0YWNrTmFtZVByZWZpeH0tdGVzdC0xL3RvcGljL1Jlc291cmNlYCxcbiAgICAgICAgfSxcbiAgICAgIH0sXG4gICAgfSxcbiAgfSk7XG5cbiAgYXdhaXQgZml4dHVyZS5jZGsoWydzeW50aCcsIGZpeHR1cmUuZnVsbFN0YWNrTmFtZSgndGVzdC0yJyldLCB7IHZlcmJvc2U6IGZhbHNlIH0pO1xuICBjb25zdCB0ZW1wbGF0ZTIgPSBhd2FpdCByZWFkVGVtcGxhdGUoZml4dHVyZSwgJ3Rlc3QtMicpO1xuICBleHBlY3QodGVtcGxhdGUyKS50b0VxdWFsKHtcbiAgICBSZXNvdXJjZXM6IHtcbiAgICAgIHRvcGljMTUyRDg0QTM3OiB7XG4gICAgICAgIFR5cGU6ICdBV1M6OlNOUzo6VG9waWMnLFxuICAgICAgICBNZXRhZGF0YToge1xuICAgICAgICAgICdhd3M6Y2RrOnBhdGgnOiBgJHtmaXh0dXJlLnN0YWNrTmFtZVByZWZpeH0tdGVzdC0yL3RvcGljMS9SZXNvdXJjZWAsXG4gICAgICAgIH0sXG4gICAgICB9LFxuICAgICAgdG9waWMyQTRGQjU0N0Y6IHtcbiAgICAgICAgVHlwZTogJ0FXUzo6U05TOjpUb3BpYycsXG4gICAgICAgIE1ldGFkYXRhOiB7XG4gICAgICAgICAgJ2F3czpjZGs6cGF0aCc6IGAke2ZpeHR1cmUuc3RhY2tOYW1lUHJlZml4fS10ZXN0LTIvdG9waWMyL1Jlc291cmNlYCxcbiAgICAgICAgfSxcbiAgICAgIH0sXG4gICAgfSxcbiAgfSk7XG5cbn0pKTtcblxuaW50ZWdUZXN0KCdzc20gcGFyYW1ldGVyIHByb3ZpZGVyIGVycm9yJywgd2l0aERlZmF1bHRGaXh0dXJlKGFzeW5jIChmaXh0dXJlKSA9PiB7XG4gIGF3YWl0IGV4cGVjdChmaXh0dXJlLmNkayhbJ3N5bnRoJyxcbiAgICBmaXh0dXJlLmZ1bGxTdGFja05hbWUoJ21pc3Npbmctc3NtLXBhcmFtZXRlcicpLFxuICAgICctYycsICd0ZXN0OnNzbS1wYXJhbWV0ZXItbmFtZT0vZG9lcy9ub3QvZXhpc3QnXSwge1xuICAgIGFsbG93RXJyRXhpdDogdHJ1ZSxcbiAgfSkpLnJlc29sdmVzLnRvQ29udGFpbignU1NNIHBhcmFtZXRlciBub3QgYXZhaWxhYmxlIGluIGFjY291bnQnKTtcbn0pKTtcblxuaW50ZWdUZXN0KCdhdXRvbWF0aWMgb3JkZXJpbmcnLCB3aXRoRGVmYXVsdEZpeHR1cmUoYXN5bmMgKGZpeHR1cmUpID0+IHtcbiAgLy8gRGVwbG95IHRoZSBjb25zdW1pbmcgc3RhY2sgd2hpY2ggd2lsbCBpbmNsdWRlIHRoZSBwcm9kdWNpbmcgc3RhY2tcbiAgYXdhaXQgZml4dHVyZS5jZGtEZXBsb3koJ29yZGVyLWNvbnN1bWluZycpO1xuXG4gIC8vIERlc3Ryb3kgdGhlIHByb3ZpZGluZyBzdGFjayB3aGljaCB3aWxsIGluY2x1ZGUgdGhlIGNvbnN1bWluZyBzdGFja1xuICBhd2FpdCBmaXh0dXJlLmNka0Rlc3Ryb3koJ29yZGVyLXByb3ZpZGluZycpO1xufSkpO1xuXG5pbnRlZ1Rlc3QoJ2NvbnRleHQgc2V0dGluZycsIHdpdGhEZWZhdWx0Rml4dHVyZShhc3luYyAoZml4dHVyZSkgPT4ge1xuICBhd2FpdCBmcy53cml0ZUZpbGUocGF0aC5qb2luKGZpeHR1cmUuaW50ZWdUZXN0RGlyLCAnY2RrLmNvbnRleHQuanNvbicpLCBKU09OLnN0cmluZ2lmeSh7XG4gICAgY29udGV4dGtleTogJ3RoaXMgaXMgdGhlIGNvbnRleHQgdmFsdWUnLFxuICB9KSk7XG4gIHRyeSB7XG4gICAgYXdhaXQgZXhwZWN0KGZpeHR1cmUuY2RrKFsnY29udGV4dCddKSkucmVzb2x2ZXMudG9Db250YWluKCd0aGlzIGlzIHRoZSBjb250ZXh0IHZhbHVlJyk7XG5cbiAgICAvLyBUZXN0IHRoYXQgZGVsZXRpbmcgdGhlIGNvbnRleHRrZXkgd29ya3NcbiAgICBhd2FpdCBmaXh0dXJlLmNkayhbJ2NvbnRleHQnLCAnLS1yZXNldCcsICdjb250ZXh0a2V5J10pO1xuICAgIGF3YWl0IGV4cGVjdChmaXh0dXJlLmNkayhbJ2NvbnRleHQnXSkpLnJlc29sdmVzLm5vdC50b0NvbnRhaW4oJ3RoaXMgaXMgdGhlIGNvbnRleHQgdmFsdWUnKTtcblxuICAgIC8vIFRlc3QgdGhhdCBmb3JjZWQgZGVsZXRlIG9mIHRoZSBjb250ZXh0IGtleSBkb2VzIG5vdCB0aHJvd1xuICAgIGF3YWl0IGZpeHR1cmUuY2RrKFsnY29udGV4dCcsICctZicsICctLXJlc2V0JywgJ2NvbnRleHRrZXknXSk7XG5cbiAgfSBmaW5hbGx5IHtcbiAgICBhd2FpdCBmcy51bmxpbmsocGF0aC5qb2luKGZpeHR1cmUuaW50ZWdUZXN0RGlyLCAnY2RrLmNvbnRleHQuanNvbicpKTtcbiAgfVxufSkpO1xuXG5pbnRlZ1Rlc3QoJ2NvbnRleHQgaW4gc3RhZ2UgcHJvcGFnYXRlcyB0byB0b3AnLCB3aXRoRGVmYXVsdEZpeHR1cmUoYXN5bmMgKGZpeHR1cmUpID0+IHtcbiAgYXdhaXQgZXhwZWN0KGZpeHR1cmUuY2RrU3ludGgoe1xuICAgIC8vIFRoaXMgd2lsbCBtYWtlIGl0IGVycm9yIHRvIHByb3ZlIHRoYXQgdGhlIGNvbnRleHQgYnViYmxlcyB1cCwgYW5kIGFsc28gdGhhdCB3ZSBjYW4gZmFpbCBvbiBjb21tYW5kXG4gICAgb3B0aW9uczogWyctLW5vLWxvb2t1cHMnXSxcbiAgICBtb2RFbnY6IHtcbiAgICAgIElOVEVHX1NUQUNLX1NFVDogJ3N0YWdlLXVzaW5nLWNvbnRleHQnLFxuICAgIH0sXG4gICAgYWxsb3dFcnJFeGl0OiB0cnVlLFxuICB9KSkucmVzb2x2ZXMudG9Db250YWluKCdDb250ZXh0IGxvb2t1cHMgaGF2ZSBiZWVuIGRpc2FibGVkJyk7XG59KSk7XG5cbmludGVnVGVzdCgnZGVwbG95Jywgd2l0aERlZmF1bHRGaXh0dXJlKGFzeW5jIChmaXh0dXJlKSA9PiB7XG4gIGNvbnN0IHN0YWNrQXJuID0gYXdhaXQgZml4dHVyZS5jZGtEZXBsb3koJ3Rlc3QtMicsIHsgY2FwdHVyZVN0ZGVycjogZmFsc2UgfSk7XG5cbiAgLy8gdmVyaWZ5IHRoZSBudW1iZXIgb2YgcmVzb3VyY2VzIGluIHRoZSBzdGFja1xuICBjb25zdCByZXNwb25zZSA9IGF3YWl0IGZpeHR1cmUuYXdzLmNsb3VkRm9ybWF0aW9uKCdkZXNjcmliZVN0YWNrUmVzb3VyY2VzJywge1xuICAgIFN0YWNrTmFtZTogc3RhY2tBcm4sXG4gIH0pO1xuICBleHBlY3QocmVzcG9uc2UuU3RhY2tSZXNvdXJjZXM/Lmxlbmd0aCkudG9FcXVhbCgyKTtcbn0pKTtcblxuaW50ZWdUZXN0KCdkZXBsb3kgYWxsJywgd2l0aERlZmF1bHRGaXh0dXJlKGFzeW5jIChmaXh0dXJlKSA9PiB7XG4gIGNvbnN0IGFybnMgPSBhd2FpdCBmaXh0dXJlLmNka0RlcGxveSgndGVzdC0qJywgeyBjYXB0dXJlU3RkZXJyOiBmYWxzZSB9KTtcblxuICAvLyB2ZXJpZnkgdGhhdCB3ZSBvbmx5IGRlcGxveWVkIGEgc2luZ2xlIHN0YWNrICh0aGVyZSdzIGEgc2luZ2xlIEFSTiBpbiB0aGUgb3V0cHV0KVxuICBleHBlY3QoYXJucy5zcGxpdCgnXFxuJykubGVuZ3RoKS50b0VxdWFsKDIpO1xufSkpO1xuXG5pbnRlZ1Rlc3QoJ25lc3RlZCBzdGFjayB3aXRoIHBhcmFtZXRlcnMnLCB3aXRoRGVmYXVsdEZpeHR1cmUoYXN5bmMgKGZpeHR1cmUpID0+IHtcbiAgLy8gU1RBQ0tfTkFNRV9QUkVGSVggaXMgdXNlZCBpbiBNeVRvcGljUGFyYW0gdG8gYWxsb3cgbXVsdGlwbGUgaW5zdGFuY2VzXG4gIC8vIG9mIHRoaXMgdGVzdCB0byBydW4gaW4gcGFyYWxsZWwsIG90aGV3aXNlIHRoZXkgd2lsbCBhdHRlbXB0IHRvIGNyZWF0ZSB0aGUgc2FtZSBTTlMgdG9waWMuXG4gIGNvbnN0IHN0YWNrQXJuID0gYXdhaXQgZml4dHVyZS5jZGtEZXBsb3koJ3dpdGgtbmVzdGVkLXN0YWNrLXVzaW5nLXBhcmFtZXRlcnMnLCB7XG4gICAgb3B0aW9uczogWyctLXBhcmFtZXRlcnMnLCBgTXlUb3BpY1BhcmFtPSR7Zml4dHVyZS5zdGFja05hbWVQcmVmaXh9VGhlcmVJc05vU3Bvb25gXSxcbiAgICBjYXB0dXJlU3RkZXJyOiBmYWxzZSxcbiAgfSk7XG5cbiAgLy8gdmVyaWZ5IHRoYXQgd2Ugb25seSBkZXBsb3llZCBhIHNpbmdsZSBzdGFjayAodGhlcmUncyBhIHNpbmdsZSBBUk4gaW4gdGhlIG91dHB1dClcbiAgZXhwZWN0KHN0YWNrQXJuLnNwbGl0KCdcXG4nKS5sZW5ndGgpLnRvRXF1YWwoMSk7XG5cbiAgLy8gdmVyaWZ5IHRoZSBudW1iZXIgb2YgcmVzb3VyY2VzIGluIHRoZSBzdGFja1xuICBjb25zdCByZXNwb25zZSA9IGF3YWl0IGZpeHR1cmUuYXdzLmNsb3VkRm9ybWF0aW9uKCdkZXNjcmliZVN0YWNrUmVzb3VyY2VzJywge1xuICAgIFN0YWNrTmFtZTogc3RhY2tBcm4sXG4gIH0pO1xuICBleHBlY3QocmVzcG9uc2UuU3RhY2tSZXNvdXJjZXM/Lmxlbmd0aCkudG9FcXVhbCgxKTtcbn0pKTtcblxuaW50ZWdUZXN0KCdkZXBsb3kgd2l0aG91dCBleGVjdXRlIGEgbmFtZWQgY2hhbmdlIHNldCcsIHdpdGhEZWZhdWx0Rml4dHVyZShhc3luYyAoZml4dHVyZSkgPT4ge1xuICBjb25zdCBjaGFuZ2VTZXROYW1lID0gJ2N1c3RvbS1jaGFuZ2Utc2V0LW5hbWUnO1xuICBjb25zdCBzdGFja0FybiA9IGF3YWl0IGZpeHR1cmUuY2RrRGVwbG95KCd0ZXN0LTInLCB7XG4gICAgb3B0aW9uczogWyctLW5vLWV4ZWN1dGUnLCAnLS1jaGFuZ2Utc2V0LW5hbWUnLCBjaGFuZ2VTZXROYW1lXSxcbiAgICBjYXB0dXJlU3RkZXJyOiBmYWxzZSxcbiAgfSk7XG4gIC8vIHZlcmlmeSB0aGF0IHdlIG9ubHkgZGVwbG95ZWQgYSBzaW5nbGUgc3RhY2sgKHRoZXJlJ3MgYSBzaW5nbGUgQVJOIGluIHRoZSBvdXRwdXQpXG4gIGV4cGVjdChzdGFja0Fybi5zcGxpdCgnXFxuJykubGVuZ3RoKS50b0VxdWFsKDEpO1xuXG4gIGNvbnN0IHJlc3BvbnNlID0gYXdhaXQgZml4dHVyZS5hd3MuY2xvdWRGb3JtYXRpb24oJ2Rlc2NyaWJlU3RhY2tzJywge1xuICAgIFN0YWNrTmFtZTogc3RhY2tBcm4sXG4gIH0pO1xuICBleHBlY3QocmVzcG9uc2UuU3RhY2tzPy5bMF0uU3RhY2tTdGF0dXMpLnRvRXF1YWwoJ1JFVklFV19JTl9QUk9HUkVTUycpO1xuXG4gIC8vdmVyaWZ5IGEgY2hhbmdlIHNldCB3YXMgY3JlYXRlZCB3aXRoIHRoZSBwcm92aWRlZCBuYW1lXG4gIGNvbnN0IGNoYW5nZVNldFJlc3BvbnNlID0gYXdhaXQgZml4dHVyZS5hd3MuY2xvdWRGb3JtYXRpb24oJ2xpc3RDaGFuZ2VTZXRzJywge1xuICAgIFN0YWNrTmFtZTogc3RhY2tBcm4sXG4gIH0pO1xuICBjb25zdCBjaGFuZ2VTZXRzID0gY2hhbmdlU2V0UmVzcG9uc2UuU3VtbWFyaWVzIHx8IFtdO1xuICBleHBlY3QoY2hhbmdlU2V0cy5sZW5ndGgpLnRvRXF1YWwoMSk7XG4gIGV4cGVjdChjaGFuZ2VTZXRzWzBdLkNoYW5nZVNldE5hbWUpLnRvRXF1YWwoY2hhbmdlU2V0TmFtZSk7XG4gIGV4cGVjdChjaGFuZ2VTZXRzWzBdLlN0YXR1cykudG9FcXVhbCgnQ1JFQVRFX0NPTVBMRVRFJyk7XG59KSk7XG5cbmludGVnVGVzdCgnc2VjdXJpdHkgcmVsYXRlZCBjaGFuZ2VzIHdpdGhvdXQgYSBDTEkgYXJlIGV4cGVjdGVkIHRvIGZhaWwnLCB3aXRoRGVmYXVsdEZpeHR1cmUoYXN5bmMgKGZpeHR1cmUpID0+IHtcbiAgLy8gcmVkaXJlY3QgL2Rldi9udWxsIHRvIHN0ZGluLCB3aGljaCBtZWFucyB0aGVyZSB3aWxsIG5vdCBiZSB0dHkgYXR0YWNoZWRcbiAgLy8gc2luY2UgdGhpcyBzdGFjayBpbmNsdWRlcyBzZWN1cml0eS1yZWxhdGVkIGNoYW5nZXMsIHRoZSBkZXBsb3ltZW50IHNob3VsZFxuICAvLyBpbW1lZGlhdGVseSBmYWlsIGJlY2F1c2Ugd2UgY2FuJ3QgY29uZmlybSB0aGUgY2hhbmdlc1xuICBjb25zdCBzdGFja05hbWUgPSAnaWFtLXRlc3QnO1xuICBhd2FpdCBleHBlY3QoZml4dHVyZS5jZGtEZXBsb3koc3RhY2tOYW1lLCB7XG4gICAgb3B0aW9uczogWyc8JywgJy9kZXYvbnVsbCddLCAvLyBINHgsIHRoaXMgb25seSB3b3JrcyBiZWNhdXNlIEkgaGFwcGVuIHRvIGtub3cgd2UgcGFzcyBzaGVsbDogdHJ1ZS5cbiAgICBuZXZlclJlcXVpcmVBcHByb3ZhbDogZmFsc2UsXG4gIH0pKS5yZWplY3RzLnRvVGhyb3coJ2V4aXRlZCB3aXRoIGVycm9yJyk7XG5cbiAgLy8gRW5zdXJlIHN0YWNrIHdhcyBub3QgZGVwbG95ZWRcbiAgYXdhaXQgZXhwZWN0KGZpeHR1cmUuYXdzLmNsb3VkRm9ybWF0aW9uKCdkZXNjcmliZVN0YWNrcycsIHtcbiAgICBTdGFja05hbWU6IGZpeHR1cmUuZnVsbFN0YWNrTmFtZShzdGFja05hbWUpLFxuICB9KSkucmVqZWN0cy50b1Rocm93KCdkb2VzIG5vdCBleGlzdCcpO1xufSkpO1xuXG5pbnRlZ1Rlc3QoJ2RlcGxveSB3aWxkY2FyZCB3aXRoIG91dHB1dHMnLCB3aXRoRGVmYXVsdEZpeHR1cmUoYXN5bmMgKGZpeHR1cmUpID0+IHtcbiAgY29uc3Qgb3V0cHV0c0ZpbGUgPSBwYXRoLmpvaW4oZml4dHVyZS5pbnRlZ1Rlc3REaXIsICdvdXRwdXRzJywgJ291dHB1dHMuanNvbicpO1xuICBhd2FpdCBmcy5ta2RpcihwYXRoLmRpcm5hbWUob3V0cHV0c0ZpbGUpLCB7IHJlY3Vyc2l2ZTogdHJ1ZSB9KTtcblxuICBhd2FpdCBmaXh0dXJlLmNka0RlcGxveShbJ291dHB1dHMtdGVzdC0qJ10sIHtcbiAgICBvcHRpb25zOiBbJy0tb3V0cHV0cy1maWxlJywgb3V0cHV0c0ZpbGVdLFxuICB9KTtcblxuICBjb25zdCBvdXRwdXRzID0gSlNPTi5wYXJzZSgoYXdhaXQgZnMucmVhZEZpbGUob3V0cHV0c0ZpbGUsIHsgZW5jb2Rpbmc6ICd1dGYtOCcgfSkpLnRvU3RyaW5nKCkpO1xuICBleHBlY3Qob3V0cHV0cykudG9FcXVhbCh7XG4gICAgW2Ake2ZpeHR1cmUuc3RhY2tOYW1lUHJlZml4fS1vdXRwdXRzLXRlc3QtMWBdOiB7XG4gICAgICBUb3BpY05hbWU6IGAke2ZpeHR1cmUuc3RhY2tOYW1lUHJlZml4fS1vdXRwdXRzLXRlc3QtMU15VG9waWNgLFxuICAgIH0sXG4gICAgW2Ake2ZpeHR1cmUuc3RhY2tOYW1lUHJlZml4fS1vdXRwdXRzLXRlc3QtMmBdOiB7XG4gICAgICBUb3BpY05hbWU6IGAke2ZpeHR1cmUuc3RhY2tOYW1lUHJlZml4fS1vdXRwdXRzLXRlc3QtMk15T3RoZXJUb3BpY2AsXG4gICAgfSxcbiAgfSk7XG59KSk7XG5cbmludGVnVGVzdCgnZGVwbG95IHdpdGggcGFyYW1ldGVycycsIHdpdGhEZWZhdWx0Rml4dHVyZShhc3luYyAoZml4dHVyZSkgPT4ge1xuICBjb25zdCBzdGFja0FybiA9IGF3YWl0IGZpeHR1cmUuY2RrRGVwbG95KCdwYXJhbS10ZXN0LTEnLCB7XG4gICAgb3B0aW9uczogW1xuICAgICAgJy0tcGFyYW1ldGVycycsIGBUb3BpY05hbWVQYXJhbT0ke2ZpeHR1cmUuc3RhY2tOYW1lUHJlZml4fWJhemluZ2FgLFxuICAgIF0sXG4gICAgY2FwdHVyZVN0ZGVycjogZmFsc2UsXG4gIH0pO1xuXG4gIGNvbnN0IHJlc3BvbnNlID0gYXdhaXQgZml4dHVyZS5hd3MuY2xvdWRGb3JtYXRpb24oJ2Rlc2NyaWJlU3RhY2tzJywge1xuICAgIFN0YWNrTmFtZTogc3RhY2tBcm4sXG4gIH0pO1xuXG4gIGV4cGVjdChyZXNwb25zZS5TdGFja3M/LlswXS5QYXJhbWV0ZXJzKS50b0VxdWFsKFtcbiAgICB7XG4gICAgICBQYXJhbWV0ZXJLZXk6ICdUb3BpY05hbWVQYXJhbScsXG4gICAgICBQYXJhbWV0ZXJWYWx1ZTogYCR7Zml4dHVyZS5zdGFja05hbWVQcmVmaXh9YmF6aW5nYWAsXG4gICAgfSxcbiAgXSk7XG59KSk7XG5cbmludGVnVGVzdCgndXBkYXRlIHRvIHN0YWNrIGluIFJPTExCQUNLX0NPTVBMRVRFIHN0YXRlIHdpbGwgZGVsZXRlIHN0YWNrIGFuZCBjcmVhdGUgYSBuZXcgb25lJywgd2l0aERlZmF1bHRGaXh0dXJlKGFzeW5jIChmaXh0dXJlKSA9PiB7XG4gIC8vIEdJVkVOXG4gIGF3YWl0IGV4cGVjdChmaXh0dXJlLmNka0RlcGxveSgncGFyYW0tdGVzdC0xJywge1xuICAgIG9wdGlvbnM6IFtcbiAgICAgICctLXBhcmFtZXRlcnMnLCBgVG9waWNOYW1lUGFyYW09JHtmaXh0dXJlLnN0YWNrTmFtZVByZWZpeH1AYXd3YCxcbiAgICBdLFxuICAgIGNhcHR1cmVTdGRlcnI6IGZhbHNlLFxuICB9KSkucmVqZWN0cy50b1Rocm93KCdleGl0ZWQgd2l0aCBlcnJvcicpO1xuXG4gIGNvbnN0IHJlc3BvbnNlID0gYXdhaXQgZml4dHVyZS5hd3MuY2xvdWRGb3JtYXRpb24oJ2Rlc2NyaWJlU3RhY2tzJywge1xuICAgIFN0YWNrTmFtZTogZml4dHVyZS5mdWxsU3RhY2tOYW1lKCdwYXJhbS10ZXN0LTEnKSxcbiAgfSk7XG5cbiAgY29uc3Qgc3RhY2tBcm4gPSByZXNwb25zZS5TdGFja3M/LlswXS5TdGFja0lkO1xuICBleHBlY3QocmVzcG9uc2UuU3RhY2tzPy5bMF0uU3RhY2tTdGF0dXMpLnRvRXF1YWwoJ1JPTExCQUNLX0NPTVBMRVRFJyk7XG5cbiAgLy8gV0hFTlxuICBjb25zdCBuZXdTdGFja0FybiA9IGF3YWl0IGZpeHR1cmUuY2RrRGVwbG95KCdwYXJhbS10ZXN0LTEnLCB7XG4gICAgb3B0aW9uczogW1xuICAgICAgJy0tcGFyYW1ldGVycycsIGBUb3BpY05hbWVQYXJhbT0ke2ZpeHR1cmUuc3RhY2tOYW1lUHJlZml4fWFsbGdvb2RgLFxuICAgIF0sXG4gICAgY2FwdHVyZVN0ZGVycjogZmFsc2UsXG4gIH0pO1xuXG4gIGNvbnN0IG5ld1N0YWNrUmVzcG9uc2UgPSBhd2FpdCBmaXh0dXJlLmF3cy5jbG91ZEZvcm1hdGlvbignZGVzY3JpYmVTdGFja3MnLCB7XG4gICAgU3RhY2tOYW1lOiBuZXdTdGFja0FybixcbiAgfSk7XG5cbiAgLy8gVEhFTlxuICBleHBlY3QgKHN0YWNrQXJuKS5ub3QudG9FcXVhbChuZXdTdGFja0Fybik7IC8vIG5ldyBzdGFjayB3YXMgY3JlYXRlZFxuICBleHBlY3QobmV3U3RhY2tSZXNwb25zZS5TdGFja3M/LlswXS5TdGFja1N0YXR1cykudG9FcXVhbCgnQ1JFQVRFX0NPTVBMRVRFJyk7XG4gIGV4cGVjdChuZXdTdGFja1Jlc3BvbnNlLlN0YWNrcz8uWzBdLlBhcmFtZXRlcnMpLnRvRXF1YWwoW1xuICAgIHtcbiAgICAgIFBhcmFtZXRlcktleTogJ1RvcGljTmFtZVBhcmFtJyxcbiAgICAgIFBhcmFtZXRlclZhbHVlOiBgJHtmaXh0dXJlLnN0YWNrTmFtZVByZWZpeH1hbGxnb29kYCxcbiAgICB9LFxuICBdKTtcbn0pKTtcblxuaW50ZWdUZXN0KCdzdGFjayBpbiBVUERBVEVfUk9MTEJBQ0tfQ09NUExFVEUgc3RhdGUgY2FuIGJlIHVwZGF0ZWQnLCB3aXRoRGVmYXVsdEZpeHR1cmUoYXN5bmMgKGZpeHR1cmUpID0+IHtcbiAgLy8gR0lWRU5cbiAgY29uc3Qgc3RhY2tBcm4gPSBhd2FpdCBmaXh0dXJlLmNka0RlcGxveSgncGFyYW0tdGVzdC0xJywge1xuICAgIG9wdGlvbnM6IFtcbiAgICAgICctLXBhcmFtZXRlcnMnLCBgVG9waWNOYW1lUGFyYW09JHtmaXh0dXJlLnN0YWNrTmFtZVByZWZpeH1uaWNlYCxcbiAgICBdLFxuICAgIGNhcHR1cmVTdGRlcnI6IGZhbHNlLFxuICB9KTtcblxuICBsZXQgcmVzcG9uc2UgPSBhd2FpdCBmaXh0dXJlLmF3cy5jbG91ZEZvcm1hdGlvbignZGVzY3JpYmVTdGFja3MnLCB7XG4gICAgU3RhY2tOYW1lOiBzdGFja0FybixcbiAgfSk7XG5cbiAgZXhwZWN0KHJlc3BvbnNlLlN0YWNrcz8uWzBdLlN0YWNrU3RhdHVzKS50b0VxdWFsKCdDUkVBVEVfQ09NUExFVEUnKTtcblxuICAvLyBiYWQgcGFyYW1ldGVyIG5hbWUgd2l0aCBAIHdpbGwgcHV0IHN0YWNrIGludG8gVVBEQVRFX1JPTExCQUNLX0NPTVBMRVRFXG4gIGF3YWl0IGV4cGVjdChmaXh0dXJlLmNka0RlcGxveSgncGFyYW0tdGVzdC0xJywge1xuICAgIG9wdGlvbnM6IFtcbiAgICAgICctLXBhcmFtZXRlcnMnLCBgVG9waWNOYW1lUGFyYW09JHtmaXh0dXJlLnN0YWNrTmFtZVByZWZpeH1AYXd3YCxcbiAgICBdLFxuICAgIGNhcHR1cmVTdGRlcnI6IGZhbHNlLFxuICB9KSkucmVqZWN0cy50b1Rocm93KCdleGl0ZWQgd2l0aCBlcnJvcicpOztcblxuICByZXNwb25zZSA9IGF3YWl0IGZpeHR1cmUuYXdzLmNsb3VkRm9ybWF0aW9uKCdkZXNjcmliZVN0YWNrcycsIHtcbiAgICBTdGFja05hbWU6IHN0YWNrQXJuLFxuICB9KTtcblxuICBleHBlY3QocmVzcG9uc2UuU3RhY2tzPy5bMF0uU3RhY2tTdGF0dXMpLnRvRXF1YWwoJ1VQREFURV9ST0xMQkFDS19DT01QTEVURScpO1xuXG4gIC8vIFdIRU5cbiAgYXdhaXQgZml4dHVyZS5jZGtEZXBsb3koJ3BhcmFtLXRlc3QtMScsIHtcbiAgICBvcHRpb25zOiBbXG4gICAgICAnLS1wYXJhbWV0ZXJzJywgYFRvcGljTmFtZVBhcmFtPSR7Zml4dHVyZS5zdGFja05hbWVQcmVmaXh9YWxsZ29vZGAsXG4gICAgXSxcbiAgICBjYXB0dXJlU3RkZXJyOiBmYWxzZSxcbiAgfSk7XG5cbiAgcmVzcG9uc2UgPSBhd2FpdCBmaXh0dXJlLmF3cy5jbG91ZEZvcm1hdGlvbignZGVzY3JpYmVTdGFja3MnLCB7XG4gICAgU3RhY2tOYW1lOiBzdGFja0FybixcbiAgfSk7XG5cbiAgLy8gVEhFTlxuICBleHBlY3QocmVzcG9uc2UuU3RhY2tzPy5bMF0uU3RhY2tTdGF0dXMpLnRvRXF1YWwoJ1VQREFURV9DT01QTEVURScpO1xuICBleHBlY3QocmVzcG9uc2UuU3RhY2tzPy5bMF0uUGFyYW1ldGVycykudG9FcXVhbChbXG4gICAge1xuICAgICAgUGFyYW1ldGVyS2V5OiAnVG9waWNOYW1lUGFyYW0nLFxuICAgICAgUGFyYW1ldGVyVmFsdWU6IGAke2ZpeHR1cmUuc3RhY2tOYW1lUHJlZml4fWFsbGdvb2RgLFxuICAgIH0sXG4gIF0pO1xufSkpO1xuXG5pbnRlZ1Rlc3QoJ2RlcGxveSB3aXRoIHdpbGRjYXJkIGFuZCBwYXJhbWV0ZXJzJywgd2l0aERlZmF1bHRGaXh0dXJlKGFzeW5jIChmaXh0dXJlKSA9PiB7XG4gIGF3YWl0IGZpeHR1cmUuY2RrRGVwbG95KCdwYXJhbS10ZXN0LSonLCB7XG4gICAgb3B0aW9uczogW1xuICAgICAgJy0tcGFyYW1ldGVycycsIGAke2ZpeHR1cmUuc3RhY2tOYW1lUHJlZml4fS1wYXJhbS10ZXN0LTE6VG9waWNOYW1lUGFyYW09JHtmaXh0dXJlLnN0YWNrTmFtZVByZWZpeH1iYXppbmdhYCxcbiAgICAgICctLXBhcmFtZXRlcnMnLCBgJHtmaXh0dXJlLnN0YWNrTmFtZVByZWZpeH0tcGFyYW0tdGVzdC0yOk90aGVyVG9waWNOYW1lUGFyYW09JHtmaXh0dXJlLnN0YWNrTmFtZVByZWZpeH1UaGF0c015U3BvdGAsXG4gICAgICAnLS1wYXJhbWV0ZXJzJywgYCR7Zml4dHVyZS5zdGFja05hbWVQcmVmaXh9LXBhcmFtLXRlc3QtMzpEaXNwbGF5TmFtZVBhcmFtPSR7Zml4dHVyZS5zdGFja05hbWVQcmVmaXh9SGV5VGhlcmVgLFxuICAgICAgJy0tcGFyYW1ldGVycycsIGAke2ZpeHR1cmUuc3RhY2tOYW1lUHJlZml4fS1wYXJhbS10ZXN0LTM6T3RoZXJEaXNwbGF5TmFtZVBhcmFtPSR7Zml4dHVyZS5zdGFja05hbWVQcmVmaXh9QW5vdGhlck9uZWAsXG4gICAgXSxcbiAgfSk7XG59KSk7XG5cbmludGVnVGVzdCgnZGVwbG95IHdpdGggcGFyYW1ldGVycyBtdWx0aScsIHdpdGhEZWZhdWx0Rml4dHVyZShhc3luYyAoZml4dHVyZSkgPT4ge1xuICBjb25zdCBwYXJhbVZhbDEgPSBgJHtmaXh0dXJlLnN0YWNrTmFtZVByZWZpeH1iYXppbmdhYDtcbiAgY29uc3QgcGFyYW1WYWwyID0gYCR7Zml4dHVyZS5zdGFja05hbWVQcmVmaXh9PWphZ3NoZW1hc2hgO1xuXG4gIGNvbnN0IHN0YWNrQXJuID0gYXdhaXQgZml4dHVyZS5jZGtEZXBsb3koJ3BhcmFtLXRlc3QtMycsIHtcbiAgICBvcHRpb25zOiBbXG4gICAgICAnLS1wYXJhbWV0ZXJzJywgYERpc3BsYXlOYW1lUGFyYW09JHtwYXJhbVZhbDF9YCxcbiAgICAgICctLXBhcmFtZXRlcnMnLCBgT3RoZXJEaXNwbGF5TmFtZVBhcmFtPSR7cGFyYW1WYWwyfWAsXG4gICAgXSxcbiAgICBjYXB0dXJlU3RkZXJyOiBmYWxzZSxcbiAgfSk7XG5cbiAgY29uc3QgcmVzcG9uc2UgPSBhd2FpdCBmaXh0dXJlLmF3cy5jbG91ZEZvcm1hdGlvbignZGVzY3JpYmVTdGFja3MnLCB7XG4gICAgU3RhY2tOYW1lOiBzdGFja0FybixcbiAgfSk7XG5cbiAgZXhwZWN0KHJlc3BvbnNlLlN0YWNrcz8uWzBdLlBhcmFtZXRlcnMpLnRvRXF1YWwoW1xuICAgIHtcbiAgICAgIFBhcmFtZXRlcktleTogJ0Rpc3BsYXlOYW1lUGFyYW0nLFxuICAgICAgUGFyYW1ldGVyVmFsdWU6IHBhcmFtVmFsMSxcbiAgICB9LFxuICAgIHtcbiAgICAgIFBhcmFtZXRlcktleTogJ090aGVyRGlzcGxheU5hbWVQYXJhbScsXG4gICAgICBQYXJhbWV0ZXJWYWx1ZTogcGFyYW1WYWwyLFxuICAgIH0sXG4gIF0pO1xufSkpO1xuXG5pbnRlZ1Rlc3QoJ2RlcGxveSB3aXRoIG5vdGlmaWNhdGlvbiBBUk4nLCB3aXRoRGVmYXVsdEZpeHR1cmUoYXN5bmMgKGZpeHR1cmUpID0+IHtcbiAgY29uc3QgdG9waWNOYW1lID0gYCR7Zml4dHVyZS5zdGFja05hbWVQcmVmaXh9LXRlc3QtdG9waWNgO1xuXG4gIGNvbnN0IHJlc3BvbnNlID0gYXdhaXQgZml4dHVyZS5hd3Muc25zKCdjcmVhdGVUb3BpYycsIHsgTmFtZTogdG9waWNOYW1lIH0pO1xuICBjb25zdCB0b3BpY0FybiA9IHJlc3BvbnNlLlRvcGljQXJuITtcbiAgdHJ5IHtcbiAgICBhd2FpdCBmaXh0dXJlLmNka0RlcGxveSgndGVzdC0yJywge1xuICAgICAgb3B0aW9uczogWyctLW5vdGlmaWNhdGlvbi1hcm5zJywgdG9waWNBcm5dLFxuICAgIH0pO1xuXG4gICAgLy8gdmVyaWZ5IHRoYXQgdGhlIHN0YWNrIHdlIGRlcGxveWVkIGhhcyBvdXIgbm90aWZpY2F0aW9uIEFSTlxuICAgIGNvbnN0IGRlc2NyaWJlUmVzcG9uc2UgPSBhd2FpdCBmaXh0dXJlLmF3cy5jbG91ZEZvcm1hdGlvbignZGVzY3JpYmVTdGFja3MnLCB7XG4gICAgICBTdGFja05hbWU6IGZpeHR1cmUuZnVsbFN0YWNrTmFtZSgndGVzdC0yJyksXG4gICAgfSk7XG4gICAgZXhwZWN0KGRlc2NyaWJlUmVzcG9uc2UuU3RhY2tzPy5bMF0uTm90aWZpY2F0aW9uQVJOcykudG9FcXVhbChbdG9waWNBcm5dKTtcbiAgfSBmaW5hbGx5IHtcbiAgICBhd2FpdCBmaXh0dXJlLmF3cy5zbnMoJ2RlbGV0ZVRvcGljJywge1xuICAgICAgVG9waWNBcm46IHRvcGljQXJuLFxuICAgIH0pO1xuICB9XG59KSk7XG5cbmludGVnVGVzdCgnZGVwbG95IHdpdGggcm9sZScsIHdpdGhEZWZhdWx0Rml4dHVyZShhc3luYyAoZml4dHVyZSkgPT4ge1xuICBjb25zdCByb2xlTmFtZSA9IGAke2ZpeHR1cmUuc3RhY2tOYW1lUHJlZml4fS10ZXN0LXJvbGVgO1xuXG4gIGF3YWl0IGRlbGV0ZVJvbGUoKTtcblxuICBjb25zdCBjcmVhdGVSZXNwb25zZSA9IGF3YWl0IGZpeHR1cmUuYXdzLmlhbSgnY3JlYXRlUm9sZScsIHtcbiAgICBSb2xlTmFtZTogcm9sZU5hbWUsXG4gICAgQXNzdW1lUm9sZVBvbGljeURvY3VtZW50OiBKU09OLnN0cmluZ2lmeSh7XG4gICAgICBWZXJzaW9uOiAnMjAxMi0xMC0xNycsXG4gICAgICBTdGF0ZW1lbnQ6IFt7XG4gICAgICAgIEFjdGlvbjogJ3N0czpBc3N1bWVSb2xlJyxcbiAgICAgICAgUHJpbmNpcGFsOiB7IFNlcnZpY2U6ICdjbG91ZGZvcm1hdGlvbi5hbWF6b25hd3MuY29tJyB9LFxuICAgICAgICBFZmZlY3Q6ICdBbGxvdycsXG4gICAgICB9LCB7XG4gICAgICAgIEFjdGlvbjogJ3N0czpBc3N1bWVSb2xlJyxcbiAgICAgICAgUHJpbmNpcGFsOiB7IEFXUzogKGF3YWl0IGZpeHR1cmUuYXdzLnN0cygnZ2V0Q2FsbGVySWRlbnRpdHknLCB7fSkpLkFybiB9LFxuICAgICAgICBFZmZlY3Q6ICdBbGxvdycsXG4gICAgICB9XSxcbiAgICB9KSxcbiAgfSk7XG4gIGNvbnN0IHJvbGVBcm4gPSBjcmVhdGVSZXNwb25zZS5Sb2xlLkFybjtcbiAgdHJ5IHtcbiAgICBhd2FpdCBmaXh0dXJlLmF3cy5pYW0oJ3B1dFJvbGVQb2xpY3knLCB7XG4gICAgICBSb2xlTmFtZTogcm9sZU5hbWUsXG4gICAgICBQb2xpY3lOYW1lOiAnRGVmYXVsdFBvbGljeScsXG4gICAgICBQb2xpY3lEb2N1bWVudDogSlNPTi5zdHJpbmdpZnkoe1xuICAgICAgICBWZXJzaW9uOiAnMjAxMi0xMC0xNycsXG4gICAgICAgIFN0YXRlbWVudDogW3tcbiAgICAgICAgICBBY3Rpb246ICcqJyxcbiAgICAgICAgICBSZXNvdXJjZTogJyonLFxuICAgICAgICAgIEVmZmVjdDogJ0FsbG93JyxcbiAgICAgICAgfV0sXG4gICAgICB9KSxcbiAgICB9KTtcblxuICAgIGF3YWl0IHJldHJ5KGZpeHR1cmUub3V0cHV0LCAnVHJ5aW5nIHRvIGFzc3VtZSBmcmVzaCByb2xlJywgcmV0cnkuZm9yU2Vjb25kcygzMDApLCBhc3luYyAoKSA9PiB7XG4gICAgICBhd2FpdCBmaXh0dXJlLmF3cy5zdHMoJ2Fzc3VtZVJvbGUnLCB7XG4gICAgICAgIFJvbGVBcm46IHJvbGVBcm4sXG4gICAgICAgIFJvbGVTZXNzaW9uTmFtZTogJ3Rlc3RpbmcnLFxuICAgICAgfSk7XG4gICAgfSk7XG5cbiAgICAvLyBJbiBwcmluY2lwbGUsIHRoZSByb2xlIGhhcyByZXBsaWNhdGVkIGZyb20gJ3VzLWVhc3QtMScgdG8gd2hlcmV2ZXIgd2UncmUgdGVzdGluZy5cbiAgICAvLyBHaXZlIGl0IGEgbGl0dGxlIG1vcmUgc2xlZXAgdG8gbWFrZSBzdXJlIENsb3VkRm9ybWF0aW9uIGlzIG5vdCBoaXR0aW5nIGEgYm94XG4gICAgLy8gdGhhdCBkb2Vzbid0IGhhdmUgaXQgeWV0LlxuICAgIGF3YWl0IHNsZWVwKDUwMDApO1xuXG4gICAgYXdhaXQgZml4dHVyZS5jZGtEZXBsb3koJ3Rlc3QtMicsIHtcbiAgICAgIG9wdGlvbnM6IFsnLS1yb2xlLWFybicsIHJvbGVBcm5dLFxuICAgIH0pO1xuXG4gICAgLy8gSW1tZWRpYXRlbHkgZGVsZXRlIHRoZSBzdGFjayBhZ2FpbiBiZWZvcmUgd2UgZGVsZXRlIHRoZSByb2xlLlxuICAgIC8vXG4gICAgLy8gU2luY2Ugcm9sZXMgYXJlIHN0aWNreSwgaWYgd2UgZGVsZXRlIHRoZSByb2xlIGJlZm9yZSB0aGUgc3RhY2ssIHN1YnNlcXVlbnQgRGVsZXRlU3RhY2tcbiAgICAvLyBvcGVyYXRpb25zIHdpbGwgZmFpbCB3aGVuIENsb3VkRm9ybWF0aW9uIHRyaWVzIHRvIGFzc3VtZSB0aGUgcm9sZSB0aGF0J3MgYWxyZWFkeSBnb25lLlxuICAgIGF3YWl0IGZpeHR1cmUuY2RrRGVzdHJveSgndGVzdC0yJyk7XG5cbiAgfSBmaW5hbGx5IHtcbiAgICBhd2FpdCBkZWxldGVSb2xlKCk7XG4gIH1cblxuICBhc3luYyBmdW5jdGlvbiBkZWxldGVSb2xlKCkge1xuICAgIHRyeSB7XG4gICAgICBmb3IgKGNvbnN0IHBvbGljeU5hbWUgb2YgKGF3YWl0IGZpeHR1cmUuYXdzLmlhbSgnbGlzdFJvbGVQb2xpY2llcycsIHsgUm9sZU5hbWU6IHJvbGVOYW1lIH0pKS5Qb2xpY3lOYW1lcykge1xuICAgICAgICBhd2FpdCBmaXh0dXJlLmF3cy5pYW0oJ2RlbGV0ZVJvbGVQb2xpY3knLCB7XG4gICAgICAgICAgUm9sZU5hbWU6IHJvbGVOYW1lLFxuICAgICAgICAgIFBvbGljeU5hbWU6IHBvbGljeU5hbWUsXG4gICAgICAgIH0pO1xuICAgICAgfVxuICAgICAgYXdhaXQgZml4dHVyZS5hd3MuaWFtKCdkZWxldGVSb2xlJywgeyBSb2xlTmFtZTogcm9sZU5hbWUgfSk7XG4gICAgfSBjYXRjaCAoZSkge1xuICAgICAgaWYgKGUubWVzc2FnZS5pbmRleE9mKCdjYW5ub3QgYmUgZm91bmQnKSA+IC0xKSB7IHJldHVybjsgfVxuICAgICAgdGhyb3cgZTtcbiAgICB9XG4gIH1cbn0pKTtcblxuaW50ZWdUZXN0KCdjZGsgZGlmZicsIHdpdGhEZWZhdWx0Rml4dHVyZShhc3luYyAoZml4dHVyZSkgPT4ge1xuICBjb25zdCBkaWZmMSA9IGF3YWl0IGZpeHR1cmUuY2RrKFsnZGlmZicsIGZpeHR1cmUuZnVsbFN0YWNrTmFtZSgndGVzdC0xJyldKTtcbiAgZXhwZWN0KGRpZmYxKS50b0NvbnRhaW4oJ0FXUzo6U05TOjpUb3BpYycpO1xuXG4gIGNvbnN0IGRpZmYyID0gYXdhaXQgZml4dHVyZS5jZGsoWydkaWZmJywgZml4dHVyZS5mdWxsU3RhY2tOYW1lKCd0ZXN0LTInKV0pO1xuICBleHBlY3QoZGlmZjIpLnRvQ29udGFpbignQVdTOjpTTlM6OlRvcGljJyk7XG5cbiAgLy8gV2UgY2FuIG1ha2UgaXQgZmFpbCBieSBwYXNzaW5nIC0tZmFpbFxuICBhd2FpdCBleHBlY3QoZml4dHVyZS5jZGsoWydkaWZmJywgJy0tZmFpbCcsIGZpeHR1cmUuZnVsbFN0YWNrTmFtZSgndGVzdC0xJyldKSlcbiAgICAucmVqZWN0cy50b1Rocm93KCdleGl0ZWQgd2l0aCBlcnJvcicpO1xufSkpO1xuXG5pbnRlZ1Rlc3QoJ2NkayBkaWZmIC0tZmFpbCBvbiBtdWx0aXBsZSBzdGFja3MgZXhpdHMgd2l0aCBlcnJvciBpZiBhbnkgb2YgdGhlIHN0YWNrcyBjb250YWlucyBhIGRpZmYnLCB3aXRoRGVmYXVsdEZpeHR1cmUoYXN5bmMgKGZpeHR1cmUpID0+IHtcbiAgLy8gR0lWRU5cbiAgY29uc3QgZGlmZjEgPSBhd2FpdCBmaXh0dXJlLmNkayhbJ2RpZmYnLCBmaXh0dXJlLmZ1bGxTdGFja05hbWUoJ3Rlc3QtMScpXSk7XG4gIGV4cGVjdChkaWZmMSkudG9Db250YWluKCdBV1M6OlNOUzo6VG9waWMnKTtcblxuICBhd2FpdCBmaXh0dXJlLmNka0RlcGxveSgndGVzdC0yJyk7XG4gIGNvbnN0IGRpZmYyID0gYXdhaXQgZml4dHVyZS5jZGsoWydkaWZmJywgZml4dHVyZS5mdWxsU3RhY2tOYW1lKCd0ZXN0LTInKV0pO1xuICBleHBlY3QoZGlmZjIpLnRvQ29udGFpbignVGhlcmUgd2VyZSBubyBkaWZmZXJlbmNlcycpO1xuXG4gIC8vIFdIRU4gLyBUSEVOXG4gIGF3YWl0IGV4cGVjdChmaXh0dXJlLmNkayhbJ2RpZmYnLCAnLS1mYWlsJywgZml4dHVyZS5mdWxsU3RhY2tOYW1lKCd0ZXN0LTEnKSwgZml4dHVyZS5mdWxsU3RhY2tOYW1lKCd0ZXN0LTInKV0pKS5yZWplY3RzLnRvVGhyb3coJ2V4aXRlZCB3aXRoIGVycm9yJyk7XG59KSk7XG5cbmludGVnVGVzdCgnY2RrIGRpZmYgLS1mYWlsIHdpdGggbXVsdGlwbGUgc3RhY2sgZXhpdHMgd2l0aCBpZiBhbnkgb2YgdGhlIHN0YWNrcyBjb250YWlucyBhIGRpZmYnLCB3aXRoRGVmYXVsdEZpeHR1cmUoYXN5bmMgKGZpeHR1cmUpID0+IHtcbiAgLy8gR0lWRU5cbiAgYXdhaXQgZml4dHVyZS5jZGtEZXBsb3koJ3Rlc3QtMScpO1xuICBjb25zdCBkaWZmMSA9IGF3YWl0IGZpeHR1cmUuY2RrKFsnZGlmZicsIGZpeHR1cmUuZnVsbFN0YWNrTmFtZSgndGVzdC0xJyldKTtcbiAgZXhwZWN0KGRpZmYxKS50b0NvbnRhaW4oJ1RoZXJlIHdlcmUgbm8gZGlmZmVyZW5jZXMnKTtcblxuICBjb25zdCBkaWZmMiA9IGF3YWl0IGZpeHR1cmUuY2RrKFsnZGlmZicsIGZpeHR1cmUuZnVsbFN0YWNrTmFtZSgndGVzdC0yJyldKTtcbiAgZXhwZWN0KGRpZmYyKS50b0NvbnRhaW4oJ0FXUzo6U05TOjpUb3BpYycpO1xuXG4gIC8vIFdIRU4gLyBUSEVOXG4gIGF3YWl0IGV4cGVjdChmaXh0dXJlLmNkayhbJ2RpZmYnLCAnLS1mYWlsJywgZml4dHVyZS5mdWxsU3RhY2tOYW1lKCd0ZXN0LTEnKSwgZml4dHVyZS5mdWxsU3RhY2tOYW1lKCd0ZXN0LTInKV0pKS5yZWplY3RzLnRvVGhyb3coJ2V4aXRlZCB3aXRoIGVycm9yJyk7XG59KSk7XG5cbmludGVnVGVzdCgnY2RrIGRpZmYgLS1zZWN1cml0eS1vbmx5IC0tZmFpbCBleGl0cyB3aGVuIHNlY3VyaXR5IGNoYW5nZXMgYXJlIHByZXNlbnQnLCB3aXRoRGVmYXVsdEZpeHR1cmUoYXN5bmMgKGZpeHR1cmUpID0+IHtcbiAgY29uc3Qgc3RhY2tOYW1lID0gJ2lhbS10ZXN0JztcbiAgYXdhaXQgZXhwZWN0KGZpeHR1cmUuY2RrKFsnZGlmZicsICctLXNlY3VyaXR5LW9ubHknLCAnLS1mYWlsJywgZml4dHVyZS5mdWxsU3RhY2tOYW1lKHN0YWNrTmFtZSldKSkucmVqZWN0cy50b1Rocm93KCdleGl0ZWQgd2l0aCBlcnJvcicpO1xufSkpO1xuXG5pbnRlZ1Rlc3QoJ2RlcGxveSBzdGFjayB3aXRoIGRvY2tlciBhc3NldCcsIHdpdGhEZWZhdWx0Rml4dHVyZShhc3luYyAoZml4dHVyZSkgPT4ge1xuICBhd2FpdCBmaXh0dXJlLmNka0RlcGxveSgnZG9ja2VyJyk7XG59KSk7XG5cbmludGVnVGVzdCgnZGVwbG95IGFuZCB0ZXN0IHN0YWNrIHdpdGggbGFtYmRhIGFzc2V0Jywgd2l0aERlZmF1bHRGaXh0dXJlKGFzeW5jIChmaXh0dXJlKSA9PiB7XG4gIGNvbnN0IHN0YWNrQXJuID0gYXdhaXQgZml4dHVyZS5jZGtEZXBsb3koJ2xhbWJkYScsIHsgY2FwdHVyZVN0ZGVycjogZmFsc2UgfSk7XG5cbiAgY29uc3QgcmVzcG9uc2UgPSBhd2FpdCBmaXh0dXJlLmF3cy5jbG91ZEZvcm1hdGlvbignZGVzY3JpYmVTdGFja3MnLCB7XG4gICAgU3RhY2tOYW1lOiBzdGFja0FybixcbiAgfSk7XG4gIGNvbnN0IGxhbWJkYUFybiA9IHJlc3BvbnNlLlN0YWNrcz8uWzBdLk91dHB1dHM/LlswXS5PdXRwdXRWYWx1ZTtcbiAgaWYgKGxhbWJkYUFybiA9PT0gdW5kZWZpbmVkKSB7XG4gICAgdGhyb3cgbmV3IEVycm9yKCdTdGFjayBkaWQgbm90IGhhdmUgZXhwZWN0ZWQgTGFtYmRhIEFSTiBvdXRwdXQnKTtcbiAgfVxuXG4gIGNvbnN0IG91dHB1dCA9IGF3YWl0IGZpeHR1cmUuYXdzLmxhbWJkYSgnaW52b2tlJywge1xuICAgIEZ1bmN0aW9uTmFtZTogbGFtYmRhQXJuLFxuICB9KTtcblxuICBleHBlY3QoSlNPTi5zdHJpbmdpZnkob3V0cHV0LlBheWxvYWQpKS50b0NvbnRhaW4oJ2RlYXIgYXNzZXQnKTtcbn0pKTtcblxuaW50ZWdUZXN0KCdjZGsgbHMnLCB3aXRoRGVmYXVsdEZpeHR1cmUoYXN5bmMgKGZpeHR1cmUpID0+IHtcbiAgY29uc3QgbGlzdGluZyA9IGF3YWl0IGZpeHR1cmUuY2RrKFsnbHMnXSwgeyBjYXB0dXJlU3RkZXJyOiBmYWxzZSB9KTtcblxuICBjb25zdCBleHBlY3RlZFN0YWNrcyA9IFtcbiAgICAnY29uZGl0aW9uYWwtcmVzb3VyY2UnLFxuICAgICdkb2NrZXInLFxuICAgICdkb2NrZXItd2l0aC1jdXN0b20tZmlsZScsXG4gICAgJ2ZhaWxlZCcsXG4gICAgJ2lhbS10ZXN0JyxcbiAgICAnbGFtYmRhJyxcbiAgICAnbWlzc2luZy1zc20tcGFyYW1ldGVyJyxcbiAgICAnb3JkZXItcHJvdmlkaW5nJyxcbiAgICAnb3V0cHV0cy10ZXN0LTEnLFxuICAgICdvdXRwdXRzLXRlc3QtMicsXG4gICAgJ3BhcmFtLXRlc3QtMScsXG4gICAgJ3BhcmFtLXRlc3QtMicsXG4gICAgJ3BhcmFtLXRlc3QtMycsXG4gICAgJ3Rlcm1pbmF0aW9uLXByb3RlY3Rpb24nLFxuICAgICd0ZXN0LTEnLFxuICAgICd0ZXN0LTInLFxuICAgICd3aXRoLW5lc3RlZC1zdGFjaycsXG4gICAgJ3dpdGgtbmVzdGVkLXN0YWNrLXVzaW5nLXBhcmFtZXRlcnMnLFxuICAgICdvcmRlci1jb25zdW1pbmcnLFxuICBdO1xuXG4gIGZvciAoY29uc3Qgc3RhY2sgb2YgZXhwZWN0ZWRTdGFja3MpIHtcbiAgICBleHBlY3QobGlzdGluZykudG9Db250YWluKGZpeHR1cmUuZnVsbFN0YWNrTmFtZShzdGFjaykpO1xuICB9XG59KSk7XG5cbmludGVnVGVzdCgnc3ludGhpbmcgYSBzdGFnZSB3aXRoIGVycm9ycyBsZWFkcyB0byBmYWlsdXJlJywgd2l0aERlZmF1bHRGaXh0dXJlKGFzeW5jIChmaXh0dXJlKSA9PiB7XG4gIGNvbnN0IG91dHB1dCA9IGF3YWl0IGZpeHR1cmUuY2RrKFsnc3ludGgnXSwge1xuICAgIGFsbG93RXJyRXhpdDogdHJ1ZSxcbiAgICBtb2RFbnY6IHtcbiAgICAgIElOVEVHX1NUQUNLX1NFVDogJ3N0YWdlLXdpdGgtZXJyb3JzJyxcbiAgICB9LFxuICB9KTtcblxuICBleHBlY3Qob3V0cHV0KS50b0NvbnRhaW4oJ1RoaXMgaXMgYW4gZXJyb3InKTtcbn0pKTtcblxuaW50ZWdUZXN0KCdzeW50aGluZyBhIHN0YWdlIHdpdGggZXJyb3JzIGNhbiBiZSBzdXBwcmVzc2VkJywgd2l0aERlZmF1bHRGaXh0dXJlKGFzeW5jIChmaXh0dXJlKSA9PiB7XG4gIGF3YWl0IGZpeHR1cmUuY2RrKFsnc3ludGgnLCAnLS1uby12YWxpZGF0aW9uJ10sIHtcbiAgICBtb2RFbnY6IHtcbiAgICAgIElOVEVHX1NUQUNLX1NFVDogJ3N0YWdlLXdpdGgtZXJyb3JzJyxcbiAgICB9LFxuICB9KTtcbn0pKTtcblxuaW50ZWdUZXN0KCdkZXBsb3kgc3RhY2sgd2l0aG91dCByZXNvdXJjZScsIHdpdGhEZWZhdWx0Rml4dHVyZShhc3luYyAoZml4dHVyZSkgPT4ge1xuICAvLyBEZXBsb3kgdGhlIHN0YWNrIHdpdGhvdXQgcmVzb3VyY2VzXG4gIGF3YWl0IGZpeHR1cmUuY2RrRGVwbG95KCdjb25kaXRpb25hbC1yZXNvdXJjZScsIHsgbW9kRW52OiB7IE5PX1JFU09VUkNFOiAnVFJVRScgfSB9KTtcblxuICAvLyBUaGlzIHNob3VsZCBoYXZlIHN1Y2NlZWRlZCBidXQgbm90IGRlcGxveWVkIHRoZSBzdGFjay5cbiAgYXdhaXQgZXhwZWN0KGZpeHR1cmUuYXdzLmNsb3VkRm9ybWF0aW9uKCdkZXNjcmliZVN0YWNrcycsIHsgU3RhY2tOYW1lOiBmaXh0dXJlLmZ1bGxTdGFja05hbWUoJ2NvbmRpdGlvbmFsLXJlc291cmNlJykgfSkpXG4gICAgLnJlamVjdHMudG9UaHJvdygnY29uZGl0aW9uYWwtcmVzb3VyY2UgZG9lcyBub3QgZXhpc3QnKTtcblxuICAvLyBEZXBsb3kgdGhlIHN0YWNrIHdpdGggcmVzb3VyY2VzXG4gIGF3YWl0IGZpeHR1cmUuY2RrRGVwbG95KCdjb25kaXRpb25hbC1yZXNvdXJjZScpO1xuXG4gIC8vIFRoZW4gYWdhaW4gV0lUSE9VVCByZXNvdXJjZXMgKHRoaXMgc2hvdWxkIGRlc3Ryb3kgdGhlIHN0YWNrKVxuICBhd2FpdCBmaXh0dXJlLmNka0RlcGxveSgnY29uZGl0aW9uYWwtcmVzb3VyY2UnLCB7IG1vZEVudjogeyBOT19SRVNPVVJDRTogJ1RSVUUnIH0gfSk7XG5cbiAgYXdhaXQgZXhwZWN0KGZpeHR1cmUuYXdzLmNsb3VkRm9ybWF0aW9uKCdkZXNjcmliZVN0YWNrcycsIHsgU3RhY2tOYW1lOiBmaXh0dXJlLmZ1bGxTdGFja05hbWUoJ2NvbmRpdGlvbmFsLXJlc291cmNlJykgfSkpXG4gICAgLnJlamVjdHMudG9UaHJvdygnY29uZGl0aW9uYWwtcmVzb3VyY2UgZG9lcyBub3QgZXhpc3QnKTtcbn0pKTtcblxuaW50ZWdUZXN0KCdJQU0gZGlmZicsIHdpdGhEZWZhdWx0Rml4dHVyZShhc3luYyAoZml4dHVyZSkgPT4ge1xuICBjb25zdCBvdXRwdXQgPSBhd2FpdCBmaXh0dXJlLmNkayhbJ2RpZmYnLCBmaXh0dXJlLmZ1bGxTdGFja05hbWUoJ2lhbS10ZXN0JyldKTtcblxuICAvLyBSb3VnaGx5IGNoZWNrIGZvciBhIHRhYmxlIGxpa2UgdGhpczpcbiAgLy9cbiAgLy8g4pSM4pSA4pSA4pSA4pSs4pSA4pSA4pSA4pSA4pSA4pSA4pSA4pSA4pSA4pSA4pSA4pSA4pSA4pSA4pSA4pSA4pSA4pSs4pSA4pSA4pSA4pSA4pSA4pSA4pSA4pSA4pSs4pSA4pSA4pSA4pSA4pSA4pSA4pSA4pSA4pSA4pSA4pSA4pSA4pSA4pSA4pSA4pSA4pSs4pSA4pSA4pSA4pSA4pSA4pSA4pSA4pSA4pSA4pSA4pSA4pSA4pSA4pSA4pSA4pSA4pSA4pSA4pSA4pSA4pSA4pSA4pSA4pSA4pSA4pSA4pSA4pSALeKUgOKUgOKUrOKUgOKUgOKUgOKUgOKUgOKUgOKUgOKUgOKUgOKUgOKUgOKUkFxuICAvLyDilIIgICDilIIgUmVzb3VyY2UgICAgICAgIOKUgiBFZmZlY3Qg4pSCIEFjdGlvbiAgICAgICAgIOKUgiBQcmluY2lwYWwgICAgICAgICAgICAgICAgICAgICDilIIgQ29uZGl0aW9uIOKUglxuICAvLyDilJzilIDilIDilIDilLzilIDilIDilIDilIDilIDilIDilIDilIDilIDilIDilIDilIDilIDilIDilIDilIDilIDilLzilIDilIDilIDilIDilIDilIDilIDilIDilLzilIDilIDilIDilIDilIDilIDilIDilIDilIDilIDilIDilIDilIDilIDilIDilIDilLzilIDilIDilIDilIDilIDilIDilIDilIDilIDilIDilIDilIDilIDilIDilIDilIDilIDilIDilIDilIDilIDilIDilIDilIDilIDilIDilIDilIDilIDilIDilIDilLzilIDilIDilIDilIDilIDilIDilIDilIDilIDilIDilIDilKRcbiAgLy8g4pSCICsg4pSCICR7U29tZVJvbGUuQXJufSDilIIgQWxsb3cgIOKUgiBzdHM6QXNzdW1lUm9sZSDilIIgU2VydmljZTplYzIuYW1hem9uYXdzLmNvbSAgICAg4pSCICAgICAgICAgICDilIJcbiAgLy8g4pSU4pSA4pSA4pSA4pS04pSA4pSA4pSA4pSA4pSA4pSA4pSA4pSA4pSA4pSA4pSA4pSA4pSA4pSA4pSA4pSA4pSA4pS04pSA4pSA4pSA4pSA4pSA4pSA4pSA4pSA4pS04pSA4pSA4pSA4pSA4pSA4pSA4pSA4pSA4pSA4pSA4pSA4pSA4pSA4pSA4pSA4pSA4pS04pSA4pSA4pSA4pSA4pSA4pSA4pSA4pSA4pSA4pSA4pSA4pSA4pSA4pSA4pSA4pSA4pSA4pSA4pSA4pSA4pSA4pSA4pSA4pSA4pSA4pSA4pSA4pSA4pSA4pSA4pSA4pS04pSA4pSA4pSA4pSA4pSA4pSA4pSA4pSA4pSA4pSA4pSA4pSYXG5cbiAgZXhwZWN0KG91dHB1dCkudG9Db250YWluKCcke1NvbWVSb2xlLkFybn0nKTtcbiAgZXhwZWN0KG91dHB1dCkudG9Db250YWluKCdzdHM6QXNzdW1lUm9sZScpO1xuICBleHBlY3Qob3V0cHV0KS50b0NvbnRhaW4oJ2VjMi5hbWF6b25hd3MuY29tJyk7XG59KSk7XG5cbmludGVnVGVzdCgnZmFzdCBkZXBsb3knLCB3aXRoRGVmYXVsdEZpeHR1cmUoYXN5bmMgKGZpeHR1cmUpID0+IHtcbiAgLy8gd2UgYXJlIHVzaW5nIGEgc3RhY2sgd2l0aCBhIG5lc3RlZCBzdGFjayBiZWNhdXNlIENGTiB3aWxsIGFsd2F5cyBhdHRlbXB0IHRvXG4gIC8vIHVwZGF0ZSBhIG5lc3RlZCBzdGFjaywgd2hpY2ggd2lsbCBhbGxvdyB1cyB0byB2ZXJpZnkgdGhhdCB1cGRhdGVzIGFyZSBhY3R1YWxseVxuICAvLyBza2lwcGVkIHVubGVzcyAtLWZvcmNlIGlzIHNwZWNpZmllZC5cbiAgY29uc3Qgc3RhY2tBcm4gPSBhd2FpdCBmaXh0dXJlLmNka0RlcGxveSgnd2l0aC1uZXN0ZWQtc3RhY2snLCB7IGNhcHR1cmVTdGRlcnI6IGZhbHNlIH0pO1xuICBjb25zdCBjaGFuZ2VTZXQxID0gYXdhaXQgZ2V0TGF0ZXN0Q2hhbmdlU2V0KCk7XG5cbiAgLy8gRGVwbG95IHRoZSBzYW1lIHN0YWNrIGFnYWluLCB0aGVyZSBzaG91bGQgYmUgbm8gbmV3IGNoYW5nZSBzZXQgY3JlYXRlZFxuICBhd2FpdCBmaXh0dXJlLmNka0RlcGxveSgnd2l0aC1uZXN0ZWQtc3RhY2snKTtcbiAgY29uc3QgY2hhbmdlU2V0MiA9IGF3YWl0IGdldExhdGVzdENoYW5nZVNldCgpO1xuICBleHBlY3QoY2hhbmdlU2V0Mi5DaGFuZ2VTZXRJZCkudG9FcXVhbChjaGFuZ2VTZXQxLkNoYW5nZVNldElkKTtcblxuICAvLyBEZXBsb3kgdGhlIHN0YWNrIGFnYWluIHdpdGggLS1mb3JjZSwgbm93IHdlIHNob3VsZCBjcmVhdGUgYSBjaGFuZ2VzZXRcbiAgYXdhaXQgZml4dHVyZS5jZGtEZXBsb3koJ3dpdGgtbmVzdGVkLXN0YWNrJywgeyBvcHRpb25zOiBbJy0tZm9yY2UnXSB9KTtcbiAgY29uc3QgY2hhbmdlU2V0MyA9IGF3YWl0IGdldExhdGVzdENoYW5nZVNldCgpO1xuICBleHBlY3QoY2hhbmdlU2V0My5DaGFuZ2VTZXRJZCkubm90LnRvRXF1YWwoY2hhbmdlU2V0Mi5DaGFuZ2VTZXRJZCk7XG5cbiAgLy8gRGVwbG95IHRoZSBzdGFjayBhZ2FpbiB3aXRoIHRhZ3MsIGV4cGVjdGVkIHRvIGNyZWF0ZSBhIG5ldyBjaGFuZ2VzZXRcbiAgLy8gZXZlbiB0aG91Z2ggdGhlIHJlc291cmNlcyBkaWRuJ3QgY2hhbmdlLlxuICBhd2FpdCBmaXh0dXJlLmNka0RlcGxveSgnd2l0aC1uZXN0ZWQtc3RhY2snLCB7IG9wdGlvbnM6IFsnLS10YWdzJywgJ2tleT12YWx1ZSddIH0pO1xuICBjb25zdCBjaGFuZ2VTZXQ0ID0gYXdhaXQgZ2V0TGF0ZXN0Q2hhbmdlU2V0KCk7XG4gIGV4cGVjdChjaGFuZ2VTZXQ0LkNoYW5nZVNldElkKS5ub3QudG9FcXVhbChjaGFuZ2VTZXQzLkNoYW5nZVNldElkKTtcblxuICBhc3luYyBmdW5jdGlvbiBnZXRMYXRlc3RDaGFuZ2VTZXQoKSB7XG4gICAgY29uc3QgcmVzcG9uc2UgPSBhd2FpdCBmaXh0dXJlLmF3cy5jbG91ZEZvcm1hdGlvbignZGVzY3JpYmVTdGFja3MnLCB7IFN0YWNrTmFtZTogc3RhY2tBcm4gfSk7XG4gICAgaWYgKCFyZXNwb25zZS5TdGFja3M/LlswXSkgeyB0aHJvdyBuZXcgRXJyb3IoJ0RpZCBub3QgZ2V0IGEgQ2hhbmdlU2V0IGF0IGFsbCcpOyB9XG4gICAgZml4dHVyZS5sb2coYEZvdW5kIENoYW5nZSBTZXQgJHtyZXNwb25zZS5TdGFja3M/LlswXS5DaGFuZ2VTZXRJZH1gKTtcbiAgICByZXR1cm4gcmVzcG9uc2UuU3RhY2tzPy5bMF07XG4gIH1cbn0pKTtcblxuaW50ZWdUZXN0KCdmYWlsZWQgZGVwbG95IGRvZXMgbm90IGhhbmcnLCB3aXRoRGVmYXVsdEZpeHR1cmUoYXN5bmMgKGZpeHR1cmUpID0+IHtcbiAgLy8gdGhpcyB3aWxsIGhhbmcgaWYgd2UgaW50cm9kdWNlIGh0dHBzOi8vZ2l0aHViLmNvbS9hd3MvYXdzLWNkay9pc3N1ZXMvNjQwMyBhZ2Fpbi5cbiAgYXdhaXQgZXhwZWN0KGZpeHR1cmUuY2RrRGVwbG95KCdmYWlsZWQnKSkucmVqZWN0cy50b1Rocm93KCdleGl0ZWQgd2l0aCBlcnJvcicpO1xufSkpO1xuXG5pbnRlZ1Rlc3QoJ2NhbiBzdGlsbCBsb2FkIG9sZCBhc3NlbWJsaWVzJywgd2l0aERlZmF1bHRGaXh0dXJlKGFzeW5jIChmaXh0dXJlKSA9PiB7XG4gIGNvbnN0IGN4QXNtRGlyID0gcGF0aC5qb2luKG9zLnRtcGRpcigpLCAnY2RrLWludGVnLWN4Jyk7XG5cbiAgY29uc3QgdGVzdEFzc2VtYmxpZXNEaXJlY3RvcnkgPSBwYXRoLmpvaW4oX19kaXJuYW1lLCAnY2xvdWQtYXNzZW1ibGllcycpO1xuICBmb3IgKGNvbnN0IGFzbWRpciBvZiBhd2FpdCBsaXN0Q2hpbGREaXJzKHRlc3RBc3NlbWJsaWVzRGlyZWN0b3J5KSkge1xuICAgIGZpeHR1cmUubG9nKGBBU1NFTUJMWSAke2FzbWRpcn1gKTtcbiAgICBhd2FpdCBjbG9uZURpcmVjdG9yeShhc21kaXIsIGN4QXNtRGlyKTtcblxuICAgIC8vIFNvbWUgZmlsZXMgaW4gdGhlIGFzbSBkaXJlY3RvcnkgdGhhdCBoYXZlIGEgLmpzIGV4dGVuc2lvbiBhcmVcbiAgICAvLyBhY3R1YWxseSB0cmVhdGVkIGFzIHRlbXBsYXRlcy4gRXZhbHVhdGUgdGhlbSB1c2luZyBOb2RlSlMuXG4gICAgY29uc3QgdGVtcGxhdGVzID0gYXdhaXQgbGlzdENoaWxkcmVuKGN4QXNtRGlyLCBmdWxsUGF0aCA9PiBQcm9taXNlLnJlc29sdmUoZnVsbFBhdGguZW5kc1dpdGgoJy5qcycpKSk7XG4gICAgZm9yIChjb25zdCB0ZW1wbGF0ZSBvZiB0ZW1wbGF0ZXMpIHtcbiAgICAgIGNvbnN0IHRhcmdldE5hbWUgPSB0ZW1wbGF0ZS5yZXBsYWNlKC8uanMkLywgJycpO1xuICAgICAgYXdhaXQgc2hlbGwoW3Byb2Nlc3MuZXhlY1BhdGgsIHRlbXBsYXRlLCAnPicsIHRhcmdldE5hbWVdLCB7XG4gICAgICAgIGN3ZDogY3hBc21EaXIsXG4gICAgICAgIG91dHB1dDogZml4dHVyZS5vdXRwdXQsXG4gICAgICAgIG1vZEVudjoge1xuICAgICAgICAgIFRFU1RfQUNDT1VOVDogYXdhaXQgZml4dHVyZS5hd3MuYWNjb3VudCgpLFxuICAgICAgICAgIFRFU1RfUkVHSU9OOiBmaXh0dXJlLmF3cy5yZWdpb24sXG4gICAgICAgIH0sXG4gICAgICB9KTtcbiAgICB9XG5cbiAgICAvLyBVc2UgdGhpcyBkaXJlY3RvcnkgYXMgYSBDbG91ZCBBc3NlbWJseVxuICAgIGNvbnN0IG91dHB1dCA9IGF3YWl0IGZpeHR1cmUuY2RrKFtcbiAgICAgICctLWFwcCcsIGN4QXNtRGlyLFxuICAgICAgJy12JyxcbiAgICAgICdzeW50aCcsXG4gICAgXSk7XG5cbiAgICAvLyBBc3NlcnQgdGhhdCB0aGVyZSB3YXMgbm8gcHJvdmlkZXJFcnJvciBpbiBDREsncyBzdGRlcnJcbiAgICAvLyBCZWNhdXNlIHdlIHJlbHkgb24gdGhlIGFwcC9mcmFtZXdvcmsgdG8gYWN0dWFsbHkgZXJyb3IgaW4gY2FzZSB0aGVcbiAgICAvLyBwcm92aWRlciBmYWlscywgd2UgaW5zcGVjdCB0aGUgbG9ncyBoZXJlLlxuICAgIGV4cGVjdChvdXRwdXQpLm5vdC50b0NvbnRhaW4oJyRwcm92aWRlckVycm9yJyk7XG4gIH1cbn0pKTtcblxuaW50ZWdUZXN0KCdnZW5lcmF0aW5nIGFuZCBsb2FkaW5nIGFzc2VtYmx5Jywgd2l0aERlZmF1bHRGaXh0dXJlKGFzeW5jIChmaXh0dXJlKSA9PiB7XG4gIGNvbnN0IGFzbU91dHB1dERpciA9IGAke2ZpeHR1cmUuaW50ZWdUZXN0RGlyfS1jZGstaW50ZWctYXNtYDtcbiAgYXdhaXQgZml4dHVyZS5zaGVsbChbJ3JtJywgJy1yZicsIGFzbU91dHB1dERpcl0pO1xuXG4gIC8vIFN5bnRoZXNpemUgYSBDbG91ZCBBc3NlbWJseSB0b3RoZSBkZWZhdWx0IGRpcmVjdG9yeSAoY2RrLm91dCkgYW5kIGEgc3BlY2lmaWMgZGlyZWN0b3J5LlxuICBhd2FpdCBmaXh0dXJlLmNkayhbJ3N5bnRoJ10pO1xuICBhd2FpdCBmaXh0dXJlLmNkayhbJ3N5bnRoJywgJy0tb3V0cHV0JywgYXNtT3V0cHV0RGlyXSk7XG5cbiAgLy8gY2RrLm91dCBpbiB0aGUgY3VycmVudCBkaXJlY3RvcnkgYW5kIHRoZSBpbmRpY2F0ZWQgLS1vdXRwdXQgc2hvdWxkIGJlIHRoZSBzYW1lXG4gIGF3YWl0IGZpeHR1cmUuc2hlbGwoWydkaWZmJywgJ2Nkay5vdXQnLCBhc21PdXRwdXREaXJdKTtcblxuICAvLyBDaGVjayB0aGF0IHdlIGNhbiAnbHMnIHRoZSBzeW50aGVzaXplZCBhc20uXG4gIC8vIENoYW5nZSB0byBzb21lIHJhbmRvbSBkaXJlY3RvcnkgdG8gbWFrZSBzdXJlIHdlJ3JlIG5vdCBhY2NpZGVudGFsbHkgbG9hZGluZyBjZGsuanNvblxuICBjb25zdCBsaXN0ID0gYXdhaXQgZml4dHVyZS5jZGsoWyctLWFwcCcsIGFzbU91dHB1dERpciwgJ2xzJ10sIHsgY3dkOiBvcy50bXBkaXIoKSB9KTtcbiAgLy8gU2FtZSBzdGFja3Mgd2Uga25vdyBhcmUgaW4gdGhlIGFwcFxuICBleHBlY3QobGlzdCkudG9Db250YWluKGAke2ZpeHR1cmUuc3RhY2tOYW1lUHJlZml4fS1sYW1iZGFgKTtcbiAgZXhwZWN0KGxpc3QpLnRvQ29udGFpbihgJHtmaXh0dXJlLnN0YWNrTmFtZVByZWZpeH0tdGVzdC0xYCk7XG4gIGV4cGVjdChsaXN0KS50b0NvbnRhaW4oYCR7Zml4dHVyZS5zdGFja05hbWVQcmVmaXh9LXRlc3QtMmApO1xuXG4gIC8vIENoZWNrIHRoYXQgd2UgY2FuIHVzZSAnLicgYW5kIGp1c3Qgc3ludGggLHRoZSBnZW5lcmF0ZWQgYXNtXG4gIGNvbnN0IHN0YWNrVGVtcGxhdGUgPSBhd2FpdCBmaXh0dXJlLmNkayhbJy0tYXBwJywgJy4nLCAnc3ludGgnLCBmaXh0dXJlLmZ1bGxTdGFja05hbWUoJ3Rlc3QtMicpXSwge1xuICAgIGN3ZDogYXNtT3V0cHV0RGlyLFxuICB9KTtcbiAgZXhwZWN0KHN0YWNrVGVtcGxhdGUpLnRvQ29udGFpbigndG9waWMxNTJEODRBMzcnKTtcblxuICAvLyBEZXBsb3kgYSBMYW1iZGEgZnJvbSB0aGUgY29waWVkIGFzbVxuICBhd2FpdCBmaXh0dXJlLmNka0RlcGxveSgnbGFtYmRhJywgeyBvcHRpb25zOiBbJy1hJywgJy4nXSwgY3dkOiBhc21PdXRwdXREaXIgfSk7XG5cbiAgLy8gUmVtb3ZlIChyZW5hbWUpIHRoZSBvcmlnaW5hbCBjdXN0b20gZG9ja2VyIGZpbGUgdGhhdCB3YXMgdXNlZCBkdXJpbmcgc3ludGguXG4gIC8vIHRoaXMgdmVyaWZpZXMgdGhhdCB0aGUgYXNzZW1seSBoYXMgYSBjb3B5IG9mIGl0IGFuZCB0aGF0IHRoZSBtYW5pZmVzdCB1c2VzXG4gIC8vIHJlbGF0aXZlIHBhdGhzIHRvIHJlZmVyZW5jZSB0byBpdC5cbiAgY29uc3QgY3VzdG9tRG9ja2VyRmlsZSA9IHBhdGguam9pbihmaXh0dXJlLmludGVnVGVzdERpciwgJ2RvY2tlcicsICdEb2NrZXJmaWxlLkN1c3RvbScpO1xuICBhd2FpdCBmcy5yZW5hbWUoY3VzdG9tRG9ja2VyRmlsZSwgYCR7Y3VzdG9tRG9ja2VyRmlsZX1+YCk7XG4gIHRyeSB7XG5cbiAgICAvLyBkZXBsb3kgYSBkb2NrZXIgaW1hZ2Ugd2l0aCBjdXN0b20gZmlsZSB3aXRob3V0IHN5bnRoICh1c2VzIGFzc2V0cylcbiAgICBhd2FpdCBmaXh0dXJlLmNka0RlcGxveSgnZG9ja2VyLXdpdGgtY3VzdG9tLWZpbGUnLCB7IG9wdGlvbnM6IFsnLWEnLCAnLiddLCBjd2Q6IGFzbU91dHB1dERpciB9KTtcblxuICB9IGZpbmFsbHkge1xuICAgIC8vIFJlbmFtZSBiYWNrIHRvIHJlc3RvcmUgZml4dHVyZSB0byBvcmlnaW5hbCBzdGF0ZVxuICAgIGF3YWl0IGZzLnJlbmFtZShgJHtjdXN0b21Eb2NrZXJGaWxlfX5gLCBjdXN0b21Eb2NrZXJGaWxlKTtcbiAgfVxufSkpO1xuXG5pbnRlZ1Rlc3QoJ3RlbXBsYXRlcyBvbiBkaXNrIGNvbnRhaW4gbWV0YWRhdGEgcmVzb3VyY2UsIGFsc28gaW4gbmVzdGVkIGFzc2VtYmxpZXMnLCB3aXRoRGVmYXVsdEZpeHR1cmUoYXN5bmMgKGZpeHR1cmUpID0+IHtcbiAgLy8gU3ludGggZmlyc3QsIGFuZCBzd2l0Y2ggb24gdmVyc2lvbiByZXBvcnRpbmcgYmVjYXVzZSBjZGsuanNvbiBpcyBkaXNhYmxpbmcgaXRcbiAgYXdhaXQgZml4dHVyZS5jZGsoWydzeW50aCcsICctLXZlcnNpb24tcmVwb3J0aW5nPXRydWUnXSk7XG5cbiAgLy8gTG9hZCB0ZW1wbGF0ZSBmcm9tIGRpc2sgZnJvbSByb290IGFzc2VtYmx5XG4gIGNvbnN0IHRlbXBsYXRlQ29udGVudHMgPSBhd2FpdCBmaXh0dXJlLnNoZWxsKFsnY2F0JywgJ2Nkay5vdXQvKi1sYW1iZGEudGVtcGxhdGUuanNvbiddKTtcblxuICBleHBlY3QoSlNPTi5wYXJzZSh0ZW1wbGF0ZUNvbnRlbnRzKS5SZXNvdXJjZXMuQ0RLTWV0YWRhdGEpLnRvQmVUcnV0aHkoKTtcblxuICAvLyBMb2FkIHRlbXBsYXRlIGZyb20gbmVzdGVkIGFzc2VtYmx5XG4gIGNvbnN0IG5lc3RlZFRlbXBsYXRlQ29udGVudHMgPSBhd2FpdCBmaXh0dXJlLnNoZWxsKFsnY2F0JywgJ2Nkay5vdXQvYXNzZW1ibHktKi1zdGFnZS8qLXN0YWdlLVN0YWNrSW5TdGFnZS50ZW1wbGF0ZS5qc29uJ10pO1xuXG4gIGV4cGVjdChKU09OLnBhcnNlKG5lc3RlZFRlbXBsYXRlQ29udGVudHMpLlJlc291cmNlcy5DREtNZXRhZGF0YSkudG9CZVRydXRoeSgpO1xufSkpO1xuXG5hc3luYyBmdW5jdGlvbiBsaXN0Q2hpbGRyZW4ocGFyZW50OiBzdHJpbmcsIHByZWQ6ICh4OiBzdHJpbmcpID0+IFByb21pc2U8Ym9vbGVhbj4pIHtcbiAgY29uc3QgcmV0ID0gbmV3IEFycmF5PHN0cmluZz4oKTtcbiAgZm9yIChjb25zdCBjaGlsZCBvZiBhd2FpdCBmcy5yZWFkZGlyKHBhcmVudCwgeyBlbmNvZGluZzogJ3V0Zi04JyB9KSkge1xuICAgIGNvbnN0IGZ1bGxQYXRoID0gcGF0aC5qb2luKHBhcmVudCwgY2hpbGQudG9TdHJpbmcoKSk7XG4gICAgaWYgKGF3YWl0IHByZWQoZnVsbFBhdGgpKSB7XG4gICAgICByZXQucHVzaChmdWxsUGF0aCk7XG4gICAgfVxuICB9XG4gIHJldHVybiByZXQ7XG59XG5cbmFzeW5jIGZ1bmN0aW9uIGxpc3RDaGlsZERpcnMocGFyZW50OiBzdHJpbmcpIHtcbiAgcmV0dXJuIGxpc3RDaGlsZHJlbihwYXJlbnQsIGFzeW5jIChmdWxsUGF0aDogc3RyaW5nKSA9PiAoYXdhaXQgZnMuc3RhdChmdWxsUGF0aCkpLmlzRGlyZWN0b3J5KCkpO1xufVxuXG5hc3luYyBmdW5jdGlvbiByZWFkVGVtcGxhdGUoZml4dHVyZTogVGVzdEZpeHR1cmUsIHN0YWNrTmFtZTogc3RyaW5nKTogUHJvbWlzZTxhbnk+IHtcbiAgY29uc3QgZnVsbFN0YWNrTmFtZSA9IGZpeHR1cmUuZnVsbFN0YWNrTmFtZShzdGFja05hbWUpO1xuICBjb25zdCB0ZW1wbGF0ZVBhdGggPSBwYXRoLmpvaW4oZml4dHVyZS5pbnRlZ1Rlc3REaXIsICdjZGsub3V0JywgYCR7ZnVsbFN0YWNrTmFtZX0udGVtcGxhdGUuanNvbmApO1xuICByZXR1cm4gSlNPTi5wYXJzZSgoYXdhaXQgZnMucmVhZEZpbGUodGVtcGxhdGVQYXRoLCB7IGVuY29kaW5nOiAndXRmLTgnIH0pKS50b1N0cmluZygpKTtcbn1cbiJdfQ==
\ No newline at end of file

From ae34d4a69a5073d8f0175b5282fa8bf92139fab5 Mon Sep 17 00:00:00 2001
From: Ken Dirschl <ken@badfunproductions.com>
Date: Wed, 25 Aug 2021 16:46:09 -0400
Subject: [PATCH 18/91] feat(codecommit): make Repository a source for CodeStar
 Notifications (#15739)

----
Fixes #15653

Notification rule can be created for CodeCommit Repository events using @aws-cdk/aws-codestarnotifications

*By submitting this pull request, I confirm that my contribution is made under the terms of the Apache-2.0 license*
---
 packages/@aws-cdk/aws-codecommit/README.md    |  13 +
 .../@aws-cdk/aws-codecommit/lib/repository.ts | 266 +++++++++++++++++-
 packages/@aws-cdk/aws-codecommit/package.json |   2 +
 ...nteg.repository-notification.expected.json |  87 ++++++
 .../test/integ.repository-notification.ts     |  19 ++
 .../test/test.notification-rule.ts            |  66 +++++
 .../lib/notification-rule.ts                  |   2 +-
 .../aws-codestarnotifications/test/helpers.ts |  11 +
 .../test/notification-rule.test.ts            |  21 ++
 9 files changed, 476 insertions(+), 11 deletions(-)
 create mode 100644 packages/@aws-cdk/aws-codecommit/test/integ.repository-notification.expected.json
 create mode 100644 packages/@aws-cdk/aws-codecommit/test/integ.repository-notification.ts
 create mode 100644 packages/@aws-cdk/aws-codecommit/test/test.notification-rule.ts

diff --git a/packages/@aws-cdk/aws-codecommit/README.md b/packages/@aws-cdk/aws-codecommit/README.md
index 3d4ef1c3ba46c..7dd08eef3bb82 100644
--- a/packages/@aws-cdk/aws-codecommit/README.md
+++ b/packages/@aws-cdk/aws-codecommit/README.md
@@ -55,3 +55,16 @@ const rule = repo.onCommentOnPullRequest('CommentOnPullRequest', {
     target: new targets.SnsTopic(myTopic),
 });
 ```
+
+## CodeStar Notifications
+
+To define CodeStar Notification rules for Repositories, use one of the `notifyOnXxx()` methods.
+They are very similar to `onXxx()` methods for CloudWatch events:
+
+```ts
+const target = new chatbot.SlackChannelConfiguration(stack, 'MySlackChannel', {
+  slackChannelConfigurationName: 'YOUR_CHANNEL_NAME',
+  slackWorkspaceId: 'YOUR_SLACK_WORKSPACE_ID',
+  slackChannelId: 'YOUR_SLACK_CHANNEL_ID',
+});
+const rule = repository.notifyOnPullRequestCreated('NotifyOnPullRequestCreated', target);
diff --git a/packages/@aws-cdk/aws-codecommit/lib/repository.ts b/packages/@aws-cdk/aws-codecommit/lib/repository.ts
index 495be2f981d86..e55053c0249be 100644
--- a/packages/@aws-cdk/aws-codecommit/lib/repository.ts
+++ b/packages/@aws-cdk/aws-codecommit/lib/repository.ts
@@ -1,10 +1,23 @@
+import * as notifications from '@aws-cdk/aws-codestarnotifications';
 import * as events from '@aws-cdk/aws-events';
 import * as iam from '@aws-cdk/aws-iam';
 import { IResource, Lazy, Resource, Stack } from '@aws-cdk/core';
 import { Construct } from 'constructs';
 import { CfnRepository } from './codecommit.generated';
 
-export interface IRepository extends IResource {
+/**
+ * Additional options to pass to the notification rule.
+ */
+export interface RepositoryNotifyOnOptions extends notifications.NotificationRuleOptions {
+  /**
+   * A list of event types associated with this notification rule for CodeCommit repositories.
+   * For a complete list of event types and IDs, see Notification concepts in the Developer Tools Console User Guide.
+   * @see https://docs.aws.amazon.com/dtconsole/latest/userguide/concepts.html#concepts-api
+   */
+  readonly events: RepositoryNotificationEvents[];
+}
+
+export interface IRepository extends IResource, notifications.INotificationRuleSource {
   /**
    * The ARN of this Repository.
    * @attribute
@@ -18,19 +31,19 @@ export interface IRepository extends IResource {
   readonly repositoryName: string;
 
   /**
-   * The HTTP clone URL
+   * The HTTP clone URL.
    * @attribute
    */
   readonly repositoryCloneUrlHttp: string;
 
   /**
-   * The SSH clone URL
+   * The SSH clone URL.
    * @attribute
    */
   readonly repositoryCloneUrlSsh: string;
 
   /**
-   * The HTTPS (GRC) clone URL
+   * The HTTPS (GRC) clone URL.
    *
    * HTTPS (GRC) is the protocol to use with git-remote-codecommit (GRC).
    *
@@ -92,7 +105,7 @@ export interface IRepository extends IResource {
   onCommit(id: string, options?: OnCommitOptions): events.Rule;
 
   /**
-   * Grant the given principal identity permissions to perform the actions on this repository
+   * Grant the given principal identity permissions to perform the actions on this repository.
    */
   grant(grantee: iam.IGrantable, ...actions: string[]): iam.Grant;
 
@@ -110,13 +123,90 @@ export interface IRepository extends IResource {
    * Grant the given identity permissions to read this repository.
    */
   grantRead(grantee: iam.IGrantable): iam.Grant;
+
+  /**
+   * Defines a CodeStar Notification rule triggered when the project
+   * events specified by you are emitted. Similar to `onEvent` API.
+   *
+   * You can also use the methods to define rules for the specific event emitted.
+   * eg: `notifyOnPullRequstCreated`.
+   *
+   * @returns CodeStar Notifications rule associated with this repository.
+   */
+  notifyOn(
+    id: string,
+    target: notifications.INotificationRuleTarget,
+    options: RepositoryNotifyOnOptions,
+  ): notifications.INotificationRule;
+
+  /**
+   * Defines a CodeStar Notification rule which triggers when a comment is made on a pull request.
+   */
+  notifyOnPullRequestComment(
+    id: string,
+    target: notifications.INotificationRuleTarget,
+    options?: notifications.NotificationRuleOptions,
+  ): notifications.INotificationRule;
+
+  /**
+   * Defines a CodeStar Notification rule which triggers when an approval status is changed.
+   */
+  notifyOnApprovalStatusChanged(
+    id: string,
+    target: notifications.INotificationRuleTarget,
+    options?: notifications.NotificationRuleOptions,
+  ): notifications.INotificationRule;
+
+  /**
+   * Defines a CodeStar Notification rule which triggers when an approval rule is overridden.
+   */
+  notifyOnApprovalRuleOverridden(
+    id: string,
+    target: notifications.INotificationRuleTarget,
+    options?: notifications.NotificationRuleOptions,
+  ): notifications.INotificationRule;
+
+  /**
+   * Defines a CodeStar Notification rule which triggers when a pull request is created.
+   */
+  notifyOnPullRequestCreated(
+    id: string,
+    target: notifications.INotificationRuleTarget,
+    options?: notifications.NotificationRuleOptions,
+  ): notifications.INotificationRule;
+
+  /**
+   * Defines a CodeStar Notification rule which triggers when a pull request is merged.
+   */
+  notifiyOnPullRequestMerged(
+    id: string,
+    target: notifications.INotificationRuleTarget,
+    options?: notifications.NotificationRuleOptions,
+  ): notifications.INotificationRule;
+
+  /**
+   * Defines a CodeStar Notification rule which triggers when a new branch or tag is created.
+   */
+  notifyOnBranchOrTagCreated(
+    id: string,
+    target: notifications.INotificationRuleTarget,
+    options?: notifications.NotificationRuleOptions,
+  ): notifications.INotificationRule;
+
+  /**
+   * Defines a CodeStar Notification rule which triggers when a branch or tag is deleted.
+   */
+  notifyOnBranchOrTagDeleted(
+    id: string,
+    target: notifications.INotificationRuleTarget,
+    options?: notifications.NotificationRuleOptions,
+  ): notifications.INotificationRule;
 }
 
 /**
- * Options for the onCommit() method
+ * Options for the onCommit() method.
  */
 export interface OnCommitOptions extends events.OnEventOptions {
-
   /**
    * The branch to monitor.
    *
@@ -268,6 +358,101 @@ abstract class RepositoryBase extends Resource implements IRepository {
       'codecommit:Describe*',
     );
   }
+
+  public notifyOn(
+    id: string,
+    target: notifications.INotificationRuleTarget,
+    options: RepositoryNotifyOnOptions,
+  ): notifications.INotificationRule {
+    return new notifications.NotificationRule(this, id, {
+      ...options,
+      source: this,
+      targets: [target],
+    });
+  }
+
+  public notifyOnPullRequestComment(
+    id: string,
+    target: notifications.INotificationRuleTarget,
+    options?: notifications.NotificationRuleOptions,
+  ): notifications.INotificationRule {
+    return this.notifyOn(id, target, {
+      ...options,
+      events: [RepositoryNotificationEvents.PULL_REQUEST_COMMENT],
+    });
+  }
+
+  public notifyOnApprovalStatusChanged(
+    id: string,
+    target: notifications.INotificationRuleTarget,
+    options?: notifications.NotificationRuleOptions,
+  ): notifications.INotificationRule {
+    return this.notifyOn(id, target, {
+      ...options,
+      events: [RepositoryNotificationEvents.APPROVAL_STATUS_CHANGED],
+    });
+  }
+
+  public notifyOnApprovalRuleOverridden(
+    id: string,
+    target: notifications.INotificationRuleTarget,
+    options?: notifications.NotificationRuleOptions,
+  ): notifications.INotificationRule {
+    return this.notifyOn(id, target, {
+      ...options,
+      events: [RepositoryNotificationEvents.APPROVAL_RULE_OVERRIDDEN],
+    });
+  }
+
+  public notifyOnPullRequestCreated(
+    id: string,
+    target: notifications.INotificationRuleTarget,
+    options?: notifications.NotificationRuleOptions,
+  ): notifications.INotificationRule {
+    return this.notifyOn(id, target, {
+      ...options,
+      events: [RepositoryNotificationEvents.PULL_REQUEST_CREATED],
+    });
+  }
+
+  public notifiyOnPullRequestMerged(
+    id: string,
+    target: notifications.INotificationRuleTarget,
+    options?: notifications.NotificationRuleOptions,
+  ): notifications.INotificationRule {
+    return this.notifyOn(id, target, {
+      ...options,
+      events: [RepositoryNotificationEvents.PULL_REQUEST_MERGED],
+    });
+  }
+
+  public notifyOnBranchOrTagCreated(
+    id: string,
+    target: notifications.INotificationRuleTarget,
+    options?: notifications.NotificationRuleOptions,
+  ): notifications.INotificationRule {
+    return this.notifyOn(id, target, {
+      ...options,
+      events: [RepositoryNotificationEvents.BRANCH_OR_TAG_CREATED],
+    });
+  }
+
+  public notifyOnBranchOrTagDeleted(
+    id: string,
+    target: notifications.INotificationRuleTarget,
+    options?: notifications.NotificationRuleOptions,
+  ): notifications.INotificationRule {
+    return this.notifyOn(id, target, {
+      ...options,
+      events: [RepositoryNotificationEvents.BRANCH_OR_TAG_DELETED],
+    });
+  }
+
+  public bindAsNotificationRuleSource(_scope: Construct): notifications.NotificationRuleSourceConfig {
+    return {
+      sourceArn: this.repositoryArn,
+    };
+  }
 }
 
 export interface RepositoryProps {
@@ -288,7 +473,7 @@ export interface RepositoryProps {
 }
 
 /**
- * Provides a CodeCommit Repository
+ * Provides a CodeCommit Repository.
  */
 export class Repository extends RepositoryBase {
 
@@ -401,7 +586,7 @@ export class Repository extends RepositoryBase {
  */
 export interface RepositoryTriggerOptions {
   /**
-   * A name for the trigger.Triggers on a repository must have unique names
+   * A name for the trigger.Triggers on a repository must have unique names.
    */
   readonly name?: string;
 
@@ -437,7 +622,7 @@ export enum RepositoryEventTrigger {
 }
 
 /**
- * Returns the clone URL for a protocol
+ * Returns the clone URL for a protocol.
  */
 function makeCloneUrl(stack: Stack, repositoryName: string, protocol: 'https' | 'ssh' | 'grc', region?: string) {
   switch (protocol) {
@@ -448,3 +633,64 @@ function makeCloneUrl(stack: Stack, repositoryName: string, protocol: 'https' |
       return `codecommit::${region ?? stack.region}://${repositoryName}`;
   }
 }
+
+/**
+ * List of event types for AWS CodeCommit
+ * @see https://docs.aws.amazon.com/dtconsole/latest/userguide/concepts.html#events-ref-repositories
+ */
+export enum RepositoryNotificationEvents {
+  /**
+   * Trigger notication when comment made on commit.
+   */
+  COMMIT_COMMENT = 'codecommit-repository-comments-on-commits',
+
+  /**
+   * Trigger notification when comment made on pull request.
+   */
+  PULL_REQUEST_COMMENT = 'codecommit-repository-comments-on-pull-requests',
+
+  /**
+   * Trigger notification when approval status changed.
+   */
+  APPROVAL_STATUS_CHANGED = 'codecommit-repository-approvals-status-changed',
+
+  /**
+   * Trigger notifications when approval rule is overridden.
+   */
+  APPROVAL_RULE_OVERRIDDEN = 'codecommit-repository-approvals-rule-override',
+
+  /**
+   * Trigger notification when pull request created.
+   */
+  PULL_REQUEST_CREATED = 'codecommit-repository-pull-request-created',
+
+  /**
+   * Trigger notification when pull request source updated.
+   */
+  PULL_REQUEST_SOURCE_UPDATED = 'codecommit-repository-pull-request-source-updated',
+
+  /**
+   * Trigger notification when pull request status is changed.
+   */
+  PULL_REQUEST_STATUS_CHANGED = 'codecommit-repository-pull-request-status-changed',
+
+  /**
+   * Trigger notification when pull requset is merged.
+   */
+  PULL_REQUEST_MERGED = 'codecommit-repository-pull-request-merged',
+
+  /**
+   * Trigger notification when a branch or tag is created.
+   */
+  BRANCH_OR_TAG_CREATED = 'codecommit-repository-branches-and-tags-created',
+
+  /**
+   * Trigger notification when a branch or tag is deleted.
+   */
+  BRANCH_OR_TAG_DELETED = 'codecommit-repository-branches-and-tags-deleted',
+
+  /**
+   * Trigger notification when a branch or tag is updated.
+   */
+  BRANCH_OR_TAG_UPDATED = 'codecommit-repository-branches-and-tags-updated',
+}
\ No newline at end of file
diff --git a/packages/@aws-cdk/aws-codecommit/package.json b/packages/@aws-cdk/aws-codecommit/package.json
index 6d622f85d076a..325c75e846904 100644
--- a/packages/@aws-cdk/aws-codecommit/package.json
+++ b/packages/@aws-cdk/aws-codecommit/package.json
@@ -88,6 +88,7 @@
     "@aws-cdk/assert-internal": "0.0.0"
   },
   "dependencies": {
+    "@aws-cdk/aws-codestarnotifications": "0.0.0",
     "@aws-cdk/aws-events": "0.0.0",
     "@aws-cdk/aws-iam": "0.0.0",
     "@aws-cdk/core": "0.0.0",
@@ -95,6 +96,7 @@
   },
   "homepage": "https://github.com/aws/aws-cdk",
   "peerDependencies": {
+    "@aws-cdk/aws-codestarnotifications": "0.0.0",
     "@aws-cdk/aws-events": "0.0.0",
     "@aws-cdk/aws-iam": "0.0.0",
     "@aws-cdk/core": "0.0.0",
diff --git a/packages/@aws-cdk/aws-codecommit/test/integ.repository-notification.expected.json b/packages/@aws-cdk/aws-codecommit/test/integ.repository-notification.expected.json
new file mode 100644
index 0000000000000..c2f386ccebe0e
--- /dev/null
+++ b/packages/@aws-cdk/aws-codecommit/test/integ.repository-notification.expected.json
@@ -0,0 +1,87 @@
+{
+  "Resources": {
+    "MyCodecommitRepository26DB372B": {
+      "Type": "AWS::CodeCommit::Repository",
+      "Properties": {
+        "RepositoryName": "my-test-repository"
+      }
+    },
+    "MyCodecommitRepositoryNotifyOnPullRequestCreated4CAB0621": {
+      "Type": "AWS::CodeStarNotifications::NotificationRule",
+      "Properties": {
+        "DetailType": "FULL",
+        "EventTypeIds": [
+          "codecommit-repository-pull-request-created"
+        ],
+        "Name": "decommitMyCodecommitRepositoryNotifyOnPullRequestCreated65969BCB",
+        "Resource": {
+          "Fn::GetAtt": [
+            "MyCodecommitRepository26DB372B",
+            "Arn"
+          ]
+        },
+        "Targets": [
+          {
+            "TargetAddress": {
+              "Ref": "MyTopic86869434"
+            },
+            "TargetType": "SNS"
+          }
+        ]
+      }
+    },
+    "MyCodecommitRepositoryNotifyOnPullRequestMerged80574FED": {
+      "Type": "AWS::CodeStarNotifications::NotificationRule",
+      "Properties": {
+        "DetailType": "FULL",
+        "EventTypeIds": [
+          "codecommit-repository-pull-request-merged"
+        ],
+        "Name": "odecommitMyCodecommitRepositoryNotifyOnPullRequestMergedF426197C",
+        "Resource": {
+          "Fn::GetAtt": [
+            "MyCodecommitRepository26DB372B",
+            "Arn"
+          ]
+        },
+        "Targets": [
+          {
+            "TargetAddress": {
+              "Ref": "MyTopic86869434"
+            },
+            "TargetType": "SNS"
+          }
+        ]
+      }
+    },
+    "MyTopic86869434": {
+      "Type": "AWS::SNS::Topic"
+    },
+    "MyTopicPolicy12A5EC17": {
+      "Type": "AWS::SNS::TopicPolicy",
+      "Properties": {
+        "PolicyDocument": {
+          "Statement": [
+            {
+              "Action": "sns:Publish",
+              "Effect": "Allow",
+              "Principal": {
+                "Service": "codestar-notifications.amazonaws.com"
+              },
+              "Resource": {
+                "Ref": "MyTopic86869434"
+              },
+              "Sid": "0"
+            }
+          ],
+          "Version": "2012-10-17"
+        },
+        "Topics": [
+          {
+            "Ref": "MyTopic86869434"
+          }
+        ]
+      }
+    }
+  }
+}
\ No newline at end of file
diff --git a/packages/@aws-cdk/aws-codecommit/test/integ.repository-notification.ts b/packages/@aws-cdk/aws-codecommit/test/integ.repository-notification.ts
new file mode 100644
index 0000000000000..4f7a5926a47ac
--- /dev/null
+++ b/packages/@aws-cdk/aws-codecommit/test/integ.repository-notification.ts
@@ -0,0 +1,19 @@
+#!/usr/bin/env node
+import * as sns from '@aws-cdk/aws-sns';
+import * as cdk from '@aws-cdk/core';
+import * as codecommit from '../lib';
+
+const app = new cdk.App();
+
+const stack = new cdk.Stack(app, 'aws-cdk-codecommit');
+
+const repository = new codecommit.Repository(stack, 'MyCodecommitRepository', {
+  repositoryName: 'my-test-repository',
+});
+
+const target = new sns.Topic(stack, 'MyTopic');
+
+repository.notifyOnPullRequestCreated('NotifyOnPullRequestCreated', target);
+repository.notifiyOnPullRequestMerged('NotifyOnPullRequestMerged', target);
+
+app.synth();
\ No newline at end of file
diff --git a/packages/@aws-cdk/aws-codecommit/test/test.notification-rule.ts b/packages/@aws-cdk/aws-codecommit/test/test.notification-rule.ts
new file mode 100644
index 0000000000000..aa0e48a51a3ac
--- /dev/null
+++ b/packages/@aws-cdk/aws-codecommit/test/test.notification-rule.ts
@@ -0,0 +1,66 @@
+import { expect, haveResource } from '@aws-cdk/assert-internal';
+import * as sns from '@aws-cdk/aws-sns';
+import * as cdk from '@aws-cdk/core';
+import { Test } from 'nodeunit';
+import * as codecommit from '../lib';
+
+export = {
+  'CodeCommit Repositories - can create notification rule'(test: Test) {
+    const stack = new cdk.Stack();
+    const repository = new codecommit.Repository(stack, 'MyCodecommitRepository', {
+      repositoryName: 'my-test-repository',
+    });
+
+    const target = new sns.Topic(stack, 'MyTopic');
+
+    repository.notifyOnPullRequestCreated('NotifyOnPullRequestCreated', target);
+
+    repository.notifiyOnPullRequestMerged('NotifyOnPullRequestMerged', target);
+
+    expect(stack).to(haveResource('AWS::CodeStarNotifications::NotificationRule', {
+      Name: 'MyCodecommitRepositoryNotifyOnPullRequestCreatedBB14EA32',
+      DetailType: 'FULL',
+      EventTypeIds: [
+        'codecommit-repository-pull-request-created',
+      ],
+      Resource: {
+        'Fn::GetAtt': [
+          'MyCodecommitRepository26DB372B',
+          'Arn',
+        ],
+      },
+      Targets: [
+        {
+          TargetAddress: {
+            Ref: 'MyTopic86869434',
+          },
+          TargetType: 'SNS',
+        },
+      ],
+    }));
+
+    expect(stack).to(haveResource('AWS::CodeStarNotifications::NotificationRule', {
+      Name: 'MyCodecommitRepositoryNotifyOnPullRequestMerged34A7EDF1',
+      DetailType: 'FULL',
+      EventTypeIds: [
+        'codecommit-repository-pull-request-merged',
+      ],
+      Resource: {
+        'Fn::GetAtt': [
+          'MyCodecommitRepository26DB372B',
+          'Arn',
+        ],
+      },
+      Targets: [
+        {
+          TargetAddress: {
+            Ref: 'MyTopic86869434',
+          },
+          TargetType: 'SNS',
+        },
+      ],
+    }));
+
+    test.done();
+  },
+};
\ No newline at end of file
diff --git a/packages/@aws-cdk/aws-codestarnotifications/lib/notification-rule.ts b/packages/@aws-cdk/aws-codestarnotifications/lib/notification-rule.ts
index 0796557e38a77..f30cf11f58a99 100644
--- a/packages/@aws-cdk/aws-codestarnotifications/lib/notification-rule.ts
+++ b/packages/@aws-cdk/aws-codestarnotifications/lib/notification-rule.ts
@@ -62,7 +62,7 @@ export interface NotificationRuleProps extends NotificationRuleOptions {
 
   /**
    * The Amazon Resource Name (ARN) of the resource to associate with the notification rule.
-   * Currently, Supported sources include pipelines in AWS CodePipeline and build projects in AWS CodeBuild in this L2 constructor.
+   * Currently, Supported sources include pipelines in AWS CodePipeline, build projects in AWS CodeBuild, and repositories in AWS CodeCommit in this L2 constructor.
    * @see https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-codestarnotifications-notificationrule.html#cfn-codestarnotifications-notificationrule-resource
    */
   readonly source: INotificationRuleSource;
diff --git a/packages/@aws-cdk/aws-codestarnotifications/test/helpers.ts b/packages/@aws-cdk/aws-codestarnotifications/test/helpers.ts
index bf1d335c94d9f..3acf5e33ca334 100644
--- a/packages/@aws-cdk/aws-codestarnotifications/test/helpers.ts
+++ b/packages/@aws-cdk/aws-codestarnotifications/test/helpers.ts
@@ -22,6 +22,17 @@ export class FakeCodePipeline implements notifications.INotificationRuleSource {
   }
 }
 
+export class FakeCodeCommit implements notifications.INotificationRuleSource {
+  readonly repositoryArn = 'arn:aws:codecommit::1234567890:MyCodecommitProject';
+  readonly repositoryName = 'test-repository';
+
+  bindAsNotificationRuleSource(): notifications.NotificationRuleSourceConfig {
+    return {
+      sourceArn: this.repositoryArn,
+    };
+  }
+}
+
 export class FakeSnsTopicTarget implements notifications.INotificationRuleTarget {
   readonly topicArn = 'arn:aws:sns::1234567890:MyTopic';
 
diff --git a/packages/@aws-cdk/aws-codestarnotifications/test/notification-rule.test.ts b/packages/@aws-cdk/aws-codestarnotifications/test/notification-rule.test.ts
index a155b3583a524..332e808ca3176 100644
--- a/packages/@aws-cdk/aws-codestarnotifications/test/notification-rule.test.ts
+++ b/packages/@aws-cdk/aws-codestarnotifications/test/notification-rule.test.ts
@@ -4,6 +4,7 @@ import * as notifications from '../lib';
 import {
   FakeCodeBuild,
   FakeCodePipeline,
+  FakeCodeCommit,
   FakeSlackTarget,
   FakeSnsTopicTarget,
 } from './helpers';
@@ -29,6 +30,26 @@ describe('NotificationRule', () => {
     });
   });
 
+  test('created new notification rule from repository source', () => {
+    const repository = new FakeCodeCommit();
+
+    new notifications.NotificationRule(stack, 'MyNotificationRule', {
+      source: repository,
+      events: [
+        'codecommit-repository-pull-request-created',
+        'codecommit-repository-pull-request-merged',
+      ],
+    });
+
+    expect(stack).toHaveResourceLike('AWS::CodeStarNotifications::NotificationRule', {
+      Resource: repository.repositoryArn,
+      EventTypeIds: [
+        'codecommit-repository-pull-request-created',
+        'codecommit-repository-pull-request-merged',
+      ],
+    });
+  });
+
   test('created new notification rule with all parameters in constructor props', () => {
     const project = new FakeCodeBuild();
     const slack = new FakeSlackTarget();

From 1d54a456cd5e2ff65251097f9a684e1ac200cc52 Mon Sep 17 00:00:00 2001
From: kaizen3031593 <36202692+kaizen3031593@users.noreply.github.com>
Date: Wed, 25 Aug 2021 17:33:23 -0400
Subject: [PATCH 19/91] feat(rds): support 's3export' for Postgres database
 instances (#16124)

As mentioned in #14546, Postgres database instances did not support `s3export` when most of the `s3 import/export` features were added in #10370. This PR fills in that gap now that `s3export` is [available](https://docs.aws.amazon.com/AmazonRDS/latest/UserGuide/postgresql-s3-export.html) for Postgres.

The supported versions are documented [here](https://docs.aws.amazon.com/AmazonRDS/latest/UserGuide/postgresql-s3-export.html) and I manually verified via AWS CLI that Postgres 13+ supports `s3export` as well.

Looking into the test suite, I think it makes more sense to modify the existing test than to create an entirely new one, similar to how other database instances test s3 import/export at the same time. But I can also move it to its own test if necessary.

I also fixed a very minor doc typo in `cluster-instance.ts`.

Closes #14546.

----

*By submitting this pull request, I confirm that my contribution is made under the terms of the Apache-2.0 license*
---
 packages/@aws-cdk/aws-rds/README.md           |  7 ++--
 .../@aws-cdk/aws-rds/lib/cluster-engine.ts    |  2 +-
 .../@aws-cdk/aws-rds/lib/instance-engine.ts   | 40 +++++++++++--------
 .../aws-rds/test/instance-engine.test.ts      |  6 +--
 4 files changed, 32 insertions(+), 23 deletions(-)

diff --git a/packages/@aws-cdk/aws-rds/README.md b/packages/@aws-cdk/aws-rds/README.md
index c604a2ad5bce8..054a660f3529e 100644
--- a/packages/@aws-cdk/aws-rds/README.md
+++ b/packages/@aws-cdk/aws-rds/README.md
@@ -359,11 +359,12 @@ You can read more about loading data to (or from) S3 here:
 
 * Aurora MySQL - [import](https://docs.aws.amazon.com/AmazonRDS/latest/AuroraUserGuide/AuroraMySQL.Integrating.LoadFromS3.html)
   and [export](https://docs.aws.amazon.com/AmazonRDS/latest/AuroraUserGuide/AuroraMySQL.Integrating.SaveIntoS3.html).
-* Aurora PostgreSQL - [import](https://docs.aws.amazon.com/AmazonRDS/latest/AuroraUserGuide/AuroraPostgreSQL.Migrating.html)
+* Aurora PostgreSQL - [import](https://docs.aws.amazon.com/AmazonRDS/latest/AuroraUserGuide/AuroraPostgreSQL.Migrating.html#USER_PostgreSQL.S3Import)
   and [export](https://docs.aws.amazon.com/AmazonRDS/latest/AuroraUserGuide/postgresql-s3-export.html).
-* Microsoft SQL Server - [import & export](https://docs.aws.amazon.com/AmazonRDS/latest/UserGuide/SQLServer.Procedural.Importing.html)
+* Microsoft SQL Server - [import and export](https://docs.aws.amazon.com/AmazonRDS/latest/UserGuide/SQLServer.Procedural.Importing.html)
 * PostgreSQL - [import](https://docs.aws.amazon.com/AmazonRDS/latest/UserGuide/PostgreSQL.Procedural.Importing.html)
-* Oracle - [import & export](https://docs.aws.amazon.com/AmazonRDS/latest/UserGuide/oracle-s3-integration.html)
+  and [export](https://docs.aws.amazon.com/AmazonRDS/latest/UserGuide/postgresql-s3-export.html)
+* Oracle - [import and export](https://docs.aws.amazon.com/AmazonRDS/latest/UserGuide/oracle-s3-integration.html)
 
 The following snippet sets up a database cluster with different S3 buckets where the data is imported and exported -
 
diff --git a/packages/@aws-cdk/aws-rds/lib/cluster-engine.ts b/packages/@aws-cdk/aws-rds/lib/cluster-engine.ts
index f92e738b2f90b..973f682e932c7 100644
--- a/packages/@aws-cdk/aws-rds/lib/cluster-engine.ts
+++ b/packages/@aws-cdk/aws-rds/lib/cluster-engine.ts
@@ -403,7 +403,7 @@ export interface AuroraPostgresEngineFeatures {
   readonly s3Import?: boolean;
 
   /**
-   * Whether this version of the Aurora Postgres cluster engine supports the S3 data import feature.
+   * Whether this version of the Aurora Postgres cluster engine supports the S3 data export feature.
    *
    * @default false
    */
diff --git a/packages/@aws-cdk/aws-rds/lib/instance-engine.ts b/packages/@aws-cdk/aws-rds/lib/instance-engine.ts
index 7b1c8fad83eaf..eacb8097da55e 100644
--- a/packages/@aws-cdk/aws-rds/lib/instance-engine.ts
+++ b/packages/@aws-cdk/aws-rds/lib/instance-engine.ts
@@ -545,6 +545,13 @@ export interface PostgresEngineFeatures {
    * @default false
    */
   readonly s3Import?: boolean;
+
+  /**
+   * Whether this version of the Postgres engine supports the S3 data export feature.
+   *
+   * @default false
+   */
+  readonly s3Export?: boolean;
 }
 
 /**
@@ -779,13 +786,13 @@ export class PostgresEngineVersion {
   /** Version "10.13". */
   public static readonly VER_10_13 = PostgresEngineVersion.of('10.13', '10', { s3Import: true });
   /** Version "10.14". */
-  public static readonly VER_10_14 = PostgresEngineVersion.of('10.14', '10', { s3Import: true });
+  public static readonly VER_10_14 = PostgresEngineVersion.of('10.14', '10', { s3Import: true, s3Export: true });
   /** Version "10.15". */
-  public static readonly VER_10_15 = PostgresEngineVersion.of('10.15', '10', { s3Import: true });
+  public static readonly VER_10_15 = PostgresEngineVersion.of('10.15', '10', { s3Import: true, s3Export: true });
   /** Version "10.16". */
-  public static readonly VER_10_16 = PostgresEngineVersion.of('10.16', '10', { s3Import: true });
+  public static readonly VER_10_16 = PostgresEngineVersion.of('10.16', '10', { s3Import: true, s3Export: true });
   /** Version "10.17". */
-  public static readonly VER_10_17 = PostgresEngineVersion.of('10.17', '10', { s3Import: true });
+  public static readonly VER_10_17 = PostgresEngineVersion.of('10.17', '10', { s3Import: true, s3Export: true });
 
   /** Version "11" (only a major version, without a specific minor version). */
   public static readonly VER_11 = PostgresEngineVersion.of('11', '11', { s3Import: true });
@@ -804,13 +811,13 @@ export class PostgresEngineVersion {
   /** Version "11.8". */
   public static readonly VER_11_8 = PostgresEngineVersion.of('11.8', '11', { s3Import: true });
   /** Version "11.9". */
-  public static readonly VER_11_9 = PostgresEngineVersion.of('11.9', '11', { s3Import: true });
+  public static readonly VER_11_9 = PostgresEngineVersion.of('11.9', '11', { s3Import: true, s3Export: true });
   /** Version "11.10". */
-  public static readonly VER_11_10 = PostgresEngineVersion.of('11.10', '11', { s3Import: true });
+  public static readonly VER_11_10 = PostgresEngineVersion.of('11.10', '11', { s3Import: true, s3Export: true });
   /** Version "11.11". */
-  public static readonly VER_11_11 = PostgresEngineVersion.of('11.11', '11', { s3Import: true });
+  public static readonly VER_11_11 = PostgresEngineVersion.of('11.11', '11', { s3Import: true, s3Export: true });
   /** Version "11.12". */
-  public static readonly VER_11_12 = PostgresEngineVersion.of('11.12', '11', { s3Import: true });
+  public static readonly VER_11_12 = PostgresEngineVersion.of('11.12', '11', { s3Import: true, s3Export: true });
 
   /** Version "12" (only a major version, without a specific minor version). */
   public static readonly VER_12 = PostgresEngineVersion.of('12', '12', { s3Import: true });
@@ -819,22 +826,22 @@ export class PostgresEngineVersion {
   /** Version "12.3". */
   public static readonly VER_12_3 = PostgresEngineVersion.of('12.3', '12', { s3Import: true });
   /** Version "12.4". */
-  public static readonly VER_12_4 = PostgresEngineVersion.of('12.4', '12', { s3Import: true });
+  public static readonly VER_12_4 = PostgresEngineVersion.of('12.4', '12', { s3Import: true, s3Export: true });
   /** Version "12.5". */
-  public static readonly VER_12_5 = PostgresEngineVersion.of('12.5', '12', { s3Import: true });
+  public static readonly VER_12_5 = PostgresEngineVersion.of('12.5', '12', { s3Import: true, s3Export: true });
   /** Version "12.6". */
-  public static readonly VER_12_6 = PostgresEngineVersion.of('12.6', '12', { s3Import: true });
+  public static readonly VER_12_6 = PostgresEngineVersion.of('12.6', '12', { s3Import: true, s3Export: true });
   /** Version "12.7". */
-  public static readonly VER_12_7 = PostgresEngineVersion.of('12.7', '12', { s3Import: true });
+  public static readonly VER_12_7 = PostgresEngineVersion.of('12.7', '12', { s3Import: true, s3Export: true });
 
   /** Version "13" (only a major version, without a specific minor version). */
-  public static readonly VER_13 = PostgresEngineVersion.of('13', '13', { s3Import: true });
+  public static readonly VER_13 = PostgresEngineVersion.of('13', '13', { s3Import: true, s3Export: true });
   /** Version "13.1". */
-  public static readonly VER_13_1 = PostgresEngineVersion.of('13.1', '13', { s3Import: true });
+  public static readonly VER_13_1 = PostgresEngineVersion.of('13.1', '13', { s3Import: true, s3Export: true });
   /** Version "13.2". */
-  public static readonly VER_13_2 = PostgresEngineVersion.of('13.2', '13', { s3Import: true });
+  public static readonly VER_13_2 = PostgresEngineVersion.of('13.2', '13', { s3Import: true, s3Export: true });
   /** Version "13.3". */
-  public static readonly VER_13_3 = PostgresEngineVersion.of('13.3', '13', { s3Import: true });
+  public static readonly VER_13_3 = PostgresEngineVersion.of('13.3', '13', { s3Import: true, s3Export: true });
 
   /**
    * Create a new PostgresEngineVersion with an arbitrary version.
@@ -864,6 +871,7 @@ export class PostgresEngineVersion {
     this.postgresMajorVersion = postgresMajorVersion;
     this._features = {
       s3Import: postgresFeatures?.s3Import ? 's3Import' : undefined,
+      s3Export: postgresFeatures?.s3Export ? 's3Export' : undefined,
     };
   }
 }
diff --git a/packages/@aws-cdk/aws-rds/test/instance-engine.test.ts b/packages/@aws-cdk/aws-rds/test/instance-engine.test.ts
index 830ad0c97bd8e..e3b02c48770d4 100644
--- a/packages/@aws-cdk/aws-rds/test/instance-engine.test.ts
+++ b/packages/@aws-cdk/aws-rds/test/instance-engine.test.ts
@@ -274,12 +274,12 @@ nodeunitShim({
       test.done();
     },
 
-    'returns s3 import feature if the version supports it'(test: Test) {
-      const engineNewerVersion = rds.DatabaseInstanceEngine.postgres({ version: rds.PostgresEngineVersion.VER_12_3 });
+    'returns s3 import/export feature if the version supports it'(test: Test) {
+      const engineNewerVersion = rds.DatabaseInstanceEngine.postgres({ version: rds.PostgresEngineVersion.VER_13_3 });
 
       const engineConfig = engineNewerVersion.bindToInstance(new cdk.Stack(), {});
       test.equals(engineConfig.features?.s3Import, 's3Import');
-      test.equals(engineConfig.features?.s3Export, undefined);
+      test.equals(engineConfig.features?.s3Export, 's3Export');
 
       test.done();
     },

From cd66fe4b101d7a377ceb733fe4d72d4cd6cec753 Mon Sep 17 00:00:00 2001
From: AWS CDK Team <aws-cdk@amazon.com>
Date: Thu, 26 Aug 2021 09:31:38 +0000
Subject: [PATCH 20/91] chore(release): 1.120.0

---
 CHANGELOG.md    | 41 +++++++++++++++++++++++++++++++++++++++++
 version.v1.json |  2 +-
 2 files changed, 42 insertions(+), 1 deletion(-)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index c207fc6012f7c..a17afe6a8cc59 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -2,6 +2,47 @@
 
 All notable changes to this project will be documented in this file. See [standard-version](https://github.com/conventional-changelog/standard-version) for commit guidelines.
 
+## [1.120.0](https://github.com/aws/aws-cdk/compare/v1.119.0...v1.120.0) (2021-08-26)
+
+
+### Features
+
+* **assertions:** queries and assertions against the Outputs and Mappings sections ([#15892](https://github.com/aws/aws-cdk/issues/15892)) ([90f95e1](https://github.com/aws/aws-cdk/commit/90f95e10f4dd9e4992731d6262dcfc767b65ab3f))
+* **aws-stepfunctions:** add support to heartbeat error inside catch block ([#16078](https://github.com/aws/aws-cdk/issues/16078)) ([2372b3c](https://github.com/aws/aws-cdk/commit/2372b3c360d13fb0224fc981a7bb1ae318581265)), closes [#16084](https://github.com/aws/aws-cdk/issues/16084)
+* **cfnspec:** cloudformation spec v39.10.0 ([#16114](https://github.com/aws/aws-cdk/issues/16114)) ([7e0ad5d](https://github.com/aws/aws-cdk/commit/7e0ad5d17b30150922d0dfd81f42da11fadb8beb))
+* **cfnspec:** cloudformation spec v40.0.0 ([#16183](https://github.com/aws/aws-cdk/issues/16183)) ([b059124](https://github.com/aws/aws-cdk/commit/b059124b238e27751217cbdaaa01c38b00e80fc9))
+* **cloudwatch:** add support for cross-account alarms ([#16007](https://github.com/aws/aws-cdk/issues/16007)) ([e547ba0](https://github.com/aws/aws-cdk/commit/e547ba0d1491af0abe703132fa06fe786ffd7070)), closes [#15959](https://github.com/aws/aws-cdk/issues/15959)
+* **codecommit:** make Repository a source for CodeStar Notifications ([#15739](https://github.com/aws/aws-cdk/issues/15739)) ([ae34d4a](https://github.com/aws/aws-cdk/commit/ae34d4a69a5073d8f0175b5282fa8bf92139fab5))
+* **cognito:** user pools - device tracking ([#16055](https://github.com/aws/aws-cdk/issues/16055)) ([64019bb](https://github.com/aws/aws-cdk/commit/64019bbf090e156261feb626a5a4bd7ff4f26545)), closes [#15013](https://github.com/aws/aws-cdk/issues/15013)
+* **docdb:** cluster - deletion protection ([#15216](https://github.com/aws/aws-cdk/issues/15216)) ([0f7beb2](https://github.com/aws/aws-cdk/commit/0f7beb29be18d809052f4d46e415a0394c9299ab))
+* **ecs:** add support for Bottlerocket on ARM64 ([#15454](https://github.com/aws/aws-cdk/issues/15454)) ([cd280a8](https://github.com/aws/aws-cdk/commit/cd280a8f4f46eb50be3a25d80c00a807881832c4)), closes [#14466](https://github.com/aws/aws-cdk/issues/14466)
+* **lambda:** nodejs14.x supports inline code ([#16131](https://github.com/aws/aws-cdk/issues/16131)) ([305f683](https://github.com/aws/aws-cdk/commit/305f683e86cca221705c0138572faa38043396eb))
+* **rds:** support 's3export' for Postgres database instances ([#16124](https://github.com/aws/aws-cdk/issues/16124)) ([1d54a45](https://github.com/aws/aws-cdk/commit/1d54a456cd5e2ff65251097f9a684e1ac200cc52)), closes [#14546](https://github.com/aws/aws-cdk/issues/14546) [#10370](https://github.com/aws/aws-cdk/issues/10370) [#14546](https://github.com/aws/aws-cdk/issues/14546)
+* **s3-deployment:** exclude and include filters ([#16054](https://github.com/aws/aws-cdk/issues/16054)) ([d42e89e](https://github.com/aws/aws-cdk/commit/d42e89e01034dcba08c8f8ac0390a743143c4531)), closes [#14362](https://github.com/aws/aws-cdk/issues/14362) [#14362](https://github.com/aws/aws-cdk/issues/14362)
+
+
+### Bug Fixes
+
+* **apigatewayv2:** http api - disallow empty string as domain name ([#16044](https://github.com/aws/aws-cdk/issues/16044)) ([9c39bcb](https://github.com/aws/aws-cdk/commit/9c39bcb970fc791e94d199b962cc006fca1a3320))
+* **appsync:** addSubscription only allows for field type ([#16097](https://github.com/aws/aws-cdk/issues/16097)) ([000d151](https://github.com/aws/aws-cdk/commit/000d151bec2215aa530819c3cf2c8c432352fec3)), closes [#10078](https://github.com/aws/aws-cdk/issues/10078) [#16071](https://github.com/aws/aws-cdk/issues/16071)
+* **cfnspec:** changes to resource-level documentation not supported ([#16170](https://github.com/aws/aws-cdk/issues/16170)) ([82e4b4f](https://github.com/aws/aws-cdk/commit/82e4b4f07be202e2d6c6afa4f9ed0d9d6146f0a8))
+* **cli:** 'deploy' and 'diff' silently does nothing when given unknown stack name ([#16073](https://github.com/aws/aws-cdk/issues/16073)) ([f35b032](https://github.com/aws/aws-cdk/commit/f35b032cea4354992d3320e78c1ed0e2878a3fe7)), closes [#15866](https://github.com/aws/aws-cdk/issues/15866)
+* **cli:** Python init template does not work in directory with '-' ([#15939](https://github.com/aws/aws-cdk/issues/15939)) ([3b2c790](https://github.com/aws/aws-cdk/commit/3b2c790c2b7d210868576540feab4e088376ab6c)), closes [#15938](https://github.com/aws/aws-cdk/issues/15938)
+* **cli:** unknown command pytest in build container fails integration tests ([#16134](https://github.com/aws/aws-cdk/issues/16134)) ([0f7c0b4](https://github.com/aws/aws-cdk/commit/0f7c0b421327f1ffed28de79692191af187f23ca)), closes [#15939](https://github.com/aws/aws-cdk/issues/15939)
+* **resourcegroups:** ResourceGroup not using TagType.STANDARD, causes deploy failure ([#16211](https://github.com/aws/aws-cdk/issues/16211)) ([cdee1af](https://github.com/aws/aws-cdk/commit/cdee1af03c34a1c08988e672bae6edc2538a8877)), closes [#12986](https://github.com/aws/aws-cdk/issues/12986)
+* **s3:** bucket is not emptied before update when the name changes ([#16203](https://github.com/aws/aws-cdk/issues/16203)) ([b1d69d7](https://github.com/aws/aws-cdk/commit/b1d69d7b06cd2a2ae8f578e217bdf7fef50a0163)), closes [#14011](https://github.com/aws/aws-cdk/issues/14011)
+* **ses:** drop spam rule appears in the incorrect order ([#16146](https://github.com/aws/aws-cdk/issues/16146)) ([677fedc](https://github.com/aws/aws-cdk/commit/677fedcc5351b8b5346970fac03e5e342f36265b)), closes [#16091](https://github.com/aws/aws-cdk/issues/16091)
+* **sqs:** unable to import a FIFO queue when the queue ARN is a token ([#15976](https://github.com/aws/aws-cdk/issues/15976)) ([a1a65bc](https://github.com/aws/aws-cdk/commit/a1a65bc9a38b06ec51dff462e52b1beb8d421a56)), closes [#12466](https://github.com/aws/aws-cdk/issues/12466)
+* **ssm:** StringParameter.fromStringParameterAttributes cannot accept version as a numeric Token ([#16048](https://github.com/aws/aws-cdk/issues/16048)) ([eb54cd4](https://github.com/aws/aws-cdk/commit/eb54cd416a48708898e30986058491e21125b2f7)), closes [#11913](https://github.com/aws/aws-cdk/issues/11913)
+* (aws-ec2): fix vpc endpoint incorrect issue in China region ([#16139](https://github.com/aws/aws-cdk/issues/16139)) ([0d0db38](https://github.com/aws/aws-cdk/commit/0d0db38e3cdb557b4a641c5993068400847cc7df)), closes [#9864](https://github.com/aws/aws-cdk/issues/9864)
+* KubectlHandler - insecure kubeconfig warning ([#16063](https://github.com/aws/aws-cdk/issues/16063)) ([82dd282](https://github.com/aws/aws-cdk/commit/82dd2822a86431d0aa0be896550d421810b80c67)), closes [#14560](https://github.com/aws/aws-cdk/issues/14560)
+
+
+### Reverts
+
+* **cli:** 'deploy' and 'diff' silently does nothing when given unknown stack name ([#16125](https://github.com/aws/aws-cdk/issues/16125)) ([f2d77d3](https://github.com/aws/aws-cdk/commit/f2d77d336d535ef718813b4ed6b88b5d2af05cb9)), closes [aws/aws-cdk#16073](https://github.com/aws/aws-cdk/issues/16073)
+* temporarily transfer [@skinny85](https://github.com/skinny85) module ownership ([#16206](https://github.com/aws/aws-cdk/issues/16206)) ([e678f10](https://github.com/aws/aws-cdk/commit/e678f104df4fb0377c6ad5c8abc4132433363871))
+
 ## [1.119.0](https://github.com/aws/aws-cdk/compare/v1.118.0...v1.119.0) (2021-08-17)
 
 
diff --git a/version.v1.json b/version.v1.json
index e02425c0f7b3d..7ff9a577d56ba 100644
--- a/version.v1.json
+++ b/version.v1.json
@@ -1,3 +1,3 @@
 {
-  "version": "1.119.0"
+  "version": "1.120.0"
 }
\ No newline at end of file

From 7543f49407e0e3bbd75eb3146b9570a93fe17aa8 Mon Sep 17 00:00:00 2001
From: Elad Ben-Israel <benisrae@amazon.com>
Date: Thu, 26 Aug 2021 13:29:54 +0300
Subject: [PATCH 21/91] Update CHANGELOG.md

---
 CHANGELOG.md | 5 -----
 1 file changed, 5 deletions(-)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index a17afe6a8cc59..09152b13c5766 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -26,7 +26,6 @@ All notable changes to this project will be documented in this file. See [standa
 * **apigatewayv2:** http api - disallow empty string as domain name ([#16044](https://github.com/aws/aws-cdk/issues/16044)) ([9c39bcb](https://github.com/aws/aws-cdk/commit/9c39bcb970fc791e94d199b962cc006fca1a3320))
 * **appsync:** addSubscription only allows for field type ([#16097](https://github.com/aws/aws-cdk/issues/16097)) ([000d151](https://github.com/aws/aws-cdk/commit/000d151bec2215aa530819c3cf2c8c432352fec3)), closes [#10078](https://github.com/aws/aws-cdk/issues/10078) [#16071](https://github.com/aws/aws-cdk/issues/16071)
 * **cfnspec:** changes to resource-level documentation not supported ([#16170](https://github.com/aws/aws-cdk/issues/16170)) ([82e4b4f](https://github.com/aws/aws-cdk/commit/82e4b4f07be202e2d6c6afa4f9ed0d9d6146f0a8))
-* **cli:** 'deploy' and 'diff' silently does nothing when given unknown stack name ([#16073](https://github.com/aws/aws-cdk/issues/16073)) ([f35b032](https://github.com/aws/aws-cdk/commit/f35b032cea4354992d3320e78c1ed0e2878a3fe7)), closes [#15866](https://github.com/aws/aws-cdk/issues/15866)
 * **cli:** Python init template does not work in directory with '-' ([#15939](https://github.com/aws/aws-cdk/issues/15939)) ([3b2c790](https://github.com/aws/aws-cdk/commit/3b2c790c2b7d210868576540feab4e088376ab6c)), closes [#15938](https://github.com/aws/aws-cdk/issues/15938)
 * **cli:** unknown command pytest in build container fails integration tests ([#16134](https://github.com/aws/aws-cdk/issues/16134)) ([0f7c0b4](https://github.com/aws/aws-cdk/commit/0f7c0b421327f1ffed28de79692191af187f23ca)), closes [#15939](https://github.com/aws/aws-cdk/issues/15939)
 * **resourcegroups:** ResourceGroup not using TagType.STANDARD, causes deploy failure ([#16211](https://github.com/aws/aws-cdk/issues/16211)) ([cdee1af](https://github.com/aws/aws-cdk/commit/cdee1af03c34a1c08988e672bae6edc2538a8877)), closes [#12986](https://github.com/aws/aws-cdk/issues/12986)
@@ -38,10 +37,6 @@ All notable changes to this project will be documented in this file. See [standa
 * KubectlHandler - insecure kubeconfig warning ([#16063](https://github.com/aws/aws-cdk/issues/16063)) ([82dd282](https://github.com/aws/aws-cdk/commit/82dd2822a86431d0aa0be896550d421810b80c67)), closes [#14560](https://github.com/aws/aws-cdk/issues/14560)
 
 
-### Reverts
-
-* **cli:** 'deploy' and 'diff' silently does nothing when given unknown stack name ([#16125](https://github.com/aws/aws-cdk/issues/16125)) ([f2d77d3](https://github.com/aws/aws-cdk/commit/f2d77d336d535ef718813b4ed6b88b5d2af05cb9)), closes [aws/aws-cdk#16073](https://github.com/aws/aws-cdk/issues/16073)
-* temporarily transfer [@skinny85](https://github.com/skinny85) module ownership ([#16206](https://github.com/aws/aws-cdk/issues/16206)) ([e678f10](https://github.com/aws/aws-cdk/commit/e678f104df4fb0377c6ad5c8abc4132433363871))
 
 ## [1.119.0](https://github.com/aws/aws-cdk/compare/v1.118.0...v1.119.0) (2021-08-17)
 

From 0d96a6772da79fbafcb586b982e5bc5316d45589 Mon Sep 17 00:00:00 2001
From: Elad Ben-Israel <benisrae@amazon.com>
Date: Thu, 26 Aug 2021 13:37:35 +0300
Subject: [PATCH 22/91] Apply suggestions from code review

Co-authored-by: Niranjan Jayakar <nija@amazon.com>
---
 CHANGELOG.md | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index 09152b13c5766..5b5e333536dde 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -8,7 +8,7 @@ All notable changes to this project will be documented in this file. See [standa
 ### Features
 
 * **assertions:** queries and assertions against the Outputs and Mappings sections ([#15892](https://github.com/aws/aws-cdk/issues/15892)) ([90f95e1](https://github.com/aws/aws-cdk/commit/90f95e10f4dd9e4992731d6262dcfc767b65ab3f))
-* **aws-stepfunctions:** add support to heartbeat error inside catch block ([#16078](https://github.com/aws/aws-cdk/issues/16078)) ([2372b3c](https://github.com/aws/aws-cdk/commit/2372b3c360d13fb0224fc981a7bb1ae318581265)), closes [#16084](https://github.com/aws/aws-cdk/issues/16084)
+* **stepfunctions:** add support to heartbeat error inside catch block ([#16078](https://github.com/aws/aws-cdk/issues/16078)) ([2372b3c](https://github.com/aws/aws-cdk/commit/2372b3c360d13fb0224fc981a7bb1ae318581265)), closes [#16084](https://github.com/aws/aws-cdk/issues/16084)
 * **cfnspec:** cloudformation spec v39.10.0 ([#16114](https://github.com/aws/aws-cdk/issues/16114)) ([7e0ad5d](https://github.com/aws/aws-cdk/commit/7e0ad5d17b30150922d0dfd81f42da11fadb8beb))
 * **cfnspec:** cloudformation spec v40.0.0 ([#16183](https://github.com/aws/aws-cdk/issues/16183)) ([b059124](https://github.com/aws/aws-cdk/commit/b059124b238e27751217cbdaaa01c38b00e80fc9))
 * **cloudwatch:** add support for cross-account alarms ([#16007](https://github.com/aws/aws-cdk/issues/16007)) ([e547ba0](https://github.com/aws/aws-cdk/commit/e547ba0d1491af0abe703132fa06fe786ffd7070)), closes [#15959](https://github.com/aws/aws-cdk/issues/15959)

From 00b9c84da7351a2eeaff0a0f31728508597fe400 Mon Sep 17 00:00:00 2001
From: Elad Ben-Israel <benisrae@amazon.com>
Date: Thu, 26 Aug 2021 13:40:47 +0300
Subject: [PATCH 23/91] Update CHANGELOG.md

---
 CHANGELOG.md | 5 ++---
 1 file changed, 2 insertions(+), 3 deletions(-)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index 5b5e333536dde..dd16881355b70 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -9,7 +9,6 @@ All notable changes to this project will be documented in this file. See [standa
 
 * **assertions:** queries and assertions against the Outputs and Mappings sections ([#15892](https://github.com/aws/aws-cdk/issues/15892)) ([90f95e1](https://github.com/aws/aws-cdk/commit/90f95e10f4dd9e4992731d6262dcfc767b65ab3f))
 * **stepfunctions:** add support to heartbeat error inside catch block ([#16078](https://github.com/aws/aws-cdk/issues/16078)) ([2372b3c](https://github.com/aws/aws-cdk/commit/2372b3c360d13fb0224fc981a7bb1ae318581265)), closes [#16084](https://github.com/aws/aws-cdk/issues/16084)
-* **cfnspec:** cloudformation spec v39.10.0 ([#16114](https://github.com/aws/aws-cdk/issues/16114)) ([7e0ad5d](https://github.com/aws/aws-cdk/commit/7e0ad5d17b30150922d0dfd81f42da11fadb8beb))
 * **cfnspec:** cloudformation spec v40.0.0 ([#16183](https://github.com/aws/aws-cdk/issues/16183)) ([b059124](https://github.com/aws/aws-cdk/commit/b059124b238e27751217cbdaaa01c38b00e80fc9))
 * **cloudwatch:** add support for cross-account alarms ([#16007](https://github.com/aws/aws-cdk/issues/16007)) ([e547ba0](https://github.com/aws/aws-cdk/commit/e547ba0d1491af0abe703132fa06fe786ffd7070)), closes [#15959](https://github.com/aws/aws-cdk/issues/15959)
 * **codecommit:** make Repository a source for CodeStar Notifications ([#15739](https://github.com/aws/aws-cdk/issues/15739)) ([ae34d4a](https://github.com/aws/aws-cdk/commit/ae34d4a69a5073d8f0175b5282fa8bf92139fab5))
@@ -33,8 +32,8 @@ All notable changes to this project will be documented in this file. See [standa
 * **ses:** drop spam rule appears in the incorrect order ([#16146](https://github.com/aws/aws-cdk/issues/16146)) ([677fedc](https://github.com/aws/aws-cdk/commit/677fedcc5351b8b5346970fac03e5e342f36265b)), closes [#16091](https://github.com/aws/aws-cdk/issues/16091)
 * **sqs:** unable to import a FIFO queue when the queue ARN is a token ([#15976](https://github.com/aws/aws-cdk/issues/15976)) ([a1a65bc](https://github.com/aws/aws-cdk/commit/a1a65bc9a38b06ec51dff462e52b1beb8d421a56)), closes [#12466](https://github.com/aws/aws-cdk/issues/12466)
 * **ssm:** StringParameter.fromStringParameterAttributes cannot accept version as a numeric Token ([#16048](https://github.com/aws/aws-cdk/issues/16048)) ([eb54cd4](https://github.com/aws/aws-cdk/commit/eb54cd416a48708898e30986058491e21125b2f7)), closes [#11913](https://github.com/aws/aws-cdk/issues/11913)
-* (aws-ec2): fix vpc endpoint incorrect issue in China region ([#16139](https://github.com/aws/aws-cdk/issues/16139)) ([0d0db38](https://github.com/aws/aws-cdk/commit/0d0db38e3cdb557b4a641c5993068400847cc7df)), closes [#9864](https://github.com/aws/aws-cdk/issues/9864)
-* KubectlHandler - insecure kubeconfig warning ([#16063](https://github.com/aws/aws-cdk/issues/16063)) ([82dd282](https://github.com/aws/aws-cdk/commit/82dd2822a86431d0aa0be896550d421810b80c67)), closes [#14560](https://github.com/aws/aws-cdk/issues/14560)
+* **ec2:** fix vpc endpoint incorrect issue in China region ([#16139](https://github.com/aws/aws-cdk/issues/16139)) ([0d0db38](https://github.com/aws/aws-cdk/commit/0d0db38e3cdb557b4a641c5993068400847cc7df)), closes [#9864](https://github.com/aws/aws-cdk/issues/9864)
+* **eks:** insecure kubeconfig warning ([#16063](https://github.com/aws/aws-cdk/issues/16063)) ([82dd282](https://github.com/aws/aws-cdk/commit/82dd2822a86431d0aa0be896550d421810b80c67)), closes [#14560](https://github.com/aws/aws-cdk/issues/14560)
 
 
 

From 0889564a0c1b04d33909dd3fdb42147f23d67cbd Mon Sep 17 00:00:00 2001
From: Yihui Han <53243835+readybuilderone@users.noreply.github.com>
Date: Fri, 27 Aug 2021 00:50:13 +0800
Subject: [PATCH 24/91] fix(apigatewayv2): api mapping key with two hyphens is
 disallowed (#16204)

fix(apigatewayv2): fix api mapping key too strict issue.

This PR fix the issue that Validation of apiMappingKey in ApiMappingProps is too strict.

Closes: #15948

----
# Considerations:

The validation rule of the apiMappingKey was added in [PR #9141](https://github.com/aws/aws-cdk/pull/9141) to fix [issue #8983](https://github.com/aws/aws-cdk/issues/8983).

However, as time changed, it looks like the validation rules have changed as well.
But the validation rules are not clearly written out in AWS documentation, so I did [various validations](https://github.com/aws/aws-cdk/issues/15948#issuecomment-899520871) in the AWS console based on the unit test, and found the rules to be very complex.

Thanks to @pahud and @nija-at 's suggestions, there is no need to stand in the way between CDK users and API Gateway supporting more possibilities in the future, I just removed the validation logic and the relative unit tests.

*By submitting this pull request, I confirm that my contribution is made under the terms of the Apache-2.0 license*
---
 .../lib/common/api-mapping.ts                 |   5 -
 .../test/common/api-mapping.test.ts           | 114 ------------------
 2 files changed, 119 deletions(-)

diff --git a/packages/@aws-cdk/aws-apigatewayv2/lib/common/api-mapping.ts b/packages/@aws-cdk/aws-apigatewayv2/lib/common/api-mapping.ts
index f9ebfc89b52ca..a4031ddf783e2 100644
--- a/packages/@aws-cdk/aws-apigatewayv2/lib/common/api-mapping.ts
+++ b/packages/@aws-cdk/aws-apigatewayv2/lib/common/api-mapping.ts
@@ -103,11 +103,6 @@ export class ApiMapping extends Resource implements IApiMapping {
       }
     }
 
-    const paramRe = '^[a-zA-Z0-9]*[-_.+!,$]?[a-zA-Z0-9]*$';
-    if (props.apiMappingKey && !new RegExp(paramRe).test(props.apiMappingKey)) {
-      throw new Error('An ApiMapping key may contain only letters, numbers and one of $-_.+!*\'(),');
-    }
-
     if (props.apiMappingKey === '') {
       throw new Error('empty string for api mapping key not allowed');
     }
diff --git a/packages/@aws-cdk/aws-apigatewayv2/test/common/api-mapping.test.ts b/packages/@aws-cdk/aws-apigatewayv2/test/common/api-mapping.test.ts
index 607afb5f8238f..ff53d3dad11fc 100644
--- a/packages/@aws-cdk/aws-apigatewayv2/test/common/api-mapping.test.ts
+++ b/packages/@aws-cdk/aws-apigatewayv2/test/common/api-mapping.test.ts
@@ -83,120 +83,6 @@ describe('ApiMapping', () => {
     }).toThrow(/empty string for api mapping key not allowed/);
   });
 
-  test('apiMappingKey validation - single slash not allowed', () => {
-
-    const stack = new Stack();
-    const api = new HttpApi(stack, 'Api');
-
-    const dn = new DomainName(stack, 'DomainName', {
-      domainName,
-      certificate: Certificate.fromCertificateArn(stack, 'cert', certArn),
-    });
-
-    expect(() => {
-      new ApiMapping(stack, 'Mapping', {
-        api,
-        domainName: dn,
-        apiMappingKey: '/',
-      });
-    }).toThrow(/An ApiMapping key may contain only letters, numbers and one of/);
-  });
-
-  test('apiMappingKey validation - prefix slash not allowd', () => {
-
-    const stack = new Stack();
-    const api = new HttpApi(stack, 'Api');
-
-    const dn = new DomainName(stack, 'DomainName', {
-      domainName,
-      certificate: Certificate.fromCertificateArn(stack, 'cert', certArn),
-    });
-
-    expect(() => {
-      new ApiMapping(stack, 'Mapping', {
-        api,
-        domainName: dn,
-        apiMappingKey: '/foo',
-      });
-    }).toThrow(/An ApiMapping key may contain only letters, numbers and one of/);
-  });
-
-  test('apiMappingKey validation - slash in the middle not allowed', () => {
-
-    const stack = new Stack();
-    const api = new HttpApi(stack, 'Api');
-
-    const dn = new DomainName(stack, 'DomainName', {
-      domainName,
-      certificate: Certificate.fromCertificateArn(stack, 'cert', certArn),
-    });
-
-    expect(() => {
-      new ApiMapping(stack, 'Mapping', {
-        api,
-        domainName: dn,
-        apiMappingKey: 'foo/bar',
-      });
-    }).toThrow(/An ApiMapping key may contain only letters, numbers and one of/);
-  });
-
-  test('apiMappingKey validation - trailing slash not allowed', () => {
-
-    const stack = new Stack();
-    const api = new HttpApi(stack, 'Api');
-
-    const dn = new DomainName(stack, 'DomainName', {
-      domainName,
-      certificate: Certificate.fromCertificateArn(stack, 'cert', certArn),
-    });
-
-    expect(() => {
-      new ApiMapping(stack, 'Mapping', {
-        api,
-        domainName: dn,
-        apiMappingKey: 'foo/',
-      });
-    }).toThrow(/An ApiMapping key may contain only letters, numbers and one of/);
-  });
-
-  test('apiMappingKey validation - special character in the prefix not allowed', () => {
-
-    const stack = new Stack();
-    const api = new HttpApi(stack, 'Api');
-
-    const dn = new DomainName(stack, 'DomainName', {
-      domainName,
-      certificate: Certificate.fromCertificateArn(stack, 'cert', certArn),
-    });
-
-    expect(() => {
-      new ApiMapping(stack, 'Mapping', {
-        api,
-        domainName: dn,
-        apiMappingKey: '^foo',
-      });
-    }).toThrow(/An ApiMapping key may contain only letters, numbers and one of/);
-  });
-
-  test('apiMappingKey validation - multiple special character not allowed', () => {
-
-    const stack = new Stack();
-    const api = new HttpApi(stack, 'Api');
-
-    const dn = new DomainName(stack, 'DomainName', {
-      domainName,
-      certificate: Certificate.fromCertificateArn(stack, 'cert', certArn),
-    });
-
-    expect(() => {
-      new ApiMapping(stack, 'Mapping', {
-        api,
-        domainName: dn,
-        apiMappingKey: 'foo.*$',
-      });
-    }).toThrow(/An ApiMapping key may contain only letters, numbers and one of/);
-  });
-
   test('import mapping', () => {
 
     const stack = new Stack();

From 5cec2f8c4f2e08838e20b9757cda446f428b80c9 Mon Sep 17 00:00:00 2001
From: Wouter Klijn <git@wouterklijn.com>
Date: Thu, 26 Aug 2021 19:30:15 +0200
Subject: [PATCH 25/91] chore(rds): add new versions of MariaDB, MySQL and SQL
 Server engines (#16115)

Added every change as a separate commit, feel free to rebase as you see fit.

----

*By submitting this pull request, I confirm that my contribution is made under the terms of the Apache-2.0 license*
---
 packages/@aws-cdk/aws-rds/lib/instance-engine.ts | 15 ++++++++++++++-
 1 file changed, 14 insertions(+), 1 deletion(-)

diff --git a/packages/@aws-cdk/aws-rds/lib/instance-engine.ts b/packages/@aws-cdk/aws-rds/lib/instance-engine.ts
index eacb8097da55e..c070b0988e314 100644
--- a/packages/@aws-cdk/aws-rds/lib/instance-engine.ts
+++ b/packages/@aws-cdk/aws-rds/lib/instance-engine.ts
@@ -247,6 +247,8 @@ export class MariaDbEngineVersion {
   public static readonly VER_10_2_32 = MariaDbEngineVersion.of('10.2.32', '10.2');
   /** Version "10.2.37". */
   public static readonly VER_10_2_37 = MariaDbEngineVersion.of('10.2.37', '10.2');
+  /** Version "10.2.39". */
+  public static readonly VER_10_2_39 = MariaDbEngineVersion.of('10.2.39', '10.2');
 
   /** Version "10.3" (only a major version, without a specific minor version). */
   public static readonly VER_10_3 = MariaDbEngineVersion.of('10.3', '10.3');
@@ -462,6 +464,8 @@ export class MysqlEngineVersion {
   public static readonly VER_5_7_31 = MysqlEngineVersion.of('5.7.31', '5.7');
   /** Version "5.7.33". */
   public static readonly VER_5_7_33 = MysqlEngineVersion.of('5.7.33', '5.7');
+  /** Version "5.7.34". */
+  public static readonly VER_5_7_34 = MysqlEngineVersion.of('5.7.34', '5.7');
 
   /** Version "8.0" (only a major version, without a specific minor version). */
   public static readonly VER_8_0 = MysqlEngineVersion.of('8.0', '8.0');
@@ -1330,6 +1334,10 @@ export class SqlServerEngineVersion {
   public static readonly VER_13_00_5598_27_V1 = SqlServerEngineVersion.of('13.00.5598.27.v1', '13.00');
   /** Version "13.00.5820.21.v1". */
   public static readonly VER_13_00_5820_21_V1 = SqlServerEngineVersion.of('13.00.5820.21.v1', '13.00');
+  /** Version "13.00.5850.14.v1". */
+  public static readonly VER_13_00_5850_14_V1 = SqlServerEngineVersion.of('13.00.5850.14.v1', '13.00');
+  /** Version "13.00.5882.1.v1". */
+  public static readonly VER_13_00_5882_1_V1 = SqlServerEngineVersion.of('13.00.5882.1.v1', '13.00');
 
   /** Version "14.00" (only a major version, without a specific minor version). */
   public static readonly VER_14 = SqlServerEngineVersion.of('14.00', '14.00');
@@ -1358,8 +1366,13 @@ export class SqlServerEngineVersion {
   public static readonly VER_15 = SqlServerEngineVersion.of('15.00', '15.00');
   /** Version "15.00.4043.16.v1". */
   public static readonly VER_15_00_4043_16_V1 = SqlServerEngineVersion.of('15.00.4043.16.v1', '15.00');
-  /** Version "15.00.4043.23.v1". */
+  /**
+   * Version "15.00.4043.23.v1".
+   * @deprecated This version is erroneous. You might be looking for {@link SqlServerEngineVersion.VER_15_00_4073_23_V1}, instead.
+   */
   public static readonly VER_15_00_4043_23_V1 = SqlServerEngineVersion.of('15.00.4043.23.v1', '15.00');
+  /** Version "15.00.4073.23.v1". */
+  public static readonly VER_15_00_4073_23_V1 = SqlServerEngineVersion.of('15.00.4073.23.v1', '15.00');
 
   /**
    * Create a new SqlServerEngineVersion with an arbitrary version.

From f40e8d6a502dd42e0a52d81f72abecaa2cdd920a Mon Sep 17 00:00:00 2001
From: Yuto Osawa <osawa.yuto@classmethod.jp>
Date: Fri, 27 Aug 2021 03:11:57 +0900
Subject: [PATCH 26/91] feat(ecs-patterns): add capacity provider strategies to
 queue processing service pattern (#15684)

closes #14781

----

*By submitting this pull request, I confirm that my contribution is made under the terms of the Apache-2.0 license*
---
 packages/@aws-cdk/aws-ecs-patterns/README.md  | 51 +++++++++++++++++++
 .../lib/base/queue-processing-service-base.ts | 10 +++-
 .../lib/ecs/queue-processing-ecs-service.ts   |  1 +
 .../queue-processing-fargate-service.ts       |  1 +
 .../@aws-cdk/aws-ecs-patterns/package.json    |  2 +
 .../ec2/test.queue-processing-ecs-service.ts  | 45 ++++++++++++++++
 .../test.queue-processing-fargate-service.ts  | 45 ++++++++++++++++
 7 files changed, 154 insertions(+), 1 deletion(-)

diff --git a/packages/@aws-cdk/aws-ecs-patterns/README.md b/packages/@aws-cdk/aws-ecs-patterns/README.md
index 58dba9f6786cb..fbeb84acb49e6 100644
--- a/packages/@aws-cdk/aws-ecs-patterns/README.md
+++ b/packages/@aws-cdk/aws-ecs-patterns/README.md
@@ -484,6 +484,57 @@ const queueProcessingFargateService = new QueueProcessingFargateService(stack, '
 });
 ```
 
+### Set capacityProviderStrategies for QueueProcessingFargateService
+
+```ts
+const vpc = new ec2.Vpc(stack, 'Vpc', { maxAzs: 1 });
+const cluster = new ecs.Cluster(stack, 'EcsCluster', { vpc });
+cluster.enableFargateCapacityProviders();
+
+const queueProcessingFargateService = new QueueProcessingFargateService(stack, 'Service', {
+  cluster,
+  memoryLimitMiB: 512,
+  image: ecs.ContainerImage.fromRegistry('test'),
+  capacityProviderStrategies: [
+    {
+      capacityProvider: 'FARGATE_SPOT',
+      weight: 2,
+    },
+    {
+      capacityProvider: 'FARGATE',
+      weight: 1,
+    },
+  ],
+});
+```
+
+### Set capacityProviderStrategies for QueueProcessingEc2Service
+
+```ts
+const vpc = new ec2.Vpc(stack, 'Vpc', { maxAzs: 1 });
+const cluster = new ecs.Cluster(stack, 'EcsCluster', { vpc });
+const autoScalingGroup = new autoscaling.AutoScalingGroup(stack, 'asg', {
+  vpc,
+  instanceType: ec2.InstanceType.of(ec2.InstanceClass.BURSTABLE2, ec2.InstanceSize.MICRO),
+  machineImage: ecs.EcsOptimizedImage.amazonLinux2(),
+});
+const capacityProvider = new ecs.AsgCapacityProvider(stack, 'provider', {
+  autoScalingGroup,
+});
+cluster.addAsgCapacityProvider(capacityProvider);
+
+const queueProcessingFargateService = new QueueProcessingFargateService(stack, 'Service', {
+  cluster,
+  memoryLimitMiB: 512,
+  image: ecs.ContainerImage.fromRegistry('test'),
+  capacityProviderStrategies: [
+    {
+      capacityProvider: capacityProvider.capacityProviderName,
+    },
+  ],
+});
+```
+
 ### Select specific vpc subnets for ApplicationLoadBalancedFargateService
 
 ```ts
diff --git a/packages/@aws-cdk/aws-ecs-patterns/lib/base/queue-processing-service-base.ts b/packages/@aws-cdk/aws-ecs-patterns/lib/base/queue-processing-service-base.ts
index b2da8f97e6bc4..2c293dc3173de 100644
--- a/packages/@aws-cdk/aws-ecs-patterns/lib/base/queue-processing-service-base.ts
+++ b/packages/@aws-cdk/aws-ecs-patterns/lib/base/queue-processing-service-base.ts
@@ -1,7 +1,7 @@
 import { ScalingInterval } from '@aws-cdk/aws-applicationautoscaling';
 import { IVpc } from '@aws-cdk/aws-ec2';
 import {
-  AwsLogDriver, BaseService, Cluster, ContainerImage, DeploymentController, DeploymentCircuitBreaker,
+  AwsLogDriver, BaseService, CapacityProviderStrategy, Cluster, ContainerImage, DeploymentController, DeploymentCircuitBreaker,
   ICluster, LogDriver, PropagatedTagSource, Secret,
 } from '@aws-cdk/aws-ecs';
 import { IQueue, Queue } from '@aws-cdk/aws-sqs';
@@ -207,6 +207,14 @@ export interface QueueProcessingServiceBaseProps {
    * @default - disabled
    */
   readonly circuitBreaker?: DeploymentCircuitBreaker;
+
+  /**
+   * A list of Capacity Provider strategies used to place a service.
+   *
+   * @default - undefined
+   *
+   */
+  readonly capacityProviderStrategies?: CapacityProviderStrategy[];
 }
 
 /**
diff --git a/packages/@aws-cdk/aws-ecs-patterns/lib/ecs/queue-processing-ecs-service.ts b/packages/@aws-cdk/aws-ecs-patterns/lib/ecs/queue-processing-ecs-service.ts
index d927284797b5b..0d9f612abfb76 100644
--- a/packages/@aws-cdk/aws-ecs-patterns/lib/ecs/queue-processing-ecs-service.ts
+++ b/packages/@aws-cdk/aws-ecs-patterns/lib/ecs/queue-processing-ecs-service.ts
@@ -123,6 +123,7 @@ export class QueueProcessingEc2Service extends QueueProcessingServiceBase {
       enableECSManagedTags: props.enableECSManagedTags,
       deploymentController: props.deploymentController,
       circuitBreaker: props.circuitBreaker,
+      capacityProviderStrategies: props.capacityProviderStrategies,
     });
 
     this.configureAutoscalingForService(this.service);
diff --git a/packages/@aws-cdk/aws-ecs-patterns/lib/fargate/queue-processing-fargate-service.ts b/packages/@aws-cdk/aws-ecs-patterns/lib/fargate/queue-processing-fargate-service.ts
index cb4b8d77a8188..e6f8b89c736b3 100644
--- a/packages/@aws-cdk/aws-ecs-patterns/lib/fargate/queue-processing-fargate-service.ts
+++ b/packages/@aws-cdk/aws-ecs-patterns/lib/fargate/queue-processing-fargate-service.ts
@@ -149,6 +149,7 @@ export class QueueProcessingFargateService extends QueueProcessingServiceBase {
       vpcSubnets: props.taskSubnets,
       assignPublicIp: props.assignPublicIp,
       circuitBreaker: props.circuitBreaker,
+      capacityProviderStrategies: props.capacityProviderStrategies,
     });
 
     this.configureAutoscalingForService(this.service);
diff --git a/packages/@aws-cdk/aws-ecs-patterns/package.json b/packages/@aws-cdk/aws-ecs-patterns/package.json
index 2bed9fe6b9cc8..c9d3b46b8f8b2 100644
--- a/packages/@aws-cdk/aws-ecs-patterns/package.json
+++ b/packages/@aws-cdk/aws-ecs-patterns/package.json
@@ -76,6 +76,7 @@
   },
   "dependencies": {
     "@aws-cdk/aws-applicationautoscaling": "0.0.0",
+    "@aws-cdk/aws-autoscaling": "0.0.0",
     "@aws-cdk/aws-certificatemanager": "0.0.0",
     "@aws-cdk/aws-ec2": "0.0.0",
     "@aws-cdk/aws-ecs": "0.0.0",
@@ -94,6 +95,7 @@
   "homepage": "https://github.com/aws/aws-cdk",
   "peerDependencies": {
     "@aws-cdk/aws-applicationautoscaling": "0.0.0",
+    "@aws-cdk/aws-autoscaling": "0.0.0",
     "@aws-cdk/aws-certificatemanager": "0.0.0",
     "@aws-cdk/aws-ec2": "0.0.0",
     "@aws-cdk/aws-ecs": "0.0.0",
diff --git a/packages/@aws-cdk/aws-ecs-patterns/test/ec2/test.queue-processing-ecs-service.ts b/packages/@aws-cdk/aws-ecs-patterns/test/ec2/test.queue-processing-ecs-service.ts
index 763cef9f33114..97bdb47c7b5b3 100644
--- a/packages/@aws-cdk/aws-ecs-patterns/test/ec2/test.queue-processing-ecs-service.ts
+++ b/packages/@aws-cdk/aws-ecs-patterns/test/ec2/test.queue-processing-ecs-service.ts
@@ -1,4 +1,5 @@
 import { ABSENT, expect, haveResource, haveResourceLike } from '@aws-cdk/assert-internal';
+import * as autoscaling from '@aws-cdk/aws-autoscaling';
 import * as ec2 from '@aws-cdk/aws-ec2';
 import * as ecs from '@aws-cdk/aws-ecs';
 import * as sqs from '@aws-cdk/aws-sqs';
@@ -351,4 +352,48 @@ export = {
 
     test.done();
   },
+
+  'can set capacity provider strategies'(test: Test) {
+    // GIVEN
+    const stack = new cdk.Stack();
+    const vpc = new ec2.Vpc(stack, 'VPC');
+    const cluster = new ecs.Cluster(stack, 'Cluster', { vpc });
+    const autoScalingGroup = new autoscaling.AutoScalingGroup(stack, 'asg', {
+      vpc,
+      instanceType: new ec2.InstanceType('bogus'),
+      machineImage: ecs.EcsOptimizedImage.amazonLinux2(),
+    });
+    const capacityProvider = new ecs.AsgCapacityProvider(stack, 'provider', {
+      autoScalingGroup,
+    });
+    cluster.addAsgCapacityProvider(capacityProvider);
+
+    // WHEN
+    new ecsPatterns.QueueProcessingEc2Service(stack, 'Service', {
+      cluster,
+      image: ecs.ContainerImage.fromRegistry('test'),
+      memoryLimitMiB: 512,
+      capacityProviderStrategies: [
+        {
+          capacityProvider: capacityProvider.capacityProviderName,
+        },
+      ],
+    });
+
+    // THEN
+    expect(stack).to(
+      haveResource('AWS::ECS::Service', {
+        LaunchType: ABSENT,
+        CapacityProviderStrategy: [
+          {
+            CapacityProvider: {
+              Ref: 'providerD3FF4D3A',
+            },
+          },
+        ],
+      }),
+    );
+
+    test.done();
+  },
 };
diff --git a/packages/@aws-cdk/aws-ecs-patterns/test/fargate/test.queue-processing-fargate-service.ts b/packages/@aws-cdk/aws-ecs-patterns/test/fargate/test.queue-processing-fargate-service.ts
index 7a0f33e3a0a0c..6b5a05ccaaf7b 100644
--- a/packages/@aws-cdk/aws-ecs-patterns/test/fargate/test.queue-processing-fargate-service.ts
+++ b/packages/@aws-cdk/aws-ecs-patterns/test/fargate/test.queue-processing-fargate-service.ts
@@ -529,4 +529,49 @@ export = {
 
     test.done();
   },
+
+  'can set capacity provider strategies'(test: Test) {
+    // GIVEN
+    const stack = new cdk.Stack();
+    const vpc = new ec2.Vpc(stack, 'MyVpc', {});
+    const cluster = new ecs.Cluster(stack, 'EcsCluster', {
+      vpc,
+    });
+    cluster.enableFargateCapacityProviders();
+
+    // WHEN
+    new ecsPatterns.QueueProcessingFargateService(stack, 'Service', {
+      cluster,
+      image: ecs.ContainerImage.fromRegistry('test'),
+      capacityProviderStrategies: [
+        {
+          capacityProvider: 'FARGATE_SPOT',
+          weight: 2,
+        },
+        {
+          capacityProvider: 'FARGATE',
+          weight: 1,
+        },
+      ],
+    });
+
+    // THEN
+    expect(stack).to(
+      haveResource('AWS::ECS::Service', {
+        LaunchType: ABSENT,
+        CapacityProviderStrategy: [
+          {
+            CapacityProvider: 'FARGATE_SPOT',
+            Weight: 2,
+          },
+          {
+            CapacityProvider: 'FARGATE',
+            Weight: 1,
+          },
+        ],
+      }),
+    );
+
+    test.done();
+  },
 };

From 04d45474d80d3687a3fdf27f4d76dd1c8521eff0 Mon Sep 17 00:00:00 2001
From: benhawley7 <31001948+benhawley7@users.noreply.github.com>
Date: Thu, 26 Aug 2021 19:53:35 +0100
Subject: [PATCH 27/91] fix(docs): unnecessary log group in Step Functions
 state machine x-ray example (#16159)

Removes an unnecessary log group definition from the code example for enabling X-Ray in the State Machine.

fixes https://github.com/aws/aws-cdk/issues/16158

----

*By submitting this pull request, I confirm that my contribution is made under the terms of the Apache-2.0 license*
---
 packages/@aws-cdk/aws-stepfunctions/README.md | 2 --
 1 file changed, 2 deletions(-)

diff --git a/packages/@aws-cdk/aws-stepfunctions/README.md b/packages/@aws-cdk/aws-stepfunctions/README.md
index 4faf512ad0509..6171bac75805a 100644
--- a/packages/@aws-cdk/aws-stepfunctions/README.md
+++ b/packages/@aws-cdk/aws-stepfunctions/README.md
@@ -593,8 +593,6 @@ new sfn.StateMachine(stack, 'MyStateMachine', {
 Enable X-Ray tracing for StateMachine:
 
 ```ts
-const logGroup = new logs.LogGroup(stack, 'MyLogGroup');
-
 new sfn.StateMachine(stack, 'MyStateMachine', {
     definition: sfn.Chain.start(new sfn.Pass(stack, 'Pass')),
     tracingEnabled: true

From a42a1ea5a122f864936cdb0113b16fe92cc7205e Mon Sep 17 00:00:00 2001
From: Robert Djurasaj <robertd@users.noreply.github.com>
Date: Thu, 26 Aug 2021 14:12:50 -0600
Subject: [PATCH 28/91] feat(ec2): add m6i instances (#16081)

https://aws.amazon.com/about-aws/whats-new/2021/08/amazon-ec2-m6i-instances/

----

*By submitting this pull request, I confirm that my contribution is made under the terms of the Apache-2.0 license*
---
 packages/@aws-cdk/aws-ec2/lib/instance-types.ts | 10 ++++++++++
 1 file changed, 10 insertions(+)

diff --git a/packages/@aws-cdk/aws-ec2/lib/instance-types.ts b/packages/@aws-cdk/aws-ec2/lib/instance-types.ts
index a12dfb92061c6..013f7d3389f3c 100644
--- a/packages/@aws-cdk/aws-ec2/lib/instance-types.ts
+++ b/packages/@aws-cdk/aws-ec2/lib/instance-types.ts
@@ -442,6 +442,16 @@ export enum InstanceClass {
    */
   M6G = 'm6g',
 
+  /**
+   * Standard instances based on Intel (Ice Lake), 6th generation.
+   */
+  STANDARD6_INTEL = 'm6i',
+
+  /**
+   * Standard instances based on Intel (Ice Lake), 6th generation.
+   */
+  M6I = 'm6i',
+
   /**
    * Standard instances, 6th generation with Graviton2 processors and local NVME drive
    */

From 2c3d21e2f1117a54510ba92748588ee95ab3631c Mon Sep 17 00:00:00 2001
From: ABevier <awbevier@gmail.com>
Date: Thu, 26 Aug 2021 19:16:26 -0400
Subject: [PATCH 29/91] feat(ecs-patterns): Allow configuration of SSL policy
 for listeners created by ECS patterns (#15210)

This pr adds the ability to specify the SSL policy of the listener created by an ECS L3 pattern.

The Listener's SSL Policy is immutable once it is created so I felt like this is best way to add this feature.   I plan to follow this PR up with another that implements #11841 and allows further configuration of the listener after it has been created.

closes #8816
----

*By submitting this pull request, I confirm that my contribution is made under the terms of the Apache-2.0 license*
---
 packages/@aws-cdk/aws-ecs-patterns/README.md  | 25 +++++++++++++++++++
 .../application-load-balanced-service-base.ts | 10 +++++++-
 ...ion-multiple-target-groups-service-base.ts | 24 +++++++++++++++---
 .../aws-ecs-patterns/test/ec2/test.l3s-v2.ts  | 12 ++++++++-
 .../aws-ecs-patterns/test/ec2/test.l3s.ts     |  4 ++-
 5 files changed, 68 insertions(+), 7 deletions(-)

diff --git a/packages/@aws-cdk/aws-ecs-patterns/README.md b/packages/@aws-cdk/aws-ecs-patterns/README.md
index fbeb84acb49e6..00212e704e294 100644
--- a/packages/@aws-cdk/aws-ecs-patterns/README.md
+++ b/packages/@aws-cdk/aws-ecs-patterns/README.md
@@ -330,6 +330,31 @@ const scheduledFargateTask = new ScheduledFargateTask(stack, 'ScheduledFargateTa
 
 In addition to using the constructs, users can also add logic to customize these constructs:
 
+### Configure HTTPS on an ApplicationLoadBalancedFargateService
+
+```ts
+import { ApplicationLoadBalancedFargateService } from './application-load-balanced-fargate-service';
+import { HostedZone } from '@aws-cdk/aws-route53';
+import { Certificate } from '@aws-cdk/aws-certificatemanager';
+import { SslPolicy } from '@aws-cdk/aws-elasticloadbalancingv2';
+
+const domainZone = HostedZone.fromLookup(this, 'Zone', { domainName: 'example.com' });
+const certificate = Certificate.fromCertificateArn(this, 'Cert', 'arn:aws:acm:us-east-1:123456:certificate/abcdefg');
+
+const loadBalancedFargateService = new ApplicationLoadBalancedFargateService(stack, 'Service', {
+  vpc
+  cluster,
+  certificate,
+  sslPolicy: SslPolicy.RECOMMENDED,
+  domainName: 'api.example.com',
+  domainZone,
+  redirectHTTP: true,
+  taskImageOptions: {
+    image: ecs.ContainerImage.fromRegistry("amazon/amazon-ecs-sample"),
+  },
+});
+```
+
 ### Add Schedule-Based Auto-Scaling to an ApplicationLoadBalancedFargateService
 
 ```ts
diff --git a/packages/@aws-cdk/aws-ecs-patterns/lib/base/application-load-balanced-service-base.ts b/packages/@aws-cdk/aws-ecs-patterns/lib/base/application-load-balanced-service-base.ts
index 3c9005af19daa..b4c41ed5aa990 100644
--- a/packages/@aws-cdk/aws-ecs-patterns/lib/base/application-load-balanced-service-base.ts
+++ b/packages/@aws-cdk/aws-ecs-patterns/lib/base/application-load-balanced-service-base.ts
@@ -6,7 +6,7 @@ import {
 } from '@aws-cdk/aws-ecs';
 import {
   ApplicationListener, ApplicationLoadBalancer, ApplicationProtocol, ApplicationProtocolVersion, ApplicationTargetGroup,
-  IApplicationLoadBalancer, ListenerCertificate, ListenerAction, AddApplicationTargetsProps,
+  IApplicationLoadBalancer, ListenerCertificate, ListenerAction, AddApplicationTargetsProps, SslPolicy,
 } from '@aws-cdk/aws-elasticloadbalancingv2';
 import { IRole } from '@aws-cdk/aws-iam';
 import { ARecord, IHostedZone, RecordTarget, CnameRecord } from '@aws-cdk/aws-route53';
@@ -190,6 +190,13 @@ export interface ApplicationLoadBalancedServiceBaseProps {
    */
   readonly listenerPort?: number;
 
+  /**
+   * The security policy that defines which ciphers and protocols are supported by the ALB Listener.
+   *
+   * @default - The recommended elastic load balancing security policy
+   */
+  readonly sslPolicy?: SslPolicy;
+
   /**
    * Specifies whether to propagate the tags from the task definition or the service to the tasks in the service.
    * Tags can only be propagated to the tasks within the service during service creation.
@@ -441,6 +448,7 @@ export abstract class ApplicationLoadBalancedServiceBase extends CoreConstruct {
       protocol,
       port: props.listenerPort,
       open: props.openListener ?? true,
+      sslPolicy: props.sslPolicy,
     });
     this.targetGroup = this.listener.addTargets('ECS', targetProps);
 
diff --git a/packages/@aws-cdk/aws-ecs-patterns/lib/base/application-multiple-target-groups-service-base.ts b/packages/@aws-cdk/aws-ecs-patterns/lib/base/application-multiple-target-groups-service-base.ts
index 9d9c21c9e7b5e..e2cafab14e71a 100644
--- a/packages/@aws-cdk/aws-ecs-patterns/lib/base/application-multiple-target-groups-service-base.ts
+++ b/packages/@aws-cdk/aws-ecs-patterns/lib/base/application-multiple-target-groups-service-base.ts
@@ -4,7 +4,7 @@ import {
   AwsLogDriver, BaseService, CloudMapOptions, Cluster, ContainerDefinition, ContainerImage, ICluster, LogDriver, PropagatedTagSource,
   Protocol, Secret,
 } from '@aws-cdk/aws-ecs';
-import { ApplicationListener, ApplicationLoadBalancer, ApplicationProtocol, ApplicationTargetGroup } from '@aws-cdk/aws-elasticloadbalancingv2';
+import { ApplicationListener, ApplicationLoadBalancer, ApplicationProtocol, ApplicationTargetGroup, SslPolicy } from '@aws-cdk/aws-elasticloadbalancingv2';
 import { IRole } from '@aws-cdk/aws-iam';
 import { ARecord, IHostedZone, RecordTarget } from '@aws-cdk/aws-route53';
 import { LoadBalancerTarget } from '@aws-cdk/aws-route53-targets';
@@ -332,6 +332,13 @@ export interface ApplicationListenerProps {
    * created for the load balancer's specified domain name.
    */
   readonly certificate?: ICertificate;
+
+  /**
+   * The security policy that defines which ciphers and protocols are supported by the ALB Listener.
+   *
+   * @default - The recommended elastic load balancing security policy
+   */
+  readonly sslPolicy?: SslPolicy;
 }
 
 /**
@@ -407,6 +414,7 @@ export abstract class ApplicationMultipleTargetGroupsServiceBase extends CoreCon
             listenerName: listenerProps.name,
             loadBalancer: lb,
             port: listenerProps.port,
+            sslPolicy: listenerProps.sslPolicy,
           });
           this.listeners.push(listener);
         }
@@ -503,7 +511,7 @@ export abstract class ApplicationMultipleTargetGroupsServiceBase extends CoreCon
   }
 
   private configListener(protocol: ApplicationProtocol, props: ListenerConfig): ApplicationListener {
-    const listener = this.createListener(props.listenerName, props.loadBalancer, protocol, props.port);
+    const listener = this.createListener(props, protocol);
     let certificate;
     if (protocol === ApplicationProtocol.HTTPS) {
       certificate = this.createListenerCertificate(props.listenerName, props.certificate, props.domainName, props.domainZone);
@@ -567,11 +575,12 @@ export abstract class ApplicationMultipleTargetGroupsServiceBase extends CoreCon
     }
   }
 
-  private createListener(name: string, lb: ApplicationLoadBalancer, protocol?: ApplicationProtocol, port?: number): ApplicationListener {
-    return lb.addListener(name, {
+  private createListener({ loadBalancer, listenerName, port, sslPolicy }: ListenerConfig, protocol?: ApplicationProtocol): ApplicationListener {
+    return loadBalancer.addListener(listenerName, {
       protocol,
       open: true,
       port,
+      sslPolicy,
     });
   }
 
@@ -622,6 +631,13 @@ interface ListenerConfig {
    */
   readonly certificate?: ICertificate;
 
+  /**
+   * SSL Policy for the listener
+   *
+   * @default null
+   */
+  readonly sslPolicy?: SslPolicy;
+
   /**
    * The domain name for the service, e.g. "api.example.com."
    *
diff --git a/packages/@aws-cdk/aws-ecs-patterns/test/ec2/test.l3s-v2.ts b/packages/@aws-cdk/aws-ecs-patterns/test/ec2/test.l3s-v2.ts
index 0946123907fe2..5c3c5889c62b6 100644
--- a/packages/@aws-cdk/aws-ecs-patterns/test/ec2/test.l3s-v2.ts
+++ b/packages/@aws-cdk/aws-ecs-patterns/test/ec2/test.l3s-v2.ts
@@ -2,7 +2,7 @@ import { expect, haveResource, haveResourceLike, SynthUtils } from '@aws-cdk/ass
 import { Certificate } from '@aws-cdk/aws-certificatemanager';
 import { InstanceType, Vpc } from '@aws-cdk/aws-ec2';
 import { AwsLogDriver, Cluster, ContainerImage, Ec2TaskDefinition, PropagatedTagSource, Protocol } from '@aws-cdk/aws-ecs';
-import { ApplicationProtocol } from '@aws-cdk/aws-elasticloadbalancingv2';
+import { ApplicationProtocol, SslPolicy } from '@aws-cdk/aws-elasticloadbalancingv2';
 import { CompositePrincipal, Role, ServicePrincipal } from '@aws-cdk/aws-iam';
 import { PublicHostedZone } from '@aws-cdk/aws-route53';
 import { NamespaceType } from '@aws-cdk/aws-servicediscovery';
@@ -124,6 +124,7 @@ export = {
                 name: 'listener',
                 protocol: ApplicationProtocol.HTTPS,
                 certificate: Certificate.fromCertificateArn(stack, 'Cert', 'helloworld'),
+                sslPolicy: SslPolicy.TLS12_EXT,
               },
             ],
           },
@@ -240,6 +241,15 @@ export = {
         },
       }));
 
+      expect(stack).to(haveResourceLike('AWS::ElasticLoadBalancingV2::Listener', {
+        Port: 443,
+        Protocol: 'HTTPS',
+        Certificates: [{
+          CertificateArn: 'helloworld',
+        }],
+        SslPolicy: SslPolicy.TLS12_EXT,
+      }));
+
       test.done();
     },
 
diff --git a/packages/@aws-cdk/aws-ecs-patterns/test/ec2/test.l3s.ts b/packages/@aws-cdk/aws-ecs-patterns/test/ec2/test.l3s.ts
index 5ef253d71bdb1..8e2f527fbe509 100644
--- a/packages/@aws-cdk/aws-ecs-patterns/test/ec2/test.l3s.ts
+++ b/packages/@aws-cdk/aws-ecs-patterns/test/ec2/test.l3s.ts
@@ -2,7 +2,7 @@ import { ABSENT, arrayWith, expect, haveResource, haveResourceLike, objectLike }
 import { Certificate } from '@aws-cdk/aws-certificatemanager';
 import * as ec2 from '@aws-cdk/aws-ec2';
 import * as ecs from '@aws-cdk/aws-ecs';
-import { ApplicationLoadBalancer, ApplicationProtocol, ApplicationProtocolVersion, NetworkLoadBalancer } from '@aws-cdk/aws-elasticloadbalancingv2';
+import { ApplicationLoadBalancer, ApplicationProtocol, ApplicationProtocolVersion, NetworkLoadBalancer, SslPolicy } from '@aws-cdk/aws-elasticloadbalancingv2';
 import { PublicHostedZone } from '@aws-cdk/aws-route53';
 import * as cloudmap from '@aws-cdk/aws-servicediscovery';
 import * as cdk from '@aws-cdk/core';
@@ -508,6 +508,7 @@ export = {
       domainName: 'api.example.com',
       domainZone: zone,
       certificate: Certificate.fromCertificateArn(stack, 'Cert', 'helloworld'),
+      sslPolicy: SslPolicy.TLS12_EXT,
     });
 
     // THEN - stack contains a load balancer and a service
@@ -519,6 +520,7 @@ export = {
       Certificates: [{
         CertificateArn: 'helloworld',
       }],
+      SslPolicy: SslPolicy.TLS12_EXT,
     }));
 
     expect(stack).to(haveResource('AWS::ElasticLoadBalancingV2::TargetGroup', {

From f42b233a76ae810634fa43a25604dbc65bdd63b9 Mon Sep 17 00:00:00 2001
From: Robert Djurasaj <robertd@users.noreply.github.com>
Date: Fri, 27 Aug 2021 04:18:44 -0600
Subject: [PATCH 30/91] feat(aws-cloudfront-origins): add custom headers to
 S3Origin (#16161)

Closes #16160.

@njlynch Can you please review this when time permits and see if it needs any further polishing.

cc @nwitte-rocketloans

----

*By submitting this pull request, I confirm that my contribution is made under the terms of the Apache-2.0 license*
---
 .../@aws-cdk/aws-cloudfront-origins/README.md | 18 +++++++
 .../aws-cloudfront-origins/lib/s3-origin.ts   |  9 +---
 .../test/s3-origin.test.ts                    | 17 +++++--
 .../@aws-cdk/aws-cloudfront/lib/origin.ts     | 32 ++++++++++++
 .../aws-cloudfront/test/origin.test.ts        | 50 ++++++++++++++++++-
 5 files changed, 114 insertions(+), 12 deletions(-)

diff --git a/packages/@aws-cdk/aws-cloudfront-origins/README.md b/packages/@aws-cdk/aws-cloudfront-origins/README.md
index 05d12bc1ae6f4..cb7af64ff8618 100644
--- a/packages/@aws-cdk/aws-cloudfront-origins/README.md
+++ b/packages/@aws-cdk/aws-cloudfront-origins/README.md
@@ -33,6 +33,24 @@ CloudFront's redirect and error handling will be used. In the latter case, the O
 underlying bucket. This can be used in conjunction with a bucket that is not public to require that your users access your content using CloudFront
 URLs and not S3 URLs directly. Alternatively, a custom origin access identity can be passed to the S3 origin in the properties.
 
+### Adding Custom Headers
+
+You can configure CloudFront to add custom headers to the requests that it sends to your origin. These custom headers enable you to send and gather information from your origin that you don’t get with typical viewer requests. These headers can even be customized for each origin. CloudFront supports custom headers for both for custom and Amazon S3 origins.
+
+```ts
+import * as cloudfront from '@aws-cdk/aws-cloudfront';
+import * as origins from '@aws-cdk/aws-cloudfront-origins';
+
+const myBucket = new s3.Bucket(this, 'myBucket');
+new cloudfront.Distribution(this, 'myDist', {
+  defaultBehavior: { origin: new origins.S3Origin(myBucket, {
+    customHeaders: {
+      Foo: 'bar',
+    },
+  })},
+});
+```
+
 ## ELBv2 Load Balancer
 
 An Elastic Load Balancing (ELB) v2 load balancer may be used as an origin. In order for a load balancer to serve as an origin, it must be publicly
diff --git a/packages/@aws-cdk/aws-cloudfront-origins/lib/s3-origin.ts b/packages/@aws-cdk/aws-cloudfront-origins/lib/s3-origin.ts
index a0ac4037d9741..4bdd39a2e5888 100644
--- a/packages/@aws-cdk/aws-cloudfront-origins/lib/s3-origin.ts
+++ b/packages/@aws-cdk/aws-cloudfront-origins/lib/s3-origin.ts
@@ -11,14 +11,7 @@ import { Construct } from '@aws-cdk/core';
 /**
  * Properties to use to customize an S3 Origin.
  */
-export interface S3OriginProps {
-  /**
-   * An optional path that CloudFront appends to the origin domain name when CloudFront requests content from the origin.
-   * Must begin, but not end, with '/' (e.g., '/production/images').
-   *
-   * @default '/'
-   */
-  readonly originPath?: string;
+export interface S3OriginProps extends cloudfront.OriginProps {
   /**
    * An optional Origin Access Identity of the origin identity cloudfront will use when calling your s3 bucket.
    *
diff --git a/packages/@aws-cdk/aws-cloudfront-origins/test/s3-origin.test.ts b/packages/@aws-cdk/aws-cloudfront-origins/test/s3-origin.test.ts
index c9e0ecb797464..e8e2c4b2c41b9 100644
--- a/packages/@aws-cdk/aws-cloudfront-origins/test/s3-origin.test.ts
+++ b/packages/@aws-cdk/aws-cloudfront-origins/test/s3-origin.test.ts
@@ -1,7 +1,7 @@
 import '@aws-cdk/assert-internal/jest';
 import * as cloudfront from '@aws-cdk/aws-cloudfront';
 import * as s3 from '@aws-cdk/aws-s3';
-import { App, Stack } from '@aws-cdk/core';
+import { App, Duration, Stack } from '@aws-cdk/core';
 import { S3Origin } from '../lib';
 
 let app: App;
@@ -34,16 +34,27 @@ describe('With bucket', () => {
     });
   });
 
-  test('can customize originPath property', () => {
+  test('can customize base origin properties', () => {
     const bucket = new s3.Bucket(stack, 'Bucket');
 
-    const origin = new S3Origin(bucket, { originPath: '/assets' });
+    const origin = new S3Origin(bucket, {
+      originPath: '/assets',
+      connectionTimeout: Duration.seconds(5),
+      connectionAttempts: 2,
+      customHeaders: { AUTH: 'NONE' },
+    });
     const originBindConfig = origin.bind(stack, { originId: 'StackOrigin029E19582' });
 
     expect(stack.resolve(originBindConfig.originProperty)).toEqual({
       id: 'StackOrigin029E19582',
       domainName: { 'Fn::GetAtt': ['Bucket83908E77', 'RegionalDomainName'] },
       originPath: '/assets',
+      connectionTimeout: 5,
+      connectionAttempts: 2,
+      originCustomHeaders: [{
+        headerName: 'AUTH',
+        headerValue: 'NONE',
+      }],
       s3OriginConfig: {
         originAccessIdentity: {
           'Fn::Join': ['',
diff --git a/packages/@aws-cdk/aws-cloudfront/lib/origin.ts b/packages/@aws-cdk/aws-cloudfront/lib/origin.ts
index 9b841e413c405..0b7ab7796b97f 100644
--- a/packages/@aws-cdk/aws-cloudfront/lib/origin.ts
+++ b/packages/@aws-cdk/aws-cloudfront/lib/origin.ts
@@ -120,6 +120,7 @@ export abstract class OriginBase implements IOrigin {
   protected constructor(domainName: string, props: OriginProps = {}) {
     validateIntInRangeOrUndefined('connectionTimeout', 1, 10, props.connectionTimeout?.toSeconds());
     validateIntInRangeOrUndefined('connectionAttempts', 1, 3, props.connectionAttempts, false);
+    validateCustomHeaders(props.customHeaders);
 
     this.domainName = domainName;
     this.originPath = this.validateOriginPath(props.originPath);
@@ -205,3 +206,34 @@ function validateIntInRangeOrUndefined(name: string, min: number, max: number, v
     throw new Error(`${name}: Must be an int between ${min} and ${max}${seconds} (inclusive); received ${value}.`);
   }
 }
+
+/**
+ * Throws an error if custom header assignment is prohibited by CloudFront.
+ * @link: https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/add-origin-custom-headers.html#add-origin-custom-headers-denylist
+ */
+function validateCustomHeaders(customHeaders?: Record<string, string>) {
+  if (!customHeaders || Object.entries(customHeaders).length === 0) { return; }
+  const customHeaderKeys = Object.keys(customHeaders);
+  const prohibitedHeaderKeys = [
+    'Cache-Control', 'Connection', 'Content-Length', 'Cookie', 'Host', 'If-Match', 'If-Modified-Since', 'If-None-Match', 'If-Range', 'If-Unmodified-Since',
+    'Max-Forwards', 'Pragma', 'Proxy-Authorization', 'Proxy-Connection', 'Range', 'Request-Range', 'TE', 'Trailer', 'Transfer-Encoding', 'Upgrade', 'Via',
+    'X-Real-Ip',
+  ];
+  const prohibitedHeaderKeyPrefixes = [
+    'X-Amz-', 'X-Edge-',
+  ];
+
+  const prohibitedHeadersKeysMatches = customHeaderKeys.filter(customKey => {
+    return prohibitedHeaderKeys.map((prohibitedKey) => prohibitedKey.toLowerCase()).includes(customKey.toLowerCase());
+  });
+  const prohibitedHeaderPrefixMatches = customHeaderKeys.filter(customKey => {
+    return prohibitedHeaderKeyPrefixes.some(prohibitedKeyPrefix => customKey.toLowerCase().startsWith(prohibitedKeyPrefix.toLowerCase()));
+  });
+
+  if (prohibitedHeadersKeysMatches.length !== 0) {
+    throw new Error(`The following headers cannot be configured as custom origin headers: ${prohibitedHeadersKeysMatches.join(', ')}`);
+  }
+  if (prohibitedHeaderPrefixMatches.length !== 0) {
+    throw new Error(`The following headers cannot be used as prefixes for custom origin headers: ${prohibitedHeaderPrefixMatches.join(', ')}`);
+  }
+}
\ No newline at end of file
diff --git a/packages/@aws-cdk/aws-cloudfront/test/origin.test.ts b/packages/@aws-cdk/aws-cloudfront/test/origin.test.ts
index b30362c7fe652..e6a59ff6179d6 100644
--- a/packages/@aws-cdk/aws-cloudfront/test/origin.test.ts
+++ b/packages/@aws-cdk/aws-cloudfront/test/origin.test.ts
@@ -57,4 +57,52 @@ test.each(['us-east-1', 'ap-southeast-2', 'eu-west-3', 'me-south-1'])
     enabled: true,
     originShieldRegion,
   });
-});
\ No newline at end of file
+});
+
+test('throw an error if Custom Headers keys are not permitted', () => {
+  // case sensitive
+  expect(() => {
+    new TestOrigin('example.com', {
+      customHeaders: {
+        Host: 'bad',
+        Cookie: 'bad',
+        Connection: 'bad',
+        TS: 'bad',
+      },
+    });
+  }).toThrow(/The following headers cannot be configured as custom origin headers: (.*?)/);
+
+  // case insensitive
+  expect(() => {
+    new TestOrigin('example.com', {
+      customHeaders: {
+        hOst: 'bad',
+        cOOkIe: 'bad',
+        Connection: 'bad',
+        Ts: 'bad',
+      },
+    });
+  }).toThrow(/The following headers cannot be configured as custom origin headers: (.*?)/);
+});
+
+test('throw an error if Custom Headers are pre-fixed with non-permitted keys', () => {
+  // case sensitive
+  expect(() => {
+    new TestOrigin('example.com', {
+      customHeaders: {
+        'X-Amz-dummy': 'bad',
+        'X-Edge-dummy': 'bad',
+      },
+    });
+  }).toThrow(/The following headers cannot be used as prefixes for custom origin headers: (.*?)/);
+
+  // case insensitive
+  expect(() => {
+    new TestOrigin('example.com', {
+      customHeaders: {
+        'x-amZ-dummy': 'bad',
+        'x-eDgE-dummy': 'bad',
+      },
+    });
+  }).toThrow(/The following headers cannot be used as prefixes for custom origin headers: (.*?)/);
+});

From fe81be78322e3f1c23d2b02e59b56faa3b06e554 Mon Sep 17 00:00:00 2001
From: AWS CDK Automation
 <43080478+aws-cdk-automation@users.noreply.github.com>
Date: Fri, 27 Aug 2021 14:00:20 +0300
Subject: [PATCH 31/91] feat(cfnspec): cloudformation spec v40.1.0 (#16254)

Co-authored-by: AWS CDK Team <aws-cdk@amazon.com>
Co-authored-by: mergify[bot] <37929162+mergify[bot]@users.noreply.github.com>
---
 packages/@aws-cdk/cfnspec/CHANGELOG.md        | 20 +++++++++++++++++++
 packages/@aws-cdk/cfnspec/cfn.version         |  2 +-
 ...0_CloudFormationResourceSpecification.json | 16 +++++++++++++--
 3 files changed, 35 insertions(+), 3 deletions(-)

diff --git a/packages/@aws-cdk/cfnspec/CHANGELOG.md b/packages/@aws-cdk/cfnspec/CHANGELOG.md
index 85274a4543fbf..5def28ee631e9 100644
--- a/packages/@aws-cdk/cfnspec/CHANGELOG.md
+++ b/packages/@aws-cdk/cfnspec/CHANGELOG.md
@@ -1,3 +1,23 @@
+# CloudFormation Resource Specification v40.1.0
+
+## New Resource Types
+
+
+## Attribute Changes
+
+
+## Property Changes
+
+* AWS::CE::CostCategory SplitChargeRules (__added__)
+
+## Property Type Changes
+
+* AWS::EFS::FileSystem.LifecyclePolicy TransitionToPrimaryStorageClass (__added__)
+* AWS::EFS::FileSystem.LifecyclePolicy TransitionToIA.Required (__changed__)
+  * Old: true
+  * New: false
+
+
 # CloudFormation Resource Specification v40.0.0
 
 ## New Resource Types
diff --git a/packages/@aws-cdk/cfnspec/cfn.version b/packages/@aws-cdk/cfnspec/cfn.version
index e9340fd6f7115..312a84c9209ab 100644
--- a/packages/@aws-cdk/cfnspec/cfn.version
+++ b/packages/@aws-cdk/cfnspec/cfn.version
@@ -1 +1 @@
-40.0.0
+40.1.0
diff --git a/packages/@aws-cdk/cfnspec/spec-source/000_CloudFormationResourceSpecification.json b/packages/@aws-cdk/cfnspec/spec-source/000_CloudFormationResourceSpecification.json
index 1bb4dde7c70f4..33d10e45ecb92 100644
--- a/packages/@aws-cdk/cfnspec/spec-source/000_CloudFormationResourceSpecification.json
+++ b/packages/@aws-cdk/cfnspec/spec-source/000_CloudFormationResourceSpecification.json
@@ -23470,7 +23470,13 @@
         "TransitionToIA": {
           "Documentation": "http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-efs-filesystem-lifecyclepolicy.html#cfn-efs-filesystem-lifecyclepolicy-transitiontoia",
           "PrimitiveType": "String",
-          "Required": true,
+          "Required": false,
+          "UpdateType": "Mutable"
+        },
+        "TransitionToPrimaryStorageClass": {
+          "Documentation": "http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-efs-filesystem-lifecyclepolicy.html#cfn-efs-filesystem-lifecyclepolicy-transitiontoprimarystorageclass",
+          "PrimitiveType": "String",
+          "Required": false,
           "UpdateType": "Mutable"
         }
       }
@@ -61896,7 +61902,7 @@
       }
     }
   },
-  "ResourceSpecificationVersion": "40.0.0",
+  "ResourceSpecificationVersion": "40.1.0",
   "ResourceTypes": {
     "AWS::ACMPCA::Certificate": {
       "Attributes": {
@@ -67257,6 +67263,12 @@
           "PrimitiveType": "String",
           "Required": true,
           "UpdateType": "Mutable"
+        },
+        "SplitChargeRules": {
+          "Documentation": "http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-ce-costcategory.html#cfn-ce-costcategory-splitchargerules",
+          "PrimitiveType": "String",
+          "Required": false,
+          "UpdateType": "Mutable"
         }
       }
     },

From b838f95f0905316fe706779381c93bedaa9ad504 Mon Sep 17 00:00:00 2001
From: Niranjan Jayakar <nija@amazon.com>
Date: Fri, 27 Aug 2021 14:48:32 +0100
Subject: [PATCH 32/91] feat(assertions): 'not' matcher (#16240)

Supply a 'not' matcher that can be used to invert the matching pattern

relates #15868

----

*By submitting this pull request, I confirm that my contribution is made under the terms of the Apache-2.0 license*
---
 packages/@aws-cdk/assertions/README.md        |  29 +++++
 packages/@aws-cdk/assertions/lib/match.ts     |  39 +++++--
 .../@aws-cdk/assertions/test/match.test.ts    | 101 +++++++++++++++++-
 3 files changed, 155 insertions(+), 14 deletions(-)

diff --git a/packages/@aws-cdk/assertions/README.md b/packages/@aws-cdk/assertions/README.md
index 67109b1156964..d651ab72c1bc3 100644
--- a/packages/@aws-cdk/assertions/README.md
+++ b/packages/@aws-cdk/assertions/README.md
@@ -238,6 +238,35 @@ target array. Out of order will be recorded as a match failure.
 Alternatively, the `Match.arrayEquals()` API can be used to assert that the target is
 exactly equal to the pattern array.
 
+### Not Matcher
+
+The not matcher inverts the search pattern and matches all patterns in the path that does
+not match the pattern specified.
+
+```ts
+// Given a template -
+// {
+//   "Resources": {
+//     "MyBar": {
+//       "Type": "Foo::Bar",
+//       "Properties": {
+//         "Fred": ["Flob", "Cat"]
+//       }
+//     }
+//   }
+// }
+
+// The following will NOT throw an assertion error
+assert.hasResourceProperties('Foo::Bar', {
+  Fred: Match.not(['Flob']),
+});
+
+// The following will throw an assertion error
+assert.hasResourceProperties('Foo::Bar', Match.objectLike({
+  Fred: Match.not(['Flob', 'Cat']);
+}});
+```
+
 ## Strongly typed languages
 
 Some of the APIs documented above, such as `templateMatches()` and
diff --git a/packages/@aws-cdk/assertions/lib/match.ts b/packages/@aws-cdk/assertions/lib/match.ts
index 2a88bada59bac..802acdc603e70 100644
--- a/packages/@aws-cdk/assertions/lib/match.ts
+++ b/packages/@aws-cdk/assertions/lib/match.ts
@@ -55,6 +55,14 @@ export abstract class Match {
   public static objectEquals(pattern: {[key: string]: any}): Matcher {
     return new ObjectMatch('objectEquals', pattern, { partial: false });
   }
+
+  /**
+   * Matches any target which does NOT follow the specified pattern.
+   * @param pattern the pattern to NOT match
+   */
+  public static not(pattern: any): Matcher {
+    return new NotMatch('not', pattern);
+  }
 }
 
 /**
@@ -82,7 +90,6 @@ class LiteralMatch extends Matcher {
 
     super();
     this.partialObjects = options.partialObjects ?? false;
-    this.name = 'exact';
 
     if (Matcher.isMatcher(this.pattern)) {
       throw new Error('LiteralMatch cannot directly contain another matcher. ' +
@@ -143,11 +150,6 @@ class ArrayMatch extends Matcher {
 
     super();
     this.partial = options.subsequence ?? true;
-    if (this.partial) {
-      this.name = 'arrayWith';
-    } else {
-      this.name = 'arrayEquals';
-    }
   }
 
   public test(actual: any): MatchResult {
@@ -211,11 +213,6 @@ class ObjectMatch extends Matcher {
 
     super();
     this.partial = options.partial ?? true;
-    if (this.partial) {
-      this.name = 'objectLike';
-    } else {
-      this.name = 'objectEquals';
-    }
   }
 
   public test(actual: any): MatchResult {
@@ -254,6 +251,26 @@ class ObjectMatch extends Matcher {
   }
 }
 
+class NotMatch extends Matcher {
+  constructor(
+    public readonly name: string,
+    private readonly pattern: {[key: string]: any}) {
+
+    super();
+  }
+
+  public test(actual: any): MatchResult {
+    const matcher = Matcher.isMatcher(this.pattern) ? this.pattern : new LiteralMatch(this.name, this.pattern);
+
+    const innerResult = matcher.test(actual);
+    const result = new MatchResult(actual);
+    if (innerResult.failCount === 0) {
+      result.push(this, [], `Found unexpected match: ${JSON.stringify(actual, undefined, 2)}`);
+    }
+    return result;
+  }
+}
+
 function getType(obj: any): string {
   return Array.isArray(obj) ? 'array' : typeof obj;
 }
\ No newline at end of file
diff --git a/packages/@aws-cdk/assertions/test/match.test.ts b/packages/@aws-cdk/assertions/test/match.test.ts
index 697c46e139c11..b46eb0d53d204 100644
--- a/packages/@aws-cdk/assertions/test/match.test.ts
+++ b/packages/@aws-cdk/assertions/test/match.test.ts
@@ -194,17 +194,112 @@ describe('Matchers', () => {
       expectFailure(matcher, { foo: 'bar', baz: 'qux' }, [/Unexpected key at \/baz/]);
     });
   });
+
+  describe('not()', () => {
+    let matcher: Matcher;
+
+    test('literal', () => {
+      matcher = Match.not('foo');
+      expectPass(matcher, 'bar');
+      expectPass(matcher, 3);
+
+      expectFailure(matcher, 'foo', ['Found unexpected match: "foo"']);
+    });
+
+    test('object', () => {
+      matcher = Match.not({ foo: 'bar' });
+      expectPass(matcher, 'bar');
+      expectPass(matcher, 3);
+      expectPass(matcher, { foo: 'baz' });
+      expectPass(matcher, { bar: 'foo' });
+
+      const msg = [
+        'Found unexpected match: {',
+        '  "foo": "bar"',
+        '}',
+      ].join('\n');
+      expectFailure(matcher, { foo: 'bar' }, [msg]);
+    });
+
+    test('array', () => {
+      matcher = Match.not(['foo', 'bar']);
+      expectPass(matcher, 'foo');
+      expectPass(matcher, []);
+      expectPass(matcher, ['bar']);
+      expectPass(matcher, ['foo', 3]);
+
+      const msg = [
+        'Found unexpected match: [',
+        '  "foo",',
+        '  "bar"',
+        ']',
+      ].join('\n');
+      expectFailure(matcher, ['foo', 'bar'], [msg]);
+    });
+
+    test('as a nested matcher', () => {
+      matcher = Match.exact({
+        foo: { bar: Match.not([1, 2]) },
+      });
+
+      expectPass(matcher, {
+        foo: { bar: [1] },
+      });
+      expectPass(matcher, {
+        foo: { bar: ['baz'] },
+      });
+
+      const msg = [
+        'Found unexpected match: [',
+        '  1,',
+        '  2',
+        '] at /foo/bar',
+      ].join('\n');
+      expectFailure(matcher, {
+        foo: { bar: [1, 2] },
+      }, [msg]);
+    });
+
+    test('with nested matcher', () => {
+      matcher = Match.not({
+        foo: { bar: Match.arrayWith([1]) },
+      });
+
+      expectPass(matcher, {
+        foo: { bar: [2] },
+      });
+      expectPass(matcher, 'foo');
+
+      const msg = [
+        'Found unexpected match: {',
+        '  "foo": {',
+        '    "bar": [',
+        '      1,',
+        '      2',
+        '    ]',
+        '  }',
+        '}',
+      ].join('\n');
+      expectFailure(matcher, {
+        foo: { bar: [1, 2] },
+      }, [msg]);
+    });
+  });
 });
 
 function expectPass(matcher: Matcher, target: any): void {
   expect(matcher.test(target).hasFailed()).toEqual(false);
 }
 
-function expectFailure(matcher: Matcher, target: any, expected: (string | RegExp)[]): void {
-  const actual = matcher.test(target).toHumanStrings();
+function expectFailure(matcher: Matcher, target: any, expected: (string | RegExp)[] = []): void {
+  const result = matcher.test(target);
+  expect(result.failCount).toBeGreaterThan(0);
+  const actual = result.toHumanStrings();
+  if (expected.length > 0) {
+    expect(actual.length).toEqual(expected.length);
+  }
   for (let i = 0; i < expected.length; i++) {
     const e = expected[i];
     expect(actual[i]).toMatch(e);
   }
-  expect(expected.length).toEqual(actual.length);
 }
\ No newline at end of file

From de218ba3a294b5b98f93fc75a04ce42294e95008 Mon Sep 17 00:00:00 2001
From: kaizen3031593 <36202692+kaizen3031593@users.noreply.github.com>
Date: Fri, 27 Aug 2021 11:40:18 -0400
Subject: [PATCH 33/91] feat(synthetics): add Python runtime and latest Nodejs
 runtime (#16069)

This PR addresses the fact that the current synthetics module was built to support nodejs runtimes only by opening support for python runtimes. Closes #15138 and #16177.

**Breaking Changes**

-  `Runtime('customRuntimeHere')` becomes `Runtime('customRuntime', 'runtimeFamily')`
-  `Code.fromAnything('path').bind(this, 'handler')` becomes `Code.fromAnything('path').bind(this, 'handler', 'runtimeFamily')`

**Whats in this PR?**

- Adds latest Nodejs runtime (`syn-nodejs-puppeteer-3.2`) and updates integ test to it.
- Adds generic python script to the folder `test/canaries/python` in order to run unit & integration tests on it.
- Adds new `RuntimeFamily` enum that is required by the `Runtime` object to differentiate between Python and Node.
- Verifies the correct folder structure for Python runtimes (`python/<filename>.py`).
- Updates readme.

----

*By submitting this pull request, I confirm that my contribution is made under the terms of the Apache-2.0 license*
---
 packages/@aws-cdk/aws-synthetics/README.md    |  11 +-
 .../@aws-cdk/aws-synthetics/lib/canary.ts     |  78 +------
 packages/@aws-cdk/aws-synthetics/lib/code.ts  |  26 ++-
 packages/@aws-cdk/aws-synthetics/lib/index.ts |   1 +
 .../@aws-cdk/aws-synthetics/lib/runtime.ts    | 123 +++++++++++
 .../test/canaries/python/canary.py            |  61 ++++++
 .../aws-synthetics/test/canary.test.ts        |  21 +-
 .../@aws-cdk/aws-synthetics/test/code.test.ts |  59 ++++--
 .../test/integ.canary.expected.json           | 191 ++++++++++++++++--
 .../aws-synthetics/test/integ.canary.ts       |  15 +-
 10 files changed, 471 insertions(+), 115 deletions(-)
 create mode 100644 packages/@aws-cdk/aws-synthetics/lib/runtime.ts
 create mode 100644 packages/@aws-cdk/aws-synthetics/test/canaries/python/canary.py

diff --git a/packages/@aws-cdk/aws-synthetics/README.md b/packages/@aws-cdk/aws-synthetics/README.md
index 6dcd911f7da5e..bd4fcaede272c 100644
--- a/packages/@aws-cdk/aws-synthetics/README.md
+++ b/packages/@aws-cdk/aws-synthetics/README.md
@@ -130,7 +130,7 @@ new synthetics.Canary(this, 'Bucket Canary', {
 });
 ```
 
-> **Note:** For `code.fromAsset()` and `code.fromBucket()`, the canary resource requires the following folder structure:
+> **Note:** Synthetics have a specified folder structure for canaries. For Node scripts supplied via `code.fromAsset()` or `code.fromBucket()`, the canary resource requires the following folder structure:
 >
 > ```plaintext
 > canary/
@@ -139,6 +139,15 @@ new synthetics.Canary(this, 'Bucket Canary', {
 >         ├── <filename>.js
 > ```
 >
+>
+> For Python scripts supplied via `code.fromAsset()` or `code.fromBucket()`, the canary resource requires the following folder structure:
+>
+> ```plaintext
+> canary/
+> ├── python/
+>     ├── <filename>.py
+> ```
+>
 > See Synthetics [docs](https://docs.aws.amazon.com/AmazonCloudWatch/latest/monitoring/CloudWatch_Synthetics_Canaries_WritingCanary.html).
 
 ### Alarms
diff --git a/packages/@aws-cdk/aws-synthetics/lib/canary.ts b/packages/@aws-cdk/aws-synthetics/lib/canary.ts
index e5061c4c999c2..c512c4d636a78 100644
--- a/packages/@aws-cdk/aws-synthetics/lib/canary.ts
+++ b/packages/@aws-cdk/aws-synthetics/lib/canary.ts
@@ -5,6 +5,7 @@ import * as s3 from '@aws-cdk/aws-s3';
 import * as cdk from '@aws-cdk/core';
 import { Construct } from 'constructs';
 import { Code } from './code';
+import { Runtime } from './runtime';
 import { Schedule } from './schedule';
 import { CloudWatchSyntheticsMetrics } from './synthetics-canned-metrics.generated';
 import { CfnCanary } from './synthetics.generated';
@@ -64,81 +65,6 @@ export interface CustomTestOptions {
   readonly handler: string,
 }
 
-/**
- * Runtime options for a canary
- */
-export class Runtime {
-  /**
-   * `syn-1.0` includes the following:
-   *
-   * - Synthetics library 1.0
-   * - Synthetics handler code 1.0
-   * - Lambda runtime Node.js 10.x
-   * - Puppeteer-core version 1.14.0
-   * - The Chromium version that matches Puppeteer-core 1.14.0
-   *
-   * @see https://docs.aws.amazon.com/AmazonCloudWatch/latest/monitoring/CloudWatch_Synthetics_Library_nodejs_puppeteer.html#CloudWatch_Synthetics_runtimeversion-1.0
-   */
-  public static readonly SYNTHETICS_1_0 = new Runtime('syn-1.0');
-
-  /**
-   * `syn-nodejs-2.0` includes the following:
-   * - Lambda runtime Node.js 10.x
-   * - Puppeteer-core version 3.3.0
-   * - Chromium version 83.0.4103.0
-   *
-   * @see https://docs.aws.amazon.com/AmazonCloudWatch/latest/monitoring/CloudWatch_Synthetics_Library_nodejs_puppeteer.html#CloudWatch_Synthetics_runtimeversion-2.0
-   */
-  public static readonly SYNTHETICS_NODEJS_2_0 = new Runtime('syn-nodejs-2.0');
-
-
-  /**
-   * `syn-nodejs-2.1` includes the following:
-   * - Lambda runtime Node.js 10.x
-   * - Puppeteer-core version 3.3.0
-   * - Chromium version 83.0.4103.0
-   *
-   * @see https://docs.aws.amazon.com/AmazonCloudWatch/latest/monitoring/CloudWatch_Synthetics_Library_nodejs_puppeteer.html#CloudWatch_Synthetics_runtimeversion-2.1
-   */
-  public static readonly SYNTHETICS_NODEJS_2_1 = new Runtime('syn-nodejs-2.1');
-
-  /**
-   * `syn-nodejs-2.2` includes the following:
-   * - Lambda runtime Node.js 10.x
-   * - Puppeteer-core version 3.3.0
-   * - Chromium version 83.0.4103.0
-   *
-   * @see https://docs.aws.amazon.com/AmazonCloudWatch/latest/monitoring/CloudWatch_Synthetics_Library_nodejs_puppeteer.html#CloudWatch_Synthetics_runtimeversion-2.2
-   */
-  public static readonly SYNTHETICS_NODEJS_2_2 = new Runtime('syn-nodejs-2.2');
-
-  /**
-   * `syn-nodejs-puppeteer-3.0` includes the following:
-   * - Lambda runtime Node.js 12.x
-   * - Puppeteer-core version 5.5.0
-   * - Chromium version 88.0.4298.0
-   *
-   * @see https://docs.aws.amazon.com/AmazonCloudWatch/latest/monitoring/CloudWatch_Synthetics_Library_nodejs_puppeteer.html#CloudWatch_Synthetics_runtimeversion-nodejs-puppeteer-3.0
-   */
-  public static readonly SYNTHETICS_NODEJS_PUPPETEER_3_0 = new Runtime('syn-nodejs-puppeteer-3.0');
-
-  /**
-   * `syn-nodejs-puppeteer-3.1` includes the following:
-   * - Lambda runtime Node.js 12.x
-   * - Puppeteer-core version 5.5.0
-   * - Chromium version 88.0.4298.0
-   *
-   * @see https://docs.aws.amazon.com/AmazonCloudWatch/latest/monitoring/CloudWatch_Synthetics_Library_nodejs_puppeteer.html#CloudWatch_Synthetics_runtimeversion-nodejs-puppeteer-3.1
-   */
-  public static readonly SYNTHETICS_NODEJS_PUPPETEER_3_1 = new Runtime('syn-nodejs-puppeteer-3.1');
-
-  /**
-   * @param name The name of the runtime version
-   */
-  public constructor(public readonly name: string) {
-  }
-}
-
 /**
  * Options for specifying the s3 location that stores the data of each canary run. The artifacts bucket location **cannot**
  * be updated once the canary is created.
@@ -398,7 +324,7 @@ export class Canary extends cdk.Resource {
   private createCode(props: CanaryProps): CfnCanary.CodeProperty {
     const codeConfig = {
       handler: props.test.handler,
-      ...props.test.code.bind(this, props.test.handler),
+      ...props.test.code.bind(this, props.test.handler, props.runtime.family),
     };
     return {
       handler: codeConfig.handler,
diff --git a/packages/@aws-cdk/aws-synthetics/lib/code.ts b/packages/@aws-cdk/aws-synthetics/lib/code.ts
index dd75815098ec1..9eef28d4674c6 100644
--- a/packages/@aws-cdk/aws-synthetics/lib/code.ts
+++ b/packages/@aws-cdk/aws-synthetics/lib/code.ts
@@ -2,7 +2,8 @@ import * as fs from 'fs';
 import * as path from 'path';
 import * as s3 from '@aws-cdk/aws-s3';
 import * as s3_assets from '@aws-cdk/aws-s3-assets';
-import { Construct } from '@aws-cdk/core';
+import { Construct } from 'constructs';
+import { RuntimeFamily } from './runtime';
 
 /**
  * The code the canary should execute
@@ -56,7 +57,7 @@ export abstract class Code {
    *
    * @returns a bound `CodeConfig`.
    */
-  public abstract bind(scope: Construct, handler: string): CodeConfig;
+  public abstract bind(scope: Construct, handler: string, family: RuntimeFamily): CodeConfig;
 }
 
 /**
@@ -95,8 +96,8 @@ export class AssetCode extends Code {
     }
   }
 
-  public bind(scope: Construct, handler: string): CodeConfig {
-    this.validateCanaryAsset(handler);
+  public bind(scope: Construct, handler: string, family: RuntimeFamily): CodeConfig {
+    this.validateCanaryAsset(handler, family);
 
     // If the same AssetCode is used multiple times, retain only the first instantiation.
     if (!this.asset) {
@@ -126,14 +127,19 @@ export class AssetCode extends Code {
    *
    * @param handler the canary handler
    */
-  private validateCanaryAsset(handler: string) {
+  private validateCanaryAsset(handler: string, family: RuntimeFamily) {
     if (path.extname(this.assetPath) !== '.zip') {
       if (!fs.lstatSync(this.assetPath).isDirectory()) {
         throw new Error(`Asset must be a .zip file or a directory (${this.assetPath})`);
       }
-      const filename = `${handler.split('.')[0]}.js`;
-      if (!fs.existsSync(path.join(this.assetPath, 'nodejs', 'node_modules', filename))) {
-        throw new Error(`The canary resource requires that the handler is present at "nodejs/node_modules/${filename}" but not found at ${this.assetPath} (https://docs.aws.amazon.com/AmazonCloudWatch/latest/monitoring/CloudWatch_Synthetics_Canaries_WritingCanary.html#CloudWatch_Synthetics_Canaries_write_from_scratch)`);
+      const filename = handler.split('.')[0];
+      const nodeFilename = `${filename}.js`;
+      const pythonFilename = `${filename}.py`;
+      if (family === RuntimeFamily.NODEJS && !fs.existsSync(path.join(this.assetPath, 'nodejs', 'node_modules', nodeFilename))) {
+        throw new Error(`The canary resource requires that the handler is present at "nodejs/node_modules/${nodeFilename}" but not found at ${this.assetPath} (https://docs.aws.amazon.com/AmazonCloudWatch/latest/monitoring/CloudWatch_Synthetics_Canaries_WritingCanary_Nodejs.html)`);
+      }
+      if (family === RuntimeFamily.PYTHON && !fs.existsSync(path.join(this.assetPath, 'python', pythonFilename))) {
+        throw new Error(`The canary resource requires that the handler is present at "python/${pythonFilename}" but not found at ${this.assetPath} (https://docs.aws.amazon.com/AmazonCloudWatch/latest/monitoring/CloudWatch_Synthetics_Canaries_WritingCanary_Python.html)`);
       }
     }
   }
@@ -151,7 +157,7 @@ export class InlineCode extends Code {
     }
   }
 
-  public bind(_scope: Construct, handler: string): CodeConfig {
+  public bind(_scope: Construct, handler: string, _family: RuntimeFamily): CodeConfig {
 
     if (handler !== 'index.handler') {
       throw new Error(`The handler for inline code must be "index.handler" (got "${handler}")`);
@@ -171,7 +177,7 @@ export class S3Code extends Code {
     super();
   }
 
-  public bind(_scope: Construct, _handler: string): CodeConfig {
+  public bind(_scope: Construct, _handler: string, _family: RuntimeFamily): CodeConfig {
     return {
       s3Location: {
         bucketName: this.bucket.bucketName,
diff --git a/packages/@aws-cdk/aws-synthetics/lib/index.ts b/packages/@aws-cdk/aws-synthetics/lib/index.ts
index f769a0309352e..ee024834f2bf1 100644
--- a/packages/@aws-cdk/aws-synthetics/lib/index.ts
+++ b/packages/@aws-cdk/aws-synthetics/lib/index.ts
@@ -1,5 +1,6 @@
 export * from './canary';
 export * from './code';
+export * from './runtime';
 export * from './schedule';
 
 // AWS::Synthetics CloudFormation Resources:
diff --git a/packages/@aws-cdk/aws-synthetics/lib/runtime.ts b/packages/@aws-cdk/aws-synthetics/lib/runtime.ts
new file mode 100644
index 0000000000000..c710d68a34e35
--- /dev/null
+++ b/packages/@aws-cdk/aws-synthetics/lib/runtime.ts
@@ -0,0 +1,123 @@
+/**
+ * All known Lambda runtime families.
+ */
+export enum RuntimeFamily {
+  /**
+   * All Lambda runtimes that depend on Node.js.
+   */
+  NODEJS,
+
+  /**
+   * All lambda runtimes that depend on Python.
+   */
+  PYTHON,
+
+  /**
+   * Any future runtime family.
+   */
+  OTHER,
+}
+
+/**
+ * Runtime options for a canary
+ */
+export class Runtime {
+  /**
+   * **Deprecated by AWS Synthetics. You can't create canaries with deprecated runtimes.**
+   *
+   * `syn-1.0` includes the following:
+   *
+   * - Synthetics library 1.0
+   * - Synthetics handler code 1.0
+   * - Lambda runtime Node.js 10.x
+   * - Puppeteer-core version 1.14.0
+   * - The Chromium version that matches Puppeteer-core 1.14.0
+   *
+   * @see https://docs.aws.amazon.com/AmazonCloudWatch/latest/monitoring/CloudWatch_Synthetics_Library_nodejs_puppeteer.html#CloudWatch_Synthetics_runtimeversion-1.0
+   */
+  public static readonly SYNTHETICS_1_0 = new Runtime('syn-1.0', RuntimeFamily.NODEJS);
+
+  /**
+   * **Deprecated by AWS Synthetics. You can't create canaries with deprecated runtimes.**
+   *
+   * `syn-nodejs-2.0` includes the following:
+   * - Lambda runtime Node.js 10.x
+   * - Puppeteer-core version 3.3.0
+   * - Chromium version 83.0.4103.0
+   *
+   * @see https://docs.aws.amazon.com/AmazonCloudWatch/latest/monitoring/CloudWatch_Synthetics_Library_nodejs_puppeteer.html#CloudWatch_Synthetics_runtimeversion-2.0
+   */
+  public static readonly SYNTHETICS_NODEJS_2_0 = new Runtime('syn-nodejs-2.0', RuntimeFamily.NODEJS);
+
+
+  /**
+   * **Deprecated by AWS Synthetics. You can't create canaries with deprecated runtimes.**
+   *
+   * `syn-nodejs-2.1` includes the following:
+   * - Lambda runtime Node.js 10.x
+   * - Puppeteer-core version 3.3.0
+   * - Chromium version 83.0.4103.0
+   *
+   * @see https://docs.aws.amazon.com/AmazonCloudWatch/latest/monitoring/CloudWatch_Synthetics_Library_nodejs_puppeteer.html#CloudWatch_Synthetics_runtimeversion-2.1
+   */
+  public static readonly SYNTHETICS_NODEJS_2_1 = new Runtime('syn-nodejs-2.1', RuntimeFamily.NODEJS);
+
+  /**
+   * **Deprecated by AWS Synthetics. You can't create canaries with deprecated runtimes.**
+   *
+   * `syn-nodejs-2.2` includes the following:
+   * - Lambda runtime Node.js 10.x
+   * - Puppeteer-core version 3.3.0
+   * - Chromium version 83.0.4103.0
+   *
+   * @see https://docs.aws.amazon.com/AmazonCloudWatch/latest/monitoring/CloudWatch_Synthetics_Library_nodejs_puppeteer.html#CloudWatch_Synthetics_runtimeversion-2.2
+   */
+  public static readonly SYNTHETICS_NODEJS_2_2 = new Runtime('syn-nodejs-2.2', RuntimeFamily.NODEJS);
+
+  /**
+   * `syn-nodejs-puppeteer-3.0` includes the following:
+   * - Lambda runtime Node.js 12.x
+   * - Puppeteer-core version 5.5.0
+   * - Chromium version 88.0.4298.0
+   *
+   * @see https://docs.aws.amazon.com/AmazonCloudWatch/latest/monitoring/CloudWatch_Synthetics_Library_nodejs_puppeteer.html#CloudWatch_Synthetics_runtimeversion-nodejs-puppeteer-3.0
+   */
+  public static readonly SYNTHETICS_NODEJS_PUPPETEER_3_0 = new Runtime('syn-nodejs-puppeteer-3.0', RuntimeFamily.NODEJS);
+
+  /**
+   * `syn-nodejs-puppeteer-3.1` includes the following:
+   * - Lambda runtime Node.js 12.x
+   * - Puppeteer-core version 5.5.0
+   * - Chromium version 88.0.4298.0
+   *
+   * @see https://docs.aws.amazon.com/AmazonCloudWatch/latest/monitoring/CloudWatch_Synthetics_Library_nodejs_puppeteer.html#CloudWatch_Synthetics_runtimeversion-nodejs-puppeteer-3.1
+   */
+  public static readonly SYNTHETICS_NODEJS_PUPPETEER_3_1 = new Runtime('syn-nodejs-puppeteer-3.1', RuntimeFamily.NODEJS);
+
+  /**
+   * `syn-nodejs-puppeteer-3.2` includes the following:
+   * - Lambda runtime Node.js 12.x
+   * - Puppeteer-core version 5.5.0
+   * - Chromium version 88.0.4298.0
+   *
+   * @see https://docs.aws.amazon.com/AmazonCloudWatch/latest/monitoring/CloudWatch_Synthetics_Library_nodejs_puppeteer.html#CloudWatch_Synthetics_runtimeversion-nodejs-puppeteer-3.2
+   */
+  public static readonly SYNTHETICS_NODEJS_PUPPETEER_3_2 = new Runtime('syn-nodejs-puppeteer-3.2', RuntimeFamily.NODEJS);
+
+  /**
+   * `syn-python-selenium-1.0` includes the following:
+   * - Lambda runtime Python 3.8
+   * - Selenium version 3.141.0
+   * - Chromium version 83.0.4103.0
+   *
+   * @see https://docs.aws.amazon.com/AmazonCloudWatch/latest/monitoring/CloudWatch_Synthetics_Library_python_selenium.html
+   */
+  public static readonly SYNTHETICS_PYTHON_SELENIUM_1_0 = new Runtime('syn-python-selenium-1.0', RuntimeFamily.PYTHON);
+
+  /**
+    * @param name The name of the runtime version
+    * @param family The Lambda runtime family
+    */
+  public constructor(public readonly name: string, public readonly family: RuntimeFamily) {
+  }
+}
\ No newline at end of file
diff --git a/packages/@aws-cdk/aws-synthetics/test/canaries/python/canary.py b/packages/@aws-cdk/aws-synthetics/test/canaries/python/canary.py
new file mode 100644
index 0000000000000..2dbed4e312afe
--- /dev/null
+++ b/packages/@aws-cdk/aws-synthetics/test/canaries/python/canary.py
@@ -0,0 +1,61 @@
+# This example comes from the AWS Synthetics service console "API canary" blueprint
+
+import json
+import http.client
+import urllib.parse
+from aws_synthetics.selenium import synthetics_webdriver as syn_webdriver
+from aws_synthetics.common import synthetics_logger as logger
+
+
+def verify_request(method, url, post_data=None, headers={}):
+    parsed_url = urllib.parse.urlparse(url)
+    user_agent = str(syn_webdriver.get_canary_user_agent_string())
+    if "User-Agent" in headers:
+        headers["User-Agent"] = " ".join([user_agent, headers["User-Agent"]])
+    else:
+        headers["User-Agent"] = "{}".format(user_agent)
+
+    logger.info("Making request with Method: '%s' URL: %s: Data: %s Headers: %s" % (
+        method, url, json.dumps(post_data), json.dumps(headers)))
+
+    if parsed_url.scheme == "https":
+        conn = http.client.HTTPSConnection(parsed_url.hostname, parsed_url.port)
+    else:
+        conn = http.client.HTTPConnection(parsed_url.hostname, parsed_url.port)
+
+    conn.request(method, url, str(post_data), headers)
+    response = conn.getresponse()
+    logger.info("Status Code: %s " % response.status)
+    logger.info("Response Headers: %s" % json.dumps(response.headers.as_string()))
+
+    if not response.status or response.status < 200 or response.status > 299:
+        try:
+            logger.error("Response: %s" % response.read().decode())
+        finally:
+            if response.reason:
+                conn.close()
+                raise Exception("Failed: %s" % response.reason)
+            else:
+                conn.close()
+                raise Exception("Failed with status code: %s" % response.status)
+
+    logger.info("Response: %s" % response.read().decode())
+    logger.info("HTTP request successfully executed")
+    conn.close()
+
+
+def main():
+
+    url = 'https://example.com/'
+    method = 'GET'
+    postData = ""
+    headers = {}
+
+    verify_request(method, url, None, headers)
+
+    logger.info("Canary successfully executed")
+
+
+def handler(event, context):
+    logger.info("Selenium Python API canary")
+    main()
\ No newline at end of file
diff --git a/packages/@aws-cdk/aws-synthetics/test/canary.test.ts b/packages/@aws-cdk/aws-synthetics/test/canary.test.ts
index 8a0baa8cb0c29..c4583ef5494cf 100644
--- a/packages/@aws-cdk/aws-synthetics/test/canary.test.ts
+++ b/packages/@aws-cdk/aws-synthetics/test/canary.test.ts
@@ -169,6 +169,25 @@ test('Runtime can be specified', () => {
   });
 });
 
+test('Python runtime can be specified', () => {
+  // GIVEN
+  const stack = new Stack();
+
+  // WHEN
+  new synthetics.Canary(stack, 'Canary', {
+    runtime: synthetics.Runtime.SYNTHETICS_PYTHON_SELENIUM_1_0,
+    test: synthetics.Test.custom({
+      handler: 'index.handler',
+      code: synthetics.Code.fromInline('# Synthetics handler code'),
+    }),
+  });
+
+  // THEN
+  Template.fromStack(stack).hasResourceProperties('AWS::Synthetics::Canary', {
+    RuntimeVersion: 'syn-python-selenium-1.0',
+  });
+});
+
 test('environment variables can be specified', () => {
   // GIVEN
   const stack = new Stack();
@@ -220,7 +239,7 @@ test('Runtime can be customized', () => {
 
   // WHEN
   new synthetics.Canary(stack, 'Canary', {
-    runtime: new synthetics.Runtime('fancy-future-runtime-1337.42'),
+    runtime: new synthetics.Runtime('fancy-future-runtime-1337.42', synthetics.RuntimeFamily.OTHER),
     test: synthetics.Test.custom({
       handler: 'index.handler',
       code: synthetics.Code.fromInline('/* Synthetics handler code */'),
diff --git a/packages/@aws-cdk/aws-synthetics/test/code.test.ts b/packages/@aws-cdk/aws-synthetics/test/code.test.ts
index 95c7883b42dbf..84bb7ec61ded1 100644
--- a/packages/@aws-cdk/aws-synthetics/test/code.test.ts
+++ b/packages/@aws-cdk/aws-synthetics/test/code.test.ts
@@ -3,6 +3,7 @@ import { Template } from '@aws-cdk/assertions';
 import * as s3 from '@aws-cdk/aws-s3';
 import { App, Stack } from '@aws-cdk/core';
 import * as synthetics from '../lib';
+import { RuntimeFamily } from '../lib';
 
 describe(synthetics.Code.fromInline, () => {
   test('fromInline works', () => {
@@ -16,7 +17,7 @@ describe(synthetics.Code.fromInline, () => {
       };`);
 
     // THEN
-    expect(inline.bind(stack, 'index.handler').inlineCode).toEqual(`
+    expect(inline.bind(stack, 'index.handler', RuntimeFamily.NODEJS).inlineCode).toEqual(`
       exports.handler = async () => {
         console.log(\'hello world\');
       };`);
@@ -32,13 +33,13 @@ describe(synthetics.Code.fromInline, () => {
     const stack = new Stack(new App(), 'canaries');
 
     // THEN
-    expect(() => synthetics.Code.fromInline('code').bind(stack, 'canary.handler'))
+    expect(() => synthetics.Code.fromInline('code').bind(stack, 'canary.handler', RuntimeFamily.NODEJS))
       .toThrowError('The handler for inline code must be "index.handler" (got "canary.handler")');
   });
 });
 
 describe(synthetics.Code.fromAsset, () => {
-  test('fromAsset works', () => {
+  test('fromAsset works for node runtimes', () => {
     // GIVEN
     const stack = new Stack(new App(), 'canaries');
 
@@ -56,8 +57,32 @@ describe(synthetics.Code.fromAsset, () => {
     Template.fromStack(stack).hasResourceProperties('AWS::Synthetics::Canary', {
       Code: {
         Handler: 'canary.handler',
-        S3Bucket: stack.resolve(directoryAsset.bind(stack, 'canary.handler').s3Location?.bucketName),
-        S3Key: stack.resolve(directoryAsset.bind(stack, 'canary.handler').s3Location?.objectKey),
+        S3Bucket: stack.resolve(directoryAsset.bind(stack, 'canary.handler', synthetics.RuntimeFamily.NODEJS).s3Location?.bucketName),
+        S3Key: stack.resolve(directoryAsset.bind(stack, 'canary.handler', synthetics.RuntimeFamily.NODEJS).s3Location?.objectKey),
+      },
+    });
+  });
+
+  test('fromAsset works for python runtimes', () => {
+    // GIVEN
+    const stack = new Stack(new App(), 'canaries');
+
+    // WHEN
+    const directoryAsset = synthetics.Code.fromAsset(path.join(__dirname, 'canaries'));
+    new synthetics.Canary(stack, 'Canary', {
+      test: synthetics.Test.custom({
+        handler: 'canary.handler',
+        code: directoryAsset,
+      }),
+      runtime: synthetics.Runtime.SYNTHETICS_PYTHON_SELENIUM_1_0,
+    });
+
+    // THEN
+    Template.fromStack(stack).hasResourceProperties('AWS::Synthetics::Canary', {
+      Code: {
+        Handler: 'canary.handler',
+        S3Bucket: stack.resolve(directoryAsset.bind(stack, 'canary.handler', synthetics.RuntimeFamily.PYTHON).s3Location?.bucketName),
+        S3Key: stack.resolve(directoryAsset.bind(stack, 'canary.handler', synthetics.RuntimeFamily.PYTHON).s3Location?.objectKey),
       },
     });
   });
@@ -104,18 +129,28 @@ describe(synthetics.Code.fromAsset, () => {
 
     // THEN
     const assetPath = path.join(__dirname, 'canaries', 'nodejs', 'node_modules', 'canary.js');
-    expect(() => synthetics.Code.fromAsset(assetPath).bind(stack, 'canary.handler'))
+    expect(() => synthetics.Code.fromAsset(assetPath).bind(stack, 'canary.handler', synthetics.RuntimeFamily.NODEJS))
       .toThrowError(`Asset must be a .zip file or a directory (${assetPath})`);
   });
 
-  test('fails if "nodejs/node_modules" folder structure not used', () => {
+  test('fails if node runtime and "nodejs/node_modules" folder structure not used', () => {
     // GIVEN
     const stack = new Stack(new App(), 'canaries');
 
     // THEN
     const assetPath = path.join(__dirname, 'canaries', 'nodejs', 'node_modules');
-    expect(() => synthetics.Code.fromAsset(assetPath).bind(stack, 'canary.handler'))
-      .toThrowError(`The canary resource requires that the handler is present at "nodejs/node_modules/canary.js" but not found at ${assetPath} (https://docs.aws.amazon.com/AmazonCloudWatch/latest/monitoring/CloudWatch_Synthetics_Canaries_WritingCanary.html#CloudWatch_Synthetics_Canaries_write_from_scratch)`);
+    expect(() => synthetics.Code.fromAsset(assetPath).bind(stack, 'canary.handler', synthetics.RuntimeFamily.NODEJS))
+      .toThrowError(`The canary resource requires that the handler is present at "nodejs/node_modules/canary.js" but not found at ${assetPath} (https://docs.aws.amazon.com/AmazonCloudWatch/latest/monitoring/CloudWatch_Synthetics_Canaries_WritingCanary_Nodejs.html)`);
+  });
+
+  test('fails if python runtime and "python" folder structure not used', () => {
+    // GIVEN
+    const stack = new Stack(new App(), 'canaries');
+
+    // THEN
+    const assetPath = path.join(__dirname, 'canaries', 'python');
+    expect(() => synthetics.Code.fromAsset(assetPath).bind(stack, 'canary.handler', synthetics.RuntimeFamily.PYTHON))
+      .toThrowError(`The canary resource requires that the handler is present at "python/canary.py" but not found at ${assetPath} (https://docs.aws.amazon.com/AmazonCloudWatch/latest/monitoring/CloudWatch_Synthetics_Canaries_WritingCanary_Python.html)`);
   });
 
   test('fails if handler is specified incorrectly', () => {
@@ -124,8 +159,8 @@ describe(synthetics.Code.fromAsset, () => {
 
     // THEN
     const assetPath = path.join(__dirname, 'canaries', 'nodejs', 'node_modules');
-    expect(() => synthetics.Code.fromAsset(assetPath).bind(stack, 'incorrect.handler'))
-      .toThrowError(`The canary resource requires that the handler is present at "nodejs/node_modules/incorrect.js" but not found at ${assetPath} (https://docs.aws.amazon.com/AmazonCloudWatch/latest/monitoring/CloudWatch_Synthetics_Canaries_WritingCanary.html#CloudWatch_Synthetics_Canaries_write_from_scratch)`);
+    expect(() => synthetics.Code.fromAsset(assetPath).bind(stack, 'incorrect.handler', synthetics.RuntimeFamily.NODEJS))
+      .toThrowError(`The canary resource requires that the handler is present at "nodejs/node_modules/incorrect.js" but not found at ${assetPath} (https://docs.aws.amazon.com/AmazonCloudWatch/latest/monitoring/CloudWatch_Synthetics_Canaries_WritingCanary_Nodejs.html)`);
   });
 });
 
@@ -138,7 +173,7 @@ describe(synthetics.Code.fromBucket, () => {
 
     // WHEN
     const code = synthetics.Code.fromBucket(bucket, 'code.js');
-    const codeConfig = code.bind(stack, 'code.handler');
+    const codeConfig = code.bind(stack, 'code.handler', RuntimeFamily.NODEJS);
 
     // THEN
     expect(codeConfig.s3Location?.bucketName).toEqual(bucket.bucketName);
diff --git a/packages/@aws-cdk/aws-synthetics/test/integ.canary.expected.json b/packages/@aws-cdk/aws-synthetics/test/integ.canary.expected.json
index 58412fee9bfbb..70d3908aa07f6 100644
--- a/packages/@aws-cdk/aws-synthetics/test/integ.canary.expected.json
+++ b/packages/@aws-cdk/aws-synthetics/test/integ.canary.expected.json
@@ -114,7 +114,7 @@
           ]
         },
         "Name": "canary-integ",
-        "RuntimeVersion": "syn-nodejs-2.0",
+        "RuntimeVersion": "syn-nodejs-puppeteer-3.2",
         "Schedule": {
           "DurationInSeconds": "0",
           "Expression": "rate(1 minute)"
@@ -238,7 +238,7 @@
         "Code": {
           "Handler": "canary.handler",
           "S3Bucket": {
-            "Ref": "AssetParameters5bf46c83158ab3b336aba1449c21b02cbac2ccea621f17d842593bb39e3e529bS3Bucket58589EB6"
+            "Ref": "AssetParameters9d00e437db1f5f8788ce938a3f00a9a1b946820e78c9b4c36207c8475db882bbS3Bucket59F507C2"
           },
           "S3Key": {
             "Fn::Join": [
@@ -251,7 +251,7 @@
                       "Fn::Split": [
                         "||",
                         {
-                          "Ref": "AssetParameters5bf46c83158ab3b336aba1449c21b02cbac2ccea621f17d842593bb39e3e529bS3VersionKey8FF13E90"
+                          "Ref": "AssetParameters9d00e437db1f5f8788ce938a3f00a9a1b946820e78c9b4c36207c8475db882bbS3VersionKeyEFB5FFF8"
                         }
                       ]
                     }
@@ -264,7 +264,7 @@
                       "Fn::Split": [
                         "||",
                         {
-                          "Ref": "AssetParameters5bf46c83158ab3b336aba1449c21b02cbac2ccea621f17d842593bb39e3e529bS3VersionKey8FF13E90"
+                          "Ref": "AssetParameters9d00e437db1f5f8788ce938a3f00a9a1b946820e78c9b4c36207c8475db882bbS3VersionKeyEFB5FFF8"
                         }
                       ]
                     }
@@ -281,7 +281,7 @@
           ]
         },
         "Name": "assetcanary-one",
-        "RuntimeVersion": "syn-nodejs-2.0",
+        "RuntimeVersion": "syn-nodejs-puppeteer-3.2",
         "Schedule": {
           "DurationInSeconds": "0",
           "Expression": "rate(5 minutes)"
@@ -448,7 +448,174 @@
           ]
         },
         "Name": "assetcanary-two",
-        "RuntimeVersion": "syn-nodejs-2.0",
+        "RuntimeVersion": "syn-nodejs-puppeteer-3.2",
+        "Schedule": {
+          "DurationInSeconds": "0",
+          "Expression": "rate(5 minutes)"
+        },
+        "StartCanaryAfterCreation": true
+      }
+    },
+    "MyPythonCanaryArtifactsBucket7AE88133": {
+      "Type": "AWS::S3::Bucket",
+      "Properties": {
+        "BucketEncryption": {
+          "ServerSideEncryptionConfiguration": [
+            {
+              "ServerSideEncryptionByDefault": {
+                "SSEAlgorithm": "aws:kms"
+              }
+            }
+          ]
+        }
+      },
+      "UpdateReplacePolicy": "Retain",
+      "DeletionPolicy": "Retain"
+    },
+    "MyPythonCanaryServiceRole41A363E1": {
+      "Type": "AWS::IAM::Role",
+      "Properties": {
+        "AssumeRolePolicyDocument": {
+          "Statement": [
+            {
+              "Action": "sts:AssumeRole",
+              "Effect": "Allow",
+              "Principal": {
+                "Service": "lambda.amazonaws.com"
+              }
+            }
+          ],
+          "Version": "2012-10-17"
+        },
+        "Policies": [
+          {
+            "PolicyDocument": {
+              "Statement": [
+                {
+                  "Action": "s3:ListAllMyBuckets",
+                  "Effect": "Allow",
+                  "Resource": "*"
+                },
+                {
+                  "Action": [
+                    "s3:PutObject",
+                    "s3:GetBucketLocation"
+                  ],
+                  "Effect": "Allow",
+                  "Resource": {
+                    "Fn::Join": [
+                      "",
+                      [
+                        {
+                          "Fn::GetAtt": [
+                            "MyPythonCanaryArtifactsBucket7AE88133",
+                            "Arn"
+                          ]
+                        },
+                        "/*"
+                      ]
+                    ]
+                  }
+                },
+                {
+                  "Action": "cloudwatch:PutMetricData",
+                  "Condition": {
+                    "StringEquals": {
+                      "cloudwatch:namespace": "CloudWatchSynthetics"
+                    }
+                  },
+                  "Effect": "Allow",
+                  "Resource": "*"
+                },
+                {
+                  "Action": [
+                    "logs:CreateLogStream",
+                    "logs:CreateLogGroup",
+                    "logs:PutLogEvents"
+                  ],
+                  "Effect": "Allow",
+                  "Resource": {
+                    "Fn::Join": [
+                      "",
+                      [
+                        "arn:",
+                        {
+                          "Ref": "AWS::Partition"
+                        },
+                        ":logs:::*"
+                      ]
+                    ]
+                  }
+                }
+              ],
+              "Version": "2012-10-17"
+            },
+            "PolicyName": "canaryPolicy"
+          }
+        ]
+      }
+    },
+    "MyPythonCanary9A3DE09E": {
+      "Type": "AWS::Synthetics::Canary",
+      "Properties": {
+        "ArtifactS3Location": {
+          "Fn::Join": [
+            "",
+            [
+              "s3://",
+              {
+                "Ref": "MyPythonCanaryArtifactsBucket7AE88133"
+              }
+            ]
+          ]
+        },
+        "Code": {
+          "Handler": "canary.handler",
+          "S3Bucket": {
+            "Ref": "AssetParameters9d00e437db1f5f8788ce938a3f00a9a1b946820e78c9b4c36207c8475db882bbS3Bucket59F507C2"
+          },
+          "S3Key": {
+            "Fn::Join": [
+              "",
+              [
+                {
+                  "Fn::Select": [
+                    0,
+                    {
+                      "Fn::Split": [
+                        "||",
+                        {
+                          "Ref": "AssetParameters9d00e437db1f5f8788ce938a3f00a9a1b946820e78c9b4c36207c8475db882bbS3VersionKeyEFB5FFF8"
+                        }
+                      ]
+                    }
+                  ]
+                },
+                {
+                  "Fn::Select": [
+                    1,
+                    {
+                      "Fn::Split": [
+                        "||",
+                        {
+                          "Ref": "AssetParameters9d00e437db1f5f8788ce938a3f00a9a1b946820e78c9b4c36207c8475db882bbS3VersionKeyEFB5FFF8"
+                        }
+                      ]
+                    }
+                  ]
+                }
+              ]
+            ]
+          }
+        },
+        "ExecutionRoleArn": {
+          "Fn::GetAtt": [
+            "MyPythonCanaryServiceRole41A363E1",
+            "Arn"
+          ]
+        },
+        "Name": "py-canary-integ",
+        "RuntimeVersion": "syn-python-selenium-1.0",
         "Schedule": {
           "DurationInSeconds": "0",
           "Expression": "rate(5 minutes)"
@@ -458,17 +625,17 @@
     }
   },
   "Parameters": {
-    "AssetParameters5bf46c83158ab3b336aba1449c21b02cbac2ccea621f17d842593bb39e3e529bS3Bucket58589EB6": {
+    "AssetParameters9d00e437db1f5f8788ce938a3f00a9a1b946820e78c9b4c36207c8475db882bbS3Bucket59F507C2": {
       "Type": "String",
-      "Description": "S3 bucket for asset \"5bf46c83158ab3b336aba1449c21b02cbac2ccea621f17d842593bb39e3e529b\""
+      "Description": "S3 bucket for asset \"9d00e437db1f5f8788ce938a3f00a9a1b946820e78c9b4c36207c8475db882bb\""
     },
-    "AssetParameters5bf46c83158ab3b336aba1449c21b02cbac2ccea621f17d842593bb39e3e529bS3VersionKey8FF13E90": {
+    "AssetParameters9d00e437db1f5f8788ce938a3f00a9a1b946820e78c9b4c36207c8475db882bbS3VersionKeyEFB5FFF8": {
       "Type": "String",
-      "Description": "S3 key for asset version \"5bf46c83158ab3b336aba1449c21b02cbac2ccea621f17d842593bb39e3e529b\""
+      "Description": "S3 key for asset version \"9d00e437db1f5f8788ce938a3f00a9a1b946820e78c9b4c36207c8475db882bb\""
     },
-    "AssetParameters5bf46c83158ab3b336aba1449c21b02cbac2ccea621f17d842593bb39e3e529bArtifactHash74DCED3D": {
+    "AssetParameters9d00e437db1f5f8788ce938a3f00a9a1b946820e78c9b4c36207c8475db882bbArtifactHash0E2FE9D4": {
       "Type": "String",
-      "Description": "Artifact hash for asset \"5bf46c83158ab3b336aba1449c21b02cbac2ccea621f17d842593bb39e3e529b\""
+      "Description": "Artifact hash for asset \"9d00e437db1f5f8788ce938a3f00a9a1b946820e78c9b4c36207c8475db882bb\""
     },
     "AssetParametersb1b777dcb79a2fa2790059927207d10bf5f4747d6dd1516e2780726d9d6fa820S3Bucket705C3761": {
       "Type": "String",
diff --git a/packages/@aws-cdk/aws-synthetics/test/integ.canary.ts b/packages/@aws-cdk/aws-synthetics/test/integ.canary.ts
index cbb3a505889ad..54822badf1c99 100644
--- a/packages/@aws-cdk/aws-synthetics/test/integ.canary.ts
+++ b/packages/@aws-cdk/aws-synthetics/test/integ.canary.ts
@@ -29,7 +29,7 @@ new synthetics.Canary(stack, 'MyCanary', {
   }),
   schedule: synthetics.Schedule.rate(cdk.Duration.minutes(1)),
   artifactsBucketLocation: { bucket, prefix },
-  runtime: synthetics.Runtime.SYNTHETICS_NODEJS_2_0,
+  runtime: synthetics.Runtime.SYNTHETICS_NODEJS_PUPPETEER_3_2,
 });
 
 new synthetics.Canary(stack, 'MyCanaryOne', {
@@ -38,7 +38,7 @@ new synthetics.Canary(stack, 'MyCanaryOne', {
     handler: 'canary.handler',
     code: synthetics.Code.fromAsset(path.join(__dirname, 'canaries')),
   }),
-  runtime: synthetics.Runtime.SYNTHETICS_NODEJS_2_0,
+  runtime: synthetics.Runtime.SYNTHETICS_NODEJS_PUPPETEER_3_2,
 });
 
 new synthetics.Canary(stack, 'MyCanaryTwo', {
@@ -47,7 +47,16 @@ new synthetics.Canary(stack, 'MyCanaryTwo', {
     handler: 'canary.handler',
     code: synthetics.Code.fromAsset(path.join(__dirname, 'canary.zip')),
   }),
-  runtime: synthetics.Runtime.SYNTHETICS_NODEJS_2_0,
+  runtime: synthetics.Runtime.SYNTHETICS_NODEJS_PUPPETEER_3_2,
+});
+
+new synthetics.Canary(stack, 'MyPythonCanary', {
+  canaryName: 'py-canary-integ',
+  test: synthetics.Test.custom({
+    handler: 'canary.handler',
+    code: synthetics.Code.fromAsset(path.join(__dirname, 'canaries')),
+  }),
+  runtime: synthetics.Runtime.SYNTHETICS_PYTHON_SELENIUM_1_0,
 });
 
 app.synth();

From a85ad392459c815d5c8e645dd3e8240d059024e6 Mon Sep 17 00:00:00 2001
From: Massimo Prencipe <mprencipe@gmail.com>
Date: Fri, 27 Aug 2021 19:29:36 +0300
Subject: [PATCH 34/91] fix(elasticloadbalancingv2): target group health check
 does not validate interval versus timeout (#16107)

fix: Add validation to target group health check creation. Fixes issue #3703.

----

*By submitting this pull request, I confirm that my contribution is made under the terms of the Apache-2.0 license*
---
 .../lib/shared/base-target-group.ts           |  5 +++
 .../test/alb/listener.test.ts                 | 12 +++---
 .../test/alb/target-group.test.ts             | 41 +++++++++++++++++++
 3 files changed, 52 insertions(+), 6 deletions(-)

diff --git a/packages/@aws-cdk/aws-elasticloadbalancingv2/lib/shared/base-target-group.ts b/packages/@aws-cdk/aws-elasticloadbalancingv2/lib/shared/base-target-group.ts
index 175f63ddc4d3d..96acd45b34a4c 100644
--- a/packages/@aws-cdk/aws-elasticloadbalancingv2/lib/shared/base-target-group.ts
+++ b/packages/@aws-cdk/aws-elasticloadbalancingv2/lib/shared/base-target-group.ts
@@ -297,6 +297,11 @@ export abstract class TargetGroupBase extends CoreConstruct implements ITargetGr
    * Set/replace the target group's health check
    */
   public configureHealthCheck(healthCheck: HealthCheck) {
+    if (healthCheck.interval && healthCheck.timeout) {
+      if (healthCheck.interval.toMilliseconds() <= healthCheck.timeout.toMilliseconds()) {
+        throw new Error(`Healthcheck interval ${healthCheck.interval.toHumanString()} must be greater than the timeout ${healthCheck.timeout.toHumanString()}`);
+      }
+    }
     this.healthCheck = healthCheck;
   }
 
diff --git a/packages/@aws-cdk/aws-elasticloadbalancingv2/test/alb/listener.test.ts b/packages/@aws-cdk/aws-elasticloadbalancingv2/test/alb/listener.test.ts
index 2d945aeb2621f..885c872482e9c 100644
--- a/packages/@aws-cdk/aws-elasticloadbalancingv2/test/alb/listener.test.ts
+++ b/packages/@aws-cdk/aws-elasticloadbalancingv2/test/alb/listener.test.ts
@@ -437,17 +437,17 @@ describe('tests', () => {
     });
     group.configureHealthCheck({
       unhealthyThresholdCount: 3,
-      timeout: cdk.Duration.hours(1),
-      interval: cdk.Duration.seconds(30),
+      timeout: cdk.Duration.seconds(30),
+      interval: cdk.Duration.seconds(60),
       path: '/test',
     });
 
     // THEN
     expect(stack).toHaveResource('AWS::ElasticLoadBalancingV2::TargetGroup', {
       UnhealthyThresholdCount: 3,
-      HealthCheckIntervalSeconds: 30,
+      HealthCheckIntervalSeconds: 60,
       HealthCheckPath: '/test',
-      HealthCheckTimeoutSeconds: 3600,
+      HealthCheckTimeoutSeconds: 30,
     });
   });
 
@@ -466,8 +466,8 @@ describe('tests', () => {
 
     group.configureHealthCheck({
       unhealthyThresholdCount: 3,
-      timeout: cdk.Duration.hours(1),
-      interval: cdk.Duration.seconds(30),
+      timeout: cdk.Duration.seconds(30),
+      interval: cdk.Duration.seconds(60),
       path: '/test',
       protocol: elbv2.Protocol.TCP,
     });
diff --git a/packages/@aws-cdk/aws-elasticloadbalancingv2/test/alb/target-group.test.ts b/packages/@aws-cdk/aws-elasticloadbalancingv2/test/alb/target-group.test.ts
index 97c36c33ce237..f1a3db5eb9508 100644
--- a/packages/@aws-cdk/aws-elasticloadbalancingv2/test/alb/target-group.test.ts
+++ b/packages/@aws-cdk/aws-elasticloadbalancingv2/test/alb/target-group.test.ts
@@ -281,4 +281,45 @@ describe('tests', () => {
       }).toThrow(/Slow start duration value must be between 30 and 900 seconds./);
     });
   });
+
+  test('Interval equal to timeout', () => {
+    // GIVEN
+    const app = new cdk.App();
+    const stack = new cdk.Stack(app, 'Stack');
+    const vpc = new ec2.Vpc(stack, 'VPC', {});
+
+    // WHEN
+    const tg = new elbv2.ApplicationTargetGroup(stack, 'TargetGroup', {
+      vpc,
+    });
+
+    // THEN
+    expect(() => {
+      tg.configureHealthCheck({
+        interval: cdk.Duration.seconds(60),
+        timeout: cdk.Duration.seconds(60),
+      });
+    }).toThrow(/Healthcheck interval 1 minute must be greater than the timeout 1 minute/);
+  });
+
+  test('Interval smaller than timeout', () => {
+    // GIVEN
+    const app = new cdk.App();
+    const stack = new cdk.Stack(app, 'Stack');
+    const vpc = new ec2.Vpc(stack, 'VPC', {});
+
+    // WHEN
+    const tg = new elbv2.ApplicationTargetGroup(stack, 'TargetGroup', {
+      vpc,
+    });
+
+    // THEN
+    expect(() => {
+      tg.configureHealthCheck({
+        interval: cdk.Duration.seconds(60),
+        timeout: cdk.Duration.seconds(120),
+      });
+    }).toThrow(/Healthcheck interval 1 minute must be greater than the timeout 2 minutes/);
+  });
+
 });

From f1bf935c47006096b33fb7bf0c847ffab9230870 Mon Sep 17 00:00:00 2001
From: "Michael S. Fischer" <fiscmi@amazon.com>
Date: Fri, 27 Aug 2021 10:09:42 -0700
Subject: [PATCH 35/91] feat(ecs): add support for Fargate PV1.4 ephemeral
 storage (#15440)

Add support for ephemeral storage on Fargate PV 1.4.0 or later.

Closes #14570

----

*By submitting this pull request, I confirm that my contribution is made under the terms of the Apache-2.0 license*
---
 packages/@aws-cdk/aws-ecs/README.md           | 11 +++++++
 .../aws-ecs/lib/base/task-definition.ts       | 21 +++++++++++++
 .../lib/fargate/fargate-task-definition.ts    | 20 +++++++++++++
 .../fargate/fargate-task-definition.test.ts   | 30 +++++++++++++++++++
 4 files changed, 82 insertions(+)

diff --git a/packages/@aws-cdk/aws-ecs/README.md b/packages/@aws-cdk/aws-ecs/README.md
index 1d8a10f4deb8c..5454d93e61095 100644
--- a/packages/@aws-cdk/aws-ecs/README.md
+++ b/packages/@aws-cdk/aws-ecs/README.md
@@ -231,6 +231,17 @@ const fargateTaskDefinition = new ecs.FargateTaskDefinition(this, 'TaskDef', {
 });
 ```
 
+On Fargate Platform Version 1.4.0 or later, you may specify up to 200GiB of
+[ephemeral storage](https://docs.aws.amazon.com/AmazonECS/latest/developerguide/fargate-task-storage.html#fargate-task-storage-pv14):
+
+```ts
+const fargateTaskDefinition = new ecs.FargateTaskDefinition(this, 'TaskDef', {
+  memoryLimitMiB: 512,
+  cpu: 256,
+  ephemeralStorageGiB: 100
+});
+```
+
 To add containers to a task definition, call `addContainer()`:
 
 ```ts
diff --git a/packages/@aws-cdk/aws-ecs/lib/base/task-definition.ts b/packages/@aws-cdk/aws-ecs/lib/base/task-definition.ts
index 91c019d9fa1f1..9521142e650c5 100644
--- a/packages/@aws-cdk/aws-ecs/lib/base/task-definition.ts
+++ b/packages/@aws-cdk/aws-ecs/lib/base/task-definition.ts
@@ -199,6 +199,15 @@ export interface TaskDefinitionProps extends CommonTaskDefinitionProps {
    * @default - No inference accelerators.
    */
   readonly inferenceAccelerators?: InferenceAccelerator[];
+
+  /**
+   * The amount (in GiB) of ephemeral storage to be allocated to the task.
+   *
+   * Only supported in Fargate platform version 1.4.0 or later.
+   *
+   * @default - Undefined, in which case, the task will receive 20GiB ephemeral storage.
+   */
+  readonly ephemeralStorageGiB?: number;
 }
 
 /**
@@ -329,6 +338,13 @@ export class TaskDefinition extends TaskDefinitionBase {
    */
   public readonly compatibility: Compatibility;
 
+  /**
+   * The amount (in GiB) of ephemeral storage to be allocated to the task.
+   *
+   * Only supported in Fargate platform version 1.4.0 or later.
+   */
+  public readonly ephemeralStorageGiB?: number;
+
   /**
    * The container definitions.
    */
@@ -399,6 +415,8 @@ export class TaskDefinition extends TaskDefinitionBase {
       props.inferenceAccelerators.forEach(ia => this.addInferenceAccelerator(ia));
     }
 
+    this.ephemeralStorageGiB = props.ephemeralStorageGiB;
+
     const taskDef = new CfnTaskDefinition(this, 'Resource', {
       containerDefinitions: Lazy.any({ produce: () => this.renderContainers() }, { omitEmptyArray: true }),
       volumes: Lazy.any({ produce: () => this.renderVolumes() }, { omitEmptyArray: true }),
@@ -424,6 +442,9 @@ export class TaskDefinition extends TaskDefinitionBase {
         produce: () =>
           !isFargateCompatible(this.compatibility) ? this.renderInferenceAccelerators() : undefined,
       }, { omitEmptyArray: true }),
+      ephemeralStorage: this.ephemeralStorageGiB ? {
+        sizeInGiB: this.ephemeralStorageGiB,
+      } : undefined,
     });
 
     if (props.placementConstraints) {
diff --git a/packages/@aws-cdk/aws-ecs/lib/fargate/fargate-task-definition.ts b/packages/@aws-cdk/aws-ecs/lib/fargate/fargate-task-definition.ts
index ccf3291859708..803ec6a449969 100644
--- a/packages/@aws-cdk/aws-ecs/lib/fargate/fargate-task-definition.ts
+++ b/packages/@aws-cdk/aws-ecs/lib/fargate/fargate-task-definition.ts
@@ -50,6 +50,15 @@ export interface FargateTaskDefinitionProps extends CommonTaskDefinitionProps {
    * @default 512
    */
   readonly memoryLimitMiB?: number;
+
+  /**
+   * The amount (in GiB) of ephemeral storage to be allocated to the task. The maximum supported value is 200 GiB.
+   *
+   * NOTE: This parameter is only supported for tasks hosted on AWS Fargate using platform version 1.4.0 or later.
+   *
+   * @default 20
+   */
+  readonly ephemeralStorageGiB?: number;
 }
 
 /**
@@ -104,6 +113,11 @@ export class FargateTaskDefinition extends TaskDefinition implements IFargateTas
   // we need to explicitly write the type here, as type deduction for enums won't lead to
   // the import being generated in the .d.ts file.
 
+  /**
+   * The amount (in GiB) of ephemeral storage to be allocated to the task.
+   */
+  public readonly ephemeralStorageGiB?: number;
+
   /**
    * Constructs a new instance of the FargateTaskDefinition class.
    */
@@ -115,5 +129,11 @@ export class FargateTaskDefinition extends TaskDefinition implements IFargateTas
       compatibility: Compatibility.FARGATE,
       networkMode: NetworkMode.AWS_VPC,
     });
+
+    if (props.ephemeralStorageGiB && (props.ephemeralStorageGiB < 21 || props.ephemeralStorageGiB > 200)) {
+      throw new Error('Ephemeral storage size must be between 21GiB and 200GiB');
+    }
+
+    this.ephemeralStorageGiB = props.ephemeralStorageGiB;
   }
 }
diff --git a/packages/@aws-cdk/aws-ecs/test/fargate/fargate-task-definition.test.ts b/packages/@aws-cdk/aws-ecs/test/fargate/fargate-task-definition.test.ts
index 9cd5d994c9555..294ae3001aa64 100644
--- a/packages/@aws-cdk/aws-ecs/test/fargate/fargate-task-definition.test.ts
+++ b/packages/@aws-cdk/aws-ecs/test/fargate/fargate-task-definition.test.ts
@@ -58,6 +58,7 @@ nodeunitShim({
         taskRole: new iam.Role(stack, 'TaskRole', {
           assumedBy: new iam.ServicePrincipal('ecs-tasks.amazonaws.com'),
         }),
+        ephemeralStorageGiB: 21,
       });
 
       taskDefinition.addVolume({
@@ -76,6 +77,9 @@ nodeunitShim({
             'Arn',
           ],
         },
+        EphemeralStorage: {
+          SizeInGiB: 21,
+        },
         Family: 'myApp',
         Memory: '1024',
         NetworkMode: 'awsvpc',
@@ -131,6 +135,32 @@ nodeunitShim({
 
       test.done();
     },
+
+    'throws when ephemeral storage request is too high'(test: Test) {
+      // GIVEN
+      const stack = new cdk.Stack();
+      test.throws(() => {
+        new ecs.FargateTaskDefinition(stack, 'FargateTaskDef', {
+          ephemeralStorageGiB: 201,
+        });
+      }, /Ephemeral storage size must be between 21GiB and 200GiB/);
+
+      // THEN
+      test.done();
+    },
+
+    'throws when ephemeral storage request is too low'(test: Test) {
+      // GIVEN
+      const stack = new cdk.Stack();
+      test.throws(() => {
+        new ecs.FargateTaskDefinition(stack, 'FargateTaskDef', {
+          ephemeralStorageGiB: 20,
+        });
+      }, /Ephemeral storage size must be between 21GiB and 200GiB/);
+
+      // THEN
+      test.done();
+    },
   },
 
   'When importing from an existing Fargate TaskDefinition': {

From d5ca419448e84f0cbb25dbd90d48fb4c407ede5c Mon Sep 17 00:00:00 2001
From: Niranjan Jayakar <nija@amazon.com>
Date: Sat, 28 Aug 2021 15:48:53 +0100
Subject: [PATCH 36/91] chore: migrate a few modules from nodeunit-shim to jest
 (#16258)

Part of the the effort to homogenize our testing environment in
the AWS CDK repo involves removing the nodeunit-shim and
using standard jest.

This change applies this to a few modules.

----

*By submitting this pull request, I confirm that my contribution is made under the terms of the Apache-2.0 license*
---
 .../@aws-cdk/aws-autoscaling/package.json     |   2 +-
 .../test/auto-scaling-group.test.ts           | 476 +++++-----
 .../aws-autoscaling/test/cfn-init.test.ts     |   1 +
 .../test/lifecyclehooks.test.ts               |  10 +-
 .../aws-autoscaling/test/scaling.test.ts      |  50 +-
 .../test/scheduled-action.test.ts             |  22 +-
 .../aws-codepipeline-actions/package.json     |   2 +-
 .../bitbucket/bitbucket-source-action.test.ts |  50 +-
 .../cloudformation-pipeline-actions.test.ts   | 134 ++-
 .../cloudformation/pipeline-actions.test.ts   | 104 +--
 .../test/codebuild/codebuild-action.test.ts   |  83 +-
 .../codecommit-source-action.test.ts          | 146 +--
 .../test/codedeploy/ecs-deploy-action.test.ts |  79 +-
 ...codestar-connections-source-action.test.ts |  50 +-
 .../test/ecr/ecr-source-action.test.ts        |  19 +-
 .../test/ecs/ecs-deploy-action.test.ts        |  95 +-
 .../test/github/github-source-action.test.ts  |  50 +-
 .../test/manual-approval.test.ts              |  47 +-
 .../test/pipeline.test.ts                     | 239 ++---
 .../test/s3/s3-source-action.test.ts          | 103 ++-
 ...servicecatalog-deploy-action-beta1.test.ts |  25 +-
 .../stepfunctions-invoke-actions.test.ts      |  43 +-
 packages/@aws-cdk/aws-ecs/package.json        |   2 +-
 .../test/app-mesh-proxy-configuration.test.ts |  45 +-
 .../aws-ecs/test/aws-log-driver.test.ts       |  71 +-
 .../@aws-cdk/aws-ecs/test/cluster.test.ts     | 716 ++++++++-------
 .../aws-ecs/test/ec2/cross-stack.test.ts      |  39 +-
 .../aws-ecs/test/ec2/ec2-service.test.ts      | 834 +++++++++---------
 .../aws-ecs/test/environment-file.test.ts     |  24 +-
 .../test/external/external-service.test.ts    |  99 +--
 .../external/external-task-definition.test.ts |  73 +-
 .../test/fargate/fargate-service.test.ts      | 660 +++++++-------
 .../fargate/fargate-task-definition.test.ts   | 127 ++-
 .../aws-ecs/test/firelens-log-driver.test.ts  |  89 +-
 .../aws-ecs/test/fluentd-log-driver.test.ts   |  51 +-
 .../aws-ecs/test/gelf-log-driver.test.ts      |  31 +-
 .../tag-parameter-container-image.test.ts     |  48 +-
 .../aws-ecs/test/journald-log-driver.test.ts  |  41 +-
 .../aws-ecs/test/json-file-log-driver.test.ts |  41 +-
 .../aws-ecs/test/splunk-log-driver.test.ts    |  73 +-
 .../aws-ecs/test/syslog-log-driver.test.ts    |  41 +-
 .../aws-ecs/test/task-definition.test.ts      |  71 +-
 packages/@aws-cdk/aws-route53/package.json    |   1 -
 .../test/hosted-zone-provider.test.ts         |  30 +-
 .../aws-route53/test/hosted-zone.test.ts      |  43 +-
 .../aws-route53/test/record-set.test.ts       | 234 ++---
 .../@aws-cdk/aws-route53/test/route53.test.ts | 106 +--
 .../@aws-cdk/aws-route53/test/util.test.ts    |  49 +-
 .../vpc-endpoint-service-domain-name.test.ts  |   1 -
 packages/@aws-cdk/aws-s3/package.json         |   2 +-
 packages/@aws-cdk/aws-s3/test/aspect.test.ts  |  21 +-
 .../aws-s3/test/bucket-policy.test.ts         |  47 +-
 packages/@aws-cdk/aws-s3/test/cors.test.ts    |  25 +-
 packages/@aws-cdk/aws-s3/test/metrics.test.ts |  45 +-
 .../@aws-cdk/aws-s3/test/notification.test.ts |  58 +-
 packages/@aws-cdk/aws-s3/test/rules.test.ts   |  65 +-
 packages/@aws-cdk/aws-s3/test/util.test.ts    |  69 +-
 57 files changed, 2891 insertions(+), 2911 deletions(-)

diff --git a/packages/@aws-cdk/aws-autoscaling/package.json b/packages/@aws-cdk/aws-autoscaling/package.json
index c2ece82fdb8b0..67fb9d4e1dd7e 100644
--- a/packages/@aws-cdk/aws-autoscaling/package.json
+++ b/packages/@aws-cdk/aws-autoscaling/package.json
@@ -78,7 +78,7 @@
     "cdk-build-tools": "0.0.0",
     "cdk-integ-tools": "0.0.0",
     "cfn2ts": "0.0.0",
-    "nodeunit-shim": "0.0.0",
+    "jest": "^26.6.3",
     "pkglint": "0.0.0",
     "@aws-cdk/cloud-assembly-schema": "0.0.0",
     "@aws-cdk/assert-internal": "0.0.0"
diff --git a/packages/@aws-cdk/aws-autoscaling/test/auto-scaling-group.test.ts b/packages/@aws-cdk/aws-autoscaling/test/auto-scaling-group.test.ts
index 9fb5da7b46ce8..64795593e8ec4 100644
--- a/packages/@aws-cdk/aws-autoscaling/test/auto-scaling-group.test.ts
+++ b/packages/@aws-cdk/aws-autoscaling/test/auto-scaling-group.test.ts
@@ -1,17 +1,17 @@
-import { ABSENT, expect, haveResource, haveResourceLike, InspectionFailure, ResourcePart } from '@aws-cdk/assert-internal';
+import '@aws-cdk/assert-internal/jest';
+import { ABSENT, InspectionFailure, ResourcePart } from '@aws-cdk/assert-internal';
 import * as cloudwatch from '@aws-cdk/aws-cloudwatch';
 import * as ec2 from '@aws-cdk/aws-ec2';
 import * as iam from '@aws-cdk/aws-iam';
 import * as sns from '@aws-cdk/aws-sns';
 import * as cxschema from '@aws-cdk/cloud-assembly-schema';
 import * as cdk from '@aws-cdk/core';
-import { nodeunitShim, Test } from 'nodeunit-shim';
 import * as autoscaling from '../lib';
 
 /* eslint-disable quote-props */
 
-nodeunitShim({
-  'default fleet'(test: Test) {
+describe('auto scaling group', () => {
+  test('default fleet', () => {
     const stack = getTestStack();
     const vpc = mockVpc(stack);
 
@@ -21,7 +21,7 @@ nodeunitShim({
       vpc,
     });
 
-    expect(stack).toMatch({
+    expect(stack).toMatchTemplate({
       'Parameters': {
         'SsmParameterValueawsserviceamiamazonlinuxlatestamznamihvmx8664gp2C96584B6F00A464EAD1953AFF4B05118Parameter': {
           'Type': 'AWS::SSM::Parameter::Value<AWS::EC2::Image::Id>',
@@ -136,10 +136,10 @@ nodeunitShim({
       },
     });
 
-    test.done();
-  },
 
-  'can set minCapacity, maxCapacity, desiredCapacity to 0'(test: Test) {
+  });
+
+  test('can set minCapacity, maxCapacity, desiredCapacity to 0', () => {
     const stack = new cdk.Stack(undefined, 'MyStack', { env: { region: 'us-east-1', account: '1234' } });
     const vpc = mockVpc(stack);
 
@@ -152,17 +152,17 @@ nodeunitShim({
       desiredCapacity: 0,
     });
 
-    expect(stack).to(haveResource('AWS::AutoScaling::AutoScalingGroup', {
+    expect(stack).toHaveResource('AWS::AutoScaling::AutoScalingGroup', {
       MinSize: '0',
       MaxSize: '0',
       DesiredCapacity: '0',
     },
-    ));
+    );
 
-    test.done();
-  },
 
-  'validation is not performed when using Tokens'(test: Test) {
+  });
+
+  test('validation is not performed when using Tokens', () => {
     const stack = new cdk.Stack(undefined, 'MyStack', { env: { region: 'us-east-1', account: '1234' } });
     const vpc = mockVpc(stack);
 
@@ -176,17 +176,17 @@ nodeunitShim({
     });
 
     // THEN: no exception
-    expect(stack).to(haveResource('AWS::AutoScaling::AutoScalingGroup', {
+    expect(stack).toHaveResource('AWS::AutoScaling::AutoScalingGroup', {
       MinSize: '5',
       MaxSize: '1',
       DesiredCapacity: '20',
     },
-    ));
+    );
 
-    test.done();
-  },
 
-  'userdata can be overridden by image'(test: Test) {
+  });
+
+  test('userdata can be overridden by image', () => {
     // GIVEN
     const stack = new cdk.Stack();
     const vpc = mockVpc(stack);
@@ -204,12 +204,12 @@ nodeunitShim({
     });
 
     // THEN
-    test.equals(asg.userData.render(), '#!/bin/bash\nit me!');
+    expect(asg.userData.render()).toEqual('#!/bin/bash\nit me!');
+
 
-    test.done();
-  },
+  });
 
-  'userdata can be overridden at ASG directly'(test: Test) {
+  test('userdata can be overridden at ASG directly', () => {
     // GIVEN
     const stack = new cdk.Stack();
     const vpc = mockVpc(stack);
@@ -231,12 +231,12 @@ nodeunitShim({
     });
 
     // THEN
-    test.equals(asg.userData.render(), '#!/bin/bash\nno me!');
+    expect(asg.userData.render()).toEqual('#!/bin/bash\nno me!');
 
-    test.done();
-  },
 
-  'can specify only min capacity'(test: Test) {
+  });
+
+  test('can specify only min capacity', () => {
     // GIVEN
     const stack = new cdk.Stack();
     const vpc = mockVpc(stack);
@@ -250,16 +250,16 @@ nodeunitShim({
     });
 
     // THEN
-    expect(stack).to(haveResource('AWS::AutoScaling::AutoScalingGroup', {
+    expect(stack).toHaveResource('AWS::AutoScaling::AutoScalingGroup', {
       MinSize: '10',
       MaxSize: '10',
     },
-    ));
+    );
+
 
-    test.done();
-  },
+  });
 
-  'can specify only max capacity'(test: Test) {
+  test('can specify only max capacity', () => {
     // GIVEN
     const stack = new cdk.Stack();
     const vpc = mockVpc(stack);
@@ -273,16 +273,16 @@ nodeunitShim({
     });
 
     // THEN
-    expect(stack).to(haveResource('AWS::AutoScaling::AutoScalingGroup', {
+    expect(stack).toHaveResource('AWS::AutoScaling::AutoScalingGroup', {
       MinSize: '1',
       MaxSize: '10',
     },
-    ));
+    );
+
 
-    test.done();
-  },
+  });
 
-  'can specify only desiredCount'(test: Test) {
+  test('can specify only desiredCount', () => {
     // GIVEN
     const stack = new cdk.Stack();
     const vpc = mockVpc(stack);
@@ -296,17 +296,17 @@ nodeunitShim({
     });
 
     // THEN
-    expect(stack).to(haveResource('AWS::AutoScaling::AutoScalingGroup', {
+    expect(stack).toHaveResource('AWS::AutoScaling::AutoScalingGroup', {
       MinSize: '1',
       MaxSize: '10',
       DesiredCapacity: '10',
     },
-    ));
+    );
+
 
-    test.done();
-  },
+  });
 
-  'addToRolePolicy can be used to add statements to the role policy'(test: Test) {
+  test('addToRolePolicy can be used to add statements to the role policy', () => {
     const stack = new cdk.Stack(undefined, 'MyStack', { env: { region: 'us-east-1', account: '1234' } });
     const vpc = mockVpc(stack);
 
@@ -321,7 +321,7 @@ nodeunitShim({
       resources: ['*'],
     }));
 
-    expect(stack).to(haveResource('AWS::IAM::Policy', {
+    expect(stack).toHaveResource('AWS::IAM::Policy', {
       PolicyDocument: {
         Version: '2012-10-17',
         Statement: [
@@ -332,11 +332,11 @@ nodeunitShim({
           },
         ],
       },
-    }));
-    test.done();
-  },
+    });
+
+  });
 
-  'can configure replacing update'(test: Test) {
+  test('can configure replacing update', () => {
     // GIVEN
     const stack = new cdk.Stack(undefined, 'MyStack', { env: { region: 'us-east-1', account: '1234' } });
     const vpc = mockVpc(stack);
@@ -351,7 +351,7 @@ nodeunitShim({
     });
 
     // THEN
-    expect(stack).to(haveResourceLike('AWS::AutoScaling::AutoScalingGroup', {
+    expect(stack).toHaveResourceLike('AWS::AutoScaling::AutoScalingGroup', {
       UpdatePolicy: {
         AutoScalingReplacingUpdate: {
           WillReplace: true,
@@ -362,12 +362,12 @@ nodeunitShim({
           MinSuccessfulInstancesPercent: 50,
         },
       },
-    }, ResourcePart.CompleteDefinition));
+    }, ResourcePart.CompleteDefinition);
 
-    test.done();
-  },
 
-  'can configure rolling update'(test: Test) {
+  });
+
+  test('can configure rolling update', () => {
     // GIVEN
     const stack = new cdk.Stack(undefined, 'MyStack', { env: { region: 'us-east-1', account: '1234' } });
     const vpc = mockVpc(stack);
@@ -385,7 +385,7 @@ nodeunitShim({
     });
 
     // THEN
-    expect(stack).to(haveResourceLike('AWS::AutoScaling::AutoScalingGroup', {
+    expect(stack).toHaveResourceLike('AWS::AutoScaling::AutoScalingGroup', {
       UpdatePolicy: {
         'AutoScalingRollingUpdate': {
           'MinSuccessfulInstancesPercent': 50,
@@ -394,12 +394,12 @@ nodeunitShim({
           'SuspendProcesses': ['HealthCheck', 'ReplaceUnhealthy', 'AZRebalance', 'AlarmNotification', 'ScheduledActions'],
         },
       },
-    }, ResourcePart.CompleteDefinition));
+    }, ResourcePart.CompleteDefinition);
 
-    test.done();
-  },
 
-  'can configure resource signals'(test: Test) {
+  });
+
+  test('can configure resource signals', () => {
     // GIVEN
     const stack = new cdk.Stack(undefined, 'MyStack', { env: { region: 'us-east-1', account: '1234' } });
     const vpc = mockVpc(stack);
@@ -414,19 +414,19 @@ nodeunitShim({
     });
 
     // THEN
-    expect(stack).to(haveResourceLike('AWS::AutoScaling::AutoScalingGroup', {
+    expect(stack).toHaveResourceLike('AWS::AutoScaling::AutoScalingGroup', {
       CreationPolicy: {
         ResourceSignal: {
           Count: 5,
           Timeout: 'PT11M6S',
         },
       },
-    }, ResourcePart.CompleteDefinition));
+    }, ResourcePart.CompleteDefinition);
 
-    test.done();
-  },
 
-  'can configure EC2 health check'(test: Test) {
+  });
+
+  test('can configure EC2 health check', () => {
     // GIVEN
     const stack = new cdk.Stack(undefined, 'MyStack', { env: { region: 'us-east-1', account: '1234' } });
     const vpc = mockVpc(stack);
@@ -440,14 +440,14 @@ nodeunitShim({
     });
 
     // THEN
-    expect(stack).to(haveResourceLike('AWS::AutoScaling::AutoScalingGroup', {
+    expect(stack).toHaveResourceLike('AWS::AutoScaling::AutoScalingGroup', {
       HealthCheckType: 'EC2',
-    }));
+    });
 
-    test.done();
-  },
 
-  'can configure EBS health check'(test: Test) {
+  });
+
+  test('can configure EBS health check', () => {
     // GIVEN
     const stack = new cdk.Stack(undefined, 'MyStack', { env: { region: 'us-east-1', account: '1234' } });
     const vpc = mockVpc(stack);
@@ -461,15 +461,15 @@ nodeunitShim({
     });
 
     // THEN
-    expect(stack).to(haveResourceLike('AWS::AutoScaling::AutoScalingGroup', {
+    expect(stack).toHaveResourceLike('AWS::AutoScaling::AutoScalingGroup', {
       HealthCheckType: 'ELB',
       HealthCheckGracePeriod: 900,
-    }));
+    });
 
-    test.done();
-  },
 
-  'can add Security Group to Fleet'(test: Test) {
+  });
+
+  test('can add Security Group to Fleet', () => {
     // GIVEN
     const stack = new cdk.Stack(undefined, 'MyStack', { env: { region: 'us-east-1', account: '1234' } });
     const vpc = mockVpc(stack);
@@ -481,7 +481,7 @@ nodeunitShim({
       vpc,
     });
     asg.addSecurityGroup(mockSecurityGroup(stack));
-    expect(stack).to(haveResource('AWS::AutoScaling::LaunchConfiguration', {
+    expect(stack).toHaveResource('AWS::AutoScaling::LaunchConfiguration', {
       SecurityGroups: [
         {
           'Fn::GetAtt': [
@@ -491,11 +491,11 @@ nodeunitShim({
         },
         'most-secure',
       ],
-    }));
-    test.done();
-  },
+    });
 
-  'can set tags'(test: Test) {
+  });
+
+  test('can set tags', () => {
     // GIVEN
     const stack = getTestStack();
     // new cdk.Stack(undefined, 'MyStack', { env: { region: 'us-east-1', account: '1234' }});
@@ -517,7 +517,7 @@ nodeunitShim({
     cdk.Tags.of(asg).add('notsuper', 'caramel', { applyToLaunchedInstances: false });
 
     // THEN
-    expect(stack).to(haveResource('AWS::AutoScaling::AutoScalingGroup', {
+    expect(stack).toHaveResource('AWS::AutoScaling::AutoScalingGroup', {
       Tags: [
         {
           Key: 'Name',
@@ -535,11 +535,11 @@ nodeunitShim({
           Value: 'acai',
         },
       ],
-    }));
-    test.done();
-  },
+    });
+
+  });
 
-  'allows setting spot price'(test: Test) {
+  test('allows setting spot price', () => {
     // GIVEN
     const stack = new cdk.Stack();
     const vpc = mockVpc(stack);
@@ -554,15 +554,15 @@ nodeunitShim({
     });
 
     // THEN
-    test.deepEqual(asg.spotPrice, '0.05');
-    expect(stack).to(haveResource('AWS::AutoScaling::LaunchConfiguration', {
+    expect(asg.spotPrice).toEqual('0.05');
+    expect(stack).toHaveResource('AWS::AutoScaling::LaunchConfiguration', {
       SpotPrice: '0.05',
-    }));
+    });
+
 
-    test.done();
-  },
+  });
 
-  'allows association of public IP address'(test: Test) {
+  test('allows association of public IP address', () => {
     // GIVEN
     const stack = new cdk.Stack();
     const vpc = mockVpc(stack);
@@ -581,20 +581,20 @@ nodeunitShim({
     });
 
     // THEN
-    expect(stack).to(haveResource('AWS::AutoScaling::LaunchConfiguration', {
+    expect(stack).toHaveResource('AWS::AutoScaling::LaunchConfiguration', {
       AssociatePublicIpAddress: true,
     },
-    ));
-    test.done();
-  },
+    );
+
+  });
 
-  'association of public IP address requires public subnet'(test: Test) {
+  test('association of public IP address requires public subnet', () => {
     // GIVEN
     const stack = new cdk.Stack();
     const vpc = mockVpc(stack);
 
     // WHEN
-    test.throws(() => {
+    expect(() => {
       new autoscaling.AutoScalingGroup(stack, 'MyStack', {
         instanceType: ec2.InstanceType.of(ec2.InstanceClass.M4, ec2.InstanceSize.MICRO),
         machineImage: new ec2.AmazonLinuxImage(),
@@ -604,11 +604,11 @@ nodeunitShim({
         desiredCapacity: 0,
         associatePublicIpAddress: true,
       });
-    });
-    test.done();
-  },
+    }).toThrow();
+
+  });
 
-  'allows disassociation of public IP address'(test: Test) {
+  test('allows disassociation of public IP address', () => {
     // GIVEN
     const stack = new cdk.Stack();
     const vpc = mockVpc(stack);
@@ -625,14 +625,14 @@ nodeunitShim({
     });
 
     // THEN
-    expect(stack).to(haveResource('AWS::AutoScaling::LaunchConfiguration', {
+    expect(stack).toHaveResource('AWS::AutoScaling::LaunchConfiguration', {
       AssociatePublicIpAddress: false,
     },
-    ));
-    test.done();
-  },
+    );
 
-  'does not specify public IP address association by default'(test: Test) {
+  });
+
+  test('does not specify public IP address association by default', () => {
     // GIVEN
     const stack = new cdk.Stack();
     const vpc = mockVpc(stack);
@@ -648,7 +648,7 @@ nodeunitShim({
     });
 
     // THEN
-    expect(stack).to(haveResource('AWS::AutoScaling::LaunchConfiguration', (resource: any, errors: InspectionFailure) => {
+    expect(stack).toHaveResource('AWS::AutoScaling::LaunchConfiguration', (resource: any, errors: InspectionFailure) => {
       for (const key of Object.keys(resource)) {
         if (key === 'AssociatePublicIpAddress') {
           errors.failureReason = 'Has AssociatePublicIpAddress';
@@ -656,11 +656,11 @@ nodeunitShim({
         }
       }
       return true;
-    }));
-    test.done();
-  },
+    });
 
-  'an existing security group can be specified instead of auto-created'(test: Test) {
+  });
+
+  test('an existing security group can be specified instead of auto-created', () => {
     // GIVEN
     const stack = new cdk.Stack();
     const vpc = mockVpc(stack);
@@ -675,14 +675,14 @@ nodeunitShim({
     });
 
     // THEN
-    expect(stack).to(haveResource('AWS::AutoScaling::LaunchConfiguration', {
+    expect(stack).toHaveResource('AWS::AutoScaling::LaunchConfiguration', {
       SecurityGroups: ['most-secure'],
     },
-    ));
-    test.done();
-  },
+    );
+
+  });
 
-  'an existing role can be specified instead of auto-created'(test: Test) {
+  test('an existing role can be specified instead of auto-created', () => {
     // GIVEN
     const stack = new cdk.Stack();
     const vpc = mockVpc(stack);
@@ -697,14 +697,14 @@ nodeunitShim({
     });
 
     // THEN
-    test.equal(asg.role, importedRole);
-    expect(stack).to(haveResource('AWS::IAM::InstanceProfile', {
+    expect(asg.role).toEqual(importedRole);
+    expect(stack).toHaveResource('AWS::IAM::InstanceProfile', {
       'Roles': ['HelloDude'],
-    }));
-    test.done();
-  },
+    });
+
+  });
 
-  'defaultChild is available on an ASG'(test: Test) {
+  test('defaultChild is available on an ASG', () => {
     // GIVEN
     const stack = new cdk.Stack();
     const vpc = mockVpc(stack);
@@ -715,12 +715,12 @@ nodeunitShim({
     });
 
     // THEN
-    test.ok(asg.node.defaultChild instanceof autoscaling.CfnAutoScalingGroup);
+    expect(asg.node.defaultChild instanceof autoscaling.CfnAutoScalingGroup).toEqual(true);
+
 
-    test.done();
-  },
+  });
 
-  'can set blockDeviceMappings'(test: Test) {
+  test('can set blockDeviceMappings', () => {
     // GIVEN
     const stack = new cdk.Stack();
     const vpc = mockVpc(stack);
@@ -758,7 +758,7 @@ nodeunitShim({
     });
 
     // THEN
-    expect(stack).to(haveResource('AWS::AutoScaling::LaunchConfiguration', {
+    expect(stack).toHaveResource('AWS::AutoScaling::LaunchConfiguration', {
       BlockDeviceMappings: [
         {
           DeviceName: 'ebs',
@@ -795,12 +795,12 @@ nodeunitShim({
           NoDevice: true,
         },
       ],
-    }));
+    });
 
-    test.done();
-  },
 
-  'can configure maxInstanceLifetime'(test: Test) {
+  });
+
+  test('can configure maxInstanceLifetime', () => {
     // GIVEN
     const stack = new cdk.Stack();
     const vpc = mockVpc(stack);
@@ -812,50 +812,50 @@ nodeunitShim({
     });
 
     // THEN
-    expect(stack).to(haveResource('AWS::AutoScaling::AutoScalingGroup', {
+    expect(stack).toHaveResource('AWS::AutoScaling::AutoScalingGroup', {
       'MaxInstanceLifetime': 604800,
-    }));
+    });
 
-    test.done();
-  },
 
-  'throws if maxInstanceLifetime < 7 days'(test: Test) {
+  });
+
+  test('throws if maxInstanceLifetime < 7 days', () => {
     // GIVEN
     const stack = new cdk.Stack();
     const vpc = mockVpc(stack);
 
     // THEN
-    test.throws(() => {
+    expect(() => {
       new autoscaling.AutoScalingGroup(stack, 'MyStack', {
         instanceType: ec2.InstanceType.of(ec2.InstanceClass.M4, ec2.InstanceSize.MICRO),
         machineImage: new ec2.AmazonLinuxImage(),
         vpc,
         maxInstanceLifetime: cdk.Duration.days(6),
       });
-    }, /maxInstanceLifetime must be between 7 and 365 days \(inclusive\)/);
+    }).toThrow(/maxInstanceLifetime must be between 7 and 365 days \(inclusive\)/);
 
-    test.done();
-  },
 
-  'throws if maxInstanceLifetime > 365 days'(test: Test) {
+  });
+
+  test('throws if maxInstanceLifetime > 365 days', () => {
     // GIVEN
     const stack = new cdk.Stack();
     const vpc = mockVpc(stack);
 
     // THEN
-    test.throws(() => {
+    expect(() => {
       new autoscaling.AutoScalingGroup(stack, 'MyStack', {
         instanceType: ec2.InstanceType.of(ec2.InstanceClass.M4, ec2.InstanceSize.MICRO),
         machineImage: new ec2.AmazonLinuxImage(),
         vpc,
         maxInstanceLifetime: cdk.Duration.days(366),
       });
-    }, /maxInstanceLifetime must be between 7 and 365 days \(inclusive\)/);
+    }).toThrow(/maxInstanceLifetime must be between 7 and 365 days \(inclusive\)/);
 
-    test.done();
-  },
 
-  'can configure instance monitoring'(test: Test) {
+  });
+
+  test('can configure instance monitoring', () => {
     // GIVEN
     const stack = new cdk.Stack();
     const vpc = mockVpc(stack);
@@ -869,13 +869,13 @@ nodeunitShim({
     });
 
     // THEN
-    expect(stack).to(haveResource('AWS::AutoScaling::LaunchConfiguration', {
+    expect(stack).toHaveResource('AWS::AutoScaling::LaunchConfiguration', {
       InstanceMonitoring: false,
-    }));
-    test.done();
-  },
+    });
+
+  });
 
-  'instance monitoring defaults to absent'(test: Test) {
+  test('instance monitoring defaults to absent', () => {
     // GIVEN
     const stack = new cdk.Stack();
     const vpc = mockVpc(stack);
@@ -888,19 +888,19 @@ nodeunitShim({
     });
 
     // THEN
-    expect(stack).to(haveResource('AWS::AutoScaling::LaunchConfiguration', {
+    expect(stack).toHaveResource('AWS::AutoScaling::LaunchConfiguration', {
       InstanceMonitoring: ABSENT,
-    }));
-    test.done();
-  },
+    });
+
+  });
 
-  'throws if ephemeral volumeIndex < 0'(test: Test) {
+  test('throws if ephemeral volumeIndex < 0', () => {
     // GIVEN
     const stack = new cdk.Stack();
     const vpc = mockVpc(stack);
 
     // THEN
-    test.throws(() => {
+    expect(() => {
       new autoscaling.AutoScalingGroup(stack, 'MyStack', {
         instanceType: ec2.InstanceType.of(ec2.InstanceClass.M4, ec2.InstanceSize.MICRO),
         machineImage: new ec2.AmazonLinuxImage(),
@@ -910,18 +910,18 @@ nodeunitShim({
           volume: autoscaling.BlockDeviceVolume.ephemeral(-1),
         }],
       });
-    }, /volumeIndex must be a number starting from 0/);
+    }).toThrow(/volumeIndex must be a number starting from 0/);
 
-    test.done();
-  },
 
-  'throws if volumeType === IO1 without iops'(test: Test) {
+  });
+
+  test('throws if volumeType === IO1 without iops', () => {
     // GIVEN
     const stack = new cdk.Stack();
     const vpc = mockVpc(stack);
 
     // THEN
-    test.throws(() => {
+    expect(() => {
       new autoscaling.AutoScalingGroup(stack, 'MyStack', {
         instanceType: ec2.InstanceType.of(ec2.InstanceClass.M4, ec2.InstanceSize.MICRO),
         machineImage: new ec2.AmazonLinuxImage(),
@@ -935,12 +935,12 @@ nodeunitShim({
           }),
         }],
       });
-    }, /ops property is required with volumeType: EbsDeviceVolumeType.IO1/);
+    }).toThrow(/ops property is required with volumeType: EbsDeviceVolumeType.IO1/);
 
-    test.done();
-  },
 
-  'warning if iops without volumeType'(test: Test) {
+  });
+
+  test('warning if iops without volumeType', () => {
     // GIVEN
     const stack = new cdk.Stack();
     const vpc = mockVpc(stack);
@@ -960,13 +960,13 @@ nodeunitShim({
     });
 
     // THEN
-    test.deepEqual(asg.node.metadata[0].type, cxschema.ArtifactMetadataEntryType.WARN);
-    test.deepEqual(asg.node.metadata[0].data, 'iops will be ignored without volumeType: EbsDeviceVolumeType.IO1');
+    expect(asg.node.metadata[0].type).toEqual(cxschema.ArtifactMetadataEntryType.WARN);
+    expect(asg.node.metadata[0].data).toEqual('iops will be ignored without volumeType: EbsDeviceVolumeType.IO1');
 
-    test.done();
-  },
 
-  'warning if iops and volumeType !== IO1'(test: Test) {
+  });
+
+  test('warning if iops and volumeType !== IO1', () => {
     // GIVEN
     const stack = new cdk.Stack();
     const vpc = mockVpc(stack);
@@ -987,13 +987,13 @@ nodeunitShim({
     });
 
     // THEN
-    test.deepEqual(asg.node.metadata[0].type, cxschema.ArtifactMetadataEntryType.WARN);
-    test.deepEqual(asg.node.metadata[0].data, 'iops will be ignored without volumeType: EbsDeviceVolumeType.IO1');
+    expect(asg.node.metadata[0].type).toEqual(cxschema.ArtifactMetadataEntryType.WARN);
+    expect(asg.node.metadata[0].data).toEqual('iops will be ignored without volumeType: EbsDeviceVolumeType.IO1');
+
 
-    test.done();
-  },
+  });
 
-  'step scaling on metric'(test: Test) {
+  test('step scaling on metric', () => {
     // GIVEN
     const stack = new cdk.Stack();
     const vpc = mockVpc(stack);
@@ -1018,18 +1018,18 @@ nodeunitShim({
     });
 
     // THEN
-    expect(stack).to(haveResource('AWS::CloudWatch::Alarm', {
+    expect(stack).toHaveResource('AWS::CloudWatch::Alarm', {
       ComparisonOperator: 'LessThanOrEqualToThreshold',
       EvaluationPeriods: 1,
       MetricName: 'Metric',
       Namespace: 'Test',
       Period: 300,
-    }));
+    });
+
 
-    test.done();
-  },
+  });
 
-  'step scaling on MathExpression'(test: Test) {
+  test('step scaling on MathExpression', () => {
     // GIVEN
     const stack = new cdk.Stack();
     const vpc = mockVpc(stack);
@@ -1059,11 +1059,11 @@ nodeunitShim({
     });
 
     // THEN
-    expect(stack).notTo(haveResource('AWS::CloudWatch::Alarm', {
+    expect(stack).not.toHaveResource('AWS::CloudWatch::Alarm', {
       Period: 60,
-    }));
+    });
 
-    expect(stack).to(haveResource('AWS::CloudWatch::Alarm', {
+    expect(stack).toHaveResource('AWS::CloudWatch::Alarm', {
       'ComparisonOperator': 'LessThanOrEqualToThreshold',
       'EvaluationPeriods': 1,
       'Metrics': [
@@ -1085,12 +1085,12 @@ nodeunitShim({
         },
       ],
       'Threshold': 49,
-    }));
+    });
 
-    test.done();
-  },
 
-  'test GroupMetrics.all(), adds a single MetricsCollection with no Metrics specified'(test: Test) {
+  });
+
+  test('test GroupMetrics.all(), adds a single MetricsCollection with no Metrics specified', () => {
     // GIVEN
     const stack = new cdk.Stack();
     const vpc = mockVpc(stack);
@@ -1103,18 +1103,18 @@ nodeunitShim({
     });
 
     // Then
-    expect(stack).to(haveResource('AWS::AutoScaling::AutoScalingGroup', {
+    expect(stack).toHaveResource('AWS::AutoScaling::AutoScalingGroup', {
       MetricsCollection: [
         {
           Granularity: '1Minute',
           Metrics: ABSENT,
         },
       ],
-    }));
-    test.done();
-  },
+    });
+
+  });
 
-  'test can specify a subset of group metrics'(test: Test) {
+  test('test can specify a subset of group metrics', () => {
     // GIVEN
     const stack = new cdk.Stack();
     const vpc = mockVpc(stack);
@@ -1138,7 +1138,7 @@ nodeunitShim({
     });
 
     // Then
-    expect(stack).to(haveResource('AWS::AutoScaling::AutoScalingGroup', {
+    expect(stack).toHaveResource('AWS::AutoScaling::AutoScalingGroup', {
       MetricsCollection: [
         {
           Granularity: '1Minute',
@@ -1148,11 +1148,11 @@ nodeunitShim({
           Metrics: ['GroupPendingInstances', 'GroupStandbyInstances', 'GroupTotalInstances', 'GroupTerminatingInstances'],
         },
       ],
-    }));
-    test.done();
-  },
+    });
+
+  });
 
-  'test deduplication of group metrics '(test: Test) {
+  test('test deduplication of group metrics ', () => {
     // GIVEN
     const stack = new cdk.Stack();
     const vpc = mockVpc(stack);
@@ -1168,18 +1168,18 @@ nodeunitShim({
     });
 
     // Then
-    expect(stack).to(haveResource('AWS::AutoScaling::AutoScalingGroup', {
+    expect(stack).toHaveResource('AWS::AutoScaling::AutoScalingGroup', {
       MetricsCollection: [
         {
           Granularity: '1Minute',
           Metrics: ['GroupMinSize', 'GroupMaxSize'],
         },
       ],
-    }));
-    test.done();
-  },
+    });
+
+  });
 
-  'allow configuring notifications'(test: Test) {
+  test('allow configuring notifications', () => {
     // GIVEN
     const stack = new cdk.Stack();
     const vpc = mockVpc(stack);
@@ -1203,7 +1203,7 @@ nodeunitShim({
     });
 
     // THEN
-    expect(stack).to(haveResource('AWS::AutoScaling::AutoScalingGroup', {
+    expect(stack).toHaveResource('AWS::AutoScaling::AutoScalingGroup', {
       NotificationConfigurations: [
         {
           TopicARN: { Ref: 'MyTopic86869434' },
@@ -1220,19 +1220,19 @@ nodeunitShim({
         },
       ],
     },
-    ));
+    );
 
-    test.done();
-  },
 
-  'throw if notification and notificationsTopics are both configured'(test: Test) {
+  });
+
+  test('throw if notification and notificationsTopics are both configured', () => {
     // GIVEN
     const stack = new cdk.Stack();
     const vpc = mockVpc(stack);
     const topic = new sns.Topic(stack, 'MyTopic');
 
     // THEN
-    test.throws(() => {
+    expect(() => {
       new autoscaling.AutoScalingGroup(stack, 'MyASG', {
         instanceType: ec2.InstanceType.of(ec2.InstanceClass.M4, ec2.InstanceSize.MICRO),
         machineImage: new ec2.AmazonLinuxImage(),
@@ -1242,11 +1242,11 @@ nodeunitShim({
           topic,
         }],
       });
-    }, 'Cannot set \'notificationsTopic\' and \'notifications\', \'notificationsTopic\' is deprecated use \'notifications\' instead');
-    test.done();
-  },
+    }).toThrow('Cannot set \'notificationsTopic\' and \'notifications\', \'notificationsTopic\' is deprecated use \'notifications\' instead');
+
+  });
 
-  'notificationTypes default includes all non test NotificationType'(test: Test) {
+  test('notificationTypes default includes all non test NotificationType', () => {
     // GIVEN
     const stack = new cdk.Stack();
     const vpc = mockVpc(stack);
@@ -1265,7 +1265,7 @@ nodeunitShim({
     });
 
     // THEN
-    expect(stack).to(haveResource('AWS::AutoScaling::AutoScalingGroup', {
+    expect(stack).toHaveResource('AWS::AutoScaling::AutoScalingGroup', {
       NotificationConfigurations: [
         {
           TopicARN: { Ref: 'MyTopic86869434' },
@@ -1278,12 +1278,12 @@ nodeunitShim({
         },
       ],
     },
-    ));
+    );
 
-    test.done();
-  },
 
-  'setting notificationTopic configures all non test NotificationType'(test: Test) {
+  });
+
+  test('setting notificationTopic configures all non test NotificationType', () => {
     // GIVEN
     const stack = new cdk.Stack();
     const vpc = mockVpc(stack);
@@ -1298,7 +1298,7 @@ nodeunitShim({
     });
 
     // THEN
-    expect(stack).to(haveResource('AWS::AutoScaling::AutoScalingGroup', {
+    expect(stack).toHaveResource('AWS::AutoScaling::AutoScalingGroup', {
       NotificationConfigurations: [
         {
           TopicARN: { Ref: 'MyTopic86869434' },
@@ -1311,17 +1311,17 @@ nodeunitShim({
         },
       ],
     },
-    ));
+    );
+
+
+  });
 
-    test.done();
-  },
+  test('NotificationTypes.ALL includes all non test NotificationType', () => {
+    expect(Object.values(autoscaling.ScalingEvent).length - 1).toEqual(autoscaling.ScalingEvents.ALL._types.length);
 
-  'NotificationTypes.ALL includes all non test NotificationType'(test: Test) {
-    test.deepEqual(Object.values(autoscaling.ScalingEvent).length - 1, autoscaling.ScalingEvents.ALL._types.length);
-    test.done();
-  },
+  });
 
-  'Can protect new instances from scale-in via constructor property'(test: Test) {
+  test('Can protect new instances from scale-in via constructor property', () => {
     // GIVEN
     const stack = new cdk.Stack();
     const vpc = mockVpc(stack);
@@ -1335,15 +1335,15 @@ nodeunitShim({
     });
 
     // THEN
-    test.strictEqual(asg.areNewInstancesProtectedFromScaleIn(), true);
-    expect(stack).to(haveResourceLike('AWS::AutoScaling::AutoScalingGroup', {
+    expect(asg.areNewInstancesProtectedFromScaleIn()).toEqual(true);
+    expect(stack).toHaveResourceLike('AWS::AutoScaling::AutoScalingGroup', {
       NewInstancesProtectedFromScaleIn: true,
-    }));
+    });
 
-    test.done();
-  },
 
-  'Can protect new instances from scale-in via setter'(test: Test) {
+  });
+
+  test('Can protect new instances from scale-in via setter', () => {
     // GIVEN
     const stack = new cdk.Stack();
     const vpc = mockVpc(stack);
@@ -1357,13 +1357,13 @@ nodeunitShim({
     asg.protectNewInstancesFromScaleIn();
 
     // THEN
-    test.strictEqual(asg.areNewInstancesProtectedFromScaleIn(), true);
-    expect(stack).to(haveResourceLike('AWS::AutoScaling::AutoScalingGroup', {
+    expect(asg.areNewInstancesProtectedFromScaleIn()).toEqual(true);
+    expect(stack).toHaveResourceLike('AWS::AutoScaling::AutoScalingGroup', {
       NewInstancesProtectedFromScaleIn: true,
-    }));
+    });
 
-    test.done();
-  },
+
+  });
 });
 
 function mockVpc(stack: cdk.Stack) {
@@ -1390,9 +1390,9 @@ test('Can set autoScalingGroupName', () => {
   });
 
   // THEN
-  expect(stack).to(haveResourceLike('AWS::AutoScaling::AutoScalingGroup', {
+  expect(stack).toHaveResourceLike('AWS::AutoScaling::AutoScalingGroup', {
     AutoScalingGroupName: 'MyAsg',
-  }));
+  });
 });
 
 test('can use Vpc imported from unparseable list tokens', () => {
@@ -1427,11 +1427,11 @@ test('can use Vpc imported from unparseable list tokens', () => {
   });
 
   // THEN
-  expect(stack).to(haveResourceLike('AWS::AutoScaling::AutoScalingGroup', {
+  expect(stack).toHaveResourceLike('AWS::AutoScaling::AutoScalingGroup', {
     VPCZoneIdentifier: {
       'Fn::Split': [',', { 'Fn::ImportValue': 'myPrivateSubnetIds' }],
     },
-  }));
+  });
 });
 
 function mockSecurityGroup(stack: cdk.Stack) {
diff --git a/packages/@aws-cdk/aws-autoscaling/test/cfn-init.test.ts b/packages/@aws-cdk/aws-autoscaling/test/cfn-init.test.ts
index 58d9bc6ec152c..2fd252e5e459d 100644
--- a/packages/@aws-cdk/aws-autoscaling/test/cfn-init.test.ts
+++ b/packages/@aws-cdk/aws-autoscaling/test/cfn-init.test.ts
@@ -1,3 +1,4 @@
+import '@aws-cdk/assert-internal/jest';
 import { anything, arrayWith, expect, haveResourceLike, ResourcePart } from '@aws-cdk/assert-internal';
 import * as ec2 from '@aws-cdk/aws-ec2';
 import { Duration, Stack } from '@aws-cdk/core';
diff --git a/packages/@aws-cdk/aws-autoscaling/test/lifecyclehooks.test.ts b/packages/@aws-cdk/aws-autoscaling/test/lifecyclehooks.test.ts
index 24bebc1a605d0..7ebf6d18cbe6e 100644
--- a/packages/@aws-cdk/aws-autoscaling/test/lifecyclehooks.test.ts
+++ b/packages/@aws-cdk/aws-autoscaling/test/lifecyclehooks.test.ts
@@ -1,13 +1,13 @@
+import '@aws-cdk/assert-internal/jest';
 import { expect, haveResource, ResourcePart } from '@aws-cdk/assert-internal';
 import * as ec2 from '@aws-cdk/aws-ec2';
 import * as iam from '@aws-cdk/aws-iam';
 import * as cdk from '@aws-cdk/core';
 import * as constructs from 'constructs';
-import { nodeunitShim, Test } from 'nodeunit-shim';
 import * as autoscaling from '../lib';
 
-nodeunitShim({
-  'we can add a lifecycle hook to an ASG'(test: Test) {
+describe('lifecycle hooks', () => {
+  test('we can add a lifecycle hook to an ASG', () => {
     // GIVEN
     const stack = new cdk.Stack();
     const vpc = new ec2.Vpc(stack, 'VPC');
@@ -67,8 +67,8 @@ nodeunitShim({
       },
     }));
 
-    test.done();
-  },
+
+  });
 });
 
 class FakeNotificationTarget implements autoscaling.ILifecycleHookTarget {
diff --git a/packages/@aws-cdk/aws-autoscaling/test/scaling.test.ts b/packages/@aws-cdk/aws-autoscaling/test/scaling.test.ts
index 89b137dd5267f..8216968f406c1 100644
--- a/packages/@aws-cdk/aws-autoscaling/test/scaling.test.ts
+++ b/packages/@aws-cdk/aws-autoscaling/test/scaling.test.ts
@@ -1,19 +1,19 @@
+import '@aws-cdk/assert-internal/jest';
 import { expect, haveResource, haveResourceLike } from '@aws-cdk/assert-internal';
 import * as cloudwatch from '@aws-cdk/aws-cloudwatch';
 import * as ec2 from '@aws-cdk/aws-ec2';
 import * as elbv2 from '@aws-cdk/aws-elasticloadbalancingv2';
 import * as cdk from '@aws-cdk/core';
 import * as constructs from 'constructs';
-import { nodeunitShim, Test } from 'nodeunit-shim';
 import * as autoscaling from '../lib';
 
 // keep this import separate from other imports to reduce chance for merge conflicts with v2-main
 // eslint-disable-next-line no-duplicate-imports, import/order
 import { Construct } from '@aws-cdk/core';
 
-nodeunitShim({
-  'target tracking policies': {
-    'cpu utilization'(test: Test) {
+describe('scaling', () => {
+  describe('target tracking policies', () => {
+    test('cpu utilization', () => {
       // GIVEN
       const stack = new cdk.Stack();
       const fixture = new ASGFixture(stack, 'Fixture');
@@ -32,10 +32,10 @@ nodeunitShim({
         },
       }));
 
-      test.done();
-    },
 
-    'network ingress'(test: Test) {
+    });
+
+    test('network ingress', () => {
       // GIVEN
       const stack = new cdk.Stack();
       const fixture = new ASGFixture(stack, 'Fixture');
@@ -54,10 +54,10 @@ nodeunitShim({
         },
       }));
 
-      test.done();
-    },
 
-    'network egress'(test: Test) {
+    });
+
+    test('network egress', () => {
       // GIVEN
       const stack = new cdk.Stack();
       const fixture = new ASGFixture(stack, 'Fixture');
@@ -76,10 +76,10 @@ nodeunitShim({
         },
       }));
 
-      test.done();
-    },
 
-    'request count per second'(test: Test) {
+    });
+
+    test('request count per second', () => {
       // GIVEN
       const stack = new cdk.Stack();
       const fixture = new ASGFixture(stack, 'Fixture');
@@ -124,10 +124,10 @@ nodeunitShim({
         },
       }));
 
-      test.done();
-    },
 
-    'request count per minute'(test: Test) {
+    });
+
+    test('request count per minute', () => {
       // GIVEN
       const stack = new cdk.Stack();
       const fixture = new ASGFixture(stack, 'Fixture');
@@ -172,10 +172,10 @@ nodeunitShim({
         },
       }));
 
-      test.done();
-    },
 
-    'custom metric'(test: Test) {
+    });
+
+    test('custom metric', () => {
       // GIVEN
       const stack = new cdk.Stack();
       const fixture = new ASGFixture(stack, 'Fixture');
@@ -206,11 +206,11 @@ nodeunitShim({
         },
       }));
 
-      test.done();
-    },
-  },
 
-  'step scaling'(test: Test) {
+    });
+  });
+
+  test('step scaling', () => {
     // GIVEN
     const stack = new cdk.Stack();
     const fixture = new ASGFixture(stack, 'Fixture');
@@ -273,8 +273,8 @@ nodeunitShim({
       AlarmDescription: 'Lower threshold scaling alarm',
     }));
 
-    test.done();
-  },
+
+  });
 });
 
 test('step scaling from percentile metric', () => {
diff --git a/packages/@aws-cdk/aws-autoscaling/test/scheduled-action.test.ts b/packages/@aws-cdk/aws-autoscaling/test/scheduled-action.test.ts
index e5044af33543e..3afbd887b45ae 100644
--- a/packages/@aws-cdk/aws-autoscaling/test/scheduled-action.test.ts
+++ b/packages/@aws-cdk/aws-autoscaling/test/scheduled-action.test.ts
@@ -1,12 +1,12 @@
+import '@aws-cdk/assert-internal/jest';
 import { expect, haveResource, MatchStyle } from '@aws-cdk/assert-internal';
 import * as ec2 from '@aws-cdk/aws-ec2';
 import * as cdk from '@aws-cdk/core';
 import * as constructs from 'constructs';
-import { nodeunitShim, Test } from 'nodeunit-shim';
 import * as autoscaling from '../lib';
 
-nodeunitShim({
-  'can schedule an action'(test: Test) {
+describe('scheduled action', () => {
+  test('can schedule an action', () => {
     // GIVEN
     const stack = new cdk.Stack();
     const asg = makeAutoScalingGroup(stack);
@@ -23,10 +23,10 @@ nodeunitShim({
       MinSize: 10,
     }));
 
-    test.done();
-  },
 
-  'correctly formats date objects'(test: Test) {
+  });
+
+  test('correctly formats date objects', () => {
     // GIVEN
     const stack = new cdk.Stack();
     const asg = makeAutoScalingGroup(stack);
@@ -43,10 +43,10 @@ nodeunitShim({
       StartTime: '2033-09-10T12:00:00Z',
     }));
 
-    test.done();
-  },
 
-  'autoscaling group has recommended updatepolicy for scheduled actions'(test: Test) {
+  });
+
+  test('autoscaling group has recommended updatepolicy for scheduled actions', () => {
     // GIVEN
     const stack = new cdk.Stack();
     const asg = makeAutoScalingGroup(stack);
@@ -104,8 +104,8 @@ nodeunitShim({
       },
     }, MatchStyle.SUPERSET);
 
-    test.done();
-  },
+
+  });
 });
 
 function makeAutoScalingGroup(scope: constructs.Construct) {
diff --git a/packages/@aws-cdk/aws-codepipeline-actions/package.json b/packages/@aws-cdk/aws-codepipeline-actions/package.json
index fafc221e72351..e2409aa86db6a 100644
--- a/packages/@aws-cdk/aws-codepipeline-actions/package.json
+++ b/packages/@aws-cdk/aws-codepipeline-actions/package.json
@@ -75,8 +75,8 @@
     "@types/lodash": "^4.14.171",
     "cdk-build-tools": "0.0.0",
     "cdk-integ-tools": "0.0.0",
+    "jest": "^26.6.3",
     "lodash": "^4.17.21",
-    "nodeunit-shim": "0.0.0",
     "pkglint": "0.0.0",
     "@aws-cdk/assert-internal": "0.0.0"
   },
diff --git a/packages/@aws-cdk/aws-codepipeline-actions/test/bitbucket/bitbucket-source-action.test.ts b/packages/@aws-cdk/aws-codepipeline-actions/test/bitbucket/bitbucket-source-action.test.ts
index 74df86e395548..a4767fa1a61bc 100644
--- a/packages/@aws-cdk/aws-codepipeline-actions/test/bitbucket/bitbucket-source-action.test.ts
+++ b/packages/@aws-cdk/aws-codepipeline-actions/test/bitbucket/bitbucket-source-action.test.ts
@@ -1,22 +1,22 @@
-import { arrayWith, expect, haveResourceLike, objectLike } from '@aws-cdk/assert-internal';
+import '@aws-cdk/assert-internal/jest';
+import { arrayWith, objectLike } from '@aws-cdk/assert-internal';
 import * as codebuild from '@aws-cdk/aws-codebuild';
 import * as codepipeline from '@aws-cdk/aws-codepipeline';
 import { Stack } from '@aws-cdk/core';
-import { nodeunitShim, Test } from 'nodeunit-shim';
 import * as cpactions from '../../lib';
 
 /* eslint-disable quote-props */
 
-nodeunitShim({
-  'BitBucket source Action': {
-    'produces the correct configuration when added to a pipeline'(test: Test) {
+describe('BitBucket source Action', () => {
+  describe('BitBucket source Action', () => {
+    test('produces the correct configuration when added to a pipeline', () => {
       const stack = new Stack();
 
       createBitBucketAndCodeBuildPipeline(stack, {
         codeBuildCloneOutput: false,
       });
 
-      expect(stack).to(haveResourceLike('AWS::CodePipeline::Pipeline', {
+      expect(stack).toHaveResourceLike('AWS::CodePipeline::Pipeline', {
         'Stages': [
           {
             'Name': 'Source',
@@ -44,20 +44,20 @@ nodeunitShim({
             ],
           },
         ],
-      }));
+      });
+
 
-      test.done();
-    },
-  },
+    });
+  });
 
-  'setting codeBuildCloneOutput=true adds permission to use the connection to the following CodeBuild Project'(test: Test) {
+  test('setting codeBuildCloneOutput=true adds permission to use the connection to the following CodeBuild Project', () => {
     const stack = new Stack();
 
     createBitBucketAndCodeBuildPipeline(stack, {
       codeBuildCloneOutput: true,
     });
 
-    expect(stack).to(haveResourceLike('AWS::IAM::Policy', {
+    expect(stack).toHaveResourceLike('AWS::IAM::Policy', {
       'PolicyDocument': {
         'Statement': [
           {
@@ -78,16 +78,16 @@ nodeunitShim({
           },
         ],
       },
-    }));
+    });
+
 
-    test.done();
-  },
-  'grant s3 putObjectACL to the following CodeBuild Project'(test: Test) {
+  });
+  test('grant s3 putObjectACL to the following CodeBuild Project', () => {
     const stack = new Stack();
     createBitBucketAndCodeBuildPipeline(stack, {
       codeBuildCloneOutput: true,
     });
-    expect(stack).to(haveResourceLike('AWS::IAM::Policy', {
+    expect(stack).toHaveResourceLike('AWS::IAM::Policy', {
       'PolicyDocument': {
         'Statement': arrayWith(
           objectLike({
@@ -110,17 +110,17 @@ nodeunitShim({
           }),
         ),
       },
-    }));
-    test.done();
-  },
-  'setting triggerOnPush=false reflects in the configuration'(test: Test) {
+    });
+
+  });
+  test('setting triggerOnPush=false reflects in the configuration', () => {
     const stack = new Stack();
 
     createBitBucketAndCodeBuildPipeline(stack, {
       triggerOnPush: false,
     });
 
-    expect(stack).to(haveResourceLike('AWS::CodePipeline::Pipeline', {
+    expect(stack).toHaveResourceLike('AWS::CodePipeline::Pipeline', {
       'Stages': [
         {
           'Name': 'Source',
@@ -149,10 +149,10 @@ nodeunitShim({
           ],
         },
       ],
-    }));
+    });
+
 
-    test.done();
-  },
+  });
 });
 
 function createBitBucketAndCodeBuildPipeline(stack: Stack, props: Partial<cpactions.BitBucketSourceActionProps>): void {
diff --git a/packages/@aws-cdk/aws-codepipeline-actions/test/cloudformation/cloudformation-pipeline-actions.test.ts b/packages/@aws-cdk/aws-codepipeline-actions/test/cloudformation/cloudformation-pipeline-actions.test.ts
index e478ad7a97d21..955e54107789a 100644
--- a/packages/@aws-cdk/aws-codepipeline-actions/test/cloudformation/cloudformation-pipeline-actions.test.ts
+++ b/packages/@aws-cdk/aws-codepipeline-actions/test/cloudformation/cloudformation-pipeline-actions.test.ts
@@ -1,16 +1,15 @@
-import { expect, haveResourceLike } from '@aws-cdk/assert-internal';
+import '@aws-cdk/assert-internal/jest';
 import * as codebuild from '@aws-cdk/aws-codebuild';
 import * as codecommit from '@aws-cdk/aws-codecommit';
 import * as codepipeline from '@aws-cdk/aws-codepipeline';
 import { PolicyStatement, Role, ServicePrincipal } from '@aws-cdk/aws-iam';
 import * as cdk from '@aws-cdk/core';
-import { nodeunitShim, Test } from 'nodeunit-shim';
 import * as cpactions from '../../lib';
 
 /* eslint-disable quote-props */
 
-nodeunitShim({
-  'CreateChangeSetAction can be used to make a change set from a CodePipeline'(test: Test) {
+describe('CloudFormation Pipeline Actions', () => {
+  test('CreateChangeSetAction can be used to make a change set from a CodePipeline', () => {
     const stack = new cdk.Stack();
 
     const pipeline = new codepipeline.Pipeline(stack, 'MagicPipeline');
@@ -79,7 +78,7 @@ nodeunitShim({
       ],
     });
 
-    expect(stack).to(haveResourceLike('AWS::CodePipeline::Pipeline', {
+    expect(stack).toHaveResourceLike('AWS::CodePipeline::Pipeline', {
       'ArtifactStore': {
         'Location': {
           'Ref': 'MagicPipelineArtifactsBucket212FE7BF',
@@ -193,13 +192,12 @@ nodeunitShim({
         ],
         'Name': 'prod',
       }],
-    }));
+    });
 
-    test.done();
 
-  },
+  });
 
-  'fullPermissions leads to admin role and full IAM capabilities with pipeline bucket+key read permissions'(test: Test) {
+  test('fullPermissions leads to admin role and full IAM capabilities with pipeline bucket+key read permissions', () => {
   // GIVEN
     const stack = new TestFixture();
 
@@ -214,7 +212,7 @@ nodeunitShim({
     const roleId = 'PipelineDeployCreateUpdateRole515CB7D4';
 
     // THEN: Action in Pipeline has named IAM capabilities
-    expect(stack).to(haveResourceLike('AWS::CodePipeline::Pipeline', {
+    expect(stack).toHaveResourceLike('AWS::CodePipeline::Pipeline', {
       'Stages': [
         { 'Name': 'Source' /* don't care about the rest */ },
         {
@@ -234,10 +232,10 @@ nodeunitShim({
           ],
         },
       ],
-    }));
+    });
 
     // THEN: Role is created with full permissions
-    expect(stack).to(haveResourceLike('AWS::IAM::Policy', {
+    expect(stack).toHaveResourceLike('AWS::IAM::Policy', {
       PolicyDocument: {
         Version: '2012-10-17',
         Statement: [
@@ -264,12 +262,12 @@ nodeunitShim({
         ],
       },
       Roles: [{ Ref: roleId }],
-    }));
+    });
+
 
-    test.done();
-  },
+  });
 
-  'outputFileName leads to creation of output artifact'(test: Test) {
+  test('outputFileName leads to creation of output artifact', () => {
   // GIVEN
     const stack = new TestFixture();
 
@@ -283,7 +281,7 @@ nodeunitShim({
     }));
 
     // THEN: Action has output artifacts
-    expect(stack).to(haveResourceLike('AWS::CodePipeline::Pipeline', {
+    expect(stack).toHaveResourceLike('AWS::CodePipeline::Pipeline', {
       'Stages': [
         { 'Name': 'Source' /* don't care about the rest */ },
         {
@@ -296,12 +294,12 @@ nodeunitShim({
           ],
         },
       ],
-    }));
+    });
+
 
-    test.done();
-  },
+  });
 
-  'replaceOnFailure switches action type'(test: Test) {
+  test('replaceOnFailure switches action type', () => {
   // GIVEN
     const stack = new TestFixture();
 
@@ -315,7 +313,7 @@ nodeunitShim({
     }));
 
     // THEN: Action has output artifacts
-    expect(stack).to(haveResourceLike('AWS::CodePipeline::Pipeline', {
+    expect(stack).toHaveResourceLike('AWS::CodePipeline::Pipeline', {
       'Stages': [
         { 'Name': 'Source' /* don't care about the rest */ },
         {
@@ -330,12 +328,12 @@ nodeunitShim({
           ],
         },
       ],
-    }));
+    });
+
 
-    test.done();
-  },
+  });
 
-  'parameterOverrides are serialized as a string'(test: Test) {
+  test('parameterOverrides are serialized as a string', () => {
   // GIVEN
     const stack = new TestFixture();
 
@@ -351,7 +349,7 @@ nodeunitShim({
     }));
 
     // THEN
-    expect(stack).to(haveResourceLike('AWS::CodePipeline::Pipeline', {
+    expect(stack).toHaveResourceLike('AWS::CodePipeline::Pipeline', {
       'Stages': [
         { 'Name': 'Source' /* don't care about the rest */ },
         {
@@ -372,12 +370,12 @@ nodeunitShim({
           ],
         },
       ],
-    }));
+    });
 
-    test.done();
-  },
 
-  'Action service role is passed to template'(test: Test) {
+  });
+
+  test('Action service role is passed to template', () => {
     const stack = new TestFixture();
 
     const importedRole = Role.fromRoleArn(stack, 'ImportedRole', 'arn:aws:iam::000000000000:role/action-role');
@@ -399,7 +397,7 @@ nodeunitShim({
       stackName: 'magicStack',
     }));
 
-    expect(stack).to(haveResourceLike('AWS::CodePipeline::Pipeline', {
+    expect(stack).toHaveResourceLike('AWS::CodePipeline::Pipeline', {
       'Stages': [
         {
           'Name': 'Source', /* don't care about the rest */
@@ -423,12 +421,12 @@ nodeunitShim({
           ],
         },
       ],
-    }));
+    });
+
 
-    test.done();
-  },
+  });
 
-  'Single capability is passed to template'(test: Test) {
+  test('Single capability is passed to template', () => {
   // GIVEN
     const stack = new TestFixture();
 
@@ -446,7 +444,7 @@ nodeunitShim({
     const roleId = 'PipelineDeployCreateUpdateRole515CB7D4';
 
     // THEN: Action in Pipeline has named IAM capabilities
-    expect(stack).to(haveResourceLike('AWS::CodePipeline::Pipeline', {
+    expect(stack).toHaveResourceLike('AWS::CodePipeline::Pipeline', {
       'Stages': [
         { 'Name': 'Source' /* don't care about the rest */ },
         {
@@ -466,12 +464,12 @@ nodeunitShim({
           ],
         },
       ],
-    }));
+    });
+
 
-    test.done();
-  },
+  });
 
-  'Multiple capabilities are passed to template'(test: Test) {
+  test('Multiple capabilities are passed to template', () => {
   // GIVEN
     const stack = new TestFixture();
 
@@ -490,7 +488,7 @@ nodeunitShim({
     const roleId = 'PipelineDeployCreateUpdateRole515CB7D4';
 
     // THEN: Action in Pipeline has named IAM and AUTOEXPAND capabilities
-    expect(stack).to(haveResourceLike('AWS::CodePipeline::Pipeline', {
+    expect(stack).toHaveResourceLike('AWS::CodePipeline::Pipeline', {
       'Stages': [
         { 'Name': 'Source' /* don't care about the rest */ },
         {
@@ -510,12 +508,12 @@ nodeunitShim({
           ],
         },
       ],
-    }));
+    });
 
-    test.done();
-  },
 
-  'Empty capabilities is not passed to template'(test: Test) {
+  });
+
+  test('Empty capabilities is not passed to template', () => {
   // GIVEN
     const stack = new TestFixture();
 
@@ -533,7 +531,7 @@ nodeunitShim({
     const roleId = 'PipelineDeployCreateUpdateRole515CB7D4';
 
     // THEN: Action in Pipeline has no capabilities
-    expect(stack).to(haveResourceLike('AWS::CodePipeline::Pipeline', {
+    expect(stack).toHaveResourceLike('AWS::CodePipeline::Pipeline', {
       'Stages': [
         { 'Name': 'Source' /* don't care about the rest */ },
         {
@@ -552,12 +550,12 @@ nodeunitShim({
           ],
         },
       ],
-    }));
+    });
+
 
-    test.done();
-  },
+  });
 
-  'can use CfnCapabilities from the core module'(test: Test) {
+  test('can use CfnCapabilities from the core module', () => {
     // GIVEN
     const stack = new TestFixture();
 
@@ -574,7 +572,7 @@ nodeunitShim({
     }));
 
     // THEN: Action in Pipeline has named IAM and AUTOEXPAND capabilities
-    expect(stack).to(haveResourceLike('AWS::CodePipeline::Pipeline', {
+    expect(stack).toHaveResourceLike('AWS::CodePipeline::Pipeline', {
       'Stages': [
         { 'Name': 'Source' /* don't care about the rest */ },
         {
@@ -594,13 +592,13 @@ nodeunitShim({
           ],
         },
       ],
-    }));
+    });
+
 
-    test.done();
-  },
+  });
 
-  'cross-account CFN Pipeline': {
-    'correctly creates the deployment Role in the other account'(test: Test) {
+  describe('cross-account CFN Pipeline', () => {
+    test('correctly creates the deployment Role in the other account', () => {
       const app = new cdk.App();
 
       const pipelineStack = new cdk.Stack(app, 'PipelineStack', {
@@ -638,7 +636,7 @@ nodeunitShim({
         ],
       });
 
-      expect(pipelineStack).to(haveResourceLike('AWS::CodePipeline::Pipeline', {
+      expect(pipelineStack).toHaveResourceLike('AWS::CodePipeline::Pipeline', {
         'Stages': [
           {
             'Name': 'Source',
@@ -662,10 +660,10 @@ nodeunitShim({
             ],
           },
         ],
-      }));
+      });
 
       // the pipeline's BucketPolicy should trust both CFN roles
-      expect(pipelineStack).to(haveResourceLike('AWS::S3::BucketPolicy', {
+      expect(pipelineStack).toHaveResourceLike('AWS::S3::BucketPolicy', {
         'PolicyDocument': {
           'Statement': [
             {
@@ -698,19 +696,19 @@ nodeunitShim({
             },
           ],
         },
-      }));
+      });
 
       const otherStack = app.node.findChild('cross-account-support-stack-123456789012') as cdk.Stack;
-      expect(otherStack).to(haveResourceLike('AWS::IAM::Role', {
+      expect(otherStack).toHaveResourceLike('AWS::IAM::Role', {
         'RoleName': 'pipelinestack-support-123loycfnactionrole56af64af3590f311bc50',
-      }));
-      expect(otherStack).to(haveResourceLike('AWS::IAM::Role', {
+      });
+      expect(otherStack).toHaveResourceLike('AWS::IAM::Role', {
         'RoleName': 'pipelinestack-support-123fndeploymentrole4668d9b5a30ce3dc4508',
-      }));
+      });
 
-      test.done();
-    },
-  },
+
+    });
+  });
 });
 
 /**
diff --git a/packages/@aws-cdk/aws-codepipeline-actions/test/cloudformation/pipeline-actions.test.ts b/packages/@aws-cdk/aws-codepipeline-actions/test/cloudformation/pipeline-actions.test.ts
index 2e94273f6924c..3d9594a9ddfbd 100644
--- a/packages/@aws-cdk/aws-codepipeline-actions/test/cloudformation/pipeline-actions.test.ts
+++ b/packages/@aws-cdk/aws-codepipeline-actions/test/cloudformation/pipeline-actions.test.ts
@@ -1,3 +1,4 @@
+import '@aws-cdk/assert-internal/jest';
 import * as codepipeline from '@aws-cdk/aws-codepipeline';
 import * as notifications from '@aws-cdk/aws-codestarnotifications';
 import * as events from '@aws-cdk/aws-events';
@@ -6,12 +7,11 @@ import * as s3 from '@aws-cdk/aws-s3';
 import * as cdk from '@aws-cdk/core';
 import * as constructs from 'constructs';
 import * as _ from 'lodash';
-import { nodeunitShim, Test } from 'nodeunit-shim';
 import * as cpactions from '../../lib';
 
-nodeunitShim({
-  CreateReplaceChangeSet: {
-    'works'(test: Test) {
+describe('Pipeline Actions', () => {
+  describe('CreateReplaceChangeSet', () => {
+    test('works', (done) => {
       const app = new cdk.App();
       const stack = new cdk.Stack(app, 'Stack');
       const pipelineRole = new RoleDouble(stack, 'PipelineRole');
@@ -30,29 +30,29 @@ nodeunitShim({
 
       app.synth();
 
-      _assertPermissionGranted(test, stack, pipelineRole.statements, 'iam:PassRole', action.deploymentRole.roleArn);
+      _assertPermissionGranted(done, stack, pipelineRole.statements, 'iam:PassRole', action.deploymentRole.roleArn);
 
       const stackArn = _stackArn('MyStack', stack);
       const changeSetCondition = { StringEqualsIfExists: { 'cloudformation:ChangeSetName': 'MyChangeSet' } };
-      _assertPermissionGranted(test, stack, pipelineRole.statements, 'cloudformation:DescribeStacks', stackArn, changeSetCondition);
-      _assertPermissionGranted(test, stack, pipelineRole.statements, 'cloudformation:DescribeChangeSet', stackArn, changeSetCondition);
-      _assertPermissionGranted(test, stack, pipelineRole.statements, 'cloudformation:CreateChangeSet', stackArn, changeSetCondition);
-      _assertPermissionGranted(test, stack, pipelineRole.statements, 'cloudformation:DeleteChangeSet', stackArn, changeSetCondition);
+      _assertPermissionGranted(done, stack, pipelineRole.statements, 'cloudformation:DescribeStacks', stackArn, changeSetCondition);
+      _assertPermissionGranted(done, stack, pipelineRole.statements, 'cloudformation:DescribeChangeSet', stackArn, changeSetCondition);
+      _assertPermissionGranted(done, stack, pipelineRole.statements, 'cloudformation:CreateChangeSet', stackArn, changeSetCondition);
+      _assertPermissionGranted(done, stack, pipelineRole.statements, 'cloudformation:DeleteChangeSet', stackArn, changeSetCondition);
 
       // TODO: revert "as any" once we move all actions into a single package.
-      test.deepEqual(stage.fullActions[0].actionProperties.inputs, [artifact],
-        'The input was correctly registered');
+      expect(stage.fullActions[0].actionProperties.inputs).toEqual([artifact]);
 
-      _assertActionMatches(test, stack, stage.fullActions, 'CloudFormation', 'Deploy', {
+      _assertActionMatches(done, stack, stage.fullActions, 'CloudFormation', 'Deploy', {
         ActionMode: 'CHANGE_SET_CREATE_REPLACE',
         StackName: 'MyStack',
         ChangeSetName: 'MyChangeSet',
       });
 
-      test.done();
-    },
+      done();
 
-    'uses a single permission statement if the same ChangeSet name is used'(test: Test) {
+    });
+
+    test('uses a single permission statement if the same ChangeSet name is used', () => {
       const stack = new cdk.Stack();
       const pipelineRole = new RoleDouble(stack, 'PipelineRole');
       const artifact = new codepipeline.Artifact('TestArtifact');
@@ -76,8 +76,9 @@ nodeunitShim({
         ],
       });
 
-      test.deepEqual(
+      expect(
         stack.resolve(pipelineRole.statements.map(s => s.toStatementJson())),
+      ).toEqual(
         [
           {
             Action: 'iam:PassRole',
@@ -106,12 +107,12 @@ nodeunitShim({
         ],
       );
 
-      test.done();
-    },
-  },
 
-  ExecuteChangeSet: {
-    'works'(test: Test) {
+    });
+  });
+
+  describe('ExecuteChangeSet', () => {
+    test('works', (done) => {
       const stack = new cdk.Stack();
       const pipelineRole = new RoleDouble(stack, 'PipelineRole');
       const stage = new StageDouble({
@@ -126,19 +127,19 @@ nodeunitShim({
       });
 
       const stackArn = _stackArn('MyStack', stack);
-      _assertPermissionGranted(test, stack, pipelineRole.statements, 'cloudformation:ExecuteChangeSet', stackArn,
+      _assertPermissionGranted(done, stack, pipelineRole.statements, 'cloudformation:ExecuteChangeSet', stackArn,
         { StringEqualsIfExists: { 'cloudformation:ChangeSetName': 'MyChangeSet' } });
 
-      _assertActionMatches(test, stack, stage.fullActions, 'CloudFormation', 'Deploy', {
+      _assertActionMatches(done, stack, stage.fullActions, 'CloudFormation', 'Deploy', {
         ActionMode: 'CHANGE_SET_EXECUTE',
         StackName: 'MyStack',
         ChangeSetName: 'MyChangeSet',
       });
 
-      test.done();
-    },
+      done();
+    });
 
-    'uses a single permission statement if the same ChangeSet name is used'(test: Test) {
+    test('uses a single permission statement if the same ChangeSet name is used', () => {
       const stack = new cdk.Stack();
       const pipelineRole = new RoleDouble(stack, 'PipelineRole');
       new StageDouble({
@@ -157,8 +158,9 @@ nodeunitShim({
         ],
       });
 
-      test.deepEqual(
+      expect(
         stack.resolve(pipelineRole.statements.map(s => s.toStatementJson())),
+      ).toEqual(
         [
           {
             Action: [
@@ -178,11 +180,11 @@ nodeunitShim({
         ],
       );
 
-      test.done();
-    },
-  },
 
-  'the CreateUpdateStack Action sets the DescribeStack*, Create/Update/DeleteStack & PassRole permissions'(test: Test) {
+    });
+  });
+
+  test('the CreateUpdateStack Action sets the DescribeStack*, Create/Update/DeleteStack & PassRole permissions', (done) => {
     const stack = new cdk.Stack();
     const pipelineRole = new RoleDouble(stack, 'PipelineRole');
     const action = new cpactions.CloudFormationCreateUpdateStackAction({
@@ -198,17 +200,17 @@ nodeunitShim({
     });
     const stackArn = _stackArn('MyStack', stack);
 
-    _assertPermissionGranted(test, stack, pipelineRole.statements, 'cloudformation:DescribeStack*', stackArn);
-    _assertPermissionGranted(test, stack, pipelineRole.statements, 'cloudformation:CreateStack', stackArn);
-    _assertPermissionGranted(test, stack, pipelineRole.statements, 'cloudformation:UpdateStack', stackArn);
-    _assertPermissionGranted(test, stack, pipelineRole.statements, 'cloudformation:DeleteStack', stackArn);
+    _assertPermissionGranted(done, stack, pipelineRole.statements, 'cloudformation:DescribeStack*', stackArn);
+    _assertPermissionGranted(done, stack, pipelineRole.statements, 'cloudformation:CreateStack', stackArn);
+    _assertPermissionGranted(done, stack, pipelineRole.statements, 'cloudformation:UpdateStack', stackArn);
+    _assertPermissionGranted(done, stack, pipelineRole.statements, 'cloudformation:DeleteStack', stackArn);
 
-    _assertPermissionGranted(test, stack, pipelineRole.statements, 'iam:PassRole', action.deploymentRole.roleArn);
+    _assertPermissionGranted(done, stack, pipelineRole.statements, 'iam:PassRole', action.deploymentRole.roleArn);
 
-    test.done();
-  },
+    done();
+  });
 
-  'the DeleteStack Action sets the DescribeStack*, DeleteStack & PassRole permissions'(test: Test) {
+  test('the DeleteStack Action sets the DescribeStack*, DeleteStack & PassRole permissions', (done) => {
     const stack = new cdk.Stack();
     const pipelineRole = new RoleDouble(stack, 'PipelineRole');
     const action = new cpactions.CloudFormationDeleteStackAction({
@@ -222,13 +224,13 @@ nodeunitShim({
     });
     const stackArn = _stackArn('MyStack', stack);
 
-    _assertPermissionGranted(test, stack, pipelineRole.statements, 'cloudformation:DescribeStack*', stackArn);
-    _assertPermissionGranted(test, stack, pipelineRole.statements, 'cloudformation:DeleteStack', stackArn);
+    _assertPermissionGranted(done, stack, pipelineRole.statements, 'cloudformation:DescribeStack*', stackArn);
+    _assertPermissionGranted(done, stack, pipelineRole.statements, 'cloudformation:DeleteStack', stackArn);
 
-    _assertPermissionGranted(test, stack, pipelineRole.statements, 'iam:PassRole', action.deploymentRole.roleArn);
+    _assertPermissionGranted(done, stack, pipelineRole.statements, 'iam:PassRole', action.deploymentRole.roleArn);
 
-    test.done();
-  },
+    done();
+  });
 });
 
 interface PolicyStatementJson {
@@ -239,7 +241,7 @@ interface PolicyStatementJson {
 }
 
 function _assertActionMatches(
-  test: Test,
+  done: jest.DoneCallback,
   stack: cdk.Stack,
   actions: FullAction[],
   provider: string,
@@ -256,8 +258,9 @@ function _assertActionMatches(
       configuration: stack.resolve(a.actionConfig.configuration),
     }),
   ), null, 2);
-  test.ok(_hasAction(stack, actions, provider, category, configuration),
-    `Expected to find an action with provider ${provider}, category ${category}${configurationStr}, but found ${actionsStr}`);
+  if (!_hasAction(stack, actions, provider, category, configuration)) {
+    done.fail(`Expected to find an action with provider ${provider}, category ${category}${configurationStr}, but found ${actionsStr}`);
+  }
 }
 
 function _hasAction(
@@ -280,7 +283,7 @@ function _hasAction(
 }
 
 function _assertPermissionGranted(
-  test: Test,
+  done: jest.DoneCallback,
   stack: cdk.Stack,
   statements: iam.PolicyStatement[],
   action: string,
@@ -291,8 +294,9 @@ function _assertPermissionGranted(
     : '';
   const resolvedStatements = stack.resolve(statements.map(s => s.toStatementJson()));
   const statementsStr = JSON.stringify(resolvedStatements, null, 2);
-  test.ok(_grantsPermission(stack, resolvedStatements, action, resource, conditions),
-    `Expected to find a statement granting ${action} on ${JSON.stringify(stack.resolve(resource))}${conditionStr}, found:\n${statementsStr}`);
+  if (!_grantsPermission(stack, resolvedStatements, action, resource, conditions)) {
+    done.fail(`Expected to find a statement granting ${action} on ${JSON.stringify(stack.resolve(resource))}${conditionStr}, found:\n${statementsStr}`);
+  }
 }
 
 function _grantsPermission(stack: cdk.Stack, statements: PolicyStatementJson[], action: string, resource: string, conditions?: any) {
diff --git a/packages/@aws-cdk/aws-codepipeline-actions/test/codebuild/codebuild-action.test.ts b/packages/@aws-cdk/aws-codepipeline-actions/test/codebuild/codebuild-action.test.ts
index 09b583c011513..c8ddc211a813d 100644
--- a/packages/@aws-cdk/aws-codepipeline-actions/test/codebuild/codebuild-action.test.ts
+++ b/packages/@aws-cdk/aws-codepipeline-actions/test/codebuild/codebuild-action.test.ts
@@ -1,19 +1,18 @@
-import { expect, haveResourceLike } from '@aws-cdk/assert-internal';
+import '@aws-cdk/assert-internal/jest';
 import * as codebuild from '@aws-cdk/aws-codebuild';
 import * as codecommit from '@aws-cdk/aws-codecommit';
 import * as codepipeline from '@aws-cdk/aws-codepipeline';
 import * as s3 from '@aws-cdk/aws-s3';
 import * as sns from '@aws-cdk/aws-sns';
 import { App, SecretValue, Stack } from '@aws-cdk/core';
-import { nodeunitShim, Test } from 'nodeunit-shim';
 import * as cpactions from '../../lib';
 
 /* eslint-disable quote-props */
 
-nodeunitShim({
-  'CodeBuild action': {
-    'that is cross-account and has outputs': {
-      'causes an error'(test: Test) {
+describe('CodeBuild Action', () => {
+  describe('CodeBuild action', () => {
+    describe('that is cross-account and has outputs', () => {
+      test('causes an error', () => {
         const app = new App();
 
         const projectStack = new Stack(app, 'ProjectStack', {
@@ -61,15 +60,15 @@ nodeunitShim({
           outputs: [new codepipeline.Artifact()],
         });
 
-        test.throws(() => {
+        expect(() => {
           buildStage.addAction(buildAction2);
-        }, /https:\/\/github\.com\/aws\/aws-cdk\/issues\/4169/);
+        }).toThrow(/https:\/\/github\.com\/aws\/aws-cdk\/issues\/4169/);
 
-        test.done();
-      },
-    },
 
-    'can be backed by an imported project'(test: Test) {
+      });
+    });
+
+    test('can be backed by an imported project', () => {
       const stack = new Stack();
 
       const codeBuildProject = codebuild.PipelineProject.fromProjectName(stack, 'CodeBuild',
@@ -102,7 +101,7 @@ nodeunitShim({
         ],
       });
 
-      expect(stack).to(haveResourceLike('AWS::CodePipeline::Pipeline', {
+      expect(stack).toHaveResourceLike('AWS::CodePipeline::Pipeline', {
         'Stages': [
           {
             'Name': 'Source',
@@ -119,12 +118,12 @@ nodeunitShim({
             ],
           },
         ],
-      }));
+      });
+
 
-      test.done();
-    },
+    });
 
-    'exposes variables for other actions to consume'(test: Test) {
+    test('exposes variables for other actions to consume', () => {
       const stack = new Stack();
 
       const sourceOutput = new codepipeline.Artifact();
@@ -177,7 +176,7 @@ nodeunitShim({
         ],
       });
 
-      expect(stack).to(haveResourceLike('AWS::CodePipeline::Pipeline', {
+      expect(stack).toHaveResourceLike('AWS::CodePipeline::Pipeline', {
         'Stages': [
           {
             'Name': 'Source',
@@ -198,12 +197,12 @@ nodeunitShim({
             ],
           },
         ],
-      }));
+      });
+
 
-      test.done();
-    },
+    });
 
-    'sets the BatchEnabled configuration'(test: Test) {
+    test('sets the BatchEnabled configuration', () => {
       const stack = new Stack();
 
       const codeBuildProject = new codebuild.PipelineProject(stack, 'CodeBuild');
@@ -236,7 +235,7 @@ nodeunitShim({
         ],
       });
 
-      expect(stack).to(haveResourceLike('AWS::CodePipeline::Pipeline', {
+      expect(stack).toHaveResourceLike('AWS::CodePipeline::Pipeline', {
         'Stages': [
           {
             'Name': 'Source',
@@ -253,12 +252,12 @@ nodeunitShim({
             ],
           },
         ],
-      }));
+      });
 
-      test.done();
-    },
 
-    'sets the CombineArtifacts configuration'(test: Test) {
+    });
+
+    test('sets the CombineArtifacts configuration', () => {
       const stack = new Stack();
 
       const codeBuildProject = new codebuild.PipelineProject(stack, 'CodeBuild');
@@ -292,7 +291,7 @@ nodeunitShim({
         ],
       });
 
-      expect(stack).to(haveResourceLike('AWS::CodePipeline::Pipeline', {
+      expect(stack).toHaveResourceLike('AWS::CodePipeline::Pipeline', {
         'Stages': [
           {
             'Name': 'Source',
@@ -310,13 +309,13 @@ nodeunitShim({
             ],
           },
         ],
-      }));
+      });
 
-      test.done();
-    },
 
-    'environment variables': {
-      'should fail by default when added to a Pipeline while using a secret value in a plaintext variable'(test: Test) {
+    });
+
+    describe('environment variables', () => {
+      test('should fail by default when added to a Pipeline while using a secret value in a plaintext variable', () => {
         const stack = new Stack();
 
         const sourceOutput = new codepipeline.Artifact();
@@ -350,14 +349,14 @@ nodeunitShim({
           },
         });
 
-        test.throws(() => {
+        expect(() => {
           buildStage.addAction(buildAction);
-        }, /Plaintext environment variable 'X' contains a secret value!/);
+        }).toThrow(/Plaintext environment variable 'X' contains a secret value!/);
 
-        test.done();
-      },
 
-      "should allow opting out of the 'secret value in a plaintext variable' validation"(test: Test) {
+      });
+
+      test("should allow opting out of the 'secret value in a plaintext variable' validation", () => {
         const stack = new Stack();
 
         const sourceOutput = new codepipeline.Artifact();
@@ -390,8 +389,8 @@ nodeunitShim({
           ],
         });
 
-        test.done();
-      },
-    },
-  },
+
+      });
+    });
+  });
 });
diff --git a/packages/@aws-cdk/aws-codepipeline-actions/test/codecommit/codecommit-source-action.test.ts b/packages/@aws-cdk/aws-codepipeline-actions/test/codecommit/codecommit-source-action.test.ts
index da226dd37a74d..648c113ce2155 100644
--- a/packages/@aws-cdk/aws-codepipeline-actions/test/codecommit/codecommit-source-action.test.ts
+++ b/packages/@aws-cdk/aws-codepipeline-actions/test/codecommit/codecommit-source-action.test.ts
@@ -1,4 +1,5 @@
-import { ABSENT, arrayWith, countResources, expect, haveResourceLike, not, objectLike } from '@aws-cdk/assert-internal';
+import '@aws-cdk/assert-internal/jest';
+import { ABSENT, arrayWith, objectLike } from '@aws-cdk/assert-internal';
 import * as codebuild from '@aws-cdk/aws-codebuild';
 import * as codecommit from '@aws-cdk/aws-codecommit';
 import * as codepipeline from '@aws-cdk/aws-codepipeline';
@@ -6,19 +7,18 @@ import * as iam from '@aws-cdk/aws-iam';
 import * as kms from '@aws-cdk/aws-kms';
 import * as s3 from '@aws-cdk/aws-s3';
 import { Stack, Lazy, App } from '@aws-cdk/core';
-import { nodeunitShim, Test } from 'nodeunit-shim';
 import * as cpactions from '../../lib';
 
 /* eslint-disable quote-props */
 
-nodeunitShim({
-  'CodeCommit Source Action': {
-    'by default does not poll for source changes and uses Events'(test: Test) {
+describe('CodeCommit Source Action', () => {
+  describe('CodeCommit Source Action', () => {
+    test('by default does not poll for source changes and uses Events', () => {
       const stack = new Stack();
 
       minimalPipeline(stack, undefined);
 
-      expect(stack).to(haveResourceLike('AWS::CodePipeline::Pipeline', {
+      expect(stack).toHaveResourceLike('AWS::CodePipeline::Pipeline', {
         'Stages': [
           {
             'Actions': [
@@ -31,14 +31,14 @@ nodeunitShim({
           },
           {},
         ],
-      }));
+      });
+
+      expect(stack).toCountResources('AWS::Events::Rule', 1);
 
-      expect(stack).to(countResources('AWS::Events::Rule', 1));
 
-      test.done();
-    },
+    });
 
-    'cross-account CodeCommit Repository Source does not use target role in source stack'(test: Test) {
+    test('cross-account CodeCommit Repository Source does not use target role in source stack', () => {
       // Test for https://github.com/aws/aws-cdk/issues/15639
       const app = new App();
       const sourceStack = new Stack(app, 'SourceStack', { env: { account: '1234', region: 'north-pole' } });
@@ -67,7 +67,7 @@ nodeunitShim({
       });
 
       // THEN - creates a Rule in the source stack targeting the pipeline stack's event bus using a generated role
-      expect(sourceStack).to(haveResourceLike('AWS::Events::Rule', {
+      expect(sourceStack).toHaveResourceLike('AWS::Events::Rule', {
         EventPattern: {
           source: ['aws.codecommit'],
           resources: [
@@ -84,10 +84,10 @@ nodeunitShim({
             ]],
           },
         }],
-      }));
+      });
 
       // THEN - creates a Rule in the pipeline stack using the role to start the pipeline
-      expect(targetStack).to(haveResourceLike('AWS::Events::Rule', {
+      expect(targetStack).toHaveResourceLike('AWS::Events::Rule', {
         'EventPattern': {
           'source': [
             'aws.codecommit',
@@ -118,17 +118,17 @@ nodeunitShim({
             'RoleArn': { 'Fn::GetAtt': ['MyPipelineEventsRoleFAB99F32', 'Arn'] },
           },
         ],
-      }));
+      });
+
 
-      test.done();
-    },
+    });
 
-    'does not poll for source changes and uses Events for CodeCommitTrigger.EVENTS'(test: Test) {
+    test('does not poll for source changes and uses Events for CodeCommitTrigger.EVENTS', () => {
       const stack = new Stack();
 
       minimalPipeline(stack, cpactions.CodeCommitTrigger.EVENTS);
 
-      expect(stack).to(haveResourceLike('AWS::CodePipeline::Pipeline', {
+      expect(stack).toHaveResourceLike('AWS::CodePipeline::Pipeline', {
         'Stages': [
           {
             'Actions': [
@@ -141,19 +141,19 @@ nodeunitShim({
           },
           {},
         ],
-      }));
+      });
 
-      expect(stack).to(countResources('AWS::Events::Rule', 1));
+      expect(stack).toCountResources('AWS::Events::Rule', 1);
 
-      test.done();
-    },
 
-    'polls for source changes and does not use Events for CodeCommitTrigger.POLL'(test: Test) {
+    });
+
+    test('polls for source changes and does not use Events for CodeCommitTrigger.POLL', () => {
       const stack = new Stack();
 
       minimalPipeline(stack, cpactions.CodeCommitTrigger.POLL);
 
-      expect(stack).to(haveResourceLike('AWS::CodePipeline::Pipeline', {
+      expect(stack).toHaveResourceLike('AWS::CodePipeline::Pipeline', {
         'Stages': [
           {
             'Actions': [
@@ -166,19 +166,19 @@ nodeunitShim({
           },
           {},
         ],
-      }));
+      });
 
-      expect(stack).to(not(haveResourceLike('AWS::Events::Rule')));
+      expect(stack).not.toHaveResourceLike('AWS::Events::Rule');
 
-      test.done();
-    },
 
-    'does not poll for source changes and does not use Events for CodeCommitTrigger.NONE'(test: Test) {
+    });
+
+    test('does not poll for source changes and does not use Events for CodeCommitTrigger.NONE', () => {
       const stack = new Stack();
 
       minimalPipeline(stack, cpactions.CodeCommitTrigger.NONE);
 
-      expect(stack).to(haveResourceLike('AWS::CodePipeline::Pipeline', {
+      expect(stack).toHaveResourceLike('AWS::CodePipeline::Pipeline', {
         'Stages': [
           {
             'Actions': [
@@ -191,32 +191,32 @@ nodeunitShim({
           },
           {},
         ],
-      }));
+      });
+
+      expect(stack).not.toHaveResourceLike('AWS::Events::Rule');
 
-      expect(stack).to(not(haveResourceLike('AWS::Events::Rule')));
 
-      test.done();
-    },
+    });
 
-    'cannot be created with an empty branch'(test: Test) {
+    test('cannot be created with an empty branch', () => {
       const stack = new Stack();
       const repo = new codecommit.Repository(stack, 'MyRepo', {
         repositoryName: 'my-repo',
       });
 
-      test.throws(() => {
+      expect(() => {
         new cpactions.CodeCommitSourceAction({
           actionName: 'Source2',
           repository: repo,
           output: new codepipeline.Artifact(),
           branch: '',
         });
-      }, /'branch' parameter cannot be an empty string/);
+      }).toThrow(/'branch' parameter cannot be an empty string/);
+
 
-      test.done();
-    },
+    });
 
-    'allows using the same repository multiple times with different branches when trigger=EVENTS'(test: Test) {
+    test('allows using the same repository multiple times with different branches when trigger=EVENTS', () => {
       const stack = new Stack();
 
       const repo = new codecommit.Repository(stack, 'MyRepo', {
@@ -255,10 +255,10 @@ nodeunitShim({
         ],
       });
 
-      test.done();
-    },
 
-    'exposes variables for other actions to consume'(test: Test) {
+    });
+
+    test('exposes variables for other actions to consume', () => {
       const stack = new Stack();
 
       const sourceOutput = new codepipeline.Artifact();
@@ -291,7 +291,7 @@ nodeunitShim({
         ],
       });
 
-      expect(stack).to(haveResourceLike('AWS::CodePipeline::Pipeline', {
+      expect(stack).toHaveResourceLike('AWS::CodePipeline::Pipeline', {
         'Stages': [
           {
             'Name': 'Source',
@@ -308,12 +308,12 @@ nodeunitShim({
             ],
           },
         ],
-      }));
+      });
+
 
-      test.done();
-    },
+    });
 
-    'allows using a Token for the branch name'(test: Test) {
+    test('allows using a Token for the branch name', () => {
       const stack = new Stack();
 
       const sourceOutput = new codepipeline.Artifact();
@@ -345,18 +345,18 @@ nodeunitShim({
         ],
       });
 
-      expect(stack).to(haveResourceLike('AWS::Events::Rule', {
+      expect(stack).toHaveResourceLike('AWS::Events::Rule', {
         EventPattern: {
           detail: {
             referenceName: ['my-branch'],
           },
         },
-      }));
+      });
+
 
-      test.done();
-    },
+    });
 
-    'allows to enable full clone'(test: Test) {
+    test('allows to enable full clone', () => {
       const stack = new Stack();
 
       const sourceOutput = new codepipeline.Artifact();
@@ -389,7 +389,7 @@ nodeunitShim({
         ],
       });
 
-      expect(stack).to(haveResourceLike('AWS::CodePipeline::Pipeline', {
+      expect(stack).toHaveResourceLike('AWS::CodePipeline::Pipeline', {
         'Stages': [
           {
             'Name': 'Source',
@@ -408,9 +408,9 @@ nodeunitShim({
             ],
           },
         ],
-      }));
+      });
 
-      expect(stack).to(haveResourceLike('AWS::IAM::Policy', {
+      expect(stack).toHaveResourceLike('AWS::IAM::Policy', {
         'PolicyDocument': {
           'Statement': arrayWith(
             objectLike({
@@ -432,9 +432,9 @@ nodeunitShim({
             }),
           ),
         },
-      }));
+      });
 
-      expect(stack).to(haveResourceLike('AWS::IAM::Policy', {
+      expect(stack).toHaveResourceLike('AWS::IAM::Policy', {
         'PolicyDocument': {
           'Statement': arrayWith(
             objectLike({
@@ -456,12 +456,12 @@ nodeunitShim({
             }),
           ),
         },
-      }));
+      });
+
 
-      test.done();
-    },
+    });
 
-    'uses the role when passed'(test: Test) {
+    test('uses the role when passed', () => {
       const stack = new Stack();
 
       const pipeline = new codepipeline.Pipeline(stack, 'P', {
@@ -504,7 +504,7 @@ nodeunitShim({
         actions: [buildAction],
       });
 
-      expect(stack).to(haveResourceLike('AWS::Events::Rule', {
+      expect(stack).toHaveResourceLike('AWS::Events::Rule', {
         Targets: [
           {
             Arn: stack.resolve(pipeline.pipelineArn),
@@ -512,12 +512,12 @@ nodeunitShim({
             RoleArn: stack.resolve(triggerEventTestRole.roleArn),
           },
         ],
-      }));
+      });
+
 
-      test.done();
-    },
+    });
 
-    'grants explicit s3:PutObjectAcl permissions when the Actions is cross-account'(test: Test) {
+    test('grants explicit s3:PutObjectAcl permissions when the Actions is cross-account', () => {
       const app = new App();
 
       const repoStack = new Stack(app, 'RepoStack', {
@@ -552,7 +552,7 @@ nodeunitShim({
         ],
       });
 
-      expect(repoStack).to(haveResourceLike('AWS::IAM::Policy', {
+      expect(repoStack).toHaveResourceLike('AWS::IAM::Policy', {
         PolicyDocument: {
           Statement: arrayWith({
             'Action': 's3:PutObjectAcl',
@@ -566,11 +566,11 @@ nodeunitShim({
             },
           }),
         },
-      }));
+      });
 
-      test.done();
-    },
-  },
+
+    });
+  });
 });
 
 function minimalPipeline(stack: Stack, trigger: cpactions.CodeCommitTrigger | undefined): codepipeline.Pipeline {
diff --git a/packages/@aws-cdk/aws-codepipeline-actions/test/codedeploy/ecs-deploy-action.test.ts b/packages/@aws-cdk/aws-codepipeline-actions/test/codedeploy/ecs-deploy-action.test.ts
index 30a1d4827b091..18a0c714f4d5b 100644
--- a/packages/@aws-cdk/aws-codepipeline-actions/test/codedeploy/ecs-deploy-action.test.ts
+++ b/packages/@aws-cdk/aws-codepipeline-actions/test/codedeploy/ecs-deploy-action.test.ts
@@ -1,13 +1,12 @@
-import { expect, haveResourceLike } from '@aws-cdk/assert-internal';
+import '@aws-cdk/assert-internal/jest';
 import * as codedeploy from '@aws-cdk/aws-codedeploy';
 import * as codepipeline from '@aws-cdk/aws-codepipeline';
 import * as cdk from '@aws-cdk/core';
-import { nodeunitShim, Test } from 'nodeunit-shim';
 import * as cpactions from '../../lib';
 
-nodeunitShim({
-  'CodeDeploy ECS Deploy Action': {
-    'throws an exception if more than 4 container image inputs are provided'(test: Test) {
+describe('CodeDeploy ECS Deploy Action', () => {
+  describe('CodeDeploy ECS Deploy Action', () => {
+    test('throws an exception if more than 4 container image inputs are provided', () => {
       const stack = new cdk.Stack();
       const deploymentGroup = addEcsDeploymentGroup(stack);
       const artifact = new codepipeline.Artifact('Artifact');
@@ -19,7 +18,7 @@ nodeunitShim({
         });
       }
 
-      test.throws(() => {
+      expect(() => {
         new cpactions.CodeDeployEcsDeployAction({
           actionName: 'DeployToECS',
           deploymentGroup,
@@ -27,18 +26,18 @@ nodeunitShim({
           appSpecTemplateInput: artifact,
           containerImageInputs,
         });
-      }, /Action cannot have more than 4 container image inputs, got: 5/);
+      }).toThrow(/Action cannot have more than 4 container image inputs, got: 5/);
 
-      test.done();
-    },
 
-    'throws an exception if both appspec artifact input and file are specified'(test: Test) {
+    });
+
+    test('throws an exception if both appspec artifact input and file are specified', () => {
       const stack = new cdk.Stack();
       const deploymentGroup = addEcsDeploymentGroup(stack);
       const artifact = new codepipeline.Artifact('Artifact');
       const artifactPath = new codepipeline.ArtifactPath(artifact, 'hello');
 
-      test.throws(() => {
+      expect(() => {
         new cpactions.CodeDeployEcsDeployAction({
           actionName: 'DeployToECS',
           deploymentGroup,
@@ -46,34 +45,34 @@ nodeunitShim({
           appSpecTemplateInput: artifact,
           appSpecTemplateFile: artifactPath,
         });
-      }, /Exactly one of 'appSpecTemplateInput' or 'appSpecTemplateFile' can be provided in the ECS CodeDeploy Action/);
+      }).toThrow(/Exactly one of 'appSpecTemplateInput' or 'appSpecTemplateFile' can be provided in the ECS CodeDeploy Action/);
 
-      test.done();
-    },
 
-    'throws an exception if neither appspec artifact input nor file are specified'(test: Test) {
+    });
+
+    test('throws an exception if neither appspec artifact input nor file are specified', () => {
       const stack = new cdk.Stack();
       const deploymentGroup = addEcsDeploymentGroup(stack);
       const artifact = new codepipeline.Artifact('Artifact');
 
-      test.throws(() => {
+      expect(() => {
         new cpactions.CodeDeployEcsDeployAction({
           actionName: 'DeployToECS',
           deploymentGroup,
           taskDefinitionTemplateInput: artifact,
         });
-      }, /Specifying one of 'appSpecTemplateInput' or 'appSpecTemplateFile' is required for the ECS CodeDeploy Action/);
+      }).toThrow(/Specifying one of 'appSpecTemplateInput' or 'appSpecTemplateFile' is required for the ECS CodeDeploy Action/);
 
-      test.done();
-    },
 
-    'throws an exception if both task definition artifact input and file are specified'(test: Test) {
+    });
+
+    test('throws an exception if both task definition artifact input and file are specified', () => {
       const stack = new cdk.Stack();
       const deploymentGroup = addEcsDeploymentGroup(stack);
       const artifact = new codepipeline.Artifact('Artifact');
       const artifactPath = new codepipeline.ArtifactPath(artifact, 'hello');
 
-      test.throws(() => {
+      expect(() => {
         new cpactions.CodeDeployEcsDeployAction({
           actionName: 'DeployToECS',
           deploymentGroup,
@@ -81,28 +80,28 @@ nodeunitShim({
           taskDefinitionTemplateFile: artifactPath,
           appSpecTemplateInput: artifact,
         });
-      }, /Exactly one of 'taskDefinitionTemplateInput' or 'taskDefinitionTemplateFile' can be provided in the ECS CodeDeploy Action/);
+      }).toThrow(/Exactly one of 'taskDefinitionTemplateInput' or 'taskDefinitionTemplateFile' can be provided in the ECS CodeDeploy Action/);
+
 
-      test.done();
-    },
+    });
 
-    'throws an exception if neither task definition artifact input nor file are specified'(test: Test) {
+    test('throws an exception if neither task definition artifact input nor file are specified', () => {
       const stack = new cdk.Stack();
       const deploymentGroup = addEcsDeploymentGroup(stack);
       const artifact = new codepipeline.Artifact('Artifact');
 
-      test.throws(() => {
+      expect(() => {
         new cpactions.CodeDeployEcsDeployAction({
           actionName: 'DeployToECS',
           deploymentGroup,
           appSpecTemplateInput: artifact,
         });
-      }, /Specifying one of 'taskDefinitionTemplateInput' or 'taskDefinitionTemplateFile' is required for the ECS CodeDeploy Action/);
+      }).toThrow(/Specifying one of 'taskDefinitionTemplateInput' or 'taskDefinitionTemplateFile' is required for the ECS CodeDeploy Action/);
 
-      test.done();
-    },
 
-    'defaults task definition and appspec template paths'(test: Test) {
+    });
+
+    test('defaults task definition and appspec template paths', () => {
       const stack = new cdk.Stack();
       const deploymentGroup = addEcsDeploymentGroup(stack);
       addCodeDeployECSCodePipeline(stack, {
@@ -112,7 +111,7 @@ nodeunitShim({
         appSpecTemplateInput: new codepipeline.Artifact('AppSpecArtifact'),
       });
 
-      expect(stack).to(haveResourceLike('AWS::CodePipeline::Pipeline', {
+      expect(stack).toHaveResourceLike('AWS::CodePipeline::Pipeline', {
         Stages: [
           {},
           {
@@ -138,12 +137,12 @@ nodeunitShim({
             ],
           },
         ],
-      }));
+      });
 
-      test.done();
-    },
 
-    'defaults task definition placeholder string'(test: Test) {
+    });
+
+    test('defaults task definition placeholder string', () => {
       const stack = new cdk.Stack();
       const deploymentGroup = addEcsDeploymentGroup(stack);
       const artifact1 = new codepipeline.Artifact();
@@ -163,7 +162,7 @@ nodeunitShim({
         ],
       });
 
-      expect(stack).to(haveResourceLike('AWS::CodePipeline::Pipeline', {
+      expect(stack).toHaveResourceLike('AWS::CodePipeline::Pipeline', {
         Stages: [
           {},
           {
@@ -193,11 +192,11 @@ nodeunitShim({
             ],
           },
         ],
-      }));
+      });
+
 
-      test.done();
-    },
-  },
+    });
+  });
 });
 
 function addEcsDeploymentGroup(stack: cdk.Stack): codedeploy.IEcsDeploymentGroup {
diff --git a/packages/@aws-cdk/aws-codepipeline-actions/test/codestar-connections/codestar-connections-source-action.test.ts b/packages/@aws-cdk/aws-codepipeline-actions/test/codestar-connections/codestar-connections-source-action.test.ts
index 367da1e11ed3f..75fe764109b25 100644
--- a/packages/@aws-cdk/aws-codepipeline-actions/test/codestar-connections/codestar-connections-source-action.test.ts
+++ b/packages/@aws-cdk/aws-codepipeline-actions/test/codestar-connections/codestar-connections-source-action.test.ts
@@ -1,22 +1,22 @@
-import { arrayWith, expect, haveResourceLike, objectLike } from '@aws-cdk/assert-internal';
+import '@aws-cdk/assert-internal/jest';
+import { arrayWith, objectLike } from '@aws-cdk/assert-internal';
 import * as codebuild from '@aws-cdk/aws-codebuild';
 import * as codepipeline from '@aws-cdk/aws-codepipeline';
 import { Stack } from '@aws-cdk/core';
-import { nodeunitShim, Test } from 'nodeunit-shim';
 import * as cpactions from '../../lib';
 
 /* eslint-disable quote-props */
 
-nodeunitShim({
-  'CodeStar Connections source Action': {
-    'produces the correct configuration when added to a pipeline'(test: Test) {
+describe('CodeStar Connections source Action', () => {
+  describe('CodeStar Connections source Action', () => {
+    test('produces the correct configuration when added to a pipeline', () => {
       const stack = new Stack();
 
       createBitBucketAndCodeBuildPipeline(stack, {
         codeBuildCloneOutput: false,
       });
 
-      expect(stack).to(haveResourceLike('AWS::CodePipeline::Pipeline', {
+      expect(stack).toHaveResourceLike('AWS::CodePipeline::Pipeline', {
         'Stages': [
           {
             'Name': 'Source',
@@ -44,20 +44,20 @@ nodeunitShim({
             ],
           },
         ],
-      }));
+      });
+
 
-      test.done();
-    },
-  },
+    });
+  });
 
-  'setting codeBuildCloneOutput=true adds permission to use the connection to the following CodeBuild Project'(test: Test) {
+  test('setting codeBuildCloneOutput=true adds permission to use the connection to the following CodeBuild Project', () => {
     const stack = new Stack();
 
     createBitBucketAndCodeBuildPipeline(stack, {
       codeBuildCloneOutput: true,
     });
 
-    expect(stack).to(haveResourceLike('AWS::IAM::Policy', {
+    expect(stack).toHaveResourceLike('AWS::IAM::Policy', {
       'PolicyDocument': {
         'Statement': [
           {
@@ -78,19 +78,19 @@ nodeunitShim({
           },
         ],
       },
-    }));
+    });
+
 
-    test.done();
-  },
+  });
 
-  'grant s3 putObjectACL to the following CodeBuild Project'(test: Test) {
+  test('grant s3 putObjectACL to the following CodeBuild Project', () => {
     const stack = new Stack();
 
     createBitBucketAndCodeBuildPipeline(stack, {
       codeBuildCloneOutput: true,
     });
 
-    expect(stack).to(haveResourceLike('AWS::IAM::Policy', {
+    expect(stack).toHaveResourceLike('AWS::IAM::Policy', {
       'PolicyDocument': {
         'Statement': arrayWith(
           objectLike({
@@ -105,19 +105,19 @@ nodeunitShim({
           }),
         ),
       },
-    }));
+    });
+
 
-    test.done();
-  },
+  });
 
-  'setting triggerOnPush=false reflects in the configuration'(test: Test) {
+  test('setting triggerOnPush=false reflects in the configuration', () => {
     const stack = new Stack();
 
     createBitBucketAndCodeBuildPipeline(stack, {
       triggerOnPush: false,
     });
 
-    expect(stack).to(haveResourceLike('AWS::CodePipeline::Pipeline', {
+    expect(stack).toHaveResourceLike('AWS::CodePipeline::Pipeline', {
       'Stages': [
         {
           'Name': 'Source',
@@ -146,10 +146,10 @@ nodeunitShim({
           ],
         },
       ],
-    }));
+    });
+
 
-    test.done();
-  },
+  });
 });
 
 function createBitBucketAndCodeBuildPipeline(stack: Stack, props: Partial<cpactions.BitBucketSourceActionProps>): void {
diff --git a/packages/@aws-cdk/aws-codepipeline-actions/test/ecr/ecr-source-action.test.ts b/packages/@aws-cdk/aws-codepipeline-actions/test/ecr/ecr-source-action.test.ts
index aecf6cb915f04..b51a566d4ef14 100644
--- a/packages/@aws-cdk/aws-codepipeline-actions/test/ecr/ecr-source-action.test.ts
+++ b/packages/@aws-cdk/aws-codepipeline-actions/test/ecr/ecr-source-action.test.ts
@@ -1,16 +1,15 @@
-import { expect, haveResourceLike } from '@aws-cdk/assert-internal';
+import '@aws-cdk/assert-internal/jest';
 import * as codebuild from '@aws-cdk/aws-codebuild';
 import * as codepipeline from '@aws-cdk/aws-codepipeline';
 import * as ecr from '@aws-cdk/aws-ecr';
 import { Stack } from '@aws-cdk/core';
-import { nodeunitShim, Test } from 'nodeunit-shim';
 import * as cpactions from '../../lib';
 
 /* eslint-disable quote-props */
 
-nodeunitShim({
-  'ECR source Action': {
-    'exposes variables for other actions to consume'(test: Test) {
+describe('ecr source action', () => {
+  describe('ECR source Action', () => {
+    test('exposes variables for other actions to consume', () => {
       const stack = new Stack();
 
       const sourceOutput = new codepipeline.Artifact();
@@ -41,7 +40,7 @@ nodeunitShim({
         ],
       });
 
-      expect(stack).to(haveResourceLike('AWS::CodePipeline::Pipeline', {
+      expect(stack).toHaveResourceLike('AWS::CodePipeline::Pipeline', {
         'Stages': [
           {
             'Name': 'Source',
@@ -58,9 +57,9 @@ nodeunitShim({
             ],
           },
         ],
-      }));
+      });
+
 
-      test.done();
-    },
-  },
+    });
+  });
 });
diff --git a/packages/@aws-cdk/aws-codepipeline-actions/test/ecs/ecs-deploy-action.test.ts b/packages/@aws-cdk/aws-codepipeline-actions/test/ecs/ecs-deploy-action.test.ts
index 3cdc12554d501..63927d5832ec8 100644
--- a/packages/@aws-cdk/aws-codepipeline-actions/test/ecs/ecs-deploy-action.test.ts
+++ b/packages/@aws-cdk/aws-codepipeline-actions/test/ecs/ecs-deploy-action.test.ts
@@ -1,124 +1,123 @@
-import { expect, haveResourceLike } from '@aws-cdk/assert-internal';
+import '@aws-cdk/assert-internal/jest';
 import * as codepipeline from '@aws-cdk/aws-codepipeline';
 import * as ec2 from '@aws-cdk/aws-ec2';
 import * as ecs from '@aws-cdk/aws-ecs';
 import * as s3 from '@aws-cdk/aws-s3';
 import * as cdk from '@aws-cdk/core';
-import { nodeunitShim, Test } from 'nodeunit-shim';
 import * as cpactions from '../../lib';
 
-nodeunitShim({
-  'ECS deploy Action': {
-    'throws an exception if neither inputArtifact nor imageFile were provided'(test: Test) {
+describe('ecs deploy action', () => {
+  describe('ECS deploy Action', () => {
+    test('throws an exception if neither inputArtifact nor imageFile were provided', () => {
       const service = anyEcsService();
 
-      test.throws(() => {
+      expect(() => {
         new cpactions.EcsDeployAction({
           actionName: 'ECS',
           service,
         });
-      }, /one of 'input' or 'imageFile' is required/);
+      }).toThrow(/one of 'input' or 'imageFile' is required/);
 
-      test.done();
-    },
 
-    'can be created just by specifying the inputArtifact'(test: Test) {
+    });
+
+    test('can be created just by specifying the inputArtifact', () => {
       const service = anyEcsService();
       const artifact = new codepipeline.Artifact('Artifact');
 
-      test.doesNotThrow(() => {
+      expect(() => {
         new cpactions.EcsDeployAction({
           actionName: 'ECS',
           service,
           input: artifact,
         });
-      });
+      }).not.toThrow();
 
-      test.done();
-    },
 
-    'can be created just by specifying the imageFile'(test: Test) {
+    });
+
+    test('can be created just by specifying the imageFile', () => {
       const service = anyEcsService();
       const artifact = new codepipeline.Artifact('Artifact');
 
-      test.doesNotThrow(() => {
+      expect(() => {
         new cpactions.EcsDeployAction({
           actionName: 'ECS',
           service,
           imageFile: artifact.atPath('imageFile.json'),
         });
-      });
+      }).not.toThrow();
 
-      test.done();
-    },
 
-    'throws an exception if both inputArtifact and imageFile were provided'(test: Test) {
+    });
+
+    test('throws an exception if both inputArtifact and imageFile were provided', () => {
       const service = anyEcsService();
       const artifact = new codepipeline.Artifact('Artifact');
 
-      test.throws(() => {
+      expect(() => {
         new cpactions.EcsDeployAction({
           actionName: 'ECS',
           service,
           input: artifact,
           imageFile: artifact.atPath('file.json'),
         });
-      }, /one of 'input' or 'imageFile' can be provided/);
+      }).toThrow(/one of 'input' or 'imageFile' can be provided/);
+
 
-      test.done();
-    },
+    });
 
-    'can be created with deploymentTimeout between 1-60 minutes'(test: Test) {
+    test('can be created with deploymentTimeout between 1-60 minutes', () => {
       const service = anyEcsService();
       const artifact = new codepipeline.Artifact('Artifact');
 
-      test.doesNotThrow(() => {
+      expect(() => {
         new cpactions.EcsDeployAction({
           actionName: 'ECS',
           service,
           input: artifact,
           deploymentTimeout: cdk.Duration.minutes(30),
         });
-      });
+      }).not.toThrow();
 
-      test.done();
-    },
 
-    'throws an exception if deploymentTimeout is out of bounds'(test: Test) {
+    });
+
+    test('throws an exception if deploymentTimeout is out of bounds', () => {
       const service = anyEcsService();
       const artifact = new codepipeline.Artifact('Artifact');
 
-      test.throws(() => {
+      expect(() => {
         new cpactions.EcsDeployAction({
           actionName: 'ECS',
           service,
           input: artifact,
           deploymentTimeout: cdk.Duration.minutes(61),
         });
-      }, /timeout must be between 1 and 60 minutes/);
+      }).toThrow(/timeout must be between 1 and 60 minutes/);
 
-      test.throws(() => {
+      expect(() => {
         new cpactions.EcsDeployAction({
           actionName: 'ECS',
           service,
           input: artifact,
           deploymentTimeout: cdk.Duration.minutes(0),
         });
-      }, /timeout must be between 1 and 60 minutes/);
+      }).toThrow(/timeout must be between 1 and 60 minutes/);
 
-      test.throws(() => {
+      expect(() => {
         new cpactions.EcsDeployAction({
           actionName: 'ECS',
           service,
           input: artifact,
           deploymentTimeout: cdk.Duration.seconds(30),
         });
-      }, /cannot be converted into a whole number/);
+      }).toThrow(/cannot be converted into a whole number/);
+
 
-      test.done();
-    },
+    });
 
-    "sets the target service as the action's backing resource"(test: Test) {
+    test("sets the target service as the action's backing resource", () => {
       const service = anyEcsService();
       const artifact = new codepipeline.Artifact('Artifact');
 
@@ -128,12 +127,12 @@ nodeunitShim({
         input: artifact,
       });
 
-      test.equal(action.actionProperties.resource, service);
+      expect(action.actionProperties.resource).toEqual(service);
+
 
-      test.done();
-    },
+    });
 
-    'can be created by existing service'(test: Test) {
+    test('can be created by existing service', () => {
       const stack = new cdk.Stack();
       const vpc = new ec2.Vpc(stack, 'Vpc');
       const service = ecs.FargateService.fromFargateServiceAttributes(stack, 'FargateService', {
@@ -173,7 +172,7 @@ nodeunitShim({
         ],
       });
 
-      expect(stack).to(haveResourceLike('AWS::CodePipeline::Pipeline', {
+      expect(stack).toHaveResourceLike('AWS::CodePipeline::Pipeline', {
         Stages: [
           {},
           {
@@ -193,11 +192,11 @@ nodeunitShim({
             ],
           },
         ],
-      }));
+      });
+
 
-      test.done();
-    },
-  },
+    });
+  });
 });
 
 function anyEcsService(): ecs.FargateService {
diff --git a/packages/@aws-cdk/aws-codepipeline-actions/test/github/github-source-action.test.ts b/packages/@aws-cdk/aws-codepipeline-actions/test/github/github-source-action.test.ts
index 635f7ac67780f..6a1342888042e 100644
--- a/packages/@aws-cdk/aws-codepipeline-actions/test/github/github-source-action.test.ts
+++ b/packages/@aws-cdk/aws-codepipeline-actions/test/github/github-source-action.test.ts
@@ -1,15 +1,15 @@
-import { expect, haveResourceLike, SynthUtils } from '@aws-cdk/assert-internal';
+import '@aws-cdk/assert-internal/jest';
+import { SynthUtils } from '@aws-cdk/assert-internal';
 import * as codebuild from '@aws-cdk/aws-codebuild';
 import * as codepipeline from '@aws-cdk/aws-codepipeline';
 import { SecretValue, Stack } from '@aws-cdk/core';
-import { nodeunitShim, Test } from 'nodeunit-shim';
 import * as cpactions from '../../lib';
 
 /* eslint-disable quote-props */
 
-nodeunitShim({
-  'GitHub source Action': {
-    'exposes variables for other actions to consume'(test: Test) {
+describe('Github source action', () => {
+  describe('GitHub source Action', () => {
+    test('exposes variables for other actions to consume', () => {
       const stack = new Stack();
 
       const sourceOutput = new codepipeline.Artifact();
@@ -42,7 +42,7 @@ nodeunitShim({
         ],
       });
 
-      expect(stack).to(haveResourceLike('AWS::CodePipeline::Pipeline', {
+      expect(stack).toHaveResourceLike('AWS::CodePipeline::Pipeline', {
         'Stages': [
           {
             'Name': 'Source',
@@ -59,12 +59,12 @@ nodeunitShim({
             ],
           },
         ],
-      }));
+      });
+
 
-      test.done();
-    },
+    });
 
-    'always renders the customer-supplied namespace, even if none of the variables are used'(test: Test) {
+    test('always renders the customer-supplied namespace, even if none of the variables are used', () => {
       const stack = new Stack();
 
       const sourceOutput = new codepipeline.Artifact();
@@ -96,7 +96,7 @@ nodeunitShim({
         ],
       });
 
-      expect(stack).to(haveResourceLike('AWS::CodePipeline::Pipeline', {
+      expect(stack).toHaveResourceLike('AWS::CodePipeline::Pipeline', {
         'Stages': [
           {
             'Name': 'Source',
@@ -110,12 +110,12 @@ nodeunitShim({
           {
           },
         ],
-      }));
+      });
 
-      test.done();
-    },
 
-    'fails if a variable from an action without a namespace set that is not part of a pipeline is referenced'(test: Test) {
+    });
+
+    test('fails if a variable from an action without a namespace set that is not part of a pipeline is referenced', () => {
       const stack = new Stack();
 
       const unusedSourceAction = new cpactions.GitHubSourceAction({
@@ -154,14 +154,14 @@ nodeunitShim({
         ],
       });
 
-      test.throws(() => {
+      expect(() => {
         SynthUtils.synthesize(stack);
-      }, /Cannot reference variables of action 'Source2', as that action was never added to a pipeline/);
+      }).toThrow(/Cannot reference variables of action 'Source2', as that action was never added to a pipeline/);
+
 
-      test.done();
-    },
+    });
 
-    'fails if a variable from an action with a namespace set that is not part of a pipeline is referenced'(test: Test) {
+    test('fails if a variable from an action with a namespace set that is not part of a pipeline is referenced', () => {
       const stack = new Stack();
 
       const unusedSourceAction = new cpactions.GitHubSourceAction({
@@ -201,11 +201,11 @@ nodeunitShim({
         ],
       });
 
-      test.throws(() => {
+      expect(() => {
         SynthUtils.synthesize(stack);
-      }, /Cannot reference variables of action 'Source2', as that action was never added to a pipeline/);
+      }).toThrow(/Cannot reference variables of action 'Source2', as that action was never added to a pipeline/);
+
 
-      test.done();
-    },
-  },
+    });
+  });
 });
diff --git a/packages/@aws-cdk/aws-codepipeline-actions/test/manual-approval.test.ts b/packages/@aws-cdk/aws-codepipeline-actions/test/manual-approval.test.ts
index 93b4dc1134160..bf894a5db1c88 100644
--- a/packages/@aws-cdk/aws-codepipeline-actions/test/manual-approval.test.ts
+++ b/packages/@aws-cdk/aws-codepipeline-actions/test/manual-approval.test.ts
@@ -1,16 +1,15 @@
-import { expect, haveResourceLike } from '@aws-cdk/assert-internal';
+import '@aws-cdk/assert-internal/jest';
 import * as codepipeline from '@aws-cdk/aws-codepipeline';
 import * as iam from '@aws-cdk/aws-iam';
 import * as sns from '@aws-cdk/aws-sns';
 import { SecretValue, Stack } from '@aws-cdk/core';
-import { nodeunitShim, Test } from 'nodeunit-shim';
 import * as cpactions from '../lib';
 
 /* eslint-disable quote-props */
 
-nodeunitShim({
-  'manual approval Action': {
-    'allows passing an SNS Topic when constructing it'(test: Test) {
+describe('manual approval', () => {
+  describe('manual approval Action', () => {
+    test('allows passing an SNS Topic when constructing it', () => {
       const stack = new Stack();
       const topic = new sns.Topic(stack, 'Topic');
       const manualApprovalAction = new cpactions.ManualApprovalAction({
@@ -21,12 +20,12 @@ nodeunitShim({
       const stage = pipeline.addStage({ stageName: 'stage' });
       stage.addAction(manualApprovalAction);
 
-      test.equal(manualApprovalAction.notificationTopic, topic);
+      expect(manualApprovalAction.notificationTopic).toEqual(topic);
 
-      test.done();
-    },
 
-    'allows granting manual approval permissions to role'(test: Test) {
+    });
+
+    test('allows granting manual approval permissions to role', () => {
       const stack = new Stack();
       const role = new iam.Role(stack, 'Human', { assumedBy: new iam.AnyPrincipal() });
       const pipeline = new codepipeline.Pipeline(stack, 'pipeline');
@@ -49,7 +48,7 @@ nodeunitShim({
 
       manualApprovalAction.grantManualApproval(role);
 
-      expect(stack).to(haveResourceLike('AWS::IAM::Policy', {
+      expect(stack).toHaveResourceLike('AWS::IAM::Policy', {
         'PolicyDocument': {
           'Statement': [
             {
@@ -109,26 +108,26 @@ nodeunitShim({
             'Ref': 'HumanD337C84C',
           },
         ],
-      }));
+      });
+
 
-      test.done();
-    },
+    });
 
-    'rejects granting manual approval permissions before binding action to stage'(test: Test) {
+    test('rejects granting manual approval permissions before binding action to stage', () => {
       const stack = new Stack();
       const role = new iam.Role(stack, 'Human', { assumedBy: new iam.AnyPrincipal() });
       const manualApprovalAction = new cpactions.ManualApprovalAction({
         actionName: 'Approve',
       });
 
-      test.throws(() => {
+      expect(() => {
         manualApprovalAction.grantManualApproval(role);
-      }, 'Cannot grant permissions before binding action to a stage');
+      }).toThrow('Cannot grant permissions before binding action to a stage');
 
-      test.done();
-    },
 
-    'renders CustomData and ExternalEntityLink even if notificationTopic was not passed'(test: Test) {
+    });
+
+    test('renders CustomData and ExternalEntityLink even if notificationTopic was not passed', () => {
       const stack = new Stack();
       new codepipeline.Pipeline(stack, 'pipeline', {
         stages: [
@@ -155,7 +154,7 @@ nodeunitShim({
         ],
       });
 
-      expect(stack).to(haveResourceLike('AWS::CodePipeline::Pipeline', {
+      expect(stack).toHaveResourceLike('AWS::CodePipeline::Pipeline', {
         'Stages': [
           {
             'Name': 'Source',
@@ -173,9 +172,9 @@ nodeunitShim({
             ],
           },
         ],
-      }));
+      });
+
 
-      test.done();
-    },
-  },
+    });
+  });
 });
diff --git a/packages/@aws-cdk/aws-codepipeline-actions/test/pipeline.test.ts b/packages/@aws-cdk/aws-codepipeline-actions/test/pipeline.test.ts
index 331bae0db4b9e..1c680e0c7e95d 100644
--- a/packages/@aws-cdk/aws-codepipeline-actions/test/pipeline.test.ts
+++ b/packages/@aws-cdk/aws-codepipeline-actions/test/pipeline.test.ts
@@ -1,4 +1,5 @@
-import { countResources, expect, haveResource, haveResourceLike, not, SynthUtils } from '@aws-cdk/assert-internal';
+import '@aws-cdk/assert-internal/jest';
+import { SynthUtils } from '@aws-cdk/assert-internal';
 import * as codebuild from '@aws-cdk/aws-codebuild';
 import * as codecommit from '@aws-cdk/aws-codecommit';
 import * as codepipeline from '@aws-cdk/aws-codepipeline';
@@ -8,13 +9,12 @@ import * as lambda from '@aws-cdk/aws-lambda';
 import * as s3 from '@aws-cdk/aws-s3';
 import * as sns from '@aws-cdk/aws-sns';
 import { App, Aws, CfnParameter, ConstructNode, SecretValue, Stack } from '@aws-cdk/core';
-import { nodeunitShim, Test } from 'nodeunit-shim';
 import * as cpactions from '../lib';
 
 /* eslint-disable quote-props */
 
-nodeunitShim({
-  'basic pipeline'(test: Test) {
+describe('pipeline', () => {
+  test('basic pipeline', () => {
     const stack = new Stack();
 
     const repository = new codecommit.Repository(stack, 'MyRepo', {
@@ -45,28 +45,50 @@ nodeunitShim({
       ],
     });
 
-    test.notDeepEqual(SynthUtils.toCloudFormation(stack), {});
-    test.deepEqual([], ConstructNode.validate(pipeline.node));
-    test.done();
-  },
+    expect(SynthUtils.toCloudFormation(stack)).not.toEqual({});
+    expect([]).toEqual(ConstructNode.validate(pipeline.node));
 
-  'Tokens can be used as physical names of the Pipeline'(test: Test) {
+  });
+
+  test('Tokens can be used as physical names of the Pipeline', () => {
     const stack = new Stack(undefined, 'StackName');
 
-    new codepipeline.Pipeline(stack, 'Pipeline', {
+    const p = new codepipeline.Pipeline(stack, 'Pipeline', {
       pipelineName: Aws.STACK_NAME,
     });
+    p.addStage({
+      stageName: 'Source',
+      actions: [
+        new cpactions.GitHubSourceAction({
+          actionName: 'GH',
+          runOrder: 8,
+          output: new codepipeline.Artifact('A'),
+          branch: 'branch',
+          oauthToken: SecretValue.plainText('secret'),
+          owner: 'foo',
+          repo: 'bar',
+          trigger: cpactions.GitHubTrigger.POLL,
+        }),
+      ],
+    });
 
-    expect(stack, true).to(haveResourceLike('AWS::CodePipeline::Pipeline', {
+    p.addStage({
+      stageName: 'Two',
+      actions: [
+        new cpactions.ManualApprovalAction({ actionName: 'Boo' }),
+      ],
+    });
+
+    expect(stack).toHaveResourceLike('AWS::CodePipeline::Pipeline', {
       'Name': {
         'Ref': 'AWS::StackName',
       },
-    }));
+    });
+
 
-    test.done();
-  },
+  });
 
-  'pipeline with GitHub source with poll trigger'(test: Test) {
+  test('pipeline with GitHub source with poll trigger', () => {
     const stack = new Stack();
 
     const secret = new CfnParameter(stack, 'GitHubToken', { type: 'String', default: 'my-token' });
@@ -96,9 +118,9 @@ nodeunitShim({
       ],
     });
 
-    expect(stack).to(not(haveResourceLike('AWS::CodePipeline::Webhook')));
+    expect(stack).not.toHaveResourceLike('AWS::CodePipeline::Webhook');
 
-    expect(stack).to(haveResourceLike('AWS::CodePipeline::Pipeline', {
+    expect(stack).toHaveResourceLike('AWS::CodePipeline::Pipeline', {
       'Stages': [
         {
           'Actions': [
@@ -120,12 +142,12 @@ nodeunitShim({
           'Name': 'Two',
         },
       ],
-    }));
+    });
+
 
-    test.done();
-  },
+  });
 
-  'pipeline with GitHub source without triggers'(test: Test) {
+  test('pipeline with GitHub source without triggers', () => {
     const stack = new Stack();
 
     const secret = new CfnParameter(stack, 'GitHubToken', { type: 'String', default: 'my-token' });
@@ -155,9 +177,9 @@ nodeunitShim({
       ],
     });
 
-    expect(stack).to(not(haveResourceLike('AWS::CodePipeline::Webhook')));
+    expect(stack).not.toHaveResourceLike('AWS::CodePipeline::Webhook');
 
-    expect(stack).to(haveResourceLike('AWS::CodePipeline::Pipeline', {
+    expect(stack).toHaveResourceLike('AWS::CodePipeline::Pipeline', {
       'Stages': [
         {
           'Actions': [
@@ -179,12 +201,12 @@ nodeunitShim({
           'Name': 'Two',
         },
       ],
-    }));
+    });
+
 
-    test.done();
-  },
+  });
 
-  'github action uses ThirdParty owner'(test: Test) {
+  test('github action uses ThirdParty owner', () => {
     const stack = new Stack();
 
     const secret = new CfnParameter(stack, 'GitHubToken', { type: 'String', default: 'my-token' });
@@ -213,9 +235,9 @@ nodeunitShim({
       ],
     });
 
-    expect(stack).to(haveResourceLike('AWS::CodePipeline::Webhook'));
+    expect(stack).toHaveResourceLike('AWS::CodePipeline::Webhook');
 
-    expect(stack).to(haveResourceLike('AWS::CodePipeline::Pipeline', {
+    expect(stack).toHaveResourceLike('AWS::CodePipeline::Pipeline', {
       'ArtifactStore': {
         'Location': {
           'Ref': 'PArtifactsBucket5E711C12',
@@ -274,13 +296,13 @@ nodeunitShim({
           'Name': 'Two',
         },
       ],
-    }));
+    });
+
+    expect([]).toEqual(ConstructNode.validate(p.node));
 
-    test.deepEqual([], ConstructNode.validate(p.node));
-    test.done();
-  },
+  });
 
-  'onStateChange'(test: Test) {
+  test('onStateChange', () => {
     const stack = new Stack();
 
     const topic = new sns.Topic(stack, 'Topic');
@@ -316,7 +338,7 @@ nodeunitShim({
       },
     });
 
-    expect(stack).to(haveResource('AWS::Events::Rule', {
+    expect(stack).toHaveResource('AWS::Events::Rule', {
       'Description': 'desc',
       'EventPattern': {
         'detail': {
@@ -365,22 +387,22 @@ nodeunitShim({
           'Id': 'Target0',
         },
       ],
-    }));
+    });
 
-    test.deepEqual([], ConstructNode.validate(pipeline.node));
-    test.done();
-  },
+    expect([]).toEqual(ConstructNode.validate(pipeline.node));
 
-  'PipelineProject': {
-    'with a custom Project Name': {
-      'sets the source and artifacts to CodePipeline'(test: Test) {
+  });
+
+  describe('PipelineProject', () => {
+    describe('with a custom Project Name', () => {
+      test('sets the source and artifacts to CodePipeline', () => {
         const stack = new Stack();
 
         new codebuild.PipelineProject(stack, 'MyProject', {
           projectName: 'MyProject',
         });
 
-        expect(stack).to(haveResourceLike('AWS::CodeBuild::Project', {
+        expect(stack).toHaveResourceLike('AWS::CodeBuild::Project', {
           'Name': 'MyProject',
           'Source': {
             'Type': 'CODEPIPELINE',
@@ -400,14 +422,14 @@ nodeunitShim({
             'Image': 'aws/codebuild/standard:1.0',
             'ComputeType': 'BUILD_GENERAL1_SMALL',
           },
-        }));
+        });
 
-        test.done();
-      },
-    },
-  },
 
-  'Lambda PipelineInvokeAction can be used to invoke Lambda functions from a CodePipeline'(test: Test) {
+      });
+    });
+  });
+
+  test('Lambda PipelineInvokeAction can be used to invoke Lambda functions from a CodePipeline', () => {
     const stack = new Stack();
 
     const lambdaFun = new lambda.Function(stack, 'Function', {
@@ -459,7 +481,7 @@ nodeunitShim({
       actions: [lambdaAction],
     });
 
-    expect(stack).to(haveResourceLike('AWS::CodePipeline::Pipeline', {
+    expect(stack).toHaveResourceLike('AWS::CodePipeline::Pipeline', {
       'ArtifactStore': {
         'Location': {
           'Ref': 'PipelineArtifactsBucket22248F97',
@@ -506,11 +528,11 @@ nodeunitShim({
           'Name': 'Stage',
         },
       ],
-    }));
+    });
 
-    test.equal((lambdaAction.actionProperties.outputs || []).length, 3);
+    expect((lambdaAction.actionProperties.outputs || []).length).toEqual(3);
 
-    expect(stack, /* skip validation */ true).to(haveResource('AWS::IAM::Policy', {
+    expect(stack).toHaveResource('AWS::IAM::Policy', {
       'PolicyDocument': {
         'Statement': [
           {
@@ -530,13 +552,13 @@ nodeunitShim({
           'Ref': 'FunctionServiceRole675BB04A',
         },
       ],
-    }));
+    });
 
-    test.done();
-  },
 
-  'cross-region Pipeline': {
-    'generates the required Action & ArtifactStores properties in the template'(test: Test) {
+  });
+
+  describe('cross-region Pipeline', () => {
+    test('generates the required Action & ArtifactStores properties in the template', () => {
       const pipelineRegion = 'us-west-2';
       const pipelineAccount = '123';
 
@@ -594,7 +616,7 @@ nodeunitShim({
         ],
       });
 
-      expect(stack).to(haveResourceLike('AWS::CodePipeline::Pipeline', {
+      expect(stack).toHaveResourceLike('AWS::CodePipeline::Pipeline', {
         'ArtifactStores': [
           {
             'Region': 'us-west-1',
@@ -644,36 +666,35 @@ nodeunitShim({
             ],
           },
         ],
-      }));
+      });
 
-      test.notEqual(pipeline.crossRegionSupport[pipelineRegion], undefined);
-      test.notEqual(pipeline.crossRegionSupport['us-west-1'], undefined);
+      expect(pipeline.crossRegionSupport[pipelineRegion]).toBeDefined();
+      expect(pipeline.crossRegionSupport['us-west-1']).toBeDefined();
 
       const usEast1Support = pipeline.crossRegionSupport['us-east-1'];
-      test.notEqual(usEast1Support, undefined);
-      test.equal(usEast1Support.stack.region, 'us-east-1');
-      test.equal(usEast1Support.stack.account, pipelineAccount);
-      test.ok(usEast1Support.stack.node.id.indexOf('us-east-1') !== -1,
-        `expected '${usEast1Support.stack.node.id}' to contain 'us-east-1'`);
+      expect(usEast1Support).toBeDefined();
+      expect(usEast1Support.stack.region).toEqual('us-east-1');
+      expect(usEast1Support.stack.account).toEqual(pipelineAccount);
+      expect(usEast1Support.stack.node.id.indexOf('us-east-1')).not.toEqual(-1);
 
-      test.done();
-    },
 
-    'allows specifying only one of artifactBucket and crossRegionReplicationBuckets'(test: Test) {
+    });
+
+    test('allows specifying only one of artifactBucket and crossRegionReplicationBuckets', () => {
       const stack = new Stack();
 
-      test.throws(() => {
+      expect(() => {
         new codepipeline.Pipeline(stack, 'Pipeline', {
           artifactBucket: new s3.Bucket(stack, 'Bucket'),
           crossRegionReplicationBuckets: {
             // even an empty map should trigger this validation...
           },
         });
-      }, /Only one of artifactBucket and crossRegionReplicationBuckets can be specified!/);
-      test.done();
-    },
+      }).toThrow(/Only one of artifactBucket and crossRegionReplicationBuckets can be specified!/);
 
-    'does not create a new artifact Bucket if one was provided in the cross-region Buckets for the Pipeline region'(test: Test) {
+    });
+
+    test('does not create a new artifact Bucket if one was provided in the cross-region Buckets for the Pipeline region', () => {
       const pipelineRegion = 'us-west-2';
 
       const stack = new Stack(undefined, undefined, {
@@ -712,9 +733,9 @@ nodeunitShim({
         ],
       });
 
-      expect(stack).to(countResources('AWS::S3::Bucket', 1));
+      expect(stack).toCountResources('AWS::S3::Bucket', 1);
 
-      expect(stack).to(haveResourceLike('AWS::CodePipeline::Pipeline', {
+      expect(stack).toHaveResourceLike('AWS::CodePipeline::Pipeline', {
         'ArtifactStores': [
           {
             'Region': pipelineRegion,
@@ -726,12 +747,12 @@ nodeunitShim({
             },
           },
         ],
-      }));
+      });
 
-      test.done();
-    },
 
-    'allows providing a resource-backed action from a different region directly'(test: Test) {
+    });
+
+    test('allows providing a resource-backed action from a different region directly', () => {
       const account = '123456789012';
       const app = new App();
 
@@ -765,7 +786,7 @@ nodeunitShim({
         ],
       });
 
-      expect(pipelineStack).to(haveResourceLike('AWS::CodePipeline::Pipeline', {
+      expect(pipelineStack).toHaveResourceLike('AWS::CodePipeline::Pipeline', {
         'ArtifactStores': [
           {
             'Region': replicationRegion,
@@ -810,18 +831,18 @@ nodeunitShim({
             ],
           },
         ],
-      }));
+      });
 
-      expect(replicationStack).to(haveResourceLike('AWS::S3::Bucket', {
+      expect(replicationStack).toHaveResourceLike('AWS::S3::Bucket', {
         'BucketName': 'replicationstackeplicationbucket2464cd5c33b386483b66',
-      }));
+      });
+
 
-      test.done();
-    },
-  },
+    });
+  });
 
-  'cross-account Pipeline': {
-    'with a CodeBuild Project in a different account works correctly'(test: Test) {
+  describe('cross-account Pipeline', () => {
+    test('with a CodeBuild Project in a different account works correctly', () => {
       const app = new App();
 
       const buildAccount = '901234567890';
@@ -874,7 +895,7 @@ nodeunitShim({
         ],
       });
 
-      expect(pipelineStack).to(haveResourceLike('AWS::CodePipeline::Pipeline', {
+      expect(pipelineStack).toHaveResourceLike('AWS::CodePipeline::Pipeline', {
         'Stages': [
           {
             'Name': 'Source',
@@ -903,9 +924,9 @@ nodeunitShim({
             ],
           },
         ],
-      }));
+      });
 
-      expect(buildStack).to(haveResourceLike('AWS::IAM::Policy', {
+      expect(buildStack).toHaveResourceLike('AWS::IAM::Policy', {
         'PolicyDocument': {
           'Statement': [
             {
@@ -958,12 +979,12 @@ nodeunitShim({
             },
           ],
         },
-      }));
+      });
 
-      test.done();
-    },
 
-    'adds a dependency on the Stack containing a new action Role'(test: Test) {
+    });
+
+    test('adds a dependency on the Stack containing a new action Role', () => {
       const region = 'us-west-2';
       const pipelineAccount = '123456789012';
       const buildAccount = '901234567890';
@@ -1017,7 +1038,7 @@ nodeunitShim({
         ],
       });
 
-      expect(pipelineStack).to(haveResourceLike('AWS::CodePipeline::Pipeline', {
+      expect(pipelineStack).toHaveResourceLike('AWS::CodePipeline::Pipeline', {
         'Stages': [
           {
             'Name': 'Source',
@@ -1041,14 +1062,14 @@ nodeunitShim({
             ],
           },
         ],
-      }));
+      });
 
-      test.equal(pipelineStack.dependencies.length, 1);
+      expect(pipelineStack.dependencies.length).toEqual(1);
 
-      test.done();
-    },
 
-    'does not add a dependency on the Stack containing an imported action Role'(test: Test) {
+    });
+
+    test('does not add a dependency on the Stack containing an imported action Role', () => {
       const region = 'us-west-2';
       const pipelineAccount = '123456789012';
       const buildAccount = '901234567890';
@@ -1101,7 +1122,7 @@ nodeunitShim({
         ],
       });
 
-      expect(pipelineStack).to(haveResourceLike('AWS::CodePipeline::Pipeline', {
+      expect(pipelineStack).toHaveResourceLike('AWS::CodePipeline::Pipeline', {
         'Stages': [
           {
             'Name': 'Source',
@@ -1119,11 +1140,11 @@ nodeunitShim({
             ],
           },
         ],
-      }));
+      });
+
+      expect(pipelineStack.dependencies.length).toEqual(0);
 
-      test.equal(pipelineStack.dependencies.length, 0);
 
-      test.done();
-    },
-  },
+    });
+  });
 });
diff --git a/packages/@aws-cdk/aws-codepipeline-actions/test/s3/s3-source-action.test.ts b/packages/@aws-cdk/aws-codepipeline-actions/test/s3/s3-source-action.test.ts
index 0fb227a9246e8..65553aee81be5 100644
--- a/packages/@aws-cdk/aws-codepipeline-actions/test/s3/s3-source-action.test.ts
+++ b/packages/@aws-cdk/aws-codepipeline-actions/test/s3/s3-source-action.test.ts
@@ -1,21 +1,20 @@
-import { countResources, expect, haveResourceLike, not } from '@aws-cdk/assert-internal';
+import '@aws-cdk/assert-internal/jest';
 import * as codebuild from '@aws-cdk/aws-codebuild';
 import * as codepipeline from '@aws-cdk/aws-codepipeline';
 import * as s3 from '@aws-cdk/aws-s3';
 import { Lazy, Stack } from '@aws-cdk/core';
-import { nodeunitShim, Test } from 'nodeunit-shim';
 import * as cpactions from '../../lib';
 
 /* eslint-disable quote-props */
 
-nodeunitShim({
-  'S3 Source Action': {
-    'by default polls for source changes and does not use Events'(test: Test) {
+describe('S3 source Action', () => {
+  describe('S3 Source Action', () => {
+    test('by default polls for source changes and does not use Events', () => {
       const stack = new Stack();
 
       minimalPipeline(stack, undefined);
 
-      expect(stack).to(haveResourceLike('AWS::CodePipeline::Pipeline', {
+      expect(stack).toHaveResourceLike('AWS::CodePipeline::Pipeline', {
         'Stages': [
           {
             'Actions': [
@@ -27,19 +26,19 @@ nodeunitShim({
           },
           {},
         ],
-      }));
+      });
+
+      expect(stack).not.toHaveResourceLike('AWS::Events::Rule');
 
-      expect(stack).to(not(haveResourceLike('AWS::Events::Rule')));
 
-      test.done();
-    },
+    });
 
-    'does not poll for source changes and uses Events for S3Trigger.EVENTS'(test: Test) {
+    test('does not poll for source changes and uses Events for S3Trigger.EVENTS', () => {
       const stack = new Stack();
 
       minimalPipeline(stack, { trigger: cpactions.S3Trigger.EVENTS });
 
-      expect(stack).to(haveResourceLike('AWS::CodePipeline::Pipeline', {
+      expect(stack).toHaveResourceLike('AWS::CodePipeline::Pipeline', {
         'Stages': [
           {
             'Actions': [
@@ -52,19 +51,19 @@ nodeunitShim({
           },
           {},
         ],
-      }));
+      });
+
+      expect(stack).toCountResources('AWS::Events::Rule', 1);
 
-      expect(stack).to(countResources('AWS::Events::Rule', 1));
 
-      test.done();
-    },
+    });
 
-    'polls for source changes and does not use Events for S3Trigger.POLL'(test: Test) {
+    test('polls for source changes and does not use Events for S3Trigger.POLL', () => {
       const stack = new Stack();
 
       minimalPipeline(stack, { trigger: cpactions.S3Trigger.POLL });
 
-      expect(stack).to(haveResourceLike('AWS::CodePipeline::Pipeline', {
+      expect(stack).toHaveResourceLike('AWS::CodePipeline::Pipeline', {
         'Stages': [
           {
             'Actions': [
@@ -77,19 +76,19 @@ nodeunitShim({
           },
           {},
         ],
-      }));
+      });
+
+      expect(stack).not.toHaveResourceLike('AWS::Events::Rule');
 
-      expect(stack).to(not(haveResourceLike('AWS::Events::Rule')));
 
-      test.done();
-    },
+    });
 
-    'does not poll for source changes and does not use Events for S3Trigger.NONE'(test: Test) {
+    test('does not poll for source changes and does not use Events for S3Trigger.NONE', () => {
       const stack = new Stack();
 
       minimalPipeline(stack, { trigger: cpactions.S3Trigger.NONE });
 
-      expect(stack).to(haveResourceLike('AWS::CodePipeline::Pipeline', {
+      expect(stack).toHaveResourceLike('AWS::CodePipeline::Pipeline', {
         'Stages': [
           {
             'Actions': [
@@ -102,29 +101,29 @@ nodeunitShim({
           },
           {},
         ],
-      }));
+      });
 
-      expect(stack).to(not(haveResourceLike('AWS::Events::Rule')));
+      expect(stack).not.toHaveResourceLike('AWS::Events::Rule');
 
-      test.done();
-    },
 
-    'does not allow passing an empty string for the bucketKey property'(test: Test) {
+    });
+
+    test('does not allow passing an empty string for the bucketKey property', () => {
       const stack = new Stack();
 
-      test.throws(() => {
+      expect(() => {
         new cpactions.S3SourceAction({
           actionName: 'Source',
           bucket: new s3.Bucket(stack, 'MyBucket'),
           bucketKey: '',
           output: new codepipeline.Artifact(),
         });
-      }, /Property bucketKey cannot be an empty string/);
+      }).toThrow(/Property bucketKey cannot be an empty string/);
+
 
-      test.done();
-    },
+    });
 
-    'allows using the same bucket with events trigger mutliple times with different bucket paths'(test: Test) {
+    test('allows using the same bucket with events trigger mutliple times with different bucket paths', () => {
       const stack = new Stack();
 
       const bucket = new s3.Bucket(stack, 'MyBucket');
@@ -141,10 +140,10 @@ nodeunitShim({
         output: new codepipeline.Artifact(),
       }));
 
-      test.done();
-    },
 
-    'throws an error if the same bucket and path with trigger = Events are added to the same pipeline twice'(test: Test) {
+    });
+
+    test('throws an error if the same bucket and path with trigger = Events are added to the same pipeline twice', () => {
       const stack = new Stack();
 
       const bucket = new s3.Bucket(stack, 'MyBucket');
@@ -169,14 +168,14 @@ nodeunitShim({
         output: new codepipeline.Artifact(),
       });
 
-      test.throws(() => {
+      expect(() => {
         sourceStage.addAction(duplicateBucketAndPath);
-      }, /S3 source action with path 'my\/other\/path' is already present in the pipeline for this source bucket/);
+      }).toThrow(/S3 source action with path 'my\/other\/path' is already present in the pipeline for this source bucket/);
 
-      test.done();
-    },
 
-    'allows using a Token bucketKey with trigger = Events, multiple times'(test: Test) {
+    });
+
+    test('allows using a Token bucketKey with trigger = Events, multiple times', () => {
       const stack = new Stack();
 
       const bucket = new s3.Bucket(stack, 'MyBucket');
@@ -193,7 +192,7 @@ nodeunitShim({
         output: new codepipeline.Artifact(),
       }));
 
-      expect(stack, /* skipValidation = */ true).to(haveResourceLike('AWS::CodePipeline::Pipeline', {
+      expect(stack).toHaveResourceLike('AWS::CodePipeline::Pipeline', {
         'Stages': [
           {
             'Actions': [
@@ -210,12 +209,12 @@ nodeunitShim({
             ],
           },
         ],
-      }));
+      });
 
-      test.done();
-    },
 
-    'exposes variables for other actions to consume'(test: Test) {
+    });
+
+    test('exposes variables for other actions to consume', () => {
       const stack = new Stack();
 
       const sourceOutput = new codepipeline.Artifact();
@@ -247,7 +246,7 @@ nodeunitShim({
         ],
       });
 
-      expect(stack).to(haveResourceLike('AWS::CodePipeline::Pipeline', {
+      expect(stack).toHaveResourceLike('AWS::CodePipeline::Pipeline', {
         'Stages': [
           {
             'Name': 'Source',
@@ -264,11 +263,11 @@ nodeunitShim({
             ],
           },
         ],
-      }));
+      });
 
-      test.done();
-    },
-  },
+
+    });
+  });
 });
 
 interface MinimalPipelineOptions {
diff --git a/packages/@aws-cdk/aws-codepipeline-actions/test/servicecatalog/servicecatalog-deploy-action-beta1.test.ts b/packages/@aws-cdk/aws-codepipeline-actions/test/servicecatalog/servicecatalog-deploy-action-beta1.test.ts
index ef96441ca585e..cf490f21fc206 100644
--- a/packages/@aws-cdk/aws-codepipeline-actions/test/servicecatalog/servicecatalog-deploy-action-beta1.test.ts
+++ b/packages/@aws-cdk/aws-codepipeline-actions/test/servicecatalog/servicecatalog-deploy-action-beta1.test.ts
@@ -1,14 +1,13 @@
-import { expect, haveResourceLike } from '@aws-cdk/assert-internal';
+import '@aws-cdk/assert-internal/jest';
 import * as codecommit from '@aws-cdk/aws-codecommit';
 import * as codepipeline from '@aws-cdk/aws-codepipeline';
 import { Stack } from '@aws-cdk/core';
-import { nodeunitShim, Test } from 'nodeunit-shim';
 import * as cpactions from '../../lib';
 
 /* eslint-disable quote-props */
 
-nodeunitShim({
-  'addAction succesfully leads to creation of codepipeline service catalog action with properly formatted TemplateFilePath'(test: Test) {
+describe('ServiceCatalog Deploy Action', () => {
+  test('addAction succesfully leads to creation of codepipeline service catalog action with properly formatted TemplateFilePath', () => {
     // GIVEN
     const stack = new TestFixture();
     // WHEN
@@ -20,7 +19,7 @@ nodeunitShim({
       productId: 'prod-xxxxxxxxx',
     }));
     // THEN
-    expect(stack).to(haveResourceLike('AWS::CodePipeline::Pipeline', {
+    expect(stack).toHaveResourceLike('AWS::CodePipeline::Pipeline', {
       'Stages': [
         { 'Name': 'Source' /* don't care about the rest */ },
         {
@@ -50,11 +49,11 @@ nodeunitShim({
           ],
         },
       ],
-    }));
+    });
+
 
-    test.done();
-  },
-  'deployment without a description works successfully'(test: Test) {
+  });
+  test('deployment without a description works successfully', () => {
     // GIVEN
     const stack = new TestFixture();
     // WHEN
@@ -65,7 +64,7 @@ nodeunitShim({
       productId: 'prod-xxxxxxxxx',
     }));
     // THEN
-    expect(stack).to(haveResourceLike('AWS::CodePipeline::Pipeline', {
+    expect(stack).toHaveResourceLike('AWS::CodePipeline::Pipeline', {
       'Stages': [
         { 'Name': 'Source' /* don't care about the rest */ },
         {
@@ -94,10 +93,10 @@ nodeunitShim({
           ],
         },
       ],
-    }));
+    });
+
 
-    test.done();
-  },
+  });
 });
 
 /**
diff --git a/packages/@aws-cdk/aws-codepipeline-actions/test/stepfunctions/stepfunctions-invoke-actions.test.ts b/packages/@aws-cdk/aws-codepipeline-actions/test/stepfunctions/stepfunctions-invoke-actions.test.ts
index 50f8788e8823c..0ad5d8b2213a1 100644
--- a/packages/@aws-cdk/aws-codepipeline-actions/test/stepfunctions/stepfunctions-invoke-actions.test.ts
+++ b/packages/@aws-cdk/aws-codepipeline-actions/test/stepfunctions/stepfunctions-invoke-actions.test.ts
@@ -1,21 +1,20 @@
-import { expect, haveResourceLike } from '@aws-cdk/assert-internal';
+import '@aws-cdk/assert-internal/jest';
 import * as codepipeline from '@aws-cdk/aws-codepipeline';
 import * as s3 from '@aws-cdk/aws-s3';
 import * as stepfunction from '@aws-cdk/aws-stepfunctions';
 import { Stack } from '@aws-cdk/core';
-import { nodeunitShim, Test } from 'nodeunit-shim';
 import * as cpactions from '../../lib';
 
-nodeunitShim({
-  'StepFunctions Invoke Action': {
-    'Verify stepfunction configuration properties are set to specific values'(test: Test) {
+describe('StepFunctions Invoke Action', () => {
+  describe('StepFunctions Invoke Action', () => {
+    test('Verify stepfunction configuration properties are set to specific values', () => {
       const stack = new Stack();
 
       // when
       minimalPipeline(stack);
 
       // then
-      expect(stack).to(haveResourceLike('AWS::CodePipeline::Pipeline', {
+      expect(stack).toHaveResourceLike('AWS::CodePipeline::Pipeline', {
         Stages: [
           //  Must have a source stage
           {
@@ -58,17 +57,17 @@ nodeunitShim({
             ],
           },
         ],
-      }));
+      });
 
-      test.done();
-    },
 
-    'Allows the pipeline to invoke this stepfunction'(test: Test) {
+    });
+
+    test('Allows the pipeline to invoke this stepfunction', () => {
       const stack = new Stack();
 
       minimalPipeline(stack);
 
-      expect(stack).to(haveResourceLike('AWS::IAM::Policy', {
+      expect(stack).toHaveResourceLike('AWS::IAM::Policy', {
         PolicyDocument: {
           Statement: [
             {
@@ -80,19 +79,19 @@ nodeunitShim({
             },
           ],
         },
-      }));
+      });
+
+      expect(stack).toHaveResourceLike('AWS::IAM::Role');
 
-      expect(stack).to(haveResourceLike('AWS::IAM::Role'));
 
-      test.done();
-    },
+    });
 
-    'Allows the pipeline to describe this stepfunction execution'(test: Test) {
+    test('Allows the pipeline to describe this stepfunction execution', () => {
       const stack = new Stack();
 
       minimalPipeline(stack);
 
-      expect(stack).to(haveResourceLike('AWS::IAM::Policy', {
+      expect(stack).toHaveResourceLike('AWS::IAM::Policy', {
         PolicyDocument: {
           Statement: [
             {},
@@ -136,14 +135,14 @@ nodeunitShim({
             },
           ],
         },
-      }));
+      });
 
-      expect(stack).to(haveResourceLike('AWS::IAM::Role'));
+      expect(stack).toHaveResourceLike('AWS::IAM::Role');
 
-      test.done();
-    },
 
-  },
+    });
+
+  });
 });
 
 function minimalPipeline(stack: Stack): codepipeline.IStage {
diff --git a/packages/@aws-cdk/aws-ecs/package.json b/packages/@aws-cdk/aws-ecs/package.json
index 1348aef9b9d62..f050efe94d045 100644
--- a/packages/@aws-cdk/aws-ecs/package.json
+++ b/packages/@aws-cdk/aws-ecs/package.json
@@ -81,7 +81,7 @@
     "cdk-build-tools": "0.0.0",
     "cdk-integ-tools": "0.0.0",
     "cfn2ts": "0.0.0",
-    "nodeunit-shim": "0.0.0",
+    "jest": "^26.6.3",
     "pkglint": "0.0.0",
     "proxyquire": "^2.1.3",
     "@aws-cdk/assert-internal": "0.0.0"
diff --git a/packages/@aws-cdk/aws-ecs/test/app-mesh-proxy-configuration.test.ts b/packages/@aws-cdk/aws-ecs/test/app-mesh-proxy-configuration.test.ts
index 7865809011a32..7c8bd5f880f77 100644
--- a/packages/@aws-cdk/aws-ecs/test/app-mesh-proxy-configuration.test.ts
+++ b/packages/@aws-cdk/aws-ecs/test/app-mesh-proxy-configuration.test.ts
@@ -1,10 +1,9 @@
-import { expect, haveResourceLike } from '@aws-cdk/assert-internal';
+import '@aws-cdk/assert-internal/jest';
 import * as cdk from '@aws-cdk/core';
-import { nodeunitShim, Test } from 'nodeunit-shim';
 import * as ecs from '../lib';
 
-nodeunitShim({
-  'correctly sets all appMeshProxyConfiguration'(test: Test) {
+describe('app mesh proxy configuration', () => {
+  test('correctly sets all appMeshProxyConfiguration', () => {
     // GIVEN
     const stack = new cdk.Stack();
 
@@ -34,7 +33,7 @@ nodeunitShim({
     });
 
     // THEN
-    expect(stack).to(haveResourceLike('AWS::ECS::TaskDefinition', {
+    expect(stack).toHaveResourceLike('AWS::ECS::TaskDefinition', {
       ProxyConfiguration: {
         ContainerName: 'envoy',
         ProxyConfigurationProperties: [
@@ -69,11 +68,11 @@ nodeunitShim({
         ],
         Type: 'APPMESH',
       },
-    }));
-    test.done();
-  },
+    });
+
+  });
 
-  'correctly sets appMeshProxyConfiguration with default properties set'(test: Test) {
+  test('correctly sets appMeshProxyConfiguration with default properties set', () => {
     // GIVEN
     const stack = new cdk.Stack();
 
@@ -100,7 +99,7 @@ nodeunitShim({
     });
 
     // THEN
-    expect(stack).to(haveResourceLike('AWS::ECS::TaskDefinition', {
+    expect(stack).toHaveResourceLike('AWS::ECS::TaskDefinition', {
       ProxyConfiguration: {
         ContainerName: 'envoy',
         ProxyConfigurationProperties: [
@@ -123,11 +122,11 @@ nodeunitShim({
         ],
         Type: 'APPMESH',
       },
-    }));
-    test.done();
-  },
+    });
+
+  });
 
-  'correctly sets appMeshProxyConfiguration with empty egressIgnoredPorts and egressIgnoredIPs'(test: Test) {
+  test('correctly sets appMeshProxyConfiguration with empty egressIgnoredPorts and egressIgnoredIPs', () => {
     // GIVEN
     const stack = new cdk.Stack();
 
@@ -156,7 +155,7 @@ nodeunitShim({
     });
 
     // THEN
-    expect(stack).to(haveResourceLike('AWS::ECS::TaskDefinition', {
+    expect(stack).toHaveResourceLike('AWS::ECS::TaskDefinition', {
       ProxyConfiguration: {
         ContainerName: 'envoy',
         ProxyConfigurationProperties: [
@@ -179,16 +178,16 @@ nodeunitShim({
         ],
         Type: 'APPMESH',
       },
-    }));
-    test.done();
-  },
+    });
+
+  });
 
-  'throws when neither of IgnoredUID and IgnoredGID is set'(test: Test) {
+  test('throws when neither of IgnoredUID and IgnoredGID is set', () => {
     // GIVEN
     const stack = new cdk.Stack();
 
     // THEN
-    test.throws(() => {
+    expect(() => {
       new ecs.Ec2TaskDefinition(stack, 'Ec2TaskDef', {
         networkMode: ecs.NetworkMode.AWS_VPC,
         proxyConfiguration: ecs.ProxyConfigurations.appMeshProxyConfiguration({
@@ -200,8 +199,8 @@ nodeunitShim({
           },
         }),
       });
-    }, /At least one of ignoredUID or ignoredGID should be specified./);
+    }).toThrow(/At least one of ignoredUID or ignoredGID should be specified./);
+
 
-    test.done();
-  },
+  });
 });
diff --git a/packages/@aws-cdk/aws-ecs/test/aws-log-driver.test.ts b/packages/@aws-cdk/aws-ecs/test/aws-log-driver.test.ts
index 8a802ac72014b..5e570a7d39eeb 100644
--- a/packages/@aws-cdk/aws-ecs/test/aws-log-driver.test.ts
+++ b/packages/@aws-cdk/aws-ecs/test/aws-log-driver.test.ts
@@ -1,22 +1,21 @@
-import { expect, haveResource, haveResourceLike } from '@aws-cdk/assert-internal';
+import '@aws-cdk/assert-internal/jest';
 import * as logs from '@aws-cdk/aws-logs';
 import * as cdk from '@aws-cdk/core';
-import { nodeunitShim, Test } from 'nodeunit-shim';
 import * as ecs from '../lib';
 
 let stack: cdk.Stack;
 let td: ecs.TaskDefinition;
 const image = ecs.ContainerImage.fromRegistry('test-image');
 
-nodeunitShim({
-  'setUp'(cb: () => void) {
+describe('aws log driver', () => {
+  beforeEach(() => {
     stack = new cdk.Stack();
     td = new ecs.FargateTaskDefinition(stack, 'TaskDefinition');
 
-    cb();
-  },
 
-  'create an aws log driver'(test: Test) {
+  });
+
+  test('create an aws log driver', () => {
     // WHEN
     td.addContainer('Container', {
       image,
@@ -30,11 +29,11 @@ nodeunitShim({
     });
 
     // THEN
-    expect(stack).to(haveResource('AWS::Logs::LogGroup', {
+    expect(stack).toHaveResource('AWS::Logs::LogGroup', {
       RetentionInDays: logs.RetentionDays.ONE_MONTH,
-    }));
+    });
 
-    expect(stack).to(haveResourceLike('AWS::ECS::TaskDefinition', {
+    expect(stack).toHaveResourceLike('AWS::ECS::TaskDefinition', {
       ContainerDefinitions: [
         {
           LogConfiguration: {
@@ -50,12 +49,12 @@ nodeunitShim({
           },
         },
       ],
-    }));
+    });
 
-    test.done();
-  },
 
-  'create an aws log driver using awsLogs'(test: Test) {
+  });
+
+  test('create an aws log driver using awsLogs', () => {
     // WHEN
     td.addContainer('Container', {
       image,
@@ -68,11 +67,11 @@ nodeunitShim({
     });
 
     // THEN
-    expect(stack).to(haveResource('AWS::Logs::LogGroup', {
+    expect(stack).toHaveResource('AWS::Logs::LogGroup', {
       RetentionInDays: logs.RetentionDays.ONE_MONTH,
-    }));
+    });
 
-    expect(stack).to(haveResourceLike('AWS::ECS::TaskDefinition', {
+    expect(stack).toHaveResourceLike('AWS::ECS::TaskDefinition', {
       ContainerDefinitions: [
         {
           LogConfiguration: {
@@ -87,12 +86,12 @@ nodeunitShim({
           },
         },
       ],
-    }));
+    });
 
-    test.done();
-  },
 
-  'with a defined log group'(test: Test) {
+  });
+
+  test('with a defined log group', () => {
     // GIVEN
     const logGroup = new logs.LogGroup(stack, 'LogGroup');
 
@@ -106,11 +105,11 @@ nodeunitShim({
     });
 
     // THEN
-    expect(stack).to(haveResource('AWS::Logs::LogGroup', {
+    expect(stack).toHaveResource('AWS::Logs::LogGroup', {
       RetentionInDays: logs.RetentionDays.TWO_YEARS,
-    }));
+    });
 
-    expect(stack).to(haveResourceLike('AWS::ECS::TaskDefinition', {
+    expect(stack).toHaveResourceLike('AWS::ECS::TaskDefinition', {
       ContainerDefinitions: [
         {
           LogConfiguration: {
@@ -123,12 +122,12 @@ nodeunitShim({
           },
         },
       ],
-    }));
+    });
 
-    test.done();
-  },
 
-  'without a defined log group: creates one anyway'(test: Test) {
+  });
+
+  test('without a defined log group: creates one anyway', () => {
     // GIVEN
     td.addContainer('Container', {
       image,
@@ -138,22 +137,22 @@ nodeunitShim({
     });
 
     // THEN
-    expect(stack).to(haveResource('AWS::Logs::LogGroup', {}));
+    expect(stack).toHaveResource('AWS::Logs::LogGroup', {});
+
 
-    test.done();
-  },
+  });
 
-  'throws when specifying log retention and log group'(test: Test) {
+  test('throws when specifying log retention and log group', () => {
     // GIVEN
     const logGroup = new logs.LogGroup(stack, 'LogGroup');
 
     // THEN
-    test.throws(() => new ecs.AwsLogDriver({
+    expect(() => new ecs.AwsLogDriver({
       logGroup,
       logRetention: logs.RetentionDays.FIVE_DAYS,
       streamPrefix: 'hello',
-    }), /`logGroup`.*`logRetentionDays`/);
+    })).toThrow(/`logGroup`.*`logRetentionDays`/);
+
 
-    test.done();
-  },
+  });
 });
diff --git a/packages/@aws-cdk/aws-ecs/test/cluster.test.ts b/packages/@aws-cdk/aws-ecs/test/cluster.test.ts
index 40c74a08257f2..cfe65183d1c02 100644
--- a/packages/@aws-cdk/aws-ecs/test/cluster.test.ts
+++ b/packages/@aws-cdk/aws-ecs/test/cluster.test.ts
@@ -1,11 +1,5 @@
-import {
-  countResources,
-  expect,
-  haveResource,
-  haveResourceLike,
-  ResourcePart,
-  ABSENT,
-} from '@aws-cdk/assert-internal';
+import '@aws-cdk/assert-internal/jest';
+import { ABSENT } from '@aws-cdk/assert-internal';
 import * as autoscaling from '@aws-cdk/aws-autoscaling';
 import * as ec2 from '@aws-cdk/aws-ec2';
 import * as kms from '@aws-cdk/aws-kms';
@@ -13,12 +7,11 @@ import * as logs from '@aws-cdk/aws-logs';
 import * as s3 from '@aws-cdk/aws-s3';
 import * as cloudmap from '@aws-cdk/aws-servicediscovery';
 import * as cdk from '@aws-cdk/core';
-import { nodeunitShim, Test } from 'nodeunit-shim';
 import * as ecs from '../lib';
 
-nodeunitShim({
-  'When creating an ECS Cluster': {
-    'with no properties set, it correctly sets default properties'(test: Test) {
+describe('cluster', () => {
+  describe('When creating an ECS Cluster', () => {
+    test('with no properties set, it correctly sets default properties', () => {
       // GIVEN
       const stack = new cdk.Stack();
       const cluster = new ecs.Cluster(stack, 'EcsCluster');
@@ -27,9 +20,9 @@ nodeunitShim({
         instanceType: new ec2.InstanceType('t2.micro'),
       });
 
-      expect(stack).to(haveResource('AWS::ECS::Cluster'));
+      expect(stack).toHaveResource('AWS::ECS::Cluster');
 
-      expect(stack).to(haveResource('AWS::EC2::VPC', {
+      expect(stack).toHaveResource('AWS::EC2::VPC', {
         CidrBlock: '10.0.0.0/16',
         EnableDnsHostnames: true,
         EnableDnsSupport: true,
@@ -40,9 +33,9 @@ nodeunitShim({
             Value: 'Default/EcsCluster/Vpc',
           },
         ],
-      }));
+      });
 
-      expect(stack).to(haveResource('AWS::AutoScaling::LaunchConfiguration', {
+      expect(stack).toHaveResource('AWS::AutoScaling::LaunchConfiguration', {
         ImageId: {
           Ref: 'SsmParameterValueawsserviceecsoptimizedamiamazonlinux2recommendedimageidC96584B6F00A464EAD1953AFF4B05118Parameter',
         },
@@ -73,9 +66,9 @@ nodeunitShim({
             ],
           },
         },
-      }));
+      });
 
-      expect(stack).to(haveResource('AWS::AutoScaling::AutoScalingGroup', {
+      expect(stack).toHaveResource('AWS::AutoScaling::AutoScalingGroup', {
         MaxSize: '1',
         MinSize: '1',
         LaunchConfigurationName: {
@@ -96,9 +89,9 @@ nodeunitShim({
             Ref: 'EcsClusterVpcPrivateSubnet2SubnetC2B7B1BA',
           },
         ],
-      }));
+      });
 
-      expect(stack).to(haveResource('AWS::EC2::SecurityGroup', {
+      expect(stack).toHaveResource('AWS::EC2::SecurityGroup', {
         GroupDescription: 'Default/EcsCluster/DefaultAutoScalingGroup/InstanceSecurityGroup',
         SecurityGroupEgress: [
           {
@@ -116,9 +109,9 @@ nodeunitShim({
         VpcId: {
           Ref: 'EcsClusterVpc779914AB',
         },
-      }));
+      });
 
-      expect(stack).to(haveResource('AWS::IAM::Role', {
+      expect(stack).toHaveResource('AWS::IAM::Role', {
         AssumeRolePolicyDocument: {
           Statement: [
             {
@@ -131,9 +124,9 @@ nodeunitShim({
           ],
           Version: '2012-10-17',
         },
-      }));
+      });
 
-      expect(stack).to(haveResource('AWS::IAM::Policy', {
+      expect(stack).toHaveResource('AWS::IAM::Policy', {
         PolicyDocument: {
           Statement: [
             {
@@ -181,12 +174,12 @@ nodeunitShim({
           ],
           Version: '2012-10-17',
         },
-      }));
+      });
 
-      test.done();
-    },
 
-    'with only vpc set, it correctly sets default properties'(test: Test) {
+    });
+
+    test('with only vpc set, it correctly sets default properties', () => {
       // GIVEN
       const stack = new cdk.Stack();
       const vpc = new ec2.Vpc(stack, 'MyVpc', {});
@@ -198,9 +191,9 @@ nodeunitShim({
         instanceType: new ec2.InstanceType('t2.micro'),
       });
 
-      expect(stack).to(haveResource('AWS::ECS::Cluster'));
+      expect(stack).toHaveResource('AWS::ECS::Cluster');
 
-      expect(stack).to(haveResource('AWS::EC2::VPC', {
+      expect(stack).toHaveResource('AWS::EC2::VPC', {
         CidrBlock: '10.0.0.0/16',
         EnableDnsHostnames: true,
         EnableDnsSupport: true,
@@ -211,9 +204,9 @@ nodeunitShim({
             Value: 'Default/MyVpc',
           },
         ],
-      }));
+      });
 
-      expect(stack).to(haveResource('AWS::AutoScaling::LaunchConfiguration', {
+      expect(stack).toHaveResource('AWS::AutoScaling::LaunchConfiguration', {
         ImageId: {
           Ref: 'SsmParameterValueawsserviceecsoptimizedamiamazonlinux2recommendedimageidC96584B6F00A464EAD1953AFF4B05118Parameter',
         },
@@ -244,9 +237,9 @@ nodeunitShim({
             ],
           },
         },
-      }));
+      });
 
-      expect(stack).to(haveResource('AWS::AutoScaling::AutoScalingGroup', {
+      expect(stack).toHaveResource('AWS::AutoScaling::AutoScalingGroup', {
         MaxSize: '1',
         MinSize: '1',
         LaunchConfigurationName: {
@@ -267,9 +260,9 @@ nodeunitShim({
             Ref: 'MyVpcPrivateSubnet2Subnet0040C983',
           },
         ],
-      }));
+      });
 
-      expect(stack).to(haveResource('AWS::EC2::SecurityGroup', {
+      expect(stack).toHaveResource('AWS::EC2::SecurityGroup', {
         GroupDescription: 'Default/EcsCluster/DefaultAutoScalingGroup/InstanceSecurityGroup',
         SecurityGroupEgress: [
           {
@@ -287,9 +280,9 @@ nodeunitShim({
         VpcId: {
           Ref: 'MyVpcF9F0CA6F',
         },
-      }));
+      });
 
-      expect(stack).to(haveResource('AWS::IAM::Role', {
+      expect(stack).toHaveResource('AWS::IAM::Role', {
         AssumeRolePolicyDocument: {
           Statement: [
             {
@@ -302,9 +295,9 @@ nodeunitShim({
           ],
           Version: '2012-10-17',
         },
-      }));
+      });
 
-      expect(stack).to(haveResource('AWS::IAM::Policy', {
+      expect(stack).toHaveResource('AWS::IAM::Policy', {
         PolicyDocument: {
           Statement: [
             {
@@ -352,12 +345,12 @@ nodeunitShim({
           ],
           Version: '2012-10-17',
         },
-      }));
+      });
 
-      test.done();
-    },
 
-    'multiple clusters with default capacity'(test: Test) {
+    });
+
+    test('multiple clusters with default capacity', () => {
       // GIVEN
       const stack = new cdk.Stack();
       const vpc = new ec2.Vpc(stack, 'MyVpc', {});
@@ -370,10 +363,10 @@ nodeunitShim({
         });
       }
 
-      test.done();
-    },
 
-    'lifecycle hook is automatically added'(test: Test) {
+    });
+
+    test('lifecycle hook is automatically added', () => {
       // GIVEN
       const stack = new cdk.Stack();
       const vpc = new ec2.Vpc(stack, 'MyVpc', {});
@@ -387,16 +380,16 @@ nodeunitShim({
       });
 
       // THEN
-      expect(stack).to(haveResource('AWS::AutoScaling::LifecycleHook', {
+      expect(stack).toHaveResource('AWS::AutoScaling::LifecycleHook', {
         AutoScalingGroupName: { Ref: 'EcsClusterDefaultAutoScalingGroupASGC1A785DB' },
         LifecycleTransition: 'autoscaling:EC2_INSTANCE_TERMINATING',
         DefaultResult: 'CONTINUE',
         HeartbeatTimeout: 300,
         NotificationTargetARN: { Ref: 'EcsClusterDefaultAutoScalingGroupLifecycleHookDrainHookTopicACD2D4A4' },
         RoleARN: { 'Fn::GetAtt': ['EcsClusterDefaultAutoScalingGroupLifecycleHookDrainHookRoleA38EC83B', 'Arn'] },
-      }));
+      });
 
-      expect(stack).to(haveResource('AWS::Lambda::Function', {
+      expect(stack).toHaveResource('AWS::Lambda::Function', {
         Timeout: 310,
         Environment: {
           Variables: {
@@ -406,9 +399,9 @@ nodeunitShim({
           },
         },
         Handler: 'index.lambda_handler',
-      }));
+      });
 
-      expect(stack).to(haveResource('AWS::IAM::Policy', {
+      expect(stack).toHaveResource('AWS::IAM::Policy', {
         PolicyDocument: {
           Statement: [
             {
@@ -507,12 +500,12 @@ nodeunitShim({
             Ref: 'EcsClusterDefaultAutoScalingGroupDrainECSHookFunctionServiceRole94543EDA',
           },
         ],
-      }));
+      });
+
 
-      test.done();
-    },
+    });
 
-    'lifecycle hook with encrypted SNS is added correctly'(test: Test) {
+    test('lifecycle hook with encrypted SNS is added correctly', () => {
       // GIVEN
       const stack = new cdk.Stack();
       const vpc = new ec2.Vpc(stack, 'MyVpc', {});
@@ -528,19 +521,19 @@ nodeunitShim({
       });
 
       // THEN
-      expect(stack).to(haveResourceLike('AWS::SNS::Topic', {
+      expect(stack).toHaveResourceLike('AWS::SNS::Topic', {
         KmsMasterKeyId: {
           'Fn::GetAtt': [
             'Key961B73FD',
             'Arn',
           ],
         },
-      }));
+      });
 
-      test.done();
-    },
 
-    'with capacity and cloudmap namespace properties set'(test: Test) {
+    });
+
+    test('with capacity and cloudmap namespace properties set', () => {
       // GIVEN
       const stack = new cdk.Stack();
       const vpc = new ec2.Vpc(stack, 'MyVpc', {});
@@ -555,16 +548,16 @@ nodeunitShim({
       });
 
       // THEN
-      expect(stack).to(haveResource('AWS::ServiceDiscovery::PrivateDnsNamespace', {
+      expect(stack).toHaveResource('AWS::ServiceDiscovery::PrivateDnsNamespace', {
         Name: 'foo.com',
         Vpc: {
           Ref: 'MyVpcF9F0CA6F',
         },
-      }));
+      });
 
-      expect(stack).to(haveResource('AWS::ECS::Cluster'));
+      expect(stack).toHaveResource('AWS::ECS::Cluster');
 
-      expect(stack).to(haveResource('AWS::EC2::VPC', {
+      expect(stack).toHaveResource('AWS::EC2::VPC', {
         CidrBlock: '10.0.0.0/16',
         EnableDnsHostnames: true,
         EnableDnsSupport: true,
@@ -575,9 +568,9 @@ nodeunitShim({
             Value: 'Default/MyVpc',
           },
         ],
-      }));
+      });
 
-      expect(stack).to(haveResource('AWS::AutoScaling::LaunchConfiguration', {
+      expect(stack).toHaveResource('AWS::AutoScaling::LaunchConfiguration', {
         ImageId: {
           Ref: 'SsmParameterValueawsserviceecsoptimizedamiamazonlinux2recommendedimageidC96584B6F00A464EAD1953AFF4B05118Parameter',
         },
@@ -608,9 +601,9 @@ nodeunitShim({
             ],
           },
         },
-      }));
+      });
 
-      expect(stack).to(haveResource('AWS::AutoScaling::AutoScalingGroup', {
+      expect(stack).toHaveResource('AWS::AutoScaling::AutoScalingGroup', {
         MaxSize: '1',
         MinSize: '1',
         LaunchConfigurationName: {
@@ -631,9 +624,9 @@ nodeunitShim({
             Ref: 'MyVpcPrivateSubnet2Subnet0040C983',
           },
         ],
-      }));
+      });
 
-      expect(stack).to(haveResource('AWS::EC2::SecurityGroup', {
+      expect(stack).toHaveResource('AWS::EC2::SecurityGroup', {
         GroupDescription: 'Default/EcsCluster/DefaultAutoScalingGroup/InstanceSecurityGroup',
         SecurityGroupEgress: [
           {
@@ -651,9 +644,9 @@ nodeunitShim({
         VpcId: {
           Ref: 'MyVpcF9F0CA6F',
         },
-      }));
+      });
 
-      expect(stack).to(haveResource('AWS::IAM::Role', {
+      expect(stack).toHaveResource('AWS::IAM::Role', {
         AssumeRolePolicyDocument: {
           Statement: [
             {
@@ -666,9 +659,9 @@ nodeunitShim({
           ],
           Version: '2012-10-17',
         },
-      }));
+      });
 
-      expect(stack).to(haveResource('AWS::IAM::Policy', {
+      expect(stack).toHaveResource('AWS::IAM::Policy', {
         PolicyDocument: {
           Statement: [
             {
@@ -716,13 +709,13 @@ nodeunitShim({
           ],
           Version: '2012-10-17',
         },
-      }));
+      });
+
 
-      test.done();
-    },
-  },
+    });
+  });
 
-  'allows specifying instance type'(test: Test) {
+  test('allows specifying instance type', () => {
     // GIVEN
     const stack = new cdk.Stack();
     const vpc = new ec2.Vpc(stack, 'MyVpc', {});
@@ -733,14 +726,14 @@ nodeunitShim({
     });
 
     // THEN
-    expect(stack).to(haveResource('AWS::AutoScaling::LaunchConfiguration', {
+    expect(stack).toHaveResource('AWS::AutoScaling::LaunchConfiguration', {
       InstanceType: 'm3.large',
-    }));
+    });
 
-    test.done();
-  },
 
-  'allows specifying cluster size'(test: Test) {
+  });
+
+  test('allows specifying cluster size', () => {
     // GIVEN
     const stack = new cdk.Stack();
     const vpc = new ec2.Vpc(stack, 'MyVpc', {});
@@ -752,14 +745,14 @@ nodeunitShim({
     });
 
     // THEN
-    expect(stack).to(haveResource('AWS::AutoScaling::AutoScalingGroup', {
+    expect(stack).toHaveResource('AWS::AutoScaling::AutoScalingGroup', {
       MaxSize: '3',
-    }));
+    });
 
-    test.done();
-  },
 
-  'configures userdata with powershell if windows machine image is specified'(test: Test) {
+  });
+
+  test('configures userdata with powershell if windows machine image is specified', () => {
     // GIVEN
     const stack = new cdk.Stack();
     const vpc = new ec2.Vpc(stack, 'MyVpc', {});
@@ -773,7 +766,7 @@ nodeunitShim({
     });
 
     // THEN
-    expect(stack).to(haveResource('AWS::AutoScaling::LaunchConfiguration', {
+    expect(stack).toHaveResource('AWS::AutoScaling::LaunchConfiguration', {
       ImageId: {
         Ref: 'SsmParameterValueawsserviceecsoptimizedamiwindowsserver2019englishfullrecommendedimageidC96584B6F00A464EAD1953AFF4B05118Parameter',
       },
@@ -807,15 +800,15 @@ nodeunitShim({
           ],
         },
       },
-    }));
+    });
 
-    test.done();
-  },
+
+  });
 
   /*
    * TODO:v2.0.0 BEGINNING OF OBSOLETE BLOCK
    */
-  'allows specifying special HW AMI Type'(test: Test) {
+  test('allows specifying special HW AMI Type', () => {
     // GIVEN
     const app = new cdk.App();
     const stack = new cdk.Stack(app, 'test');
@@ -832,23 +825,23 @@ nodeunitShim({
     // THEN
     const assembly = app.synth();
     const template = assembly.getStackByName(stack.stackName).template;
-    expect(stack).to(haveResource('AWS::AutoScaling::LaunchConfiguration', {
+    expect(stack).toHaveResource('AWS::AutoScaling::LaunchConfiguration', {
       ImageId: {
         Ref: 'SsmParameterValueawsserviceecsoptimizedamiamazonlinux2gpurecommendedimageidC96584B6F00A464EAD1953AFF4B05118Parameter',
       },
-    }));
+    });
 
-    test.deepEqual(template.Parameters, {
+    expect(template.Parameters).toEqual({
       SsmParameterValueawsserviceecsoptimizedamiamazonlinux2gpurecommendedimageidC96584B6F00A464EAD1953AFF4B05118Parameter: {
         Type: 'AWS::SSM::Parameter::Value<AWS::EC2::Image::Id>',
         Default: '/aws/service/ecs/optimized-ami/amazon-linux-2/gpu/recommended/image_id',
       },
     });
 
-    test.done();
-  },
 
-  'errors if amazon linux given with special HW type'(test: Test) {
+  });
+
+  test('errors if amazon linux given with special HW type', () => {
     // GIVEN
     const stack = new cdk.Stack();
     const vpc = new ec2.Vpc(stack, 'MyVpc', {});
@@ -856,7 +849,7 @@ nodeunitShim({
     const cluster = new ecs.Cluster(stack, 'EcsCluster', { vpc });
 
     // THEN
-    test.throws(() => {
+    expect(() => {
       cluster.addCapacity('GpuAutoScalingGroup', {
         instanceType: new ec2.InstanceType('t2.micro'),
         machineImage: new ecs.EcsOptimizedAmi({
@@ -864,12 +857,12 @@ nodeunitShim({
           hardwareType: ecs.AmiHardwareType.GPU,
         }),
       });
-    }, /Amazon Linux does not support special hardware type/);
+    }).toThrow(/Amazon Linux does not support special hardware type/);
+
 
-    test.done();
-  },
+  });
 
-  'allows specifying windows image'(test: Test) {
+  test('allows specifying windows image', () => {
     // GIVEN
     const app = new cdk.App();
     const stack = new cdk.Stack(app, 'test');
@@ -886,17 +879,17 @@ nodeunitShim({
     // THEN
     const assembly = app.synth();
     const template = assembly.getStackByName(stack.stackName).template;
-    test.deepEqual(template.Parameters, {
+    expect(template.Parameters).toEqual({
       SsmParameterValueawsserviceecsoptimizedamiwindowsserver2019englishfullrecommendedimageidC96584B6F00A464EAD1953AFF4B05118Parameter: {
         Type: 'AWS::SSM::Parameter::Value<AWS::EC2::Image::Id>',
         Default: '/aws/service/ecs/optimized-ami/windows_server/2019/english/full/recommended/image_id',
       },
     });
 
-    test.done();
-  },
 
-  'errors if windows given with special HW type'(test: Test) {
+  });
+
+  test('errors if windows given with special HW type', () => {
     // GIVEN
     const stack = new cdk.Stack();
     const vpc = new ec2.Vpc(stack, 'MyVpc', {});
@@ -904,7 +897,7 @@ nodeunitShim({
     const cluster = new ecs.Cluster(stack, 'EcsCluster', { vpc });
 
     // THEN
-    test.throws(() => {
+    expect(() => {
       cluster.addCapacity('WindowsGpuAutoScalingGroup', {
         instanceType: new ec2.InstanceType('t2.micro'),
         machineImage: new ecs.EcsOptimizedAmi({
@@ -912,12 +905,12 @@ nodeunitShim({
           hardwareType: ecs.AmiHardwareType.GPU,
         }),
       });
-    }, /Windows Server does not support special hardware type/);
+    }).toThrow(/Windows Server does not support special hardware type/);
+
 
-    test.done();
-  },
+  });
 
-  'errors if windowsVersion and linux generation are set'(test: Test) {
+  test('errors if windowsVersion and linux generation are set', () => {
     // GIVEN
     const stack = new cdk.Stack();
     const vpc = new ec2.Vpc(stack, 'MyVpc', {});
@@ -925,7 +918,7 @@ nodeunitShim({
     const cluster = new ecs.Cluster(stack, 'EcsCluster', { vpc });
 
     // THEN
-    test.throws(() => {
+    expect(() => {
       cluster.addCapacity('WindowsScalingGroup', {
         instanceType: new ec2.InstanceType('t2.micro'),
         machineImage: new ecs.EcsOptimizedAmi({
@@ -933,93 +926,93 @@ nodeunitShim({
           generation: ec2.AmazonLinuxGeneration.AMAZON_LINUX,
         }),
       });
-    }, /"windowsVersion" and Linux image "generation" cannot be both set/);
+    }).toThrow(/"windowsVersion" and Linux image "generation" cannot be both set/);
 
-    test.done();
-  },
 
-  'allows returning the correct image for windows for EcsOptimizedAmi'(test: Test) {
+  });
+
+  test('allows returning the correct image for windows for EcsOptimizedAmi', () => {
     // GIVEN
     const stack = new cdk.Stack();
     const ami = new ecs.EcsOptimizedAmi({
       windowsVersion: ecs.WindowsOptimizedVersion.SERVER_2019,
     });
 
-    test.equal(ami.getImage(stack).osType, ec2.OperatingSystemType.WINDOWS);
+    expect(ami.getImage(stack).osType).toEqual(ec2.OperatingSystemType.WINDOWS);
+
 
-    test.done();
-  },
+  });
 
-  'allows returning the correct image for linux for EcsOptimizedAmi'(test: Test) {
+  test('allows returning the correct image for linux for EcsOptimizedAmi', () => {
     // GIVEN
     const stack = new cdk.Stack();
     const ami = new ecs.EcsOptimizedAmi({
       generation: ec2.AmazonLinuxGeneration.AMAZON_LINUX,
     });
 
-    test.equal(ami.getImage(stack).osType, ec2.OperatingSystemType.LINUX);
+    expect(ami.getImage(stack).osType).toEqual(ec2.OperatingSystemType.LINUX);
 
-    test.done();
-  },
 
-  'allows returning the correct image for linux 2 for EcsOptimizedAmi'(test: Test) {
+  });
+
+  test('allows returning the correct image for linux 2 for EcsOptimizedAmi', () => {
     // GIVEN
     const stack = new cdk.Stack();
     const ami = new ecs.EcsOptimizedAmi({
       generation: ec2.AmazonLinuxGeneration.AMAZON_LINUX_2,
     });
 
-    test.equal(ami.getImage(stack).osType, ec2.OperatingSystemType.LINUX);
+    expect(ami.getImage(stack).osType).toEqual(ec2.OperatingSystemType.LINUX);
+
 
-    test.done();
-  },
+  });
 
-  'allows returning the correct image for linux for EcsOptimizedImage'(test: Test) {
+  test('allows returning the correct image for linux for EcsOptimizedImage', () => {
     // GIVEN
     const stack = new cdk.Stack();
 
-    test.equal(ecs.EcsOptimizedImage.amazonLinux().getImage(stack).osType,
+    expect(ecs.EcsOptimizedImage.amazonLinux().getImage(stack).osType).toEqual(
       ec2.OperatingSystemType.LINUX);
 
-    test.done();
-  },
 
-  'allows returning the correct image for linux 2 for EcsOptimizedImage'(test: Test) {
+  });
+
+  test('allows returning the correct image for linux 2 for EcsOptimizedImage', () => {
     // GIVEN
     const stack = new cdk.Stack();
 
-    test.equal(ecs.EcsOptimizedImage.amazonLinux2().getImage(stack).osType,
+    expect(ecs.EcsOptimizedImage.amazonLinux2().getImage(stack).osType).toEqual(
       ec2.OperatingSystemType.LINUX);
 
-    test.done();
-  },
 
-  'allows returning the correct image for linux 2 for EcsOptimizedImage with ARM hardware'(test: Test) {
+  });
+
+  test('allows returning the correct image for linux 2 for EcsOptimizedImage with ARM hardware', () => {
     // GIVEN
     const stack = new cdk.Stack();
 
-    test.equal(ecs.EcsOptimizedImage.amazonLinux2(ecs.AmiHardwareType.ARM).getImage(stack).osType,
+    expect(ecs.EcsOptimizedImage.amazonLinux2(ecs.AmiHardwareType.ARM).getImage(stack).osType).toEqual(
       ec2.OperatingSystemType.LINUX);
 
-    test.done();
-  },
 
+  });
 
-  'allows returning the correct image for windows for EcsOptimizedImage'(test: Test) {
+
+  test('allows returning the correct image for windows for EcsOptimizedImage', () => {
     // GIVEN
     const stack = new cdk.Stack();
 
-    test.equal(ecs.EcsOptimizedImage.windows(ecs.WindowsOptimizedVersion.SERVER_2019).getImage(stack).osType,
+    expect(ecs.EcsOptimizedImage.windows(ecs.WindowsOptimizedVersion.SERVER_2019).getImage(stack).osType).toEqual(
       ec2.OperatingSystemType.WINDOWS);
 
-    test.done();
-  },
+
+  });
 
   /*
    * TODO:v2.0.0 END OF OBSOLETE BLOCK
    */
 
-  'allows specifying special HW AMI Type v2'(test: Test) {
+  test('allows specifying special HW AMI Type v2', () => {
     // GIVEN
     const app = new cdk.App();
     const stack = new cdk.Stack(app, 'test');
@@ -1034,23 +1027,23 @@ nodeunitShim({
     // THEN
     const assembly = app.synth();
     const template = assembly.getStackByName(stack.stackName).template;
-    expect(stack).to(haveResource('AWS::AutoScaling::LaunchConfiguration', {
+    expect(stack).toHaveResource('AWS::AutoScaling::LaunchConfiguration', {
       ImageId: {
         Ref: 'SsmParameterValueawsserviceecsoptimizedamiamazonlinux2gpurecommendedimageidC96584B6F00A464EAD1953AFF4B05118Parameter',
       },
-    }));
+    });
 
-    test.deepEqual(template.Parameters, {
+    expect(template.Parameters).toEqual({
       SsmParameterValueawsserviceecsoptimizedamiamazonlinux2gpurecommendedimageidC96584B6F00A464EAD1953AFF4B05118Parameter: {
         Type: 'AWS::SSM::Parameter::Value<AWS::EC2::Image::Id>',
         Default: '/aws/service/ecs/optimized-ami/amazon-linux-2/gpu/recommended/image_id',
       },
     });
 
-    test.done();
-  },
 
-  'allows specifying Amazon Linux v1 AMI'(test: Test) {
+  });
+
+  test('allows specifying Amazon Linux v1 AMI', () => {
     // GIVEN
     const app = new cdk.App();
     const stack = new cdk.Stack(app, 'test');
@@ -1065,23 +1058,23 @@ nodeunitShim({
     // THEN
     const assembly = app.synth();
     const template = assembly.getStackByName(stack.stackName).template;
-    expect(stack).to(haveResource('AWS::AutoScaling::LaunchConfiguration', {
+    expect(stack).toHaveResource('AWS::AutoScaling::LaunchConfiguration', {
       ImageId: {
         Ref: 'SsmParameterValueawsserviceecsoptimizedamiamazonlinuxrecommendedimageidC96584B6F00A464EAD1953AFF4B05118Parameter',
       },
-    }));
+    });
 
-    test.deepEqual(template.Parameters, {
+    expect(template.Parameters).toEqual({
       SsmParameterValueawsserviceecsoptimizedamiamazonlinuxrecommendedimageidC96584B6F00A464EAD1953AFF4B05118Parameter: {
         Type: 'AWS::SSM::Parameter::Value<AWS::EC2::Image::Id>',
         Default: '/aws/service/ecs/optimized-ami/amazon-linux/recommended/image_id',
       },
     });
 
-    test.done();
-  },
 
-  'allows specifying windows image v2'(test: Test) {
+  });
+
+  test('allows specifying windows image v2', () => {
     // GIVEN
     const app = new cdk.App();
     const stack = new cdk.Stack(app, 'test');
@@ -1096,17 +1089,17 @@ nodeunitShim({
     // THEN
     const assembly = app.synth();
     const template = assembly.getStackByName(stack.stackName).template;
-    test.deepEqual(template.Parameters, {
+    expect(template.Parameters).toEqual({
       SsmParameterValueawsserviceecsoptimizedamiwindowsserver2019englishfullrecommendedimageidC96584B6F00A464EAD1953AFF4B05118Parameter: {
         Type: 'AWS::SSM::Parameter::Value<AWS::EC2::Image::Id>',
         Default: '/aws/service/ecs/optimized-ami/windows_server/2019/english/full/recommended/image_id',
       },
     });
 
-    test.done();
-  },
 
-  'allows specifying spot fleet'(test: Test) {
+  });
+
+  test('allows specifying spot fleet', () => {
     // GIVEN
     const stack = new cdk.Stack();
     const vpc = new ec2.Vpc(stack, 'MyVpc', {});
@@ -1118,14 +1111,14 @@ nodeunitShim({
     });
 
     // THEN
-    expect(stack).to(haveResource('AWS::AutoScaling::LaunchConfiguration', {
+    expect(stack).toHaveResource('AWS::AutoScaling::LaunchConfiguration', {
       SpotPrice: '0.31',
-    }));
+    });
 
-    test.done();
-  },
 
-  'allows specifying drain time'(test: Test) {
+  });
+
+  test('allows specifying drain time', () => {
     // GIVEN
     const stack = new cdk.Stack();
     const vpc = new ec2.Vpc(stack, 'MyVpc', {});
@@ -1137,14 +1130,14 @@ nodeunitShim({
     });
 
     // THEN
-    expect(stack).to(haveResource('AWS::AutoScaling::LifecycleHook', {
+    expect(stack).toHaveResource('AWS::AutoScaling::LifecycleHook', {
       HeartbeatTimeout: 60,
-    }));
+    });
+
 
-    test.done();
-  },
+  });
 
-  'allows specifying automated spot draining'(test: Test) {
+  test('allows specifying automated spot draining', () => {
     // GIVEN
     const stack = new cdk.Stack();
     const vpc = new ec2.Vpc(stack, 'MyVpc', {});
@@ -1157,7 +1150,7 @@ nodeunitShim({
     });
 
     // THEN
-    expect(stack).to(haveResource('AWS::AutoScaling::LaunchConfiguration', {
+    expect(stack).toHaveResource('AWS::AutoScaling::LaunchConfiguration', {
       UserData: {
         'Fn::Base64': {
           'Fn::Join': [
@@ -1172,12 +1165,12 @@ nodeunitShim({
           ],
         },
       },
-    }));
+    });
+
 
-    test.done();
-  },
+  });
 
-  'allows containers access to instance metadata service'(test: Test) {
+  test('allows containers access to instance metadata service', () => {
     // GIVEN
     const stack = new cdk.Stack();
     const vpc = new ec2.Vpc(stack, 'MyVpc', {});
@@ -1189,7 +1182,7 @@ nodeunitShim({
     });
 
     // THEN
-    expect(stack).to(haveResource('AWS::AutoScaling::LaunchConfiguration', {
+    expect(stack).toHaveResource('AWS::AutoScaling::LaunchConfiguration', {
       UserData: {
         'Fn::Base64': {
           'Fn::Join': [
@@ -1204,12 +1197,12 @@ nodeunitShim({
           ],
         },
       },
-    }));
+    });
+
 
-    test.done();
-  },
+  });
 
-  'allows adding default service discovery namespace'(test: Test) {
+  test('allows adding default service discovery namespace', () => {
     // GIVEN
     const stack = new cdk.Stack();
     const vpc = new ec2.Vpc(stack, 'MyVpc', {});
@@ -1225,17 +1218,17 @@ nodeunitShim({
     });
 
     // THEN
-    expect(stack).to(haveResource('AWS::ServiceDiscovery::PrivateDnsNamespace', {
+    expect(stack).toHaveResource('AWS::ServiceDiscovery::PrivateDnsNamespace', {
       Name: 'foo.com',
       Vpc: {
         Ref: 'MyVpcF9F0CA6F',
       },
-    }));
+    });
+
 
-    test.done();
-  },
+  });
 
-  'allows adding public service discovery namespace'(test: Test) {
+  test('allows adding public service discovery namespace', () => {
     // GIVEN
     const stack = new cdk.Stack();
     const vpc = new ec2.Vpc(stack, 'MyVpc', {});
@@ -1252,16 +1245,16 @@ nodeunitShim({
     });
 
     // THEN
-    expect(stack).to(haveResource('AWS::ServiceDiscovery::PublicDnsNamespace', {
+    expect(stack).toHaveResource('AWS::ServiceDiscovery::PublicDnsNamespace', {
       Name: 'foo.com',
-    }));
+    });
+
+    expect(cluster.defaultCloudMapNamespace!.type).toEqual(cloudmap.NamespaceType.DNS_PUBLIC);
 
-    test.equal(cluster.defaultCloudMapNamespace!.type, cloudmap.NamespaceType.DNS_PUBLIC);
 
-    test.done();
-  },
+  });
 
-  'throws if default service discovery namespace added more than once'(test: Test) {
+  test('throws if default service discovery namespace added more than once', () => {
     // GIVEN
     const stack = new cdk.Stack();
     const vpc = new ec2.Vpc(stack, 'MyVpc', {});
@@ -1277,16 +1270,16 @@ nodeunitShim({
     });
 
     // THEN
-    test.throws(() => {
+    expect(() => {
       cluster.addDefaultCloudMapNamespace({
         name: 'foo.com',
       });
-    }, /Can only add default namespace once./);
+    }).toThrow(/Can only add default namespace once./);
 
-    test.done();
-  },
 
-  'export/import of a cluster with a namespace'(test: Test) {
+  });
+
+  test('export/import of a cluster with a namespace', () => {
     // GIVEN
     const stack1 = new cdk.Stack();
     const vpc1 = new ec2.Vpc(stack1, 'Vpc');
@@ -1310,16 +1303,16 @@ nodeunitShim({
     });
 
     // THEN
-    test.equal(cluster2.defaultCloudMapNamespace!.type, cloudmap.NamespaceType.DNS_PRIVATE);
-    test.deepEqual(stack2.resolve(cluster2.defaultCloudMapNamespace!.namespaceId), 'import-namespace-id');
+    expect(cluster2.defaultCloudMapNamespace!.type).toEqual(cloudmap.NamespaceType.DNS_PRIVATE);
+    expect(stack2.resolve(cluster2.defaultCloudMapNamespace!.namespaceId)).toEqual('import-namespace-id');
 
     // Can retrieve subnets from VPC - will throw 'There are no 'Private' subnets in this VPC. Use a different VPC subnet selection.' if broken.
     cluster2.vpc.selectSubnets();
 
-    test.done();
-  },
 
-  'imported cluster with imported security groups honors allowAllOutbound'(test: Test) {
+  });
+
+  test('imported cluster with imported security groups honors allowAllOutbound', () => {
     // GIVEN
     const stack = new cdk.Stack();
     const vpc = new ec2.Vpc(stack, 'Vpc');
@@ -1337,16 +1330,16 @@ nodeunitShim({
     cluster.connections.allowToAnyIpv4(ec2.Port.tcp(443));
 
     // THEN
-    expect(stack).to(haveResource('AWS::EC2::SecurityGroupEgress', {
+    expect(stack).toHaveResource('AWS::EC2::SecurityGroupEgress', {
       GroupId: 'sg-1',
-    }));
+    });
+
+    expect(stack).toCountResources('AWS::EC2::SecurityGroupEgress', 1);
 
-    expect(stack).to(countResources('AWS::EC2::SecurityGroupEgress', 1));
 
-    test.done();
-  },
+  });
 
-  'Metric'(test: Test) {
+  test('Metric', () => {
     // GIVEN
     const stack = new cdk.Stack();
     const vpc = new ec2.Vpc(stack, 'MyVpc', {});
@@ -1354,7 +1347,7 @@ nodeunitShim({
     const cluster = new ecs.Cluster(stack, 'EcsCluster', { vpc });
 
     // THEN
-    test.deepEqual(stack.resolve(cluster.metricCpuReservation()), {
+    expect(stack.resolve(cluster.metricCpuReservation())).toEqual({
       dimensions: {
         ClusterName: { Ref: 'EcsCluster97242B84' },
       },
@@ -1364,7 +1357,7 @@ nodeunitShim({
       statistic: 'Average',
     });
 
-    test.deepEqual(stack.resolve(cluster.metricMemoryReservation()), {
+    expect(stack.resolve(cluster.metricMemoryReservation())).toEqual({
       dimensions: {
         ClusterName: { Ref: 'EcsCluster97242B84' },
       },
@@ -1374,7 +1367,7 @@ nodeunitShim({
       statistic: 'Average',
     });
 
-    test.deepEqual(stack.resolve(cluster.metric('myMetric')), {
+    expect(stack.resolve(cluster.metric('myMetric'))).toEqual({
       dimensions: {
         ClusterName: { Ref: 'EcsCluster97242B84' },
       },
@@ -1384,10 +1377,10 @@ nodeunitShim({
       statistic: 'Average',
     });
 
-    test.done();
-  },
 
-  'ASG with a public VPC without NAT Gateways'(test: Test) {
+  });
+
+  test('ASG with a public VPC without NAT Gateways', () => {
     // GIVEN
     const stack = new cdk.Stack();
     const vpc = new ec2.Vpc(stack, 'MyPublicVpc', {
@@ -1409,9 +1402,9 @@ nodeunitShim({
       },
     });
 
-    expect(stack).to(haveResource('AWS::ECS::Cluster'));
+    expect(stack).toHaveResource('AWS::ECS::Cluster');
 
-    expect(stack).to(haveResource('AWS::EC2::VPC', {
+    expect(stack).toHaveResource('AWS::EC2::VPC', {
       CidrBlock: '10.0.0.0/16',
       EnableDnsHostnames: true,
       EnableDnsSupport: true,
@@ -1422,9 +1415,9 @@ nodeunitShim({
           Value: 'Default/MyPublicVpc',
         },
       ],
-    }));
+    });
 
-    expect(stack).to(haveResource('AWS::AutoScaling::LaunchConfiguration', {
+    expect(stack).toHaveResource('AWS::AutoScaling::LaunchConfiguration', {
       ImageId: {
         Ref: 'SsmParameterValueawsserviceecsoptimizedamiamazonlinux2recommendedimageidC96584B6F00A464EAD1953AFF4B05118Parameter',
       },
@@ -1456,9 +1449,9 @@ nodeunitShim({
           ],
         },
       },
-    }));
+    });
 
-    expect(stack).to(haveResource('AWS::AutoScaling::AutoScalingGroup', {
+    expect(stack).toHaveResource('AWS::AutoScaling::AutoScalingGroup', {
       MaxSize: '1',
       MinSize: '1',
       LaunchConfigurationName: {
@@ -1479,9 +1472,9 @@ nodeunitShim({
           Ref: 'MyPublicVpcingressSubnet2SubnetD2F2E034',
         },
       ],
-    }));
+    });
 
-    expect(stack).to(haveResource('AWS::EC2::SecurityGroup', {
+    expect(stack).toHaveResource('AWS::EC2::SecurityGroup', {
       GroupDescription: 'Default/EcsCluster/DefaultAutoScalingGroup/InstanceSecurityGroup',
       SecurityGroupEgress: [
         {
@@ -1499,13 +1492,13 @@ nodeunitShim({
       VpcId: {
         Ref: 'MyPublicVpcA2BF6CDA',
       },
-    }));
+    });
 
     // THEN
-    test.done();
-  },
 
-  'enable container insights'(test: Test) {
+  });
+
+  test('enable container insights', () => {
     // GIVEN
     const app = new cdk.App();
     const stack = new cdk.Stack(app, 'test');
@@ -1513,19 +1506,19 @@ nodeunitShim({
     new ecs.Cluster(stack, 'EcsCluster', { containerInsights: true });
 
     // THEN
-    expect(stack).to(haveResource('AWS::ECS::Cluster', {
+    expect(stack).toHaveResource('AWS::ECS::Cluster', {
       ClusterSettings: [
         {
           Name: 'containerInsights',
           Value: 'enabled',
         },
       ],
-    }, ResourcePart.Properties));
+    });
+
 
-    test.done();
-  },
+  });
 
-  'disable container insights'(test: Test) {
+  test('disable container insights', () => {
     // GIVEN
     const app = new cdk.App();
     const stack = new cdk.Stack(app, 'test');
@@ -1533,19 +1526,19 @@ nodeunitShim({
     new ecs.Cluster(stack, 'EcsCluster', { containerInsights: false });
 
     // THEN
-    expect(stack).to(haveResource('AWS::ECS::Cluster', {
+    expect(stack).toHaveResource('AWS::ECS::Cluster', {
       ClusterSettings: [
         {
           Name: 'containerInsights',
           Value: 'disabled',
         },
       ],
-    }, ResourcePart.Properties));
+    });
+
 
-    test.done();
-  },
+  });
 
-  'default container insights is undefined'(test: Test) {
+  test('default container insights is undefined', () => {
     // GIVEN
     const app = new cdk.App();
     const stack = new cdk.Stack(app, 'test');
@@ -1557,17 +1550,15 @@ nodeunitShim({
     const stackAssembly = assembly.getStackByName(stack.stackName);
     const template = stackAssembly.template;
 
-    test.equal(
+    expect(
       template.Resources.EcsCluster97242B84.Properties === undefined ||
       template.Resources.EcsCluster97242B84.Properties.ClusterSettings === undefined,
-      true,
-      'ClusterSettings should not be defined',
-    );
+    ).toEqual(true);
 
-    test.done();
-  },
 
-  'BottleRocketImage() returns correct AMI'(test: Test) {
+  });
+
+  test('BottleRocketImage() returns correct AMI', () => {
     // GIVEN
     const app = new cdk.App();
     const stack = new cdk.Stack(app, 'test');
@@ -1578,18 +1569,18 @@ nodeunitShim({
     // THEN
     const assembly = app.synth();
     const parameters = assembly.getStackByName(stack.stackName).template.Parameters;
-    test.ok(Object.entries(parameters).some(
+    expect(Object.entries(parameters).some(
       ([k, v]) => k.startsWith('SsmParameterValueawsservicebottlerocketawsecs') &&
         (v as any).Default.includes('/bottlerocket/'),
-    ), 'Bottlerocket AMI should be in ssm parameters');
-    test.ok(Object.entries(parameters).some(
+    )).toEqual(true);
+    expect(Object.entries(parameters).some(
       ([k, v]) => k.startsWith('SsmParameterValueawsservicebottlerocketawsecs') &&
         (v as any).Default.includes('/aws-ecs-1/'),
-    ), 'ecs variant should be in ssm parameters');
-    test.done();
-  },
+    )).toEqual(true);
+
+  });
 
-  'cluster capacity with bottlerocket AMI, by setting machineImageType'(test: Test) {
+  test('cluster capacity with bottlerocket AMI, by setting machineImageType', () => {
     // GIVEN
     const app = new cdk.App();
     const stack = new cdk.Stack(app, 'test');
@@ -1601,9 +1592,9 @@ nodeunitShim({
     });
 
     // THEN
-    expect(stack).to(haveResource('AWS::ECS::Cluster'));
-    expect(stack).to(haveResource('AWS::AutoScaling::AutoScalingGroup'));
-    expect(stack).to(haveResource('AWS::AutoScaling::LaunchConfiguration', {
+    expect(stack).toHaveResource('AWS::ECS::Cluster');
+    expect(stack).toHaveResource('AWS::AutoScaling::AutoScalingGroup');
+    expect(stack).toHaveResource('AWS::AutoScaling::LaunchConfiguration', {
       ImageId: {
         Ref: 'SsmParameterValueawsservicebottlerocketawsecs1x8664latestimageidC96584B6F00A464EAD1953AFF4B05118Parameter',
       },
@@ -1621,8 +1612,8 @@ nodeunitShim({
           ],
         },
       },
-    }));
-    expect(stack).to(haveResourceLike('AWS::IAM::Role', {
+    });
+    expect(stack).toHaveResourceLike('AWS::IAM::Role', {
       AssumeRolePolicyDocument: {
         Statement: [
           {
@@ -1677,12 +1668,11 @@ nodeunitShim({
           Value: 'test/EcsCluster/bottlerocket-asg',
         },
       ],
-    }),
-    );
-    test.done();
-  },
+    });
 
-  'correct bottlerocket AMI for ARM64 architecture'(test: Test) {
+  });
+
+  test('correct bottlerocket AMI for ARM64 architecture', () => {
     // GIVEN
     const app = new cdk.App();
     const stack = new cdk.Stack(app, 'test');
@@ -1694,24 +1684,24 @@ nodeunitShim({
     });
 
     // THEN
-    expect(stack).to(haveResource('AWS::AutoScaling::LaunchConfiguration', {
+    expect(stack).toHaveResource('AWS::AutoScaling::LaunchConfiguration', {
       ImageId: {
         Ref: 'SsmParameterValueawsservicebottlerocketawsecs1arm64latestimageidC96584B6F00A464EAD1953AFF4B05118Parameter',
       },
-    }));
+    });
 
     const assembly = app.synth();
     const template = assembly.getStackByName(stack.stackName).template;
-    test.deepEqual(template.Parameters, {
+    expect(template.Parameters).toEqual({
       SsmParameterValueawsservicebottlerocketawsecs1arm64latestimageidC96584B6F00A464EAD1953AFF4B05118Parameter: {
         Type: 'AWS::SSM::Parameter::Value<String>',
         Default: '/aws/service/bottlerocket/aws-ecs-1/arm64/latest/image_id',
       },
     });
-    test.done();
-  },
 
-  'throws when machineImage and machineImageType both specified'(test: Test) {
+  });
+
+  test('throws when machineImage and machineImageType both specified', () => {
     // GIVEN
     const app = new cdk.App();
     const stack = new cdk.Stack(app, 'test');
@@ -1723,7 +1713,7 @@ nodeunitShim({
     });
 
     // THEN
-    expect(stack).to(haveResourceLike('AWS::AutoScaling::LaunchConfiguration', {
+    expect(stack).toHaveResourceLike('AWS::AutoScaling::LaunchConfiguration', {
       UserData: {
         'Fn::Base64': {
           'Fn::Join': [
@@ -1738,11 +1728,11 @@ nodeunitShim({
           ],
         },
       },
-    }));
-    test.done();
-  },
+    });
 
-  'allows specifying capacityProviders (deprecated)'(test: Test) {
+  });
+
+  test('allows specifying capacityProviders (deprecated)', () => {
     // GIVEN
     const app = new cdk.App();
     const stack = new cdk.Stack(app, 'test');
@@ -1751,18 +1741,18 @@ nodeunitShim({
     new ecs.Cluster(stack, 'EcsCluster', { capacityProviders: ['FARGATE_SPOT'] });
 
     // THEN
-    expect(stack).to(haveResource('AWS::ECS::Cluster', {
+    expect(stack).toHaveResource('AWS::ECS::Cluster', {
       CapacityProviders: ABSENT,
-    }));
+    });
 
-    expect(stack).to(haveResource('AWS::ECS::ClusterCapacityProviderAssociations', {
+    expect(stack).toHaveResource('AWS::ECS::ClusterCapacityProviderAssociations', {
       CapacityProviders: ['FARGATE_SPOT'],
-    }));
+    });
+
 
-    test.done();
-  },
+  });
 
-  'allows specifying Fargate capacityProviders'(test: Test) {
+  test('allows specifying Fargate capacityProviders', () => {
     // GIVEN
     const app = new cdk.App();
     const stack = new cdk.Stack(app, 'test');
@@ -1773,18 +1763,18 @@ nodeunitShim({
     });
 
     // THEN
-    expect(stack).to(haveResource('AWS::ECS::Cluster', {
+    expect(stack).toHaveResource('AWS::ECS::Cluster', {
       CapacityProviders: ABSENT,
-    }));
+    });
 
-    expect(stack).to(haveResource('AWS::ECS::ClusterCapacityProviderAssociations', {
+    expect(stack).toHaveResource('AWS::ECS::ClusterCapacityProviderAssociations', {
       CapacityProviders: ['FARGATE', 'FARGATE_SPOT'],
-    }));
+    });
 
-    test.done();
-  },
 
-  'allows specifying capacityProviders (alternate method)'(test: Test) {
+  });
+
+  test('allows specifying capacityProviders (alternate method)', () => {
     // GIVEN
     const app = new cdk.App();
     const stack = new cdk.Stack(app, 'test');
@@ -1794,18 +1784,18 @@ nodeunitShim({
     cluster.enableFargateCapacityProviders();
 
     // THEN
-    expect(stack).to(haveResource('AWS::ECS::Cluster', {
+    expect(stack).toHaveResource('AWS::ECS::Cluster', {
       CapacityProviders: ABSENT,
-    }));
+    });
 
-    expect(stack).to(haveResource('AWS::ECS::ClusterCapacityProviderAssociations', {
+    expect(stack).toHaveResource('AWS::ECS::ClusterCapacityProviderAssociations', {
       CapacityProviders: ['FARGATE', 'FARGATE_SPOT'],
-    }));
+    });
+
 
-    test.done();
-  },
+  });
 
-  'allows adding capacityProviders post-construction (deprecated)'(test: Test) {
+  test('allows adding capacityProviders post-construction (deprecated)', () => {
     // GIVEN
     const app = new cdk.App();
     const stack = new cdk.Stack(app, 'test');
@@ -1816,18 +1806,18 @@ nodeunitShim({
     cluster.addCapacityProvider('FARGATE'); // does not add twice
 
     // THEN
-    expect(stack).to(haveResource('AWS::ECS::Cluster', {
+    expect(stack).toHaveResource('AWS::ECS::Cluster', {
       CapacityProviders: ABSENT,
-    }));
+    });
 
-    expect(stack).to(haveResource('AWS::ECS::ClusterCapacityProviderAssociations', {
+    expect(stack).toHaveResource('AWS::ECS::ClusterCapacityProviderAssociations', {
       CapacityProviders: ['FARGATE'],
-    }));
+    });
 
-    test.done();
-  },
 
-  'allows adding capacityProviders post-construction'(test: Test) {
+  });
+
+  test('allows adding capacityProviders post-construction', () => {
     // GIVEN
     const app = new cdk.App();
     const stack = new cdk.Stack(app, 'test');
@@ -1838,32 +1828,32 @@ nodeunitShim({
     cluster.addCapacityProvider('FARGATE'); // does not add twice
 
     // THEN
-    expect(stack).to(haveResource('AWS::ECS::Cluster', {
+    expect(stack).toHaveResource('AWS::ECS::Cluster', {
       CapacityProviders: ABSENT,
-    }));
+    });
 
-    expect(stack).to(haveResource('AWS::ECS::ClusterCapacityProviderAssociations', {
+    expect(stack).toHaveResource('AWS::ECS::ClusterCapacityProviderAssociations', {
       CapacityProviders: ['FARGATE'],
-    }));
+    });
+
 
-    test.done();
-  },
+  });
 
-  'throws for unsupported capacity providers'(test: Test) {
+  test('throws for unsupported capacity providers', () => {
     // GIVEN
     const app = new cdk.App();
     const stack = new cdk.Stack(app, 'test');
     const cluster = new ecs.Cluster(stack, 'EcsCluster');
 
     // THEN
-    test.throws(() => {
+    expect(() => {
       cluster.addCapacityProvider('HONK');
-    }, /CapacityProvider not supported/);
+    }).toThrow(/CapacityProvider not supported/);
 
-    test.done();
-  },
 
-  'creates ASG capacity providers with expected defaults'(test: Test) {
+  });
+
+  test('creates ASG capacity providers with expected defaults', () => {
     // GIVEN
     const app = new cdk.App();
     const stack = new cdk.Stack(app, 'test');
@@ -1880,7 +1870,7 @@ nodeunitShim({
     });
 
     // THEN
-    expect(stack).to(haveResource('AWS::ECS::CapacityProvider', {
+    expect(stack).toHaveResource('AWS::ECS::CapacityProvider', {
       AutoScalingGroupProvider: {
         AutoScalingGroupArn: {
           Ref: 'asgASG4D014670',
@@ -1891,11 +1881,11 @@ nodeunitShim({
         },
         ManagedTerminationProtection: 'ENABLED',
       },
-    }));
-    test.done();
-  },
+    });
 
-  'can disable managed scaling for ASG capacity provider'(test: Test) {
+  });
+
+  test('can disable managed scaling for ASG capacity provider', () => {
     // GIVEN
     const app = new cdk.App();
     const stack = new cdk.Stack(app, 'test');
@@ -1913,7 +1903,7 @@ nodeunitShim({
     });
 
     // THEN
-    expect(stack).to(haveResource('AWS::ECS::CapacityProvider', {
+    expect(stack).toHaveResource('AWS::ECS::CapacityProvider', {
       AutoScalingGroupProvider: {
         AutoScalingGroupArn: {
           Ref: 'asgASG4D014670',
@@ -1921,11 +1911,11 @@ nodeunitShim({
         ManagedScaling: ABSENT,
         ManagedTerminationProtection: 'ENABLED',
       },
-    }));
-    test.done();
-  },
+    });
 
-  'capacity provider enables ASG new instance scale-in protection by default'(test: Test) {
+  });
+
+  test('capacity provider enables ASG new instance scale-in protection by default', () => {
     // GIVEN
     const app = new cdk.App();
     const stack = new cdk.Stack(app, 'test');
@@ -1942,13 +1932,13 @@ nodeunitShim({
     });
 
     // THEN
-    expect(stack).to(haveResource('AWS::AutoScaling::AutoScalingGroup', {
+    expect(stack).toHaveResource('AWS::AutoScaling::AutoScalingGroup', {
       NewInstancesProtectedFromScaleIn: true,
-    }));
-    test.done();
-  },
+    });
 
-  'capacity provider disables ASG new instance scale-in protection'(test: Test) {
+  });
+
+  test('capacity provider disables ASG new instance scale-in protection', () => {
     // GIVEN
     const app = new cdk.App();
     const stack = new cdk.Stack(app, 'test');
@@ -1966,13 +1956,13 @@ nodeunitShim({
     });
 
     // THEN
-    expect(stack).notTo(haveResource('AWS::AutoScaling::AutoScalingGroup', {
+    expect(stack).not.toHaveResource('AWS::AutoScaling::AutoScalingGroup', {
       NewInstancesProtectedFromScaleIn: true,
-    }));
-    test.done();
-  },
+    });
 
-  'can add ASG capacity via Capacity Provider'(test: Test) {
+  });
+
+  test('can add ASG capacity via Capacity Provider', () => {
     // GIVEN
     const app = new cdk.App();
     const stack = new cdk.Stack(app, 'test');
@@ -1998,7 +1988,7 @@ nodeunitShim({
     cluster.addAsgCapacityProvider(capacityProvider);
 
     // THEN
-    expect(stack).to(haveResource('AWS::ECS::ClusterCapacityProviderAssociations', {
+    expect(stack).toHaveResource('AWS::ECS::ClusterCapacityProviderAssociations', {
       Cluster: {
         Ref: 'EcsCluster97242B84',
       },
@@ -2010,11 +2000,11 @@ nodeunitShim({
         },
       ],
       DefaultCapacityProviderStrategy: [],
-    }));
-    test.done();
-  },
+    });
 
-  'correctly sets log configuration for execute command'(test: Test) {
+  });
+
+  test('correctly sets log configuration for execute command', () => {
     // GIVEN
     const app = new cdk.App();
     const stack = new cdk.Stack(app, 'test');
@@ -2045,7 +2035,7 @@ nodeunitShim({
     });
 
     // THEN
-    expect(stack).to(haveResource('AWS::ECS::Cluster', {
+    expect(stack).toHaveResource('AWS::ECS::Cluster', {
       Configuration: {
         ExecuteCommandConfiguration: {
           KmsKeyId: {
@@ -2068,29 +2058,29 @@ nodeunitShim({
           Logging: 'OVERRIDE',
         },
       },
-    }));
+    });
 
-    test.done();
-  },
 
-  'throws when no log configuration is provided when logging is set to OVERRIDE'(test: Test) {
+  });
+
+  test('throws when no log configuration is provided when logging is set to OVERRIDE', () => {
     // GIVEN
     const app = new cdk.App();
     const stack = new cdk.Stack(app, 'test');
 
     // THEN
-    test.throws(() => {
+    expect(() => {
       new ecs.Cluster(stack, 'EcsCluster', {
         executeCommandConfiguration: {
           logging: ecs.ExecuteCommandLogging.OVERRIDE,
         },
       });
-    }, /Execute command log configuration must only be specified when logging is OVERRIDE./);
+    }).toThrow(/Execute command log configuration must only be specified when logging is OVERRIDE./);
+
 
-    test.done();
-  },
+  });
 
-  'throws when log configuration provided but logging is set to DEFAULT'(test: Test) {
+  test('throws when log configuration provided but logging is set to DEFAULT', () => {
     // GIVEN
     const app = new cdk.App();
     const stack = new cdk.Stack(app, 'test');
@@ -2098,7 +2088,7 @@ nodeunitShim({
     const logGroup = new logs.LogGroup(stack, 'LogGroup');
 
     // THEN
-    test.throws(() => {
+    expect(() => {
       new ecs.Cluster(stack, 'EcsCluster', {
         executeCommandConfiguration: {
           logConfiguration: {
@@ -2107,18 +2097,18 @@ nodeunitShim({
           logging: ecs.ExecuteCommandLogging.DEFAULT,
         },
       });
-    }, /Execute command log configuration must only be specified when logging is OVERRIDE./);
+    }).toThrow(/Execute command log configuration must only be specified when logging is OVERRIDE./);
 
-    test.done();
-  },
 
-  'throws when CloudWatchEncryptionEnabled without providing CloudWatch Logs log group name'(test: Test) {
+  });
+
+  test('throws when CloudWatchEncryptionEnabled without providing CloudWatch Logs log group name', () => {
     // GIVEN
     const app = new cdk.App();
     const stack = new cdk.Stack(app, 'test');
 
     // THEN
-    test.throws(() => {
+    expect(() => {
       new ecs.Cluster(stack, 'EcsCluster', {
         executeCommandConfiguration: {
           logConfiguration: {
@@ -2127,18 +2117,18 @@ nodeunitShim({
           logging: ecs.ExecuteCommandLogging.OVERRIDE,
         },
       });
-    }, /You must specify a CloudWatch log group in the execute command log configuration to enable CloudWatch encryption./);
+    }).toThrow(/You must specify a CloudWatch log group in the execute command log configuration to enable CloudWatch encryption./);
+
 
-    test.done();
-  },
+  });
 
-  'throws when S3EncryptionEnabled without providing S3 Bucket name'(test: Test) {
+  test('throws when S3EncryptionEnabled without providing S3 Bucket name', () => {
     // GIVEN
     const app = new cdk.App();
     const stack = new cdk.Stack(app, 'test');
 
     // THEN
-    test.throws(() => {
+    expect(() => {
       new ecs.Cluster(stack, 'EcsCluster', {
         executeCommandConfiguration: {
           logConfiguration: {
@@ -2147,8 +2137,8 @@ nodeunitShim({
           logging: ecs.ExecuteCommandLogging.OVERRIDE,
         },
       });
-    }, /You must specify an S3 bucket name in the execute command log configuration to enable S3 encryption./);
+    }).toThrow(/You must specify an S3 bucket name in the execute command log configuration to enable S3 encryption./);
+
 
-    test.done();
-  },
+  });
 });
diff --git a/packages/@aws-cdk/aws-ecs/test/ec2/cross-stack.test.ts b/packages/@aws-cdk/aws-ecs/test/ec2/cross-stack.test.ts
index 7e6fce7a4f301..7decd0047975e 100644
--- a/packages/@aws-cdk/aws-ecs/test/ec2/cross-stack.test.ts
+++ b/packages/@aws-cdk/aws-ecs/test/ec2/cross-stack.test.ts
@@ -1,8 +1,7 @@
-import { expect, haveResource } from '@aws-cdk/assert-internal';
+import '@aws-cdk/assert-internal/jest';
 import * as ec2 from '@aws-cdk/aws-ec2';
 import * as elbv2 from '@aws-cdk/aws-elasticloadbalancingv2';
 import { App, Stack } from '@aws-cdk/core';
-import { nodeunitShim, Test } from 'nodeunit-shim';
 import * as ecs from '../../lib';
 
 // Test various cross-stack Cluster/Service/ALB scenario's
@@ -13,8 +12,8 @@ let stack2: Stack;
 let cluster: ecs.Cluster;
 let service: ecs.Ec2Service;
 
-nodeunitShim({
-  'setUp'(cb: () => void) {
+describe('cross stack', () => {
+  beforeEach(() => {
     app = new App();
 
     stack1 = new Stack(app, 'Stack1');
@@ -37,10 +36,10 @@ nodeunitShim({
       taskDefinition,
     });
 
-    cb();
-  },
 
-  'ALB next to Service'(test: Test) {
+  });
+
+  test('ALB next to Service', () => {
     // WHEN
     const lb = new elbv2.ApplicationLoadBalancer(stack2, 'ALB', { vpc: cluster.vpc });
     const listener = lb.addListener('listener', { port: 80 });
@@ -50,14 +49,14 @@ nodeunitShim({
     });
 
     // THEN: it shouldn't throw due to cyclic dependencies
-    expect(stack2).to(haveResource('AWS::ECS::Service'));
+    expect(stack2).toHaveResource('AWS::ECS::Service');
 
     expectIngress(stack2);
 
-    test.done();
-  },
 
-  'ALB next to Cluster'(test: Test) {
+  });
+
+  test('ALB next to Cluster', () => {
     // WHEN
     const lb = new elbv2.ApplicationLoadBalancer(stack1, 'ALB', { vpc: cluster.vpc });
     const listener = lb.addListener('listener', { port: 80 });
@@ -67,13 +66,13 @@ nodeunitShim({
     });
 
     // THEN: it shouldn't throw due to cyclic dependencies
-    expect(stack2).to(haveResource('AWS::ECS::Service'));
+    expect(stack2).toHaveResource('AWS::ECS::Service');
     expectIngress(stack2);
 
-    test.done();
-  },
 
-  'ALB in its own stack'(test: Test) {
+  });
+
+  test('ALB in its own stack', () => {
     // WHEN
     const stack3 = new Stack(app, 'Stack3');
     const lb = new elbv2.ApplicationLoadBalancer(stack3, 'ALB', { vpc: cluster.vpc });
@@ -84,17 +83,17 @@ nodeunitShim({
     });
 
     // THEN: it shouldn't throw due to cyclic dependencies
-    expect(stack2).to(haveResource('AWS::ECS::Service'));
+    expect(stack2).toHaveResource('AWS::ECS::Service');
     expectIngress(stack2);
 
-    test.done();
-  },
+
+  });
 });
 
 function expectIngress(stack: Stack) {
-  expect(stack).to(haveResource('AWS::EC2::SecurityGroupIngress', {
+  expect(stack).toHaveResource('AWS::EC2::SecurityGroupIngress', {
     FromPort: 32768,
     ToPort: 65535,
     GroupId: { 'Fn::ImportValue': 'Stack1:ExportsOutputFnGetAttClusterDefaultAutoScalingGroupInstanceSecurityGroup1D15236AGroupIdEAB9C5E1' },
-  }));
+  });
 }
\ No newline at end of file
diff --git a/packages/@aws-cdk/aws-ecs/test/ec2/ec2-service.test.ts b/packages/@aws-cdk/aws-ecs/test/ec2/ec2-service.test.ts
index 7e942c866b213..48da04142ff3c 100644
--- a/packages/@aws-cdk/aws-ecs/test/ec2/ec2-service.test.ts
+++ b/packages/@aws-cdk/aws-ecs/test/ec2/ec2-service.test.ts
@@ -1,4 +1,5 @@
-import { expect, haveResource, haveResourceLike } from '@aws-cdk/assert-internal';
+import { SynthUtils } from '@aws-cdk/assert-internal';
+import '@aws-cdk/assert-internal/jest';
 import * as autoscaling from '@aws-cdk/aws-autoscaling';
 import * as ec2 from '@aws-cdk/aws-ec2';
 import * as elb from '@aws-cdk/aws-elasticloadbalancing';
@@ -8,14 +9,13 @@ import * as logs from '@aws-cdk/aws-logs';
 import * as s3 from '@aws-cdk/aws-s3';
 import * as cloudmap from '@aws-cdk/aws-servicediscovery';
 import * as cdk from '@aws-cdk/core';
-import { nodeunitShim, Test } from 'nodeunit-shim';
 import * as ecs from '../../lib';
 import { DeploymentControllerType, LaunchType, PropagatedTagSource } from '../../lib/base/base-service';
 import { PlacementConstraint, PlacementStrategy } from '../../lib/placement';
 
-nodeunitShim({
-  'When creating an EC2 Service': {
-    'with only required properties set, it correctly sets default properties'(test: Test) {
+describe('ec2 service', () => {
+  describe('When creating an EC2 Service', () => {
+    test('with only required properties set, it correctly sets default properties', () => {
       // GIVEN
       const stack = new cdk.Stack();
       const vpc = new ec2.Vpc(stack, 'MyVpc', {});
@@ -34,7 +34,7 @@ nodeunitShim({
       });
 
       // THEN
-      expect(stack).to(haveResource('AWS::ECS::Service', {
+      expect(stack).toHaveResource('AWS::ECS::Service', {
         TaskDefinition: {
           Ref: 'Ec2TaskDef0226F28C',
         },
@@ -48,14 +48,14 @@ nodeunitShim({
         LaunchType: LaunchType.EC2,
         SchedulingStrategy: 'REPLICA',
         EnableECSManagedTags: false,
-      }));
+      });
 
-      test.notEqual(service.node.defaultChild, undefined);
+      expect(service.node.defaultChild).toBeDefined();
 
-      test.done();
-    },
 
-    'allows setting enable execute command'(test: Test) {
+    });
+
+    test('allows setting enable execute command', () => {
       // GIVEN
       const stack = new cdk.Stack();
       const vpc = new ec2.Vpc(stack, 'MyVpc', {});
@@ -75,7 +75,7 @@ nodeunitShim({
       });
 
       // THEN
-      expect(stack).to(haveResource('AWS::ECS::Service', {
+      expect(stack).toHaveResource('AWS::ECS::Service', {
         TaskDefinition: {
           Ref: 'Ec2TaskDef0226F28C',
         },
@@ -90,9 +90,9 @@ nodeunitShim({
         SchedulingStrategy: 'REPLICA',
         EnableECSManagedTags: false,
         EnableExecuteCommand: true,
-      }));
+      });
 
-      expect(stack).to(haveResource('AWS::IAM::Policy', {
+      expect(stack).toHaveResource('AWS::IAM::Policy', {
         PolicyDocument: {
           Statement: [
             {
@@ -128,12 +128,12 @@ nodeunitShim({
             Ref: 'Ec2TaskDefTaskRole400FA349',
           },
         ],
-      }));
+      });
 
-      test.done();
-    },
 
-    'no logging enabled when logging field is set to NONE'(test: Test) {
+    });
+
+    test('no logging enabled when logging field is set to NONE', () => {
       // GIVEN
       const stack = new cdk.Stack();
       const vpc = new ec2.Vpc(stack, 'MyVpc', {});
@@ -166,7 +166,7 @@ nodeunitShim({
       });
 
       // THEN
-      expect(stack).to(haveResource('AWS::IAM::Policy', {
+      expect(stack).toHaveResource('AWS::IAM::Policy', {
         PolicyDocument: {
           Statement: [
             {
@@ -188,12 +188,12 @@ nodeunitShim({
             Ref: 'Ec2TaskDefTaskRole400FA349',
           },
         ],
-      }));
+      });
+
 
-      test.done();
-    },
+    });
 
-    'enables execute command logging when logging field is set to OVERRIDE'(test: Test) {
+    test('enables execute command logging when logging field is set to OVERRIDE', () => {
       // GIVEN
       const stack = new cdk.Stack();
       const vpc = new ec2.Vpc(stack, 'MyVpc', {});
@@ -229,7 +229,7 @@ nodeunitShim({
       });
 
       // THEN
-      expect(stack).to(haveResource('AWS::IAM::Policy', {
+      expect(stack).toHaveResource('AWS::IAM::Policy', {
         PolicyDocument: {
           Statement: [
             {
@@ -305,12 +305,12 @@ nodeunitShim({
             Ref: 'Ec2TaskDefTaskRole400FA349',
           },
         ],
-      }));
+      });
 
-      test.done();
-    },
 
-    'enables only execute command session encryption'(test: Test) {
+    });
+
+    test('enables only execute command session encryption', () => {
       // GIVEN
       const stack = new cdk.Stack();
       const vpc = new ec2.Vpc(stack, 'MyVpc', {});
@@ -349,7 +349,7 @@ nodeunitShim({
       });
 
       // THEN
-      expect(stack).to(haveResource('AWS::IAM::Policy', {
+      expect(stack).toHaveResource('AWS::IAM::Policy', {
         PolicyDocument: {
           Statement: [
             {
@@ -438,9 +438,9 @@ nodeunitShim({
             Ref: 'Ec2TaskDefTaskRole400FA349',
           },
         ],
-      }));
+      });
 
-      expect(stack).to(haveResource('AWS::KMS::Key', {
+      expect(stack).toHaveResource('AWS::KMS::Key', {
         KeyPolicy: {
           Statement: [
             {
@@ -504,12 +504,12 @@ nodeunitShim({
           ],
           Version: '2012-10-17',
         },
-      }));
+      });
+
 
-      test.done();
-    },
+    });
 
-    'enables encryption for execute command logging'(test: Test) {
+    test('enables encryption for execute command logging', () => {
       // GIVEN
       const stack = new cdk.Stack();
       const vpc = new ec2.Vpc(stack, 'MyVpc', {});
@@ -555,7 +555,7 @@ nodeunitShim({
       });
 
       // THEN
-      expect(stack).to(haveResource('AWS::IAM::Policy', {
+      expect(stack).toHaveResource('AWS::IAM::Policy', {
         PolicyDocument: {
           Statement: [
             {
@@ -659,9 +659,9 @@ nodeunitShim({
             Ref: 'Ec2TaskDefTaskRole400FA349',
           },
         ],
-      }));
+      });
 
-      expect(stack).to(haveResource('AWS::KMS::Key', {
+      expect(stack).toHaveResource('AWS::KMS::Key', {
         KeyPolicy: {
           Statement: [
             {
@@ -770,12 +770,12 @@ nodeunitShim({
           ],
           Version: '2012-10-17',
         },
-      }));
+      });
+
 
-      test.done();
-    },
+    });
 
-    'with custom cloudmap namespace'(test: Test) {
+    test('with custom cloudmap namespace', () => {
       // GIVEN
       const stack = new cdk.Stack();
       const vpc = new ec2.Vpc(stack, 'MyVpc', {});
@@ -805,7 +805,7 @@ nodeunitShim({
       });
 
       // THEN
-      expect(stack).to(haveResource('AWS::ServiceDiscovery::Service', {
+      expect(stack).toHaveResource('AWS::ServiceDiscovery::Service', {
         DnsConfig: {
           DnsRecords: [
             {
@@ -831,19 +831,19 @@ nodeunitShim({
             'Id',
           ],
         },
-      }));
+      });
 
-      expect(stack).to(haveResource('AWS::ServiceDiscovery::PrivateDnsNamespace', {
+      expect(stack).toHaveResource('AWS::ServiceDiscovery::PrivateDnsNamespace', {
         Name: 'scorekeep.com',
         Vpc: {
           Ref: 'MyVpcF9F0CA6F',
         },
-      }));
+      });
+
 
-      test.done();
-    },
+    });
 
-    'with all properties set'(test: Test) {
+    test('with all properties set', () => {
       // GIVEN
       const stack = new cdk.Stack();
       const vpc = new ec2.Vpc(stack, 'MyVpc', {});
@@ -896,7 +896,7 @@ nodeunitShim({
       service.addPlacementStrategies(PlacementStrategy.spreadAcross(ecs.BuiltInAttributes.AVAILABILITY_ZONE));
 
       // THEN
-      expect(stack).to(haveResource('AWS::ECS::Service', {
+      expect(stack).toHaveResource('AWS::ECS::Service', {
         TaskDefinition: {
           Ref: 'Ec2TaskDef0226F28C',
         },
@@ -957,12 +957,12 @@ nodeunitShim({
             },
           },
         ],
-      }));
+      });
 
-      test.done();
-    },
 
-    'with autoscaling group capacity provider'(test: Test) {
+    });
+
+    test('with autoscaling group capacity provider', () => {
       // GIVEN
       const stack = new cdk.Stack();
       const vpc = new ec2.Vpc(stack, 'Vpc');
@@ -1002,7 +1002,7 @@ nodeunitShim({
       });
 
       // THEN
-      expect(stack).to(haveResource('AWS::ECS::Service', {
+      expect(stack).toHaveResource('AWS::ECS::Service', {
         CapacityProviderStrategy: [
           {
             CapacityProvider: {
@@ -1010,11 +1010,11 @@ nodeunitShim({
             },
           },
         ],
-      }));
-      test.done();
-    },
+      });
 
-    'with multiple security groups, it correctly updates the cfn template'(test: Test) {
+    });
+
+    test('with multiple security groups, it correctly updates the cfn template', () => {
       // GIVEN
       const stack = new cdk.Stack();
       const vpc = new ec2.Vpc(stack, 'MyVpc', {});
@@ -1053,7 +1053,7 @@ nodeunitShim({
       });
 
       // THEN
-      expect(stack).to(haveResource('AWS::ECS::Service', {
+      expect(stack).toHaveResource('AWS::ECS::Service', {
         TaskDefinition: {
           Ref: 'Ec2TaskDef0226F28C',
         },
@@ -1091,9 +1091,9 @@ nodeunitShim({
         },
         SchedulingStrategy: 'REPLICA',
         ServiceName: 'bonjour',
-      }));
+      });
 
-      expect(stack).to(haveResource('AWS::EC2::SecurityGroup', {
+      expect(stack).toHaveResource('AWS::EC2::SecurityGroup', {
         GroupDescription: 'Example',
         GroupName: 'Bingo',
         SecurityGroupEgress: [
@@ -1106,9 +1106,9 @@ nodeunitShim({
         VpcId: {
           Ref: 'MyVpcF9F0CA6F',
         },
-      }));
+      });
 
-      expect(stack).to(haveResource('AWS::EC2::SecurityGroup', {
+      expect(stack).toHaveResource('AWS::EC2::SecurityGroup', {
         GroupDescription: 'Example',
         GroupName: 'Rolly',
         SecurityGroupEgress: [
@@ -1123,12 +1123,12 @@ nodeunitShim({
         VpcId: {
           Ref: 'MyVpcF9F0CA6F',
         },
-      }));
+      });
 
-      test.done();
-    },
 
-    'throws when both securityGroup and securityGroups are supplied'(test: Test) {
+    });
+
+    test('throws when both securityGroup and securityGroups are supplied', () => {
       // GIVEN
       const stack = new cdk.Stack();
       const vpc = new ec2.Vpc(stack, 'MyVpc', {});
@@ -1155,7 +1155,7 @@ nodeunitShim({
       });
 
       // THEN
-      test.throws(() => {
+      expect(() => {
         new ecs.Ec2Service(stack, 'Ec2Service', {
           cluster,
           taskDefinition,
@@ -1168,12 +1168,12 @@ nodeunitShim({
           serviceName: 'bonjour',
           vpcSubnets: { subnetType: ec2.SubnetType.PUBLIC },
         });
-      }, /Only one of SecurityGroup or SecurityGroups can be populated./);
+      }).toThrow(/Only one of SecurityGroup or SecurityGroups can be populated./);
 
-      test.done();
-    },
 
-    'throws when task definition is not EC2 compatible'(test: Test) {
+    });
+
+    test('throws when task definition is not EC2 compatible', () => {
       const stack = new cdk.Stack();
       const vpc = new ec2.Vpc(stack, 'MyVpc', {});
       const cluster = new ecs.Cluster(stack, 'EcsCluster', { vpc });
@@ -1188,17 +1188,17 @@ nodeunitShim({
       });
 
       // THEN
-      test.throws(() => {
+      expect(() => {
         new ecs.Ec2Service(stack, 'Ec2Service', {
           cluster,
           taskDefinition,
         });
-      }, /Supplied TaskDefinition is not configured for compatibility with EC2/);
+      }).toThrow(/Supplied TaskDefinition is not configured for compatibility with EC2/);
 
-      test.done();
-    },
 
-    'ignore task definition and launch type if deployment controller is set to be EXTERNAL'(test: Test) {
+    });
+
+    test('ignore task definition and launch type if deployment controller is set to be EXTERNAL', () => {
       // GIVEN
       const stack = new cdk.Stack();
       const vpc = new ec2.Vpc(stack, 'MyVpc', {});
@@ -1220,8 +1220,8 @@ nodeunitShim({
       });
 
       // THEN
-      test.deepEqual(service.node.metadata[0].data, 'taskDefinition and launchType are blanked out when using external deployment controller.');
-      expect(stack).to(haveResource('AWS::ECS::Service', {
+      expect(service.node.metadata[0].data).toEqual('taskDefinition and launchType are blanked out when using external deployment controller.');
+      expect(stack).toHaveResource('AWS::ECS::Service', {
         Cluster: {
           Ref: 'EcsCluster97242B84',
         },
@@ -1231,12 +1231,12 @@ nodeunitShim({
         },
         SchedulingStrategy: 'REPLICA',
         EnableECSManagedTags: false,
-      }));
+      });
 
-      test.done();
-    },
 
-    'errors if daemon and desiredCount both specified'(test: Test) {
+    });
+
+    test('errors if daemon and desiredCount both specified', () => {
       // GIVEN
       const stack = new cdk.Stack();
       const vpc = new ec2.Vpc(stack, 'MyVpc', {});
@@ -1249,19 +1249,19 @@ nodeunitShim({
       });
 
       // THEN
-      test.throws(() => {
+      expect(() => {
         new ecs.Ec2Service(stack, 'Ec2Service', {
           cluster,
           taskDefinition,
           daemon: true,
           desiredCount: 2,
         });
-      }, /Don't supply desiredCount/);
+      }).toThrow(/Don't supply desiredCount/);
 
-      test.done();
-    },
 
-    'errors if daemon and maximumPercent not 100'(test: Test) {
+    });
+
+    test('errors if daemon and maximumPercent not 100', () => {
       // GIVEN
       const stack = new cdk.Stack();
       const vpc = new ec2.Vpc(stack, 'MyVpc', {});
@@ -1274,19 +1274,19 @@ nodeunitShim({
       });
 
       // THEN
-      test.throws(() => {
+      expect(() => {
         new ecs.Ec2Service(stack, 'Ec2Service', {
           cluster,
           taskDefinition,
           daemon: true,
           maxHealthyPercent: 300,
         });
-      }, /Maximum percent must be 100 for daemon mode./);
+      }).toThrow(/Maximum percent must be 100 for daemon mode./);
 
-      test.done();
-    },
 
-    'errors if minimum not less than maximum'(test: Test) {
+    });
+
+    test('errors if minimum not less than maximum', () => {
       // GIVEN
       const stack = new cdk.Stack();
       const vpc = new ec2.Vpc(stack, 'MyVpc', {});
@@ -1299,7 +1299,7 @@ nodeunitShim({
       });
 
       // THEN
-      test.throws(() => {
+      expect(() => {
         new ecs.Ec2Service(stack, 'Ec2Service', {
           cluster,
           taskDefinition,
@@ -1307,12 +1307,12 @@ nodeunitShim({
           minHealthyPercent: 100,
           maxHealthyPercent: 100,
         });
-      }, /Minimum healthy percent must be less than maximum healthy percent./);
+      }).toThrow(/Minimum healthy percent must be less than maximum healthy percent./);
 
-      test.done();
-    },
 
-    'errors if no container definitions'(test: Test) {
+    });
+
+    test('errors if no container definitions', () => {
       // GIVEN
       const stack = new cdk.Stack();
       const vpc = new ec2.Vpc(stack, 'MyVpc', {});
@@ -1326,14 +1326,14 @@ nodeunitShim({
       });
 
       // THEN
-      test.throws(() => {
-        expect(stack);
-      }, /one essential container/);
+      expect(() => {
+        SynthUtils.synthesize(stack);
+      }).toThrow(/one essential container/);
 
-      test.done();
-    },
 
-    'allows adding the default container after creating the service'(test: Test) {
+    });
+
+    test('allows adding the default container after creating the service', () => {
       // GIVEN
       const stack = new cdk.Stack();
       const vpc = new ec2.Vpc(stack, 'MyVpc', {});
@@ -1353,18 +1353,18 @@ nodeunitShim({
       });
 
       // THEN
-      expect(stack).to(haveResourceLike('AWS::ECS::TaskDefinition', {
+      expect(stack).toHaveResourceLike('AWS::ECS::TaskDefinition', {
         ContainerDefinitions: [
           {
             Name: 'main',
           },
         ],
-      }));
+      });
 
-      test.done();
-    },
 
-    'sets daemon scheduling strategy'(test: Test) {
+    });
+
+    test('sets daemon scheduling strategy', () => {
       // GIVEN
       const stack = new cdk.Stack();
       const vpc = new ec2.Vpc(stack, 'MyVpc', {});
@@ -1384,19 +1384,19 @@ nodeunitShim({
       });
 
       // THEN
-      expect(stack).to(haveResource('AWS::ECS::Service', {
+      expect(stack).toHaveResource('AWS::ECS::Service', {
         SchedulingStrategy: 'DAEMON',
         DeploymentConfiguration: {
           MaximumPercent: 100,
           MinimumHealthyPercent: 0,
         },
-      }));
+      });
 
-      test.done();
-    },
 
-    'with a TaskDefinition with Bridge network mode': {
-      'it errors if vpcSubnets is specified'(test: Test) {
+    });
+
+    describe('with a TaskDefinition with Bridge network mode', () => {
+      test('it errors if vpcSubnets is specified', () => {
         // GIVEN
         const stack = new cdk.Stack();
         const vpc = new ec2.Vpc(stack, 'MyVpc', {});
@@ -1412,7 +1412,7 @@ nodeunitShim({
         });
 
         // THEN
-        test.throws(() => {
+        expect(() => {
           new ecs.Ec2Service(stack, 'Ec2Service', {
             cluster,
             taskDefinition,
@@ -1423,10 +1423,10 @@ nodeunitShim({
         });
 
         // THEN
-        test.done();
-      },
 
-      'it errors if assignPublicIp is true'(test: Test) {
+      });
+
+      test('it errors if assignPublicIp is true', () => {
         // GIVEN
         const stack = new cdk.Stack();
         const vpc = new ec2.Vpc(stack, 'MyVpc', {});
@@ -1442,19 +1442,19 @@ nodeunitShim({
         });
 
         // THEN
-        test.throws(() => {
+        expect(() => {
           new ecs.Ec2Service(stack, 'Ec2Service', {
             cluster,
             taskDefinition,
             assignPublicIp: true,
           });
-        }, /vpcSubnets, securityGroup\(s\) and assignPublicIp can only be used in AwsVpc networking mode/);
+        }).toThrow(/vpcSubnets, securityGroup\(s\) and assignPublicIp can only be used in AwsVpc networking mode/);
 
         // THEN
-        test.done();
-      },
 
-      'it errors if vpc subnets is provided'(test: Test) {
+      });
+
+      test('it errors if vpc subnets is provided', () => {
         // GIVEN
         const stack = new cdk.Stack();
         const vpc = new ec2.Vpc(stack, 'MyVpc', {});
@@ -1474,7 +1474,7 @@ nodeunitShim({
         });
 
         // THEN
-        test.throws(() => {
+        expect(() => {
           new ecs.Ec2Service(stack, 'Ec2Service', {
             cluster,
             taskDefinition,
@@ -1482,13 +1482,13 @@ nodeunitShim({
               subnets: [subnet],
             },
           });
-        }, /vpcSubnets, securityGroup\(s\) and assignPublicIp can only be used in AwsVpc networking mode/);
+        }).toThrow(/vpcSubnets, securityGroup\(s\) and assignPublicIp can only be used in AwsVpc networking mode/);
 
         // THEN
-        test.done();
-      },
 
-      'it errors if security group is provided'(test: Test) {
+      });
+
+      test('it errors if security group is provided', () => {
         // GIVEN
         const stack = new cdk.Stack();
         const vpc = new ec2.Vpc(stack, 'MyVpc', {});
@@ -1504,19 +1504,19 @@ nodeunitShim({
         });
 
         // THEN
-        test.throws(() => {
+        expect(() => {
           new ecs.Ec2Service(stack, 'Ec2Service', {
             cluster,
             taskDefinition,
             securityGroup,
           });
-        }, /vpcSubnets, securityGroup\(s\) and assignPublicIp can only be used in AwsVpc networking mode/);
+        }).toThrow(/vpcSubnets, securityGroup\(s\) and assignPublicIp can only be used in AwsVpc networking mode/);
 
         // THEN
-        test.done();
-      },
 
-      'it errors if multiple security groups is provided'(test: Test) {
+      });
+
+      test('it errors if multiple security groups is provided', () => {
         // GIVEN
         const stack = new cdk.Stack();
         const vpc = new ec2.Vpc(stack, 'MyVpc', {});
@@ -1535,21 +1535,21 @@ nodeunitShim({
         });
 
         // THEN
-        test.throws(() => {
+        expect(() => {
           new ecs.Ec2Service(stack, 'Ec2Service', {
             cluster,
             taskDefinition,
             securityGroups,
           });
-        }, /vpcSubnets, securityGroup\(s\) and assignPublicIp can only be used in AwsVpc networking mode/);
+        }).toThrow(/vpcSubnets, securityGroup\(s\) and assignPublicIp can only be used in AwsVpc networking mode/);
 
         // THEN
-        test.done();
-      },
-    },
 
-    'with a TaskDefinition with AwsVpc network mode': {
-      'it creates a security group for the service'(test: Test) {
+      });
+    });
+
+    describe('with a TaskDefinition with AwsVpc network mode', () => {
+      test('it creates a security group for the service', () => {
         // GIVEN
         const stack = new cdk.Stack();
         const vpc = new ec2.Vpc(stack, 'MyVpc', {});
@@ -1570,7 +1570,7 @@ nodeunitShim({
         });
 
         // THEN
-        expect(stack).to(haveResource('AWS::ECS::Service', {
+        expect(stack).toHaveResource('AWS::ECS::Service', {
           NetworkConfiguration: {
             AwsvpcConfiguration: {
               AssignPublicIp: 'DISABLED',
@@ -1592,12 +1592,12 @@ nodeunitShim({
               ],
             },
           },
-        }));
+        });
 
-        test.done();
-      },
 
-      'it allows vpcSubnets'(test: Test) {
+      });
+
+      test('it allows vpcSubnets', () => {
         // GIVEN
         const stack = new cdk.Stack();
         const vpc = new ec2.Vpc(stack, 'MyVpc', {});
@@ -1621,11 +1621,11 @@ nodeunitShim({
         });
 
         // THEN
-        test.done();
-      },
-    },
 
-    'with distinctInstance placement constraint'(test: Test) {
+      });
+    });
+
+    test('with distinctInstance placement constraint', () => {
       // GIVEN
       const stack = new cdk.Stack();
       const vpc = new ec2.Vpc(stack, 'MyVpc', {});
@@ -1645,16 +1645,16 @@ nodeunitShim({
       });
 
       // THEN
-      expect(stack).to(haveResource('AWS::ECS::Service', {
+      expect(stack).toHaveResource('AWS::ECS::Service', {
         PlacementConstraints: [{
           Type: 'distinctInstance',
         }],
-      }));
+      });
+
 
-      test.done();
-    },
+    });
 
-    'with memberOf placement constraints'(test: Test) {
+    test('with memberOf placement constraints', () => {
       // GIVEN
       const stack = new cdk.Stack();
       const vpc = new ec2.Vpc(stack, 'MyVpc', {});
@@ -1675,17 +1675,17 @@ nodeunitShim({
       service.addPlacementConstraints(PlacementConstraint.memberOf('attribute:ecs.instance-type =~ t2.*'));
 
       // THEN
-      expect(stack).to(haveResource('AWS::ECS::Service', {
+      expect(stack).toHaveResource('AWS::ECS::Service', {
         PlacementConstraints: [{
           Expression: 'attribute:ecs.instance-type =~ t2.*',
           Type: 'memberOf',
         }],
-      }));
+      });
+
 
-      test.done();
-    },
+    });
 
-    'with spreadAcross container instances strategy'(test: Test) {
+    test('with spreadAcross container instances strategy', () => {
       // GIVEN
       const stack = new cdk.Stack();
       const vpc = new ec2.Vpc(stack, 'MyVpc', {});
@@ -1707,17 +1707,17 @@ nodeunitShim({
       service.addPlacementStrategies(PlacementStrategy.spreadAcrossInstances());
 
       // THEN
-      expect(stack).to(haveResource('AWS::ECS::Service', {
+      expect(stack).toHaveResource('AWS::ECS::Service', {
         PlacementStrategies: [{
           Field: 'instanceId',
           Type: 'spread',
         }],
-      }));
+      });
+
 
-      test.done();
-    },
+    });
 
-    'with spreadAcross placement strategy'(test: Test) {
+    test('with spreadAcross placement strategy', () => {
       // GIVEN
       const stack = new cdk.Stack();
       const vpc = new ec2.Vpc(stack, 'MyVpc', {});
@@ -1738,36 +1738,36 @@ nodeunitShim({
       service.addPlacementStrategies(PlacementStrategy.spreadAcross(ecs.BuiltInAttributes.AVAILABILITY_ZONE));
 
       // THEN
-      expect(stack).to(haveResource('AWS::ECS::Service', {
+      expect(stack).toHaveResource('AWS::ECS::Service', {
         PlacementStrategies: [{
           Field: 'attribute:ecs.availability-zone',
           Type: 'spread',
         }],
-      }));
+      });
+
 
-      test.done();
-    },
+    });
 
-    'can turn PlacementStrategy into json format'(test: Test) {
+    test('can turn PlacementStrategy into json format', () => {
       // THEN
-      test.deepEqual(PlacementStrategy.spreadAcross(ecs.BuiltInAttributes.AVAILABILITY_ZONE).toJson(), [{
+      expect(PlacementStrategy.spreadAcross(ecs.BuiltInAttributes.AVAILABILITY_ZONE).toJson()).toEqual([{
         type: 'spread',
         field: 'attribute:ecs.availability-zone',
       }]);
 
-      test.done();
-    },
 
-    'can turn PlacementConstraints into json format'(test: Test) {
+    });
+
+    test('can turn PlacementConstraints into json format', () => {
       // THEN
-      test.deepEqual(PlacementConstraint.distinctInstances().toJson(), [{
+      expect(PlacementConstraint.distinctInstances().toJson()).toEqual([{
         type: 'distinctInstance',
       }]);
 
-      test.done();
-    },
 
-    'errors when spreadAcross with no input'(test: Test) {
+    });
+
+    test('errors when spreadAcross with no input', () => {
       // GIVEN
       const stack = new cdk.Stack();
       const vpc = new ec2.Vpc(stack, 'MyVpc', {});
@@ -1786,14 +1786,14 @@ nodeunitShim({
       });
 
       // THEN
-      test.throws(() => {
+      expect(() => {
         service.addPlacementStrategies(PlacementStrategy.spreadAcross());
-      }, 'spreadAcross: give at least one field to spread by');
+      }).toThrow('spreadAcross: give at least one field to spread by');
+
 
-      test.done();
-    },
+    });
 
-    'errors with spreadAcross placement strategy if daemon specified'(test: Test) {
+    test('errors with spreadAcross placement strategy if daemon specified', () => {
       // GIVEN
       const stack = new cdk.Stack();
       const vpc = new ec2.Vpc(stack, 'MyVpc', {});
@@ -1813,14 +1813,14 @@ nodeunitShim({
       });
 
       // THEN
-      test.throws(() => {
+      expect(() => {
         service.addPlacementStrategies(PlacementStrategy.spreadAcross(ecs.BuiltInAttributes.AVAILABILITY_ZONE));
       });
 
-      test.done();
-    },
 
-    'with no placement constraints'(test: Test) {
+    });
+
+    test('with no placement constraints', () => {
       // GIVEN
       const stack = new cdk.Stack();
       const vpc = new ec2.Vpc(stack, 'MyVpc', {});
@@ -1839,14 +1839,14 @@ nodeunitShim({
       });
 
       // THEN
-      expect(stack).notTo(haveResource('AWS::ECS::Service', {
+      expect(stack).not.toHaveResource('AWS::ECS::Service', {
         PlacementConstraints: undefined,
-      }));
+      });
+
 
-      test.done();
-    },
+    });
 
-    'with both propagateTags and propagateTaskTagsFrom defined'(test: Test) {
+    test('with both propagateTags and propagateTaskTagsFrom defined', () => {
       // GIVEN
       const stack = new cdk.Stack();
       const vpc = new ec2.Vpc(stack, 'MyVpc', {});
@@ -1859,18 +1859,18 @@ nodeunitShim({
         memoryLimitMiB: 512,
       });
 
-      test.throws(() => {
+      expect(() => {
         new ecs.Ec2Service(stack, 'Ec2Service', {
           cluster,
           taskDefinition,
           propagateTags: PropagatedTagSource.SERVICE,
           propagateTaskTagsFrom: PropagatedTagSource.SERVICE,
         });
-      }, /You can only specify either propagateTags or propagateTaskTagsFrom. Alternatively, you can leave both blank/);
-      test.done();
-    },
+      }).toThrow(/You can only specify either propagateTags or propagateTaskTagsFrom. Alternatively, you can leave both blank/);
+
+    });
 
-    'with no placement strategy if daemon specified'(test: Test) {
+    test('with no placement strategy if daemon specified', () => {
       // GIVEN
       const stack = new cdk.Stack();
       const vpc = new ec2.Vpc(stack, 'MyVpc', {});
@@ -1890,14 +1890,14 @@ nodeunitShim({
       });
 
       // THEN
-      expect(stack).notTo(haveResource('AWS::ECS::Service', {
+      expect(stack).not.toHaveResource('AWS::ECS::Service', {
         PlacementStrategies: undefined,
-      }));
+      });
+
 
-      test.done();
-    },
+    });
 
-    'with random placement strategy'(test: Test) {
+    test('with random placement strategy', () => {
       // GIVEN
       const stack = new cdk.Stack();
       const vpc = new ec2.Vpc(stack, 'MyVpc');
@@ -1918,16 +1918,16 @@ nodeunitShim({
       service.addPlacementStrategies(PlacementStrategy.randomly());
 
       // THEN
-      expect(stack).to(haveResource('AWS::ECS::Service', {
+      expect(stack).toHaveResource('AWS::ECS::Service', {
         PlacementStrategies: [{
           Type: 'random',
         }],
-      }));
+      });
 
-      test.done();
-    },
 
-    'errors with random placement strategy if daemon specified'(test: Test) {
+    });
+
+    test('errors with random placement strategy if daemon specified', () => {
       // GIVEN
       const stack = new cdk.Stack();
       const vpc = new ec2.Vpc(stack, 'MyVpc');
@@ -1947,14 +1947,14 @@ nodeunitShim({
       });
 
       // THEN
-      test.throws(() => {
+      expect(() => {
         service.addPlacementStrategies(PlacementStrategy.randomly());
-      });
+      }).toThrow();
 
-      test.done();
-    },
 
-    'with packedbyCpu placement strategy'(test: Test) {
+    });
+
+    test('with packedbyCpu placement strategy', () => {
       // GIVEN
       const stack = new cdk.Stack();
       const vpc = new ec2.Vpc(stack, 'MyVpc', {});
@@ -1975,17 +1975,17 @@ nodeunitShim({
       service.addPlacementStrategies(PlacementStrategy.packedByCpu());
 
       // THEN
-      expect(stack).to(haveResource('AWS::ECS::Service', {
+      expect(stack).toHaveResource('AWS::ECS::Service', {
         PlacementStrategies: [{
           Field: 'cpu',
           Type: 'binpack',
         }],
-      }));
+      });
+
 
-      test.done();
-    },
+    });
 
-    'with packedbyMemory placement strategy'(test: Test) {
+    test('with packedbyMemory placement strategy', () => {
       // GIVEN
       const stack = new cdk.Stack();
       const vpc = new ec2.Vpc(stack, 'MyVpc', {});
@@ -2006,17 +2006,17 @@ nodeunitShim({
       service.addPlacementStrategies(PlacementStrategy.packedByMemory());
 
       // THEN
-      expect(stack).to(haveResource('AWS::ECS::Service', {
+      expect(stack).toHaveResource('AWS::ECS::Service', {
         PlacementStrategies: [{
           Field: 'memory',
           Type: 'binpack',
         }],
-      }));
+      });
 
-      test.done();
-    },
 
-    'with packedBy placement strategy'(test: Test) {
+    });
+
+    test('with packedBy placement strategy', () => {
       // GIVEN
       const stack = new cdk.Stack();
       const vpc = new ec2.Vpc(stack, 'MyVpc', {});
@@ -2037,17 +2037,17 @@ nodeunitShim({
       service.addPlacementStrategies(PlacementStrategy.packedBy(ecs.BinPackResource.MEMORY));
 
       // THEN
-      expect(stack).to(haveResource('AWS::ECS::Service', {
+      expect(stack).toHaveResource('AWS::ECS::Service', {
         PlacementStrategies: [{
           Field: 'memory',
           Type: 'binpack',
         }],
-      }));
+      });
+
 
-      test.done();
-    },
+    });
 
-    'errors with packedBy placement strategy if daemon specified'(test: Test) {
+    test('errors with packedBy placement strategy if daemon specified', () => {
       // GIVEN
       const stack = new cdk.Stack();
       const vpc = new ec2.Vpc(stack, 'MyVpc', {});
@@ -2067,16 +2067,16 @@ nodeunitShim({
       });
 
       // THEN
-      test.throws(() => {
+      expect(() => {
         service.addPlacementStrategies(PlacementStrategy.packedBy(ecs.BinPackResource.MEMORY));
-      });
+      }).toThrow();
 
-      test.done();
-    },
-  },
 
-  'attachToClassicLB': {
-    'allows network mode of task definition to be host'(test: Test) {
+    });
+  });
+
+  describe('attachToClassicLB', () => {
+    test('allows network mode of task definition to be host', () => {
       // GIVEN
       const stack = new cdk.Stack();
       const vpc = new ec2.Vpc(stack, 'VPC');
@@ -2097,10 +2097,10 @@ nodeunitShim({
       const lb = new elb.LoadBalancer(stack, 'LB', { vpc });
       service.attachToClassicLB(lb);
 
-      test.done();
-    },
 
-    'allows network mode of task definition to be bridge'(test: Test) {
+    });
+
+    test('allows network mode of task definition to be bridge', () => {
       // GIVEN
       const stack = new cdk.Stack();
       const vpc = new ec2.Vpc(stack, 'VPC');
@@ -2121,10 +2121,10 @@ nodeunitShim({
       const lb = new elb.LoadBalancer(stack, 'LB', { vpc });
       service.attachToClassicLB(lb);
 
-      test.done();
-    },
 
-    'throws when network mode of task definition is AwsVpc'(test: Test) {
+    });
+
+    test('throws when network mode of task definition is AwsVpc', () => {
       // GIVEN
       const stack = new cdk.Stack();
       const vpc = new ec2.Vpc(stack, 'VPC');
@@ -2143,14 +2143,14 @@ nodeunitShim({
 
       // THEN
       const lb = new elb.LoadBalancer(stack, 'LB', { vpc });
-      test.throws(() => {
+      expect(() => {
         service.attachToClassicLB(lb);
-      }, /Cannot use a Classic Load Balancer if NetworkMode is AwsVpc. Use Host or Bridge instead./);
+      }).toThrow(/Cannot use a Classic Load Balancer if NetworkMode is AwsVpc. Use Host or Bridge instead./);
 
-      test.done();
-    },
 
-    'throws when network mode of task definition is none'(test: Test) {
+    });
+
+    test('throws when network mode of task definition is none', () => {
       // GIVEN
       const stack = new cdk.Stack();
       const vpc = new ec2.Vpc(stack, 'VPC');
@@ -2169,16 +2169,16 @@ nodeunitShim({
 
       // THEN
       const lb = new elb.LoadBalancer(stack, 'LB', { vpc });
-      test.throws(() => {
+      expect(() => {
         service.attachToClassicLB(lb);
-      }, /Cannot use a Classic Load Balancer if NetworkMode is None. Use Host or Bridge instead./);
+      }).toThrow(/Cannot use a Classic Load Balancer if NetworkMode is None. Use Host or Bridge instead./);
 
-      test.done();
-    },
-  },
 
-  'attachToApplicationTargetGroup': {
-    'allows network mode of task definition to be other than none'(test: Test) {
+    });
+  });
+
+  describe('attachToApplicationTargetGroup', () => {
+    test('allows network mode of task definition to be other than none', () => {
       // GIVEN
       const stack = new cdk.Stack();
       const vpc = new ec2.Vpc(stack, 'MyVpc', {});
@@ -2203,10 +2203,10 @@ nodeunitShim({
       // THEN
       service.attachToApplicationTargetGroup(targetGroup);
 
-      test.done();
-    },
 
-    'throws when network mode of task definition is none'(test: Test) {
+    });
+
+    test('throws when network mode of task definition is none', () => {
       // GIVEN
       const stack = new cdk.Stack();
       const vpc = new ec2.Vpc(stack, 'MyVpc', {});
@@ -2229,15 +2229,15 @@ nodeunitShim({
       });
 
       // THEN
-      test.throws(() => {
+      expect(() => {
         service.attachToApplicationTargetGroup(targetGroup);
-      }, /Cannot use a load balancer if NetworkMode is None. Use Bridge, Host or AwsVpc instead./);
+      }).toThrow(/Cannot use a load balancer if NetworkMode is None. Use Bridge, Host or AwsVpc instead./);
 
-      test.done();
-    },
 
-    'correctly setting ingress and egress port': {
-      'with bridge/NAT network mode and 0 host port'(test: Test) {
+    });
+
+    describe('correctly setting ingress and egress port', () => {
+      test('with bridge/NAT network mode and 0 host port', () => {
         [ecs.NetworkMode.BRIDGE, ecs.NetworkMode.NAT].forEach((networkMode: ecs.NetworkMode) => {
           // GIVEN
           const stack = new cdk.Stack();
@@ -2269,23 +2269,23 @@ nodeunitShim({
           });
 
           // THEN
-          expect(stack).to(haveResource('AWS::EC2::SecurityGroupIngress', {
+          expect(stack).toHaveResource('AWS::EC2::SecurityGroupIngress', {
             Description: 'Load balancer to target',
             FromPort: 32768,
             ToPort: 65535,
-          }));
+          });
 
-          expect(stack).to(haveResource('AWS::EC2::SecurityGroupEgress', {
+          expect(stack).toHaveResource('AWS::EC2::SecurityGroupEgress', {
             Description: 'Load balancer to target',
             FromPort: 32768,
             ToPort: 65535,
-          }));
+          });
         });
 
-        test.done();
-      },
 
-      'with bridge/NAT network mode and host port other than 0'(test: Test) {
+      });
+
+      test('with bridge/NAT network mode and host port other than 0', () => {
         [ecs.NetworkMode.BRIDGE, ecs.NetworkMode.NAT].forEach((networkMode: ecs.NetworkMode) => {
           // GIVEN
           const stack = new cdk.Stack();
@@ -2317,23 +2317,23 @@ nodeunitShim({
           });
 
           // THEN
-          expect(stack).to(haveResource('AWS::EC2::SecurityGroupIngress', {
+          expect(stack).toHaveResource('AWS::EC2::SecurityGroupIngress', {
             Description: 'Load balancer to target',
             FromPort: 80,
             ToPort: 80,
-          }));
+          });
 
-          expect(stack).to(haveResource('AWS::EC2::SecurityGroupEgress', {
+          expect(stack).toHaveResource('AWS::EC2::SecurityGroupEgress', {
             Description: 'Load balancer to target',
             FromPort: 80,
             ToPort: 80,
-          }));
+          });
         });
 
-        test.done();
-      },
 
-      'with host network mode'(test: Test) {
+      });
+
+      test('with host network mode', () => {
         // GIVEN
         const stack = new cdk.Stack();
         const vpc = new ec2.Vpc(stack, 'MyVpc', {});
@@ -2364,22 +2364,22 @@ nodeunitShim({
         });
 
         // THEN
-        expect(stack).to(haveResource('AWS::EC2::SecurityGroupIngress', {
+        expect(stack).toHaveResource('AWS::EC2::SecurityGroupIngress', {
           Description: 'Load balancer to target',
           FromPort: 8001,
           ToPort: 8001,
-        }));
+        });
 
-        expect(stack).to(haveResource('AWS::EC2::SecurityGroupEgress', {
+        expect(stack).toHaveResource('AWS::EC2::SecurityGroupEgress', {
           Description: 'Load balancer to target',
           FromPort: 8001,
           ToPort: 8001,
-        }));
+        });
 
-        test.done();
-      },
 
-      'with aws_vpc network mode'(test: Test) {
+      });
+
+      test('with aws_vpc network mode', () => {
         // GIVEN
         const stack = new cdk.Stack();
         const vpc = new ec2.Vpc(stack, 'MyVpc', {});
@@ -2410,25 +2410,25 @@ nodeunitShim({
         });
 
         // THEN
-        expect(stack).to(haveResource('AWS::EC2::SecurityGroupIngress', {
+        expect(stack).toHaveResource('AWS::EC2::SecurityGroupIngress', {
           Description: 'Load balancer to target',
           FromPort: 8001,
           ToPort: 8001,
-        }));
+        });
 
-        expect(stack).to(haveResource('AWS::EC2::SecurityGroupEgress', {
+        expect(stack).toHaveResource('AWS::EC2::SecurityGroupEgress', {
           Description: 'Load balancer to target',
           FromPort: 8001,
           ToPort: 8001,
-        }));
+        });
 
-        test.done();
-      },
-    },
-  },
 
-  'attachToNetworkTargetGroup': {
-    'allows network mode of task definition to be other than none'(test: Test) {
+      });
+    });
+  });
+
+  describe('attachToNetworkTargetGroup', () => {
+    test('allows network mode of task definition to be other than none', () => {
       // GIVEN
       const stack = new cdk.Stack();
       const vpc = new ec2.Vpc(stack, 'MyVpc', {});
@@ -2453,10 +2453,10 @@ nodeunitShim({
       // THEN
       service.attachToNetworkTargetGroup(targetGroup);
 
-      test.done();
-    },
 
-    'throws when network mode of task definition is none'(test: Test) {
+    });
+
+    test('throws when network mode of task definition is none', () => {
       // GIVEN
       const stack = new cdk.Stack();
       const vpc = new ec2.Vpc(stack, 'MyVpc', {});
@@ -2479,16 +2479,16 @@ nodeunitShim({
       });
 
       // THEN
-      test.throws(() => {
+      expect(() => {
         service.attachToNetworkTargetGroup(targetGroup);
-      }, /Cannot use a load balancer if NetworkMode is None. Use Bridge, Host or AwsVpc instead./);
+      }).toThrow(/Cannot use a load balancer if NetworkMode is None. Use Bridge, Host or AwsVpc instead./);
 
-      test.done();
-    },
-  },
 
-  'classic ELB': {
-    'can attach to classic ELB'(test: Test) {
+    });
+  });
+
+  describe('classic ELB', () => {
+    test('can attach to classic ELB', () => {
       // GIVEN
       const stack = new cdk.Stack();
       const vpc = new ec2.Vpc(stack, 'VPC');
@@ -2510,7 +2510,7 @@ nodeunitShim({
       lb.addTarget(service);
 
       // THEN
-      expect(stack).to(haveResource('AWS::ECS::Service', {
+      expect(stack).toHaveResource('AWS::ECS::Service', {
         LoadBalancers: [
           {
             ContainerName: 'web',
@@ -2518,18 +2518,18 @@ nodeunitShim({
             LoadBalancerName: { Ref: 'LB8A12904C' },
           },
         ],
-      }));
+      });
 
-      expect(stack).to(haveResource('AWS::ECS::Service', {
+      expect(stack).toHaveResource('AWS::ECS::Service', {
         // if any load balancer is configured and healthCheckGracePeriodSeconds is not
         // set, then it should default to 60 seconds.
         HealthCheckGracePeriodSeconds: 60,
-      }));
+      });
 
-      test.done();
-    },
 
-    'can attach any container and port as a target'(test: Test) {
+    });
+
+    test('can attach any container and port as a target', () => {
       // GIVEN
       const stack = new cdk.Stack();
       const vpc = new ec2.Vpc(stack, 'VPC');
@@ -2555,7 +2555,7 @@ nodeunitShim({
       }));
 
       // THEN
-      expect(stack).to(haveResource('AWS::ECS::Service', {
+      expect(stack).toHaveResource('AWS::ECS::Service', {
         LoadBalancers: [
           {
             ContainerName: 'web',
@@ -2563,14 +2563,14 @@ nodeunitShim({
             LoadBalancerName: { Ref: 'LB8A12904C' },
           },
         ],
-      }));
+      });
 
-      test.done();
-    },
-  },
 
-  'When enabling service discovery': {
-    'throws if namespace has not been added to cluster'(test: Test) {
+    });
+  });
+
+  describe('When enabling service discovery', () => {
+    test('throws if namespace has not been added to cluster', () => {
       // GIVEN
       const stack = new cdk.Stack();
       const vpc = new ec2.Vpc(stack, 'MyVpc', {});
@@ -2586,7 +2586,7 @@ nodeunitShim({
       container.addPortMappings({ containerPort: 8000 });
 
       // THEN
-      test.throws(() => {
+      expect(() => {
         new ecs.Ec2Service(stack, 'Service', {
           cluster,
           taskDefinition,
@@ -2594,12 +2594,12 @@ nodeunitShim({
             name: 'myApp',
           },
         });
-      }, /Cannot enable service discovery if a Cloudmap Namespace has not been created in the cluster./);
+      }).toThrow(/Cannot enable service discovery if a Cloudmap Namespace has not been created in the cluster./);
+
 
-      test.done();
-    },
+    });
 
-    'throws if network mode is none'(test: Test) {
+    test('throws if network mode is none', () => {
       // GIVEN
       const stack = new cdk.Stack();
       const vpc = new ec2.Vpc(stack, 'MyVpc', {});
@@ -2617,7 +2617,7 @@ nodeunitShim({
       cluster.addDefaultCloudMapNamespace({ name: 'foo.com' });
 
       // THEN
-      test.throws(() => {
+      expect(() => {
         new ecs.Ec2Service(stack, 'Service', {
           cluster,
           taskDefinition,
@@ -2625,12 +2625,12 @@ nodeunitShim({
             name: 'myApp',
           },
         });
-      }, /Cannot use a service discovery if NetworkMode is None. Use Bridge, Host or AwsVpc instead./);
+      }).toThrow(/Cannot use a service discovery if NetworkMode is None. Use Bridge, Host or AwsVpc instead./);
 
-      test.done();
-    },
 
-    'creates AWS Cloud Map service for Private DNS namespace with bridge network mode'(test: Test) {
+    });
+
+    test('creates AWS Cloud Map service for Private DNS namespace with bridge network mode', () => {
       // GIVEN
       const stack = new cdk.Stack();
       const vpc = new ec2.Vpc(stack, 'MyVpc', {});
@@ -2660,7 +2660,7 @@ nodeunitShim({
       });
 
       // THEN
-      expect(stack).to(haveResource('AWS::ECS::Service', {
+      expect(stack).toHaveResource('AWS::ECS::Service', {
         ServiceRegistries: [
           {
             ContainerName: 'MainContainer',
@@ -2673,9 +2673,9 @@ nodeunitShim({
             },
           },
         ],
-      }));
+      });
 
-      expect(stack).to(haveResource('AWS::ServiceDiscovery::Service', {
+      expect(stack).toHaveResource('AWS::ServiceDiscovery::Service', {
         DnsConfig: {
           DnsRecords: [
             {
@@ -2701,12 +2701,12 @@ nodeunitShim({
             'Id',
           ],
         },
-      }));
+      });
+
 
-      test.done();
-    },
+    });
 
-    'creates AWS Cloud Map service for Private DNS namespace with host network mode'(test: Test) {
+    test('creates AWS Cloud Map service for Private DNS namespace with host network mode', () => {
       // GIVEN
       const stack = new cdk.Stack();
       const vpc = new ec2.Vpc(stack, 'MyVpc', {});
@@ -2737,7 +2737,7 @@ nodeunitShim({
       });
 
       // THEN
-      expect(stack).to(haveResource('AWS::ECS::Service', {
+      expect(stack).toHaveResource('AWS::ECS::Service', {
         ServiceRegistries: [
           {
             ContainerName: 'MainContainer',
@@ -2750,9 +2750,9 @@ nodeunitShim({
             },
           },
         ],
-      }));
+      });
 
-      expect(stack).to(haveResource('AWS::ServiceDiscovery::Service', {
+      expect(stack).toHaveResource('AWS::ServiceDiscovery::Service', {
         DnsConfig: {
           DnsRecords: [
             {
@@ -2778,12 +2778,12 @@ nodeunitShim({
             'Id',
           ],
         },
-      }));
+      });
+
 
-      test.done();
-    },
+    });
 
-    'throws if wrong DNS record type specified with bridge network mode'(test: Test) {
+    test('throws if wrong DNS record type specified with bridge network mode', () => {
       // GIVEN
       const stack = new cdk.Stack();
       const vpc = new ec2.Vpc(stack, 'MyVpc', {});
@@ -2803,7 +2803,7 @@ nodeunitShim({
       });
 
       // THEN
-      test.throws(() => {
+      expect(() => {
         new ecs.Ec2Service(stack, 'Service', {
           cluster,
           taskDefinition,
@@ -2812,12 +2812,12 @@ nodeunitShim({
             dnsRecordType: cloudmap.DnsRecordType.A,
           },
         });
-      }, /SRV records must be used when network mode is Bridge or Host./);
+      }).toThrow(/SRV records must be used when network mode is Bridge or Host./);
+
 
-      test.done();
-    },
+    });
 
-    'creates AWS Cloud Map service for Private DNS namespace with AwsVpc network mode'(test: Test) {
+    test('creates AWS Cloud Map service for Private DNS namespace with AwsVpc network mode', () => {
       // GIVEN
       const stack = new cdk.Stack();
       const vpc = new ec2.Vpc(stack, 'MyVpc', {});
@@ -2848,7 +2848,7 @@ nodeunitShim({
       });
 
       // THEN
-      expect(stack).to(haveResource('AWS::ECS::Service', {
+      expect(stack).toHaveResource('AWS::ECS::Service', {
         ServiceRegistries: [
           {
             RegistryArn: {
@@ -2859,9 +2859,9 @@ nodeunitShim({
             },
           },
         ],
-      }));
+      });
 
-      expect(stack).to(haveResource('AWS::ServiceDiscovery::Service', {
+      expect(stack).toHaveResource('AWS::ServiceDiscovery::Service', {
         DnsConfig: {
           DnsRecords: [
             {
@@ -2887,12 +2887,12 @@ nodeunitShim({
             'Id',
           ],
         },
-      }));
+      });
+
 
-      test.done();
-    },
+    });
 
-    'creates AWS Cloud Map service for Private DNS namespace with AwsVpc network mode with SRV records'(test: Test) {
+    test('creates AWS Cloud Map service for Private DNS namespace with AwsVpc network mode with SRV records', () => {
       // GIVEN
       const stack = new cdk.Stack();
       const vpc = new ec2.Vpc(stack, 'MyVpc', {});
@@ -2924,7 +2924,7 @@ nodeunitShim({
       });
 
       // THEN
-      expect(stack).to(haveResource('AWS::ECS::Service', {
+      expect(stack).toHaveResource('AWS::ECS::Service', {
         ServiceRegistries: [
           {
             ContainerName: 'MainContainer',
@@ -2937,9 +2937,9 @@ nodeunitShim({
             },
           },
         ],
-      }));
+      });
 
-      expect(stack).to(haveResource('AWS::ServiceDiscovery::Service', {
+      expect(stack).toHaveResource('AWS::ServiceDiscovery::Service', {
         DnsConfig: {
           DnsRecords: [
             {
@@ -2965,12 +2965,12 @@ nodeunitShim({
             'Id',
           ],
         },
-      }));
+      });
+
 
-      test.done();
-    },
+    });
 
-    'user can select any container and port'(test: Test) {
+    test('user can select any container and port', () => {
       // GIVEN
       const stack = new cdk.Stack();
       const vpc = new ec2.Vpc(stack, 'MyVpc', {});
@@ -3008,7 +3008,7 @@ nodeunitShim({
       });
 
       // THEN
-      expect(stack).to(haveResourceLike('AWS::ECS::Service', {
+      expect(stack).toHaveResourceLike('AWS::ECS::Service', {
         ServiceRegistries: [
           {
             RegistryArn: { 'Fn::GetAtt': ['ServiceCloudmapService046058A4', 'Arn'] },
@@ -3016,12 +3016,12 @@ nodeunitShim({
             ContainerPort: 8001,
           },
         ],
-      }));
+      });
+
 
-      test.done();
-    },
+    });
 
-    'By default, the container name is the default'(test: Test) {
+    test('By default, the container name is the default', () => {
       // GIVEN
       const stack = new cdk.Stack();
       const vpc = new ec2.Vpc(stack, 'MyVpc', {});
@@ -3053,17 +3053,17 @@ nodeunitShim({
       });
 
       // THEN
-      expect(stack).to(haveResourceLike('AWS::ECS::Service', {
+      expect(stack).toHaveResourceLike('AWS::ECS::Service', {
         ServiceRegistries: [{
           ContainerName: 'main',
           ContainerPort: undefined,
         }],
-      }));
+      });
+
 
-      test.done();
-    },
+    });
 
-    'For SRV, by default, container name is default container and port is the default container port'(test: Test) {
+    test('For SRV, by default, container name is default container and port is the default container port', () => {
       // GIVEN
       const stack = new cdk.Stack();
       const vpc = new ec2.Vpc(stack, 'MyVpc', {});
@@ -3097,17 +3097,17 @@ nodeunitShim({
       });
 
       // THEN
-      expect(stack).to(haveResourceLike('AWS::ECS::Service', {
+      expect(stack).toHaveResourceLike('AWS::ECS::Service', {
         ServiceRegistries: [{
           ContainerName: 'main',
           ContainerPort: 1234,
         }],
-      }));
+      });
+
 
-      test.done();
-    },
+    });
 
-    'allows SRV service discovery to select the container and port'(test: Test) {
+    test('allows SRV service discovery to select the container and port', () => {
       // GIVEN
       const stack = new cdk.Stack();
       const vpc = new ec2.Vpc(stack, 'MyVpc', {});
@@ -3144,17 +3144,17 @@ nodeunitShim({
       });
 
       // THEN
-      expect(stack).to(haveResourceLike('AWS::ECS::Service', {
+      expect(stack).toHaveResourceLike('AWS::ECS::Service', {
         ServiceRegistries: [{
           ContainerName: 'second',
           ContainerPort: 4321,
         }],
-      }));
+      });
+
 
-      test.done();
-    },
+    });
 
-    'throws if SRV and container is not part of task definition'(test: Test) {
+    test('throws if SRV and container is not part of task definition', () => {
       // GIVEN
       const stack = new cdk.Stack();
       const vpc = new ec2.Vpc(stack, 'MyVpc', {});
@@ -3182,7 +3182,7 @@ nodeunitShim({
       });
 
       // WHEN
-      test.throws(() => {
+      expect(() => {
         new ecs.Ec2Service(stack, 'Service', {
           cluster,
           taskDefinition,
@@ -3192,12 +3192,12 @@ nodeunitShim({
             containerPort: 4321,
           },
         });
-      }, /another task definition/i);
+      }).toThrow(/another task definition/i);
+
 
-      test.done();
-    },
+    });
 
-    'throws if SRV and the container port is not mapped'(test: Test) {
+    test('throws if SRV and the container port is not mapped', () => {
       const stack = new cdk.Stack();
       const vpc = new ec2.Vpc(stack, 'MyVpc', {});
       const cluster = new ecs.Cluster(stack, 'EcsCluster', { vpc });
@@ -3217,7 +3217,7 @@ nodeunitShim({
 
       container.addPortMappings({ containerPort: 8000 });
 
-      test.throws(() => {
+      expect(() => {
         new ecs.Ec2Service(stack, 'Service', {
           cluster,
           taskDefinition,
@@ -3227,13 +3227,13 @@ nodeunitShim({
             containerPort: 4321,
           },
         });
-      }, /container port.*not.*mapped/i);
+      }).toThrow(/container port.*not.*mapped/i);
+
 
-      test.done();
-    },
-  },
+    });
+  });
 
-  'Metric'(test: Test) {
+  test('Metric', () => {
     // GIVEN
     const stack = new cdk.Stack();
     const vpc = new ec2.Vpc(stack, 'MyVpc', {});
@@ -3251,7 +3251,7 @@ nodeunitShim({
     });
 
     // THEN
-    test.deepEqual(stack.resolve(service.metricMemoryUtilization()), {
+    expect(stack.resolve(service.metricMemoryUtilization())).toEqual({
       dimensions: {
         ClusterName: { Ref: 'EcsCluster97242B84' },
         ServiceName: { 'Fn::GetAtt': ['ServiceD69D759B', 'Name'] },
@@ -3262,7 +3262,7 @@ nodeunitShim({
       statistic: 'Average',
     });
 
-    test.deepEqual(stack.resolve(service.metricCpuUtilization()), {
+    expect(stack.resolve(service.metricCpuUtilization())).toEqual({
       dimensions: {
         ClusterName: { Ref: 'EcsCluster97242B84' },
         ServiceName: { 'Fn::GetAtt': ['ServiceD69D759B', 'Name'] },
@@ -3273,11 +3273,11 @@ nodeunitShim({
       statistic: 'Average',
     });
 
-    test.done();
-  },
 
-  'When import an EC2 Service': {
-    'with serviceArn'(test: Test) {
+  });
+
+  describe('When import an EC2 Service', () => {
+    test('with serviceArn', () => {
       // GIVEN
       const stack = new cdk.Stack();
       const cluster = new ecs.Cluster(stack, 'EcsCluster');
@@ -3289,13 +3289,13 @@ nodeunitShim({
       });
 
       // THEN
-      test.equal(service.serviceArn, 'arn:aws:ecs:us-west-2:123456789012:service/my-http-service');
-      test.equal(service.serviceName, 'my-http-service');
+      expect(service.serviceArn).toEqual('arn:aws:ecs:us-west-2:123456789012:service/my-http-service');
+      expect(service.serviceName).toEqual('my-http-service');
 
-      test.done();
-    },
 
-    'with serviceName'(test: Test) {
+    });
+
+    test('with serviceName', () => {
       // GIVEN
       const stack = new cdk.Stack();
       const pseudo = new cdk.ScopedAws(stack);
@@ -3308,40 +3308,40 @@ nodeunitShim({
       });
 
       // THEN
-      test.deepEqual(stack.resolve(service.serviceArn), stack.resolve(`arn:${pseudo.partition}:ecs:${pseudo.region}:${pseudo.accountId}:service/my-http-service`));
-      test.equal(service.serviceName, 'my-http-service');
+      expect(stack.resolve(service.serviceArn)).toEqual(stack.resolve(`arn:${pseudo.partition}:ecs:${pseudo.region}:${pseudo.accountId}:service/my-http-service`));
+      expect(service.serviceName).toEqual('my-http-service');
 
-      test.done();
-    },
 
-    'throws an exception if both serviceArn and serviceName were provided for fromEc2ServiceAttributes'(test: Test) {
+    });
+
+    test('throws an exception if both serviceArn and serviceName were provided for fromEc2ServiceAttributes', () => {
       // GIVEN
       const stack = new cdk.Stack();
       const cluster = new ecs.Cluster(stack, 'EcsCluster');
 
-      test.throws(() => {
+      expect(() => {
         ecs.Ec2Service.fromEc2ServiceAttributes(stack, 'EcsService', {
           serviceArn: 'arn:aws:ecs:us-west-2:123456789012:service/my-http-service',
           serviceName: 'my-http-service',
           cluster,
         });
-      }, /only specify either serviceArn or serviceName/);
+      }).toThrow(/only specify either serviceArn or serviceName/);
 
-      test.done();
-    },
 
-    'throws an exception if neither serviceArn nor serviceName were provided for fromEc2ServiceAttributes'(test: Test) {
+    });
+
+    test('throws an exception if neither serviceArn nor serviceName were provided for fromEc2ServiceAttributes', () => {
       // GIVEN
       const stack = new cdk.Stack();
       const cluster = new ecs.Cluster(stack, 'EcsCluster');
 
-      test.throws(() => {
+      expect(() => {
         ecs.Ec2Service.fromEc2ServiceAttributes(stack, 'EcsService', {
           cluster,
         });
-      }, /only specify either serviceArn or serviceName/);
+      }).toThrow(/only specify either serviceArn or serviceName/);
 
-      test.done();
-    },
-  },
+
+    });
+  });
 });
diff --git a/packages/@aws-cdk/aws-ecs/test/environment-file.test.ts b/packages/@aws-cdk/aws-ecs/test/environment-file.test.ts
index e80651cbbd65b..815973a80e602 100644
--- a/packages/@aws-cdk/aws-ecs/test/environment-file.test.ts
+++ b/packages/@aws-cdk/aws-ecs/test/environment-file.test.ts
@@ -1,23 +1,23 @@
+import '@aws-cdk/assert-internal/jest';
 import * as path from 'path';
 import * as cdk from '@aws-cdk/core';
-import { nodeunitShim, Test } from 'nodeunit-shim';
 import * as ecs from '../lib';
 
 /* eslint-disable dot-notation */
 
-nodeunitShim({
-  'ecs.EnvironmentFile.fromAsset': {
-    'fails if asset is not a single file'(test: Test) {
+describe('environment file', () => {
+  describe('ecs.EnvironmentFile.fromAsset', () => {
+    test('fails if asset is not a single file', () => {
       // GIVEN
       const stack = new cdk.Stack();
       const fileAsset = ecs.EnvironmentFile.fromAsset(path.join(__dirname, 'demo-envfiles'));
 
       // THEN
-      test.throws(() => defineContainerDefinition(stack, fileAsset), /Asset must be a single file/);
-      test.done();
-    },
+      expect(() => defineContainerDefinition(stack, fileAsset)).toThrow(/Asset must be a single file/);
 
-    'only one environment file asset object is created even if multiple container definitions use the same file'(test: Test) {
+    });
+
+    test('only one environment file asset object is created even if multiple container definitions use the same file', () => {
       // GIVEN
       const app = new cdk.App();
       const stack = new cdk.Stack(app);
@@ -41,10 +41,10 @@ nodeunitShim({
       const synthesized = assembly.stacks[0];
 
       // container one has an asset, container two does not
-      test.deepEqual(synthesized.assets.length, 1);
-      test.done();
-    },
-  },
+      expect(synthesized.assets.length).toEqual(1);
+
+    });
+  });
 });
 
 function defineContainerDefinition(stack: cdk.Stack, environmentFile: ecs.EnvironmentFile) {
diff --git a/packages/@aws-cdk/aws-ecs/test/external/external-service.test.ts b/packages/@aws-cdk/aws-ecs/test/external/external-service.test.ts
index d01eaa14f11b9..94384a464bb47 100644
--- a/packages/@aws-cdk/aws-ecs/test/external/external-service.test.ts
+++ b/packages/@aws-cdk/aws-ecs/test/external/external-service.test.ts
@@ -4,13 +4,12 @@ import * as ec2 from '@aws-cdk/aws-ec2';
 import * as elbv2 from '@aws-cdk/aws-elasticloadbalancingv2';
 import * as cloudmap from '@aws-cdk/aws-servicediscovery';
 import * as cdk from '@aws-cdk/core';
-import { nodeunitShim, Test } from 'nodeunit-shim';
 import * as ecs from '../../lib';
 import { LaunchType } from '../../lib/base/base-service';
 
-nodeunitShim({
-  'When creating an External Service': {
-    'with only required properties set, it correctly sets default properties'(test: Test) {
+describe('external service', () => {
+  describe('When creating an External Service', () => {
+    test('with only required properties set, it correctly sets default properties', () => {
       // GIVEN
       const stack = new cdk.Stack();
       const vpc = new ec2.Vpc(stack, 'MyVpc', {});
@@ -44,13 +43,13 @@ nodeunitShim({
         LaunchType: LaunchType.EXTERNAL,
       });
 
-      test.notEqual(service.node.defaultChild, undefined);
+      expect(service.node.defaultChild).toBeDefined();
 
-      test.done();
-    },
-  },
 
-  'with all properties set'(test: Test) {
+    });
+  });
+
+  test('with all properties set', () => {
     // GIVEN
     const stack = new cdk.Stack();
     const vpc = new ec2.Vpc(stack, 'MyVpc', {});
@@ -97,10 +96,10 @@ nodeunitShim({
       ServiceName: 'bonjour',
     });
 
-    test.done();
-  },
 
-  'with cloudmap set on cluster, throw error'(test: Test) {
+  });
+
+  test('with cloudmap set on cluster, throw error', () => {
     // GIVEN
     const stack = new cdk.Stack();
     const vpc = new ec2.Vpc(stack, 'MyVpc', {});
@@ -130,10 +129,10 @@ nodeunitShim({
       serviceName: 'bonjour',
     })).toThrow('Cloud map integration is not supported for External service' );
 
-    test.done();
-  },
 
-  'with multiple security groups, it correctly updates the cfn template'(test: Test) {
+  });
+
+  test('with multiple security groups, it correctly updates the cfn template', () => {
     // GIVEN
     const stack = new cdk.Stack();
     const vpc = new ec2.Vpc(stack, 'MyVpc', {});
@@ -205,10 +204,10 @@ nodeunitShim({
       ],
     });
 
-    test.done();
-  },
 
-  'throws when task definition is not External compatible'(test: Test) {
+  });
+
+  test('throws when task definition is not External compatible', () => {
     const stack = new cdk.Stack();
     const vpc = new ec2.Vpc(stack, 'MyVpc', {});
     const cluster = new ecs.Cluster(stack, 'EcsCluster', { vpc });
@@ -227,10 +226,10 @@ nodeunitShim({
       taskDefinition,
     })).toThrow('Supplied TaskDefinition is not configured for compatibility with ECS Anywhere cluster');
 
-    test.done();
-  },
 
-  'errors if minimum not less than maximum'(test: Test) {
+  });
+
+  test('errors if minimum not less than maximum', () => {
     // GIVEN
     const stack = new cdk.Stack();
     const vpc = new ec2.Vpc(stack, 'MyVpc', {});
@@ -250,10 +249,10 @@ nodeunitShim({
       maxHealthyPercent: 100,
     })).toThrow('Minimum healthy percent must be less than maximum healthy percent.');
 
-    test.done();
-  },
 
-  'error if cloudmap options provided with external service'(test: Test) {
+  });
+
+  test('error if cloudmap options provided with external service', () => {
     // GIVEN
     const stack = new cdk.Stack();
     const vpc = new ec2.Vpc(stack, 'MyVpc', {});
@@ -276,10 +275,10 @@ nodeunitShim({
     })).toThrow('Cloud map options are not supported for External service');
 
     // THEN
-    test.done();
-  },
 
-  'error if enableExecuteCommand options provided with external service'(test: Test) {
+  });
+
+  test('error if enableExecuteCommand options provided with external service', () => {
     // GIVEN
     const stack = new cdk.Stack();
     const vpc = new ec2.Vpc(stack, 'MyVpc', {});
@@ -300,10 +299,10 @@ nodeunitShim({
     })).toThrow('Enable Execute Command options are not supported for External service');
 
     // THEN
-    test.done();
-  },
 
-  'error if capacityProviderStrategies options provided with external service'(test: Test) {
+  });
+
+  test('error if capacityProviderStrategies options provided with external service', () => {
     // GIVEN
     const stack = new cdk.Stack();
     const vpc = new ec2.Vpc(stack, 'MyVpc', {});
@@ -338,10 +337,10 @@ nodeunitShim({
     })).toThrow('Capacity Providers are not supported for External service');
 
     // THEN
-    test.done();
-  },
 
-  'error when performing attachToApplicationTargetGroup to an external service'(test: Test) {
+  });
+
+  test('error when performing attachToApplicationTargetGroup to an external service', () => {
     // GIVEN
     const stack = new cdk.Stack();
     const vpc = new ec2.Vpc(stack, 'MyVpc', {});
@@ -369,10 +368,10 @@ nodeunitShim({
     expect(() => service.attachToApplicationTargetGroup(targetGroup)).toThrow('Application load balancer cannot be attached to an external service');
 
     // THEN
-    test.done();
-  },
 
-  'error when performing loadBalancerTarget to an external service'(test: Test) {
+  });
+
+  test('error when performing loadBalancerTarget to an external service', () => {
     // GIVEN
     const stack = new cdk.Stack();
     const vpc = new ec2.Vpc(stack, 'MyVpc', {});
@@ -396,10 +395,10 @@ nodeunitShim({
     })).toThrow('External service cannot be attached as load balancer targets');
 
     // THEN
-    test.done();
-  },
 
-  'error when performing registerLoadBalancerTargets to an external service'(test: Test) {
+  });
+
+  test('error when performing registerLoadBalancerTargets to an external service', () => {
     // GIVEN
     const stack = new cdk.Stack();
     const vpc = new ec2.Vpc(stack, 'MyVpc', {});
@@ -430,10 +429,10 @@ nodeunitShim({
     )).toThrow('External service cannot be registered as load balancer targets');
 
     // THEN
-    test.done();
-  },
 
-  'error when performing autoScaleTaskCount to an external service'(test: Test) {
+  });
+
+  test('error when performing autoScaleTaskCount to an external service', () => {
     // GIVEN
     const stack = new cdk.Stack();
     const vpc = new ec2.Vpc(stack, 'MyVpc', {});
@@ -458,10 +457,10 @@ nodeunitShim({
     })).toThrow('Autoscaling not supported for external service');
 
     // THEN
-    test.done();
-  },
 
-  'error when performing enableCloudMap to an external service'(test: Test) {
+  });
+
+  test('error when performing enableCloudMap to an external service', () => {
     // GIVEN
     const stack = new cdk.Stack();
     const vpc = new ec2.Vpc(stack, 'MyVpc', {});
@@ -483,10 +482,10 @@ nodeunitShim({
     expect(() => service.enableCloudMap({})).toThrow('Cloud map integration not supported for an external service');
 
     // THEN
-    test.done();
-  },
 
-  'error when performing associateCloudMapService to an external service'(test: Test) {
+  });
+
+  test('error when performing associateCloudMapService to an external service', () => {
     // GIVEN
     const stack = new cdk.Stack();
     const vpc = new ec2.Vpc(stack, 'MyVpc', {});
@@ -523,6 +522,6 @@ nodeunitShim({
     })).toThrow('Cloud map service association is not supported for an external service');
 
     // THEN
-    test.done();
-  },
+
+  });
 });
diff --git a/packages/@aws-cdk/aws-ecs/test/external/external-task-definition.test.ts b/packages/@aws-cdk/aws-ecs/test/external/external-task-definition.test.ts
index c5fd8f942f1f0..c4e296b2c6831 100644
--- a/packages/@aws-cdk/aws-ecs/test/external/external-task-definition.test.ts
+++ b/packages/@aws-cdk/aws-ecs/test/external/external-task-definition.test.ts
@@ -6,12 +6,11 @@ import * as iam from '@aws-cdk/aws-iam';
 import * as secretsmanager from '@aws-cdk/aws-secretsmanager';
 import * as ssm from '@aws-cdk/aws-ssm';
 import * as cdk from '@aws-cdk/core';
-import { nodeunitShim, Test } from 'nodeunit-shim';
 import * as ecs from '../../lib';
 
-nodeunitShim({
-  'When creating an External TaskDefinition': {
-    'with only required properties set, it correctly sets default properties'(test: Test) {
+describe('external task definition', () => {
+  describe('When creating an External TaskDefinition', () => {
+    test('with only required properties set, it correctly sets default properties', () => {
       // GIVEN
       const stack = new cdk.Stack();
       new ecs.ExternalTaskDefinition(stack, 'ExternalTaskDef');
@@ -23,10 +22,10 @@ nodeunitShim({
         RequiresCompatibilities: ['EXTERNAL'],
       });
 
-      test.done();
-    },
 
-    'with all properties set'(test: Test) {
+    });
+
+    test('with all properties set', () => {
       // GIVEN
       const stack = new cdk.Stack();
       new ecs.ExternalTaskDefinition(stack, 'ExternalTaskDef', {
@@ -64,10 +63,10 @@ nodeunitShim({
         },
       });
 
-      test.done();
-    },
 
-    'correctly sets containers'(test: Test) {
+    });
+
+    test('correctly sets containers', () => {
       // GIVEN
       const stack = new cdk.Stack();
 
@@ -131,10 +130,10 @@ nodeunitShim({
         },
       });
 
-      test.done();
-    },
 
-    'all container definition options defined'(test: Test) {
+    });
+
+    test('all container definition options defined', () => {
       const stack = new cdk.Stack();
 
       const taskDefinition = new ecs.ExternalTaskDefinition(stack, 'ExternalTaskDef');
@@ -330,10 +329,10 @@ nodeunitShim({
         ],
       });
 
-      test.done();
-    },
 
-    'correctly sets containers from ECR repository using all props'(test: Test) {
+    });
+
+    test('correctly sets containers from ECR repository using all props', () => {
       // GIVEN
       const stack = new cdk.Stack();
 
@@ -423,11 +422,11 @@ nodeunitShim({
         }],
       });
 
-      test.done();
-    },
-  },
 
-  'correctly sets containers from ECR repository using an image tag'(test: Test) {
+    });
+  });
+
+  test('correctly sets containers from ECR repository using an image tag', () => {
     // GIVEN
     const stack = new cdk.Stack();
 
@@ -498,10 +497,10 @@ nodeunitShim({
       }],
     });
 
-    test.done();
-  },
 
-  'correctly sets containers from ECR repository using an image digest'(test: Test) {
+  });
+
+  test('correctly sets containers from ECR repository using an image digest', () => {
     // GIVEN
     const stack = new cdk.Stack();
     const taskDefinition = new ecs.ExternalTaskDefinition(stack, 'ExternalTaskDef');
@@ -571,10 +570,10 @@ nodeunitShim({
       }],
     });
 
-    test.done();
-  },
 
-  'correctly sets containers from ECR repository using default props'(test: Test) {
+  });
+
+  test('correctly sets containers from ECR repository using default props', () => {
     // GIVEN
     const stack = new cdk.Stack();
     const taskDefinition = new ecs.ExternalTaskDefinition(stack, 'ExternalTaskDef');
@@ -588,10 +587,10 @@ nodeunitShim({
     // THEN
     expect(stack).toHaveResource('AWS::ECR::Repository', {});
 
-    test.done();
-  },
 
-  'warns when setting containers from ECR repository using fromRegistry method'(test: Test) {
+  });
+
+  test('warns when setting containers from ECR repository using fromRegistry method', () => {
     // GIVEN
     const stack = new cdk.Stack();
 
@@ -605,10 +604,10 @@ nodeunitShim({
     // THEN
     expect(container.node.metadata[0].data).toEqual("Proper policies need to be attached before pulling from ECR repository, or use 'fromEcrRepository'.");
 
-    test.done();
-  },
 
-  'correctly sets volumes from'(test: Test) {
+  });
+
+  test('correctly sets volumes from', () => {
     const stack = new cdk.Stack();
     const taskDefinition = new ecs.ExternalTaskDefinition(stack, 'ExternalTaskDef', {});
 
@@ -620,10 +619,10 @@ nodeunitShim({
       name: 'scratch',
     })).toThrow('External task definitions doesnt support volumes' );
 
-    test.done();
-  },
 
-  'error when interferenceAccelerators set'(test: Test) {
+  });
+
+  test('error when interferenceAccelerators set', () => {
     const stack = new cdk.Stack();
     const taskDefinition = new ecs.ExternalTaskDefinition(stack, 'ExternalTaskDef', {});
 
@@ -633,6 +632,6 @@ nodeunitShim({
       deviceType: 'eia2.medium',
     })).toThrow('Cannot use inference accelerators on tasks that run on External service');
 
-    test.done();
-  },
+
+  });
 });
\ No newline at end of file
diff --git a/packages/@aws-cdk/aws-ecs/test/fargate/fargate-service.test.ts b/packages/@aws-cdk/aws-ecs/test/fargate/fargate-service.test.ts
index f7c33eb7b8af9..ef4ceae4ccedc 100644
--- a/packages/@aws-cdk/aws-ecs/test/fargate/fargate-service.test.ts
+++ b/packages/@aws-cdk/aws-ecs/test/fargate/fargate-service.test.ts
@@ -1,4 +1,5 @@
-import { expect, haveResource, haveResourceLike, ABSENT } from '@aws-cdk/assert-internal';
+import '@aws-cdk/assert-internal/jest';
+import { ABSENT, SynthUtils } from '@aws-cdk/assert-internal';
 import * as appscaling from '@aws-cdk/aws-applicationautoscaling';
 import * as cloudwatch from '@aws-cdk/aws-cloudwatch';
 import * as ec2 from '@aws-cdk/aws-ec2';
@@ -9,13 +10,12 @@ import * as s3 from '@aws-cdk/aws-s3';
 import * as secretsmanager from '@aws-cdk/aws-secretsmanager';
 import * as cloudmap from '@aws-cdk/aws-servicediscovery';
 import * as cdk from '@aws-cdk/core';
-import { nodeunitShim, Test } from 'nodeunit-shim';
 import * as ecs from '../../lib';
 import { DeploymentControllerType, LaunchType, PropagatedTagSource } from '../../lib/base/base-service';
 
-nodeunitShim({
-  'When creating a Fargate Service': {
-    'with only required properties set, it correctly sets default properties'(test: Test) {
+describe('fargate service', () => {
+  describe('When creating a Fargate Service', () => {
+    test('with only required properties set, it correctly sets default properties', () => {
       // GIVEN
       const stack = new cdk.Stack();
       const vpc = new ec2.Vpc(stack, 'MyVpc', {});
@@ -32,7 +32,7 @@ nodeunitShim({
       });
 
       // THEN
-      expect(stack).to(haveResource('AWS::ECS::Service', {
+      expect(stack).toHaveResource('AWS::ECS::Service', {
         TaskDefinition: {
           Ref: 'FargateTaskDefC6FB60B4',
         },
@@ -66,9 +66,9 @@ nodeunitShim({
             ],
           },
         },
-      }));
+      });
 
-      expect(stack).to(haveResource('AWS::EC2::SecurityGroup', {
+      expect(stack).toHaveResource('AWS::EC2::SecurityGroup', {
         GroupDescription: 'Default/FargateService/SecurityGroup',
         SecurityGroupEgress: [
           {
@@ -80,14 +80,14 @@ nodeunitShim({
         VpcId: {
           Ref: 'MyVpcF9F0CA6F',
         },
-      }));
+      });
+
+      expect(service.node.defaultChild).toBeDefined();
 
-      test.notEqual(service.node.defaultChild, undefined);
 
-      test.done();
-    },
+    });
 
-    'can create service with default settings if VPC only has public subnets'(test: Test) {
+    test('can create service with default settings if VPC only has public subnets', () => {
       // GIVEN
       const stack = new cdk.Stack();
       const vpc = new ec2.Vpc(stack, 'MyVpc', {
@@ -112,10 +112,10 @@ nodeunitShim({
       });
 
       // THEN -- did not throw
-      test.done();
-    },
 
-    'does not set launchType when capacity provider strategies specified (deprecated)'(test: Test) {
+    });
+
+    test('does not set launchType when capacity provider strategies specified (deprecated)', () => {
       // GIVEN
       const stack = new cdk.Stack();
       const vpc = new ec2.Vpc(stack, 'MyVpc', {});
@@ -147,15 +147,15 @@ nodeunitShim({
       });
 
       // THEN
-      expect(stack).to(haveResource('AWS::ECS::Cluster', {
+      expect(stack).toHaveResource('AWS::ECS::Cluster', {
         CapacityProviders: ABSENT,
-      }));
+      });
 
-      expect(stack).to(haveResource('AWS::ECS::ClusterCapacityProviderAssociations', {
+      expect(stack).toHaveResource('AWS::ECS::ClusterCapacityProviderAssociations', {
         CapacityProviders: ['FARGATE', 'FARGATE_SPOT'],
-      }));
+      });
 
-      expect(stack).to(haveResource('AWS::ECS::Service', {
+      expect(stack).toHaveResource('AWS::ECS::Service', {
         TaskDefinition: {
           Ref: 'FargateTaskDefC6FB60B4',
         },
@@ -199,12 +199,12 @@ nodeunitShim({
             ],
           },
         },
-      }));
+      });
 
-      test.done();
-    },
 
-    'does not set launchType when capacity provider strategies specified'(test: Test) {
+    });
+
+    test('does not set launchType when capacity provider strategies specified', () => {
       // GIVEN
       const stack = new cdk.Stack();
       const vpc = new ec2.Vpc(stack, 'MyVpc', {});
@@ -237,15 +237,15 @@ nodeunitShim({
       });
 
       // THEN
-      expect(stack).to(haveResource('AWS::ECS::Cluster', {
+      expect(stack).toHaveResource('AWS::ECS::Cluster', {
         CapacityProviders: ABSENT,
-      }));
+      });
 
-      expect(stack).to(haveResource('AWS::ECS::ClusterCapacityProviderAssociations', {
+      expect(stack).toHaveResource('AWS::ECS::ClusterCapacityProviderAssociations', {
         CapacityProviders: ['FARGATE', 'FARGATE_SPOT'],
-      }));
+      });
 
-      expect(stack).to(haveResource('AWS::ECS::Service', {
+      expect(stack).toHaveResource('AWS::ECS::Service', {
         TaskDefinition: {
           Ref: 'FargateTaskDefC6FB60B4',
         },
@@ -290,12 +290,12 @@ nodeunitShim({
             ],
           },
         },
-      }));
+      });
+
 
-      test.done();
-    },
+    });
 
-    'with custom cloudmap namespace'(test: Test) {
+    test('with custom cloudmap namespace', () => {
       // GIVEN
       const stack = new cdk.Stack();
       const vpc = new ec2.Vpc(stack, 'MyVpc', {});
@@ -324,7 +324,7 @@ nodeunitShim({
       });
 
       // THEN
-      expect(stack).to(haveResource('AWS::ServiceDiscovery::Service', {
+      expect(stack).toHaveResource('AWS::ServiceDiscovery::Service', {
         DnsConfig: {
           DnsRecords: [
             {
@@ -350,19 +350,19 @@ nodeunitShim({
             'Id',
           ],
         },
-      }));
+      });
 
-      expect(stack).to(haveResource('AWS::ServiceDiscovery::PrivateDnsNamespace', {
+      expect(stack).toHaveResource('AWS::ServiceDiscovery::PrivateDnsNamespace', {
         Name: 'scorekeep.com',
         Vpc: {
           Ref: 'MyVpcF9F0CA6F',
         },
-      }));
+      });
 
-      test.done();
-    },
 
-    'with user-provided cloudmap service'(test: Test) {
+    });
+
+    test('with user-provided cloudmap service', () => {
       // GIVEN
       const stack = new cdk.Stack();
       const vpc = new ec2.Vpc(stack, 'MyVpc', {});
@@ -399,7 +399,7 @@ nodeunitShim({
       });
 
       // THEN
-      expect(stack).to(haveResource('AWS::ECS::Service', {
+      expect(stack).toHaveResource('AWS::ECS::Service', {
         ServiceRegistries: [
           {
             ContainerName: 'web',
@@ -407,12 +407,12 @@ nodeunitShim({
             RegistryArn: { 'Fn::GetAtt': ['ServiceDBC79909', 'Arn'] },
           },
         ],
-      }));
+      });
 
-      test.done();
-    },
 
-    'errors when more than one service registry used'(test: Test) {
+    });
+
+    test('errors when more than one service registry used', () => {
       // GIVEN
       const stack = new cdk.Stack();
       const vpc = new ec2.Vpc(stack, 'MyVpc', {});
@@ -446,18 +446,18 @@ nodeunitShim({
       });
 
       // WHEN / THEN
-      test.throws(() => {
+      expect(() => {
         ecsService.associateCloudMapService({
           service: cloudMapService,
           container: container,
           containerPort: 8000,
         });
-      }, /at most one service registry/i);
+      }).toThrow(/at most one service registry/i);
 
-      test.done();
-    },
 
-    'with all properties set'(test: Test) {
+    });
+
+    test('with all properties set', () => {
       // GIVEN
       const stack = new cdk.Stack();
       const vpc = new ec2.Vpc(stack, 'MyVpc', {});
@@ -503,9 +503,9 @@ nodeunitShim({
       });
 
       // THEN
-      test.ok(svc.cloudMapService !== undefined);
+      expect(svc.cloudMapService).toBeDefined();
 
-      expect(stack).to(haveResource('AWS::ECS::Service', {
+      expect(stack).toHaveResource('AWS::ECS::Service', {
         TaskDefinition: {
           Ref: 'FargateTaskDefC6FB60B4',
         },
@@ -558,12 +558,12 @@ nodeunitShim({
             },
           },
         ],
-      }));
+      });
 
-      test.done();
-    },
 
-    'throws when task definition is not Fargate compatible'(test: Test) {
+    });
+
+    test('throws when task definition is not Fargate compatible', () => {
       const stack = new cdk.Stack();
       const vpc = new ec2.Vpc(stack, 'MyVpc', {});
       const cluster = new ecs.Cluster(stack, 'EcsCluster', { vpc });
@@ -576,17 +576,17 @@ nodeunitShim({
       });
 
       // THEN
-      test.throws(() => {
+      expect(() => {
         new ecs.FargateService(stack, 'FargateService', {
           cluster,
           taskDefinition,
         });
-      }, /Supplied TaskDefinition is not configured for compatibility with Fargate/);
+      }).toThrow(/Supplied TaskDefinition is not configured for compatibility with Fargate/);
 
-      test.done();
-    },
 
-    'throws whith secret json field on unsupported platform version'(test: Test) {
+    });
+
+    test('throws whith secret json field on unsupported platform version', () => {
       const stack = new cdk.Stack();
       const vpc = new ec2.Vpc(stack, 'MyVpc', {});
       const cluster = new ecs.Cluster(stack, 'EcsCluster', { vpc });
@@ -600,18 +600,18 @@ nodeunitShim({
       });
 
       // THEN
-      test.throws(() => {
+      expect(() => {
         new ecs.FargateService(stack, 'FargateService', {
           cluster,
           taskDefinition,
           platformVersion: ecs.FargatePlatformVersion.VERSION1_3,
         });
-      }, new RegExp(`uses at least one container that references a secret JSON field.+platform version ${ecs.FargatePlatformVersion.VERSION1_4} or later`));
+      }).toThrow(new RegExp(`uses at least one container that references a secret JSON field.+platform version ${ecs.FargatePlatformVersion.VERSION1_4} or later`));
+
 
-      test.done();
-    },
+    });
 
-    'ignore task definition and launch type if deployment controller is set to be EXTERNAL'(test: Test) {
+    test('ignore task definition and launch type if deployment controller is set to be EXTERNAL', () => {
       // GIVEN
       const stack = new cdk.Stack();
       const vpc = new ec2.Vpc(stack, 'MyVpc', {});
@@ -631,8 +631,8 @@ nodeunitShim({
       });
 
       // THEN
-      test.deepEqual(service.node.metadata[0].data, 'taskDefinition and launchType are blanked out when using external deployment controller.');
-      expect(stack).to(haveResource('AWS::ECS::Service', {
+      expect(service.node.metadata[0].data).toEqual('taskDefinition and launchType are blanked out when using external deployment controller.');
+      expect(stack).toHaveResource('AWS::ECS::Service', {
         Cluster: {
           Ref: 'EcsCluster97242B84',
         },
@@ -665,12 +665,12 @@ nodeunitShim({
             ],
           },
         },
-      }));
+      });
+
 
-      test.done();
-    },
+    });
 
-    'errors when no container specified on task definition'(test: Test) {
+    test('errors when no container specified on task definition', () => {
       // GIVEN
       const stack = new cdk.Stack();
       const vpc = new ec2.Vpc(stack, 'MyVpc', {});
@@ -684,14 +684,14 @@ nodeunitShim({
       });
 
       // THEN
-      test.throws(() => {
-        expect(stack);
-      }, /one essential container/);
+      expect(() => {
+        SynthUtils.synthesize(stack);
+      }).toThrow(/one essential container/);
+
 
-      test.done();
-    },
+    });
 
-    'allows adding the default container after creating the service'(test: Test) {
+    test('allows adding the default container after creating the service', () => {
       // GIVEN
       const stack = new cdk.Stack();
       const vpc = new ec2.Vpc(stack, 'MyVpc', {});
@@ -709,18 +709,18 @@ nodeunitShim({
       });
 
       // THEN
-      expect(stack).to(haveResourceLike('AWS::ECS::TaskDefinition', {
+      expect(stack).toHaveResourceLike('AWS::ECS::TaskDefinition', {
         ContainerDefinitions: [
           {
             Name: 'main',
           },
         ],
-      }));
+      });
+
 
-      test.done();
-    },
+    });
 
-    'allows specifying assignPublicIP as enabled'(test: Test) {
+    test('allows specifying assignPublicIP as enabled', () => {
       // GIVEN
       const stack = new cdk.Stack();
       const vpc = new ec2.Vpc(stack, 'MyVpc', {});
@@ -738,18 +738,18 @@ nodeunitShim({
       });
 
       // THEN
-      expect(stack).to(haveResourceLike('AWS::ECS::Service', {
+      expect(stack).toHaveResourceLike('AWS::ECS::Service', {
         NetworkConfiguration: {
           AwsvpcConfiguration: {
             AssignPublicIp: 'ENABLED',
           },
         },
-      }));
+      });
+
 
-      test.done();
-    },
+    });
 
-    'allows specifying 0 for minimumHealthyPercent'(test: Test) {
+    test('allows specifying 0 for minimumHealthyPercent', () => {
       // GIVEN
       const stack = new cdk.Stack();
       const vpc = new ec2.Vpc(stack, 'MyVpc', {});
@@ -767,16 +767,16 @@ nodeunitShim({
       });
 
       // THEN
-      expect(stack).to(haveResourceLike('AWS::ECS::Service', {
+      expect(stack).toHaveResourceLike('AWS::ECS::Service', {
         DeploymentConfiguration: {
           MinimumHealthyPercent: 0,
         },
-      }));
+      });
 
-      test.done();
-    },
 
-    'throws when securityGroup and securityGroups are supplied'(test: Test) {
+    });
+
+    test('throws when securityGroup and securityGroups are supplied', () => {
       // GIVEN
       const stack = new cdk.Stack();
       const vpc = new ec2.Vpc(stack, 'MyVpc', {});
@@ -800,19 +800,19 @@ nodeunitShim({
       });
 
       // THEN
-      test.throws(() => {
+      expect(() => {
         new ecs.FargateService(stack, 'FargateService', {
           cluster,
           taskDefinition,
           securityGroup: securityGroup1,
           securityGroups: [securityGroup2],
         });
-      }, /Only one of SecurityGroup or SecurityGroups can be populated./);
+      }).toThrow(/Only one of SecurityGroup or SecurityGroups can be populated./);
+
 
-      test.done();
-    },
+    });
 
-    'with multiple securty groups, it correctly updates cloudformation template'(test: Test) {
+    test('with multiple securty groups, it correctly updates cloudformation template', () => {
       // GIVEN
       const stack = new cdk.Stack();
       const vpc = new ec2.Vpc(stack, 'MyVpc', {});
@@ -842,7 +842,7 @@ nodeunitShim({
       });
 
       // THEN
-      expect(stack).to(haveResource('AWS::ECS::Service', {
+      expect(stack).toHaveResource('AWS::ECS::Service', {
         TaskDefinition: {
           Ref: 'FargateTaskDefC6FB60B4',
         },
@@ -882,9 +882,9 @@ nodeunitShim({
             ],
           },
         },
-      }));
+      });
 
-      expect(stack).to(haveResource('AWS::EC2::SecurityGroup', {
+      expect(stack).toHaveResource('AWS::EC2::SecurityGroup', {
         GroupDescription: 'Example',
         GroupName: 'Bingo',
         SecurityGroupEgress: [
@@ -897,9 +897,9 @@ nodeunitShim({
         VpcId: {
           Ref: 'MyVpcF9F0CA6F',
         },
-      }));
+      });
 
-      expect(stack).to(haveResource('AWS::EC2::SecurityGroup', {
+      expect(stack).toHaveResource('AWS::EC2::SecurityGroup', {
         GroupDescription: 'Example',
         GroupName: 'Rolly',
         SecurityGroupEgress: [
@@ -914,15 +914,15 @@ nodeunitShim({
         VpcId: {
           Ref: 'MyVpcF9F0CA6F',
         },
-      }));
+      });
 
-      test.done();
-    },
 
-  },
+    });
+
+  });
 
-  'When setting up a health check': {
-    'grace period is respected'(test: Test) {
+  describe('When setting up a health check', () => {
+    test('grace period is respected', () => {
       // GIVEN
       const stack = new cdk.Stack();
       const vpc = new ec2.Vpc(stack, 'MyVpc', {});
@@ -940,16 +940,16 @@ nodeunitShim({
       });
 
       // THEN
-      expect(stack).to(haveResource('AWS::ECS::Service', {
+      expect(stack).toHaveResource('AWS::ECS::Service', {
         HealthCheckGracePeriodSeconds: 10,
-      }));
+      });
 
-      test.done();
-    },
-  },
 
-  'When adding an app load balancer': {
-    'allows auto scaling by ALB request per target'(test: Test) {
+    });
+  });
+
+  describe('When adding an app load balancer', () => {
+    test('allows auto scaling by ALB request per target', () => {
       // GIVEN
       const stack = new cdk.Stack();
       const vpc = new ec2.Vpc(stack, 'MyVpc', {});
@@ -976,7 +976,7 @@ nodeunitShim({
       });
 
       // THEN
-      expect(stack).to(haveResource('AWS::ApplicationAutoScaling::ScalableTarget', {
+      expect(stack).toHaveResource('AWS::ApplicationAutoScaling::ScalableTarget', {
         MaxCapacity: 10,
         MinCapacity: 1,
         ResourceId: {
@@ -997,9 +997,9 @@ nodeunitShim({
             ],
           ],
         },
-      }));
+      });
 
-      expect(stack).to(haveResource('AWS::ApplicationAutoScaling::ScalingPolicy', {
+      expect(stack).toHaveResource('AWS::ApplicationAutoScaling::ScalingPolicy', {
         TargetTrackingScalingPolicyConfiguration: {
           PredefinedMetricSpecification: {
             PredefinedMetricType: 'ALBRequestCountPerTarget',
@@ -1014,18 +1014,18 @@ nodeunitShim({
           },
           TargetValue: 1000,
         },
-      }));
+      });
 
-      expect(stack).to(haveResource('AWS::ECS::Service', {
+      expect(stack).toHaveResource('AWS::ECS::Service', {
         // if any load balancer is configured and healthCheckGracePeriodSeconds is not
         // set, then it should default to 60 seconds.
         HealthCheckGracePeriodSeconds: 60,
-      }));
+      });
 
-      test.done();
-    },
 
-    'allows auto scaling by ALB with new service arn format'(test: Test) {
+    });
+
+    test('allows auto scaling by ALB with new service arn format', () => {
       // GIVEN
       const stack = new cdk.Stack();
       const vpc = new ec2.Vpc(stack, 'MyVpc', {});
@@ -1056,7 +1056,7 @@ nodeunitShim({
       });
 
       // THEN
-      expect(stack).to(haveResource('AWS::ApplicationAutoScaling::ScalableTarget', {
+      expect(stack).toHaveResource('AWS::ApplicationAutoScaling::ScalableTarget', {
         MaxCapacity: 10,
         MinCapacity: 1,
         ResourceId: {
@@ -1077,13 +1077,13 @@ nodeunitShim({
             ],
           ],
         },
-      }));
+      });
 
-      test.done();
-    },
 
-    'allows specify any existing container name and port in a service': {
-      'with default setting'(test: Test) {
+    });
+
+    describe('allows specify any existing container name and port in a service', () => {
+      test('with default setting', () => {
         // GIVEN
         const stack = new cdk.Stack();
         const vpc = new ec2.Vpc(stack, 'MyVpc', {});
@@ -1111,7 +1111,7 @@ nodeunitShim({
         });
 
         // THEN
-        expect(stack).to(haveResource('AWS::ECS::Service', {
+        expect(stack).toHaveResource('AWS::ECS::Service', {
           LoadBalancers: [
             {
               ContainerName: 'MainContainer',
@@ -1121,24 +1121,24 @@ nodeunitShim({
               },
             },
           ],
-        }));
+        });
 
-        expect(stack).to(haveResource('AWS::EC2::SecurityGroupIngress', {
+        expect(stack).toHaveResource('AWS::EC2::SecurityGroupIngress', {
           Description: 'Load balancer to target',
           FromPort: 8000,
           ToPort: 8000,
-        }));
+        });
 
-        expect(stack).to(haveResource('AWS::EC2::SecurityGroupEgress', {
+        expect(stack).toHaveResource('AWS::EC2::SecurityGroupEgress', {
           Description: 'Load balancer to target',
           FromPort: 8000,
           ToPort: 8000,
-        }));
+        });
 
-        test.done();
-      },
 
-      'with TCP protocol'(test: Test) {
+      });
+
+      test('with TCP protocol', () => {
         // GIVEN
         const stack = new cdk.Stack();
         const vpc = new ec2.Vpc(stack, 'MyVpc', {});
@@ -1169,10 +1169,10 @@ nodeunitShim({
           })],
         });
 
-        test.done();
-      },
 
-      'with UDP protocol'(test: Test) {
+      });
+
+      test('with UDP protocol', () => {
         // GIVEN
         const stack = new cdk.Stack();
         const vpc = new ec2.Vpc(stack, 'MyVpc', {});
@@ -1203,10 +1203,10 @@ nodeunitShim({
           })],
         });
 
-        test.done();
-      },
 
-      'throws when protocol does not match'(test: Test) {
+      });
+
+      test('throws when protocol does not match', () => {
         // GIVEN
         const stack = new cdk.Stack();
         const vpc = new ec2.Vpc(stack, 'MyVpc', {});
@@ -1228,7 +1228,7 @@ nodeunitShim({
         const listener = lb.addListener('listener', { port: 80 });
 
         // THEN
-        test.throws(() => {
+        expect(() => {
           listener.addTargets('target', {
             port: 80,
             targets: [service.loadBalancerTarget({
@@ -1237,12 +1237,12 @@ nodeunitShim({
               protocol: ecs.Protocol.TCP,
             })],
           });
-        }, /Container 'Default\/FargateTaskDef\/MainContainer' has no mapping for port 8001 and protocol tcp. Did you call "container.addPortMappings\(\)"\?/);
+        }).toThrow(/Container 'Default\/FargateTaskDef\/MainContainer' has no mapping for port 8001 and protocol tcp. Did you call "container.addPortMappings\(\)"\?/);
 
-        test.done();
-      },
 
-      'throws when port does not match'(test: Test) {
+      });
+
+      test('throws when port does not match', () => {
         // GIVEN
         const stack = new cdk.Stack();
         const vpc = new ec2.Vpc(stack, 'MyVpc', {});
@@ -1264,7 +1264,7 @@ nodeunitShim({
         const listener = lb.addListener('listener', { port: 80 });
 
         // THEN
-        test.throws(() => {
+        expect(() => {
           listener.addTargets('target', {
             port: 80,
             targets: [service.loadBalancerTarget({
@@ -1272,12 +1272,12 @@ nodeunitShim({
               containerPort: 8002,
             })],
           });
-        }, /Container 'Default\/FargateTaskDef\/MainContainer' has no mapping for port 8002 and protocol tcp. Did you call "container.addPortMappings\(\)"\?/);
+        }).toThrow(/Container 'Default\/FargateTaskDef\/MainContainer' has no mapping for port 8002 and protocol tcp. Did you call "container.addPortMappings\(\)"\?/);
 
-        test.done();
-      },
 
-      'throws when container does not exist'(test: Test) {
+      });
+
+      test('throws when container does not exist', () => {
         // GIVEN
         const stack = new cdk.Stack();
         const vpc = new ec2.Vpc(stack, 'MyVpc', {});
@@ -1299,7 +1299,7 @@ nodeunitShim({
         const listener = lb.addListener('listener', { port: 80 });
 
         // THEN
-        test.throws(() => {
+        expect(() => {
           listener.addTargets('target', {
             port: 80,
             targets: [service.loadBalancerTarget({
@@ -1307,15 +1307,15 @@ nodeunitShim({
               containerPort: 8001,
             })],
           });
-        }, /No container named 'SideContainer'. Did you call "addContainer()"?/);
+        }).toThrow(/No container named 'SideContainer'. Did you call "addContainer()"?/);
 
-        test.done();
-      },
-    },
 
-    'allows load balancing to any container and port of service': {
-      'with application load balancers': {
-        'with default target group port and protocol'(test: Test) {
+      });
+    });
+
+    describe('allows load balancing to any container and port of service', () => {
+      describe('with application load balancers', () => {
+        test('with default target group port and protocol', () => {
           // GIVEN
           const stack = new cdk.Stack();
           const vpc = new ec2.Vpc(stack, 'MyVpc', {});
@@ -1345,7 +1345,7 @@ nodeunitShim({
           );
 
           // THEN
-          expect(stack).to(haveResource('AWS::ECS::Service', {
+          expect(stack).toHaveResource('AWS::ECS::Service', {
             LoadBalancers: [
               {
                 ContainerName: 'MainContainer',
@@ -1355,17 +1355,17 @@ nodeunitShim({
                 },
               },
             ],
-          }));
+          });
 
-          expect(stack).to(haveResource('AWS::ElasticLoadBalancingV2::TargetGroup', {
+          expect(stack).toHaveResource('AWS::ElasticLoadBalancingV2::TargetGroup', {
             Port: 80,
             Protocol: 'HTTP',
-          }));
+          });
 
-          test.done();
-        },
 
-        'with default target group port and HTTP protocol'(test: Test) {
+        });
+
+        test('with default target group port and HTTP protocol', () => {
           // GIVEN
           const stack = new cdk.Stack();
           const vpc = new ec2.Vpc(stack, 'MyVpc', {});
@@ -1397,7 +1397,7 @@ nodeunitShim({
           );
 
           // THEN
-          expect(stack).to(haveResource('AWS::ECS::Service', {
+          expect(stack).toHaveResource('AWS::ECS::Service', {
             LoadBalancers: [
               {
                 ContainerName: 'MainContainer',
@@ -1407,17 +1407,17 @@ nodeunitShim({
                 },
               },
             ],
-          }));
+          });
 
-          expect(stack).to(haveResource('AWS::ElasticLoadBalancingV2::TargetGroup', {
+          expect(stack).toHaveResource('AWS::ElasticLoadBalancingV2::TargetGroup', {
             Port: 80,
             Protocol: 'HTTP',
-          }));
+          });
 
-          test.done();
-        },
 
-        'with default target group port and HTTPS protocol'(test: Test) {
+        });
+
+        test('with default target group port and HTTPS protocol', () => {
           // GIVEN
           const stack = new cdk.Stack();
           const vpc = new ec2.Vpc(stack, 'MyVpc', {});
@@ -1449,7 +1449,7 @@ nodeunitShim({
           );
 
           // THEN
-          expect(stack).to(haveResource('AWS::ECS::Service', {
+          expect(stack).toHaveResource('AWS::ECS::Service', {
             LoadBalancers: [
               {
                 ContainerName: 'MainContainer',
@@ -1459,17 +1459,17 @@ nodeunitShim({
                 },
               },
             ],
-          }));
+          });
 
-          expect(stack).to(haveResource('AWS::ElasticLoadBalancingV2::TargetGroup', {
+          expect(stack).toHaveResource('AWS::ElasticLoadBalancingV2::TargetGroup', {
             Port: 443,
             Protocol: 'HTTPS',
-          }));
+          });
 
-          test.done();
-        },
 
-        'with any target group port and protocol'(test: Test) {
+        });
+
+        test('with any target group port and protocol', () => {
           // GIVEN
           const stack = new cdk.Stack();
           const vpc = new ec2.Vpc(stack, 'MyVpc', {});
@@ -1502,7 +1502,7 @@ nodeunitShim({
           );
 
           // THEN
-          expect(stack).to(haveResource('AWS::ECS::Service', {
+          expect(stack).toHaveResource('AWS::ECS::Service', {
             LoadBalancers: [
               {
                 ContainerName: 'MainContainer',
@@ -1512,19 +1512,19 @@ nodeunitShim({
                 },
               },
             ],
-          }));
+          });
 
-          expect(stack).to(haveResource('AWS::ElasticLoadBalancingV2::TargetGroup', {
+          expect(stack).toHaveResource('AWS::ElasticLoadBalancingV2::TargetGroup', {
             Port: 83,
             Protocol: 'HTTP',
-          }));
+          });
 
-          test.done();
-        },
-      },
 
-      'with network load balancers': {
-        'with default target group port'(test: Test) {
+        });
+      });
+
+      describe('with network load balancers', () => {
+        test('with default target group port', () => {
           // GIVEN
           const stack = new cdk.Stack();
           const vpc = new ec2.Vpc(stack, 'MyVpc', {});
@@ -1554,7 +1554,7 @@ nodeunitShim({
           );
 
           // THEN
-          expect(stack).to(haveResource('AWS::ECS::Service', {
+          expect(stack).toHaveResource('AWS::ECS::Service', {
             LoadBalancers: [
               {
                 ContainerName: 'MainContainer',
@@ -1564,17 +1564,17 @@ nodeunitShim({
                 },
               },
             ],
-          }));
+          });
 
-          expect(stack).to(haveResource('AWS::ElasticLoadBalancingV2::TargetGroup', {
+          expect(stack).toHaveResource('AWS::ElasticLoadBalancingV2::TargetGroup', {
             Port: 80,
             Protocol: 'TCP',
-          }));
+          });
 
-          test.done();
-        },
 
-        'with any target group port'(test: Test) {
+        });
+
+        test('with any target group port', () => {
           // GIVEN
           const stack = new cdk.Stack();
           const vpc = new ec2.Vpc(stack, 'MyVpc', {});
@@ -1606,7 +1606,7 @@ nodeunitShim({
           );
 
           // THEN
-          expect(stack).to(haveResource('AWS::ECS::Service', {
+          expect(stack).toHaveResource('AWS::ECS::Service', {
             LoadBalancers: [
               {
                 ContainerName: 'MainContainer',
@@ -1616,20 +1616,20 @@ nodeunitShim({
                 },
               },
             ],
-          }));
+          });
 
-          expect(stack).to(haveResource('AWS::ElasticLoadBalancingV2::TargetGroup', {
+          expect(stack).toHaveResource('AWS::ElasticLoadBalancingV2::TargetGroup', {
             Port: 81,
             Protocol: 'TCP',
-          }));
+          });
 
-          test.done();
-        },
-      },
-    },
-  },
 
-  'allows scaling on a specified scheduled time'(test: Test) {
+        });
+      });
+    });
+  });
+
+  test('allows scaling on a specified scheduled time', () => {
     // GIVEN
     const stack = new cdk.Stack();
     const vpc = new ec2.Vpc(stack, 'MyVpc', {});
@@ -1653,7 +1653,7 @@ nodeunitShim({
     });
 
     // THEN
-    expect(stack).to(haveResource('AWS::ApplicationAutoScaling::ScalableTarget', {
+    expect(stack).toHaveResource('AWS::ApplicationAutoScaling::ScalableTarget', {
       ScheduledActions: [
         {
           ScalableTargetAction: {
@@ -1663,12 +1663,12 @@ nodeunitShim({
           ScheduledActionName: 'ScaleOnSchedule',
         },
       ],
-    }));
+    });
 
-    test.done();
-  },
 
-  'allows scaling on a specified metric value'(test: Test) {
+  });
+
+  test('allows scaling on a specified metric value', () => {
     // GIVEN
     const stack = new cdk.Stack();
     const vpc = new ec2.Vpc(stack, 'MyVpc', {});
@@ -1696,7 +1696,7 @@ nodeunitShim({
     });
 
     // THEN
-    expect(stack).to(haveResource('AWS::ApplicationAutoScaling::ScalingPolicy', {
+    expect(stack).toHaveResource('AWS::ApplicationAutoScaling::ScalingPolicy', {
       PolicyType: 'StepScaling',
       ScalingTargetId: {
         Ref: 'ServiceTaskCountTarget23E25614',
@@ -1711,12 +1711,12 @@ nodeunitShim({
           },
         ],
       },
-    }));
+    });
+
 
-    test.done();
-  },
+  });
 
-  'allows scaling on a target CPU utilization'(test: Test) {
+  test('allows scaling on a target CPU utilization', () => {
     // GIVEN
     const stack = new cdk.Stack();
     const vpc = new ec2.Vpc(stack, 'MyVpc', {});
@@ -1739,18 +1739,18 @@ nodeunitShim({
     });
 
     // THEN
-    expect(stack).to(haveResource('AWS::ApplicationAutoScaling::ScalingPolicy', {
+    expect(stack).toHaveResource('AWS::ApplicationAutoScaling::ScalingPolicy', {
       PolicyType: 'TargetTrackingScaling',
       TargetTrackingScalingPolicyConfiguration: {
         PredefinedMetricSpecification: { PredefinedMetricType: 'ECSServiceAverageCPUUtilization' },
         TargetValue: 30,
       },
-    }));
+    });
+
 
-    test.done();
-  },
+  });
 
-  'allows scaling on memory utilization'(test: Test) {
+  test('allows scaling on memory utilization', () => {
     // GIVEN
     const stack = new cdk.Stack();
     const vpc = new ec2.Vpc(stack, 'MyVpc', {});
@@ -1773,18 +1773,18 @@ nodeunitShim({
     });
 
     // THEN
-    expect(stack).to(haveResource('AWS::ApplicationAutoScaling::ScalingPolicy', {
+    expect(stack).toHaveResource('AWS::ApplicationAutoScaling::ScalingPolicy', {
       PolicyType: 'TargetTrackingScaling',
       TargetTrackingScalingPolicyConfiguration: {
         PredefinedMetricSpecification: { PredefinedMetricType: 'ECSServiceAverageMemoryUtilization' },
         TargetValue: 30,
       },
-    }));
+    });
 
-    test.done();
-  },
 
-  'allows scaling on custom CloudWatch metric'(test: Test) {
+  });
+
+  test('allows scaling on custom CloudWatch metric', () => {
     // GIVEN
     const stack = new cdk.Stack();
     const vpc = new ec2.Vpc(stack, 'MyVpc', {});
@@ -1808,7 +1808,7 @@ nodeunitShim({
     });
 
     // THEN
-    expect(stack).to(haveResource('AWS::ApplicationAutoScaling::ScalingPolicy', {
+    expect(stack).toHaveResource('AWS::ApplicationAutoScaling::ScalingPolicy', {
       PolicyType: 'TargetTrackingScaling',
       TargetTrackingScalingPolicyConfiguration: {
         CustomizedMetricSpecification: {
@@ -1818,13 +1818,13 @@ nodeunitShim({
         },
         TargetValue: 5,
       },
-    }));
+    });
+
 
-    test.done();
-  },
+  });
 
-  'When enabling service discovery': {
-    'throws if namespace has not been added to cluster'(test: Test) {
+  describe('When enabling service discovery', () => {
+    test('throws if namespace has not been added to cluster', () => {
       // GIVEN
       const stack = new cdk.Stack();
       const vpc = new ec2.Vpc(stack, 'MyVpc', {});
@@ -1837,7 +1837,7 @@ nodeunitShim({
       container.addPortMappings({ containerPort: 8000 });
 
       // THEN
-      test.throws(() => {
+      expect(() => {
         new ecs.FargateService(stack, 'Service', {
           cluster,
           taskDefinition,
@@ -1845,12 +1845,12 @@ nodeunitShim({
             name: 'myApp',
           },
         });
-      }, /Cannot enable service discovery if a Cloudmap Namespace has not been created in the cluster./);
+      }).toThrow(/Cannot enable service discovery if a Cloudmap Namespace has not been created in the cluster./);
 
-      test.done();
-    },
 
-    'creates cloud map service for Private DNS namespace'(test: Test) {
+    });
+
+    test('creates cloud map service for Private DNS namespace', () => {
       // GIVEN
       const stack = new cdk.Stack();
       const vpc = new ec2.Vpc(stack, 'MyVpc', {});
@@ -1876,7 +1876,7 @@ nodeunitShim({
       });
 
       // THEN
-      expect(stack).to(haveResource('AWS::ServiceDiscovery::Service', {
+      expect(stack).toHaveResource('AWS::ServiceDiscovery::Service', {
         DnsConfig: {
           DnsRecords: [
             {
@@ -1902,12 +1902,12 @@ nodeunitShim({
             'Id',
           ],
         },
-      }));
+      });
+
 
-      test.done();
-    },
+    });
 
-    'creates AWS Cloud Map service for Private DNS namespace with SRV records with proper defaults'(test: Test) {
+    test('creates AWS Cloud Map service for Private DNS namespace with SRV records with proper defaults', () => {
       // GIVEN
       const stack = new cdk.Stack();
       const vpc = new ec2.Vpc(stack, 'MyVpc', {});
@@ -1937,7 +1937,7 @@ nodeunitShim({
       });
 
       // THEN
-      expect(stack).to(haveResource('AWS::ServiceDiscovery::Service', {
+      expect(stack).toHaveResource('AWS::ServiceDiscovery::Service', {
         DnsConfig: {
           DnsRecords: [
             {
@@ -1963,12 +1963,12 @@ nodeunitShim({
             'Id',
           ],
         },
-      }));
+      });
+
 
-      test.done();
-    },
+    });
 
-    'creates AWS Cloud Map service for Private DNS namespace with SRV records with overriden defaults'(test: Test) {
+    test('creates AWS Cloud Map service for Private DNS namespace with SRV records with overriden defaults', () => {
       // GIVEN
       const stack = new cdk.Stack();
       const vpc = new ec2.Vpc(stack, 'MyVpc', {});
@@ -1999,7 +1999,7 @@ nodeunitShim({
       });
 
       // THEN
-      expect(stack).to(haveResource('AWS::ServiceDiscovery::Service', {
+      expect(stack).toHaveResource('AWS::ServiceDiscovery::Service', {
         DnsConfig: {
           DnsRecords: [
             {
@@ -2025,12 +2025,12 @@ nodeunitShim({
             'Id',
           ],
         },
-      }));
+      });
+
 
-      test.done();
-    },
+    });
 
-    'user can select any container and port'(test: Test) {
+    test('user can select any container and port', () => {
       const stack = new cdk.Stack();
       const vpc = new ec2.Vpc(stack, 'MyVpc', {});
       const cluster = new ecs.Cluster(stack, 'EcsCluster', { vpc });
@@ -2063,7 +2063,7 @@ nodeunitShim({
         },
       });
 
-      expect(stack).to(haveResourceLike('AWS::ECS::Service', {
+      expect(stack).toHaveResourceLike('AWS::ECS::Service', {
         ServiceRegistries: [
           {
             RegistryArn: { 'Fn::GetAtt': ['ServiceCloudmapService046058A4', 'Arn'] },
@@ -2071,13 +2071,13 @@ nodeunitShim({
             ContainerPort: 8001,
           },
         ],
-      }));
+      });
+
 
-      test.done();
-    },
-  },
+    });
+  });
 
-  'Metric'(test: Test) {
+  test('Metric', () => {
     // GIVEN
     const stack = new cdk.Stack();
     const vpc = new ec2.Vpc(stack, 'MyVpc', {});
@@ -2094,7 +2094,7 @@ nodeunitShim({
     });
 
     // THEN
-    test.deepEqual(stack.resolve(service.metricCpuUtilization()), {
+    expect(stack.resolve(service.metricCpuUtilization())).toEqual({
       dimensions: {
         ClusterName: { Ref: 'EcsCluster97242B84' },
         ServiceName: { 'Fn::GetAtt': ['ServiceD69D759B', 'Name'] },
@@ -2105,11 +2105,11 @@ nodeunitShim({
       statistic: 'Average',
     });
 
-    test.done();
-  },
 
-  'When import a Fargate Service': {
-    'with serviceArn'(test: Test) {
+  });
+
+  describe('When import a Fargate Service', () => {
+    test('with serviceArn', () => {
       // GIVEN
       const stack = new cdk.Stack();
       const cluster = new ecs.Cluster(stack, 'EcsCluster');
@@ -2121,13 +2121,13 @@ nodeunitShim({
       });
 
       // THEN
-      test.equal(service.serviceArn, 'arn:aws:ecs:us-west-2:123456789012:service/my-http-service');
-      test.equal(service.serviceName, 'my-http-service');
+      expect(service.serviceArn).toEqual('arn:aws:ecs:us-west-2:123456789012:service/my-http-service');
+      expect(service.serviceName).toEqual('my-http-service');
+
 
-      test.done();
-    },
+    });
 
-    'with serviceName'(test: Test) {
+    test('with serviceName', () => {
       // GIVEN
       const stack = new cdk.Stack();
       const pseudo = new cdk.ScopedAws(stack);
@@ -2140,13 +2140,13 @@ nodeunitShim({
       });
 
       // THEN
-      test.deepEqual(stack.resolve(service.serviceArn), stack.resolve(`arn:${pseudo.partition}:ecs:${pseudo.region}:${pseudo.accountId}:service/my-http-service`));
-      test.equal(service.serviceName, 'my-http-service');
+      expect(stack.resolve(service.serviceArn)).toEqual(stack.resolve(`arn:${pseudo.partition}:ecs:${pseudo.region}:${pseudo.accountId}:service/my-http-service`));
+      expect(service.serviceName).toEqual('my-http-service');
+
 
-      test.done();
-    },
+    });
 
-    'with circuit breaker'(test: Test) {
+    test('with circuit breaker', () => {
       // GIVEN
       const stack = new cdk.Stack();
       const cluster = new ecs.Cluster(stack, 'EcsCluster');
@@ -2164,7 +2164,7 @@ nodeunitShim({
       });
 
       // THEN
-      expect(stack).to(haveResource('AWS::ECS::Service', {
+      expect(stack).toHaveResource('AWS::ECS::Service', {
         DeploymentConfiguration: {
           MaximumPercent: 200,
           MinimumHealthyPercent: 50,
@@ -2176,42 +2176,42 @@ nodeunitShim({
         DeploymentController: {
           Type: ecs.DeploymentControllerType.ECS,
         },
-      }));
+      });
+
 
-      test.done();
-    },
+    });
 
-    'throws an exception if both serviceArn and serviceName were provided for fromEc2ServiceAttributes'(test: Test) {
+    test('throws an exception if both serviceArn and serviceName were provided for fromEc2ServiceAttributes', () => {
       // GIVEN
       const stack = new cdk.Stack();
       const cluster = new ecs.Cluster(stack, 'EcsCluster');
 
-      test.throws(() => {
+      expect(() => {
         ecs.FargateService.fromFargateServiceAttributes(stack, 'EcsService', {
           serviceArn: 'arn:aws:ecs:us-west-2:123456789012:service/my-http-service',
           serviceName: 'my-http-service',
           cluster,
         });
-      }, /only specify either serviceArn or serviceName/);
+      }).toThrow(/only specify either serviceArn or serviceName/);
 
-      test.done();
-    },
 
-    'throws an exception if neither serviceArn nor serviceName were provided for fromEc2ServiceAttributes'(test: Test) {
+    });
+
+    test('throws an exception if neither serviceArn nor serviceName were provided for fromEc2ServiceAttributes', () => {
       // GIVEN
       const stack = new cdk.Stack();
       const cluster = new ecs.Cluster(stack, 'EcsCluster');
 
-      test.throws(() => {
+      expect(() => {
         ecs.FargateService.fromFargateServiceAttributes(stack, 'EcsService', {
           cluster,
         });
-      }, /only specify either serviceArn or serviceName/);
+      }).toThrow(/only specify either serviceArn or serviceName/);
 
-      test.done();
-    },
 
-    'allows setting enable execute command'(test: Test) {
+    });
+
+    test('allows setting enable execute command', () => {
       // GIVEN
       const stack = new cdk.Stack();
       const vpc = new ec2.Vpc(stack, 'MyVpc', {});
@@ -2229,7 +2229,7 @@ nodeunitShim({
       });
 
       // THEN
-      expect(stack).to(haveResource('AWS::ECS::Service', {
+      expect(stack).toHaveResource('AWS::ECS::Service', {
         TaskDefinition: {
           Ref: 'FargateTaskDefC6FB60B4',
         },
@@ -2264,9 +2264,9 @@ nodeunitShim({
             ],
           },
         },
-      }));
+      });
 
-      expect(stack).to(haveResource('AWS::IAM::Policy', {
+      expect(stack).toHaveResource('AWS::IAM::Policy', {
         PolicyDocument: {
           Statement: [
             {
@@ -2302,12 +2302,12 @@ nodeunitShim({
             Ref: 'FargateTaskDefTaskRole0B257552',
           },
         ],
-      }));
+      });
+
 
-      test.done();
-    },
+    });
 
-    'no logging enabled when logging field is set to NONE'(test: Test) {
+    test('no logging enabled when logging field is set to NONE', () => {
       // GIVEN
       const stack = new cdk.Stack();
       const vpc = new ec2.Vpc(stack, 'MyVpc', {});
@@ -2340,7 +2340,7 @@ nodeunitShim({
       });
 
       // THEN
-      expect(stack).to(haveResource('AWS::IAM::Policy', {
+      expect(stack).toHaveResource('AWS::IAM::Policy', {
         PolicyDocument: {
           Statement: [
             {
@@ -2362,12 +2362,12 @@ nodeunitShim({
             Ref: 'FargateTaskDefTaskRole0B257552',
           },
         ],
-      }));
+      });
+
 
-      test.done();
-    },
+    });
 
-    'enables execute command logging with logging field set to OVERRIDE'(test: Test) {
+    test('enables execute command logging with logging field set to OVERRIDE', () => {
       // GIVEN
       const stack = new cdk.Stack();
       const vpc = new ec2.Vpc(stack, 'MyVpc', {});
@@ -2403,7 +2403,7 @@ nodeunitShim({
       });
 
       // THEN
-      expect(stack).to(haveResource('AWS::IAM::Policy', {
+      expect(stack).toHaveResource('AWS::IAM::Policy', {
         PolicyDocument: {
           Statement: [
             {
@@ -2479,12 +2479,12 @@ nodeunitShim({
             Ref: 'FargateTaskDefTaskRole0B257552',
           },
         ],
-      }));
+      });
+
 
-      test.done();
-    },
+    });
 
-    'enables only execute command session encryption'(test: Test) {
+    test('enables only execute command session encryption', () => {
       // GIVEN
       const stack = new cdk.Stack();
       const vpc = new ec2.Vpc(stack, 'MyVpc', {});
@@ -2523,7 +2523,7 @@ nodeunitShim({
       });
 
       // THEN
-      expect(stack).to(haveResource('AWS::IAM::Policy', {
+      expect(stack).toHaveResource('AWS::IAM::Policy', {
         PolicyDocument: {
           Statement: [
             {
@@ -2612,9 +2612,9 @@ nodeunitShim({
             Ref: 'FargateTaskDefTaskRole0B257552',
           },
         ],
-      }));
+      });
 
-      expect(stack).to(haveResource('AWS::KMS::Key', {
+      expect(stack).toHaveResource('AWS::KMS::Key', {
         KeyPolicy: {
           Statement: [
             {
@@ -2678,12 +2678,12 @@ nodeunitShim({
           ],
           Version: '2012-10-17',
         },
-      }));
+      });
 
-      test.done();
-    },
 
-    'enables encryption for execute command logging'(test: Test) {
+    });
+
+    test('enables encryption for execute command logging', () => {
       // GIVEN
       const stack = new cdk.Stack();
       const vpc = new ec2.Vpc(stack, 'MyVpc', {});
@@ -2729,7 +2729,7 @@ nodeunitShim({
       });
 
       // THEN
-      expect(stack).to(haveResource('AWS::IAM::Policy', {
+      expect(stack).toHaveResource('AWS::IAM::Policy', {
         PolicyDocument: {
           Statement: [
             {
@@ -2833,9 +2833,9 @@ nodeunitShim({
             Ref: 'FargateTaskDefTaskRole0B257552',
           },
         ],
-      }));
+      });
 
-      expect(stack).to(haveResource('AWS::KMS::Key', {
+      expect(stack).toHaveResource('AWS::KMS::Key', {
         KeyPolicy: {
           Statement: [
             {
@@ -2944,12 +2944,12 @@ nodeunitShim({
           ],
           Version: '2012-10-17',
         },
-      }));
+      });
+
 
-      test.done();
-    },
+    });
 
-    'with both propagateTags and propagateTaskTagsFrom defined'(test: Test) {
+    test('with both propagateTags and propagateTaskTagsFrom defined', () => {
       // GIVEN
       const stack = new cdk.Stack();
       const vpc = new ec2.Vpc(stack, 'MyVpc', {});
@@ -2962,15 +2962,15 @@ nodeunitShim({
       });
 
       // THEN
-      test.throws(() => {
+      expect(() => {
         new ecs.FargateService(stack, 'FargateService', {
           cluster,
           taskDefinition,
           propagateTags: PropagatedTagSource.SERVICE,
           propagateTaskTagsFrom: PropagatedTagSource.SERVICE,
         });
-      }, /You can only specify either propagateTags or propagateTaskTagsFrom. Alternatively, you can leave both blank/);
-      test.done();
-    },
-  },
+      }).toThrow(/You can only specify either propagateTags or propagateTaskTagsFrom. Alternatively, you can leave both blank/);
+
+    });
+  });
 });
diff --git a/packages/@aws-cdk/aws-ecs/test/fargate/fargate-task-definition.test.ts b/packages/@aws-cdk/aws-ecs/test/fargate/fargate-task-definition.test.ts
index 294ae3001aa64..3ff15ac22057e 100644
--- a/packages/@aws-cdk/aws-ecs/test/fargate/fargate-task-definition.test.ts
+++ b/packages/@aws-cdk/aws-ecs/test/fargate/fargate-task-definition.test.ts
@@ -1,29 +1,28 @@
-import { expect, haveResourceLike } from '@aws-cdk/assert-internal';
+import '@aws-cdk/assert-internal/jest';
 import * as iam from '@aws-cdk/aws-iam';
 import * as cdk from '@aws-cdk/core';
-import { nodeunitShim, Test } from 'nodeunit-shim';
 import * as ecs from '../../lib';
 
-nodeunitShim({
-  'When creating a Fargate TaskDefinition': {
-    'with only required properties set, it correctly sets default properties'(test: Test) {
+describe('fargate task definition', () => {
+  describe('When creating a Fargate TaskDefinition', () => {
+    test('with only required properties set, it correctly sets default properties', () => {
       // GIVEN
       const stack = new cdk.Stack();
       new ecs.FargateTaskDefinition(stack, 'FargateTaskDef');
 
       // THEN
-      expect(stack).to(haveResourceLike('AWS::ECS::TaskDefinition', {
+      expect(stack).toHaveResourceLike('AWS::ECS::TaskDefinition', {
         Family: 'FargateTaskDef',
         NetworkMode: ecs.NetworkMode.AWS_VPC,
         RequiresCompatibilities: ['FARGATE'],
         Cpu: '256',
         Memory: '512',
-      }));
+      });
+
 
-      test.done();
-    },
+    });
 
-    'support lazy cpu and memory values'(test: Test) {
+    test('support lazy cpu and memory values', () => {
       // GIVEN
       const stack = new cdk.Stack();
 
@@ -33,15 +32,15 @@ nodeunitShim({
       });
 
       // THEN
-      expect(stack).to(haveResourceLike('AWS::ECS::TaskDefinition', {
+      expect(stack).toHaveResourceLike('AWS::ECS::TaskDefinition', {
         Cpu: '128',
         Memory: '1024',
-      }));
+      });
 
-      test.done();
-    },
 
-    'with all properties set'(test: Test) {
+    });
+
+    test('with all properties set', () => {
       // GIVEN
       const stack = new cdk.Stack();
       const taskDefinition = new ecs.FargateTaskDefinition(stack, 'FargateTaskDef', {
@@ -69,7 +68,7 @@ nodeunitShim({
       });
 
       // THEN
-      expect(stack).to(haveResourceLike('AWS::ECS::TaskDefinition', {
+      expect(stack).toHaveResourceLike('AWS::ECS::TaskDefinition', {
         Cpu: '128',
         ExecutionRoleArn: {
           'Fn::GetAtt': [
@@ -100,25 +99,25 @@ nodeunitShim({
             Name: 'scratch',
           },
         ],
-      }));
+      });
+
 
-      test.done();
-    },
+    });
 
-    'throws when adding placement constraint'(test: Test) {
+    test('throws when adding placement constraint', () => {
       // GIVEN
       const stack = new cdk.Stack();
       const taskDefinition = new ecs.FargateTaskDefinition(stack, 'FargateTaskDef');
 
       // THEN
-      test.throws(() => {
+      expect(() => {
         taskDefinition.addPlacementConstraint(ecs.PlacementConstraint.memberOf('attribute:ecs.instance-type =~ t2.*'));
-      }, /Cannot set placement constraints on tasks that run on Fargate/);
+      }).toThrow(/Cannot set placement constraints on tasks that run on Fargate/);
 
-      test.done();
-    },
 
-    'throws when adding inference accelerators'(test: Test) {
+    });
+
+    test('throws when adding inference accelerators', () => {
       // GIVEN
       const stack = new cdk.Stack();
       const taskDefinition = new ecs.FargateTaskDefinition(stack, 'FargateTaskDef');
@@ -129,42 +128,40 @@ nodeunitShim({
       };
 
       // THEN
-      test.throws(() => {
+      expect(() => {
         taskDefinition.addInferenceAccelerator(inferenceAccelerator);
-      }, /Cannot use inference accelerators on tasks that run on Fargate/);
+      }).toThrow(/Cannot use inference accelerators on tasks that run on Fargate/);
+
 
-      test.done();
-    },
+    });
 
-    'throws when ephemeral storage request is too high'(test: Test) {
+    test('throws when ephemeral storage request is too high', () => {
       // GIVEN
       const stack = new cdk.Stack();
-      test.throws(() => {
+      expect(() => {
         new ecs.FargateTaskDefinition(stack, 'FargateTaskDef', {
           ephemeralStorageGiB: 201,
         });
-      }, /Ephemeral storage size must be between 21GiB and 200GiB/);
+      }).toThrow(/Ephemeral storage size must be between 21GiB and 200GiB/);
 
       // THEN
-      test.done();
-    },
+    });
 
-    'throws when ephemeral storage request is too low'(test: Test) {
+    test('throws when ephemeral storage request is too low', () => {
       // GIVEN
       const stack = new cdk.Stack();
-      test.throws(() => {
+      expect(() => {
         new ecs.FargateTaskDefinition(stack, 'FargateTaskDef', {
           ephemeralStorageGiB: 20,
         });
-      }, /Ephemeral storage size must be between 21GiB and 200GiB/);
+      }).toThrow(/Ephemeral storage size must be between 21GiB and 200GiB/);
 
       // THEN
-      test.done();
-    },
-  },
+    });
+  });
 
-  'When importing from an existing Fargate TaskDefinition': {
-    'can succeed using TaskDefinition Arn'(test: Test) {
+  describe('When importing from an existing Fargate TaskDefinition', () => {
+    test('can succeed using TaskDefinition Arn', () => {
       // GIVEN
       const stack = new cdk.Stack();
       const expectTaskDefinitionArn = 'TD_ARN';
@@ -173,11 +170,11 @@ nodeunitShim({
       const taskDefinition = ecs.FargateTaskDefinition.fromFargateTaskDefinitionArn(stack, 'FARGATE_TD_ID', expectTaskDefinitionArn);
 
       // THEN
-      test.equal(taskDefinition.taskDefinitionArn, expectTaskDefinitionArn);
-      test.done();
-    },
+      expect(taskDefinition.taskDefinitionArn).toEqual(expectTaskDefinitionArn);
+
+    });
 
-    'can succeed using attributes'(test: Test) {
+    test('can succeed using attributes', () => {
       // GIVEN
       const stack = new cdk.Stack();
       const expectTaskDefinitionArn = 'TD_ARN';
@@ -194,17 +191,17 @@ nodeunitShim({
       });
 
       // THEN
-      test.equal(taskDefinition.taskDefinitionArn, expectTaskDefinitionArn);
-      test.equal(taskDefinition.compatibility, ecs.Compatibility.FARGATE);
-      test.ok(taskDefinition.isFargateCompatible);
-      test.equal(taskDefinition.isEc2Compatible, false);
-      test.equal(taskDefinition.networkMode, expectNetworkMode);
-      test.equal(taskDefinition.taskRole, expectTaskRole);
+      expect(taskDefinition.taskDefinitionArn).toEqual(expectTaskDefinitionArn);
+      expect(taskDefinition.compatibility).toEqual(ecs.Compatibility.FARGATE);
+      expect(taskDefinition.isFargateCompatible).toEqual(true);
+      expect(taskDefinition.isEc2Compatible).toEqual(false);
+      expect(taskDefinition.networkMode).toEqual(expectNetworkMode);
+      expect(taskDefinition.taskRole).toEqual(expectTaskRole);
 
-      test.done();
-    },
 
-    'returns a Fargate TaskDefinition that will throw an error when trying to access its networkMode but its networkMode is undefined'(test: Test) {
+    });
+
+    test('returns a Fargate TaskDefinition that will throw an error when trying to access its networkMode but its networkMode is undefined', () => {
       // GIVEN
       const stack = new cdk.Stack();
       const expectTaskDefinitionArn = 'TD_ARN';
@@ -219,15 +216,15 @@ nodeunitShim({
       });
 
       // THEN
-      test.throws(() => {
+      expect(() => {
         taskDefinition.networkMode;
-      }, 'This operation requires the networkMode in ImportedTaskDefinition to be defined. ' +
+      }).toThrow('This operation requires the networkMode in ImportedTaskDefinition to be defined. ' +
         'Add the \'networkMode\' in ImportedTaskDefinitionProps to instantiate ImportedTaskDefinition');
 
-      test.done();
-    },
 
-    'returns a Fargate TaskDefinition that will throw an error when trying to access its taskRole but its taskRole is undefined'(test: Test) {
+    });
+
+    test('returns a Fargate TaskDefinition that will throw an error when trying to access its taskRole but its taskRole is undefined', () => {
       // GIVEN
       const stack = new cdk.Stack();
       const expectTaskDefinitionArn = 'TD_ARN';
@@ -240,12 +237,12 @@ nodeunitShim({
       });
 
       // THEN
-      test.throws(() => {
+      expect(() => {
         taskDefinition.taskRole;
-      }, 'This operation requires the taskRole in ImportedTaskDefinition to be defined. ' +
+      }).toThrow('This operation requires the taskRole in ImportedTaskDefinition to be defined. ' +
         'Add the \'taskRole\' in ImportedTaskDefinitionProps to instantiate ImportedTaskDefinition');
 
-      test.done();
-    },
-  },
+
+    });
+  });
 });
diff --git a/packages/@aws-cdk/aws-ecs/test/firelens-log-driver.test.ts b/packages/@aws-cdk/aws-ecs/test/firelens-log-driver.test.ts
index aff395c8598d2..6ab96b05df364 100644
--- a/packages/@aws-cdk/aws-ecs/test/firelens-log-driver.test.ts
+++ b/packages/@aws-cdk/aws-ecs/test/firelens-log-driver.test.ts
@@ -1,22 +1,21 @@
-import { expect, haveResourceLike } from '@aws-cdk/assert-internal';
+import '@aws-cdk/assert-internal/jest';
 import * as secretsmanager from '@aws-cdk/aws-secretsmanager';
 import * as ssm from '@aws-cdk/aws-ssm';
 import * as cdk from '@aws-cdk/core';
-import { nodeunitShim, Test } from 'nodeunit-shim';
 import * as ecs from '../lib';
 
 let stack: cdk.Stack;
 let td: ecs.TaskDefinition;
 const image = ecs.ContainerImage.fromRegistry('test-image');
 
-nodeunitShim({
-  'setUp'(cb: () => void) {
+describe('firelens log driver', () => {
+  beforeEach(() => {
     stack = new cdk.Stack();
     td = new ecs.Ec2TaskDefinition(stack, 'TaskDefinition');
 
-    cb();
-  },
-  'create a firelens log driver with default options'(test: Test) {
+
+  });
+  test('create a firelens log driver with default options', () => {
     // WHEN
     td.addContainer('Container', {
       image,
@@ -25,7 +24,7 @@ nodeunitShim({
     });
 
     // THEN
-    expect(stack).to(haveResourceLike('AWS::ECS::TaskDefinition', {
+    expect(stack).toHaveResourceLike('AWS::ECS::TaskDefinition', {
       ContainerDefinitions: [
         {
           LogConfiguration: {
@@ -39,12 +38,12 @@ nodeunitShim({
           },
         },
       ],
-    }));
+    });
+
 
-    test.done();
-  },
+  });
 
-  'create a firelens log driver with secret options'(test: Test) {
+  test('create a firelens log driver with secret options', () => {
     const secret = new secretsmanager.Secret(stack, 'Secret');
     const parameter = ssm.StringParameter.fromSecureStringParameterAttributes(stack, 'Parameter', {
       parameterName: '/host',
@@ -72,7 +71,7 @@ nodeunitShim({
     });
 
     // THEN
-    expect(stack).to(haveResourceLike('AWS::ECS::TaskDefinition', {
+    expect(stack).toHaveResourceLike('AWS::ECS::TaskDefinition', {
       ContainerDefinitions: [
         {
           LogConfiguration: {
@@ -125,9 +124,9 @@ nodeunitShim({
           },
         },
       ],
-    }));
+    });
 
-    expect(stack).to(haveResourceLike('AWS::IAM::Policy', {
+    expect(stack).toHaveResourceLike('AWS::IAM::Policy', {
       PolicyDocument: {
         Statement: [
           {
@@ -172,12 +171,12 @@ nodeunitShim({
         ],
         Version: '2012-10-17',
       },
-    }));
+    });
 
-    test.done();
-  },
 
-  'create a firelens log driver to route logs to CloudWatch Logs with Fluent Bit'(test: Test) {
+  });
+
+  test('create a firelens log driver to route logs to CloudWatch Logs with Fluent Bit', () => {
     // WHEN
     td.addContainer('Container', {
       image,
@@ -194,7 +193,7 @@ nodeunitShim({
     });
 
     // THEN
-    expect(stack).to(haveResourceLike('AWS::ECS::TaskDefinition', {
+    expect(stack).toHaveResourceLike('AWS::ECS::TaskDefinition', {
       ContainerDefinitions: [
         {
           LogConfiguration: {
@@ -215,12 +214,12 @@ nodeunitShim({
           },
         },
       ],
-    }));
+    });
+
 
-    test.done();
-  },
+  });
 
-  'create a firelens log driver to route logs to kinesis firehose Logs with Fluent Bit'(test: Test) {
+  test('create a firelens log driver to route logs to kinesis firehose Logs with Fluent Bit', () => {
     // WHEN
     td.addContainer('Container', {
       image,
@@ -235,7 +234,7 @@ nodeunitShim({
     });
 
     // THEN
-    expect(stack).to(haveResourceLike('AWS::ECS::TaskDefinition', {
+    expect(stack).toHaveResourceLike('AWS::ECS::TaskDefinition', {
       ContainerDefinitions: [
         {
           LogConfiguration: {
@@ -254,13 +253,13 @@ nodeunitShim({
           },
         },
       ],
-    }));
+    });
+
 
-    test.done();
-  },
+  });
 
-  'Firelens Configuration': {
-    'fluentd log router container'(test: Test) {
+  describe('Firelens Configuration', () => {
+    test('fluentd log router container', () => {
       // GIVEN
       td.addFirelensLogRouter('log_router', {
         image: ecs.ContainerImage.fromRegistry('fluent/fluentd'),
@@ -271,7 +270,7 @@ nodeunitShim({
       });
 
       // THEN
-      expect(stack).to(haveResourceLike('AWS::ECS::TaskDefinition', {
+      expect(stack).toHaveResourceLike('AWS::ECS::TaskDefinition', {
         ContainerDefinitions: [
           {
             Essential: true,
@@ -283,11 +282,11 @@ nodeunitShim({
             },
           },
         ],
-      }));
-      test.done();
-    },
+      });
+
+    });
 
-    'fluent-bit log router container with options'(test: Test) {
+    test('fluent-bit log router container with options', () => {
       // GIVEN
       const stack2 = new cdk.Stack(undefined, 'Stack2', { env: { region: 'us-east-1' } });
       const td2 = new ecs.Ec2TaskDefinition(stack2, 'TaskDefinition');
@@ -305,7 +304,7 @@ nodeunitShim({
       });
 
       // THEN
-      expect(stack2).to(haveResourceLike('AWS::ECS::TaskDefinition', {
+      expect(stack2).toHaveResourceLike('AWS::ECS::TaskDefinition', {
         ContainerDefinitions: [
           {
             Essential: true,
@@ -321,12 +320,12 @@ nodeunitShim({
             },
           },
         ],
-      }));
+      });
 
-      test.done();
-    },
 
-    'fluent-bit log router with file config type'(test: Test) {
+    });
+
+    test('fluent-bit log router with file config type', () => {
       // GIVEN
       td.addFirelensLogRouter('log_router', {
         image: ecs.obtainDefaultFluentBitECRImage(td, undefined, '2.1.0'),
@@ -343,7 +342,7 @@ nodeunitShim({
       });
 
       // THEN
-      expect(stack).to(haveResourceLike('AWS::ECS::TaskDefinition', {
+      expect(stack).toHaveResourceLike('AWS::ECS::TaskDefinition', {
         ContainerDefinitions: [
           {
             Essential: true,
@@ -359,9 +358,9 @@ nodeunitShim({
             },
           },
         ],
-      }));
+      });
 
-      test.done();
-    },
-  },
+
+    });
+  });
 });
diff --git a/packages/@aws-cdk/aws-ecs/test/fluentd-log-driver.test.ts b/packages/@aws-cdk/aws-ecs/test/fluentd-log-driver.test.ts
index 54ac824fb6c47..81c17b8c0b76f 100644
--- a/packages/@aws-cdk/aws-ecs/test/fluentd-log-driver.test.ts
+++ b/packages/@aws-cdk/aws-ecs/test/fluentd-log-driver.test.ts
@@ -1,21 +1,20 @@
-import { expect, haveResourceLike } from '@aws-cdk/assert-internal';
+import '@aws-cdk/assert-internal/jest';
 import * as cdk from '@aws-cdk/core';
-import { nodeunitShim, Test } from 'nodeunit-shim';
 import * as ecs from '../lib';
 
 let stack: cdk.Stack;
 let td: ecs.TaskDefinition;
 const image = ecs.ContainerImage.fromRegistry('test-image');
 
-nodeunitShim({
-  'setUp'(cb: () => void) {
+describe('fluentd log driver', () => {
+  beforeEach(() => {
     stack = new cdk.Stack();
     td = new ecs.Ec2TaskDefinition(stack, 'TaskDefinition');
 
-    cb();
-  },
 
-  'create a fluentd log driver with options'(test: Test) {
+  });
+
+  test('create a fluentd log driver with options', () => {
     // WHEN
     td.addContainer('Container', {
       image,
@@ -26,7 +25,7 @@ nodeunitShim({
     });
 
     // THEN
-    expect(stack).to(haveResourceLike('AWS::ECS::TaskDefinition', {
+    expect(stack).toHaveResourceLike('AWS::ECS::TaskDefinition', {
       ContainerDefinitions: [
         {
           LogConfiguration: {
@@ -37,12 +36,12 @@ nodeunitShim({
           },
         },
       ],
-    }));
+    });
+
 
-    test.done();
-  },
+  });
 
-  'create a fluentd log driver without options'(test: Test) {
+  test('create a fluentd log driver without options', () => {
     // WHEN
     td.addContainer('Container', {
       image,
@@ -51,7 +50,7 @@ nodeunitShim({
     });
 
     // THEN
-    expect(stack).to(haveResourceLike('AWS::ECS::TaskDefinition', {
+    expect(stack).toHaveResourceLike('AWS::ECS::TaskDefinition', {
       ContainerDefinitions: [
         {
           LogConfiguration: {
@@ -59,12 +58,12 @@ nodeunitShim({
           },
         },
       ],
-    }));
+    });
+
 
-    test.done();
-  },
+  });
 
-  'create a fluentd log driver with all possible options'(test: Test) {
+  test('create a fluentd log driver with all possible options', () => {
     // WHEN
     td.addContainer('Container', {
       image,
@@ -92,7 +91,7 @@ nodeunitShim({
     });
 
     // THEN
-    expect(stack).to(haveResourceLike('AWS::ECS::TaskDefinition', {
+    expect(stack).toHaveResourceLike('AWS::ECS::TaskDefinition', {
       ContainerDefinitions: [
         {
           LogConfiguration: {
@@ -112,12 +111,12 @@ nodeunitShim({
           },
         },
       ],
-    }));
+    });
+
 
-    test.done();
-  },
+  });
 
-  'create a fluentd log driver using fluentd'(test: Test) {
+  test('create a fluentd log driver using fluentd', () => {
     // WHEN
     td.addContainer('Container', {
       image,
@@ -126,7 +125,7 @@ nodeunitShim({
     });
 
     // THEN
-    expect(stack).to(haveResourceLike('AWS::ECS::TaskDefinition', {
+    expect(stack).toHaveResourceLike('AWS::ECS::TaskDefinition', {
       ContainerDefinitions: [
         {
           LogConfiguration: {
@@ -134,8 +133,8 @@ nodeunitShim({
           },
         },
       ],
-    }));
+    });
+
 
-    test.done();
-  },
+  });
 });
diff --git a/packages/@aws-cdk/aws-ecs/test/gelf-log-driver.test.ts b/packages/@aws-cdk/aws-ecs/test/gelf-log-driver.test.ts
index 9f6663304d353..e8cdce10736e1 100644
--- a/packages/@aws-cdk/aws-ecs/test/gelf-log-driver.test.ts
+++ b/packages/@aws-cdk/aws-ecs/test/gelf-log-driver.test.ts
@@ -1,21 +1,20 @@
-import { expect, haveResourceLike } from '@aws-cdk/assert-internal';
+import '@aws-cdk/assert-internal/jest';
 import * as cdk from '@aws-cdk/core';
-import { nodeunitShim, Test } from 'nodeunit-shim';
 import * as ecs from '../lib';
 
 let stack: cdk.Stack;
 let td: ecs.TaskDefinition;
 const image = ecs.ContainerImage.fromRegistry('test-image');
 
-nodeunitShim({
-  'setUp'(cb: () => void) {
+describe('gelf log driver', () => {
+  beforeEach(() => {
     stack = new cdk.Stack();
     td = new ecs.Ec2TaskDefinition(stack, 'TaskDefinition');
 
-    cb();
-  },
 
-  'create a gelf log driver with minimum options'(test: Test) {
+  });
+
+  test('create a gelf log driver with minimum options', () => {
     // WHEN
     td.addContainer('Container', {
       image,
@@ -26,7 +25,7 @@ nodeunitShim({
     });
 
     // THEN
-    expect(stack).to(haveResourceLike('AWS::ECS::TaskDefinition', {
+    expect(stack).toHaveResourceLike('AWS::ECS::TaskDefinition', {
       ContainerDefinitions: [
         {
           LogConfiguration: {
@@ -37,12 +36,12 @@ nodeunitShim({
           },
         },
       ],
-    }));
+    });
+
 
-    test.done();
-  },
+  });
 
-  'create a gelf log driver using gelf with minimum options'(test: Test) {
+  test('create a gelf log driver using gelf with minimum options', () => {
     // WHEN
     td.addContainer('Container', {
       image,
@@ -53,7 +52,7 @@ nodeunitShim({
     });
 
     // THEN
-    expect(stack).to(haveResourceLike('AWS::ECS::TaskDefinition', {
+    expect(stack).toHaveResourceLike('AWS::ECS::TaskDefinition', {
       ContainerDefinitions: [
         {
           LogConfiguration: {
@@ -64,8 +63,8 @@ nodeunitShim({
           },
         },
       ],
-    }));
+    });
+
 
-    test.done();
-  },
+  });
 });
diff --git a/packages/@aws-cdk/aws-ecs/test/images/tag-parameter-container-image.test.ts b/packages/@aws-cdk/aws-ecs/test/images/tag-parameter-container-image.test.ts
index d782d39d874cb..3f409739d76ed 100644
--- a/packages/@aws-cdk/aws-ecs/test/images/tag-parameter-container-image.test.ts
+++ b/packages/@aws-cdk/aws-ecs/test/images/tag-parameter-container-image.test.ts
@@ -1,12 +1,12 @@
-import { expect, haveResourceLike, SynthUtils } from '@aws-cdk/assert-internal';
+import '@aws-cdk/assert-internal/jest';
+import { SynthUtils } from '@aws-cdk/assert-internal';
 import * as ecr from '@aws-cdk/aws-ecr';
 import * as cdk from '@aws-cdk/core';
-import { nodeunitShim, Test } from 'nodeunit-shim';
 import * as ecs from '../../lib';
 
-nodeunitShim({
-  'TagParameter container image': {
-    'throws an error when tagParameterName() is used without binding the image'(test: Test) {
+describe('tag parameter container image', () => {
+  describe('TagParameter container image', () => {
+    test('throws an error when tagParameterName() is used without binding the image', () => {
       // GIVEN
       const stack = new cdk.Stack();
       const repository = new ecr.Repository(stack, 'Repository');
@@ -15,14 +15,14 @@ nodeunitShim({
         value: tagParameterContainerImage.tagParameterName,
       });
 
-      test.throws(() => {
+      expect(() => {
         SynthUtils.synthesize(stack);
-      }, /TagParameterContainerImage must be used in a container definition when using tagParameterName/);
+      }).toThrow(/TagParameterContainerImage must be used in a container definition when using tagParameterName/);
 
-      test.done();
-    },
 
-    'throws an error when tagParameterValue() is used without binding the image'(test: Test) {
+    });
+
+    test('throws an error when tagParameterValue() is used without binding the image', () => {
       // GIVEN
       const stack = new cdk.Stack();
       const repository = new ecr.Repository(stack, 'Repository');
@@ -31,14 +31,14 @@ nodeunitShim({
         value: tagParameterContainerImage.tagParameterValue,
       });
 
-      test.throws(() => {
+      expect(() => {
         SynthUtils.synthesize(stack);
-      }, /TagParameterContainerImage must be used in a container definition when using tagParameterValue/);
+      }).toThrow(/TagParameterContainerImage must be used in a container definition when using tagParameterValue/);
+
 
-      test.done();
-    },
+    });
 
-    'can be used in a cross-account manner'(test: Test) {
+    test('can be used in a cross-account manner', () => {
       // GIVEN
       const app = new cdk.App();
       const pipelineStack = new cdk.Stack(app, 'PipelineStack', {
@@ -67,7 +67,7 @@ nodeunitShim({
       });
 
       // THEN
-      expect(pipelineStack).to(haveResourceLike('AWS::ECR::Repository', {
+      expect(pipelineStack).toHaveResourceLike('AWS::ECR::Repository', {
         RepositoryName: repositoryName,
         RepositoryPolicyText: {
           Statement: [{
@@ -88,11 +88,11 @@ nodeunitShim({
             },
           }],
         },
-      }));
-      expect(serviceStack).to(haveResourceLike('AWS::IAM::Role', {
+      });
+      expect(serviceStack).toHaveResourceLike('AWS::IAM::Role', {
         RoleName: 'servicestackionexecutionrolee7e2d9a783a54eb795f4',
-      }));
-      expect(serviceStack).to(haveResourceLike('AWS::ECS::TaskDefinition', {
+      });
+      expect(serviceStack).toHaveResourceLike('AWS::ECS::TaskDefinition', {
         ContainerDefinitions: [
           {
             Image: {
@@ -128,9 +128,9 @@ nodeunitShim({
             },
           },
         ],
-      }));
+      });
+
 
-      test.done();
-    },
-  },
+    });
+  });
 });
diff --git a/packages/@aws-cdk/aws-ecs/test/journald-log-driver.test.ts b/packages/@aws-cdk/aws-ecs/test/journald-log-driver.test.ts
index aeffbc2073629..fdf67efc3bb4f 100644
--- a/packages/@aws-cdk/aws-ecs/test/journald-log-driver.test.ts
+++ b/packages/@aws-cdk/aws-ecs/test/journald-log-driver.test.ts
@@ -1,21 +1,20 @@
-import { expect, haveResourceLike } from '@aws-cdk/assert-internal';
+import '@aws-cdk/assert-internal/jest';
 import * as cdk from '@aws-cdk/core';
-import { nodeunitShim, Test } from 'nodeunit-shim';
 import * as ecs from '../lib';
 
 let stack: cdk.Stack;
 let td: ecs.TaskDefinition;
 const image = ecs.ContainerImage.fromRegistry('test-image');
 
-nodeunitShim({
-  'setUp'(cb: () => void) {
+describe('journald log driver', () => {
+  beforeEach(() => {
     stack = new cdk.Stack();
     td = new ecs.Ec2TaskDefinition(stack, 'TaskDefinition');
 
-    cb();
-  },
 
-  'create a journald log driver with options'(test: Test) {
+  });
+
+  test('create a journald log driver with options', () => {
     // WHEN
     td.addContainer('Container', {
       image,
@@ -26,7 +25,7 @@ nodeunitShim({
     });
 
     // THEN
-    expect(stack).to(haveResourceLike('AWS::ECS::TaskDefinition', {
+    expect(stack).toHaveResourceLike('AWS::ECS::TaskDefinition', {
       ContainerDefinitions: [
         {
           LogConfiguration: {
@@ -37,12 +36,12 @@ nodeunitShim({
           },
         },
       ],
-    }));
+    });
 
-    test.done();
-  },
 
-  'create a journald log driver without options'(test: Test) {
+  });
+
+  test('create a journald log driver without options', () => {
     // WHEN
     td.addContainer('Container', {
       image,
@@ -51,7 +50,7 @@ nodeunitShim({
     });
 
     // THEN
-    expect(stack).to(haveResourceLike('AWS::ECS::TaskDefinition', {
+    expect(stack).toHaveResourceLike('AWS::ECS::TaskDefinition', {
       ContainerDefinitions: [
         {
           LogConfiguration: {
@@ -59,12 +58,12 @@ nodeunitShim({
           },
         },
       ],
-    }));
+    });
 
-    test.done();
-  },
 
-  'create a journald log driver using journald'(test: Test) {
+  });
+
+  test('create a journald log driver using journald', () => {
     // WHEN
     td.addContainer('Container', {
       image,
@@ -73,7 +72,7 @@ nodeunitShim({
     });
 
     // THEN
-    expect(stack).to(haveResourceLike('AWS::ECS::TaskDefinition', {
+    expect(stack).toHaveResourceLike('AWS::ECS::TaskDefinition', {
       ContainerDefinitions: [
         {
           LogConfiguration: {
@@ -82,8 +81,8 @@ nodeunitShim({
           },
         },
       ],
-    }));
+    });
+
 
-    test.done();
-  },
+  });
 });
diff --git a/packages/@aws-cdk/aws-ecs/test/json-file-log-driver.test.ts b/packages/@aws-cdk/aws-ecs/test/json-file-log-driver.test.ts
index b282a61c29f88..0c21ff2d0b5f1 100644
--- a/packages/@aws-cdk/aws-ecs/test/json-file-log-driver.test.ts
+++ b/packages/@aws-cdk/aws-ecs/test/json-file-log-driver.test.ts
@@ -1,21 +1,20 @@
-import { expect, haveResourceLike } from '@aws-cdk/assert-internal';
+import '@aws-cdk/assert-internal/jest';
 import * as cdk from '@aws-cdk/core';
-import { nodeunitShim, Test } from 'nodeunit-shim';
 import * as ecs from '../lib';
 
 let stack: cdk.Stack;
 let td: ecs.TaskDefinition;
 const image = ecs.ContainerImage.fromRegistry('test-image');
 
-nodeunitShim({
-  'setUp'(cb: () => void) {
+describe('json file log driver', () => {
+  beforeEach(() => {
     stack = new cdk.Stack();
     td = new ecs.Ec2TaskDefinition(stack, 'TaskDefinition');
 
-    cb();
-  },
 
-  'create a json-file log driver with options'(test: Test) {
+  });
+
+  test('create a json-file log driver with options', () => {
     // WHEN
     td.addContainer('Container', {
       image,
@@ -26,7 +25,7 @@ nodeunitShim({
     });
 
     // THEN
-    expect(stack).to(haveResourceLike('AWS::ECS::TaskDefinition', {
+    expect(stack).toHaveResourceLike('AWS::ECS::TaskDefinition', {
       ContainerDefinitions: [
         {
           LogConfiguration: {
@@ -37,12 +36,12 @@ nodeunitShim({
           },
         },
       ],
-    }));
+    });
 
-    test.done();
-  },
 
-  'create a json-file log driver without options'(test: Test) {
+  });
+
+  test('create a json-file log driver without options', () => {
     // WHEN
     td.addContainer('Container', {
       image,
@@ -51,7 +50,7 @@ nodeunitShim({
     });
 
     // THEN
-    expect(stack).to(haveResourceLike('AWS::ECS::TaskDefinition', {
+    expect(stack).toHaveResourceLike('AWS::ECS::TaskDefinition', {
       ContainerDefinitions: [
         {
           LogConfiguration: {
@@ -59,12 +58,12 @@ nodeunitShim({
           },
         },
       ],
-    }));
+    });
 
-    test.done();
-  },
 
-  'create a json-file log driver using json-file'(test: Test) {
+  });
+
+  test('create a json-file log driver using json-file', () => {
     // WHEN
     td.addContainer('Container', {
       image,
@@ -73,7 +72,7 @@ nodeunitShim({
     });
 
     // THEN
-    expect(stack).to(haveResourceLike('AWS::ECS::TaskDefinition', {
+    expect(stack).toHaveResourceLike('AWS::ECS::TaskDefinition', {
       ContainerDefinitions: [
         {
           LogConfiguration: {
@@ -82,8 +81,8 @@ nodeunitShim({
           },
         },
       ],
-    }));
+    });
+
 
-    test.done();
-  },
+  });
 });
diff --git a/packages/@aws-cdk/aws-ecs/test/splunk-log-driver.test.ts b/packages/@aws-cdk/aws-ecs/test/splunk-log-driver.test.ts
index ee7d3f4b68ee8..d9902cb9728e3 100644
--- a/packages/@aws-cdk/aws-ecs/test/splunk-log-driver.test.ts
+++ b/packages/@aws-cdk/aws-ecs/test/splunk-log-driver.test.ts
@@ -1,23 +1,22 @@
-import { expect, haveResourceLike } from '@aws-cdk/assert-internal';
-import * as cdk from '@aws-cdk/core';
+import '@aws-cdk/assert-internal/jest';
 import * as secretsmanager from '@aws-cdk/aws-secretsmanager';
 import * as ssm from '@aws-cdk/aws-ssm';
-import { nodeunitShim, Test } from 'nodeunit-shim';
+import * as cdk from '@aws-cdk/core';
 import * as ecs from '../lib';
 
 let stack: cdk.Stack;
 let td: ecs.TaskDefinition;
 const image = ecs.ContainerImage.fromRegistry('test-image');
 
-nodeunitShim({
-  'setUp'(cb: () => void) {
+describe('splunk log driver', () => {
+  beforeEach(() => {
     stack = new cdk.Stack();
     td = new ecs.Ec2TaskDefinition(stack, 'TaskDefinition');
 
-    cb();
-  },
 
-  'create a splunk log driver with minimum options'(test: Test) {
+  });
+
+  test('create a splunk log driver with minimum options', () => {
     // WHEN
     td.addContainer('Container', {
       image,
@@ -29,7 +28,7 @@ nodeunitShim({
     });
 
     // THEN
-    expect(stack).to(haveResourceLike('AWS::ECS::TaskDefinition', {
+    expect(stack).toHaveResourceLike('AWS::ECS::TaskDefinition', {
       ContainerDefinitions: [
         {
           LogConfiguration: {
@@ -41,12 +40,12 @@ nodeunitShim({
           },
         },
       ],
-    }));
+    });
 
-    test.done();
-  },
 
-  'create a splunk log driver using splunk with minimum options'(test: Test) {
+  });
+
+  test('create a splunk log driver using splunk with minimum options', () => {
     // WHEN
     td.addContainer('Container', {
       image,
@@ -58,7 +57,7 @@ nodeunitShim({
     });
 
     // THEN
-    expect(stack).to(haveResourceLike('AWS::ECS::TaskDefinition', {
+    expect(stack).toHaveResourceLike('AWS::ECS::TaskDefinition', {
       ContainerDefinitions: [
         {
           LogConfiguration: {
@@ -70,12 +69,12 @@ nodeunitShim({
           },
         },
       ],
-    }));
+    });
+
 
-    test.done();
-  },
+  });
 
-  'create a splunk log driver using splunk with sourcetype defined'(test: Test) {
+  test('create a splunk log driver using splunk with sourcetype defined', () => {
     // WHEN
     td.addContainer('Container', {
       image,
@@ -88,7 +87,7 @@ nodeunitShim({
     });
 
     // THEN
-    expect(stack).to(haveResourceLike('AWS::ECS::TaskDefinition', {
+    expect(stack).toHaveResourceLike('AWS::ECS::TaskDefinition', {
       ContainerDefinitions: [
         {
           LogConfiguration: {
@@ -101,12 +100,12 @@ nodeunitShim({
           },
         },
       ],
-    }));
+    });
+
 
-    test.done();
-  },
+  });
 
-  'create a splunk log driver using secret splunk token from secrets manager'(test: Test) {
+  test('create a splunk log driver using secret splunk token from secrets manager', () => {
     const secret = new secretsmanager.Secret(stack, 'Secret');
     // WHEN
     td.addContainer('Container', {
@@ -119,7 +118,7 @@ nodeunitShim({
     });
 
     // THEN
-    expect(stack).to(haveResourceLike('AWS::ECS::TaskDefinition', {
+    expect(stack).toHaveResourceLike('AWS::ECS::TaskDefinition', {
       ContainerDefinitions: [
         {
           LogConfiguration: {
@@ -138,12 +137,12 @@ nodeunitShim({
           },
         },
       ],
-    }));
+    });
+
 
-    test.done();
-  },
+  });
 
-  'create a splunk log driver using secret splunk token from systems manager parameter store'(test: Test) {
+  test('create a splunk log driver using secret splunk token from systems manager parameter store', () => {
     const parameter = ssm.StringParameter.fromSecureStringParameterAttributes(stack, 'Parameter', {
       parameterName: '/token',
       version: 1,
@@ -159,7 +158,7 @@ nodeunitShim({
     });
 
     // THEN
-    expect(stack).to(haveResourceLike('AWS::ECS::TaskDefinition', {
+    expect(stack).toHaveResourceLike('AWS::ECS::TaskDefinition', {
       ContainerDefinitions: [
         {
           LogConfiguration: {
@@ -195,13 +194,13 @@ nodeunitShim({
           },
         },
       ],
-    }));
+    });
+
 
-    test.done();
-  },
+  });
 
-  'throws when neither token nor secret token are provided'(test: Test) {
-    test.throws(() => {
+  test('throws when neither token nor secret token are provided', () => {
+    expect(() => {
       td.addContainer('Container', {
         image,
         logging: ecs.LogDrivers.splunk({
@@ -209,8 +208,8 @@ nodeunitShim({
         }),
         memoryLimitMiB: 128,
       });
-    }, 'Please provide either token or secretToken.');
+    }).toThrow('Please provide either token or secretToken.');
+
 
-    test.done();
-  },
+  });
 });
diff --git a/packages/@aws-cdk/aws-ecs/test/syslog-log-driver.test.ts b/packages/@aws-cdk/aws-ecs/test/syslog-log-driver.test.ts
index db328772d7548..ae32f55ecd863 100644
--- a/packages/@aws-cdk/aws-ecs/test/syslog-log-driver.test.ts
+++ b/packages/@aws-cdk/aws-ecs/test/syslog-log-driver.test.ts
@@ -1,21 +1,20 @@
-import { expect, haveResourceLike } from '@aws-cdk/assert-internal';
+import '@aws-cdk/assert-internal/jest';
 import * as cdk from '@aws-cdk/core';
-import { nodeunitShim, Test } from 'nodeunit-shim';
 import * as ecs from '../lib';
 
 let stack: cdk.Stack;
 let td: ecs.TaskDefinition;
 const image = ecs.ContainerImage.fromRegistry('test-image');
 
-nodeunitShim({
-  'setUp'(cb: () => void) {
+describe('syslog log driver', () => {
+  beforeEach(() => {
     stack = new cdk.Stack();
     td = new ecs.Ec2TaskDefinition(stack, 'TaskDefinition');
 
-    cb();
-  },
 
-  'create a syslog log driver with options'(test: Test) {
+  });
+
+  test('create a syslog log driver with options', () => {
     // WHEN
     td.addContainer('Container', {
       image,
@@ -26,7 +25,7 @@ nodeunitShim({
     });
 
     // THEN
-    expect(stack).to(haveResourceLike('AWS::ECS::TaskDefinition', {
+    expect(stack).toHaveResourceLike('AWS::ECS::TaskDefinition', {
       ContainerDefinitions: [
         {
           LogConfiguration: {
@@ -37,12 +36,12 @@ nodeunitShim({
           },
         },
       ],
-    }));
+    });
 
-    test.done();
-  },
 
-  'create a syslog log driver without options'(test: Test) {
+  });
+
+  test('create a syslog log driver without options', () => {
     // WHEN
     td.addContainer('Container', {
       image,
@@ -51,7 +50,7 @@ nodeunitShim({
     });
 
     // THEN
-    expect(stack).to(haveResourceLike('AWS::ECS::TaskDefinition', {
+    expect(stack).toHaveResourceLike('AWS::ECS::TaskDefinition', {
       ContainerDefinitions: [
         {
           LogConfiguration: {
@@ -59,12 +58,12 @@ nodeunitShim({
           },
         },
       ],
-    }));
+    });
 
-    test.done();
-  },
 
-  'create a syslog log driver using syslog'(test: Test) {
+  });
+
+  test('create a syslog log driver using syslog', () => {
     // WHEN
     td.addContainer('Container', {
       image,
@@ -73,7 +72,7 @@ nodeunitShim({
     });
 
     // THEN
-    expect(stack).to(haveResourceLike('AWS::ECS::TaskDefinition', {
+    expect(stack).toHaveResourceLike('AWS::ECS::TaskDefinition', {
       ContainerDefinitions: [
         {
           LogConfiguration: {
@@ -82,8 +81,8 @@ nodeunitShim({
           },
         },
       ],
-    }));
+    });
+
 
-    test.done();
-  },
+  });
 });
diff --git a/packages/@aws-cdk/aws-ecs/test/task-definition.test.ts b/packages/@aws-cdk/aws-ecs/test/task-definition.test.ts
index 6e578952a5765..07b3a8211da06 100644
--- a/packages/@aws-cdk/aws-ecs/test/task-definition.test.ts
+++ b/packages/@aws-cdk/aws-ecs/test/task-definition.test.ts
@@ -1,12 +1,11 @@
-import { expect, haveResource } from '@aws-cdk/assert-internal';
+import '@aws-cdk/assert-internal/jest';
 import * as iam from '@aws-cdk/aws-iam';
 import * as cdk from '@aws-cdk/core';
-import { nodeunitShim, Test } from 'nodeunit-shim';
 import * as ecs from '../lib';
 
-nodeunitShim({
-  'When creating a new TaskDefinition': {
-    'A task definition with both compatibilities defaults to networkmode AwsVpc'(test: Test) {
+describe('task definition', () => {
+  describe('When creating a new TaskDefinition', () => {
+    test('A task definition with both compatibilities defaults to networkmode AwsVpc', () => {
       // GIVEN
       const stack = new cdk.Stack();
 
@@ -18,16 +17,16 @@ nodeunitShim({
       });
 
       // THEN
-      expect(stack).to(haveResource('AWS::ECS::TaskDefinition', {
+      expect(stack).toHaveResource('AWS::ECS::TaskDefinition', {
         NetworkMode: 'awsvpc',
-      }));
+      });
+
 
-      test.done();
-    },
-  },
+    });
+  });
 
-  'When importing from an existing Task definition': {
-    'can import using a task definition arn'(test: Test) {
+  describe('When importing from an existing Task definition', () => {
+    test('can import using a task definition arn', () => {
       // GIVEN
       const stack = new cdk.Stack();
       const taskDefinitionArn = 'TDArn';
@@ -36,14 +35,14 @@ nodeunitShim({
       const taskDefinition = ecs.TaskDefinition.fromTaskDefinitionArn(stack, 'TD_ID', taskDefinitionArn);
 
       // THEN
-      test.equal(taskDefinition.taskDefinitionArn, taskDefinitionArn);
-      test.equal(taskDefinition.compatibility, ecs.Compatibility.EC2_AND_FARGATE);
-      test.equal(taskDefinition.executionRole, undefined);
+      expect(taskDefinition.taskDefinitionArn).toEqual(taskDefinitionArn);
+      expect(taskDefinition.compatibility).toEqual(ecs.Compatibility.EC2_AND_FARGATE);
+      expect(taskDefinition.executionRole).toEqual(undefined);
+
 
-      test.done();
-    },
+    });
 
-    'can import a Task Definition using attributes'(test: Test) {
+    test('can import a Task Definition using attributes', () => {
       // GIVEN
       const stack = new cdk.Stack();
       const expectTaskDefinitionArn = 'TD_ARN';
@@ -62,16 +61,16 @@ nodeunitShim({
       });
 
       // THEN
-      test.equal(taskDefinition.taskDefinitionArn, expectTaskDefinitionArn);
-      test.equal(taskDefinition.compatibility, expectCompatibility);
-      test.equal(taskDefinition.executionRole, undefined);
-      test.equal(taskDefinition.networkMode, expectNetworkMode);
-      test.equal(taskDefinition.taskRole, expectTaskRole);
+      expect(taskDefinition.taskDefinitionArn).toEqual(expectTaskDefinitionArn);
+      expect(taskDefinition.compatibility).toEqual(expectCompatibility);
+      expect(taskDefinition.executionRole).toEqual(undefined);
+      expect(taskDefinition.networkMode).toEqual(expectNetworkMode);
+      expect(taskDefinition.taskRole).toEqual(expectTaskRole);
 
-      test.done();
-    },
 
-    'returns an imported TaskDefinition that will throw an error when trying to access its yet to defined networkMode'(test: Test) {
+    });
+
+    test('returns an imported TaskDefinition that will throw an error when trying to access its yet to defined networkMode', () => {
       // GIVEN
       const stack = new cdk.Stack();
       const expectTaskDefinitionArn = 'TD_ARN';
@@ -88,15 +87,15 @@ nodeunitShim({
       });
 
       // THEN
-      test.throws(() => {
+      expect(() => {
         taskDefinition.networkMode;
-      }, 'This operation requires the networkMode in ImportedTaskDefinition to be defined. ' +
+      }).toThrow('This operation requires the networkMode in ImportedTaskDefinition to be defined. ' +
         'Add the \'networkMode\' in ImportedTaskDefinitionProps to instantiate ImportedTaskDefinition');
 
-      test.done();
-    },
 
-    'returns an imported TaskDefinition that will throw an error when trying to access its yet to defined taskRole'(test: Test) {
+    });
+
+    test('returns an imported TaskDefinition that will throw an error when trying to access its yet to defined taskRole', () => {
       // GIVEN
       const stack = new cdk.Stack();
       const expectTaskDefinitionArn = 'TD_ARN';
@@ -111,12 +110,12 @@ nodeunitShim({
       });
 
       // THEN
-      test.throws(() => {
+      expect(() => {
         taskDefinition.taskRole;
-      }, 'This operation requires the taskRole in ImportedTaskDefinition to be defined. ' +
+      }).toThrow('This operation requires the taskRole in ImportedTaskDefinition to be defined. ' +
         'Add the \'taskRole\' in ImportedTaskDefinitionProps to instantiate ImportedTaskDefinition');
 
-      test.done();
-    },
-  },
+
+    });
+  });
 });
diff --git a/packages/@aws-cdk/aws-route53/package.json b/packages/@aws-cdk/aws-route53/package.json
index 90608982f090b..24e72e9300c93 100644
--- a/packages/@aws-cdk/aws-route53/package.json
+++ b/packages/@aws-cdk/aws-route53/package.json
@@ -81,7 +81,6 @@
     "cdk-integ-tools": "0.0.0",
     "cfn2ts": "0.0.0",
     "jest": "^26.6.3",
-    "nodeunit-shim": "0.0.0",
     "pkglint": "0.0.0",
     "@aws-cdk/assert-internal": "0.0.0"
   },
diff --git a/packages/@aws-cdk/aws-route53/test/hosted-zone-provider.test.ts b/packages/@aws-cdk/aws-route53/test/hosted-zone-provider.test.ts
index bf4fba67df048..0b66c9589cd50 100644
--- a/packages/@aws-cdk/aws-route53/test/hosted-zone-provider.test.ts
+++ b/packages/@aws-cdk/aws-route53/test/hosted-zone-provider.test.ts
@@ -1,11 +1,11 @@
+import '@aws-cdk/assert-internal/jest';
 import { SynthUtils } from '@aws-cdk/assert-internal';
 import * as cdk from '@aws-cdk/core';
-import { nodeunitShim, Test } from 'nodeunit-shim';
 import { HostedZone } from '../lib';
 
-nodeunitShim({
-  'Hosted Zone Provider': {
-    'HostedZoneProvider will return context values if available'(test: Test) {
+describe('hosted zone provider', () => {
+  describe('Hosted Zone Provider', () => {
+    test('HostedZoneProvider will return context values if available', () => {
       // GIVEN
       const stack = new cdk.Stack(undefined, 'TestStack', {
         env: { account: '12345', region: 'us-east-1' },
@@ -15,7 +15,7 @@ nodeunitShim({
       HostedZone.fromLookup(stack, 'Ref', filter);
 
       const missing = SynthUtils.synthesize(stack).assembly.manifest.missing!;
-      test.ok(missing && missing.length === 1);
+      expect(missing && missing.length === 1).toEqual(true);
 
       const fakeZoneId = '11111111111111';
       const fakeZone = {
@@ -38,12 +38,10 @@ nodeunitShim({
       const zoneRef = HostedZone.fromLookup(stack2, 'MyZoneProvider', filter);
 
       // THEN
-      test.deepEqual(zoneRef.hostedZoneId, fakeZoneId);
-      test.done();
-    },
-    'HostedZoneProvider will return context values if available when using plain hosted zone id'(
-      test: Test,
-    ) {
+      expect(zoneRef.hostedZoneId).toEqual(fakeZoneId);
+
+    });
+    test('HostedZoneProvider will return context values if available when using plain hosted zone id', () => {
       // GIVEN
       const stack = new cdk.Stack(undefined, 'TestStack', {
         env: { account: '12345', region: 'us-east-1' },
@@ -53,7 +51,7 @@ nodeunitShim({
       HostedZone.fromLookup(stack, 'Ref', filter);
 
       const missing = SynthUtils.synthesize(stack).assembly.manifest.missing!;
-      test.ok(missing && missing.length === 1);
+      expect(missing && missing.length === 1).toEqual(true);
 
       const fakeZoneId = '11111111111111';
       const fakeZone = {
@@ -78,8 +76,8 @@ nodeunitShim({
       const zoneId = zone.hostedZoneId;
 
       // THEN
-      test.deepEqual(fakeZoneId, zoneId);
-      test.done();
-    },
-  },
+      expect(fakeZoneId).toEqual(zoneId);
+
+    });
+  });
 });
diff --git a/packages/@aws-cdk/aws-route53/test/hosted-zone.test.ts b/packages/@aws-cdk/aws-route53/test/hosted-zone.test.ts
index a11b3308641d2..7939452fd3421 100644
--- a/packages/@aws-cdk/aws-route53/test/hosted-zone.test.ts
+++ b/packages/@aws-cdk/aws-route53/test/hosted-zone.test.ts
@@ -1,12 +1,11 @@
-import { expect } from '@aws-cdk/assert-internal';
+import '@aws-cdk/assert-internal/jest';
 import * as iam from '@aws-cdk/aws-iam';
 import * as cdk from '@aws-cdk/core';
-import { nodeunitShim, Test } from 'nodeunit-shim';
 import { HostedZone, PublicHostedZone } from '../lib';
 
-nodeunitShim({
-  'Hosted Zone': {
-    'Hosted Zone constructs the ARN'(test: Test) {
+describe('hosted zone', () => {
+  describe('Hosted Zone', () => {
+    test('Hosted Zone constructs the ARN', () => {
       // GIVEN
       const stack = new cdk.Stack(undefined, 'TestStack', {
         env: { account: '123456789012', region: 'us-east-1' },
@@ -16,7 +15,7 @@ nodeunitShim({
         zoneName: 'testZone',
       });
 
-      test.deepEqual(stack.resolve(testZone.hostedZoneArn), {
+      expect(stack.resolve(testZone.hostedZoneArn)).toEqual({
         'Fn::Join': [
           '',
           [
@@ -28,11 +27,11 @@ nodeunitShim({
         ],
       });
 
-      test.done();
-    },
-  },
 
-  'Supports tags'(test: Test) {
+    });
+  });
+
+  test('Supports tags', () => {
     // GIVEN
     const stack = new cdk.Stack();
 
@@ -43,7 +42,7 @@ nodeunitShim({
     cdk.Tags.of(hostedZone).add('zoneTag', 'inMyZone');
 
     // THEN
-    expect(stack).toMatch({
+    expect(stack).toMatchTemplate({
       Resources: {
         HostedZoneDB99F866: {
           Type: 'AWS::Route53::HostedZone',
@@ -60,10 +59,10 @@ nodeunitShim({
       },
     });
 
-    test.done();
-  },
 
-  'with crossAccountZoneDelegationPrincipal'(test: Test) {
+  });
+
+  test('with crossAccountZoneDelegationPrincipal', () => {
     // GIVEN
     const stack = new cdk.Stack(undefined, 'TestStack', {
       env: { account: '123456789012', region: 'us-east-1' },
@@ -77,7 +76,7 @@ nodeunitShim({
     });
 
     // THEN
-    expect(stack).toMatch({
+    expect(stack).toMatchTemplate({
       Resources: {
         HostedZoneDB99F866: {
           Type: 'AWS::Route53::HostedZone',
@@ -151,23 +150,23 @@ nodeunitShim({
       },
     });
 
-    test.done();
-  },
 
-  'with crossAccountZoneDelegationPrincipal, throws if name provided without principal'(test: Test) {
+  });
+
+  test('with crossAccountZoneDelegationPrincipal, throws if name provided without principal', () => {
     // GIVEN
     const stack = new cdk.Stack(undefined, 'TestStack', {
       env: { account: '123456789012', region: 'us-east-1' },
     });
 
     // THEN
-    test.throws(() => {
+    expect(() => {
       new PublicHostedZone(stack, 'HostedZone', {
         zoneName: 'testZone',
         crossAccountZoneDelegationRoleName: 'myrole',
       });
-    }, /crossAccountZoneDelegationRoleName property is not supported without crossAccountZoneDelegationPrincipal/);
+    }).toThrow(/crossAccountZoneDelegationRoleName property is not supported without crossAccountZoneDelegationPrincipal/);
+
 
-    test.done();
-  },
+  });
 });
diff --git a/packages/@aws-cdk/aws-route53/test/record-set.test.ts b/packages/@aws-cdk/aws-route53/test/record-set.test.ts
index a071ad2a1aeea..8e380e3dfcd81 100644
--- a/packages/@aws-cdk/aws-route53/test/record-set.test.ts
+++ b/packages/@aws-cdk/aws-route53/test/record-set.test.ts
@@ -1,11 +1,11 @@
-import { expect, haveResource, ResourcePart } from '@aws-cdk/assert-internal';
+import '@aws-cdk/assert-internal/jest';
+import { ResourcePart } from '@aws-cdk/assert-internal';
 import * as iam from '@aws-cdk/aws-iam';
 import { Duration, RemovalPolicy, Stack } from '@aws-cdk/core';
-import { nodeunitShim, Test } from 'nodeunit-shim';
 import * as route53 from '../lib';
 
-nodeunitShim({
-  'with default ttl'(test: Test) {
+describe('record set', () => {
+  test('with default ttl', () => {
     // GIVEN
     const stack = new Stack();
 
@@ -22,7 +22,7 @@ nodeunitShim({
     });
 
     // THEN
-    expect(stack).to(haveResource('AWS::Route53::RecordSet', {
+    expect(stack).toHaveResource('AWS::Route53::RecordSet', {
       Name: 'www.myzone.',
       Type: 'CNAME',
       HostedZoneId: {
@@ -32,11 +32,11 @@ nodeunitShim({
         'zzz',
       ],
       TTL: '1800',
-    }));
-    test.done();
-  },
+    });
+
+  });
 
-  'with custom ttl'(test: Test) {
+  test('with custom ttl', () => {
     // GIVEN
     const stack = new Stack();
 
@@ -54,7 +54,7 @@ nodeunitShim({
     });
 
     // THEN
-    expect(stack).to(haveResource('AWS::Route53::RecordSet', {
+    expect(stack).toHaveResource('AWS::Route53::RecordSet', {
       Name: 'aa.myzone.',
       Type: 'CNAME',
       HostedZoneId: {
@@ -64,11 +64,11 @@ nodeunitShim({
         'bbb',
       ],
       TTL: '6077',
-    }));
-    test.done();
-  },
+    });
 
-  'with ttl of 0'(test: Test) {
+  });
+
+  test('with ttl of 0', () => {
     // GIVEN
     const stack = new Stack();
 
@@ -86,13 +86,13 @@ nodeunitShim({
     });
 
     // THEN
-    expect(stack).to(haveResource('AWS::Route53::RecordSet', {
+    expect(stack).toHaveResource('AWS::Route53::RecordSet', {
       TTL: '0',
-    }));
-    test.done();
-  },
+    });
+
+  });
 
-  'defaults to zone root'(test: Test) {
+  test('defaults to zone root', () => {
     // GIVEN
     const stack = new Stack();
 
@@ -108,7 +108,7 @@ nodeunitShim({
     });
 
     // THEN
-    expect(stack).to(haveResource('AWS::Route53::RecordSet', {
+    expect(stack).toHaveResource('AWS::Route53::RecordSet', {
       Name: 'myzone.',
       Type: 'A',
       HostedZoneId: {
@@ -117,11 +117,11 @@ nodeunitShim({
       ResourceRecords: [
         '1.2.3.4',
       ],
-    }));
-    test.done();
-  },
+    });
+
+  });
 
-  'A record with ip addresses'(test: Test) {
+  test('A record with ip addresses', () => {
     // GIVEN
     const stack = new Stack();
 
@@ -137,7 +137,7 @@ nodeunitShim({
     });
 
     // THEN
-    expect(stack).to(haveResource('AWS::Route53::RecordSet', {
+    expect(stack).toHaveResource('AWS::Route53::RecordSet', {
       Name: 'www.myzone.',
       Type: 'A',
       HostedZoneId: {
@@ -148,11 +148,11 @@ nodeunitShim({
         '5.6.7.8',
       ],
       TTL: '1800',
-    }));
-    test.done();
-  },
+    });
 
-  'A record with alias'(test: Test) {
+  });
+
+  test('A record with alias', () => {
     // GIVEN
     const stack = new Stack();
 
@@ -177,7 +177,7 @@ nodeunitShim({
     });
 
     // THEN
-    expect(stack).to(haveResource('AWS::Route53::RecordSet', {
+    expect(stack).toHaveResource('AWS::Route53::RecordSet', {
       Name: '_foo.myzone.',
       HostedZoneId: {
         Ref: 'HostedZoneDB99F866',
@@ -187,12 +187,12 @@ nodeunitShim({
         HostedZoneId: 'Z2P70J7EXAMPLE',
         DNSName: 'foo.example.com',
       },
-    }));
+    });
 
-    test.done();
-  },
 
-  'AAAA record with ip addresses'(test: Test) {
+  });
+
+  test('AAAA record with ip addresses', () => {
     // GIVEN
     const stack = new Stack();
 
@@ -208,7 +208,7 @@ nodeunitShim({
     });
 
     // THEN
-    expect(stack).to(haveResource('AWS::Route53::RecordSet', {
+    expect(stack).toHaveResource('AWS::Route53::RecordSet', {
       Name: 'www.myzone.',
       Type: 'AAAA',
       HostedZoneId: {
@@ -218,11 +218,11 @@ nodeunitShim({
         '2001:0db8:85a3:0000:0000:8a2e:0370:7334',
       ],
       TTL: '1800',
-    }));
-    test.done();
-  },
+    });
+
+  });
 
-  'AAAA record with alias on zone root'(test: Test) {
+  test('AAAA record with alias on zone root', () => {
     // GIVEN
     const stack = new Stack();
     const zone = new route53.HostedZone(stack, 'HostedZone', {
@@ -245,7 +245,7 @@ nodeunitShim({
     });
 
     // THEN
-    expect(stack).to(haveResource('AWS::Route53::RecordSet', {
+    expect(stack).toHaveResource('AWS::Route53::RecordSet', {
       Name: 'myzone.',
       HostedZoneId: {
         Ref: 'HostedZoneDB99F866',
@@ -255,12 +255,12 @@ nodeunitShim({
         HostedZoneId: 'Z2P70J7EXAMPLE',
         DNSName: 'foo.example.com',
       },
-    }));
+    });
+
 
-    test.done();
-  },
+  });
 
-  'CNAME record'(test: Test) {
+  test('CNAME record', () => {
     // GIVEN
     const stack = new Stack();
 
@@ -276,7 +276,7 @@ nodeunitShim({
     });
 
     // THEN
-    expect(stack).to(haveResource('AWS::Route53::RecordSet', {
+    expect(stack).toHaveResource('AWS::Route53::RecordSet', {
       Name: 'www.myzone.',
       Type: 'CNAME',
       HostedZoneId: {
@@ -286,11 +286,11 @@ nodeunitShim({
         'hello',
       ],
       TTL: '1800',
-    }));
-    test.done();
-  },
+    });
 
-  'TXT record'(test: Test) {
+  });
+
+  test('TXT record', () => {
     // GIVEN
     const stack = new Stack();
 
@@ -306,7 +306,7 @@ nodeunitShim({
     });
 
     // THEN
-    expect(stack).to(haveResource('AWS::Route53::RecordSet', {
+    expect(stack).toHaveResource('AWS::Route53::RecordSet', {
       Name: 'www.myzone.',
       Type: 'TXT',
       HostedZoneId: {
@@ -316,11 +316,11 @@ nodeunitShim({
         '"should be enclosed with double quotes"',
       ],
       TTL: '1800',
-    }));
-    test.done();
-  },
+    });
+
+  });
 
-  'TXT record with value longer than 255 chars'(test: Test) {
+  test('TXT record with value longer than 255 chars', () => {
     // GIVEN
     const stack = new Stack();
 
@@ -336,7 +336,7 @@ nodeunitShim({
     });
 
     // THEN
-    expect(stack).to(haveResource('AWS::Route53::RecordSet', {
+    expect(stack).toHaveResource('AWS::Route53::RecordSet', {
       Name: 'www.myzone.',
       Type: 'TXT',
       HostedZoneId: {
@@ -346,11 +346,11 @@ nodeunitShim({
         '"hellohellohellohellohellohellohellohellohellohellohellohellohellohellohellohellohellohellohellohellohellohellohellohellohellohellohellohellohellohellohellohellohellohellohellohellohellohellohellohellohellohellohellohellohellohellohellohellohellohellohello""hello"',
       ],
       TTL: '1800',
-    }));
-    test.done();
-  },
+    });
+
+  });
 
-  'SRV record'(test: Test) {
+  test('SRV record', () => {
     // GIVEN
     const stack = new Stack();
 
@@ -371,7 +371,7 @@ nodeunitShim({
     });
 
     // THEN
-    expect(stack).to(haveResource('AWS::Route53::RecordSet', {
+    expect(stack).toHaveResource('AWS::Route53::RecordSet', {
       Name: 'www.myzone.',
       Type: 'SRV',
       HostedZoneId: {
@@ -381,11 +381,11 @@ nodeunitShim({
         '10 5 8080 aws.com',
       ],
       TTL: '1800',
-    }));
-    test.done();
-  },
+    });
+
+  });
 
-  'CAA record'(test: Test) {
+  test('CAA record', () => {
     // GIVEN
     const stack = new Stack();
 
@@ -405,7 +405,7 @@ nodeunitShim({
     });
 
     // THEN
-    expect(stack).to(haveResource('AWS::Route53::RecordSet', {
+    expect(stack).toHaveResource('AWS::Route53::RecordSet', {
       Name: 'www.myzone.',
       Type: 'CAA',
       HostedZoneId: {
@@ -415,11 +415,11 @@ nodeunitShim({
         '0 issue "ssl.com"',
       ],
       TTL: '1800',
-    }));
-    test.done();
-  },
+    });
 
-  'CAA Amazon record'(test: Test) {
+  });
+
+  test('CAA Amazon record', () => {
     // GIVEN
     const stack = new Stack();
 
@@ -433,7 +433,7 @@ nodeunitShim({
     });
 
     // THEN
-    expect(stack).to(haveResource('AWS::Route53::RecordSet', {
+    expect(stack).toHaveResource('AWS::Route53::RecordSet', {
       Name: 'myzone.',
       Type: 'CAA',
       HostedZoneId: {
@@ -443,11 +443,11 @@ nodeunitShim({
         '0 issue "amazon.com"',
       ],
       TTL: '1800',
-    }));
-    test.done();
-  },
+    });
+
+  });
 
-  'CAA Amazon record with record name'(test: Test) {
+  test('CAA Amazon record with record name', () => {
     // GIVEN
     const stack = new Stack();
 
@@ -462,7 +462,7 @@ nodeunitShim({
     });
 
     // THEN
-    expect(stack).to(haveResource('AWS::Route53::RecordSet', {
+    expect(stack).toHaveResource('AWS::Route53::RecordSet', {
       Name: 'www.myzone.',
       Type: 'CAA',
       HostedZoneId: {
@@ -472,11 +472,11 @@ nodeunitShim({
         '0 issue "amazon.com"',
       ],
       TTL: '1800',
-    }));
-    test.done();
-  },
+    });
+
+  });
 
-  'MX record'(test: Test) {
+  test('MX record', () => {
     // GIVEN
     const stack = new Stack();
 
@@ -495,7 +495,7 @@ nodeunitShim({
     });
 
     // THEN
-    expect(stack).to(haveResource('AWS::Route53::RecordSet', {
+    expect(stack).toHaveResource('AWS::Route53::RecordSet', {
       Name: 'mail.myzone.',
       Type: 'MX',
       HostedZoneId: {
@@ -505,11 +505,11 @@ nodeunitShim({
         '10 workmail.aws',
       ],
       TTL: '1800',
-    }));
-    test.done();
-  },
+    });
 
-  'NS record'(test: Test) {
+  });
+
+  test('NS record', () => {
     // GIVEN
     const stack = new Stack();
 
@@ -525,7 +525,7 @@ nodeunitShim({
     });
 
     // THEN
-    expect(stack).to(haveResource('AWS::Route53::RecordSet', {
+    expect(stack).toHaveResource('AWS::Route53::RecordSet', {
       Name: 'www.myzone.',
       Type: 'NS',
       HostedZoneId: {
@@ -536,11 +536,11 @@ nodeunitShim({
         'ns-2.awsdns.com.',
       ],
       TTL: '1800',
-    }));
-    test.done();
-  },
+    });
 
-  'DS record'(test: Test) {
+  });
+
+  test('DS record', () => {
     // GIVEN
     const stack = new Stack();
 
@@ -556,7 +556,7 @@ nodeunitShim({
     });
 
     // THEN
-    expect(stack).to(haveResource('AWS::Route53::RecordSet', {
+    expect(stack).toHaveResource('AWS::Route53::RecordSet', {
       Name: 'www.myzone.',
       Type: 'DS',
       HostedZoneId: {
@@ -566,11 +566,11 @@ nodeunitShim({
         '12345 3 1 123456789abcdef67890123456789abcdef67890',
       ],
       TTL: '1800',
-    }));
-    test.done();
-  },
+    });
+
+  });
 
-  'Zone delegation record'(test: Test) {
+  test('Zone delegation record', () => {
     // GIVEN
     const stack = new Stack();
 
@@ -586,7 +586,7 @@ nodeunitShim({
     });
 
     // THEN
-    expect(stack).to(haveResource('AWS::Route53::RecordSet', {
+    expect(stack).toHaveResource('AWS::Route53::RecordSet', {
       Name: 'foo.myzone.',
       Type: 'NS',
       HostedZoneId: {
@@ -596,11 +596,11 @@ nodeunitShim({
         'ns-1777.awsdns-30.co.uk.',
       ],
       TTL: '172800',
-    }));
-    test.done();
-  },
+    });
+
+  });
 
-  'Cross account zone delegation record with parentHostedZoneId'(test: Test) {
+  test('Cross account zone delegation record with parentHostedZoneId', () => {
     // GIVEN
     const stack = new Stack();
     const parentZone = new route53.PublicHostedZone(stack, 'ParentHostedZone', {
@@ -621,7 +621,7 @@ nodeunitShim({
     });
 
     // THEN
-    expect(stack).to(haveResource('Custom::CrossAccountZoneDelegation', {
+    expect(stack).toHaveResource('Custom::CrossAccountZoneDelegation', {
       ServiceToken: {
         'Fn::GetAtt': [
           'CustomCrossAccountZoneDelegationCustomResourceProviderHandler44A84265',
@@ -645,15 +645,15 @@ nodeunitShim({
         ],
       },
       TTL: 60,
-    }));
-    expect(stack).to(haveResource('Custom::CrossAccountZoneDelegation', {
+    });
+    expect(stack).toHaveResource('Custom::CrossAccountZoneDelegation', {
       DeletionPolicy: 'Retain',
       UpdateReplacePolicy: 'Retain',
-    }, ResourcePart.CompleteDefinition));
-    test.done();
-  },
+    }, ResourcePart.CompleteDefinition);
+
+  });
 
-  'Cross account zone delegation record with parentHostedZoneName'(test: Test) {
+  test('Cross account zone delegation record with parentHostedZoneName', () => {
     // GIVEN
     const stack = new Stack();
     const parentZone = new route53.PublicHostedZone(stack, 'ParentHostedZone', {
@@ -673,7 +673,7 @@ nodeunitShim({
     });
 
     // THEN
-    expect(stack).to(haveResource('Custom::CrossAccountZoneDelegation', {
+    expect(stack).toHaveResource('Custom::CrossAccountZoneDelegation', {
       ServiceToken: {
         'Fn::GetAtt': [
           'CustomCrossAccountZoneDelegationCustomResourceProviderHandler44A84265',
@@ -695,11 +695,11 @@ nodeunitShim({
         ],
       },
       TTL: 60,
-    }));
-    test.done();
-  },
+    });
 
-  'Cross account zone delegation record throws when parent id and name both/nither are supplied'(test: Test) {
+  });
+
+  test('Cross account zone delegation record throws when parent id and name both/nither are supplied', () => {
     // GIVEN
     const stack = new Stack();
     const parentZone = new route53.PublicHostedZone(stack, 'ParentHostedZone', {
@@ -712,15 +712,15 @@ nodeunitShim({
       zoneName: 'sub.myzone.com',
     });
 
-    test.throws(() => {
+    expect(() => {
       new route53.CrossAccountZoneDelegationRecord(stack, 'Delegation1', {
         delegatedZone: childZone,
         delegationRole: parentZone.crossAccountZoneDelegationRole!,
         ttl: Duration.seconds(60),
       });
-    }, /At least one of parentHostedZoneName or parentHostedZoneId is required/);
+    }).toThrow(/At least one of parentHostedZoneName or parentHostedZoneId is required/);
 
-    test.throws(() => {
+    expect(() => {
       new route53.CrossAccountZoneDelegationRecord(stack, 'Delegation2', {
         delegatedZone: childZone,
         parentHostedZoneId: parentZone.hostedZoneId,
@@ -728,8 +728,8 @@ nodeunitShim({
         delegationRole: parentZone.crossAccountZoneDelegationRole!,
         ttl: Duration.seconds(60),
       });
-    }, /Only one of parentHostedZoneName and parentHostedZoneId is supported/);
+    }).toThrow(/Only one of parentHostedZoneName and parentHostedZoneId is supported/);
+
 
-    test.done();
-  },
+  });
 });
diff --git a/packages/@aws-cdk/aws-route53/test/route53.test.ts b/packages/@aws-cdk/aws-route53/test/route53.test.ts
index e5dd624163a9b..f86b155592db7 100644
--- a/packages/@aws-cdk/aws-route53/test/route53.test.ts
+++ b/packages/@aws-cdk/aws-route53/test/route53.test.ts
@@ -1,15 +1,15 @@
-import { beASupersetOfTemplate, exactlyMatchTemplate, expect, haveResource } from '@aws-cdk/assert-internal';
+import '@aws-cdk/assert-internal/jest';
+import { MatchStyle } from '@aws-cdk/assert-internal';
 import * as ec2 from '@aws-cdk/aws-ec2';
 import * as cdk from '@aws-cdk/core';
-import { nodeunitShim, Test } from 'nodeunit-shim';
 import { HostedZone, PrivateHostedZone, PublicHostedZone, TxtRecord } from '../lib';
 
-nodeunitShim({
-  'default properties': {
-    'public hosted zone'(test: Test) {
+describe('route53', () => {
+  describe('default properties', () => {
+    test('public hosted zone', () => {
       const app = new TestApp();
       new PublicHostedZone(app.stack, 'HostedZone', { zoneName: 'test.public' });
-      expect(app.stack).to(exactlyMatchTemplate({
+      expect(app.stack).toMatchTemplate({
         Resources: {
           HostedZoneDB99F866: {
             Type: 'AWS::Route53::HostedZone',
@@ -18,14 +18,14 @@ nodeunitShim({
             },
           },
         },
-      }));
-      test.done();
-    },
-    'private hosted zone'(test: Test) {
+      });
+
+    });
+    test('private hosted zone', () => {
       const app = new TestApp();
       const vpcNetwork = new ec2.Vpc(app.stack, 'VPC');
       new PrivateHostedZone(app.stack, 'HostedZone', { zoneName: 'test.private', vpc: vpcNetwork });
-      expect(app.stack).to(beASupersetOfTemplate({
+      expect(app.stack).toMatchTemplate({
         Resources: {
           HostedZoneDB99F866: {
             Type: 'AWS::Route53::HostedZone',
@@ -38,16 +38,16 @@ nodeunitShim({
             },
           },
         },
-      }));
-      test.done();
-    },
-    'when specifying multiple VPCs'(test: Test) {
+      }, MatchStyle.SUPERSET);
+
+    });
+    test('when specifying multiple VPCs', () => {
       const app = new TestApp();
       const vpcNetworkA = new ec2.Vpc(app.stack, 'VPC1');
       const vpcNetworkB = new ec2.Vpc(app.stack, 'VPC2');
       new PrivateHostedZone(app.stack, 'HostedZone', { zoneName: 'test.private', vpc: vpcNetworkA })
         .addVpc(vpcNetworkB);
-      expect(app.stack).to(beASupersetOfTemplate({
+      expect(app.stack).toMatchTemplate({
         Resources: {
           HostedZoneDB99F866: {
             Type: 'AWS::Route53::HostedZone',
@@ -64,12 +64,12 @@ nodeunitShim({
             },
           },
         },
-      }));
-      test.done();
-    },
-  },
+      }, MatchStyle.SUPERSET);
 
-  'exporting and importing works'(test: Test) {
+    });
+  });
+
+  test('exporting and importing works', () => {
     const stack2 = new cdk.Stack();
 
     const importedZone = HostedZone.fromHostedZoneAttributes(stack2, 'Imported', {
@@ -83,17 +83,17 @@ nodeunitShim({
       values: ['SeeThere'],
     });
 
-    expect(stack2).to(haveResource('AWS::Route53::RecordSet', {
+    expect(stack2).toHaveResource('AWS::Route53::RecordSet', {
       HostedZoneId: 'hosted-zone-id',
       Name: 'lookHere.cdk.local.',
       ResourceRecords: ['"SeeThere"'],
       Type: 'TXT',
-    }));
+    });
 
-    test.done();
-  },
 
-  'adds period to name if not provided'(test: Test) {
+  });
+
+  test('adds period to name if not provided', () => {
     // GIVEN
     const stack = new cdk.Stack();
 
@@ -103,22 +103,22 @@ nodeunitShim({
     });
 
     // THEN
-    expect(stack).to(haveResource('AWS::Route53::HostedZone', {
+    expect(stack).toHaveResource('AWS::Route53::HostedZone', {
       Name: 'zonename.',
-    }));
-    test.done();
-  },
+    });
 
-  'fails if zone name ends with a trailing dot'(test: Test) {
+  });
+
+  test('fails if zone name ends with a trailing dot', () => {
     // GIVEN
     const stack = new cdk.Stack();
 
     // THEN
-    test.throws(() => new HostedZone(stack, 'MyHostedZone', { zoneName: 'zonename.' }), /zone name must not end with a trailing dot/);
-    test.done();
-  },
+    expect(() => new HostedZone(stack, 'MyHostedZone', { zoneName: 'zonename.' })).toThrow(/zone name must not end with a trailing dot/);
+
+  });
 
-  'a hosted zone can be assiciated with a VPC either upon creation or using "addVpc"'(test: Test) {
+  test('a hosted zone can be assiciated with a VPC either upon creation or using "addVpc"', () => {
     // GIVEN
     const stack = new cdk.Stack();
     const vpc1 = new ec2.Vpc(stack, 'VPC1');
@@ -133,7 +133,7 @@ nodeunitShim({
     zone.addVpc(vpc3);
 
     // THEN
-    expect(stack).to(haveResource('AWS::Route53::HostedZone', {
+    expect(stack).toHaveResource('AWS::Route53::HostedZone', {
       VPCs: [
         {
           VPCId: {
@@ -160,22 +160,22 @@ nodeunitShim({
           },
         },
       ],
-    }));
-    test.done();
-  },
+    });
 
-  'public zone cannot be associated with a vpc (runtime error)'(test: Test) {
+  });
+
+  test('public zone cannot be associated with a vpc (runtime error)', () => {
     // GIVEN
     const stack = new cdk.Stack();
     const zone = new PublicHostedZone(stack, 'MyHostedZone', { zoneName: 'zonename' });
     const vpc = new ec2.Vpc(stack, 'VPC');
 
     // THEN
-    test.throws(() => zone.addVpc(vpc), /Cannot associate public hosted zones with a VPC/);
-    test.done();
-  },
+    expect(() => zone.addVpc(vpc)).toThrow(/Cannot associate public hosted zones with a VPC/);
+
+  });
 
-  'setting up zone delegation'(test: Test) {
+  test('setting up zone delegation', () => {
     // GIVEN
     const stack = new cdk.Stack();
     const zone = new PublicHostedZone(stack, 'TopZone', { zoneName: 'top.test' });
@@ -185,17 +185,17 @@ nodeunitShim({
     zone.addDelegation(delegate, { ttl: cdk.Duration.seconds(1337) });
 
     // THEN
-    expect(stack).to(haveResource('AWS::Route53::RecordSet', {
+    expect(stack).toHaveResource('AWS::Route53::RecordSet', {
       Type: 'NS',
       Name: 'sub.top.test.',
       HostedZoneId: stack.resolve(zone.hostedZoneId),
       ResourceRecords: stack.resolve(delegate.hostedZoneNameServers),
       TTL: '1337',
-    }));
-    test.done();
-  },
+    });
+
+  });
 
-  'public hosted zone wiht caaAmazon set to true'(test: Test) {
+  test('public hosted zone wiht caaAmazon set to true', () => {
     // GIVEN
     const stack = new cdk.Stack();
 
@@ -206,15 +206,15 @@ nodeunitShim({
     });
 
     // THEN
-    expect(stack).to(haveResource('AWS::Route53::RecordSet', {
+    expect(stack).toHaveResource('AWS::Route53::RecordSet', {
       Type: 'CAA',
       Name: 'protected.com.',
       ResourceRecords: [
         '0 issue "amazon.com"',
       ],
-    }));
-    test.done();
-  },
+    });
+
+  });
 });
 
 class TestApp {
diff --git a/packages/@aws-cdk/aws-route53/test/util.test.ts b/packages/@aws-cdk/aws-route53/test/util.test.ts
index c6ded4e74f7b4..f6ec2b7cd36a6 100644
--- a/packages/@aws-cdk/aws-route53/test/util.test.ts
+++ b/packages/@aws-cdk/aws-route53/test/util.test.ts
@@ -1,21 +1,20 @@
 import * as cdk from '@aws-cdk/core';
-import { nodeunitShim, Test } from 'nodeunit-shim';
 import { HostedZone } from '../lib';
 import * as util from '../lib/util';
 
-nodeunitShim({
-  'throws when zone name ending with a \'.\''(test: Test) {
-    test.throws(() => util.validateZoneName('zone.name.'), /trailing dot/);
-    test.done();
-  },
+describe('util', () => {
+  test('throws when zone name ending with a \'.\'', () => {
+    expect(() => util.validateZoneName('zone.name.')).toThrow(/trailing dot/);
 
-  'accepts a valid domain name'(test: Test) {
+  });
+
+  test('accepts a valid domain name', () => {
     const domainName = 'amazonaws.com';
     util.validateZoneName(domainName);
-    test.done();
-  },
 
-  'providedName ending with a dot returns the name'(test: Test) {
+  });
+
+  test('providedName ending with a dot returns the name', () => {
     // GIVEN
     const stack = new cdk.Stack();
 
@@ -27,11 +26,11 @@ nodeunitShim({
     }));
 
     // THEN
-    test.equal(qualified, 'test.domain.com.');
-    test.done();
-  },
+    expect(qualified).toEqual('test.domain.com.');
+
+  });
 
-  'providedName that matches zoneName returns providedName with a trailing dot'(test: Test) {
+  test('providedName that matches zoneName returns providedName with a trailing dot', () => {
     // GIVEN
     const stack = new cdk.Stack();
 
@@ -43,11 +42,11 @@ nodeunitShim({
     }));
 
     // THEN
-    test.equal(qualified, 'test.domain.com.');
-    test.done();
-  },
+    expect(qualified).toEqual('test.domain.com.');
 
-  'providedName that ends with zoneName returns providedName with a trailing dot'(test: Test) {
+  });
+
+  test('providedName that ends with zoneName returns providedName with a trailing dot', () => {
     // GIVEN
     const stack = new cdk.Stack();
 
@@ -59,11 +58,11 @@ nodeunitShim({
     }));
 
     // THEN
-    test.equal(qualified, 'test.domain.com.');
-    test.done();
-  },
+    expect(qualified).toEqual('test.domain.com.');
+
+  });
 
-  'providedName that does not match zoneName concatenates providedName and zoneName'(test: Test) {
+  test('providedName that does not match zoneName concatenates providedName and zoneName', () => {
     // GIVEN
     const stack = new cdk.Stack();
 
@@ -75,7 +74,7 @@ nodeunitShim({
     }));
 
     // THEN
-    test.equal(qualified, 'test.domain.com.');
-    test.done();
-  },
+    expect(qualified).toEqual('test.domain.com.');
+
+  });
 });
diff --git a/packages/@aws-cdk/aws-route53/test/vpc-endpoint-service-domain-name.test.ts b/packages/@aws-cdk/aws-route53/test/vpc-endpoint-service-domain-name.test.ts
index 82706fe29d0ea..35b7ac9c67596 100644
--- a/packages/@aws-cdk/aws-route53/test/vpc-endpoint-service-domain-name.test.ts
+++ b/packages/@aws-cdk/aws-route53/test/vpc-endpoint-service-domain-name.test.ts
@@ -1,4 +1,3 @@
-/* eslint-disable jest/no-disabled-tests */
 import { expect as cdkExpect, haveResource, haveResourceLike, ResourcePart } from '@aws-cdk/assert-internal';
 import '@aws-cdk/assert-internal/jest';
 import { IVpcEndpointServiceLoadBalancer, VpcEndpointService } from '@aws-cdk/aws-ec2';
diff --git a/packages/@aws-cdk/aws-s3/package.json b/packages/@aws-cdk/aws-s3/package.json
index da9bdd3d05df4..865be5d5232b8 100644
--- a/packages/@aws-cdk/aws-s3/package.json
+++ b/packages/@aws-cdk/aws-s3/package.json
@@ -78,8 +78,8 @@
     "cdk-build-tools": "0.0.0",
     "cdk-integ-tools": "0.0.0",
     "cfn2ts": "0.0.0",
+    "jest": "^26.6.3",
     "pkglint": "0.0.0",
-    "nodeunit-shim": "0.0.0",
     "@aws-cdk/assert-internal": "0.0.0"
   },
   "dependencies": {
diff --git a/packages/@aws-cdk/aws-s3/test/aspect.test.ts b/packages/@aws-cdk/aws-s3/test/aspect.test.ts
index ef0394a4cf9cb..023ef826c18f8 100644
--- a/packages/@aws-cdk/aws-s3/test/aspect.test.ts
+++ b/packages/@aws-cdk/aws-s3/test/aspect.test.ts
@@ -1,12 +1,11 @@
-// import { expect, haveResource, haveResourceLike, SynthUtils } from '@aws-cdk/assert-internal';
+import '@aws-cdk/assert-internal/jest';
 import { SynthUtils } from '@aws-cdk/assert-internal';
 import * as cdk from '@aws-cdk/core';
 import { IConstruct } from 'constructs';
-import { nodeunitShim, Test } from 'nodeunit-shim';
 import * as s3 from '../lib';
 
-nodeunitShim({
-  'bucket must have versioning: failure'(test: Test) {
+describe('aspect', () => {
+  test('bucket must have versioning: failure', () => {
     // GIVEN
     const stack = new cdk.Stack();
     new s3.Bucket(stack, 'MyBucket');
@@ -17,12 +16,12 @@ nodeunitShim({
     // THEN
     const assembly = SynthUtils.synthesize(stack);
     const errorMessage = assembly.messages.find(m => m.entry.data === 'Bucket versioning is not enabled');
-    test.ok(errorMessage, 'Error message not reported');
+    expect(errorMessage).toBeDefined();
 
-    test.done();
-  },
 
-  'bucket must have versioning: success'(test: Test) {
+  });
+
+  test('bucket must have versioning: success', () => {
     // GIVEN
     const stack = new cdk.Stack();
     new s3.Bucket(stack, 'MyBucket', {
@@ -34,10 +33,10 @@ nodeunitShim({
 
     // THEN
     const assembly = SynthUtils.synthesize(stack);
-    test.deepEqual(assembly.messages, []);
+    expect(assembly.messages.length).toEqual(0);
+
 
-    test.done();
-  },
+  });
 });
 
 class BucketVersioningChecker implements cdk.IAspect {
diff --git a/packages/@aws-cdk/aws-s3/test/bucket-policy.test.ts b/packages/@aws-cdk/aws-s3/test/bucket-policy.test.ts
index b64ab3d99df43..13b4b798bbd09 100644
--- a/packages/@aws-cdk/aws-s3/test/bucket-policy.test.ts
+++ b/packages/@aws-cdk/aws-s3/test/bucket-policy.test.ts
@@ -1,14 +1,13 @@
-import { expect, haveResource } from '@aws-cdk/assert-internal';
+import '@aws-cdk/assert-internal/jest';
 import { AnyPrincipal, PolicyStatement } from '@aws-cdk/aws-iam';
 import { RemovalPolicy, Stack, App } from '@aws-cdk/core';
-import { nodeunitShim, Test } from 'nodeunit-shim';
 import * as s3 from '../lib';
 
 // to make it easy to copy & paste from output:
 /* eslint-disable quote-props */
 
-nodeunitShim({
-  'default properties'(test: Test) {
+describe('bucket policy', () => {
+  test('default properties', () => {
     const stack = new Stack();
 
     const myBucket = new s3.Bucket(stack, 'MyBucket');
@@ -21,7 +20,7 @@ nodeunitShim({
       principals: [new AnyPrincipal()],
     }));
 
-    expect(stack).to(haveResource('AWS::S3::BucketPolicy', {
+    expect(stack).toHaveResource('AWS::S3::BucketPolicy', {
       Bucket: {
         'Ref': 'MyBucketF68F3FF0',
       },
@@ -36,12 +35,12 @@ nodeunitShim({
           },
         ],
       },
-    }));
+    });
 
-    test.done();
-  },
 
-  'when specifying a removalPolicy at creation'(test: Test) {
+  });
+
+  test('when specifying a removalPolicy at creation', () => {
     const stack = new Stack();
 
     const myBucket = new s3.Bucket(stack, 'MyBucket');
@@ -55,7 +54,7 @@ nodeunitShim({
       principals: [new AnyPrincipal()],
     }));
 
-    expect(stack).toMatch({
+    expect(stack).toMatchTemplate({
       'Resources': {
         'MyBucketF68F3FF0': {
           'Type': 'AWS::S3::Bucket',
@@ -86,10 +85,10 @@ nodeunitShim({
       },
     });
 
-    test.done();
-  },
 
-  'when specifying a removalPolicy after creation'(test: Test) {
+  });
+
+  test('when specifying a removalPolicy after creation', () => {
     const stack = new Stack();
 
     const myBucket = new s3.Bucket(stack, 'MyBucket');
@@ -100,7 +99,7 @@ nodeunitShim({
     }));
     myBucket.policy?.applyRemovalPolicy(RemovalPolicy.RETAIN);
 
-    expect(stack).toMatch({
+    expect(stack).toMatchTemplate({
       'Resources': {
         'MyBucketF68F3FF0': {
           'Type': 'AWS::S3::Bucket',
@@ -131,10 +130,10 @@ nodeunitShim({
       },
     });
 
-    test.done();
-  },
 
-  'fails if bucket policy has no actions'(test: Test) {
+  });
+
+  test('fails if bucket policy has no actions', () => {
     const app = new App();
     const stack = new Stack(app, 'my-stack');
     const myBucket = new s3.Bucket(stack, 'MyBucket');
@@ -143,12 +142,12 @@ nodeunitShim({
       principals: [new AnyPrincipal()],
     }));
 
-    test.throws(() => app.synth(), /A PolicyStatement must specify at least one \'action\' or \'notAction\'/);
+    expect(() => app.synth()).toThrow(/A PolicyStatement must specify at least one \'action\' or \'notAction\'/);
+
 
-    test.done();
-  },
+  });
 
-  'fails if bucket policy has no IAM principals'(test: Test) {
+  test('fails if bucket policy has no IAM principals', () => {
     const app = new App();
     const stack = new Stack(app, 'my-stack');
     const myBucket = new s3.Bucket(stack, 'MyBucket');
@@ -157,8 +156,8 @@ nodeunitShim({
       actions: ['s3:GetObject*'],
     }));
 
-    test.throws(() => app.synth(), /A PolicyStatement used in a resource-based policy must specify at least one IAM principal/);
+    expect(() => app.synth()).toThrow(/A PolicyStatement used in a resource-based policy must specify at least one IAM principal/);
+
 
-    test.done();
-  },
+  });
 });
\ No newline at end of file
diff --git a/packages/@aws-cdk/aws-s3/test/cors.test.ts b/packages/@aws-cdk/aws-s3/test/cors.test.ts
index 5769c1059640d..feddf0b159669 100644
--- a/packages/@aws-cdk/aws-s3/test/cors.test.ts
+++ b/packages/@aws-cdk/aws-s3/test/cors.test.ts
@@ -1,10 +1,9 @@
-import { expect, haveResource } from '@aws-cdk/assert-internal';
+import '@aws-cdk/assert-internal/jest';
 import { Stack } from '@aws-cdk/core';
-import { nodeunitShim, Test } from 'nodeunit-shim';
 import { Bucket, HttpMethods } from '../lib';
 
-nodeunitShim({
-  'Can use addCors() to add a CORS configuration'(test: Test) {
+describe('cors', () => {
+  test('Can use addCors() to add a CORS configuration', () => {
     // GIVEN
     const stack = new Stack();
 
@@ -16,19 +15,19 @@ nodeunitShim({
     });
 
     // THEN
-    expect(stack).to(haveResource('AWS::S3::Bucket', {
+    expect(stack).toHaveResource('AWS::S3::Bucket', {
       CorsConfiguration: {
         CorsRules: [{
           AllowedMethods: ['GET', 'HEAD'],
           AllowedOrigins: ['https://example.com'],
         }],
       },
-    }));
+    });
+
 
-    test.done();
-  },
+  });
 
-  'Bucket with multiple cors configurations'(test: Test) {
+  test('Bucket with multiple cors configurations', () => {
     // GIVEN
     const stack = new Stack();
 
@@ -74,7 +73,7 @@ nodeunitShim({
     });
 
     // THEN
-    expect(stack).to(haveResource('AWS::S3::Bucket', {
+    expect(stack).toHaveResource('AWS::S3::Bucket', {
       CorsConfiguration: {
         CorsRules: [
           {
@@ -114,8 +113,8 @@ nodeunitShim({
           },
         ],
       },
-    }));
+    });
+
 
-    test.done();
-  },
+  });
 });
diff --git a/packages/@aws-cdk/aws-s3/test/metrics.test.ts b/packages/@aws-cdk/aws-s3/test/metrics.test.ts
index bf7e57e04b557..9072c33a5fcb6 100644
--- a/packages/@aws-cdk/aws-s3/test/metrics.test.ts
+++ b/packages/@aws-cdk/aws-s3/test/metrics.test.ts
@@ -1,10 +1,9 @@
-import { expect, haveResource } from '@aws-cdk/assert-internal';
+import '@aws-cdk/assert-internal/jest';
 import { Stack } from '@aws-cdk/core';
-import { nodeunitShim, Test } from 'nodeunit-shim';
 import { Bucket } from '../lib';
 
-nodeunitShim({
-  'Can use addMetrics() to add a metric configuration'(test: Test) {
+describe('metrics', () => {
+  test('Can use addMetrics() to add a metric configuration', () => {
     // GIVEN
     const stack = new Stack();
 
@@ -15,16 +14,16 @@ nodeunitShim({
     });
 
     // THEN
-    expect(stack).to(haveResource('AWS::S3::Bucket', {
+    expect(stack).toHaveResource('AWS::S3::Bucket', {
       MetricsConfigurations: [{
         Id: 'test',
       }],
-    }));
+    });
+
 
-    test.done();
-  },
+  });
 
-  'Bucket with metrics on prefix'(test: Test) {
+  test('Bucket with metrics on prefix', () => {
     // GIVEN
     const stack = new Stack();
 
@@ -37,17 +36,17 @@ nodeunitShim({
     });
 
     // THEN
-    expect(stack).to(haveResource('AWS::S3::Bucket', {
+    expect(stack).toHaveResource('AWS::S3::Bucket', {
       MetricsConfigurations: [{
         Id: 'test',
         Prefix: 'prefix',
       }],
-    }));
+    });
+
 
-    test.done();
-  },
+  });
 
-  'Bucket with metrics on tag filter'(test: Test) {
+  test('Bucket with metrics on tag filter', () => {
     // GIVEN
     const stack = new Stack();
 
@@ -60,7 +59,7 @@ nodeunitShim({
     });
 
     // THEN
-    expect(stack).to(haveResource('AWS::S3::Bucket', {
+    expect(stack).toHaveResource('AWS::S3::Bucket', {
       MetricsConfigurations: [{
         Id: 'test',
         TagFilters: [
@@ -68,12 +67,12 @@ nodeunitShim({
           { Key: 'tagname2', Value: 'tagvalue2' },
         ],
       }],
-    }));
+    });
+
 
-    test.done();
-  },
+  });
 
-  'Bucket with multiple metric configurations'(test: Test) {
+  test('Bucket with multiple metric configurations', () => {
     // GIVEN
     const stack = new Stack();
 
@@ -93,7 +92,7 @@ nodeunitShim({
     });
 
     // THEN
-    expect(stack).to(haveResource('AWS::S3::Bucket', {
+    expect(stack).toHaveResource('AWS::S3::Bucket', {
       MetricsConfigurations: [{
         Id: 'test',
         TagFilters: [
@@ -105,8 +104,8 @@ nodeunitShim({
         Id: 'test2',
         Prefix: 'prefix',
       }],
-    }));
+    });
+
 
-    test.done();
-  },
+  });
 });
diff --git a/packages/@aws-cdk/aws-s3/test/notification.test.ts b/packages/@aws-cdk/aws-s3/test/notification.test.ts
index 75906826ddeff..2f3178fb42af0 100644
--- a/packages/@aws-cdk/aws-s3/test/notification.test.ts
+++ b/packages/@aws-cdk/aws-s3/test/notification.test.ts
@@ -1,10 +1,10 @@
-import { expect, haveResource, haveResourceLike, ResourcePart } from '@aws-cdk/assert-internal';
+import '@aws-cdk/assert-internal/jest';
+import { ResourcePart } from '@aws-cdk/assert-internal';
 import * as cdk from '@aws-cdk/core';
-import { nodeunitShim, Test } from 'nodeunit-shim';
 import * as s3 from '../lib';
 
-nodeunitShim({
-  'when notification is added a custom s3 bucket notification resource is provisioned'(test: Test) {
+describe('notification', () => {
+  test('when notification is added a custom s3 bucket notification resource is provisioned', () => {
     const stack = new cdk.Stack();
 
     const bucket = new s3.Bucket(stack, 'MyBucket');
@@ -16,8 +16,8 @@ nodeunitShim({
       }),
     });
 
-    expect(stack).to(haveResource('AWS::S3::Bucket'));
-    expect(stack).to(haveResource('Custom::S3BucketNotifications', {
+    expect(stack).toHaveResource('AWS::S3::Bucket');
+    expect(stack).toHaveResource('Custom::S3BucketNotifications', {
       NotificationConfiguration: {
         TopicConfigurations: [
           {
@@ -28,12 +28,12 @@ nodeunitShim({
           },
         ],
       },
-    }));
+    });
+
 
-    test.done();
-  },
+  });
 
-  'can specify prefix and suffix filter rules'(test: Test) {
+  test('can specify prefix and suffix filter rules', () => {
     const stack = new cdk.Stack();
 
     const bucket = new s3.Bucket(stack, 'MyBucket');
@@ -45,7 +45,7 @@ nodeunitShim({
       }),
     }, { prefix: 'images/', suffix: '.png' });
 
-    expect(stack).to(haveResource('Custom::S3BucketNotifications', {
+    expect(stack).toHaveResource('Custom::S3BucketNotifications', {
       NotificationConfiguration: {
         TopicConfigurations: [
           {
@@ -70,12 +70,12 @@ nodeunitShim({
           },
         ],
       },
-    }));
+    });
+
 
-    test.done();
-  },
+  });
 
-  'the notification lambda handler must depend on the role to prevent executing too early'(test: Test) {
+  test('the notification lambda handler must depend on the role to prevent executing too early', () => {
     const stack = new cdk.Stack();
 
     const bucket = new s3.Bucket(stack, 'MyBucket');
@@ -87,7 +87,7 @@ nodeunitShim({
       }),
     });
 
-    expect(stack).to(haveResourceLike('AWS::Lambda::Function', {
+    expect(stack).toHaveResourceLike('AWS::Lambda::Function', {
       Type: 'AWS::Lambda::Function',
       Properties: {
         Role: {
@@ -99,38 +99,38 @@ nodeunitShim({
       },
       DependsOn: ['BucketNotificationsHandler050a0587b7544547bf325f094a3db834RoleDefaultPolicy2CF63D36',
         'BucketNotificationsHandler050a0587b7544547bf325f094a3db834RoleB6FB88EC'],
-    }, ResourcePart.CompleteDefinition ) );
+    }, ResourcePart.CompleteDefinition );
 
-    test.done();
-  },
 
-  'throws with multiple prefix rules in a filter'(test: Test) {
+  });
+
+  test('throws with multiple prefix rules in a filter', () => {
     const stack = new cdk.Stack();
 
     const bucket = new s3.Bucket(stack, 'MyBucket');
 
-    test.throws(() => bucket.addEventNotification(s3.EventType.OBJECT_CREATED, {
+    expect(() => bucket.addEventNotification(s3.EventType.OBJECT_CREATED, {
       bind: () => ({
         arn: 'ARN',
         type: s3.BucketNotificationDestinationType.TOPIC,
       }),
-    }, { prefix: 'images/' }, { prefix: 'archive/' }), /prefix rule/);
+    }, { prefix: 'images/' }, { prefix: 'archive/' })).toThrow(/prefix rule/);
+
 
-    test.done();
-  },
+  });
 
-  'throws with multiple suffix rules in a filter'(test: Test) {
+  test('throws with multiple suffix rules in a filter', () => {
     const stack = new cdk.Stack();
 
     const bucket = new s3.Bucket(stack, 'MyBucket');
 
-    test.throws(() => bucket.addEventNotification(s3.EventType.OBJECT_CREATED, {
+    expect(() => bucket.addEventNotification(s3.EventType.OBJECT_CREATED, {
       bind: () => ({
         arn: 'ARN',
         type: s3.BucketNotificationDestinationType.TOPIC,
       }),
-    }, { suffix: '.png' }, { suffix: '.zip' }), /suffix rule/);
+    }, { suffix: '.png' }, { suffix: '.zip' })).toThrow(/suffix rule/);
+
 
-    test.done();
-  },
+  });
 });
diff --git a/packages/@aws-cdk/aws-s3/test/rules.test.ts b/packages/@aws-cdk/aws-s3/test/rules.test.ts
index fb613bcf109e8..818ae7d830439 100644
--- a/packages/@aws-cdk/aws-s3/test/rules.test.ts
+++ b/packages/@aws-cdk/aws-s3/test/rules.test.ts
@@ -1,10 +1,9 @@
-import { expect, haveResource } from '@aws-cdk/assert-internal';
+import '@aws-cdk/assert-internal/jest';
 import { Duration, Stack } from '@aws-cdk/core';
-import { nodeunitShim, Test } from 'nodeunit-shim';
 import { Bucket, StorageClass } from '../lib';
 
-nodeunitShim({
-  'Bucket with expiration days'(test: Test) {
+describe('rules', () => {
+  test('Bucket with expiration days', () => {
     // GIVEN
     const stack = new Stack();
 
@@ -16,19 +15,19 @@ nodeunitShim({
     });
 
     // THEN
-    expect(stack).to(haveResource('AWS::S3::Bucket', {
+    expect(stack).toHaveResource('AWS::S3::Bucket', {
       LifecycleConfiguration: {
         Rules: [{
           ExpirationInDays: 30,
           Status: 'Enabled',
         }],
       },
-    }));
+    });
+
 
-    test.done();
-  },
+  });
 
-  'Can use addLifecycleRule() to add a lifecycle rule'(test: Test) {
+  test('Can use addLifecycleRule() to add a lifecycle rule', () => {
     // GIVEN
     const stack = new Stack();
 
@@ -39,19 +38,19 @@ nodeunitShim({
     });
 
     // THEN
-    expect(stack).to(haveResource('AWS::S3::Bucket', {
+    expect(stack).toHaveResource('AWS::S3::Bucket', {
       LifecycleConfiguration: {
         Rules: [{
           ExpirationInDays: 30,
           Status: 'Enabled',
         }],
       },
-    }));
+    });
 
-    test.done();
-  },
 
-  'Bucket with expiration date'(test: Test) {
+  });
+
+  test('Bucket with expiration date', () => {
     // GIVEN
     const stack = new Stack();
 
@@ -63,19 +62,19 @@ nodeunitShim({
     });
 
     // THEN
-    expect(stack).to(haveResource('AWS::S3::Bucket', {
+    expect(stack).toHaveResource('AWS::S3::Bucket', {
       LifecycleConfiguration: {
         Rules: [{
           ExpirationDate: '2018-01-01T00:00:00',
           Status: 'Enabled',
         }],
       },
-    }));
+    });
+
 
-    test.done();
-  },
+  });
 
-  'Bucket with transition rule'(test: Test) {
+  test('Bucket with transition rule', () => {
     // GIVEN
     const stack = new Stack();
 
@@ -90,7 +89,7 @@ nodeunitShim({
     });
 
     // THEN
-    expect(stack).to(haveResource('AWS::S3::Bucket', {
+    expect(stack).toHaveResource('AWS::S3::Bucket', {
       LifecycleConfiguration: {
         Rules: [{
           Transitions: [{
@@ -100,23 +99,23 @@ nodeunitShim({
           Status: 'Enabled',
         }],
       },
-    }));
+    });
+
 
-    test.done();
-  },
+  });
 
-  'Noncurrent rule on nonversioned bucket fails'(test: Test) {
+  test('Noncurrent rule on nonversioned bucket fails', () => {
     // GIVEN
     const stack = new Stack();
 
     // WHEN: Fail because of lack of versioning
-    test.throws(() => {
+    expect(() => {
       new Bucket(stack, 'Bucket1', {
         lifecycleRules: [{
           noncurrentVersionExpiration: Duration.days(10),
         }],
       });
-    });
+    }).toThrow();
 
     // WHEN: Succeeds because versioning is enabled
     new Bucket(stack, 'Bucket2', {
@@ -126,10 +125,10 @@ nodeunitShim({
       }],
     });
 
-    test.done();
-  },
 
-  'Bucket with expiredObjectDeleteMarker'(test: Test) {
+  });
+
+  test('Bucket with expiredObjectDeleteMarker', () => {
     // GIVEN
     const stack = new Stack();
 
@@ -141,15 +140,15 @@ nodeunitShim({
     });
 
     // THEN
-    expect(stack).to(haveResource('AWS::S3::Bucket', {
+    expect(stack).toHaveResource('AWS::S3::Bucket', {
       LifecycleConfiguration: {
         Rules: [{
           ExpiredObjectDeleteMarker: true,
           Status: 'Enabled',
         }],
       },
-    }));
+    });
+
 
-    test.done();
-  },
+  });
 });
diff --git a/packages/@aws-cdk/aws-s3/test/util.test.ts b/packages/@aws-cdk/aws-s3/test/util.test.ts
index 528b83b10404b..e688932a0f7eb 100644
--- a/packages/@aws-cdk/aws-s3/test/util.test.ts
+++ b/packages/@aws-cdk/aws-s3/test/util.test.ts
@@ -1,68 +1,69 @@
+import '@aws-cdk/assert-internal/jest';
 import * as cdk from '@aws-cdk/core';
-import { nodeunitShim, Test } from 'nodeunit-shim';
 import { parseBucketArn, parseBucketName } from '../lib/util';
 
-nodeunitShim({
-  parseBucketArn: {
-    'explicit arn'(test: Test) {
+describe('utils', () => {
+  describe('parseBucketArn', () => {
+    test('explicit arn', () => {
       const stack = new cdk.Stack();
       const bucketArn = 'my:bucket:arn';
-      test.deepEqual(parseBucketArn(stack, { bucketArn }), bucketArn);
-      test.done();
-    },
+      expect(parseBucketArn(stack, { bucketArn })).toEqual(bucketArn);
 
-    'produce arn from bucket name'(test: Test) {
+    });
+
+    test('produce arn from bucket name', () => {
       const stack = new cdk.Stack();
       const bucketName = 'hello';
-      test.deepEqual(stack.resolve(parseBucketArn(stack, { bucketName })), {
+      expect(stack.resolve(parseBucketArn(stack, { bucketName }))).toEqual({
         'Fn::Join':
           ['',
             ['arn:',
               { Ref: 'AWS::Partition' },
               ':s3:::hello']],
       });
-      test.done();
-    },
 
-    'fails if neither arn nor name are provided'(test: Test) {
+    });
+
+    test('fails if neither arn nor name are provided', () => {
       const stack = new cdk.Stack();
-      test.throws(() => parseBucketArn(stack, {}), /Cannot determine bucket ARN. At least `bucketArn` or `bucketName` is needed/);
-      test.done();
-    },
-  },
+      expect(() => parseBucketArn(stack, {})).toThrow(/Cannot determine bucket ARN. At least `bucketArn` or `bucketName` is needed/);
 
-  parseBucketName: {
+    });
+  });
 
-    'explicit name'(test: Test) {
+  describe('parseBucketName', () => {
+
+    test('explicit name', () => {
       const stack = new cdk.Stack();
       const bucketName = 'foo';
-      test.deepEqual(stack.resolve(parseBucketName(stack, { bucketName })), 'foo');
-      test.done();
-    },
+      expect(stack.resolve(parseBucketName(stack, { bucketName }))).toEqual('foo');
+
+    });
 
-    'extract bucket name from string arn'(test: Test) {
+    test('extract bucket name from string arn', () => {
       const stack = new cdk.Stack();
       const bucketArn = 'arn:aws:s3:::my-bucket';
-      test.deepEqual(stack.resolve(parseBucketName(stack, { bucketArn })), 'my-bucket');
-      test.done();
-    },
+      expect(stack.resolve(parseBucketName(stack, { bucketArn }))).toEqual('my-bucket');
 
-    'can parse bucket name even if it contains a token'(test: Test) {
+    });
+
+    test('can parse bucket name even if it contains a token', () => {
       const stack = new cdk.Stack();
       const bucketArn = `arn:aws:s3:::${cdk.Token.asString({ Ref: 'my-bucket' })}`;
 
-      test.deepEqual(
+      expect(
         stack.resolve(parseBucketName(stack, { bucketArn })),
+      ).toEqual(
         { Ref: 'my-bucket' },
       );
-      test.done();
-    },
 
-    'fails if ARN has invalid format'(test: Test) {
+    });
+
+    test('fails if ARN has invalid format', () => {
       const stack = new cdk.Stack();
       const bucketArn = 'invalid-arn';
-      test.throws(() => parseBucketName(stack, { bucketArn }), /ARNs must/);
-      test.done();
-    },
-  },
+      expect(() => parseBucketName(stack, { bucketArn })).toThrow(/ARNs must/);
+
+    });
+  });
 });

From 01bf6e2922994e7d41c8c6b171aa1693835f2b53 Mon Sep 17 00:00:00 2001
From: Jonathan Goldwasser <jogold@users.noreply.github.com>
Date: Mon, 30 Aug 2021 17:46:22 +0200
Subject: [PATCH 37/91] feat(core): normalize line endings in asset hash
 calculation (#16276)

Replace CRLF with LF so asset hashes are identical across platforms.

The hash still includes the size but it is now the size after converting
line endings.

Addresses #14555 (closes it?)

----

*By submitting this pull request, I confirm that my contribution is made under the terms of the Apache-2.0 license*
---
 packages/@aws-cdk/core/lib/fs/fingerprint.ts  | 52 ++++++++++++++++---
 packages/@aws-cdk/core/test/fs/eol/lf.txt     |  2 +
 .../core/test/fs/fs-fingerprint.test.ts       | 24 +++++++++
 3 files changed, 71 insertions(+), 7 deletions(-)
 create mode 100644 packages/@aws-cdk/core/test/fs/eol/lf.txt

diff --git a/packages/@aws-cdk/core/lib/fs/fingerprint.ts b/packages/@aws-cdk/core/lib/fs/fingerprint.ts
index 50a81fd53982d..7ba7214109b2c 100644
--- a/packages/@aws-cdk/core/lib/fs/fingerprint.ts
+++ b/packages/@aws-cdk/core/lib/fs/fingerprint.ts
@@ -9,14 +9,18 @@ const BUFFER_SIZE = 8 * 1024;
 const CTRL_SOH = '\x01';
 const CTRL_SOT = '\x02';
 const CTRL_ETX = '\x03';
+const CR = '\r';
+const LF = '\n';
+const CRLF = `${CR}${LF}`;
 
 /**
  * Produces fingerprint based on the contents of a single file or an entire directory tree.
  *
+ * Line endings are converted from CRLF to LF.
+ *
  * The fingerprint will also include:
  * 1. An extra string if defined in `options.extra`.
- * 2. The set of exclude patterns, if defined in `options.exclude`
- * 3. The symlink follow mode value.
+ * 2. The symlink follow mode value.
  *
  * @param fileOrDirectory The directory or file to fingerprint
  * @param options Fingerprinting options
@@ -60,7 +64,7 @@ export function fingerprint(fileOrDirectory: string, options: FingerprintOptions
         _hashField(hash, `link:${relativePath}`, linkTarget);
       }
     } else if (stat.isFile()) {
-      _hashField(hash, `file:${relativePath}`, _contentFingerprint(realPath, stat));
+      _hashField(hash, `file:${relativePath}`, contentFingerprint(realPath));
     } else if (stat.isDirectory()) {
       for (const item of fs.readdirSync(realPath).sort()) {
         _processFileOrDirectory(path.join(symbolicPath, item), false, path.join(realPath, item));
@@ -71,20 +75,54 @@ export function fingerprint(fileOrDirectory: string, options: FingerprintOptions
   }
 }
 
-function _contentFingerprint(file: string, stat: fs.Stats): string {
+export function contentFingerprint(file: string): string {
   const hash = crypto.createHash('sha256');
   const buffer = Buffer.alloc(BUFFER_SIZE);
   // eslint-disable-next-line no-bitwise
   const fd = fs.openSync(file, fs.constants.O_DSYNC | fs.constants.O_RDONLY | fs.constants.O_SYNC);
+  let size = 0;
+  let isBinary = false;
+  let lastStr = '';
+  let read = 0;
   try {
-    let read = 0;
     while ((read = fs.readSync(fd, buffer, 0, BUFFER_SIZE, null)) !== 0) {
-      hash.update(buffer.slice(0, read));
+      const slicedBuffer = buffer.slice(0, read);
+
+      // Detect if file is binary by checking the first 8k bytes for the
+      // null character (git like implementation)
+      if (size === 0) {
+        isBinary = slicedBuffer.indexOf(0) !== -1;
+      }
+
+      let dataBuffer = slicedBuffer;
+      if (!isBinary) { // Line endings normalization (CRLF -> LF)
+        const str = buffer.slice(0, read).toString();
+
+        // We are going to normalize line endings to LF. So if the current
+        // buffer ends with CR, it could be that the next one starts with
+        // LF so we need to save it for later use.
+        if (new RegExp(`${CR}$`).test(str)) {
+          lastStr += str;
+          continue;
+        }
+
+        const data = lastStr + str;
+        const normalizedData = data.replace(new RegExp(CRLF, 'g'), LF);
+        dataBuffer = Buffer.from(normalizedData);
+        lastStr = '';
+      }
+
+      size += dataBuffer.length;
+      hash.update(dataBuffer);
+    }
+
+    if (lastStr) {
+      hash.update(Buffer.from(lastStr));
     }
   } finally {
     fs.closeSync(fd);
   }
-  return `${stat.size}:${hash.digest('hex')}`;
+  return `${size}:${hash.digest('hex')}`;
 }
 
 function _hashField(hash: crypto.Hash, header: string, value: string | Buffer | DataView) {
diff --git a/packages/@aws-cdk/core/test/fs/eol/lf.txt b/packages/@aws-cdk/core/test/fs/eol/lf.txt
new file mode 100644
index 0000000000000..f41bc690ba927
--- /dev/null
+++ b/packages/@aws-cdk/core/test/fs/eol/lf.txt
@@ -0,0 +1,2 @@
+hello word
+this a new line!
diff --git a/packages/@aws-cdk/core/test/fs/fs-fingerprint.test.ts b/packages/@aws-cdk/core/test/fs/fs-fingerprint.test.ts
index 6a589b3ba159e..be093c32cbffc 100644
--- a/packages/@aws-cdk/core/test/fs/fs-fingerprint.test.ts
+++ b/packages/@aws-cdk/core/test/fs/fs-fingerprint.test.ts
@@ -3,6 +3,7 @@ import * as os from 'os';
 import * as path from 'path';
 import { nodeunitShim, Test } from 'nodeunit-shim';
 import { FileSystem, SymlinkFollowMode } from '../../lib/fs';
+import { contentFingerprint } from '../../lib/fs/fingerprint';
 
 nodeunitShim({
   files: {
@@ -155,4 +156,27 @@ nodeunitShim({
       test.done();
     },
   },
+
+  eol: {
+    'normalizes line endings'(test: Test) {
+      // GIVEN
+      const lf = path.join(__dirname, 'eol', 'lf.txt');
+      const crlf = path.join(__dirname, 'eol', 'crlf.txt');
+      fs.writeFileSync(crlf, fs.readFileSync(lf, 'utf8').replace(/\n/g, '\r\n'));
+
+      const lfStat = fs.statSync(lf);
+      const crlfStat = fs.statSync(crlf);
+
+      // WHEN
+      const crlfHash = contentFingerprint(crlf);
+      const lfHash = contentFingerprint(lf);
+
+      // THEN
+      test.notEqual(crlfStat.size, lfStat.size); // Difference in size due to different line endings
+      test.deepEqual(crlfHash, lfHash); // Same hash
+
+      fs.unlinkSync(crlf);
+      test.done();
+    },
+  },
 });

From f6fbcb8a4de611d2a6e8968665e893d9b67d3874 Mon Sep 17 00:00:00 2001
From: Ben Chaimberg <chaimber@amazon.com>
Date: Mon, 30 Aug 2021 15:48:51 -0400
Subject: [PATCH 38/91] chore: upgrade jsii packages (#16184)

Ran npm-check-updates and yarn upgrade to keep the `yarn.lock` file up-to-date.


----

*By submitting this pull request, I confirm that my contribution is made under the terms of the Apache-2.0 license*
---
 package.json                               |   8 +-
 tools/cdk-integ-tools/lib/integ-helpers.ts |   2 +-
 yarn.lock                                  | 103 +++++++++++++++++++--
 3 files changed, 101 insertions(+), 12 deletions(-)

diff --git a/package.json b/package.json
index a18d46e63c20d..383ddf1c8e4c5 100644
--- a/package.json
+++ b/package.json
@@ -20,10 +20,10 @@
     "fs-extra": "^9.1.0",
     "graceful-fs": "^4.2.6",
     "jest-junit": "^12.2.0",
-    "jsii-diff": "^1.31.0",
-    "jsii-pacmak": "^1.31.0",
-    "jsii-reflect": "^1.31.0",
-    "jsii-rosetta": "^1.31.0",
+    "jsii-diff": "^1.34.0",
+    "jsii-pacmak": "^1.34.0",
+    "jsii-reflect": "^1.34.0",
+    "jsii-rosetta": "^1.34.0",
     "lerna": "^4.0.0",
     "patch-package": "^6.4.7",
     "standard-version": "^9.3.1",
diff --git a/tools/cdk-integ-tools/lib/integ-helpers.ts b/tools/cdk-integ-tools/lib/integ-helpers.ts
index bf52cbc4247cc..6b725d980a6f6 100644
--- a/tools/cdk-integ-tools/lib/integ-helpers.ts
+++ b/tools/cdk-integ-tools/lib/integ-helpers.ts
@@ -41,7 +41,7 @@ export class IntegrationTests {
   public async discover(): Promise<IntegrationTest[]> {
     const files = await this.readTree();
     const integs = files.filter(fileName => path.basename(fileName).startsWith('integ.') && path.basename(fileName).endsWith('.js'));
-    return await this.request(integs);
+    return this.request(integs);
   }
 
   public async request(files: string[]): Promise<IntegrationTest[]> {
diff --git a/yarn.lock b/yarn.lock
index dc35a18bf0134..ddf6785bfb202 100644
--- a/yarn.lock
+++ b/yarn.lock
@@ -565,6 +565,14 @@
     chalk "^4.1.2"
     semver "^7.3.5"
 
+"@jsii/check-node@1.34.0":
+  version "1.34.0"
+  resolved "https://registry.yarnpkg.com/@jsii/check-node/-/check-node-1.34.0.tgz#24da38da36e18639c84787dabd464b8474ddee22"
+  integrity sha512-Z+eGyIoV6B6RNFCR+Z/p0ANnZA++bmCXhoU1RIwGh9RG39PAT38KkZZNr9ZHNTTQbVoTJMSatoX/9WQ33pQxAw==
+  dependencies:
+    chalk "^4.1.2"
+    semver "^7.3.5"
+
 "@jsii/spec@^1.31.0":
   version "1.31.0"
   resolved "https://registry.yarnpkg.com/@jsii/spec/-/spec-1.31.0.tgz#9298dc163fdae0bab4006b817592235a29922871"
@@ -572,6 +580,13 @@
   dependencies:
     jsonschema "^1.4.0"
 
+"@jsii/spec@^1.34.0":
+  version "1.34.0"
+  resolved "https://registry.yarnpkg.com/@jsii/spec/-/spec-1.34.0.tgz#8b78adf07518f567d2c44bf6c98c426e5c18e0cf"
+  integrity sha512-yAK8FrTRrZ3lQ+DmdyAFZuHmsTJ1ej0719+sVgjr5ahE9i64huStaraX/jJM+PniuUQwE7N+B49ue6X9qj7vJA==
+  dependencies:
+    jsonschema "^1.4.0"
+
 "@lerna/add@4.0.0":
   version "4.0.0"
   resolved "https://registry.yarnpkg.com/@lerna/add/-/add-4.0.0.tgz#c36f57d132502a57b9e7058d1548b7a565ef183f"
@@ -1886,6 +1901,11 @@
     "@typescript-eslint/types" "4.28.4"
     eslint-visitor-keys "^2.0.0"
 
+"@xmldom/xmldom@^0.7.0":
+  version "0.7.3"
+  resolved "https://registry.yarnpkg.com/@xmldom/xmldom/-/xmldom-0.7.3.tgz#55de695f77afd3cc0e5bee0aa900040bc63c0f63"
+  integrity sha512-8XmJdPut2XGtfFcsNsqEsvMUmAwk7xLq7m+E/GcsU9b5qyFFIsiX4Fvnb5UoQ4wo12Wlm07YFJERoyWUYdbIpw==
+
 "@yarnpkg/lockfile@^1.1.0":
   version "1.1.0"
   resolved "https://registry.yarnpkg.com/@yarnpkg/lockfile/-/lockfile-1.1.0.tgz#e77a97fbd345b76d83245edcd17d393b1b41fb31"
@@ -2843,6 +2863,15 @@ codemaker@^1.31.0:
     decamelize "^5.0.0"
     fs-extra "^9.1.0"
 
+codemaker@^1.34.0:
+  version "1.34.0"
+  resolved "https://registry.yarnpkg.com/codemaker/-/codemaker-1.34.0.tgz#dba5dbd9ca6d1d9d9af64d64f17bde45882b0aa0"
+  integrity sha512-NHwy6TxMh21ygch7+K/OwtdN3BjxhAMoP5QXqzkkR0TDP2kEdKCNc31EChz3Xcmxk1qkdJN5CpXMnLjo7f07sQ==
+  dependencies:
+    camelcase "^6.2.0"
+    decamelize "^5.0.0"
+    fs-extra "^9.1.0"
+
 collect-v8-coverage@^1.0.0:
   version "1.0.1"
   resolved "https://registry.yarnpkg.com/collect-v8-coverage/-/collect-v8-coverage-1.0.1.tgz#cc2c8e94fc18bbdffe64d6534570c8a673b27f59"
@@ -2930,6 +2959,16 @@ commonmark@^0.29.3:
     minimist ">=1.2.2"
     string.prototype.repeat "^0.2.0"
 
+commonmark@^0.30.0:
+  version "0.30.0"
+  resolved "https://registry.yarnpkg.com/commonmark/-/commonmark-0.30.0.tgz#38811dc7bbf0f59d277ae09054d4d73a332f2e45"
+  integrity sha512-j1yoUo4gxPND1JWV9xj5ELih0yMv1iCWDG6eEQIPLSWLxzCXiFoyS7kvB+WwU+tZMf4snwJMMtaubV0laFpiBA==
+  dependencies:
+    entities "~2.0"
+    mdurl "~1.0.1"
+    minimist ">=1.2.2"
+    string.prototype.repeat "^0.2.0"
+
 compare-func@^2.0.0:
   version "2.0.0"
   resolved "https://registry.yarnpkg.com/compare-func/-/compare-func-2.0.0.tgz#fb65e75edbddfd2e568554e8b5b05fff7a51fcb3"
@@ -6007,16 +6046,17 @@ jsesc@^2.5.1:
   resolved "https://registry.yarnpkg.com/jsesc/-/jsesc-2.5.2.tgz#80564d2e483dacf6e8ef209650a67df3f0c283a4"
   integrity sha512-OYu7XEzjkCQ3C5Ps3QIZsQfNpqoJyZZA99wd9aWd05NCtC5pWOkShK2mkL6HXQR6/Cy2lbNdPlZBpuQHXE63gA==
 
-jsii-diff@^1.31.0:
-  version "1.31.0"
-  resolved "https://registry.yarnpkg.com/jsii-diff/-/jsii-diff-1.31.0.tgz#7f32b340cf340cc1929f4d534bdfa6495fc09bed"
-  integrity sha512-eEKFfZXGXxlWFg7E0F4h2UGOnpVCzHclM586SE4KnMwHzSlpRrdYrXa2KhFQSLs/gpZofDV4rPLZ9UDLvNu75Q==
+jsii-diff@^1.34.0:
+  version "1.34.0"
+  resolved "https://registry.yarnpkg.com/jsii-diff/-/jsii-diff-1.34.0.tgz#86742f21f5ab809df2ce8b6902f390c6379a9a39"
+  integrity sha512-fPVBoixNjo3kQs8WgjNeE7M5HxcK3jqfgM/IC6fpzrsGDjjqnH7emtVH3gvS18uQxUfYKKkXEKbkHsywQe6EkA==
   dependencies:
-    "@jsii/spec" "^1.31.0"
+    "@jsii/check-node" "1.34.0"
+    "@jsii/spec" "^1.34.0"
     fs-extra "^9.1.0"
-    jsii-reflect "^1.31.0"
+    jsii-reflect "^1.34.0"
     log4js "^6.3.0"
-    typescript "~3.9.9"
+    typescript "~3.9.10"
     yargs "^16.2.0"
 
 jsii-pacmak@^1.31.0:
@@ -6037,6 +6077,25 @@ jsii-pacmak@^1.31.0:
     xmlbuilder "^15.1.1"
     yargs "^16.2.0"
 
+jsii-pacmak@^1.34.0:
+  version "1.34.0"
+  resolved "https://registry.yarnpkg.com/jsii-pacmak/-/jsii-pacmak-1.34.0.tgz#7fc6a79fb72bd791a0cac5877339253fd26e14e3"
+  integrity sha512-OngbNHieb5g7B1VkRSZkZq1vgoflhjX4heTJnQJZYbG59j2qVgD7E/o/Dl2OTBLrGRms8e2oCsYc7XROt2htSA==
+  dependencies:
+    "@jsii/check-node" "1.34.0"
+    "@jsii/spec" "^1.34.0"
+    clone "^2.1.2"
+    codemaker "^1.34.0"
+    commonmark "^0.30.0"
+    escape-string-regexp "^4.0.0"
+    fs-extra "^9.1.0"
+    jsii-reflect "^1.34.0"
+    jsii-rosetta "^1.34.0"
+    semver "^7.3.5"
+    spdx-license-list "^6.4.0"
+    xmlbuilder "^15.1.1"
+    yargs "^16.2.0"
+
 jsii-reflect@^1.31.0:
   version "1.31.0"
   resolved "https://registry.yarnpkg.com/jsii-reflect/-/jsii-reflect-1.31.0.tgz#83acdae835071c734bb8847cf3cad7ccc4497540"
@@ -6048,6 +6107,18 @@ jsii-reflect@^1.31.0:
     oo-ascii-tree "^1.31.0"
     yargs "^16.2.0"
 
+jsii-reflect@^1.34.0:
+  version "1.34.0"
+  resolved "https://registry.yarnpkg.com/jsii-reflect/-/jsii-reflect-1.34.0.tgz#3d5c8f7c2e8310df2c8dea3aad5bef487fe1d0d9"
+  integrity sha512-IOEdwgeDCOq821PM3OfRro1Pgu0QzHFW7zQy3aN7/w5Fcb/tSYGxI9+Ykr6JCdg681LFzcMEgwJpCUHnfi/shw==
+  dependencies:
+    "@jsii/check-node" "1.34.0"
+    "@jsii/spec" "^1.34.0"
+    colors "^1.4.0"
+    fs-extra "^9.1.0"
+    oo-ascii-tree "^1.34.0"
+    yargs "^16.2.0"
+
 jsii-rosetta@^1.31.0:
   version "1.31.0"
   resolved "https://registry.yarnpkg.com/jsii-rosetta/-/jsii-rosetta-1.31.0.tgz#f5174b532b4c3a79eadd9ed059aa33bee21e3225"
@@ -6060,6 +6131,19 @@ jsii-rosetta@^1.31.0:
     xmldom "^0.6.0"
     yargs "^16.2.0"
 
+jsii-rosetta@^1.34.0:
+  version "1.34.0"
+  resolved "https://registry.yarnpkg.com/jsii-rosetta/-/jsii-rosetta-1.34.0.tgz#64b1233726a98a992be5cffd1d0f4b824346dbef"
+  integrity sha512-GOGAy5b+zCGeyYziBoNVXgamL2CEZKMj5moeemkyN4AUHUqugNk3fSul2Zdbxs2S13Suk0D9iYAgChDxew0bOw==
+  dependencies:
+    "@jsii/check-node" "1.34.0"
+    "@jsii/spec" "^1.34.0"
+    "@xmldom/xmldom" "^0.7.0"
+    commonmark "^0.30.0"
+    fs-extra "^9.1.0"
+    typescript "~3.9.10"
+    yargs "^16.2.0"
+
 jsii@^1.31.0:
   version "1.31.0"
   resolved "https://registry.yarnpkg.com/jsii/-/jsii-1.31.0.tgz#513ff04581eae233accef2e2ce06a19d9bd4d972"
@@ -7481,6 +7565,11 @@ oo-ascii-tree@^1.31.0:
   resolved "https://registry.yarnpkg.com/oo-ascii-tree/-/oo-ascii-tree-1.31.0.tgz#36e10dcad35ba767db41c2d2050ff2174f3d5e6f"
   integrity sha512-gNb2MyP1ZcF7cX0WgsAjYe4gZcx7BMLBWKE2TJZZbQ9/j4D8gbJh5Aq6RlXBgev74ODlgAVVcPr2wKU4Dufhqg==
 
+oo-ascii-tree@^1.34.0:
+  version "1.34.0"
+  resolved "https://registry.yarnpkg.com/oo-ascii-tree/-/oo-ascii-tree-1.34.0.tgz#5528a52d92ef18b3860d0e784383007e476c18b3"
+  integrity sha512-gAY+yfKCskAk7mkfI8nOhkP12iTGE7b8UxnQuscN80vghrozt/E/2rLeKKMJFagJlm/NnnUmBA0tBQZ3oPHEKg==
+
 open@^7.4.2:
   version "7.4.2"
   resolved "https://registry.yarnpkg.com/open/-/open-7.4.2.tgz#b8147e26dcf3e426316c730089fd71edd29c2321"

From ab44d42e85ab432e1f5ca426f2652e0e94768a9e Mon Sep 17 00:00:00 2001
From: Eli Polonsky <epolon@amazon.com>
Date: Mon, 30 Aug 2021 14:24:57 -0700
Subject: [PATCH 39/91] chore: upgrade jsii version (#16285)

Following https://github.com/aws/aws-cdk/pull/16184 - there are more places to upgrade jsii in.

This addresses https://github.com/aws/aws-cdk/security/dependabot/yarn.lock/xmldom/open

----

*By submitting this pull request, I confirm that my contribution is made under the terms of the Apache-2.0 license*
---
 tools/cdk-build-tools/package.json |  6 +--
 yarn.lock                          | 64 +++++++++---------------------
 2 files changed, 22 insertions(+), 48 deletions(-)

diff --git a/tools/cdk-build-tools/package.json b/tools/cdk-build-tools/package.json
index c4c3df70fc154..91fad0c39faf3 100644
--- a/tools/cdk-build-tools/package.json
+++ b/tools/cdk-build-tools/package.json
@@ -55,9 +55,9 @@
     "fs-extra": "^9.1.0",
     "jest": "^26.6.3",
     "jest-junit": "^11.1.0",
-    "jsii": "^1.31.0",
-    "jsii-pacmak": "^1.31.0",
-    "jsii-reflect": "^1.31.0",
+    "jsii": "^1.34.0",
+    "jsii-pacmak": "^1.34.0",
+    "jsii-reflect": "^1.34.0",
     "markdownlint-cli": "^0.27.1",
     "nodeunit": "^0.11.3",
     "nyc": "^15.1.0",
diff --git a/yarn.lock b/yarn.lock
index ddf6785bfb202..c553079426b7d 100644
--- a/yarn.lock
+++ b/yarn.lock
@@ -2949,16 +2949,6 @@ commondir@^1.0.1:
   resolved "https://registry.yarnpkg.com/commondir/-/commondir-1.0.1.tgz#ddd800da0c66127393cca5950ea968a3aaf1253b"
   integrity sha1-3dgA2gxmEnOTzKWVDqloo6rxJTs=
 
-commonmark@^0.29.3:
-  version "0.29.3"
-  resolved "https://registry.yarnpkg.com/commonmark/-/commonmark-0.29.3.tgz#bb1d5733bfe3ea213b412f33f16439cc12999c2c"
-  integrity sha512-fvt/NdOFKaL2gyhltSy6BC4LxbbxbnPxBMl923ittqO/JBM0wQHaoYZliE4tp26cRxX/ZZtRsJlZzQrVdUkXAA==
-  dependencies:
-    entities "~2.0"
-    mdurl "~1.0.1"
-    minimist ">=1.2.2"
-    string.prototype.repeat "^0.2.0"
-
 commonmark@^0.30.0:
   version "0.30.0"
   resolved "https://registry.yarnpkg.com/commonmark/-/commonmark-0.30.0.tgz#38811dc7bbf0f59d277ae09054d4d73a332f2e45"
@@ -6059,24 +6049,6 @@ jsii-diff@^1.34.0:
     typescript "~3.9.10"
     yargs "^16.2.0"
 
-jsii-pacmak@^1.31.0:
-  version "1.31.0"
-  resolved "https://registry.yarnpkg.com/jsii-pacmak/-/jsii-pacmak-1.31.0.tgz#7e4fa67f1de582be04263904aa45966d84210996"
-  integrity sha512-fGiAoooRPMadwTWU0vfHJdcNzeYdESnkU/8LmlI4k6yF1iIlFMIbWPulBxP6fV7SqV3CZQKGpUbcPD/Uzf1glg==
-  dependencies:
-    "@jsii/spec" "^1.31.0"
-    clone "^2.1.2"
-    codemaker "^1.31.0"
-    commonmark "^0.29.3"
-    escape-string-regexp "^4.0.0"
-    fs-extra "^9.1.0"
-    jsii-reflect "^1.31.0"
-    jsii-rosetta "^1.31.0"
-    semver "^7.3.5"
-    spdx-license-list "^6.4.0"
-    xmlbuilder "^15.1.1"
-    yargs "^16.2.0"
-
 jsii-pacmak@^1.34.0:
   version "1.34.0"
   resolved "https://registry.yarnpkg.com/jsii-pacmak/-/jsii-pacmak-1.34.0.tgz#7fc6a79fb72bd791a0cac5877339253fd26e14e3"
@@ -6119,18 +6091,6 @@ jsii-reflect@^1.34.0:
     oo-ascii-tree "^1.34.0"
     yargs "^16.2.0"
 
-jsii-rosetta@^1.31.0:
-  version "1.31.0"
-  resolved "https://registry.yarnpkg.com/jsii-rosetta/-/jsii-rosetta-1.31.0.tgz#f5174b532b4c3a79eadd9ed059aa33bee21e3225"
-  integrity sha512-Heu6D+yI5mmUklLQdX3PdDvHUQm14618Fj4PQM9seKa4cohxzJ7EHopfRObKYHMko9awopx4Qr7Gtu6u/QPqfw==
-  dependencies:
-    "@jsii/spec" "^1.31.0"
-    commonmark "^0.29.3"
-    fs-extra "^9.1.0"
-    typescript "~3.9.9"
-    xmldom "^0.6.0"
-    yargs "^16.2.0"
-
 jsii-rosetta@^1.34.0:
   version "1.34.0"
   resolved "https://registry.yarnpkg.com/jsii-rosetta/-/jsii-rosetta-1.34.0.tgz#64b1233726a98a992be5cffd1d0f4b824346dbef"
@@ -6162,6 +6122,25 @@ jsii@^1.31.0:
     typescript "~3.9.9"
     yargs "^16.2.0"
 
+jsii@^1.34.0:
+  version "1.34.0"
+  resolved "https://registry.yarnpkg.com/jsii/-/jsii-1.34.0.tgz#d009d7ae36f069819f97dcade4203722a5ec524f"
+  integrity sha512-z/p8cuWdRntQzdZ1Fq/hvXHPjq/HjZhQzTF/GmYrH3s7Wsb14LphHGAENTZwICBaSovoqSRIboOb2FbPLsCjoA==
+  dependencies:
+    "@jsii/check-node" "1.34.0"
+    "@jsii/spec" "^1.34.0"
+    case "^1.6.3"
+    colors "^1.4.0"
+    deep-equal "^2.0.5"
+    fs-extra "^9.1.0"
+    log4js "^6.3.0"
+    semver "^7.3.5"
+    semver-intersect "^1.4.0"
+    sort-json "^2.0.0"
+    spdx-license-list "^6.4.0"
+    typescript "~3.9.10"
+    yargs "^16.2.0"
+
 json-diff@^0.5.4:
   version "0.5.4"
   resolved "https://registry.yarnpkg.com/json-diff/-/json-diff-0.5.4.tgz#7bc8198c441756632aab66c7d9189d365a7a035a"
@@ -10209,11 +10188,6 @@ xmlchars@^2.2.0:
   resolved "https://registry.yarnpkg.com/xmlchars/-/xmlchars-2.2.0.tgz#060fe1bcb7f9c76fe2a17db86a9bc3ab894210cb"
   integrity sha512-JZnDKK8B0RCDw84FNdDAIpZK+JuJw+s7Lz8nksI7SIuU3UXJJslUthsi+uWBUYOwPFwW7W7PRLRfUKpxjtjFCw==
 
-xmldom@^0.6.0:
-  version "0.6.0"
-  resolved "https://registry.yarnpkg.com/xmldom/-/xmldom-0.6.0.tgz#43a96ecb8beece991cef382c08397d82d4d0c46f"
-  integrity sha512-iAcin401y58LckRZ0TkI4k0VSM1Qg0KGSc3i8rU+xrxe19A/BN1zHyVSJY7uoutVlaTSzYyk/v5AmkewAP7jtg==
-
 xregexp@2.0.0:
   version "2.0.0"
   resolved "https://registry.yarnpkg.com/xregexp/-/xregexp-2.0.0.tgz#52a63e56ca0b84a7f3a5f3d61872f126ad7a5943"

From d210bb8b657e1a611074c583946798a5085dcbe1 Mon Sep 17 00:00:00 2001
From: Adam Ruka <adamruka@amazon.com>
Date: Mon, 30 Aug 2021 15:54:57 -0700
Subject: [PATCH 40/91] chore: assign AppMesh issues to Seiya6329 (#16248)

---
 .github/workflows/issue-label-assign.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.github/workflows/issue-label-assign.yml b/.github/workflows/issue-label-assign.yml
index 64e3daf97887b..9451bd1b960ae 100644
--- a/.github/workflows/issue-label-assign.yml
+++ b/.github/workflows/issue-label-assign.yml
@@ -37,7 +37,7 @@ jobs:
            {"keywords":["(@aws-cdk/aws-appintegrations)","(aws-appintegrations)","(appintegrations)"],"labels":["@aws-cdk/aws-appintegrations"],"assignees":["skinny85"]},
            {"keywords":["(@aws-cdk/aws-applicationautoscaling)","(aws-applicationautoscaling)","(applicationautoscaling)","(application autoscaling)","(application-autoscaling)"],"labels":["@aws-cdk/aws-applicationautoscaling"],"assignees":["comcalvi"]},
            {"keywords":["(@aws-cdk/aws-applicationinsights)","(aws-applicationinsights)","(applicationinsights)","(application insights)","(application-insights)"],"labels":["@aws-cdk/aws-applicationinsights"],"assignees":["njlynch"]},
-           {"keywords":["(@aws-cdk/aws-appmesh)","(aws-appmesh)","(appmesh)","(app mesh)","(app-mesh)"],"labels":["@aws-cdk/aws-appmesh"],"assignees":["skinny85"]},
+           {"keywords":["(@aws-cdk/aws-appmesh)","(aws-appmesh)","(appmesh)","(app mesh)","(app-mesh)"],"labels":["@aws-cdk/aws-appmesh"],"assignees":["Seiya6329"]},
            {"keywords":["(@aws-cdk/aws-appstream)","(aws-appstream)","(appstream)","(app stream)","(app-stream)"],"labels":["@aws-cdk/aws-appstream"],"assignees":["madeline-k"]},
            {"keywords":["(@aws-cdk/aws-appsync)","(aws-appsync)","(appsync)","(app sync)","(app-sync)"],"labels":["@aws-cdk/aws-appsync"],"assignees":["otaviomacedo"]},
            {"keywords":["(@aws-cdk/aws-athena)","(aws-athena)","(athena)"],"labels":["@aws-cdk/aws-athena"],"assignees":["BenChaimberg"]},

From 41b831a6698ee6c7a3c8968bff8273a0c7f35448 Mon Sep 17 00:00:00 2001
From: Calvin Combs <66279577+comcalvi@users.noreply.github.com>
Date: Mon, 30 Aug 2021 17:47:29 -0700
Subject: [PATCH 41/91] fix(aws-rds): fromDatabaseInstanceAttributes
 incorrectly stringifies ports with tokens (#16286)

Closes #11813. Fixes `port` with tokens being incorrectly stringified in `fromDatabaseInstanceAttributes()`.

----


*By submitting this pull request, I confirm that my contribution is made under the terms of the Apache-2.0 license*
---
 packages/@aws-cdk/aws-rds/lib/instance.ts     |  4 +--
 .../@aws-cdk/aws-rds/test/instance.test.ts    | 29 +++++++++++++++++++
 2 files changed, 31 insertions(+), 2 deletions(-)

diff --git a/packages/@aws-cdk/aws-rds/lib/instance.ts b/packages/@aws-cdk/aws-rds/lib/instance.ts
index 20073ad021b40..6ea2418ee1a97 100644
--- a/packages/@aws-cdk/aws-rds/lib/instance.ts
+++ b/packages/@aws-cdk/aws-rds/lib/instance.ts
@@ -5,7 +5,7 @@ import * as kms from '@aws-cdk/aws-kms';
 import * as logs from '@aws-cdk/aws-logs';
 import * as s3 from '@aws-cdk/aws-s3';
 import * as secretsmanager from '@aws-cdk/aws-secretsmanager';
-import { ArnComponents, Duration, FeatureFlags, IResource, Lazy, RemovalPolicy, Resource, Stack, Token } from '@aws-cdk/core';
+import { ArnComponents, Duration, FeatureFlags, IResource, Lazy, RemovalPolicy, Resource, Stack, Token, Tokenization } from '@aws-cdk/core';
 import * as cxapi from '@aws-cdk/cx-api';
 import { Construct } from 'constructs';
 import { DatabaseSecret } from './database-secret';
@@ -124,7 +124,7 @@ export abstract class DatabaseInstanceBase extends Resource implements IDatabase
       });
       public readonly instanceIdentifier = attrs.instanceIdentifier;
       public readonly dbInstanceEndpointAddress = attrs.instanceEndpointAddress;
-      public readonly dbInstanceEndpointPort = attrs.port.toString();
+      public readonly dbInstanceEndpointPort = Tokenization.stringifyNumber(attrs.port);
       public readonly instanceEndpoint = new Endpoint(attrs.instanceEndpointAddress, attrs.port);
       public readonly engine = attrs.engine;
       protected enableIamAuthentication = true;
diff --git a/packages/@aws-cdk/aws-rds/test/instance.test.ts b/packages/@aws-cdk/aws-rds/test/instance.test.ts
index 4621a5bf6512d..f0591eb2469d1 100644
--- a/packages/@aws-cdk/aws-rds/test/instance.test.ts
+++ b/packages/@aws-cdk/aws-rds/test/instance.test.ts
@@ -401,6 +401,35 @@ describe('instance', () => {
 
 
     });
+
+    test('can create a new database instance with fromDatabaseInstanceAttributes using a token for the port', () => {
+      // GIVEN
+      const databasePort = new cdk.CfnParameter(stack, 'DatabasePort', {
+        type: 'Number',
+        default: 5432,
+      }).valueAsNumber;
+
+      // WHEN
+      const instance = rds.DatabaseInstance.fromDatabaseInstanceAttributes(stack, 'DatabaseInstance', {
+        instanceIdentifier: '',
+        securityGroups: [],
+        instanceEndpointAddress: '',
+        port: databasePort,
+      });
+
+      new cdk.CfnOutput(stack, 'portOutput', {
+        exportName: 'databaseUrl',
+        value: `${instance.dbInstanceEndpointPort}`,
+      });
+
+      // THEN
+      expect(stack).toHaveOutput({
+        exportName: 'databaseUrl',
+        outputValue: {
+          Ref: 'DatabasePort',
+        },
+      });
+    });
   });
 
   test('create a read replica in the same region - with the subnet group name', () => {

From ffdcd94405c160763e396a191d5af793ac8db998 Mon Sep 17 00:00:00 2001
From: Jonathan Goldwasser <jogold@users.noreply.github.com>
Date: Tue, 31 Aug 2021 12:02:29 +0200
Subject: [PATCH 42/91] feat(route53resolver): DNS Firewall (#15031)

Add L2s for `FirewallDomainList`, `FirewallRuleGroup` and
`FirewallRuleGroupAssociation`.


----

*By submitting this pull request, I confirm that my contribution is made under the terms of the Apache-2.0 license*
---
 .../@aws-cdk/aws-route53resolver/README.md    |  93 ++++-
 .../lib/firewall-domain-list.ts               | 234 +++++++++++++
 .../lib/firewall-rule-group-association.ts    | 129 +++++++
 .../lib/firewall-rule-group.ts                | 277 +++++++++++++++
 .../@aws-cdk/aws-route53resolver/lib/index.ts |   4 +
 .../@aws-cdk/aws-route53resolver/package.json |  16 +-
 .../aws-route53resolver/test/domains.txt      |   4 +
 .../test/firewall-domain-list.test.ts         | 123 +++++++
 .../test/firewall-rule-group.test.ts          | 137 ++++++++
 .../test/integ.firewall.expected.json         | 321 ++++++++++++++++++
 .../test/integ.firewall.ts                    |  46 +++
 .../test/route53resolver.test.ts              |   6 -
 12 files changed, 1382 insertions(+), 8 deletions(-)
 create mode 100644 packages/@aws-cdk/aws-route53resolver/lib/firewall-domain-list.ts
 create mode 100644 packages/@aws-cdk/aws-route53resolver/lib/firewall-rule-group-association.ts
 create mode 100644 packages/@aws-cdk/aws-route53resolver/lib/firewall-rule-group.ts
 create mode 100644 packages/@aws-cdk/aws-route53resolver/test/domains.txt
 create mode 100644 packages/@aws-cdk/aws-route53resolver/test/firewall-domain-list.test.ts
 create mode 100644 packages/@aws-cdk/aws-route53resolver/test/firewall-rule-group.test.ts
 create mode 100644 packages/@aws-cdk/aws-route53resolver/test/integ.firewall.expected.json
 create mode 100644 packages/@aws-cdk/aws-route53resolver/test/integ.firewall.ts
 delete mode 100644 packages/@aws-cdk/aws-route53resolver/test/route53resolver.test.ts

diff --git a/packages/@aws-cdk/aws-route53resolver/README.md b/packages/@aws-cdk/aws-route53resolver/README.md
index 9cf4ab7748b3d..a3bf5946ead7d 100644
--- a/packages/@aws-cdk/aws-route53resolver/README.md
+++ b/packages/@aws-cdk/aws-route53resolver/README.md
@@ -9,10 +9,101 @@
 >
 > [CFN Resources]: https://docs.aws.amazon.com/cdk/latest/guide/constructs.html#constructs_lib
 
+![cdk-constructs: Experimental](https://img.shields.io/badge/cdk--constructs-experimental-important.svg?style=for-the-badge)
+
+> The APIs of higher level constructs in this module are experimental and under active development.
+> They are subject to non-backward compatible changes or removal in any future version. These are
+> not subject to the [Semantic Versioning](https://semver.org/) model and breaking changes will be
+> announced in the release notes. This means that while you may use them, you may need to update
+> your source code when upgrading to a newer version of this package.
+
 ---
 
 <!--END STABILITY BANNER-->
 
+## DNS Firewall
+
+With Route 53 Resolver DNS Firewall, you can filter and regulate outbound DNS traffic for your
+virtual private connections (VPCs). To do this, you create reusable collections of filtering rules
+in DNS Firewall rule groups and associate the rule groups to your VPC.
+
+DNS Firewall provides protection for outbound DNS requests from your VPCs. These requests route
+through Resolver for domain name resolution. A primary use of DNS Firewall protections is to help
+prevent DNS exfiltration of your data. DNS exfiltration can happen when a bad actor compromises
+an application instance in your VPC and then uses DNS lookup to send data out of the VPC to a domain
+that they control. With DNS Firewall, you can monitor and control the domains that your applications
+can query. You can deny access to the domains that you know to be bad and allow all other queries
+to pass through. Alternately, you can deny access to all domains except for the ones that you
+explicitly trust.
+
+### Domain lists
+
+Domain lists can be created using a list of strings, a text file stored in Amazon S3 or a local
+text file:
+
+```ts
+const blockList = new route53resolver.FirewallDomainList(this, 'BlockList', {
+  domains: route53resolver.FirewallDomains.fromList(['bad-domain.com', 'bot-domain.net']),
+});
+
+const s3List = new route53resolver.FirewallDomainList(this, 'S3List', {
+  domains: route53resolver.FirewallDomains.fromS3Url('s3://bucket/prefix/object'),
+});
+
+const assetList = new route53resolver.FirewallDomainList(this, 'AssetList', {
+  domains: route53resolver.FirewallDomains.fromAsset('/path/to/domains.txt'),
+});
+```
+
+The file must be a text file and must contain a single domain per line.
+
+Use `FirewallDomainList.fromFirewallDomainListId()` to import an existing or [AWS managed domain list](https://docs.aws.amazon.com/Route53/latest/DeveloperGuide/resolver-dns-firewall-managed-domain-lists.html):
+
+```ts
+// AWSManagedDomainsMalwareDomainList in us-east-1
+const malwareList = route53resolver.FirewallDomainList.fromFirewallDomainListId(this, 'Malware', 'rslvr-fdl-2c46f2ecbfec4dcc');
+```
+
+### Rule group
+
+Create a rule group:
+
+```ts
+new route53resolver.FirewallRuleGroup(this, 'RuleGroup', {
+  rules: [
+    {
+      priority: 10,
+      firewallDomainList: myBlockList,
+      // block and reply with NODATA
+      action: route53resolver.FirewallRuleAction.block(),
+    },
+  ],
+});
+```
+
+Rules can be added at construction time or using `addRule()`:
+
+```ts
+ruleGroup.addRule({
+  priority: 10,
+  firewallDomainList: blockList,
+  // block and reply with NXDOMAIN
+  action: route53resolver.FirewallRuleAction.block(route53resolver.DnsBlockResponse.nxDomain()),
+});
+
+ruleGroup.addRule({
+  priority: 20,
+  firewallDomainList: blockList,
+  // block and override DNS response with a custom domain
+  action: route53resolver.FirewallRuleAction.block(route53resolver.DnsBlockResponse.override('amazon.com')),
+});
+```
+
+Use `associate()` to associate a rule group with a VPC:
+
 ```ts
-import * as route53resolver from '@aws-cdk/aws-route53resolver';
+ruleGroup.associate({
+  priority: 101,
+  vpc: myVpc,
+})
 ```
diff --git a/packages/@aws-cdk/aws-route53resolver/lib/firewall-domain-list.ts b/packages/@aws-cdk/aws-route53resolver/lib/firewall-domain-list.ts
new file mode 100644
index 0000000000000..a6303b2c78114
--- /dev/null
+++ b/packages/@aws-cdk/aws-route53resolver/lib/firewall-domain-list.ts
@@ -0,0 +1,234 @@
+import * as path from 'path';
+import { IBucket } from '@aws-cdk/aws-s3';
+import { Asset } from '@aws-cdk/aws-s3-assets';
+import { IResource, Resource, Token } from '@aws-cdk/core';
+import { Construct } from 'constructs';
+import { CfnFirewallDomainList } from './route53resolver.generated';
+
+/**
+ * A Firewall Domain List
+ */
+export interface IFirewallDomainList extends IResource {
+  /**
+   * The ID of the domain list
+   *
+   * @attribute
+   */
+  readonly firewallDomainListId: string;
+}
+
+/**
+ * Properties for a Firewall Domain List
+ */
+export interface FirewallDomainListProps {
+  /**
+   * A name for the domain list
+   *
+   * @default - a CloudFormation generated name
+   */
+  readonly name?: string;
+
+  /**
+   * A list of domains
+   */
+  readonly domains: FirewallDomains;
+}
+
+/**
+ * A list of domains
+ */
+export abstract class FirewallDomains {
+  /**
+   * Firewall domains created from a list of domains
+   *
+   * @param list the list of domains
+   */
+  public static fromList(list: string[]): FirewallDomains {
+    for (const domain of list) {
+      if (!/^[\w-.]+$/.test(domain)) {
+        throw new Error(`Invalid domain: ${domain}. Valid characters: A-Z, a-z, 0-9, _, -, .`);
+      }
+    }
+
+    return {
+      bind(_scope: Construct): DomainsConfig {
+        return { domains: list };
+      },
+    };
+  }
+
+  /**
+   * Firewall domains created from the URL of a file stored in Amazon S3.
+   * The file must be a text file and must contain a single domain per line.
+   * The content type of the S3 object must be `plain/text`.
+   *
+   * @param url S3 bucket url (s3://bucket/prefix/objet).
+   */
+  public static fromS3Url(url: string): FirewallDomains {
+    if (!Token.isUnresolved(url) && !url.startsWith('s3://')) {
+      throw new Error(`The S3 URL must start with s3://, got ${url}`);
+    }
+
+    return {
+      bind(_scope: Construct): DomainsConfig {
+        return { domainFileUrl: url };
+      },
+    };
+  }
+
+  /**
+   * Firewall domains created from a file stored in Amazon S3.
+   * The file must be a text file and must contain a single domain per line.
+   * The content type of the S3 object must be `plain/text`.
+   *
+   * @param bucket S3 bucket
+   * @param key S3 key
+   */
+  public static fromS3(bucket: IBucket, key: string): FirewallDomains {
+    return this.fromS3Url(bucket.s3UrlForObject(key));
+  }
+
+  /**
+   * Firewall domains created from a local disk path to a text file.
+   * The file must be a text file (`.txt` extension) and must contain a single
+   * domain per line. It will be uploaded to S3.
+   *
+   * @param assetPath path to the text file
+   */
+  public static fromAsset(assetPath: string): FirewallDomains {
+    // cdk-assets will correctly set the content type for the S3 object
+    // if the file has the correct extension
+    if (path.extname(assetPath) !== '.txt') {
+      throw new Error(`FirewallDomains.fromAsset() expects a file with the .txt extension, got ${assetPath}`);
+    }
+
+    return {
+      bind(scope: Construct): DomainsConfig {
+        const asset = new Asset(scope, 'Domains', { path: assetPath });
+
+        if (!asset.isFile) {
+          throw new Error('FirewallDomains.fromAsset() expects a file');
+        }
+
+        return { domainFileUrl: asset.s3ObjectUrl };
+      },
+    };
+
+  }
+
+  /** Binds the domains to a domain list */
+  public abstract bind(scope: Construct): DomainsConfig;
+}
+
+/**
+ * Domains configuration
+ */
+export interface DomainsConfig {
+  /**
+   * The fully qualified URL or URI of the file stored in Amazon S3 that contains
+   * the list of domains to import. The file must be a text file and must contain
+   * a single domain per line. The content type of the S3 object must be `plain/text`.
+   *
+   * @default - use `domains`
+   */
+  readonly domainFileUrl?: string;
+
+  /**
+   * A list of domains
+   *
+   * @default - use `domainFileUrl`
+   */
+  readonly domains?: string[];
+}
+
+/**
+ * A Firewall Domain List
+ */
+export class FirewallDomainList extends Resource implements IFirewallDomainList {
+  /**
+   * Import an existing Firewall Rule Group
+   */
+  public static fromFirewallDomainListId(scope: Construct, id: string, firewallDomainListId: string): IFirewallDomainList {
+    class Import extends Resource implements IFirewallDomainList {
+      public readonly firewallDomainListId = firewallDomainListId;
+    }
+    return new Import(scope, id);
+  }
+
+  public readonly firewallDomainListId: string;
+
+  /**
+   * The ARN (Amazon Resource Name) of the domain list
+   * @attribute
+   */
+  public readonly firewallDomainListArn: string;
+
+  /**
+    * The date and time that the domain list was created
+    * @attribute
+    */
+  public readonly firewallDomainListCreationTime: string;
+
+  /**
+    * The creator request ID
+    * @attribute
+    */
+  public readonly firewallDomainListCreatorRequestId: string;
+
+  /**
+    * The number of domains in the list
+    * @attribute
+    */
+  public readonly firewallDomainListDomainCount: number;
+
+  /**
+    * The owner of the list, used only for lists that are not managed by you.
+    * For example, the managed domain list `AWSManagedDomainsMalwareDomainList`
+    * has the managed owner name `Route 53 Resolver DNS Firewall`.
+    * @attribute
+    */
+  public readonly firewallDomainListManagedOwnerName: string;
+
+  /**
+    * The date and time that the domain list was last modified
+    * @attribute
+    */
+  public readonly firewallDomainListModificationTime: string;
+
+  /**
+    * The status of the domain list
+    * @attribute
+    */
+  public readonly firewallDomainListStatus: string;
+
+  /**
+    * Additional information about the status of the rule group
+    * @attribute
+    */
+  public readonly firewallDomainListStatusMessage: string;
+
+  constructor(scope: Construct, id: string, props: FirewallDomainListProps) {
+    super(scope, id);
+
+    if (props.name && !Token.isUnresolved(props.name) && !/^[\w-.]{1,128}$/.test(props.name)) {
+      throw new Error(`Invalid domain list name: ${props.name}. The name must have 1-128 characters. Valid characters: A-Z, a-z, 0-9, _, -, .`);
+    }
+
+    const domainsConfig = props.domains.bind(this);
+    const domainList = new CfnFirewallDomainList(this, 'Resource', {
+      name: props.name,
+      domainFileUrl: domainsConfig.domainFileUrl,
+      domains: domainsConfig.domains,
+    });
+
+    this.firewallDomainListId = domainList.attrId;
+    this.firewallDomainListArn = domainList.attrArn;
+    this.firewallDomainListCreationTime = domainList.attrCreationTime;
+    this.firewallDomainListCreatorRequestId = domainList.attrCreatorRequestId;
+    this.firewallDomainListDomainCount = domainList.attrDomainCount;
+    this.firewallDomainListManagedOwnerName = domainList.attrManagedOwnerName;
+    this.firewallDomainListModificationTime = domainList.attrModificationTime;
+    this.firewallDomainListStatus = domainList.attrStatus;
+    this.firewallDomainListStatusMessage = domainList.attrStatusMessage;
+  }
+}
diff --git a/packages/@aws-cdk/aws-route53resolver/lib/firewall-rule-group-association.ts b/packages/@aws-cdk/aws-route53resolver/lib/firewall-rule-group-association.ts
new file mode 100644
index 0000000000000..10281eba1dda1
--- /dev/null
+++ b/packages/@aws-cdk/aws-route53resolver/lib/firewall-rule-group-association.ts
@@ -0,0 +1,129 @@
+import { IVpc } from '@aws-cdk/aws-ec2';
+import { Resource, Token } from '@aws-cdk/core';
+import { Construct } from 'constructs';
+import { IFirewallRuleGroup } from './firewall-rule-group';
+import { CfnFirewallRuleGroupAssociation } from './route53resolver.generated';
+
+/**
+ * Options for a Firewall Rule Group Association
+ */
+export interface FirewallRuleGroupAssociationOptions {
+  /**
+   * If enabled, this setting disallows modification or removal of the
+   * association, to help prevent against accidentally altering DNS firewall
+   * protections.
+   *
+   * @default true
+   */
+  readonly mutationProtection?: boolean;
+
+  /**
+   * The name of the association
+   *
+   * @default - a CloudFormation generated name
+   */
+  readonly name?: string;
+
+  /**
+   * The setting that determines the processing order of the rule group among
+   * the rule groups that are associated with a single VPC. DNS Firewall filters VPC
+   * traffic starting from rule group with the lowest numeric priority setting.
+   *
+   * This value must be greater than 100 and less than 9,000
+   */
+  readonly priority: number;
+
+  /**
+   * The VPC that to associate with the rule group.
+   */
+  readonly vpc: IVpc;
+}
+
+/**
+ * Properties for a Firewall Rule Group Association
+ */
+export interface FirewallRuleGroupAssociationProps extends FirewallRuleGroupAssociationOptions {
+  /**
+   * The firewall rule group which must be associated
+   */
+  readonly firewallRuleGroup: IFirewallRuleGroup;
+}
+
+/**
+ * A Firewall Rule Group Association
+ */
+export class FirewallRuleGroupAssociation extends Resource {
+  /**
+   * The ARN (Amazon Resource Name) of the association
+   * @attribute
+   */
+  public readonly firewallRuleGroupAssociationArn: string;
+
+  /**
+    * The date and time that the association was created
+    * @attribute
+    */
+  public readonly firewallRuleGroupAssociationCreationTime: string;
+
+  /**
+    * The creator request ID
+    * @attribute
+    */
+  public readonly firewallRuleGroupAssociationCreatorRequestId: string;
+
+  /**
+   * The ID of the association
+   *
+   * @attribute
+   */
+  public readonly firewallRuleGroupAssociationId: string;
+
+  /**
+    * The owner of the association, used only for lists that are not managed by you.
+    * If you use AWS Firewall Manager to manage your firewallls from DNS Firewall,
+    * then this reports Firewall Manager as the managed owner.
+    * @attribute
+    */
+  public readonly firewallRuleGroupAssociationManagedOwnerName: string;
+
+  /**
+    * The date and time that the association was last modified
+    * @attribute
+    */
+  public readonly firewallRuleGroupAssociationModificationTime: string;
+
+  /**
+    * The status of the association
+    * @attribute
+    */
+  public readonly firewallRuleGroupAssociationStatus: string;
+
+  /**
+    * Additional information about the status of the association
+    * @attribute
+    */
+  public readonly firewallRuleGroupAssociationStatusMessage: string;
+
+  constructor(scope: Construct, id: string, props: FirewallRuleGroupAssociationProps) {
+    super(scope, id);
+
+    if (!Token.isUnresolved(props.priority) && (props.priority <= 100 || props.priority >= 9000)) {
+      throw new Error(`Priority must be greater than 100 and less than 9000, got ${props.priority}`);
+    }
+
+    const association = new CfnFirewallRuleGroupAssociation(this, 'Resource', {
+      firewallRuleGroupId: props.firewallRuleGroup.firewallRuleGroupId,
+      priority: props.priority,
+      vpcId: props.vpc.vpcId,
+    });
+
+    this.firewallRuleGroupAssociationArn = association.attrArn;
+    this.firewallRuleGroupAssociationCreationTime = association.attrCreationTime;
+    this.firewallRuleGroupAssociationCreatorRequestId = association.attrCreatorRequestId;
+    this.firewallRuleGroupAssociationId = association.attrId;
+    this.firewallRuleGroupAssociationManagedOwnerName = association.attrManagedOwnerName;
+    this.firewallRuleGroupAssociationModificationTime = association.attrModificationTime;
+    this.firewallRuleGroupAssociationStatus = association.attrStatus;
+    this.firewallRuleGroupAssociationStatusMessage = association.attrStatusMessage;
+  }
+}
diff --git a/packages/@aws-cdk/aws-route53resolver/lib/firewall-rule-group.ts b/packages/@aws-cdk/aws-route53resolver/lib/firewall-rule-group.ts
new file mode 100644
index 0000000000000..4346e23e46435
--- /dev/null
+++ b/packages/@aws-cdk/aws-route53resolver/lib/firewall-rule-group.ts
@@ -0,0 +1,277 @@
+import { Duration, IResource, Lazy, Resource } from '@aws-cdk/core';
+import { Construct } from 'constructs';
+import { IFirewallDomainList } from './firewall-domain-list';
+import { FirewallRuleGroupAssociation, FirewallRuleGroupAssociationOptions } from './firewall-rule-group-association';
+import { CfnFirewallRuleGroup } from './route53resolver.generated';
+
+/**
+ * A Firewall Rule Group
+ */
+export interface IFirewallRuleGroup extends IResource {
+  /**
+   * The ID of the rule group
+   *
+   * @attribute
+   */
+  readonly firewallRuleGroupId: string;
+}
+
+/**
+ * Properties for a Firewall Rule Group
+ */
+export interface FirewallRuleGroupProps {
+  /**
+   * The name of the rule group.
+   *
+   * @default - a CloudFormation generated name
+   */
+  readonly name?: string;
+
+  /**
+   * A list of rules for this group
+   *
+   * @default - no rules
+   */
+  readonly rules?: FirewallRule[];
+}
+
+/**
+ * A Firewall Rule
+ */
+export interface FirewallRule {
+  /**
+   * The action for this rule
+   */
+  readonly action: FirewallRuleAction;
+
+  /**
+   * The domain list for this rule
+   */
+  readonly firewallDomainList: IFirewallDomainList;
+
+  /**
+   * The priority of the rule in the rule group. This value must be unique within
+   * the rule group.
+   */
+  readonly priority: number;
+}
+
+/**
+ * A Firewall Rule
+ */
+export abstract class FirewallRuleAction {
+  /**
+   * Permit the request to go through
+   */
+  public static allow(): FirewallRuleAction {
+    return { action: 'ALLOW' };
+  }
+
+  /**
+   * Permit the request to go through but send an alert to the logs
+   */
+  public static alert(): FirewallRuleAction {
+    return { action: 'ALERT' };
+  }
+
+  /**
+   * Disallow the request
+   *
+   * @param [response=DnsBlockResponse.noData()] The way that you want DNS Firewall to block the request
+   */
+  public static block(response?: DnsBlockResponse): FirewallRuleAction {
+    return {
+      action: 'BLOCK',
+      blockResponse: response ?? DnsBlockResponse.noData(),
+    };
+  }
+
+  /**
+   * The action that DNS Firewall should take on a DNS query when it matches
+   * one of the domains in the rule's domain list
+   */
+  public abstract readonly action: string;
+
+  /**
+   * The way that you want DNS Firewall to block the request
+   */
+  public abstract readonly blockResponse?: DnsBlockResponse;
+}
+
+/**
+ * The way that you want DNS Firewall to block the request
+ */
+export abstract class DnsBlockResponse {
+  /**
+   * Respond indicating that the query was successful, but no
+   * response is available for it.
+   */
+  public static noData(): DnsBlockResponse {
+    return { blockResponse: 'NODATA' };
+  }
+
+  /**
+   * Respond indicating that the domain name that's in the query
+   * doesn't exist.
+   */
+  public static nxDomain(): DnsBlockResponse {
+    return { blockResponse: 'NXDOMAIN' };
+  }
+
+  /**
+   * Provides a custom override response to the query
+   *
+   * @param domain The custom DNS record to send back in response to the query
+   * @param [ttl=0] The recommended amount of time for the DNS resolver or
+   *   web browser to cache the provided override record
+   */
+  public static override(domain: string, ttl?: Duration): DnsBlockResponse {
+    return {
+      blockResponse: 'OVERRIDE',
+      blockOverrideDnsType: 'CNAME',
+      blockOverrideDomain: domain,
+      blockOverrideTtl: ttl ?? Duration.seconds(0),
+    };
+  }
+
+  /** The DNS record's type */
+  public abstract readonly blockOverrideDnsType?: string;
+
+  /** The custom DNS record to send back in response to the query */
+  public abstract readonly blockOverrideDomain?: string;
+
+  /**
+   * The recommended amount of time for the DNS resolver or
+   * web browser to cache the provided override record
+   */
+  public abstract readonly blockOverrideTtl?: Duration;
+
+  /** The way that you want DNS Firewall to block the request */
+  public abstract readonly blockResponse?: string;
+}
+
+/**
+ * A Firewall Rule Group
+ */
+export class FirewallRuleGroup extends Resource implements IFirewallRuleGroup {
+  /**
+   * Import an existing Firewall Rule Group
+   */
+  public static fromFirewallRuleGroupId(scope: Construct, id: string, firewallRuleGroupId: string): IFirewallRuleGroup {
+    class Import extends Resource implements IFirewallRuleGroup {
+      public readonly firewallRuleGroupId = firewallRuleGroupId;
+    }
+    return new Import(scope, id);
+  }
+
+  public readonly firewallRuleGroupId: string;
+
+  /**
+   * The ARN (Amazon Resource Name) of the rule group
+   * @attribute
+   */
+  public readonly firewallRuleGroupArn: string;
+
+  /**
+   * The date and time that the rule group was created
+   * @attribute
+   */
+  public readonly firewallRuleGroupCreationTime: string;
+
+  /**
+   * The creator request ID
+   * @attribute
+   */
+  public readonly firewallRuleGroupCreatorRequestId: string;
+
+  /**
+   * The date and time that the rule group was last modified
+   * @attribute
+   */
+  public readonly firewallRuleGroupModificationTime: string;
+
+  /**
+   * The AWS account ID for the account that created the rule group
+   * @attribute
+   */
+  public readonly firewallRuleGroupOwnerId: string;
+
+  /**
+   * The number of rules in the rule group
+   * @attribute
+   */
+  public readonly firewallRuleGroupRuleCount: number;
+
+  /**
+   * Whether the rule group is shared with other AWS accounts,
+   * or was shared with the current account by another AWS account
+   * @attribute
+   */
+  public readonly firewallRuleGroupShareStatus: string;
+
+  /**
+   * The status of the rule group
+   * @attribute
+   */
+  public readonly firewallRuleGroupStatus: string;
+
+  /**
+   * Additional information about the status of the rule group
+   * @attribute
+   */
+  public readonly firewallRuleGroupStatusMessage: string;
+
+  private readonly rules: FirewallRule[];
+
+  constructor(scope: Construct, id: string, props: FirewallRuleGroupProps = {}) {
+    super(scope, id);
+
+    this.rules = props.rules ?? [];
+
+    const ruleGroup = new CfnFirewallRuleGroup(this, 'Resource', {
+      name: props.name,
+      firewallRules: Lazy.any({ produce: () => this.rules.map(renderRule) }),
+    });
+
+    this.firewallRuleGroupId = ruleGroup.attrId;
+    this.firewallRuleGroupArn = ruleGroup.attrArn;
+    this.firewallRuleGroupCreationTime = ruleGroup.attrCreationTime;
+    this.firewallRuleGroupCreatorRequestId = ruleGroup.attrCreatorRequestId;
+    this.firewallRuleGroupModificationTime = ruleGroup.attrModificationTime;
+    this.firewallRuleGroupOwnerId = ruleGroup.attrOwnerId;
+    this.firewallRuleGroupRuleCount = ruleGroup.attrRuleCount;
+    this.firewallRuleGroupShareStatus = ruleGroup.attrShareStatus;
+    this.firewallRuleGroupStatus = ruleGroup.attrStatus;
+    this.firewallRuleGroupStatusMessage = ruleGroup.attrStatusMessage;
+  }
+
+  /**
+   * Adds a rule to this group
+   */
+  public addRule(rule: FirewallRule): FirewallRuleGroup {
+    this.rules.push(rule);
+    return this;
+  }
+
+  /**
+   * Associates this Firewall Rule Group with a VPC
+   */
+  public associate(id: string, props: FirewallRuleGroupAssociationOptions): FirewallRuleGroupAssociation {
+    return new FirewallRuleGroupAssociation(this, id, {
+      ...props,
+      firewallRuleGroup: this,
+    });
+  }
+}
+
+function renderRule(rule: FirewallRule): CfnFirewallRuleGroup.FirewallRuleProperty {
+  return {
+    action: rule.action.action,
+    firewallDomainListId: rule.firewallDomainList.firewallDomainListId,
+    priority: rule.priority,
+    blockOverrideDnsType: rule.action.blockResponse?.blockOverrideDnsType,
+    blockOverrideDomain: rule.action.blockResponse?.blockOverrideDomain,
+    blockOverrideTtl: rule.action.blockResponse?.blockOverrideTtl?.toSeconds(),
+    blockResponse: rule.action.blockResponse?.blockResponse,
+  };
+}
diff --git a/packages/@aws-cdk/aws-route53resolver/lib/index.ts b/packages/@aws-cdk/aws-route53resolver/lib/index.ts
index 7a6d65433e61f..97baf0759d24a 100644
--- a/packages/@aws-cdk/aws-route53resolver/lib/index.ts
+++ b/packages/@aws-cdk/aws-route53resolver/lib/index.ts
@@ -1,2 +1,6 @@
+export * from './firewall-domain-list';
+export * from './firewall-rule-group';
+export * from './firewall-rule-group-association';
+
 // AWS::Route53Resolver CloudFormation Resources:
 export * from './route53resolver.generated';
diff --git a/packages/@aws-cdk/aws-route53resolver/package.json b/packages/@aws-cdk/aws-route53resolver/package.json
index a515fecb3c120..5e24de4caaffb 100644
--- a/packages/@aws-cdk/aws-route53resolver/package.json
+++ b/packages/@aws-cdk/aws-route53resolver/package.json
@@ -76,15 +76,22 @@
   "devDependencies": {
     "@types/jest": "^26.0.24",
     "cdk-build-tools": "0.0.0",
+    "cdk-integ-tools": "0.0.0",
     "cfn2ts": "0.0.0",
     "pkglint": "0.0.0",
     "@aws-cdk/assertions": "0.0.0"
   },
   "dependencies": {
+    "@aws-cdk/aws-ec2": "0.0.0",
+    "@aws-cdk/aws-s3": "0.0.0",
+    "@aws-cdk/aws-s3-assets": "0.0.0",
     "@aws-cdk/core": "0.0.0",
     "constructs": "^3.3.69"
   },
   "peerDependencies": {
+    "@aws-cdk/aws-ec2": "0.0.0",
+    "@aws-cdk/aws-s3": "0.0.0",
+    "@aws-cdk/aws-s3-assets": "0.0.0",
     "@aws-cdk/core": "0.0.0",
     "constructs": "^3.3.69"
   },
@@ -92,7 +99,14 @@
     "node": ">= 10.13.0 <13 || >=13.7.0"
   },
   "stability": "experimental",
-  "maturity": "cfn-only",
+  "maturity": "experimental",
+  "awslint": {
+    "exclude": [
+      "props-physical-name:@aws-cdk/aws-route53resolver.FirewallDomainListProps",
+      "props-physical-name:@aws-cdk/aws-route53resolver.FirewallRuleGroupProps",
+      "props-physical-name:@aws-cdk/aws-route53resolver.FirewallRuleGroupAssociationProps"
+    ]
+  },  
   "awscdkio": {
     "announce": false
   },
diff --git a/packages/@aws-cdk/aws-route53resolver/test/domains.txt b/packages/@aws-cdk/aws-route53resolver/test/domains.txt
new file mode 100644
index 0000000000000..872337c768ca7
--- /dev/null
+++ b/packages/@aws-cdk/aws-route53resolver/test/domains.txt
@@ -0,0 +1,4 @@
+amazon.com
+amazon.co.uk
+amazon.fr
+amazon.de
diff --git a/packages/@aws-cdk/aws-route53resolver/test/firewall-domain-list.test.ts b/packages/@aws-cdk/aws-route53resolver/test/firewall-domain-list.test.ts
new file mode 100644
index 0000000000000..3806a59c670ba
--- /dev/null
+++ b/packages/@aws-cdk/aws-route53resolver/test/firewall-domain-list.test.ts
@@ -0,0 +1,123 @@
+import * as path from 'path';
+import { Template } from '@aws-cdk/assertions';
+import { Bucket } from '@aws-cdk/aws-s3';
+import { Stack } from '@aws-cdk/core';
+import { FirewallDomainList, FirewallDomains } from '../lib';
+
+let stack: Stack;
+beforeEach(() => {
+  stack = new Stack();
+});
+
+test('domain list from strings', () => {
+  // WHEN
+  new FirewallDomainList(stack, 'List', {
+    domains: FirewallDomains.fromList(['first-domain.com', 'second-domain.net']),
+  });
+
+  // THEN
+  Template.fromStack(stack).hasResourceProperties('AWS::Route53Resolver::FirewallDomainList', {
+    Domains: [
+      'first-domain.com',
+      'second-domain.net',
+    ],
+  });
+});
+
+test('domain list from S3 URL', () => {
+  // WHEN
+  new FirewallDomainList(stack, 'List', {
+    domains: FirewallDomains.fromS3Url('s3://bucket/prefix/object'),
+  });
+
+  // THEN
+  Template.fromStack(stack).hasResourceProperties('AWS::Route53Resolver::FirewallDomainList', {
+    DomainFileUrl: 's3://bucket/prefix/object',
+  });
+});
+
+test('domain list from S3', () => {
+  // WHEN
+  new FirewallDomainList(stack, 'List', {
+    domains: FirewallDomains.fromS3(Bucket.fromBucketName(stack, 'Bucket', 'bucket'), 'prefix/object'),
+  });
+
+  // THEN
+  Template.fromStack(stack).hasResourceProperties('AWS::Route53Resolver::FirewallDomainList', {
+    DomainFileUrl: 's3://bucket/prefix/object',
+  });
+});
+
+test('domain list from asset', () => {
+  // WHEN
+  new FirewallDomainList(stack, 'List', {
+    domains: FirewallDomains.fromAsset(path.join(__dirname, 'domains.txt')),
+  });
+
+  // THEN
+  Template.fromStack(stack).hasResourceProperties('AWS::Route53Resolver::FirewallDomainList', {
+    DomainFileUrl: {
+      'Fn::Join': [
+        '',
+        [
+          's3://',
+          {
+            Ref: 'AssetParameterse820b3f07bf66854be0dfd6f3ec357a10d644f2011069e5ad07d42f4f89ed35aS3BucketD6778673',
+          },
+          '/',
+          {
+            'Fn::Select': [
+              0,
+              {
+                'Fn::Split': [
+                  '||',
+                  {
+                    Ref: 'AssetParameterse820b3f07bf66854be0dfd6f3ec357a10d644f2011069e5ad07d42f4f89ed35aS3VersionKey1A69D23D',
+                  },
+                ],
+              },
+            ],
+          },
+          {
+            'Fn::Select': [
+              1,
+              {
+                'Fn::Split': [
+                  '||',
+                  {
+                    Ref: 'AssetParameterse820b3f07bf66854be0dfd6f3ec357a10d644f2011069e5ad07d42f4f89ed35aS3VersionKey1A69D23D',
+                  },
+                ],
+              },
+            ],
+          },
+        ],
+      ],
+    },
+  });
+});
+
+test('throws with invalid name', () => {
+  expect(() => new FirewallDomainList(stack, 'List', {
+    name: 'Inv@lid',
+    domains: FirewallDomains.fromList(['domain.com']),
+  })).toThrow(/Invalid domain list name/);
+});
+
+test('throws with invalid domain', () => {
+  expect(() => new FirewallDomainList(stack, 'List', {
+    domains: FirewallDomains.fromList(['valid.fr', 'inv@lid.com']),
+  })).toThrow(/Invalid domain/);
+});
+
+test('throws with fromAsset and not .txt', () => {
+  expect(() => new FirewallDomainList(stack, 'List', {
+    domains: FirewallDomains.fromAsset('image.jpg'),
+  })).toThrow(/expects a file with the .txt extension/);
+});
+
+test('throws with invalid S3 URL', () => {
+  expect(() => new FirewallDomainList(stack, 'List', {
+    domains: FirewallDomains.fromS3Url('https://invalid/bucket/url'),
+  })).toThrow(/The S3 URL must start with s3:\/\//);
+});
diff --git a/packages/@aws-cdk/aws-route53resolver/test/firewall-rule-group.test.ts b/packages/@aws-cdk/aws-route53resolver/test/firewall-rule-group.test.ts
new file mode 100644
index 0000000000000..f8868d2bb31d9
--- /dev/null
+++ b/packages/@aws-cdk/aws-route53resolver/test/firewall-rule-group.test.ts
@@ -0,0 +1,137 @@
+import { Template } from '@aws-cdk/assertions';
+import { Vpc } from '@aws-cdk/aws-ec2';
+import { Duration, Stack } from '@aws-cdk/core';
+import { DnsBlockResponse, FirewallDomainList, FirewallRuleAction, FirewallRuleGroup, IFirewallDomainList } from '../lib';
+
+let stack: Stack;
+let firewallDomainList: IFirewallDomainList;
+beforeEach(() => {
+  stack = new Stack();
+  firewallDomainList = FirewallDomainList.fromFirewallDomainListId(stack, 'List', 'domain-list-id');
+});
+
+test('basic rule group', () => {
+  // WHEN
+  new FirewallRuleGroup(stack, 'RuleGroup', {
+    rules: [
+      {
+        priority: 10,
+        firewallDomainList,
+        action: FirewallRuleAction.block(),
+      },
+    ],
+  });
+
+  // THEN
+  Template.fromStack(stack).hasResourceProperties('AWS::Route53Resolver::FirewallRuleGroup', {
+    FirewallRules: [
+      {
+        Action: 'BLOCK',
+        BlockResponse: 'NODATA',
+        FirewallDomainListId: 'domain-list-id',
+        Priority: 10,
+      },
+    ],
+  });
+});
+
+test('use addRule to add rules', () => {
+  // GIVEN
+  const ruleGroup = new FirewallRuleGroup(stack, 'RuleGroup', {
+    rules: [
+      {
+        priority: 10,
+        firewallDomainList,
+        action: FirewallRuleAction.allow(),
+      },
+    ],
+  });
+
+  // WHEN
+  ruleGroup.addRule({
+    priority: 20,
+    firewallDomainList: FirewallDomainList.fromFirewallDomainListId(stack, 'OtherList', 'other-list-id'),
+    action: FirewallRuleAction.allow(),
+  });
+
+  // THEN
+  Template.fromStack(stack).hasResourceProperties('AWS::Route53Resolver::FirewallRuleGroup', {
+    FirewallRules: [
+      {
+        Action: 'ALLOW',
+        FirewallDomainListId: 'domain-list-id',
+        Priority: 10,
+      },
+      {
+        Action: 'ALLOW',
+        FirewallDomainListId: 'other-list-id',
+        Priority: 20,
+      },
+    ],
+  });
+});
+
+test('rule with response override', () => {
+  // GIVEN
+  const ruleGroup = new FirewallRuleGroup(stack, 'RuleGroup');
+
+  // WHEN
+  ruleGroup.addRule({
+    priority: 10,
+    firewallDomainList,
+    action: FirewallRuleAction.block(DnsBlockResponse.override('amazon.com', Duration.minutes(5))),
+  });
+
+  // THEN
+  Template.fromStack(stack).hasResourceProperties('AWS::Route53Resolver::FirewallRuleGroup', {
+    FirewallRules: [
+      {
+        Action: 'BLOCK',
+        BlockOverrideDnsType: 'CNAME',
+        BlockOverrideDomain: 'amazon.com',
+        BlockOverrideTtl: 300,
+        BlockResponse: 'OVERRIDE',
+        FirewallDomainListId: 'domain-list-id',
+        Priority: 10,
+      },
+    ],
+  });
+});
+
+test('associate rule group with a vpc', () => {
+  // GIVEN
+  const vpc = new Vpc(stack, 'Vpc');
+  const ruleGroup = new FirewallRuleGroup(stack, 'RuleGroup');
+
+  // WHEN
+  ruleGroup.associate('Association', {
+    priority: 101,
+    vpc,
+  });
+
+  // THEN
+  Template.fromStack(stack).hasResourceProperties('AWS::Route53Resolver::FirewallRuleGroupAssociation', {
+    FirewallRuleGroupId: {
+      'Fn::GetAtt': [
+        'RuleGroup06BA8844',
+        'Id',
+      ],
+    },
+    Priority: 101,
+    VpcId: {
+      Ref: 'Vpc8378EB38',
+    },
+  });
+});
+
+test('throws when associating with a priority not between 100-9,000', () => {
+  // GIVEN
+  const vpc = new Vpc(stack, 'Vpc');
+  const ruleGroup = new FirewallRuleGroup(stack, 'RuleGroup');
+
+  // THEN
+  expect(() => ruleGroup.associate('Association', {
+    priority: 100,
+    vpc,
+  })).toThrow(/Priority must be greater than 100 and less than 9000/);
+});
diff --git a/packages/@aws-cdk/aws-route53resolver/test/integ.firewall.expected.json b/packages/@aws-cdk/aws-route53resolver/test/integ.firewall.expected.json
new file mode 100644
index 0000000000000..c6b43a9c3ccfd
--- /dev/null
+++ b/packages/@aws-cdk/aws-route53resolver/test/integ.firewall.expected.json
@@ -0,0 +1,321 @@
+{
+  "Resources": {
+    "Vpc8378EB38": {
+      "Type": "AWS::EC2::VPC",
+      "Properties": {
+        "CidrBlock": "10.0.0.0/16",
+        "EnableDnsHostnames": true,
+        "EnableDnsSupport": true,
+        "InstanceTenancy": "default",
+        "Tags": [
+          {
+            "Key": "Name",
+            "Value": "cdk-route53-resolver-firewall/Vpc"
+          }
+        ]
+      }
+    },
+    "VpcPublicSubnet1Subnet5C2D37C4": {
+      "Type": "AWS::EC2::Subnet",
+      "Properties": {
+        "CidrBlock": "10.0.0.0/17",
+        "VpcId": {
+          "Ref": "Vpc8378EB38"
+        },
+        "AvailabilityZone": "test-region-1a",
+        "MapPublicIpOnLaunch": true,
+        "Tags": [
+          {
+            "Key": "aws-cdk:subnet-name",
+            "Value": "Public"
+          },
+          {
+            "Key": "aws-cdk:subnet-type",
+            "Value": "Public"
+          },
+          {
+            "Key": "Name",
+            "Value": "cdk-route53-resolver-firewall/Vpc/PublicSubnet1"
+          }
+        ]
+      }
+    },
+    "VpcPublicSubnet1RouteTable6C95E38E": {
+      "Type": "AWS::EC2::RouteTable",
+      "Properties": {
+        "VpcId": {
+          "Ref": "Vpc8378EB38"
+        },
+        "Tags": [
+          {
+            "Key": "Name",
+            "Value": "cdk-route53-resolver-firewall/Vpc/PublicSubnet1"
+          }
+        ]
+      }
+    },
+    "VpcPublicSubnet1RouteTableAssociation97140677": {
+      "Type": "AWS::EC2::SubnetRouteTableAssociation",
+      "Properties": {
+        "RouteTableId": {
+          "Ref": "VpcPublicSubnet1RouteTable6C95E38E"
+        },
+        "SubnetId": {
+          "Ref": "VpcPublicSubnet1Subnet5C2D37C4"
+        }
+      }
+    },
+    "VpcPublicSubnet1DefaultRoute3DA9E72A": {
+      "Type": "AWS::EC2::Route",
+      "Properties": {
+        "RouteTableId": {
+          "Ref": "VpcPublicSubnet1RouteTable6C95E38E"
+        },
+        "DestinationCidrBlock": "0.0.0.0/0",
+        "GatewayId": {
+          "Ref": "VpcIGWD7BA715C"
+        }
+      },
+      "DependsOn": [
+        "VpcVPCGWBF912B6E"
+      ]
+    },
+    "VpcPublicSubnet1EIPD7E02669": {
+      "Type": "AWS::EC2::EIP",
+      "Properties": {
+        "Domain": "vpc",
+        "Tags": [
+          {
+            "Key": "Name",
+            "Value": "cdk-route53-resolver-firewall/Vpc/PublicSubnet1"
+          }
+        ]
+      }
+    },
+    "VpcPublicSubnet1NATGateway4D7517AA": {
+      "Type": "AWS::EC2::NatGateway",
+      "Properties": {
+        "AllocationId": {
+          "Fn::GetAtt": [
+            "VpcPublicSubnet1EIPD7E02669",
+            "AllocationId"
+          ]
+        },
+        "SubnetId": {
+          "Ref": "VpcPublicSubnet1Subnet5C2D37C4"
+        },
+        "Tags": [
+          {
+            "Key": "Name",
+            "Value": "cdk-route53-resolver-firewall/Vpc/PublicSubnet1"
+          }
+        ]
+      }
+    },
+    "VpcPrivateSubnet1Subnet536B997A": {
+      "Type": "AWS::EC2::Subnet",
+      "Properties": {
+        "CidrBlock": "10.0.128.0/17",
+        "VpcId": {
+          "Ref": "Vpc8378EB38"
+        },
+        "AvailabilityZone": "test-region-1a",
+        "MapPublicIpOnLaunch": false,
+        "Tags": [
+          {
+            "Key": "aws-cdk:subnet-name",
+            "Value": "Private"
+          },
+          {
+            "Key": "aws-cdk:subnet-type",
+            "Value": "Private"
+          },
+          {
+            "Key": "Name",
+            "Value": "cdk-route53-resolver-firewall/Vpc/PrivateSubnet1"
+          }
+        ]
+      }
+    },
+    "VpcPrivateSubnet1RouteTableB2C5B500": {
+      "Type": "AWS::EC2::RouteTable",
+      "Properties": {
+        "VpcId": {
+          "Ref": "Vpc8378EB38"
+        },
+        "Tags": [
+          {
+            "Key": "Name",
+            "Value": "cdk-route53-resolver-firewall/Vpc/PrivateSubnet1"
+          }
+        ]
+      }
+    },
+    "VpcPrivateSubnet1RouteTableAssociation70C59FA6": {
+      "Type": "AWS::EC2::SubnetRouteTableAssociation",
+      "Properties": {
+        "RouteTableId": {
+          "Ref": "VpcPrivateSubnet1RouteTableB2C5B500"
+        },
+        "SubnetId": {
+          "Ref": "VpcPrivateSubnet1Subnet536B997A"
+        }
+      }
+    },
+    "VpcPrivateSubnet1DefaultRouteBE02A9ED": {
+      "Type": "AWS::EC2::Route",
+      "Properties": {
+        "RouteTableId": {
+          "Ref": "VpcPrivateSubnet1RouteTableB2C5B500"
+        },
+        "DestinationCidrBlock": "0.0.0.0/0",
+        "NatGatewayId": {
+          "Ref": "VpcPublicSubnet1NATGateway4D7517AA"
+        }
+      }
+    },
+    "VpcIGWD7BA715C": {
+      "Type": "AWS::EC2::InternetGateway",
+      "Properties": {
+        "Tags": [
+          {
+            "Key": "Name",
+            "Value": "cdk-route53-resolver-firewall/Vpc"
+          }
+        ]
+      }
+    },
+    "VpcVPCGWBF912B6E": {
+      "Type": "AWS::EC2::VPCGatewayAttachment",
+      "Properties": {
+        "VpcId": {
+          "Ref": "Vpc8378EB38"
+        },
+        "InternetGatewayId": {
+          "Ref": "VpcIGWD7BA715C"
+        }
+      }
+    },
+    "BlockListC03D0423": {
+      "Type": "AWS::Route53Resolver::FirewallDomainList",
+      "Properties": {
+        "Domains": [
+          "bad-domain.com",
+          "bot-domain.net"
+        ]
+      }
+    },
+    "OverrideListF573FB0F": {
+      "Type": "AWS::Route53Resolver::FirewallDomainList",
+      "Properties": {
+        "Domains": [
+          "override-domain.com"
+        ]
+      }
+    },
+    "OtherListBA4427B5": {
+      "Type": "AWS::Route53Resolver::FirewallDomainList",
+      "Properties": {
+        "DomainFileUrl": {
+          "Fn::Join": [
+            "",
+            [
+              "s3://",
+              {
+                "Ref": "AssetParameterse820b3f07bf66854be0dfd6f3ec357a10d644f2011069e5ad07d42f4f89ed35aS3BucketD6778673"
+              },
+              "/",
+              {
+                "Fn::Select": [
+                  0,
+                  {
+                    "Fn::Split": [
+                      "||",
+                      {
+                        "Ref": "AssetParameterse820b3f07bf66854be0dfd6f3ec357a10d644f2011069e5ad07d42f4f89ed35aS3VersionKey1A69D23D"
+                      }
+                    ]
+                  }
+                ]
+              },
+              {
+                "Fn::Select": [
+                  1,
+                  {
+                    "Fn::Split": [
+                      "||",
+                      {
+                        "Ref": "AssetParameterse820b3f07bf66854be0dfd6f3ec357a10d644f2011069e5ad07d42f4f89ed35aS3VersionKey1A69D23D"
+                      }
+                    ]
+                  }
+                ]
+              }
+            ]
+          ]
+        }
+      }
+    },
+    "RuleGroup06BA8844": {
+      "Type": "AWS::Route53Resolver::FirewallRuleGroup",
+      "Properties": {
+        "FirewallRules": [
+          {
+            "Action": "BLOCK",
+            "BlockResponse": "NODATA",
+            "FirewallDomainListId": {
+              "Fn::GetAtt": [
+                "BlockListC03D0423",
+                "Id"
+              ]
+            },
+            "Priority": 10
+          },
+          {
+            "Action": "BLOCK",
+            "BlockOverrideDnsType": "CNAME",
+            "BlockOverrideDomain": "amazon.com",
+            "BlockOverrideTtl": 0,
+            "BlockResponse": "OVERRIDE",
+            "FirewallDomainListId": {
+              "Fn::GetAtt": [
+                "OverrideListF573FB0F",
+                "Id"
+              ]
+            },
+            "Priority": 20
+          }
+        ]
+      }
+    },
+    "RuleGroupAssociation5494BFB1": {
+      "Type": "AWS::Route53Resolver::FirewallRuleGroupAssociation",
+      "Properties": {
+        "FirewallRuleGroupId": {
+          "Fn::GetAtt": [
+            "RuleGroup06BA8844",
+            "Id"
+          ]
+        },
+        "Priority": 101,
+        "VpcId": {
+          "Ref": "Vpc8378EB38"
+        }
+      }
+    }
+  },
+  "Parameters": {
+    "AssetParameterse820b3f07bf66854be0dfd6f3ec357a10d644f2011069e5ad07d42f4f89ed35aS3BucketD6778673": {
+      "Type": "String",
+      "Description": "S3 bucket for asset \"e820b3f07bf66854be0dfd6f3ec357a10d644f2011069e5ad07d42f4f89ed35a\""
+    },
+    "AssetParameterse820b3f07bf66854be0dfd6f3ec357a10d644f2011069e5ad07d42f4f89ed35aS3VersionKey1A69D23D": {
+      "Type": "String",
+      "Description": "S3 key for asset version \"e820b3f07bf66854be0dfd6f3ec357a10d644f2011069e5ad07d42f4f89ed35a\""
+    },
+    "AssetParameterse820b3f07bf66854be0dfd6f3ec357a10d644f2011069e5ad07d42f4f89ed35aArtifactHashFF61A347": {
+      "Type": "String",
+      "Description": "Artifact hash for asset \"e820b3f07bf66854be0dfd6f3ec357a10d644f2011069e5ad07d42f4f89ed35a\""
+    }
+  }
+}
\ No newline at end of file
diff --git a/packages/@aws-cdk/aws-route53resolver/test/integ.firewall.ts b/packages/@aws-cdk/aws-route53resolver/test/integ.firewall.ts
new file mode 100644
index 0000000000000..7c4b2498af6f5
--- /dev/null
+++ b/packages/@aws-cdk/aws-route53resolver/test/integ.firewall.ts
@@ -0,0 +1,46 @@
+import * as path from 'path';
+import { Vpc } from '@aws-cdk/aws-ec2';
+import { App, Stack, StackProps } from '@aws-cdk/core';
+import { Construct } from 'constructs';
+import * as route53resolver from '../lib';
+
+class TestStack extends Stack {
+  constructor(scope: Construct, id: string, props?: StackProps) {
+    super(scope, id, props);
+
+    const vpc = new Vpc(this, 'Vpc', { maxAzs: 1 });
+
+    const blockList = new route53resolver.FirewallDomainList(this, 'BlockList', {
+      domains: route53resolver.FirewallDomains.fromList(['bad-domain.com', 'bot-domain.net']),
+    });
+    const overrideList = new route53resolver.FirewallDomainList(this, 'OverrideList', {
+      domains: route53resolver.FirewallDomains.fromList(['override-domain.com']),
+    });
+
+    new route53resolver.FirewallDomainList(this, 'OtherList', {
+      domains: route53resolver.FirewallDomains.fromAsset(path.join(__dirname, 'domains.txt')),
+    });
+
+    const ruleGroup = new route53resolver.FirewallRuleGroup(this, 'RuleGroup');
+
+    ruleGroup.addRule({
+      priority: 10,
+      firewallDomainList: blockList,
+      action: route53resolver.FirewallRuleAction.block(),
+    });
+    ruleGroup.addRule({
+      priority: 20,
+      firewallDomainList: overrideList,
+      action: route53resolver.FirewallRuleAction.block(route53resolver.DnsBlockResponse.override('amazon.com')),
+    });
+
+    ruleGroup.associate('Association', {
+      priority: 101,
+      vpc,
+    });
+  }
+}
+
+const app = new App();
+new TestStack(app, 'cdk-route53-resolver-firewall');
+app.synth();
diff --git a/packages/@aws-cdk/aws-route53resolver/test/route53resolver.test.ts b/packages/@aws-cdk/aws-route53resolver/test/route53resolver.test.ts
deleted file mode 100644
index 465c7bdea0693..0000000000000
--- a/packages/@aws-cdk/aws-route53resolver/test/route53resolver.test.ts
+++ /dev/null
@@ -1,6 +0,0 @@
-import '@aws-cdk/assertions';
-import {} from '../lib';
-
-test('No tests are specified for this package', () => {
-  expect(true).toBe(true);
-});

From d763d9092289d0b28b2695b8474b44ed7d0bce54 Mon Sep 17 00:00:00 2001
From: Rico Huijbers <rix0rrr@gmail.com>
Date: Tue, 31 Aug 2021 13:35:15 +0200
Subject: [PATCH 43/91] feat(cli): support `--no-rollback` flag (#16293)

CloudFormation recently released a feature that makes it easier
to iterate quickly on development stacks, where the rollback step
of a deployment is skipped if a deployment fails.

https://aws.amazon.com/de/blogs/aws/new-for-aws-cloudformation-quickly-retry-stack-operations-from-the-point-of-failure/

This allows a developer to fix their code and retry quickly without
losing time waiting for rollbacks.

Fixes #16289.


----

*By submitting this pull request, I confirm that my contribution is made under the terms of the Apache-2.0 license*
---
 packages/aws-cdk/README.md                    | 20 ++++++++++++-
 packages/aws-cdk/bin/cdk.ts                   | 16 +++++++++-
 .../lib/api/cloudformation-deployments.ts     |  8 +++++
 packages/aws-cdk/lib/api/deploy-stack.ts      | 14 ++++++++-
 packages/aws-cdk/lib/cdk-toolkit.ts           |  8 +++++
 packages/aws-cdk/lib/settings.ts              |  9 ++++++
 packages/aws-cdk/package.json                 |  2 +-
 .../aws-cdk/test/api/deploy-stack.test.ts     | 29 +++++++++++++++++++
 yarn.lock                                     | 15 ++++++++++
 9 files changed, 117 insertions(+), 4 deletions(-)

diff --git a/packages/aws-cdk/README.md b/packages/aws-cdk/README.md
index cc6bfe3bbd39a..729413ae6859d 100644
--- a/packages/aws-cdk/README.md
+++ b/packages/aws-cdk/README.md
@@ -140,7 +140,7 @@ $ cdk diff --app='node bin/main.js' MyStackName --template=path/to/template.yml
 
 ### `cdk deploy`
 
-Deploys a stack of your CDK app to it's environment. During the deployment, the toolkit will output progress
+Deploys a stack of your CDK app to its environment. During the deployment, the toolkit will output progress
 indications, similar to what can be observed in the AWS CloudFormation Console. If the environment was never
 bootstrapped (using `cdk bootstrap`), only stacks that are not using assets and synthesize to a template that is under
 51,200 bytes will successfully deploy.
@@ -154,6 +154,24 @@ currently deployed stack to the template and tags that are about to be deployed
 will skip deployment if they are identical. Use `--force` to override this behavior
 and always deploy the stack.
 
+#### Disabling Rollback
+
+If a resource fails to be created or updated, the deployment will *roll back* before the CLI returns. All changes made
+up to that point will be undone (resources that were created will be deleted, updates that were made will be changed
+back) in order to leave the stack in a consistent state at the end of the operation. If you are using the CDK CLI
+to iterate on a development stack in your personal account, you might not require CloudFormation to leave your
+stack in a consistent state, but instead would prefer to update your CDK application and try again.
+
+To disable the rollback feature, specify `--no-rollback` (`-R` for short):
+
+```console
+$ cdk deploy --no-rollback
+$ cdk deploy -R
+```
+
+NOTE: you cannot use `--no-rollback` for any updates that would cause a resource replacement, only for updates
+and creations of new resources.
+
 #### Deploying multiple stacks
 
 You can have multiple stacks in a cdk app. An example can be found in [how to create multiple stacks](https://docs.aws.amazon.com/cdk/latest/guide/stack_how_to_create_multiple_stacks.html).
diff --git a/packages/aws-cdk/bin/cdk.ts b/packages/aws-cdk/bin/cdk.ts
index 29f217360355f..a21a350415223 100644
--- a/packages/aws-cdk/bin/cdk.ts
+++ b/packages/aws-cdk/bin/cdk.ts
@@ -104,7 +104,11 @@ async function parseCommandLineArguments() {
       .option('parameters', { type: 'array', desc: 'Additional parameters passed to CloudFormation at deploy time (STACK:KEY=VALUE)', nargs: 1, requiresArg: true, default: {} })
       .option('outputs-file', { type: 'string', alias: 'O', desc: 'Path to file where stack outputs will be written as JSON', requiresArg: true })
       .option('previous-parameters', { type: 'boolean', default: true, desc: 'Use previous values for existing parameters (you must specify all parameters on every deployment if this is disabled)' })
-      .option('progress', { type: 'string', choices: [StackActivityProgress.BAR, StackActivityProgress.EVENTS], desc: 'Display mode for stack activity events' }),
+      .option('progress', { type: 'string', choices: [StackActivityProgress.BAR, StackActivityProgress.EVENTS], desc: 'Display mode for stack activity events' })
+      .option('rollback', { type: 'boolean', default: true, desc: 'Rollback stack to stable state on failure (iterate more rapidly with --no-rollback or -R)' })
+      // Hack to get '-R' as an alias for '--no-rollback', suggested by: https://github.com/yargs/yargs/issues/1729
+      .option('R', { type: 'boolean', hidden: true })
+      .middleware(yargsNegativeAlias('R', 'rollback'), true),
     )
     .command('destroy [STACKS..]', 'Destroy the stack(s) named STACKS', yargs => yargs
       .option('all', { type: 'boolean', default: false, desc: 'Destroy all available stacks' })
@@ -319,6 +323,7 @@ async function initCommandLine() {
           outputsFile: configuration.settings.get(['outputsFile']),
           progress: configuration.settings.get(['progress']),
           ci: args.ci,
+          rollback: configuration.settings.get(['rollback']),
         });
 
       case 'destroy':
@@ -421,6 +426,15 @@ function arrayFromYargs(xs: string[]): string[] | undefined {
   return xs.filter(x => x !== '');
 }
 
+function yargsNegativeAlias<T extends { [x in S | L ]: boolean | undefined }, S extends string, L extends string>(shortName: S, longName: L) {
+  return (argv: T) => {
+    if (shortName in argv && argv[shortName]) {
+      (argv as any)[longName] = false;
+    }
+    return argv;
+  };
+}
+
 initCommandLine()
   .then(value => {
     if (value == null) { return; }
diff --git a/packages/aws-cdk/lib/api/cloudformation-deployments.ts b/packages/aws-cdk/lib/api/cloudformation-deployments.ts
index ed783e0826fd7..8cea2ae411212 100644
--- a/packages/aws-cdk/lib/api/cloudformation-deployments.ts
+++ b/packages/aws-cdk/lib/api/cloudformation-deployments.ts
@@ -129,6 +129,13 @@ export interface DeployStackOptions {
    * @default false
    */
   readonly ci?: boolean;
+
+  /**
+   * Rollback failed deployments
+   *
+   * @default true
+   */
+  readonly rollback?: boolean;
 }
 
 export interface DestroyStackOptions {
@@ -204,6 +211,7 @@ export class CloudFormationDeployments {
       usePreviousParameters: options.usePreviousParameters,
       progress: options.progress,
       ci: options.ci,
+      rollback: options.rollback,
     });
   }
 
diff --git a/packages/aws-cdk/lib/api/deploy-stack.ts b/packages/aws-cdk/lib/api/deploy-stack.ts
index df811e39587be..62c5815197fc2 100644
--- a/packages/aws-cdk/lib/api/deploy-stack.ts
+++ b/packages/aws-cdk/lib/api/deploy-stack.ts
@@ -175,6 +175,13 @@ export interface DeployStackOptions {
    * @default false
    */
   readonly ci?: boolean;
+
+  /**
+   * Rollback failed deployments
+   *
+   * @default true
+   */
+  readonly rollback?: boolean;
 }
 
 const LARGE_TEMPLATE_SIZE_KB = 50;
@@ -282,7 +289,12 @@ export async function deployStack(options: DeployStackOptions): Promise<DeploySt
   const execute = options.execute === undefined ? true : options.execute;
   if (execute) {
     debug('Initiating execution of changeset %s on stack %s', changeSet.Id, deployName);
-    await cfn.executeChangeSet({ StackName: deployName, ChangeSetName: changeSetName }).promise();
+
+    // Do a bit of contortions to only pass the `DisableRollback` flag if it's true. That way,
+    // CloudFormation won't balk at the unrecognized option in regions where the feature is not available yet.
+    const disableRollback = options.rollback === false ? { DisableRollback: true } : undefined;
+    await cfn.executeChangeSet({ StackName: deployName, ChangeSetName: changeSetName, ...disableRollback }).promise();
+
     // eslint-disable-next-line max-len
     const monitor = options.quiet ? undefined : StackActivityMonitor.withDefaultPrinter(cfn, deployName, stackArtifact, {
       resourcesTotal: (changeSetDescription.Changes ?? []).length,
diff --git a/packages/aws-cdk/lib/cdk-toolkit.ts b/packages/aws-cdk/lib/cdk-toolkit.ts
index 55ca1c6e24903..427139535bde5 100644
--- a/packages/aws-cdk/lib/cdk-toolkit.ts
+++ b/packages/aws-cdk/lib/cdk-toolkit.ts
@@ -196,6 +196,7 @@ export class CdkToolkit {
           usePreviousParameters: options.usePreviousParameters,
           progress: options.progress,
           ci: options.ci,
+          rollback: options.rollback,
         });
 
         const message = result.noOp
@@ -625,6 +626,13 @@ export interface DeployOptions {
    * @default false
    */
   readonly ci?: boolean;
+
+  /**
+   * Rollback failed deployments
+   *
+   * @default true
+   */
+  readonly rollback?: boolean;
 }
 
 export interface DestroyOptions {
diff --git a/packages/aws-cdk/lib/settings.ts b/packages/aws-cdk/lib/settings.ts
index b33a578d75098..4bfafd447d607 100644
--- a/packages/aws-cdk/lib/settings.ts
+++ b/packages/aws-cdk/lib/settings.ts
@@ -229,6 +229,14 @@ export class Settings {
 
   /**
    * Parse Settings out of CLI arguments.
+   *
+   * CLI arguments in must be accessed in the CLI code via
+   * `configuration.settings.get(['argName'])` instead of via `args.argName`.
+   *
+   * The advantage is that they can be configured via `cdk.json` and
+   * `$HOME/.cdk.json`. Arguments not listed below and accessed via this object
+   * can only be specified on the command line.
+   *
    * @param argv the received CLI arguments.
    * @returns a new Settings object.
    */
@@ -272,6 +280,7 @@ export class Settings {
       progress: argv.progress,
       bundlingStacks,
       lookups: argv.lookups,
+      rollback: argv.rollback,
     });
   }
 
diff --git a/packages/aws-cdk/package.json b/packages/aws-cdk/package.json
index 497afb2e2ec92..f179a9bd58bb6 100644
--- a/packages/aws-cdk/package.json
+++ b/packages/aws-cdk/package.json
@@ -75,7 +75,7 @@
     "@aws-cdk/region-info": "0.0.0",
     "@jsii/check-node": "1.33.0",
     "archiver": "^5.3.0",
-    "aws-sdk": "^2.848.0",
+    "aws-sdk": "^2.979.0",
     "camelcase": "^6.2.0",
     "cdk-assets": "0.0.0",
     "colors": "^1.4.0",
diff --git a/packages/aws-cdk/test/api/deploy-stack.test.ts b/packages/aws-cdk/test/api/deploy-stack.test.ts
index 7e4c5484e2f5a..844b971e7f2d4 100644
--- a/packages/aws-cdk/test/api/deploy-stack.test.ts
+++ b/packages/aws-cdk/test/api/deploy-stack.test.ts
@@ -635,6 +635,35 @@ test('updateTerminationProtection called when termination protection is undefine
   }));
 });
 
+describe('disable rollback', () => {
+  test('by default, we do not disable rollback (and also do not pass the flag)', async () => {
+    // WHEN
+    await deployStack({
+      ...standardDeployStackArguments(),
+    });
+
+    // THEN
+    expect(cfnMocks.executeChangeSet).toHaveBeenCalledTimes(1);
+    expect(cfnMocks.executeChangeSet).not.toHaveBeenCalledWith(expect.objectContaining({
+      DisableRollback: expect.anything(),
+    }));
+  });
+
+  test('rollback can be disabled by setting rollback: false', async () => {
+    // WHEN
+    await deployStack({
+      ...standardDeployStackArguments(),
+      rollback: false,
+    });
+
+    // THEN
+    expect(cfnMocks.executeChangeSet).toHaveBeenCalledWith(expect.objectContaining({
+      DisableRollback: true,
+    }));
+  });
+
+});
+
 /**
  * Set up the mocks so that it looks like the stack exists to start with
  *
diff --git a/yarn.lock b/yarn.lock
index c553079426b7d..e9d7fe62947d7 100644
--- a/yarn.lock
+++ b/yarn.lock
@@ -2319,6 +2319,21 @@ aws-sdk@^2.848.0, aws-sdk@^2.928.0:
     uuid "3.3.2"
     xml2js "0.4.19"
 
+aws-sdk@^2.979.0:
+  version "2.979.0"
+  resolved "https://registry.yarnpkg.com/aws-sdk/-/aws-sdk-2.979.0.tgz#d0104fec763cc3eafb123e709f94866790109da4"
+  integrity sha512-pKKhpYZwmihCvuH3757WHY8JQI9g2wvtF3s0aiyH2xCUmX/6uekhExz/utD4uqZP3m3PwKZPGQkQkH30DtHrPw==
+  dependencies:
+    buffer "4.9.2"
+    events "1.1.1"
+    ieee754 "1.1.13"
+    jmespath "0.15.0"
+    querystring "0.2.0"
+    sax "1.2.1"
+    url "0.10.3"
+    uuid "3.3.2"
+    xml2js "0.4.19"
+
 aws-sign2@~0.7.0:
   version "0.7.0"
   resolved "https://registry.yarnpkg.com/aws-sign2/-/aws-sign2-0.7.0.tgz#b46e890934a9591f2d2f6f86d7e6a9f1b3fe76a8"

From cb1cf15e0a9a92713e71e80d0ec804c7642f1675 Mon Sep 17 00:00:00 2001
From: Niranjan Jayakar <nija@amazon.com>
Date: Tue, 31 Aug 2021 13:44:31 +0100
Subject: [PATCH 44/91] chore: migrate some modules from nodeunit to jest
 (#16295)

No changes have been made to the tests, pure migration.

----

*By submitting this pull request, I confirm that my contribution is made under the terms of the Apache-2.0 license*
---
 packages/@aws-cdk/app-delivery/.gitignore     |   3 +-
 packages/@aws-cdk/app-delivery/.npmignore     |   3 +-
 packages/@aws-cdk/app-delivery/jest.config.js |   2 +
 packages/@aws-cdk/app-delivery/package.json   |   6 +-
 ...s => pipeline-deploy-stack-action.test.ts} | 112 +++---
 .../aws-applicationautoscaling/.gitignore     |   3 +-
 .../aws-applicationautoscaling/.npmignore     |   3 +-
 .../aws-applicationautoscaling/jest.config.js |   9 +
 .../aws-applicationautoscaling/package.json   |   5 +-
 .../test/cron.test.ts                         |  55 +++
 ...able-target.ts => scalable-target.test.ts} |  81 ++---
 ...-policy.ts => step-scaling-policy.test.ts} |  82 ++---
 ...et-tracking.ts => target-tracking.test.ts} |  37 +-
 .../test/test.cron.ts                         |  56 ---
 packages/@aws-cdk/aws-eks-legacy/.gitignore   |   3 +-
 packages/@aws-cdk/aws-eks-legacy/.npmignore   |   3 +-
 .../@aws-cdk/aws-eks-legacy/jest.config.js    |   2 +
 packages/@aws-cdk/aws-eks-legacy/package.json |   7 +-
 .../test/{test.awsauth.ts => awsauth.test.ts} |  39 +-
 .../test/{test.cluster.ts => cluster.test.ts} | 297 ++++++++-------
 .../aws-eks-legacy/test/helm-chart.test.ts    |  54 +++
 .../{test.manifest.ts => manifest.test.ts}    |  17 +-
 .../test/test.cluster-resource.ts             |  69 ----
 .../aws-eks-legacy/test/test.helm-chart.ts    |  55 ---
 .../{test.user-data.ts => user-data.test.ts}  |  85 +++--
 packages/@aws-cdk/aws-events/.gitignore       |   3 +-
 packages/@aws-cdk/aws-events/.npmignore       |   3 +-
 packages/@aws-cdk/aws-events/jest.config.js   |   2 +
 packages/@aws-cdk/aws-events/package.json     |   4 +-
 .../test/{test.archive.ts => archive.test.ts} |  35 +-
 .../{test.event-bus.ts => event-bus.test.ts}  | 223 ++++++------
 .../test/{test.input.ts => input.test.ts}     | 115 +++---
 .../test/{test.rule.ts => rule.test.ts}       | 341 +++++++++---------
 .../@aws-cdk/aws-events/test/schedule.test.ts |  96 +++++
 .../@aws-cdk/aws-events/test/test.schedule.ts |  97 -----
 .../test/{test.util.ts => util.test.ts}       |  75 ++--
 36 files changed, 1015 insertions(+), 1067 deletions(-)
 create mode 100644 packages/@aws-cdk/app-delivery/jest.config.js
 rename packages/@aws-cdk/app-delivery/test/{test.pipeline-deploy-stack-action.ts => pipeline-deploy-stack-action.test.ts} (87%)
 create mode 100644 packages/@aws-cdk/aws-applicationautoscaling/jest.config.js
 create mode 100644 packages/@aws-cdk/aws-applicationautoscaling/test/cron.test.ts
 rename packages/@aws-cdk/aws-applicationautoscaling/test/{test.scalable-target.ts => scalable-target.test.ts} (64%)
 rename packages/@aws-cdk/aws-applicationautoscaling/test/{test.step-scaling-policy.ts => step-scaling-policy.test.ts} (87%)
 rename packages/@aws-cdk/aws-applicationautoscaling/test/{test.target-tracking.ts => target-tracking.test.ts} (73%)
 delete mode 100644 packages/@aws-cdk/aws-applicationautoscaling/test/test.cron.ts
 create mode 100644 packages/@aws-cdk/aws-eks-legacy/jest.config.js
 rename packages/@aws-cdk/aws-eks-legacy/test/{test.awsauth.ts => awsauth.test.ts} (85%)
 rename packages/@aws-cdk/aws-eks-legacy/test/{test.cluster.ts => cluster.test.ts} (70%)
 create mode 100644 packages/@aws-cdk/aws-eks-legacy/test/helm-chart.test.ts
 rename packages/@aws-cdk/aws-eks-legacy/test/{test.manifest.ts => manifest.test.ts} (86%)
 delete mode 100644 packages/@aws-cdk/aws-eks-legacy/test/test.cluster-resource.ts
 delete mode 100644 packages/@aws-cdk/aws-eks-legacy/test/test.helm-chart.ts
 rename packages/@aws-cdk/aws-eks-legacy/test/{test.user-data.ts => user-data.test.ts} (73%)
 create mode 100644 packages/@aws-cdk/aws-events/jest.config.js
 rename packages/@aws-cdk/aws-events/test/{test.archive.ts => archive.test.ts} (69%)
 rename packages/@aws-cdk/aws-events/test/{test.event-bus.ts => event-bus.test.ts} (71%)
 rename packages/@aws-cdk/aws-events/test/{test.input.ts => input.test.ts} (78%)
 rename packages/@aws-cdk/aws-events/test/{test.rule.ts => rule.test.ts} (79%)
 create mode 100644 packages/@aws-cdk/aws-events/test/schedule.test.ts
 delete mode 100644 packages/@aws-cdk/aws-events/test/test.schedule.ts
 rename packages/@aws-cdk/aws-events/test/{test.util.ts => util.test.ts} (53%)

diff --git a/packages/@aws-cdk/app-delivery/.gitignore b/packages/@aws-cdk/app-delivery/.gitignore
index 1ed331de29bb6..8e88c5db7a762 100644
--- a/packages/@aws-cdk/app-delivery/.gitignore
+++ b/packages/@aws-cdk/app-delivery/.gitignore
@@ -11,4 +11,5 @@ tsconfig.json
 coverage
 !.eslintrc.js
 
-junit.xml
\ No newline at end of file
+junit.xml
+!jest.config.js
\ No newline at end of file
diff --git a/packages/@aws-cdk/app-delivery/.npmignore b/packages/@aws-cdk/app-delivery/.npmignore
index b0d9cb5dd2512..a11c52cc9c6cb 100644
--- a/packages/@aws-cdk/app-delivery/.npmignore
+++ b/packages/@aws-cdk/app-delivery/.npmignore
@@ -22,4 +22,5 @@ tsconfig.json
 **/cdk.out
 junit.xml
 test/
-!*.lit.ts
\ No newline at end of file
+!*.lit.ts
+jest.config.js
\ No newline at end of file
diff --git a/packages/@aws-cdk/app-delivery/jest.config.js b/packages/@aws-cdk/app-delivery/jest.config.js
new file mode 100644
index 0000000000000..cd664e1d069e5
--- /dev/null
+++ b/packages/@aws-cdk/app-delivery/jest.config.js
@@ -0,0 +1,2 @@
+const baseConfig = require('../../../tools/cdk-build-tools/config/jest.config');
+module.exports = baseConfig;
diff --git a/packages/@aws-cdk/app-delivery/package.json b/packages/@aws-cdk/app-delivery/package.json
index 45694d1f602c0..9b5bb232938dd 100644
--- a/packages/@aws-cdk/app-delivery/package.json
+++ b/packages/@aws-cdk/app-delivery/package.json
@@ -61,11 +61,12 @@
   },
   "devDependencies": {
     "@aws-cdk/aws-s3": "0.0.0",
+    "@types/jest": "^26.0.24",
     "@types/nodeunit": "^0.0.32",
     "cdk-build-tools": "0.0.0",
     "cdk-integ-tools": "0.0.0",
     "fast-check": "^2.17.0",
-    "nodeunit": "^0.11.3",
+    "jest": "^26.6.3",
     "pkglint": "0.0.0",
     "@aws-cdk/assert-internal": "0.0.0"
   },
@@ -81,6 +82,9 @@
     "url": "https://aws.amazon.com",
     "organization": true
   },
+  "cdk-build": {
+    "jest": true
+  },
   "keywords": [
     "aws",
     "cdk"
diff --git a/packages/@aws-cdk/app-delivery/test/test.pipeline-deploy-stack-action.ts b/packages/@aws-cdk/app-delivery/test/pipeline-deploy-stack-action.test.ts
similarity index 87%
rename from packages/@aws-cdk/app-delivery/test/test.pipeline-deploy-stack-action.ts
rename to packages/@aws-cdk/app-delivery/test/pipeline-deploy-stack-action.test.ts
index e4611adf570f6..e065330c152d3 100644
--- a/packages/@aws-cdk/app-delivery/test/test.pipeline-deploy-stack-action.ts
+++ b/packages/@aws-cdk/app-delivery/test/pipeline-deploy-stack-action.test.ts
@@ -1,4 +1,5 @@
-import { expect, haveResource, haveResourceLike, isSuperObject } from '@aws-cdk/assert-internal';
+import '@aws-cdk/assert-internal/jest';
+import { isSuperObject } from '@aws-cdk/assert-internal';
 import * as cfn from '@aws-cdk/aws-cloudformation';
 import * as codebuild from '@aws-cdk/aws-codebuild';
 import * as codepipeline from '@aws-cdk/aws-codepipeline';
@@ -10,7 +11,6 @@ import * as cxschema from '@aws-cdk/cloud-assembly-schema';
 import * as cdk from '@aws-cdk/core';
 import * as constructs from 'constructs';
 import * as fc from 'fast-check';
-import * as nodeunit from 'nodeunit';
 import { PipelineDeployStackAction } from '../lib/pipeline-deploy-stack-action';
 
 interface SelfUpdatingPipeline {
@@ -19,14 +19,14 @@ interface SelfUpdatingPipeline {
 }
 const accountId = fc.array(fc.integer(0, 9), 12, 12).map(arr => arr.join());
 
-export = nodeunit.testCase({
-  'rejects cross-environment deployment'(test: nodeunit.Test) {
+describe('pipeline deploy stack action', () => {
+  test('rejects cross-environment deployment', () => {
     fc.assert(
       fc.property(
         accountId, accountId,
         (pipelineAccount, stackAccount) => {
           fc.pre(pipelineAccount !== stackAccount);
-          test.throws(() => {
+          expect(() => {
             const app = new cdk.App();
             const stack = new cdk.Stack(app, 'Test', { env: { account: pipelineAccount } });
             const pipeline = new codepipeline.Pipeline(stack, 'Pipeline');
@@ -43,20 +43,20 @@ export = nodeunit.testCase({
               stack: new cdk.Stack(app, 'DeployedStack', { env: { account: stackAccount } }),
               adminPermissions: false,
             }));
-          }, 'Cross-environment deployment is not supported');
+          }).toThrow('Cross-environment deployment is not supported');
         },
       ),
     );
-    test.done();
-  },
 
-  'rejects createRunOrder >= executeRunOrder'(test: nodeunit.Test) {
+  });
+
+  test('rejects createRunOrder >= executeRunOrder', () => {
     fc.assert(
       fc.property(
         fc.integer(1, 999), fc.integer(1, 999),
         (createRunOrder, executeRunOrder) => {
           fc.pre(createRunOrder >= executeRunOrder);
-          test.throws(() => {
+          expect(() => {
             const app = new cdk.App();
             const stack = new cdk.Stack(app, 'Test');
             const pipeline = new codepipeline.Pipeline(stack, 'Pipeline');
@@ -74,13 +74,13 @@ export = nodeunit.testCase({
               stack: new cdk.Stack(app, 'DeployedStack'),
               adminPermissions: false,
             }));
-          }, 'createChangeSetRunOrder must be < executeChangeSetRunOrder');
+          }).toThrow(/createChangeSetRunOrder .* must be < executeChangeSetRunOrder/);
         },
       ),
     );
-    test.done();
-  },
-  'users can supply CloudFormation capabilities'(test: nodeunit.Test) {
+
+  });
+  test('users can supply CloudFormation capabilities', () => {
     const pipelineStack = getTestStack();
     const stackWithNoCapability = new cdk.Stack(undefined, 'NoCapStack',
       { env: { account: '123456789012', region: 'us-east-1' } });
@@ -134,57 +134,57 @@ export = nodeunit.testCase({
       capabilities: [cfn.CloudFormationCapabilities.ANONYMOUS_IAM, cfn.CloudFormationCapabilities.AUTO_EXPAND],
       adminPermissions: false,
     }));
-    expect(pipelineStack).to(haveResource('AWS::CodePipeline::Pipeline', hasPipelineAction({
+    expect(pipelineStack).toHaveResource('AWS::CodePipeline::Pipeline', hasPipelineAction({
       Configuration: {
         StackName: 'TestStack',
         ActionMode: 'CHANGE_SET_REPLACE',
         Capabilities: 'CAPABILITY_NAMED_IAM',
       },
-    })));
-    expect(pipelineStack).to(haveResource('AWS::CodePipeline::Pipeline', hasPipelineAction({
+    }));
+    expect(pipelineStack).toHaveResource('AWS::CodePipeline::Pipeline', hasPipelineAction({
       Configuration: {
         StackName: 'AnonymousIAM',
         ActionMode: 'CHANGE_SET_REPLACE',
         Capabilities: 'CAPABILITY_IAM',
       },
-    })));
-    expect(pipelineStack).notTo(haveResource('AWS::CodePipeline::Pipeline', hasPipelineAction({
+    }));
+    expect(pipelineStack).not.toHaveResource('AWS::CodePipeline::Pipeline', hasPipelineAction({
       Configuration: {
         StackName: 'NoCapStack',
         ActionMode: 'CHANGE_SET_REPLACE',
         Capabilities: 'CAPABILITY_NAMED_IAM',
       },
-    })));
-    expect(pipelineStack).notTo(haveResource('AWS::CodePipeline::Pipeline', hasPipelineAction({
+    }));
+    expect(pipelineStack).not.toHaveResource('AWS::CodePipeline::Pipeline', hasPipelineAction({
       Configuration: {
         StackName: 'NoCapStack',
         ActionMode: 'CHANGE_SET_REPLACE',
         Capabilities: 'CAPABILITY_IAM',
       },
-    })));
-    expect(pipelineStack).to(haveResource('AWS::CodePipeline::Pipeline', hasPipelineAction({
+    }));
+    expect(pipelineStack).toHaveResource('AWS::CodePipeline::Pipeline', hasPipelineAction({
       Configuration: {
         StackName: 'NoCapStack',
         ActionMode: 'CHANGE_SET_REPLACE',
       },
-    })));
-    expect(pipelineStack).to(haveResource('AWS::CodePipeline::Pipeline', hasPipelineAction({
+    }));
+    expect(pipelineStack).toHaveResource('AWS::CodePipeline::Pipeline', hasPipelineAction({
       Configuration: {
         StackName: 'AutoExpand',
         ActionMode: 'CHANGE_SET_REPLACE',
         Capabilities: 'CAPABILITY_AUTO_EXPAND',
       },
-    })));
-    expect(pipelineStack).to(haveResource('AWS::CodePipeline::Pipeline', hasPipelineAction({
+    }));
+    expect(pipelineStack).toHaveResource('AWS::CodePipeline::Pipeline', hasPipelineAction({
       Configuration: {
         StackName: 'AnonymousIAMAndAutoExpand',
         ActionMode: 'CHANGE_SET_REPLACE',
         Capabilities: 'CAPABILITY_IAM,CAPABILITY_AUTO_EXPAND',
       },
-    })));
-    test.done();
-  },
-  'users can use admin permissions'(test: nodeunit.Test) {
+    }));
+
+  });
+  test('users can use admin permissions', () => {
     const pipelineStack = getTestStack();
     const selfUpdatingStack = createSelfUpdatingStack(pipelineStack);
 
@@ -195,7 +195,7 @@ export = nodeunit.testCase({
       input: selfUpdatingStack.synthesizedApp,
       adminPermissions: true,
     }));
-    expect(pipelineStack).to(haveResource('AWS::IAM::Policy', {
+    expect(pipelineStack).toHaveResource('AWS::IAM::Policy', {
       PolicyDocument: {
         Version: '2012-10-17',
         Statement: [
@@ -249,17 +249,17 @@ export = nodeunit.testCase({
           },
         ],
       },
-    }));
-    expect(pipelineStack).to(haveResource('AWS::CodePipeline::Pipeline', hasPipelineAction({
+    });
+    expect(pipelineStack).toHaveResource('AWS::CodePipeline::Pipeline', hasPipelineAction({
       Configuration: {
         StackName: 'TestStack',
         ActionMode: 'CHANGE_SET_REPLACE',
         Capabilities: 'CAPABILITY_NAMED_IAM,CAPABILITY_AUTO_EXPAND',
       },
-    })));
-    test.done();
-  },
-  'users can supply a role for deploy action'(test: nodeunit.Test) {
+    }));
+
+  });
+  test('users can supply a role for deploy action', () => {
     const pipelineStack = getTestStack();
     const selfUpdatingStack = createSelfUpdatingStack(pipelineStack);
 
@@ -275,10 +275,10 @@ export = nodeunit.testCase({
       role,
     });
     selfUpdateStage.addAction(deployAction);
-    test.same(deployAction.deploymentRole, role);
-    test.done();
-  },
-  'users can specify IAM permissions for the deploy action'(test: nodeunit.Test) {
+    expect(deployAction.deploymentRole).toEqual(role);
+
+  });
+  test('users can specify IAM permissions for the deploy action', () => {
     // GIVEN //
     const pipelineStack = getTestStack();
 
@@ -312,7 +312,7 @@ export = nodeunit.testCase({
     }));
 
     // THEN //
-    expect(pipelineStack).to(haveResource('AWS::IAM::Policy', {
+    expect(pipelineStack).toHaveResource('AWS::IAM::Policy', {
       PolicyDocument: {
         Version: '2012-10-17',
         Statement: [
@@ -379,10 +379,10 @@ export = nodeunit.testCase({
           Ref: 'CodePipelineDeployChangeSetRoleF9F2B343',
         },
       ],
-    }));
-    test.done();
-  },
-  'rejects stacks with assets'(test: nodeunit.Test) {
+    });
+
+  });
+  test('rejects stacks with assets', () => {
     fc.assert(
       fc.property(
         fc.integer(1, 5),
@@ -394,21 +394,21 @@ export = nodeunit.testCase({
             deployedStack.node.addMetadata(cxschema.ArtifactMetadataEntryType.ASSET, {});
           }
 
-          test.throws(() => {
+          expect(() => {
             new PipelineDeployStackAction({
               changeSetName: 'ChangeSet',
               input: new codepipeline.Artifact(),
               stack: deployedStack,
               adminPermissions: false,
             });
-          }, /Cannot deploy the stack DeployedStack because it references/);
+          }).toThrow(/Cannot deploy the stack DeployedStack because it references/);
         },
       ),
     );
-    test.done();
-  },
 
-  'allows overriding the ChangeSet and Execute action names'(test: nodeunit.Test) {
+  });
+
+  test('allows overriding the ChangeSet and Execute action names', () => {
     const stack = getTestStack();
     const selfUpdatingPipeline = createSelfUpdatingStack(stack);
     selfUpdatingPipeline.pipeline.addStage({
@@ -424,7 +424,7 @@ export = nodeunit.testCase({
       ],
     });
 
-    expect(stack).to(haveResourceLike('AWS::CodePipeline::Pipeline', {
+    expect(stack).toHaveResourceLike('AWS::CodePipeline::Pipeline', {
       Stages: [
         {},
         {},
@@ -440,10 +440,10 @@ export = nodeunit.testCase({
           ],
         },
       ],
-    }));
+    });
+
 
-    test.done();
-  },
+  });
 });
 
 class FakeAction implements codepipeline.IAction {
diff --git a/packages/@aws-cdk/aws-applicationautoscaling/.gitignore b/packages/@aws-cdk/aws-applicationautoscaling/.gitignore
index 018c65919d67c..7e6fdd4d423db 100644
--- a/packages/@aws-cdk/aws-applicationautoscaling/.gitignore
+++ b/packages/@aws-cdk/aws-applicationautoscaling/.gitignore
@@ -15,4 +15,5 @@ nyc.config.js
 *.snk
 !.eslintrc.js
 
-junit.xml
\ No newline at end of file
+junit.xml
+!jest.config.js
\ No newline at end of file
diff --git a/packages/@aws-cdk/aws-applicationautoscaling/.npmignore b/packages/@aws-cdk/aws-applicationautoscaling/.npmignore
index 9a032ae80868c..e8acf10a468a1 100644
--- a/packages/@aws-cdk/aws-applicationautoscaling/.npmignore
+++ b/packages/@aws-cdk/aws-applicationautoscaling/.npmignore
@@ -24,4 +24,5 @@ tsconfig.json
 **/cdk.out
 junit.xml
 test/
-!*.lit.ts
\ No newline at end of file
+!*.lit.ts
+jest.config.js
\ No newline at end of file
diff --git a/packages/@aws-cdk/aws-applicationautoscaling/jest.config.js b/packages/@aws-cdk/aws-applicationautoscaling/jest.config.js
new file mode 100644
index 0000000000000..3eef7ba398c07
--- /dev/null
+++ b/packages/@aws-cdk/aws-applicationautoscaling/jest.config.js
@@ -0,0 +1,9 @@
+const baseConfig = require('../../../tools/cdk-build-tools/config/jest.config');
+module.exports = {
+  ...baseConfig,
+  coverageThreshold: {
+    global: {
+        branches: 75,
+    },
+  },
+};
diff --git a/packages/@aws-cdk/aws-applicationautoscaling/package.json b/packages/@aws-cdk/aws-applicationautoscaling/package.json
index a48c9b098229f..5026578a5d6d0 100644
--- a/packages/@aws-cdk/aws-applicationautoscaling/package.json
+++ b/packages/@aws-cdk/aws-applicationautoscaling/package.json
@@ -55,6 +55,7 @@
   },
   "cdk-build": {
     "cloudformation": "AWS::ApplicationAutoScaling",
+    "jest": true,
     "env": {
       "AWSLINT_BASE_CONSTRUCT": true
     }
@@ -72,11 +73,11 @@
   },
   "license": "Apache-2.0",
   "devDependencies": {
-    "@types/nodeunit": "^0.0.32",
+    "@types/jest": "^26.0.24",
     "cdk-build-tools": "0.0.0",
     "cfn2ts": "0.0.0",
     "fast-check": "^2.17.0",
-    "nodeunit": "^0.11.3",
+    "jest": "^26.6.3",
     "pkglint": "0.0.0",
     "@aws-cdk/assert-internal": "0.0.0"
   },
diff --git a/packages/@aws-cdk/aws-applicationautoscaling/test/cron.test.ts b/packages/@aws-cdk/aws-applicationautoscaling/test/cron.test.ts
new file mode 100644
index 0000000000000..b3c337883146c
--- /dev/null
+++ b/packages/@aws-cdk/aws-applicationautoscaling/test/cron.test.ts
@@ -0,0 +1,55 @@
+import { Duration, Stack, Lazy } from '@aws-cdk/core';
+import * as appscaling from '../lib';
+
+describe('cron', () => {
+  test('test utc cron, hour only', () => {
+    expect(appscaling.Schedule.cron({ hour: '18', minute: '0' }).expressionString).toEqual('cron(0 18 * * ? *)');
+
+  });
+
+  test('test utc cron, hour and minute', () => {
+    expect(appscaling.Schedule.cron({ hour: '18', minute: '24' }).expressionString).toEqual('cron(24 18 * * ? *)');
+
+  });
+
+  test('rate must be whole number of minutes', () => {
+    expect(() => {
+      appscaling.Schedule.rate(Duration.minutes(0.13456));
+    }).toThrow(/'0.13456 minutes' cannot be converted into a whole number of seconds/);
+
+  });
+
+  test('rate can be in seconds', () => {
+    const duration = appscaling.Schedule.rate(Duration.seconds(120));
+    expect('rate(2 minutes)').toEqual(duration.expressionString);
+
+  });
+
+  test('rate must not be in seconds when specified as a token', () => {
+    expect(() => {
+      appscaling.Schedule.rate(Duration.seconds(Lazy.number({ produce: () => 5 })));
+    }).toThrow(/Allowed units for scheduling/);
+
+  });
+
+  test('rate cannot be 0', () => {
+    expect(() => {
+      appscaling.Schedule.rate(Duration.days(0));
+    }).toThrow(/Duration cannot be 0/);
+
+  });
+
+  test('rate can be token', () => {
+    const stack = new Stack();
+    const lazyDuration = Duration.minutes(Lazy.number({ produce: () => 5 }));
+    const rate = appscaling.Schedule.rate(lazyDuration);
+    expect('rate(5 minutes)').toEqual(stack.resolve(rate).expressionString);
+
+  });
+
+  test('rate can be in allowed type hours', () => {
+    expect('rate(1 hour)').toEqual(appscaling.Schedule.rate(Duration.hours(1))
+      .expressionString);
+
+  });
+});
diff --git a/packages/@aws-cdk/aws-applicationautoscaling/test/test.scalable-target.ts b/packages/@aws-cdk/aws-applicationautoscaling/test/scalable-target.test.ts
similarity index 64%
rename from packages/@aws-cdk/aws-applicationautoscaling/test/test.scalable-target.ts
rename to packages/@aws-cdk/aws-applicationautoscaling/test/scalable-target.test.ts
index 8c48f8b844a84..8628a8624468c 100644
--- a/packages/@aws-cdk/aws-applicationautoscaling/test/test.scalable-target.ts
+++ b/packages/@aws-cdk/aws-applicationautoscaling/test/scalable-target.test.ts
@@ -1,12 +1,11 @@
-import { expect, haveResource } from '@aws-cdk/assert-internal';
+import '@aws-cdk/assert-internal/jest';
 import * as cloudwatch from '@aws-cdk/aws-cloudwatch';
 import * as cdk from '@aws-cdk/core';
-import { Test } from 'nodeunit';
 import * as appscaling from '../lib';
 import { createScalableTarget } from './util';
 
-export = {
-  'test scalable target creation'(test: Test) {
+describe('scalable target', () => {
+  test('test scalable target creation', () => {
     // GIVEN
     const stack = new cdk.Stack();
 
@@ -20,18 +19,18 @@ export = {
     });
 
     // THEN
-    expect(stack).to(haveResource('AWS::ApplicationAutoScaling::ScalableTarget', {
+    expect(stack).toHaveResource('AWS::ApplicationAutoScaling::ScalableTarget', {
       ServiceNamespace: 'dynamodb',
       ScalableDimension: 'test:TestCount',
       ResourceId: 'test:this/test',
       MinCapacity: 1,
       MaxCapacity: 20,
-    }));
+    });
+
 
-    test.done();
-  },
+  });
 
-  'validation does not fail when using Tokens'(test: Test) {
+  test('validation does not fail when using Tokens', () => {
     // GIVEN
     const stack = new cdk.Stack();
 
@@ -45,18 +44,18 @@ export = {
     });
 
     // THEN: no exception
-    expect(stack).to(haveResource('AWS::ApplicationAutoScaling::ScalableTarget', {
+    expect(stack).toHaveResource('AWS::ApplicationAutoScaling::ScalableTarget', {
       ServiceNamespace: 'dynamodb',
       ScalableDimension: 'test:TestCount',
       ResourceId: 'test:this/test',
       MinCapacity: 10,
       MaxCapacity: 1,
-    }));
+    });
 
-    test.done();
-  },
 
-  'add scheduled scaling'(test: Test) {
+  });
+
+  test('add scheduled scaling', () => {
     // GIVEN
     const stack = new cdk.Stack();
     const target = createScalableTarget(stack);
@@ -69,7 +68,7 @@ export = {
     });
 
     // THEN
-    expect(stack).to(haveResource('AWS::ApplicationAutoScaling::ScalableTarget', {
+    expect(stack).toHaveResource('AWS::ApplicationAutoScaling::ScalableTarget', {
       ScheduledActions: [
         {
           ScalableTargetAction: {
@@ -80,12 +79,12 @@ export = {
           ScheduledActionName: 'ScaleUp',
         },
       ],
-    }));
+    });
+
 
-    test.done();
-  },
+  });
 
-  'step scaling on MathExpression'(test: Test) {
+  test('step scaling on MathExpression', () => {
     // GIVEN
     const stack = new cdk.Stack();
     const target = createScalableTarget(stack);
@@ -110,11 +109,11 @@ export = {
     });
 
     // THEN
-    expect(stack).notTo(haveResource('AWS::CloudWatch::Alarm', {
+    expect(stack).not.toHaveResource('AWS::CloudWatch::Alarm', {
       Period: 60,
-    }));
+    });
 
-    expect(stack).to(haveResource('AWS::CloudWatch::Alarm', {
+    expect(stack).toHaveResource('AWS::CloudWatch::Alarm', {
       ComparisonOperator: 'LessThanOrEqualToThreshold',
       EvaluationPeriods: 1,
       Metrics: [
@@ -136,22 +135,22 @@ export = {
         },
       ],
       Threshold: 49,
-    }));
-
-    test.done();
-  },
-
-  'test service namespace enum'(test: Test) {
-    test.equals(appscaling.ServiceNamespace.APPSTREAM, 'appstream');
-    test.equals(appscaling.ServiceNamespace.COMPREHEND, 'comprehend');
-    test.equals(appscaling.ServiceNamespace.CUSTOM_RESOURCE, 'custom-resource');
-    test.equals(appscaling.ServiceNamespace.DYNAMODB, 'dynamodb');
-    test.equals(appscaling.ServiceNamespace.EC2, 'ec2');
-    test.equals(appscaling.ServiceNamespace.ECS, 'ecs');
-    test.equals(appscaling.ServiceNamespace.ELASTIC_MAP_REDUCE, 'elasticmapreduce');
-    test.equals(appscaling.ServiceNamespace.LAMBDA, 'lambda');
-    test.equals(appscaling.ServiceNamespace.RDS, 'rds');
-    test.equals(appscaling.ServiceNamespace.SAGEMAKER, 'sagemaker');
-    test.done();
-  },
-};
+    });
+
+
+  });
+
+  test('test service namespace enum', () => {
+    expect(appscaling.ServiceNamespace.APPSTREAM).toEqual( 'appstream');
+    expect(appscaling.ServiceNamespace.COMPREHEND).toEqual( 'comprehend');
+    expect(appscaling.ServiceNamespace.CUSTOM_RESOURCE).toEqual( 'custom-resource');
+    expect(appscaling.ServiceNamespace.DYNAMODB).toEqual( 'dynamodb');
+    expect(appscaling.ServiceNamespace.EC2).toEqual( 'ec2');
+    expect(appscaling.ServiceNamespace.ECS).toEqual( 'ecs');
+    expect(appscaling.ServiceNamespace.ELASTIC_MAP_REDUCE).toEqual( 'elasticmapreduce');
+    expect(appscaling.ServiceNamespace.LAMBDA).toEqual( 'lambda');
+    expect(appscaling.ServiceNamespace.RDS).toEqual( 'rds');
+    expect(appscaling.ServiceNamespace.SAGEMAKER).toEqual( 'sagemaker');
+
+  });
+});
diff --git a/packages/@aws-cdk/aws-applicationautoscaling/test/test.step-scaling-policy.ts b/packages/@aws-cdk/aws-applicationautoscaling/test/step-scaling-policy.test.ts
similarity index 87%
rename from packages/@aws-cdk/aws-applicationautoscaling/test/test.step-scaling-policy.ts
rename to packages/@aws-cdk/aws-applicationautoscaling/test/step-scaling-policy.test.ts
index bb585daeb6eae..528a84b997306 100644
--- a/packages/@aws-cdk/aws-applicationautoscaling/test/test.step-scaling-policy.ts
+++ b/packages/@aws-cdk/aws-applicationautoscaling/test/step-scaling-policy.test.ts
@@ -1,13 +1,13 @@
-import { expect, haveResource, haveResourceLike, SynthUtils } from '@aws-cdk/assert-internal';
+import '@aws-cdk/assert-internal/jest';
+import { SynthUtils } from '@aws-cdk/assert-internal';
 import * as cloudwatch from '@aws-cdk/aws-cloudwatch';
 import * as cdk from '@aws-cdk/core';
 import * as fc from 'fast-check';
-import { Test } from 'nodeunit';
 import * as appscaling from '../lib';
 import { arbitrary_input_intervals, createScalableTarget } from './util';
 
-export = {
-  'alarm thresholds are valid numbers'(test: Test) {
+describe('step scaling policy', () => {
+  test('alarm thresholds are valid numbers', () => {
     fc.assert(fc.property(
       arbitrary_input_intervals(),
       (intervals) => {
@@ -24,10 +24,10 @@ export = {
       },
     ));
 
-    test.done();
-  },
 
-  'generated step intervals are valid intervals'(test: Test) {
+  });
+
+  test('generated step intervals are valid intervals', () => {
     fc.assert(fc.property(
       arbitrary_input_intervals(),
       (intervals) => {
@@ -40,10 +40,10 @@ export = {
       },
     ));
 
-    test.done();
-  },
 
-  'generated step intervals are nonoverlapping'(test: Test) {
+  });
+
+  test('generated step intervals are nonoverlapping', () => {
     fc.assert(fc.property(
       arbitrary_input_intervals(),
       (intervals) => {
@@ -61,10 +61,10 @@ export = {
       },
     ), { verbose: true });
 
-    test.done();
-  },
 
-  'all template intervals occur in input array'(test: Test) {
+  });
+
+  test('all template intervals occur in input array', () => {
     fc.assert(fc.property(
       arbitrary_input_intervals(),
       (intervals) => {
@@ -83,10 +83,10 @@ export = {
       },
     ));
 
-    test.done();
-  },
 
-  'lower alarm uses lower policy'(test: Test) {
+  });
+
+  test('lower alarm uses lower policy', () => {
     fc.assert(fc.property(
       arbitrary_input_intervals(),
       (intervals) => {
@@ -98,10 +98,10 @@ export = {
       },
     ));
 
-    test.done();
-  },
 
-  'upper alarm uses upper policy'(test: Test) {
+  });
+
+  test('upper alarm uses upper policy', () => {
     fc.assert(fc.property(
       arbitrary_input_intervals(),
       (intervals) => {
@@ -113,10 +113,10 @@ export = {
       },
     ));
 
-    test.done();
-  },
 
-  'test step scaling on metric'(test: Test) {
+  });
+
+  test('test step scaling on metric', () => {
     // GIVEN
     const stack = new cdk.Stack();
     const target = createScalableTarget(stack);
@@ -132,7 +132,7 @@ export = {
     });
 
     // THEN
-    expect(stack).to(haveResource('AWS::ApplicationAutoScaling::ScalingPolicy', {
+    expect(stack).toHaveResource('AWS::ApplicationAutoScaling::ScalingPolicy', {
       PolicyType: 'StepScaling',
       ScalingTargetId: {
         Ref: 'Target3191CF44',
@@ -148,12 +148,12 @@ export = {
         ],
       },
 
-    }));
+    });
+
 
-    test.done();
-  },
+  });
 
-  'step scaling from percentile metric'(test: Test) {
+  test('step scaling from percentile metric', () => {
     // GIVEN
     const stack = new cdk.Stack();
     const target = createScalableTarget(stack);
@@ -169,14 +169,14 @@ export = {
     });
 
     // THEN
-    expect(stack).to(haveResourceLike('AWS::ApplicationAutoScaling::ScalingPolicy', {
+    expect(stack).toHaveResourceLike('AWS::ApplicationAutoScaling::ScalingPolicy', {
       PolicyType: 'StepScaling',
       StepScalingPolicyConfiguration: {
         AdjustmentType: 'ChangeInCapacity',
         MetricAggregationType: 'Average',
       },
-    }));
-    expect(stack).to(haveResource('AWS::CloudWatch::Alarm', {
+    });
+    expect(stack).toHaveResource('AWS::CloudWatch::Alarm', {
       ComparisonOperator: 'GreaterThanOrEqualToThreshold',
       EvaluationPeriods: 1,
       AlarmActions: [
@@ -186,12 +186,12 @@ export = {
       MetricName: 'Metric',
       Namespace: 'Test',
       Threshold: 100,
-    }));
+    });
 
-    test.done();
-  },
 
-  'step scaling with evaluation period configured'(test: Test) {
+  });
+
+  test('step scaling with evaluation period configured', () => {
     // GIVEN
     const stack = new cdk.Stack();
     const target = createScalableTarget(stack);
@@ -209,25 +209,25 @@ export = {
     });
 
     // THEN
-    expect(stack).to(haveResourceLike('AWS::ApplicationAutoScaling::ScalingPolicy', {
+    expect(stack).toHaveResourceLike('AWS::ApplicationAutoScaling::ScalingPolicy', {
       PolicyType: 'StepScaling',
       StepScalingPolicyConfiguration: {
         AdjustmentType: 'ChangeInCapacity',
         MetricAggregationType: 'Maximum',
       },
-    }));
-    expect(stack).to(haveResource('AWS::CloudWatch::Alarm', {
+    });
+    expect(stack).toHaveResource('AWS::CloudWatch::Alarm', {
       ComparisonOperator: 'GreaterThanOrEqualToThreshold',
       EvaluationPeriods: 10,
       ExtendedStatistic: 'p99',
       MetricName: 'Metric',
       Namespace: 'Test',
       Threshold: 100,
-    }));
+    });
 
-    test.done();
-  },
-};
+
+  });
+});
 
 /**
  * Synthesize the given step scaling setup to a template
diff --git a/packages/@aws-cdk/aws-applicationautoscaling/test/test.target-tracking.ts b/packages/@aws-cdk/aws-applicationautoscaling/test/target-tracking.test.ts
similarity index 73%
rename from packages/@aws-cdk/aws-applicationautoscaling/test/test.target-tracking.ts
rename to packages/@aws-cdk/aws-applicationautoscaling/test/target-tracking.test.ts
index cbd67cbe9c330..2ec9f8dd07a26 100644
--- a/packages/@aws-cdk/aws-applicationautoscaling/test/test.target-tracking.ts
+++ b/packages/@aws-cdk/aws-applicationautoscaling/test/target-tracking.test.ts
@@ -1,12 +1,11 @@
-import { expect, haveResource } from '@aws-cdk/assert-internal';
+import '@aws-cdk/assert-internal/jest';
 import * as cloudwatch from '@aws-cdk/aws-cloudwatch';
 import * as cdk from '@aws-cdk/core';
-import { Test } from 'nodeunit';
 import * as appscaling from '../lib';
 import { createScalableTarget } from './util';
 
-export = {
-  'test setup target tracking on predefined metric'(test: Test) {
+describe('target tracking', () => {
+  test('test setup target tracking on predefined metric', () => {
     // GIVEN
     const stack = new cdk.Stack();
     const target = createScalableTarget(stack);
@@ -18,19 +17,19 @@ export = {
     });
 
     // THEN
-    expect(stack).to(haveResource('AWS::ApplicationAutoScaling::ScalingPolicy', {
+    expect(stack).toHaveResource('AWS::ApplicationAutoScaling::ScalingPolicy', {
       PolicyType: 'TargetTrackingScaling',
       TargetTrackingScalingPolicyConfiguration: {
         PredefinedMetricSpecification: { PredefinedMetricType: 'EC2SpotFleetRequestAverageCPUUtilization' },
         TargetValue: 30,
       },
 
-    }));
+    });
+
 
-    test.done();
-  },
+  });
 
-  'test setup target tracking on predefined metric for lambda'(test: Test) {
+  test('test setup target tracking on predefined metric for lambda', () => {
     // GIVEN
     const stack = new cdk.Stack();
     const target = createScalableTarget(stack);
@@ -42,19 +41,19 @@ export = {
     });
 
     // THEN
-    expect(stack).to(haveResource('AWS::ApplicationAutoScaling::ScalingPolicy', {
+    expect(stack).toHaveResource('AWS::ApplicationAutoScaling::ScalingPolicy', {
       PolicyType: 'TargetTrackingScaling',
       TargetTrackingScalingPolicyConfiguration: {
         PredefinedMetricSpecification: { PredefinedMetricType: 'LambdaProvisionedConcurrencyUtilization' },
         TargetValue: 0.9,
       },
 
-    }));
+    });
+
 
-    test.done();
-  },
+  });
 
-  'test setup target tracking on custom metric'(test: Test) {
+  test('test setup target tracking on custom metric', () => {
     // GIVEN
     const stack = new cdk.Stack();
     const target = createScalableTarget(stack);
@@ -66,7 +65,7 @@ export = {
     });
 
     // THEN
-    expect(stack).to(haveResource('AWS::ApplicationAutoScaling::ScalingPolicy', {
+    expect(stack).toHaveResource('AWS::ApplicationAutoScaling::ScalingPolicy', {
       PolicyType: 'TargetTrackingScaling',
       TargetTrackingScalingPolicyConfiguration: {
         CustomizedMetricSpecification: {
@@ -77,8 +76,8 @@ export = {
         TargetValue: 30,
       },
 
-    }));
+    });
+
 
-    test.done();
-  },
-};
+  });
+});
diff --git a/packages/@aws-cdk/aws-applicationautoscaling/test/test.cron.ts b/packages/@aws-cdk/aws-applicationautoscaling/test/test.cron.ts
deleted file mode 100644
index 324b2f8243c97..0000000000000
--- a/packages/@aws-cdk/aws-applicationautoscaling/test/test.cron.ts
+++ /dev/null
@@ -1,56 +0,0 @@
-import { Duration, Stack, Lazy } from '@aws-cdk/core';
-import { Test } from 'nodeunit';
-import * as appscaling from '../lib';
-
-export = {
-  'test utc cron, hour only'(test: Test) {
-    test.equals(appscaling.Schedule.cron({ hour: '18', minute: '0' }).expressionString, 'cron(0 18 * * ? *)');
-    test.done();
-  },
-
-  'test utc cron, hour and minute'(test: Test) {
-    test.equals(appscaling.Schedule.cron({ hour: '18', minute: '24' }).expressionString, 'cron(24 18 * * ? *)');
-    test.done();
-  },
-
-  'rate must be whole number of minutes'(test: Test) {
-    test.throws(() => {
-      appscaling.Schedule.rate(Duration.minutes(0.13456));
-    }, /'0.13456 minutes' cannot be converted into a whole number of seconds/);
-    test.done();
-  },
-
-  'rate can be in seconds'(test: Test) {
-    const duration = appscaling.Schedule.rate(Duration.seconds(120));
-    test.equal('rate(2 minutes)', duration.expressionString);
-    test.done();
-  },
-
-  'rate must not be in seconds when specified as a token'(test: Test) {
-    test.throws(() => {
-      appscaling.Schedule.rate(Duration.seconds(Lazy.number({ produce: () => 5 })));
-    }, /Allowed units for scheduling/);
-    test.done();
-  },
-
-  'rate cannot be 0'(test: Test) {
-    test.throws(() => {
-      appscaling.Schedule.rate(Duration.days(0));
-    }, /Duration cannot be 0/);
-    test.done();
-  },
-
-  'rate can be token'(test: Test) {
-    const stack = new Stack();
-    const lazyDuration = Duration.minutes(Lazy.number({ produce: () => 5 }));
-    const rate = appscaling.Schedule.rate(lazyDuration);
-    test.equal('rate(5 minutes)', stack.resolve(rate).expressionString);
-    test.done();
-  },
-
-  'rate can be in allowed type hours'(test: Test) {
-    test.equal('rate(1 hour)', appscaling.Schedule.rate(Duration.hours(1))
-      .expressionString);
-    test.done();
-  },
-};
diff --git a/packages/@aws-cdk/aws-eks-legacy/.gitignore b/packages/@aws-cdk/aws-eks-legacy/.gitignore
index 752d096cc6b12..633c903ceefc7 100644
--- a/packages/@aws-cdk/aws-eks-legacy/.gitignore
+++ b/packages/@aws-cdk/aws-eks-legacy/.gitignore
@@ -16,4 +16,5 @@ coverage
 nyc.config.js
 !.eslintrc.js
 
-junit.xml
\ No newline at end of file
+junit.xml
+!jest.config.js
\ No newline at end of file
diff --git a/packages/@aws-cdk/aws-eks-legacy/.npmignore b/packages/@aws-cdk/aws-eks-legacy/.npmignore
index 9a032ae80868c..e8acf10a468a1 100644
--- a/packages/@aws-cdk/aws-eks-legacy/.npmignore
+++ b/packages/@aws-cdk/aws-eks-legacy/.npmignore
@@ -24,4 +24,5 @@ tsconfig.json
 **/cdk.out
 junit.xml
 test/
-!*.lit.ts
\ No newline at end of file
+!*.lit.ts
+jest.config.js
\ No newline at end of file
diff --git a/packages/@aws-cdk/aws-eks-legacy/jest.config.js b/packages/@aws-cdk/aws-eks-legacy/jest.config.js
new file mode 100644
index 0000000000000..cd664e1d069e5
--- /dev/null
+++ b/packages/@aws-cdk/aws-eks-legacy/jest.config.js
@@ -0,0 +1,2 @@
+const baseConfig = require('../../../tools/cdk-build-tools/config/jest.config');
+module.exports = baseConfig;
diff --git a/packages/@aws-cdk/aws-eks-legacy/package.json b/packages/@aws-cdk/aws-eks-legacy/package.json
index 862a69da0f289..1494c1d93020f 100644
--- a/packages/@aws-cdk/aws-eks-legacy/package.json
+++ b/packages/@aws-cdk/aws-eks-legacy/package.json
@@ -55,7 +55,8 @@
     "build+test+extract": "yarn build+test && yarn rosetta:extract"
   },
   "cdk-build": {
-    "cloudformation": "AWS::EKS"
+    "cloudformation": "AWS::EKS",
+    "jest": true
   },
   "keywords": [
     "aws",
@@ -70,11 +71,11 @@
   },
   "license": "Apache-2.0",
   "devDependencies": {
-    "@types/nodeunit": "^0.0.32",
+    "@types/jest": "^26.0.24",
     "cdk-build-tools": "0.0.0",
     "cdk-integ-tools": "0.0.0",
     "cfn2ts": "0.0.0",
-    "nodeunit": "^0.11.3",
+    "jest": "^26.6.3",
     "pkglint": "0.0.0",
     "@aws-cdk/assert-internal": "0.0.0"
   },
diff --git a/packages/@aws-cdk/aws-eks-legacy/test/test.awsauth.ts b/packages/@aws-cdk/aws-eks-legacy/test/awsauth.test.ts
similarity index 85%
rename from packages/@aws-cdk/aws-eks-legacy/test/test.awsauth.ts
rename to packages/@aws-cdk/aws-eks-legacy/test/awsauth.test.ts
index 2ebdcde32dbcf..d9eacb3f183d1 100644
--- a/packages/@aws-cdk/aws-eks-legacy/test/test.awsauth.ts
+++ b/packages/@aws-cdk/aws-eks-legacy/test/awsauth.test.ts
@@ -1,14 +1,13 @@
-import { countResources, expect, haveResource } from '@aws-cdk/assert-internal';
+import '@aws-cdk/assert-internal/jest';
 import * as iam from '@aws-cdk/aws-iam';
-import { Test } from 'nodeunit';
 import { Cluster, KubernetesResource } from '../lib';
 import { AwsAuth } from '../lib/aws-auth';
 import { testFixtureNoVpc } from './util';
 
 /* eslint-disable max-len */
 
-export = {
-  'empty aws-auth'(test: Test) {
+describe('awsauth', () => {
+  test('empty aws-auth', () => {
     // GIVEN
     const { stack } = testFixtureNoVpc();
     const cluster = new Cluster(stack, 'cluster');
@@ -17,18 +16,18 @@ export = {
     new AwsAuth(stack, 'AwsAuth', { cluster });
 
     // THEN
-    expect(stack).to(haveResource(KubernetesResource.RESOURCE_TYPE, {
+    expect(stack).toHaveResource(KubernetesResource.RESOURCE_TYPE, {
       Manifest: JSON.stringify([{
         apiVersion: 'v1',
         kind: 'ConfigMap',
         metadata: { name: 'aws-auth', namespace: 'kube-system' },
         data: { mapRoles: '[]', mapUsers: '[]', mapAccounts: '[]' },
       }]),
-    }));
-    test.done();
-  },
+    });
 
-  'addRoleMapping and addUserMapping can be used to define the aws-auth ConfigMap'(test: Test) {
+  });
+
+  test('addRoleMapping and addUserMapping can be used to define the aws-auth ConfigMap', () => {
     // GIVEN
     const { stack } = testFixtureNoVpc();
     const cluster = new Cluster(stack, 'Cluster');
@@ -44,8 +43,8 @@ export = {
     cluster.awsAuth.addAccount('5566776655');
 
     // THEN
-    expect(stack).to(countResources(KubernetesResource.RESOURCE_TYPE, 1));
-    expect(stack).to(haveResource(KubernetesResource.RESOURCE_TYPE, {
+    expect(stack).toCountResources(KubernetesResource.RESOURCE_TYPE, 1);
+    expect(stack).toHaveResource(KubernetesResource.RESOURCE_TYPE, {
       Manifest: {
         'Fn::Join': [
           '',
@@ -89,12 +88,12 @@ export = {
           ],
         ],
       },
-    }));
+    });
+
 
-    test.done();
-  },
+  });
 
-  'imported users and roles can be also be used'(test: Test) {
+  test('imported users and roles can be also be used', () => {
     // GIVEN
     const { stack } = testFixtureNoVpc();
     const cluster = new Cluster(stack, 'Cluster');
@@ -106,7 +105,7 @@ export = {
     cluster.awsAuth.addUserMapping(user, { groups: ['group2'] });
 
     // THEN
-    expect(stack).to(haveResource(KubernetesResource.RESOURCE_TYPE, {
+    expect(stack).toHaveResource(KubernetesResource.RESOURCE_TYPE, {
       Manifest: {
         'Fn::Join': [
           '',
@@ -130,8 +129,8 @@ export = {
           ],
         ],
       },
-    }));
+    });
+
 
-    test.done();
-  },
-};
+  });
+});
diff --git a/packages/@aws-cdk/aws-eks-legacy/test/test.cluster.ts b/packages/@aws-cdk/aws-eks-legacy/test/cluster.test.ts
similarity index 70%
rename from packages/@aws-cdk/aws-eks-legacy/test/test.cluster.ts
rename to packages/@aws-cdk/aws-eks-legacy/test/cluster.test.ts
index cfcc21a8ce50e..f395348cc6f1e 100644
--- a/packages/@aws-cdk/aws-eks-legacy/test/test.cluster.ts
+++ b/packages/@aws-cdk/aws-eks-legacy/test/cluster.test.ts
@@ -1,16 +1,15 @@
-import { expect, haveResource, haveResourceLike, not } from '@aws-cdk/assert-internal';
+import '@aws-cdk/assert-internal/jest';
 import * as ec2 from '@aws-cdk/aws-ec2';
 import * as iam from '@aws-cdk/aws-iam';
 import * as cdk from '@aws-cdk/core';
-import { Test } from 'nodeunit';
 import * as eks from '../lib';
 import { spotInterruptHandler } from '../lib/spot-interrupt-handler';
 import { testFixture, testFixtureNoVpc } from './util';
 
 /* eslint-disable max-len */
 
-export = {
-  'a default cluster spans all subnets'(test: Test) {
+describe('cluster', () => {
+  test('a default cluster spans all subnets', () => {
     // GIVEN
     const { stack, vpc } = testFixture();
 
@@ -18,7 +17,7 @@ export = {
     new eks.Cluster(stack, 'Cluster', { vpc, kubectlEnabled: false, defaultCapacity: 0 });
 
     // THEN
-    expect(stack).to(haveResourceLike('AWS::EKS::Cluster', {
+    expect(stack).toHaveResourceLike('AWS::EKS::Cluster', {
       ResourcesVpcConfig: {
         SubnetIds: [
           { Ref: 'VPCPublicSubnet1SubnetB4246D30' },
@@ -27,12 +26,12 @@ export = {
           { Ref: 'VPCPrivateSubnet2SubnetCFCDAA7A' },
         ],
       },
-    }));
+    });
+
 
-    test.done();
-  },
+  });
 
-  'if "vpc" is not specified, vpc with default configuration will be created'(test: Test) {
+  test('if "vpc" is not specified, vpc with default configuration will be created', () => {
     // GIVEN
     const { stack } = testFixtureNoVpc();
 
@@ -40,13 +39,13 @@ export = {
     new eks.Cluster(stack, 'cluster');
 
     // THEN
-    expect(stack).to(haveResource('AWS::EC2::VPC'));
-    test.done();
-  },
+    expect(stack).toHaveResource('AWS::EC2::VPC');
 
-  'default capacity': {
+  });
 
-    'x2 m5.large by default'(test: Test) {
+  describe('default capacity', () => {
+
+    test('x2 m5.large by default', () => {
       // GIVEN
       const { stack } = testFixtureNoVpc();
 
@@ -54,13 +53,13 @@ export = {
       const cluster = new eks.Cluster(stack, 'cluster');
 
       // THEN
-      test.ok(cluster.defaultCapacity);
-      expect(stack).to(haveResource('AWS::AutoScaling::AutoScalingGroup', { DesiredCapacity: '2' }));
-      expect(stack).to(haveResource('AWS::AutoScaling::LaunchConfiguration', { InstanceType: 'm5.large' }));
-      test.done();
-    },
+      expect(cluster.defaultCapacity).toBeDefined();
+      expect(stack).toHaveResource('AWS::AutoScaling::AutoScalingGroup', { DesiredCapacity: '2' });
+      expect(stack).toHaveResource('AWS::AutoScaling::LaunchConfiguration', { InstanceType: 'm5.large' });
+
+    });
 
-    'quantity and type can be customized'(test: Test) {
+    test('quantity and type can be customized', () => {
       // GIVEN
       const { stack } = testFixtureNoVpc();
 
@@ -71,13 +70,13 @@ export = {
       });
 
       // THEN
-      test.ok(cluster.defaultCapacity);
-      expect(stack).to(haveResource('AWS::AutoScaling::AutoScalingGroup', { DesiredCapacity: '10' }));
-      expect(stack).to(haveResource('AWS::AutoScaling::LaunchConfiguration', { InstanceType: 'm2.xlarge' }));
-      test.done();
-    },
+      expect(cluster.defaultCapacity).toBeDefined();
+      expect(stack).toHaveResource('AWS::AutoScaling::AutoScalingGroup', { DesiredCapacity: '10' });
+      expect(stack).toHaveResource('AWS::AutoScaling::LaunchConfiguration', { InstanceType: 'm2.xlarge' });
+
+    });
 
-    'defaultCapacity=0 will not allocate at all'(test: Test) {
+    test('defaultCapacity=0 will not allocate at all', () => {
       // GIVEN
       const { stack } = testFixtureNoVpc();
 
@@ -85,14 +84,14 @@ export = {
       const cluster = new eks.Cluster(stack, 'cluster', { defaultCapacity: 0 });
 
       // THEN
-      test.ok(!cluster.defaultCapacity);
-      expect(stack).notTo(haveResource('AWS::AutoScaling::AutoScalingGroup'));
-      expect(stack).notTo(haveResource('AWS::AutoScaling::LaunchConfiguration'));
-      test.done();
-    },
-  },
-
-  'creating a cluster tags the private VPC subnets'(test: Test) {
+      expect(cluster.defaultCapacity).toBeUndefined();
+      expect(stack).not.toHaveResource('AWS::AutoScaling::AutoScalingGroup');
+      expect(stack).not.toHaveResource('AWS::AutoScaling::LaunchConfiguration');
+
+    });
+  });
+
+  test('creating a cluster tags the private VPC subnets', () => {
     // GIVEN
     const { stack, vpc } = testFixture();
 
@@ -100,19 +99,19 @@ export = {
     new eks.Cluster(stack, 'Cluster', { vpc, kubectlEnabled: false, defaultCapacity: 0 });
 
     // THEN
-    expect(stack).to(haveResource('AWS::EC2::Subnet', {
+    expect(stack).toHaveResource('AWS::EC2::Subnet', {
       Tags: [
         { Key: 'aws-cdk:subnet-name', Value: 'Private' },
         { Key: 'aws-cdk:subnet-type', Value: 'Private' },
         { Key: 'kubernetes.io/role/internal-elb', Value: '1' },
         { Key: 'Name', Value: 'Stack/VPC/PrivateSubnet1' },
       ],
-    }));
+    });
+
 
-    test.done();
-  },
+  });
 
-  'creating a cluster tags the public VPC subnets'(test: Test) {
+  test('creating a cluster tags the public VPC subnets', () => {
     // GIVEN
     const { stack, vpc } = testFixture();
 
@@ -120,7 +119,7 @@ export = {
     new eks.Cluster(stack, 'Cluster', { vpc, kubectlEnabled: false, defaultCapacity: 0 });
 
     // THEN
-    expect(stack).to(haveResource('AWS::EC2::Subnet', {
+    expect(stack).toHaveResource('AWS::EC2::Subnet', {
       MapPublicIpOnLaunch: true,
       Tags: [
         { Key: 'aws-cdk:subnet-name', Value: 'Public' },
@@ -128,12 +127,12 @@ export = {
         { Key: 'kubernetes.io/role/elb', Value: '1' },
         { Key: 'Name', Value: 'Stack/VPC/PublicSubnet1' },
       ],
-    }));
+    });
+
 
-    test.done();
-  },
+  });
 
-  'adding capacity creates an ASG with tags'(test: Test) {
+  test('adding capacity creates an ASG with tags', () => {
     // GIVEN
     const { stack, vpc } = testFixture();
     const cluster = new eks.Cluster(stack, 'Cluster', { vpc, kubectlEnabled: false, defaultCapacity: 0 });
@@ -144,7 +143,7 @@ export = {
     });
 
     // THEN
-    expect(stack).to(haveResource('AWS::AutoScaling::AutoScalingGroup', {
+    expect(stack).toHaveResource('AWS::AutoScaling::AutoScalingGroup', {
       Tags: [
         {
           Key: { 'Fn::Join': ['', ['kubernetes.io/cluster/', { Ref: 'ClusterEB0386A7' }]] },
@@ -157,12 +156,12 @@ export = {
           Value: 'Stack/Cluster/Default',
         },
       ],
-    }));
+    });
 
-    test.done();
-  },
 
-  'exercise export/import'(test: Test) {
+  });
+
+  test('exercise export/import', () => {
     // GIVEN
     const { stack: stack1, vpc, app } = testFixture();
     const stack2 = new cdk.Stack(app, 'stack2', { env: { region: 'us-east-1' } });
@@ -182,7 +181,7 @@ export = {
     new cdk.CfnOutput(stack2, 'ClusterARN', { value: imported.clusterArn });
 
     // THEN
-    expect(stack2).toMatch({
+    expect(stack2).toMatchTemplate({
       Outputs: {
         ClusterARN: {
           Value: {
@@ -191,23 +190,23 @@ export = {
         },
       },
     });
-    test.done();
-  },
 
-  'disabled features when kubectl is disabled'(test: Test) {
+  });
+
+  test('disabled features when kubectl is disabled', () => {
     // GIVEN
     const { stack, vpc } = testFixture();
     const cluster = new eks.Cluster(stack, 'Cluster', { vpc, kubectlEnabled: false, defaultCapacity: 0 });
 
-    test.throws(() => cluster.awsAuth, /Cannot define aws-auth mappings if kubectl is disabled/);
-    test.throws(() => cluster.addResource('foo', {}), /Cannot define a KubernetesManifest resource on a cluster with kubectl disabled/);
-    test.throws(() => cluster.addCapacity('boo', { instanceType: new ec2.InstanceType('r5d.24xlarge'), mapRole: true }),
+    expect(() => cluster.awsAuth).toThrow(/Cannot define aws-auth mappings if kubectl is disabled/);
+    expect(() => cluster.addResource('foo', {})).toThrow(/Cannot define a KubernetesManifest resource on a cluster with kubectl disabled/);
+    expect(() => cluster.addCapacity('boo', { instanceType: new ec2.InstanceType('r5d.24xlarge'), mapRole: true })).toThrow(
       /Cannot map instance IAM role to RBAC if kubectl is disabled for the cluster/);
-    test.throws(() => new eks.HelmChart(stack, 'MyChart', { cluster, chart: 'chart' }), /Cannot define a Helm chart on a cluster with kubectl disabled/);
-    test.done();
-  },
+    expect(() => new eks.HelmChart(stack, 'MyChart', { cluster, chart: 'chart' })).toThrow(/Cannot define a Helm chart on a cluster with kubectl disabled/);
 
-  'mastersRole can be used to map an IAM role to "system:masters" (required kubectl)'(test: Test) {
+  });
+
+  test('mastersRole can be used to map an IAM role to "system:masters" (required kubectl)', () => {
     // GIVEN
     const { stack, vpc } = testFixture();
     const role = new iam.Role(stack, 'role', { assumedBy: new iam.AnyPrincipal() });
@@ -216,7 +215,7 @@ export = {
     new eks.Cluster(stack, 'Cluster', { vpc, mastersRole: role, defaultCapacity: 0 });
 
     // THEN
-    expect(stack).to(haveResource(eks.KubernetesResource.RESOURCE_TYPE, {
+    expect(stack).toHaveResource(eks.KubernetesResource.RESOURCE_TYPE, {
       Manifest: {
         'Fn::Join': [
           '',
@@ -232,12 +231,12 @@ export = {
           ],
         ],
       },
-    }));
+    });
 
-    test.done();
-  },
 
-  'addResource can be used to apply k8s manifests on this cluster'(test: Test) {
+  });
+
+  test('addResource can be used to apply k8s manifests on this cluster', () => {
     // GIVEN
     const { stack, vpc } = testFixture();
     const cluster = new eks.Cluster(stack, 'Cluster', { vpc, defaultCapacity: 0 });
@@ -247,18 +246,18 @@ export = {
     cluster.addResource('manifest2', { bar: 123 }, { boor: [1, 2, 3] });
 
     // THEN
-    expect(stack).to(haveResource(eks.KubernetesResource.RESOURCE_TYPE, {
+    expect(stack).toHaveResource(eks.KubernetesResource.RESOURCE_TYPE, {
       Manifest: '[{"foo":123}]',
-    }));
+    });
 
-    expect(stack).to(haveResource(eks.KubernetesResource.RESOURCE_TYPE, {
+    expect(stack).toHaveResource(eks.KubernetesResource.RESOURCE_TYPE, {
       Manifest: '[{"bar":123},{"boor":[1,2,3]}]',
-    }));
+    });
 
-    test.done();
-  },
 
-  'when kubectl is enabled (default) adding capacity will automatically map its IAM role'(test: Test) {
+  });
+
+  test('when kubectl is enabled (default) adding capacity will automatically map its IAM role', () => {
     // GIVEN
     const { stack, vpc } = testFixture();
     const cluster = new eks.Cluster(stack, 'Cluster', { vpc, defaultCapacity: 0 });
@@ -269,7 +268,7 @@ export = {
     });
 
     // THEN
-    expect(stack).to(haveResource(eks.KubernetesResource.RESOURCE_TYPE, {
+    expect(stack).toHaveResource(eks.KubernetesResource.RESOURCE_TYPE, {
       Manifest: {
         'Fn::Join': [
           '',
@@ -285,12 +284,12 @@ export = {
           ],
         ],
       },
-    }));
+    });
 
-    test.done();
-  },
 
-  'addCapacity will *not* map the IAM role if mapRole is false'(test: Test) {
+  });
+
+  test('addCapacity will *not* map the IAM role if mapRole is false', () => {
     // GIVEN
     const { stack, vpc } = testFixture();
     const cluster = new eks.Cluster(stack, 'Cluster', { vpc, defaultCapacity: 0 });
@@ -302,11 +301,11 @@ export = {
     });
 
     // THEN
-    expect(stack).to(not(haveResource(eks.KubernetesResource.RESOURCE_TYPE)));
-    test.done();
-  },
+    expect(stack).not.toHaveResource(eks.KubernetesResource.RESOURCE_TYPE);
+
+  });
 
-  'addCapacity will *not* map the IAM role if kubectl is disabled'(test: Test) {
+  test('addCapacity will *not* map the IAM role if kubectl is disabled', () => {
     // GIVEN
     const { stack, vpc } = testFixture();
     const cluster = new eks.Cluster(stack, 'Cluster', { vpc, kubectlEnabled: false, defaultCapacity: 0 });
@@ -317,12 +316,12 @@ export = {
     });
 
     // THEN
-    expect(stack).to(not(haveResource(eks.KubernetesResource.RESOURCE_TYPE)));
-    test.done();
-  },
+    expect(stack).not.toHaveResource(eks.KubernetesResource.RESOURCE_TYPE);
 
-  'outputs': {
-    'aws eks update-kubeconfig is the only output synthesized by default'(test: Test) {
+  });
+
+  describe('outputs', () => {
+    test('aws eks update-kubeconfig is the only output synthesized by default', () => {
       // GIVEN
       const { app, stack } = testFixtureNoVpc();
 
@@ -332,14 +331,14 @@ export = {
       // THEN
       const assembly = app.synth();
       const template = assembly.getStackByName(stack.stackName).template;
-      test.deepEqual(template.Outputs, {
+      expect(template.Outputs).toEqual({
         ClusterConfigCommand43AAE40F: { Value: { 'Fn::Join': ['', ['aws eks update-kubeconfig --name ', { Ref: 'Cluster9EE0221C' }, ' --region us-east-1']] } },
         ClusterGetTokenCommand06AE992E: { Value: { 'Fn::Join': ['', ['aws eks get-token --cluster-name ', { Ref: 'Cluster9EE0221C' }, ' --region us-east-1']] } },
       });
-      test.done();
-    },
 
-    'if masters role is defined, it should be included in the config command'(test: Test) {
+    });
+
+    test('if masters role is defined, it should be included in the config command', () => {
       // GIVEN
       const { app, stack } = testFixtureNoVpc();
 
@@ -350,14 +349,14 @@ export = {
       // THEN
       const assembly = app.synth();
       const template = assembly.getStackByName(stack.stackName).template;
-      test.deepEqual(template.Outputs, {
+      expect(template.Outputs).toEqual({
         ClusterConfigCommand43AAE40F: { Value: { 'Fn::Join': ['', ['aws eks update-kubeconfig --name ', { Ref: 'Cluster9EE0221C' }, ' --region us-east-1 --role-arn ', { 'Fn::GetAtt': ['masters0D04F23D', 'Arn'] }]] } },
         ClusterGetTokenCommand06AE992E: { Value: { 'Fn::Join': ['', ['aws eks get-token --cluster-name ', { Ref: 'Cluster9EE0221C' }, ' --region us-east-1 --role-arn ', { 'Fn::GetAtt': ['masters0D04F23D', 'Arn'] }]] } },
       });
-      test.done();
-    },
 
-    'if `outputConfigCommand=false` will disabled the output'(test: Test) {
+    });
+
+    test('if `outputConfigCommand=false` will disabled the output', () => {
       // GIVEN
       const { app, stack } = testFixtureNoVpc();
 
@@ -371,11 +370,11 @@ export = {
       // THEN
       const assembly = app.synth();
       const template = assembly.getStackByName(stack.stackName).template;
-      test.ok(!template.Outputs); // no outputs
-      test.done();
-    },
+      expect(template.Outputs).toBeUndefined(); // no outputs
+
+    });
 
-    '`outputClusterName` can be used to synthesize an output with the cluster name'(test: Test) {
+    test('`outputClusterName` can be used to synthesize an output with the cluster name', () => {
       // GIVEN
       const { app, stack } = testFixtureNoVpc();
 
@@ -388,13 +387,13 @@ export = {
       // THEN
       const assembly = app.synth();
       const template = assembly.getStackByName(stack.stackName).template;
-      test.deepEqual(template.Outputs, {
+      expect(template.Outputs).toEqual({
         ClusterClusterNameEB26049E: { Value: { Ref: 'Cluster9EE0221C' } },
       });
-      test.done();
-    },
 
-    '`outputMastersRoleArn` can be used to synthesize an output with the arn of the masters role if defined'(test: Test) {
+    });
+
+    test('`outputMastersRoleArn` can be used to synthesize an output with the arn of the masters role if defined', () => {
       // GIVEN
       const { app, stack } = testFixtureNoVpc();
 
@@ -408,13 +407,13 @@ export = {
       // THEN
       const assembly = app.synth();
       const template = assembly.getStackByName(stack.stackName).template;
-      test.deepEqual(template.Outputs, {
+      expect(template.Outputs).toEqual({
         ClusterMastersRoleArnB15964B1: { Value: { 'Fn::GetAtt': ['masters0D04F23D', 'Arn'] } },
       });
-      test.done();
-    },
 
-    'when adding capacity, instance role ARN will not be outputed only if we do not auto-map aws-auth'(test: Test) {
+    });
+
+    test('when adding capacity, instance role ARN will not be outputed only if we do not auto-map aws-auth', () => {
       // GIVEN
       const { app, stack } = testFixtureNoVpc();
 
@@ -427,18 +426,18 @@ export = {
       // THEN
       const assembly = app.synth();
       const template = assembly.getStackByName(stack.stackName).template;
-      test.deepEqual(template.Outputs, {
+      expect(template.Outputs).toEqual({
         ClusterDefaultCapacityInstanceRoleARN7DADF219: {
           Value: { 'Fn::GetAtt': ['ClusterDefaultCapacityInstanceRole3E209969', 'Arn'] },
         },
       });
-      test.done();
-    },
-  },
 
-  'boostrap user-data': {
+    });
+  });
+
+  describe('boostrap user-data', () => {
 
-    'rendered by default for ASGs'(test: Test) {
+    test('rendered by default for ASGs', () => {
       // GIVEN
       const { app, stack } = testFixtureNoVpc();
       const cluster = new eks.Cluster(stack, 'Cluster', { defaultCapacity: 0 });
@@ -449,11 +448,11 @@ export = {
       // THEN
       const template = app.synth().getStackByName(stack.stackName).template;
       const userData = template.Resources.ClusterMyCapcityLaunchConfig58583345.Properties.UserData;
-      test.deepEqual(userData, { 'Fn::Base64': { 'Fn::Join': ['', ['#!/bin/bash\nset -o xtrace\n/etc/eks/bootstrap.sh ', { Ref: 'Cluster9EE0221C' }, ' --kubelet-extra-args "--node-labels lifecycle=OnDemand" --use-max-pods true\n/opt/aws/bin/cfn-signal --exit-code $? --stack Stack --resource ClusterMyCapcityASGD4CD8B97 --region us-east-1']] } });
-      test.done();
-    },
+      expect(userData).toEqual({ 'Fn::Base64': { 'Fn::Join': ['', ['#!/bin/bash\nset -o xtrace\n/etc/eks/bootstrap.sh ', { Ref: 'Cluster9EE0221C' }, ' --kubelet-extra-args "--node-labels lifecycle=OnDemand" --use-max-pods true\n/opt/aws/bin/cfn-signal --exit-code $? --stack Stack --resource ClusterMyCapcityASGD4CD8B97 --region us-east-1']] } });
 
-    'not rendered if bootstrap is disabled'(test: Test) {
+    });
+
+    test('not rendered if bootstrap is disabled', () => {
       // GIVEN
       const { app, stack } = testFixtureNoVpc();
       const cluster = new eks.Cluster(stack, 'Cluster', { defaultCapacity: 0 });
@@ -467,12 +466,12 @@ export = {
       // THEN
       const template = app.synth().getStackByName(stack.stackName).template;
       const userData = template.Resources.ClusterMyCapcityLaunchConfig58583345.Properties.UserData;
-      test.deepEqual(userData, { 'Fn::Base64': '#!/bin/bash' });
-      test.done();
-    },
+      expect(userData).toEqual({ 'Fn::Base64': '#!/bin/bash' });
+
+    });
 
     // cursory test for options: see test.user-data.ts for full suite
-    'bootstrap options'(test: Test) {
+    test('bootstrap options', () => {
       // GIVEN
       const { app, stack } = testFixtureNoVpc();
       const cluster = new eks.Cluster(stack, 'Cluster', { defaultCapacity: 0 });
@@ -488,13 +487,13 @@ export = {
       // THEN
       const template = app.synth().getStackByName(stack.stackName).template;
       const userData = template.Resources.ClusterMyCapcityLaunchConfig58583345.Properties.UserData;
-      test.deepEqual(userData, { 'Fn::Base64': { 'Fn::Join': ['', ['#!/bin/bash\nset -o xtrace\n/etc/eks/bootstrap.sh ', { Ref: 'Cluster9EE0221C' }, ' --kubelet-extra-args "--node-labels lifecycle=OnDemand  --node-labels FOO=42" --use-max-pods true\n/opt/aws/bin/cfn-signal --exit-code $? --stack Stack --resource ClusterMyCapcityASGD4CD8B97 --region us-east-1']] } });
-      test.done();
-    },
+      expect(userData).toEqual({ 'Fn::Base64': { 'Fn::Join': ['', ['#!/bin/bash\nset -o xtrace\n/etc/eks/bootstrap.sh ', { Ref: 'Cluster9EE0221C' }, ' --kubelet-extra-args "--node-labels lifecycle=OnDemand  --node-labels FOO=42" --use-max-pods true\n/opt/aws/bin/cfn-signal --exit-code $? --stack Stack --resource ClusterMyCapcityASGD4CD8B97 --region us-east-1']] } });
 
-    'spot instances': {
+    });
+
+    describe('spot instances', () => {
 
-      'nodes labeled an tainted accordingly'(test: Test) {
+      test('nodes labeled an tainted accordingly', () => {
         // GIVEN
         const { app, stack } = testFixtureNoVpc();
         const cluster = new eks.Cluster(stack, 'Cluster', { defaultCapacity: 0 });
@@ -508,11 +507,11 @@ export = {
         // THEN
         const template = app.synth().getStackByName(stack.stackName).template;
         const userData = template.Resources.ClusterMyCapcityLaunchConfig58583345.Properties.UserData;
-        test.deepEqual(userData, { 'Fn::Base64': { 'Fn::Join': ['', ['#!/bin/bash\nset -o xtrace\n/etc/eks/bootstrap.sh ', { Ref: 'Cluster9EE0221C' }, ' --kubelet-extra-args "--node-labels lifecycle=Ec2Spot --register-with-taints=spotInstance=true:PreferNoSchedule" --use-max-pods true\n/opt/aws/bin/cfn-signal --exit-code $? --stack Stack --resource ClusterMyCapcityASGD4CD8B97 --region us-east-1']] } });
-        test.done();
-      },
+        expect(userData).toEqual({ 'Fn::Base64': { 'Fn::Join': ['', ['#!/bin/bash\nset -o xtrace\n/etc/eks/bootstrap.sh ', { Ref: 'Cluster9EE0221C' }, ' --kubelet-extra-args "--node-labels lifecycle=Ec2Spot --register-with-taints=spotInstance=true:PreferNoSchedule" --use-max-pods true\n/opt/aws/bin/cfn-signal --exit-code $? --stack Stack --resource ClusterMyCapcityASGD4CD8B97 --region us-east-1']] } });
 
-      'if kubectl is enabled, the interrupt handler is added'(test: Test) {
+      });
+
+      test('if kubectl is enabled, the interrupt handler is added', () => {
         // GIVEN
         const { stack } = testFixtureNoVpc();
         const cluster = new eks.Cluster(stack, 'Cluster', { defaultCapacity: 0 });
@@ -524,11 +523,11 @@ export = {
         });
 
         // THEN
-        expect(stack).to(haveResource(eks.KubernetesResource.RESOURCE_TYPE, { Manifest: JSON.stringify(spotInterruptHandler()) }));
-        test.done();
-      },
+        expect(stack).toHaveResource(eks.KubernetesResource.RESOURCE_TYPE, { Manifest: JSON.stringify(spotInterruptHandler()) });
+
+      });
 
-      'if kubectl is disabled, interrupt handler is not added'(test: Test) {
+      test('if kubectl is disabled, interrupt handler is not added', () => {
         // GIVEN
         const { stack } = testFixtureNoVpc();
         const cluster = new eks.Cluster(stack, 'Cluster', { defaultCapacity: 0, kubectlEnabled: false });
@@ -540,29 +539,29 @@ export = {
         });
 
         // THEN
-        expect(stack).notTo(haveResource(eks.KubernetesResource.RESOURCE_TYPE));
-        test.done();
-      },
+        expect(stack).not.toHaveResource(eks.KubernetesResource.RESOURCE_TYPE);
 
-    },
+      });
 
-  },
+    });
 
-  'if bootstrap is disabled cannot specify options'(test: Test) {
+  });
+
+  test('if bootstrap is disabled cannot specify options', () => {
     // GIVEN
     const { stack } = testFixtureNoVpc();
     const cluster = new eks.Cluster(stack, 'Cluster', { defaultCapacity: 0 });
 
     // THEN
-    test.throws(() => cluster.addCapacity('MyCapcity', {
+    expect(() => cluster.addCapacity('MyCapcity', {
       instanceType: new ec2.InstanceType('m3.xlargs'),
       bootstrapEnabled: false,
       bootstrapOptions: { awsApiRetryAttempts: 10 },
-    }), /Cannot specify "bootstrapOptions" if "bootstrapEnabled" is false/);
-    test.done();
-  },
+    })).toThrow(/Cannot specify "bootstrapOptions" if "bootstrapEnabled" is false/);
+
+  });
 
-  'EKS-Optimized AMI with GPU support'(test: Test) {
+  test('EKS-Optimized AMI with GPU support', () => {
     // GIVEN
     const { app, stack } = testFixtureNoVpc();
 
@@ -575,9 +574,9 @@ export = {
     // THEN
     const assembly = app.synth();
     const parameters = assembly.getStackByName(stack.stackName).template.Parameters;
-    test.ok(Object.entries(parameters).some(
+    expect(Object.entries(parameters).some(
       ([k, v]) => k.startsWith('SsmParameterValueawsserviceeksoptimizedami') && (v as any).Default.includes('amazon-linux2-gpu'),
-    ), 'EKS AMI with GPU should be in ssm parameters');
-    test.done();
-  },
-};
+    )).toEqual(true);
+
+  });
+});
diff --git a/packages/@aws-cdk/aws-eks-legacy/test/helm-chart.test.ts b/packages/@aws-cdk/aws-eks-legacy/test/helm-chart.test.ts
new file mode 100644
index 0000000000000..4101ce02168d9
--- /dev/null
+++ b/packages/@aws-cdk/aws-eks-legacy/test/helm-chart.test.ts
@@ -0,0 +1,54 @@
+import '@aws-cdk/assert-internal/jest';
+import * as eks from '../lib';
+import { testFixtureCluster } from './util';
+
+/* eslint-disable max-len */
+
+describe('helm chart', () => {
+  describe('add Helm chart', () => {
+    test('should have default namespace', () => {
+      // GIVEN
+      const { stack, cluster } = testFixtureCluster();
+
+      // WHEN
+      new eks.HelmChart(stack, 'MyChart', { cluster, chart: 'chart' });
+
+      // THEN
+      expect(stack).toHaveResource(eks.HelmChart.RESOURCE_TYPE, { Namespace: 'default' });
+
+    });
+    test('should have a lowercase default release name', () => {
+      // GIVEN
+      const { stack, cluster } = testFixtureCluster();
+
+      // WHEN
+      new eks.HelmChart(stack, 'MyChart', { cluster, chart: 'chart' });
+
+      // THEN
+      expect(stack).toHaveResource(eks.HelmChart.RESOURCE_TYPE, { Release: 'stackmychartff398361' });
+
+    });
+    test('should trim the last 63 of the default release name', () => {
+      // GIVEN
+      const { stack, cluster } = testFixtureCluster();
+
+      // WHEN
+      new eks.HelmChart(stack, 'MyChartNameWhichISMostProbablyLongerThenSixtyThreeCharacters', { cluster, chart: 'chart' });
+
+      // THEN
+      expect(stack).toHaveResource(eks.HelmChart.RESOURCE_TYPE, { Release: 'rtnamewhichismostprobablylongerthensixtythreecharactersb800614d' });
+
+    });
+    test('with values', () => {
+      // GIVEN
+      const { stack, cluster } = testFixtureCluster();
+
+      // WHEN
+      new eks.HelmChart(stack, 'MyChart', { cluster, chart: 'chart', values: { foo: 123 } });
+
+      // THEN
+      expect(stack).toHaveResource(eks.HelmChart.RESOURCE_TYPE, { Values: '{\"foo\":123}' });
+
+    });
+  });
+});
diff --git a/packages/@aws-cdk/aws-eks-legacy/test/test.manifest.ts b/packages/@aws-cdk/aws-eks-legacy/test/manifest.test.ts
similarity index 86%
rename from packages/@aws-cdk/aws-eks-legacy/test/test.manifest.ts
rename to packages/@aws-cdk/aws-eks-legacy/test/manifest.test.ts
index 32e418352f808..962e0c0129821 100644
--- a/packages/@aws-cdk/aws-eks-legacy/test/test.manifest.ts
+++ b/packages/@aws-cdk/aws-eks-legacy/test/manifest.test.ts
@@ -1,12 +1,11 @@
-import { expect, haveResource } from '@aws-cdk/assert-internal';
-import { Test } from 'nodeunit';
+import '@aws-cdk/assert-internal/jest';
 import { Cluster, KubernetesResource } from '../lib';
 import { testFixtureNoVpc } from './util';
 
 /* eslint-disable max-len */
 
-export = {
-  'basic usage'(test: Test) {
+describe('manifest', () => {
+  test('basic usage', () => {
     // GIVEN
     const { stack } = testFixtureNoVpc();
     const cluster = new Cluster(stack, 'cluster');
@@ -69,9 +68,9 @@ export = {
       manifest,
     });
 
-    expect(stack).to(haveResource(KubernetesResource.RESOURCE_TYPE, {
+    expect(stack).toHaveResource(KubernetesResource.RESOURCE_TYPE, {
       Manifest: JSON.stringify(manifest),
-    }));
-    test.done();
-  },
-};
\ No newline at end of file
+    });
+
+  });
+});
\ No newline at end of file
diff --git a/packages/@aws-cdk/aws-eks-legacy/test/test.cluster-resource.ts b/packages/@aws-cdk/aws-eks-legacy/test/test.cluster-resource.ts
deleted file mode 100644
index 90bddc141b05e..0000000000000
--- a/packages/@aws-cdk/aws-eks-legacy/test/test.cluster-resource.ts
+++ /dev/null
@@ -1,69 +0,0 @@
-import { Test } from 'nodeunit';
-
-export = {
-  create: {
-    'defaults'(test: Test) {
-      test.done();
-    },
-    'with no specific version'(test: Test) {
-      test.done();
-    },
-  },
-
-  update: {
-    'requires replacement': {
-      'change of "name" creates a new cluster with the new name and deletes the old cluster'(test: Test) {
-        test.done();
-      },
-      'change of "resourcesVpcConfig"'(test: Test) {
-        test.done();
-      },
-      'change of "roleArn"'(test: Test) {
-        test.done();
-      },
-      'change of "roleArn" and "version"'(test: Test) {
-        test.done();
-      },
-    },
-
-    'in-place': {
-      'version change': {
-        'from undefined to a specific value'(test: Test) {
-          test.done();
-        },
-
-        'from a specific value to another value'(test: Test) {
-          test.done();
-        },
-
-        'fails from specific value to undefined'(test: Test) {
-          test.done();
-        },
-      },
-    },
-
-    'update failure returns the previous physical name': {
-
-      'for "version" updates'(test: Test) {
-        test.done();
-      },
-
-      'for "name" updates'(test: Test) {
-        test.done();
-      },
-
-      'for "roleArn" updates'(test: Test) {
-        test.done();
-      },
-
-    },
-  },
-
-  delete: {
-    'delete failure': {
-      'returns correct physical name'(test: Test) {
-        test.done();
-      },
-    },
-  },
-};
\ No newline at end of file
diff --git a/packages/@aws-cdk/aws-eks-legacy/test/test.helm-chart.ts b/packages/@aws-cdk/aws-eks-legacy/test/test.helm-chart.ts
deleted file mode 100644
index e595e3d00a5ac..0000000000000
--- a/packages/@aws-cdk/aws-eks-legacy/test/test.helm-chart.ts
+++ /dev/null
@@ -1,55 +0,0 @@
-import { expect, haveResource } from '@aws-cdk/assert-internal';
-import { Test } from 'nodeunit';
-import * as eks from '../lib';
-import { testFixtureCluster } from './util';
-
-/* eslint-disable max-len */
-
-export = {
-  'add Helm chart': {
-    'should have default namespace'(test: Test) {
-      // GIVEN
-      const { stack, cluster } = testFixtureCluster();
-
-      // WHEN
-      new eks.HelmChart(stack, 'MyChart', { cluster, chart: 'chart' });
-
-      // THEN
-      expect(stack).to(haveResource(eks.HelmChart.RESOURCE_TYPE, { Namespace: 'default' }));
-      test.done();
-    },
-    'should have a lowercase default release name'(test: Test) {
-      // GIVEN
-      const { stack, cluster } = testFixtureCluster();
-
-      // WHEN
-      new eks.HelmChart(stack, 'MyChart', { cluster, chart: 'chart' });
-
-      // THEN
-      expect(stack).to(haveResource(eks.HelmChart.RESOURCE_TYPE, { Release: 'stackmychartff398361' }));
-      test.done();
-    },
-    'should trim the last 63 of the default release name'(test: Test) {
-      // GIVEN
-      const { stack, cluster } = testFixtureCluster();
-
-      // WHEN
-      new eks.HelmChart(stack, 'MyChartNameWhichISMostProbablyLongerThenSixtyThreeCharacters', { cluster, chart: 'chart' });
-
-      // THEN
-      expect(stack).to(haveResource(eks.HelmChart.RESOURCE_TYPE, { Release: 'rtnamewhichismostprobablylongerthensixtythreecharactersb800614d' }));
-      test.done();
-    },
-    'with values'(test: Test) {
-      // GIVEN
-      const { stack, cluster } = testFixtureCluster();
-
-      // WHEN
-      new eks.HelmChart(stack, 'MyChart', { cluster, chart: 'chart', values: { foo: 123 } });
-
-      // THEN
-      expect(stack).to(haveResource(eks.HelmChart.RESOURCE_TYPE, { Values: '{\"foo\":123}' }));
-      test.done();
-    },
-  },
-};
diff --git a/packages/@aws-cdk/aws-eks-legacy/test/test.user-data.ts b/packages/@aws-cdk/aws-eks-legacy/test/user-data.test.ts
similarity index 73%
rename from packages/@aws-cdk/aws-eks-legacy/test/test.user-data.ts
rename to packages/@aws-cdk/aws-eks-legacy/test/user-data.test.ts
index be8341bf6834b..4189e720d2f97 100644
--- a/packages/@aws-cdk/aws-eks-legacy/test/test.user-data.ts
+++ b/packages/@aws-cdk/aws-eks-legacy/test/user-data.test.ts
@@ -1,13 +1,12 @@
 import * as autoscaling from '@aws-cdk/aws-autoscaling';
 import * as ec2 from '@aws-cdk/aws-ec2';
 import { App, Stack } from '@aws-cdk/core';
-import { Test } from 'nodeunit';
 import { renderUserData } from '../lib/user-data';
 
 /* eslint-disable max-len */
 
-export = {
-  'default user data'(test: Test) {
+describe('user data', () => {
+  test('default user data', () => {
     // GIVEN
     const { asg, stack } = newFixtures();
 
@@ -15,16 +14,16 @@ export = {
     const userData = stack.resolve(renderUserData('my-cluster-name', asg));
 
     // THEN
-    test.deepEqual(userData, [
+    expect(userData).toEqual([
       'set -o xtrace',
       '/etc/eks/bootstrap.sh my-cluster-name --kubelet-extra-args "--node-labels lifecycle=OnDemand" --use-max-pods true',
       '/opt/aws/bin/cfn-signal --exit-code $? --stack my-stack --resource ASG46ED3070 --region us-west-33',
     ]);
 
-    test.done();
-  },
 
-  '--use-max-pods=true'(test: Test) {
+  });
+
+  test('--use-max-pods=true', () => {
     // GIVEN
     const { asg, stack } = newFixtures();
 
@@ -34,11 +33,11 @@ export = {
     }));
 
     // THEN
-    test.deepEqual(userData[1], '/etc/eks/bootstrap.sh my-cluster-name --kubelet-extra-args "--node-labels lifecycle=OnDemand" --use-max-pods true');
-    test.done();
-  },
+    expect(userData[1]).toEqual('/etc/eks/bootstrap.sh my-cluster-name --kubelet-extra-args "--node-labels lifecycle=OnDemand" --use-max-pods true');
 
-  '--use-max-pods=false'(test: Test) {
+  });
+
+  test('--use-max-pods=false', () => {
     // GIVEN
     const { asg, stack } = newFixtures();
 
@@ -48,11 +47,11 @@ export = {
     }));
 
     // THEN
-    test.deepEqual(userData[1], '/etc/eks/bootstrap.sh my-cluster-name --kubelet-extra-args "--node-labels lifecycle=OnDemand" --use-max-pods false');
-    test.done();
-  },
+    expect(userData[1]).toEqual('/etc/eks/bootstrap.sh my-cluster-name --kubelet-extra-args "--node-labels lifecycle=OnDemand" --use-max-pods false');
+
+  });
 
-  '--aws-api-retry-attempts'(test: Test) {
+  test('--aws-api-retry-attempts', () => {
     // GIVEN
     const { asg, stack } = newFixtures();
 
@@ -62,11 +61,11 @@ export = {
     }));
 
     // THEN
-    test.deepEqual(userData[1], '/etc/eks/bootstrap.sh my-cluster-name --kubelet-extra-args "--node-labels lifecycle=OnDemand" --use-max-pods true --aws-api-retry-attempts 123');
-    test.done();
-  },
+    expect(userData[1]).toEqual('/etc/eks/bootstrap.sh my-cluster-name --kubelet-extra-args "--node-labels lifecycle=OnDemand" --use-max-pods true --aws-api-retry-attempts 123');
+
+  });
 
-  '--docker-config-json'(test: Test) {
+  test('--docker-config-json', () => {
     // GIVEN
     const { asg } = newFixtures();
 
@@ -76,11 +75,11 @@ export = {
     });
 
     // THEN
-    test.deepEqual(userData[1], '/etc/eks/bootstrap.sh my-cluster-name --kubelet-extra-args "--node-labels lifecycle=OnDemand" --use-max-pods true --docker-config-json \'{"docker":123}\'');
-    test.done();
-  },
+    expect(userData[1]).toEqual('/etc/eks/bootstrap.sh my-cluster-name --kubelet-extra-args "--node-labels lifecycle=OnDemand" --use-max-pods true --docker-config-json \'{"docker":123}\'');
+
+  });
 
-  '--enable-docker-bridge=true'(test: Test) {
+  test('--enable-docker-bridge=true', () => {
     // GIVEN
     const { asg, stack } = newFixtures();
 
@@ -90,11 +89,11 @@ export = {
     }));
 
     // THEN
-    test.deepEqual(userData[1], '/etc/eks/bootstrap.sh my-cluster-name --kubelet-extra-args "--node-labels lifecycle=OnDemand" --use-max-pods true --enable-docker-bridge');
-    test.done();
-  },
+    expect(userData[1]).toEqual('/etc/eks/bootstrap.sh my-cluster-name --kubelet-extra-args "--node-labels lifecycle=OnDemand" --use-max-pods true --enable-docker-bridge');
 
-  '--enable-docker-bridge=false'(test: Test) {
+  });
+
+  test('--enable-docker-bridge=false', () => {
     // GIVEN
     const { asg, stack } = newFixtures();
 
@@ -104,11 +103,11 @@ export = {
     }));
 
     // THEN
-    test.deepEqual(userData[1], '/etc/eks/bootstrap.sh my-cluster-name --kubelet-extra-args "--node-labels lifecycle=OnDemand" --use-max-pods true');
-    test.done();
-  },
+    expect(userData[1]).toEqual('/etc/eks/bootstrap.sh my-cluster-name --kubelet-extra-args "--node-labels lifecycle=OnDemand" --use-max-pods true');
 
-  '--kubelet-extra-args'(test: Test) {
+  });
+
+  test('--kubelet-extra-args', () => {
     // GIVEN
     const { asg, stack } = newFixtures();
 
@@ -118,11 +117,11 @@ export = {
     }));
 
     // THEN
-    test.deepEqual(userData[1], '/etc/eks/bootstrap.sh my-cluster-name --kubelet-extra-args "--node-labels lifecycle=OnDemand  --extra-args-for --kubelet" --use-max-pods true');
-    test.done();
-  },
+    expect(userData[1]).toEqual('/etc/eks/bootstrap.sh my-cluster-name --kubelet-extra-args "--node-labels lifecycle=OnDemand  --extra-args-for --kubelet" --use-max-pods true');
+
+  });
 
-  'arbitrary additional bootstrap arguments can be passed through "additionalArgs"'(test: Test) {
+  test('arbitrary additional bootstrap arguments can be passed through "additionalArgs"', () => {
     // GIVEN
     const { asg, stack } = newFixtures();
 
@@ -132,11 +131,11 @@ export = {
     }));
 
     // THEN
-    test.deepEqual(userData[1], '/etc/eks/bootstrap.sh my-cluster-name --kubelet-extra-args "--node-labels lifecycle=OnDemand" --use-max-pods true --apiserver-endpoint 1111 --foo-bar');
-    test.done();
-  },
+    expect(userData[1]).toEqual('/etc/eks/bootstrap.sh my-cluster-name --kubelet-extra-args "--node-labels lifecycle=OnDemand" --use-max-pods true --apiserver-endpoint 1111 --foo-bar');
+
+  });
 
-  'if asg has spot instances, the correct label and taint is used'(test: Test) {
+  test('if asg has spot instances, the correct label and taint is used', () => {
     // GIVEN
     const { asg, stack } = newFixtures(true);
 
@@ -146,10 +145,10 @@ export = {
     }));
 
     // THEN
-    test.deepEqual(userData[1], '/etc/eks/bootstrap.sh my-cluster-name --kubelet-extra-args "--node-labels lifecycle=Ec2Spot --register-with-taints=spotInstance=true:PreferNoSchedule --node-labels X=y" --use-max-pods true');
-    test.done();
-  },
-};
+    expect(userData[1]).toEqual('/etc/eks/bootstrap.sh my-cluster-name --kubelet-extra-args "--node-labels lifecycle=Ec2Spot --register-with-taints=spotInstance=true:PreferNoSchedule --node-labels X=y" --use-max-pods true');
+
+  });
+});
 
 function newFixtures(spot = false) {
   const app = new App();
diff --git a/packages/@aws-cdk/aws-events/.gitignore b/packages/@aws-cdk/aws-events/.gitignore
index dcc1dc41e477f..17a41566f0002 100644
--- a/packages/@aws-cdk/aws-events/.gitignore
+++ b/packages/@aws-cdk/aws-events/.gitignore
@@ -15,4 +15,5 @@ nyc.config.js
 *.snk
 !.eslintrc.js
 
-junit.xml
\ No newline at end of file
+junit.xml
+!jest.config.js
\ No newline at end of file
diff --git a/packages/@aws-cdk/aws-events/.npmignore b/packages/@aws-cdk/aws-events/.npmignore
index 9a032ae80868c..e8acf10a468a1 100644
--- a/packages/@aws-cdk/aws-events/.npmignore
+++ b/packages/@aws-cdk/aws-events/.npmignore
@@ -24,4 +24,5 @@ tsconfig.json
 **/cdk.out
 junit.xml
 test/
-!*.lit.ts
\ No newline at end of file
+!*.lit.ts
+jest.config.js
\ No newline at end of file
diff --git a/packages/@aws-cdk/aws-events/jest.config.js b/packages/@aws-cdk/aws-events/jest.config.js
new file mode 100644
index 0000000000000..cd664e1d069e5
--- /dev/null
+++ b/packages/@aws-cdk/aws-events/jest.config.js
@@ -0,0 +1,2 @@
+const baseConfig = require('../../../tools/cdk-build-tools/config/jest.config');
+module.exports = baseConfig;
diff --git a/packages/@aws-cdk/aws-events/package.json b/packages/@aws-cdk/aws-events/package.json
index 2d962235e0227..cf480c87c1dfe 100644
--- a/packages/@aws-cdk/aws-events/package.json
+++ b/packages/@aws-cdk/aws-events/package.json
@@ -55,6 +55,7 @@
   },
   "cdk-build": {
     "cloudformation": "AWS::Events",
+    "jest": true,
     "env": {
       "AWSLINT_BASE_CONSTRUCT": "true"
     }
@@ -74,10 +75,11 @@
   },
   "license": "Apache-2.0",
   "devDependencies": {
+    "@types/jest": "^26.0.24",
     "@types/nodeunit": "^0.0.32",
     "cdk-build-tools": "0.0.0",
     "cfn2ts": "0.0.0",
-    "nodeunit": "^0.11.3",
+    "jest": "^26.6.3",
     "pkglint": "0.0.0",
     "@aws-cdk/assert-internal": "0.0.0"
   },
diff --git a/packages/@aws-cdk/aws-events/test/test.archive.ts b/packages/@aws-cdk/aws-events/test/archive.test.ts
similarity index 69%
rename from packages/@aws-cdk/aws-events/test/test.archive.ts
rename to packages/@aws-cdk/aws-events/test/archive.test.ts
index 84c9d12222e42..0c37a0ec4ae39 100644
--- a/packages/@aws-cdk/aws-events/test/test.archive.ts
+++ b/packages/@aws-cdk/aws-events/test/archive.test.ts
@@ -1,11 +1,10 @@
-import { expect, haveResource } from '@aws-cdk/assert-internal';
+import '@aws-cdk/assert-internal/jest';
 import { Duration, Stack } from '@aws-cdk/core';
-import { Test } from 'nodeunit';
 import { EventBus } from '../lib';
 import { Archive } from '../lib/archive';
 
-export = {
-  'creates an archive for an EventBus'(test: Test) {
+describe('archive', () => {
+  test('creates an archive for an EventBus', () => {
     // GIVEN
     const stack = new Stack();
 
@@ -21,11 +20,11 @@ export = {
     });
 
     // THEN
-    expect(stack).to(haveResource('AWS::Events::EventBus', {
+    expect(stack).toHaveResource('AWS::Events::EventBus', {
       Name: 'Bus',
-    }));
+    });
 
-    expect(stack).to(haveResource('AWS::Events::Archive', {
+    expect(stack).toHaveResource('AWS::Events::Archive', {
       EventPattern: {
         account: [{
           Ref: 'AWS::AccountId',
@@ -38,11 +37,11 @@ export = {
           'Arn',
         ],
       },
-    }));
+    });
+
 
-    test.done();
-  },
-  'creates an archive for an EventBus with a pattern including a detailType property'(test: Test) {
+  });
+  test('creates an archive for an EventBus with a pattern including a detailType property', () => {
     // GIVEN
     const stack = new Stack();
 
@@ -59,11 +58,11 @@ export = {
     });
 
     // THEN
-    expect(stack).to(haveResource('AWS::Events::EventBus', {
+    expect(stack).toHaveResource('AWS::Events::EventBus', {
       Name: 'Bus',
-    }));
+    });
 
-    expect(stack).to(haveResource('AWS::Events::Archive', {
+    expect(stack).toHaveResource('AWS::Events::Archive', {
       EventPattern: {
         'account': [{
           Ref: 'AWS::AccountId',
@@ -77,8 +76,8 @@ export = {
           'Arn',
         ],
       },
-    }));
+    });
+
 
-    test.done();
-  },
-}
+  });
+});
diff --git a/packages/@aws-cdk/aws-events/test/test.event-bus.ts b/packages/@aws-cdk/aws-events/test/event-bus.test.ts
similarity index 71%
rename from packages/@aws-cdk/aws-events/test/test.event-bus.ts
rename to packages/@aws-cdk/aws-events/test/event-bus.test.ts
index 9dea3faab34f6..b4384255ea7b4 100644
--- a/packages/@aws-cdk/aws-events/test/test.event-bus.ts
+++ b/packages/@aws-cdk/aws-events/test/event-bus.test.ts
@@ -1,11 +1,10 @@
-import { expect, haveResource } from '@aws-cdk/assert-internal';
+import '@aws-cdk/assert-internal/jest';
 import * as iam from '@aws-cdk/aws-iam';
 import { Aws, CfnResource, Stack, Arn } from '@aws-cdk/core';
-import { Test } from 'nodeunit';
 import { EventBus } from '../lib';
 
-export = {
-  'default event bus'(test: Test) {
+describe('event bus', () => {
+  test('default event bus', () => {
     // GIVEN
     const stack = new Stack();
 
@@ -13,14 +12,14 @@ export = {
     new EventBus(stack, 'Bus');
 
     // THEN
-    expect(stack).to(haveResource('AWS::Events::EventBus', {
+    expect(stack).toHaveResource('AWS::Events::EventBus', {
       Name: 'Bus',
-    }));
+    });
+
 
-    test.done();
-  },
+  });
 
-  'named event bus'(test: Test) {
+  test('named event bus', () => {
     // GIVEN
     const stack = new Stack();
 
@@ -30,14 +29,14 @@ export = {
     });
 
     // THEN
-    expect(stack).to(haveResource('AWS::Events::EventBus', {
+    expect(stack).toHaveResource('AWS::Events::EventBus', {
       Name: 'myEventBus',
-    }));
+    });
 
-    test.done();
-  },
 
-  'partner event bus'(test: Test) {
+  });
+
+  test('partner event bus', () => {
     // GIVEN
     const stack = new Stack();
 
@@ -47,15 +46,15 @@ export = {
     });
 
     // THEN
-    expect(stack).to(haveResource('AWS::Events::EventBus', {
+    expect(stack).toHaveResource('AWS::Events::EventBus', {
       Name: 'aws.partner/PartnerName/acct1/repo1',
       EventSourceName: 'aws.partner/PartnerName/acct1/repo1',
-    }));
+    });
 
-    test.done();
-  },
 
-  'imported event bus'(test: Test) {
+  });
+
+  test('imported event bus', () => {
     const stack = new Stack();
 
     const eventBus = new EventBus(stack, 'Bus');
@@ -71,15 +70,15 @@ export = {
       },
     });
 
-    expect(stack).to(haveResource('Test::Resource', {
+    expect(stack).toHaveResource('Test::Resource', {
       EventBusArn1: { 'Fn::GetAtt': ['BusEA82B648', 'Arn'] },
       EventBusArn2: { 'Fn::GetAtt': ['BusEA82B648', 'Arn'] },
-    }));
+    });
 
-    test.done();
-  },
 
-  'imported event bus from name'(test: Test) {
+  });
+
+  test('imported event bus from name', () => {
     const stack = new Stack();
 
     const eventBus = new EventBus(stack, 'Bus', { eventBusName: 'test-bus-to-import-by-name' });
@@ -87,12 +86,12 @@ export = {
     const importEB = EventBus.fromEventBusName(stack, 'ImportBus', eventBus.eventBusName);
 
     // WHEN
-    test.deepEqual(stack.resolve(eventBus.eventBusName), stack.resolve(importEB.eventBusName));
+    expect(stack.resolve(eventBus.eventBusName)).toEqual(stack.resolve(importEB.eventBusName));
+
 
-    test.done();
-  },
+  });
 
-  'same account imported event bus has right resource env'(test: Test) {
+  test('same account imported event bus has right resource env', () => {
     const stack = new Stack();
 
     const eventBus = new EventBus(stack, 'Bus');
@@ -100,13 +99,13 @@ export = {
     const importEB = EventBus.fromEventBusArn(stack, 'ImportBus', eventBus.eventBusArn);
 
     // WHEN
-    test.deepEqual(stack.resolve(importEB.env.account), { 'Fn::Select': [4, { 'Fn::Split': [':', { 'Fn::GetAtt': ['BusEA82B648', 'Arn'] }] }] });
-    test.deepEqual(stack.resolve(importEB.env.region), { 'Fn::Select': [3, { 'Fn::Split': [':', { 'Fn::GetAtt': ['BusEA82B648', 'Arn'] }] }] });
+    expect(stack.resolve(importEB.env.account)).toEqual({ 'Fn::Select': [4, { 'Fn::Split': [':', { 'Fn::GetAtt': ['BusEA82B648', 'Arn'] }] }] });
+    expect(stack.resolve(importEB.env.region)).toEqual({ 'Fn::Select': [3, { 'Fn::Split': [':', { 'Fn::GetAtt': ['BusEA82B648', 'Arn'] }] }] });
 
-    test.done();
-  },
 
-  'cross account imported event bus has right resource env'(test: Test) {
+  });
+
+  test('cross account imported event bus has right resource env', () => {
     const stack = new Stack();
 
     const arnParts = {
@@ -121,13 +120,13 @@ export = {
     const importEB = EventBus.fromEventBusArn(stack, 'ImportBus', arn);
 
     // WHEN
-    test.deepEqual(importEB.env.account, arnParts.account);
-    test.deepEqual(importEB.env.region, arnParts.region);
+    expect(importEB.env.account).toEqual(arnParts.account);
+    expect(importEB.env.region).toEqual(arnParts.region);
+
 
-    test.done();
-  },
+  });
 
-  'can get bus name'(test: Test) {
+  test('can get bus name', () => {
     // GIVEN
     const stack = new Stack();
     const bus = new EventBus(stack, 'Bus', {
@@ -143,14 +142,14 @@ export = {
     });
 
     // THEN
-    expect(stack).to(haveResource('Test::Resource', {
+    expect(stack).toHaveResource('Test::Resource', {
       EventBusName: { Ref: 'BusEA82B648' },
-    }));
+    });
+
 
-    test.done();
-  },
+  });
 
-  'can get bus arn'(test: Test) {
+  test('can get bus arn', () => {
     // GIVEN
     const stack = new Stack();
     const bus = new EventBus(stack, 'Bus', {
@@ -166,14 +165,14 @@ export = {
     });
 
     // THEN
-    expect(stack).to(haveResource('Test::Resource', {
+    expect(stack).toHaveResource('Test::Resource', {
       EventBusArn: { 'Fn::GetAtt': ['BusEA82B648', 'Arn'] },
-    }));
+    });
+
 
-    test.done();
-  },
+  });
 
-  'event bus name cannot be default'(test: Test) {
+  test('event bus name cannot be default', () => {
     // GIVEN
     const stack = new Stack();
 
@@ -183,14 +182,14 @@ export = {
     });
 
     // THEN
-    test.throws(() => {
+    expect(() => {
       createInvalidBus();
-    }, /'eventBusName' must not be 'default'/);
+    }).toThrow(/'eventBusName' must not be 'default'/);
 
-    test.done();
-  },
 
-  'event bus name cannot contain slash'(test: Test) {
+  });
+
+  test('event bus name cannot contain slash', () => {
     // GIVEN
     const stack = new Stack();
 
@@ -200,14 +199,14 @@ export = {
     });
 
     // THEN
-    test.throws(() => {
+    expect(() => {
       createInvalidBus();
-    }, /'eventBusName' must not contain '\/'/);
+    }).toThrow(/'eventBusName' must not contain '\/'/);
+
 
-    test.done();
-  },
+  });
 
-  'event bus cannot have name and source name'(test: Test) {
+  test('event bus cannot have name and source name', () => {
     // GIVEN
     const stack = new Stack();
 
@@ -218,14 +217,14 @@ export = {
     });
 
     // THEN
-    test.throws(() => {
+    expect(() => {
       createInvalidBus();
-    }, /'eventBusName' and 'eventSourceName' cannot both be provided/);
+    }).toThrow(/'eventBusName' and 'eventSourceName' cannot both be provided/);
 
-    test.done();
-  },
 
-  'event bus name cannot be empty string'(test: Test) {
+  });
+
+  test('event bus name cannot be empty string', () => {
     // GIVEN
     const stack = new Stack();
 
@@ -235,26 +234,26 @@ export = {
     });
 
     // THEN
-    test.throws(() => {
+    expect(() => {
       createInvalidBus();
-    }, /'eventBusName' must satisfy: /);
+    }).toThrow(/'eventBusName' must satisfy: /);
+
 
-    test.done();
-  },
+  });
 
-  'does not throw if eventBusName is a token'(test: Test) {
+  test('does not throw if eventBusName is a token', () => {
     // GIVEN
     const stack = new Stack();
 
     // WHEN / THEN
-    test.doesNotThrow(() => new EventBus(stack, 'EventBus', {
+    expect(() => new EventBus(stack, 'EventBus', {
       eventBusName: Aws.STACK_NAME,
-    }));
+    })).not.toThrow();
+
 
-    test.done();
-  },
+  });
 
-  'event bus source name must follow pattern'(test: Test) {
+  test('event bus source name must follow pattern', () => {
     // GIVEN
     const stack = new Stack();
 
@@ -264,14 +263,14 @@ export = {
     });
 
     // THEN
-    test.throws(() => {
+    expect(() => {
       createInvalidBus();
-    }, /'eventSourceName' must satisfy: \/\^aws/);
+    }).toThrow(/'eventSourceName' must satisfy: \/\^aws/);
 
-    test.done();
-  },
 
-  'event bus source name cannot be empty string'(test: Test) {
+  });
+
+  test('event bus source name cannot be empty string', () => {
     // GIVEN
     const stack = new Stack();
 
@@ -281,14 +280,14 @@ export = {
     });
 
     // THEN
-    test.throws(() => {
+    expect(() => {
       createInvalidBus();
-    }, /'eventSourceName' must satisfy: /);
+    }).toThrow(/'eventSourceName' must satisfy: /);
+
 
-    test.done();
-  },
+  });
 
-  'can grant PutEvents'(test: Test) {
+  test('can grant PutEvents', () => {
     // GIVEN
     const stack = new Stack();
     const role = new iam.Role(stack, 'Role', {
@@ -299,7 +298,7 @@ export = {
     EventBus.grantPutEvents(role);
 
     // THEN
-    expect(stack).to(haveResource('AWS::IAM::Policy', {
+    expect(stack).toHaveResource('AWS::IAM::Policy', {
       PolicyDocument: {
         Statement: [
           {
@@ -315,12 +314,12 @@ export = {
           Ref: 'Role1ABCC5F0',
         },
       ],
-    }));
+    });
+
 
-    test.done();
-  },
+  });
 
-  'can grant PutEvents using grantAllPutEvents'(test: Test) {
+  test('can grant PutEvents using grantAllPutEvents', () => {
     // GIVEN
     const stack = new Stack();
     const role = new iam.Role(stack, 'Role', {
@@ -331,7 +330,7 @@ export = {
     EventBus.grantAllPutEvents(role);
 
     // THEN
-    expect(stack).to(haveResource('AWS::IAM::Policy', {
+    expect(stack).toHaveResource('AWS::IAM::Policy', {
       PolicyDocument: {
         Statement: [
           {
@@ -347,11 +346,11 @@ export = {
           Ref: 'Role1ABCC5F0',
         },
       ],
-    }));
+    });
+
 
-    test.done();
-  },
-  'can grant PutEvents to a specific event bus'(test: Test) {
+  });
+  test('can grant PutEvents to a specific event bus', () => {
     // GIVEN
     const stack = new Stack();
     const role = new iam.Role(stack, 'Role', {
@@ -364,7 +363,7 @@ export = {
     eventBus.grantPutEventsTo(role);
 
     // THEN
-    expect(stack).to(haveResource('AWS::IAM::Policy', {
+    expect(stack).toHaveResource('AWS::IAM::Policy', {
       PolicyDocument: {
         Statement: [
           {
@@ -385,11 +384,11 @@ export = {
           Ref: 'Role1ABCC5F0',
         },
       ],
-    }));
+    });
+
 
-    test.done();
-  },
-  'can archive events'(test: Test) {
+  });
+  test('can archive events', () => {
     // GIVEN
     const stack = new Stack();
 
@@ -404,11 +403,11 @@ export = {
     });
 
     // THEN
-    expect(stack).to(haveResource('AWS::Events::EventBus', {
+    expect(stack).toHaveResource('AWS::Events::EventBus', {
       Name: 'Bus',
-    }));
+    });
 
-    expect(stack).to(haveResource('AWS::Events::Archive', {
+    expect(stack).toHaveResource('AWS::Events::Archive', {
       SourceArn: {
         'Fn::GetAtt': [
           'BusEA82B648',
@@ -436,11 +435,11 @@ export = {
       },
       RetentionDays: 0,
       ArchiveName: 'MyArchive',
-    }));
+    });
 
-    test.done();
-  },
-  'can archive events from an imported EventBus'(test: Test) {
+
+  });
+  test('can archive events from an imported EventBus', () => {
     // GIVEN
     const stack = new Stack();
 
@@ -457,11 +456,11 @@ export = {
     });
 
     // THEN
-    expect(stack).to(haveResource('AWS::Events::EventBus', {
+    expect(stack).toHaveResource('AWS::Events::EventBus', {
       Name: 'Bus',
-    }));
+    });
 
-    expect(stack).to(haveResource('AWS::Events::Archive', {
+    expect(stack).toHaveResource('AWS::Events::Archive', {
       SourceArn: {
         'Fn::GetAtt': [
           'BusEA82B648',
@@ -512,8 +511,8 @@ export = {
       },
       RetentionDays: 0,
       ArchiveName: 'MyArchive',
-    }));
+    });
+
 
-    test.done();
-  },
-};
+  });
+});
diff --git a/packages/@aws-cdk/aws-events/test/test.input.ts b/packages/@aws-cdk/aws-events/test/input.test.ts
similarity index 78%
rename from packages/@aws-cdk/aws-events/test/test.input.ts
rename to packages/@aws-cdk/aws-events/test/input.test.ts
index 43c763ef35f74..76ec2cd2d2bd9 100644
--- a/packages/@aws-cdk/aws-events/test/test.input.ts
+++ b/packages/@aws-cdk/aws-events/test/input.test.ts
@@ -1,13 +1,12 @@
-import { expect, haveResourceLike } from '@aws-cdk/assert-internal';
+import '@aws-cdk/assert-internal/jest';
 import { User } from '@aws-cdk/aws-iam';
 import * as cdk from '@aws-cdk/core';
-import { Test } from 'nodeunit';
 import { EventField, IRuleTarget, RuleTargetInput, Schedule } from '../lib';
 import { Rule } from '../lib/rule';
 
-export = {
-  'json template': {
-    'can just be a JSON object'(test: Test) {
+describe('input', () => {
+  describe('json template', () => {
+    test('can just be a JSON object', () => {
       // GIVEN
       const stack = new cdk.Stack();
       const rule = new Rule(stack, 'Rule', {
@@ -18,17 +17,17 @@ export = {
       rule.addTarget(new SomeTarget(RuleTargetInput.fromObject({ SomeObject: 'withAValue' })));
 
       // THEN
-      expect(stack).to(haveResourceLike('AWS::Events::Rule', {
+      expect(stack).toHaveResourceLike('AWS::Events::Rule', {
         Targets: [
           {
             Input: '{"SomeObject":"withAValue"}',
           },
         ],
-      }));
-      test.done();
-    },
+      });
+
+    });
 
-    'can use joined JSON containing refs in JSON object'(test: Test) {
+    test('can use joined JSON containing refs in JSON object', () => {
       // GIVEN
       const stack = new cdk.Stack();
       const rule = new Rule(stack, 'Rule', {
@@ -42,7 +41,7 @@ export = {
       })));
 
       // THEN
-      expect(stack).to(haveResourceLike('AWS::Events::Rule', {
+      expect(stack).toHaveResourceLike('AWS::Events::Rule', {
         Targets: [
           {
             InputTransformer: {
@@ -62,12 +61,12 @@ export = {
             },
           },
         ],
-      }));
+      });
 
-      test.done();
-    },
 
-    'can use joined JSON containing refs in JSON object with tricky inputs'(test: Test) {
+    });
+
+    test('can use joined JSON containing refs in JSON object with tricky inputs', () => {
       // GIVEN
       const stack = new cdk.Stack();
       const rule = new Rule(stack, 'Rule', {
@@ -81,7 +80,7 @@ export = {
       })));
 
       // THEN
-      expect(stack).to(haveResourceLike('AWS::Events::Rule', {
+      expect(stack).toHaveResourceLike('AWS::Events::Rule', {
         Targets: [
           {
             InputTransformer: {
@@ -101,12 +100,12 @@ export = {
             },
           },
         ],
-      }));
+      });
 
-      test.done();
-    },
 
-    'can use joined JSON containing refs in JSON object and concat'(test: Test) {
+    });
+
+    test('can use joined JSON containing refs in JSON object and concat', () => {
       // GIVEN
       const stack = new cdk.Stack();
       const rule = new Rule(stack, 'Rule', {
@@ -120,7 +119,7 @@ export = {
       })));
 
       // THEN
-      expect(stack).to(haveResourceLike('AWS::Events::Rule', {
+      expect(stack).toHaveResourceLike('AWS::Events::Rule', {
         Targets: [
           {
             InputTransformer: {
@@ -140,12 +139,12 @@ export = {
             },
           },
         ],
-      }));
+      });
+
 
-      test.done();
-    },
+    });
 
-    'can use joined JSON containing refs in JSON object and quotes'(test: Test) {
+    test('can use joined JSON containing refs in JSON object and quotes', () => {
       // GIVEN
       const stack = new cdk.Stack();
       const rule = new Rule(stack, 'Rule', {
@@ -159,7 +158,7 @@ export = {
       })));
 
       // THEN
-      expect(stack).to(haveResourceLike('AWS::Events::Rule', {
+      expect(stack).toHaveResourceLike('AWS::Events::Rule', {
         Targets: [
           {
             InputTransformer: {
@@ -179,12 +178,12 @@ export = {
             },
           },
         ],
-      }));
+      });
+
 
-      test.done();
-    },
+    });
 
-    'can use joined JSON containing refs in JSON object and multiple keys'(test: Test) {
+    test('can use joined JSON containing refs in JSON object and multiple keys', () => {
       // GIVEN
       const stack = new cdk.Stack();
       const rule = new Rule(stack, 'Rule', {
@@ -198,7 +197,7 @@ export = {
       })));
 
       // THEN
-      expect(stack).to(haveResourceLike('AWS::Events::Rule', {
+      expect(stack).toHaveResourceLike('AWS::Events::Rule', {
         Targets: [
           {
             InputTransformer: {
@@ -218,12 +217,12 @@ export = {
             },
           },
         ],
-      }));
+      });
+
 
-      test.done();
-    },
+    });
 
-    'can use token'(test: Test) {
+    test('can use token', () => {
       // GIVEN
       const stack = new cdk.Stack();
       const rule = new Rule(stack, 'Rule', {
@@ -235,7 +234,7 @@ export = {
       rule.addTarget(new SomeTarget(RuleTargetInput.fromObject({ userArn: user.userArn })));
 
       // THEN
-      expect(stack).to(haveResourceLike('AWS::Events::Rule', {
+      expect(stack).toHaveResourceLike('AWS::Events::Rule', {
         Targets: [
           {
             Input: {
@@ -255,13 +254,13 @@ export = {
             },
           },
         ],
-      }));
-      test.done();
-    },
-  },
+      });
 
-  'text templates': {
-    'strings with newlines are serialized to a newline-delimited list of JSON strings'(test: Test) {
+    });
+  });
+
+  describe('text templates', () => {
+    test('strings with newlines are serialized to a newline-delimited list of JSON strings', () => {
       // GIVEN
       const stack = new cdk.Stack();
       const rule = new Rule(stack, 'Rule', {
@@ -272,18 +271,18 @@ export = {
       rule.addTarget(new SomeTarget(RuleTargetInput.fromMultilineText('I have\nmultiple lines')));
 
       // THEN
-      expect(stack).to(haveResourceLike('AWS::Events::Rule', {
+      expect(stack).toHaveResourceLike('AWS::Events::Rule', {
         Targets: [
           {
             Input: '"I have"\n"multiple lines"',
           },
         ],
-      }));
+      });
 
-      test.done();
-    },
 
-    'escaped newlines are not interpreted as newlines'(test: Test) {
+    });
+
+    test('escaped newlines are not interpreted as newlines', () => {
       // GIVEN
       const stack = new cdk.Stack();
       const rule = new Rule(stack, 'Rule', {
@@ -294,18 +293,18 @@ export = {
       rule.addTarget(new SomeTarget(RuleTargetInput.fromMultilineText('this is not\\na real newline'))),
 
       // THEN
-      expect(stack).to(haveResourceLike('AWS::Events::Rule', {
+      expect(stack).toHaveResourceLike('AWS::Events::Rule', {
         Targets: [
           {
             Input: '"this is not\\\\na real newline"',
           },
         ],
-      }));
+      });
+
 
-      test.done();
-    },
+    });
 
-    'can use Tokens in text templates'(test: Test) {
+    test('can use Tokens in text templates', () => {
       // GIVEN
       const stack = new cdk.Stack();
       const rule = new Rule(stack, 'Rule', {
@@ -318,18 +317,18 @@ export = {
       rule.addTarget(new SomeTarget(RuleTargetInput.fromText(`hello ${world}`)));
 
       // THEN
-      expect(stack).to(haveResourceLike('AWS::Events::Rule', {
+      expect(stack).toHaveResourceLike('AWS::Events::Rule', {
         Targets: [
           {
             Input: '"hello world"',
           },
         ],
-      }));
+      });
+
 
-      test.done();
-    },
-  },
-};
+    });
+  });
+});
 
 class SomeTarget implements IRuleTarget {
   public constructor(private readonly input: RuleTargetInput) {
diff --git a/packages/@aws-cdk/aws-events/test/test.rule.ts b/packages/@aws-cdk/aws-events/test/rule.test.ts
similarity index 79%
rename from packages/@aws-cdk/aws-events/test/test.rule.ts
rename to packages/@aws-cdk/aws-events/test/rule.test.ts
index b6ff7b62d86d4..5cc3b6c5f03e1 100644
--- a/packages/@aws-cdk/aws-events/test/test.rule.ts
+++ b/packages/@aws-cdk/aws-events/test/rule.test.ts
@@ -1,22 +1,21 @@
 /* eslint-disable object-curly-newline */
-import { expect, haveResource, haveResourceLike } from '@aws-cdk/assert-internal';
+import '@aws-cdk/assert-internal/jest';
 import * as iam from '@aws-cdk/aws-iam';
 import * as cdk from '@aws-cdk/core';
-import { Test } from 'nodeunit';
 import { EventBus, EventField, IRule, IRuleTarget, RuleTargetConfig, RuleTargetInput, Schedule } from '../lib';
 import { Rule } from '../lib/rule';
 
 /* eslint-disable quote-props */
 
-export = {
-  'default rule'(test: Test) {
+describe('rule', () => {
+  test('default rule', () => {
     const stack = new cdk.Stack();
 
     new Rule(stack, 'MyRule', {
       schedule: Schedule.rate(cdk.Duration.minutes(10)),
     });
 
-    expect(stack).toMatch({
+    expect(stack).toMatchTemplate({
       'Resources': {
         'MyRuleA44AB831': {
           'Type': 'AWS::Events::Rule',
@@ -27,10 +26,10 @@ export = {
         },
       },
     });
-    test.done();
-  },
 
-  'can get rule name'(test: Test) {
+  });
+
+  test('can get rule name', () => {
     const stack = new cdk.Stack();
     const rule = new Rule(stack, 'MyRule', {
       schedule: Schedule.rate(cdk.Duration.minutes(10)),
@@ -43,14 +42,14 @@ export = {
       },
     });
 
-    expect(stack).to(haveResource('Test::Resource', {
+    expect(stack).toHaveResource('Test::Resource', {
       RuleName: { Ref: 'MyRuleA44AB831' },
-    }));
+    });
 
-    test.done();
-  },
 
-  'get rate as token'(test: Test) {
+  });
+
+  test('get rate as token', () => {
     const app = new cdk.App();
     const stack = new cdk.Stack(app, 'MyScheduledStack');
     const lazyDuration = cdk.Duration.minutes(cdk.Lazy.number({ produce: () => 5 }));
@@ -61,29 +60,29 @@ export = {
     });
 
     // THEN
-    expect(stack).to(haveResourceLike('AWS::Events::Rule', {
+    expect(stack).toHaveResourceLike('AWS::Events::Rule', {
       'Name': 'rateInMinutes',
       'ScheduleExpression': 'rate(5 minutes)',
-    }));
+    });
 
-    test.done();
-  },
 
-  'Seconds is not an allowed value for Schedule rate'(test: Test) {
+  });
+
+  test('Seconds is not an allowed value for Schedule rate', () => {
     const lazyDuration = cdk.Duration.seconds(cdk.Lazy.number({ produce: () => 5 }));
-    test.throws(() => Schedule.rate(lazyDuration), /Allowed units for scheduling/i);
-    test.done();
-  },
+    expect(() => Schedule.rate(lazyDuration)).toThrow(/Allowed units for scheduling/i);
+
+  });
 
-  'Millis is not an allowed value for Schedule rate'(test: Test) {
+  test('Millis is not an allowed value for Schedule rate', () => {
     const lazyDuration = cdk.Duration.millis(cdk.Lazy.number({ produce: () => 5 }));
 
     // THEN
-    test.throws(() => Schedule.rate(lazyDuration), /Allowed units for scheduling/i);
-    test.done();
-  },
+    expect(() => Schedule.rate(lazyDuration)).toThrow(/Allowed units for scheduling/i);
 
-  'rule with physical name'(test: Test) {
+  });
+
+  test('rule with physical name', () => {
     // GIVEN
     const stack = new cdk.Stack();
 
@@ -94,14 +93,14 @@ export = {
     });
 
     // THEN
-    expect(stack).to(haveResource('AWS::Events::Rule', {
+    expect(stack).toHaveResource('AWS::Events::Rule', {
       Name: 'PhysicalName',
-    }));
+    });
 
-    test.done();
-  },
 
-  'eventPattern is rendered properly'(test: Test) {
+  });
+
+  test('eventPattern is rendered properly', () => {
     const stack = new cdk.Stack();
 
     new Rule(stack, 'MyRule', {
@@ -120,7 +119,7 @@ export = {
       },
     });
 
-    expect(stack).toMatch({
+    expect(stack).toMatchTemplate({
       'Resources': {
         'MyRuleA44AB831': {
           'Type': 'AWS::Events::Rule',
@@ -142,18 +141,18 @@ export = {
       },
     });
 
-    test.done();
-  },
 
-  'fails synthesis if neither eventPattern nor scheudleExpression are specified'(test: Test) {
+  });
+
+  test('fails synthesis if neither eventPattern nor scheudleExpression are specified', () => {
     const app = new cdk.App();
     const stack = new cdk.Stack(app, 'MyStack');
     new Rule(stack, 'Rule');
-    test.throws(() => app.synth(), /Either 'eventPattern' or 'schedule' must be defined/);
-    test.done();
-  },
+    expect(() => app.synth()).toThrow(/Either 'eventPattern' or 'schedule' must be defined/);
 
-  'addEventPattern can be used to add filters'(test: Test) {
+  });
+
+  test('addEventPattern can be used to add filters', () => {
     const stack = new cdk.Stack();
 
     const rule = new Rule(stack, 'MyRule');
@@ -174,7 +173,7 @@ export = {
       },
     });
 
-    expect(stack).toMatch({
+    expect(stack).toMatchTemplate({
       'Resources': {
         'MyRuleA44AB831': {
           'Type': 'AWS::Events::Rule',
@@ -203,10 +202,10 @@ export = {
         },
       },
     });
-    test.done();
-  },
 
-  'addEventPattern can de-duplicate filters and keep the order'(test: Test) {
+  });
+
+  test('addEventPattern can de-duplicate filters and keep the order', () => {
     const stack = new cdk.Stack();
 
     const rule = new Rule(stack, 'MyRule');
@@ -218,7 +217,7 @@ export = {
       detailType: ['EC2 Instance State-change Notification', 'AWS API Call via CloudTrail'],
     });
 
-    expect(stack).toMatch({
+    expect(stack).toMatchTemplate({
       'Resources': {
         'MyRuleA44AB831': {
           'Type': 'AWS::Events::Rule',
@@ -234,10 +233,10 @@ export = {
         },
       },
     });
-    test.done();
-  },
 
-  'targets can be added via props or addTarget with input transformer'(test: Test) {
+  });
+
+  test('targets can be added via props or addTarget with input transformer', () => {
     const stack = new cdk.Stack();
     const t1: IRuleTarget = {
       bind: () => ({
@@ -262,7 +261,7 @@ export = {
 
     rule.addTarget(t2);
 
-    expect(stack).toMatch({
+    expect(stack).toMatchTemplate({
       'Resources': {
         'EventRule5A491D2C': {
           'Type': 'AWS::Events::Rule',
@@ -292,10 +291,10 @@ export = {
         },
       },
     });
-    test.done();
-  },
 
-  'input template can contain tokens'(test: Test) {
+  });
+
+  test('input template can contain tokens', () => {
     const stack = new cdk.Stack();
 
     const rule = new Rule(stack, 'EventRule', {
@@ -338,7 +337,7 @@ export = {
       }),
     });
 
-    expect(stack).toMatch({
+    expect(stack).toMatchTemplate({
       'Resources': {
         'EventRule5A491D2C': {
           'Type': 'AWS::Events::Rule',
@@ -380,10 +379,10 @@ export = {
       },
     });
 
-    test.done();
-  },
 
-  'target can declare role which will be used'(test: Test) {
+  });
+
+  test('target can declare role which will be used', () => {
     // GIVEN
     const stack = new cdk.Stack();
 
@@ -405,7 +404,7 @@ export = {
     });
 
     // THEN
-    expect(stack).to(haveResourceLike('AWS::Events::Rule', {
+    expect(stack).toHaveResourceLike('AWS::Events::Rule', {
       'Targets': [
         {
           'Arn': 'ARN2',
@@ -413,12 +412,12 @@ export = {
           'RoleArn': { 'Fn::GetAtt': ['SomeRole6DDC54DD', 'Arn'] },
         },
       ],
-    }));
+    });
 
-    test.done();
-  },
 
-  'in cross-account scenario, target role is only used in target account'(test: Test) {
+  });
+
+  test('in cross-account scenario, target role is only used in target account', () => {
     // GIVEN
     const app = new cdk.App();
     const ruleStack = new cdk.Stack(app, 'RuleStack', { env: { account: '1234', region: 'us-east-1' } });
@@ -443,7 +442,7 @@ export = {
     });
 
     // THEN
-    expect(ruleStack).to(haveResourceLike('AWS::Events::Rule', {
+    expect(ruleStack).toHaveResourceLike('AWS::Events::Rule', {
       Targets: [
         {
           Arn: { 'Fn::Join': ['', [
@@ -453,8 +452,8 @@ export = {
           ]] },
         },
       ],
-    }));
-    expect(targetStack).to(haveResourceLike('AWS::Events::Rule', {
+    });
+    expect(targetStack).toHaveResourceLike('AWS::Events::Rule', {
       'Targets': [
         {
           'Arn': 'ARN2',
@@ -462,12 +461,12 @@ export = {
           'RoleArn': { 'Fn::GetAtt': ['SomeRole6DDC54DD', 'Arn'] },
         },
       ],
-    }));
+    });
+
 
-    test.done();
-  },
+  });
 
-  'asEventRuleTarget can use the ruleArn and a uniqueId of the rule'(test: Test) {
+  test('asEventRuleTarget can use the ruleArn and a uniqueId of the rule', () => {
     const stack = new cdk.Stack();
 
     let receivedRuleArn = 'FAIL';
@@ -489,12 +488,12 @@ export = {
     const rule = new Rule(stack, 'EventRule');
     rule.addTarget(t1);
 
-    test.deepEqual(stack.resolve(receivedRuleArn), stack.resolve(rule.ruleArn));
-    test.deepEqual(receivedRuleId, cdk.Names.uniqueId(rule));
-    test.done();
-  },
+    expect(stack.resolve(receivedRuleArn)).toEqual(stack.resolve(rule.ruleArn));
+    expect(receivedRuleId).toEqual(cdk.Names.uniqueId(rule));
 
-  'fromEventRuleArn'(test: Test) {
+  });
+
+  test('fromEventRuleArn', () => {
     // GIVEN
     const stack = new cdk.Stack();
 
@@ -502,12 +501,12 @@ export = {
     const importedRule = Rule.fromEventRuleArn(stack, 'ImportedRule', 'arn:aws:events:us-east-2:123456789012:rule/example');
 
     // THEN
-    test.deepEqual(importedRule.ruleArn, 'arn:aws:events:us-east-2:123456789012:rule/example');
-    test.deepEqual(importedRule.ruleName, 'example');
-    test.done();
-  },
+    expect(importedRule.ruleArn).toEqual('arn:aws:events:us-east-2:123456789012:rule/example');
+    expect(importedRule.ruleName).toEqual('example');
+
+  });
 
-  'rule can be disabled'(test: Test) {
+  test('rule can be disabled', () => {
     // GIVEN
     const stack = new cdk.Stack();
 
@@ -518,14 +517,14 @@ export = {
     });
 
     // THEN
-    expect(stack).to(haveResource('AWS::Events::Rule', {
+    expect(stack).toHaveResource('AWS::Events::Rule', {
       'State': 'DISABLED',
-    }));
+    });
+
 
-    test.done();
-  },
+  });
 
-  'can add multiple targets with the same id'(test: Test) {
+  test('can add multiple targets with the same id', () => {
     // GIVEN
     const stack = new cdk.Stack();
     const rule = new Rule(stack, 'Rule', {
@@ -536,7 +535,7 @@ export = {
     rule.addTarget(new SomeTarget());
 
     // THEN
-    expect(stack).to(haveResource('AWS::Events::Rule', {
+    expect(stack).toHaveResource('AWS::Events::Rule', {
       Targets: [
         {
           'Arn': 'ARN1',
@@ -553,12 +552,12 @@ export = {
           },
         },
       ],
-    }));
+    });
+
 
-    test.done();
-  },
+  });
 
-  'sqsParameters are generated when they are specified in target props'(test: Test) {
+  test('sqsParameters are generated when they are specified in target props', () => {
     const stack = new cdk.Stack();
     const t1: IRuleTarget = {
       bind: () => ({
@@ -573,7 +572,7 @@ export = {
       targets: [t1],
     });
 
-    expect(stack).to(haveResource('AWS::Events::Rule', {
+    expect(stack).toHaveResource('AWS::Events::Rule', {
       Targets: [
         {
           'Arn': 'ARN1',
@@ -583,11 +582,11 @@ export = {
           },
         },
       ],
-    }));
-    test.done();
-  },
+    });
+
+  });
 
-  'associate rule with event bus'(test: Test) {
+  test('associate rule with event bus', () => {
     // GIVEN
     const stack = new cdk.Stack();
     const eventBus = new EventBus(stack, 'EventBus');
@@ -601,30 +600,30 @@ export = {
     });
 
     // THEN
-    expect(stack).to(haveResource('AWS::Events::Rule', {
+    expect(stack).toHaveResource('AWS::Events::Rule', {
       EventBusName: {
         Ref: 'EventBus7B8748AA',
       },
-    }));
+    });
+
 
-    test.done();
-  },
+  });
 
-  'throws with eventBus and schedule'(test: Test) {
+  test('throws with eventBus and schedule', () => {
     // GIVEN
     const app = new cdk.App();
     const stack = new cdk.Stack(app, 'MyStack');
     const eventBus = new EventBus(stack, 'EventBus');
 
     // THEN
-    test.throws(() => new Rule(stack, 'MyRule', {
+    expect(() => new Rule(stack, 'MyRule', {
       schedule: Schedule.rate(cdk.Duration.minutes(10)),
       eventBus,
-    }), /Cannot associate rule with 'eventBus' when using 'schedule'/);
-    test.done();
-  },
+    })).toThrow(/Cannot associate rule with 'eventBus' when using 'schedule'/);
 
-  'allow an imported target if is in the same account and region'(test: Test) {
+  });
+
+  test('allow an imported target if is in the same account and region', () => {
     const app = new cdk.App();
 
     const sourceAccount = '123456789012';
@@ -640,7 +639,7 @@ export = {
 
     rule.addTarget(new SomeTarget('T', resource));
 
-    expect(sourceStack).to(haveResource('AWS::Events::Rule', {
+    expect(sourceStack).toHaveResource('AWS::Events::Rule', {
       Targets: [
         {
           'Arn': 'ARN1',
@@ -650,13 +649,13 @@ export = {
           },
         },
       ],
-    }));
+    });
 
-    test.done();
-  },
 
-  'for cross-account and/or cross-region targets': {
-    'requires that the source stack specify a concrete account'(test: Test) {
+  });
+
+  describe('for cross-account and/or cross-region targets', () => {
+    test('requires that the source stack specify a concrete account', () => {
       const app = new cdk.App();
 
       const sourceStack = new cdk.Stack(app, 'SourceStack');
@@ -666,14 +665,14 @@ export = {
       const targetStack = new cdk.Stack(app, 'TargetStack', { env: { account: targetAccount } });
       const resource = new cdk.Construct(targetStack, 'Resource');
 
-      test.throws(() => {
+      expect(() => {
         rule.addTarget(new SomeTarget('T', resource));
-      }, /You need to provide a concrete region/);
+      }).toThrow(/You need to provide a concrete region/);
+
 
-      test.done();
-    },
+    });
 
-    'requires that the target stack specify a concrete account'(test: Test) {
+    test('requires that the target stack specify a concrete account', () => {
       const app = new cdk.App();
 
       const sourceAccount = '123456789012';
@@ -683,14 +682,14 @@ export = {
       const targetStack = new cdk.Stack(app, 'TargetStack');
       const resource = new cdk.Construct(targetStack, 'Resource');
 
-      test.throws(() => {
+      expect(() => {
         rule.addTarget(new SomeTarget('T', resource));
-      }, /You need to provide a concrete account for the target stack when using cross-account or cross-region events/);
+      }).toThrow(/You need to provide a concrete account for the target stack when using cross-account or cross-region events/);
+
 
-      test.done();
-    },
+    });
 
-    'requires that the target stack specify a concrete region'(test: Test) {
+    test('requires that the target stack specify a concrete region', () => {
       const app = new cdk.App();
 
       const sourceAccount = '123456789012';
@@ -701,14 +700,14 @@ export = {
       const targetStack = new cdk.Stack(app, 'TargetStack', { env: { account: targetAccount } });
       const resource = new cdk.Construct(targetStack, 'Resource');
 
-      test.throws(() => {
+      expect(() => {
         rule.addTarget(new SomeTarget('T', resource));
-      }, /You need to provide a concrete region for the target stack when using cross-account or cross-region events/);
+      }).toThrow(/You need to provide a concrete region for the target stack when using cross-account or cross-region events/);
+
 
-      test.done();
-    },
+    });
 
-    'creates cross-account targets if in the same region'(test: Test) {
+    test('creates cross-account targets if in the same region', () => {
       const app = new cdk.App();
 
       const sourceAccount = '123456789012';
@@ -727,7 +726,7 @@ export = {
 
       rule.addTarget(new SomeTarget('T', resource));
 
-      expect(sourceStack).to(haveResourceLike('AWS::Events::Rule', {
+      expect(sourceStack).toHaveResourceLike('AWS::Events::Rule', {
         'State': 'ENABLED',
         'Targets': [
           {
@@ -744,9 +743,9 @@ export = {
             },
           },
         ],
-      }));
+      });
 
-      expect(targetStack).to(haveResource('AWS::Events::Rule', {
+      expect(targetStack).toHaveResource('AWS::Events::Rule', {
         Targets: [
           {
             'Arn': 'ARN1',
@@ -756,12 +755,12 @@ export = {
             },
           },
         ],
-      }));
+      });
+
 
-      test.done();
-    },
+    });
 
-    'creates cross-region targets'(test: Test) {
+    test('creates cross-region targets', () => {
       const app = new cdk.App();
 
       const sourceAccount = '123456789012';
@@ -780,7 +779,7 @@ export = {
 
       rule.addTarget(new SomeTarget('T', resource));
 
-      expect(sourceStack).to(haveResourceLike('AWS::Events::Rule', {
+      expect(sourceStack).toHaveResourceLike('AWS::Events::Rule', {
         'State': 'ENABLED',
         'Targets': [
           {
@@ -797,9 +796,9 @@ export = {
             },
           },
         ],
-      }));
+      });
 
-      expect(targetStack).to(haveResource('AWS::Events::Rule', {
+      expect(targetStack).toHaveResource('AWS::Events::Rule', {
         Targets: [
           {
             'Arn': 'ARN1',
@@ -809,12 +808,12 @@ export = {
             },
           },
         ],
-      }));
+      });
+
 
-      test.done();
-    },
+    });
 
-    'do not create duplicated targets'(test: Test) {
+    test('do not create duplicated targets', () => {
       const app = new cdk.App();
 
       const sourceAccount = '123456789012';
@@ -835,7 +834,7 @@ export = {
       // same target should be skipped
       rule.addTarget(new SomeTarget('T1', resource));
 
-      expect(sourceStack).to(haveResourceLike('AWS::Events::Rule', {
+      expect(sourceStack).toHaveResourceLike('AWS::Events::Rule', {
         'State': 'ENABLED',
         'Targets': [
           {
@@ -852,9 +851,9 @@ export = {
             },
           },
         ],
-      }));
+      });
 
-      expect(sourceStack).notTo(haveResourceLike('AWS::Events::Rule', {
+      expect(sourceStack).not.toHaveResourceLike('AWS::Events::Rule', {
         'State': 'ENABLED',
         'Targets': [
           {
@@ -871,12 +870,12 @@ export = {
             },
           },
         ],
-      }));
+      });
+
 
-      test.done();
-    },
+    });
 
-    'requires that the target is not imported'(test: Test) {
+    test('requires that the target is not imported', () => {
       const app = new cdk.App();
 
       const sourceAccount = '123456789012';
@@ -891,14 +890,14 @@ export = {
       const targetAccount = '123456789012';
       const targetRegion = 'us-west-1';
       const resource = EventBus.fromEventBusArn(sourceStack, 'TargetEventBus', `arn:aws:events:${targetRegion}:${targetAccount}:event-bus/default`);
-      test.throws(() => {
+      expect(() => {
         rule.addTarget(new SomeTarget('T', resource));
-      }, /Cannot create a cross-account or cross-region rule for an imported resource/);
+      }).toThrow(/Cannot create a cross-account or cross-region rule for an imported resource/);
+
 
-      test.done();
-    },
+    });
 
-    'requires that the source and target stacks be part of the same App'(test: Test) {
+    test('requires that the source and target stacks be part of the same App', () => {
       const sourceApp = new cdk.App();
       const sourceAccount = '123456789012';
       const sourceStack = new cdk.Stack(sourceApp, 'SourceStack', { env: { account: sourceAccount, region: 'us-west-2' } });
@@ -909,14 +908,14 @@ export = {
       const targetStack = new cdk.Stack(targetApp, 'TargetStack', { env: { account: targetAccount, region: 'us-west-2' } });
       const resource = new cdk.Construct(targetStack, 'Resource');
 
-      test.throws(() => {
+      expect(() => {
         rule.addTarget(new SomeTarget('T', resource));
-      }, /Event stack and target stack must belong to the same CDK app/);
+      }).toThrow(/Event stack and target stack must belong to the same CDK app/);
+
 
-      test.done();
-    },
+    });
 
-    'generates the correct rules in the source and target stacks when eventPattern is passed in the constructor'(test: Test) {
+    test('generates the correct rules in the source and target stacks when eventPattern is passed in the constructor', () => {
       const app = new cdk.App();
 
       const sourceAccount = '123456789012';
@@ -945,7 +944,7 @@ export = {
       rule.addTarget(new SomeTarget('T1', resource1));
       rule.addTarget(new SomeTarget('T2', resource2));
 
-      expect(sourceStack).to(haveResourceLike('AWS::Events::Rule', {
+      expect(sourceStack).toHaveResourceLike('AWS::Events::Rule', {
         'EventPattern': {
           'source': [
             'some-event',
@@ -967,9 +966,9 @@ export = {
             },
           },
         ],
-      }));
+      });
 
-      expect(targetStack).to(haveResourceLike('AWS::Events::Rule', {
+      expect(targetStack).toHaveResourceLike('AWS::Events::Rule', {
         'EventPattern': {
           'source': [
             'some-event',
@@ -982,8 +981,8 @@ export = {
             'Arn': 'ARN1',
           },
         ],
-      }));
-      expect(targetStack).to(haveResourceLike('AWS::Events::Rule', {
+      });
+      expect(targetStack).toHaveResourceLike('AWS::Events::Rule', {
         'EventPattern': {
           'source': [
             'some-event',
@@ -996,19 +995,19 @@ export = {
             'Arn': 'ARN1',
           },
         ],
-      }));
+      });
 
       const eventBusPolicyStack = app.node.findChild(`EventBusPolicy-${sourceAccount}-us-west-2-${targetAccount}`) as cdk.Stack;
-      expect(eventBusPolicyStack).to(haveResourceLike('AWS::Events::EventBusPolicy', {
+      expect(eventBusPolicyStack).toHaveResourceLike('AWS::Events::EventBusPolicy', {
         'Action': 'events:PutEvents',
         'StatementId': `Allow-account-${sourceAccount}`,
         'Principal': sourceAccount,
-      }));
+      });
+
 
-      test.done();
-    },
+    });
 
-    'generates the correct rule in the target stack when addEventPattern in the source rule is used'(test: Test) {
+    test('generates the correct rule in the target stack when addEventPattern in the source rule is used', () => {
       const app = new cdk.App();
 
       const sourceAccount = '123456789012';
@@ -1035,7 +1034,7 @@ export = {
         source: ['some-event'],
       });
 
-      expect(targetStack).to(haveResourceLike('AWS::Events::Rule', {
+      expect(targetStack).toHaveResourceLike('AWS::Events::Rule', {
         'EventPattern': {
           'source': [
             'some-event',
@@ -1048,12 +1047,12 @@ export = {
             'Arn': 'ARN1',
           },
         ],
-      }));
+      });
 
-      test.done();
-    },
-  },
-};
+
+    });
+  });
+});
 
 class SomeTarget implements IRuleTarget {
   // eslint-disable-next-line cdk/no-core-construct
diff --git a/packages/@aws-cdk/aws-events/test/schedule.test.ts b/packages/@aws-cdk/aws-events/test/schedule.test.ts
new file mode 100644
index 0000000000000..d853da9ba6c30
--- /dev/null
+++ b/packages/@aws-cdk/aws-events/test/schedule.test.ts
@@ -0,0 +1,96 @@
+import { Duration, Stack, Lazy } from '@aws-cdk/core';
+import * as events from '../lib';
+
+describe('schedule', () => {
+  test('cron expressions day and dow are mutex: given weekday', () => {
+    // Run every 10 minutes Monday through Friday
+    expect('cron(0/10 * ? * MON-FRI *)').toEqual(events.Schedule.cron({
+      minute: '0/10',
+      weekDay: 'MON-FRI',
+    }).expressionString);
+
+  });
+
+  test('cron expressions day and dow are mutex: given month day', () => {
+    // Run at 8:00 am (UTC) every 1st day of the month
+    expect('cron(0 8 1 * ? *)').toEqual(events.Schedule.cron({
+      minute: '0',
+      hour: '8',
+      day: '1',
+    }).expressionString);
+
+  });
+
+  test('cron expressions day and dow are mutex: given neither', () => {
+    // Run at 10:00 am (UTC) every day
+    expect('cron(0 10 * * ? *)').toEqual(events.Schedule.cron({
+      minute: '0',
+      hour: '10',
+    }).expressionString);
+
+  });
+
+  test('rate must be whole number of minutes', () => {
+    expect(() => {
+      events.Schedule.rate(Duration.minutes(0.13456));
+    }).toThrow(/'0.13456 minutes' cannot be converted into a whole number of seconds/);
+
+  });
+
+  test('rate must be whole number', () => {
+    expect(() => {
+      events.Schedule.rate(Duration.minutes(1/8));
+    }).toThrow(/'0.125 minutes' cannot be converted into a whole number of seconds/);
+
+  });
+
+  test('rate cannot be 0', () => {
+    expect(() => {
+      events.Schedule.rate(Duration.days(0));
+    }).toThrow(/Duration cannot be 0/);
+
+  });
+
+  test('rate can be from a token', () => {
+    const stack = new Stack();
+    const lazyDuration = Duration.minutes(Lazy.number({ produce: () => 5 }));
+    const rate = events.Schedule.rate(lazyDuration);
+    expect('rate(5 minutes)').toEqual(stack.resolve(rate).expressionString);
+
+  });
+
+  test('rate can be in minutes', () => {
+    expect('rate(10 minutes)').toEqual(
+      events.Schedule.rate(Duration.minutes(10))
+        .expressionString);
+
+  });
+
+  test('rate can be in days', () => {
+    expect('rate(10 days)').toEqual(
+      events.Schedule.rate(Duration.days(10))
+        .expressionString);
+
+  });
+
+  test('rate can be in hours', () => {
+    expect('rate(10 hours)').toEqual(
+      events.Schedule.rate(Duration.hours(10))
+        .expressionString);
+
+  });
+
+  test('rate can be in seconds', () => {
+    expect('rate(2 minutes)').toEqual(
+      events.Schedule.rate(Duration.seconds(120))
+        .expressionString);
+
+  });
+
+  test('rate must not be in seconds when specified as a token', () => {
+    expect(() => {
+      events.Schedule.rate(Duration.seconds(Lazy.number({ produce: () => 5 })));
+    }).toThrow(/Allowed units for scheduling/);
+
+  });
+});
diff --git a/packages/@aws-cdk/aws-events/test/test.schedule.ts b/packages/@aws-cdk/aws-events/test/test.schedule.ts
deleted file mode 100644
index 2d9728e743202..0000000000000
--- a/packages/@aws-cdk/aws-events/test/test.schedule.ts
+++ /dev/null
@@ -1,97 +0,0 @@
-import { Duration, Stack, Lazy } from '@aws-cdk/core';
-import { Test } from 'nodeunit';
-import * as events from '../lib';
-
-export = {
-  'cron expressions day and dow are mutex: given weekday'(test: Test) {
-    // Run every 10 minutes Monday through Friday
-    test.equal('cron(0/10 * ? * MON-FRI *)', events.Schedule.cron({
-      minute: '0/10',
-      weekDay: 'MON-FRI',
-    }).expressionString);
-    test.done();
-  },
-
-  'cron expressions day and dow are mutex: given month day'(test: Test) {
-    // Run at 8:00 am (UTC) every 1st day of the month
-    test.equal('cron(0 8 1 * ? *)', events.Schedule.cron({
-      minute: '0',
-      hour: '8',
-      day: '1',
-    }).expressionString);
-    test.done();
-  },
-
-  'cron expressions day and dow are mutex: given neither'(test: Test) {
-    // Run at 10:00 am (UTC) every day
-    test.equal('cron(0 10 * * ? *)', events.Schedule.cron({
-      minute: '0',
-      hour: '10',
-    }).expressionString);
-    test.done();
-  },
-
-  'rate must be whole number of minutes'(test: Test) {
-    test.throws(() => {
-      events.Schedule.rate(Duration.minutes(0.13456));
-    }, /'0.13456 minutes' cannot be converted into a whole number of seconds/);
-    test.done();
-  },
-
-  'rate must be whole number'(test: Test) {
-    test.throws(() => {
-      events.Schedule.rate(Duration.minutes(1/8));
-    }, /'0.125 minutes' cannot be converted into a whole number of seconds/);
-    test.done();
-  },
-
-  'rate cannot be 0'(test: Test) {
-    test.throws(() => {
-      events.Schedule.rate(Duration.days(0));
-    }, /Duration cannot be 0/);
-    test.done();
-  },
-
-  'rate can be from a token'(test: Test) {
-    const stack = new Stack();
-    const lazyDuration = Duration.minutes(Lazy.number({ produce: () => 5 }));
-    const rate = events.Schedule.rate(lazyDuration);
-    test.equal('rate(5 minutes)', stack.resolve(rate).expressionString);
-    test.done();
-  },
-
-  'rate can be in minutes'(test: Test) {
-    test.equal('rate(10 minutes)',
-      events.Schedule.rate(Duration.minutes(10))
-        .expressionString);
-    test.done();
-  },
-
-  'rate can be in days'(test: Test) {
-    test.equal('rate(10 days)',
-      events.Schedule.rate(Duration.days(10))
-        .expressionString);
-    test.done();
-  },
-
-  'rate can be in hours'(test: Test) {
-    test.equal('rate(10 hours)',
-      events.Schedule.rate(Duration.hours(10))
-        .expressionString);
-    test.done();
-  },
-
-  'rate can be in seconds'(test: Test) {
-    test.equal('rate(2 minutes)',
-      events.Schedule.rate(Duration.seconds(120))
-        .expressionString);
-    test.done();
-  },
-
-  'rate must not be in seconds when specified as a token'(test: Test) {
-    test.throws(() => {
-      events.Schedule.rate(Duration.seconds(Lazy.number({ produce: () => 5 })));
-    }, /Allowed units for scheduling/);
-    test.done();
-  },
-};
diff --git a/packages/@aws-cdk/aws-events/test/test.util.ts b/packages/@aws-cdk/aws-events/test/util.test.ts
similarity index 53%
rename from packages/@aws-cdk/aws-events/test/test.util.ts
rename to packages/@aws-cdk/aws-events/test/util.test.ts
index 80cbe36ddbba4..eb354ca9c48a0 100644
--- a/packages/@aws-cdk/aws-events/test/test.util.ts
+++ b/packages/@aws-cdk/aws-events/test/util.test.ts
@@ -1,10 +1,9 @@
-import { Test } from 'nodeunit';
 import { mergeEventPattern } from '../lib/util';
 
-export = {
-  mergeEventPattern: {
-    'happy case'(test: Test) {
-      test.deepEqual(mergeEventPattern({
+describe('util', () => {
+  describe('mergeEventPattern', () => {
+    test('happy case', () => {
+      expect(mergeEventPattern({
         bar: [1, 2],
         hey: ['happy'],
         hello: {
@@ -16,7 +15,7 @@ export = {
         hello: {
           world: ['you'],
         },
-      }), {
+      })).toEqual({
         bar: [1, 2],
         hey: ['happy', 'day', 'today'],
         hello: {
@@ -24,25 +23,25 @@ export = {
           case: [1],
         },
       });
-      test.done();
-    },
 
-    'merge into an empty destination'(test: Test) {
-      test.deepEqual(mergeEventPattern(undefined, { foo: ['123'] }), { foo: [123] });
-      test.deepEqual(mergeEventPattern(undefined, { foo: { bar: ['123'] } }), { foo: { bar: [123] } });
-      test.deepEqual(mergeEventPattern({ }, { foo: { bar: ['123'] } }), { foo: { bar: [123] } });
-      test.done();
-    },
+    });
 
-    'fails if a field is not an array'(test: Test) {
-      test.throws(() => mergeEventPattern(undefined, 123), /Invalid event pattern '123', expecting an object or an array/);
-      test.throws(() => mergeEventPattern(undefined, 'Hello'), /Invalid event pattern '"Hello"', expecting an object or an array/);
-      test.throws(() => mergeEventPattern(undefined, { foo: '123' }), /Invalid event pattern field { foo: "123" }. All fields must be arrays/);
-      test.done();
-    },
+    test('merge into an empty destination', () => {
+      expect(mergeEventPattern(undefined, { foo: ['123'] })).toEqual({ foo: ['123'] });
+      expect(mergeEventPattern(undefined, { foo: { bar: ['123'] } })).toEqual({ foo: { bar: ['123'] } });
+      expect(mergeEventPattern({ }, { foo: { bar: ['123'] } })).toEqual({ foo: { bar: ['123'] } });
 
-    'fails if mismatch between dest and src'(test: Test) {
-      test.throws(() => mergeEventPattern({
+    });
+
+    test('fails if a field is not an array', () => {
+      expect(() => mergeEventPattern(undefined, 123)).toThrow(/Invalid event pattern '123', expecting an object or an array/);
+      expect(() => mergeEventPattern(undefined, 'Hello')).toThrow(/Invalid event pattern '"Hello"', expecting an object or an array/);
+      expect(() => mergeEventPattern(undefined, { foo: '123' })).toThrow(/Invalid event pattern field { foo: "123" }. All fields must be arrays/);
+
+    });
+
+    test('fails if mismatch between dest and src', () => {
+      expect(() => mergeEventPattern({
         obj: {
           array: [1],
         },
@@ -52,46 +51,46 @@ export = {
             value: ['hello'],
           },
         },
-      }), /Invalid event pattern field array. Type mismatch between existing pattern \[1\] and added pattern \{"value":\["hello"\]\}/);
-      test.done();
-    },
+      })).toThrow(/Invalid event pattern field array. Type mismatch between existing pattern \[1\] and added pattern \{"value":\["hello"\]\}/);
 
-    'deduplicate match values in pattern array'(test: Test) {
-      test.deepEqual(mergeEventPattern({
+    });
+
+    test('deduplicate match values in pattern array', () => {
+      expect(mergeEventPattern({
         'detail-type': ['AWS API Call via CloudTrail'],
       }, {
         'detail-type': ['AWS API Call via CloudTrail'],
-      }), {
+      })).toEqual({
         'detail-type': ['AWS API Call via CloudTrail'],
       });
-      test.deepEqual(mergeEventPattern({
+      expect(mergeEventPattern({
         time: [{ prefix: '2017-10-02' }],
       }, {
         time: [{ prefix: '2017-10-02' }, { prefix: '2017-10-03' }],
-      }), {
+      })).toEqual({
         time: [{ prefix: '2017-10-02' }, { prefix: '2017-10-03' }],
       });
-      test.deepEqual(mergeEventPattern({
+      expect(mergeEventPattern({
         'detail-type': ['AWS API Call via CloudTrail'],
         'time': [{ prefix: '2017-10-02' }],
       }, {
         'detail-type': ['AWS API Call via CloudTrail'],
         'time': [{ prefix: '2017-10-02' }, { prefix: '2017-10-03' }],
-      }), {
+      })).toEqual({
         'detail-type': ['AWS API Call via CloudTrail'],
         'time': [{ prefix: '2017-10-02' }, { prefix: '2017-10-03' }],
       });
-      test.deepEqual(mergeEventPattern({
+      expect(mergeEventPattern({
         'detail-type': ['AWS API Call via CloudTrail', 'AWS API Call via CloudTrail'],
         'time': [{ prefix: '2017-10-02' }],
       }, {
         'detail-type': ['AWS API Call via CloudTrail', 'AWS API Call via CloudTrail'],
         'time': [{ prefix: '2017-10-02' }, { prefix: '2017-10-03' }, { prefix: '2017-10-02' }],
-      }), {
+      })).toEqual({
         'detail-type': ['AWS API Call via CloudTrail'],
         'time': [{ prefix: '2017-10-02' }, { prefix: '2017-10-03' }],
       });
-      test.done();
-    },
-  },
-};
+
+    });
+  });
+});

From b60367526f0b962ed0466237a6e9db2b0931a50f Mon Sep 17 00:00:00 2001
From: Nick Lynch <nlynch@amazon.com>
Date: Tue, 31 Aug 2021 16:53:33 +0100
Subject: [PATCH 45/91] chore(cdk-release): support separate alpha Changelog
 (#16182)

This is part of the continued work to release the experimental modules as
independent alpha modules. This change introduces a new mode for handling
changes in the changelog: in this new mode, all changes from alpha modules are still
stripped from the main changelog (as they are currently for v2); those alpha module
changes are now also written to a dedicated changelog (e.g., `CHANGELOG.v2.alpha.md`).

related #15591

----

*By submitting this pull request, I confirm that my contribution is made under the terms of the Apache-2.0 license*
---
 scripts/bump.js                               |  12 +-
 scripts/resolve-version-lib.js                |  11 +-
 scripts/script-tests/resolve-version.test.js  |   5 +
 tools/cdk-release/lib/conventional-commits.ts |  58 +++----
 tools/cdk-release/lib/index.ts                |  39 +++--
 tools/cdk-release/lib/lifecycles/changelog.ts |  81 +++++++---
 tools/cdk-release/lib/types.ts                |  23 ++-
 tools/cdk-release/test/changelog.test.ts      | 146 ++++++++++++++++--
 .../test/conventional-commits.test.ts         |  88 +++++++----
 9 files changed, 357 insertions(+), 106 deletions(-)

diff --git a/scripts/bump.js b/scripts/bump.js
index b7e364bc0ab16..6078e04460a95 100755
--- a/scripts/bump.js
+++ b/scripts/bump.js
@@ -29,11 +29,6 @@ async function main() {
     }
   };
 
-  const majorVersion = semver.major(ver.version);
-  if (majorVersion > 1) {
-    opts.stripExperimentalChanges = true;
-  }
-
   const forTesting = process.env.BUMP_CANDIDATE || false;
   if (forTesting) {
     opts.skip.commit = true;
@@ -46,6 +41,8 @@ async function main() {
     console.error(`BUMP_CANDIDATE is set, so bumping version for testing (with the "${opts.prerelease}" prerelease tag)`);
   }
 
+  const majorVersion = semver.major(ver.version);
+
   const useLegacyBump = process.env.LEGACY_BUMP || false;
   if (useLegacyBump) {
     console.error("ℹ️ Using the third-party 'standard-version' package to perform the bump");
@@ -67,9 +64,14 @@ async function main() {
     // this is incredible, but passing this option to standard-version actually makes it crash!
     // good thing we're getting rid of it...
     opts.verbose = !!process.env.VERBOSE;
+    if (majorVersion > 1) {
+      // NOTE - Once we start publishing alpha modules independently, this needs to be flipped to 'separate'
+      opts.experimentalChangesTreatment = 'strip';
+    }
     // Rename some options to match cdk-release inputs (replaces bumpFiles, packageFiles, and infile)
     opts.versionFile = ver.versionFile;
     opts.changelogFile = ver.changelogFile;
+    opts.alphaChangelogFile = ver.alphaChangelogFile;
     console.error("🎉 Calling our 'cdk-release' package to make the bump");
     console.error("ℹ️ Set the LEGACY_BUMP env variable to use the old 'standard-version' bump instead");
     const cdkRelease = require('cdk-release');
diff --git a/scripts/resolve-version-lib.js b/scripts/resolve-version-lib.js
index 21a13c0eb4ab2..ec1f7b1b83822 100755
--- a/scripts/resolve-version-lib.js
+++ b/scripts/resolve-version-lib.js
@@ -51,21 +51,26 @@ function resolveVersion(rootdir) {
   }
 
   //
-  // determine changelog file name
+  // determine changelog file names
   //
 
   const changelogFile = majorVersion === 1
     ? 'CHANGELOG.md'
     : `CHANGELOG.v${majorVersion}.md`;
 
+  const alphaChangelogFile = majorVersion === 1
+    ? undefined
+    : `CHANGELOG.v${majorVersion}.alpha.md`;
+
   //
   // export all of it
   //
 
   return {
     version: currentVersion,
-    versionFile: versionFile,
-    changelogFile: changelogFile,
+    versionFile,
+    changelogFile,
+    alphaChangelogFile,
     prerelease: releaseType !== 'stable' ? releaseType : undefined,
     marker: '0.0.0',
   };
diff --git a/scripts/script-tests/resolve-version.test.js b/scripts/script-tests/resolve-version.test.js
index 442e97e45b3cf..693e29234f023 100644
--- a/scripts/script-tests/resolve-version.test.js
+++ b/scripts/script-tests/resolve-version.test.js
@@ -13,6 +13,7 @@ happy({
   },
   expected: {
     changelogFile: 'CHANGELOG.v2.md',
+    alphaChangelogFile: 'CHANGELOG.v2.alpha.md',
     marker: '0.0.0',
     prerelease: undefined,
     version: '2.1.0',
@@ -28,6 +29,7 @@ happy({
   },
   expected: {
     changelogFile: 'CHANGELOG.v2.md',
+    alphaChangelogFile: 'CHANGELOG.v2.alpha.md',
     marker: '0.0.0',
     prerelease: 'alpha',
     version: '2.1.0-alpha.0',
@@ -43,6 +45,7 @@ happy({
   },
   expected: {
     changelogFile: 'CHANGELOG.v2.md',
+    alphaChangelogFile: 'CHANGELOG.v2.alpha.md',
     marker: '0.0.0',
     prerelease: 'rc',
     version: '2.1.0-rc.0',
@@ -58,6 +61,7 @@ happy({
   },
   expected: {
     changelogFile: 'CHANGELOG.md',
+    alphaChangelogFile: undefined,
     marker: '0.0.0',
     prerelease: undefined,
     version: '1.72.0',
@@ -73,6 +77,7 @@ happy({
   },
   expected: {
     changelogFile: 'CHANGELOG.v2.md',
+    alphaChangelogFile: 'CHANGELOG.v2.alpha.md',
     marker: '0.0.0',
     prerelease: undefined,
     version: '2.0.0-rc.0',
diff --git a/tools/cdk-release/lib/conventional-commits.ts b/tools/cdk-release/lib/conventional-commits.ts
index ed42884bc8b08..56355edc7ac62 100644
--- a/tools/cdk-release/lib/conventional-commits.ts
+++ b/tools/cdk-release/lib/conventional-commits.ts
@@ -1,8 +1,5 @@
-import * as fs from 'fs-extra';
 import { ReleaseOptions } from './types';
 // eslint-disable-next-line @typescript-eslint/no-require-imports
-const lerna_project = require('@lerna/project');
-// eslint-disable-next-line @typescript-eslint/no-require-imports
 const conventionalCommitsParser = require('conventional-commits-parser');
 // eslint-disable-next-line @typescript-eslint/no-require-imports
 const gitRawCommits = require('git-raw-commits');
@@ -95,31 +92,42 @@ export async function getConventionalCommitsFromGitHistory(args: ReleaseOptions,
 }
 
 /**
- * Filters commits based on the criteria in `args`
- * (right now, the only criteria is whether to remove commits that relate to experimental packages).
+ * Options for filterCommits
+ */
+export interface FilterCommitsOptions {
+  /**
+   * Scopes matching these package names (and variants) will be excluded from the commits returned.
+   * @default - No packages are excluded.
+   **/
+  excludePackages?: string[];
+
+  /**
+   * If provided, scopes matching these package names (and variants) will be the *only commits* considered.
+   * @default - All packages are included.
+   **/
+  includePackages?: string[];
+}
+
+/**
+ * Filters commits based on package scopes and inclusion/exclusion criteria.
+ * If `opts.includePackages` is provided, commits without scopes will not be included.
  *
- * @param args configuration
  * @param commits the array of Conventional Commits to filter
- * @returns an array of ConventionalCommit objects which is a subset of `commits`
- *   (possibly exactly equal to `commits`)
+ * @param opts filtering options; if none are provided, all commits are returned.
  */
-export function filterCommits(args: ReleaseOptions, commits: ConventionalCommit[]): ConventionalCommit[] {
-  if (!args.stripExperimentalChanges) {
-    return commits;
-  }
+export function filterCommits(commits: ConventionalCommit[], opts: FilterCommitsOptions = {}): ConventionalCommit[] {
+  const excludeScopes = createScopeVariations(opts.excludePackages ?? []);
+  const includeScopes = createScopeVariations(opts.includePackages ?? []);
+
+  return commits
+    .filter(commit => includeScopes.length === 0 || (commit.scope && includeScopes.includes(commit.scope)))
+    .filter(commit => excludeScopes.length === 0 || !commit.scope || !excludeScopes.includes(commit.scope));
+}
+
+function createScopeVariations(names: string[]) {
+  const simplifiedNames = names.map(n => n.replace(/^@aws-cdk\//, ''));
 
-  // a get a list of packages from our monorepo
-  const project = new lerna_project.Project();
-  const packages = project.getPackagesSync();
-  const experimentalPackageNames: string[] = packages
-    .filter((pkg: any) => {
-      const pkgJson = fs.readJsonSync(pkg.manifestLocation);
-      return pkgJson.name.startsWith('@aws-cdk/')
-        && (pkgJson.maturity === 'experimental' || pkgJson.maturity === 'developer-preview');
-    })
-    .map((pkg: any) => pkg.name.substr('@aws-cdk/'.length));
-
-  const experimentalScopes = flatMap(experimentalPackageNames, (pkgName) => [
+  return flatMap(simplifiedNames, (pkgName) => [
     pkgName,
     ...(pkgName.startsWith('aws-')
       ? [
@@ -133,8 +141,6 @@ export function filterCommits(args: ReleaseOptions, commits: ConventionalCommit[
       : []
     ),
   ]);
-
-  return commits.filter(commit => !commit.scope || !experimentalScopes.includes(commit.scope));
 }
 
 function flatMap<T, U>(xs: T[], fn: (x: T) => U[]): U[] {
diff --git a/tools/cdk-release/lib/index.ts b/tools/cdk-release/lib/index.ts
index 04159170ffd81..b908e4cccdc7d 100644
--- a/tools/cdk-release/lib/index.ts
+++ b/tools/cdk-release/lib/index.ts
@@ -1,12 +1,14 @@
-import * as fs from 'fs';
 import * as path from 'path';
-import { filterCommits, getConventionalCommitsFromGitHistory } from './conventional-commits';
+import * as fs from 'fs-extra';
+import { getConventionalCommitsFromGitHistory } from './conventional-commits';
 import { defaults } from './defaults';
 import { bump } from './lifecycles/bump';
-import { changelog } from './lifecycles/changelog';
+import { writeChangelogs } from './lifecycles/changelog';
 import { commit } from './lifecycles/commit';
 import { debug, debugObject } from './private/print';
-import { ReleaseOptions, Versions } from './types';
+import { PackageInfo, ReleaseOptions, Versions } from './types';
+// eslint-disable-next-line @typescript-eslint/no-require-imports
+const lerna_project = require('@lerna/project');
 
 module.exports = async function main(opts: ReleaseOptions): Promise<void> {
   // handle the default options
@@ -19,21 +21,20 @@ module.exports = async function main(opts: ReleaseOptions): Promise<void> {
   const currentVersion = readVersion(args.versionFile);
   debugObject(args, 'Current version info', currentVersion);
 
-  const commits = await getConventionalCommitsFromGitHistory(args, `v${currentVersion.stableVersion}`);
-  const filteredCommits = filterCommits(args, commits);
-  debugObject(args, 'Found and filtered commits', filteredCommits);
-
   const newVersion = await bump(args, currentVersion);
   debugObject(args, 'New version is', newVersion);
 
+  debug(args, 'Reading Git commits');
+  const commits = await getConventionalCommitsFromGitHistory(args, `v${currentVersion.stableVersion}`);
+
   debug(args, 'Writing Changelog');
-  await changelog(args, currentVersion.stableVersion, newVersion.stableVersion, filteredCommits);
+  const changelogResults = await writeChangelogs({ ...args, currentVersion, newVersion, commits, packages: getProjectPackageInfos() });
 
   debug(args, 'Committing result');
-  await commit(args, newVersion.stableVersion, [args.versionFile, args.changelogFile]);
+  await commit(args, newVersion.stableVersion, [args.versionFile, ...changelogResults.map(r => r.filePath)]);
 };
 
-export function readVersion(versionFile: string): Versions {
+function readVersion(versionFile: string): Versions {
   const versionPath = path.resolve(process.cwd(), versionFile);
   const contents = JSON.parse(fs.readFileSync(versionPath, { encoding: 'utf-8' }));
   return {
@@ -41,3 +42,19 @@ export function readVersion(versionFile: string): Versions {
     alphaVersion: contents.alphaVersion,
   };
 }
+
+function getProjectPackageInfos(): PackageInfo[] {
+  const packages = lerna_project.Project.getPackagesSync();
+
+  return packages.map((pkg: any) => {
+    const maturity = pkg.get('maturity');
+    const alpha = pkg.name.startsWith('@aws-cdk/')
+      && (maturity === 'experimental' || maturity === 'developer-preview');
+
+    return {
+      name: pkg.name,
+      location: pkg.location,
+      alpha,
+    };
+  });
+}
diff --git a/tools/cdk-release/lib/lifecycles/changelog.ts b/tools/cdk-release/lib/lifecycles/changelog.ts
index 7e1052068ffd9..3da1b8e10de3a 100644
--- a/tools/cdk-release/lib/lifecycles/changelog.ts
+++ b/tools/cdk-release/lib/lifecycles/changelog.ts
@@ -1,9 +1,9 @@
 import * as stream from 'stream';
 import * as fs from 'fs-extra';
-import { ConventionalCommit } from '../conventional-commits';
+import { ConventionalCommit, filterCommits } from '../conventional-commits';
 import { writeFile } from '../private/files';
-import { notify, debug, debugObject } from '../private/print';
-import { LifecyclesSkip } from '../types';
+import { notify, debug } from '../private/print';
+import { ExperimentalChangesTreatment, LifecyclesSkip, PackageInfo, Versions } from '../types';
 // eslint-disable-next-line @typescript-eslint/no-require-imports
 const conventionalChangelogPresetLoader = require('conventional-changelog-preset-loader');
 // eslint-disable-next-line @typescript-eslint/no-require-imports
@@ -11,8 +11,18 @@ const conventionalChangelogWriter = require('conventional-changelog-writer');
 
 const START_OF_LAST_RELEASE_PATTERN = /(^#+ \[?[0-9]+\.[0-9]+\.[0-9]+|<a name=)/m;
 
-export interface ChangelogOptions {
+export interface WriteChangelogOptions extends ChangelogOptions {
   skip?: LifecyclesSkip;
+  alphaChangelogFile?: string;
+  experimentalChangesTreatment?: ExperimentalChangesTreatment;
+
+  currentVersion: Versions;
+  newVersion: Versions;
+  commits: ConventionalCommit[];
+  packages: PackageInfo[];
+}
+
+export interface ChangelogOptions {
   changelogFile: string;
   dryRun?: boolean;
   verbose?: boolean;
@@ -20,23 +30,60 @@ export interface ChangelogOptions {
 
   changeLogHeader?: string;
   includeDateInChangelog?: boolean;
-  releaseCommitMessageFormat?: string;
 }
 
 export interface ChangelogResult {
-  readonly contents: string;
-  readonly changedFiles: string[];
+  readonly filePath: string;
+  readonly fileContents: string;
+}
+
+export async function writeChangelogs(opts: WriteChangelogOptions): Promise<ChangelogResult[]> {
+  if (opts.skip?.changelog) {
+    return [];
+  }
+
+  const experimentalChangesTreatment = opts.experimentalChangesTreatment ?? ExperimentalChangesTreatment.INCLUDE;
+  const alphaPackages = opts.packages.filter(p => p.alpha);
+  const stableCommits = filterCommits(opts.commits, { excludePackages: alphaPackages.map(p => p.name) });
+
+  switch (experimentalChangesTreatment) {
+    case ExperimentalChangesTreatment.INCLUDE:
+      const allContents = await changelog(opts, opts.currentVersion.stableVersion, opts.newVersion.stableVersion, opts.commits);
+      return [{ filePath: opts.changelogFile, fileContents: allContents }];
+
+    case ExperimentalChangesTreatment.STRIP:
+      const strippedContents = await changelog(opts, opts.currentVersion.stableVersion, opts.newVersion.stableVersion, stableCommits);
+      return [{ filePath: opts.changelogFile, fileContents: strippedContents }];
+
+    case ExperimentalChangesTreatment.SEPARATE:
+      if (!opts.currentVersion.alphaVersion || !opts.newVersion.alphaVersion) {
+        throw new Error('unable to create separate alpha Changelog without alpha package versions');
+      }
+      if (!opts.alphaChangelogFile) {
+        throw new Error('alphaChangelogFile must be specified if experimentalChangesTreatment is SEPARATE');
+      }
+
+      const changelogResults: ChangelogResult[] = [];
+      const contents = await changelog(opts, opts.currentVersion.stableVersion, opts.newVersion.stableVersion, stableCommits);
+      changelogResults.push({ filePath: opts.changelogFile, fileContents: contents });
+
+      const alphaCommits = filterCommits(opts.commits, { includePackages: alphaPackages.map(p => p.name) });
+      const alphaContents = await changelog(
+        { ...opts, changelogFile: opts.alphaChangelogFile },
+        opts.currentVersion.alphaVersion, opts.newVersion.alphaVersion, alphaCommits);
+      changelogResults.push({ filePath: opts.alphaChangelogFile, fileContents: alphaContents });
+
+      return changelogResults;
+
+    default:
+      throw new Error(`unsupported experimentalChanges type: ${opts.experimentalChangesTreatment}`);
+  }
 }
 
 export async function changelog(
   args: ChangelogOptions, currentVersion: string, newVersion: string, commits: ConventionalCommit[],
-): Promise<ChangelogResult> {
-  if (args.skip?.changelog) {
-    return {
-      contents: '',
-      changedFiles: [],
-    };
-  }
+): Promise<string> {
+
   createChangelogIfMissing(args);
 
   // find the position of the last release and remove header
@@ -50,7 +97,6 @@ export async function changelog(
   const presetConfig = await conventionalChangelogPresetLoader({
     name: 'conventional-changelog-conventionalcommits',
   });
-  debugObject(args, 'conventionalChangelogPresetLoader returned', presetConfig);
 
   return new Promise((resolve, reject) => {
     // convert an array of commits into a Stream,
@@ -118,10 +164,7 @@ export async function changelog(
       } else {
         writeFile(args, args.changelogFile, args.changeLogHeader + '\n' + (content + oldContent).replace(/\n+$/, '\n'));
       }
-      return resolve({
-        contents: content,
-        changedFiles: [args.changelogFile],
-      });
+      return resolve(content);
     });
   });
 }
diff --git a/tools/cdk-release/lib/types.ts b/tools/cdk-release/lib/types.ts
index 822a5beba84d2..7dcbb12956f51 100644
--- a/tools/cdk-release/lib/types.ts
+++ b/tools/cdk-release/lib/types.ts
@@ -20,22 +20,41 @@ export interface Versions {
 
 export type ReleaseType = 'major' | 'minor' | 'patch';
 
-/* ****** main options ******** */
+/** How to handle experimental changes in the changelog. */
+export enum ExperimentalChangesTreatment {
+  /** Experimental changes are included in the main changelog (this is the default) */
+  INCLUDE = 'include',
+  /** Remove all experimental changes from the changelog */
+  STRIP = 'strip',
+  /** Write experimental changes to a separate changelog */
+  SEPARATE = 'separate'
+};
 
 export interface ReleaseOptions {
   releaseAs: ReleaseType;
   skip?: LifecyclesSkip;
   versionFile: string;
   changelogFile: string;
+  alphaChangelogFile?: string;
   prerelease?: string;
   scripts?: Lifecycles;
   dryRun?: boolean;
   verbose?: boolean;
   silent?: boolean;
   sign?: boolean;
-  stripExperimentalChanges?: boolean;
 
+  /**
+   * How to handle experimental changes in the changelog.
+   * @default ExperimentalChangesTreatment.INCLUDE
+   */
+  experimentalChangesTreatment?: ExperimentalChangesTreatment;
   changeLogHeader?: string;
   includeDateInChangelog?: boolean;
   releaseCommitMessageFormat?: string;
 }
+
+export interface PackageInfo {
+  name: string;
+  location: string;
+  alpha: boolean;
+}
diff --git a/tools/cdk-release/test/changelog.test.ts b/tools/cdk-release/test/changelog.test.ts
index 67e01477e4ced..6e618d00a1389 100644
--- a/tools/cdk-release/test/changelog.test.ts
+++ b/tools/cdk-release/test/changelog.test.ts
@@ -1,14 +1,140 @@
 import { ConventionalCommit } from '../lib/conventional-commits';
-import { changelog, ChangelogOptions } from '../lib/lifecycles/changelog';
-
-describe('Changelog generation', () => {
-  const args: ChangelogOptions = {
-    changelogFile: 'CHANGELOG.md',
-    dryRun: true,
-    silent: true,
-    includeDateInChangelog: false,
+import { changelog, ChangelogOptions, writeChangelogs } from '../lib/lifecycles/changelog';
+import { ExperimentalChangesTreatment, PackageInfo, Versions } from '../lib/types';
+
+const args: ChangelogOptions = {
+  changelogFile: 'CHANGELOG.md',
+  dryRun: true,
+  silent: true,
+  includeDateInChangelog: false,
+};
+
+describe('writeChangelogs', () => {
+
+  const currentVersion: Versions = { stableVersion: '1.23.0' };
+  const newVersion: Versions = { stableVersion: '1.24.0' };
+
+  const commits: ConventionalCommit[] = [
+    buildCommit({ type: 'feat', scope: 'aws-stable', subject: 'new stable feat' }),
+    buildCommit({ type: 'feat', scope: 'aws-experimental', subject: 'new experimental feat' }),
+  ];
+  const packages: PackageInfo[] = [
+    { name: 'aws-stable', alpha: false, location: 'aws-stable' },
+    { name: 'aws-experimental', alpha: true, location: 'aws-experimental' },
+  ];
+
+  const defaultWriteChangelogOpts = {
+    ...args,
+    currentVersion,
+    newVersion,
+    commits,
+    packages,
   };
 
+  test('does nothing if skip.changelog is set', async () => {
+    const changelogResult = await writeChangelogs({ ...defaultWriteChangelogOpts, skip: { changelog: true } });
+
+    expect(changelogResult).toEqual([]);
+  });
+
+  test('defaults experimentalChangesTreatment to "include"', async () => {
+    const changelogResultDefault = await writeChangelogs({
+      ...defaultWriteChangelogOpts, experimentalChangesTreatment: undefined,
+    });
+    const changelogResultInclude = await writeChangelogs({
+      ...defaultWriteChangelogOpts, experimentalChangesTreatment: ExperimentalChangesTreatment.INCLUDE,
+    });
+
+    expect(changelogResultDefault).toEqual(changelogResultInclude);
+  });
+
+  test('if experimentalChangesTreatment is "include", includes experimental changes', async () => {
+    const changelogResult = await writeChangelogs({
+      ...defaultWriteChangelogOpts, experimentalChangesTreatment: ExperimentalChangesTreatment.INCLUDE,
+    });
+
+    expect(changelogResult.length).toEqual(1);
+    expect(changelogResult[0].filePath).toEqual('CHANGELOG.md');
+    expect(changelogResult[0].fileContents.trim()).toBe(
+      `## [1.24.0](https://github.com/aws/aws-cdk/compare/v1.23.0...v1.24.0)
+
+### Features
+
+* **aws-experimental:** new experimental feat
+* **aws-stable:** new stable feat`);
+  });
+
+  test('if changelogExperimentalChanges is "strip", excludes experimental changes', async () => {
+    const changelogResult = await writeChangelogs({
+      ...defaultWriteChangelogOpts, experimentalChangesTreatment: ExperimentalChangesTreatment.STRIP,
+    });
+
+    expect(changelogResult.length).toEqual(1);
+    expect(changelogResult[0].filePath).toEqual('CHANGELOG.md');
+    expect(changelogResult[0].fileContents.trim()).toBe(
+      `## [1.24.0](https://github.com/aws/aws-cdk/compare/v1.23.0...v1.24.0)
+
+### Features
+
+* **aws-stable:** new stable feat`);
+  });
+
+  describe('experimentalChangesTreatment is SEPARATE', () => {
+
+    const defaultSeparateChangelogOpts = {
+      ...defaultWriteChangelogOpts,
+      experimentalChangesTreatment: ExperimentalChangesTreatment.SEPARATE,
+      currentVersion: { stableVersion: '1.23.0', alphaVersion: '1.23.0-alpha.0' },
+      newVersion: { stableVersion: '1.24.0', alphaVersion: '1.24.0-alpha.0' },
+      alphaChangelogFile: 'CHANGELOG.alpha.md',
+    };
+
+    test('throws if alpha versions are not present', async () => {
+      await expect(writeChangelogs({
+        ...defaultSeparateChangelogOpts,
+        currentVersion: { stableVersion: '1.23.0' },
+        newVersion: { stableVersion: '1.24.0' },
+      }))
+        .rejects
+        .toThrow(/without alpha package versions/);
+
+      await expect(writeChangelogs({ ...defaultSeparateChangelogOpts, newVersion: { stableVersion: '1.24.0' } }))
+        .rejects
+        .toThrow(/without alpha package versions/);
+
+      await expect(writeChangelogs({ ...defaultSeparateChangelogOpts, currentVersion: { stableVersion: '1.23.0' } }))
+        .rejects
+        .toThrow(/without alpha package versions/);
+    });
+
+    test('throws if alpha changelog file is not present', async () => {
+      await expect(writeChangelogs({ ...defaultSeparateChangelogOpts, alphaChangelogFile: undefined }))
+        .rejects
+        .toThrow(/alphaChangelogFile must be specified/);
+    });
+
+    test('excludes experimental changes and writes to the alpha changelog', async () => {
+      const changelogResult = await writeChangelogs(defaultSeparateChangelogOpts);
+
+      const mainResult = changelogResult.find(r => r.filePath === 'CHANGELOG.md');
+      const alphaResult = changelogResult.find(r => r.filePath === 'CHANGELOG.alpha.md');
+      expect(mainResult?.fileContents.trim()).toBe(
+        `## [1.24.0](https://github.com/aws/aws-cdk/compare/v1.23.0...v1.24.0)
+
+### Features
+
+* **aws-stable:** new stable feat`);
+      expect(alphaResult?.fileContents.trim()).toBe(
+        `## [1.24.0-alpha.0](https://github.com/aws/aws-cdk/compare/v1.23.0-alpha.0...v1.24.0-alpha.0)
+
+### Features
+
+* **aws-experimental:** new experimental feat`);
+    });
+  });
+});
+
+describe('changelog', () => {
   test("correctly handles 'BREAKING CHANGES'", async () => {
     const commits: ConventionalCommit[] = [
       buildCommit({
@@ -68,6 +194,6 @@ function buildCommit(commit: PartialCommit): ConventionalCommit {
   };
 }
 
-async function invokeChangelogFrom1_23_0to1_24_0(args: ChangelogOptions, commits: ConventionalCommit[]): Promise<string> {
-  return (await changelog(args, '1.23.0', '1.24.0', commits)).contents;
+async function invokeChangelogFrom1_23_0to1_24_0(changelogArgs: ChangelogOptions, commits: ConventionalCommit[]): Promise<string> {
+  return changelog(changelogArgs, '1.23.0', '1.24.0', commits);
 }
diff --git a/tools/cdk-release/test/conventional-commits.test.ts b/tools/cdk-release/test/conventional-commits.test.ts
index 773f229849e5d..000031f142074 100644
--- a/tools/cdk-release/test/conventional-commits.test.ts
+++ b/tools/cdk-release/test/conventional-commits.test.ts
@@ -39,38 +39,69 @@ describe('getConventionalCommitsFromGitHistory', () => {
   });
 });
 
-// NOTE - These test currently use real package.json data to determine package's stability.
 describe('filterCommits', () => {
   const commits: ConventionalCommit[] = [
-    buildCommit({
-      type: 'feat',
-      scope: 'scope',
-      subject: 'super important feature',
-    }),
-    buildCommit({
-      type: 'fix',
-      scope: 'example-construct-library', // really hope we don't stabilize this one
-      subject: 'hairy bugfix',
-      notes: [
-        {
-          title: 'BREAKING CHANGE',
-          text: 'this is a breaking change',
-        },
-      ],
-    }),
+    commitWithScope('aws-stable'),
+    commitWithScope('aws-experimental'),
+    commitWithScope(),
   ];
 
-  test('if stripExperimental is not set, returns original commits', async () => {
-    const filteredCommits = filterCommits(args, commits);
+  test('if no options are provided, returns all commits', () => {
+    const filteredCommits = filterCommits(commits);
+
+    expect(filteredCommits).toEqual(commits);
+  });
+
+  test('excludePackages removes commits matching scope', () => {
+    const filteredCommits = filterCommits(commits, { excludePackages: ['@aws-cdk/aws-experimental'] });
 
     expect(filteredCommits.length).toEqual(2);
+    expect(filteredCommits.map(c => c.scope)).not.toContain('aws-experimental');
+  });
+
+  test('excludePackages removes commits matching specific variants of the scope', () => {
+    const experimentalCommits = [
+      commitWithScope('aws-experimental'),
+      commitWithScope('awsexperimental'),
+      commitWithScope('experimental'),
+      commitWithScope('aws.experimental'),
+    ];
+
+    const filteredCommits = filterCommits(experimentalCommits, { excludePackages: ['@aws-cdk/aws-experimental'] });
+
+    expect(filteredCommits.length).toEqual(1);
+    expect(filteredCommits[0].scope).toEqual('aws.experimental');
+  });
+
+  test('includePackages only includes commits matching scope', () => {
+    const filteredCommits = filterCommits(commits, { includePackages: ['@aws-cdk/aws-stable'] });
+
+    expect(filteredCommits.length).toEqual(1);
+    expect(filteredCommits[0].scope).toEqual('aws-stable');
   });
 
-  test("skips experimental modules if requested, even with 'BREAKING CHANGES'", async () => {
-    const filteredCommits = filterCommits({ ...args, stripExperimentalChanges: true }, commits);
+  test('includePackages includes commits matching variants of the scope', () => {
+    const stableCommits = [
+      commitWithScope('aws-stable'),
+      commitWithScope('awsstable'),
+      commitWithScope('stable'),
+      commitWithScope('notstable'),
+    ];
+
+    const filteredCommits = filterCommits(stableCommits, { includePackages: ['@aws-cdk/aws-stable'] });
+
+    expect(filteredCommits.length).toEqual(3);
+    expect(filteredCommits.map(c => c.scope)).not.toContain('notstable');
+  });
+
+  test('excludes criteria are run after includes', () => {
+    const filteredCommits = filterCommits(commits, {
+      includePackages: ['@aws-cdk/aws-stable', '@aws-cdk/aws-experimental'],
+      excludePackages: ['@aws-cdk/aws-experimental'],
+    });
 
     expect(filteredCommits.length).toEqual(1);
-    expect(filteredCommits[0].subject).toEqual('super important feature');
+    expect(filteredCommits[0].scope).toEqual('aws-stable');
   });
 });
 
@@ -85,16 +116,13 @@ function mockGitCommits(messages: string[]) {
   return rStream;
 }
 
-interface PartialCommit extends Partial<ConventionalCommit> {
-  readonly type: string;
-  readonly subject: string;
-}
-
-function buildCommit(commit: PartialCommit): ConventionalCommit {
+function commitWithScope(scope?: string): ConventionalCommit {
   return {
     notes: [],
     references: [],
-    header: `${commit.type}${commit.scope ? '(' + commit.scope + ')' : ''}: ${commit.subject}`,
-    ...commit,
+    header: `feat${scope ? '(' + scope + ')' : ''}: some commit message`,
+    type: 'feat',
+    subject: 'some commit message',
+    scope,
   };
 }

From ff6082caf7e534989fb8ee6b4c63c0c02e9a5ec0 Mon Sep 17 00:00:00 2001
From: Elad Ben-Israel <benisrae@amazon.com>
Date: Wed, 1 Sep 2021 00:36:00 +0300
Subject: [PATCH 46/91] fix(core): inconsistent analytics string across
 operating systems (#16300)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The gzip header includes an “OS” byte that indicates which operating system was used to perform the operation. This means that the CDK Metadata analytics string would be different for the same CDK app in two different operating systems.

To address this, we explicitly set the [gzip OS flag] to 255 (unknown).

Fixes #15322

[gzip OS flag]: https://datatracker.ietf.org/doc/html/rfc1952


----

*By submitting this pull request, I confirm that my contribution is made under the terms of the Apache-2.0 license*
---
 .../core/lib/private/metadata-resource.ts     | 51 ++++++++++++++++++-
 .../core/test/metadata-resource.test.ts       |  7 +++
 2 files changed, 57 insertions(+), 1 deletion(-)

diff --git a/packages/@aws-cdk/core/lib/private/metadata-resource.ts b/packages/@aws-cdk/core/lib/private/metadata-resource.ts
index 1cccc4f24ff3d..b74fe41e17a2e 100644
--- a/packages/@aws-cdk/core/lib/private/metadata-resource.ts
+++ b/packages/@aws-cdk/core/lib/private/metadata-resource.ts
@@ -74,8 +74,13 @@ export function formatAnalytics(infos: ConstructInfo[]) {
   infos.forEach(info => insertFqnInTrie(`${info.version}!${info.fqn}`, trie));
 
   const plaintextEncodedConstructs = prefixEncodeTrie(trie);
-  const compressedConstructs = zlib.gzipSync(Buffer.from(plaintextEncodedConstructs)).toString('base64');
+  const compressedConstructsBuffer = zlib.gzipSync(Buffer.from(plaintextEncodedConstructs));
 
+  // set OS flag to "unknown" in order to ensure we get consistent results across operating systems
+  // see https://github.com/aws/aws-cdk/issues/15322
+  setGzipOperatingSystemToUnknown(compressedConstructsBuffer);
+
+  const compressedConstructs = compressedConstructsBuffer.toString('base64');
   return `v2:deflate64:${compressedConstructs}`;
 }
 
@@ -125,3 +130,47 @@ function prefixEncodeTrie(trie: Trie) {
   });
   return prefixEncoded;
 }
+
+/**
+ * Sets the OS flag to "unknown" in order to ensure we get consistent results across operating systems.
+ *
+ * @see https://datatracker.ietf.org/doc/html/rfc1952#page-5
+ *
+ *   +---+---+---+---+---+---+---+---+---+---+
+ *   |ID1|ID2|CM |FLG|     MTIME     |XFL|OS |
+ *   +---+---+---+---+---+---+---+---+---+---+
+ *   | 0 | 1 | 2 | 3 | 4 | 5 | 6 | 7 | 8 | 9 |
+ *   +---+---+---+---+---+---+---+---+---+---+
+ *
+ * OS (Operating System)
+ * =====================
+ * This identifies the type of file system on which compression
+ * took place.  This may be useful in determining end-of-line
+ * convention for text files.  The currently defined values are
+ * as follows:
+ *      0 - FAT filesystem (MS-DOS, OS/2, NT/Win32)
+ *      1 - Amiga
+ *      2 - VMS (or OpenVMS)
+ *      3 - Unix
+ *      4 - VM/CMS
+ *      5 - Atari TOS
+ *      6 - HPFS filesystem (OS/2, NT)
+ *      7 - Macintosh
+ *      8 - Z-System
+ *      9 - CP/M
+ *     10 - TOPS-20
+ *     11 - NTFS filesystem (NT)
+ *     12 - QDOS
+ *     13 - Acorn RISCOS
+ *    255 - unknown
+ *
+ * @param gzipBuffer A gzip buffer
+ */
+function setGzipOperatingSystemToUnknown(gzipBuffer: Buffer) {
+  // check that this is indeed a gzip buffer (https://datatracker.ietf.org/doc/html/rfc1952#page-6)
+  if (gzipBuffer[0] !== 0x1f || gzipBuffer[1] !== 0x8b) {
+    throw new Error('Expecting a gzip buffer (must start with 0x1f8b)');
+  }
+
+  gzipBuffer[9] = 255;
+}
\ No newline at end of file
diff --git a/packages/@aws-cdk/core/test/metadata-resource.test.ts b/packages/@aws-cdk/core/test/metadata-resource.test.ts
index ca87ae9d252f6..a1fed889d9894 100644
--- a/packages/@aws-cdk/core/test/metadata-resource.test.ts
+++ b/packages/@aws-cdk/core/test/metadata-resource.test.ts
@@ -125,6 +125,13 @@ describe('formatAnalytics', () => {
     expectAnalytics(constructInfo, '1.2.3!aws-cdk-lib.{Construct,CfnResource,Stack},0.1.2!aws-cdk-lib.{CoolResource,OtherResource}');
   });
 
+  test('ensure gzip is encoded with "unknown" operating system to maintain consistent output across systems', () => {
+    const constructInfo = [{ fqn: 'aws-cdk-lib.Construct', version: '1.2.3' }];
+    const analytics = formatAnalytics(constructInfo);
+    const gzip = Buffer.from(analytics.split(':')[2], 'base64');
+    expect(gzip[9]).toBe(255);
+  });
+
   // Compares the output of formatAnalytics with an expected (plaintext) output.
   // For ease of testing, the plaintext versions are compared rather than the encoded versions.
   function expectAnalytics(constructs: ConstructInfo[], expectedPlaintext: string) {

From 5a5da573149d45bf6e29bf7155715fa926804871 Mon Sep 17 00:00:00 2001
From: Johs Kristoffersen <johsbk@gmail.com>
Date: Wed, 1 Sep 2021 00:51:09 +0200
Subject: [PATCH 47/91] feat(stepfunctions-tasks): support allocation
 strategies in EMR CreateCluster (#16296)

fixes #16252

----

*By submitting this pull request, I confirm that my contribution is made under the terms of the Apache-2.0 license*
---
 .../lib/emr/emr-create-cluster.ts             |  25 +++-
 .../lib/emr/private/cluster-utils.ts          |   1 +
 .../test/emr/emr-create-cluster.test.ts       | 117 ++++++++++++++++++
 3 files changed, 141 insertions(+), 2 deletions(-)

diff --git a/packages/@aws-cdk/aws-stepfunctions-tasks/lib/emr/emr-create-cluster.ts b/packages/@aws-cdk/aws-stepfunctions-tasks/lib/emr/emr-create-cluster.ts
index 5e1e1d708d2d2..bfb3d94e28b5c 100644
--- a/packages/@aws-cdk/aws-stepfunctions-tasks/lib/emr/emr-create-cluster.ts
+++ b/packages/@aws-cdk/aws-stepfunctions-tasks/lib/emr/emr-create-cluster.ts
@@ -544,7 +544,7 @@ export namespace EmrCreateCluster {
    *
    */
   export enum SpotTimeoutAction {
-    /**\
+    /**
      * SWITCH_TO_ON_DEMAND
      */
     SWITCH_TO_ON_DEMAND = 'SWITCH_TO_ON_DEMAND',
@@ -554,6 +554,21 @@ export namespace EmrCreateCluster {
     TERMINATE_CLUSTER = 'TERMINATE_CLUSTER',
   }
 
+  /**
+   * Spot Allocation Strategies
+   *
+   * Specifies the strategy to use in launching Spot Instance fleets. For example, "capacity-optimized" launches instances from Spot Instance pools with optimal capacity for the number of instances that are launching.
+   *
+   * @see https://docs.aws.amazon.com/emr/latest/APIReference/API_SpotProvisioningSpecification.html
+   *
+   */
+  export enum SpotAllocationStrategy {
+    /**
+     * Capacity-optimized, which launches instances from Spot Instance pools with optimal capacity for the number of instances that are launching.
+     */
+    CAPACITY_OPTIMIZED = 'capacity-optimized',
+  }
+
   /**
    * The launch specification for Spot instances in the instance fleet, which determines the defined duration and provisioning timeout behavior.
    *
@@ -561,10 +576,16 @@ export namespace EmrCreateCluster {
    *
    */
   export interface SpotProvisioningSpecificationProperty {
+    /**
+     * Specifies the strategy to use in launching Spot Instance fleets.
+     *
+     * @default - No allocation strategy, i.e. spot instance type will be chosen based on current price only
+     */
+    readonly allocationStrategy?: SpotAllocationStrategy;
     /**
      * The defined duration for Spot instances (also known as Spot blocks) in minutes.
      *
-     * @default No blockDurationMinutes
+     * @default - No blockDurationMinutes
      */
     readonly blockDurationMinutes?: number;
 
diff --git a/packages/@aws-cdk/aws-stepfunctions-tasks/lib/emr/private/cluster-utils.ts b/packages/@aws-cdk/aws-stepfunctions-tasks/lib/emr/private/cluster-utils.ts
index 37cf474c83ea0..c8ae8a50a360c 100644
--- a/packages/@aws-cdk/aws-stepfunctions-tasks/lib/emr/private/cluster-utils.ts
+++ b/packages/@aws-cdk/aws-stepfunctions-tasks/lib/emr/private/cluster-utils.ts
@@ -123,6 +123,7 @@ export function InstanceTypeConfigPropertyToJson(property: EmrCreateCluster.Inst
 export function InstanceFleetProvisioningSpecificationsPropertyToJson(property: EmrCreateCluster.InstanceFleetProvisioningSpecificationsProperty) {
   return {
     SpotSpecification: {
+      AllocationStrategy: cdk.stringToCloudFormation(property.spotSpecification.allocationStrategy),
       BlockDurationMinutes: cdk.numberToCloudFormation(property.spotSpecification.blockDurationMinutes),
       TimeoutAction: cdk.stringToCloudFormation(property.spotSpecification.timeoutAction?.valueOf()),
       TimeoutDurationMinutes: cdk.numberToCloudFormation(property.spotSpecification.timeoutDurationMinutes),
diff --git a/packages/@aws-cdk/aws-stepfunctions-tasks/test/emr/emr-create-cluster.test.ts b/packages/@aws-cdk/aws-stepfunctions-tasks/test/emr/emr-create-cluster.test.ts
index 5f40b28be29ac..273a580a6a38e 100644
--- a/packages/@aws-cdk/aws-stepfunctions-tasks/test/emr/emr-create-cluster.test.ts
+++ b/packages/@aws-cdk/aws-stepfunctions-tasks/test/emr/emr-create-cluster.test.ts
@@ -641,6 +641,123 @@ test('Create Cluster with Instances configuration', () => {
   });
 });
 
+test('Create Cluster with InstanceFleet with allocation strategy=capacity-optimized', () => {
+  // WHEN
+  const task = new EmrCreateCluster(stack, 'Task', {
+    instances: {
+      instanceFleets: [{
+        instanceFleetType: EmrCreateCluster.InstanceRoleType.MASTER,
+        instanceTypeConfigs: [{
+          bidPrice: '1',
+          bidPriceAsPercentageOfOnDemandPrice: 1,
+          configurations: [{
+            classification: 'Classification',
+            properties: {
+              Key: 'Value',
+            },
+          }],
+          ebsConfiguration: {
+            ebsBlockDeviceConfigs: [{
+              volumeSpecification: {
+                iops: 1,
+                volumeSize: cdk.Size.gibibytes(1),
+                volumeType: EmrCreateCluster.EbsBlockDeviceVolumeType.STANDARD,
+              },
+              volumesPerInstance: 1,
+            }],
+            ebsOptimized: true,
+          },
+          instanceType: 'm5.xlarge',
+          weightedCapacity: 1,
+        }],
+        launchSpecifications: {
+          spotSpecification: {
+            allocationStrategy: EmrCreateCluster.SpotAllocationStrategy.CAPACITY_OPTIMIZED,
+            blockDurationMinutes: 1,
+            timeoutAction: EmrCreateCluster.SpotTimeoutAction.TERMINATE_CLUSTER,
+            timeoutDurationMinutes: 1,
+          },
+        },
+        name: 'Master',
+        targetOnDemandCapacity: 1,
+        targetSpotCapacity: 1,
+      }],
+    },
+    clusterRole,
+    name: 'Cluster',
+    serviceRole,
+    integrationPattern: sfn.IntegrationPattern.REQUEST_RESPONSE,
+  });
+
+  // THEN
+  expect(stack.resolve(task.toStateJson())).toEqual({
+    Type: 'Task',
+    Resource: {
+      'Fn::Join': [
+        '',
+        [
+          'arn:',
+          {
+            Ref: 'AWS::Partition',
+          },
+          ':states:::elasticmapreduce:createCluster',
+        ],
+      ],
+    },
+    End: true,
+    Parameters: {
+      Name: 'Cluster',
+      Instances: {
+        KeepJobFlowAliveWhenNoSteps: true,
+        InstanceFleets: [{
+          InstanceFleetType: 'MASTER',
+          InstanceTypeConfigs: [{
+            BidPrice: '1',
+            BidPriceAsPercentageOfOnDemandPrice: 1,
+            Configurations: [{
+              Classification: 'Classification',
+              Properties: {
+                Key: 'Value',
+              },
+            }],
+            EbsConfiguration: {
+              EbsBlockDeviceConfigs: [{
+                VolumeSpecification: {
+                  Iops: 1,
+                  SizeInGB: 1,
+                  VolumeType: 'standard',
+                },
+                VolumesPerInstance: 1,
+              }],
+              EbsOptimized: true,
+            },
+            InstanceType: 'm5.xlarge',
+            WeightedCapacity: 1,
+          }],
+          LaunchSpecifications: {
+            SpotSpecification: {
+              AllocationStrategy: 'capacity-optimized',
+              BlockDurationMinutes: 1,
+              TimeoutAction: 'TERMINATE_CLUSTER',
+              TimeoutDurationMinutes: 1,
+            },
+          },
+          Name: 'Master',
+          TargetOnDemandCapacity: 1,
+          TargetSpotCapacity: 1,
+        }],
+      },
+      VisibleToAllUsers: true,
+      JobFlowRole: {
+        Ref: 'ClusterRoleD9CA7471',
+      },
+      ServiceRole: {
+        Ref: 'ServiceRole4288B192',
+      },
+    },
+  });
+});
+
 test('Create Cluster with InstanceFleet', () => {
   // WHEN
   const task = new EmrCreateCluster(stack, 'Task', {

From 97b3b979c0a3cfc301acd772ba1ca7253a3f624d Mon Sep 17 00:00:00 2001
From: AWS CDK Team <aws-cdk@amazon.com>
Date: Wed, 1 Sep 2021 07:59:20 +0000
Subject: [PATCH 48/91] chore(release): 1.121.0

---
 CHANGELOG.md    | 27 +++++++++++++++++++++++++++
 version.v1.json |  2 +-
 2 files changed, 28 insertions(+), 1 deletion(-)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index dd16881355b70..22a49e715b1dc 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -2,6 +2,33 @@
 
 All notable changes to this project will be documented in this file. See [standard-version](https://github.com/conventional-changelog/standard-version) for commit guidelines.
 
+## [1.121.0](https://github.com/aws/aws-cdk/compare/v1.120.0...v1.121.0) (2021-09-01)
+
+
+### Features
+
+* **assertions:** 'not' matcher ([#16240](https://github.com/aws/aws-cdk/issues/16240)) ([b838f95](https://github.com/aws/aws-cdk/commit/b838f95f0905316fe706779381c93bedaa9ad504)), closes [#15868](https://github.com/aws/aws-cdk/issues/15868)
+* **aws-cloudfront-origins:** add custom headers to S3Origin ([#16161](https://github.com/aws/aws-cdk/issues/16161)) ([f42b233](https://github.com/aws/aws-cdk/commit/f42b233a76ae810634fa43a25604dbc65bdd63b9)), closes [#16160](https://github.com/aws/aws-cdk/issues/16160)
+* **cfnspec:** cloudformation spec v40.1.0 ([#16254](https://github.com/aws/aws-cdk/issues/16254)) ([fe81be7](https://github.com/aws/aws-cdk/commit/fe81be78322e3f1c23d2b02e59b56faa3b06e554))
+* **cli:** support `--no-rollback` flag ([#16293](https://github.com/aws/aws-cdk/issues/16293)) ([d763d90](https://github.com/aws/aws-cdk/commit/d763d9092289d0b28b2695b8474b44ed7d0bce54)), closes [#16289](https://github.com/aws/aws-cdk/issues/16289)
+* **core:** normalize line endings in asset hash calculation ([#16276](https://github.com/aws/aws-cdk/issues/16276)) ([01bf6e2](https://github.com/aws/aws-cdk/commit/01bf6e2922994e7d41c8c6b171aa1693835f2b53))
+* **ec2:** add m6i instances ([#16081](https://github.com/aws/aws-cdk/issues/16081)) ([a42a1ea](https://github.com/aws/aws-cdk/commit/a42a1ea5a122f864936cdb0113b16fe92cc7205e))
+* **ecs:** add support for Fargate PV1.4 ephemeral storage ([#15440](https://github.com/aws/aws-cdk/issues/15440)) ([f1bf935](https://github.com/aws/aws-cdk/commit/f1bf935c47006096b33fb7bf0c847ffab9230870)), closes [#14570](https://github.com/aws/aws-cdk/issues/14570)
+* **ecs-patterns:** add capacity provider strategies to queue processing service pattern ([#15684](https://github.com/aws/aws-cdk/issues/15684)) ([f40e8d6](https://github.com/aws/aws-cdk/commit/f40e8d6a502dd42e0a52d81f72abecaa2cdd920a)), closes [#14781](https://github.com/aws/aws-cdk/issues/14781)
+* **ecs-patterns:** Allow configuration of SSL policy for listeners created by ECS patterns ([#15210](https://github.com/aws/aws-cdk/issues/15210)) ([2c3d21e](https://github.com/aws/aws-cdk/commit/2c3d21e2f1117a54510ba92748588ee95ab3631c)), closes [#11841](https://github.com/aws/aws-cdk/issues/11841) [#8816](https://github.com/aws/aws-cdk/issues/8816)
+* **route53resolver:** DNS Firewall ([#15031](https://github.com/aws/aws-cdk/issues/15031)) ([ffdcd94](https://github.com/aws/aws-cdk/commit/ffdcd94405c160763e396a191d5af793ac8db998))
+* **stepfunctions-tasks:** support allocation strategies in EMR CreateCluster ([#16296](https://github.com/aws/aws-cdk/issues/16296)) ([5a5da57](https://github.com/aws/aws-cdk/commit/5a5da573149d45bf6e29bf7155715fa926804871)), closes [#16252](https://github.com/aws/aws-cdk/issues/16252)
+* **synthetics:** add Python runtime and latest Nodejs runtime ([#16069](https://github.com/aws/aws-cdk/issues/16069)) ([de218ba](https://github.com/aws/aws-cdk/commit/de218ba3a294b5b98f93fc75a04ce42294e95008)), closes [#15138](https://github.com/aws/aws-cdk/issues/15138) [#16177](https://github.com/aws/aws-cdk/issues/16177)
+
+
+### Bug Fixes
+
+* **apigatewayv2:** api mapping key with two hyphens is disallowed ([#16204](https://github.com/aws/aws-cdk/issues/16204)) ([0889564](https://github.com/aws/aws-cdk/commit/0889564a0c1b04d33909dd3fdb42147f23d67cbd)), closes [#15948](https://github.com/aws/aws-cdk/issues/15948)
+* **aws-rds:** fromDatabaseInstanceAttributes incorrectly stringifies ports with tokens ([#16286](https://github.com/aws/aws-cdk/issues/16286)) ([41b831a](https://github.com/aws/aws-cdk/commit/41b831a6698ee6c7a3c8968bff8273a0c7f35448)), closes [#11813](https://github.com/aws/aws-cdk/issues/11813)
+* **core:** inconsistent analytics string across operating systems ([#16300](https://github.com/aws/aws-cdk/issues/16300)) ([ff6082c](https://github.com/aws/aws-cdk/commit/ff6082caf7e534989fb8ee6b4c63c0c02e9a5ec0)), closes [#15322](https://github.com/aws/aws-cdk/issues/15322)
+* **docs:** unnecessary log group in Step Functions state machine x-ray example ([#16159](https://github.com/aws/aws-cdk/issues/16159)) ([04d4547](https://github.com/aws/aws-cdk/commit/04d45474d80d3687a3fdf27f4d76dd1c8521eff0))
+* **elasticloadbalancingv2:** target group health check does not validate interval versus timeout ([#16107](https://github.com/aws/aws-cdk/issues/16107)) ([a85ad39](https://github.com/aws/aws-cdk/commit/a85ad392459c815d5c8e645dd3e8240d059024e6)), closes [#3703](https://github.com/aws/aws-cdk/issues/3703)
+
 ## [1.120.0](https://github.com/aws/aws-cdk/compare/v1.119.0...v1.120.0) (2021-08-26)
 
 
diff --git a/version.v1.json b/version.v1.json
index 7ff9a577d56ba..be934684cecce 100644
--- a/version.v1.json
+++ b/version.v1.json
@@ -1,3 +1,3 @@
 {
-  "version": "1.120.0"
+  "version": "1.121.0"
 }
\ No newline at end of file

From 1cf068dbf068d03ece47ed7617008ea7a55e0cdd Mon Sep 17 00:00:00 2001
From: Elad Ben-Israel <benisrae@amazon.com>
Date: Wed, 1 Sep 2021 11:08:06 +0300
Subject: [PATCH 49/91] Update CHANGELOG.md

---
 CHANGELOG.md | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index 22a49e715b1dc..638fe5a43e6e2 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -8,7 +8,7 @@ All notable changes to this project will be documented in this file. See [standa
 ### Features
 
 * **assertions:** 'not' matcher ([#16240](https://github.com/aws/aws-cdk/issues/16240)) ([b838f95](https://github.com/aws/aws-cdk/commit/b838f95f0905316fe706779381c93bedaa9ad504)), closes [#15868](https://github.com/aws/aws-cdk/issues/15868)
-* **aws-cloudfront-origins:** add custom headers to S3Origin ([#16161](https://github.com/aws/aws-cdk/issues/16161)) ([f42b233](https://github.com/aws/aws-cdk/commit/f42b233a76ae810634fa43a25604dbc65bdd63b9)), closes [#16160](https://github.com/aws/aws-cdk/issues/16160)
+* **cloudfront-origins:** add custom headers to S3Origin ([#16161](https://github.com/aws/aws-cdk/issues/16161)) ([f42b233](https://github.com/aws/aws-cdk/commit/f42b233a76ae810634fa43a25604dbc65bdd63b9)), closes [#16160](https://github.com/aws/aws-cdk/issues/16160)
 * **cfnspec:** cloudformation spec v40.1.0 ([#16254](https://github.com/aws/aws-cdk/issues/16254)) ([fe81be7](https://github.com/aws/aws-cdk/commit/fe81be78322e3f1c23d2b02e59b56faa3b06e554))
 * **cli:** support `--no-rollback` flag ([#16293](https://github.com/aws/aws-cdk/issues/16293)) ([d763d90](https://github.com/aws/aws-cdk/commit/d763d9092289d0b28b2695b8474b44ed7d0bce54)), closes [#16289](https://github.com/aws/aws-cdk/issues/16289)
 * **core:** normalize line endings in asset hash calculation ([#16276](https://github.com/aws/aws-cdk/issues/16276)) ([01bf6e2](https://github.com/aws/aws-cdk/commit/01bf6e2922994e7d41c8c6b171aa1693835f2b53))

From 78b4660db79ce4dd3974b074d828414054bb9179 Mon Sep 17 00:00:00 2001
From: Elad Ben-Israel <benisrae@amazon.com>
Date: Wed, 1 Sep 2021 11:08:39 +0300
Subject: [PATCH 50/91] Update CHANGELOG.md

---
 CHANGELOG.md | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index 638fe5a43e6e2..e50659a3c7123 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -24,7 +24,7 @@ All notable changes to this project will be documented in this file. See [standa
 ### Bug Fixes
 
 * **apigatewayv2:** api mapping key with two hyphens is disallowed ([#16204](https://github.com/aws/aws-cdk/issues/16204)) ([0889564](https://github.com/aws/aws-cdk/commit/0889564a0c1b04d33909dd3fdb42147f23d67cbd)), closes [#15948](https://github.com/aws/aws-cdk/issues/15948)
-* **aws-rds:** fromDatabaseInstanceAttributes incorrectly stringifies ports with tokens ([#16286](https://github.com/aws/aws-cdk/issues/16286)) ([41b831a](https://github.com/aws/aws-cdk/commit/41b831a6698ee6c7a3c8968bff8273a0c7f35448)), closes [#11813](https://github.com/aws/aws-cdk/issues/11813)
+* **rds:** fromDatabaseInstanceAttributes incorrectly stringifies ports with tokens ([#16286](https://github.com/aws/aws-cdk/issues/16286)) ([41b831a](https://github.com/aws/aws-cdk/commit/41b831a6698ee6c7a3c8968bff8273a0c7f35448)), closes [#11813](https://github.com/aws/aws-cdk/issues/11813)
 * **core:** inconsistent analytics string across operating systems ([#16300](https://github.com/aws/aws-cdk/issues/16300)) ([ff6082c](https://github.com/aws/aws-cdk/commit/ff6082caf7e534989fb8ee6b4c63c0c02e9a5ec0)), closes [#15322](https://github.com/aws/aws-cdk/issues/15322)
 * **docs:** unnecessary log group in Step Functions state machine x-ray example ([#16159](https://github.com/aws/aws-cdk/issues/16159)) ([04d4547](https://github.com/aws/aws-cdk/commit/04d45474d80d3687a3fdf27f4d76dd1c8521eff0))
 * **elasticloadbalancingv2:** target group health check does not validate interval versus timeout ([#16107](https://github.com/aws/aws-cdk/issues/16107)) ([a85ad39](https://github.com/aws/aws-cdk/commit/a85ad392459c815d5c8e645dd3e8240d059024e6)), closes [#3703](https://github.com/aws/aws-cdk/issues/3703)

From 74af7afc6a741061a40d28892d6164a7d39f8a92 Mon Sep 17 00:00:00 2001
From: Niranjan Jayakar <nija@amazon.com>
Date: Wed, 1 Sep 2021 10:00:13 +0100
Subject: [PATCH 51/91] Apply suggestions from code review

---
 CHANGELOG.md | 3 +--
 1 file changed, 1 insertion(+), 2 deletions(-)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index e50659a3c7123..0c4b63bd89989 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -24,9 +24,8 @@ All notable changes to this project will be documented in this file. See [standa
 ### Bug Fixes
 
 * **apigatewayv2:** api mapping key with two hyphens is disallowed ([#16204](https://github.com/aws/aws-cdk/issues/16204)) ([0889564](https://github.com/aws/aws-cdk/commit/0889564a0c1b04d33909dd3fdb42147f23d67cbd)), closes [#15948](https://github.com/aws/aws-cdk/issues/15948)
-* **rds:** fromDatabaseInstanceAttributes incorrectly stringifies ports with tokens ([#16286](https://github.com/aws/aws-cdk/issues/16286)) ([41b831a](https://github.com/aws/aws-cdk/commit/41b831a6698ee6c7a3c8968bff8273a0c7f35448)), closes [#11813](https://github.com/aws/aws-cdk/issues/11813)
+* **rds:** `fromDatabaseInstanceAttributes()` incorrectly stringifies ports with tokens ([#16286](https://github.com/aws/aws-cdk/issues/16286)) ([41b831a](https://github.com/aws/aws-cdk/commit/41b831a6698ee6c7a3c8968bff8273a0c7f35448)), closes [#11813](https://github.com/aws/aws-cdk/issues/11813)
 * **core:** inconsistent analytics string across operating systems ([#16300](https://github.com/aws/aws-cdk/issues/16300)) ([ff6082c](https://github.com/aws/aws-cdk/commit/ff6082caf7e534989fb8ee6b4c63c0c02e9a5ec0)), closes [#15322](https://github.com/aws/aws-cdk/issues/15322)
-* **docs:** unnecessary log group in Step Functions state machine x-ray example ([#16159](https://github.com/aws/aws-cdk/issues/16159)) ([04d4547](https://github.com/aws/aws-cdk/commit/04d45474d80d3687a3fdf27f4d76dd1c8521eff0))
 * **elasticloadbalancingv2:** target group health check does not validate interval versus timeout ([#16107](https://github.com/aws/aws-cdk/issues/16107)) ([a85ad39](https://github.com/aws/aws-cdk/commit/a85ad392459c815d5c8e645dd3e8240d059024e6)), closes [#3703](https://github.com/aws/aws-cdk/issues/3703)
 
 ## [1.120.0](https://github.com/aws/aws-cdk/compare/v1.119.0...v1.120.0) (2021-08-26)

From 61c251c21887ca15184618d7ab858b6a7907f96d Mon Sep 17 00:00:00 2001
From: Madeline Kusters <80541297+madeline-k@users.noreply.github.com>
Date: Wed, 1 Sep 2021 10:26:00 -0700
Subject: [PATCH 52/91] chore(resolve-version): export the alphaVersion
 (#16321)

This will be used by a change in `tools/individual-pkg-gen/copy-files-removing-deps.ts` on the `v2-main` branch, so that the `transform` step can correctly set the `version` key and the version for each dependency in each alpha module's `package.json` file.

See https://github.com/aws/aws-cdk/pull/16322 for usage.

Part of #15591

----

*By submitting this pull request, I confirm that my contribution is made under the terms of the Apache-2.0 license*
---
 scripts/resolve-version-lib.js               |  4 +-
 scripts/script-tests/resolve-version.test.js | 39 ++++++++++++++++++++
 2 files changed, 42 insertions(+), 1 deletion(-)

diff --git a/scripts/resolve-version-lib.js b/scripts/resolve-version-lib.js
index ec1f7b1b83822..5885d96b6afd9 100755
--- a/scripts/resolve-version-lib.js
+++ b/scripts/resolve-version-lib.js
@@ -37,7 +37,8 @@ function resolveVersion(rootdir) {
   // validate that current version matches the requirements
   //
 
-  const currentVersion = require(versionFilePath).version;
+  const versions = require(versionFilePath);
+  const currentVersion = versions.version;
   if (!currentVersion.startsWith(`${majorVersion}.`)) {
     throw new Error(`current version "${currentVersion}" does not use the expected major version ${majorVersion}`);
   }
@@ -68,6 +69,7 @@ function resolveVersion(rootdir) {
 
   return {
     version: currentVersion,
+    alphaVersion: versions.alphaVersion,
     versionFile,
     changelogFile,
     alphaChangelogFile,
diff --git a/scripts/script-tests/resolve-version.test.js b/scripts/script-tests/resolve-version.test.js
index 693e29234f023..1cabbb2acd795 100644
--- a/scripts/script-tests/resolve-version.test.js
+++ b/scripts/script-tests/resolve-version.test.js
@@ -17,6 +17,24 @@ happy({
     marker: '0.0.0',
     prerelease: undefined,
     version: '2.1.0',
+    alphaVersion: undefined,
+    versionFile: 'version.v2.json'
+  }
+});
+
+happy({
+  name: 'stable release with alpha modules',
+  inputs: {
+    'release.json': { majorVersion: 2, releaseType: 'stable' },
+    'version.v2.json': { version: '2.1.0', alphaVersion: '2.1.0-alpha' },
+  },
+  expected: {
+    changelogFile: 'CHANGELOG.v2.md',
+    alphaChangelogFile: 'CHANGELOG.v2.alpha.md',
+    marker: '0.0.0',
+    prerelease: undefined,
+    version: '2.1.0',
+    alphaVersion: '2.1.0-alpha',
     versionFile: 'version.v2.json'
   }
 });
@@ -33,6 +51,7 @@ happy({
     marker: '0.0.0',
     prerelease: 'alpha',
     version: '2.1.0-alpha.0',
+    alphaVersion: undefined,
     versionFile: 'version.v2.json'
   }
 });
@@ -49,6 +68,24 @@ happy({
     marker: '0.0.0',
     prerelease: 'rc',
     version: '2.1.0-rc.0',
+    alphaVersion: undefined,
+    versionFile: 'version.v2.json'
+  }
+});
+
+happy({
+  name: 'rc release with alpha modules',
+  inputs: {
+    'release.json': { majorVersion: 2, releaseType: 'rc' },
+    'version.v2.json': { version: '2.0.0-rc.0', alphaVersion: '2.0.0-alpha.0' },
+  },
+  expected: {
+    changelogFile: 'CHANGELOG.v2.md',
+    alphaChangelogFile: 'CHANGELOG.v2.alpha.md',
+    marker: '0.0.0',
+    prerelease: 'rc',
+    version: '2.0.0-rc.0',
+    alphaVersion: '2.0.0-alpha.0',
     versionFile: 'version.v2.json'
   }
 });
@@ -65,6 +102,7 @@ happy({
     marker: '0.0.0',
     prerelease: undefined,
     version: '1.72.0',
+    alphaVersion: undefined,
     versionFile: 'version.v1.json'
   }
 });
@@ -81,6 +119,7 @@ happy({
     marker: '0.0.0',
     prerelease: undefined,
     version: '2.0.0-rc.0',
+    alphaVersion: undefined,
     versionFile: 'version.v2.json'
   }
 });

From 46ea434e4dd3aa1f2d6d35217315c0464781d914 Mon Sep 17 00:00:00 2001
From: kaizen3031593 <zen.conroy@gmail.com>
Date: Wed, 1 Sep 2021 13:53:21 -0400
Subject: [PATCH 53/91] initial implementation of adding outputname to
 hasoutput

---
 .../assertions/lib/private/outputs.ts         | 15 ++++--
 packages/@aws-cdk/assertions/lib/template.ts  |  5 +-
 .../@aws-cdk/assertions/test/template.test.ts | 50 +++++++++++++++++--
 3 files changed, 60 insertions(+), 10 deletions(-)

diff --git a/packages/@aws-cdk/assertions/lib/private/outputs.ts b/packages/@aws-cdk/assertions/lib/private/outputs.ts
index 46e5a6cb1d52b..0b328ffda7fcb 100644
--- a/packages/@aws-cdk/assertions/lib/private/outputs.ts
+++ b/packages/@aws-cdk/assertions/lib/private/outputs.ts
@@ -12,20 +12,25 @@ export function findOutputs(inspector: StackInspector, props: any = {}): { [key:
   return result.matches;
 }
 
-export function hasOutput(inspector: StackInspector, props: any): string | void {
+export function hasOutput(inspector: StackInspector, outputName: string, props: any): string | void {
   const section: { [key: string]: {} } = inspector.value.Outputs;
-  const result = matchSection(section, props);
-
+  const result = matchSection(filterName(section, outputName), props);
   if (result.match) {
     return;
   }
 
   if (result.closestResult === undefined) {
-    return 'No outputs found in the template';
+    return `No outputs named ${outputName} found in the template.`;
   }
 
   return [
-    `Template has ${result.analyzedCount} outputs, but none match as expected.`,
+    `Template has ${result.analyzedCount} outputs named ${outputName}, but none match as expected.`,
     formatFailure(result.closestResult),
   ].join('\n');
+}
+
+function filterName(section: { [key: string]: {} }, outputName: string): { [key: string]: {} } {
+  return Object.entries(section ?? {})
+    .filter(([k, _]) => k === outputName)
+    .reduce((agg, [k, v]) => { return { ...agg, [k]: v }; }, {});
 }
\ No newline at end of file
diff --git a/packages/@aws-cdk/assertions/lib/template.ts b/packages/@aws-cdk/assertions/lib/template.ts
index 848c46bcc295a..2f9f84c54cabb 100644
--- a/packages/@aws-cdk/assertions/lib/template.ts
+++ b/packages/@aws-cdk/assertions/lib/template.ts
@@ -109,10 +109,11 @@ export class Template {
    * Assert that an Output with the given properties exists in the CloudFormation template.
    * By default, performs partial matching on the resource, via the `Match.objectLike()`.
    * To configure different behavour, use other matchers in the `Match` class.
+   * @param outputName the name of the output.
    * @param props the output as should be expected in the template.
    */
-  public hasOutput(props: any): void {
-    const matchError = hasOutput(this.inspector, props);
+  public hasOutput(outputName: string, props: any): void {
+    const matchError = hasOutput(this.inspector, outputName, props);
     if (matchError) {
       throw new Error(matchError);
     }
diff --git a/packages/@aws-cdk/assertions/test/template.test.ts b/packages/@aws-cdk/assertions/test/template.test.ts
index 50fb60a1a27f7..fc3c34deecd57 100644
--- a/packages/@aws-cdk/assertions/test/template.test.ts
+++ b/packages/@aws-cdk/assertions/test/template.test.ts
@@ -342,7 +342,7 @@ describe('Template', () => {
       });
 
       const inspect = Template.fromStack(stack);
-      expect(() => inspect.hasOutput({ Value: 'Bar' })).not.toThrow();
+      expect(() => inspect.hasOutput('Foo', { Value: 'Bar' })).not.toThrow();
     });
 
     test('not matching', (done) => {
@@ -357,18 +357,62 @@ describe('Template', () => {
 
       const inspect = Template.fromStack(stack);
       expectToThrow(
-        () => inspect.hasOutput({
+        () => inspect.hasOutput('Foo', {
           Value: 'Bar',
           Export: { Name: 'ExportBaz' },
         }),
         [
-          /2 outputs/,
+          /1 outputs named Foo/,
           /Expected ExportBaz but received ExportBar/,
         ],
         done,
       );
       done();
     });
+
+    test('outputName not matching', (done) => {
+      const stack = new Stack();
+      new CfnOutput(stack, 'Foo', {
+        value: 'Bar',
+      });
+      new CfnOutput(stack, 'Fred', {
+        value: 'Baz',
+      });
+
+      const inspect = Template.fromStack(stack);
+      expectToThrow(
+        () => inspect.hasOutput('Fred', {
+          Value: 'Bar',
+        }),
+        [
+          /1 outputs named Fred/,
+          /Expected Bar but received Baz/,
+        ],
+        done,
+      );
+      done();
+    });
+  });
+
+  test('name not matching', (done) => {
+    const stack = new Stack();
+    new CfnOutput(stack, 'Foo', {
+      value: 'Bar',
+      exportName: 'ExportBar',
+    });
+
+    const inspect = Template.fromStack(stack);
+    expectToThrow(
+      () => inspect.hasOutput('Fred', {
+        Value: 'Bar',
+        Export: { Name: 'ExportBar' },
+      }),
+      [
+        /No outputs named Fred found in the template./,
+      ],
+      done,
+    );
+    done();
   });
 
   describe('findOutputs', () => {

From 839fdb90f4d68bf0f49fe6b8358af2870acb891d Mon Sep 17 00:00:00 2001
From: Nick Lynch <nlynch@amazon.com>
Date: Wed, 1 Sep 2021 19:20:28 +0100
Subject: [PATCH 54/91] chore(yarn-cling): rename test packages to real package
 names (#16325)

The tests for `yarn-cling` currently reference what were imaginary package names
as placeholders; those package names have now been registered. While this has no
practical impact, switching the package names to be ones we own just so there's
no ambiguity.

An `npm install` is never done on these directories, so the packages chosen really
doesn't matter. Just picked two of our favorites at random. :)

----

*By submitting this pull request, I confirm that my contribution is made under the terms of the Apache-2.0 license*
---
 tools/yarn-cling/.gitignore                   |  4 +--
 tools/yarn-cling/package.json                 |  2 +-
 tools/yarn-cling/test/cling.test.ts           | 32 +++++++++----------
 .../{package2 => cdk}/package.json            |  2 +-
 .../node_modules/aws-cdk-lib/package.json     |  4 +++
 .../jsii/node_modules/aws-cdk/package.json    |  7 ++++
 .../test/test-fixture/jsii/node_modules/cdk   |  1 +
 .../test/test-fixture/jsii/package.json       |  8 +++++
 .../package1/node_modules/package2            |  1 -
 .../registrydependency1/package.json          |  7 ----
 .../registrydependency2/package.json          |  4 ---
 .../test/test-fixture/package1/package.json   |  8 -----
 tools/yarn-cling/test/test-fixture/yarn.lock  |  4 +--
 13 files changed, 42 insertions(+), 42 deletions(-)
 rename tools/yarn-cling/test/test-fixture/{package2 => cdk}/package.json (52%)
 create mode 100644 tools/yarn-cling/test/test-fixture/jsii/node_modules/aws-cdk-lib/package.json
 create mode 100644 tools/yarn-cling/test/test-fixture/jsii/node_modules/aws-cdk/package.json
 create mode 120000 tools/yarn-cling/test/test-fixture/jsii/node_modules/cdk
 create mode 100644 tools/yarn-cling/test/test-fixture/jsii/package.json
 delete mode 120000 tools/yarn-cling/test/test-fixture/package1/node_modules/package2
 delete mode 100644 tools/yarn-cling/test/test-fixture/package1/node_modules/registrydependency1/package.json
 delete mode 100644 tools/yarn-cling/test/test-fixture/package1/node_modules/registrydependency2/package.json
 delete mode 100644 tools/yarn-cling/test/test-fixture/package1/package.json

diff --git a/tools/yarn-cling/.gitignore b/tools/yarn-cling/.gitignore
index 884f5381e01ab..bef31def37928 100644
--- a/tools/yarn-cling/.gitignore
+++ b/tools/yarn-cling/.gitignore
@@ -11,5 +11,5 @@ dist
 coverage
 nyc.config.js
 !.eslintrc.js
-!test/test-fixture/package1/node_modules/
-junit.xml
\ No newline at end of file
+!test/test-fixture/jsii/node_modules/
+junit.xml
diff --git a/tools/yarn-cling/package.json b/tools/yarn-cling/package.json
index 52501bf50f83e..9d86cc671b4d4 100644
--- a/tools/yarn-cling/package.json
+++ b/tools/yarn-cling/package.json
@@ -16,7 +16,7 @@
     "build": "tsc",
     "watch": "tsc -w",
     "pkglint": "pkglint -f",
-    "test": "ln -sf ../../package2 test/test-fixture/package1/node_modules/ && jest",
+    "test": "ln -sf ../../cdk test/test-fixture/jsii/node_modules/ && jest",
     "build+test+package": "yarn build+test",
     "build+test": "yarn build && yarn test",
     "build+extract": "yarn build",
diff --git a/tools/yarn-cling/test/cling.test.ts b/tools/yarn-cling/test/cling.test.ts
index 1628d2415a1ae..f56e98f535f91 100644
--- a/tools/yarn-cling/test/cling.test.ts
+++ b/tools/yarn-cling/test/cling.test.ts
@@ -3,22 +3,22 @@ import { checkRequiredVersions, generateShrinkwrap } from '../lib';
 
 test('generate lock for fixture directory', async () => {
   const lockFile = await generateShrinkwrap({
-    packageJsonFile: path.join(__dirname, 'test-fixture', 'package1', 'package.json'),
+    packageJsonFile: path.join(__dirname, 'test-fixture', 'jsii', 'package.json'),
     hoist: false,
   });
 
   expect(lockFile).toEqual({
     lockfileVersion: 1,
-    name: 'package1',
+    name: 'jsii',
     requires: true,
     version: '1.1.1',
     dependencies: {
-      package2: {
+      'cdk': {
         version: '2.2.2',
       },
-      registrydependency1: {
+      'aws-cdk': {
         dependencies: {
-          registrydependency2: {
+          'aws-cdk-lib': {
             integrity: 'sha512-pineapple',
             resolved: 'https://registry.bla.com/stuff',
             version: '2.3.999',
@@ -26,7 +26,7 @@ test('generate lock for fixture directory', async () => {
         },
         integrity: 'sha512-banana',
         requires: {
-          registrydependency2: '^2.3.4',
+          'aws-cdk-lib': '^2.3.4',
         },
         resolved: 'https://registry.bla.com/stuff',
         version: '1.2.999',
@@ -37,28 +37,28 @@ test('generate lock for fixture directory', async () => {
 
 test('generate hoisted lock for fixture directory', async () => {
   const lockFile = await generateShrinkwrap({
-    packageJsonFile: path.join(__dirname, 'test-fixture', 'package1', 'package.json'),
+    packageJsonFile: path.join(__dirname, 'test-fixture', 'jsii', 'package.json'),
     hoist: true,
   });
 
   expect(lockFile).toEqual({
     lockfileVersion: 1,
-    name: 'package1',
+    name: 'jsii',
     requires: true,
     version: '1.1.1',
     dependencies: {
-      package2: {
+      'cdk': {
         version: '2.2.2',
       },
-      registrydependency1: {
+      'aws-cdk': {
         integrity: 'sha512-banana',
         requires: {
-          registrydependency2: '^2.3.4',
+          'aws-cdk-lib': '^2.3.4',
         },
         resolved: 'https://registry.bla.com/stuff',
         version: '1.2.999',
       },
-      registrydependency2: {
+      'aws-cdk-lib': {
         integrity: 'sha512-pineapple',
         resolved: 'https://registry.bla.com/stuff',
         version: '2.3.999',
@@ -70,17 +70,17 @@ test('generate hoisted lock for fixture directory', async () => {
 test('fail when requires cannot be satisfied', async () => {
   const lockFile = {
     lockfileVersion: 1,
-    name: 'package1',
+    name: 'jsii',
     requires: true,
     version: '1.1.1',
     dependencies: {
-      package1: {
+      jsii: {
         version: '2.2.2',
         requires: {
-          package2: '^3.3.3', // <- this needs to be adjusted
+          cdk: '^3.3.3', // <- this needs to be adjusted
         },
       },
-      package2: {
+      cdk: {
         version: '4.4.4',
       },
     },
diff --git a/tools/yarn-cling/test/test-fixture/package2/package.json b/tools/yarn-cling/test/test-fixture/cdk/package.json
similarity index 52%
rename from tools/yarn-cling/test/test-fixture/package2/package.json
rename to tools/yarn-cling/test/test-fixture/cdk/package.json
index d10f139d13944..8594e124f71b7 100644
--- a/tools/yarn-cling/test/test-fixture/package2/package.json
+++ b/tools/yarn-cling/test/test-fixture/cdk/package.json
@@ -1,4 +1,4 @@
 {
-    "name": "package2",
+    "name": "cdk",
     "version": "2.2.2"
 }
diff --git a/tools/yarn-cling/test/test-fixture/jsii/node_modules/aws-cdk-lib/package.json b/tools/yarn-cling/test/test-fixture/jsii/node_modules/aws-cdk-lib/package.json
new file mode 100644
index 0000000000000..2721d93a758df
--- /dev/null
+++ b/tools/yarn-cling/test/test-fixture/jsii/node_modules/aws-cdk-lib/package.json
@@ -0,0 +1,4 @@
+{
+    "name": "aws-cdk-lib",
+    "version": "2.3.999"
+}
diff --git a/tools/yarn-cling/test/test-fixture/jsii/node_modules/aws-cdk/package.json b/tools/yarn-cling/test/test-fixture/jsii/node_modules/aws-cdk/package.json
new file mode 100644
index 0000000000000..f074216bccb3b
--- /dev/null
+++ b/tools/yarn-cling/test/test-fixture/jsii/node_modules/aws-cdk/package.json
@@ -0,0 +1,7 @@
+{
+    "name": "aws-cdk",
+    "version": "1.2.999",
+    "dependencies": {
+        "aws-cdk-lib": "^2.3.4"
+    }
+}
diff --git a/tools/yarn-cling/test/test-fixture/jsii/node_modules/cdk b/tools/yarn-cling/test/test-fixture/jsii/node_modules/cdk
new file mode 120000
index 0000000000000..7ce3fadc4aadf
--- /dev/null
+++ b/tools/yarn-cling/test/test-fixture/jsii/node_modules/cdk
@@ -0,0 +1 @@
+../../cdk
\ No newline at end of file
diff --git a/tools/yarn-cling/test/test-fixture/jsii/package.json b/tools/yarn-cling/test/test-fixture/jsii/package.json
new file mode 100644
index 0000000000000..8508d1f52fc9e
--- /dev/null
+++ b/tools/yarn-cling/test/test-fixture/jsii/package.json
@@ -0,0 +1,8 @@
+{
+    "name": "jsii",
+    "version": "1.1.1",
+    "dependencies": {
+        "aws-cdk": "^1.2.3",
+        "cdk": "2.2.2"
+    }
+}
diff --git a/tools/yarn-cling/test/test-fixture/package1/node_modules/package2 b/tools/yarn-cling/test/test-fixture/package1/node_modules/package2
deleted file mode 120000
index 8db12e196dfbd..0000000000000
--- a/tools/yarn-cling/test/test-fixture/package1/node_modules/package2
+++ /dev/null
@@ -1 +0,0 @@
-../../package2
\ No newline at end of file
diff --git a/tools/yarn-cling/test/test-fixture/package1/node_modules/registrydependency1/package.json b/tools/yarn-cling/test/test-fixture/package1/node_modules/registrydependency1/package.json
deleted file mode 100644
index 8ecbc5b50e2e6..0000000000000
--- a/tools/yarn-cling/test/test-fixture/package1/node_modules/registrydependency1/package.json
+++ /dev/null
@@ -1,7 +0,0 @@
-{
-    "name": "registrydependency1",
-    "version": "1.2.999",
-    "dependencies": {
-        "registrydependency2": "^2.3.4"
-    }
-}
diff --git a/tools/yarn-cling/test/test-fixture/package1/node_modules/registrydependency2/package.json b/tools/yarn-cling/test/test-fixture/package1/node_modules/registrydependency2/package.json
deleted file mode 100644
index 8b9d7f39ababd..0000000000000
--- a/tools/yarn-cling/test/test-fixture/package1/node_modules/registrydependency2/package.json
+++ /dev/null
@@ -1,4 +0,0 @@
-{
-    "name": "registrydependency2",
-    "version": "2.3.999"
-}
diff --git a/tools/yarn-cling/test/test-fixture/package1/package.json b/tools/yarn-cling/test/test-fixture/package1/package.json
deleted file mode 100644
index 8edf6d46e6537..0000000000000
--- a/tools/yarn-cling/test/test-fixture/package1/package.json
+++ /dev/null
@@ -1,8 +0,0 @@
-{
-    "name": "package1",
-    "version": "1.1.1",
-    "dependencies": {
-        "registrydependency1": "^1.2.3",
-        "package2": "2.2.2"
-    }
-}
diff --git a/tools/yarn-cling/test/test-fixture/yarn.lock b/tools/yarn-cling/test/test-fixture/yarn.lock
index fda733502a052..bb94543e94422 100644
--- a/tools/yarn-cling/test/test-fixture/yarn.lock
+++ b/tools/yarn-cling/test/test-fixture/yarn.lock
@@ -1,9 +1,9 @@
-"registrydependency1@^1.2.3":
+"aws-cdk@^1.2.3":
   version "1.2.999"
   resolved "https://registry.bla.com/stuff"
   integrity sha512-banana
 
-"registrydependency2@^2.3.4":
+"aws-cdk-lib@^2.3.4":
   version "2.3.999"
   resolved "https://registry.bla.com/stuff"
   integrity sha512-pineapple

From 66baca58adc294d5c5924cf8f8c5fa122c6d6dfc Mon Sep 17 00:00:00 2001
From: Unnati Parekh <80710604+upparekh@users.noreply.github.com>
Date: Wed, 1 Sep 2021 13:50:54 -0700
Subject: [PATCH 55/91] feat(ecs-service-extensions): Subscribe Extension
 (#16049)

----

This PR adds a new service extension, `SubscribeExtension`. This extension can be added to a service to create SQS Queues which can subscribe to the SNS Topics provided by the user.

It creates a default SQS Queue called `eventsQueue` . It also supports creation of topic-specific queues and sets up the SNS subscriptions accordingly. The created topic-queue subscriptions can be accessed using `subscriptions` field of the extension and the default queue for this service can be accessed using the `eventsQueue` getter method. (This PR does not include autoscaling, will be adding it in a separate PR)

*By submitting this pull request, I confirm that my contribution is made under the terms of the Apache-2.0 license*
---
 .../ecs-service-extensions/README.md          |  35 ++
 .../lib/extensions/index.ts                   |   1 +
 .../lib/extensions/queue.ts                   | 212 ++++++++
 .../ecs-service-extensions/package.json       |   4 +
 .../ecs-service-extensions/test/test.queue.ts | 508 ++++++++++++++++++
 5 files changed, 760 insertions(+)
 create mode 100644 packages/@aws-cdk-containers/ecs-service-extensions/lib/extensions/queue.ts
 create mode 100644 packages/@aws-cdk-containers/ecs-service-extensions/test/test.queue.ts

diff --git a/packages/@aws-cdk-containers/ecs-service-extensions/README.md b/packages/@aws-cdk-containers/ecs-service-extensions/README.md
index f3845e69a55e5..53e4d2b6f3c56 100644
--- a/packages/@aws-cdk-containers/ecs-service-extensions/README.md
+++ b/packages/@aws-cdk-containers/ecs-service-extensions/README.md
@@ -19,6 +19,7 @@ The `Service` construct provided by this module can be extended with optional `S
 - [AWS AppMesh](https://aws.amazon.com/app-mesh/) for adding your application to a service mesh
 - [Application Load Balancer](https://docs.aws.amazon.com/elasticloadbalancing/latest/application/introduction.html), for exposing your service to the public
 - [AWS FireLens](https://docs.aws.amazon.com/AmazonECS/latest/developerguide/using_firelens.html), for filtering and routing application logs
+- Queue to allow your service to consume messages from an SQS Queue which is populated by one or more SNS Topics that it is subscribed to
 - [Community Extensions](#community-extensions), providing support for advanced use cases
 
 The `ServiceExtension` class is an abstract class which you can also implement in
@@ -321,6 +322,40 @@ const environment = Environment.fromEnvironmentAttributes(stack, 'Environment',
 
 ```
 
+## Queue Extension
+
+This service extension creates a default SQS Queue `eventsQueue` for the service (if not provided) and accepts a list of `ISubscribable` objects that the `eventsQueue` can subscribe to. The service extension creates the subscriptions and sets up permissions for the service to consume messages from the SQS Queue.
+
+### Setting up SNS Topic Subscriptions for SQS Queues
+
+You can use this extension to set up SNS Topic subscriptions for the `eventsQueue`. To do this, create a new object of type `TopicSubscription` for every SNS Topic you want the `eventsQueue` to subscribe to and provide it as input to the service extension.
+
+```ts
+const myServiceDescription = nameDescription.add(new QueueExtension({
+  // Provide list of topic subscriptions that you want the `eventsQueue` to subscribe to
+  subscriptions: [new TopicSubscription({
+    topic: new sns.Topic(stack, 'my-topic'),
+  }],
+}));
+
+// To access the `eventsQueue` for the service, use the `eventsQueue` getter for the extension
+const myQueueExtension = myServiceDescription.extensions.queue as QueueExtension;
+const myEventsQueue = myQueueExtension.eventsQueue;
+```
+
+For setting up a topic-specific queue subscription, you can provide a custom queue in the `TopicSubscription` object along with the SNS Topic. The extension will set up a topic subscription for the provided queue instead of the default `eventsQueue` of the service.
+
+```ts
+nameDescription.add(new QueueExtension({
+  queue: myEventsQueue,
+  subscriptions: [new TopicSubscription({
+    topic: new sns.Topic(stack, 'my-topic'),
+    // `myTopicQueue` will subscribe to the `my-topic` instead of `eventsQueue`
+    queue: myTopicQueue,
+  }],
+}));
+```
+
 ## Community Extensions
 
 We encourage the development of Community Service Extensions that support
diff --git a/packages/@aws-cdk-containers/ecs-service-extensions/lib/extensions/index.ts b/packages/@aws-cdk-containers/ecs-service-extensions/lib/extensions/index.ts
index 4e464e0d0734e..78c138aba0102 100644
--- a/packages/@aws-cdk-containers/ecs-service-extensions/lib/extensions/index.ts
+++ b/packages/@aws-cdk-containers/ecs-service-extensions/lib/extensions/index.ts
@@ -6,3 +6,4 @@ export * from './cloudwatch-agent';
 export * from './scale-on-cpu-utilization';
 export * from './xray';
 export * from './assign-public-ip';
+export * from './queue';
\ No newline at end of file
diff --git a/packages/@aws-cdk-containers/ecs-service-extensions/lib/extensions/queue.ts b/packages/@aws-cdk-containers/ecs-service-extensions/lib/extensions/queue.ts
new file mode 100644
index 0000000000000..d43b587d6326e
--- /dev/null
+++ b/packages/@aws-cdk-containers/ecs-service-extensions/lib/extensions/queue.ts
@@ -0,0 +1,212 @@
+import * as ecs from '@aws-cdk/aws-ecs';
+import * as sns from '@aws-cdk/aws-sns';
+import * as subscription from '@aws-cdk/aws-sns-subscriptions';
+import * as sqs from '@aws-cdk/aws-sqs';
+import * as cdk from '@aws-cdk/core';
+import { Service } from '../service';
+import { Container } from './container';
+import { ContainerMutatingHook, ServiceExtension } from './extension-interfaces';
+
+// Keep this import separate from other imports to reduce chance for merge conflicts with v2-main
+// eslint-disable-next-line no-duplicate-imports, import/order
+import { Construct } from '@aws-cdk/core';
+
+/**
+ * An interface that will be implemented by all the resources that can be subscribed to.
+ */
+export interface ISubscribable {
+  /**
+   * All classes implementing this interface must also implement the `subscribe()` method
+   */
+  subscribe(extension: QueueExtension): sqs.IQueue;
+}
+
+/**
+ * The settings for the Queue extension.
+ */
+export interface QueueExtensionProps {
+  /**
+   * The list of subscriptions for this service.
+   *
+   * @default none
+   */
+  readonly subscriptions?: ISubscribable[];
+
+  /**
+   * The user-provided default queue for this service.
+   *
+   * @default If the `eventsQueue` is not provided, a default SQS Queue is created for the service.
+   */
+  readonly eventsQueue?: sqs.IQueue;
+}
+
+/**
+ * The topic-specific settings for creating the queue subscriptions.
+ */
+export interface TopicSubscriptionProps {
+  /**
+   * The SNS Topic to subscribe to.
+   */
+  readonly topic: sns.ITopic;
+
+  /**
+   * The user-provided queue to subscribe to the given topic.
+   * If the `queue` is not provided, the default `eventsQueue` will subscribe to the given topic.
+   *
+   * @default none
+   */
+  readonly queue?: sqs.IQueue;
+}
+
+/**
+ * The `TopicSubscription` class represents an SNS Topic resource that can be subscribed to by the service queues.
+ */
+export class TopicSubscription implements ISubscribable {
+  public readonly topic: sns.ITopic;
+
+  public readonly queue?: sqs.IQueue;
+
+  constructor(props: TopicSubscriptionProps) {
+    this.topic = props.topic;
+    this.queue = props.queue;
+  }
+
+  /**
+   * This method sets up SNS Topic subscriptions for the SQS queue provided by the user. If a `queue` is not provided,
+   * the default `eventsQueue` subscribes to the given topic.
+   *
+   * @param extension `QueueExtension` added to the service
+   * @returns the queue subscribed to the given topic
+   */
+  public subscribe(extension: QueueExtension) : sqs.IQueue {
+    let queue = extension.eventsQueue;
+    if (this.queue) {
+      queue = this.queue;
+    }
+    this.topic.addSubscription(new subscription.SqsSubscription(queue));
+    return queue;
+  }
+}
+
+/**
+ * Settings for the hook which mutates the application container
+ * to add the events queue URI to its environment.
+ */
+interface ContainerMutatingProps {
+  /**
+   * The events queue name and URI to be added to the container environment.
+   */
+  readonly environment: { [key: string]: string };
+}
+
+/**
+ * This hook modifies the application container's environment to
+ * add the queue URL for the events queue of the service.
+ */
+class QueueExtensionMutatingHook extends ContainerMutatingHook {
+  private environment: { [key: string]: string };
+
+  constructor(props: ContainerMutatingProps) {
+    super();
+    this.environment = props.environment;
+  }
+
+  public mutateContainerDefinition(props: ecs.ContainerDefinitionOptions): ecs.ContainerDefinitionOptions {
+    return {
+      ...props,
+
+      environment: { ...(props.environment || {}), ...this.environment },
+    } as ecs.ContainerDefinitionOptions;
+  }
+}
+
+/**
+ * This extension creates a default `eventsQueue` for the service (if not provided) and accepts a list of objects of
+ * type `ISubscribable` that the `eventsQueue` subscribes to. It creates the subscriptions and sets up permissions
+ * for the service to consume messages from the SQS Queues.
+ *
+ * The default queue for this service can be accessed using the getter `<extension>.eventsQueue`.
+ */
+export class QueueExtension extends ServiceExtension {
+  private _eventsQueue!: sqs.IQueue;
+
+  private subscriptionQueues = new Set<sqs.IQueue>();
+
+  private environment: { [key: string]: string } = {};
+
+  private props?: QueueExtensionProps;
+
+  constructor(props?: QueueExtensionProps) {
+    super('queue');
+
+    this.props = props;
+  }
+
+  /**
+   * This hook creates (if required) and sets the default queue `eventsQueue`. It also sets up the subscriptions for
+   * the provided `ISubscribable` objects.
+   *
+   * @param service The parent service which this extension has been added to
+   * @param scope The scope that this extension should create resources in
+   */
+  public prehook(service: Service, scope: Construct) {
+    this.parentService = service;
+    this.scope = scope;
+
+    let eventsQueue = this.props?.eventsQueue;
+    if (!eventsQueue) {
+      const deadLetterQueue = new sqs.Queue(this.scope, 'EventsDeadLetterQueue', {
+        retentionPeriod: cdk.Duration.days(14),
+      });
+
+      eventsQueue = new sqs.Queue(this.scope, 'EventsQueue', {
+        deadLetterQueue: {
+          queue: deadLetterQueue,
+          maxReceiveCount: 3,
+        },
+      });
+    }
+    this._eventsQueue = eventsQueue;
+
+    this.environment[`${this.parentService.id.toUpperCase()}_QUEUE_URI`] = this._eventsQueue.queueUrl;
+
+    if (this.props?.subscriptions) {
+      for (const subs of this.props.subscriptions) {
+        const subsQueue = subs.subscribe(this);
+        this.subscriptionQueues.add(subsQueue);
+      }
+    }
+  }
+
+  /**
+   * Add hooks to the main application extension so that it is modified to
+   * add the events queue URL to the container environment.
+   */
+  public addHooks() {
+    const container = this.parentService.serviceDescription.get('service-container') as Container;
+
+    if (!container) {
+      throw new Error('Queue Extension requires an application extension');
+    }
+
+    container.addContainerMutatingHook(new QueueExtensionMutatingHook({
+      environment: this.environment,
+    }));
+  }
+
+  /**
+   * After the task definition has been created, this hook grants SQS permissions to the task role.
+   *
+   * @param taskDefinition The created task definition
+   */
+  public useTaskDefinition(taskDefinition: ecs.TaskDefinition) {
+    this._eventsQueue.grantConsumeMessages(taskDefinition.taskRole);
+    for (const queue of this.subscriptionQueues) {
+      queue.grantConsumeMessages(taskDefinition.taskRole);
+    }
+  }
+
+  public get eventsQueue() : sqs.IQueue {
+    return this._eventsQueue;
+  }
+}
\ No newline at end of file
diff --git a/packages/@aws-cdk-containers/ecs-service-extensions/package.json b/packages/@aws-cdk-containers/ecs-service-extensions/package.json
index 0d99dadbedb02..444e43ba9a19a 100644
--- a/packages/@aws-cdk-containers/ecs-service-extensions/package.json
+++ b/packages/@aws-cdk-containers/ecs-service-extensions/package.json
@@ -64,6 +64,8 @@
     "@aws-cdk/aws-route53": "0.0.0",
     "@aws-cdk/aws-route53-targets": "0.0.0",
     "@aws-cdk/aws-servicediscovery": "0.0.0",
+    "@aws-cdk/aws-sns": "0.0.0",
+    "@aws-cdk/aws-sns-subscriptions": "0.0.0",
     "@aws-cdk/aws-sqs": "0.0.0",
     "@aws-cdk/core": "0.0.0",
     "@aws-cdk/custom-resources": "0.0.0",
@@ -89,6 +91,8 @@
     "@aws-cdk/aws-route53": "0.0.0",
     "@aws-cdk/aws-route53-targets": "0.0.0",
     "@aws-cdk/aws-servicediscovery": "0.0.0",
+    "@aws-cdk/aws-sns": "0.0.0",
+    "@aws-cdk/aws-sns-subscriptions": "0.0.0",
     "@aws-cdk/aws-sqs": "0.0.0",
     "@aws-cdk/core": "0.0.0",
     "@aws-cdk/custom-resources": "0.0.0",
diff --git a/packages/@aws-cdk-containers/ecs-service-extensions/test/test.queue.ts b/packages/@aws-cdk-containers/ecs-service-extensions/test/test.queue.ts
new file mode 100644
index 0000000000000..ec2fb234c16ce
--- /dev/null
+++ b/packages/@aws-cdk-containers/ecs-service-extensions/test/test.queue.ts
@@ -0,0 +1,508 @@
+import { countResources, expect, haveResource } from '@aws-cdk/assert-internal';
+import * as ecs from '@aws-cdk/aws-ecs';
+import * as sns from '@aws-cdk/aws-sns';
+import * as sqs from '@aws-cdk/aws-sqs';
+import * as cdk from '@aws-cdk/core';
+import { Test } from 'nodeunit';
+import { Container, Environment, QueueExtension, Service, ServiceDescription, TopicSubscription } from '../lib';
+
+export = {
+  'should only create a default queue when no input props are provided'(test: Test) {
+    // GIVEN
+    const stack = new cdk.Stack();
+
+    const environment = new Environment(stack, 'production');
+    const serviceDescription = new ServiceDescription();
+
+    serviceDescription.add(new Container({
+      cpu: 256,
+      memoryMiB: 512,
+      trafficPort: 80,
+      image: ecs.ContainerImage.fromRegistry('nathanpeck/name'),
+      environment: {
+        PORT: '80',
+      },
+    }));
+
+    // WHEN
+    serviceDescription.add(new QueueExtension());
+
+    new Service(stack, 'my-service', {
+      environment,
+      serviceDescription,
+    });
+
+    // THEN
+    // Ensure creation of default queue and queue policy allowing SNS Topics to send message to the queue
+    expect(stack).to(haveResource('AWS::SQS::Queue', {
+      MessageRetentionPeriod: 1209600,
+    }));
+
+    expect(stack).to(haveResource('AWS::SQS::Queue', {
+      RedrivePolicy: {
+        deadLetterTargetArn: {
+          'Fn::GetAtt': [
+            'EventsDeadLetterQueue404572C7',
+            'Arn',
+          ],
+        },
+        maxReceiveCount: 3,
+      },
+    }));
+
+    // Ensure the task role is given permissions to consume messages from the queue
+    expect(stack).to(haveResource('AWS::IAM::Policy', {
+      PolicyDocument: {
+        Statement: [
+          {
+            Action: [
+              'sqs:ReceiveMessage',
+              'sqs:ChangeMessageVisibility',
+              'sqs:GetQueueUrl',
+              'sqs:DeleteMessage',
+              'sqs:GetQueueAttributes',
+            ],
+            Effect: 'Allow',
+            Resource: {
+              'Fn::GetAtt': [
+                'EventsQueueB96EB0D2',
+                'Arn',
+              ],
+            },
+          },
+        ],
+        Version: '2012-10-17',
+      },
+    }));
+
+    // Ensure there are no SNS Subscriptions created
+    expect(stack).to(countResources('AWS::SNS::Subscription', 0));
+
+    // Ensure that the queue URL has been correctly appended to the environment variables
+    expect(stack).to(haveResource('AWS::ECS::TaskDefinition', {
+      ContainerDefinitions: [
+        {
+          Cpu: 256,
+          Environment: [
+            {
+              Name: 'PORT',
+              Value: '80',
+            },
+            {
+              Name: 'MY-SERVICE_QUEUE_URI',
+              Value: {
+                Ref: 'EventsQueueB96EB0D2',
+              },
+            },
+          ],
+          Image: 'nathanpeck/name',
+          Essential: true,
+          Memory: 512,
+          Name: 'app',
+          PortMappings: [
+            {
+              ContainerPort: 80,
+              Protocol: 'tcp',
+            },
+          ],
+          Ulimits: [
+            {
+              HardLimit: 1024000,
+              Name: 'nofile',
+              SoftLimit: 1024000,
+            },
+          ],
+        },
+      ],
+    }));
+
+    test.done();
+  },
+
+  'should be able to subscribe default events queue created by the extension to given topics'(test: Test) {
+    // GIVEN
+    const stack = new cdk.Stack();
+
+    const environment = new Environment(stack, 'production');
+    const serviceDescription = new ServiceDescription();
+
+    serviceDescription.add(new Container({
+      cpu: 256,
+      memoryMiB: 512,
+      trafficPort: 80,
+      image: ecs.ContainerImage.fromRegistry('nathanpeck/name'),
+      environment: {
+        PORT: '80',
+      },
+    }));
+
+    // WHEN
+    const topicSubscription1 = new TopicSubscription({
+      topic: new sns.Topic(stack, 'topic1'),
+    });
+    const topicSubscription2 = new TopicSubscription({
+      topic: new sns.Topic(stack, 'topic2'),
+    });
+    serviceDescription.add(new QueueExtension({
+      subscriptions: [topicSubscription1, topicSubscription2],
+    }));
+
+    new Service(stack, 'my-service', {
+      environment,
+      serviceDescription,
+    });
+
+    // THEN
+    // Ensure creation of default queue and queue policy allowing SNS Topics to send message to the queue
+    expect(stack).to(haveResource('AWS::SQS::Queue', {
+      MessageRetentionPeriod: 1209600,
+    }));
+
+    expect(stack).to(haveResource('AWS::SQS::Queue', {
+      RedrivePolicy: {
+        deadLetterTargetArn: {
+          'Fn::GetAtt': [
+            'EventsDeadLetterQueue404572C7',
+            'Arn',
+          ],
+        },
+        maxReceiveCount: 3,
+      },
+    }));
+
+    expect(stack).to(haveResource('AWS::SQS::QueuePolicy', {
+      PolicyDocument: {
+        Statement: [
+          {
+            Action: 'sqs:SendMessage',
+            Condition: {
+              ArnEquals: {
+                'aws:SourceArn': {
+                  Ref: 'topic152D84A37',
+                },
+              },
+            },
+            Effect: 'Allow',
+            Principal: {
+              Service: 'sns.amazonaws.com',
+            },
+            Resource: {
+              'Fn::GetAtt': [
+                'EventsQueueB96EB0D2',
+                'Arn',
+              ],
+            },
+          },
+          {
+            Action: 'sqs:SendMessage',
+            Condition: {
+              ArnEquals: {
+                'aws:SourceArn': {
+                  Ref: 'topic2A4FB547F',
+                },
+              },
+            },
+            Effect: 'Allow',
+            Principal: {
+              Service: 'sns.amazonaws.com',
+            },
+            Resource: {
+              'Fn::GetAtt': [
+                'EventsQueueB96EB0D2',
+                'Arn',
+              ],
+            },
+          },
+        ],
+        Version: '2012-10-17',
+      },
+    }));
+
+    // Ensure the task role is given permissions to consume messages from the queue
+    expect(stack).to(haveResource('AWS::IAM::Policy', {
+      PolicyDocument: {
+        Statement: [
+          {
+            Action: [
+              'sqs:ReceiveMessage',
+              'sqs:ChangeMessageVisibility',
+              'sqs:GetQueueUrl',
+              'sqs:DeleteMessage',
+              'sqs:GetQueueAttributes',
+            ],
+            Effect: 'Allow',
+            Resource: {
+              'Fn::GetAtt': [
+                'EventsQueueB96EB0D2',
+                'Arn',
+              ],
+            },
+          },
+        ],
+        Version: '2012-10-17',
+      },
+    }));
+
+    // Ensure SNS Subscriptions for given topics
+    expect(stack).to(haveResource('AWS::SNS::Subscription', {
+      Protocol: 'sqs',
+      TopicArn: {
+        Ref: 'topic152D84A37',
+      },
+      Endpoint: {
+        'Fn::GetAtt': [
+          'EventsQueueB96EB0D2',
+          'Arn',
+        ],
+      },
+    }));
+
+    expect(stack).to(haveResource('AWS::SNS::Subscription', {
+      Protocol: 'sqs',
+      TopicArn: {
+        Ref: 'topic2A4FB547F',
+      },
+      Endpoint: {
+        'Fn::GetAtt': [
+          'EventsQueueB96EB0D2',
+          'Arn',
+        ],
+      },
+    }));
+
+    // Ensure that the queue URL has been correctly appended to the environment variables
+    expect(stack).to(haveResource('AWS::ECS::TaskDefinition', {
+      ContainerDefinitions: [
+        {
+          Cpu: 256,
+          Environment: [
+            {
+              Name: 'PORT',
+              Value: '80',
+            },
+            {
+              Name: 'MY-SERVICE_QUEUE_URI',
+              Value: {
+                Ref: 'EventsQueueB96EB0D2',
+              },
+            },
+          ],
+          Image: 'nathanpeck/name',
+          Essential: true,
+          Memory: 512,
+          Name: 'app',
+          PortMappings: [
+            {
+              ContainerPort: 80,
+              Protocol: 'tcp',
+            },
+          ],
+          Ulimits: [
+            {
+              HardLimit: 1024000,
+              Name: 'nofile',
+              SoftLimit: 1024000,
+            },
+          ],
+        },
+      ],
+    }));
+
+    test.done();
+  },
+
+  'should be able to subscribe user-provided queue to given topics'(test: Test) {
+    // GIVEN
+    const stack = new cdk.Stack();
+
+    // WHEN
+    const environment = new Environment(stack, 'production');
+    const serviceDescription = new ServiceDescription();
+
+    serviceDescription.add(new Container({
+      cpu: 256,
+      memoryMiB: 512,
+      trafficPort: 80,
+      image: ecs.ContainerImage.fromRegistry('nathanpeck/name'),
+    }));
+
+    const topicSubscription1 = new TopicSubscription({
+      topic: new sns.Topic(stack, 'topic1'),
+      queue: new sqs.Queue(stack, 'myQueue'),
+    });
+    const topicSubscription2 = new TopicSubscription({
+      topic: new sns.Topic(stack, 'topic2'),
+    });
+    serviceDescription.add(new QueueExtension({
+      subscriptions: [topicSubscription1, topicSubscription2],
+      eventsQueue: new sqs.Queue(stack, 'defQueue'),
+    }));
+
+    new Service(stack, 'my-service', {
+      environment,
+      serviceDescription,
+    });
+
+    // THEN
+    // Ensure queue policy allows SNS Topics to send message to the queue
+    expect(stack).to(haveResource('AWS::SQS::QueuePolicy', {
+      PolicyDocument: {
+        Statement: [
+          {
+            Action: 'sqs:SendMessage',
+            Condition: {
+              ArnEquals: {
+                'aws:SourceArn': {
+                  Ref: 'topic152D84A37',
+                },
+              },
+            },
+            Effect: 'Allow',
+            Principal: {
+              Service: 'sns.amazonaws.com',
+            },
+            Resource: {
+              'Fn::GetAtt': [
+                'myQueue4FDFF71C',
+                'Arn',
+              ],
+            },
+          },
+        ],
+        Version: '2012-10-17',
+      },
+    }));
+
+    expect(stack).to(haveResource('AWS::SQS::QueuePolicy', {
+      PolicyDocument: {
+        Statement: [
+          {
+            Action: 'sqs:SendMessage',
+            Condition: {
+              ArnEquals: {
+                'aws:SourceArn': {
+                  Ref: 'topic2A4FB547F',
+                },
+              },
+            },
+            Effect: 'Allow',
+            Principal: {
+              Service: 'sns.amazonaws.com',
+            },
+            Resource: {
+              'Fn::GetAtt': [
+                'defQueue1F91A65B',
+                'Arn',
+              ],
+            },
+          },
+        ],
+        Version: '2012-10-17',
+      },
+    }));
+
+    // Ensure the task role is given permissions to consume messages from the queue
+    expect(stack).to(haveResource('AWS::IAM::Policy', {
+      PolicyDocument: {
+        Statement: [
+          {
+            Action: [
+              'sqs:ReceiveMessage',
+              'sqs:ChangeMessageVisibility',
+              'sqs:GetQueueUrl',
+              'sqs:DeleteMessage',
+              'sqs:GetQueueAttributes',
+            ],
+            Effect: 'Allow',
+            Resource: {
+              'Fn::GetAtt': [
+                'defQueue1F91A65B',
+                'Arn',
+              ],
+            },
+          },
+          {
+            Action: [
+              'sqs:ReceiveMessage',
+              'sqs:ChangeMessageVisibility',
+              'sqs:GetQueueUrl',
+              'sqs:DeleteMessage',
+              'sqs:GetQueueAttributes',
+            ],
+            Effect: 'Allow',
+            Resource: {
+              'Fn::GetAtt': [
+                'myQueue4FDFF71C',
+                'Arn',
+              ],
+            },
+          },
+        ],
+        Version: '2012-10-17',
+      },
+    }));
+
+    // Ensure SNS Subscriptions for given topics
+    expect(stack).to(haveResource('AWS::SNS::Subscription', {
+      Protocol: 'sqs',
+      TopicArn: {
+        Ref: 'topic152D84A37',
+      },
+      Endpoint: {
+        'Fn::GetAtt': [
+          'myQueue4FDFF71C',
+          'Arn',
+        ],
+      },
+    }));
+
+    expect(stack).to(haveResource('AWS::SNS::Subscription', {
+      Protocol: 'sqs',
+      TopicArn: {
+        Ref: 'topic2A4FB547F',
+      },
+      Endpoint: {
+        'Fn::GetAtt': [
+          'defQueue1F91A65B',
+          'Arn',
+        ],
+      },
+    }));
+
+    // Ensure that the queue URL has been correctly added to the environment variables
+    expect(stack).to(haveResource('AWS::ECS::TaskDefinition', {
+      ContainerDefinitions: [
+        {
+          Cpu: 256,
+          Environment: [
+            {
+              Name: 'MY-SERVICE_QUEUE_URI',
+              Value: {
+                Ref: 'defQueue1F91A65B',
+              },
+            },
+          ],
+          Image: 'nathanpeck/name',
+          Essential: true,
+          Memory: 512,
+          Name: 'app',
+          PortMappings: [
+            {
+              ContainerPort: 80,
+              Protocol: 'tcp',
+            },
+          ],
+          Ulimits: [
+            {
+              HardLimit: 1024000,
+              Name: 'nofile',
+              SoftLimit: 1024000,
+            },
+          ],
+        },
+      ],
+    }));
+
+    test.done();
+  },
+};
\ No newline at end of file

From 349361d0399c05e21c5c4c5a2b69edfc6774c94f Mon Sep 17 00:00:00 2001
From: Douglas Naphas <douglasnaphas@gmail.com>
Date: Wed, 1 Sep 2021 18:10:46 -0400
Subject: [PATCH 56/91] docs(aws-ecr-assets): Correct un-closed parenthetical
 expression (#16172)

Closes #16171.

The expression is missing a right parentheses, and it is just as clear anyway as a new sentence.


----

*By submitting this pull request, I confirm that my contribution is made under the terms of the Apache-2.0 license*
---
 packages/@aws-cdk/aws-ecr-assets/README.md | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/packages/@aws-cdk/aws-ecr-assets/README.md b/packages/@aws-cdk/aws-ecr-assets/README.md
index 2414dc57c084e..f5993097418ac 100644
--- a/packages/@aws-cdk/aws-ecr-assets/README.md
+++ b/packages/@aws-cdk/aws-ecr-assets/README.md
@@ -46,7 +46,7 @@ interpreted. The recommended setting for Docker image assets is
 old projects) then `IgnoreMode.DOCKER` is the default and you don't need to
 configure it on the asset itself.
 
-Use `asset.imageUri` to reference the image (it includes both the ECR image URL
+Use `asset.imageUri` to reference the image. It includes both the ECR image URL
 and tag.
 
 You can optionally pass build args to the `docker build` command by specifying

From 2c1eb08ad174ba56c4f2a0d807a0cb039534d1a9 Mon Sep 17 00:00:00 2001
From: Markus Lindqvist <markus.lindqvist@op.fi>
Date: Thu, 2 Sep 2021 01:52:19 +0300
Subject: [PATCH 57/91] docs(pipelines): Fix documentation regarding
 rolePolicyStatements of CodeBuildStep (#16294)

fix(pipelines): Fix documentation regarding rolePolicyStatements of CodeBuildStep

----

*By submitting this pull request, I confirm that my contribution is made under the terms of the Apache-2.0 license*
---
 packages/@aws-cdk/pipelines/README.md | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/packages/@aws-cdk/pipelines/README.md b/packages/@aws-cdk/pipelines/README.md
index bab41842c2316..a63f1eab4d7c4 100644
--- a/packages/@aws-cdk/pipelines/README.md
+++ b/packages/@aws-cdk/pipelines/README.md
@@ -575,7 +575,7 @@ new CodeBuildStep('Synth', {
   securityGroups: [mySecurityGroup],
 
   // Additional policy statements for the execution role
-  rolePolicy: [
+  rolePolicyStatements: [
     new iam.PolicyStatement({ /* ... */ }),
   ],
 });

From dbfebb47a8ae61b2bb0557b6ba79a7b073f9d0df Mon Sep 17 00:00:00 2001
From: maafk <maafk@users.noreply.github.com>
Date: Thu, 2 Sep 2021 05:14:11 -0400
Subject: [PATCH 58/91] fix(core): allow asset bundling when selinux is enabled
 (#15742)

----

Revisiting [#9445](https://github.com/aws/aws-cdk/pull/9445) but looking to see if running on linux with selinux enabled.

This PR aims to allow for asset bundling on linux os with selinux enabled

*By submitting this pull request, I confirm that my contribution is made under the terms of the Apache-2.0 license*
---
 packages/@aws-cdk/core/lib/bundling.ts       |  27 +++-
 packages/@aws-cdk/core/test/bundling.test.ts | 134 ++++++++++++++++++-
 2 files changed, 158 insertions(+), 3 deletions(-)

diff --git a/packages/@aws-cdk/core/lib/bundling.ts b/packages/@aws-cdk/core/lib/bundling.ts
index c6b6b66881771..1ce4633354511 100644
--- a/packages/@aws-cdk/core/lib/bundling.ts
+++ b/packages/@aws-cdk/core/lib/bundling.ts
@@ -200,7 +200,7 @@ export class BundlingDockerImage {
       ...options.user
         ? ['-u', options.user]
         : [],
-      ...flatten(volumes.map(v => ['-v', `${v.hostPath}:${v.containerPath}:${v.consistency ?? DockerVolumeConsistency.DELEGATED}`])),
+      ...flatten(volumes.map(v => ['-v', `${v.hostPath}:${v.containerPath}:${isSeLinux() ? 'z,' : ''}${v.consistency ?? DockerVolumeConsistency.DELEGATED}`])),
       ...flatten(Object.entries(environment).map(([k, v]) => ['--env', `${k}=${v}`])),
       ...options.workingDirectory
         ? ['-w', options.workingDirectory]
@@ -481,3 +481,28 @@ function dockerExec(args: string[], options?: SpawnSyncOptions) {
 
   return proc;
 }
+
+function isSeLinux() : boolean {
+  if (process.platform != 'linux') {
+    return false;
+  }
+  const prog = 'selinuxenabled';
+  const proc = spawnSync(prog, [], {
+    stdio: [ // show selinux status output
+      'pipe', // get value of stdio
+      process.stderr, // redirect stdout to stderr
+      'inherit', // inherit stderr
+    ],
+  });
+  if (proc.error) {
+    // selinuxenabled not a valid command, therefore not enabled
+    return false;
+  }
+  if (proc.status == 0) {
+    // selinux enabled
+    return true;
+  } else {
+    // selinux not enabled
+    return false;
+  }
+}
diff --git a/packages/@aws-cdk/core/test/bundling.test.ts b/packages/@aws-cdk/core/test/bundling.test.ts
index 174bc15c7b115..48522347e698c 100644
--- a/packages/@aws-cdk/core/test/bundling.test.ts
+++ b/packages/@aws-cdk/core/test/bundling.test.ts
@@ -12,6 +12,7 @@ nodeunitShim({
   },
 
   'bundling with image from registry'(test: Test) {
+    sinon.stub(process, 'platform').value('darwin');
     const spawnSyncStub = sinon.stub(child_process, 'spawnSync').returns({
       status: 0,
       stderr: Buffer.from('stderr'),
@@ -230,6 +231,7 @@ nodeunitShim({
   },
 
   'custom entrypoint is passed through to docker exec'(test: Test) {
+    sinon.stub(process, 'platform').value('darwin');
     const spawnSyncStub = sinon.stub(child_process, 'spawnSync').returns({
       status: 0,
       stderr: Buffer.from('stderr'),
@@ -343,7 +345,9 @@ nodeunitShim({
     test.done();
   },
 
-  'adding user provided securit-opt'(test: Test) {
+  'adding user provided security-opt'(test: Test) {
+    // GIVEN
+    sinon.stub(process, 'platform').value('darwin');
     const spawnSyncStub = sinon.stub(child_process, 'spawnSync').returns({
       status: 0,
       stderr: Buffer.from('stderr'),
@@ -352,8 +356,9 @@ nodeunitShim({
       output: ['stdout', 'stderr'],
       signal: null,
     });
-
     const image = DockerImage.fromRegistry('alpine');
+
+    // GIVEN
     image.run({
       command: ['cool', 'command'],
       environment: {
@@ -379,4 +384,129 @@ nodeunitShim({
     ], { stdio: ['ignore', process.stderr, 'inherit'] }));
     test.done();
   },
+
+  'ensure selinux docker mount'(test: Test) {
+    // GIVEN
+    sinon.stub(process, 'platform').value('linux');
+    const spawnSyncStub = sinon.stub(child_process, 'spawnSync');
+    spawnSyncStub.onFirstCall().returns({
+      status: 0,
+      stderr: Buffer.from('stderr'),
+      stdout: Buffer.from('stdout'),
+      pid: 123,
+      output: ['selinuxenable-command', 'stderr'],
+      signal: null,
+    });
+    spawnSyncStub.onSecondCall().returns({
+      status: 0,
+      stderr: Buffer.from('stderr'),
+      stdout: Buffer.from('stdout'),
+      pid: 124,
+      output: ['docker run command', 'stderr'],
+      signal: null,
+    });
+
+    // WHEN
+    const image = DockerImage.fromRegistry('alpine');
+    image.run({
+      command: ['cool', 'command'],
+      volumes: [{ hostPath: '/host-path', containerPath: '/container-path' }],
+      workingDirectory: '/working-directory',
+      user: 'user:group',
+    });
+
+    // THEN
+    test.ok(spawnSyncStub.secondCall.calledWith('docker', [
+      'run', '--rm',
+      '-u', 'user:group',
+      '-v', '/host-path:/container-path:z,delegated',
+      '-w', '/working-directory',
+      'alpine',
+      'cool', 'command',
+    ], { stdio: ['ignore', process.stderr, 'inherit'] }));
+    test.done();
+  },
+
+  'ensure selinux docker mount on linux with selinux disabled'(test: Test) {
+    // GIVEN
+    sinon.stub(process, 'platform').value('linux');
+    const spawnSyncStub = sinon.stub(child_process, 'spawnSync');
+    spawnSyncStub.onFirstCall().returns({
+      status: 1,
+      stderr: Buffer.from('stderr'),
+      stdout: Buffer.from('stdout'),
+      pid: 123,
+      output: ['selinuxenabled output', 'stderr'],
+      signal: null,
+    });
+    spawnSyncStub.onSecondCall().returns({
+      status: 0,
+      stderr: Buffer.from('stderr'),
+      stdout: Buffer.from('stdout'),
+      pid: 124,
+      output: ['docker run command', 'stderr'],
+      signal: null,
+    });
+
+    // WHEN
+    const image = DockerImage.fromRegistry('alpine');
+    image.run({
+      command: ['cool', 'command'],
+      volumes: [{ hostPath: '/host-path', containerPath: '/container-path' }],
+      workingDirectory: '/working-directory',
+      user: 'user:group',
+    });
+
+    // THEN
+    test.ok(spawnSyncStub.secondCall.calledWith('docker', [
+      'run', '--rm',
+      '-u', 'user:group',
+      '-v', '/host-path:/container-path:delegated',
+      '-w', '/working-directory',
+      'alpine',
+      'cool', 'command',
+    ], { stdio: ['ignore', process.stderr, 'inherit'] }));
+    test.done();
+  },
+  'ensure no selinux docker mount if selinuxenabled isn\'t an available command'(test: Test) {
+    // GIVEN
+    sinon.stub(process, 'platform').value('linux');
+    const spawnSyncStub = sinon.stub(child_process, 'spawnSync');
+    spawnSyncStub.onFirstCall().returns({
+      status: 127,
+      stderr: Buffer.from('stderr'),
+      stdout: Buffer.from('stdout'),
+      pid: 123,
+      output: ['selinuxenabled output', 'stderr'],
+      signal: null,
+    });
+    spawnSyncStub.onSecondCall().returns({
+      status: 0,
+      stderr: Buffer.from('stderr'),
+      stdout: Buffer.from('stdout'),
+      pid: 124,
+      output: ['docker run command', 'stderr'],
+      signal: null,
+    });
+
+    // WHEN
+    const image = DockerImage.fromRegistry('alpine');
+    image.run({
+      command: ['cool', 'command'],
+      volumes: [{ hostPath: '/host-path', containerPath: '/container-path' }],
+      workingDirectory: '/working-directory',
+      user: 'user:group',
+    });
+
+    // THEN
+    test.ok(spawnSyncStub.secondCall.calledWith('docker', [
+      'run', '--rm',
+      '-u', 'user:group',
+      '-v', '/host-path:/container-path:delegated',
+      '-w', '/working-directory',
+      'alpine',
+      'cool', 'command',
+    ], { stdio: ['ignore', process.stderr, 'inherit'] }));
+    test.done();
+  },
 });

From 6e55c952d683f87bb815deb29124b9a37824749a Mon Sep 17 00:00:00 2001
From: Adam Ruka <adamruka@amazon.com>
Date: Thu, 2 Sep 2021 15:32:47 -0700
Subject: [PATCH 59/91] feat(cli): hotswap deployments (#15748)

This is the first PR implementing the ["Accelerated personal deployments" RFC](https://github.com/aws/aws-cdk-rfcs/blob/master/text/0001-cdk-update.md).

It adds a (boolean) `--hotswap` flag to the `deploy` command that attempts to perform a short-circuit deployment, updating the resource directly, and skipping CloudFormation.
If we detect that the current change cannot be short-circuited
(because it contains an infrastructure change to the CDK code, most likely),
we fall back on performing a full CloudFormation deployment,
same as if `cdk deploy` was called without the `--hotswap` flag.

In this PR, the new switch supports only Lambda functions. Later PRs will add support for new resource types.

----

*By submitting this pull request, I confirm that my contribution is made under the terms of the Apache-2.0 license*
---
 .../cloudformation-diff/lib/diff/types.ts     |   6 +-
 packages/aws-cdk/README.md                    |  36 ++++
 packages/aws-cdk/bin/cdk.ts                   |  12 +-
 packages/aws-cdk/lib/api/aws-auth/sdk.ts      |   5 +
 .../lib/api/cloudformation-deployments.ts     |  10 ++
 packages/aws-cdk/lib/api/deploy-stack.ts      |  46 ++++-
 .../aws-cdk/lib/api/hotswap-deployments.ts    | 100 +++++++++++
 packages/aws-cdk/lib/api/hotswap/common.ts    |  57 +++++++
 .../lib/api/hotswap/lambda-functions.ts       | 159 ++++++++++++++++++
 .../api/util/cloudformation/evaluate-cfn.ts   |  89 ++++++++++
 packages/aws-cdk/lib/cdk-toolkit.ts           |  20 ++-
 .../api/cloudformation-deployments.test.ts    |  15 ++
 .../aws-cdk/test/api/deploy-stack.test.ts     |  62 ++++++-
 .../test/api/fake-cloudformation-stack.ts     |  34 ++++
 .../test/api/hotswap-deployments.test.ts      | 113 +++++++++++++
 packages/aws-cdk/test/cdk-toolkit.test.ts     |  34 +++-
 packages/aws-cdk/test/util.ts                 |   2 +-
 packages/aws-cdk/test/util/mock-sdk.ts        |   5 +
 18 files changed, 787 insertions(+), 18 deletions(-)
 create mode 100644 packages/aws-cdk/lib/api/hotswap-deployments.ts
 create mode 100644 packages/aws-cdk/lib/api/hotswap/common.ts
 create mode 100644 packages/aws-cdk/lib/api/hotswap/lambda-functions.ts
 create mode 100644 packages/aws-cdk/lib/api/util/cloudformation/evaluate-cfn.ts
 create mode 100644 packages/aws-cdk/test/api/fake-cloudformation-stack.ts
 create mode 100644 packages/aws-cdk/test/api/hotswap-deployments.test.ts

diff --git a/packages/@aws-cdk/cloudformation-diff/lib/diff/types.ts b/packages/@aws-cdk/cloudformation-diff/lib/diff/types.ts
index c8911c5da19fe..335783388275f 100644
--- a/packages/@aws-cdk/cloudformation-diff/lib/diff/types.ts
+++ b/packages/@aws-cdk/cloudformation-diff/lib/diff/types.ts
@@ -282,7 +282,7 @@ export class Difference<ValueType> implements IDifference<ValueType> {
    * @param oldValue the old value, cannot be equal (to the sense of +deepEqual+) to +newValue+.
    * @param newValue the new value, cannot be equal (to the sense of +deepEqual+) to +oldValue+.
    */
-  constructor(public readonly oldValue: ValueType | undefined, public readonly newValue: ValueType | undefined) {
+  constructor(public readonly oldValue: ValueType | undefined, public readonly newValue: ValueType | undefined) {
     if (oldValue === undefined && newValue === undefined) {
       throw new AssertionError({ message: 'oldValue and newValue are both undefined!' });
     }
@@ -309,7 +309,7 @@ export class Difference<ValueType> implements IDifference<ValueType> {
 export class PropertyDifference<ValueType> extends Difference<ValueType> {
   public readonly changeImpact?: ResourceImpact;
 
-  constructor(oldValue: ValueType | undefined, newValue: ValueType | undefined, args: { changeImpact?: ResourceImpact }) {
+  constructor(oldValue: ValueType | undefined, newValue: ValueType | undefined, args: { changeImpact?: ResourceImpact }) {
     super(oldValue, newValue);
     this.changeImpact = args.changeImpact;
   }
@@ -506,7 +506,7 @@ export class ResourceDifference implements IDifference<Resource> {
 
   constructor(
     public readonly oldValue: Resource | undefined,
-    public readonly newValue: Resource | undefined,
+    public readonly newValue: Resource | undefined,
     args: {
       resourceType: { oldType?: string, newType?: string },
       propertyDiffs: { [key: string]: PropertyDifference<any> },
diff --git a/packages/aws-cdk/README.md b/packages/aws-cdk/README.md
index 729413ae6859d..3a1b2882b2506 100644
--- a/packages/aws-cdk/README.md
+++ b/packages/aws-cdk/README.md
@@ -334,6 +334,42 @@ execute.
 $ cdk deploy --no-execute --change-set-name MyChangeSetName
 ```
 
+#### Hotswap deployments for faster development
+
+You can pass the `--hotswap` flag to the `deploy` command:
+
+```console
+$ cdk deploy --hotswap [StackNames]
+```
+
+This will attempt to perform a faster, short-circuit deployment if possible
+(for example, if you only changed the code of a Lambda function in your CDK app,
+but nothing else in your CDK code),
+skipping CloudFormation, and updating the affected resources directly.
+If the tool detects that the change does not support hotswapping,
+it will fall back and perform a full CloudFormation deployment,
+exactly like `cdk deploy` does without the `--hotswap` flag.
+
+Passing this option to `cdk deploy` will make it use your current AWS credentials to perform the API calls -
+it will not assume the Roles from your bootstrap stack,
+even if the `@aws-cdk/core:newStyleStackSynthesis` feature flag is set to `true`
+(as those Roles do not have the necessary permissions to update AWS resources directly, without using CloudFormation).
+For that reason, make sure that your credentials are for the same AWS account that the Stack(s)
+you are performing the hotswap deployment for belong to,
+and that you have the necessary IAM permissions to update the resources that are being deployed.
+
+Hotswapping is currently supported for the following changes
+(additional changes will be supported in the future):
+
+- Code asset changes of AWS Lambda functions.
+
+**⚠ Note #1**: This command deliberately introduces drift in CloudFormation stacks in order to speed up deployments.
+For this reason, only use it for development purposes.
+**Never use this flag for your production deployments**!
+
+**⚠ Note #2**: This command is considered experimental,
+and might have breaking changes in the future.
+
 ### `cdk destroy`
 
 Deletes a stack from it's environment. This will cause the resources in the stack to be destroyed (unless they were
diff --git a/packages/aws-cdk/bin/cdk.ts b/packages/aws-cdk/bin/cdk.ts
index a21a350415223..aaaef0deb3182 100644
--- a/packages/aws-cdk/bin/cdk.ts
+++ b/packages/aws-cdk/bin/cdk.ts
@@ -105,10 +105,17 @@ async function parseCommandLineArguments() {
       .option('outputs-file', { type: 'string', alias: 'O', desc: 'Path to file where stack outputs will be written as JSON', requiresArg: true })
       .option('previous-parameters', { type: 'boolean', default: true, desc: 'Use previous values for existing parameters (you must specify all parameters on every deployment if this is disabled)' })
       .option('progress', { type: 'string', choices: [StackActivityProgress.BAR, StackActivityProgress.EVENTS], desc: 'Display mode for stack activity events' })
-      .option('rollback', { type: 'boolean', default: true, desc: 'Rollback stack to stable state on failure (iterate more rapidly with --no-rollback or -R)' })
+      .option('rollback', { type: 'boolean', desc: 'Rollback stack to stable state on failure (iterate more rapidly with --no-rollback or -R)' })
       // Hack to get '-R' as an alias for '--no-rollback', suggested by: https://github.com/yargs/yargs/issues/1729
       .option('R', { type: 'boolean', hidden: true })
-      .middleware(yargsNegativeAlias('R', 'rollback'), true),
+      .middleware(yargsNegativeAlias('R', 'rollback'), true)
+      .option('hotswap', {
+        type: 'boolean',
+        desc: "Attempts to perform a 'hotswap' deployment, " +
+          'which skips CloudFormation and updates the resources directly, ' +
+          'and falls back to a full deployment if that is not possible. ' +
+          'Do not use this in production environments',
+      }),
     )
     .command('destroy [STACKS..]', 'Destroy the stack(s) named STACKS', yargs => yargs
       .option('all', { type: 'boolean', default: false, desc: 'Destroy all available stacks' })
@@ -324,6 +331,7 @@ async function initCommandLine() {
           progress: configuration.settings.get(['progress']),
           ci: args.ci,
           rollback: configuration.settings.get(['rollback']),
+          hotswap: args.hotswap,
         });
 
       case 'destroy':
diff --git a/packages/aws-cdk/lib/api/aws-auth/sdk.ts b/packages/aws-cdk/lib/api/aws-auth/sdk.ts
index ee21d8c17111b..3e6a935acdb9a 100644
--- a/packages/aws-cdk/lib/api/aws-auth/sdk.ts
+++ b/packages/aws-cdk/lib/api/aws-auth/sdk.ts
@@ -22,6 +22,7 @@ export interface ISDK {
    */
   currentAccount(): Promise<Account>;
 
+  lambda(): AWS.Lambda;
   cloudFormation(): AWS.CloudFormation;
   ec2(): AWS.EC2;
   ssm(): AWS.SSM;
@@ -83,6 +84,10 @@ export class SDK implements ISDK {
     this.currentRegion = region;
   }
 
+  public lambda(): AWS.Lambda {
+    return this.wrapServiceErrorHandling(new AWS.Lambda(this.config));
+  }
+
   public cloudFormation(): AWS.CloudFormation {
     return this.wrapServiceErrorHandling(new AWS.CloudFormation({
       ...this.config,
diff --git a/packages/aws-cdk/lib/api/cloudformation-deployments.ts b/packages/aws-cdk/lib/api/cloudformation-deployments.ts
index 8cea2ae411212..914efd51cd574 100644
--- a/packages/aws-cdk/lib/api/cloudformation-deployments.ts
+++ b/packages/aws-cdk/lib/api/cloudformation-deployments.ts
@@ -136,6 +136,15 @@ export interface DeployStackOptions {
    * @default true
    */
   readonly rollback?: boolean;
+
+  /*
+   * Whether to perform a 'hotswap' deployment.
+   * A 'hotswap' deployment will attempt to short-circuit CloudFormation
+   * and update the affected resources like Lambda functions directly.
+   *
+   * @default - false (do not perform a 'hotswap' deployment)
+   */
+  readonly hotswap?: boolean;
 }
 
 export interface DestroyStackOptions {
@@ -212,6 +221,7 @@ export class CloudFormationDeployments {
       progress: options.progress,
       ci: options.ci,
       rollback: options.rollback,
+      hotswap: options.hotswap,
     });
   }
 
diff --git a/packages/aws-cdk/lib/api/deploy-stack.ts b/packages/aws-cdk/lib/api/deploy-stack.ts
index 62c5815197fc2..b0770ebdf8ea7 100644
--- a/packages/aws-cdk/lib/api/deploy-stack.ts
+++ b/packages/aws-cdk/lib/api/deploy-stack.ts
@@ -9,8 +9,12 @@ import { AssetManifestBuilder } from '../util/asset-manifest-builder';
 import { publishAssets } from '../util/asset-publishing';
 import { contentHash } from '../util/content-hash';
 import { ISDK, SdkProvider } from './aws-auth';
+import { tryHotswapDeployment } from './hotswap-deployments';
 import { ToolkitInfo } from './toolkit-info';
-import { changeSetHasNoChanges, CloudFormationStack, TemplateParameters, waitForChangeSet, waitForStackDeploy, waitForStackDelete } from './util/cloudformation';
+import {
+  changeSetHasNoChanges, CloudFormationStack, TemplateParameters, waitForChangeSet,
+  waitForStackDeploy, waitForStackDelete, ParameterValues,
+} from './util/cloudformation';
 import { StackActivityMonitor, StackActivityProgress } from './util/cloudformation/stack-activity-monitor';
 
 // We need to map regions to domain suffixes, and the SDK already has a function to do this.
@@ -182,6 +186,15 @@ export interface DeployStackOptions {
    * @default true
    */
   readonly rollback?: boolean;
+
+  /*
+   * Whether to perform a 'hotswap' deployment.
+   * A 'hotswap' deployment will attempt to short-circuit CloudFormation
+   * and update the affected resources like Lambda functions directly.
+   *
+   * @default - false (do not perform a 'hotswap' deployment)
+   */
+  readonly hotswap?: boolean;
 }
 
 const LARGE_TEMPLATE_SIZE_KB = 50;
@@ -233,12 +246,32 @@ export async function deployStack(options: DeployStackOptions): Promise<DeploySt
     debug(`${deployName}: deploying...`);
   }
 
-  const executionId = uuid.v4();
   const bodyParameter = await makeBodyParameter(stackArtifact, options.resolvedEnvironment, legacyAssets, options.toolkitInfo);
 
   await publishAssets(legacyAssets.toManifest(stackArtifact.assembly.directory), options.sdkProvider, stackEnv);
 
-  const changeSetName = options.changeSetName || 'cdk-deploy-change-set';
+  if (options.hotswap) {
+    // attempt to short-circuit the deployment if possible
+    const hotswapDeploymentResult = await tryHotswapDeployment(options.sdkProvider, assetParams, cloudFormationStack, stackArtifact);
+    if (hotswapDeploymentResult) {
+      return hotswapDeploymentResult;
+    }
+    // could not short-circuit the deployment, perform a full CFN deploy instead
+    print('Could not perform a hotswap deployment, as the stack %s contains non-Asset changes', stackArtifact.displayName);
+    print('Falling back to doing a full deployment');
+  }
+
+  return prepareAndExecuteChangeSet(options, cloudFormationStack, stackArtifact, stackParams, bodyParameter);
+}
+
+async function prepareAndExecuteChangeSet(
+  options: DeployStackOptions, cloudFormationStack: CloudFormationStack,
+  stackArtifact: cxapi.CloudFormationStackArtifact, stackParams: ParameterValues, bodyParameter: TemplateBodyParameter,
+): Promise<DeployStackResult> {
+  const cfn = options.sdk.cloudFormation();
+  const deployName = options.deployName ?? stackArtifact.stackName;
+
+  const changeSetName = options.changeSetName ?? 'cdk-deploy-change-set';
   if (cloudFormationStack.exists) {
     //Delete any existing change sets generated by CDK since change set names must be unique.
     //The delete request is successful as long as the stack exists (even if the change set does not exist).
@@ -250,6 +283,7 @@ export async function deployStack(options: DeployStackOptions): Promise<DeploySt
 
   debug(`Attempting to create ChangeSet with name ${changeSetName} to ${update ? 'update' : 'create'} stack ${deployName}`);
   print('%s: creating CloudFormation changeset...', colors.bold(deployName));
+  const executionId = uuid.v4();
   const changeSet = await cfn.createChangeSet({
     StackName: deployName,
     ChangeSetName: changeSetName,
@@ -290,9 +324,11 @@ export async function deployStack(options: DeployStackOptions): Promise<DeploySt
   if (execute) {
     debug('Initiating execution of changeset %s on stack %s', changeSet.Id, deployName);
 
+    const shouldDisableRollback = (options.rollback === undefined && options.hotswap === true) || options.rollback === false;
     // Do a bit of contortions to only pass the `DisableRollback` flag if it's true. That way,
     // CloudFormation won't balk at the unrecognized option in regions where the feature is not available yet.
-    const disableRollback = options.rollback === false ? { DisableRollback: true } : undefined;
+    const disableRollback = shouldDisableRollback ? { DisableRollback: true } : undefined;
+
     await cfn.executeChangeSet({ StackName: deployName, ChangeSetName: changeSetName, ...disableRollback }).promise();
 
     // eslint-disable-next-line max-len
@@ -528,4 +564,4 @@ function restUrlFromManifest(url: string, environment: cxapi.Environment): strin
 
   const urlSuffix: string = regionUtil.getEndpointSuffix(environment.region);
   return `https://s3.${environment.region}.${urlSuffix}/${bucketName}/${objectKey}`;
-}
\ No newline at end of file
+}
diff --git a/packages/aws-cdk/lib/api/hotswap-deployments.ts b/packages/aws-cdk/lib/api/hotswap-deployments.ts
new file mode 100644
index 0000000000000..0c058499116cd
--- /dev/null
+++ b/packages/aws-cdk/lib/api/hotswap-deployments.ts
@@ -0,0 +1,100 @@
+import * as cfn_diff from '@aws-cdk/cloudformation-diff';
+import * as cxapi from '@aws-cdk/cx-api';
+import { CloudFormation } from 'aws-sdk';
+import { ISDK, Mode, SdkProvider } from './aws-auth';
+import { DeployStackResult } from './deploy-stack';
+import { ChangeHotswapImpact, HotswapOperation, ListStackResources } from './hotswap/common';
+import { isHotswappableLambdaFunctionChange } from './hotswap/lambda-functions';
+import { CloudFormationStack } from './util/cloudformation';
+
+/**
+ * Perform a hotswap deployment,
+ * short-circuiting CloudFormation if possible.
+ * If it's not possible to short-circuit the deployment
+ * (because the CDK Stack contains changes that cannot be deployed without CloudFormation),
+ * returns `undefined`.
+ */
+export async function tryHotswapDeployment(
+  sdkProvider: SdkProvider, assetParams: { [key: string]: string },
+  cloudFormationStack: CloudFormationStack, stackArtifact: cxapi.CloudFormationStackArtifact,
+): Promise<DeployStackResult | undefined> {
+  const currentTemplate = await cloudFormationStack.template();
+  const stackChanges = cfn_diff.diffTemplate(currentTemplate, stackArtifact.template);
+
+  // resolve the environment, so we can substitute things like AWS::Region in CFN expressions
+  const resolvedEnv = await sdkProvider.resolveEnvironment(stackArtifact.environment);
+  const hotswappableChanges = findAllHotswappableChanges(stackChanges, {
+    ...assetParams,
+    'AWS::Region': resolvedEnv.region,
+    'AWS::AccountId': resolvedEnv.account,
+  });
+  if (!hotswappableChanges) {
+    // this means there were changes to the template that cannot be short-circuited
+    return undefined;
+  }
+
+  // create a new SDK using the CLI credentials, because the default one will not work for new-style synthesis -
+  // it assumes the bootstrap deploy Role, which doesn't have permissions to update Lambda functions
+  const sdk = await sdkProvider.forEnvironment(resolvedEnv, Mode.ForWriting);
+  // apply the short-circuitable changes
+  await applyAllHotswappableChanges(sdk, stackArtifact, hotswappableChanges);
+
+  return { noOp: hotswappableChanges.length === 0, stackArn: cloudFormationStack.stackId, outputs: cloudFormationStack.outputs, stackArtifact };
+}
+
+function findAllHotswappableChanges(
+  stackChanges: cfn_diff.TemplateDiff, assetParamsWithEnv: { [key: string]: string },
+): HotswapOperation[] | undefined {
+  const hotswappableResources = new Array<HotswapOperation>();
+  let foundNonHotswappableChange = false;
+  stackChanges.resources.forEachDifference((logicalId: string, change: cfn_diff.ResourceDifference) => {
+    const lambdaFunctionShortCircuitChange = isHotswappableLambdaFunctionChange(logicalId, change, assetParamsWithEnv);
+    if (lambdaFunctionShortCircuitChange === ChangeHotswapImpact.REQUIRES_FULL_DEPLOYMENT) {
+      foundNonHotswappableChange = true;
+    } else if (lambdaFunctionShortCircuitChange === ChangeHotswapImpact.IRRELEVANT) {
+      // empty 'if' just for flow-aware typing to kick in...
+    } else {
+      hotswappableResources.push(lambdaFunctionShortCircuitChange);
+    }
+  });
+  return foundNonHotswappableChange ? undefined : hotswappableResources;
+}
+
+async function applyAllHotswappableChanges(
+  sdk: ISDK, stackArtifact: cxapi.CloudFormationStackArtifact, hotswappableChanges: HotswapOperation[],
+): Promise<void[]> {
+  // The current resources of the Stack.
+  // We need them to figure out the physical name of a function in case it wasn't specified by the user.
+  // We fetch it lazily, to save a service call, in case all updated Lambdas have their names set.
+  const listStackResources = new LazyListStackResources(sdk, stackArtifact.stackName);
+
+  return Promise.all(hotswappableChanges.map(hotswapOperation => hotswapOperation.apply(sdk, listStackResources)));
+}
+
+class LazyListStackResources implements ListStackResources {
+  private stackResources: CloudFormation.StackResourceSummary[] | undefined;
+
+  constructor(private readonly sdk: ISDK, private readonly stackName: string) {
+  }
+
+  async listStackResources(): Promise<CloudFormation.StackResourceSummary[]> {
+    if (this.stackResources === undefined) {
+      this.stackResources = await this.getStackResource();
+    }
+    return this.stackResources;
+  }
+
+  private async getStackResource(): Promise<CloudFormation.StackResourceSummary[]> {
+    const ret = new Array<CloudFormation.StackResourceSummary>();
+    let nextToken: string | undefined;
+    do {
+      const stackResourcesResponse = await this.sdk.cloudFormation().listStackResources({
+        StackName: this.stackName,
+        NextToken: nextToken,
+      }).promise();
+      ret.push(...(stackResourcesResponse.StackResourceSummaries ?? []));
+      nextToken = stackResourcesResponse.NextToken;
+    } while (nextToken);
+    return ret;
+  }
+}
diff --git a/packages/aws-cdk/lib/api/hotswap/common.ts b/packages/aws-cdk/lib/api/hotswap/common.ts
new file mode 100644
index 0000000000000..d509c32b4c781
--- /dev/null
+++ b/packages/aws-cdk/lib/api/hotswap/common.ts
@@ -0,0 +1,57 @@
+import * as cfn_diff from '@aws-cdk/cloudformation-diff';
+import { CloudFormation } from 'aws-sdk';
+import { ISDK } from '../aws-auth';
+import { evaluateCfn } from '../util/cloudformation/evaluate-cfn';
+
+export interface ListStackResources {
+  listStackResources(): Promise<CloudFormation.StackResourceSummary[]>;
+}
+
+/**
+ * An interface that represents a change that can be deployed in a short-circuit manner.
+ */
+export interface HotswapOperation {
+  apply(sdk: ISDK, stackResources: ListStackResources): Promise<any>;
+}
+
+/**
+ * An enum that represents the result of detection whether a given change can be hotswapped.
+ */
+export enum ChangeHotswapImpact {
+  /**
+   * This result means that the given change cannot be hotswapped,
+   * and requires a full deployment.
+   */
+  REQUIRES_FULL_DEPLOYMENT = 'requires-full-deployment',
+
+  /**
+   * This result means that the given change can be safely be ignored when determining
+   * whether the given Stack can be hotswapped or not
+   * (for example, it's a change to the CDKMetadata resource).
+   */
+  IRRELEVANT = 'irrelevant',
+}
+
+export type ChangeHotswapResult = HotswapOperation | ChangeHotswapImpact;
+
+/**
+ * For old-style synthesis which uses CFN Parameters,
+ * the Code properties can have the values of complex CFN expressions.
+ * For new-style synthesis of env-agnostic stacks,
+ * the Fn::Sub expression is used for the Asset bucket.
+ * Evaluate the CFN expressions to concrete string values which we need for the
+ * updateFunctionCode() service call.
+ */
+export function stringifyPotentialCfnExpression(value: any, assetParamsWithEnv: { [key: string]: string }): string {
+  // if we already have a string, nothing to do
+  if (value == null || typeof value === 'string') {
+    return value;
+  }
+
+  // otherwise, we assume this is a CloudFormation expression that we need to evaluate
+  return evaluateCfn(value, assetParamsWithEnv);
+}
+
+export function assetMetadataChanged(change: cfn_diff.ResourceDifference): boolean {
+  return !!change.newValue?.Metadata['aws:asset:path'];
+}
diff --git a/packages/aws-cdk/lib/api/hotswap/lambda-functions.ts b/packages/aws-cdk/lib/api/hotswap/lambda-functions.ts
new file mode 100644
index 0000000000000..73b4c529188c5
--- /dev/null
+++ b/packages/aws-cdk/lib/api/hotswap/lambda-functions.ts
@@ -0,0 +1,159 @@
+import * as cfn_diff from '@aws-cdk/cloudformation-diff';
+import { ISDK } from '../aws-auth';
+import { assetMetadataChanged, ChangeHotswapImpact, ChangeHotswapResult, HotswapOperation, ListStackResources, stringifyPotentialCfnExpression } from './common';
+
+/**
+ * Returns `false` if the change cannot be short-circuited,
+ * `true` if the change is irrelevant from a short-circuit perspective
+ * (like a change to CDKMetadata),
+ * or a LambdaFunctionResource if the change can be short-circuited.
+ */
+export function isHotswappableLambdaFunctionChange(
+  logicalId: string, change: cfn_diff.ResourceDifference, assetParamsWithEnv: { [key: string]: string },
+): ChangeHotswapResult {
+  const lambdaCodeChange = isLambdaFunctionCodeOnlyChange(change, assetParamsWithEnv);
+  if (typeof lambdaCodeChange === 'string') {
+    return lambdaCodeChange;
+  } else {
+    // verify that the Asset changed - otherwise,
+    // it's a Code property-only change,
+    // but not to an asset change
+    // (for example, going from Code.fromAsset() to Code.fromInline())
+    if (!assetMetadataChanged(change)) {
+      return ChangeHotswapImpact.REQUIRES_FULL_DEPLOYMENT;
+    }
+
+    let functionPhysicalName: string | undefined;
+    try {
+      functionPhysicalName = stringifyPotentialCfnExpression(change.newValue?.Properties?.FunctionName, assetParamsWithEnv);
+    } catch (e) {
+      // It's possible we can't evaluate the function's name -
+      // for example, it can use a Ref to a different resource,
+      // which we wouldn't have in `assetParamsWithEnv`.
+      // That's fine though - ignore any errors,
+      // and treat this case the same way as if the name wasn't provided at all,
+      // which means it will be looked up using the listStackResources() call
+      // by the later phase (which actually does the Lambda function update)
+      functionPhysicalName = undefined;
+    }
+
+    return new LambdaFunctionHotswapOperation({
+      logicalId,
+      physicalName: functionPhysicalName,
+      code: lambdaCodeChange,
+    });
+  }
+}
+
+/**
+ * Returns `true` if the change is not for a AWS::Lambda::Function,
+ * but doesn't prevent short-circuiting
+ * (like a change to CDKMetadata resource),
+ * `false` if the change is to a AWS::Lambda::Function,
+ * but not only to its Code property,
+ * or a LambdaFunctionCode if the change is to a AWS::Lambda::Function,
+ * and only affects its Code property.
+ */
+function isLambdaFunctionCodeOnlyChange(
+  change: cfn_diff.ResourceDifference, assetParamsWithEnv: { [key: string]: string },
+): LambdaFunctionCode | ChangeHotswapImpact {
+  if (!change.newValue) {
+    return ChangeHotswapImpact.REQUIRES_FULL_DEPLOYMENT;
+  }
+  const newResourceType = change.newValue.Type;
+  // Ignore Metadata changes
+  if (newResourceType === 'AWS::CDK::Metadata') {
+    return ChangeHotswapImpact.IRRELEVANT;
+  }
+  // The only other resource change we should see is a Lambda function
+  if (newResourceType !== 'AWS::Lambda::Function') {
+    return ChangeHotswapImpact.REQUIRES_FULL_DEPLOYMENT;
+  }
+  if (change.oldValue?.Type == null) {
+    // this means this is a brand-new Lambda function -
+    // obviously, we can't short-circuit that!
+    return ChangeHotswapImpact.REQUIRES_FULL_DEPLOYMENT;
+  }
+
+  /*
+   * On first glance, we would want to initialize these using the "previous" values (change.oldValue),
+   * in case only one of them changed, like the key, and the Bucket stayed the same.
+   * However, that actually fails for old-style synthesis, which uses CFN Parameters!
+   * Because the names of the Parameters depend on the hash of the Asset,
+   * the Parameters used for the "old" values no longer exist in `assetParams` at this point,
+   * which means we don't have the correct values available to evaluate the CFN expression with.
+   * Fortunately, the diff will always include both the s3Bucket and s3Key parts of the Lambda's Code property,
+   * even if only one of them was actually changed,
+   * which means we don't need the "old" values at all, and we can safely initialize these with just `''`.
+   */
+  let s3Bucket = '', s3Key = '';
+  let foundCodeDifference = false;
+  // Make sure only the code in the Lambda function changed
+  const propertyUpdates = change.propertyUpdates;
+  for (const updatedPropName in propertyUpdates) {
+    const updatedProp = propertyUpdates[updatedPropName];
+    if (updatedProp.newValue === undefined) {
+      return ChangeHotswapImpact.REQUIRES_FULL_DEPLOYMENT;
+    }
+    for (const newPropName in updatedProp.newValue) {
+      switch (newPropName) {
+        case 'S3Bucket':
+          foundCodeDifference = true;
+          s3Bucket = stringifyPotentialCfnExpression(updatedProp.newValue[newPropName], assetParamsWithEnv);
+          break;
+        case 'S3Key':
+          foundCodeDifference = true;
+          s3Key = stringifyPotentialCfnExpression(updatedProp.newValue[newPropName], assetParamsWithEnv);
+          break;
+        default:
+          return ChangeHotswapImpact.REQUIRES_FULL_DEPLOYMENT;
+      }
+    }
+  }
+
+  return foundCodeDifference
+    ? {
+      s3Bucket,
+      s3Key,
+    }
+    : ChangeHotswapImpact.IRRELEVANT;
+}
+
+interface LambdaFunctionCode {
+  readonly s3Bucket: string;
+  readonly s3Key: string;
+}
+
+interface LambdaFunctionResource {
+  readonly logicalId: string;
+  readonly physicalName?: string;
+  readonly code: LambdaFunctionCode;
+}
+
+class LambdaFunctionHotswapOperation implements HotswapOperation {
+  constructor(private readonly lambdaFunctionResource: LambdaFunctionResource) {
+  }
+
+  public async apply(sdk: ISDK, stackResources: ListStackResources): Promise<any> {
+    let functionPhysicalName: string;
+    if (this.lambdaFunctionResource.physicalName) {
+      functionPhysicalName = this.lambdaFunctionResource.physicalName;
+    } else {
+      const stackResourceList = await stackResources.listStackResources();
+      const foundFunctionName = stackResourceList
+        .find(resSummary => resSummary.LogicalResourceId === this.lambdaFunctionResource.logicalId)
+        ?.PhysicalResourceId;
+      if (!foundFunctionName) {
+        // if we couldn't find the function in the current stack, we can't update it
+        return;
+      }
+      functionPhysicalName = foundFunctionName;
+    }
+
+    return sdk.lambda().updateFunctionCode({
+      FunctionName: functionPhysicalName,
+      S3Bucket: this.lambdaFunctionResource.code.s3Bucket,
+      S3Key: this.lambdaFunctionResource.code.s3Key,
+    }).promise();
+  }
+}
diff --git a/packages/aws-cdk/lib/api/util/cloudformation/evaluate-cfn.ts b/packages/aws-cdk/lib/api/util/cloudformation/evaluate-cfn.ts
new file mode 100644
index 0000000000000..bdc395df83814
--- /dev/null
+++ b/packages/aws-cdk/lib/api/util/cloudformation/evaluate-cfn.ts
@@ -0,0 +1,89 @@
+export function evaluateCfn(object: any, context: { [key: string]: string }): any {
+  const intrinsicFns: any = {
+    'Fn::Join'(separator: string, args: string[]): string {
+      return evaluate(args).map(evaluate).join(separator);
+    },
+
+    'Fn::Split'(separator: string, args: string): string {
+      return evaluate(args).split(separator);
+    },
+
+    'Fn::Select'(index: number, args: string[]): string {
+      return evaluate(args).map(evaluate)[index];
+    },
+
+    'Ref'(logicalId: string): string {
+      if (logicalId in context) {
+        return context[logicalId];
+      } else {
+        throw new Error(`Reference target '${logicalId}' was not found`);
+      }
+    },
+
+    'Fn::Sub'(template: string, explicitPlaceholders?: { [variable: string]: string }): string {
+      const placeholders = explicitPlaceholders
+        ? { ...context, ...evaluate(explicitPlaceholders) }
+        : context;
+
+      return template.replace(/\${([^}]*)}/g, (_: string, key: string) => {
+        if (key in placeholders) {
+          return placeholders[key];
+        } else {
+          throw new Error(`Fn::Sub target '${key}' was not found`);
+        }
+      });
+    },
+  };
+
+  return evaluate(object);
+
+  function evaluate(obj: any): any {
+    if (Array.isArray(obj)) {
+      return obj.map(evaluate);
+    }
+
+    if (typeof obj === 'object') {
+      const intrinsic = parseIntrinsic(obj);
+      if (intrinsic) {
+        return evaluateIntrinsic(intrinsic);
+      }
+
+      const ret: { [key: string]: any } = {};
+      for (const key of Object.keys(obj)) {
+        ret[key] = evaluate(obj[key]);
+      }
+      return ret;
+    }
+
+    return obj;
+  }
+
+  function evaluateIntrinsic(intrinsic: Intrinsic) {
+    if (!(intrinsic.name in intrinsicFns)) {
+      throw new Error(`Intrinsic ${intrinsic.name} not supported here`);
+    }
+
+    const argsAsArray = Array.isArray(intrinsic.args) ? intrinsic.args : [intrinsic.args];
+
+    return intrinsicFns[intrinsic.name].apply(intrinsicFns, argsAsArray);
+  }
+}
+
+interface Intrinsic {
+  readonly name: string;
+  readonly args: any;
+}
+
+function parseIntrinsic(x: any): Intrinsic | undefined {
+  if (typeof x !== 'object' || x === null) {
+    return undefined;
+  }
+  const keys = Object.keys(x);
+  if (keys.length === 1 && (keys[0].startsWith('Fn::') || keys[0] === 'Ref')) {
+    return {
+      name: keys[0],
+      args: x[keys[0]],
+    };
+  }
+  return undefined;
+}
diff --git a/packages/aws-cdk/lib/cdk-toolkit.ts b/packages/aws-cdk/lib/cdk-toolkit.ts
index 427139535bde5..636da75d12975 100644
--- a/packages/aws-cdk/lib/cdk-toolkit.ts
+++ b/packages/aws-cdk/lib/cdk-toolkit.ts
@@ -131,6 +131,11 @@ export class CdkToolkit {
       }
     }
 
+    if (options.hotswap) {
+      warning('⚠️ The --hotswap flag deliberately introduces CloudFormation drift to speed up deployments');
+      warning('⚠️ It should only be used for development - never use it for your production Stacks!');
+    }
+
     const stackOutputs: { [key: string]: any } = { };
     const outputsFile = options.outputsFile;
 
@@ -197,6 +202,7 @@ export class CdkToolkit {
           progress: options.progress,
           ci: options.ci,
           rollback: options.rollback,
+          hotswap: options.hotswap,
         });
 
         const message = result.noOp
@@ -391,7 +397,7 @@ export class CdkToolkit {
     return stacks;
   }
 
-  private async selectStacksForDeploy(selector: StackSelector, exclusively?: boolean) {
+  private async selectStacksForDeploy(selector: StackSelector, exclusively?: boolean): Promise<StackCollection> {
     const assembly = await this.assembly();
     const stacks = await assembly.selectStacks(selector, {
       extend: exclusively ? ExtendedStackSelection.None : ExtendedStackSelection.Upstream,
@@ -403,7 +409,7 @@ export class CdkToolkit {
     return stacks;
   }
 
-  private async selectStacksForDiff(stackNames: string[], exclusively?: boolean, autoValidate?: boolean) {
+  private async selectStacksForDiff(stackNames: string[], exclusively?: boolean, autoValidate?: boolean): Promise<StackCollection> {
     const assembly = await this.assembly();
 
     const selectedForDiff = await assembly.selectStacks({ patterns: stackNames }, {
@@ -633,6 +639,14 @@ export interface DeployOptions {
    * @default true
    */
   readonly rollback?: boolean;
+  /*
+   * Whether to perform a 'hotswap' deployment.
+   * A 'hotswap' deployment will attempt to short-circuit CloudFormation
+   * and update the affected resources like Lambda functions directly.
+   *
+   * @default - false (do not perform a 'hotswap' deployment)
+   */
+  readonly hotswap?: boolean;
 }
 
 export interface DestroyOptions {
@@ -672,4 +686,4 @@ function tagsForStack(stack: cxapi.CloudFormationStackArtifact): Tag[] {
 export interface Tag {
   readonly Key: string;
   readonly Value: string;
-}
\ No newline at end of file
+}
diff --git a/packages/aws-cdk/test/api/cloudformation-deployments.test.ts b/packages/aws-cdk/test/api/cloudformation-deployments.test.ts
index 7a4e29628564c..c7a64a7b19ff3 100644
--- a/packages/aws-cdk/test/api/cloudformation-deployments.test.ts
+++ b/packages/aws-cdk/test/api/cloudformation-deployments.test.ts
@@ -34,6 +34,21 @@ function mockSuccessfulBootstrapStackLookup(props?: Record<string, any>) {
   mockToolkitInfoLookup.mockResolvedValue(ToolkitInfo.fromStack(fakeStack, sdkProvider.sdk));
 }
 
+test('passes through hotswap=true to deployStack()', async () => {
+  // WHEN
+  await deployments.deployStack({
+    stack: testStack({
+      stackName: 'boop',
+    }),
+    hotswap: true,
+  });
+
+  // THEN
+  expect(deployStack).toHaveBeenCalledWith(expect.objectContaining({
+    hotswap: true,
+  }));
+});
+
 test('placeholders are substituted in CloudFormation execution role', async () => {
   await deployments.deployStack({
     stack: testStack({
diff --git a/packages/aws-cdk/test/api/deploy-stack.test.ts b/packages/aws-cdk/test/api/deploy-stack.test.ts
index 844b971e7f2d4..eb551ac528ec4 100644
--- a/packages/aws-cdk/test/api/deploy-stack.test.ts
+++ b/packages/aws-cdk/test/api/deploy-stack.test.ts
@@ -1,7 +1,10 @@
-import { deployStack, ToolkitInfo } from '../../lib/api';
+import { deployStack, DeployStackOptions, ToolkitInfo } from '../../lib/api';
+import { tryHotswapDeployment } from '../../lib/api/hotswap-deployments';
 import { DEFAULT_FAKE_TEMPLATE, testStack } from '../util';
 import { MockedObject, mockResolvedEnvironment, MockSdk, MockSdkProvider, SyncHandlerSubsetOf } from '../util/mock-sdk';
 
+jest.mock('../../lib/api/hotswap-deployments');
+
 const FAKE_STACK = testStack({
   stackName: 'withouterrors',
 });
@@ -27,6 +30,8 @@ let sdk: MockSdk;
 let sdkProvider: MockSdkProvider;
 let cfnMocks: MockedObject<SyncHandlerSubsetOf<AWS.CloudFormation>>;
 beforeEach(() => {
+  jest.resetAllMocks();
+
   sdkProvider = new MockSdkProvider();
   sdk = new MockSdk();
 
@@ -60,7 +65,7 @@ beforeEach(() => {
 
 });
 
-function standardDeployStackArguments() {
+function standardDeployStackArguments(): DeployStackOptions {
   return {
     stack: FAKE_STACK,
     sdk,
@@ -70,6 +75,57 @@ function standardDeployStackArguments() {
   };
 }
 
+test("calls tryHotswapDeployment() if 'hotswap' is true", async () => {
+  // WHEN
+  await deployStack({
+    ...standardDeployStackArguments(),
+    hotswap: true,
+  });
+
+  // THEN
+  expect(tryHotswapDeployment).toHaveBeenCalled();
+});
+
+test("does not call tryHotswapDeployment() if 'hotswap' is false", async () => {
+  // WHEN
+  await deployStack({
+    ...standardDeployStackArguments(),
+    hotswap: false,
+  });
+
+  // THEN
+  expect(tryHotswapDeployment).not.toHaveBeenCalled();
+});
+
+test("rollback defaults to disabled if 'hotswap' is true", async () => {
+  // WHEN
+  await deployStack({
+    ...standardDeployStackArguments(),
+    hotswap: true,
+    rollback: undefined,
+  });
+
+  // THEN
+  expect(cfnMocks.executeChangeSet).toHaveBeenCalledWith(expect.objectContaining({
+    DisableRollback: true,
+  }));
+});
+
+test("rollback defaults to enabled if 'hotswap' is false", async () => {
+  // WHEN
+  await deployStack({
+    ...standardDeployStackArguments(),
+    hotswap: false,
+    rollback: undefined,
+  });
+
+  // THEN
+  expect(cfnMocks.executeChangeSet).toHaveBeenCalledTimes(1);
+  expect(cfnMocks.executeChangeSet).not.toHaveBeenCalledWith(expect.objectContaining({
+    DisableRollback: expect.anything(),
+  }));
+});
+
 test('do deploy executable change set with 0 changes', async () => {
   // WHEN
   const ret = await deployStack({
@@ -699,4 +755,4 @@ function givenTemplateIs(template: any) {
   cfnMocks.getTemplate!.mockReturnValue({
     TemplateBody: JSON.stringify(template),
   });
-}
\ No newline at end of file
+}
diff --git a/packages/aws-cdk/test/api/fake-cloudformation-stack.ts b/packages/aws-cdk/test/api/fake-cloudformation-stack.ts
new file mode 100644
index 0000000000000..3e722f3cad249
--- /dev/null
+++ b/packages/aws-cdk/test/api/fake-cloudformation-stack.ts
@@ -0,0 +1,34 @@
+import { CloudFormation } from 'aws-sdk';
+import { CloudFormationStack, Template } from '../../lib/api/util/cloudformation';
+import { instanceMockFrom } from '../util';
+
+export interface FakeCloudFormationStackProps {
+  readonly stackName: string;
+  readonly stackId: string;
+}
+
+export class FakeCloudformationStack extends CloudFormationStack {
+  public readonly cfnMock: jest.Mocked<CloudFormation>;
+  private readonly props: FakeCloudFormationStackProps;
+  private __template: Template;
+
+  public constructor(props: FakeCloudFormationStackProps) {
+    const cfnMock = instanceMockFrom(CloudFormation);
+    super(cfnMock, props.stackName);
+    this.cfnMock = cfnMock;
+    this.props = props;
+    this.__template = {};
+  }
+
+  public setTemplate(template: Template): void {
+    this.__template = template;
+  }
+
+  public async template(): Promise<Template> {
+    return Promise.resolve(this.__template);
+  }
+
+  public get stackId(): string {
+    return this.props.stackId;
+  }
+}
diff --git a/packages/aws-cdk/test/api/hotswap-deployments.test.ts b/packages/aws-cdk/test/api/hotswap-deployments.test.ts
new file mode 100644
index 0000000000000..a241e7c707d5c
--- /dev/null
+++ b/packages/aws-cdk/test/api/hotswap-deployments.test.ts
@@ -0,0 +1,113 @@
+import * as cxapi from '@aws-cdk/cx-api';
+import { Lambda } from 'aws-sdk';
+import { tryHotswapDeployment } from '../../lib/api/hotswap-deployments';
+import { testStack, TestStackArtifact } from '../util';
+import { MockSdkProvider } from '../util/mock-sdk';
+import { FakeCloudformationStack } from './fake-cloudformation-stack';
+
+const STACK_NAME = 'withouterrors';
+const STACK_ID = 'stackId';
+
+let mockSdkProvider: MockSdkProvider;
+let mockUpdateLambdaCode: (params: Lambda.Types.UpdateFunctionCodeRequest) => Lambda.Types.FunctionConfiguration;
+let currentCfnStack: FakeCloudformationStack;
+
+beforeEach(() => {
+  jest.resetAllMocks();
+  mockSdkProvider = new MockSdkProvider({ realSdk: false });
+  mockUpdateLambdaCode = jest.fn();
+  mockSdkProvider.stubLambda({
+    updateFunctionCode: mockUpdateLambdaCode,
+  });
+  currentCfnStack = new FakeCloudformationStack({
+    stackName: STACK_NAME,
+    stackId: STACK_ID,
+  });
+});
+
+test('returns a deployStackResult with noOp=true when it receives an empty set of changes', async () => {
+  // WHEN
+  const deployStackResult = await tryHotswapDeployment(mockSdkProvider, {}, currentCfnStack, cdkStackArtifactOf());
+
+  // THEN
+  expect(deployStackResult).not.toBeUndefined();
+  expect(deployStackResult?.noOp).toBeTruthy();
+  expect(deployStackResult?.stackArn).toEqual(STACK_ID);
+});
+
+test('returns undefined when it a new Lambda function is added to the Stack', async () => {
+  // GIVEN
+  const cdkStackArtifact = cdkStackArtifactOf({
+    template: {
+      Resources: {
+        Func: {
+          Type: 'AWS::Lambda::Function',
+        },
+      },
+    },
+  });
+
+  // WHEN
+  const deployStackResult = await tryHotswapDeployment(mockSdkProvider, {}, currentCfnStack, cdkStackArtifact);
+
+  // THEN
+  expect(deployStackResult).toBeUndefined();
+});
+
+test('calls the updateLambdaCode() API when it receives only a code difference in a Lambda function', async () => {
+  // GIVEN
+  currentCfnStack.setTemplate({
+    Resources: {
+      Func: {
+        Type: 'AWS::Lambda::Function',
+        Properties: {
+          Code: {
+            S3Bucket: 'current-bucket',
+            S3Key: 'current-key',
+          },
+          FunctionName: 'my-function',
+        },
+        Metadata: {
+          'aws:asset:path': 'old-path',
+        },
+      },
+    },
+  });
+  const cdkStackArtifact = cdkStackArtifactOf({
+    template: {
+      Resources: {
+        Func: {
+          Type: 'AWS::Lambda::Function',
+          Properties: {
+            Code: {
+              S3Bucket: 'current-bucket',
+              S3Key: 'new-key',
+            },
+            FunctionName: 'my-function',
+          },
+          Metadata: {
+            'aws:asset:path': 'new-path',
+          },
+        },
+      },
+    },
+  });
+
+  // WHEN
+  const deployStackResult = await tryHotswapDeployment(mockSdkProvider, {}, currentCfnStack, cdkStackArtifact);
+
+  // THEN
+  expect(deployStackResult).not.toBeUndefined();
+  expect(mockUpdateLambdaCode).toHaveBeenCalledWith({
+    FunctionName: 'my-function',
+    S3Bucket: 'current-bucket',
+    S3Key: 'new-key',
+  });
+});
+
+function cdkStackArtifactOf(testStackArtifact: Partial<TestStackArtifact> = {}): cxapi.CloudFormationStackArtifact {
+  return testStack({
+    stackName: STACK_NAME,
+    ...testStackArtifact,
+  });
+}
diff --git a/packages/aws-cdk/test/cdk-toolkit.test.ts b/packages/aws-cdk/test/cdk-toolkit.test.ts
index 8f53405b749e4..9c42c21261eaa 100644
--- a/packages/aws-cdk/test/cdk-toolkit.test.ts
+++ b/packages/aws-cdk/test/cdk-toolkit.test.ts
@@ -5,7 +5,8 @@ import { CloudFormationDeployments, DeployStackOptions } from '../lib/api/cloudf
 import { DeployStackResult } from '../lib/api/deploy-stack';
 import { Template } from '../lib/api/util/cloudformation';
 import { CdkToolkit, Tag } from '../lib/cdk-toolkit';
-import { MockCloudExecutable, TestStackArtifact, instanceMockFrom } from './util';
+import { RequireApproval } from '../lib/diff';
+import { instanceMockFrom, MockCloudExecutable, TestStackArtifact } from './util';
 
 let cloudExecutable: MockCloudExecutable;
 let bootstrapper: jest.Mocked<Bootstrapper>;
@@ -39,6 +40,37 @@ function defaultToolkitSetup() {
 }
 
 describe('deploy', () => {
+  describe('with hotswap deployment', () => {
+    test("passes through the 'hotswap' option to CloudFormationDeployments.deployStack()", async () => {
+      // GIVEN
+      const mockCfnDeployments = instanceMockFrom(CloudFormationDeployments);
+      mockCfnDeployments.deployStack.mockReturnValue(Promise.resolve({
+        noOp: false,
+        outputs: {},
+        stackArn: 'stackArn',
+        stackArtifact: instanceMockFrom(cxapi.CloudFormationStackArtifact),
+      }));
+      const cdkToolkit = new CdkToolkit({
+        cloudExecutable,
+        configuration: cloudExecutable.configuration,
+        sdkProvider: cloudExecutable.sdkProvider,
+        cloudFormation: mockCfnDeployments,
+      });
+
+      // WHEN
+      await cdkToolkit.deploy({
+        selector: { patterns: ['Test-Stack-A'] },
+        requireApproval: RequireApproval.Never,
+        hotswap: true,
+      });
+
+      // THEN
+      expect(mockCfnDeployments.deployStack).toHaveBeenCalledWith(expect.objectContaining({
+        hotswap: true,
+      }));
+    });
+  });
+
   describe('makes correct CloudFormation calls', () => {
     test('without options', async () => {
       // GIVEN
diff --git a/packages/aws-cdk/test/util.ts b/packages/aws-cdk/test/util.ts
index 060c75d29f63a..494efcff1982e 100644
--- a/packages/aws-cdk/test/util.ts
+++ b/packages/aws-cdk/test/util.ts
@@ -125,7 +125,7 @@ function patchStackTags(metadata: { [path: string]: cxschema.MetadataEntry[] }):
   return cloned;
 }
 
-export function testStack(stack: TestStackArtifact) {
+export function testStack(stack: TestStackArtifact): cxapi.CloudFormationStackArtifact {
   const assembly = testAssembly({ stacks: [stack] });
   return assembly.getStackByName(stack.stackName);
 }
diff --git a/packages/aws-cdk/test/util/mock-sdk.ts b/packages/aws-cdk/test/util/mock-sdk.ts
index 90392ee14f3c9..9bfd3972deb06 100644
--- a/packages/aws-cdk/test/util/mock-sdk.ts
+++ b/packages/aws-cdk/test/util/mock-sdk.ts
@@ -97,10 +97,15 @@ export class MockSdkProvider extends SdkProvider {
   public stubSSM(stubs: SyncHandlerSubsetOf<AWS.SSM>) {
     (this.sdk as any).ssm = jest.fn().mockReturnValue(partialAwsService<AWS.SSM>(stubs));
   }
+
+  public stubLambda(stubs: SyncHandlerSubsetOf<AWS.Lambda>) {
+    (this.sdk as any).lambda = jest.fn().mockReturnValue(partialAwsService<AWS.Lambda>(stubs));
+  }
 }
 
 export class MockSdk implements ISDK {
   public readonly currentRegion: string = 'bermuda-triangle-1337';
+  public readonly lambda = jest.fn();
   public readonly cloudFormation = jest.fn();
   public readonly ec2 = jest.fn();
   public readonly ssm = jest.fn();

From 174b066634755c76d1b78d05ca9b403145dedc47 Mon Sep 17 00:00:00 2001
From: Sepehr Laal <5657848+3p3r@users.noreply.github.com>
Date: Thu, 2 Sep 2021 16:13:28 -0700
Subject: [PATCH 60/91] feat(stepfunctions-tasks): await the eval so async ops
 can be passed to tasks.EvaluateExpression (#16290)

Currently the way `EvaluateExpression` is set up, if you pass an async expression to it, it never waits for the execution to complete. By adding an `await` before the `eval()` call, async ops can be passed in. This also works for sync ops same as before (await works with sync code as well).

----

*By submitting this pull request, I confirm that my contribution is made under the terms of the Apache-2.0 license*
---
 .../aws-stepfunctions-tasks/lib/eval-nodejs-handler/index.ts    | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/packages/@aws-cdk/aws-stepfunctions-tasks/lib/eval-nodejs-handler/index.ts b/packages/@aws-cdk/aws-stepfunctions-tasks/lib/eval-nodejs-handler/index.ts
index c40aeb340bfbb..52db50f92605e 100644
--- a/packages/@aws-cdk/aws-stepfunctions-tasks/lib/eval-nodejs-handler/index.ts
+++ b/packages/@aws-cdk/aws-stepfunctions-tasks/lib/eval-nodejs-handler/index.ts
@@ -15,5 +15,5 @@ export async function handler(event: Event): Promise<any> {
     );
   console.log(`Expression: ${expression}`);
 
-  return eval(expression);
+  return await eval(expression);
 }

From 2023004cc941a0e7a908bf3c90ad9887c6679564 Mon Sep 17 00:00:00 2001
From: Nick Lynch <nlynch@amazon.com>
Date: Fri, 3 Sep 2021 11:01:35 +0100
Subject: [PATCH 61/91] feat(ec2): rename SubnetTypes to improve clarity with
 EC2 conventions (#16348)

Early on in the CDK history, a decision was made to delineate between subnets
with Internet access (i.e., those with a NAT) and those without. The convention
chosen at that time was to label the subnets as `PRIVATE` and `ISOLATED`,
respectively. The intent was to make it clear that subnets without a NAT were
completely isolated from the broader Internet (unless connected through another
subnet).

However, this introduction of a new subnet type that does not match EC2
documentation and naming conventions can cause confusion. Most critically, a
user may select a `PRIVATE` subnet without realizing that it automatically
requires one (or more) NAT gateways. As NAT gateways are not free, this can
lead to unintended charges.

To realign to the EC2 terminology -- while retaining the existing logic
surrounding SubnetTypes -- the existing types of `PRIVATE` and `ISOLATED` are
being renamed to `PRIVATE_WITH_NAT` and `PRIVATE_ISOLATED`, respectively.

fixes #15929


----

*By submitting this pull request, I confirm that my contribution is made under the terms of the Apache-2.0 license*
---
 packages/@aws-cdk/aws-ec2/README.md           | 14 +--
 packages/@aws-cdk/aws-ec2/lib/util.ts         |  6 +-
 packages/@aws-cdk/aws-ec2/lib/vpc-endpoint.ts |  2 +-
 packages/@aws-cdk/aws-ec2/lib/vpc.ts          | 90 ++++++++++++++-----
 .../aws-ec2/test/bastion-host.test.ts         |  4 +-
 .../test/integ.reserved-private-subnet.ts     |  2 +-
 .../aws-ec2/test/integ.vpc-gateway.ts         |  2 +-
 .../aws-ec2/test/integ.vpc-networkacl.ts      |  2 +-
 .../aws-ec2/test/vpc-endpoint.test.ts         |  2 +-
 .../aws-ec2/test/vpc.from-lookup.test.ts      |  2 +-
 packages/@aws-cdk/aws-ec2/test/vpc.test.ts    | 68 +++++++-------
 11 files changed, 119 insertions(+), 75 deletions(-)

diff --git a/packages/@aws-cdk/aws-ec2/README.md b/packages/@aws-cdk/aws-ec2/README.md
index ae628ce7d21dc..0ed5fc82d0252 100644
--- a/packages/@aws-cdk/aws-ec2/README.md
+++ b/packages/@aws-cdk/aws-ec2/README.md
@@ -38,15 +38,15 @@ instances for your project.
 A VPC consists of one or more subnets that instances can be placed into. CDK
 distinguishes three different subnet types:
 
-* **Public** - public subnets connect directly to the Internet using an
+* **Public (`SubnetType.PUBLIC`)** - public subnets connect directly to the Internet using an
   Internet Gateway. If you want your instances to have a public IP address
   and be directly reachable from the Internet, you must place them in a
   public subnet.
-* **Private** - instances in private subnets are not directly routable from the
+* **Private with Internet Access (`SubnetType.PRIVATE_WITH_NAT`)** - instances in private subnets are not directly routable from the
   Internet, and connect out to the Internet via a NAT gateway. By default, a
   NAT gateway is created in every public subnet for maximum availability. Be
   aware that you will be charged for NAT gateways.
-* **Isolated** - isolated subnets do not route from or to the Internet, and
+* **Isolated (`SubnetType.PRIVATE_ISOLATED`)** - isolated subnets do not route from or to the Internet, and
   as such do not require NAT gateways. They can only connect to or be
   connected to from other instances in the same VPC. A default VPC configuration
   will not include isolated subnets,
@@ -245,12 +245,12 @@ const vpc = new ec2.Vpc(this, 'TheVPC', {
     {
       cidrMask: 24,
       name: 'Application',
-      subnetType: ec2.SubnetType.PRIVATE,
+      subnetType: ec2.SubnetType.PRIVATE_WITH_NAT,
     },
     {
       cidrMask: 28,
       name: 'Database',
-      subnetType: ec2.SubnetType.ISOLATED,
+      subnetType: ec2.SubnetType.PRIVATE_ISOLATED,
 
       // 'reserved' can be used to reserve IP address space. No resources will
       // be created for this subnet, but the IP range will be kept available for
@@ -345,12 +345,12 @@ const vpc = new ec2.Vpc(this, 'TheVPC', {
     {
       cidrMask: 26,
       name: 'Application1',
-      subnetType: ec2.SubnetType.PRIVATE,
+      subnetType: ec2.SubnetType.PRIVATE_WITH_NAT,
     },
     {
       cidrMask: 26,
       name: 'Application2',
-      subnetType: ec2.SubnetType.PRIVATE,
+      subnetType: ec2.SubnetType.PRIVATE_WITH_NAT,
       reserved: true,   // <---- This subnet group is reserved
     },
     {
diff --git a/packages/@aws-cdk/aws-ec2/lib/util.ts b/packages/@aws-cdk/aws-ec2/lib/util.ts
index 7ad31d02e54ec..31814d5cc45e5 100644
--- a/packages/@aws-cdk/aws-ec2/lib/util.ts
+++ b/packages/@aws-cdk/aws-ec2/lib/util.ts
@@ -16,8 +16,8 @@ export function slugify(x: string): string {
 export function defaultSubnetName(type: SubnetType) {
   switch (type) {
     case SubnetType.PUBLIC: return 'Public';
-    case SubnetType.PRIVATE: return 'Private';
-    case SubnetType.ISOLATED: return 'Isolated';
+    case SubnetType.PRIVATE_WITH_NAT: return 'Private';
+    case SubnetType.PRIVATE_ISOLATED: return 'Isolated';
   }
 }
 
@@ -132,4 +132,4 @@ export function allRouteTableIds(subnets: ISubnet[]): string[] {
 
 export function flatten<A>(xs: A[][]): A[] {
   return Array.prototype.concat.apply([], xs);
-}
\ No newline at end of file
+}
diff --git a/packages/@aws-cdk/aws-ec2/lib/vpc-endpoint.ts b/packages/@aws-cdk/aws-ec2/lib/vpc-endpoint.ts
index 69ad4aab88404..f9cb70afea180 100644
--- a/packages/@aws-cdk/aws-ec2/lib/vpc-endpoint.ts
+++ b/packages/@aws-cdk/aws-ec2/lib/vpc-endpoint.ts
@@ -125,7 +125,7 @@ export interface GatewayVpcEndpointOptions {
    *   service: ec2.GatewayVpcEndpointAwsService.DYNAMODB,
    *   // Add only to ISOLATED subnets
    *   subnets: [
-   *     { subnetType: ec2.SubnetType.ISOLATED }
+   *     { subnetType: ec2.SubnetType.PRIVATE_ISOLATED }
    *   ]
    * });
    *
diff --git a/packages/@aws-cdk/aws-ec2/lib/vpc.ts b/packages/@aws-cdk/aws-ec2/lib/vpc.ts
index 1fe534df6c483..b8194eb161c1d 100644
--- a/packages/@aws-cdk/aws-ec2/lib/vpc.ts
+++ b/packages/@aws-cdk/aws-ec2/lib/vpc.ts
@@ -159,26 +159,69 @@ export interface IVpc extends IResource {
  */
 export enum SubnetType {
   /**
-   * Isolated Subnets do not route traffic to the Internet (in this VPC).
+   * Isolated Subnets do not route traffic to the Internet (in this VPC),
+   * and as such, do not require NAT gateways.
+   *
+   * Isolated subnets can only connect to or be connected to from other
+   * instances in the same VPC. A default VPC configuration will not include
+   * isolated subnets.
    *
    * This can be good for subnets with RDS or Elasticache instances,
    * or which route Internet traffic through a peer VPC.
+   *
+   * @deprecated use `SubnetType.PRIVATE_ISOLATED`
    */
   ISOLATED = 'Isolated',
 
+  /**
+   * Isolated Subnets do not route traffic to the Internet (in this VPC),
+   * and as such, do not require NAT gateways.
+   *
+   * Isolated subnets can only connect to or be connected to from other
+   * instances in the same VPC. A default VPC configuration will not include
+   * isolated subnets.
+   *
+   * This can be good for subnets with RDS or Elasticache instances,
+   * or which route Internet traffic through a peer VPC.
+   */
+  PRIVATE_ISOLATED = 'Isolated',
+
   /**
    * Subnet that routes to the internet, but not vice versa.
    *
    * Instances in a private subnet can connect to the Internet, but will not
-   * allow connections to be initiated from the Internet. Internet traffic will
-   * be routed via a NAT Gateway.
+   * allow connections to be initiated from the Internet. NAT Gateway(s) are
+   * required with this subnet type to route the Internet traffic through.
+   * If a NAT Gateway is not required or desired, use `SubnetType.PRIVATE_ISOLATED` instead.
+   *
+   * By default, a NAT gateway is created in every public subnet for maximum availability.
+   * Be aware that you will be charged for NAT gateways.
    *
    * Normally a Private subnet will use a NAT gateway in the same AZ, but
    * if `natGateways` is used to reduce the number of NAT gateways, a NAT
    * gateway from another AZ will be used instead.
+   *
+   * @deprecated use `PRIVATE_WITH_NAT`
    */
   PRIVATE = 'Private',
 
+  /**
+   * Subnet that routes to the internet (via a NAT gateway), but not vice versa.
+   *
+   * Instances in a private subnet can connect to the Internet, but will not
+   * allow connections to be initiated from the Internet. NAT Gateway(s) are
+   * required with this subnet type to route the Internet traffic through.
+   * If a NAT Gateway is not required or desired, use `SubnetType.PRIVATE_ISOLATED` instead.
+   *
+   * By default, a NAT gateway is created in every public subnet for maximum availability.
+   * Be aware that you will be charged for NAT gateways.
+   *
+   * Normally a Private subnet will use a NAT gateway in the same AZ, but
+   * if `natGateways` is used to reduce the number of NAT gateways, a NAT
+   * gateway from another AZ will be used instead.
+   */
+  PRIVATE_WITH_NAT = 'Private',
+
   /**
    * Subnet connected to the Internet
    *
@@ -206,7 +249,7 @@ export interface SubnetSelection {
    *
    * At most one of `subnetType` and `subnetGroupName` can be supplied.
    *
-   * @default SubnetType.PRIVATE (or ISOLATED or PUBLIC if there are no PRIVATE subnets)
+   * @default SubnetType.PRIVATE_WITH_NAT (or ISOLATED or PUBLIC if there are no PRIVATE_WITH_NAT subnets)
    */
   readonly subnetType?: SubnetType;
 
@@ -490,7 +533,7 @@ abstract class VpcBase extends Resource implements IVpc {
       subnets = this.selectSubnetObjectsByName(selection.subnetGroupName);
 
     } else { // Or specify by type
-      const type = selection.subnetType || SubnetType.PRIVATE;
+      const type = selection.subnetType || SubnetType.PRIVATE_WITH_NAT;
       subnets = this.selectSubnetObjectsByType(type);
     }
 
@@ -523,8 +566,8 @@ abstract class VpcBase extends Resource implements IVpc {
 
   private selectSubnetObjectsByType(subnetType: SubnetType) {
     const allSubnets = {
-      [SubnetType.ISOLATED]: this.isolatedSubnets,
-      [SubnetType.PRIVATE]: this.privateSubnets,
+      [SubnetType.PRIVATE_ISOLATED]: this.isolatedSubnets,
+      [SubnetType.PRIVATE_WITH_NAT]: this.privateSubnets,
       [SubnetType.PUBLIC]: this.publicSubnets,
     };
 
@@ -566,7 +609,8 @@ abstract class VpcBase extends Resource implements IVpc {
 
     if (placement.subnetType === undefined && placement.subnetGroupName === undefined && placement.subnets === undefined) {
       // Return default subnet type based on subnets that actually exist
-      let subnetType = this.privateSubnets.length ? SubnetType.PRIVATE : this.isolatedSubnets.length ? SubnetType.ISOLATED : SubnetType.PUBLIC;
+      let subnetType = this.privateSubnets.length
+        ? SubnetType.PRIVATE_WITH_NAT : this.isolatedSubnets.length ? SubnetType.PRIVATE_ISOLATED : SubnetType.PUBLIC;
       placement = { ...placement, subnetType: subnetType };
     }
 
@@ -839,12 +883,12 @@ export interface VpcProps {
    *      {
    *        cidrMask: 24,
    *        name: 'application',
-   *        subnetType: ec2.SubnetType.PRIVATE,
+   *        subnetType: ec2.SubnetType.PRIVATE_WITH_NAT,
    *      },
    *      {
    *        cidrMask: 28,
    *        name: 'rds',
-   *        subnetType: ec2.SubnetType.ISOLATED,
+   *        subnetType: ec2.SubnetType.PRIVATE_ISOLATED,
    *      }
    *   ]
    * });
@@ -975,7 +1019,7 @@ export interface SubnetConfiguration {
  *
  * // Iterate the private subnets
  * const selection = vpc.selectSubnets({
- *   subnetType: ec2.SubnetType.PRIVATE
+ *   subnetType: ec2.SubnetType.PRIVATE_WITH_NAT
  * });
  *
  * for (const subnet of selection.subnets) {
@@ -1004,8 +1048,8 @@ export class Vpc extends VpcBase {
       name: defaultSubnetName(SubnetType.PUBLIC),
     },
     {
-      subnetType: SubnetType.PRIVATE,
-      name: defaultSubnetName(SubnetType.PRIVATE),
+      subnetType: SubnetType.PRIVATE_WITH_NAT,
+      name: defaultSubnetName(SubnetType.PRIVATE_WITH_NAT),
     },
   ];
 
@@ -1020,8 +1064,8 @@ export class Vpc extends VpcBase {
       name: defaultSubnetName(SubnetType.PUBLIC),
     },
     {
-      subnetType: SubnetType.ISOLATED,
-      name: defaultSubnetName(SubnetType.ISOLATED),
+      subnetType: SubnetType.PRIVATE_ISOLATED,
+      name: defaultSubnetName(SubnetType.PRIVATE_ISOLATED),
     },
   ];
 
@@ -1244,7 +1288,7 @@ export class Vpc extends VpcBase {
     this.createSubnets();
 
     const allowOutbound = this.subnetConfiguration.filter(
-      subnet => (subnet.subnetType !== SubnetType.ISOLATED)).length > 0;
+      subnet => (subnet.subnetType !== SubnetType.PRIVATE_ISOLATED)).length > 0;
 
     // Create an Internet Gateway and attach it if necessary
     if (allowOutbound) {
@@ -1396,12 +1440,12 @@ export class Vpc extends VpcBase {
           this.publicSubnets.push(publicSubnet);
           subnet = publicSubnet;
           break;
-        case SubnetType.PRIVATE:
+        case SubnetType.PRIVATE_WITH_NAT:
           const privateSubnet = new PrivateSubnet(this, name, subnetProps);
           this.privateSubnets.push(privateSubnet);
           subnet = privateSubnet;
           break;
-        case SubnetType.ISOLATED:
+        case SubnetType.PRIVATE_ISOLATED:
           const isolatedSubnet = new PrivateSubnet(this, name, subnetProps);
           this.isolatedSubnets.push(isolatedSubnet);
           subnet = isolatedSubnet;
@@ -1424,8 +1468,8 @@ const SUBNETNAME_TAG = 'aws-cdk:subnet-name';
 function subnetTypeTagValue(type: SubnetType) {
   switch (type) {
     case SubnetType.PUBLIC: return 'Public';
-    case SubnetType.PRIVATE: return 'Private';
-    case SubnetType.ISOLATED: return 'Isolated';
+    case SubnetType.PRIVATE_WITH_NAT: return 'Private';
+    case SubnetType.PRIVATE_ISOLATED: return 'Isolated';
   }
 }
 
@@ -1834,8 +1878,8 @@ class ImportedVpc extends VpcBase {
 
     /* eslint-disable max-len */
     const pub = new ImportSubnetGroup(props.publicSubnetIds, props.publicSubnetNames, props.publicSubnetRouteTableIds, SubnetType.PUBLIC, this.availabilityZones, 'publicSubnetIds', 'publicSubnetNames', 'publicSubnetRouteTableIds');
-    const priv = new ImportSubnetGroup(props.privateSubnetIds, props.privateSubnetNames, props.privateSubnetRouteTableIds, SubnetType.PRIVATE, this.availabilityZones, 'privateSubnetIds', 'privateSubnetNames', 'privateSubnetRouteTableIds');
-    const iso = new ImportSubnetGroup(props.isolatedSubnetIds, props.isolatedSubnetNames, props.isolatedSubnetRouteTableIds, SubnetType.ISOLATED, this.availabilityZones, 'isolatedSubnetIds', 'isolatedSubnetNames', 'isolatedSubnetRouteTableIds');
+    const priv = new ImportSubnetGroup(props.privateSubnetIds, props.privateSubnetNames, props.privateSubnetRouteTableIds, SubnetType.PRIVATE_WITH_NAT, this.availabilityZones, 'privateSubnetIds', 'privateSubnetNames', 'privateSubnetRouteTableIds');
+    const iso = new ImportSubnetGroup(props.isolatedSubnetIds, props.isolatedSubnetNames, props.isolatedSubnetRouteTableIds, SubnetType.PRIVATE_ISOLATED, this.availabilityZones, 'isolatedSubnetIds', 'isolatedSubnetNames', 'isolatedSubnetRouteTableIds');
     /* eslint-enable max-len */
 
     this.publicSubnets = pub.import(this);
@@ -2028,7 +2072,7 @@ class ImportedSubnet extends Resource implements ISubnet, IPublicSubnet, IPrivat
  * They seem pointless but I see no reason to prevent it.
  */
 function determineNatGatewayCount(requestedCount: number | undefined, subnetConfig: SubnetConfiguration[], azCount: number) {
-  const hasPrivateSubnets = subnetConfig.some(c => c.subnetType === SubnetType.PRIVATE && !c.reserved);
+  const hasPrivateSubnets = subnetConfig.some(c => c.subnetType === SubnetType.PRIVATE_WITH_NAT && !c.reserved);
   const hasPublicSubnets = subnetConfig.some(c => c.subnetType === SubnetType.PUBLIC);
 
   const count = requestedCount !== undefined ? Math.min(requestedCount, azCount) : (hasPrivateSubnets ? azCount : 0);
diff --git a/packages/@aws-cdk/aws-ec2/test/bastion-host.test.ts b/packages/@aws-cdk/aws-ec2/test/bastion-host.test.ts
index f774cf9aaa3d8..2bacb5e918920 100644
--- a/packages/@aws-cdk/aws-ec2/test/bastion-host.test.ts
+++ b/packages/@aws-cdk/aws-ec2/test/bastion-host.test.ts
@@ -28,7 +28,7 @@ nodeunitShim({
     const vpc = new Vpc(stack, 'VPC', {
       subnetConfiguration: [
         {
-          subnetType: SubnetType.ISOLATED,
+          subnetType: SubnetType.PRIVATE_ISOLATED,
           name: 'Isolated',
         },
       ],
@@ -53,7 +53,7 @@ nodeunitShim({
     const vpc = new Vpc(stack, 'VPC', {
       subnetConfiguration: [
         {
-          subnetType: SubnetType.ISOLATED,
+          subnetType: SubnetType.PRIVATE_ISOLATED,
           name: 'Isolated',
         },
       ],
diff --git a/packages/@aws-cdk/aws-ec2/test/integ.reserved-private-subnet.ts b/packages/@aws-cdk/aws-ec2/test/integ.reserved-private-subnet.ts
index 8caf7fcdf087d..76c0b35eb2d8e 100644
--- a/packages/@aws-cdk/aws-ec2/test/integ.reserved-private-subnet.ts
+++ b/packages/@aws-cdk/aws-ec2/test/integ.reserved-private-subnet.ts
@@ -27,7 +27,7 @@ class VpcReservedPrivateSubnetStack extends cdk.Stack {
         },
         {
           name: 'private',
-          subnetType: ec2.SubnetType.PRIVATE,
+          subnetType: ec2.SubnetType.PRIVATE_WITH_NAT,
           reserved: true,
         },
       ],
diff --git a/packages/@aws-cdk/aws-ec2/test/integ.vpc-gateway.ts b/packages/@aws-cdk/aws-ec2/test/integ.vpc-gateway.ts
index 6e1a4d5648a04..6f84541a29911 100644
--- a/packages/@aws-cdk/aws-ec2/test/integ.vpc-gateway.ts
+++ b/packages/@aws-cdk/aws-ec2/test/integ.vpc-gateway.ts
@@ -12,7 +12,7 @@ const vpc = new ec2.Vpc(stack, 'MyVpc', {
       name: 'Public',
     },
     {
-      subnetType: ec2.SubnetType.ISOLATED,
+      subnetType: ec2.SubnetType.PRIVATE_ISOLATED,
       name: 'Isolated',
     },
   ],
diff --git a/packages/@aws-cdk/aws-ec2/test/integ.vpc-networkacl.ts b/packages/@aws-cdk/aws-ec2/test/integ.vpc-networkacl.ts
index 0167af2bdc168..348f18be18ed2 100644
--- a/packages/@aws-cdk/aws-ec2/test/integ.vpc-networkacl.ts
+++ b/packages/@aws-cdk/aws-ec2/test/integ.vpc-networkacl.ts
@@ -10,7 +10,7 @@ const vpc = new ec2.Vpc(stack, 'MyVpc');
 
 const nacl1 = new ec2.NetworkAcl(stack, 'myNACL1', {
   vpc,
-  subnetSelection: { subnetType: ec2.SubnetType.PRIVATE },
+  subnetSelection: { subnetType: ec2.SubnetType.PRIVATE_WITH_NAT },
 });
 
 nacl1.addEntry('AllowDNSEgress', {
diff --git a/packages/@aws-cdk/aws-ec2/test/vpc-endpoint.test.ts b/packages/@aws-cdk/aws-ec2/test/vpc-endpoint.test.ts
index 267c48a9e4145..79a9f3594479e 100644
--- a/packages/@aws-cdk/aws-ec2/test/vpc-endpoint.test.ts
+++ b/packages/@aws-cdk/aws-ec2/test/vpc-endpoint.test.ts
@@ -64,7 +64,7 @@ nodeunitShim({
                 subnetType: SubnetType.PUBLIC,
               },
               {
-                subnetType: SubnetType.PRIVATE,
+                subnetType: SubnetType.PRIVATE_WITH_NAT,
               },
             ],
           },
diff --git a/packages/@aws-cdk/aws-ec2/test/vpc.from-lookup.test.ts b/packages/@aws-cdk/aws-ec2/test/vpc.from-lookup.test.ts
index 12ed7d05329d5..65e4b071a0b53 100644
--- a/packages/@aws-cdk/aws-ec2/test/vpc.from-lookup.test.ts
+++ b/packages/@aws-cdk/aws-ec2/test/vpc.from-lookup.test.ts
@@ -166,7 +166,7 @@ nodeunitShim({
       });
 
       // WHEN
-      const subnets = vpc.selectSubnets({ subnetType: SubnetType.PRIVATE, onePerAz: true });
+      const subnets = vpc.selectSubnets({ subnetType: SubnetType.PRIVATE_WITH_NAT, onePerAz: true });
 
       // THEN: we got 2 subnets and not 4
       test.deepEqual(subnets.subnets.map(s => s.availabilityZone), ['us-east-1c', 'us-east-1d']);
diff --git a/packages/@aws-cdk/aws-ec2/test/vpc.test.ts b/packages/@aws-cdk/aws-ec2/test/vpc.test.ts
index d65bc016271be..355f4fd3662c7 100644
--- a/packages/@aws-cdk/aws-ec2/test/vpc.test.ts
+++ b/packages/@aws-cdk/aws-ec2/test/vpc.test.ts
@@ -146,7 +146,7 @@ nodeunitShim({
       new Vpc(stack, 'TheVPC', {
         subnetConfiguration: [
           {
-            subnetType: SubnetType.ISOLATED,
+            subnetType: SubnetType.PRIVATE_ISOLATED,
             name: 'Isolated',
           },
         ],
@@ -168,7 +168,7 @@ nodeunitShim({
             name: 'Public',
           },
           {
-            subnetType: SubnetType.ISOLATED,
+            subnetType: SubnetType.PRIVATE_ISOLATED,
             name: 'Isolated',
           },
         ],
@@ -186,7 +186,7 @@ nodeunitShim({
             name: 'Public',
           },
           {
-            subnetType: SubnetType.PRIVATE,
+            subnetType: SubnetType.PRIVATE_WITH_NAT,
             name: 'private',
           },
         ],
@@ -194,7 +194,7 @@ nodeunitShim({
 
       const nacl1 = new NetworkAcl(stack, 'myNACL1', {
         vpc,
-        subnetSelection: { subnetType: SubnetType.PRIVATE },
+        subnetSelection: { subnetType: SubnetType.PRIVATE_WITH_NAT },
       });
 
       new NetworkAclEntry(stack, 'AllowDNSEgress', {
@@ -233,7 +233,7 @@ nodeunitShim({
       const vpc = new Vpc(stack, 'TheVPC', {
         subnetConfiguration: [
           {
-            subnetType: SubnetType.ISOLATED,
+            subnetType: SubnetType.PRIVATE_ISOLATED,
             name: 'isolated',
           },
           {
@@ -260,7 +260,7 @@ nodeunitShim({
       const vpc = new Vpc(stack, 'TheVPC', {
         subnetConfiguration: [
           {
-            subnetType: SubnetType.ISOLATED,
+            subnetType: SubnetType.PRIVATE_ISOLATED,
             name: 'isolated',
           },
         ],
@@ -283,13 +283,13 @@ nodeunitShim({
           {
             cidrMask: 24,
             name: 'reserved',
-            subnetType: SubnetType.PRIVATE,
+            subnetType: SubnetType.PRIVATE_WITH_NAT,
             reserved: true,
           },
           {
             cidrMask: 28,
             name: 'rds',
-            subnetType: SubnetType.ISOLATED,
+            subnetType: SubnetType.PRIVATE_ISOLATED,
           },
         ],
         maxAzs: 3,
@@ -310,13 +310,13 @@ nodeunitShim({
           {
             cidrMask: 24,
             name: 'reserved',
-            subnetType: SubnetType.PRIVATE,
+            subnetType: SubnetType.PRIVATE_WITH_NAT,
             reserved: true,
           },
           {
             cidrMask: 24,
             name: 'rds',
-            subnetType: SubnetType.PRIVATE,
+            subnetType: SubnetType.PRIVATE_WITH_NAT,
           },
         ],
         maxAzs: 3,
@@ -352,12 +352,12 @@ nodeunitShim({
           {
             cidrMask: 24,
             name: 'application',
-            subnetType: SubnetType.PRIVATE,
+            subnetType: SubnetType.PRIVATE_WITH_NAT,
           },
           {
             cidrMask: 28,
             name: 'rds',
-            subnetType: SubnetType.ISOLATED,
+            subnetType: SubnetType.PRIVATE_ISOLATED,
           },
         ],
         maxAzs: 3,
@@ -391,12 +391,12 @@ nodeunitShim({
           {
             cidrMask: 24,
             name: 'application',
-            subnetType: SubnetType.PRIVATE,
+            subnetType: SubnetType.PRIVATE_WITH_NAT,
           },
           {
             cidrMask: 28,
             name: 'rds',
-            subnetType: SubnetType.ISOLATED,
+            subnetType: SubnetType.PRIVATE_ISOLATED,
           },
         ],
         maxAzs: 3,
@@ -509,7 +509,7 @@ nodeunitShim({
           {
             cidrMask: 24,
             name: 'private',
-            subnetType: SubnetType.PRIVATE,
+            subnetType: SubnetType.PRIVATE_WITH_NAT,
           },
         ],
         natGatewaySubnets: {
@@ -541,7 +541,7 @@ nodeunitShim({
             },
             {
               name: 'private',
-              subnetType: SubnetType.PRIVATE,
+              subnetType: SubnetType.PRIVATE_WITH_NAT,
             },
           ],
         });
@@ -583,7 +583,7 @@ nodeunitShim({
           },
           {
             name: 'private',
-            subnetType: SubnetType.PRIVATE,
+            subnetType: SubnetType.PRIVATE_WITH_NAT,
             reserved: true,
           },
         ],
@@ -608,7 +608,7 @@ nodeunitShim({
           {
             cidrMask: 24,
             name: 'private',
-            subnetType: SubnetType.PRIVATE,
+            subnetType: SubnetType.PRIVATE_WITH_NAT,
           },
         ],
         natGatewaySubnets: {
@@ -662,12 +662,12 @@ nodeunitShim({
       new Vpc(stack, 'VPC', {
         subnetConfiguration: [
           { subnetType: SubnetType.PUBLIC, name: 'Public' },
-          { subnetType: SubnetType.ISOLATED, name: 'Isolated' },
+          { subnetType: SubnetType.PRIVATE_ISOLATED, name: 'Isolated' },
         ],
         vpnGateway: true,
         vpnRoutePropagation: [
           {
-            subnetType: SubnetType.ISOLATED,
+            subnetType: SubnetType.PRIVATE_ISOLATED,
           },
         ],
       });
@@ -696,16 +696,16 @@ nodeunitShim({
       new Vpc(stack, 'VPC', {
         subnetConfiguration: [
           { subnetType: SubnetType.PUBLIC, name: 'Public' },
-          { subnetType: SubnetType.PRIVATE, name: 'Private' },
-          { subnetType: SubnetType.ISOLATED, name: 'Isolated' },
+          { subnetType: SubnetType.PRIVATE_WITH_NAT, name: 'Private' },
+          { subnetType: SubnetType.PRIVATE_ISOLATED, name: 'Isolated' },
         ],
         vpnGateway: true,
         vpnRoutePropagation: [
           {
-            subnetType: SubnetType.PRIVATE,
+            subnetType: SubnetType.PRIVATE_WITH_NAT,
           },
           {
-            subnetType: SubnetType.ISOLATED,
+            subnetType: SubnetType.PRIVATE_ISOLATED,
           },
         ],
       });
@@ -743,7 +743,7 @@ nodeunitShim({
       new Vpc(stack, 'VPC', {
         subnetConfiguration: [
           { subnetType: SubnetType.PUBLIC, name: 'Public' },
-          { subnetType: SubnetType.ISOLATED, name: 'Isolated' },
+          { subnetType: SubnetType.PRIVATE_ISOLATED, name: 'Isolated' },
         ],
         vpnGateway: true,
       });
@@ -1292,12 +1292,12 @@ nodeunitShim({
       const vpc = new Vpc(stack, 'VPC', {
         subnetConfiguration: [
           { subnetType: SubnetType.PUBLIC, name: 'Public' },
-          { subnetType: SubnetType.ISOLATED, name: 'Isolated' },
+          { subnetType: SubnetType.PRIVATE_ISOLATED, name: 'Isolated' },
         ],
       });
 
       // WHEN
-      const { subnetIds } = vpc.selectSubnets({ subnetType: SubnetType.ISOLATED });
+      const { subnetIds } = vpc.selectSubnets({ subnetType: SubnetType.PRIVATE_ISOLATED });
 
       // THEN
       test.deepEqual(subnetIds, vpc.isolatedSubnets.map(s => s.subnetId));
@@ -1311,8 +1311,8 @@ nodeunitShim({
       const vpc = new Vpc(stack, 'VPC', {
         subnetConfiguration: [
           { subnetType: SubnetType.PUBLIC, name: 'BlaBla' },
-          { subnetType: SubnetType.PRIVATE, name: 'DontTalkToMe' },
-          { subnetType: SubnetType.ISOLATED, name: 'DontTalkAtAll' },
+          { subnetType: SubnetType.PRIVATE_WITH_NAT, name: 'DontTalkToMe' },
+          { subnetType: SubnetType.PRIVATE_ISOLATED, name: 'DontTalkAtAll' },
         ],
       });
 
@@ -1330,8 +1330,8 @@ nodeunitShim({
       const vpc = new Vpc(stack, 'VPC', {
         subnetConfiguration: [
           { subnetType: SubnetType.PUBLIC, name: 'BlaBla' },
-          { subnetType: SubnetType.PRIVATE, name: 'DontTalkToMe' },
-          { subnetType: SubnetType.ISOLATED, name: 'DontTalkAtAll' },
+          { subnetType: SubnetType.PRIVATE_WITH_NAT, name: 'DontTalkToMe' },
+          { subnetType: SubnetType.PRIVATE_ISOLATED, name: 'DontTalkAtAll' },
         ],
       });
 
@@ -1398,8 +1398,8 @@ nodeunitShim({
         maxAzs: 1,
         subnetConfiguration: [
           { name: 'lb', subnetType: SubnetType.PUBLIC },
-          { name: 'app', subnetType: SubnetType.PRIVATE },
-          { name: 'db', subnetType: SubnetType.PRIVATE },
+          { name: 'app', subnetType: SubnetType.PRIVATE_WITH_NAT },
+          { name: 'db', subnetType: SubnetType.PRIVATE_WITH_NAT },
         ],
       });
 
@@ -1579,7 +1579,7 @@ nodeunitShim({
         privateDnsEnabled: false,
         service: new InterfaceVpcEndpointService('com.amazonaws.vpce.us-east-1.vpce-svc-uuddlrlrbastrtsvc', 443),
         subnets: {
-          subnetType: SubnetType.PRIVATE,
+          subnetType: SubnetType.PRIVATE_WITH_NAT,
           availabilityZones: ['dummy1a', 'dummy1c'],
         },
       });

From 34a57eda01ab816cd77f260b10ca466a749586bf Mon Sep 17 00:00:00 2001
From: Julian Michel <mail@julianmichel.de>
Date: Fri, 3 Sep 2021 17:05:27 +0200
Subject: [PATCH 62/91] feat(kms): support fromLookup in KMS key to get key by
 alias name (#15652)

Add method `fromLookup` in KMS key which provides the option to get a KMS key including its key id by an alias name.
In some cases, aliases can't be used because access to the underlying key id is necessary. In this case, the `fromLookup` method can be used.

The following packages were changed:
- @aws-cdk/aws-kms: introduce new `fromLookup` method
- @aws-cdk/cx-api: new KeyContextResponse
- @aws-cdk/cloud-assembly-schema: new ContextProvider KEY_PROVIDER and KeyContextQuery
- aws-cdk: implementation of key ContextProvider

Closes #8822

-----

*By submitting this pull request, I confirm that my contribution is made under the terms of the Apache-2.0 license*
---
 packages/@aws-cdk/aws-kms/README.md           |  34 +++-
 packages/@aws-cdk/aws-kms/lib/index.ts        |   1 +
 packages/@aws-cdk/aws-kms/lib/key-lookup.ts   |   9 +
 packages/@aws-cdk/aws-kms/lib/key.ts          |  58 ++++++-
 packages/@aws-cdk/aws-kms/package.json        |   9 +-
 .../aws-kms/test/key.from-lookup.test.ts      |  70 ++++++++
 .../lib/cloud-assembly/context-queries.ts     |  36 +++-
 .../schema/cloud-assembly.schema.json         |  31 ++++
 .../schema/cloud-assembly.version.json        |   2 +-
 packages/@aws-cdk/cx-api/lib/context/key.ts   |  11 ++
 packages/@aws-cdk/cx-api/lib/index.ts         |   1 +
 packages/aws-cdk/lib/api/aws-auth/sdk.ts      |   5 +
 .../aws-cdk/lib/context-providers/index.ts    |   2 +
 .../aws-cdk/lib/context-providers/keys.ts     |  62 +++++++
 .../test/context-providers/keys.test.ts       | 156 ++++++++++++++++++
 packages/aws-cdk/test/util/mock-sdk.ts        |   1 +
 16 files changed, 481 insertions(+), 7 deletions(-)
 create mode 100644 packages/@aws-cdk/aws-kms/lib/key-lookup.ts
 create mode 100644 packages/@aws-cdk/aws-kms/test/key.from-lookup.test.ts
 create mode 100644 packages/@aws-cdk/cx-api/lib/context/key.ts
 create mode 100644 packages/aws-cdk/lib/context-providers/keys.ts
 create mode 100644 packages/aws-cdk/test/context-providers/keys.test.ts

diff --git a/packages/@aws-cdk/aws-kms/README.md b/packages/@aws-cdk/aws-kms/README.md
index a576eab5aab08..098e643440784 100644
--- a/packages/@aws-cdk/aws-kms/README.md
+++ b/packages/@aws-cdk/aws-kms/README.md
@@ -62,6 +62,8 @@ pass the construct to the other stack:
 
 ## Importing existing keys
 
+### Import key by ARN
+
 To use a KMS key that is not defined in this CDK app, but is created through other means, use
 `Key.fromKeyArn(parent, name, ref)`:
 
@@ -72,10 +74,12 @@ const myKeyImported = kms.Key.fromKeyArn(this, 'MyImportedKey', 'arn:aws:...');
 myKeyImported.addAlias('alias/foo');
 ```
 
-Note that a call to `.addToPolicy(statement)` on `myKeyImported` will not have
+Note that a call to `.addToResourcePolicy(statement)` on `myKeyImported` will not have
 an affect on the key's policy because it is not owned by your stack. The call
 will be a no-op.
 
+### Import key by alias
+
 If a Key has an associated Alias, the Alias can be imported by name and used in place
 of the Key as a reference. A common scenario for this is in referencing AWS managed keys.
 
@@ -91,6 +95,34 @@ Note that calls to `addToResourcePolicy` and `grant*` methods on `myKeyAlias` wi
 no-ops, and `addAlias` and `aliasTargetKey` will fail, as the imported alias does not
 have a reference to the underlying KMS Key.
 
+### Lookup key by alias
+
+If you can't use a KMS key imported by alias (e.g. because you need access to the key id), you can lookup the key with `Key.fromLookup()`.
+
+In general, the preferred method would be to use `Alias.fromAliasName()` which returns an `IAlias` object which extends `IKey`. However, some services need to have access to the underlying key id. In this case, `Key.fromLookup()` allows to lookup the key id.
+
+The result of the `Key.fromLookup()` operation will be written to a file
+called `cdk.context.json`. You must commit this file to source control so
+that the lookup values are available in non-privileged environments such
+as CI build steps, and to ensure your template builds are repeatable.
+
+Here's how `Key.fromLookup()` can be used:
+
+```ts
+const myKeyLookup = kms.Key.fromLookup(this, 'MyKeyLookup', {
+  aliasName: 'alias/KeyAlias'
+});
+
+const role = new iam.Role(this, 'MyRole', {
+  assumedBy: new iam.ServicePrincipal('lambda.amazonaws.com'),
+});
+myKeyLookup.grantEncryptDecrypt(role);
+```
+
+Note that a call to `.addToResourcePolicy(statement)` on `myKeyLookup` will not have
+an affect on the key's policy because it is not owned by your stack. The call
+will be a no-op.
+
 ## Key Policies
 
 Controlling access and usage of KMS Keys requires the use of key policies (resource-based policies attached to the key);
diff --git a/packages/@aws-cdk/aws-kms/lib/index.ts b/packages/@aws-cdk/aws-kms/lib/index.ts
index 5affbeb43c54c..75274b1a221ef 100644
--- a/packages/@aws-cdk/aws-kms/lib/index.ts
+++ b/packages/@aws-cdk/aws-kms/lib/index.ts
@@ -1,4 +1,5 @@
 export * from './key';
+export * from './key-lookup';
 export * from './alias';
 export * from './via-service-principal';
 
diff --git a/packages/@aws-cdk/aws-kms/lib/key-lookup.ts b/packages/@aws-cdk/aws-kms/lib/key-lookup.ts
new file mode 100644
index 0000000000000..260e28e96e4c7
--- /dev/null
+++ b/packages/@aws-cdk/aws-kms/lib/key-lookup.ts
@@ -0,0 +1,9 @@
+/**
+ * Properties for looking up an existing Key.
+ */
+export interface KeyLookupOptions {
+  /**
+   * The alias name of the Key
+   */
+  readonly aliasName: string;
+}
diff --git a/packages/@aws-cdk/aws-kms/lib/key.ts b/packages/@aws-cdk/aws-kms/lib/key.ts
index aae71efb460a7..8c726958f500e 100644
--- a/packages/@aws-cdk/aws-kms/lib/key.ts
+++ b/packages/@aws-cdk/aws-kms/lib/key.ts
@@ -1,8 +1,10 @@
 import * as iam from '@aws-cdk/aws-iam';
-import { FeatureFlags, IResource, Lazy, RemovalPolicy, Resource, Stack, Duration } from '@aws-cdk/core';
+import * as cxschema from '@aws-cdk/cloud-assembly-schema';
+import { FeatureFlags, IResource, Lazy, RemovalPolicy, Resource, Stack, Duration, Token, ContextProvider, Arn } from '@aws-cdk/core';
 import * as cxapi from '@aws-cdk/cx-api';
 import { IConstruct, Construct } from 'constructs';
 import { Alias } from './alias';
+import { KeyLookupOptions } from './key-lookup';
 import { CfnKey } from './kms.generated';
 import * as perms from './private/perms';
 
@@ -534,6 +536,60 @@ export class Key extends KeyBase {
     }(cfnKey, id);
   }
 
+  /**
+   * Import an existing Key by querying the AWS environment this stack is deployed to.
+   *
+   * This function only needs to be used to use Keys not defined in your CDK
+   * application. If you are looking to share a Key between stacks, you can
+   * pass the `Key` object between stacks and use it as normal. In addition,
+   * it's not necessary to use this method if an interface accepts an `IKey`.
+   * In this case, `Alias.fromAliasName()` can be used which returns an alias
+   * that extends `IKey`.
+   *
+   * Calling this method will lead to a lookup when the CDK CLI is executed.
+   * You can therefore not use any values that will only be available at
+   * CloudFormation execution time (i.e., Tokens).
+   *
+   * The Key information will be cached in `cdk.context.json` and the same Key
+   * will be used on future runs. To refresh the lookup, you will have to
+   * evict the value from the cache using the `cdk context` command. See
+   * https://docs.aws.amazon.com/cdk/latest/guide/context.html for more information.
+   */
+  public static fromLookup(scope: Construct, id: string, options: KeyLookupOptions): IKey {
+    class Import extends KeyBase {
+      public readonly keyArn: string;
+      public readonly keyId: string;
+      protected readonly policy?: iam.PolicyDocument | undefined = undefined;
+      // defaulting true: if we are importing the key the key policy is
+      // undefined and impossible to change here; this means updating identity
+      // policies is really the only option
+      protected readonly trustAccountIdentities: boolean = true;
+
+      constructor(keyId: string, keyArn: string) {
+        super(scope, id);
+
+        this.keyId = keyId;
+        this.keyArn = keyArn;
+      }
+    }
+    if (Token.isUnresolved(options.aliasName)) {
+      throw new Error('All arguments to Key.fromLookup() must be concrete (no Tokens)');
+    }
+
+    const attributes: cxapi.KeyContextResponse = ContextProvider.getValue(scope, {
+      provider: cxschema.ContextProvider.KEY_PROVIDER,
+      props: {
+        aliasName: options.aliasName,
+      } as cxschema.KeyContextQuery,
+      dummyValue: {
+        keyId: '1234abcd-12ab-34cd-56ef-1234567890ab',
+      },
+    }).value;
+
+    return new Import(attributes.keyId,
+      Arn.format({ resource: 'key', service: 'kms', resourceName: attributes.keyId }, Stack.of(scope)));
+  }
+
   public readonly keyArn: string;
   public readonly keyId: string;
   protected readonly policy?: iam.PolicyDocument;
diff --git a/packages/@aws-cdk/aws-kms/package.json b/packages/@aws-cdk/aws-kms/package.json
index d157f85c4e67d..9bb9e8b04c1f8 100644
--- a/packages/@aws-cdk/aws-kms/package.json
+++ b/packages/@aws-cdk/aws-kms/package.json
@@ -78,20 +78,23 @@
     "cdk-integ-tools": "0.0.0",
     "cfn2ts": "0.0.0",
     "pkglint": "0.0.0",
-    "@aws-cdk/assert-internal": "0.0.0"
+    "@aws-cdk/assert-internal": "0.0.0",
+    "@aws-cdk/cloud-assembly-schema": "0.0.0"
   },
   "dependencies": {
     "@aws-cdk/aws-iam": "0.0.0",
     "@aws-cdk/core": "0.0.0",
     "@aws-cdk/cx-api": "0.0.0",
-    "constructs": "^3.3.69"
+    "constructs": "^3.3.69",
+    "@aws-cdk/cloud-assembly-schema": "0.0.0"
   },
   "homepage": "https://github.com/aws/aws-cdk",
   "peerDependencies": {
     "@aws-cdk/aws-iam": "0.0.0",
     "@aws-cdk/core": "0.0.0",
     "@aws-cdk/cx-api": "0.0.0",
-    "constructs": "^3.3.69"
+    "constructs": "^3.3.69",
+    "@aws-cdk/cloud-assembly-schema": "0.0.0"
   },
   "engines": {
     "node": ">= 10.13.0 <13 || >=13.7.0"
diff --git a/packages/@aws-cdk/aws-kms/test/key.from-lookup.test.ts b/packages/@aws-cdk/aws-kms/test/key.from-lookup.test.ts
new file mode 100644
index 0000000000000..f7af3c8c0dd14
--- /dev/null
+++ b/packages/@aws-cdk/aws-kms/test/key.from-lookup.test.ts
@@ -0,0 +1,70 @@
+import * as cxschema from '@aws-cdk/cloud-assembly-schema';
+import { ContextProvider, GetContextValueOptions, GetContextValueResult, Lazy, Stack } from '@aws-cdk/core';
+import * as cxapi from '@aws-cdk/cx-api';
+import { Construct } from 'constructs';
+import { Key } from '../lib';
+import '@aws-cdk/assert-internal/jest';
+
+test('requires concrete values', () => {
+  expect(() => {
+    // GIVEN
+    const stack = new Stack();
+
+    Key.fromLookup(stack, 'Key', {
+      aliasName: Lazy.string({ produce: () => 'some-id' }),
+    });
+  }).toThrow('All arguments to Key.fromLookup() must be concrete (no Tokens)');
+});
+
+test('return correct key', () => {
+  const previous = mockKeyContextProviderWith({
+    keyId: '12345678-1234-1234-1234-123456789012',
+  }, options => {
+    expect(options.aliasName).toEqual('alias/foo');
+  });
+
+  const stack = new Stack(undefined, undefined, { env: { region: 'us-east-1', account: '123456789012' } });
+  const key = Key.fromLookup(stack, 'Key', {
+    aliasName: 'alias/foo',
+  });
+
+  expect(key.keyId).toEqual('12345678-1234-1234-1234-123456789012');
+  expect(stack.resolve(key.keyArn)).toEqual({
+    'Fn::Join': ['', [
+      'arn:',
+      { Ref: 'AWS::Partition' },
+      ':kms:us-east-1:123456789012:key/12345678-1234-1234-1234-123456789012',
+    ]],
+  });
+
+  restoreContextProvider(previous);
+});
+
+interface MockKeyContextResponse {
+  readonly keyId: string;
+}
+
+function mockKeyContextProviderWith(
+  response: MockKeyContextResponse,
+  paramValidator?: (options: cxschema.KeyContextQuery) => void) {
+  const previous = ContextProvider.getValue;
+  ContextProvider.getValue = (_scope: Construct, options: GetContextValueOptions) => {
+    // do some basic sanity checks
+    expect(options.provider).toEqual(cxschema.ContextProvider.KEY_PROVIDER);
+
+    if (paramValidator) {
+      paramValidator(options.props as any);
+    }
+
+    return {
+      value: {
+        ...response,
+      } as cxapi.KeyContextResponse,
+    };
+  };
+  return previous;
+}
+
+function restoreContextProvider(previous: (scope: Construct, options: GetContextValueOptions) => GetContextValueResult): void {
+  ContextProvider.getValue = previous;
+}
diff --git a/packages/@aws-cdk/cloud-assembly-schema/lib/cloud-assembly/context-queries.ts b/packages/@aws-cdk/cloud-assembly-schema/lib/cloud-assembly/context-queries.ts
index a9e5df9bd1d0b..ebed927f1828e 100644
--- a/packages/@aws-cdk/cloud-assembly-schema/lib/cloud-assembly/context-queries.ts
+++ b/packages/@aws-cdk/cloud-assembly-schema/lib/cloud-assembly/context-queries.ts
@@ -48,6 +48,11 @@ export enum ContextProvider {
    * Security group provider
    */
   SECURITY_GROUP_PROVIDER = 'security-group',
+
+  /**
+   * KMS Key Provider
+   */
+  KEY_PROVIDER = 'key-provider',
 }
 
 /**
@@ -415,6 +420,34 @@ export interface SecurityGroupContextQuery {
   readonly securityGroupId: string;
 }
 
+/**
+ * Query input for looking up a KMS Key
+ */
+export interface KeyContextQuery {
+  /**
+   * Query account
+   */
+  readonly account: string;
+
+  /**
+   * Query region
+   */
+  readonly region: string;
+
+  /**
+   * The ARN of the role that should be used to look up the missing values
+   *
+   * @default - None
+   */
+  readonly lookupRoleArn?: string;
+
+  /**
+   * Alias name used to search the Key
+   */
+  readonly aliasName: string;
+
+}
+
 export type ContextQueryProperties = AmiContextQuery
 | AvailabilityZonesContextQuery
 | HostedZoneContextQuery
@@ -423,4 +456,5 @@ export type ContextQueryProperties = AmiContextQuery
 | EndpointServiceAvailabilityZonesContextQuery
 | LoadBalancerContextQuery
 | LoadBalancerListenerContextQuery
-| SecurityGroupContextQuery;
+| SecurityGroupContextQuery
+| KeyContextQuery;
diff --git a/packages/@aws-cdk/cloud-assembly-schema/schema/cloud-assembly.schema.json b/packages/@aws-cdk/cloud-assembly-schema/schema/cloud-assembly.schema.json
index 171c57d064b93..d52512102e9a6 100644
--- a/packages/@aws-cdk/cloud-assembly-schema/schema/cloud-assembly.schema.json
+++ b/packages/@aws-cdk/cloud-assembly-schema/schema/cloud-assembly.schema.json
@@ -420,6 +420,9 @@
                         },
                         {
                             "$ref": "#/definitions/SecurityGroupContextQuery"
+                        },
+                        {
+                            "$ref": "#/definitions/KeyContextQuery"
                         }
                     ]
                 }
@@ -437,6 +440,7 @@
                 "availability-zones",
                 "endpoint-service-availability-zones",
                 "hosted-zone",
+                "key-provider",
                 "load-balancer",
                 "load-balancer-listener",
                 "security-group",
@@ -767,6 +771,33 @@
                 "securityGroupId"
             ]
         },
+        "KeyContextQuery": {
+            "description": "Query input for looking up a KMS Key",
+            "type": "object",
+            "properties": {
+                "account": {
+                    "description": "Query account",
+                    "type": "string"
+                },
+                "region": {
+                    "description": "Query region",
+                    "type": "string"
+                },
+                "lookupRoleArn": {
+                    "description": "The ARN of the role that should be used to look up the missing values (Default - None)",
+                    "type": "string"
+                },
+                "aliasName": {
+                    "description": "Alias name used to search the Key",
+                    "type": "string"
+                }
+            },
+            "required": [
+                "account",
+                "aliasName",
+                "region"
+            ]
+        },
         "RuntimeInfo": {
             "description": "Information about the application's runtime components.",
             "type": "object",
diff --git a/packages/@aws-cdk/cloud-assembly-schema/schema/cloud-assembly.version.json b/packages/@aws-cdk/cloud-assembly-schema/schema/cloud-assembly.version.json
index 72764c536bcd9..c1ee7b9a1f8ad 100644
--- a/packages/@aws-cdk/cloud-assembly-schema/schema/cloud-assembly.version.json
+++ b/packages/@aws-cdk/cloud-assembly-schema/schema/cloud-assembly.version.json
@@ -1 +1 @@
-{"version":"13.0.0"}
\ No newline at end of file
+{"version":"14.0.0"}
\ No newline at end of file
diff --git a/packages/@aws-cdk/cx-api/lib/context/key.ts b/packages/@aws-cdk/cx-api/lib/context/key.ts
new file mode 100644
index 0000000000000..00693711eb7f4
--- /dev/null
+++ b/packages/@aws-cdk/cx-api/lib/context/key.ts
@@ -0,0 +1,11 @@
+/**
+ * Properties of a discovered key
+ */
+export interface KeyContextResponse {
+
+  /**
+   * Id of the key
+   */
+  readonly keyId: string;
+
+}
\ No newline at end of file
diff --git a/packages/@aws-cdk/cx-api/lib/index.ts b/packages/@aws-cdk/cx-api/lib/index.ts
index 8bab2151735c0..0b0d7b519e5d7 100644
--- a/packages/@aws-cdk/cx-api/lib/index.ts
+++ b/packages/@aws-cdk/cx-api/lib/index.ts
@@ -5,6 +5,7 @@ export * from './context/load-balancer';
 export * from './context/availability-zones';
 export * from './context/endpoint-service-availability-zones';
 export * from './context/security-group';
+export * from './context/key';
 export * from './cloud-artifact';
 export * from './artifacts/asset-manifest-artifact';
 export * from './artifacts/cloudformation-artifact';
diff --git a/packages/aws-cdk/lib/api/aws-auth/sdk.ts b/packages/aws-cdk/lib/api/aws-auth/sdk.ts
index 3e6a935acdb9a..0f1468b4d08b8 100644
--- a/packages/aws-cdk/lib/api/aws-auth/sdk.ts
+++ b/packages/aws-cdk/lib/api/aws-auth/sdk.ts
@@ -31,6 +31,7 @@ export interface ISDK {
   ecr(): AWS.ECR;
   elbv2(): AWS.ELBv2;
   secretsManager(): AWS.SecretsManager;
+  kms(): AWS.KMS;
 }
 
 /**
@@ -123,6 +124,10 @@ export class SDK implements ISDK {
     return this.wrapServiceErrorHandling(new AWS.SecretsManager(this.config));
   }
 
+  public kms(): AWS.KMS {
+    return this.wrapServiceErrorHandling(new AWS.KMS(this.config));
+  }
+
   public async currentAccount(): Promise<Account> {
     // Get/refresh if necessary before we can access `accessKeyId`
     await this.forceCredentialRetrieval();
diff --git a/packages/aws-cdk/lib/context-providers/index.ts b/packages/aws-cdk/lib/context-providers/index.ts
index 4e93905e4935c..4de652715dcf2 100644
--- a/packages/aws-cdk/lib/context-providers/index.ts
+++ b/packages/aws-cdk/lib/context-providers/index.ts
@@ -8,6 +8,7 @@ import { AmiContextProviderPlugin } from './ami';
 import { AZContextProviderPlugin } from './availability-zones';
 import { EndpointServiceAZContextProviderPlugin } from './endpoint-service-availability-zones';
 import { HostedZoneContextProviderPlugin } from './hosted-zones';
+import { KeyContextProviderPlugin } from './keys';
 import { LoadBalancerContextProviderPlugin, LoadBalancerListenerContextProviderPlugin } from './load-balancers';
 import { ContextProviderPlugin } from './provider';
 import { SecurityGroupContextProviderPlugin } from './security-groups';
@@ -74,4 +75,5 @@ const availableContextProviders: ProviderMap = {
   [cxschema.ContextProvider.SECURITY_GROUP_PROVIDER]: SecurityGroupContextProviderPlugin,
   [cxschema.ContextProvider.LOAD_BALANCER_PROVIDER]: LoadBalancerContextProviderPlugin,
   [cxschema.ContextProvider.LOAD_BALANCER_LISTENER_PROVIDER]: LoadBalancerListenerContextProviderPlugin,
+  [cxschema.ContextProvider.KEY_PROVIDER]: KeyContextProviderPlugin,
 };
diff --git a/packages/aws-cdk/lib/context-providers/keys.ts b/packages/aws-cdk/lib/context-providers/keys.ts
new file mode 100644
index 0000000000000..7c06f0119c48c
--- /dev/null
+++ b/packages/aws-cdk/lib/context-providers/keys.ts
@@ -0,0 +1,62 @@
+import * as cxschema from '@aws-cdk/cloud-assembly-schema';
+import * as cxapi from '@aws-cdk/cx-api';
+import * as AWS from 'aws-sdk';
+import { PromiseResult } from 'aws-sdk/lib/request';
+import { Mode, SdkProvider } from '../api';
+import { debug } from '../logging';
+import { ContextProviderPlugin } from './provider';
+
+export class KeyContextProviderPlugin implements ContextProviderPlugin {
+
+  constructor(private readonly aws: SdkProvider) {
+  }
+
+  public async getValue(args: cxschema.KeyContextQuery) {
+    const account: string = args.account!;
+    const region: string = args.region!;
+
+    const options = { assumeRoleArn: args.lookupRoleArn };
+    const kms = (await this.aws.forEnvironment(cxapi.EnvironmentUtils.make(account, region), Mode.ForReading, options)).kms();
+
+    const aliasListEntry = await this.findKey(kms, args);
+
+    return this.readKeyProps(aliasListEntry, args);
+  }
+
+  private async findKey(kms: AWS.KMS, args: cxschema.KeyContextQuery): Promise<AWS.KMS.AliasListEntry> {
+
+    debug(`Listing keys in ${args.account}:${args.region}`);
+
+    let response: PromiseResult<AWS.KMS.ListAliasesResponse, AWS.AWSError>;
+    let nextMarker: string | undefined;
+    do {
+      response = await kms.listAliases({
+        Marker: nextMarker,
+      }).promise();
+
+      const aliases = response.Aliases || [];
+      for (const alias of aliases) {
+        if (alias.AliasName == args.aliasName) {
+          return alias;
+        }
+      }
+
+      nextMarker = response.NextMarker;
+    } while (response.Truncated);
+
+    throw new Error(`Could not find any key with alias named ${args.aliasName}`);
+  }
+
+  private async readKeyProps(alias: AWS.KMS.AliasListEntry, args: cxschema.KeyContextQuery): Promise<cxapi.KeyContextResponse> {
+    if (!alias.TargetKeyId) {
+      throw new Error(`Could not find any key with alias named ${args.aliasName}`);
+    }
+
+    debug(`Key found ${alias.TargetKeyId}`);
+
+    return {
+      keyId: alias.TargetKeyId,
+    };
+  }
+
+}
\ No newline at end of file
diff --git a/packages/aws-cdk/test/context-providers/keys.test.ts b/packages/aws-cdk/test/context-providers/keys.test.ts
new file mode 100644
index 0000000000000..bed1d1fa8f02c
--- /dev/null
+++ b/packages/aws-cdk/test/context-providers/keys.test.ts
@@ -0,0 +1,156 @@
+import * as aws from 'aws-sdk';
+import * as AWS from 'aws-sdk-mock';
+import { KeyContextProviderPlugin } from '../../lib/context-providers/keys';
+import { MockSdkProvider } from '../util/mock-sdk';
+
+AWS.setSDK(require.resolve('aws-sdk'));
+const mockSDK = new MockSdkProvider();
+type AwsCallback<T> = (err: Error | null, val: T) => void;
+
+afterEach(done => {
+  AWS.restore();
+  done();
+});
+
+test('looks up the requested Key - single result', async () => {
+  // GIVEN
+  const provider = new KeyContextProviderPlugin(mockSDK);
+
+  AWS.mock('KMS', 'listAliases', (params: aws.KMS.ListAliasesRequest, cb: AwsCallback<aws.KMS.ListAliasesResponse>) => {
+    expect(params.KeyId).toBeUndefined();
+    return cb(null, {
+      Aliases: [
+        {
+          AliasName: 'alias/foo',
+          TargetKeyId: '1234abcd-12ab-34cd-56ef-123456789000',
+        },
+      ],
+    });
+  });
+
+  // WHEN
+  const result = await provider.getValue({
+    account: '1234',
+    region: 'us-east-1',
+    aliasName: 'alias/foo',
+  });
+
+  // THEN
+  expect(result).toEqual({
+    keyId: '1234abcd-12ab-34cd-56ef-123456789000',
+  });
+});
+
+test('looks up the requested Key - multiple results', async () => {
+  // GIVEN
+  const provider = new KeyContextProviderPlugin(mockSDK);
+
+  AWS.mock('KMS', 'listAliases', (params: aws.KMS.ListAliasesRequest, cb: AwsCallback<aws.KMS.ListAliasesResponse>) => {
+    expect(params.KeyId).toBeUndefined();
+    return cb(null, {
+      Aliases: [
+        {
+          AliasName: 'alias/bar',
+          TargetKeyId: '1234abcd-12ab-34cd-56ef-123456789000',
+        },
+        {
+          AliasName: 'alias/foo',
+          TargetKeyId: '1234abcd-12ab-34cd-56ef-123456789001',
+        },
+        {
+          AliasName: 'alias/fooBar',
+          TargetKeyId: '1234abcd-12ab-34cd-56ef-123456789002',
+        },
+      ],
+    });
+  });
+
+  // WHEN
+  const result = await provider.getValue({
+    account: '1234',
+    region: 'us-east-1',
+    aliasName: 'alias/foo',
+  });
+
+  // THEN
+  expect(result).toEqual({
+    keyId: '1234abcd-12ab-34cd-56ef-123456789001',
+  });
+});
+
+
+test('looks up the requested Key - multiple results with pagination', async () => {
+  // GIVEN
+  const provider = new KeyContextProviderPlugin(mockSDK);
+
+  AWS.mock('KMS', 'listAliases', (params: aws.KMS.ListAliasesRequest, cb: AwsCallback<aws.KMS.ListAliasesResponse>) => {
+    if (!params.Marker) {
+      return cb(null, {
+        Truncated: true,
+        NextMarker: 'nextMarker',
+        Aliases: [
+          {
+            AliasName: 'alias/key1',
+            TargetKeyId: '1234abcd-12ab-34cd-56ef-123456789000',
+          },
+          {
+            AliasName: 'alias/key2',
+            TargetKeyId: '1234abcd-12ab-34cd-56ef-123456789001',
+          },
+          {
+            AliasName: 'alias/key3',
+            TargetKeyId: '1234abcd-12ab-34cd-56ef-123456789002',
+          },
+        ],
+      });
+    } else if (params.Marker == 'nextMarker') {
+      return cb(null, {
+        Aliases: [
+          {
+            AliasName: 'alias/key4',
+            TargetKeyId: '1234abcd-12ab-34cd-56ef-123456789003',
+          },
+          {
+            AliasName: 'alias/foo',
+            TargetKeyId: '1234abcd-12ab-34cd-56ef-123456789004',
+          },
+          {
+            AliasName: 'alias/key5',
+            TargetKeyId: '1234abcd-12ab-34cd-56ef-123456789005',
+          },
+        ],
+      });
+    }
+  });
+
+  // WHEN
+  const result = await provider.getValue({
+    account: '1234',
+    region: 'us-east-1',
+    aliasName: 'alias/foo',
+  });
+
+  // THEN
+  expect(result).toEqual({
+    keyId: '1234abcd-12ab-34cd-56ef-123456789004',
+  });
+});
+
+test('throw exception - no key found', async () => {
+  // GIVEN
+  const provider = new KeyContextProviderPlugin(mockSDK);
+
+  AWS.mock('KMS', 'listAliases', (params: aws.KMS.ListAliasesRequest, cb: AwsCallback<aws.KMS.ListAliasesResponse>) => {
+    expect(params.KeyId).toBeUndefined();
+    return cb(null, {
+    });
+  });
+
+  // WHEN
+  await expect(provider.getValue({
+    account: '1234',
+    region: 'us-east-1',
+    aliasName: 'alias/foo',
+  })).rejects.toThrow(/Could not find any key with alias named/);
+
+});
\ No newline at end of file
diff --git a/packages/aws-cdk/test/util/mock-sdk.ts b/packages/aws-cdk/test/util/mock-sdk.ts
index 9bfd3972deb06..19ab5ae3cc9f5 100644
--- a/packages/aws-cdk/test/util/mock-sdk.ts
+++ b/packages/aws-cdk/test/util/mock-sdk.ts
@@ -114,6 +114,7 @@ export class MockSdk implements ISDK {
   public readonly ecr = jest.fn();
   public readonly elbv2 = jest.fn();
   public readonly secretsManager = jest.fn();
+  public readonly kms = jest.fn();
 
   public currentAccount(): Promise<Account> {
     return Promise.resolve({ accountId: '123456789012', partition: 'aws' });

From a534829b2458c5ed54d05fd5cca025cba2ddaaa7 Mon Sep 17 00:00:00 2001
From: Michael Brewer <michael.brewer@gyft.com>
Date: Fri, 3 Sep 2021 09:47:09 -0600
Subject: [PATCH 63/91] feat(lambda): python 3.9 runtime (#16366)

Add Python 3.9 to the list of supported runtimes.

closes: https://github.com/aws/aws-cdk/issues/16144 , https://github.com/aws/aws-cdk/issues/16355


----

*By submitting this pull request, I confirm that my contribution is made under the terms of the Apache-2.0 license*
---
 packages/@aws-cdk/aws-lambda/README.md        |  6 +-
 packages/@aws-cdk/aws-lambda/lib/runtime.ts   |  8 +++
 .../integ.runtime.inlinecode.expected.json    | 55 +++++++++++++++++++
 .../test/integ.runtime.inlinecode.ts          |  7 +++
 4 files changed, 73 insertions(+), 3 deletions(-)

diff --git a/packages/@aws-cdk/aws-lambda/README.md b/packages/@aws-cdk/aws-lambda/README.md
index 03839a99a2155..d257bbd635df5 100644
--- a/packages/@aws-cdk/aws-lambda/README.md
+++ b/packages/@aws-cdk/aws-lambda/README.md
@@ -601,14 +601,14 @@ Example with Python:
 new Function(this, 'Function', {
   code: Code.fromAsset(path.join(__dirname, 'my-python-handler'), {
     bundling: {
-      image: Runtime.PYTHON_3_8.bundlingImage,
+      image: Runtime.PYTHON_3_9.bundlingImage,
       command: [
         'bash', '-c',
         'pip install -r requirements.txt -t /asset-output && cp -au . /asset-output'
       ],
     },
   }),
-  runtime: Runtime.PYTHON_3_8,
+  runtime: Runtime.PYTHON_3_9,
   handler: 'index.handler',
 });
 ```
@@ -632,7 +632,7 @@ new Function(this, 'Function', {
       command: ['my', 'cool', 'command'],
     },
   }),
-  runtime: Runtime.PYTHON_3_8,
+  runtime: Runtime.PYTHON_3_9,
   handler: 'index.handler',
 });
 ```
diff --git a/packages/@aws-cdk/aws-lambda/lib/runtime.ts b/packages/@aws-cdk/aws-lambda/lib/runtime.ts
index ae26ca066e1c9..74d41bbb7e9e4 100644
--- a/packages/@aws-cdk/aws-lambda/lib/runtime.ts
+++ b/packages/@aws-cdk/aws-lambda/lib/runtime.ts
@@ -108,6 +108,14 @@ export class Runtime {
     supportsCodeGuruProfiling: true,
   });
 
+  /**
+   * The Python 3.9 runtime (python3.9)
+   */
+  public static readonly PYTHON_3_9 = new Runtime('python3.9', RuntimeFamily.PYTHON, {
+    supportsInlineCode: true,
+    supportsCodeGuruProfiling: true,
+  });
+
   /**
    * The Java 8 runtime (java8)
    */
diff --git a/packages/@aws-cdk/aws-lambda/test/integ.runtime.inlinecode.expected.json b/packages/@aws-cdk/aws-lambda/test/integ.runtime.inlinecode.expected.json
index 59961a0755b84..2a6f6c964822b 100644
--- a/packages/@aws-cdk/aws-lambda/test/integ.runtime.inlinecode.expected.json
+++ b/packages/@aws-cdk/aws-lambda/test/integ.runtime.inlinecode.expected.json
@@ -300,6 +300,56 @@
         "PYTHON38ServiceRole3EA86BBE"
       ]
     },
+    "PYTHON39ServiceRole53E964DF": {
+      "Type": "AWS::IAM::Role",
+      "Properties": {
+        "AssumeRolePolicyDocument": {
+          "Statement": [
+            {
+              "Action": "sts:AssumeRole",
+              "Effect": "Allow",
+              "Principal": {
+                "Service": "lambda.amazonaws.com"
+              }
+            }
+          ],
+          "Version": "2012-10-17"
+        },
+        "ManagedPolicyArns": [
+          {
+            "Fn::Join": [
+              "",
+              [
+                "arn:",
+                {
+                  "Ref": "AWS::Partition"
+                },
+                ":iam::aws:policy/service-role/AWSLambdaBasicExecutionRole"
+              ]
+            ]
+          }
+        ]
+      }
+    },
+    "PYTHON39143BF976": {
+      "Type": "AWS::Lambda::Function",
+      "Properties": {
+        "Code": {
+          "ZipFile": "def handler(event, context):\n  return \"success\""
+        },
+        "Role": {
+          "Fn::GetAtt": [
+            "PYTHON39ServiceRole53E964DF",
+            "Arn"
+          ]
+        },
+        "Handler": "index.handler",
+        "Runtime": "python3.9"
+      },
+      "DependsOn": [
+        "PYTHON39ServiceRole53E964DF"
+      ]
+    },
     "NODEJS14XServiceRole4523ECDB": {
       "Type": "AWS::IAM::Role",
       "Properties": {
@@ -382,6 +432,11 @@
         "Ref": "PYTHON38A180AE47"
       }
     },
+    "PYTHON39functionName": {
+      "Value": {
+        "Ref": "PYTHON39143BF976"
+      }
+    },
     "NODEJS14XfunctionName": {
       "Value": {
         "Ref": "NODEJS14X930214A3"
diff --git a/packages/@aws-cdk/aws-lambda/test/integ.runtime.inlinecode.ts b/packages/@aws-cdk/aws-lambda/test/integ.runtime.inlinecode.ts
index 3bde19e5cd22b..ff6160da9ac27 100644
--- a/packages/@aws-cdk/aws-lambda/test/integ.runtime.inlinecode.ts
+++ b/packages/@aws-cdk/aws-lambda/test/integ.runtime.inlinecode.ts
@@ -57,6 +57,13 @@ const python38 = new Function(stack, 'PYTHON_3_8', {
 });
 new CfnOutput(stack, 'PYTHON_3_8-functionName', { value: python38.functionName });
 
+const python39 = new Function(stack, 'PYTHON_3_9', {
+  code: new InlineCode('def handler(event, context):\n  return "success"'),
+  handler: 'index.handler',
+  runtime: Runtime.PYTHON_3_9,
+});
+new CfnOutput(stack, 'PYTHON_3_9-functionName', { value: python39.functionName });
+
 const node14xfn = new Function(stack, 'NODEJS_14_X', {
   code: new InlineCode('exports.handler = async function(event) { return "success" }'),
   handler: 'index.handler',

From 1d94646bd50cbbbc1ace3732a7b8ebb313ed3ddf Mon Sep 17 00:00:00 2001
From: maafk <maafk@users.noreply.github.com>
Date: Fri, 3 Sep 2021 12:27:48 -0400
Subject: [PATCH 64/91] feat(aws-ec2): Allow ApplyCloudformationInitOptions to
 set additional params (#16121)

Resolves #16004

When using CloudformationInit, can opt to include the `--role` and `--url` argument to `cfn-init` and `cfn-signal` ([ref](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/cfn-init.html#cfn-init-Syntax)).

User can do this by including [InitOptions](https://docs.aws.amazon.com/cdk/api/latest/docs/@aws-cdk_aws-ec2.ApplyCloudFormationInitOptions.html) that include `includeUrl` and `includeRole`

```typescript
ec2.Instance(this, 'MyInstance', {
  init: // init config,
  initOptions: {
    includeUrl: true,
    includeRole: true,
  }
}
```

It's possible to _always_ include these added arguments, but not sure whether that would cause regressions.

Open to any suggestions on a better way to implement

----

*By submitting this pull request, I confirm that my contribution is made under the terms of the Apache-2.0 license*
---
 .../aws-autoscaling/lib/auto-scaling-group.ts | 21 ++++++++++++++
 packages/@aws-cdk/aws-ec2/README.md           |  6 ++++
 packages/@aws-cdk/aws-ec2/lib/cfn-init.ts     | 29 ++++++++++++++++++-
 packages/@aws-cdk/aws-ec2/lib/instance.ts     | 21 ++++++++++++++
 .../@aws-cdk/aws-ec2/test/cfn-init.test.ts    | 28 ++++++++++++++++++
 5 files changed, 104 insertions(+), 1 deletion(-)

diff --git a/packages/@aws-cdk/aws-autoscaling/lib/auto-scaling-group.ts b/packages/@aws-cdk/aws-autoscaling/lib/auto-scaling-group.ts
index a57f226208c9c..027034249c4dd 100644
--- a/packages/@aws-cdk/aws-autoscaling/lib/auto-scaling-group.ts
+++ b/packages/@aws-cdk/aws-autoscaling/lib/auto-scaling-group.ts
@@ -1145,6 +1145,8 @@ export class AutoScalingGroup extends AutoScalingGroupBase implements
       embedFingerprint: options.embedFingerprint,
       printLog: options.printLog,
       ignoreFailures: options.ignoreFailures,
+      includeRole: options.includeRole,
+      includeUrl: options.includeUrl,
     });
   }
 
@@ -1780,4 +1782,23 @@ export interface ApplyCloudFormationInitOptions {
    * @default false
    */
   readonly ignoreFailures?: boolean;
+
+  /**
+   * Include --url argument when running cfn-init and cfn-signal commands
+   *
+   * This will be the cloudformation endpoint in the deployed region
+   * e.g. https://cloudformation.us-east-1.amazonaws.com
+   *
+   * @default false
+   */
+  readonly includeUrl?: boolean;
+
+  /**
+  * Include --role argument when running cfn-init and cfn-signal commands
+  *
+  * This will be the IAM instance profile attached to the EC2 instance
+  *
+  * @default false
+  */
+  readonly includeRole?: boolean;
 }
diff --git a/packages/@aws-cdk/aws-ec2/README.md b/packages/@aws-cdk/aws-ec2/README.md
index 0ed5fc82d0252..802b5fe9b3e0c 100644
--- a/packages/@aws-cdk/aws-ec2/README.md
+++ b/packages/@aws-cdk/aws-ec2/README.md
@@ -824,6 +824,12 @@ new ec2.Instance(this, 'Instance', {
 
     // Optional, how long the installation is expected to take (5 minutes by default)
     timeout: Duration.minutes(30),
+
+    // Optional, whether to include the --url argument when running cfn-init and cfn-signal commands (false by default)
+    includeUrl: true
+
+    // Optional, whether to include the --role argument when running cfn-init and cfn-signal commands (false by default)
+    includeRole: true
   },
 });
 ```
diff --git a/packages/@aws-cdk/aws-ec2/lib/cfn-init.ts b/packages/@aws-cdk/aws-ec2/lib/cfn-init.ts
index 910e7ab85cf7f..78b3345743347 100644
--- a/packages/@aws-cdk/aws-ec2/lib/cfn-init.ts
+++ b/packages/@aws-cdk/aws-ec2/lib/cfn-init.ts
@@ -124,7 +124,15 @@ export class CloudFormationInit {
 
     // To identify the resources that have the metadata and where the signal
     // needs to be sent, we need { region, stackName, logicalId }
-    const resourceLocator = `--region ${Aws.REGION} --stack ${Aws.STACK_NAME} --resource ${attachedResource.logicalId}`;
+    let resourceLocator = `--region ${Aws.REGION} --stack ${Aws.STACK_NAME} --resource ${attachedResource.logicalId}`;
+
+    // If specified in attachOptions, include arguments in cfn-init/cfn-signal commands
+    if (attachOptions.includeUrl) {
+      resourceLocator = `${resourceLocator} --url https://cloudformation.${Aws.REGION}.${Aws.URL_SUFFIX}`;
+    }
+    if (attachOptions.includeRole) {
+      resourceLocator = `${resourceLocator} --role ${attachOptions.instanceRole}`;
+    }
     const configSets = (attachOptions.configSets ?? ['default']).join(',');
     const printLog = attachOptions.printLog ?? true;
 
@@ -346,6 +354,25 @@ export interface AttachInitOptions {
    */
   readonly instanceRole: iam.IRole;
 
+  /**
+   * Include --url argument when running cfn-init and cfn-signal commands
+   *
+   * This will be the cloudformation endpoint in the deployed region
+   * e.g. https://cloudformation.us-east-1.amazonaws.com
+   *
+   * @default false
+   */
+  readonly includeUrl?: boolean;
+
+  /**
+   * Include --role argument when running cfn-init and cfn-signal commands
+   *
+   * This will be the IAM instance profile attached to the EC2 instance
+   *
+   * @default false
+   */
+  readonly includeRole?: boolean;
+
   /**
    * OS Platform the init config will be used for
    */
diff --git a/packages/@aws-cdk/aws-ec2/lib/instance.ts b/packages/@aws-cdk/aws-ec2/lib/instance.ts
index aad8cda0f5deb..813d4d5f43880 100644
--- a/packages/@aws-cdk/aws-ec2/lib/instance.ts
+++ b/packages/@aws-cdk/aws-ec2/lib/instance.ts
@@ -452,6 +452,8 @@ export class Instance extends Resource implements IInstance {
       embedFingerprint: options.embedFingerprint,
       printLog: options.printLog,
       ignoreFailures: options.ignoreFailures,
+      includeRole: options.includeRole,
+      includeUrl: options.includeUrl,
     });
     this.waitForResourceSignal(options.timeout ?? Duration.minutes(5));
   }
@@ -557,4 +559,23 @@ export interface ApplyCloudFormationInitOptions {
    * @default false
    */
   readonly ignoreFailures?: boolean;
+
+  /**
+   * Include --url argument when running cfn-init and cfn-signal commands
+   *
+   * This will be the cloudformation endpoint in the deployed region
+   * e.g. https://cloudformation.us-east-1.amazonaws.com
+   *
+   * @default false
+   */
+  readonly includeUrl?: boolean;
+
+  /**
+   * Include --role argument when running cfn-init and cfn-signal commands
+   *
+   * This will be the IAM instance profile attached to the EC2 instance
+   *
+   * @default false
+   */
+  readonly includeRole?: boolean;
 }
diff --git a/packages/@aws-cdk/aws-ec2/test/cfn-init.test.ts b/packages/@aws-cdk/aws-ec2/test/cfn-init.test.ts
index 61ed0e53fa887..e2539b71ac223 100644
--- a/packages/@aws-cdk/aws-ec2/test/cfn-init.test.ts
+++ b/packages/@aws-cdk/aws-ec2/test/cfn-init.test.ts
@@ -153,6 +153,34 @@ describe('userdata', () => {
     expectLine(lines, /fingerprint/);
   });
 
+  test('linux userdata contains right commands when url and role included', () => {
+    // WHEN
+    simpleInit.attach(resource, {
+      platform: ec2.OperatingSystemType.LINUX,
+      instanceRole,
+      includeUrl: true,
+      includeRole: true,
+      userData: linuxUserData,
+    });
+
+    // THEN
+    const lines = linuxUserData.render().split('\n');
+    expectLine(lines, cmdArg('cfn-init', `--region ${Aws.REGION}`));
+    expectLine(lines, cmdArg('cfn-init', `--stack ${Aws.STACK_NAME}`));
+    expectLine(lines, cmdArg('cfn-init', `--resource ${resource.logicalId}`));
+    expectLine(lines, cmdArg('cfn-init', `--role ${instanceRole}`));
+    expectLine(lines, cmdArg('cfn-init', `--url https://cloudformation.${Aws.REGION}.${Aws.URL_SUFFIX}`));
+    expectLine(lines, cmdArg('cfn-init', '-c default'));
+    expectLine(lines, cmdArg('cfn-signal', `--region ${Aws.REGION}`));
+    expectLine(lines, cmdArg('cfn-signal', `--stack ${Aws.STACK_NAME}`));
+    expectLine(lines, cmdArg('cfn-signal', `--resource ${resource.logicalId}`));
+    expectLine(lines, cmdArg('cfn-init', `--role ${instanceRole}`));
+    expectLine(lines, cmdArg('cfn-init', `--url https://cloudformation.${Aws.REGION}.${Aws.URL_SUFFIX}`));
+    expectLine(lines, cmdArg('cfn-signal', '-e $?'));
+    expectLine(lines, cmdArg('cat', 'cfn-init.log'));
+    expectLine(lines, /fingerprint/);
+  });
+
   test('Windows userdata contains right commands', () => {
     // WHEN
     const windowsUserData = ec2.UserData.forWindows();

From ad425d004dd9154c367622733e2a2e36a38f1cef Mon Sep 17 00:00:00 2001
From: Derek Chen-Becker <61260622+dchenbec@users.noreply.github.com>
Date: Fri, 3 Sep 2021 11:09:20 -0600
Subject: [PATCH 65/91] feat(ec2): vpc endpoint for aws keyspaces (#16306)

Adds a static instance of InterfaceVpcEndpointAwsService for the AWS
Keyspaces service so that users do not need to define it manually.
Keyspaces uses a custom TCP port (9142), so this avoids confusion.


----

*By submitting this pull request, I confirm that my contribution is made under the terms of the Apache-2.0 license*
---
 packages/@aws-cdk/aws-ec2/README.md           | 8 ++++++++
 packages/@aws-cdk/aws-ec2/lib/vpc-endpoint.ts | 1 +
 packages/@aws-cdk/aws-ec2/package.json        | 1 +
 3 files changed, 10 insertions(+)

diff --git a/packages/@aws-cdk/aws-ec2/README.md b/packages/@aws-cdk/aws-ec2/README.md
index 802b5fe9b3e0c..a9ac3794580b4 100644
--- a/packages/@aws-cdk/aws-ec2/README.md
+++ b/packages/@aws-cdk/aws-ec2/README.md
@@ -663,6 +663,14 @@ new InterfaceVpcEndpoint(stack, 'VPC Endpoint', {
 });
 ```
 
+Pre-defined AWS services are defined in the [InterfaceVpcEndpointAwsService](lib/vpc-endpoint.ts) class, and can be used to
+create VPC endpoints without having to configure name, ports, etc. For example, a Keyspaces endpoint can be created for
+use in your VPC:
+
+``` ts
+new InterfaceVpcEndpoint(stack, 'VPC Endpoint', { vpc, service: InterfaceVpcEndpointAwsService.KEYSPACES });
+```
+
 #### Security groups for interface VPC endpoints
 
 By default, interface VPC endpoints create a new security group and traffic is **not**
diff --git a/packages/@aws-cdk/aws-ec2/lib/vpc-endpoint.ts b/packages/@aws-cdk/aws-ec2/lib/vpc-endpoint.ts
index f9cb70afea180..de64072868391 100644
--- a/packages/@aws-cdk/aws-ec2/lib/vpc-endpoint.ts
+++ b/packages/@aws-cdk/aws-ec2/lib/vpc-endpoint.ts
@@ -282,6 +282,7 @@ export class InterfaceVpcEndpointAwsService implements IInterfaceVpcEndpointServ
   public static readonly CODECOMMIT_GIT = new InterfaceVpcEndpointAwsService('git-codecommit');
   public static readonly CODECOMMIT_GIT_FIPS = new InterfaceVpcEndpointAwsService('git-codecommit-fips');
   public static readonly GLUE = new InterfaceVpcEndpointAwsService('glue');
+  public static readonly KEYSPACES = new InterfaceVpcEndpointAwsService('cassandra', '', 9142);
   public static readonly KINESIS_STREAMS = new InterfaceVpcEndpointAwsService('kinesis-streams');
   public static readonly KINESIS_FIREHOSE = new InterfaceVpcEndpointAwsService('kinesis-firehose');
   public static readonly KMS = new InterfaceVpcEndpointAwsService('kms');
diff --git a/packages/@aws-cdk/aws-ec2/package.json b/packages/@aws-cdk/aws-ec2/package.json
index 941d598075411..d7c8591357c7e 100644
--- a/packages/@aws-cdk/aws-ec2/package.json
+++ b/packages/@aws-cdk/aws-ec2/package.json
@@ -239,6 +239,7 @@
       "docs-public-apis:@aws-cdk/aws-ec2.InterfaceVpcEndpointAwsService.ELASTIC_INFERENCE_RUNTIME",
       "docs-public-apis:@aws-cdk/aws-ec2.InterfaceVpcEndpointAwsService.ELASTIC_LOAD_BALANCING",
       "docs-public-apis:@aws-cdk/aws-ec2.InterfaceVpcEndpointAwsService.GLUE",
+      "docs-public-apis:@aws-cdk/aws-ec2.InterfaceVpcEndpointAwsService.KEYSPACES",
       "docs-public-apis:@aws-cdk/aws-ec2.InterfaceVpcEndpointAwsService.KINESIS_STREAMS",
       "docs-public-apis:@aws-cdk/aws-ec2.InterfaceVpcEndpointAwsService.KINESIS_FIREHOSE",
       "docs-public-apis:@aws-cdk/aws-ec2.InterfaceVpcEndpointAwsService.KMS",

From 5427578515c0b65d172f95c27f32f1933fcf8d60 Mon Sep 17 00:00:00 2001
From: Richard Hillmann <Project0@users.noreply.github.com>
Date: Fri, 3 Sep 2021 19:51:03 +0200
Subject: [PATCH 66/91] feat(elasticloadbalancingv2): ALPN policy support for
 NLB listener (#15956)

Allow specifying the ALPN Policy
----

*By submitting this pull request, I confirm that my contribution is made under the terms of the Apache-2.0 license*
---
 .../lib/nlb/network-listener.ts               | 18 +++++++-
 .../lib/shared/enums.ts                       | 35 ++++++++++++++-
 .../test/nlb/listener.test.ts                 | 44 +++++++++++++++++++
 3 files changed, 94 insertions(+), 3 deletions(-)

diff --git a/packages/@aws-cdk/aws-elasticloadbalancingv2/lib/nlb/network-listener.ts b/packages/@aws-cdk/aws-elasticloadbalancingv2/lib/nlb/network-listener.ts
index f738fbcf65bc4..2a5fbce2a28a1 100644
--- a/packages/@aws-cdk/aws-elasticloadbalancingv2/lib/nlb/network-listener.ts
+++ b/packages/@aws-cdk/aws-elasticloadbalancingv2/lib/nlb/network-listener.ts
@@ -3,7 +3,7 @@ import { Duration, IResource, Resource } from '@aws-cdk/core';
 import { Construct } from 'constructs';
 import { BaseListener, BaseListenerLookupOptions } from '../shared/base-listener';
 import { HealthCheck } from '../shared/base-target-group';
-import { Protocol, SslPolicy } from '../shared/enums';
+import { AlpnPolicy, Protocol, SslPolicy } from '../shared/enums';
 import { IListenerCertificate } from '../shared/listener-certificate';
 import { validateNetworkProtocol } from '../shared/util';
 import { NetworkListenerAction } from './network-listener-action';
@@ -65,6 +65,17 @@ export interface BaseNetworkListenerProps {
    * @default - Current predefined security policy.
    */
   readonly sslPolicy?: SslPolicy;
+
+
+  /**
+   * Application-Layer Protocol Negotiation (ALPN) is a TLS extension that is sent on the initial TLS handshake hello messages.
+   * ALPN enables the application layer to negotiate which protocols should be used over a secure connection, such as HTTP/1 and HTTP/2.
+   *
+   * Can only be specified together with Protocol TLS.
+   *
+   * @default - None
+   */
+  readonly alpnPolicy?: AlpnPolicy;
 }
 
 /**
@@ -168,12 +179,17 @@ export class NetworkListener extends BaseListener implements INetworkListener {
       throw new Error('Protocol must be TLS when certificates have been specified');
     }
 
+    if (proto !== Protocol.TLS && props.alpnPolicy) {
+      throw new Error('Protocol must be TLS when alpnPolicy have been specified');
+    }
+
     super(scope, id, {
       loadBalancerArn: props.loadBalancer.loadBalancerArn,
       protocol: proto,
       port: props.port,
       sslPolicy: props.sslPolicy,
       certificates: props.certificates,
+      alpnPolicy: props.alpnPolicy ? [props.alpnPolicy] : undefined,
     });
 
     this.loadBalancer = props.loadBalancer;
diff --git a/packages/@aws-cdk/aws-elasticloadbalancingv2/lib/shared/enums.ts b/packages/@aws-cdk/aws-elasticloadbalancingv2/lib/shared/enums.ts
index 94a9473ab9bc9..a711211a44065 100644
--- a/packages/@aws-cdk/aws-elasticloadbalancingv2/lib/shared/enums.ts
+++ b/packages/@aws-cdk/aws-elasticloadbalancingv2/lib/shared/enums.ts
@@ -60,7 +60,7 @@ export enum ApplicationProtocol {
   /**
    * HTTPS
    */
-  HTTPS = 'HTTPS'
+  HTTPS = 'HTTPS',
 }
 
 /**
@@ -172,6 +172,37 @@ export enum TargetType {
   LAMBDA = 'lambda',
 }
 
+/**
+ * Application-Layer Protocol Negotiation Policies for network load balancers.
+ * Which protocols should be used over a secure connection.
+ */
+export enum AlpnPolicy {
+  /**
+   * Negotiate only HTTP/1.*. The ALPN preference list is http/1.1, http/1.0
+   */
+  HTTP1_ONLY = 'HTTP1Only',
+
+  /**
+   * Negotiate only HTTP/2. The ALPN preference list is h2
+   */
+  HTTP2_ONLY = 'HTTP2Only',
+
+  /**
+   * Prefer HTTP/1.* over HTTP/2 (which can be useful for HTTP/2 testing). The ALPN preference list is http/1.1, http/1.0, h2
+   */
+  HTTP2_OPTIONAL = 'HTTP2Optional',
+
+  /**
+   * Prefer HTTP/2 over HTTP/1.*. The ALPN preference list is h2, http/1.1, http/1.0
+   */
+  HTTP2_PREFERRED = 'HTTP2Preferred',
+
+  /**
+   * Do not negotiate ALPN
+   */
+  NONE = 'None',
+}
+
 /**
  * Load balancing algorithmm type for target groups
  */
@@ -185,4 +216,4 @@ export enum TargetGroupLoadBalancingAlgorithmType {
    * least_outstanding_requests
    */
   LEAST_OUTSTANDING_REQUESTS = 'least_outstanding_requests',
-}
\ No newline at end of file
+}
diff --git a/packages/@aws-cdk/aws-elasticloadbalancingv2/test/nlb/listener.test.ts b/packages/@aws-cdk/aws-elasticloadbalancingv2/test/nlb/listener.test.ts
index c2f863fd4f078..e2666d3056c9f 100644
--- a/packages/@aws-cdk/aws-elasticloadbalancingv2/test/nlb/listener.test.ts
+++ b/packages/@aws-cdk/aws-elasticloadbalancingv2/test/nlb/listener.test.ts
@@ -243,6 +243,50 @@ describe('tests', () => {
     });
   });
 
+  test('Trivial add TLS listener with ALPN', () => {
+    // GIVEN
+    const stack = new cdk.Stack();
+    const vpc = new ec2.Vpc(stack, 'Stack');
+    const lb = new elbv2.NetworkLoadBalancer(stack, 'LB', { vpc });
+    const cert = new acm.Certificate(stack, 'Certificate', {
+      domainName: 'example.com',
+    });
+
+    // WHEN
+    lb.addListener('Listener', {
+      port: 443,
+      protocol: elbv2.Protocol.TLS,
+      alpnPolicy: elbv2.AlpnPolicy.HTTP2_ONLY,
+      certificates: [elbv2.ListenerCertificate.fromCertificateManager(cert)],
+      sslPolicy: elbv2.SslPolicy.TLS12,
+      defaultTargetGroups: [
+        new elbv2.NetworkTargetGroup(stack, 'Group', { vpc, port: 80 }),
+      ],
+    });
+
+    // THEN
+    expect(stack).toHaveResource('AWS::ElasticLoadBalancingV2::Listener', {
+      Protocol: 'TLS',
+      Port: 443,
+      AlpnPolicy: ['HTTP2Only'],
+      Certificates: [{ CertificateArn: { Ref: 'Certificate4E7ABB08' } }],
+      SslPolicy: 'ELBSecurityPolicy-TLS-1-2-2017-01',
+    });
+  });
+
+  test('Incompatible Protocol with ALPN', () => {
+    const stack = new cdk.Stack();
+    const vpc = new ec2.Vpc(stack, 'Stack');
+    const lb = new elbv2.NetworkLoadBalancer(stack, 'LB', { vpc });
+
+    expect(() => lb.addListener('Listener', {
+      port: 443,
+      protocol: elbv2.Protocol.TCP,
+      alpnPolicy: elbv2.AlpnPolicy.HTTP2_OPTIONAL,
+      defaultTargetGroups: [new elbv2.NetworkTargetGroup(stack, 'Group', { vpc, port: 80 })],
+    })).toThrow(/Protocol must be TLS when alpnPolicy have been specified/);
+  });
+
   test('Invalid Protocol listener', () => {
     const stack = new cdk.Stack();
     const vpc = new ec2.Vpc(stack, 'Stack');

From 27a0113ac68a05360faa22fa8897609f2f90b764 Mon Sep 17 00:00:00 2001
From: Calvin Combs <87042526+calvin-cc@users.noreply.github.com>
Date: Fri, 3 Sep 2021 11:31:28 -0700
Subject: [PATCH 67/91] fix(apigatewayv2): some methods of the `defaultStage`
 are not available without casting it to `IHttpStage` (#15607)

----

Closes #14787. Changes the defaultStage to an IHttpStage.

*By submitting this pull request, I confirm that my contribution is made under the terms of the Apache-2.0 license*
---
 packages/@aws-cdk/aws-apigatewayv2/lib/http/api.ts | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/packages/@aws-cdk/aws-apigatewayv2/lib/http/api.ts b/packages/@aws-cdk/aws-apigatewayv2/lib/http/api.ts
index 094c0131872d8..254a29ea6d28b 100644
--- a/packages/@aws-cdk/aws-apigatewayv2/lib/http/api.ts
+++ b/packages/@aws-cdk/aws-apigatewayv2/lib/http/api.ts
@@ -4,11 +4,11 @@ import { Construct } from 'constructs';
 import { CfnApi, CfnApiProps } from '../apigatewayv2.generated';
 import { IApi } from '../common/api';
 import { ApiBase } from '../common/base';
-import { DomainMappingOptions, IStage } from '../common/stage';
+import { DomainMappingOptions } from '../common/stage';
 import { IHttpRouteAuthorizer } from './authorizer';
 import { IHttpRouteIntegration, HttpIntegration, HttpRouteIntegrationConfig } from './integration';
 import { BatchHttpRouteOptions, HttpMethod, HttpRoute, HttpRouteKey } from './route';
-import { HttpStage, HttpStageOptions } from './stage';
+import { IHttpStage, HttpStage, HttpStageOptions } from './stage';
 import { VpcLink, VpcLinkProps } from './vpc-link';
 
 /**
@@ -366,7 +366,7 @@ export class HttpApi extends HttpApiBase {
   /**
    * The default stage of this API
    */
-  public readonly defaultStage: IStage | undefined;
+  public readonly defaultStage: IHttpStage | undefined;
 
   private readonly _apiEndpoint: string;
 

From 6e2a3e0f855221df98f78f6465586d5524f5c7d5 Mon Sep 17 00:00:00 2001
From: Lukas Fruntke <lukas@fruntke.tech>
Date: Fri, 3 Sep 2021 21:18:11 +0200
Subject: [PATCH 68/91] fix(stepfunctions-tasks): Athena StartQueryExecution
 includes QueryExecutionContext even when object is empty (#16141)

fixes: #16133

As described in #16133, the empty  `QueryExecutionContext`, which was included before this fix, leads to an error.
To mitigate this, I implemented a check to exclude the  `QueryExecutionContext`when both params are empty.
This way, it behaves like a truly optional parameter.

Additionally I integrated an easier way to merge an OutputLocation if provided.
This means less redundancy than the original solution, which returned an object that was only different in one key in each branch.

The unittest is based on the default unittest, but a bit "stripped down". It proofs that no empty `QueryExecutionContext` object is present.

In my tests, this fixes the
```
{
  "resourceType": "athena",
  "resource": "startQueryExecution.sync",
  "error": "Athena.InvalidRequestException",
  "cause": "Both queryExecutionContext.catalog and queryExecutionContext.database are null or empty (Service: AmazonAthena; Status Code: 400; Error Code: InvalidRequestException; Request ID: [Censored]; Proxy: null)"
}
```
error.


This solution turned out to be a bit different than I envisioned in the issue.

----

*By submitting this pull request, I confirm that my contribution is made under the terms of the Apache-2.0 license*
---
 .../lib/athena/start-query-execution.ts       | 50 ++++++-------------
 .../test/athena/start-query-execution.test.ts | 21 ++++++++
 2 files changed, 37 insertions(+), 34 deletions(-)

diff --git a/packages/@aws-cdk/aws-stepfunctions-tasks/lib/athena/start-query-execution.ts b/packages/@aws-cdk/aws-stepfunctions-tasks/lib/athena/start-query-execution.ts
index 146f8c7d1cd48..f23bd66fc5591 100644
--- a/packages/@aws-cdk/aws-stepfunctions-tasks/lib/athena/start-query-execution.ts
+++ b/packages/@aws-cdk/aws-stepfunctions-tasks/lib/athena/start-query-execution.ts
@@ -183,40 +183,22 @@ export class AthenaStartQueryExecution extends sfn.TaskStateBase {
    * @internal
    */
   protected _renderTask(): any {
-    if (this.props.resultConfiguration?.outputLocation) {
-      return {
-        Resource: integrationResourceArn('athena', 'startQueryExecution', this.integrationPattern),
-        Parameters: sfn.FieldUtils.renderObject({
-          QueryString: this.props.queryString,
-          ClientRequestToken: this.props.clientRequestToken,
-          QueryExecutionContext: {
-            Catalog: this.props.queryExecutionContext?.catalogName,
-            Database: this.props.queryExecutionContext?.databaseName,
-          },
-          ResultConfiguration: {
-            EncryptionConfiguration: this.renderEncryption(),
-            OutputLocation: `s3://${this.props.resultConfiguration?.outputLocation?.bucketName}/${this.props.resultConfiguration?.outputLocation?.objectKey}/`,
-          },
-          WorkGroup: this.props.workGroup,
-        }),
-      };
-    } else {
-      return {
-        Resource: integrationResourceArn('athena', 'startQueryExecution', this.integrationPattern),
-        Parameters: sfn.FieldUtils.renderObject({
-          QueryString: this.props.queryString,
-          ClientRequestToken: this.props.clientRequestToken,
-          QueryExecutionContext: {
-            Catalog: this.props.queryExecutionContext?.catalogName,
-            Database: this.props.queryExecutionContext?.databaseName,
-          },
-          ResultConfiguration: {
-            EncryptionConfiguration: this.renderEncryption(),
-          },
-          WorkGroup: this.props.workGroup,
-        }),
-      };
-    }
+    return {
+      Resource: integrationResourceArn('athena', 'startQueryExecution', this.integrationPattern),
+      Parameters: sfn.FieldUtils.renderObject({
+        QueryString: this.props.queryString,
+        ClientRequestToken: this.props.clientRequestToken,
+        QueryExecutionContext: (this.props.queryExecutionContext?.catalogName || this.props.queryExecutionContext?.databaseName) ? {
+          Catalog: this.props.queryExecutionContext?.catalogName,
+          Database: this.props.queryExecutionContext?.databaseName,
+        } : undefined,
+        ResultConfiguration: {
+          EncryptionConfiguration: this.renderEncryption(),
+          OutputLocation: this.props.resultConfiguration?.outputLocation ? `s3://${this.props.resultConfiguration.outputLocation.bucketName}/${this.props.resultConfiguration.outputLocation.objectKey}/` : undefined,
+        },
+        WorkGroup: this.props?.workGroup,
+      }),
+    };
   }
 }
 
diff --git a/packages/@aws-cdk/aws-stepfunctions-tasks/test/athena/start-query-execution.test.ts b/packages/@aws-cdk/aws-stepfunctions-tasks/test/athena/start-query-execution.test.ts
index 5742872286167..c2936afc2d751 100644
--- a/packages/@aws-cdk/aws-stepfunctions-tasks/test/athena/start-query-execution.test.ts
+++ b/packages/@aws-cdk/aws-stepfunctions-tasks/test/athena/start-query-execution.test.ts
@@ -153,4 +153,25 @@ describe('Start Query Execution', () => {
       },
     });
   });
+
+  test('omit QueryExecutionContext if no catalog or database name provided', () => {
+    // GIVEN
+    const stack = new cdk.Stack();
+
+    // WHEN
+    const task = new AthenaStartQueryExecution(stack, 'Query', {
+      queryString: 'CREATE DATABASE database',
+      clientRequestToken: 'unique-client-request-token',
+      resultConfiguration: {
+        outputLocation: {
+          bucketName: 'query-results-bucket',
+          objectKey: 'folder',
+        },
+      },
+    });
+
+
+    // THEN
+    expect(stack.resolve(task.toStateJson())).not.toHaveProperty('Parameters.QueryExecutionContext');
+  });
 });

From f19896be08209f140fdf07189b9d1e4c9d601bc6 Mon Sep 17 00:00:00 2001
From: Niranjan Jayakar <nija@amazon.com>
Date: Tue, 7 Sep 2021 12:21:58 +0100
Subject: [PATCH 69/91] chore: migrate all remaining modules from nodunit-shim
 to jest (#16398)

Migrate remaining module to pure jest.

Remove the module `nodeunit-shim`. Any modules still using nodeunit
must migrate directly to jest.

----

*By submitting this pull request, I confirm that my contribution is made under the terms of the Apache-2.0 license*
---
 packages/@aws-cdk/aws-athena/package.json     |   2 +-
 packages/@aws-cdk/aws-cloudfront/package.json |   2 +-
 .../aws-cloudfront/test/origin-groups.test.ts |  31 +-
 .../test/web-distribution.test.ts             | 472 ++++-----
 .../@aws-cdk/aws-codepipeline/package.json    |   3 +-
 .../aws-codepipeline/test/action.test.ts      | 207 ++--
 .../aws-codepipeline/test/artifacts.test.ts   |  85 +-
 .../test/general-validation.test.ts           |  46 +-
 .../aws-codepipeline/test/stages.test.ts      | 109 +-
 .../aws-codepipeline/test/variables.test.ts   |  88 +-
 packages/@aws-cdk/aws-ec2/package.json        |   2 +-
 .../aws-ec2/test/bastion-host.test.ts         |  55 +-
 .../@aws-cdk/aws-ec2/test/connections.test.ts | 135 ++-
 .../@aws-cdk/aws-ec2/test/instance.test.ts    | 135 ++-
 .../aws-ec2/test/launch-template.test.ts      | 105 +-
 .../aws-ec2/test/network-utils.test.ts        | 177 ++--
 .../aws-ec2/test/security-group.test.ts       | 982 +++++++++---------
 .../@aws-cdk/aws-ec2/test/userdata.test.ts    | 245 +++--
 packages/@aws-cdk/aws-ec2/test/volume.test.ts | 152 ++-
 .../aws-ec2/test/vpc-endpoint-service.test.ts |  51 +-
 .../aws-ec2/test/vpc-endpoint.test.ts         | 305 +++---
 .../aws-ec2/test/vpc-flow-logs.test.ts        | 127 ++-
 .../aws-ec2/test/vpc.from-lookup.test.ts      |  99 +-
 packages/@aws-cdk/aws-ec2/test/vpc.test.ts    | 902 ++++++++--------
 packages/@aws-cdk/aws-ec2/test/vpn.test.ts    | 153 ++-
 packages/@aws-cdk/aws-ecr-assets/package.json |   2 +-
 packages/@aws-cdk/aws-rds/package.json        |   2 +-
 .../aws-rds/test/cluster-engine.test.ts       |  82 +-
 .../aws-rds/test/database-secret.test.ts      |  39 +-
 .../test/database-secretmanager.test.ts       |  16 +-
 .../aws-rds/test/instance-engine.test.ts      | 207 ++--
 .../aws-rds/test/option-group.test.ts         |  49 +-
 .../aws-rds/test/parameter-group.test.ts      |  55 +-
 packages/@aws-cdk/aws-rds/test/proxy.test.ts  | 152 +--
 .../aws-rds/test/serverless-cluster.test.ts   | 318 +++---
 .../sql-server.instance-engine.test.ts        |  29 +-
 .../aws-rds/test/subnet-group.test.ts         |  73 +-
 packages/@aws-cdk/core/package.json           |   2 +-
 .../@aws-cdk/core/test/annotations.test.ts    |  33 +-
 packages/@aws-cdk/core/test/app.test.ts       | 135 ++-
 packages/@aws-cdk/core/test/arn.test.ts       | 195 ++--
 packages/@aws-cdk/core/test/aspect.test.ts    |  43 +-
 packages/@aws-cdk/core/test/assets.test.ts    |  91 +-
 packages/@aws-cdk/core/test/bundling.test.ts  | 185 ++--
 packages/@aws-cdk/core/test/cfn-json.test.ts  |  39 +-
 .../@aws-cdk/core/test/cfn-parameter.test.ts  |  21 +-
 .../@aws-cdk/core/test/cfn-resource.test.ts   |  83 +-
 packages/@aws-cdk/core/test/condition.test.ts |  21 +-
 packages/@aws-cdk/core/test/construct.test.ts | 425 ++++----
 packages/@aws-cdk/core/test/context.test.ts   |  69 +-
 .../core/test/cross-environment-token.test.ts |  57 +-
 .../custom-resource-provider.test.ts          |  55 +-
 .../nodejs-entrypoint.test.ts                 |  75 +-
 .../core/test/custom-resource.test.ts         |  53 +-
 packages/@aws-cdk/core/test/duration.test.ts  | 277 +++--
 .../core/test/dynamic-reference.test.ts       |  11 +-
 .../@aws-cdk/core/test/environment.test.ts    |  97 +-
 .../@aws-cdk/core/test/expiration.test.ts     |  73 +-
 .../@aws-cdk/core/test/feature-flags.test.ts  |  31 +-
 packages/@aws-cdk/core/test/fn.test.ts        | 129 ++-
 .../@aws-cdk/core/test/fs/fs-copy.test.ts     |  43 +-
 .../core/test/fs/fs-fingerprint.test.ts       |  93 +-
 packages/@aws-cdk/core/test/fs/fs.test.ts     |  33 +-
 packages/@aws-cdk/core/test/fs/utils.test.ts  | 143 ++-
 packages/@aws-cdk/core/test/include.test.ts   |  35 +-
 .../@aws-cdk/core/test/logical-id.test.ts     | 137 ++-
 packages/@aws-cdk/core/test/mappings.test.ts  |  49 +-
 packages/@aws-cdk/core/test/output.test.ts    |  49 +-
 packages/@aws-cdk/core/test/parameter.test.ts |  19 +-
 .../private/physical-name-generator.test.ts   |  99 +-
 .../core/test/private/tree-metadata.test.ts   |  65 +-
 packages/@aws-cdk/core/test/resource.test.ts  | 271 +++--
 packages/@aws-cdk/core/test/rule.test.ts      |  19 +-
 .../@aws-cdk/core/test/secret-value.test.ts   |  85 +-
 packages/@aws-cdk/core/test/size.test.ts      | 150 ++-
 .../new-style-synthesis.test.ts               | 129 ++-
 packages/@aws-cdk/core/test/stage.test.ts     | 165 ++-
 packages/@aws-cdk/core/test/staging.test.ts   | 449 ++++----
 packages/@aws-cdk/core/test/synthesis.test.ts |  77 +-
 .../@aws-cdk/core/test/tag-aspect.test.ts     | 129 ++-
 .../@aws-cdk/core/test/tag-manager.test.ts    | 143 ++-
 packages/@aws-cdk/core/test/tokens.test.ts    | 513 +++++----
 packages/@aws-cdk/core/test/util.test.ts      | 178 ++--
 tools/nodeunit-shim/.gitignore                |  13 -
 tools/nodeunit-shim/README.md                 |  80 --
 tools/nodeunit-shim/index.ts                  |  91 --
 tools/nodeunit-shim/package.json              |  27 -
 tools/nodeunit-shim/tsconfig.json             |  20 -
 88 files changed, 5452 insertions(+), 5746 deletions(-)
 delete mode 100644 tools/nodeunit-shim/.gitignore
 delete mode 100644 tools/nodeunit-shim/README.md
 delete mode 100644 tools/nodeunit-shim/index.ts
 delete mode 100644 tools/nodeunit-shim/package.json
 delete mode 100644 tools/nodeunit-shim/tsconfig.json

diff --git a/packages/@aws-cdk/aws-athena/package.json b/packages/@aws-cdk/aws-athena/package.json
index 4248daf56fb68..57bc9bfd3a677 100644
--- a/packages/@aws-cdk/aws-athena/package.json
+++ b/packages/@aws-cdk/aws-athena/package.json
@@ -76,7 +76,7 @@
     "@types/jest": "^26.0.24",
     "cdk-build-tools": "0.0.0",
     "cdk-integ-tools": "0.0.0",
-    "nodeunit-shim": "0.0.0",
+    "jest": "^26.6.3",
     "cfn2ts": "0.0.0",
     "pkglint": "0.0.0",
     "@aws-cdk/assertions": "0.0.0"
diff --git a/packages/@aws-cdk/aws-cloudfront/package.json b/packages/@aws-cdk/aws-cloudfront/package.json
index 58a6b35ef281f..36d4ce40952f5 100644
--- a/packages/@aws-cdk/aws-cloudfront/package.json
+++ b/packages/@aws-cdk/aws-cloudfront/package.json
@@ -78,7 +78,7 @@
     "cdk-build-tools": "0.0.0",
     "cdk-integ-tools": "0.0.0",
     "cfn2ts": "0.0.0",
-    "nodeunit-shim": "0.0.0",
+    "jest": "^26.6.3",
     "pkglint": "0.0.0",
     "@aws-cdk/assert-internal": "0.0.0"
   },
diff --git a/packages/@aws-cdk/aws-cloudfront/test/origin-groups.test.ts b/packages/@aws-cdk/aws-cloudfront/test/origin-groups.test.ts
index 6ffd4b5bd9e8e..891fd10eaff37 100644
--- a/packages/@aws-cdk/aws-cloudfront/test/origin-groups.test.ts
+++ b/packages/@aws-cdk/aws-cloudfront/test/origin-groups.test.ts
@@ -1,11 +1,10 @@
-import { expect, haveResourceLike } from '@aws-cdk/assert-internal';
+import '@aws-cdk/assert-internal/jest';
 import * as s3 from '@aws-cdk/aws-s3';
 import * as cdk from '@aws-cdk/core';
-import { nodeunitShim, Test } from 'nodeunit-shim';
 import { CloudFrontWebDistribution, FailoverStatusCode } from '../lib';
 
-nodeunitShim({
-  'Distribution with custom origin failover'(test: Test) {
+describe('origin group', () => {
+  test('Distribution with custom origin failover', () => {
     const stack = new cdk.Stack();
 
     new CloudFrontWebDistribution(stack, 'ADistribution', {
@@ -29,8 +28,8 @@ nodeunitShim({
       ],
     });
 
-    expect(stack).to(
-      haveResourceLike('AWS::CloudFront::Distribution', {
+    expect(stack)
+      .toHaveResourceLike('AWS::CloudFront::Distribution', {
         DistributionConfig: {
           OriginGroups: {
             Items: [
@@ -105,13 +104,12 @@ nodeunitShim({
             },
           ],
         },
-      }),
-    );
+      });
 
-    test.done();
-  },
 
-  'Distribution with s3 origin failover'(test: Test) {
+  });
+
+  test('Distribution with s3 origin failover', () => {
     const stack = new cdk.Stack();
 
     new CloudFrontWebDistribution(stack, 'ADistribution', {
@@ -141,8 +139,8 @@ nodeunitShim({
       ],
     });
 
-    expect(stack).to(
-      haveResourceLike('AWS::CloudFront::Distribution', {
+    expect(stack)
+      .toHaveResourceLike('AWS::CloudFront::Distribution', {
         DistributionConfig: {
           OriginGroups: {
             Items: [
@@ -226,9 +224,8 @@ nodeunitShim({
             },
           ],
         },
-      }),
-    );
+      });
+
 
-    test.done();
-  },
+  });
 });
diff --git a/packages/@aws-cdk/aws-cloudfront/test/web-distribution.test.ts b/packages/@aws-cdk/aws-cloudfront/test/web-distribution.test.ts
index 6d799b2f89cf9..9e40e24e3fe42 100644
--- a/packages/@aws-cdk/aws-cloudfront/test/web-distribution.test.ts
+++ b/packages/@aws-cdk/aws-cloudfront/test/web-distribution.test.ts
@@ -1,9 +1,9 @@
-import { ABSENT, expect, haveResource, haveResourceLike } from '@aws-cdk/assert-internal';
+import '@aws-cdk/assert-internal/jest';
+import { ABSENT } from '@aws-cdk/assert-internal';
 import * as certificatemanager from '@aws-cdk/aws-certificatemanager';
 import * as lambda from '@aws-cdk/aws-lambda';
 import * as s3 from '@aws-cdk/aws-s3';
 import * as cdk from '@aws-cdk/core';
-import { nodeunitShim, Test } from 'nodeunit-shim';
 import {
   CfnDistribution,
   CloudFrontWebDistribution,
@@ -33,9 +33,9 @@ dlhHmnVegyPNjP9dNqZ7zwNqMEPOPnS/NOHbJj1KYKpn1f8pPNycQ5MQCntKGnSj
 NQIDAQAB
 -----END PUBLIC KEY-----`;
 
-nodeunitShim({
+describe('web distribution', () => {
 
-  'distribution with custom origin adds custom origin'(test: Test) {
+  test('distribution with custom origin adds custom origin', () => {
     const stack = new cdk.Stack();
 
     new CloudFrontWebDistribution(stack, 'AnAmazingWebsiteProbably', {
@@ -57,7 +57,7 @@ nodeunitShim({
       ],
     });
 
-    expect(stack).toMatch(
+    expect(stack).toMatchTemplate(
       {
         'Resources': {
           'AnAmazingWebsiteProbablyCFDistribution47E3983B': {
@@ -126,10 +126,10 @@ nodeunitShim({
       },
     );
 
-    test.done();
-  },
 
-  'most basic distribution'(test: Test) {
+  });
+
+  test('most basic distribution', () => {
     const stack = new cdk.Stack();
     const sourceBucket = new s3.Bucket(stack, 'Bucket');
 
@@ -148,7 +148,7 @@ nodeunitShim({
       ],
     });
 
-    expect(stack).toMatch({
+    expect(stack).toMatchTemplate({
       'Resources': {
         'Bucket83908E77': {
           'Type': 'AWS::S3::Bucket',
@@ -203,10 +203,10 @@ nodeunitShim({
         },
       },
     });
-    test.done();
-  },
 
-  'can disable distribution'(test: Test) {
+  });
+
+  test('can disable distribution', () => {
     const stack = new cdk.Stack();
     const sourceBucket = new s3.Bucket(stack, 'Bucket');
 
@@ -226,7 +226,7 @@ nodeunitShim({
       ],
     });
 
-    expect(stack).toMatch({
+    expect(stack).toMatchTemplate({
       'Resources': {
         'Bucket83908E77': {
           'Type': 'AWS::S3::Bucket',
@@ -281,10 +281,10 @@ nodeunitShim({
         },
       },
     });
-    test.done();
-  },
 
-  'ensure long comments will not break the distribution'(test: Test) {
+  });
+
+  test('ensure long comments will not break the distribution', () => {
     const stack = new cdk.Stack();
     const sourceBucket = new s3.Bucket(stack, 'Bucket');
 
@@ -305,7 +305,7 @@ added the ellipsis so a user would know there was more to read and everything be
       ],
     });
 
-    expect(stack).toMatch({
+    expect(stack).toMatchTemplate({
       Resources: {
         Bucket83908E77: {
           Type: 'AWS::S3::Bucket',
@@ -353,10 +353,10 @@ added the ellipsis so a user would know there was more to ...`,
         },
       },
     });
-    test.done();
-  },
 
-  'distribution with bucket and OAI'(test: Test) {
+  });
+
+  test('distribution with bucket and OAI', () => {
     const stack = new cdk.Stack();
     const s3BucketSource = new s3.Bucket(stack, 'Bucket');
     const originAccessIdentity = new OriginAccessIdentity(stack, 'OAI');
@@ -368,7 +368,7 @@ added the ellipsis so a user would know there was more to ...`,
       }],
     });
 
-    expect(stack).to(haveResourceLike('AWS::CloudFront::Distribution', {
+    expect(stack).toHaveResourceLike('AWS::CloudFront::Distribution', {
       DistributionConfig: {
         Origins: [
           {
@@ -389,9 +389,9 @@ added the ellipsis so a user would know there was more to ...`,
           },
         ],
       },
-    }));
+    });
 
-    expect(stack).to(haveResourceLike('AWS::S3::BucketPolicy', {
+    expect(stack).toHaveResourceLike('AWS::S3::BucketPolicy', {
       PolicyDocument: {
         Statement: [{
           Action: 's3:GetObject',
@@ -403,13 +403,13 @@ added the ellipsis so a user would know there was more to ...`,
           },
         }],
       },
-    }));
+    });
 
-    test.done();
-  },
 
+  });
 
-  'distribution with trusted signers on default distribution'(test: Test) {
+
+  test('distribution with trusted signers on default distribution', () => {
     const stack = new cdk.Stack();
     const sourceBucket = new s3.Bucket(stack, 'Bucket');
     const pubKey = new PublicKey(stack, 'MyPubKey', {
@@ -440,7 +440,7 @@ added the ellipsis so a user would know there was more to ...`,
       ],
     });
 
-    expect(stack).toMatch({
+    expect(stack).toMatchTemplate({
       'Resources': {
         'Bucket83908E77': {
           'Type': 'AWS::S3::Bucket',
@@ -524,10 +524,10 @@ added the ellipsis so a user would know there was more to ...`,
         },
       },
     });
-    test.done();
-  },
 
-  'distribution with ViewerProtocolPolicy set to a non-default value'(test: Test) {
+  });
+
+  test('distribution with ViewerProtocolPolicy set to a non-default value', () => {
     const stack = new cdk.Stack();
     const sourceBucket = new s3.Bucket(stack, 'Bucket');
 
@@ -547,7 +547,7 @@ added the ellipsis so a user would know there was more to ...`,
       ],
     });
 
-    expect(stack).toMatch({
+    expect(stack).toMatchTemplate({
       'Resources': {
         'Bucket83908E77': {
           'Type': 'AWS::S3::Bucket',
@@ -602,10 +602,10 @@ added the ellipsis so a user would know there was more to ...`,
         },
       },
     });
-    test.done();
-  },
 
-  'distribution with disabled compression'(test: Test) {
+  });
+
+  test('distribution with disabled compression', () => {
     const stack = new cdk.Stack();
     const sourceBucket = new s3.Bucket(stack, 'Bucket');
 
@@ -625,7 +625,7 @@ added the ellipsis so a user would know there was more to ...`,
       ],
     });
 
-    expect(stack).toMatch({
+    expect(stack).toMatchTemplate({
       'Resources': {
         'Bucket83908E77': {
           'Type': 'AWS::S3::Bucket',
@@ -680,10 +680,10 @@ added the ellipsis so a user would know there was more to ...`,
         },
       },
     });
-    test.done();
-  },
 
-  'distribution with CloudFront function-association'(test: Test) {
+  });
+
+  test('distribution with CloudFront function-association', () => {
     const stack = new cdk.Stack();
     const sourceBucket = new s3.Bucket(stack, 'Bucket');
 
@@ -708,7 +708,7 @@ added the ellipsis so a user would know there was more to ...`,
       ],
     });
 
-    expect(stack).to(haveResourceLike('AWS::CloudFront::Distribution', {
+    expect(stack).toHaveResourceLike('AWS::CloudFront::Distribution', {
       'DistributionConfig': {
         'DefaultCacheBehavior': {
           'FunctionAssociations': [
@@ -724,12 +724,12 @@ added the ellipsis so a user would know there was more to ...`,
           ],
         },
       },
-    }));
+    });
+
 
-    test.done();
-  },
+  });
 
-  'distribution with resolvable lambda-association'(test: Test) {
+  test('distribution with resolvable lambda-association', () => {
     const stack = new cdk.Stack();
     const sourceBucket = new s3.Bucket(stack, 'Bucket');
 
@@ -759,7 +759,7 @@ added the ellipsis so a user would know there was more to ...`,
       ],
     });
 
-    expect(stack).to(haveResourceLike('AWS::CloudFront::Distribution', {
+    expect(stack).toHaveResourceLike('AWS::CloudFront::Distribution', {
       'DistributionConfig': {
         'DefaultCacheBehavior': {
           'LambdaFunctionAssociations': [
@@ -773,12 +773,12 @@ added the ellipsis so a user would know there was more to ...`,
           ],
         },
       },
-    }));
+    });
+
 
-    test.done();
-  },
+  });
 
-  'associate a lambda with removable env vars'(test: Test) {
+  test('associate a lambda with removable env vars', () => {
     const app = new cdk.App();
     const stack = new cdk.Stack(app, 'Stack');
     const sourceBucket = new s3.Bucket(stack, 'Bucket');
@@ -809,14 +809,14 @@ added the ellipsis so a user would know there was more to ...`,
       ],
     });
 
-    expect(stack).to(haveResource('AWS::Lambda::Function', {
+    expect(stack).toHaveResource('AWS::Lambda::Function', {
       Environment: ABSENT,
-    }));
+    });
 
-    test.done();
-  },
 
-  'throws when associating a lambda with incompatible env vars'(test: Test) {
+  });
+
+  test('throws when associating a lambda with incompatible env vars', () => {
     const app = new cdk.App();
     const stack = new cdk.Stack(app, 'Stack');
     const sourceBucket = new s3.Bucket(stack, 'Bucket');
@@ -849,19 +849,19 @@ added the ellipsis so a user would know there was more to ...`,
       ],
     });
 
-    test.throws(() => app.synth(), /KEY/);
+    expect(() => app.synth()).toThrow(/KEY/);
+
 
-    test.done();
-  },
+  });
 
-  'throws when associating a lambda with includeBody and a response event type'(test: Test) {
+  test('throws when associating a lambda with includeBody and a response event type', () => {
     const app = new cdk.App();
     const stack = new cdk.Stack(app, 'Stack');
     const sourceBucket = new s3.Bucket(stack, 'Bucket');
 
     const fnVersion = lambda.Version.fromVersionArn(stack, 'Version', 'arn:aws:lambda:testregion:111111111111:function:myTestFun:v1');
 
-    test.throws(() => {
+    expect(() => {
       new CloudFrontWebDistribution(stack, 'AnAmazingWebsiteProbably', {
         originConfigs: [
           {
@@ -881,12 +881,12 @@ added the ellipsis so a user would know there was more to ...`,
           },
         ],
       });
-    }, /'includeBody' can only be true for ORIGIN_REQUEST or VIEWER_REQUEST event types./);
+    }).toThrow(/'includeBody' can only be true for ORIGIN_REQUEST or VIEWER_REQUEST event types./);
 
-    test.done();
-  },
 
-  'distribution has a defaultChild'(test: Test) {
+  });
+
+  test('distribution has a defaultChild', () => {
     const stack = new cdk.Stack();
     const sourceBucket = new s3.Bucket(stack, 'Bucket');
 
@@ -901,11 +901,11 @@ added the ellipsis so a user would know there was more to ...`,
       ],
     });
 
-    test.ok(distribution.node.defaultChild instanceof CfnDistribution);
-    test.done();
-  },
+    expect(distribution.node.defaultChild instanceof CfnDistribution).toEqual(true);
+
+  });
 
-  'allows multiple aliasConfiguration CloudFrontWebDistribution per stack'(test: Test) {
+  test('allows multiple aliasConfiguration CloudFrontWebDistribution per stack', () => {
     const stack = new cdk.Stack();
     const s3BucketSource = new s3.Bucket(stack, 'Bucket');
 
@@ -923,7 +923,7 @@ added the ellipsis so a user would know there was more to ...`,
       aliasConfiguration: { acmCertRef: 'another_acm_ref', names: ['ftp.example.com'] },
     });
 
-    expect(stack).to(haveResourceLike('AWS::CloudFront::Distribution', {
+    expect(stack).toHaveResourceLike('AWS::CloudFront::Distribution', {
       'DistributionConfig': {
         'Aliases': ['www.example.com'],
         'ViewerCertificate': {
@@ -931,9 +931,9 @@ added the ellipsis so a user would know there was more to ...`,
           'SslSupportMethod': 'sni-only',
         },
       },
-    }));
+    });
 
-    expect(stack).to(haveResourceLike('AWS::CloudFront::Distribution', {
+    expect(stack).toHaveResourceLike('AWS::CloudFront::Distribution', {
       'DistributionConfig': {
         'Aliases': ['ftp.example.com'],
         'ViewerCertificate': {
@@ -941,13 +941,13 @@ added the ellipsis so a user would know there was more to ...`,
           'SslSupportMethod': 'sni-only',
         },
       },
-    }));
-    test.done();
-  },
+    });
 
-  'viewerCertificate': {
-    'acmCertificate': {
-      'base usage'(test: Test) {
+  });
+
+  describe('viewerCertificate', () => {
+    describe('acmCertificate', () => {
+      test('base usage', () => {
         const stack = new cdk.Stack();
         const sourceBucket = new s3.Bucket(stack, 'Bucket');
 
@@ -963,7 +963,7 @@ added the ellipsis so a user would know there was more to ...`,
           viewerCertificate: ViewerCertificate.fromAcmCertificate(certificate),
         });
 
-        expect(stack).to(haveResourceLike('AWS::CloudFront::Distribution', {
+        expect(stack).toHaveResourceLike('AWS::CloudFront::Distribution', {
           'DistributionConfig': {
             'Aliases': [],
             'ViewerCertificate': {
@@ -973,11 +973,11 @@ added the ellipsis so a user would know there was more to ...`,
               'SslSupportMethod': 'sni-only',
             },
           },
-        }));
+        });
 
-        test.done();
-      },
-      'imported certificate fromCertificateArn'(test: Test) {
+
+      });
+      test('imported certificate fromCertificateArn', () => {
         const stack = new cdk.Stack();
         const sourceBucket = new s3.Bucket(stack, 'Bucket');
 
@@ -993,7 +993,7 @@ added the ellipsis so a user would know there was more to ...`,
           viewerCertificate: ViewerCertificate.fromAcmCertificate(certificate),
         });
 
-        expect(stack).to(haveResourceLike('AWS::CloudFront::Distribution', {
+        expect(stack).toHaveResourceLike('AWS::CloudFront::Distribution', {
           'DistributionConfig': {
             'Aliases': [],
             'ViewerCertificate': {
@@ -1001,11 +1001,11 @@ added the ellipsis so a user would know there was more to ...`,
               'SslSupportMethod': 'sni-only',
             },
           },
-        }));
+        });
 
-        test.done();
-      },
-      'advanced usage'(test: Test) {
+
+      });
+      test('advanced usage', () => {
         const stack = new cdk.Stack();
         const sourceBucket = new s3.Bucket(stack, 'Bucket');
 
@@ -1025,7 +1025,7 @@ added the ellipsis so a user would know there was more to ...`,
           }),
         });
 
-        expect(stack).to(haveResourceLike('AWS::CloudFront::Distribution', {
+        expect(stack).toHaveResourceLike('AWS::CloudFront::Distribution', {
           'DistributionConfig': {
             'Aliases': ['example.com', 'www.example.com'],
             'ViewerCertificate': {
@@ -1036,13 +1036,13 @@ added the ellipsis so a user would know there was more to ...`,
               'SslSupportMethod': 'vip',
             },
           },
-        }));
+        });
 
-        test.done();
-      },
-    },
-    'iamCertificate': {
-      'base usage'(test: Test) {
+
+      });
+    });
+    describe('iamCertificate', () => {
+      test('base usage', () => {
         const stack = new cdk.Stack();
         const sourceBucket = new s3.Bucket(stack, 'Bucket');
 
@@ -1054,7 +1054,7 @@ added the ellipsis so a user would know there was more to ...`,
           viewerCertificate: ViewerCertificate.fromIamCertificate('test'),
         });
 
-        expect(stack).to(haveResourceLike('AWS::CloudFront::Distribution', {
+        expect(stack).toHaveResourceLike('AWS::CloudFront::Distribution', {
           'DistributionConfig': {
             'Aliases': [],
             'ViewerCertificate': {
@@ -1062,11 +1062,11 @@ added the ellipsis so a user would know there was more to ...`,
               'SslSupportMethod': 'sni-only',
             },
           },
-        }));
+        });
 
-        test.done();
-      },
-      'advanced usage'(test: Test) {
+
+      });
+      test('advanced usage', () => {
         const stack = new cdk.Stack();
         const sourceBucket = new s3.Bucket(stack, 'Bucket');
 
@@ -1082,7 +1082,7 @@ added the ellipsis so a user would know there was more to ...`,
           }),
         });
 
-        expect(stack).to(haveResourceLike('AWS::CloudFront::Distribution', {
+        expect(stack).toHaveResourceLike('AWS::CloudFront::Distribution', {
           'DistributionConfig': {
             'Aliases': ['example.com'],
             'ViewerCertificate': {
@@ -1091,13 +1091,13 @@ added the ellipsis so a user would know there was more to ...`,
               'SslSupportMethod': 'vip',
             },
           },
-        }));
+        });
 
-        test.done();
-      },
-    },
-    'cloudFrontDefaultCertificate': {
-      'base usage'(test: Test) {
+
+      });
+    });
+    describe('cloudFrontDefaultCertificate', () => {
+      test('base usage', () => {
         const stack = new cdk.Stack();
         const sourceBucket = new s3.Bucket(stack, 'Bucket');
 
@@ -1109,18 +1109,18 @@ added the ellipsis so a user would know there was more to ...`,
           viewerCertificate: ViewerCertificate.fromCloudFrontDefaultCertificate(),
         });
 
-        expect(stack).to(haveResourceLike('AWS::CloudFront::Distribution', {
+        expect(stack).toHaveResourceLike('AWS::CloudFront::Distribution', {
           'DistributionConfig': {
             'Aliases': [],
             'ViewerCertificate': {
               'CloudFrontDefaultCertificate': true,
             },
           },
-        }));
+        });
 
-        test.done();
-      },
-      'aliases are set'(test: Test) {
+
+      });
+      test('aliases are set', () => {
         const stack = new cdk.Stack();
         const sourceBucket = new s3.Bucket(stack, 'Bucket');
 
@@ -1132,24 +1132,24 @@ added the ellipsis so a user would know there was more to ...`,
           viewerCertificate: ViewerCertificate.fromCloudFrontDefaultCertificate('example.com', 'www.example.com'),
         });
 
-        expect(stack).to(haveResourceLike('AWS::CloudFront::Distribution', {
+        expect(stack).toHaveResourceLike('AWS::CloudFront::Distribution', {
           'DistributionConfig': {
             'Aliases': ['example.com', 'www.example.com'],
             'ViewerCertificate': {
               'CloudFrontDefaultCertificate': true,
             },
           },
-        }));
+        });
 
-        test.done();
-      },
-    },
-    'errors': {
-      'throws if both deprecated aliasConfiguration and viewerCertificate'(test: Test) {
+
+      });
+    });
+    describe('errors', () => {
+      test('throws if both deprecated aliasConfiguration and viewerCertificate', () => {
         const stack = new cdk.Stack();
         const sourceBucket = new s3.Bucket(stack, 'Bucket');
 
-        test.throws(() => {
+        expect(() => {
           new CloudFrontWebDistribution(stack, 'AnAmazingWebsiteProbably', {
             originConfigs: [{
               s3OriginSource: { s3BucketSource: sourceBucket },
@@ -1158,15 +1158,15 @@ added the ellipsis so a user would know there was more to ...`,
             aliasConfiguration: { acmCertRef: 'test', names: ['ftp.example.com'] },
             viewerCertificate: ViewerCertificate.fromCloudFrontDefaultCertificate('example.com', 'www.example.com'),
           });
-        }, /You cannot set both aliasConfiguration and viewerCertificate properties/);
+        }).toThrow(/You cannot set both aliasConfiguration and viewerCertificate properties/);
 
-        test.done();
-      },
-      'throws if invalid security policy for SSL method'(test: Test) {
+
+      });
+      test('throws if invalid security policy for SSL method', () => {
         const stack = new cdk.Stack();
         const sourceBucket = new s3.Bucket(stack, 'Bucket');
 
-        test.throws(() => {
+        expect(() => {
           new CloudFrontWebDistribution(stack, 'AnAmazingWebsiteProbably', {
             originConfigs: [{
               s3OriginSource: { s3BucketSource: sourceBucket },
@@ -1177,12 +1177,12 @@ added the ellipsis so a user would know there was more to ...`,
               sslMethod: SSLMethod.VIP,
             }),
           });
-        }, /TLSv1.1_2016 is not compabtible with sslMethod vip./);
+        }).toThrow(/TLSv1.1_2016 is not compabtible with sslMethod vip./);
 
-        test.done();
-      },
+
+      });
       // FIXME https://github.com/aws/aws-cdk/issues/4724
-      'does not throw if acmCertificate explicitly not in us-east-1'(test: Test) {
+      test('does not throw if acmCertificate explicitly not in us-east-1', () => {
         const stack = new cdk.Stack();
         const sourceBucket = new s3.Bucket(stack, 'Bucket');
 
@@ -1198,7 +1198,7 @@ added the ellipsis so a user would know there was more to ...`,
           viewerCertificate: ViewerCertificate.fromAcmCertificate(certificate),
         });
 
-        expect(stack).to(haveResourceLike('AWS::CloudFront::Distribution', {
+        expect(stack).toHaveResourceLike('AWS::CloudFront::Distribution', {
           'DistributionConfig': {
             'Aliases': [],
             'ViewerCertificate': {
@@ -1206,14 +1206,14 @@ added the ellipsis so a user would know there was more to ...`,
               'SslSupportMethod': 'sni-only',
             },
           },
-        }));
+        });
 
-        test.done();
-      },
-    },
-  },
 
-  'edgelambda.amazonaws.com is added to the trust policy of lambda'(test: Test) {
+      });
+    });
+  });
+
+  test('edgelambda.amazonaws.com is added to the trust policy of lambda', () => {
     // GIVEN
     const stack = new cdk.Stack();
     const sourceBucket = new s3.Bucket(stack, 'Bucket');
@@ -1245,7 +1245,7 @@ added the ellipsis so a user would know there was more to ...`,
     });
 
     // THEN
-    expect(stack).to(haveResource('AWS::IAM::Role', {
+    expect(stack).toHaveResource('AWS::IAM::Role', {
       AssumeRolePolicyDocument: {
         'Statement': [
           {
@@ -1265,11 +1265,11 @@ added the ellipsis so a user would know there was more to ...`,
         ],
         'Version': '2012-10-17',
       },
-    }));
-    test.done();
-  },
+    });
 
-  'edgelambda.amazonaws.com is not added to lambda role for imported functions'(test: Test) {
+  });
+
+  test('edgelambda.amazonaws.com is not added to lambda role for imported functions', () => {
     // GIVEN
     const stack = new cdk.Stack();
     const sourceBucket = new s3.Bucket(stack, 'Bucket');
@@ -1295,13 +1295,13 @@ added the ellipsis so a user would know there was more to ...`,
       ],
     });
 
-    expect(stack).notTo(haveResourceLike('AWS::IAM::Role'));
-    test.done();
-  },
+    expect(stack).not.toHaveResourceLike('AWS::IAM::Role');
+
+  });
 
-  'geo restriction': {
-    'success': {
-      'allowlist'(test: Test) {
+  describe('geo restriction', () => {
+    describe('success', () => {
+      test('allowlist', () => {
         const stack = new cdk.Stack();
         const sourceBucket = new s3.Bucket(stack, 'Bucket');
 
@@ -1313,7 +1313,7 @@ added the ellipsis so a user would know there was more to ...`,
           geoRestriction: GeoRestriction.allowlist('US', 'UK'),
         });
 
-        expect(stack).toMatch({
+        expect(stack).toMatchTemplate({
           'Resources': {
             'Bucket83908E77': {
               'Type': 'AWS::S3::Bucket',
@@ -1375,9 +1375,9 @@ added the ellipsis so a user would know there was more to ...`,
           },
         });
 
-        test.done();
-      },
-      'denylist'(test: Test) {
+
+      });
+      test('denylist', () => {
         const stack = new cdk.Stack();
         const sourceBucket = new s3.Bucket(stack, 'Bucket');
 
@@ -1389,7 +1389,7 @@ added the ellipsis so a user would know there was more to ...`,
           geoRestriction: GeoRestriction.denylist('US'),
         });
 
-        expect(stack).toMatch({
+        expect(stack).toMatchTemplate({
           'Resources': {
             'Bucket83908E77': {
               'Type': 'AWS::S3::Bucket',
@@ -1451,40 +1451,40 @@ added the ellipsis so a user would know there was more to ...`,
           },
         });
 
-        test.done();
-      },
-    },
-    'error': {
-      'throws if locations is empty array'(test: Test) {
-        test.throws(() => {
+
+      });
+    });
+    describe('error', () => {
+      test('throws if locations is empty array', () => {
+        expect(() => {
           GeoRestriction.allowlist();
-        }, /Should provide at least 1 location/);
+        }).toThrow(/Should provide at least 1 location/);
 
-        test.throws(() => {
+        expect(() => {
           GeoRestriction.denylist();
-        }, /Should provide at least 1 location/);
+        }).toThrow(/Should provide at least 1 location/);
 
-        test.done();
-      },
-      'throws if locations format is wrong'(test: Test) {
-        test.throws(() => {
+
+      });
+      test('throws if locations format is wrong', () => {
+        expect(() => {
           GeoRestriction.allowlist('us');
-        }, /Invalid location format for location: us, location should be two-letter and uppercase country ISO 3166-1-alpha-2 code/);
+        }).toThrow(/Invalid location format for location: us, location should be two-letter and uppercase country ISO 3166-1-alpha-2 code/);
 
-        test.throws(() => {
+        expect(() => {
           GeoRestriction.denylist('us');
-        }, /Invalid location format for location: us, location should be two-letter and uppercase country ISO 3166-1-alpha-2 code/);
+        }).toThrow(/Invalid location format for location: us, location should be two-letter and uppercase country ISO 3166-1-alpha-2 code/);
 
-        test.done();
-      },
-    },
-  },
 
-  'Connection behaviors between CloudFront and your origin': {
-    'success': {
-      'connectionAttempts = 1'(test: Test) {
+      });
+    });
+  });
+
+  describe('Connection behaviors between CloudFront and your origin', () => {
+    describe('success', () => {
+      test('connectionAttempts = 1', () => {
         const stack = new cdk.Stack();
-        test.doesNotThrow(() => {
+        expect(() => {
           new CloudFrontWebDistribution(stack, 'Distribution', {
             originConfigs: [{
               behaviors: [{ isDefaultBehavior: true }],
@@ -1492,12 +1492,12 @@ added the ellipsis so a user would know there was more to ...`,
               customOriginSource: { domainName: 'myorigin.com' },
             }],
           });
-        }, /connectionAttempts: You can specify 1, 2, or 3 as the number of attempts./);
-        test.done();
-      },
-      '3 = connectionAttempts'(test: Test) {
+        }).not.toThrow(/connectionAttempts: You can specify 1, 2, or 3 as the number of attempts./);
+
+      });
+      test('3 = connectionAttempts', () => {
         const stack = new cdk.Stack();
-        test.doesNotThrow(() => {
+        expect(() => {
           new CloudFrontWebDistribution(stack, 'Distribution', {
             originConfigs: [{
               behaviors: [{ isDefaultBehavior: true }],
@@ -1505,12 +1505,12 @@ added the ellipsis so a user would know there was more to ...`,
               customOriginSource: { domainName: 'myorigin.com' },
             }],
           });
-        }, /connectionAttempts: You can specify 1, 2, or 3 as the number of attempts./);
-        test.done();
-      },
-      'connectionTimeout = 1'(test: Test) {
+        }).not.toThrow(/connectionAttempts: You can specify 1, 2, or 3 as the number of attempts./);
+
+      });
+      test('connectionTimeout = 1', () => {
         const stack = new cdk.Stack();
-        test.doesNotThrow(() => {
+        expect(() => {
           new CloudFrontWebDistribution(stack, 'Distribution', {
             originConfigs: [{
               behaviors: [{ isDefaultBehavior: true }],
@@ -1518,12 +1518,12 @@ added the ellipsis so a user would know there was more to ...`,
               customOriginSource: { domainName: 'myorigin.com' },
             }],
           });
-        }, /connectionTimeout: You can specify a number of seconds between 1 and 10 (inclusive)./);
-        test.done();
-      },
-      '10 = connectionTimeout'(test: Test) {
+        }).not.toThrow(/connectionTimeout: You can specify a number of seconds between 1 and 10 (inclusive)./);
+
+      });
+      test('10 = connectionTimeout', () => {
         const stack = new cdk.Stack();
-        test.doesNotThrow(() => {
+        expect(() => {
           new CloudFrontWebDistribution(stack, 'Distribution', {
             originConfigs: [{
               behaviors: [{ isDefaultBehavior: true }],
@@ -1531,14 +1531,14 @@ added the ellipsis so a user would know there was more to ...`,
               customOriginSource: { domainName: 'myorigin.com' },
             }],
           });
-        }, /connectionTimeout: You can specify a number of seconds between 1 and 10 (inclusive)./);
-        test.done();
-      },
-    },
-    'errors': {
-      'connectionAttempts = 1.1'(test: Test) {
+        }).not.toThrow(/connectionTimeout: You can specify a number of seconds between 1 and 10 (inclusive)./);
+
+      });
+    });
+    describe('errors', () => {
+      test('connectionAttempts = 1.1', () => {
         const stack = new cdk.Stack();
-        test.throws(() => {
+        expect(() => {
           new CloudFrontWebDistribution(stack, 'Distribution', {
             originConfigs: [{
               behaviors: [{ isDefaultBehavior: true }],
@@ -1546,12 +1546,12 @@ added the ellipsis so a user would know there was more to ...`,
               customOriginSource: { domainName: 'myorigin.com' },
             }],
           });
-        }, /connectionAttempts: You can specify 1, 2, or 3 as the number of attempts./);
-        test.done();
-      },
-      'connectionAttempts = -1'(test: Test) {
+        }).toThrow(/connectionAttempts: You can specify 1, 2, or 3 as the number of attempts./);
+
+      });
+      test('connectionAttempts = -1', () => {
         const stack = new cdk.Stack();
-        test.throws(() => {
+        expect(() => {
           new CloudFrontWebDistribution(stack, 'Distribution', {
             originConfigs: [{
               behaviors: [{ isDefaultBehavior: true }],
@@ -1559,12 +1559,12 @@ added the ellipsis so a user would know there was more to ...`,
               customOriginSource: { domainName: 'myorigin.com' },
             }],
           });
-        }, /connectionAttempts: You can specify 1, 2, or 3 as the number of attempts./);
-        test.done();
-      },
-      'connectionAttempts < 1'(test: Test) {
+        }).toThrow(/connectionAttempts: You can specify 1, 2, or 3 as the number of attempts./);
+
+      });
+      test('connectionAttempts < 1', () => {
         const stack = new cdk.Stack();
-        test.throws(() => {
+        expect(() => {
           new CloudFrontWebDistribution(stack, 'Distribution', {
             originConfigs: [{
               behaviors: [{ isDefaultBehavior: true }],
@@ -1572,12 +1572,12 @@ added the ellipsis so a user would know there was more to ...`,
               customOriginSource: { domainName: 'myorigin.com' },
             }],
           });
-        }, /connectionAttempts: You can specify 1, 2, or 3 as the number of attempts./);
-        test.done();
-      },
-      '3 < connectionAttempts'(test: Test) {
+        }).toThrow(/connectionAttempts: You can specify 1, 2, or 3 as the number of attempts./);
+
+      });
+      test('3 < connectionAttempts', () => {
         const stack = new cdk.Stack();
-        test.throws(() => {
+        expect(() => {
           new CloudFrontWebDistribution(stack, 'Distribution', {
             originConfigs: [{
               behaviors: [{ isDefaultBehavior: true }],
@@ -1585,12 +1585,12 @@ added the ellipsis so a user would know there was more to ...`,
               customOriginSource: { domainName: 'myorigin.com' },
             }],
           });
-        }, /connectionAttempts: You can specify 1, 2, or 3 as the number of attempts./);
-        test.done();
-      },
-      'connectionTimeout = 1.1'(test: Test) {
+        }).toThrow(/connectionAttempts: You can specify 1, 2, or 3 as the number of attempts./);
+
+      });
+      test('connectionTimeout = 1.1', () => {
         const stack = new cdk.Stack();
-        test.throws(() => {
+        expect(() => {
           new CloudFrontWebDistribution(stack, 'Distribution', {
             originConfigs: [{
               behaviors: [{ isDefaultBehavior: true }],
@@ -1598,12 +1598,12 @@ added the ellipsis so a user would know there was more to ...`,
               customOriginSource: { domainName: 'myorigin.com' },
             }],
           });
-        }, /connectionTimeout: You can specify a number of seconds between 1 and 10 \(inclusive\)./);
-        test.done();
-      },
-      'connectionTimeout < 1'(test: Test) {
+        }).toThrow(/connectionTimeout: You can specify a number of seconds between 1 and 10 \(inclusive\)./);
+
+      });
+      test('connectionTimeout < 1', () => {
         const stack = new cdk.Stack();
-        test.throws(() => {
+        expect(() => {
           new CloudFrontWebDistribution(stack, 'Distribution', {
             originConfigs: [{
               behaviors: [{ isDefaultBehavior: true }],
@@ -1611,12 +1611,12 @@ added the ellipsis so a user would know there was more to ...`,
               customOriginSource: { domainName: 'myorigin.com' },
             }],
           });
-        }, /connectionTimeout: You can specify a number of seconds between 1 and 10 \(inclusive\)./);
-        test.done();
-      },
-      '10 < connectionTimeout'(test: Test) {
+        }).toThrow(/connectionTimeout: You can specify a number of seconds between 1 and 10 \(inclusive\)./);
+
+      });
+      test('10 < connectionTimeout', () => {
         const stack = new cdk.Stack();
-        test.throws(() => {
+        expect(() => {
           new CloudFrontWebDistribution(stack, 'Distribution', {
             originConfigs: [{
               behaviors: [{ isDefaultBehavior: true }],
@@ -1624,22 +1624,22 @@ added the ellipsis so a user would know there was more to ...`,
               customOriginSource: { domainName: 'myorigin.com' },
             }],
           });
-        }, /connectionTimeout: You can specify a number of seconds between 1 and 10 \(inclusive\)./);
-        test.done();
-      },
-    },
-  },
+        }).toThrow(/connectionTimeout: You can specify a number of seconds between 1 and 10 \(inclusive\)./);
 
-  'existing distributions can be imported'(test: Test) {
+      });
+    });
+  });
+
+  test('existing distributions can be imported', () => {
     const stack = new cdk.Stack();
     const dist = CloudFrontWebDistribution.fromDistributionAttributes(stack, 'ImportedDist', {
       domainName: 'd111111abcdef8.cloudfront.net',
       distributionId: '012345ABCDEF',
     });
 
-    test.equals(dist.distributionDomainName, 'd111111abcdef8.cloudfront.net');
-    test.equals(dist.distributionId, '012345ABCDEF');
+    expect(dist.distributionDomainName).toEqual('d111111abcdef8.cloudfront.net');
+    expect(dist.distributionId).toEqual('012345ABCDEF');
+
 
-    test.done();
-  },
+  });
 });
diff --git a/packages/@aws-cdk/aws-codepipeline/package.json b/packages/@aws-cdk/aws-codepipeline/package.json
index 95b30ad58ae03..0f6ff83649093 100644
--- a/packages/@aws-cdk/aws-codepipeline/package.json
+++ b/packages/@aws-cdk/aws-codepipeline/package.json
@@ -83,9 +83,8 @@
     "@types/nodeunit": "^0.0.32",
     "cdk-build-tools": "0.0.0",
     "cdk-integ-tools": "0.0.0",
-    "nodeunit-shim": "0.0.0",
     "cfn2ts": "0.0.0",
-    "nodeunit": "^0.11.3",
+    "jest": "^26.6.3",
     "pkglint": "0.0.0",
     "@aws-cdk/assert-internal": "0.0.0"
   },
diff --git a/packages/@aws-cdk/aws-codepipeline/test/action.test.ts b/packages/@aws-cdk/aws-codepipeline/test/action.test.ts
index 8f3e81736d0b2..69a5839385fcd 100644
--- a/packages/@aws-cdk/aws-codepipeline/test/action.test.ts
+++ b/packages/@aws-cdk/aws-codepipeline/test/action.test.ts
@@ -1,7 +1,6 @@
-import { expect, haveResourceLike } from '@aws-cdk/assert-internal';
+import '@aws-cdk/assert-internal/jest';
 import * as iam from '@aws-cdk/aws-iam';
 import * as cdk from '@aws-cdk/core';
-import { nodeunitShim, Test } from 'nodeunit-shim';
 import * as codepipeline from '../lib';
 import * as validations from '../lib/private/validation';
 import { FakeBuildAction } from './fake-build-action';
@@ -9,61 +8,61 @@ import { FakeSourceAction } from './fake-source-action';
 
 /* eslint-disable quote-props */
 
-nodeunitShim({
-  'artifact bounds validation': {
+describe('action', () => {
+  describe('artifact bounds validation', () => {
 
-    'artifacts count exceed maximum'(test: Test) {
+    test('artifacts count exceed maximum', () => {
       const result = boundsValidationResult(1, 0, 0);
-      test.deepEqual(result.length, 1);
-      test.ok(result[0].match(/cannot have more than 0/), 'the validation should have failed');
-      test.done();
-    },
+      expect(result.length).toEqual(1);
+      expect(result[0]).toMatch(/cannot have more than 0/);
 
-    'artifacts count below minimum'(test: Test) {
+    });
+
+    test('artifacts count below minimum', () => {
       const result = boundsValidationResult(1, 2, 2);
-      test.deepEqual(result.length, 1);
-      test.ok(result[0].match(/must have at least 2/), 'the validation should have failed');
-      test.done();
-    },
+      expect(result.length).toEqual(1);
+      expect(result[0]).toMatch(/must have at least 2/);
 
-    'artifacts count within bounds'(test: Test) {
+    });
+
+    test('artifacts count within bounds', () => {
       const result = boundsValidationResult(1, 0, 2);
-      test.deepEqual(result.length, 0);
-      test.done();
-    },
-  },
+      expect(result.length).toEqual(0);
 
-  'action type validation': {
+    });
+  });
 
-    'must be source and is source'(test: Test) {
+  describe('action type validation', () => {
+
+    test('must be source and is source', () => {
       const result = validations.validateSourceAction(true, codepipeline.ActionCategory.SOURCE, 'test action', 'test stage');
-      test.deepEqual(result.length, 0);
-      test.done();
-    },
+      expect(result.length).toEqual(0);
+
+    });
 
-    'must be source and is not source'(test: Test) {
+    test('must be source and is not source', () => {
       const result = validations.validateSourceAction(true, codepipeline.ActionCategory.DEPLOY, 'test action', 'test stage');
-      test.deepEqual(result.length, 1);
-      test.ok(result[0].match(/may only contain Source actions/), 'the validation should have failed');
-      test.done();
-    },
+      expect(result.length).toEqual(1);
+      expect(result[0]).toMatch(/may only contain Source actions/);
+
+    });
 
-    'cannot be source and is source'(test: Test) {
+    test('cannot be source and is source', () => {
       const result = validations.validateSourceAction(false, codepipeline.ActionCategory.SOURCE, 'test action', 'test stage');
-      test.deepEqual(result.length, 1);
-      test.ok(result[0].match(/may only occur in first stage/), 'the validation should have failed');
-      test.done();
-    },
+      expect(result.length).toEqual(1);
+      expect(result[0]).toMatch(/may only occur in first stage/);
+
+    });
 
-    'cannot be source and is not source'(test: Test) {
+    test('cannot be source and is not source', () => {
       const result = validations.validateSourceAction(false, codepipeline.ActionCategory.DEPLOY, 'test action', 'test stage');
-      test.deepEqual(result.length, 0);
-      test.done();
-    },
-  },
+      expect(result.length).toEqual(0);
+
+    });
+  });
 
-  'action name validation': {
-    'throws an exception when adding an Action with an empty name to the Pipeline'(test: Test) {
+  describe('action name validation', () => {
+    test('throws an exception when adding an Action with an empty name to the Pipeline', () => {
       const stack = new cdk.Stack();
       const action = new FakeSourceAction({
         actionName: '',
@@ -72,16 +71,16 @@ nodeunitShim({
 
       const pipeline = new codepipeline.Pipeline(stack, 'Pipeline');
       const stage = pipeline.addStage({ stageName: 'Source' });
-      test.throws(() => {
+      expect(() => {
         stage.addAction(action);
-      }, /Action name must match regular expression:/);
+      }).toThrow(/Action name must match regular expression:/);
 
-      test.done();
-    },
-  },
 
-  'action Artifacts validation': {
-    'validates that input Artifacts are within bounds'(test: Test) {
+    });
+  });
+
+  describe('action Artifacts validation', () => {
+    test('validates that input Artifacts are within bounds', () => {
       const stack = new cdk.Stack();
       const sourceOutput = new codepipeline.Artifact();
       const extraOutput1 = new codepipeline.Artifact('A1');
@@ -121,15 +120,15 @@ nodeunitShim({
         ],
       });
 
-      test.throws(() => {
-        expect(stack).to(haveResourceLike('AWS::CodePipeline::Pipeline', {
-        }));
-      }, /Build\/Fake cannot have more than 3 input artifacts/);
+      expect(() => {
+        expect(stack).toHaveResourceLike('AWS::CodePipeline::Pipeline', {
+        });
+      }).toThrow(/Build\/Fake cannot have more than 3 input artifacts/);
+
 
-      test.done();
-    },
+    });
 
-    'validates that output Artifacts are within bounds'(test: Test) {
+    test('validates that output Artifacts are within bounds', () => {
       const stack = new cdk.Stack();
       const sourceOutput = new codepipeline.Artifact();
       const extraOutput1 = new codepipeline.Artifact('A1');
@@ -166,16 +165,16 @@ nodeunitShim({
         ],
       });
 
-      test.throws(() => {
-        expect(stack).to(haveResourceLike('AWS::CodePipeline::Pipeline', {
-        }));
-      }, /Source\/Fake cannot have more than 4 output artifacts/);
+      expect(() => {
+        expect(stack).toHaveResourceLike('AWS::CodePipeline::Pipeline', {
+        });
+      }).toThrow(/Source\/Fake cannot have more than 4 output artifacts/);
 
-      test.done();
-    },
-  },
 
-  'automatically assigns artifact names to the Actions'(test: Test) {
+    });
+  });
+
+  test('automatically assigns artifact names to the Actions', () => {
     const stack = new cdk.Stack();
     const pipeline = new codepipeline.Pipeline(stack, 'pipeline');
 
@@ -200,7 +199,7 @@ nodeunitShim({
       ],
     });
 
-    expect(stack).to(haveResourceLike('AWS::CodePipeline::Pipeline', {
+    expect(stack).toHaveResourceLike('AWS::CodePipeline::Pipeline', {
       'Stages': [
         {
           'Name': 'Source',
@@ -234,12 +233,12 @@ nodeunitShim({
           ],
         },
       ],
-    }));
+    });
 
-    test.done();
-  },
 
-  'the same Action can be safely added to 2 different Stages'(test: Test) {
+  });
+
+  test('the same Action can be safely added to 2 different Stages', () => {
     const stack = new cdk.Stack();
 
     const sourceOutput = new codepipeline.Artifact();
@@ -268,47 +267,47 @@ nodeunitShim({
     };
 
     pipeline.addStage(stage2);
-    test.doesNotThrow(() => {
+    expect(() => {
       pipeline.addStage(stage3);
-    }, /FakeAction/);
+    }).not.toThrow(/FakeAction/);
+
 
-    test.done();
-  },
+  });
 
-  'input Artifacts': {
-    'can be added multiple times to an Action safely'(test: Test) {
+  describe('input Artifacts', () => {
+    test('can be added multiple times to an Action safely', () => {
       const artifact = new codepipeline.Artifact('SomeArtifact');
 
-      test.doesNotThrow(() => {
+      expect(() => {
         new FakeBuildAction({
           actionName: 'CodeBuild',
           input: artifact,
           extraInputs: [artifact],
         });
-      });
+      }).not.toThrow();
+
 
-      test.done();
-    },
+    });
 
-    'can have duplicate names'(test: Test) {
+    test('can have duplicate names', () => {
       const artifact1 = new codepipeline.Artifact('SomeArtifact');
       const artifact2 = new codepipeline.Artifact('SomeArtifact');
 
-      test.doesNotThrow(() => {
+      expect(() => {
         new FakeBuildAction({
           actionName: 'CodeBuild',
           input: artifact1,
           extraInputs: [artifact2],
         });
-      });
+      }).not.toThrow();
 
-      test.done();
-    },
-  },
 
-  'output Artifacts': {
-    'accept multiple Artifacts with the same name safely'(test: Test) {
-      test.doesNotThrow(() => {
+    });
+  });
+
+  describe('output Artifacts', () => {
+    test('accept multiple Artifacts with the same name safely', () => {
+      expect(() => {
         new FakeSourceAction({
           actionName: 'CodeBuild',
           output: new codepipeline.Artifact('Artifact1'),
@@ -317,13 +316,13 @@ nodeunitShim({
             new codepipeline.Artifact('Artifact1'),
           ],
         });
-      });
+      }).not.toThrow();
 
-      test.done();
-    },
-  },
 
-  'an Action with a non-AWS owner cannot have a Role passed for it'(test: Test) {
+    });
+  });
+
+  test('an Action with a non-AWS owner cannot have a Role passed for it', () => {
     const stack = new cdk.Stack();
 
     const sourceOutput = new codepipeline.Artifact();
@@ -353,14 +352,14 @@ nodeunitShim({
     });
 
     // an attempt to add it to the Pipeline is where things blow up
-    test.throws(() => {
+    expect(() => {
       buildStage.addAction(buildAction);
-    }, /Role is not supported for actions with an owner different than 'AWS' - got 'ThirdParty' \(Action: 'build' in Stage: 'Build'\)/);
+    }).toThrow(/Role is not supported for actions with an owner different than 'AWS' - got 'ThirdParty' \(Action: 'build' in Stage: 'Build'\)/);
 
-    test.done();
-  },
 
-  'actions can be retrieved from stages they have been added to'(test: Test) {
+  });
+
+  test('actions can be retrieved from stages they have been added to', () => {
     const stack = new cdk.Stack();
 
     const sourceOutput = new codepipeline.Artifact();
@@ -394,15 +393,15 @@ nodeunitShim({
       ],
     });
 
-    test.equal(sourceStage.actions.length, 1);
-    test.equal(sourceStage.actions[0].actionProperties.actionName, 'source');
+    expect(sourceStage.actions.length).toEqual(1);
+    expect(sourceStage.actions[0].actionProperties.actionName).toEqual('source');
+
+    expect(buildStage.actions.length).toEqual(2);
+    expect(buildStage.actions[0].actionProperties.actionName).toEqual('build1');
+    expect(buildStage.actions[1].actionProperties.actionName).toEqual('build2');
 
-    test.equal(buildStage.actions.length, 2);
-    test.equal(buildStage.actions[0].actionProperties.actionName, 'build1');
-    test.equal(buildStage.actions[1].actionProperties.actionName, 'build2');
 
-    test.done();
-  },
+  });
 });
 
 function boundsValidationResult(numberOfArtifacts: number, min: number, max: number): string[] {
diff --git a/packages/@aws-cdk/aws-codepipeline/test/artifacts.test.ts b/packages/@aws-cdk/aws-codepipeline/test/artifacts.test.ts
index 29cda05adedf8..5009f5fbdefd0 100644
--- a/packages/@aws-cdk/aws-codepipeline/test/artifacts.test.ts
+++ b/packages/@aws-cdk/aws-codepipeline/test/artifacts.test.ts
@@ -1,21 +1,20 @@
-import { expect, haveResourceLike } from '@aws-cdk/assert-internal';
+import '@aws-cdk/assert-internal/jest';
 import * as cdk from '@aws-cdk/core';
-import { nodeunitShim, Test } from 'nodeunit-shim';
 import * as codepipeline from '../lib';
 import { FakeBuildAction } from './fake-build-action';
 import { FakeSourceAction } from './fake-source-action';
 
 /* eslint-disable quote-props */
 
-nodeunitShim({
-  'Artifacts in CodePipeline': {
-    'cannot be created with an empty name'(test: Test) {
-      test.throws(() => new codepipeline.Artifact(''), /Artifact name must match regular expression/);
+describe('artifacts', () => {
+  describe('Artifacts in CodePipeline', () => {
+    test('cannot be created with an empty name', () => {
+      expect(() => new codepipeline.Artifact('')).toThrow(/Artifact name must match regular expression/);
 
-      test.done();
-    },
 
-    'without a name, when used as an input without being used as an output first - should fail validation'(test: Test) {
+    });
+
+    test('without a name, when used as an input without being used as an output first - should fail validation', () => {
       const stack = new cdk.Stack();
       const sourceOutput = new codepipeline.Artifact();
       const pipeline = new codepipeline.Pipeline(stack, 'Pipeline', {
@@ -43,15 +42,15 @@ nodeunitShim({
 
       const errors = validate(stack);
 
-      test.equal(errors.length, 1);
+      expect(errors.length).toEqual(1);
       const error = errors[0];
-      test.same(error.source, pipeline);
-      test.equal(error.message, "Action 'Build' is using an unnamed input Artifact, which is not being produced in this pipeline");
+      expect(error.source).toEqual(pipeline);
+      expect(error.message).toEqual("Action 'Build' is using an unnamed input Artifact, which is not being produced in this pipeline");
+
 
-      test.done();
-    },
+    });
 
-    'with a name, when used as an input without being used as an output first - should fail validation'(test: Test) {
+    test('with a name, when used as an input without being used as an output first - should fail validation', () => {
       const stack = new cdk.Stack();
       const sourceOutput = new codepipeline.Artifact();
       const pipeline = new codepipeline.Pipeline(stack, 'Pipeline', {
@@ -79,15 +78,15 @@ nodeunitShim({
 
       const errors = validate(stack);
 
-      test.equal(errors.length, 1);
+      expect(errors.length).toEqual(1);
       const error = errors[0];
-      test.same(error.source, pipeline);
-      test.equal(error.message, "Action 'Build' is using input Artifact 'named', which is not being produced in this pipeline");
+      expect(error.source).toEqual(pipeline);
+      expect(error.message).toEqual("Action 'Build' is using input Artifact 'named', which is not being produced in this pipeline");
 
-      test.done();
-    },
 
-    'without a name, when used as an output multiple times - should fail validation'(test: Test) {
+    });
+
+    test('without a name, when used as an output multiple times - should fail validation', () => {
       const stack = new cdk.Stack();
       const sourceOutput = new codepipeline.Artifact();
       const pipeline = new codepipeline.Pipeline(stack, 'Pipeline', {
@@ -116,15 +115,15 @@ nodeunitShim({
 
       const errors = validate(stack);
 
-      test.equal(errors.length, 1);
+      expect(errors.length).toEqual(1);
       const error = errors[0];
-      test.same(error.source, pipeline);
-      test.equal(error.message, "Both Actions 'Source' and 'Build' are producting Artifact 'Artifact_Source_Source'. Every artifact can only be produced once.");
+      expect(error.source).toEqual(pipeline);
+      expect(error.message).toEqual("Both Actions 'Source' and 'Build' are producting Artifact 'Artifact_Source_Source'. Every artifact can only be produced once.");
+
 
-      test.done();
-    },
+    });
 
-    "an Action's output can be used as input for an Action in the same Stage with a higher runOrder"(test: Test) {
+    test("an Action's output can be used as input for an Action in the same Stage with a higher runOrder", () => {
       const stack = new cdk.Stack();
 
       const sourceOutput1 = new codepipeline.Artifact('sourceOutput1');
@@ -166,14 +165,12 @@ nodeunitShim({
         ],
       });
 
-      expect(stack).to(haveResourceLike('AWS::CodePipeline::Pipeline', {
-        //
-      }));
+      expect(stack).toHaveResourceLike('AWS::CodePipeline::Pipeline');
 
-      test.done();
-    },
 
-    'violation of runOrder constraints is detected and reported'(test: Test) {
+    });
+
+    test('violation of runOrder constraints is detected and reported', () => {
       const stack = new cdk.Stack();
 
       const sourceOutput1 = new codepipeline.Artifact('sourceOutput1');
@@ -218,15 +215,15 @@ nodeunitShim({
 
       const errors = validate(stack);
 
-      test.equal(errors.length, 1);
+      expect(errors.length).toEqual(1);
       const error = errors[0];
-      test.same(error.source, pipeline);
-      test.equal(error.message, "Stage 2 Action 2 ('Build'/'build2') is consuming input Artifact 'buildOutput1' before it is being produced at Stage 2 Action 3 ('Build'/'build1')");
+      expect(error.source).toEqual(pipeline);
+      expect(error.message).toEqual("Stage 2 Action 2 ('Build'/'build2') is consuming input Artifact 'buildOutput1' before it is being produced at Stage 2 Action 3 ('Build'/'build1')");
+
 
-      test.done();
-    },
+    });
 
-    'without a name, sanitize the auto stage-action derived name'(test: Test) {
+    test('without a name, sanitize the auto stage-action derived name', () => {
       const stack = new cdk.Stack();
 
       const sourceOutput = new codepipeline.Artifact();
@@ -253,7 +250,7 @@ nodeunitShim({
         ],
       });
 
-      expect(stack).to(haveResourceLike('AWS::CodePipeline::Pipeline', {
+      expect(stack).toHaveResourceLike('AWS::CodePipeline::Pipeline', {
         'Stages': [
           {
             'Name': 'Source.@',
@@ -278,11 +275,11 @@ nodeunitShim({
             ],
           },
         ],
-      }));
+      });
+
 
-      test.done();
-    },
-  },
+    });
+  });
 });
 
 /* eslint-disable cdk/no-core-construct */
diff --git a/packages/@aws-cdk/aws-codepipeline/test/general-validation.test.ts b/packages/@aws-cdk/aws-codepipeline/test/general-validation.test.ts
index 76cd9b71a6941..d8186532d7cea 100644
--- a/packages/@aws-cdk/aws-codepipeline/test/general-validation.test.ts
+++ b/packages/@aws-cdk/aws-codepipeline/test/general-validation.test.ts
@@ -1,5 +1,5 @@
+import '@aws-cdk/assert-internal/jest';
 import * as cdk from '@aws-cdk/core';
-import { nodeunitShim, Test } from 'nodeunit-shim';
 import { IStage } from '../lib/action';
 import { Artifact } from '../lib/artifact';
 import { Pipeline } from '../lib/pipeline';
@@ -12,8 +12,8 @@ interface NameValidationTestCase {
   explanation: string;
 }
 
-nodeunitShim({
-  'name validation'(test: Test) {
+describe('general validation', () => {
+  test('name validation', () => {
     const cases: NameValidationTestCase[] = [
       { name: 'BlahBleep123.@-_', shouldPassValidation: true, explanation: 'should be valid' },
       { name: '', shouldPassValidation: false, explanation: 'the empty string should be invalid' },
@@ -25,36 +25,36 @@ nodeunitShim({
       const name = testCase.name;
       const validationBlock = () => { validateName('test thing', name); };
       if (testCase.shouldPassValidation) {
-        test.doesNotThrow(validationBlock, Error, `${name} failed validation but ${testCase.explanation}`);
+        expect(validationBlock).not.toThrow();
       } else {
-        test.throws(validationBlock, Error, `${name} passed validation but ${testCase.explanation}`);
+        expect(validationBlock).toThrow();
       }
     });
 
-    test.done();
-  },
 
-  'Stage validation': {
-    'should fail if Stage has no Actions'(test: Test) {
+  });
+
+  describe('Stage validation', () => {
+    test('should fail if Stage has no Actions', () => {
       const stage = stageForTesting();
 
-      test.deepEqual((stage as any).validate().length, 1);
+      expect((stage as any).validate().length).toEqual(1);
+
 
-      test.done();
-    },
-  },
+    });
+  });
 
-  'Pipeline validation': {
-    'should fail if Pipeline has no Stages'(test: Test) {
+  describe('Pipeline validation', () => {
+    test('should fail if Pipeline has no Stages', () => {
       const stack = new cdk.Stack();
       const pipeline = new Pipeline(stack, 'Pipeline');
 
-      test.deepEqual(cdk.ConstructNode.validate(pipeline.node).length, 1);
+      expect(cdk.ConstructNode.validate(pipeline.node).length).toEqual(1);
 
-      test.done();
-    },
 
-    'should fail if Pipeline has a Source Action in a non-first Stage'(test: Test) {
+    });
+
+    test('should fail if Pipeline has a Source Action in a non-first Stage', () => {
       const stack = new cdk.Stack();
       const pipeline = new Pipeline(stack, 'Pipeline');
 
@@ -68,11 +68,11 @@ nodeunitShim({
         ],
       });
 
-      test.deepEqual(cdk.ConstructNode.validate(pipeline.node).length, 1);
+      expect(cdk.ConstructNode.validate(pipeline.node).length).toEqual(1);
+
 
-      test.done();
-    },
-  },
+    });
+  });
 });
 
 function stageForTesting(): IStage {
diff --git a/packages/@aws-cdk/aws-codepipeline/test/stages.test.ts b/packages/@aws-cdk/aws-codepipeline/test/stages.test.ts
index 3cbb290187436..d7931a23a531e 100644
--- a/packages/@aws-cdk/aws-codepipeline/test/stages.test.ts
+++ b/packages/@aws-cdk/aws-codepipeline/test/stages.test.ts
@@ -1,101 +1,130 @@
-import { expect, haveResourceLike } from '@aws-cdk/assert-internal';
+import '@aws-cdk/assert-internal/jest';
 import * as cdk from '@aws-cdk/core';
-import { nodeunitShim, Test } from 'nodeunit-shim';
 import * as codepipeline from '../lib';
 import { Stage } from '../lib/private/stage';
+import { FakeBuildAction } from './fake-build-action';
+import { FakeSourceAction } from './fake-source-action';
 
 /* eslint-disable quote-props */
 
-nodeunitShim({
-  'Pipeline Stages': {
-    'can be inserted before another Stage'(test: Test) {
+describe('stages', () => {
+  describe('Pipeline Stages', () => {
+    test('can be inserted before another Stage', () => {
       const stack = new cdk.Stack();
       const pipeline = new codepipeline.Pipeline(stack, 'Pipeline');
 
       const secondStage = pipeline.addStage({ stageName: 'SecondStage' });
-      pipeline.addStage({
+      const firstStage = pipeline.addStage({
         stageName: 'FirstStage',
         placement: {
           rightBefore: secondStage,
         },
       });
 
-      expect(stack, true).to(haveResourceLike('AWS::CodePipeline::Pipeline', {
+      // -- dummy actions here are needed to satisfy validation rules
+      const sourceArtifact = new codepipeline.Artifact();
+      firstStage.addAction(new FakeSourceAction({
+        actionName: 'dummyAction',
+        output: sourceArtifact,
+      }));
+      secondStage.addAction(new FakeBuildAction({
+        actionName: 'dummyAction',
+        input: sourceArtifact,
+      }));
+      // --
+
+      expect(stack).toHaveResourceLike('AWS::CodePipeline::Pipeline', {
         'Stages': [
           { 'Name': 'FirstStage' },
           { 'Name': 'SecondStage' },
         ],
-      }));
+      });
 
-      test.done();
-    },
 
-    'can be inserted after another Stage'(test: Test) {
+    });
+
+    test('can be inserted after another Stage', () => {
       const stack = new cdk.Stack();
       const pipeline = new codepipeline.Pipeline(stack, 'Pipeline');
 
       const firstStage = pipeline.addStage({ stageName: 'FirstStage' });
-      pipeline.addStage({ stageName: 'ThirdStage' });
-      pipeline.addStage({
+      const thirdStage = pipeline.addStage({ stageName: 'ThirdStage' });
+      const secondStage = pipeline.addStage({
         stageName: 'SecondStage',
         placement: {
           justAfter: firstStage,
         },
       });
 
-      expect(stack, true).to(haveResourceLike('AWS::CodePipeline::Pipeline', {
+      // -- dummy actions here are needed to satisfy validation rules
+      const sourceArtifact = new codepipeline.Artifact();
+      firstStage.addAction(new FakeSourceAction({
+        actionName: 'dummyAction',
+        output: sourceArtifact,
+      }));
+      secondStage.addAction(new FakeBuildAction({
+        actionName: 'dummyAction',
+        input: sourceArtifact,
+      }));
+      thirdStage.addAction(new FakeBuildAction({
+        actionName: 'dummyAction',
+        input: sourceArtifact,
+      }));
+      // --
+
+      expect(stack).toHaveResourceLike('AWS::CodePipeline::Pipeline', {
         'Stages': [
           { 'Name': 'FirstStage' },
           { 'Name': 'SecondStage' },
           { 'Name': 'ThirdStage' },
         ],
-      }));
+      });
+
 
-      test.done();
-    },
+    });
 
-    "attempting to insert a Stage before a Stage that doesn't exist results in an error"(test: Test) {
+    test("attempting to insert a Stage before a Stage that doesn't exist results in an error", () => {
       const stack = new cdk.Stack();
       const pipeline = new codepipeline.Pipeline(stack, 'Pipeline');
       const stage = pipeline.addStage({ stageName: 'Stage' });
 
       const anotherPipeline = new codepipeline.Pipeline(stack, 'AnotherPipeline');
-      test.throws(() => {
+      expect(() => {
         anotherPipeline.addStage({
           stageName: 'AnotherStage',
           placement: {
             rightBefore: stage,
           },
         });
-      }, /before/i);
+      }).toThrow(/before/i);
 
-      test.done();
-    },
 
-    "attempting to insert a Stage after a Stage that doesn't exist results in an error"(test: Test) {
+    });
+
+    test("attempting to insert a Stage after a Stage that doesn't exist results in an error", () => {
       const stack = new cdk.Stack();
       const pipeline = new codepipeline.Pipeline(stack, 'Pipeline');
       const stage = pipeline.addStage({ stageName: 'Stage' });
 
       const anotherPipeline = new codepipeline.Pipeline(stack, 'AnotherPipeline');
-      test.throws(() => {
+      expect(() => {
         anotherPipeline.addStage({
           stageName: 'AnotherStage',
           placement: {
             justAfter: stage,
           },
         });
-      }, /after/i);
+      }).toThrow(/after/i);
+
 
-      test.done();
-    },
+    });
 
-    'providing more than one placement value results in an error'(test: Test) {
+    test('providing more than one placement value results in an error', () => {
       const stack = new cdk.Stack();
       const pipeline = new codepipeline.Pipeline(stack, 'Pipeline');
       const stage = pipeline.addStage({ stageName: 'Stage' });
 
-      test.throws(() => {
+      expect(() => {
         pipeline.addStage({
           stageName: 'SecondStage',
           placement: {
@@ -105,12 +134,12 @@ nodeunitShim({
         });
       // incredibly, an arrow function below causes nodeunit to crap out with:
       // "TypeError: Function has non-object prototype 'undefined' in instanceof check"
-      }, /(rightBefore.*justAfter)|(justAfter.*rightBefore)/);
+      }).toThrow(/(rightBefore.*justAfter)|(justAfter.*rightBefore)/);
 
-      test.done();
-    },
 
-    'can be retrieved from a pipeline after it has been created'(test: Test) {
+    });
+
+    test('can be retrieved from a pipeline after it has been created', () => {
       const stack = new cdk.Stack();
       const pipeline = new codepipeline.Pipeline(stack, 'Pipeline', {
         stages: [
@@ -122,17 +151,17 @@ nodeunitShim({
 
       pipeline.addStage({ stageName: 'SecondStage' });
 
-      test.equal(pipeline.stages.length, 2);
-      test.equal(pipeline.stages[0].stageName, 'FirstStage');
-      test.equal(pipeline.stages[1].stageName, 'SecondStage');
+      expect(pipeline.stages.length).toEqual(2);
+      expect(pipeline.stages[0].stageName).toEqual('FirstStage');
+      expect(pipeline.stages[1].stageName).toEqual('SecondStage');
 
       // adding stages to the returned array should have no effect
       pipeline.stages.push(new Stage({
         stageName: 'ThirdStage',
       }, pipeline));
-      test.equal(pipeline.stageCount, 2);
+      expect(pipeline.stageCount).toEqual(2);
+
 
-      test.done();
-    },
-  },
+    });
+  });
 });
diff --git a/packages/@aws-cdk/aws-codepipeline/test/variables.test.ts b/packages/@aws-cdk/aws-codepipeline/test/variables.test.ts
index 265ddd09b0843..537b108df805a 100644
--- a/packages/@aws-cdk/aws-codepipeline/test/variables.test.ts
+++ b/packages/@aws-cdk/aws-codepipeline/test/variables.test.ts
@@ -1,30 +1,44 @@
-import { expect, haveResourceLike } from '@aws-cdk/assert-internal';
+import '@aws-cdk/assert-internal/jest';
+import { arrayWith, objectLike } from '@aws-cdk/assert-internal';
 import * as cdk from '@aws-cdk/core';
-import { nodeunitShim, Test } from 'nodeunit-shim';
 import * as codepipeline from '../lib';
 import { FakeBuildAction } from './fake-build-action';
 import { FakeSourceAction } from './fake-source-action';
 
 /* eslint-disable quote-props */
 
-nodeunitShim({
-  'Pipeline Variables': {
-    'uses the passed namespace when its passed when constructing the Action'(test: Test) {
+describe('variables', () => {
+  describe('Pipeline Variables', () => {
+    test('uses the passed namespace when its passed when constructing the Action', () => {
       const stack = new cdk.Stack();
-      new codepipeline.Pipeline(stack, 'Pipeline', {
+      const sourceArtifact = new codepipeline.Artifact();
+      const pipeline = new codepipeline.Pipeline(stack, 'Pipeline', {
         stages: [
           {
             stageName: 'Source',
             actions: [new FakeSourceAction({
               actionName: 'Source',
-              output: new codepipeline.Artifact(),
+              output: sourceArtifact,
               variablesNamespace: 'MyNamespace',
             })],
           },
         ],
       });
 
-      expect(stack, true).to(haveResourceLike('AWS::CodePipeline::Pipeline', {
+      // -- stages and actions here are needed to satisfy validation rules
+      const first = pipeline.addStage({ stageName: 'FirstStage' });
+      first.addAction(new FakeBuildAction({
+        actionName: 'dummyAction',
+        input: sourceArtifact,
+      }));
+      const second = pipeline.addStage({ stageName: 'SecondStage' });
+      second.addAction(new FakeBuildAction({
+        actionName: 'dummyAction',
+        input: sourceArtifact,
+      }));
+      // --
+
+      expect(stack).toHaveResourceLike('AWS::CodePipeline::Pipeline', {
         'Stages': [
           {
             'Name': 'Source',
@@ -36,12 +50,12 @@ nodeunitShim({
             ],
           },
         ],
-      }));
+      });
+
 
-      test.done();
-    },
+    });
 
-    'allows using the variable in the configuration of a different action'(test: Test) {
+    test('allows using the variable in the configuration of a different action', () => {
       const stack = new cdk.Stack();
       const sourceOutput = new codepipeline.Artifact();
       const fakeSourceAction = new FakeSourceAction({
@@ -66,7 +80,7 @@ nodeunitShim({
         ],
       });
 
-      expect(stack).to(haveResourceLike('AWS::CodePipeline::Pipeline', {
+      expect(stack).toHaveResourceLike('AWS::CodePipeline::Pipeline', {
         'Stages': [
           {
             'Name': 'Source',
@@ -83,12 +97,12 @@ nodeunitShim({
             ],
           },
         ],
-      }));
+      });
+
 
-      test.done();
-    },
+    });
 
-    'fails when trying add an action using variables with an empty string for the namespace to a pipeline'(test: Test) {
+    test('fails when trying add an action using variables with an empty string for the namespace to a pipeline', () => {
       const stack = new cdk.Stack();
       const pipeline = new codepipeline.Pipeline(stack, 'Pipeline');
       const sourceStage = pipeline.addStage({ stageName: 'Source' });
@@ -99,46 +113,54 @@ nodeunitShim({
         variablesNamespace: '',
       });
 
-      test.throws(() => {
+      expect(() => {
         sourceStage.addAction(sourceAction);
-      }, /Namespace name must match regular expression:/);
+      }).toThrow(/Namespace name must match regular expression:/);
 
-      test.done();
-    },
 
-    'can use global variables'(test: Test) {
+    });
+
+    test('can use global variables', () => {
       const stack = new cdk.Stack();
 
+      const sourceArtifact = new codepipeline.Artifact();
       new codepipeline.Pipeline(stack, 'Pipeline', {
         stages: [
           {
             stageName: 'Source',
+            actions: [new FakeSourceAction({
+              actionName: 'Source',
+              output: sourceArtifact,
+            })],
+          },
+          {
+            stageName: 'Build',
             actions: [new FakeBuildAction({
               actionName: 'Build',
-              input: new codepipeline.Artifact(),
+              input: sourceArtifact,
               customConfigKey: codepipeline.GlobalVariables.executionId,
             })],
           },
         ],
       });
 
-      expect(stack, true).to(haveResourceLike('AWS::CodePipeline::Pipeline', {
-        'Stages': [
+      expect(stack).toHaveResourceLike('AWS::CodePipeline::Pipeline', {
+        'Stages': arrayWith(
           {
-            'Name': 'Source',
+            'Name': 'Build',
             'Actions': [
-              {
+              objectLike({
                 'Name': 'Build',
                 'Configuration': {
                   'CustomConfigKey': '#{codepipeline.PipelineExecutionId}',
                 },
-              },
+              }),
             ],
           },
-        ],
-      }));
+        ),
+      });
+
 
-      test.done();
-    },
-  },
+    });
+  });
 });
diff --git a/packages/@aws-cdk/aws-ec2/package.json b/packages/@aws-cdk/aws-ec2/package.json
index d7c8591357c7e..6bb38a38ece94 100644
--- a/packages/@aws-cdk/aws-ec2/package.json
+++ b/packages/@aws-cdk/aws-ec2/package.json
@@ -79,7 +79,7 @@
     "cdk-build-tools": "0.0.0",
     "cdk-integ-tools": "0.0.0",
     "cfn2ts": "0.0.0",
-    "nodeunit-shim": "0.0.0",
+    "jest": "^26.6.3",
     "pkglint": "0.0.0",
     "@aws-cdk/cloud-assembly-schema": "0.0.0",
     "@aws-cdk/assert-internal": "0.0.0"
diff --git a/packages/@aws-cdk/aws-ec2/test/bastion-host.test.ts b/packages/@aws-cdk/aws-ec2/test/bastion-host.test.ts
index 2bacb5e918920..42e2dd8cd7e0a 100644
--- a/packages/@aws-cdk/aws-ec2/test/bastion-host.test.ts
+++ b/packages/@aws-cdk/aws-ec2/test/bastion-host.test.ts
@@ -1,10 +1,9 @@
-import { expect, haveResource } from '@aws-cdk/assert-internal';
+import '@aws-cdk/assert-internal/jest';
 import { Stack } from '@aws-cdk/core';
-import { nodeunitShim, Test } from 'nodeunit-shim';
 import { BastionHostLinux, BlockDeviceVolume, InstanceClass, InstanceSize, InstanceType, SubnetType, Vpc } from '../lib';
 
-nodeunitShim({
-  'default instance is created in basic'(test: Test) {
+describe('bastion host', () => {
+  test('default instance is created in basic', () => {
     // GIVEN
     const stack = new Stack();
     const vpc = new Vpc(stack, 'VPC');
@@ -15,14 +14,14 @@ nodeunitShim({
     });
 
     // THEN
-    expect(stack).to(haveResource('AWS::EC2::Instance', {
+    expect(stack).toHaveResource('AWS::EC2::Instance', {
       InstanceType: 't3.nano',
       SubnetId: { Ref: 'VPCPrivateSubnet1Subnet8BCA10E0' },
-    }));
+    });
+
 
-    test.done();
-  },
-  'default instance is created in isolated vpc'(test: Test) {
+  });
+  test('default instance is created in isolated vpc', () => {
     // GIVEN
     const stack = new Stack();
     const vpc = new Vpc(stack, 'VPC', {
@@ -40,14 +39,14 @@ nodeunitShim({
     });
 
     // THEN
-    expect(stack).to(haveResource('AWS::EC2::Instance', {
+    expect(stack).toHaveResource('AWS::EC2::Instance', {
       InstanceType: 't3.nano',
       SubnetId: { Ref: 'VPCIsolatedSubnet1SubnetEBD00FC6' },
-    }));
+    });
 
-    test.done();
-  },
-  'ebs volume is encrypted'(test: Test) {
+
+  });
+  test('ebs volume is encrypted', () => {
     // GIVEN
     const stack = new Stack();
     const vpc = new Vpc(stack, 'VPC', {
@@ -71,7 +70,7 @@ nodeunitShim({
     });
 
     // THEN
-    expect(stack).to(haveResource('AWS::EC2::Instance', {
+    expect(stack).toHaveResource('AWS::EC2::Instance', {
       BlockDeviceMappings: [
         {
           DeviceName: 'EBSBastionHost',
@@ -81,11 +80,11 @@ nodeunitShim({
           },
         },
       ],
-    }));
+    });
 
-    test.done();
-  },
-  'x86-64 instances use x86-64 image by default'(test: Test) {
+
+  });
+  test('x86-64 instances use x86-64 image by default', () => {
     // GIVEN
     const stack = new Stack();
     const vpc = new Vpc(stack, 'VPC');
@@ -96,15 +95,15 @@ nodeunitShim({
     });
 
     // THEN
-    expect(stack).to(haveResource('AWS::EC2::Instance', {
+    expect(stack).toHaveResource('AWS::EC2::Instance', {
       ImageId: {
         Ref: 'SsmParameterValueawsserviceamiamazonlinuxlatestamzn2amihvmx8664gp2C96584B6F00A464EAD1953AFF4B05118Parameter',
       },
-    }));
+    });
+
 
-    test.done();
-  },
-  'arm instances use arm image by default'(test: Test) {
+  });
+  test('arm instances use arm image by default', () => {
     // GIVEN
     const stack = new Stack();
     const vpc = new Vpc(stack, 'VPC');
@@ -116,12 +115,12 @@ nodeunitShim({
     });
 
     // THEN
-    expect(stack).to(haveResource('AWS::EC2::Instance', {
+    expect(stack).toHaveResource('AWS::EC2::Instance', {
       ImageId: {
         Ref: 'SsmParameterValueawsserviceamiamazonlinuxlatestamzn2amihvmarm64gp2C96584B6F00A464EAD1953AFF4B05118Parameter',
       },
-    }));
+    });
+
 
-    test.done();
-  },
+  });
 });
diff --git a/packages/@aws-cdk/aws-ec2/test/connections.test.ts b/packages/@aws-cdk/aws-ec2/test/connections.test.ts
index 2adc0ce242db8..e5c48f2740f57 100644
--- a/packages/@aws-cdk/aws-ec2/test/connections.test.ts
+++ b/packages/@aws-cdk/aws-ec2/test/connections.test.ts
@@ -1,6 +1,5 @@
-import { expect, haveResource } from '@aws-cdk/assert-internal';
+import '@aws-cdk/assert-internal/jest';
 import { App, Stack } from '@aws-cdk/core';
-import { nodeunitShim, Test } from 'nodeunit-shim';
 
 import {
   Connections,
@@ -10,8 +9,8 @@ import {
   Vpc,
 } from '../lib';
 
-nodeunitShim({
-  'peering between two security groups does not recursive infinitely'(test: Test) {
+describe('connections', () => {
+  test('peering between two security groups does not recursive infinitely', () => {
     // GIVEN
     const stack = new Stack(undefined, 'TestStack', { env: { account: '12345678', region: 'dummy' } });
 
@@ -26,10 +25,10 @@ nodeunitShim({
     conn1.connections.allowTo(conn2, Port.tcp(80), 'Test');
 
     // THEN -- it finishes!
-    test.done();
-  },
 
-  '(imported) SecurityGroup can be used as target of .allowTo()'(test: Test) {
+  });
+
+  test('(imported) SecurityGroup can be used as target of .allowTo()', () => {
     // GIVEN
     const stack = new Stack();
     const vpc = new Vpc(stack, 'VPC');
@@ -42,29 +41,29 @@ nodeunitShim({
     somethingConnectable.connections.allowTo(securityGroup, Port.allTcp(), 'Connect there');
 
     // THEN: rule to generated security group to connect to imported
-    expect(stack).to(haveResource('AWS::EC2::SecurityGroupEgress', {
+    expect(stack).toHaveResource('AWS::EC2::SecurityGroupEgress', {
       GroupId: { 'Fn::GetAtt': ['SomeSecurityGroupEF219AD6', 'GroupId'] },
       IpProtocol: 'tcp',
       Description: 'Connect there',
       DestinationSecurityGroupId: 'sg-12345',
       FromPort: 0,
       ToPort: 65535,
-    }));
+    });
 
     // THEN: rule to imported security group to allow connections from generated
-    expect(stack).to(haveResource('AWS::EC2::SecurityGroupIngress', {
+    expect(stack).toHaveResource('AWS::EC2::SecurityGroupIngress', {
       IpProtocol: 'tcp',
       Description: 'Connect there',
       FromPort: 0,
       GroupId: 'sg-12345',
       SourceSecurityGroupId: { 'Fn::GetAtt': ['SomeSecurityGroupEF219AD6', 'GroupId'] },
       ToPort: 65535,
-    }));
+    });
+
 
-    test.done();
-  },
+  });
 
-  'security groups added to connections after rule still gets rule'(test: Test) {
+  test('security groups added to connections after rule still gets rule', () => {
     // GIVEN
     const stack = new Stack();
     const vpc = new Vpc(stack, 'VPC');
@@ -77,7 +76,7 @@ nodeunitShim({
     connections.addSecurityGroup(sg2);
 
     // THEN
-    expect(stack).to(haveResource('AWS::EC2::SecurityGroup', {
+    expect(stack).toHaveResource('AWS::EC2::SecurityGroup', {
       GroupDescription: 'Default/SecurityGroup1',
       SecurityGroupIngress: [
         {
@@ -88,9 +87,9 @@ nodeunitShim({
           IpProtocol: 'tcp',
         },
       ],
-    }));
+    });
 
-    expect(stack).to(haveResource('AWS::EC2::SecurityGroup', {
+    expect(stack).toHaveResource('AWS::EC2::SecurityGroup', {
       GroupDescription: 'Default/SecurityGroup2',
       SecurityGroupIngress: [
         {
@@ -101,12 +100,12 @@ nodeunitShim({
           IpProtocol: 'tcp',
         },
       ],
-    }));
+    });
+
 
-    test.done();
-  },
+  });
 
-  'when security groups are added to target they also get the rule'(test: Test) {
+  test('when security groups are added to target they also get the rule', () => {
     // GIVEN
     const stack = new Stack();
     const vpc = new Vpc(stack, 'VPC');
@@ -122,24 +121,24 @@ nodeunitShim({
     connections2.addSecurityGroup(sg3);
 
     // THEN
-    expect(stack).to(haveResource('AWS::EC2::SecurityGroupIngress', {
+    expect(stack).toHaveResource('AWS::EC2::SecurityGroupIngress', {
       GroupId: { 'Fn::GetAtt': ['SecurityGroup23BE86BB7', 'GroupId'] },
       SourceSecurityGroupId: { 'Fn::GetAtt': ['SecurityGroup1F554B36F', 'GroupId'] },
       FromPort: 88,
       ToPort: 88,
-    }));
+    });
 
-    expect(stack).to(haveResource('AWS::EC2::SecurityGroupIngress', {
+    expect(stack).toHaveResource('AWS::EC2::SecurityGroupIngress', {
       GroupId: { 'Fn::GetAtt': ['SecurityGroup3E5E374B9', 'GroupId'] },
       SourceSecurityGroupId: { 'Fn::GetAtt': ['SecurityGroup1F554B36F', 'GroupId'] },
       FromPort: 88,
       ToPort: 88,
-    }));
+    });
 
-    test.done();
-  },
 
-  'multiple security groups allows internally between them'(test: Test) {
+  });
+
+  test('multiple security groups allows internally between them', () => {
     // GIVEN
     const stack = new Stack();
     const vpc = new Vpc(stack, 'VPC');
@@ -152,24 +151,24 @@ nodeunitShim({
     connections.addSecurityGroup(sg2);
 
     // THEN
-    expect(stack).to(haveResource('AWS::EC2::SecurityGroupIngress', {
+    expect(stack).toHaveResource('AWS::EC2::SecurityGroupIngress', {
       GroupId: { 'Fn::GetAtt': ['SecurityGroup1F554B36F', 'GroupId'] },
       SourceSecurityGroupId: { 'Fn::GetAtt': ['SecurityGroup1F554B36F', 'GroupId'] },
       FromPort: 88,
       ToPort: 88,
-    }));
+    });
 
-    expect(stack).to(haveResource('AWS::EC2::SecurityGroupEgress', {
+    expect(stack).toHaveResource('AWS::EC2::SecurityGroupEgress', {
       DestinationSecurityGroupId: { 'Fn::GetAtt': ['SecurityGroup1F554B36F', 'GroupId'] },
       GroupId: { 'Fn::GetAtt': ['SecurityGroup1F554B36F', 'GroupId'] },
       FromPort: 88,
       ToPort: 88,
-    }));
+    });
+
 
-    test.done();
-  },
+  });
 
-  'can establish cross stack Security Group connections - allowFrom'(test: Test) {
+  test('can establish cross stack Security Group connections - allowFrom', () => {
     // GIVEN
     const app = new App();
 
@@ -187,20 +186,20 @@ nodeunitShim({
     // THEN -- both rules are in Stack2
     app.synth();
 
-    expect(stack2).to(haveResource('AWS::EC2::SecurityGroupIngress', {
+    expect(stack2).toHaveResource('AWS::EC2::SecurityGroupIngress', {
       GroupId: { 'Fn::GetAtt': ['SecurityGroupDD263621', 'GroupId'] },
       SourceSecurityGroupId: { 'Fn::ImportValue': 'Stack1:ExportsOutputFnGetAttSecurityGroupDD263621GroupIdDF6F8B09' },
-    }));
+    });
 
-    expect(stack2).to(haveResource('AWS::EC2::SecurityGroupEgress', {
+    expect(stack2).toHaveResource('AWS::EC2::SecurityGroupEgress', {
       GroupId: { 'Fn::ImportValue': 'Stack1:ExportsOutputFnGetAttSecurityGroupDD263621GroupIdDF6F8B09' },
       DestinationSecurityGroupId: { 'Fn::GetAtt': ['SecurityGroupDD263621', 'GroupId'] },
-    }));
+    });
+
 
-    test.done();
-  },
+  });
 
-  'can establish cross stack Security Group connections - allowTo'(test: Test) {
+  test('can establish cross stack Security Group connections - allowTo', () => {
     // GIVEN
     const app = new App();
 
@@ -218,20 +217,20 @@ nodeunitShim({
     // THEN -- both rules are in Stack2
     app.synth();
 
-    expect(stack2).to(haveResource('AWS::EC2::SecurityGroupIngress', {
+    expect(stack2).toHaveResource('AWS::EC2::SecurityGroupIngress', {
       GroupId: { 'Fn::ImportValue': 'Stack1:ExportsOutputFnGetAttSecurityGroupDD263621GroupIdDF6F8B09' },
       SourceSecurityGroupId: { 'Fn::GetAtt': ['SecurityGroupDD263621', 'GroupId'] },
-    }));
+    });
 
-    expect(stack2).to(haveResource('AWS::EC2::SecurityGroupEgress', {
+    expect(stack2).toHaveResource('AWS::EC2::SecurityGroupEgress', {
       GroupId: { 'Fn::GetAtt': ['SecurityGroupDD263621', 'GroupId'] },
       DestinationSecurityGroupId: { 'Fn::ImportValue': 'Stack1:ExportsOutputFnGetAttSecurityGroupDD263621GroupIdDF6F8B09' },
-    }));
+    });
 
-    test.done();
-  },
 
-  'can establish multiple cross-stack SGs'(test: Test) {
+  });
+
+  test('can establish multiple cross-stack SGs', () => {
     // GIVEN
     const app = new App();
 
@@ -251,19 +250,19 @@ nodeunitShim({
     // THEN -- both egress rules are in Stack2
     app.synth();
 
-    expect(stack2).to(haveResource('AWS::EC2::SecurityGroupEgress', {
+    expect(stack2).toHaveResource('AWS::EC2::SecurityGroupEgress', {
       GroupId: { 'Fn::ImportValue': 'Stack1:ExportsOutputFnGetAttSecurityGroupAED40ADC5GroupId1D10C76A' },
       DestinationSecurityGroupId: { 'Fn::GetAtt': ['SecurityGroupDD263621', 'GroupId'] },
-    }));
+    });
 
-    expect(stack2).to(haveResource('AWS::EC2::SecurityGroupEgress', {
+    expect(stack2).toHaveResource('AWS::EC2::SecurityGroupEgress', {
       GroupId: { 'Fn::ImportValue': 'Stack1:ExportsOutputFnGetAttSecurityGroupB04591F90GroupIdFA7208D5' },
       DestinationSecurityGroupId: { 'Fn::GetAtt': ['SecurityGroupDD263621', 'GroupId'] },
-    }));
+    });
 
-    test.done();
-  },
-  'Imported SecurityGroup does not create egress rule'(test: Test) {
+
+  });
+  test('Imported SecurityGroup does not create egress rule', () => {
     // GIVEN
     const stack = new Stack();
     const vpc = new Vpc(stack, 'VPC');
@@ -276,21 +275,21 @@ nodeunitShim({
     somethingConnectable.connections.allowFrom(securityGroup, Port.allTcp(), 'Connect there');
 
     // THEN: rule to generated security group to connect to imported
-    expect(stack).to(haveResource('AWS::EC2::SecurityGroupIngress', {
+    expect(stack).toHaveResource('AWS::EC2::SecurityGroupIngress', {
       GroupId: { 'Fn::GetAtt': ['SomeSecurityGroupEF219AD6', 'GroupId'] },
       IpProtocol: 'tcp',
       Description: 'Connect there',
       SourceSecurityGroupId: 'sg-12345',
       FromPort: 0,
       ToPort: 65535,
-    }));
+    });
 
     // THEN: rule to imported security group to allow connections from generated
-    expect(stack).notTo(haveResource('AWS::EC2::SecurityGroupEgress'));
+    expect(stack).not.toHaveResource('AWS::EC2::SecurityGroupEgress');
+
 
-    test.done();
-  },
-  'Imported SecurityGroup with allowAllOutbound: false DOES create egress rule'(test: Test) {
+  });
+  test('Imported SecurityGroup with allowAllOutbound: false DOES create egress rule', () => {
     // GIVEN
     const stack = new Stack();
     const vpc = new Vpc(stack, 'VPC');
@@ -305,27 +304,27 @@ nodeunitShim({
     somethingConnectable.connections.allowFrom(securityGroup, Port.allTcp(), 'Connect there');
 
     // THEN: rule to generated security group to connect to imported
-    expect(stack).to(haveResource('AWS::EC2::SecurityGroupIngress', {
+    expect(stack).toHaveResource('AWS::EC2::SecurityGroupIngress', {
       GroupId: { 'Fn::GetAtt': ['SomeSecurityGroupEF219AD6', 'GroupId'] },
       IpProtocol: 'tcp',
       Description: 'Connect there',
       SourceSecurityGroupId: 'sg-12345',
       FromPort: 0,
       ToPort: 65535,
-    }));
+    });
 
     // THEN: rule to imported security group to allow connections from generated
-    expect(stack).to(haveResource('AWS::EC2::SecurityGroupEgress', {
+    expect(stack).toHaveResource('AWS::EC2::SecurityGroupEgress', {
       IpProtocol: 'tcp',
       Description: 'Connect there',
       FromPort: 0,
       GroupId: 'sg-12345',
       DestinationSecurityGroupId: { 'Fn::GetAtt': ['SomeSecurityGroupEF219AD6', 'GroupId'] },
       ToPort: 65535,
-    }));
+    });
+
 
-    test.done();
-  },
+  });
 });
 
 class SomethingConnectable implements IConnectable {
diff --git a/packages/@aws-cdk/aws-ec2/test/instance.test.ts b/packages/@aws-cdk/aws-ec2/test/instance.test.ts
index 392aeb8ec22d9..884021f518a84 100644
--- a/packages/@aws-cdk/aws-ec2/test/instance.test.ts
+++ b/packages/@aws-cdk/aws-ec2/test/instance.test.ts
@@ -1,11 +1,10 @@
 import * as path from 'path';
-import { arrayWith, expect as cdkExpect, haveResource, ResourcePart, stringLike, SynthUtils } from '@aws-cdk/assert-internal';
 import '@aws-cdk/assert-internal/jest';
+import { arrayWith, ResourcePart, stringLike, SynthUtils } from '@aws-cdk/assert-internal';
 import { Asset } from '@aws-cdk/aws-s3-assets';
 import { StringParameter } from '@aws-cdk/aws-ssm';
 import * as cxschema from '@aws-cdk/cloud-assembly-schema';
 import { Stack } from '@aws-cdk/core';
-import { nodeunitShim, Test } from 'nodeunit-shim';
 import {
   AmazonLinuxImage, BlockDeviceVolume, CloudFormationInit,
   EbsDeviceVolumeType, InitCommand, Instance, InstanceArchitecture, InstanceClass, InstanceSize, InstanceType, UserData, Vpc,
@@ -19,8 +18,8 @@ beforeEach(() => {
   vpc = new Vpc(stack, 'VPC');
 });
 
-nodeunitShim({
-  'instance is created correctly'(test: Test) {
+describe('instance', () => {
+  test('instance is created correctly', () => {
     // GIVEN
     const sampleInstances = [{
       instanceClass: InstanceClass.BURSTABLE4_GRAVITON,
@@ -41,14 +40,14 @@ nodeunitShim({
       });
 
       // THEN
-      cdkExpect(stack).to(haveResource('AWS::EC2::Instance', {
+      expect(stack).toHaveResource('AWS::EC2::Instance', {
         InstanceType: sampleInstance.instanceType,
-      }));
+      });
     }
 
-    test.done();
-  },
-  'instance is created with source/dest check switched off'(test: Test) {
+
+  });
+  test('instance is created with source/dest check switched off', () => {
     // WHEN
     new Instance(stack, 'Instance', {
       vpc,
@@ -58,14 +57,14 @@ nodeunitShim({
     });
 
     // THEN
-    cdkExpect(stack).to(haveResource('AWS::EC2::Instance', {
+    expect(stack).toHaveResource('AWS::EC2::Instance', {
       InstanceType: 't3.large',
       SourceDestCheck: false,
-    }));
+    });
+
 
-    test.done();
-  },
-  'instance is grantable'(test: Test) {
+  });
+  test('instance is grantable', () => {
     // GIVEN
     const param = new StringParameter(stack, 'Param', { stringValue: 'Foobar' });
     const instance = new Instance(stack, 'Instance', {
@@ -78,7 +77,7 @@ nodeunitShim({
     param.grantRead(instance);
 
     // THEN
-    cdkExpect(stack).to(haveResource('AWS::IAM::Policy', {
+    expect(stack).toHaveResource('AWS::IAM::Policy', {
       PolicyDocument: {
         Statement: [
           {
@@ -116,11 +115,11 @@ nodeunitShim({
         ],
         Version: '2012-10-17',
       },
-    }));
+    });
+
 
-    test.done();
-  },
-  'instance architecture is correctly discerned for arm instances'(test: Test) {
+  });
+  test('instance architecture is correctly discerned for arm instances', () => {
     // GIVEN
     const sampleInstanceClasses = [
       'a1', 't4g', 'c6g', 'c6gd', 'c6gn', 'm6g', 'm6gd', 'r6g', 'r6gd', // current Graviton-based instance classes
@@ -135,9 +134,9 @@ nodeunitShim({
       expect(instanceType.architecture).toBe(InstanceArchitecture.ARM_64);
     }
 
-    test.done();
-  },
-  'instance architecture is correctly discerned for x86-64 instance'(test: Test) {
+
+  });
+  test('instance architecture is correctly discerned for x86-64 instance', () => {
     // GIVEN
     const sampleInstanceClasses = ['c5', 'm5ad', 'r5n', 'm6', 't3a']; // A sample of x86-64 instance classes
 
@@ -149,9 +148,9 @@ nodeunitShim({
       expect(instanceType.architecture).toBe(InstanceArchitecture.X86_64);
     }
 
-    test.done();
-  },
-  'instances with local NVME drive are correctly named'(test: Test) {
+
+  });
+  test('instances with local NVME drive are correctly named', () => {
     // GIVEN
     const sampleInstanceClassKeys = [{
       key: 'R5D',
@@ -182,9 +181,9 @@ nodeunitShim({
       expect(instanceType).toBe(instanceClass.value);
     }
 
-    test.done();
-  },
-  'instance architecture throws an error when instance type is invalid'(test: Test) {
+
+  });
+  test('instance architecture throws an error when instance type is invalid', () => {
     // GIVEN
     const malformedInstanceTypes = ['t4', 't4g.nano.', 't4gnano', ''];
 
@@ -193,18 +192,13 @@ nodeunitShim({
       const instanceType = new InstanceType(malformedInstanceType);
 
       // THEN
-      try {
-        instanceType.architecture;
-        expect(true).toBe(false); // The line above should have thrown an error
-      } catch (err) {
-        expect(err.message).toBe('Malformed instance type identifier');
-      }
+      expect(() => instanceType.architecture).toThrow('Malformed instance type identifier');
     }
 
-    test.done();
-  },
-  blockDeviceMappings: {
-    'can set blockDeviceMappings'(test: Test) {
+
+  });
+  describe('blockDeviceMappings', () => {
+    test('can set blockDeviceMappings', () => {
       // WHEN
       new Instance(stack, 'Instance', {
         vpc,
@@ -234,7 +228,7 @@ nodeunitShim({
       });
 
       // THEN
-      cdkExpect(stack).to(haveResource('AWS::EC2::Instance', {
+      expect(stack).toHaveResource('AWS::EC2::Instance', {
         BlockDeviceMappings: [
           {
             DeviceName: 'ebs',
@@ -261,14 +255,14 @@ nodeunitShim({
             VirtualName: 'ephemeral0',
           },
         ],
-      }));
+      });
 
-      test.done();
-    },
 
-    'throws if ephemeral volumeIndex < 0'(test: Test) {
+    });
+
+    test('throws if ephemeral volumeIndex < 0', () => {
       // THEN
-      test.throws(() => {
+      expect(() => {
         new Instance(stack, 'Instance', {
           vpc,
           machineImage: new AmazonLinuxImage(),
@@ -278,14 +272,14 @@ nodeunitShim({
             volume: BlockDeviceVolume.ephemeral(-1),
           }],
         });
-      }, /volumeIndex must be a number starting from 0/);
+      }).toThrow(/volumeIndex must be a number starting from 0/);
 
-      test.done();
-    },
 
-    'throws if volumeType === IO1 without iops'(test: Test) {
+    });
+
+    test('throws if volumeType === IO1 without iops', () => {
       // THEN
-      test.throws(() => {
+      expect(() => {
         new Instance(stack, 'Instance', {
           vpc,
           machineImage: new AmazonLinuxImage(),
@@ -299,12 +293,12 @@ nodeunitShim({
             }),
           }],
         });
-      }, /ops property is required with volumeType: EbsDeviceVolumeType.IO1/);
+      }).toThrow(/ops property is required with volumeType: EbsDeviceVolumeType.IO1/);
 
-      test.done();
-    },
 
-    'warning if iops without volumeType'(test: Test) {
+    });
+
+    test('warning if iops without volumeType', () => {
       const instance = new Instance(stack, 'Instance', {
         vpc,
         machineImage: new AmazonLinuxImage(),
@@ -320,13 +314,13 @@ nodeunitShim({
       });
 
       // THEN
-      test.deepEqual(instance.node.metadata[0].type, cxschema.ArtifactMetadataEntryType.WARN);
-      test.deepEqual(instance.node.metadata[0].data, 'iops will be ignored without volumeType: EbsDeviceVolumeType.IO1');
+      expect(instance.node.metadata[0].type).toEqual(cxschema.ArtifactMetadataEntryType.WARN);
+      expect(instance.node.metadata[0].data).toEqual('iops will be ignored without volumeType: EbsDeviceVolumeType.IO1');
 
-      test.done();
-    },
 
-    'warning if iops and volumeType !== IO1'(test: Test) {
+    });
+
+    test('warning if iops and volumeType !== IO1', () => {
       const instance = new Instance(stack, 'Instance', {
         vpc,
         machineImage: new AmazonLinuxImage(),
@@ -343,14 +337,14 @@ nodeunitShim({
       });
 
       // THEN
-      test.deepEqual(instance.node.metadata[0].type, cxschema.ArtifactMetadataEntryType.WARN);
-      test.deepEqual(instance.node.metadata[0].data, 'iops will be ignored without volumeType: EbsDeviceVolumeType.IO1');
+      expect(instance.node.metadata[0].type).toEqual(cxschema.ArtifactMetadataEntryType.WARN);
+      expect(instance.node.metadata[0].data).toEqual('iops will be ignored without volumeType: EbsDeviceVolumeType.IO1');
 
-      test.done();
-    },
-  },
 
-  'instance can be created with Private IP Address'(test: Test) {
+    });
+  });
+
+  test('instance can be created with Private IP Address', () => {
     // WHEN
     new Instance(stack, 'Instance', {
       vpc,
@@ -360,15 +354,16 @@ nodeunitShim({
     });
 
     // THEN
-    cdkExpect(stack).to(haveResource('AWS::EC2::Instance', {
+    expect(stack).toHaveResource('AWS::EC2::Instance', {
       InstanceType: 't3.large',
       PrivateIpAddress: '10.0.0.2',
-    }));
+    });
 
-    test.done();
-  },
+
+  });
 });
 
+
 test('add CloudFormation Init to instance', () => {
   // GIVEN
   new Instance(stack, 'Instance', {
@@ -408,14 +403,14 @@ test('add CloudFormation Init to instance', () => {
       Version: '2012-10-17',
     },
   });
-  cdkExpect(stack).to(haveResource('AWS::EC2::Instance', {
+  expect(stack).toHaveResource('AWS::EC2::Instance', {
     CreationPolicy: {
       ResourceSignal: {
         Count: 1,
         Timeout: 'PT5M',
       },
     },
-  }, ResourcePart.CompleteDefinition));
+  }, ResourcePart.CompleteDefinition);
 });
 
 test('cause replacement from s3 asset in userdata', () => {
diff --git a/packages/@aws-cdk/aws-ec2/test/launch-template.test.ts b/packages/@aws-cdk/aws-ec2/test/launch-template.test.ts
index 4d033a0cad78c..27399affe8149 100644
--- a/packages/@aws-cdk/aws-ec2/test/launch-template.test.ts
+++ b/packages/@aws-cdk/aws-ec2/test/launch-template.test.ts
@@ -1,8 +1,5 @@
+import '@aws-cdk/assert-internal/jest';
 import {
-  countResources,
-  expect as expectCDK,
-  haveResource,
-  haveResourceLike,
   stringLike,
 } from '@aws-cdk/assert-internal';
 import {
@@ -55,7 +52,7 @@ describe('LaunchTemplate', () => {
     // Note: The following is intentionally a haveResource instead of haveResourceLike
     // to ensure that only the bare minimum of properties have values when no properties
     // are given to a LaunchTemplate.
-    expectCDK(stack).to(haveResource('AWS::EC2::LaunchTemplate', {
+    expect(stack).toHaveResource('AWS::EC2::LaunchTemplate', {
       LaunchTemplateData: {
         TagSpecifications: [
           {
@@ -78,8 +75,8 @@ describe('LaunchTemplate', () => {
           },
         ],
       },
-    }));
-    expectCDK(stack).notTo(haveResource('AWS::IAM::InstanceProfile'));
+    });
+    expect(stack).not.toHaveResource('AWS::IAM::InstanceProfile');
     expect(() => { template.grantPrincipal; }).toThrow();
     expect(() => { template.connections; }).toThrow();
     expect(template.osType).toBeUndefined();
@@ -130,9 +127,9 @@ describe('LaunchTemplate', () => {
     });
 
     // THEN
-    expectCDK(stack).to(haveResourceLike('AWS::EC2::LaunchTemplate', {
+    expect(stack).toHaveResourceLike('AWS::EC2::LaunchTemplate', {
       LaunchTemplateName: 'LTName',
-    }));
+    });
   });
 
   test('Given instanceType', () => {
@@ -142,11 +139,11 @@ describe('LaunchTemplate', () => {
     });
 
     // THEN
-    expectCDK(stack).to(haveResourceLike('AWS::EC2::LaunchTemplate', {
+    expect(stack).toHaveResourceLike('AWS::EC2::LaunchTemplate', {
       LaunchTemplateData: {
         InstanceType: 'tt.test',
       },
-    }));
+    });
   });
 
   test('Given machineImage (Linux)', () => {
@@ -156,13 +153,13 @@ describe('LaunchTemplate', () => {
     });
 
     // THEN
-    expectCDK(stack).to(haveResourceLike('AWS::EC2::LaunchTemplate', {
+    expect(stack).toHaveResourceLike('AWS::EC2::LaunchTemplate', {
       LaunchTemplateData: {
         ImageId: {
           Ref: stringLike('SsmParameterValueawsserviceamiamazonlinuxlatestamznami*Parameter'),
         },
       },
-    }));
+    });
     expect(template.osType).toBe(OperatingSystemType.LINUX);
     expect(template.userData).toBeUndefined();
   });
@@ -174,13 +171,13 @@ describe('LaunchTemplate', () => {
     });
 
     // THEN
-    expectCDK(stack).to(haveResourceLike('AWS::EC2::LaunchTemplate', {
+    expect(stack).toHaveResourceLike('AWS::EC2::LaunchTemplate', {
       LaunchTemplateData: {
         ImageId: {
           Ref: stringLike('SsmParameterValueawsserviceamiwindowslatestWindowsServer2019EnglishFullBase*Parameter'),
         },
       },
-    }));
+    });
     expect(template.osType).toBe(OperatingSystemType.WINDOWS);
     expect(template.userData).toBeUndefined();
   });
@@ -196,13 +193,13 @@ describe('LaunchTemplate', () => {
     });
 
     // THEN
-    expectCDK(stack).to(haveResourceLike('AWS::EC2::LaunchTemplate', {
+    expect(stack).toHaveResourceLike('AWS::EC2::LaunchTemplate', {
       LaunchTemplateData: {
         UserData: {
           'Fn::Base64': '#!/bin/bash\necho Test',
         },
       },
-    }));
+    });
     expect(template.userData).toBeDefined();
   });
 
@@ -218,15 +215,15 @@ describe('LaunchTemplate', () => {
     });
 
     // THEN
-    expectCDK(stack).to(countResources('AWS::IAM::Role', 1));
-    expectCDK(stack).to(haveResourceLike('AWS::IAM::InstanceProfile', {
+    expect(stack).toCountResources('AWS::IAM::Role', 1);
+    expect(stack).toHaveResourceLike('AWS::IAM::InstanceProfile', {
       Roles: [
         {
           Ref: 'TestRole6C9272DF',
         },
       ],
-    }));
-    expectCDK(stack).to(haveResource('AWS::EC2::LaunchTemplate', {
+    });
+    expect(stack).toHaveResource('AWS::EC2::LaunchTemplate', {
       LaunchTemplateData: {
         IamInstanceProfile: {
           Arn: stack.resolve((template.node.findChild('Profile') as CfnInstanceProfile).getAtt('Arn')),
@@ -252,7 +249,7 @@ describe('LaunchTemplate', () => {
           },
         ],
       },
-    }));
+    });
     expect(template.role).toBeDefined();
     expect(template.grantPrincipal).toBeDefined();
   });
@@ -289,7 +286,7 @@ describe('LaunchTemplate', () => {
     });
 
     // THEN
-    expectCDK(stack).to(haveResourceLike('AWS::EC2::LaunchTemplate', {
+    expect(stack).toHaveResourceLike('AWS::EC2::LaunchTemplate', {
       LaunchTemplateData: {
         BlockDeviceMappings: [
           {
@@ -318,7 +315,7 @@ describe('LaunchTemplate', () => {
           },
         ],
       },
-    }));
+    });
   });
 
   test.each([
@@ -331,13 +328,13 @@ describe('LaunchTemplate', () => {
     });
 
     // THEN
-    expectCDK(stack).to(haveResourceLike('AWS::EC2::LaunchTemplate', {
+    expect(stack).toHaveResourceLike('AWS::EC2::LaunchTemplate', {
       LaunchTemplateData: {
         CreditSpecification: {
           CpuCredits: expected,
         },
       },
-    }));
+    });
   });
 
   test.each([
@@ -350,11 +347,11 @@ describe('LaunchTemplate', () => {
     });
 
     // THEN
-    expectCDK(stack).to(haveResourceLike('AWS::EC2::LaunchTemplate', {
+    expect(stack).toHaveResourceLike('AWS::EC2::LaunchTemplate', {
       LaunchTemplateData: {
         DisableApiTermination: expected,
       },
-    }));
+    });
   });
 
   test.each([
@@ -367,11 +364,11 @@ describe('LaunchTemplate', () => {
     });
 
     // THEN
-    expectCDK(stack).to(haveResourceLike('AWS::EC2::LaunchTemplate', {
+    expect(stack).toHaveResourceLike('AWS::EC2::LaunchTemplate', {
       LaunchTemplateData: {
         EbsOptimized: expected,
       },
-    }));
+    });
   });
 
   test.each([
@@ -384,13 +381,13 @@ describe('LaunchTemplate', () => {
     });
 
     // THEN
-    expectCDK(stack).to(haveResourceLike('AWS::EC2::LaunchTemplate', {
+    expect(stack).toHaveResourceLike('AWS::EC2::LaunchTemplate', {
       LaunchTemplateData: {
         EnclaveOptions: {
           Enabled: expected,
         },
       },
-    }));
+    });
   });
 
   test.each([
@@ -403,11 +400,11 @@ describe('LaunchTemplate', () => {
     });
 
     // THEN
-    expectCDK(stack).to(haveResourceLike('AWS::EC2::LaunchTemplate', {
+    expect(stack).toHaveResourceLike('AWS::EC2::LaunchTemplate', {
       LaunchTemplateData: {
         InstanceInitiatedShutdownBehavior: expected,
       },
-    }));
+    });
   });
 
   test('Given keyName', () => {
@@ -417,11 +414,11 @@ describe('LaunchTemplate', () => {
     });
 
     // THEN
-    expectCDK(stack).to(haveResourceLike('AWS::EC2::LaunchTemplate', {
+    expect(stack).toHaveResourceLike('AWS::EC2::LaunchTemplate', {
       LaunchTemplateData: {
         KeyName: 'TestKeyname',
       },
-    }));
+    });
   });
 
   test.each([
@@ -434,13 +431,13 @@ describe('LaunchTemplate', () => {
     });
 
     // THEN
-    expectCDK(stack).to(haveResourceLike('AWS::EC2::LaunchTemplate', {
+    expect(stack).toHaveResourceLike('AWS::EC2::LaunchTemplate', {
       LaunchTemplateData: {
         Monitoring: {
           Enabled: expected,
         },
       },
-    }));
+    });
   });
 
   test('Given securityGroup', () => {
@@ -454,7 +451,7 @@ describe('LaunchTemplate', () => {
     });
 
     // THEN
-    expectCDK(stack).to(haveResourceLike('AWS::EC2::LaunchTemplate', {
+    expect(stack).toHaveResourceLike('AWS::EC2::LaunchTemplate', {
       LaunchTemplateData: {
         SecurityGroupIds: [
           {
@@ -465,7 +462,7 @@ describe('LaunchTemplate', () => {
           },
         ],
       },
-    }));
+    });
     expect(template.connections).toBeDefined();
     expect(template.connections.securityGroups).toHaveLength(1);
     expect(template.connections.securityGroups[0]).toBe(sg);
@@ -479,7 +476,7 @@ describe('LaunchTemplate', () => {
     Tags.of(template).add('TestKey', 'TestValue');
 
     // THEN
-    expectCDK(stack).to(haveResourceLike('AWS::EC2::LaunchTemplate', {
+    expect(stack).toHaveResourceLike('AWS::EC2::LaunchTemplate', {
       LaunchTemplateData: {
         TagSpecifications: [
           {
@@ -510,7 +507,7 @@ describe('LaunchTemplate', () => {
           },
         ],
       },
-    }));
+    });
   });
 });
 
@@ -530,13 +527,13 @@ describe('LaunchTemplate marketOptions', () => {
     });
 
     // THEN
-    expectCDK(stack).to(haveResourceLike('AWS::EC2::LaunchTemplate', {
+    expect(stack).toHaveResourceLike('AWS::EC2::LaunchTemplate', {
       LaunchTemplateData: {
         InstanceMarketOptions: {
           MarketType: 'spot',
         },
       },
-    }));
+    });
   });
 
   test.each([
@@ -576,7 +573,7 @@ describe('LaunchTemplate marketOptions', () => {
     });
 
     // THEN
-    expectCDK(stack).to(haveResourceLike('AWS::EC2::LaunchTemplate', {
+    expect(stack).toHaveResourceLike('AWS::EC2::LaunchTemplate', {
       LaunchTemplateData: {
         InstanceMarketOptions: {
           MarketType: 'spot',
@@ -585,7 +582,7 @@ describe('LaunchTemplate marketOptions', () => {
           },
         },
       },
-    }));
+    });
   });
 
   test.each([
@@ -601,7 +598,7 @@ describe('LaunchTemplate marketOptions', () => {
     });
 
     // THEN
-    expectCDK(stack).to(haveResourceLike('AWS::EC2::LaunchTemplate', {
+    expect(stack).toHaveResourceLike('AWS::EC2::LaunchTemplate', {
       LaunchTemplateData: {
         InstanceMarketOptions: {
           MarketType: 'spot',
@@ -610,7 +607,7 @@ describe('LaunchTemplate marketOptions', () => {
           },
         },
       },
-    }));
+    });
   });
 
   test.each([
@@ -626,7 +623,7 @@ describe('LaunchTemplate marketOptions', () => {
     });
 
     // THEN
-    expectCDK(stack).to(haveResourceLike('AWS::EC2::LaunchTemplate', {
+    expect(stack).toHaveResourceLike('AWS::EC2::LaunchTemplate', {
       LaunchTemplateData: {
         InstanceMarketOptions: {
           MarketType: 'spot',
@@ -635,7 +632,7 @@ describe('LaunchTemplate marketOptions', () => {
           },
         },
       },
-    }));
+    });
   });
 
   test.each([
@@ -650,7 +647,7 @@ describe('LaunchTemplate marketOptions', () => {
     });
 
     // THEN
-    expectCDK(stack).to(haveResourceLike('AWS::EC2::LaunchTemplate', {
+    expect(stack).toHaveResourceLike('AWS::EC2::LaunchTemplate', {
       LaunchTemplateData: {
         InstanceMarketOptions: {
           MarketType: 'spot',
@@ -659,7 +656,7 @@ describe('LaunchTemplate marketOptions', () => {
           },
         },
       },
-    }));
+    });
   });
 
   test('given validUntil', () => {
@@ -671,7 +668,7 @@ describe('LaunchTemplate marketOptions', () => {
     });
 
     // THEN
-    expectCDK(stack).to(haveResourceLike('AWS::EC2::LaunchTemplate', {
+    expect(stack).toHaveResourceLike('AWS::EC2::LaunchTemplate', {
       LaunchTemplateData: {
         InstanceMarketOptions: {
           MarketType: 'spot',
@@ -680,6 +677,6 @@ describe('LaunchTemplate marketOptions', () => {
           },
         },
       },
-    }));
+    });
   });
 });
diff --git a/packages/@aws-cdk/aws-ec2/test/network-utils.test.ts b/packages/@aws-cdk/aws-ec2/test/network-utils.test.ts
index b1904331644f2..f6ed377869fed 100644
--- a/packages/@aws-cdk/aws-ec2/test/network-utils.test.ts
+++ b/packages/@aws-cdk/aws-ec2/test/network-utils.test.ts
@@ -1,4 +1,3 @@
-import { nodeunitShim, Test } from 'nodeunit-shim';
 import {
   CidrBlock,
   InvalidCidrRangeError,
@@ -6,65 +5,65 @@ import {
   NetworkUtils,
 } from '../lib/network-util';
 
-nodeunitShim({
-  IP: {
-    'should convert a valid IP Address to an integer'(test: Test) {
-      test.strictEqual(NetworkUtils.ipToNum('174.66.173.168'), 2923605416);
-      test.done();
-    },
-    'should throw on invalid IP Address'(test: Test) {
-      test.throws(() => {
+describe('network utils', () => {
+  describe('IP', () => {
+    test('should convert a valid IP Address to an integer', () => {
+      expect(NetworkUtils.ipToNum('174.66.173.168')).toEqual(2923605416);
+
+    });
+    test('should throw on invalid IP Address', () => {
+      expect(() => {
         NetworkUtils.ipToNum('174.266.173.168');
-      }, 'is not valid');
-      test.done();
-    },
-    'should convert a valid IP integer to a staring'(test: Test) {
-      test.strictEqual(NetworkUtils.numToIp(2923605416), '174.66.173.168');
-      test.done();
-    },
-    'should throw an error for invalid IP'(test: Test) {
-      test.throws(() => {
+      }).toThrow('is not valid');
+
+    });
+    test('should convert a valid IP integer to a staring', () => {
+      expect(NetworkUtils.numToIp(2923605416)).toEqual('174.66.173.168');
+
+    });
+    test('should throw an error for invalid IP', () => {
+      expect(() => {
         NetworkUtils.numToIp(2923605416 * 5);
-      }, /is not a valid/);
-      test.throws(() => {
+      }).toThrow(/is not a valid/);
+      expect(() => {
         NetworkUtils.numToIp(-1);
-      }, /is not a valid/);
-      test.done();
-    },
-    'validIp returns true if octect is in 0-255'(test: Test) {
+      }).toThrow(/is not a valid/);
+
+    });
+    test('validIp returns true if octect is in 0-255', () => {
       const invalidIps = ['255.255.0.0', '0.0.0.0', '1.2.3.4', '10.0.0.0', '255.01.01.255'];
       for (const ip of invalidIps) {
-        test.strictEqual(true, NetworkUtils.validIp(ip));
+        expect(true).toEqual(NetworkUtils.validIp(ip));
       }
-      test.done();
-    },
-    'validIp returns false if octect is not in 0-255'(test: Test) {
+
+    });
+    test('validIp returns false if octect is not in 0-255', () => {
       const invalidIps = ['1.2.3.4.689', '-1.55.22.22', '', ' ', '255.264.1.01'];
       for (const ip of invalidIps) {
-        test.strictEqual(false, NetworkUtils.validIp(ip));
+        expect(false).toEqual(NetworkUtils.validIp(ip));
       }
-      test.done();
-    },
-  },
-  CidrBlock: {
-    'should return the next valid subnet from offset IP'(test: Test) {
+
+    });
+  });
+  describe('CidrBlock', () => {
+    test('should return the next valid subnet from offset IP', () => {
       const num = NetworkUtils.ipToNum('10.0.1.255');
       const newBlock = new CidrBlock(num, 24);
-      test.strictEqual(newBlock.cidr, '10.0.2.0/24');
-      test.done();
-    },
-    'nextBlock() returns the next higher CIDR space'(test: Test) {
+      expect(newBlock.cidr).toEqual('10.0.2.0/24');
+
+    });
+    test('nextBlock() returns the next higher CIDR space', () => {
       const testValues = [
         ['192.168.0.0/24', '192.168.1.0/24'],
         ['10.85.7.0/28', '10.85.7.16/28'],
       ];
       for (const value of testValues) {
         const block = new CidrBlock(value[0]);
-        test.strictEqual(block.nextBlock().cidr, value[1]);
+        expect(block.nextBlock().cidr).toEqual(value[1]);
       }
-      test.done();
-    },
-    'maxIp() should return the last usable IP from the CidrBlock'(test: Test) {
+
+    });
+    test('maxIp() should return the last usable IP from the CidrBlock', () => {
       const testValues = [
         ['10.0.3.0/28', '10.0.3.15'],
         ['10.0.3.1/28', '10.0.3.31'],
@@ -72,42 +71,42 @@ nodeunitShim({
       ];
       for (const value of testValues) {
         const block = new CidrBlock(value[0]);
-        test.strictEqual(block.maxIp(), value[1]);
+        expect(block.maxIp()).toEqual(value[1]);
       }
-      test.done();
-    },
-    'minIp() should return the first usable IP from the CidrBlock'(test: Test) {
+
+    });
+    test('minIp() should return the first usable IP from the CidrBlock', () => {
       const testValues = [
         ['192.168.0.0/18', '192.168.0.0'],
         ['10.0.3.0/24', '10.0.3.0'],
       ];
       for (const answer of testValues) {
         const block = new CidrBlock(answer[0]);
-        test.strictEqual(block.minIp(), answer[1]);
+        expect(block.minIp()).toEqual(answer[1]);
       }
-      test.done();
-    },
-    'containsCidr returns true if fully contained'(test: Test) {
+
+    });
+    test('containsCidr returns true if fully contained', () => {
       const block = new CidrBlock('10.0.3.0/24');
       const contained = new CidrBlock('10.0.3.0/26');
-      test.strictEqual(block.containsCidr(contained), true);
-      test.done();
-    },
-    'containsCidr returns false if not fully contained'(test: Test) {
+      expect(block.containsCidr(contained)).toEqual(true);
+
+    });
+    test('containsCidr returns false if not fully contained', () => {
       const block = new CidrBlock('10.0.3.0/26');
       const notContained = new CidrBlock('10.0.3.0/25');
-      test.strictEqual(block.containsCidr(notContained), false);
-      test.done();
-    },
-    'calculateNetmask returns the ip string mask'(test: Test) {
+      expect(block.containsCidr(notContained)).toEqual(false);
+
+    });
+    test('calculateNetmask returns the ip string mask', () => {
       const netmask = CidrBlock.calculateNetmask(27);
-      test.strictEqual(netmask, '255.255.255.224');
-      test.done();
-    },
+      expect(netmask).toEqual('255.255.255.224');
 
-  },
-  NetworkBuilder: {
-    'allows you to carve subnets our of CIDR network'(test: Test) {
+    });
+
+  });
+  describe('NetworkBuilder', () => {
+    test('allows you to carve subnets our of CIDR network', () => {
       const answers = [
         [
           '192.168.0.0/28',
@@ -142,49 +141,49 @@ nodeunitShim({
         efficient.cidrStrings.sort(),
       ];
       for (let i = 0; i < answers.length; i++) {
-        test.deepEqual(answers[i].sort(), expected[i]);
+        expect(answers[i].sort()).toEqual(expected[i]);
       }
-      test.done();
-    },
-    'throws on subnets < 16 or > 28'(test: Test) {
+
+    });
+    test('throws on subnets < 16 or > 28', () => {
       const builder = new NetworkBuilder('192.168.0.0/18');
-      test.throws(() => {
+      expect(() => {
         builder.addSubnet(15);
-      }, InvalidCidrRangeError);
-      test.throws(() => {
+      }).toThrow(InvalidCidrRangeError);
+      expect(() => {
         builder.addSubnet(29);
-      }, InvalidCidrRangeError);
-      test.done();
-    },
-    'throws if you add a subnet outside of the cidr'(test: Test) {
+      }).toThrow(InvalidCidrRangeError);
+
+    });
+    test('throws if you add a subnet outside of the cidr', () => {
       const builder = new NetworkBuilder('192.168.0.0/18');
       const builder2 = new NetworkBuilder('10.0.0.0/21');
       builder.addSubnets(19, 1);
       builder2.addSubnets(24, 8);
-      test.throws(() => {
+      expect(() => {
         builder.addSubnet(19);
         builder.addSubnet(28);
-      }, /exceeds remaining space/);
-      test.throws(() => {
+      }).toThrow(/exceeds remaining space/);
+      expect(() => {
         builder2.addSubnet(28);
-      }, /exceeds remaining space/);
-      test.done();
-    },
-    'maskForRemainingSubnets calcs mask for even split of remaining'(test: Test) {
+      }).toThrow(/exceeds remaining space/);
+
+    });
+    test('maskForRemainingSubnets calcs mask for even split of remaining', () => {
       const builder = new NetworkBuilder('10.0.0.0/24');
       builder.addSubnet(25);
-      test.strictEqual(27, builder.maskForRemainingSubnets(3));
+      expect(27).toEqual(builder.maskForRemainingSubnets(3));
       const builder2 = new NetworkBuilder('192.168.176.0/20');
       builder2.addSubnets(22, 2);
-      test.strictEqual(22, builder2.maskForRemainingSubnets(2));
+      expect(22).toEqual(builder2.maskForRemainingSubnets(2));
       const builder3 = new NetworkBuilder('192.168.0.0/16');
-      test.strictEqual(17, builder3.maskForRemainingSubnets(2));
+      expect(17).toEqual(builder3.maskForRemainingSubnets(2));
       const builder4 = new NetworkBuilder('10.0.0.0/16');
-      test.strictEqual(18, builder4.maskForRemainingSubnets(4));
+      expect(18).toEqual(builder4.maskForRemainingSubnets(4));
       const builder5 = new NetworkBuilder('10.0.0.0/16');
       builder5.addSubnets(26, 3);
       builder5.addSubnets(27, 3);
-      test.strictEqual(18, builder5.maskForRemainingSubnets(3)); test.done();
-    },
-  },
+      expect(18).toEqual(builder5.maskForRemainingSubnets(3));
+    });
+  });
 });
diff --git a/packages/@aws-cdk/aws-ec2/test/security-group.test.ts b/packages/@aws-cdk/aws-ec2/test/security-group.test.ts
index 1a7cb23b51493..09ccc6cdc682e 100644
--- a/packages/@aws-cdk/aws-ec2/test/security-group.test.ts
+++ b/packages/@aws-cdk/aws-ec2/test/security-group.test.ts
@@ -1,12 +1,11 @@
-import { expect, haveResource, haveResourceLike, not } from '@aws-cdk/assert-internal';
+import '@aws-cdk/assert-internal/jest';
 import { App, Intrinsic, Lazy, Stack, Token } from '@aws-cdk/core';
-import { nodeunitShim, Test } from 'nodeunit-shim';
 import { Peer, Port, SecurityGroup, SecurityGroupProps, Vpc } from '../lib';
 
 const SECURITY_GROUP_DISABLE_INLINE_RULES_CONTEXT_KEY = '@aws-cdk/aws-ec2.securityGroupDisableInlineRules';
 
-nodeunitShim({
-  'security group can allows all outbound traffic by default'(test: Test) {
+describe('security group', () => {
+  test('security group can allows all outbound traffic by default', () => {
     // GIVEN
     const stack = new Stack();
     const vpc = new Vpc(stack, 'VPC');
@@ -15,7 +14,7 @@ nodeunitShim({
     new SecurityGroup(stack, 'SG1', { vpc, allowAllOutbound: true });
 
     // THEN
-    expect(stack).to(haveResource('AWS::EC2::SecurityGroup', {
+    expect(stack).toHaveResource('AWS::EC2::SecurityGroup', {
       SecurityGroupEgress: [
         {
           CidrIp: '0.0.0.0/0',
@@ -23,12 +22,12 @@ nodeunitShim({
           IpProtocol: '-1',
         },
       ],
-    }));
+    });
+
 
-    test.done();
-  },
+  });
 
-  'no new outbound rule is added if we are allowing all traffic anyway'(test: Test) {
+  test('no new outbound rule is added if we are allowing all traffic anyway', () => {
     // GIVEN
     const stack = new Stack();
     const vpc = new Vpc(stack, 'VPC');
@@ -38,7 +37,7 @@ nodeunitShim({
     sg.addEgressRule(Peer.anyIpv4(), Port.tcp(86), 'This does not show up');
 
     // THEN
-    expect(stack).to(haveResource('AWS::EC2::SecurityGroup', {
+    expect(stack).toHaveResource('AWS::EC2::SecurityGroup', {
       SecurityGroupEgress: [
         {
           CidrIp: '0.0.0.0/0',
@@ -46,12 +45,12 @@ nodeunitShim({
           IpProtocol: '-1',
         },
       ],
-    }));
+    });
+
 
-    test.done();
-  },
+  });
 
-  'security group disallow outbound traffic by default'(test: Test) {
+  test('security group disallow outbound traffic by default', () => {
     // GIVEN
     const stack = new Stack();
     const vpc = new Vpc(stack, 'VPC');
@@ -60,7 +59,7 @@ nodeunitShim({
     new SecurityGroup(stack, 'SG1', { vpc, allowAllOutbound: false });
 
     // THEN
-    expect(stack).to(haveResource('AWS::EC2::SecurityGroup', {
+    expect(stack).toHaveResource('AWS::EC2::SecurityGroup', {
       SecurityGroupEgress: [
         {
           CidrIp: '255.255.255.255/32',
@@ -70,12 +69,12 @@ nodeunitShim({
           ToPort: 86,
         },
       ],
-    }));
+    });
+
 
-    test.done();
-  },
+  });
 
-  'bogus outbound rule disappears if another rule is added'(test: Test) {
+  test('bogus outbound rule disappears if another rule is added', () => {
     // GIVEN
     const stack = new Stack();
     const vpc = new Vpc(stack, 'VPC');
@@ -85,7 +84,7 @@ nodeunitShim({
     sg.addEgressRule(Peer.anyIpv4(), Port.tcp(86), 'This replaces the other one');
 
     // THEN
-    expect(stack).to(haveResource('AWS::EC2::SecurityGroup', {
+    expect(stack).toHaveResource('AWS::EC2::SecurityGroup', {
       SecurityGroupEgress: [
         {
           CidrIp: '0.0.0.0/0',
@@ -95,26 +94,26 @@ nodeunitShim({
           ToPort: 86,
         },
       ],
-    }));
+    });
+
 
-    test.done();
-  },
+  });
 
-  'all outbound rule cannot be added after creation'(test: Test) {
+  test('all outbound rule cannot be added after creation', () => {
     // GIVEN
     const stack = new Stack();
     const vpc = new Vpc(stack, 'VPC');
 
     // WHEN
     const sg = new SecurityGroup(stack, 'SG1', { vpc, allowAllOutbound: false });
-    test.throws(() => {
+    expect(() => {
       sg.addEgressRule(Peer.anyIpv4(), Port.allTraffic(), 'All traffic');
-    }, /Cannot add/);
+    }).toThrow(/Cannot add/);
 
-    test.done();
-  },
 
-  'immutable imports do not add rules'(test: Test) {
+  });
+
+  test('immutable imports do not add rules', () => {
     // GIVEN
     const stack = new Stack();
 
@@ -123,7 +122,7 @@ nodeunitShim({
     sg.addEgressRule(Peer.anyIpv4(), Port.tcp(86), 'This rule was not added');
     sg.addIngressRule(Peer.anyIpv4(), Port.tcp(86), 'This rule was not added');
 
-    expect(stack).to(not(haveResource('AWS::EC2::SecurityGroup', {
+    expect(stack).not.toHaveResource('AWS::EC2::SecurityGroup', {
       SecurityGroupEgress: [
         {
           CidrIp: '0.0.0.0/0',
@@ -133,9 +132,9 @@ nodeunitShim({
           ToPort: 86,
         },
       ],
-    })));
+    });
 
-    expect(stack).to(not(haveResource('AWS::EC2::SecurityGroup', {
+    expect(stack).not.toHaveResource('AWS::EC2::SecurityGroup', {
       SecurityGroupIngress: [
         {
           CidrIp: '0.0.0.0/0',
@@ -145,29 +144,29 @@ nodeunitShim({
           ToPort: 86,
         },
       ],
-    })));
+    });
+
 
-    test.done();
-  },
+  });
 
-  'Inline Rule Control': {
+  describe('Inline Rule Control', () => {
     //Not inlined
-    'When props.disableInlineRules is true': testRulesAreNotInlined(undefined, true),
-    'When context.disableInlineRules is true': testRulesAreNotInlined(true, undefined),
-    'When context.disableInlineRules is true and props.disableInlineRules is true': testRulesAreNotInlined(true, true),
-    'When context.disableInlineRules is false and props.disableInlineRules is true': testRulesAreNotInlined(false, true),
-    'When props.disableInlineRules is true and context.disableInlineRules is null': testRulesAreNotInlined(null, true),
+    describe('When props.disableInlineRules is true', () => { testRulesAreNotInlined(undefined, true); });
+    describe('When context.disableInlineRules is true', () => { testRulesAreNotInlined(true, undefined); });
+    describe('When context.disableInlineRules is true and props.disableInlineRules is true', () => { testRulesAreNotInlined(true, true); });
+    describe('When context.disableInlineRules is false and props.disableInlineRules is true', () => { testRulesAreNotInlined(false, true); });
+    describe('When props.disableInlineRules is true and context.disableInlineRules is null', () => { testRulesAreNotInlined(null, true); });
     //Inlined
-    'When context.disableInlineRules is false and props.disableInlineRules is false': testRulesAreInlined(false, false),
-    'When context.disableInlineRules is true and props.disableInlineRules is false': testRulesAreInlined(true, false),
-    'When context.disableInlineRules is false': testRulesAreInlined(false, undefined),
-    'When props.disableInlineRules is false': testRulesAreInlined(undefined, false),
-    'When neither props.disableInlineRules nor context.disableInlineRules are defined': testRulesAreInlined(undefined, undefined),
-    'When props.disableInlineRules is undefined and context.disableInlineRules is null': testRulesAreInlined(null, undefined),
-    'When props.disableInlineRules is false and context.disableInlineRules is null': testRulesAreInlined(null, false),
-  },
-
-  'peer between all types of peers and port range types'(test: Test) {
+    describe('When context.disableInlineRules is false and props.disableInlineRules is false', () => { testRulesAreInlined(false, false); });
+    describe('When context.disableInlineRules is true and props.disableInlineRules is false', () => { testRulesAreInlined(true, false); });
+    describe('When context.disableInlineRules is false', () => { testRulesAreInlined(false, undefined); });
+    describe('When props.disableInlineRules is false', () => { testRulesAreInlined(undefined, false); });
+    describe('When neither props.disableInlineRules nor context.disableInlineRules are defined', () => { testRulesAreInlined(undefined, undefined); });
+    describe('When props.disableInlineRules is undefined and context.disableInlineRules is null', () => { testRulesAreInlined(null, undefined); });
+    describe('When props.disableInlineRules is false and context.disableInlineRules is null', () => { testRulesAreInlined(null, false); });
+  });
+
+  test('peer between all types of peers and port range types', () => {
     // GIVEN
     const stack = new Stack(undefined, 'TestStack', { env: { account: '12345678', region: 'dummy' } });
     const vpc = new Vpc(stack, 'VPC');
@@ -206,10 +205,10 @@ nodeunitShim({
 
     // THEN -- no crash
 
-    test.done();
-  },
 
-  'if tokens are used in ports, `canInlineRule` should be false to avoid cycles'(test: Test) {
+  });
+
+  test('if tokens are used in ports, `canInlineRule` should be false to avoid cycles', () => {
     // GIVEN
     const p1 = Lazy.number({ produce: () => 80 });
     const p2 = Lazy.number({ produce: () => 5000 });
@@ -233,52 +232,52 @@ nodeunitShim({
 
     // THEN
     for (const range of ports) {
-      test.equal(range.canInlineRule, false, range.toString());
+      expect(range.canInlineRule).toEqual(false);
     }
 
-    test.done();
-  },
 
-  'Peer IP CIDR validation': {
-    'passes with valid IPv4 CIDR block'(test: Test) {
+  });
+
+  describe('Peer IP CIDR validation', () => {
+    test('passes with valid IPv4 CIDR block', () => {
       // GIVEN
       const cidrIps = ['0.0.0.0/0', '192.168.255.255/24'];
 
       // THEN
       for (const cidrIp of cidrIps) {
-        test.equal(Peer.ipv4(cidrIp).uniqueId, cidrIp);
+        expect(Peer.ipv4(cidrIp).uniqueId).toEqual(cidrIp);
       }
 
-      test.done();
-    },
 
-    'passes with unresolved IP CIDR token'(test: Test) {
+    });
+
+    test('passes with unresolved IP CIDR token', () => {
       // GIVEN
       Token.asString(new Intrinsic('ip'));
 
       // THEN: don't throw
 
-      test.done();
-    },
 
-    'throws if invalid IPv4 CIDR block'(test: Test) {
+    });
+
+    test('throws if invalid IPv4 CIDR block', () => {
       // THEN
-      test.throws(() => {
+      expect(() => {
         Peer.ipv4('invalid');
-      }, /Invalid IPv4 CIDR/);
+      }).toThrow(/Invalid IPv4 CIDR/);
 
-      test.done();
-    },
 
-    'throws if missing mask in IPv4 CIDR block'(test: Test) {
-      test.throws(() => {
+    });
+
+    test('throws if missing mask in IPv4 CIDR block', () => {
+      expect(() => {
         Peer.ipv4('0.0.0.0');
-      }, /CIDR mask is missing in IPv4/);
+      }).toThrow(/CIDR mask is missing in IPv4/);
+
 
-      test.done();
-    },
+    });
 
-    'passes with valid IPv6 CIDR block'(test: Test) {
+    test('passes with valid IPv6 CIDR block', () => {
       // GIVEN
       const cidrIps = [
         '::/0',
@@ -289,31 +288,31 @@ nodeunitShim({
 
       // THEN
       for (const cidrIp of cidrIps) {
-        test.equal(Peer.ipv6(cidrIp).uniqueId, cidrIp);
+        expect(Peer.ipv6(cidrIp).uniqueId).toEqual(cidrIp);
       }
 
-      test.done();
-    },
 
-    'throws if invalid IPv6 CIDR block'(test: Test) {
+    });
+
+    test('throws if invalid IPv6 CIDR block', () => {
       // THEN
-      test.throws(() => {
+      expect(() => {
         Peer.ipv6('invalid');
-      }, /Invalid IPv6 CIDR/);
+      }).toThrow(/Invalid IPv6 CIDR/);
 
-      test.done();
-    },
 
-    'throws if missing mask in IPv6 CIDR block'(test: Test) {
-      test.throws(() => {
+    });
+
+    test('throws if missing mask in IPv6 CIDR block', () => {
+      expect(() => {
         Peer.ipv6('::');
-      }, /IDR mask is missing in IPv6/);
+      }).toThrow(/IDR mask is missing in IPv6/);
 
-      test.done();
-    },
-  },
 
-  'can look up a security group'(test: Test) {
+    });
+  });
+
+  test('can look up a security group', () => {
     const app = new App();
     const stack = new Stack(app, 'stack', {
       env: {
@@ -324,438 +323,435 @@ nodeunitShim({
 
     const securityGroup = SecurityGroup.fromLookup(stack, 'stack', 'sg-1234');
 
-    test.equal(securityGroup.securityGroupId, 'sg-12345');
-    test.equal(securityGroup.allowAllOutbound, true);
+    expect(securityGroup.securityGroupId).toEqual('sg-12345');
+    expect(securityGroup.allowAllOutbound).toEqual(true);
+
 
-    test.done();
-  },
+  });
 });
 
 function testRulesAreInlined(contextDisableInlineRules: boolean | undefined | null, optionsDisableInlineRules: boolean | undefined) {
-  return {
-    'When allowAllOutbound': {
-      'new SecurityGroup will create an inline SecurityGroupEgress rule to allow all traffic'(test: Test) {
-        // GIVEN
-        const stack = new Stack();
-        stack.node.setContext(SECURITY_GROUP_DISABLE_INLINE_RULES_CONTEXT_KEY, contextDisableInlineRules);
-        const vpc = new Vpc(stack, 'VPC');
-        const props: SecurityGroupProps = { vpc, allowAllOutbound: true, disableInlineRules: optionsDisableInlineRules };
-
-        // WHEN
-        new SecurityGroup(stack, 'SG1', props);
-
-        expect(stack).to(haveResource('AWS::EC2::SecurityGroup', {
-          GroupDescription: 'Default/SG1',
-          VpcId: stack.resolve(vpc.vpcId),
-          SecurityGroupEgress: [
-            {
-              CidrIp: '0.0.0.0/0',
-              Description: 'Allow all outbound traffic by default',
-              IpProtocol: '-1',
-            },
-          ],
-        }));
-        expect(stack).to(not(haveResourceLike('AWS::EC2::SecurityGroupEgress', {})));
-        expect(stack).to(not(haveResourceLike('AWS::EC2::SecurityGroupIngress', {})));
-        test.done();
-      },
 
-      'addEgressRule rule will not modify egress rules'(test: Test) {
-        // GIVEN
-        const stack = new Stack();
-        stack.node.setContext(SECURITY_GROUP_DISABLE_INLINE_RULES_CONTEXT_KEY, contextDisableInlineRules);
-        const vpc = new Vpc(stack, 'VPC');
-        const props: SecurityGroupProps = { vpc, allowAllOutbound: true, disableInlineRules: optionsDisableInlineRules };
-
-        // WHEN
-        const sg = new SecurityGroup(stack, 'SG1', props);
-        sg.addEgressRule(Peer.anyIpv4(), Port.tcp(86), 'An external Rule');
-
-        expect(stack).to(haveResource('AWS::EC2::SecurityGroup', {
-          GroupDescription: 'Default/SG1',
-          VpcId: stack.resolve(vpc.vpcId),
-          SecurityGroupEgress: [
-            {
-              CidrIp: '0.0.0.0/0',
-              Description: 'Allow all outbound traffic by default',
-              IpProtocol: '-1',
-            },
-          ],
-        }));
-
-        expect(stack).to(not(haveResourceLike('AWS::EC2::SecurityGroupEgress', {})));
-        expect(stack).to(not(haveResourceLike('AWS::EC2::SecurityGroupIngress', {})));
-        test.done();
-      },
+  describe('When allowAllOutbound', () => {
+    test('new SecurityGroup will create an inline SecurityGroupEgress rule to allow all traffic', () => {
+      // GIVEN
+      const stack = new Stack();
+      stack.node.setContext(SECURITY_GROUP_DISABLE_INLINE_RULES_CONTEXT_KEY, contextDisableInlineRules);
+      const vpc = new Vpc(stack, 'VPC');
+      const props: SecurityGroupProps = { vpc, allowAllOutbound: true, disableInlineRules: optionsDisableInlineRules };
+
+      // WHEN
+      new SecurityGroup(stack, 'SG1', props);
+
+      expect(stack).toHaveResource('AWS::EC2::SecurityGroup', {
+        GroupDescription: 'Default/SG1',
+        VpcId: stack.resolve(vpc.vpcId),
+        SecurityGroupEgress: [
+          {
+            CidrIp: '0.0.0.0/0',
+            Description: 'Allow all outbound traffic by default',
+            IpProtocol: '-1',
+          },
+        ],
+      });
+      expect(stack).not.toHaveResourceLike('AWS::EC2::SecurityGroupEgress', {});
+      expect(stack).not.toHaveResourceLike('AWS::EC2::SecurityGroupIngress', {});
 
-      'addIngressRule will add a new ingress rule'(test: Test) {
-        // GIVEN
-        const stack = new Stack();
-        stack.node.setContext(SECURITY_GROUP_DISABLE_INLINE_RULES_CONTEXT_KEY, contextDisableInlineRules);
-        const vpc = new Vpc(stack, 'VPC');
-        const props: SecurityGroupProps = { vpc, allowAllOutbound: true, disableInlineRules: optionsDisableInlineRules };
-
-        // WHEN
-        const sg = new SecurityGroup(stack, 'SG1', props);
-        sg.addIngressRule(Peer.anyIpv4(), Port.tcp(86), 'An external Rule');
-
-        expect(stack).to(haveResource('AWS::EC2::SecurityGroup', {
-          GroupDescription: 'Default/SG1',
-          VpcId: stack.resolve(vpc.vpcId),
-          SecurityGroupIngress: [
-            {
-              CidrIp: '0.0.0.0/0',
-              Description: 'An external Rule',
-              FromPort: 86,
-              IpProtocol: 'tcp',
-              ToPort: 86,
-            },
-          ],
-          SecurityGroupEgress: [
-            {
-              CidrIp: '0.0.0.0/0',
-              Description: 'Allow all outbound traffic by default',
-              IpProtocol: '-1',
-            },
-          ],
-        }));
-
-        expect(stack).to(not(haveResourceLike('AWS::EC2::SecurityGroupEgress', {})));
-        expect(stack).to(not(haveResourceLike('AWS::EC2::SecurityGroupIngress', {})));
-        test.done();
-      },
-    },
-
-    'When do not allowAllOutbound': {
-      'new SecurityGroup rule will create an egress rule that denies all traffic'(test: Test) {
-        // GIVEN
-        const stack = new Stack();
-        stack.node.setContext(SECURITY_GROUP_DISABLE_INLINE_RULES_CONTEXT_KEY, contextDisableInlineRules);
-        const vpc = new Vpc(stack, 'VPC');
-        const props: SecurityGroupProps = { vpc, allowAllOutbound: false, disableInlineRules: optionsDisableInlineRules };
-
-        // WHEN
-        new SecurityGroup(stack, 'SG1', props);
-
-        expect(stack).to(haveResource('AWS::EC2::SecurityGroup', {
-          GroupDescription: 'Default/SG1',
-          VpcId: stack.resolve(vpc.vpcId),
-          SecurityGroupEgress: [
-            {
-              CidrIp: '255.255.255.255/32',
-              Description: 'Disallow all traffic',
-              IpProtocol: 'icmp',
-              FromPort: 252,
-              ToPort: 86,
-            },
-          ],
-        }));
-        expect(stack).to(not(haveResourceLike('AWS::EC2::SecurityGroupIngress', {})));
-        expect(stack).to(not(haveResourceLike('AWS::EC2::SecurityGroupIngress', {})));
-
-        test.done();
-      },
-      'addEgressRule rule will add a new inline egress rule and remove the denyAllTraffic rule'(test: Test) {
-        // GIVEN
-        const stack = new Stack();
-        stack.node.setContext(SECURITY_GROUP_DISABLE_INLINE_RULES_CONTEXT_KEY, contextDisableInlineRules);
-        const vpc = new Vpc(stack, 'VPC');
-        const props: SecurityGroupProps = { vpc, allowAllOutbound: false, disableInlineRules: optionsDisableInlineRules };
-
-        // WHEN
-        const sg = new SecurityGroup(stack, 'SG1', props);
-        sg.addEgressRule(Peer.anyIpv4(), Port.tcp(86), 'An inline Rule');
-
-        expect(stack).to(haveResource('AWS::EC2::SecurityGroup', {
-          GroupDescription: 'Default/SG1',
-          VpcId: stack.resolve(vpc.vpcId),
-          SecurityGroupEgress: [
-            {
-              CidrIp: '0.0.0.0/0',
-              Description: 'An inline Rule',
-              FromPort: 86,
-              IpProtocol: 'tcp',
-              ToPort: 86,
-            },
-          ],
-        }));
-
-        expect(stack).to(not(haveResourceLike('AWS::EC2::SecurityGroupEgress', {})));
-        expect(stack).to(not(haveResourceLike('AWS::EC2::SecurityGroupIngress', {})));
-        test.done();
-      },
+    });
 
-      'addIngressRule will add a new ingress rule'(test: Test) {
-        // GIVEN
-        const stack = new Stack();
-        stack.node.setContext(SECURITY_GROUP_DISABLE_INLINE_RULES_CONTEXT_KEY, contextDisableInlineRules);
-        const vpc = new Vpc(stack, 'VPC');
-        const props: SecurityGroupProps = { vpc, allowAllOutbound: false, disableInlineRules: optionsDisableInlineRules };
-
-        // WHEN
-        const sg = new SecurityGroup(stack, 'SG1', props);
-        sg.addIngressRule(Peer.anyIpv4(), Port.tcp(86), 'An external Rule');
-
-        expect(stack).to(haveResource('AWS::EC2::SecurityGroup', {
-          GroupDescription: 'Default/SG1',
-          VpcId: stack.resolve(vpc.vpcId),
-          SecurityGroupIngress: [
-            {
-              CidrIp: '0.0.0.0/0',
-              Description: 'An external Rule',
-              FromPort: 86,
-              IpProtocol: 'tcp',
-              ToPort: 86,
-            },
-          ],
-          SecurityGroupEgress: [
-            {
-              CidrIp: '255.255.255.255/32',
-              Description: 'Disallow all traffic',
-              IpProtocol: 'icmp',
-              FromPort: 252,
-              ToPort: 86,
-            },
-          ],
-        }));
-
-        expect(stack).to(not(haveResourceLike('AWS::EC2::SecurityGroupEgress', {})));
-        expect(stack).to(not(haveResourceLike('AWS::EC2::SecurityGroupIngress', {})));
-        test.done();
-      },
-    },
-  };
-}
+    test('addEgressRule rule will not modify egress rules', () => {
+      // GIVEN
+      const stack = new Stack();
+      stack.node.setContext(SECURITY_GROUP_DISABLE_INLINE_RULES_CONTEXT_KEY, contextDisableInlineRules);
+      const vpc = new Vpc(stack, 'VPC');
+      const props: SecurityGroupProps = { vpc, allowAllOutbound: true, disableInlineRules: optionsDisableInlineRules };
+
+      // WHEN
+      const sg = new SecurityGroup(stack, 'SG1', props);
+      sg.addEgressRule(Peer.anyIpv4(), Port.tcp(86), 'An external Rule');
+
+      expect(stack).toHaveResource('AWS::EC2::SecurityGroup', {
+        GroupDescription: 'Default/SG1',
+        VpcId: stack.resolve(vpc.vpcId),
+        SecurityGroupEgress: [
+          {
+            CidrIp: '0.0.0.0/0',
+            Description: 'Allow all outbound traffic by default',
+            IpProtocol: '-1',
+          },
+        ],
+      });
+
+      expect(stack).not.toHaveResourceLike('AWS::EC2::SecurityGroupEgress', {});
+      expect(stack).not.toHaveResourceLike('AWS::EC2::SecurityGroupIngress', {});
+
+    });
+
+    test('addIngressRule will add a new ingress rule', () => {
+      // GIVEN
+      const stack = new Stack();
+      stack.node.setContext(SECURITY_GROUP_DISABLE_INLINE_RULES_CONTEXT_KEY, contextDisableInlineRules);
+      const vpc = new Vpc(stack, 'VPC');
+      const props: SecurityGroupProps = { vpc, allowAllOutbound: true, disableInlineRules: optionsDisableInlineRules };
+
+      // WHEN
+      const sg = new SecurityGroup(stack, 'SG1', props);
+      sg.addIngressRule(Peer.anyIpv4(), Port.tcp(86), 'An external Rule');
+
+      expect(stack).toHaveResource('AWS::EC2::SecurityGroup', {
+        GroupDescription: 'Default/SG1',
+        VpcId: stack.resolve(vpc.vpcId),
+        SecurityGroupIngress: [
+          {
+            CidrIp: '0.0.0.0/0',
+            Description: 'An external Rule',
+            FromPort: 86,
+            IpProtocol: 'tcp',
+            ToPort: 86,
+          },
+        ],
+        SecurityGroupEgress: [
+          {
+            CidrIp: '0.0.0.0/0',
+            Description: 'Allow all outbound traffic by default',
+            IpProtocol: '-1',
+          },
+        ],
+      });
+
+    });
+  });
+
+  describe('When do not allowAllOutbound', () => {
+    test('new SecurityGroup rule will create an egress rule that denies all traffic', () => {
+      // GIVEN
+      const stack = new Stack();
+      stack.node.setContext(SECURITY_GROUP_DISABLE_INLINE_RULES_CONTEXT_KEY, contextDisableInlineRules);
+      const vpc = new Vpc(stack, 'VPC');
+      const props: SecurityGroupProps = { vpc, allowAllOutbound: false, disableInlineRules: optionsDisableInlineRules };
+
+      // WHEN
+      new SecurityGroup(stack, 'SG1', props);
+
+      expect(stack).toHaveResource('AWS::EC2::SecurityGroup', {
+        GroupDescription: 'Default/SG1',
+        VpcId: stack.resolve(vpc.vpcId),
+        SecurityGroupEgress: [
+          {
+            CidrIp: '255.255.255.255/32',
+            Description: 'Disallow all traffic',
+            IpProtocol: 'icmp',
+            FromPort: 252,
+            ToPort: 86,
+          },
+        ],
+      });
+      expect(stack).not.toHaveResourceLike('AWS::EC2::SecurityGroupIngress', {});
+      expect(stack).not.toHaveResourceLike('AWS::EC2::SecurityGroupIngress', {});
+
+
+    });
+    test('addEgressRule rule will add a new inline egress rule and remove the denyAllTraffic rule', () => {
+      // GIVEN
+      const stack = new Stack();
+      stack.node.setContext(SECURITY_GROUP_DISABLE_INLINE_RULES_CONTEXT_KEY, contextDisableInlineRules);
+      const vpc = new Vpc(stack, 'VPC');
+      const props: SecurityGroupProps = { vpc, allowAllOutbound: false, disableInlineRules: optionsDisableInlineRules };
+
+      // WHEN
+      const sg = new SecurityGroup(stack, 'SG1', props);
+      sg.addEgressRule(Peer.anyIpv4(), Port.tcp(86), 'An inline Rule');
+
+      expect(stack).toHaveResource('AWS::EC2::SecurityGroup', {
+        GroupDescription: 'Default/SG1',
+        VpcId: stack.resolve(vpc.vpcId),
+        SecurityGroupEgress: [
+          {
+            CidrIp: '0.0.0.0/0',
+            Description: 'An inline Rule',
+            FromPort: 86,
+            IpProtocol: 'tcp',
+            ToPort: 86,
+          },
+        ],
+      });
+
+      expect(stack).not.toHaveResourceLike('AWS::EC2::SecurityGroupEgress', {});
+      expect(stack).not.toHaveResourceLike('AWS::EC2::SecurityGroupIngress', {});
+
+    });
+
+    test('addIngressRule will add a new ingress rule', () => {
+      // GIVEN
+      const stack = new Stack();
+      stack.node.setContext(SECURITY_GROUP_DISABLE_INLINE_RULES_CONTEXT_KEY, contextDisableInlineRules);
+      const vpc = new Vpc(stack, 'VPC');
+      const props: SecurityGroupProps = { vpc, allowAllOutbound: false, disableInlineRules: optionsDisableInlineRules };
+
+      // WHEN
+      const sg = new SecurityGroup(stack, 'SG1', props);
+      sg.addIngressRule(Peer.anyIpv4(), Port.tcp(86), 'An external Rule');
+
+      expect(stack).toHaveResource('AWS::EC2::SecurityGroup', {
+        GroupDescription: 'Default/SG1',
+        VpcId: stack.resolve(vpc.vpcId),
+        SecurityGroupIngress: [
+          {
+            CidrIp: '0.0.0.0/0',
+            Description: 'An external Rule',
+            FromPort: 86,
+            IpProtocol: 'tcp',
+            ToPort: 86,
+          },
+        ],
+        SecurityGroupEgress: [
+          {
+            CidrIp: '255.255.255.255/32',
+            Description: 'Disallow all traffic',
+            IpProtocol: 'icmp',
+            FromPort: 252,
+            ToPort: 86,
+          },
+        ],
+      });
+
+      expect(stack).not.toHaveResourceLike('AWS::EC2::SecurityGroupEgress', {});
+      expect(stack).not.toHaveResourceLike('AWS::EC2::SecurityGroupIngress', {});
+
+    });
+  });
+
+};
 
 
 function testRulesAreNotInlined(contextDisableInlineRules: boolean | undefined | null, optionsDisableInlineRules: boolean | undefined) {
-  return {
-    'When allowAllOutbound': {
-      'new SecurityGroup will create an external SecurityGroupEgress rule'(test: Test) {
-        // GIVEN
-        const stack = new Stack();
-        stack.node.setContext(SECURITY_GROUP_DISABLE_INLINE_RULES_CONTEXT_KEY, contextDisableInlineRules);
-        const vpc = new Vpc(stack, 'VPC');
-        const props: SecurityGroupProps = { vpc, allowAllOutbound: true, disableInlineRules: optionsDisableInlineRules };
-
-        // WHEN
-        const sg = new SecurityGroup(stack, 'SG1', props);
-
-        expect(stack).to(haveResource('AWS::EC2::SecurityGroup', {
-          GroupDescription: 'Default/SG1',
-          VpcId: stack.resolve(vpc.vpcId),
-        }));
-        expect(stack).to(haveResource('AWS::EC2::SecurityGroupEgress', {
-          GroupId: stack.resolve(sg.securityGroupId),
-          CidrIp: '0.0.0.0/0',
-          Description: 'Allow all outbound traffic by default',
-          IpProtocol: '-1',
-        }));
-        expect(stack).to(not(haveResourceLike('AWS::EC2::SecurityGroupIngress', {})));
-        test.done();
-      },
 
-      'addIngressRule rule will not remove external allowAllOutbound rule'(test: Test) {
-        // GIVEN
-        const stack = new Stack();
-        stack.node.setContext(SECURITY_GROUP_DISABLE_INLINE_RULES_CONTEXT_KEY, contextDisableInlineRules);
-        const vpc = new Vpc(stack, 'VPC');
-        const props: SecurityGroupProps = { vpc, allowAllOutbound: true, disableInlineRules: optionsDisableInlineRules };
+  describe('When allowAllOutbound', () => {
+    test('new SecurityGroup will create an external SecurityGroupEgress rule', () => {
+      // GIVEN
+      const stack = new Stack();
+      stack.node.setContext(SECURITY_GROUP_DISABLE_INLINE_RULES_CONTEXT_KEY, contextDisableInlineRules);
+      const vpc = new Vpc(stack, 'VPC');
+      const props: SecurityGroupProps = { vpc, allowAllOutbound: true, disableInlineRules: optionsDisableInlineRules };
+
+      // WHEN
+      const sg = new SecurityGroup(stack, 'SG1', props);
+
+      expect(stack).toHaveResource('AWS::EC2::SecurityGroup', {
+        GroupDescription: 'Default/SG1',
+        VpcId: stack.resolve(vpc.vpcId),
+      });
+      expect(stack).toHaveResource('AWS::EC2::SecurityGroupEgress', {
+        GroupId: stack.resolve(sg.securityGroupId),
+        CidrIp: '0.0.0.0/0',
+        Description: 'Allow all outbound traffic by default',
+        IpProtocol: '-1',
+      });
+      expect(stack).not.toHaveResourceLike('AWS::EC2::SecurityGroupIngress', {});
 
-        // WHEN
-        const sg = new SecurityGroup(stack, 'SG1', props);
-        sg.addEgressRule(Peer.anyIpv4(), Port.tcp(86), 'An external Rule');
+    });
 
-        expect(stack).to(haveResource('AWS::EC2::SecurityGroup', {
-          GroupDescription: 'Default/SG1',
-          VpcId: stack.resolve(vpc.vpcId),
-        }));
+    test('addIngressRule rule will not remove external allowAllOutbound rule', () => {
+      // GIVEN
+      const stack = new Stack();
+      stack.node.setContext(SECURITY_GROUP_DISABLE_INLINE_RULES_CONTEXT_KEY, contextDisableInlineRules);
+      const vpc = new Vpc(stack, 'VPC');
+      const props: SecurityGroupProps = { vpc, allowAllOutbound: true, disableInlineRules: optionsDisableInlineRules };
 
-        expect(stack).to(haveResource('AWS::EC2::SecurityGroupEgress', {
-          GroupId: stack.resolve(sg.securityGroupId),
-          CidrIp: '0.0.0.0/0',
-          Description: 'Allow all outbound traffic by default',
-          IpProtocol: '-1',
-        }));
+      // WHEN
+      const sg = new SecurityGroup(stack, 'SG1', props);
+      sg.addEgressRule(Peer.anyIpv4(), Port.tcp(86), 'An external Rule');
 
-        expect(stack).to(not(haveResourceLike('AWS::EC2::SecurityGroupIngress', {})));
-        test.done();
-      },
+      expect(stack).toHaveResource('AWS::EC2::SecurityGroup', {
+        GroupDescription: 'Default/SG1',
+        VpcId: stack.resolve(vpc.vpcId),
+      });
 
-      'addIngressRule rule will not add a new egress rule'(test: Test) {
-        // GIVEN
-        const stack = new Stack();
-        stack.node.setContext(SECURITY_GROUP_DISABLE_INLINE_RULES_CONTEXT_KEY, contextDisableInlineRules);
-        const vpc = new Vpc(stack, 'VPC');
-        const props: SecurityGroupProps = { vpc, allowAllOutbound: true, disableInlineRules: optionsDisableInlineRules };
-
-        // WHEN
-        const sg = new SecurityGroup(stack, 'SG1', props);
-        sg.addEgressRule(Peer.anyIpv4(), Port.tcp(86), 'An external Rule');
-
-        expect(stack).to(haveResource('AWS::EC2::SecurityGroup', {
-          GroupDescription: 'Default/SG1',
-          VpcId: stack.resolve(vpc.vpcId),
-        }));
-
-        expect(stack).to(not(haveResource('AWS::EC2::SecurityGroupEgress', {
-          GroupId: stack.resolve(sg.securityGroupId),
-          Description: 'An external Rule',
-        })));
-
-        expect(stack).to(not(haveResourceLike('AWS::EC2::SecurityGroupIngress', {})));
-        test.done();
-      },
+      expect(stack).toHaveResource('AWS::EC2::SecurityGroupEgress', {
+        GroupId: stack.resolve(sg.securityGroupId),
+        CidrIp: '0.0.0.0/0',
+        Description: 'Allow all outbound traffic by default',
+        IpProtocol: '-1',
+      });
 
-      'addIngressRule rule will add a new external ingress rule even if it could have been inlined'(test: Test) {
-        // GIVEN
-        const stack = new Stack();
-        stack.node.setContext(SECURITY_GROUP_DISABLE_INLINE_RULES_CONTEXT_KEY, contextDisableInlineRules);
-        const vpc = new Vpc(stack, 'VPC');
-        const props: SecurityGroupProps = { vpc, allowAllOutbound: true, disableInlineRules: optionsDisableInlineRules };
+      expect(stack).not.toHaveResourceLike('AWS::EC2::SecurityGroupIngress', {});
 
-        // WHEN
-        const sg = new SecurityGroup(stack, 'SG1', props);
-        sg.addIngressRule(Peer.anyIpv4(), Port.tcp(86), 'An external Rule');
+    });
 
-        expect(stack).to(haveResource('AWS::EC2::SecurityGroup', {
-          GroupDescription: 'Default/SG1',
-          VpcId: stack.resolve(vpc.vpcId),
-        }));
+    test('addIngressRule rule will not add a new egress rule', () => {
+      // GIVEN
+      const stack = new Stack();
+      stack.node.setContext(SECURITY_GROUP_DISABLE_INLINE_RULES_CONTEXT_KEY, contextDisableInlineRules);
+      const vpc = new Vpc(stack, 'VPC');
+      const props: SecurityGroupProps = { vpc, allowAllOutbound: true, disableInlineRules: optionsDisableInlineRules };
 
-        expect(stack).to(haveResource('AWS::EC2::SecurityGroupIngress', {
-          GroupId: stack.resolve(sg.securityGroupId),
-          CidrIp: '0.0.0.0/0',
-          Description: 'An external Rule',
-          FromPort: 86,
-          IpProtocol: 'tcp',
-          ToPort: 86,
-        }));
+      // WHEN
+      const sg = new SecurityGroup(stack, 'SG1', props);
+      sg.addEgressRule(Peer.anyIpv4(), Port.tcp(86), 'An external Rule');
 
-        expect(stack).to(haveResource('AWS::EC2::SecurityGroupEgress', {
-          GroupId: stack.resolve(sg.securityGroupId),
-          CidrIp: '0.0.0.0/0',
-          Description: 'Allow all outbound traffic by default',
-          IpProtocol: '-1',
-        }));
-        test.done();
-      },
-    },
-
-    'When do not allowAllOutbound': {
-      'new SecurityGroup rule will create an external egress rule that denies all traffic'(test: Test) {
-        // GIVEN
-        const stack = new Stack();
-        stack.node.setContext(SECURITY_GROUP_DISABLE_INLINE_RULES_CONTEXT_KEY, contextDisableInlineRules);
-        const vpc = new Vpc(stack, 'VPC');
-        const props: SecurityGroupProps = { vpc, allowAllOutbound: false, disableInlineRules: optionsDisableInlineRules };
-
-        // WHEN
-        const sg = new SecurityGroup(stack, 'SG1', props);
-
-        expect(stack).to(haveResource('AWS::EC2::SecurityGroup', {
-          GroupDescription: 'Default/SG1',
-          VpcId: stack.resolve(vpc.vpcId),
-        }));
-        expect(stack).to(not(haveResourceLike('AWS::EC2::SecurityGroupIngress', {})));
-        expect(stack).to(haveResource('AWS::EC2::SecurityGroupEgress', {
-          GroupId: stack.resolve(sg.securityGroupId),
-          CidrIp: '255.255.255.255/32',
-          Description: 'Disallow all traffic',
-          IpProtocol: 'icmp',
-          FromPort: 252,
-          ToPort: 86,
-        }));
-        test.done();
-      },
+      expect(stack).toHaveResource('AWS::EC2::SecurityGroup', {
+        GroupDescription: 'Default/SG1',
+        VpcId: stack.resolve(vpc.vpcId),
+      });
 
-      'addEgressRule rule will remove the rule that denies all traffic if another egress rule is added'(test: Test) {
-        // GIVEN
-        const stack = new Stack();
-        stack.node.setContext(SECURITY_GROUP_DISABLE_INLINE_RULES_CONTEXT_KEY, contextDisableInlineRules);
-        const vpc = new Vpc(stack, 'VPC');
-        const props: SecurityGroupProps = { vpc, allowAllOutbound: false, disableInlineRules: optionsDisableInlineRules };
-
-        // WHEN
-        const sg = new SecurityGroup(stack, 'SG1', props);
-        sg.addEgressRule(Peer.anyIpv4(), Port.tcp(86), 'An external Rule');
-
-        expect(stack).to(haveResource('AWS::EC2::SecurityGroup', {
-          GroupDescription: 'Default/SG1',
-          VpcId: stack.resolve(vpc.vpcId),
-        }));
-        expect(stack).to(not(haveResourceLike('AWS::EC2::SecurityGroupIngress', {})));
-        expect(stack).to(not(haveResourceLike('AWS::EC2::SecurityGroupEgress', {
-          GroupId: stack.resolve(sg.securityGroupId),
-          CidrIp: '255.255.255.255/32',
-        })));
-        test.done();
-      },
+      expect(stack).not.toHaveResource('AWS::EC2::SecurityGroupEgress', {
+        GroupId: stack.resolve(sg.securityGroupId),
+        Description: 'An external Rule',
+      });
 
-      'addEgressRule rule will add a new external egress rule even if it could have been inlined'(test: Test) {
-        // GIVEN
-        const stack = new Stack();
-        stack.node.setContext(SECURITY_GROUP_DISABLE_INLINE_RULES_CONTEXT_KEY, contextDisableInlineRules);
-        const vpc = new Vpc(stack, 'VPC');
-        const props: SecurityGroupProps = { vpc, allowAllOutbound: false, disableInlineRules: optionsDisableInlineRules };
+      expect(stack).not.toHaveResourceLike('AWS::EC2::SecurityGroupIngress', {});
 
-        // WHEN
-        const sg = new SecurityGroup(stack, 'SG1', props);
-        sg.addEgressRule(Peer.anyIpv4(), Port.tcp(86), 'An external Rule');
+    });
 
-        expect(stack).to(haveResource('AWS::EC2::SecurityGroup', {
-          GroupDescription: 'Default/SG1',
-          VpcId: stack.resolve(vpc.vpcId),
-        }));
+    test('addIngressRule rule will add a new external ingress rule even if it could have been inlined', () => {
+      // GIVEN
+      const stack = new Stack();
+      stack.node.setContext(SECURITY_GROUP_DISABLE_INLINE_RULES_CONTEXT_KEY, contextDisableInlineRules);
+      const vpc = new Vpc(stack, 'VPC');
+      const props: SecurityGroupProps = { vpc, allowAllOutbound: true, disableInlineRules: optionsDisableInlineRules };
+
+      // WHEN
+      const sg = new SecurityGroup(stack, 'SG1', props);
+      sg.addIngressRule(Peer.anyIpv4(), Port.tcp(86), 'An external Rule');
+
+      expect(stack).toHaveResource('AWS::EC2::SecurityGroup', {
+        GroupDescription: 'Default/SG1',
+        VpcId: stack.resolve(vpc.vpcId),
+      });
+
+      expect(stack).toHaveResource('AWS::EC2::SecurityGroupIngress', {
+        GroupId: stack.resolve(sg.securityGroupId),
+        CidrIp: '0.0.0.0/0',
+        Description: 'An external Rule',
+        FromPort: 86,
+        IpProtocol: 'tcp',
+        ToPort: 86,
+      });
+
+      expect(stack).toHaveResource('AWS::EC2::SecurityGroupEgress', {
+        GroupId: stack.resolve(sg.securityGroupId),
+        CidrIp: '0.0.0.0/0',
+        Description: 'Allow all outbound traffic by default',
+        IpProtocol: '-1',
+      });
 
-        expect(stack).to(haveResource('AWS::EC2::SecurityGroupEgress', {
-          GroupId: stack.resolve(sg.securityGroupId),
-          CidrIp: '0.0.0.0/0',
-          Description: 'An external Rule',
-          FromPort: 86,
-          IpProtocol: 'tcp',
-          ToPort: 86,
-        }));
+    });
+  });
 
-        expect(stack).to(not(haveResourceLike('AWS::EC2::SecurityGroupIngress', {})));
-        test.done();
-      },
+  describe('When do not allowAllOutbound', () => {
+    test('new SecurityGroup rule will create an external egress rule that denies all traffic', () => {
+      // GIVEN
+      const stack = new Stack();
+      stack.node.setContext(SECURITY_GROUP_DISABLE_INLINE_RULES_CONTEXT_KEY, contextDisableInlineRules);
+      const vpc = new Vpc(stack, 'VPC');
+      const props: SecurityGroupProps = { vpc, allowAllOutbound: false, disableInlineRules: optionsDisableInlineRules };
+
+      // WHEN
+      const sg = new SecurityGroup(stack, 'SG1', props);
+
+      expect(stack).toHaveResource('AWS::EC2::SecurityGroup', {
+        GroupDescription: 'Default/SG1',
+        VpcId: stack.resolve(vpc.vpcId),
+      });
+      expect(stack).not.toHaveResourceLike('AWS::EC2::SecurityGroupIngress', {});
+      expect(stack).toHaveResource('AWS::EC2::SecurityGroupEgress', {
+        GroupId: stack.resolve(sg.securityGroupId),
+        CidrIp: '255.255.255.255/32',
+        Description: 'Disallow all traffic',
+        IpProtocol: 'icmp',
+        FromPort: 252,
+        ToPort: 86,
+      });
 
-      'addIngressRule will add a new external ingress rule even if it could have been inlined'(test: Test) {
-        // GIVEN
-        const stack = new Stack();
-        stack.node.setContext(SECURITY_GROUP_DISABLE_INLINE_RULES_CONTEXT_KEY, contextDisableInlineRules);
-        const vpc = new Vpc(stack, 'VPC');
-        const props: SecurityGroupProps = { vpc, allowAllOutbound: false, disableInlineRules: optionsDisableInlineRules };
+    });
 
-        // WHEN
-        const sg = new SecurityGroup(stack, 'SG1', props);
-        sg.addIngressRule(Peer.anyIpv4(), Port.tcp(86), 'An external Rule');
+    test('addEgressRule rule will remove the rule that denies all traffic if another egress rule is added', () => {
+      // GIVEN
+      const stack = new Stack();
+      stack.node.setContext(SECURITY_GROUP_DISABLE_INLINE_RULES_CONTEXT_KEY, contextDisableInlineRules);
+      const vpc = new Vpc(stack, 'VPC');
+      const props: SecurityGroupProps = { vpc, allowAllOutbound: false, disableInlineRules: optionsDisableInlineRules };
+
+      // WHEN
+      const sg = new SecurityGroup(stack, 'SG1', props);
+      sg.addEgressRule(Peer.anyIpv4(), Port.tcp(86), 'An external Rule');
+
+      expect(stack).toHaveResource('AWS::EC2::SecurityGroup', {
+        GroupDescription: 'Default/SG1',
+        VpcId: stack.resolve(vpc.vpcId),
+      });
+      expect(stack).not.toHaveResourceLike('AWS::EC2::SecurityGroupIngress', {});
+      expect(stack).not.toHaveResourceLike('AWS::EC2::SecurityGroupEgress', {
+        GroupId: stack.resolve(sg.securityGroupId),
+        CidrIp: '255.255.255.255/32',
+      });
 
-        expect(stack).to(haveResource('AWS::EC2::SecurityGroup', {
-          GroupDescription: 'Default/SG1',
-          VpcId: stack.resolve(vpc.vpcId),
-        }));
+    });
 
-        expect(stack).to(haveResource('AWS::EC2::SecurityGroupIngress', {
-          GroupId: stack.resolve(sg.securityGroupId),
-          CidrIp: '0.0.0.0/0',
-          Description: 'An external Rule',
-          FromPort: 86,
-          IpProtocol: 'tcp',
-          ToPort: 86,
-        }));
+    test('addEgressRule rule will add a new external egress rule even if it could have been inlined', () => {
+      // GIVEN
+      const stack = new Stack();
+      stack.node.setContext(SECURITY_GROUP_DISABLE_INLINE_RULES_CONTEXT_KEY, contextDisableInlineRules);
+      const vpc = new Vpc(stack, 'VPC');
+      const props: SecurityGroupProps = { vpc, allowAllOutbound: false, disableInlineRules: optionsDisableInlineRules };
+
+      // WHEN
+      const sg = new SecurityGroup(stack, 'SG1', props);
+      sg.addEgressRule(Peer.anyIpv4(), Port.tcp(86), 'An external Rule');
+
+      expect(stack).toHaveResource('AWS::EC2::SecurityGroup', {
+        GroupDescription: 'Default/SG1',
+        VpcId: stack.resolve(vpc.vpcId),
+      });
+
+      expect(stack).toHaveResource('AWS::EC2::SecurityGroupEgress', {
+        GroupId: stack.resolve(sg.securityGroupId),
+        CidrIp: '0.0.0.0/0',
+        Description: 'An external Rule',
+        FromPort: 86,
+        IpProtocol: 'tcp',
+        ToPort: 86,
+      });
+
+      expect(stack).not.toHaveResourceLike('AWS::EC2::SecurityGroupIngress', {});
+
+    });
+
+    test('addIngressRule will add a new external ingress rule even if it could have been inlined', () => {
+      // GIVEN
+      const stack = new Stack();
+      stack.node.setContext(SECURITY_GROUP_DISABLE_INLINE_RULES_CONTEXT_KEY, contextDisableInlineRules);
+      const vpc = new Vpc(stack, 'VPC');
+      const props: SecurityGroupProps = { vpc, allowAllOutbound: false, disableInlineRules: optionsDisableInlineRules };
+
+      // WHEN
+      const sg = new SecurityGroup(stack, 'SG1', props);
+      sg.addIngressRule(Peer.anyIpv4(), Port.tcp(86), 'An external Rule');
+
+      expect(stack).toHaveResource('AWS::EC2::SecurityGroup', {
+        GroupDescription: 'Default/SG1',
+        VpcId: stack.resolve(vpc.vpcId),
+      });
+
+      expect(stack).toHaveResource('AWS::EC2::SecurityGroupIngress', {
+        GroupId: stack.resolve(sg.securityGroupId),
+        CidrIp: '0.0.0.0/0',
+        Description: 'An external Rule',
+        FromPort: 86,
+        IpProtocol: 'tcp',
+        ToPort: 86,
+      });
+
+      expect(stack).toHaveResource('AWS::EC2::SecurityGroupEgress', {
+        GroupId: stack.resolve(sg.securityGroupId),
+        CidrIp: '255.255.255.255/32',
+        Description: 'Disallow all traffic',
+        IpProtocol: 'icmp',
+        FromPort: 252,
+        ToPort: 86,
+      });
+
+    });
+  });
 
-        expect(stack).to(haveResource('AWS::EC2::SecurityGroupEgress', {
-          GroupId: stack.resolve(sg.securityGroupId),
-          CidrIp: '255.255.255.255/32',
-          Description: 'Disallow all traffic',
-          IpProtocol: 'icmp',
-          FromPort: 252,
-          ToPort: 86,
-        }));
-        test.done();
-      },
-    },
-  };
 }
\ No newline at end of file
diff --git a/packages/@aws-cdk/aws-ec2/test/userdata.test.ts b/packages/@aws-cdk/aws-ec2/test/userdata.test.ts
index c3a7538c07f66..272ad60a84b00 100644
--- a/packages/@aws-cdk/aws-ec2/test/userdata.test.ts
+++ b/packages/@aws-cdk/aws-ec2/test/userdata.test.ts
@@ -1,10 +1,9 @@
 import { Bucket } from '@aws-cdk/aws-s3';
 import { Aws, Stack } from '@aws-cdk/core';
-import { nodeunitShim, Test } from 'nodeunit-shim';
 import * as ec2 from '../lib';
 
-nodeunitShim({
-  'can create Windows user data'(test: Test) {
+describe('user data', () => {
+  test('can create Windows user data', () => {
     // GIVEN
 
     // WHEN
@@ -13,10 +12,10 @@ nodeunitShim({
 
     // THEN
     const rendered = userData.render();
-    test.equals(rendered, '<powershell>command1\ncommand2</powershell>');
-    test.done();
-  },
-  'can create Windows user data with commands on exit'(test: Test) {
+    expect(rendered).toEqual('<powershell>command1\ncommand2</powershell>');
+
+  });
+  test('can create Windows user data with commands on exit', () => {
     // GIVEN
     const userData = ec2.UserData.forWindows();
 
@@ -26,7 +25,7 @@ nodeunitShim({
 
     // THEN
     const rendered = userData.render();
-    test.equals(rendered, '<powershell>trap {\n' +
+    expect(rendered).toEqual('<powershell>trap {\n' +
         '$success=($PSItem.Exception.Message -eq "Success")\n' +
         'onexit1\n' +
         'onexit2\n' +
@@ -35,9 +34,9 @@ nodeunitShim({
         'command1\n' +
         'command2\n' +
         'throw "Success"</powershell>');
-    test.done();
-  },
-  'can create Windows with Signal Command'(test: Test) {
+
+  });
+  test('can create Windows with Signal Command', () => {
     // GIVEN
     const stack = new Stack();
     const resource = new ec2.Vpc(stack, 'RESOURCE');
@@ -50,7 +49,7 @@ nodeunitShim({
     // THEN
     const rendered = userData.render();
 
-    test.equals(rendered, '<powershell>trap {\n' +
+    expect(rendered).toEqual('<powershell>trap {\n' +
         '$success=($PSItem.Exception.Message -eq "Success")\n' +
         `cfn-signal --stack Default --resource RESOURCE1989552F --region ${Aws.REGION} --success ($success.ToString().ToLower())\n` +
         'break\n' +
@@ -58,9 +57,9 @@ nodeunitShim({
         'command1\n' +
         'throw "Success"</powershell>',
     );
-    test.done();
-  },
-  'can windows userdata download S3 files'(test: Test) {
+
+  });
+  test('can windows userdata download S3 files', () => {
     // GIVEN
     const stack = new Stack();
     const userData = ec2.UserData.forWindows();
@@ -80,14 +79,14 @@ nodeunitShim({
 
     // THEN
     const rendered = userData.render();
-    test.equals(rendered, '<powershell>mkdir (Split-Path -Path \'C:/temp/filename.bat\' ) -ea 0\n' +
+    expect(rendered).toEqual('<powershell>mkdir (Split-Path -Path \'C:/temp/filename.bat\' ) -ea 0\n' +
       'Read-S3Object -BucketName \'test\' -key \'filename.bat\' -file \'C:/temp/filename.bat\' -ErrorAction Stop\n' +
       'mkdir (Split-Path -Path \'c:\\test\\location\\otherScript.bat\' ) -ea 0\n' +
       'Read-S3Object -BucketName \'test2\' -key \'filename2.bat\' -file \'c:\\test\\location\\otherScript.bat\' -ErrorAction Stop</powershell>',
     );
-    test.done();
-  },
-  'can windows userdata execute files'(test: Test) {
+
+  });
+  test('can windows userdata execute files', () => {
     // GIVEN
     const userData = ec2.UserData.forWindows();
 
@@ -102,14 +101,14 @@ nodeunitShim({
 
     // THEN
     const rendered = userData.render();
-    test.equals(rendered, '<powershell>&\'C:\\test\\filename.bat\'\n' +
+    expect(rendered).toEqual('<powershell>&\'C:\\test\\filename.bat\'\n' +
       'if (!$?) { Write-Error \'Failed to execute the file "C:\\test\\filename.bat"\' -ErrorAction Stop }\n' +
       '&\'C:\\test\\filename2.bat\' arg1 arg2 -arg $variable\n' +
       'if (!$?) { Write-Error \'Failed to execute the file "C:\\test\\filename2.bat"\' -ErrorAction Stop }</powershell>',
     );
-    test.done();
-  },
-  'can create Linux user data'(test: Test) {
+
+  });
+  test('can create Linux user data', () => {
     // GIVEN
 
     // WHEN
@@ -118,10 +117,10 @@ nodeunitShim({
 
     // THEN
     const rendered = userData.render();
-    test.equals(rendered, '#!/bin/bash\ncommand1\ncommand2');
-    test.done();
-  },
-  'can create Linux user data with commands on exit'(test: Test) {
+    expect(rendered).toEqual('#!/bin/bash\ncommand1\ncommand2');
+
+  });
+  test('can create Linux user data with commands on exit', () => {
     // GIVEN
     const userData = ec2.UserData.forLinux();
 
@@ -131,7 +130,7 @@ nodeunitShim({
 
     // THEN
     const rendered = userData.render();
-    test.equals(rendered, '#!/bin/bash\n' +
+    expect(rendered).toEqual('#!/bin/bash\n' +
         'function exitTrap(){\n' +
         'exitCode=$?\n' +
         'onexit1\n' +
@@ -140,9 +139,9 @@ nodeunitShim({
         'trap exitTrap EXIT\n' +
         'command1\n' +
         'command2');
-    test.done();
-  },
-  'can create Linux with Signal Command'(test: Test) {
+
+  });
+  test('can create Linux with Signal Command', () => {
     // GIVEN
     const stack = new Stack();
     const resource = new ec2.Vpc(stack, 'RESOURCE');
@@ -154,16 +153,16 @@ nodeunitShim({
 
     // THEN
     const rendered = userData.render();
-    test.equals(rendered, '#!/bin/bash\n' +
+    expect(rendered).toEqual('#!/bin/bash\n' +
         'function exitTrap(){\n' +
         'exitCode=$?\n' +
         `/opt/aws/bin/cfn-signal --stack Default --resource RESOURCE1989552F --region ${Aws.REGION} -e $exitCode || echo \'Failed to send Cloudformation Signal\'\n` +
         '}\n' +
         'trap exitTrap EXIT\n' +
         'command1');
-    test.done();
-  },
-  'can linux userdata download S3 files'(test: Test) {
+
+  });
+  test('can linux userdata download S3 files', () => {
     // GIVEN
     const stack = new Stack();
     const userData = ec2.UserData.forLinux();
@@ -183,15 +182,15 @@ nodeunitShim({
 
     // THEN
     const rendered = userData.render();
-    test.equals(rendered, '#!/bin/bash\n' +
+    expect(rendered).toEqual('#!/bin/bash\n' +
       'mkdir -p $(dirname \'/tmp/filename.sh\')\n' +
       'aws s3 cp \'s3://test/filename.sh\' \'/tmp/filename.sh\'\n' +
       'mkdir -p $(dirname \'c:\\test\\location\\otherScript.sh\')\n' +
       'aws s3 cp \'s3://test2/filename2.sh\' \'c:\\test\\location\\otherScript.sh\'',
     );
-    test.done();
-  },
-  'can linux userdata execute files'(test: Test) {
+
+  });
+  test('can linux userdata execute files', () => {
     // GIVEN
     const userData = ec2.UserData.forLinux();
 
@@ -206,7 +205,7 @@ nodeunitShim({
 
     // THEN
     const rendered = userData.render();
-    test.equals(rendered, '#!/bin/bash\n' +
+    expect(rendered).toEqual('#!/bin/bash\n' +
       'set -e\n' +
       'chmod +x \'/tmp/filename.sh\'\n' +
       '\'/tmp/filename.sh\'\n' +
@@ -214,9 +213,9 @@ nodeunitShim({
       'chmod +x \'/test/filename2.sh\'\n' +
       '\'/test/filename2.sh\' arg1 arg2 -arg $variable',
     );
-    test.done();
-  },
-  'can create Custom user data'(test: Test) {
+
+  });
+  test('can create Custom user data', () => {
     // GIVEN
 
     // WHEN
@@ -224,19 +223,19 @@ nodeunitShim({
 
     // THEN
     const rendered = userData.render();
-    test.equals(rendered, 'Some\nmultiline\ncontent');
-    test.done();
-  },
-  'Custom user data throws when adding on exit commands'(test: Test) {
+    expect(rendered).toEqual('Some\nmultiline\ncontent');
+
+  });
+  test('Custom user data throws when adding on exit commands', () => {
     // GIVEN
     // WHEN
     const userData = ec2.UserData.custom('');
 
     // THEN
-    test.throws(() => userData.addOnExitCommands( 'a command goes here' ));
-    test.done();
-  },
-  'Custom user data throws when adding signal command'(test: Test) {
+    expect(() => userData.addOnExitCommands( 'a command goes here' )).toThrow();
+
+  });
+  test('Custom user data throws when adding signal command', () => {
     // GIVEN
     const stack = new Stack();
     const resource = new ec2.Vpc(stack, 'RESOURCE');
@@ -245,35 +244,35 @@ nodeunitShim({
     const userData = ec2.UserData.custom('');
 
     // THEN
-    test.throws(() => userData.addSignalOnExitCommand( resource ));
-    test.done();
-  },
-  'Custom user data throws when downloading file'(test: Test) {
+    expect(() => userData.addSignalOnExitCommand( resource )).toThrow();
+
+  });
+  test('Custom user data throws when downloading file', () => {
     // GIVEN
     const stack = new Stack();
     const userData = ec2.UserData.custom('');
     const bucket = Bucket.fromBucketName( stack, 'testBucket', 'test' );
     // WHEN
     // THEN
-    test.throws(() => userData.addS3DownloadCommand({
+    expect(() => userData.addS3DownloadCommand({
       bucket,
       bucketKey: 'filename.sh',
-    } ));
-    test.done();
-  },
-  'Custom user data throws when executing file'(test: Test) {
+    })).toThrow();
+
+  });
+  test('Custom user data throws when executing file', () => {
     // GIVEN
     const userData = ec2.UserData.custom('');
     // WHEN
     // THEN
-    test.throws(() =>
+    expect(() =>
       userData.addExecuteFileCommand({
         filePath: '/tmp/filename.sh',
-      } ));
-    test.done();
-  },
+      })).toThrow();
 
-  'Linux user rendering multipart headers'(test: Test) {
+  });
+
+  test('Linux user rendering multipart headers', () => {
     // GIVEN
     const stack = new Stack();
     const linuxUserData = ec2.UserData.forLinux();
@@ -297,10 +296,10 @@ nodeunitShim({
       { 'Fn::Base64': '#!/bin/bash\necho \"Hello world\"' },
     ]);
 
-    test.done();
-  },
 
-  'Default parts separator used, if not specified'(test: Test) {
+  });
+
+  test('Default parts separator used, if not specified', () => {
     // GIVEN
     const multipart = new ec2.MultipartUserData();
 
@@ -312,7 +311,7 @@ nodeunitShim({
     const out = multipart.render();
 
     // WHEN
-    test.equals(out, [
+    expect(out).toEqual([
       'Content-Type: multipart/mixed; boundary=\"+AWS+CDK+User+Data+Separator==\"',
       'MIME-Version: 1.0',
       '',
@@ -323,10 +322,10 @@ nodeunitShim({
       '',
     ].join('\n'));
 
-    test.done();
-  },
 
-  'Non-default parts separator used, if not specified'(test: Test) {
+  });
+
+  test('Non-default parts separator used, if not specified', () => {
     // GIVEN
     const multipart = new ec2.MultipartUserData({
       partsSeparator: '//',
@@ -340,7 +339,7 @@ nodeunitShim({
     const out = multipart.render();
 
     // WHEN
-    test.equals(out, [
+    expect(out).toEqual([
       'Content-Type: multipart/mixed; boundary=\"//\"',
       'MIME-Version: 1.0',
       '',
@@ -351,35 +350,35 @@ nodeunitShim({
       '',
     ].join('\n'));
 
-    test.done();
-  },
 
-  'Multipart separator validation'(test: Test) {
+  });
+
+  test('Multipart separator validation', () => {
     // Happy path
     new ec2.MultipartUserData();
     new ec2.MultipartUserData({
       partsSeparator: 'a-zA-Z0-9()+,-./:=?',
     });
 
-    [' ', '\n', '\r', '[', ']', '<', '>', '違う'].forEach(s => test.throws(() => {
+    [' ', '\n', '\r', '[', ']', '<', '>', '違う'].forEach(s => expect(() => {
       new ec2.MultipartUserData({
         partsSeparator: s,
       });
-    }, /Invalid characters in separator/));
+    }).toThrow(/Invalid characters in separator/));
 
-    test.done();
-  },
 
-  'Multipart user data throws when adding on exit commands'(test: Test) {
+  });
+
+  test('Multipart user data throws when adding on exit commands', () => {
     // GIVEN
     // WHEN
     const userData = new ec2.MultipartUserData();
 
     // THEN
-    test.throws(() => userData.addOnExitCommands( 'a command goes here' ));
-    test.done();
-  },
-  'Multipart user data throws when adding signal command'(test: Test) {
+    expect(() => userData.addOnExitCommands( 'a command goes here' )).toThrow();
+
+  });
+  test('Multipart user data throws when adding signal command', () => {
     // GIVEN
     const stack = new Stack();
     const resource = new ec2.Vpc(stack, 'RESOURCE');
@@ -388,36 +387,36 @@ nodeunitShim({
     const userData = new ec2.MultipartUserData();
 
     // THEN
-    test.throws(() => userData.addSignalOnExitCommand( resource ));
-    test.done();
-  },
-  'Multipart user data throws when downloading file'(test: Test) {
+    expect(() => userData.addSignalOnExitCommand( resource )).toThrow();
+
+  });
+  test('Multipart user data throws when downloading file', () => {
     // GIVEN
     const stack = new Stack();
     const userData = new ec2.MultipartUserData();
     const bucket = Bucket.fromBucketName( stack, 'testBucket', 'test' );
     // WHEN
     // THEN
-    test.throws(() => userData.addS3DownloadCommand({
+    expect(() => userData.addS3DownloadCommand({
       bucket,
       bucketKey: 'filename.sh',
-    } ));
-    test.done();
-  },
-  'Multipart user data throws when executing file'(test: Test) {
+    } )).toThrow();
+
+  });
+  test('Multipart user data throws when executing file', () => {
     // GIVEN
     const userData = new ec2.MultipartUserData();
 
     // WHEN
     // THEN
-    test.throws(() =>
+    expect(() =>
       userData.addExecuteFileCommand({
         filePath: '/tmp/filename.sh',
-      } ));
-    test.done();
-  },
+      } )).toThrow();
+
+  });
 
-  'can add commands to Multipart user data'(test: Test) {
+  test('can add commands to Multipart user data', () => {
     // GIVEN
     const stack = new Stack();
     const innerUserData = ec2.UserData.forLinux();
@@ -430,9 +429,9 @@ nodeunitShim({
     // THEN
     const expectedInner = '#!/bin/bash\ncommand1\ncommand2';
     const rendered = innerUserData.render();
-    test.equals(rendered, expectedInner);
+    expect(rendered).toEqual(expectedInner);
     const out = stack.resolve(userData.render());
-    test.equals(out, {
+    expect(out).toEqual({
       'Fn::Join': [
         '',
         [
@@ -453,9 +452,9 @@ nodeunitShim({
         ],
       ],
     });
-    test.done();
-  },
-  'can add commands on exit to Multipart user data'(test: Test) {
+
+  });
+  test('can add commands on exit to Multipart user data', () => {
     // GIVEN
     const stack = new Stack();
     const innerUserData = ec2.UserData.forLinux();
@@ -477,9 +476,9 @@ nodeunitShim({
     'command1\n' +
     'command2';
     const rendered = stack.resolve(innerUserData.render());
-    test.equals(rendered, expectedInner);
+    expect(rendered).toEqual(expectedInner);
     const out = stack.resolve(userData.render());
-    test.equals(out, {
+    expect(out).toEqual({
       'Fn::Join': [
         '',
         [
@@ -500,9 +499,9 @@ nodeunitShim({
         ],
       ],
     });
-    test.done();
-  },
-  'can add Signal Command to Multipart user data'(test: Test) {
+
+  });
+  test('can add Signal Command to Multipart user data', () => {
     // GIVEN
     const stack = new Stack();
     const resource = new ec2.Vpc(stack, 'RESOURCE');
@@ -523,9 +522,9 @@ nodeunitShim({
     'trap exitTrap EXIT\n' +
     'command1');
     const rendered = stack.resolve(innerUserData.render());
-    test.equals(rendered, expectedInner);
+    expect(rendered).toEqual(expectedInner);
     const out = stack.resolve(userData.render());
-    test.equals(out, {
+    expect(out).toEqual({
       'Fn::Join': [
         '',
         [
@@ -546,9 +545,9 @@ nodeunitShim({
         ],
       ],
     });
-    test.done();
-  },
-  'can add download S3 files to Multipart user data'(test: Test) {
+
+  });
+  test('can add download S3 files to Multipart user data', () => {
     // GIVEN
     const stack = new Stack();
     const innerUserData = ec2.UserData.forLinux();
@@ -575,9 +574,9 @@ nodeunitShim({
     'mkdir -p $(dirname \'c:\\test\\location\\otherScript.sh\')\n' +
     'aws s3 cp \'s3://test2/filename2.sh\' \'c:\\test\\location\\otherScript.sh\'';
     const rendered = stack.resolve(innerUserData.render());
-    test.equals(rendered, expectedInner);
+    expect(rendered).toEqual(expectedInner);
     const out = stack.resolve(userData.render());
-    test.equals(out, {
+    expect(out).toEqual({
       'Fn::Join': [
         '',
         [
@@ -598,9 +597,9 @@ nodeunitShim({
         ],
       ],
     });
-    test.done();
-  },
-  'can add execute files to Multipart user data'(test: Test) {
+
+  });
+  test('can add execute files to Multipart user data', () => {
     // GIVEN
     const stack = new Stack();
     const innerUserData = ec2.UserData.forLinux();
@@ -625,9 +624,9 @@ nodeunitShim({
     'chmod +x \'/test/filename2.sh\'\n' +
     '\'/test/filename2.sh\' arg1 arg2 -arg $variable';
     const rendered = stack.resolve(innerUserData.render());
-    test.equals(rendered, expectedInner);
+    expect(rendered).toEqual(expectedInner);
     const out = stack.resolve(userData.render());
-    test.equals(out, {
+    expect(out).toEqual({
       'Fn::Join': [
         '',
         [
@@ -648,6 +647,6 @@ nodeunitShim({
         ],
       ],
     });
-    test.done();
-  },
+
+  });
 });
diff --git a/packages/@aws-cdk/aws-ec2/test/volume.test.ts b/packages/@aws-cdk/aws-ec2/test/volume.test.ts
index af88164fcc439..d33acadc3f8dc 100644
--- a/packages/@aws-cdk/aws-ec2/test/volume.test.ts
+++ b/packages/@aws-cdk/aws-ec2/test/volume.test.ts
@@ -1,8 +1,6 @@
+import '@aws-cdk/assert-internal/jest';
 import {
   arrayWith,
-  expect as cdkExpect,
-  haveResource,
-  haveResourceLike,
   ResourcePart,
 } from '@aws-cdk/assert-internal';
 import {
@@ -36,7 +34,7 @@ describe('volume', () => {
     });
 
     // THEN
-    cdkExpect(stack).to(haveResource('AWS::EC2::Volume', {
+    expect(stack).toHaveResource('AWS::EC2::Volume', {
       AvailabilityZone: 'us-east-1a',
       MultiAttachEnabled: false,
       Size: 8,
@@ -47,11 +45,11 @@ describe('volume', () => {
           Value: 'MyVolume',
         },
       ],
-    }, ResourcePart.Properties));
+    }, ResourcePart.Properties);
 
-    cdkExpect(stack).to(haveResource('AWS::EC2::Volume', {
+    expect(stack).toHaveResource('AWS::EC2::Volume', {
       DeletionPolicy: 'Retain',
-    }, ResourcePart.CompleteDefinition));
+    }, ResourcePart.CompleteDefinition);
   });
 
   test('fromVolumeAttributes', () => {
@@ -87,7 +85,7 @@ describe('volume', () => {
     cdk.Tags.of(volume).add('TagKey', 'TagValue');
 
     // THEN
-    cdkExpect(stack).to(haveResource('AWS::EC2::Volume', {
+    expect(stack).toHaveResource('AWS::EC2::Volume', {
       AvailabilityZone: 'us-east-1a',
       MultiAttachEnabled: false,
       Size: 8,
@@ -96,7 +94,7 @@ describe('volume', () => {
         Key: 'TagKey',
         Value: 'TagValue',
       }],
-    }, ResourcePart.Properties));
+    }, ResourcePart.Properties);
 
 
   });
@@ -113,9 +111,9 @@ describe('volume', () => {
     });
 
     // THEN
-    cdkExpect(stack).to(haveResourceLike('AWS::EC2::Volume', {
+    expect(stack).toHaveResourceLike('AWS::EC2::Volume', {
       AutoEnableIO: true,
-    }, ResourcePart.Properties));
+    }, ResourcePart.Properties);
 
 
   });
@@ -132,9 +130,9 @@ describe('volume', () => {
     });
 
     // THEN
-    cdkExpect(stack).to(haveResourceLike('AWS::EC2::Volume', {
+    expect(stack).toHaveResourceLike('AWS::EC2::Volume', {
       Encrypted: true,
-    }, ResourcePart.Properties));
+    }, ResourcePart.Properties);
 
 
   });
@@ -153,7 +151,7 @@ describe('volume', () => {
     });
 
     // THEN
-    cdkExpect(stack).to(haveResourceLike('AWS::EC2::Volume', {
+    expect(stack).toHaveResourceLike('AWS::EC2::Volume', {
       Encrypted: true,
       KmsKeyId: {
         'Fn::GetAtt': [
@@ -161,8 +159,8 @@ describe('volume', () => {
           'Arn',
         ],
       },
-    }, ResourcePart.Properties));
-    cdkExpect(stack).to(haveResourceLike('AWS::KMS::Key', {
+    }, ResourcePart.Properties);
+    expect(stack).toHaveResourceLike('AWS::KMS::Key', {
       KeyPolicy: {
         Statement: [
           {},
@@ -213,7 +211,7 @@ describe('volume', () => {
           },
         ],
       },
-    }));
+    });
 
 
   });
@@ -235,7 +233,7 @@ describe('volume', () => {
     });
 
     // THEN
-    cdkExpect(stack).to(haveResourceLike('AWS::KMS::Key', {
+    expect(stack).toHaveResourceLike('AWS::KMS::Key', {
       KeyPolicy: {
         Statement: [
           {},
@@ -248,7 +246,7 @@ describe('volume', () => {
           },
         ],
       },
-    }));
+    });
 
 
   });
@@ -266,10 +264,10 @@ describe('volume', () => {
     });
 
     // THEN
-    cdkExpect(stack).to(haveResourceLike('AWS::EC2::Volume', {
+    expect(stack).toHaveResourceLike('AWS::EC2::Volume', {
       Iops: 500,
       VolumeType: 'io1',
-    }, ResourcePart.Properties));
+    }, ResourcePart.Properties);
 
 
   });
@@ -288,9 +286,9 @@ describe('volume', () => {
     });
 
     // THEN
-    cdkExpect(stack).to(haveResourceLike('AWS::EC2::Volume', {
+    expect(stack).toHaveResourceLike('AWS::EC2::Volume', {
       MultiAttachEnabled: true,
-    }, ResourcePart.Properties));
+    }, ResourcePart.Properties);
 
 
   });
@@ -306,9 +304,9 @@ describe('volume', () => {
     });
 
     // THEN
-    cdkExpect(stack).to(haveResourceLike('AWS::EC2::Volume', {
+    expect(stack).toHaveResourceLike('AWS::EC2::Volume', {
       SnapshotId: 'snap-00000000',
-    }, ResourcePart.Properties));
+    }, ResourcePart.Properties);
 
 
   });
@@ -325,9 +323,9 @@ describe('volume', () => {
     });
 
     // THEN
-    cdkExpect(stack).to(haveResourceLike('AWS::EC2::Volume', {
+    expect(stack).toHaveResourceLike('AWS::EC2::Volume', {
       VolumeType: 'standard',
-    }, ResourcePart.Properties));
+    }, ResourcePart.Properties);
 
 
   });
@@ -345,9 +343,9 @@ describe('volume', () => {
     });
 
     // THEN
-    cdkExpect(stack).to(haveResourceLike('AWS::EC2::Volume', {
+    expect(stack).toHaveResourceLike('AWS::EC2::Volume', {
       VolumeType: 'io1',
-    }, ResourcePart.Properties));
+    }, ResourcePart.Properties);
 
 
   });
@@ -365,9 +363,9 @@ describe('volume', () => {
     });
 
     // THEN
-    cdkExpect(stack).to(haveResourceLike('AWS::EC2::Volume', {
+    expect(stack).toHaveResourceLike('AWS::EC2::Volume', {
       VolumeType: 'io2',
-    }, ResourcePart.Properties));
+    }, ResourcePart.Properties);
 
 
   });
@@ -384,9 +382,9 @@ describe('volume', () => {
     });
 
     // THEN
-    cdkExpect(stack).to(haveResourceLike('AWS::EC2::Volume', {
+    expect(stack).toHaveResourceLike('AWS::EC2::Volume', {
       VolumeType: 'gp2',
-    }, ResourcePart.Properties));
+    }, ResourcePart.Properties);
 
 
   });
@@ -403,9 +401,9 @@ describe('volume', () => {
     });
 
     // THEN
-    cdkExpect(stack).to(haveResourceLike('AWS::EC2::Volume', {
+    expect(stack).toHaveResourceLike('AWS::EC2::Volume', {
       VolumeType: 'gp3',
-    }, ResourcePart.Properties));
+    }, ResourcePart.Properties);
 
 
   });
@@ -422,9 +420,9 @@ describe('volume', () => {
     });
 
     // THEN
-    cdkExpect(stack).to(haveResourceLike('AWS::EC2::Volume', {
+    expect(stack).toHaveResourceLike('AWS::EC2::Volume', {
       VolumeType: 'st1',
-    }, ResourcePart.Properties));
+    }, ResourcePart.Properties);
 
 
   });
@@ -441,9 +439,9 @@ describe('volume', () => {
     });
 
     // THEN
-    cdkExpect(stack).to(haveResourceLike('AWS::EC2::Volume', {
+    expect(stack).toHaveResourceLike('AWS::EC2::Volume', {
       VolumeType: 'sc1',
-    }, ResourcePart.Properties));
+    }, ResourcePart.Properties);
 
 
   });
@@ -461,7 +459,7 @@ describe('volume', () => {
     volume.grantAttachVolume(role);
 
     // THEN
-    cdkExpect(stack).to(haveResource('AWS::IAM::Policy', {
+    expect(stack).toHaveResource('AWS::IAM::Policy', {
       PolicyDocument: {
         Version: '2012-10-17',
         Statement: [{
@@ -514,7 +512,7 @@ describe('volume', () => {
           ],
         }],
       },
-    }));
+    });
 
   });
 
@@ -538,7 +536,7 @@ describe('volume', () => {
       volume.grantAttachVolume(role);
 
       // THEN
-      cdkExpect(stack).to(haveResourceLike('AWS::KMS::Key', {
+      expect(stack).toHaveResourceLike('AWS::KMS::Key', {
         KeyPolicy: {
           Statement: [
             {},
@@ -578,7 +576,7 @@ describe('volume', () => {
             },
           ],
         },
-      }));
+      });
 
 
     });
@@ -599,7 +597,7 @@ describe('volume', () => {
       volume.grantAttachVolume(role);
 
       // THEN
-      cdkExpect(stack).to(haveResourceLike('AWS::IAM::Policy', {
+      expect(stack).toHaveResourceLike('AWS::IAM::Policy', {
         PolicyDocument: {
           Statement: arrayWith({
             Effect: 'Allow',
@@ -632,7 +630,7 @@ describe('volume', () => {
             },
           }),
         },
-      }));
+      });
 
 
     });
@@ -672,7 +670,7 @@ describe('volume', () => {
     volume.grantAttachVolume(role);
 
     // THEN
-    cdkExpect(stack).to(haveResourceLike('AWS::IAM::Policy', {
+    expect(stack).toHaveResourceLike('AWS::IAM::Policy', {
       PolicyDocument: {
         Version: '2012-10-17',
         Statement: [
@@ -709,7 +707,7 @@ describe('volume', () => {
           },
         ],
       },
-    }));
+    });
 
 
   });
@@ -740,7 +738,7 @@ describe('volume', () => {
     volume.grantAttachVolume(role, [instance1, instance2]);
 
     // THEN
-    cdkExpect(stack).to(haveResourceLike('AWS::IAM::Policy', {
+    expect(stack).toHaveResourceLike('AWS::IAM::Policy', {
       PolicyDocument: {
         Version: '2012-10-17',
         Statement: [{
@@ -797,7 +795,7 @@ describe('volume', () => {
           ],
         }],
       },
-    }));
+    });
 
 
   });
@@ -821,7 +819,7 @@ describe('volume', () => {
     volume.grantAttachVolumeByResourceTag(instance.grantPrincipal, [instance]);
 
     // THEN
-    cdkExpect(stack).to(haveResourceLike('AWS::IAM::Policy', {
+    expect(stack).toHaveResourceLike('AWS::IAM::Policy', {
       PolicyDocument: {
         Version: '2012-10-17',
         Statement: [{
@@ -857,16 +855,16 @@ describe('volume', () => {
           },
         }],
       },
-    }));
-    cdkExpect(stack).to(haveResourceLike('AWS::EC2::Volume', {
+    });
+    expect(stack).toHaveResourceLike('AWS::EC2::Volume', {
       Tags: [
         {
           Key: 'VolumeGrantAttach-B2376B2BDA',
           Value: 'b2376b2bda65cb40f83c290dd844c4aa',
         },
       ],
-    }, ResourcePart.Properties));
-    cdkExpect(stack).to(haveResourceLike('AWS::EC2::Instance', {
+    }, ResourcePart.Properties);
+    expect(stack).toHaveResourceLike('AWS::EC2::Instance', {
       Tags: [
         {},
         {
@@ -874,7 +872,7 @@ describe('volume', () => {
           Value: 'b2376b2bda65cb40f83c290dd844c4aa',
         },
       ],
-    }, ResourcePart.Properties));
+    }, ResourcePart.Properties);
 
 
   });
@@ -898,7 +896,7 @@ describe('volume', () => {
     volume.grantAttachVolumeByResourceTag(instance.grantPrincipal, [instance], 'TestSuffix');
 
     // THEN
-    cdkExpect(stack).to(haveResourceLike('AWS::IAM::Policy', {
+    expect(stack).toHaveResourceLike('AWS::IAM::Policy', {
       PolicyDocument: {
         Version: '2012-10-17',
         Statement: [{
@@ -934,16 +932,16 @@ describe('volume', () => {
           },
         }],
       },
-    }));
-    cdkExpect(stack).to(haveResourceLike('AWS::EC2::Volume', {
+    });
+    expect(stack).toHaveResourceLike('AWS::EC2::Volume', {
       Tags: [
         {
           Key: 'VolumeGrantAttach-TestSuffix',
           Value: 'b2376b2bda65cb40f83c290dd844c4aa',
         },
       ],
-    }, ResourcePart.Properties));
-    cdkExpect(stack).to(haveResourceLike('AWS::EC2::Instance', {
+    }, ResourcePart.Properties);
+    expect(stack).toHaveResourceLike('AWS::EC2::Instance', {
       Tags: [
         {},
         {
@@ -951,7 +949,7 @@ describe('volume', () => {
           Value: 'b2376b2bda65cb40f83c290dd844c4aa',
         },
       ],
-    }, ResourcePart.Properties));
+    }, ResourcePart.Properties);
 
   });
 
@@ -968,7 +966,7 @@ describe('volume', () => {
     volume.grantDetachVolume(role);
 
     // THEN
-    cdkExpect(stack).to(haveResource('AWS::IAM::Policy', {
+    expect(stack).toHaveResource('AWS::IAM::Policy', {
       PolicyDocument: {
         Version: '2012-10-17',
         Statement: [{
@@ -1021,7 +1019,7 @@ describe('volume', () => {
           ],
         }],
       },
-    }));
+    });
 
   });
 
@@ -1051,7 +1049,7 @@ describe('volume', () => {
     volume.grantDetachVolume(role, [instance1, instance2]);
 
     // THEN
-    cdkExpect(stack).to(haveResourceLike('AWS::IAM::Policy', {
+    expect(stack).toHaveResourceLike('AWS::IAM::Policy', {
       PolicyDocument: {
         Version: '2012-10-17',
         Statement: [{
@@ -1108,7 +1106,7 @@ describe('volume', () => {
           ],
         }],
       },
-    }));
+    });
 
 
   });
@@ -1132,7 +1130,7 @@ describe('volume', () => {
     volume.grantDetachVolumeByResourceTag(instance.grantPrincipal, [instance]);
 
     // THEN
-    cdkExpect(stack).to(haveResourceLike('AWS::IAM::Policy', {
+    expect(stack).toHaveResourceLike('AWS::IAM::Policy', {
       PolicyDocument: {
         Version: '2012-10-17',
         Statement: [{
@@ -1168,16 +1166,16 @@ describe('volume', () => {
           },
         }],
       },
-    }));
-    cdkExpect(stack).to(haveResourceLike('AWS::EC2::Volume', {
+    });
+    expect(stack).toHaveResourceLike('AWS::EC2::Volume', {
       Tags: [
         {
           Key: 'VolumeGrantDetach-B2376B2BDA',
           Value: 'b2376b2bda65cb40f83c290dd844c4aa',
         },
       ],
-    }, ResourcePart.Properties));
-    cdkExpect(stack).to(haveResourceLike('AWS::EC2::Instance', {
+    }, ResourcePart.Properties);
+    expect(stack).toHaveResourceLike('AWS::EC2::Instance', {
       Tags: [
         {},
         {
@@ -1185,7 +1183,7 @@ describe('volume', () => {
           Value: 'b2376b2bda65cb40f83c290dd844c4aa',
         },
       ],
-    }, ResourcePart.Properties));
+    }, ResourcePart.Properties);
 
 
   });
@@ -1209,7 +1207,7 @@ describe('volume', () => {
     volume.grantDetachVolumeByResourceTag(instance.grantPrincipal, [instance], 'TestSuffix');
 
     // THEN
-    cdkExpect(stack).to(haveResourceLike('AWS::IAM::Policy', {
+    expect(stack).toHaveResourceLike('AWS::IAM::Policy', {
       PolicyDocument: {
         Version: '2012-10-17',
         Statement: [{
@@ -1245,16 +1243,16 @@ describe('volume', () => {
           },
         }],
       },
-    }));
-    cdkExpect(stack).to(haveResourceLike('AWS::EC2::Volume', {
+    });
+    expect(stack).toHaveResourceLike('AWS::EC2::Volume', {
       Tags: [
         {
           Key: 'VolumeGrantDetach-TestSuffix',
           Value: 'b2376b2bda65cb40f83c290dd844c4aa',
         },
       ],
-    }, ResourcePart.Properties));
-    cdkExpect(stack).to(haveResourceLike('AWS::EC2::Instance', {
+    }, ResourcePart.Properties);
+    expect(stack).toHaveResourceLike('AWS::EC2::Instance', {
       Tags: [
         {},
         {
@@ -1262,7 +1260,7 @@ describe('volume', () => {
           Value: 'b2376b2bda65cb40f83c290dd844c4aa',
         },
       ],
-    }, ResourcePart.Properties));
+    }, ResourcePart.Properties);
 
   });
 
diff --git a/packages/@aws-cdk/aws-ec2/test/vpc-endpoint-service.test.ts b/packages/@aws-cdk/aws-ec2/test/vpc-endpoint-service.test.ts
index 744e32953cc15..2b00460ec793b 100644
--- a/packages/@aws-cdk/aws-ec2/test/vpc-endpoint-service.test.ts
+++ b/packages/@aws-cdk/aws-ec2/test/vpc-endpoint-service.test.ts
@@ -1,7 +1,6 @@
-import { expect, haveResource } from '@aws-cdk/assert-internal';
+import '@aws-cdk/assert-internal/jest';
 import { ArnPrincipal } from '@aws-cdk/aws-iam';
 import { Stack } from '@aws-cdk/core';
-import { nodeunitShim, Test } from 'nodeunit-shim';
 
 // eslint-disable-next-line max-len
 import { IVpcEndpointServiceLoadBalancer, Vpc, VpcEndpointService } from '../lib';
@@ -19,9 +18,9 @@ class DummyEndpointLoadBalacer implements IVpcEndpointServiceLoadBalancer {
   }
 }
 
-nodeunitShim({
-  'test vpc endpoint service': {
-    'create endpoint service with no principals'(test: Test) {
+describe('vpc endpoint service', () => {
+  describe('test vpc endpoint service', () => {
+    test('create endpoint service with no principals', () => {
       // GIVEN
       const stack = new Stack();
       new Vpc(stack, 'MyVPC');
@@ -34,21 +33,21 @@ nodeunitShim({
         allowedPrincipals: [new ArnPrincipal('arn:aws:iam::123456789012:root')],
       });
       // THEN
-      expect(stack).to(haveResource('AWS::EC2::VPCEndpointService', {
+      expect(stack).toHaveResource('AWS::EC2::VPCEndpointService', {
         NetworkLoadBalancerArns: ['arn:aws:elasticloadbalancing:us-east-1:123456789012:loadbalancer/net/Test/9bn6qkf4e9jrw77a'],
         AcceptanceRequired: false,
-      }));
+      });
 
-      expect(stack).notTo(haveResource('AWS::EC2::VPCEndpointServicePermissions', {
+      expect(stack).not.toHaveResource('AWS::EC2::VPCEndpointServicePermissions', {
         ServiceId: {
           Ref: 'EndpointServiceED36BE1F',
         },
         AllowedPrincipals: [],
-      }));
+      });
+
 
-      test.done();
-    },
-    'create endpoint service with a principal'(test: Test) {
+    });
+    test('create endpoint service with a principal', () => {
       // GIVEN
       const stack = new Stack();
 
@@ -61,22 +60,22 @@ nodeunitShim({
       });
 
       // THEN
-      expect(stack).to(haveResource('AWS::EC2::VPCEndpointService', {
+      expect(stack).toHaveResource('AWS::EC2::VPCEndpointService', {
         NetworkLoadBalancerArns: ['arn:aws:elasticloadbalancing:us-east-1:123456789012:loadbalancer/net/Test/9bn6qkf4e9jrw77a'],
         AcceptanceRequired: false,
-      }));
+      });
 
-      expect(stack).to(haveResource('AWS::EC2::VPCEndpointServicePermissions', {
+      expect(stack).toHaveResource('AWS::EC2::VPCEndpointServicePermissions', {
         ServiceId: {
           Ref: 'EndpointServiceED36BE1F',
         },
         AllowedPrincipals: ['arn:aws:iam::123456789012:root'],
-      }));
+      });
 
-      test.done();
-    },
 
-    'with acceptance requried'(test: Test) {
+    });
+
+    test('with acceptance requried', () => {
       // GIVEN
       const stack = new Stack();
 
@@ -89,19 +88,19 @@ nodeunitShim({
       });
 
       // THEN
-      expect(stack).to(haveResource('AWS::EC2::VPCEndpointService', {
+      expect(stack).toHaveResource('AWS::EC2::VPCEndpointService', {
         NetworkLoadBalancerArns: ['arn:aws:elasticloadbalancing:us-east-1:123456789012:loadbalancer/net/Test/9bn6qkf4e9jrw77a'],
         AcceptanceRequired: true,
-      }));
+      });
 
-      expect(stack).to(haveResource('AWS::EC2::VPCEndpointServicePermissions', {
+      expect(stack).toHaveResource('AWS::EC2::VPCEndpointServicePermissions', {
         ServiceId: {
           Ref: 'EndpointServiceED36BE1F',
         },
         AllowedPrincipals: ['arn:aws:iam::123456789012:root'],
-      }));
+      });
+
 
-      test.done();
-    },
-  },
+    });
+  });
 });
diff --git a/packages/@aws-cdk/aws-ec2/test/vpc-endpoint.test.ts b/packages/@aws-cdk/aws-ec2/test/vpc-endpoint.test.ts
index 79a9f3594479e..c5724e91c2bcc 100644
--- a/packages/@aws-cdk/aws-ec2/test/vpc-endpoint.test.ts
+++ b/packages/@aws-cdk/aws-ec2/test/vpc-endpoint.test.ts
@@ -1,14 +1,13 @@
-import { expect, haveResource, haveResourceLike } from '@aws-cdk/assert-internal';
+import '@aws-cdk/assert-internal/jest';
 import { AnyPrincipal, PolicyStatement } from '@aws-cdk/aws-iam';
 import * as cxschema from '@aws-cdk/cloud-assembly-schema';
 import { ContextProvider, Fn, Stack } from '@aws-cdk/core';
-import { nodeunitShim, Test } from 'nodeunit-shim';
 // eslint-disable-next-line max-len
 import { GatewayVpcEndpoint, GatewayVpcEndpointAwsService, InterfaceVpcEndpoint, InterfaceVpcEndpointAwsService, InterfaceVpcEndpointService, SecurityGroup, SubnetType, Vpc } from '../lib';
 
-nodeunitShim({
-  'gateway endpoint': {
-    'add an endpoint to a vpc'(test: Test) {
+describe('vpc endpoint', () => {
+  describe('gateway endpoint', () => {
+    test('add an endpoint to a vpc', () => {
       // GIVEN
       const stack = new Stack();
 
@@ -22,7 +21,7 @@ nodeunitShim({
       });
 
       // THEN
-      expect(stack).to(haveResource('AWS::EC2::VPCEndpoint', {
+      expect(stack).toHaveResource('AWS::EC2::VPCEndpoint', {
         ServiceName: {
           'Fn::Join': [
             '',
@@ -45,12 +44,12 @@ nodeunitShim({
           { Ref: 'VpcNetworkPublicSubnet2RouteTableE5F348DF' },
         ],
         VpcEndpointType: 'Gateway',
-      }));
+      });
+
 
-      test.done();
-    },
+    });
 
-    'routing on private and public subnets'(test: Test) {
+    test('routing on private and public subnets', () => {
       // GIVEN
       const stack = new Stack();
 
@@ -72,7 +71,7 @@ nodeunitShim({
       });
 
       // THEN
-      expect(stack).to(haveResource('AWS::EC2::VPCEndpoint', {
+      expect(stack).toHaveResource('AWS::EC2::VPCEndpoint', {
         ServiceName: {
           'Fn::Join': [
             '',
@@ -103,12 +102,12 @@ nodeunitShim({
           },
         ],
         VpcEndpointType: 'Gateway',
-      }));
+      });
 
-      test.done();
-    },
 
-    'add statements to policy'(test: Test) {
+    });
+
+    test('add statements to policy', () => {
       // GIVEN
       const stack = new Stack();
       const vpc = new Vpc(stack, 'VpcNetwork');
@@ -124,7 +123,7 @@ nodeunitShim({
       }));
 
       // THEN
-      expect(stack).to(haveResource('AWS::EC2::VPCEndpoint', {
+      expect(stack).toHaveResource('AWS::EC2::VPCEndpoint', {
         PolicyDocument: {
           Statement: [
             {
@@ -139,12 +138,12 @@ nodeunitShim({
           ],
           Version: '2012-10-17',
         },
-      }));
+      });
 
-      test.done();
-    },
 
-    'throws when adding a statement without a principal'(test: Test) {
+    });
+
+    test('throws when adding a statement without a principal', () => {
       // GIVEN
       const stack = new Stack();
       const vpc = new Vpc(stack, 'VpcNetwork');
@@ -153,15 +152,15 @@ nodeunitShim({
       });
 
       // THEN
-      test.throws(() => endpoint.addToPolicy(new PolicyStatement({
+      expect(() => endpoint.addToPolicy(new PolicyStatement({
         actions: ['s3:GetObject', 's3:ListBucket'],
         resources: ['*'],
-      })), /`Principal`/);
+      }))).toThrow(/`Principal`/);
+
 
-      test.done();
-    },
+    });
 
-    'import/export'(test: Test) {
+    test('import/export', () => {
       // GIVEN
       const stack2 = new Stack();
 
@@ -169,11 +168,11 @@ nodeunitShim({
       const ep = GatewayVpcEndpoint.fromGatewayVpcEndpointId(stack2, 'ImportedEndpoint', 'endpoint-id');
 
       // THEN
-      test.deepEqual(ep.vpcEndpointId, 'endpoint-id');
-      test.done();
-    },
+      expect(ep.vpcEndpointId).toEqual('endpoint-id');
 
-    'works with an imported vpc'(test: Test) {
+    });
+
+    test('works with an imported vpc', () => {
       // GIVEN
       const stack = new Stack();
       const vpc = Vpc.fromVpcAttributes(stack, 'VPC', {
@@ -186,17 +185,17 @@ nodeunitShim({
       // THEN
       vpc.addGatewayEndpoint('Gateway', { service: GatewayVpcEndpointAwsService.S3 });
 
-      expect(stack).to(haveResource('AWS::EC2::VPCEndpoint', {
+      expect(stack).toHaveResource('AWS::EC2::VPCEndpoint', {
         ServiceName: { 'Fn::Join': ['', ['com.amazonaws.', { Ref: 'AWS::Region' }, '.s3']] },
         VpcId: 'id',
         RouteTableIds: ['rt1', 'rt2', 'rt3'],
         VpcEndpointType: 'Gateway',
-      }));
+      });
 
-      test.done();
-    },
 
-    'throws with an imported vpc without route tables ids'(test: Test) {
+    });
+
+    test('throws with an imported vpc without route tables ids', () => {
       // GIVEN
       const stack = new Stack();
       const vpc = Vpc.fromVpcAttributes(stack, 'VPC', {
@@ -205,14 +204,14 @@ nodeunitShim({
         availabilityZones: ['a', 'b', 'c'],
       });
 
-      test.throws(() => vpc.addGatewayEndpoint('Gateway', { service: GatewayVpcEndpointAwsService.S3 }), /route table/);
+      expect(() => vpc.addGatewayEndpoint('Gateway', { service: GatewayVpcEndpointAwsService.S3 })).toThrow(/route table/);
+
 
-      test.done();
-    },
-  },
+    });
+  });
 
-  'interface endpoint': {
-    'add an endpoint to a vpc'(test: Test) {
+  describe('interface endpoint', () => {
+    test('add an endpoint to a vpc', () => {
       // GIVEN
       const stack = new Stack();
       const vpc = new Vpc(stack, 'VpcNetwork');
@@ -223,7 +222,7 @@ nodeunitShim({
       });
 
       // THEN
-      expect(stack).to(haveResource('AWS::EC2::VPCEndpoint', {
+      expect(stack).toHaveResource('AWS::EC2::VPCEndpoint', {
         ServiceName: {
           'Fn::Join': [
             '',
@@ -257,19 +256,19 @@ nodeunitShim({
           },
         ],
         VpcEndpointType: 'Interface',
-      }));
+      });
 
-      expect(stack).to(haveResource('AWS::EC2::SecurityGroup', {
+      expect(stack).toHaveResource('AWS::EC2::SecurityGroup', {
         GroupDescription: 'Default/VpcNetwork/EcrDocker/SecurityGroup',
         VpcId: {
           Ref: 'VpcNetworkB258E83A',
         },
-      }));
+      });
 
-      test.done();
-    },
 
-    'import/export'(test: Test) {
+    });
+
+    test('import/export', () => {
       // GIVEN
       const stack2 = new Stack();
 
@@ -282,15 +281,15 @@ nodeunitShim({
       importedEndpoint.connections.allowDefaultPortFromAnyIpv4();
 
       // THEN
-      expect(stack2).to(haveResource('AWS::EC2::SecurityGroupIngress', {
+      expect(stack2).toHaveResource('AWS::EC2::SecurityGroupIngress', {
         GroupId: 'security-group-id',
-      }));
-      test.deepEqual(importedEndpoint.vpcEndpointId, 'vpc-endpoint-id');
+      });
+      expect(importedEndpoint.vpcEndpointId).toEqual('vpc-endpoint-id');
 
-      test.done();
-    },
 
-    'import/export without security group'(test: Test) {
+    });
+
+    test('import/export without security group', () => {
       // GIVEN
       const stack2 = new Stack();
 
@@ -302,13 +301,13 @@ nodeunitShim({
       importedEndpoint.connections.allowDefaultPortFromAnyIpv4();
 
       // THEN
-      test.deepEqual(importedEndpoint.vpcEndpointId, 'vpc-endpoint-id');
-      test.deepEqual(importedEndpoint.connections.securityGroups.length, 0);
+      expect(importedEndpoint.vpcEndpointId).toEqual('vpc-endpoint-id');
+      expect(importedEndpoint.connections.securityGroups.length).toEqual(0);
+
 
-      test.done();
-    },
+    });
 
-    'with existing security groups'(test: Test) {
+    test('with existing security groups', () => {
       // GIVEN
       const stack = new Stack();
       const vpc = new Vpc(stack, 'VpcNetwork');
@@ -320,13 +319,13 @@ nodeunitShim({
       });
 
       // THEN
-      expect(stack).to(haveResource('AWS::EC2::VPCEndpoint', {
+      expect(stack).toHaveResource('AWS::EC2::VPCEndpoint', {
         SecurityGroupIds: ['existing-id'],
-      }));
+      });
+
 
-      test.done();
-    },
-    'with existing security groups for efs'(test: Test) {
+    });
+    test('with existing security groups for efs', () => {
       // GIVEN
       const stack = new Stack();
       const vpc = new Vpc(stack, 'VpcNetwork');
@@ -338,13 +337,13 @@ nodeunitShim({
       });
 
       // THEN
-      expect(stack).to(haveResource('AWS::EC2::VPCEndpoint', {
+      expect(stack).toHaveResource('AWS::EC2::VPCEndpoint', {
         SecurityGroupIds: ['existing-id'],
-      }));
+      });
 
-      test.done();
-    },
-    'security group has ingress by default'(test: Test) {
+
+    });
+    test('security group has ingress by default', () => {
       // GIVEN
       const stack = new Stack();
       const vpc = new Vpc(stack, 'VpcNetwork');
@@ -355,7 +354,7 @@ nodeunitShim({
       });
 
       // THEN
-      expect(stack).to(haveResourceLike('AWS::EC2::SecurityGroup', {
+      expect(stack).toHaveResourceLike('AWS::EC2::SecurityGroup', {
         SecurityGroupIngress: [
           {
             CidrIp: { 'Fn::GetAtt': ['VpcNetworkB258E83A', 'CidrBlock'] },
@@ -364,11 +363,11 @@ nodeunitShim({
             ToPort: 443,
           },
         ],
-      } ));
+      });
+
 
-      test.done();
-    },
-    'non-AWS service interface endpoint'(test: Test) {
+    });
+    test('non-AWS service interface endpoint', () => {
       // GIVEN
       const stack = new Stack();
       const vpc = new Vpc(stack, 'VpcNetwork');
@@ -379,14 +378,14 @@ nodeunitShim({
       });
 
       // THEN
-      expect(stack).to(haveResource('AWS::EC2::VPCEndpoint', {
+      expect(stack).toHaveResource('AWS::EC2::VPCEndpoint', {
         ServiceName: 'com.amazonaws.vpce.us-east-1.vpce-svc-uuddlrlrbastrtsvc',
         PrivateDnsEnabled: false,
-      }));
+      });
 
-      test.done();
-    },
-    'marketplace partner service interface endpoint'(test: Test) {
+
+    });
+    test('marketplace partner service interface endpoint', () => {
       // GIVEN
       const stack = new Stack();
       const vpc = new Vpc(stack, 'VpcNetwork');
@@ -401,14 +400,14 @@ nodeunitShim({
       });
 
       // THEN
-      expect(stack).to(haveResource('AWS::EC2::VPCEndpoint', {
+      expect(stack).toHaveResource('AWS::EC2::VPCEndpoint', {
         ServiceName: 'com.amazonaws.vpce.us-east-1.vpce-svc-mktplacesvcwprdns',
         PrivateDnsEnabled: true,
-      }));
+      });
+
 
-      test.done();
-    },
-    'test endpoint service context azs discovered'(test: Test) {
+    });
+    test('test endpoint service context azs discovered', () => {
       // GIVEN
       const stack = new Stack(undefined, 'TestStack', { env: { account: '123456789012', region: 'us-east-1' } });
 
@@ -440,7 +439,7 @@ nodeunitShim({
       });
 
       // THEN
-      expect(stack).to(haveResource('AWS::EC2::VPCEndpoint', {
+      expect(stack).toHaveResource('AWS::EC2::VPCEndpoint', {
         ServiceName: 'com.amazonaws.vpce.us-east-1.vpce-svc-uuddlrlrbastrtsvc',
         SubnetIds: [
           {
@@ -450,11 +449,11 @@ nodeunitShim({
             Ref: 'VPCPrivateSubnet3Subnet3EDCD457',
           },
         ],
-      }));
+      });
+
 
-      test.done();
-    },
-    'endpoint service setup with stack AZ context but no endpoint context'(test: Test) {
+    });
+    test('endpoint service setup with stack AZ context but no endpoint context', () => {
       // GIVEN
       const stack = new Stack(undefined, 'TestStack', { env: { account: '123456789012', region: 'us-east-1' } });
 
@@ -477,7 +476,7 @@ nodeunitShim({
       });
 
       // THEN
-      expect(stack).to(haveResource('AWS::EC2::VPCEndpoint', {
+      expect(stack).toHaveResource('AWS::EC2::VPCEndpoint', {
         ServiceName: 'com.amazonaws.vpce.us-east-1.vpce-svc-uuddlrlrbastrtsvc',
         SubnetIds: [
           {
@@ -490,11 +489,11 @@ nodeunitShim({
             Ref: 'VPCPrivateSubnet3Subnet3EDCD457',
           },
         ],
-      }));
+      });
 
-      test.done();
-    },
-    'test endpoint service context with aws service'(test: Test) {
+
+    });
+    test('test endpoint service context with aws service', () => {
       // GIVEN
       const stack = new Stack(undefined, 'TestStack', { env: { account: '123456789012', region: 'us-east-1' } });
 
@@ -523,7 +522,7 @@ nodeunitShim({
       });
 
       // THEN
-      expect(stack).to(haveResource('AWS::EC2::VPCEndpoint', {
+      expect(stack).toHaveResource('AWS::EC2::VPCEndpoint', {
         ServiceName: 'com.amazonaws.us-east-1.execute-api',
         SubnetIds: [
           {
@@ -533,39 +532,39 @@ nodeunitShim({
             Ref: 'VPCPrivateSubnet3Subnet3EDCD457',
           },
         ],
-      }));
+      });
 
-      test.done();
-    },
-    'lookupSupportedAzs fails if account is unresolved'(test: Test) {
+
+    });
+    test('lookupSupportedAzs fails if account is unresolved', () => {
       // GIVEN
       const stack = new Stack(undefined, 'TestStack', { env: { region: 'us-east-1' } });
       const vpc = new Vpc(stack, 'VPC');
       // WHEN
-      test.throws(() =>vpc.addInterfaceEndpoint('YourService', {
+      expect(() =>vpc.addInterfaceEndpoint('YourService', {
         service: {
           name: 'com.amazonaws.vpce.us-east-1.vpce-svc-uuddlrlrbastrtsvc',
           port: 443,
         },
         lookupSupportedAzs: true,
-      }));
-      test.done();
-    },
-    'lookupSupportedAzs fails if region is unresolved'(test: Test) {
+      })).toThrow();
+
+    });
+    test('lookupSupportedAzs fails if region is unresolved', () => {
       // GIVEN
       const stack = new Stack(undefined, 'TestStack', { env: { account: '123456789012' } });
       const vpc = new Vpc(stack, 'VPC');
       // WHEN
-      test.throws(() =>vpc.addInterfaceEndpoint('YourService', {
+      expect(() =>vpc.addInterfaceEndpoint('YourService', {
         service: {
           name: 'com.amazonaws.vpce.us-east-1.vpce-svc-uuddlrlrbastrtsvc',
           port: 443,
         },
         lookupSupportedAzs: true,
-      }));
-      test.done();
-    },
-    'lookupSupportedAzs fails if subnet AZs are tokens'(test: Test) {
+      })).toThrow();
+
+    });
+    test('lookupSupportedAzs fails if subnet AZs are tokens', () => {
       // GIVEN
       const stack = new Stack(undefined, 'TestStack', { env: { account: '123456789012', region: 'us-east-1' } });
       const tokenAZs = [
@@ -582,21 +581,21 @@ nodeunitShim({
       const vpc = new Vpc(stack, 'VPC');
 
       // WHEN
-      test.throws(() =>vpc.addInterfaceEndpoint('YourService', {
+      expect(() =>vpc.addInterfaceEndpoint('YourService', {
         service: {
           name: 'com.amazonaws.vpce.us-east-1.vpce-svc-uuddlrlrbastrtsvc',
           port: 443,
         },
         lookupSupportedAzs: true,
-      }));
-      test.done();
-    },
-    'vpc endpoint fails if no subnets provided'(test: Test) {
+      })).toThrow();
+
+    });
+    test('vpc endpoint fails if no subnets provided', () => {
       // GIVEN
       const stack = new Stack(undefined, 'TestStack', { env: { account: '123456789012', region: 'us-east-1' } });
       const vpc = new Vpc(stack, 'VPC');
       // WHEN
-      test.throws(() =>vpc.addInterfaceEndpoint('YourService', {
+      expect(() =>vpc.addInterfaceEndpoint('YourService', {
         service: {
           name: 'com.amazonaws.vpce.us-east-1.vpce-svc-uuddlrlrbastrtsvc',
           port: 443,
@@ -604,10 +603,10 @@ nodeunitShim({
         subnets: vpc.selectSubnets({
           subnets: [],
         }),
-      }));
-      test.done();
-    },
-    'test vpc interface endpoint with cn.com.amazonaws prefix can be created correctly in cn-north-1'(test: Test) {
+      })).toThrow();
+
+    });
+    test('test vpc interface endpoint with cn.com.amazonaws prefix can be created correctly in cn-north-1', () => {
       //GIVEN
       const stack = new Stack(undefined, 'TestStack', { env: { account: '123456789012', region: 'cn-north-1' } });
       const vpc = new Vpc(stack, 'VPC');
@@ -618,13 +617,13 @@ nodeunitShim({
       });
 
       //THEN
-      expect(stack).to(haveResource('AWS::EC2::VPCEndpoint', {
+      expect(stack).toHaveResource('AWS::EC2::VPCEndpoint', {
         ServiceName: 'cn.com.amazonaws.cn-north-1.ecr.api',
-      }));
+      });
 
-      test.done();
-    },
-    'test vpc interface endpoint with cn.com.amazonaws prefix can be created correctly in cn-northwest-1'(test: Test) {
+
+    });
+    test('test vpc interface endpoint with cn.com.amazonaws prefix can be created correctly in cn-northwest-1', () => {
       //GIVEN
       const stack = new Stack(undefined, 'TestStack', { env: { account: '123456789012', region: 'cn-northwest-1' } });
       const vpc = new Vpc(stack, 'VPC');
@@ -635,13 +634,13 @@ nodeunitShim({
       });
 
       //THEN
-      expect(stack).to(haveResource('AWS::EC2::VPCEndpoint', {
+      expect(stack).toHaveResource('AWS::EC2::VPCEndpoint', {
         ServiceName: 'cn.com.amazonaws.cn-northwest-1.lambda',
-      }));
+      });
 
-      test.done();
-    },
-    'test vpc interface endpoint without cn.com.amazonaws prefix can be created correctly in cn-north-1'(test: Test) {
+
+    });
+    test('test vpc interface endpoint without cn.com.amazonaws prefix can be created correctly in cn-north-1', () => {
       //GIVEN
       const stack = new Stack(undefined, 'TestStack', { env: { account: '123456789012', region: 'cn-north-1' } });
       const vpc = new Vpc(stack, 'VPC');
@@ -652,13 +651,13 @@ nodeunitShim({
       });
 
       //THEN
-      expect(stack).to(haveResource('AWS::EC2::VPCEndpoint', {
+      expect(stack).toHaveResource('AWS::EC2::VPCEndpoint', {
         ServiceName: 'com.amazonaws.cn-north-1.ecs',
-      }));
+      });
+
 
-      test.done();
-    },
-    'test vpc interface endpoint without cn.com.amazonaws prefix can be created correctly in cn-northwest-1'(test: Test) {
+    });
+    test('test vpc interface endpoint without cn.com.amazonaws prefix can be created correctly in cn-northwest-1', () => {
       //GIVEN
       const stack = new Stack(undefined, 'TestStack', { env: { account: '123456789012', region: 'cn-northwest-1' } });
       const vpc = new Vpc(stack, 'VPC');
@@ -669,13 +668,13 @@ nodeunitShim({
       });
 
       //THEN
-      expect(stack).to(haveResource('AWS::EC2::VPCEndpoint', {
+      expect(stack).toHaveResource('AWS::EC2::VPCEndpoint', {
         ServiceName: 'com.amazonaws.cn-northwest-1.glue',
-      }));
+      });
+
 
-      test.done();
-    },
-    'test vpc interface endpoint for transcribe can be created correctly in non-china regions'(test: Test) {
+    });
+    test('test vpc interface endpoint for transcribe can be created correctly in non-china regions', () => {
       //GIVEN
       const stack = new Stack(undefined, 'TestStack', { env: { account: '123456789012', region: 'us-east-1' } });
       const vpc = new Vpc(stack, 'VPC');
@@ -686,13 +685,13 @@ nodeunitShim({
       });
 
       //THEN
-      expect(stack).to(haveResource('AWS::EC2::VPCEndpoint', {
+      expect(stack).toHaveResource('AWS::EC2::VPCEndpoint', {
         ServiceName: 'com.amazonaws.us-east-1.transcribe',
-      }));
+      });
+
 
-      test.done();
-    },
-    'test vpc interface endpoint for transcribe can be created correctly in cn-north-1'(test: Test) {
+    });
+    test('test vpc interface endpoint for transcribe can be created correctly in cn-north-1', () => {
       //GIVEN
       const stack = new Stack(undefined, 'TestStack', { env: { account: '123456789012', region: 'cn-north-1' } });
       const vpc = new Vpc(stack, 'VPC');
@@ -703,13 +702,13 @@ nodeunitShim({
       });
 
       //THEN
-      expect(stack).to(haveResource('AWS::EC2::VPCEndpoint', {
+      expect(stack).toHaveResource('AWS::EC2::VPCEndpoint', {
         ServiceName: 'cn.com.amazonaws.cn-north-1.transcribe.cn',
-      }));
+      });
 
-      test.done();
-    },
-    'test vpc interface endpoint for transcribe can be created correctly in cn-northwest-1'(test: Test) {
+
+    });
+    test('test vpc interface endpoint for transcribe can be created correctly in cn-northwest-1', () => {
       //GIVEN
       const stack = new Stack(undefined, 'TestStack', { env: { account: '123456789012', region: 'cn-northwest-1' } });
       const vpc = new Vpc(stack, 'VPC');
@@ -720,11 +719,11 @@ nodeunitShim({
       });
 
       //THEN
-      expect(stack).to(haveResource('AWS::EC2::VPCEndpoint', {
+      expect(stack).toHaveResource('AWS::EC2::VPCEndpoint', {
         ServiceName: 'cn.com.amazonaws.cn-northwest-1.transcribe.cn',
-      }));
+      });
+
 
-      test.done();
-    },
-  },
+    });
+  });
 });
diff --git a/packages/@aws-cdk/aws-ec2/test/vpc-flow-logs.test.ts b/packages/@aws-cdk/aws-ec2/test/vpc-flow-logs.test.ts
index 243d5fef0b46c..956632bf1a0a5 100644
--- a/packages/@aws-cdk/aws-ec2/test/vpc-flow-logs.test.ts
+++ b/packages/@aws-cdk/aws-ec2/test/vpc-flow-logs.test.ts
@@ -1,23 +1,20 @@
-import { countResources, expect, haveResource } from '@aws-cdk/assert-internal';
+import '@aws-cdk/assert-internal/jest';
 import * as iam from '@aws-cdk/aws-iam';
 import * as logs from '@aws-cdk/aws-logs';
 import * as s3 from '@aws-cdk/aws-s3';
 import { Stack } from '@aws-cdk/core';
-import { nodeunitShim, Test } from 'nodeunit-shim';
 import { FlowLog, FlowLogDestination, FlowLogResourceType, Vpc } from '../lib';
 
-nodeunitShim({
-  'with defaults set, it successfully creates with cloudwatch logs destination'(
-    test: Test,
-  ) {
+describe('vpc flow logs', () => {
+  test('with defaults set, it successfully creates with cloudwatch logs destination', () => {
     const stack = getTestStack();
 
     new FlowLog(stack, 'FlowLogs', {
       resourceType: FlowLogResourceType.fromNetworkInterfaceId('eni-123455'),
     });
 
-    expect(stack).to(
-      haveResource('AWS::EC2::FlowLog', {
+    expect(stack).
+      toHaveResource('AWS::EC2::FlowLog', {
         ResourceType: 'NetworkInterface',
         TrafficType: 'ALL',
         ResourceId: 'eni-123455',
@@ -27,15 +24,15 @@ nodeunitShim({
         LogGroupName: {
           Ref: 'FlowLogsLogGroup9853A85F',
         },
-      }),
-    );
-
-    expect(stack).to(countResources('AWS::Logs::LogGroup', 1));
-    expect(stack).to(countResources('AWS::IAM::Role', 1));
-    expect(stack).notTo(haveResource('AWS::S3::Bucket'));
-    test.done();
-  },
-  'with cloudwatch logs as the destination, allows use of existing resources'(test: Test) {
+      },
+      );
+
+    expect(stack).toCountResources('AWS::Logs::LogGroup', 1);
+    expect(stack).toCountResources('AWS::IAM::Role', 1);
+    expect(stack).not.toHaveResource('AWS::S3::Bucket');
+
+  });
+  test('with cloudwatch logs as the destination, allows use of existing resources', () => {
     const stack = getTestStack();
 
     new FlowLog(stack, 'FlowLogs', {
@@ -51,16 +48,16 @@ nodeunitShim({
       ),
     });
 
-    expect(stack).to(haveResource('AWS::Logs::LogGroup', {
+    expect(stack).toHaveResource('AWS::Logs::LogGroup', {
       RetentionInDays: 5,
-    }));
-    expect(stack).to(haveResource('AWS::IAM::Role', {
+    });
+    expect(stack).toHaveResource('AWS::IAM::Role', {
       RoleName: 'TestName',
-    }));
-    expect(stack).notTo(haveResource('AWS::S3::Bucket'));
-    test.done();
-  },
-  'with s3 as the destination, allows use of existing resources'(test: Test) {
+    });
+    expect(stack).not.toHaveResource('AWS::S3::Bucket');
+
+  });
+  test('with s3 as the destination, allows use of existing resources', () => {
     const stack = getTestStack();
 
     new FlowLog(stack, 'FlowLogs', {
@@ -72,14 +69,14 @@ nodeunitShim({
       ),
     });
 
-    expect(stack).notTo(haveResource('AWS::Logs::LogGroup'));
-    expect(stack).notTo(haveResource('AWS::IAM::Role'));
-    expect(stack).to(haveResource('AWS::S3::Bucket', {
+    expect(stack).not.toHaveResource('AWS::Logs::LogGroup');
+    expect(stack).not.toHaveResource('AWS::IAM::Role');
+    expect(stack).toHaveResource('AWS::S3::Bucket', {
       BucketName: 'testbucket',
-    }));
-    test.done();
-  },
-  'with s3 as the destination, allows use of key prefix'(test: Test) {
+    });
+
+  });
+  test('with s3 as the destination, allows use of key prefix', () => {
     const stack = getTestStack();
 
     new FlowLog(stack, 'FlowLogs', {
@@ -92,16 +89,14 @@ nodeunitShim({
       ),
     });
 
-    expect(stack).notTo(haveResource('AWS::Logs::LogGroup'));
-    expect(stack).notTo(haveResource('AWS::IAM::Role'));
-    expect(stack).to(haveResource('AWS::S3::Bucket', {
+    expect(stack).not.toHaveResource('AWS::Logs::LogGroup');
+    expect(stack).not.toHaveResource('AWS::IAM::Role');
+    expect(stack).toHaveResource('AWS::S3::Bucket', {
       BucketName: 'testbucket',
-    }));
-    test.done();
-  },
-  'with s3 as the destination and all the defaults set, it successfully creates all the resources'(
-    test: Test,
-  ) {
+    });
+
+  });
+  test('with s3 as the destination and all the defaults set, it successfully creates all the resources', () => {
     const stack = getTestStack();
 
     new FlowLog(stack, 'FlowLogs', {
@@ -109,22 +104,22 @@ nodeunitShim({
       destination: FlowLogDestination.toS3(),
     });
 
-    expect(stack).to(
-      haveResource('AWS::EC2::FlowLog', {
+    expect(stack).
+      toHaveResource('AWS::EC2::FlowLog', {
         ResourceType: 'NetworkInterface',
         TrafficType: 'ALL',
         ResourceId: 'eni-123456',
         LogDestination: {
           'Fn::GetAtt': ['FlowLogsBucket87F67F60', 'Arn'],
         },
-      }),
-    );
-    expect(stack).notTo(haveResource('AWS::Logs::LogGroup'));
-    expect(stack).notTo(haveResource('AWS::IAM::Role'));
-    expect(stack).to(countResources('AWS::S3::Bucket', 1));
-    test.done();
-  },
-  'create with vpc'(test: Test) {
+      },
+      );
+    expect(stack).not.toHaveResource('AWS::Logs::LogGroup');
+    expect(stack).not.toHaveResource('AWS::IAM::Role');
+    expect(stack).toCountResources('AWS::S3::Bucket', 1);
+
+  });
+  test('create with vpc', () => {
     const stack = getTestStack();
 
     new Vpc(stack, 'VPC', {
@@ -133,9 +128,9 @@ nodeunitShim({
       },
     });
 
-    expect(stack).to(haveResource('AWS::EC2::VPC'));
-    expect(stack).to(
-      haveResource('AWS::EC2::FlowLog', {
+    expect(stack).toHaveResource('AWS::EC2::VPC');
+    expect(stack).
+      toHaveResource('AWS::EC2::FlowLog', {
         ResourceType: 'VPC',
         TrafficType: 'ALL',
         ResourceId: {
@@ -147,19 +142,19 @@ nodeunitShim({
         LogGroupName: {
           Ref: 'VPCflowLogsLogGroupE900F980',
         },
-      }),
-    );
-    test.done();
-  },
-  'add to vpc'(test: Test) {
+      },
+      );
+
+  });
+  test('add to vpc', () => {
     const stack = getTestStack();
 
     const vpc = new Vpc(stack, 'VPC');
     vpc.addFlowLog('FlowLogs');
 
-    expect(stack).to(haveResource('AWS::EC2::VPC'));
-    expect(stack).to(
-      haveResource('AWS::EC2::FlowLog', {
+    expect(stack).toHaveResource('AWS::EC2::VPC');
+    expect(stack).
+      toHaveResource('AWS::EC2::FlowLog', {
         ResourceType: 'VPC',
         TrafficType: 'ALL',
         ResourceId: {
@@ -171,10 +166,10 @@ nodeunitShim({
         LogGroupName: {
           Ref: 'VPCFlowLogsLogGroupF48E1B0A',
         },
-      }),
-    );
-    test.done();
-  },
+      },
+      );
+
+  });
 });
 
 function getTestStack(): Stack {
diff --git a/packages/@aws-cdk/aws-ec2/test/vpc.from-lookup.test.ts b/packages/@aws-cdk/aws-ec2/test/vpc.from-lookup.test.ts
index 65e4b071a0b53..4ad08203a525e 100644
--- a/packages/@aws-cdk/aws-ec2/test/vpc.from-lookup.test.ts
+++ b/packages/@aws-cdk/aws-ec2/test/vpc.from-lookup.test.ts
@@ -2,26 +2,25 @@ import * as cxschema from '@aws-cdk/cloud-assembly-schema';
 import { ContextProvider, GetContextValueOptions, GetContextValueResult, Lazy, Stack } from '@aws-cdk/core';
 import * as cxapi from '@aws-cdk/cx-api';
 import { Construct } from 'constructs';
-import { nodeunitShim, Test } from 'nodeunit-shim';
 import { GenericLinuxImage, Instance, InstanceType, SubnetType, Vpc } from '../lib';
 
-nodeunitShim({
-  'Vpc.fromLookup()': {
-    'requires concrete values'(test: Test) {
+describe('vpc from lookup', () => {
+  describe('Vpc.fromLookup()', () => {
+    test('requires concrete values', () => {
       // GIVEN
       const stack = new Stack();
 
-      test.throws(() => {
+      expect(() => {
         Vpc.fromLookup(stack, 'Vpc', {
           vpcId: Lazy.string({ produce: () => 'some-id' }),
         });
 
-      }, 'All arguments to Vpc.fromLookup() must be concrete');
+      }).toThrow('All arguments to Vpc.fromLookup() must be concrete');
 
-      test.done();
-    },
 
-    'selecting subnets by name from a looked-up VPC does not throw'(test: Test) {
+    });
+
+    test('selecting subnets by name from a looked-up VPC does not throw', () => {
       // GIVEN
       const stack = new Stack(undefined, undefined, { env: { region: 'us-east-1', account: '123456789012' } });
       const vpc = Vpc.fromLookup(stack, 'VPC', {
@@ -33,11 +32,11 @@ nodeunitShim({
 
       // THEN: no exception
 
-      test.done();
-    },
 
-    'accepts asymmetric subnets'(test: Test) {
-      const previous = mockVpcContextProviderWith(test, {
+    });
+
+    test('accepts asymmetric subnets', () => {
+      const previous = mockVpcContextProviderWith({
         vpcId: 'vpc-1234',
         subnetGroups: [
           {
@@ -84,11 +83,11 @@ nodeunitShim({
           },
         ],
       }, options => {
-        test.deepEqual(options.filter, {
+        expect(options.filter).toEqual({
           isDefault: 'true',
         });
 
-        test.equal(options.subnetGroupNameTag, undefined);
+        expect(options.subnetGroupNameTag).toEqual(undefined);
       });
 
       const stack = new Stack();
@@ -96,17 +95,17 @@ nodeunitShim({
         isDefault: true,
       });
 
-      test.deepEqual(vpc.availabilityZones, ['us-east-1a', 'us-east-1b', 'us-east-1c', 'us-east-1d']);
-      test.equal(vpc.publicSubnets.length, 2);
-      test.equal(vpc.privateSubnets.length, 4);
-      test.equal(vpc.isolatedSubnets.length, 0);
+      expect(vpc.availabilityZones).toEqual(['us-east-1a', 'us-east-1b', 'us-east-1c', 'us-east-1d']);
+      expect(vpc.publicSubnets.length).toEqual(2);
+      expect(vpc.privateSubnets.length).toEqual(4);
+      expect(vpc.isolatedSubnets.length).toEqual(0);
 
       restoreContextProvider(previous);
-      test.done();
-    },
 
-    'selectSubnets onePerAz works on imported VPC'(test: Test) {
-      const previous = mockVpcContextProviderWith(test, {
+    });
+
+    test('selectSubnets onePerAz works on imported VPC', () => {
+      const previous = mockVpcContextProviderWith({
         vpcId: 'vpc-1234',
         subnetGroups: [
           {
@@ -153,11 +152,11 @@ nodeunitShim({
           },
         ],
       }, options => {
-        test.deepEqual(options.filter, {
+        expect(options.filter).toEqual({
           isDefault: 'true',
         });
 
-        test.equal(options.subnetGroupNameTag, undefined);
+        expect(options.subnetGroupNameTag).toEqual(undefined);
       });
 
       const stack = new Stack();
@@ -169,13 +168,13 @@ nodeunitShim({
       const subnets = vpc.selectSubnets({ subnetType: SubnetType.PRIVATE_WITH_NAT, onePerAz: true });
 
       // THEN: we got 2 subnets and not 4
-      test.deepEqual(subnets.subnets.map(s => s.availabilityZone), ['us-east-1c', 'us-east-1d']);
+      expect(subnets.subnets.map(s => s.availabilityZone)).toEqual(['us-east-1c', 'us-east-1d']);
 
       restoreContextProvider(previous);
-      test.done();
-    },
 
-    'AZ in dummy lookup VPC matches AZ in Stack'(test: Test) {
+    });
+
+    test('AZ in dummy lookup VPC matches AZ in Stack', () => {
       // GIVEN
       const stack = new Stack(undefined, 'MyTestStack', { env: { account: '1234567890', region: 'dummy' } });
       const vpc = Vpc.fromLookup(stack, 'vpc', { isDefault: true });
@@ -186,12 +185,12 @@ nodeunitShim({
       });
 
       // THEN
-      test.equals(subnets.subnets.length, 2);
+      expect(subnets.subnets.length).toEqual(2);
 
-      test.done();
-    },
 
-    'don\'t crash when using subnetgroup name in lookup VPC'(test: Test) {
+    });
+
+    test('don\'t crash when using subnetgroup name in lookup VPC', () => {
       // GIVEN
       const stack = new Stack(undefined, 'MyTestStack', { env: { account: '1234567890', region: 'dummy' } });
       const vpc = Vpc.fromLookup(stack, 'vpc', { isDefault: true });
@@ -208,10 +207,10 @@ nodeunitShim({
 
       // THEN -- no exception occurred
 
-      test.done();
-    },
-    'subnets in imported VPC has all expected attributes'(test: Test) {
-      const previous = mockVpcContextProviderWith(test, {
+
+    });
+    test('subnets in imported VPC has all expected attributes', () => {
+      const previous = mockVpcContextProviderWith({
         vpcId: 'vpc-1234',
         subnetGroups: [
           {
@@ -228,11 +227,11 @@ nodeunitShim({
           },
         ],
       }, options => {
-        test.deepEqual(options.filter, {
+        expect(options.filter).toEqual({
           isDefault: 'true',
         });
 
-        test.equal(options.subnetGroupNameTag, undefined);
+        expect(options.subnetGroupNameTag).toEqual(undefined);
       });
 
       const stack = new Stack();
@@ -242,16 +241,16 @@ nodeunitShim({
 
       let subnet = vpc.publicSubnets[0];
 
-      test.equal(subnet.availabilityZone, 'us-east-1a');
-      test.equal(subnet.subnetId, 'pub-sub-in-us-east-1a');
-      test.equal(subnet.routeTable.routeTableId, 'rt-123');
-      test.equal(subnet.ipv4CidrBlock, '10.100.0.0/24');
+      expect(subnet.availabilityZone).toEqual('us-east-1a');
+      expect(subnet.subnetId).toEqual('pub-sub-in-us-east-1a');
+      expect(subnet.routeTable.routeTableId).toEqual('rt-123');
+      expect(subnet.ipv4CidrBlock).toEqual('10.100.0.0/24');
 
 
       restoreContextProvider(previous);
-      test.done();
-    },
-  },
+
+    });
+  });
 });
 
 interface MockVcpContextResponse {
@@ -260,15 +259,13 @@ interface MockVcpContextResponse {
 }
 
 function mockVpcContextProviderWith(
-  test: Test, response: MockVcpContextResponse,
+  response: MockVcpContextResponse,
   paramValidator?: (options: cxschema.VpcContextQuery) => void) {
   const previous = ContextProvider.getValue;
   ContextProvider.getValue = (_scope: Construct, options: GetContextValueOptions) => {
     // do some basic sanity checks
-    test.equal(options.provider, cxschema.ContextProvider.VPC_PROVIDER,
-      `Expected provider to be: '${cxschema.ContextProvider.VPC_PROVIDER}', got: '${options.provider}'`);
-    test.equal((options.props || {}).returnAsymmetricSubnets, true,
-      `Expected options.props.returnAsymmetricSubnets to be true, got: '${(options.props || {}).returnAsymmetricSubnets}'`);
+    expect(options.provider).toEqual(cxschema.ContextProvider.VPC_PROVIDER);
+    expect((options.props || {}).returnAsymmetricSubnets).toEqual(true);
 
     if (paramValidator) {
       paramValidator(options.props as any);
diff --git a/packages/@aws-cdk/aws-ec2/test/vpc.test.ts b/packages/@aws-cdk/aws-ec2/test/vpc.test.ts
index 355f4fd3662c7..ca375dc7fe321 100644
--- a/packages/@aws-cdk/aws-ec2/test/vpc.test.ts
+++ b/packages/@aws-cdk/aws-ec2/test/vpc.test.ts
@@ -1,6 +1,6 @@
-import { countResources, expect as cdkExpect, haveResource, haveResourceLike, isSuperObject, MatchStyle, SynthUtils } from '@aws-cdk/assert-internal';
+import '@aws-cdk/assert-internal/jest';
+import { isSuperObject, MatchStyle, SynthUtils } from '@aws-cdk/assert-internal';
 import { CfnOutput, CfnResource, Fn, Lazy, Stack, Tags } from '@aws-cdk/core';
-import { nodeunitShim, Test } from 'nodeunit-shim';
 import {
   AclCidr,
   AclTraffic,
@@ -28,45 +28,45 @@ import {
   Vpc,
 } from '../lib';
 
-nodeunitShim({
-  'When creating a VPC': {
-    'with the default CIDR range': {
+describe('vpc', () => {
+  describe('When creating a VPC', () => {
+    describe('with the default CIDR range', () => {
 
-      'vpc.vpcId returns a token to the VPC ID'(test: Test) {
+      test('vpc.vpcId returns a token to the VPC ID', () => {
         const stack = getTestStack();
         const vpc = new Vpc(stack, 'TheVPC');
-        test.deepEqual(stack.resolve(vpc.vpcId), { Ref: 'TheVPC92636AB0' });
-        test.done();
-      },
+        expect(stack.resolve(vpc.vpcId)).toEqual({ Ref: 'TheVPC92636AB0' });
 
-      'it uses the correct network range'(test: Test) {
+      });
+
+      test('it uses the correct network range', () => {
         const stack = getTestStack();
         new Vpc(stack, 'TheVPC');
-        cdkExpect(stack).to(haveResource('AWS::EC2::VPC', {
+        expect(stack).toHaveResource('AWS::EC2::VPC', {
           CidrBlock: Vpc.DEFAULT_CIDR_RANGE,
           EnableDnsHostnames: true,
           EnableDnsSupport: true,
           InstanceTenancy: DefaultInstanceTenancy.DEFAULT,
-        }));
-        test.done();
-      },
-      'the Name tag is defaulted to path'(test: Test) {
+        });
+
+      });
+      test('the Name tag is defaulted to path', () => {
         const stack = getTestStack();
         new Vpc(stack, 'TheVPC');
-        cdkExpect(stack).to(
-          haveResource('AWS::EC2::VPC',
-            hasTags([{ Key: 'Name', Value: 'TestStack/TheVPC' }])),
-        );
-        cdkExpect(stack).to(
-          haveResource('AWS::EC2::InternetGateway',
-            hasTags([{ Key: 'Name', Value: 'TestStack/TheVPC' }])),
-        );
-        test.done();
-      },
-
-    },
-
-    'with all of the properties set, it successfully sets the correct VPC properties'(test: Test) {
+        expect(stack).
+          toHaveResource('AWS::EC2::VPC',
+            hasTags([{ Key: 'Name', Value: 'TestStack/TheVPC' }]),
+          );
+        expect(stack).
+          toHaveResource('AWS::EC2::InternetGateway',
+            hasTags([{ Key: 'Name', Value: 'TestStack/TheVPC' }]),
+          );
+
+      });
+
+    });
+
+    test('with all of the properties set, it successfully sets the correct VPC properties', () => {
       const stack = getTestStack();
       new Vpc(stack, 'TheVPC', {
         cidr: '192.168.0.0/16',
@@ -75,18 +75,17 @@ nodeunitShim({
         defaultInstanceTenancy: DefaultInstanceTenancy.DEDICATED,
       });
 
-      cdkExpect(stack).to(haveResource('AWS::EC2::VPC', {
+      expect(stack).toHaveResource('AWS::EC2::VPC', {
         CidrBlock: '192.168.0.0/16',
         EnableDnsHostnames: false,
         EnableDnsSupport: false,
         InstanceTenancy: DefaultInstanceTenancy.DEDICATED,
-      }));
-      test.done();
-    },
+      });
+
+    });
 
-    'dns getters correspond to CFN properties': (() => {
+    describe('dns getters correspond to CFN properties', () => {
 
-      const tests: any = {};
 
       const inputs = [
         { dnsSupport: false, dnsHostnames: false },
@@ -97,7 +96,7 @@ nodeunitShim({
 
       for (const input of inputs) {
 
-        tests[`[dnsSupport=${input.dnsSupport},dnsHostnames=${input.dnsHostnames}]`] = (test: Test) => {
+        test(`[dnsSupport=${input.dnsSupport},dnsHostnames=${input.dnsHostnames}]`, () => {
 
           const stack = getTestStack();
           const vpc = new Vpc(stack, 'TheVPC', {
@@ -107,41 +106,41 @@ nodeunitShim({
             defaultInstanceTenancy: DefaultInstanceTenancy.DEDICATED,
           });
 
-          cdkExpect(stack).to(haveResource('AWS::EC2::VPC', {
+          expect(stack).toHaveResource('AWS::EC2::VPC', {
             CidrBlock: '192.168.0.0/16',
             EnableDnsHostnames: input.dnsHostnames,
             EnableDnsSupport: input.dnsSupport,
             InstanceTenancy: DefaultInstanceTenancy.DEDICATED,
-          }));
+          });
 
-          test.equal(input.dnsSupport, vpc.dnsSupportEnabled);
-          test.equal(input.dnsHostnames, vpc.dnsHostnamesEnabled);
-          test.done();
+          expect(input.dnsSupport).toEqual(vpc.dnsSupportEnabled);
+          expect(input.dnsHostnames).toEqual(vpc.dnsHostnamesEnabled);
 
-        };
+
+        });
       }
 
-      return tests;
-    })(),
 
-    'contains the correct number of subnets'(test: Test) {
+    });
+
+    test('contains the correct number of subnets', () => {
       const stack = getTestStack();
       const vpc = new Vpc(stack, 'TheVPC');
       const zones = stack.availabilityZones.length;
-      test.equal(vpc.publicSubnets.length, zones);
-      test.equal(vpc.privateSubnets.length, zones);
-      test.deepEqual(stack.resolve(vpc.vpcId), { Ref: 'TheVPC92636AB0' });
-      test.done();
-    },
+      expect(vpc.publicSubnets.length).toEqual(zones);
+      expect(vpc.privateSubnets.length).toEqual(zones);
+      expect(stack.resolve(vpc.vpcId)).toEqual({ Ref: 'TheVPC92636AB0' });
+
+    });
 
-    'can refer to the internet gateway'(test: Test) {
+    test('can refer to the internet gateway', () => {
       const stack = getTestStack();
       const vpc = new Vpc(stack, 'TheVPC');
-      test.deepEqual(stack.resolve(vpc.internetGatewayId), { Ref: 'TheVPCIGWFA25CC08' });
-      test.done();
-    },
+      expect(stack.resolve(vpc.internetGatewayId)).toEqual({ Ref: 'TheVPCIGWFA25CC08' });
 
-    'with only isolated subnets, the VPC should not contain an IGW or NAT Gateways'(test: Test) {
+    });
+
+    test('with only isolated subnets, the VPC should not contain an IGW or NAT Gateways', () => {
       const stack = getTestStack();
       new Vpc(stack, 'TheVPC', {
         subnetConfiguration: [
@@ -151,15 +150,15 @@ nodeunitShim({
           },
         ],
       });
-      cdkExpect(stack).notTo(haveResource('AWS::EC2::InternetGateway'));
-      cdkExpect(stack).notTo(haveResource('AWS::EC2::NatGateway'));
-      cdkExpect(stack).to(haveResource('AWS::EC2::Subnet', {
+      expect(stack).not.toHaveResource('AWS::EC2::InternetGateway');
+      expect(stack).not.toHaveResource('AWS::EC2::NatGateway');
+      expect(stack).toHaveResource('AWS::EC2::Subnet', {
         MapPublicIpOnLaunch: false,
-      }));
-      test.done();
-    },
+      });
 
-    'with no private subnets, the VPC should have an IGW but no NAT Gateways'(test: Test) {
+    });
+
+    test('with no private subnets, the VPC should have an IGW but no NAT Gateways', () => {
       const stack = getTestStack();
       new Vpc(stack, 'TheVPC', {
         subnetConfiguration: [
@@ -173,11 +172,11 @@ nodeunitShim({
           },
         ],
       });
-      cdkExpect(stack).to(countResources('AWS::EC2::InternetGateway', 1));
-      cdkExpect(stack).notTo(haveResource('AWS::EC2::NatGateway'));
-      test.done();
-    },
-    'with private subnets and custom networkAcl.'(test: Test) {
+      expect(stack).toCountResources('AWS::EC2::InternetGateway', 1);
+      expect(stack).not.toHaveResource('AWS::EC2::NatGateway');
+
+    });
+    test('with private subnets and custom networkAcl.', () => {
       const stack = getTestStack();
       const vpc = new Vpc(stack, 'TheVPC', {
         subnetConfiguration: [
@@ -213,22 +212,22 @@ nodeunitShim({
         cidr: AclCidr.anyIpv4(),
       });
 
-      cdkExpect(stack).to(countResources('AWS::EC2::NetworkAcl', 1));
-      cdkExpect(stack).to(countResources('AWS::EC2::NetworkAclEntry', 2));
-      cdkExpect(stack).to(countResources('AWS::EC2::SubnetNetworkAclAssociation', 3));
-      test.done();
-    },
+      expect(stack).toCountResources('AWS::EC2::NetworkAcl', 1);
+      expect(stack).toCountResources('AWS::EC2::NetworkAclEntry', 2);
+      expect(stack).toCountResources('AWS::EC2::SubnetNetworkAclAssociation', 3);
+
+    });
 
-    'with no subnets defined, the VPC should have an IGW, and a NAT Gateway per AZ'(test: Test) {
+    test('with no subnets defined, the VPC should have an IGW, and a NAT Gateway per AZ', () => {
       const stack = getTestStack();
       const zones = stack.availabilityZones.length;
       new Vpc(stack, 'TheVPC', {});
-      cdkExpect(stack).to(countResources('AWS::EC2::InternetGateway', 1));
-      cdkExpect(stack).to(countResources('AWS::EC2::NatGateway', zones));
-      test.done();
-    },
+      expect(stack).toCountResources('AWS::EC2::InternetGateway', 1);
+      expect(stack).toCountResources('AWS::EC2::NatGateway', zones);
 
-    'with isolated and public subnet, should be able to use the internet gateway to define routes'(test: Test) {
+    });
+
+    test('with isolated and public subnet, should be able to use the internet gateway to define routes', () => {
       const stack = getTestStack();
       const vpc = new Vpc(stack, 'TheVPC', {
         subnetConfiguration: [
@@ -247,30 +246,15 @@ nodeunitShim({
         routerType: RouterType.GATEWAY,
         destinationCidrBlock: '8.8.8.8/32',
       });
-      cdkExpect(stack).to(haveResource('AWS::EC2::InternetGateway'));
-      cdkExpect(stack).to(haveResourceLike('AWS::EC2::Route', {
+      expect(stack).toHaveResource('AWS::EC2::InternetGateway');
+      expect(stack).toHaveResourceLike('AWS::EC2::Route', {
         DestinationCidrBlock: '8.8.8.8/32',
         GatewayId: {},
-      }));
-      test.done();
-    },
-
-    'with only isolated subnets the internet gateway should be undefined'(test: Test) {
-      const stack = getTestStack();
-      const vpc = new Vpc(stack, 'TheVPC', {
-        subnetConfiguration: [
-          {
-            subnetType: SubnetType.PRIVATE_ISOLATED,
-            name: 'isolated',
-          },
-        ],
       });
-      test.equal(vpc.internetGatewayId, undefined);
-      cdkExpect(stack).notTo(haveResource('AWS::EC2::InternetGateway'));
-      test.done();
-    },
 
-    'with subnets and reserved subnets defined, VPC subnet count should not contain reserved subnets '(test: Test) {
+    });
+
+    test('with subnets and reserved subnets defined, VPC subnet count should not contain reserved subnets ', () => {
       const stack = getTestStack();
       new Vpc(stack, 'TheVPC', {
         cidr: '10.0.0.0/16',
@@ -294,10 +278,10 @@ nodeunitShim({
         ],
         maxAzs: 3,
       });
-      cdkExpect(stack).to(countResources('AWS::EC2::Subnet', 6));
-      test.done();
-    },
-    'with reserved subnets, any other subnets should not have cidrBlock from within reserved space'(test: Test) {
+      expect(stack).toCountResources('AWS::EC2::Subnet', 6);
+
+    });
+    test('with reserved subnets, any other subnets should not have cidrBlock from within reserved space', () => {
       const stack = getTestStack();
       new Vpc(stack, 'TheVPC', {
         cidr: '10.0.0.0/16',
@@ -322,23 +306,23 @@ nodeunitShim({
         maxAzs: 3,
       });
       for (let i = 0; i < 3; i++) {
-        cdkExpect(stack).to(haveResource('AWS::EC2::Subnet', {
+        expect(stack).toHaveResource('AWS::EC2::Subnet', {
           CidrBlock: `10.0.${i}.0/24`,
-        }));
+        });
       }
       for (let i = 3; i < 6; i++) {
-        cdkExpect(stack).notTo(haveResource('AWS::EC2::Subnet', {
+        expect(stack).not.toHaveResource('AWS::EC2::Subnet', {
           CidrBlock: `10.0.${i}.0/24`,
-        }));
+        });
       }
       for (let i = 6; i < 9; i++) {
-        cdkExpect(stack).to(haveResource('AWS::EC2::Subnet', {
+        expect(stack).toHaveResource('AWS::EC2::Subnet', {
           CidrBlock: `10.0.${i}.0/24`,
-        }));
+        });
       }
-      test.done();
-    },
-    'with custom subnets, the VPC should have the right number of subnets, an IGW, and a NAT Gateway per AZ'(test: Test) {
+
+    });
+    test('with custom subnets, the VPC should have the right number of subnets, an IGW, and a NAT Gateway per AZ', () => {
       const stack = getTestStack();
       const zones = stack.availabilityZones.length;
       new Vpc(stack, 'TheVPC', {
@@ -362,22 +346,22 @@ nodeunitShim({
         ],
         maxAzs: 3,
       });
-      cdkExpect(stack).to(countResources('AWS::EC2::InternetGateway', 1));
-      cdkExpect(stack).to(countResources('AWS::EC2::NatGateway', zones));
-      cdkExpect(stack).to(countResources('AWS::EC2::Subnet', 9));
+      expect(stack).toCountResources('AWS::EC2::InternetGateway', 1);
+      expect(stack).toCountResources('AWS::EC2::NatGateway', zones);
+      expect(stack).toCountResources('AWS::EC2::Subnet', 9);
       for (let i = 0; i < 6; i++) {
-        cdkExpect(stack).to(haveResource('AWS::EC2::Subnet', {
+        expect(stack).toHaveResource('AWS::EC2::Subnet', {
           CidrBlock: `10.0.${i}.0/24`,
-        }));
+        });
       }
       for (let i = 0; i < 3; i++) {
-        cdkExpect(stack).to(haveResource('AWS::EC2::Subnet', {
+        expect(stack).toHaveResource('AWS::EC2::Subnet', {
           CidrBlock: `10.0.6.${i * 16}/28`,
-        }));
+        });
       }
-      test.done();
-    },
-    'with custom subents and natGateways = 2 there should be only two NATGW'(test: Test) {
+
+    });
+    test('with custom subents and natGateways = 2 there should be only two NATGW', () => {
       const stack = getTestStack();
       new Vpc(stack, 'TheVPC', {
         cidr: '10.0.0.0/21',
@@ -401,30 +385,30 @@ nodeunitShim({
         ],
         maxAzs: 3,
       });
-      cdkExpect(stack).to(countResources('AWS::EC2::InternetGateway', 1));
-      cdkExpect(stack).to(countResources('AWS::EC2::NatGateway', 2));
-      cdkExpect(stack).to(countResources('AWS::EC2::Subnet', 9));
+      expect(stack).toCountResources('AWS::EC2::InternetGateway', 1);
+      expect(stack).toCountResources('AWS::EC2::NatGateway', 2);
+      expect(stack).toCountResources('AWS::EC2::Subnet', 9);
       for (let i = 0; i < 6; i++) {
-        cdkExpect(stack).to(haveResource('AWS::EC2::Subnet', {
+        expect(stack).toHaveResource('AWS::EC2::Subnet', {
           CidrBlock: `10.0.${i}.0/24`,
-        }));
+        });
       }
       for (let i = 0; i < 3; i++) {
-        cdkExpect(stack).to(haveResource('AWS::EC2::Subnet', {
+        expect(stack).toHaveResource('AWS::EC2::Subnet', {
           CidrBlock: `10.0.6.${i * 16}/28`,
-        }));
+        });
       }
-      test.done();
-    },
-    'with enableDnsHostnames enabled but enableDnsSupport disabled, should throw an Error'(test: Test) {
+
+    });
+    test('with enableDnsHostnames enabled but enableDnsSupport disabled, should throw an Error', () => {
       const stack = getTestStack();
-      test.throws(() => new Vpc(stack, 'TheVPC', {
+      expect(() => new Vpc(stack, 'TheVPC', {
         enableDnsHostnames: true,
         enableDnsSupport: false,
-      }));
-      test.done();
-    },
-    'with public subnets MapPublicIpOnLaunch is true'(test: Test) {
+      })).toThrow();
+
+    });
+    test('with public subnets MapPublicIpOnLaunch is true', () => {
       const stack = getTestStack();
       new Vpc(stack, 'VPC', {
         maxAzs: 1,
@@ -436,63 +420,63 @@ nodeunitShim({
           },
         ],
       });
-      cdkExpect(stack).to(countResources('AWS::EC2::Subnet', 1));
-      cdkExpect(stack).notTo(haveResource('AWS::EC2::NatGateway'));
-      cdkExpect(stack).to(haveResource('AWS::EC2::Subnet', {
+      expect(stack).toCountResources('AWS::EC2::Subnet', 1);
+      expect(stack).not.toHaveResource('AWS::EC2::NatGateway');
+      expect(stack).toHaveResource('AWS::EC2::Subnet', {
         MapPublicIpOnLaunch: true,
-      }));
-      test.done();
-    },
+      });
 
-    'maxAZs defaults to 3 if unset'(test: Test) {
+    });
+
+    test('maxAZs defaults to 3 if unset', () => {
       const stack = getTestStack();
       new Vpc(stack, 'VPC');
-      cdkExpect(stack).to(countResources('AWS::EC2::Subnet', 6));
-      cdkExpect(stack).to(countResources('AWS::EC2::Route', 6));
+      expect(stack).toCountResources('AWS::EC2::Subnet', 6);
+      expect(stack).toCountResources('AWS::EC2::Route', 6);
       for (let i = 0; i < 6; i++) {
-        cdkExpect(stack).to(haveResource('AWS::EC2::Subnet', {
+        expect(stack).toHaveResource('AWS::EC2::Subnet', {
           CidrBlock: `10.0.${i * 32}.0/19`,
-        }));
+        });
       }
-      cdkExpect(stack).to(haveResourceLike('AWS::EC2::Route', {
+      expect(stack).toHaveResourceLike('AWS::EC2::Route', {
         DestinationCidrBlock: '0.0.0.0/0',
         NatGatewayId: {},
-      }));
+      });
 
-      test.done();
-    },
 
-    'with maxAZs set to 2'(test: Test) {
+    });
+
+    test('with maxAZs set to 2', () => {
       const stack = getTestStack();
       new Vpc(stack, 'VPC', { maxAzs: 2 });
-      cdkExpect(stack).to(countResources('AWS::EC2::Subnet', 4));
-      cdkExpect(stack).to(countResources('AWS::EC2::Route', 4));
+      expect(stack).toCountResources('AWS::EC2::Subnet', 4);
+      expect(stack).toCountResources('AWS::EC2::Route', 4);
       for (let i = 0; i < 4; i++) {
-        cdkExpect(stack).to(haveResource('AWS::EC2::Subnet', {
+        expect(stack).toHaveResource('AWS::EC2::Subnet', {
           CidrBlock: `10.0.${i * 64}.0/18`,
-        }));
+        });
       }
-      cdkExpect(stack).to(haveResourceLike('AWS::EC2::Route', {
+      expect(stack).toHaveResourceLike('AWS::EC2::Route', {
         DestinationCidrBlock: '0.0.0.0/0',
         NatGatewayId: {},
-      }));
-      test.done();
-    },
-    'with natGateway set to 1'(test: Test) {
+      });
+
+    });
+    test('with natGateway set to 1', () => {
       const stack = getTestStack();
       new Vpc(stack, 'VPC', {
         natGateways: 1,
       });
-      cdkExpect(stack).to(countResources('AWS::EC2::Subnet', 6));
-      cdkExpect(stack).to(countResources('AWS::EC2::Route', 6));
-      cdkExpect(stack).to(countResources('AWS::EC2::NatGateway', 1));
-      cdkExpect(stack).to(haveResourceLike('AWS::EC2::Route', {
+      expect(stack).toCountResources('AWS::EC2::Subnet', 6);
+      expect(stack).toCountResources('AWS::EC2::Route', 6);
+      expect(stack).toCountResources('AWS::EC2::NatGateway', 1);
+      expect(stack).toHaveResourceLike('AWS::EC2::Route', {
         DestinationCidrBlock: '0.0.0.0/0',
         NatGatewayId: {},
-      }));
-      test.done();
-    },
-    'with natGateway subnets defined'(test: Test) {
+      });
+
+    });
+    test('with natGateway subnets defined', () => {
       const stack = getTestStack();
       new Vpc(stack, 'VPC', {
         subnetConfiguration: [
@@ -516,22 +500,22 @@ nodeunitShim({
           subnetGroupName: 'egress',
         },
       });
-      cdkExpect(stack).to(countResources('AWS::EC2::NatGateway', 3));
+      expect(stack).toCountResources('AWS::EC2::NatGateway', 3);
       for (let i = 1; i < 4; i++) {
-        cdkExpect(stack).to(haveResource('AWS::EC2::Subnet', hasTags([{
+        expect(stack).toHaveResource('AWS::EC2::Subnet', hasTags([{
           Key: 'Name',
           Value: `TestStack/VPC/egressSubnet${i}`,
         }, {
           Key: 'aws-cdk:subnet-name',
           Value: 'egress',
-        }])));
+        }]));
       }
-      test.done();
-    },
 
-    'natGateways = 0 throws if no PRIVATE subnets configured'(test: Test) {
+    });
+
+    test('natGateways = 0 throws if no PRIVATE subnets configured', () => {
       const stack = getTestStack();
-      test.throws(() => {
+      expect(() => {
         new Vpc(stack, 'VPC', {
           natGateways: 0,
           subnetConfiguration: [
@@ -545,34 +529,34 @@ nodeunitShim({
             },
           ],
         });
-      }, /make sure you don't configure any PRIVATE subnets/);
-      test.done();
+      }).toThrow(/make sure you don't configure any PRIVATE subnets/);
+
 
-    },
+    });
 
-    'natGateway = 0 defaults with ISOLATED subnet'(test: Test) {
+    test('natGateway = 0 defaults with ISOLATED subnet', () => {
       const stack = getTestStack();
       new Vpc(stack, 'VPC', {
         natGateways: 0,
       });
-      cdkExpect(stack).to(haveResource('AWS::EC2::Subnet', hasTags([{
+      expect(stack).toHaveResource('AWS::EC2::Subnet', hasTags([{
         Key: 'aws-cdk:subnet-type',
         Value: 'Isolated',
-      }])));
-      test.done();
-    },
+      }]));
+
+    });
 
-    'unspecified natGateways constructs with PRIVATE subnet'(test: Test) {
+    test('unspecified natGateways constructs with PRIVATE subnet', () => {
       const stack = getTestStack();
       new Vpc(stack, 'VPC');
-      cdkExpect(stack).to(haveResource('AWS::EC2::Subnet', hasTags([{
+      expect(stack).toHaveResource('AWS::EC2::Subnet', hasTags([{
         Key: 'aws-cdk:subnet-type',
         Value: 'Private',
-      }])));
-      test.done();
-    },
+      }]));
 
-    'natGateways = 0 allows RESERVED PRIVATE subnets'(test: Test) {
+    });
+
+    test('natGateways = 0 allows RESERVED PRIVATE subnets', () => {
       const stack = getTestStack();
       new Vpc(stack, 'VPC', {
         cidr: '10.0.0.0/16',
@@ -589,16 +573,16 @@ nodeunitShim({
         ],
         natGateways: 0,
       });
-      cdkExpect(stack).to(haveResource('AWS::EC2::Subnet', hasTags([{
+      expect(stack).toHaveResource('AWS::EC2::Subnet', hasTags([{
         Key: 'aws-cdk:subnet-name',
         Value: 'ingress',
-      }])));
-      test.done();
-    },
+      }]));
+
+    });
 
-    'with mis-matched nat and subnet configs it throws'(test: Test) {
+    test('with mis-matched nat and subnet configs it throws', () => {
       const stack = getTestStack();
-      test.throws(() => new Vpc(stack, 'VPC', {
+      expect(() => new Vpc(stack, 'VPC', {
         subnetConfiguration: [
           {
             cidrMask: 24,
@@ -614,31 +598,31 @@ nodeunitShim({
         natGatewaySubnets: {
           subnetGroupName: 'notthere',
         },
-      }));
-      test.done();
-    },
-    'with a vpn gateway'(test: Test) {
+      })).toThrow();
+
+    });
+    test('with a vpn gateway', () => {
       const stack = getTestStack();
       new Vpc(stack, 'VPC', {
         vpnGateway: true,
         vpnGatewayAsn: 65000,
       });
 
-      cdkExpect(stack).to(haveResource('AWS::EC2::VPNGateway', {
+      expect(stack).toHaveResource('AWS::EC2::VPNGateway', {
         AmazonSideAsn: 65000,
         Type: 'ipsec.1',
-      }));
+      });
 
-      cdkExpect(stack).to(haveResource('AWS::EC2::VPCGatewayAttachment', {
+      expect(stack).toHaveResource('AWS::EC2::VPCGatewayAttachment', {
         VpcId: {
           Ref: 'VPCB9E5F0B4',
         },
         VpnGatewayId: {
           Ref: 'VPCVpnGatewayB5ABAE68',
         },
-      }));
+      });
 
-      cdkExpect(stack).to(haveResource('AWS::EC2::VPNGatewayRoutePropagation', {
+      expect(stack).toHaveResource('AWS::EC2::VPNGatewayRoutePropagation', {
         RouteTableIds: [
           {
             Ref: 'VPCPrivateSubnet1RouteTableBE8A6027',
@@ -653,11 +637,11 @@ nodeunitShim({
         VpnGatewayId: {
           Ref: 'VPCVpnGatewayB5ABAE68',
         },
-      }));
+      });
 
-      test.done();
-    },
-    'with a vpn gateway and route propagation on isolated subnets'(test: Test) {
+
+    });
+    test('with a vpn gateway and route propagation on isolated subnets', () => {
       const stack = getTestStack();
       new Vpc(stack, 'VPC', {
         subnetConfiguration: [
@@ -672,7 +656,7 @@ nodeunitShim({
         ],
       });
 
-      cdkExpect(stack).to(haveResource('AWS::EC2::VPNGatewayRoutePropagation', {
+      expect(stack).toHaveResource('AWS::EC2::VPNGatewayRoutePropagation', {
         RouteTableIds: [
           {
             Ref: 'VPCIsolatedSubnet1RouteTableEB156210',
@@ -687,11 +671,11 @@ nodeunitShim({
         VpnGatewayId: {
           Ref: 'VPCVpnGatewayB5ABAE68',
         },
-      }));
+      });
+
 
-      test.done();
-    },
-    'with a vpn gateway and route propagation on private and isolated subnets'(test: Test) {
+    });
+    test('with a vpn gateway and route propagation on private and isolated subnets', () => {
       const stack = getTestStack();
       new Vpc(stack, 'VPC', {
         subnetConfiguration: [
@@ -710,7 +694,7 @@ nodeunitShim({
         ],
       });
 
-      cdkExpect(stack).to(haveResource('AWS::EC2::VPNGatewayRoutePropagation', {
+      expect(stack).toHaveResource('AWS::EC2::VPNGatewayRoutePropagation', {
         RouteTableIds: [
           {
             Ref: 'VPCPrivateSubnet1RouteTableBE8A6027',
@@ -734,11 +718,11 @@ nodeunitShim({
         VpnGatewayId: {
           Ref: 'VPCVpnGatewayB5ABAE68',
         },
-      }));
+      });
+
 
-      test.done();
-    },
-    'route propagation defaults to isolated subnets when there are no private subnets'(test: Test) {
+    });
+    test('route propagation defaults to isolated subnets when there are no private subnets', () => {
       const stack = getTestStack();
       new Vpc(stack, 'VPC', {
         subnetConfiguration: [
@@ -748,7 +732,7 @@ nodeunitShim({
         vpnGateway: true,
       });
 
-      cdkExpect(stack).to(haveResource('AWS::EC2::VPNGatewayRoutePropagation', {
+      expect(stack).toHaveResource('AWS::EC2::VPNGatewayRoutePropagation', {
         RouteTableIds: [
           {
             Ref: 'VPCIsolatedSubnet1RouteTableEB156210',
@@ -763,11 +747,11 @@ nodeunitShim({
         VpnGatewayId: {
           Ref: 'VPCVpnGatewayB5ABAE68',
         },
-      }));
+      });
+
 
-      test.done();
-    },
-    'route propagation defaults to public subnets when there are no private/isolated subnets'(test: Test) {
+    });
+    test('route propagation defaults to public subnets when there are no private/isolated subnets', () => {
       const stack = getTestStack();
       new Vpc(stack, 'VPC', {
         subnetConfiguration: [
@@ -776,7 +760,7 @@ nodeunitShim({
         vpnGateway: true,
       });
 
-      cdkExpect(stack).to(haveResource('AWS::EC2::VPNGatewayRoutePropagation', {
+      expect(stack).toHaveResource('AWS::EC2::VPNGatewayRoutePropagation', {
         RouteTableIds: [
           {
             Ref: 'VPCPublicSubnet1RouteTableFEE4B781',
@@ -791,15 +775,15 @@ nodeunitShim({
         VpnGatewayId: {
           Ref: 'VPCVpnGatewayB5ABAE68',
         },
-      }));
+      });
+
 
-      test.done();
-    },
-    'fails when specifying vpnConnections with vpnGateway set to false'(test: Test) {
+    });
+    test('fails when specifying vpnConnections with vpnGateway set to false', () => {
       // GIVEN
       const stack = new Stack();
 
-      test.throws(() => new Vpc(stack, 'VpcNetwork', {
+      expect(() => new Vpc(stack, 'VpcNetwork', {
         vpnGateway: false,
         vpnConnections: {
           VpnConnection: {
@@ -807,97 +791,97 @@ nodeunitShim({
             ip: '192.0.2.1',
           },
         },
-      }), /`vpnConnections`.+`vpnGateway`.+false/);
+      })).toThrow(/`vpnConnections`.+`vpnGateway`.+false/);
 
-      test.done();
-    },
-    'fails when specifying vpnGatewayAsn with vpnGateway set to false'(test: Test) {
+
+    });
+    test('fails when specifying vpnGatewayAsn with vpnGateway set to false', () => {
       // GIVEN
       const stack = new Stack();
 
-      test.throws(() => new Vpc(stack, 'VpcNetwork', {
+      expect(() => new Vpc(stack, 'VpcNetwork', {
         vpnGateway: false,
         vpnGatewayAsn: 65000,
-      }), /`vpnGatewayAsn`.+`vpnGateway`.+false/);
+      })).toThrow(/`vpnGatewayAsn`.+`vpnGateway`.+false/);
+
 
-      test.done();
-    },
+    });
 
-    'Subnets have a defaultChild'(test: Test) {
+    test('Subnets have a defaultChild', () => {
       // GIVEN
       const stack = new Stack();
 
       const vpc = new Vpc(stack, 'VpcNetwork');
 
-      test.ok(vpc.publicSubnets[0].node.defaultChild instanceof CfnSubnet);
+      expect(vpc.publicSubnets[0].node.defaultChild instanceof CfnSubnet).toEqual(true);
+
 
-      test.done();
-    },
+    });
 
-    'CIDR cannot be a Token'(test: Test) {
+    test('CIDR cannot be a Token', () => {
       const stack = new Stack();
-      test.throws(() => {
+      expect(() => {
         new Vpc(stack, 'Vpc', {
           cidr: Lazy.string({ produce: () => 'abc' }),
         });
-      }, /property must be a concrete CIDR string/);
+      }).toThrow(/property must be a concrete CIDR string/);
 
-      test.done();
-    },
 
-    'Default NAT gateway provider'(test: Test) {
+    });
+
+    test('Default NAT gateway provider', () => {
       const stack = new Stack();
       const natGatewayProvider = NatProvider.gateway();
       new Vpc(stack, 'VpcNetwork', { natGatewayProvider });
 
-      test.ok(natGatewayProvider.configuredGateways.length > 0);
+      expect(natGatewayProvider.configuredGateways.length).toBeGreaterThan(0);
+
 
-      test.done();
-    },
+    });
 
-    'NAT gateway provider with EIP allocations'(test: Test) {
+    test('NAT gateway provider with EIP allocations', () => {
       const stack = new Stack();
       const natGatewayProvider = NatProvider.gateway({
         eipAllocationIds: ['a', 'b', 'c', 'd'],
       });
       new Vpc(stack, 'VpcNetwork', { natGatewayProvider });
 
-      cdkExpect(stack).to(haveResource('AWS::EC2::NatGateway', {
+      expect(stack).toHaveResource('AWS::EC2::NatGateway', {
         AllocationId: 'a',
-      }));
-      cdkExpect(stack).to(haveResource('AWS::EC2::NatGateway', {
+      });
+      expect(stack).toHaveResource('AWS::EC2::NatGateway', {
         AllocationId: 'b',
-      }));
+      });
 
-      test.done();
-    },
 
-    'NAT gateway provider with insufficient EIP allocations'(test: Test) {
+    });
+
+    test('NAT gateway provider with insufficient EIP allocations', () => {
       const stack = new Stack();
       const natGatewayProvider = NatProvider.gateway({ eipAllocationIds: ['a'] });
       expect(() => new Vpc(stack, 'VpcNetwork', { natGatewayProvider }))
         .toThrow(/Not enough NAT gateway EIP allocation IDs \(1 provided\) for the requested subnet count \(\d+ needed\)/);
 
-      test.done();
-    },
 
-    'NAT gateway provider with token EIP allocations'(test: Test) {
+    });
+
+    test('NAT gateway provider with token EIP allocations', () => {
       const stack = new Stack();
       const eipAllocationIds = Fn.split(',', Fn.importValue('myVpcId'));
       const natGatewayProvider = NatProvider.gateway({ eipAllocationIds });
       new Vpc(stack, 'VpcNetwork', { natGatewayProvider });
 
-      cdkExpect(stack).to(haveResource('AWS::EC2::NatGateway', {
+      expect(stack).toHaveResource('AWS::EC2::NatGateway', {
         AllocationId: stack.resolve(Fn.select(0, eipAllocationIds)),
-      }));
-      cdkExpect(stack).to(haveResource('AWS::EC2::NatGateway', {
+      });
+      expect(stack).toHaveResource('AWS::EC2::NatGateway', {
         AllocationId: stack.resolve(Fn.select(1, eipAllocationIds)),
-      }));
+      });
+
 
-      test.done();
-    },
+    });
 
-    'Can add an IPv6 route'(test: Test) {
+    test('Can add an IPv6 route', () => {
       // GIVEN
       const stack = getTestStack();
 
@@ -911,14 +895,14 @@ nodeunitShim({
 
       // THEN
 
-      cdkExpect(stack).to(haveResourceLike('AWS::EC2::Route', {
+      expect(stack).toHaveResourceLike('AWS::EC2::Route', {
         DestinationIpv6CidrBlock: '2001:4860:4860::8888/32',
         NetworkInterfaceId: 'router-1',
-      }));
+      });
+
 
-      test.done();
-    },
-    'Can add an IPv4 route'(test: Test) {
+    });
+    test('Can add an IPv4 route', () => {
       // GIVEN
       const stack = getTestStack();
 
@@ -932,17 +916,17 @@ nodeunitShim({
 
       // THEN
 
-      cdkExpect(stack).to(haveResourceLike('AWS::EC2::Route', {
+      expect(stack).toHaveResourceLike('AWS::EC2::Route', {
         DestinationCidrBlock: '0.0.0.0/0',
         NetworkInterfaceId: 'router-1',
-      }));
+      });
+
 
-      test.done();
-    },
-  },
+    });
+  });
 
-  'NAT instances': {
-    'Can configure NAT instances instead of NAT gateways'(test: Test) {
+  describe('NAT instances', () => {
+    test('Can configure NAT instances instead of NAT gateways', () => {
       // GIVEN
       const stack = getTestStack();
 
@@ -956,18 +940,18 @@ nodeunitShim({
       new Vpc(stack, 'TheVPC', { natGatewayProvider });
 
       // THEN
-      cdkExpect(stack).to(countResources('AWS::EC2::Instance', 3));
-      cdkExpect(stack).to(haveResource('AWS::EC2::Instance', {
+      expect(stack).toCountResources('AWS::EC2::Instance', 3);
+      expect(stack).toHaveResource('AWS::EC2::Instance', {
         ImageId: 'ami-1',
         InstanceType: 'q86.mega',
         SourceDestCheck: false,
-      }));
-      cdkExpect(stack).to(haveResource('AWS::EC2::Route', {
+      });
+      expect(stack).toHaveResource('AWS::EC2::Route', {
         RouteTableId: { Ref: 'TheVPCPrivateSubnet1RouteTableF6513BC2' },
         DestinationCidrBlock: '0.0.0.0/0',
         InstanceId: { Ref: 'TheVPCPublicSubnet1NatInstanceCC514192' },
-      }));
-      cdkExpect(stack).to(haveResource('AWS::EC2::SecurityGroup', {
+      });
+      expect(stack).toHaveResource('AWS::EC2::SecurityGroup', {
         SecurityGroupEgress: [
           {
             CidrIp: '0.0.0.0/0',
@@ -982,12 +966,12 @@ nodeunitShim({
             IpProtocol: '-1',
           },
         ],
-      }));
+      });
+
 
-      test.done();
-    },
+    });
 
-    'natGateways controls amount of NAT instances'(test: Test) {
+    test('natGateways controls amount of NAT instances', () => {
       // GIVEN
       const stack = getTestStack();
 
@@ -1003,12 +987,12 @@ nodeunitShim({
       });
 
       // THEN
-      cdkExpect(stack).to(countResources('AWS::EC2::Instance', 1));
+      expect(stack).toCountResources('AWS::EC2::Instance', 1);
 
-      test.done();
-    },
 
-    'can configure Security Groups of NAT instances with allowAllTraffic false'(test: Test) {
+    });
+
+    test('can configure Security Groups of NAT instances with allowAllTraffic false', () => {
       // GIVEN
       const stack = getTestStack();
 
@@ -1026,7 +1010,7 @@ nodeunitShim({
       provider.connections.allowFrom(Peer.ipv4('1.2.3.4/32'), Port.tcp(86));
 
       // THEN
-      cdkExpect(stack).to(haveResource('AWS::EC2::SecurityGroup', {
+      expect(stack).toHaveResource('AWS::EC2::SecurityGroup', {
         SecurityGroupEgress: [
           {
             CidrIp: '0.0.0.0/0',
@@ -1043,12 +1027,12 @@ nodeunitShim({
             ToPort: 86,
           },
         ],
-      }));
+      });
 
-      test.done();
-    },
 
-    'can configure Security Groups of NAT instances with defaultAllowAll INBOUND_AND_OUTBOUND'(test: Test) {
+    });
+
+    test('can configure Security Groups of NAT instances with defaultAllowAll INBOUND_AND_OUTBOUND', () => {
       // GIVEN
       const stack = getTestStack();
 
@@ -1065,7 +1049,7 @@ nodeunitShim({
       });
 
       // THEN
-      cdkExpect(stack).to(haveResource('AWS::EC2::SecurityGroup', {
+      expect(stack).toHaveResource('AWS::EC2::SecurityGroup', {
         SecurityGroupEgress: [
           {
             CidrIp: '0.0.0.0/0',
@@ -1080,12 +1064,12 @@ nodeunitShim({
             IpProtocol: '-1',
           },
         ],
-      }));
+      });
 
-      test.done();
-    },
 
-    'can configure Security Groups of NAT instances with defaultAllowAll OUTBOUND_ONLY'(test: Test) {
+    });
+
+    test('can configure Security Groups of NAT instances with defaultAllowAll OUTBOUND_ONLY', () => {
       // GIVEN
       const stack = getTestStack();
 
@@ -1102,7 +1086,7 @@ nodeunitShim({
       });
 
       // THEN
-      cdkExpect(stack).to(haveResource('AWS::EC2::SecurityGroup', {
+      expect(stack).toHaveResource('AWS::EC2::SecurityGroup', {
         SecurityGroupEgress: [
           {
             CidrIp: '0.0.0.0/0',
@@ -1110,12 +1094,12 @@ nodeunitShim({
             IpProtocol: '-1',
           },
         ],
-      }));
+      });
 
-      test.done();
-    },
 
-    'can configure Security Groups of NAT instances with defaultAllowAll NONE'(test: Test) {
+    });
+
+    test('can configure Security Groups of NAT instances with defaultAllowAll NONE', () => {
       // GIVEN
       const stack = getTestStack();
 
@@ -1132,7 +1116,7 @@ nodeunitShim({
       });
 
       // THEN
-      cdkExpect(stack).to(haveResource('AWS::EC2::SecurityGroup', {
+      expect(stack).toHaveResource('AWS::EC2::SecurityGroup', {
         SecurityGroupEgress: [
           {
             CidrIp: '255.255.255.255/32',
@@ -1142,15 +1126,15 @@ nodeunitShim({
             ToPort: 86,
           },
         ],
-      }));
+      });
 
-      test.done();
-    },
 
-  },
+    });
 
-  'Network ACL association': {
-    'by default uses default ACL reference'(test: Test) {
+  });
+
+  describe('Network ACL association', () => {
+    test('by default uses default ACL reference', () => {
       // GIVEN
       const stack = getTestStack();
 
@@ -1160,7 +1144,7 @@ nodeunitShim({
         value: (vpc.publicSubnets[0] as Subnet).subnetNetworkAclAssociationId,
       });
 
-      cdkExpect(stack).toMatch({
+      expect(stack).toMatchTemplate({
         Outputs: {
           Output: {
             Value: { 'Fn::GetAtt': ['TheVPCPublicSubnet1Subnet770D4FF2', 'NetworkAclAssociationId'] },
@@ -1168,10 +1152,10 @@ nodeunitShim({
         },
       }, MatchStyle.SUPERSET);
 
-      test.done();
-    },
 
-    'if ACL is replaced new ACL reference is returned'(test: Test) {
+    });
+
+    test('if ACL is replaced new ACL reference is returned', () => {
       // GIVEN
       const stack = getTestStack();
       const vpc = new Vpc(stack, 'TheVPC', { cidr: '192.168.0.0/16' });
@@ -1185,7 +1169,7 @@ nodeunitShim({
         subnetSelection: { subnetType: SubnetType.PUBLIC },
       });
 
-      cdkExpect(stack).toMatch({
+      expect(stack).toMatchTemplate({
         Outputs: {
           Output: {
             Value: { Ref: 'ACLDBD1BB49' },
@@ -1193,22 +1177,22 @@ nodeunitShim({
         },
       }, MatchStyle.SUPERSET);
 
-      test.done();
-    },
-  },
 
-  'When creating a VPC with a custom CIDR range': {
-    'vpc.vpcCidrBlock is the correct network range'(test: Test) {
+    });
+  });
+
+  describe('When creating a VPC with a custom CIDR range', () => {
+    test('vpc.vpcCidrBlock is the correct network range', () => {
       const stack = getTestStack();
       new Vpc(stack, 'TheVPC', { cidr: '192.168.0.0/16' });
-      cdkExpect(stack).to(haveResource('AWS::EC2::VPC', {
+      expect(stack).toHaveResource('AWS::EC2::VPC', {
         CidrBlock: '192.168.0.0/16',
-      }));
-      test.done();
-    },
-  },
-  'When tagging': {
-    'VPC propagated tags will be on subnet, IGW, routetables, NATGW'(test: Test) {
+      });
+
+    });
+  });
+  describe('When tagging', () => {
+    test('VPC propagated tags will be on subnet, IGW, routetables, NATGW', () => {
       const stack = getTestStack();
       const tags = {
         VpcType: 'Good',
@@ -1222,44 +1206,44 @@ nodeunitShim({
       // overwrite to set propagate
       Tags.of(vpc).add('BusinessUnit', 'Marketing', { includeResourceTypes: [CfnVPC.CFN_RESOURCE_TYPE_NAME] });
       Tags.of(vpc).add('VpcType', 'Good');
-      cdkExpect(stack).to(haveResource('AWS::EC2::VPC', hasTags(toCfnTags(allTags))));
+      expect(stack).toHaveResource('AWS::EC2::VPC', hasTags(toCfnTags(allTags)));
       const taggables = ['Subnet', 'InternetGateway', 'NatGateway', 'RouteTable'];
       const propTags = toCfnTags(tags);
       const noProp = toCfnTags(noPropTags);
       for (const resource of taggables) {
-        cdkExpect(stack).to(haveResource(`AWS::EC2::${resource}`, hasTags(propTags)));
-        cdkExpect(stack).notTo(haveResource(`AWS::EC2::${resource}`, hasTags(noProp)));
+        expect(stack).toHaveResource(`AWS::EC2::${resource}`, hasTags(propTags));
+        expect(stack).not.toHaveResource(`AWS::EC2::${resource}`, hasTags(noProp));
       }
-      test.done();
-    },
-    'Subnet Name will propagate to route tables and NATGW'(test: Test) {
+
+    });
+    test('Subnet Name will propagate to route tables and NATGW', () => {
       const stack = getTestStack();
       const vpc = new Vpc(stack, 'TheVPC');
       for (const subnet of vpc.publicSubnets) {
         const tag = { Key: 'Name', Value: subnet.node.path };
-        cdkExpect(stack).to(haveResource('AWS::EC2::NatGateway', hasTags([tag])));
-        cdkExpect(stack).to(haveResource('AWS::EC2::RouteTable', hasTags([tag])));
+        expect(stack).toHaveResource('AWS::EC2::NatGateway', hasTags([tag]));
+        expect(stack).toHaveResource('AWS::EC2::RouteTable', hasTags([tag]));
       }
       for (const subnet of vpc.privateSubnets) {
         const tag = { Key: 'Name', Value: subnet.node.path };
-        cdkExpect(stack).to(haveResource('AWS::EC2::RouteTable', hasTags([tag])));
+        expect(stack).toHaveResource('AWS::EC2::RouteTable', hasTags([tag]));
       }
-      test.done();
-    },
-    'Tags can be added after the Vpc is created with `vpc.tags.setTag(...)`'(test: Test) {
+
+    });
+    test('Tags can be added after the Vpc is created with `vpc.tags.setTag(...)`', () => {
       const stack = getTestStack();
 
       const vpc = new Vpc(stack, 'TheVPC');
       const tag = { Key: 'Late', Value: 'Adder' };
-      cdkExpect(stack).notTo(haveResource('AWS::EC2::VPC', hasTags([tag])));
+      expect(stack).not.toHaveResource('AWS::EC2::VPC', hasTags([tag]));
       Tags.of(vpc).add(tag.Key, tag.Value);
-      cdkExpect(stack).to(haveResource('AWS::EC2::VPC', hasTags([tag])));
-      test.done();
-    },
-  },
+      expect(stack).toHaveResource('AWS::EC2::VPC', hasTags([tag]));
+
+    });
+  });
 
-  'subnet selection': {
-    'selecting default subnets returns the private ones'(test: Test) {
+  describe('subnet selection', () => {
+    test('selecting default subnets returns the private ones', () => {
       // GIVEN
       const stack = getTestStack();
       const vpc = new Vpc(stack, 'VPC');
@@ -1268,11 +1252,11 @@ nodeunitShim({
       const { subnetIds } = vpc.selectSubnets();
 
       // THEN
-      test.deepEqual(subnetIds, vpc.privateSubnets.map(s => s.subnetId));
-      test.done();
-    },
+      expect(subnetIds).toEqual(vpc.privateSubnets.map(s => s.subnetId));
 
-    'can select public subnets'(test: Test) {
+    });
+
+    test('can select public subnets', () => {
       // GIVEN
       const stack = getTestStack();
       const vpc = new Vpc(stack, 'VPC');
@@ -1281,12 +1265,12 @@ nodeunitShim({
       const { subnetIds } = vpc.selectSubnets({ subnetType: SubnetType.PUBLIC });
 
       // THEN
-      test.deepEqual(subnetIds, vpc.publicSubnets.map(s => s.subnetId));
+      expect(subnetIds).toEqual(vpc.publicSubnets.map(s => s.subnetId));
+
 
-      test.done();
-    },
+    });
 
-    'can select isolated subnets'(test: Test) {
+    test('can select isolated subnets', () => {
       // GIVEN
       const stack = getTestStack();
       const vpc = new Vpc(stack, 'VPC', {
@@ -1300,12 +1284,12 @@ nodeunitShim({
       const { subnetIds } = vpc.selectSubnets({ subnetType: SubnetType.PRIVATE_ISOLATED });
 
       // THEN
-      test.deepEqual(subnetIds, vpc.isolatedSubnets.map(s => s.subnetId));
+      expect(subnetIds).toEqual(vpc.isolatedSubnets.map(s => s.subnetId));
 
-      test.done();
-    },
 
-    'can select subnets by name'(test: Test) {
+    });
+
+    test('can select subnets by name', () => {
       // GIVEN
       const stack = getTestStack();
       const vpc = new Vpc(stack, 'VPC', {
@@ -1320,11 +1304,11 @@ nodeunitShim({
       const { subnetIds } = vpc.selectSubnets({ subnetGroupName: 'DontTalkToMe' });
 
       // THEN
-      test.deepEqual(subnetIds, vpc.privateSubnets.map(s => s.subnetId));
-      test.done();
-    },
+      expect(subnetIds).toEqual(vpc.privateSubnets.map(s => s.subnetId));
+
+    });
 
-    'subnetName is an alias for subnetGroupName (backwards compat)'(test: Test) {
+    test('subnetName is an alias for subnetGroupName (backwards compat)', () => {
       // GIVEN
       const stack = getTestStack();
       const vpc = new Vpc(stack, 'VPC', {
@@ -1339,11 +1323,11 @@ nodeunitShim({
       const { subnetIds } = vpc.selectSubnets({ subnetName: 'DontTalkToMe' });
 
       // THEN
-      test.deepEqual(subnetIds, vpc.privateSubnets.map(s => s.subnetId));
-      test.done();
-    },
+      expect(subnetIds).toEqual(vpc.privateSubnets.map(s => s.subnetId));
 
-    'selecting default subnets in a VPC with only isolated subnets returns the isolateds'(test: Test) {
+    });
+
+    test('selecting default subnets in a VPC with only isolated subnets returns the isolateds', () => {
       // GIVEN
       const stack = new Stack();
       const vpc = Vpc.fromVpcAttributes(stack, 'VPC', {
@@ -1357,11 +1341,11 @@ nodeunitShim({
       const subnets = vpc.selectSubnets();
 
       // THEN
-      test.deepEqual(subnets.subnetIds, ['iso-1', 'iso-2', 'iso-3']);
-      test.done();
-    },
+      expect(subnets.subnetIds).toEqual(['iso-1', 'iso-2', 'iso-3']);
+
+    });
 
-    'selecting default subnets in a VPC with only public subnets returns the publics'(test: Test) {
+    test('selecting default subnets in a VPC with only public subnets returns the publics', () => {
       // GIVEN
       const stack = new Stack();
       const vpc = Vpc.fromVpcAttributes(stack, 'VPC', {
@@ -1375,23 +1359,23 @@ nodeunitShim({
       const subnets = vpc.selectSubnets();
 
       // THEN
-      test.deepEqual(subnets.subnetIds, ['pub-1', 'pub-2', 'pub-3']);
-      test.done();
-    },
+      expect(subnets.subnetIds).toEqual(['pub-1', 'pub-2', 'pub-3']);
+
+    });
 
-    'selecting subnets by name fails if the name is unknown'(test: Test) {
+    test('selecting subnets by name fails if the name is unknown', () => {
       // GIVEN
       const stack = new Stack();
       const vpc = new Vpc(stack, 'VPC');
 
-      test.throws(() => {
+      expect(() => {
         vpc.selectSubnets({ subnetGroupName: 'Toot' });
-      }, /There are no subnet groups with name 'Toot' in this VPC. Available names: Public,Private/);
+      }).toThrow(/There are no subnet groups with name 'Toot' in this VPC. Available names: Public,Private/);
 
-      test.done();
-    },
 
-    'select subnets with az restriction'(test: Test) {
+    });
+
+    test('select subnets with az restriction', () => {
       // GIVEN
       const stack = getTestStack();
       const vpc = new Vpc(stack, 'VpcNetwork', {
@@ -1407,12 +1391,12 @@ nodeunitShim({
       const { subnetIds } = vpc.selectSubnets({ onePerAz: true });
 
       // THEN
-      test.deepEqual(subnetIds.length, 1);
-      test.deepEqual(subnetIds[0], vpc.privateSubnets[0].subnetId);
-      test.done();
-    },
+      expect(subnetIds.length).toEqual(1);
+      expect(subnetIds[0]).toEqual(vpc.privateSubnets[0].subnetId);
+
+    });
 
-    'fromVpcAttributes using unknown-length list tokens'(test: Test) {
+    test('fromVpcAttributes using unknown-length list tokens', () => {
       // GIVEN
       const stack = getTestStack();
 
@@ -1435,9 +1419,9 @@ nodeunitShim({
       });
 
       // THEN - No exception
-      cdkExpect(stack).to(haveResource('Some::Resource', {
+      expect(stack).toHaveResource('Some::Resource', {
         subnetIds: { 'Fn::Split': [',', { 'Fn::ImportValue': 'myPublicSubnetIds' }] },
-      }));
+      });
 
       // THEN - Warnings have been added to the stack metadata
       const asm = SynthUtils.synthesize(stack);
@@ -1452,10 +1436,10 @@ nodeunitShim({
         ),
       ]));
 
-      test.done();
-    },
 
-    'fromVpcAttributes using fixed-length list tokens'(test: Test) {
+    });
+
+    test('fromVpcAttributes using fixed-length list tokens', () => {
       // GIVEN
       const stack = getTestStack();
 
@@ -1480,17 +1464,17 @@ nodeunitShim({
       // THEN - No exception
 
       const publicSubnetList = { 'Fn::Split': [',', { 'Fn::ImportValue': 'myPublicSubnetIds' }] };
-      cdkExpect(stack).to(haveResource('Some::Resource', {
+      expect(stack).toHaveResource('Some::Resource', {
         subnetIds: [
           { 'Fn::Select': [0, publicSubnetList] },
           { 'Fn::Select': [1, publicSubnetList] },
         ],
-      }));
+      });
+
 
-      test.done();
-    },
+    });
 
-    'select explicitly defined subnets'(test: Test) {
+    test('select explicitly defined subnets', () => {
       // GIVEN
       const stack = getTestStack();
       const vpc = Vpc.fromVpcAttributes(stack, 'VPC', {
@@ -1509,12 +1493,12 @@ nodeunitShim({
       const { subnetIds } = vpc.selectSubnets({ subnets: [subnet] });
 
       // THEN
-      test.deepEqual(subnetIds.length, 1);
-      test.deepEqual(subnetIds[0], subnet.subnetId);
-      test.done();
-    },
+      expect(subnetIds.length).toEqual(1);
+      expect(subnetIds[0]).toEqual(subnet.subnetId);
 
-    'subnet created from subnetId'(test: Test) {
+    });
+
+    test('subnet created from subnetId', () => {
       // GIVEN
       const stack = getTestStack();
 
@@ -1522,11 +1506,11 @@ nodeunitShim({
       const subnet = Subnet.fromSubnetId(stack, 'subnet1', 'pub-1');
 
       // THEN
-      test.deepEqual(subnet.subnetId, 'pub-1');
-      test.done();
-    },
+      expect(subnet.subnetId).toEqual('pub-1');
+
+    });
 
-    'Referencing AZ throws error when subnet created from subnetId'(test: Test) {
+    test('Referencing AZ throws error when subnet created from subnetId', () => {
       // GIVEN
       const stack = getTestStack();
 
@@ -1535,11 +1519,11 @@ nodeunitShim({
 
       // THEN
       // eslint-disable-next-line max-len
-      test.throws(() => subnet.availabilityZone, "You cannot reference a Subnet's availability zone if it was not supplied. Add the availabilityZone when importing using Subnet.fromSubnetAttributes()");
-      test.done();
-    },
+      expect(() => subnet.availabilityZone).toThrow("You cannot reference a Subnet's availability zone if it was not supplied. Add the availabilityZone when importing using Subnet.fromSubnetAttributes()");
+
+    });
 
-    'Referencing AZ throws error when subnet created from attributes without az'(test: Test) {
+    test('Referencing AZ throws error when subnet created from attributes without az', () => {
       // GIVEN
       const stack = getTestStack();
 
@@ -1547,13 +1531,13 @@ nodeunitShim({
       const subnet = Subnet.fromSubnetAttributes(stack, 'subnet1', { subnetId: 'pub-1', availabilityZone: '' });
 
       // THEN
-      test.deepEqual(subnet.subnetId, 'pub-1');
+      expect(subnet.subnetId).toEqual('pub-1');
       // eslint-disable-next-line max-len
-      test.throws(() => subnet.availabilityZone, "You cannot reference a Subnet's availability zone if it was not supplied. Add the availabilityZone when importing using Subnet.fromSubnetAttributes()");
-      test.done();
-    },
+      expect(() => subnet.availabilityZone).toThrow("You cannot reference a Subnet's availability zone if it was not supplied. Add the availabilityZone when importing using Subnet.fromSubnetAttributes()");
 
-    'AZ have value when subnet created from attributes with az'(test: Test) {
+    });
+
+    test('AZ have value when subnet created from attributes with az', () => {
       // GIVEN
       const stack = getTestStack();
 
@@ -1561,12 +1545,12 @@ nodeunitShim({
       const subnet = Subnet.fromSubnetAttributes(stack, 'subnet1', { subnetId: 'pub-1', availabilityZone: 'az-1234' });
 
       // THEN
-      test.deepEqual(subnet.subnetId, 'pub-1');
-      test.deepEqual(subnet.availabilityZone, 'az-1234');
-      test.done();
-    },
+      expect(subnet.subnetId).toEqual('pub-1');
+      expect(subnet.availabilityZone).toEqual('az-1234');
+
+    });
 
-    'Can select subnets by type and AZ'(test: Test) {
+    test('Can select subnets by type and AZ', () => {
       // GIVEN
       const stack = getTestStack();
       const vpc = new Vpc(stack, 'VPC', {
@@ -1585,7 +1569,7 @@ nodeunitShim({
       });
 
       // THEN
-      cdkExpect(stack).to(haveResource('AWS::EC2::VPCEndpoint', {
+      expect(stack).toHaveResource('AWS::EC2::VPCEndpoint', {
         ServiceName: 'com.amazonaws.vpce.us-east-1.vpce-svc-uuddlrlrbastrtsvc',
         SubnetIds: [
           {
@@ -1595,11 +1579,11 @@ nodeunitShim({
             Ref: 'VPCPrivateSubnet3Subnet3EDCD457',
           },
         ],
-      }));
-      test.done();
-    },
+      });
+
+    });
 
-    'SubnetSelection filtered on az uses default subnetType when no subnet type specified'(test: Test) {
+    test('SubnetSelection filtered on az uses default subnetType when no subnet type specified', () => {
       // GIVEN
       const stack = getTestStack();
       const vpc = new Vpc(stack, 'VPC', {
@@ -1616,7 +1600,7 @@ nodeunitShim({
       });
 
       // THEN
-      cdkExpect(stack).to(haveResource('AWS::EC2::VPCEndpoint', {
+      expect(stack).toHaveResource('AWS::EC2::VPCEndpoint', {
         ServiceName: 'com.amazonaws.vpce.us-east-1.vpce-svc-uuddlrlrbastrtsvc',
         SubnetIds: [
           {
@@ -1626,10 +1610,10 @@ nodeunitShim({
             Ref: 'VPCPrivateSubnet3Subnet3EDCD457',
           },
         ],
-      }));
-      test.done();
-    },
-    'SubnetSelection doesnt throw error when selecting imported subnets'(test: Test) {
+      });
+
+    });
+    test('SubnetSelection doesnt throw error when selecting imported subnets', () => {
       // GIVEN
       const stack = getTestStack();
 
@@ -1637,15 +1621,15 @@ nodeunitShim({
       const vpc = new Vpc(stack, 'VPC');
 
       // THEN
-      test.doesNotThrow(() => vpc.selectSubnets({
+      expect(() => vpc.selectSubnets({
         subnets: [
           Subnet.fromSubnetId(stack, 'Subnet', 'sub-1'),
         ],
-      }));
-      test.done();
-    },
+      })).not.toThrow();
 
-    'can filter by single IP address'(test: Test) {
+    });
+
+    test('can filter by single IP address', () => {
       // GIVEN
       const stack = getTestStack();
 
@@ -1668,15 +1652,15 @@ nodeunitShim({
       // THEN
       // 10.0.160.0/19 is the third subnet, sequentially, if you split
       // 10.0.0.0/16 into 6 pieces
-      cdkExpect(stack).to(haveResource('AWS::EC2::Instance', {
+      expect(stack).toHaveResource('AWS::EC2::Instance', {
         SubnetId: {
           Ref: 'VPCPrivateSubnet3Subnet3EDCD457',
         },
-      }));
-      test.done();
-    },
+      });
+
+    });
 
-    'can filter by multiple IP addresses'(test: Test) {
+    test('can filter by multiple IP addresses', () => {
       // GIVEN
       const stack = getTestStack();
 
@@ -1699,7 +1683,7 @@ nodeunitShim({
       });
 
       // THEN
-      cdkExpect(stack).to(haveResource('AWS::EC2::VPCEndpoint', {
+      expect(stack).toHaveResource('AWS::EC2::VPCEndpoint', {
         ServiceName: 'com.amazonaws.vpce.us-east-1.vpce-svc-uuddlrlrbastrtsvc',
         SubnetIds: [
           {
@@ -1709,11 +1693,11 @@ nodeunitShim({
             Ref: 'VPCPrivateSubnet3Subnet3EDCD457',
           },
         ],
-      }));
-      test.done();
-    },
+      });
+
+    });
 
-    'can filter by Subnet Ids'(test: Test) {
+    test('can filter by Subnet Ids', () => {
       // GIVEN
       const stack = getTestStack();
 
@@ -1734,14 +1718,14 @@ nodeunitShim({
       });
 
       // THEN
-      cdkExpect(stack).to(haveResource('AWS::EC2::VPCEndpoint', {
+      expect(stack).toHaveResource('AWS::EC2::VPCEndpoint', {
         ServiceName: 'com.amazonaws.vpce.us-east-1.vpce-svc-uuddlrlrbastrtsvc',
         SubnetIds: ['priv-1', 'priv-2'],
-      }));
-      test.done();
-    },
+      });
+
+    });
 
-    'can filter by Cidr Netmask'(test: Test) {
+    test('can filter by Cidr Netmask', () => {
       // GIVEN
       const stack = getTestStack();
       const vpc = new Vpc(stack, 'VpcNetwork', {
@@ -1759,12 +1743,12 @@ nodeunitShim({
       );
 
       // THEN
-      test.deepEqual(subnetIds.length, 2);
+      expect(subnetIds.length).toEqual(2);
       const expected = vpc.publicSubnets.filter(s => s.ipv4CidrBlock.endsWith('/20'));
-      test.deepEqual(subnetIds, expected.map(s => s.subnetId));
-      test.done();
-    },
-  },
+      expect(subnetIds).toEqual(expected.map(s => s.subnetId));
+
+    });
+  });
 });
 
 function getTestStack(): Stack {
diff --git a/packages/@aws-cdk/aws-ec2/test/vpn.test.ts b/packages/@aws-cdk/aws-ec2/test/vpn.test.ts
index 3240c59a5c9e0..8a4c99159e5ec 100644
--- a/packages/@aws-cdk/aws-ec2/test/vpn.test.ts
+++ b/packages/@aws-cdk/aws-ec2/test/vpn.test.ts
@@ -1,10 +1,9 @@
-import { expect, haveResource } from '@aws-cdk/assert-internal';
+import '@aws-cdk/assert-internal/jest';
 import { Duration, Stack, Token } from '@aws-cdk/core';
-import { nodeunitShim, Test } from 'nodeunit-shim';
 import { PublicSubnet, Vpc, VpnConnection } from '../lib';
 
-nodeunitShim({
-  'can add a vpn connection to a vpc with a vpn gateway'(test: Test) {
+describe('vpn', () => {
+  test('can add a vpn connection to a vpc with a vpn gateway', () => {
     // GIVEN
     const stack = new Stack();
 
@@ -19,13 +18,13 @@ nodeunitShim({
     });
 
     // THEN
-    expect(stack).to(haveResource('AWS::EC2::CustomerGateway', {
+    expect(stack).toHaveResource('AWS::EC2::CustomerGateway', {
       BgpAsn: 65001,
       IpAddress: '192.0.2.1',
       Type: 'ipsec.1',
-    }));
+    });
 
-    expect(stack).to(haveResource('AWS::EC2::VPNConnection', {
+    expect(stack).toHaveResource('AWS::EC2::VPNConnection', {
       CustomerGatewayId: {
         Ref: 'VpcNetworkVpnConnectionCustomerGateway8B56D9AF',
       },
@@ -34,12 +33,12 @@ nodeunitShim({
         Ref: 'VpcNetworkVpnGateway501295FA',
       },
       StaticRoutesOnly: false,
-    }));
+    });
+
 
-    test.done();
-  },
+  });
 
-  'with static routing'(test: Test) {
+  test('with static routing', () => {
     // GIVEN
     const stack = new Stack();
 
@@ -57,7 +56,7 @@ nodeunitShim({
     });
 
     // THEN
-    expect(stack).to(haveResource('AWS::EC2::VPNConnection', {
+    expect(stack).toHaveResource('AWS::EC2::VPNConnection', {
       CustomerGatewayId: {
         Ref: 'VpcNetworkstaticCustomerGatewayAF2651CC',
       },
@@ -66,26 +65,26 @@ nodeunitShim({
         Ref: 'VpcNetworkVpnGateway501295FA',
       },
       StaticRoutesOnly: true,
-    }));
+    });
 
-    expect(stack).to(haveResource('AWS::EC2::VPNConnectionRoute', {
+    expect(stack).toHaveResource('AWS::EC2::VPNConnectionRoute', {
       DestinationCidrBlock: '192.168.10.0/24',
       VpnConnectionId: {
         Ref: 'VpcNetworkstaticE33EA98C',
       },
-    }));
+    });
 
-    expect(stack).to(haveResource('AWS::EC2::VPNConnectionRoute', {
+    expect(stack).toHaveResource('AWS::EC2::VPNConnectionRoute', {
       DestinationCidrBlock: '192.168.20.0/24',
       VpnConnectionId: {
         Ref: 'VpcNetworkstaticE33EA98C',
       },
-    }));
+    });
 
-    test.done();
-  },
 
-  'with tunnel options'(test: Test) {
+  });
+
+  test('with tunnel options', () => {
     // GIVEN
     const stack = new Stack();
 
@@ -103,7 +102,7 @@ nodeunitShim({
       },
     });
 
-    expect(stack).to(haveResource('AWS::EC2::VPNConnection', {
+    expect(stack).toHaveResource('AWS::EC2::VPNConnection', {
       CustomerGatewayId: {
         Ref: 'VpcNetworkVpnConnectionCustomerGateway8B56D9AF',
       },
@@ -118,31 +117,31 @@ nodeunitShim({
           TunnelInsideCidr: '169.254.10.0/30',
         },
       ],
-    }));
+    });
+
 
-    test.done();
-  },
+  });
 
-  'fails when ip is invalid'(test: Test) {
+  test('fails when ip is invalid', () => {
     // GIVEN
     const stack = new Stack();
 
-    test.throws(() => new Vpc(stack, 'VpcNetwork', {
+    expect(() => new Vpc(stack, 'VpcNetwork', {
       vpnConnections: {
         VpnConnection: {
           ip: '192.0.2.256',
         },
       },
-    }), /`ip`.+IPv4/);
+    })).toThrow(/`ip`.+IPv4/);
 
-    test.done();
-  },
 
-  'fails when specifying more than two tunnel options'(test: Test) {
+  });
+
+  test('fails when specifying more than two tunnel options', () => {
     // GIVEN
     const stack = new Stack();
 
-    test.throws(() => new Vpc(stack, 'VpcNetwork', {
+    expect(() => new Vpc(stack, 'VpcNetwork', {
       vpnConnections: {
         VpnConnection: {
           ip: '192.0.2.1',
@@ -159,16 +158,16 @@ nodeunitShim({
           ],
         },
       },
-    }), /two.+`tunnelOptions`/);
+    })).toThrow(/two.+`tunnelOptions`/);
+
 
-    test.done();
-  },
+  });
 
-  'fails with duplicate tunnel inside cidr'(test: Test) {
+  test('fails with duplicate tunnel inside cidr', () => {
     // GIVEN
     const stack = new Stack();
 
-    test.throws(() => new Vpc(stack, 'VpcNetwork', {
+    expect(() => new Vpc(stack, 'VpcNetwork', {
       vpnConnections: {
         VpnConnection: {
           ip: '192.0.2.1',
@@ -182,16 +181,16 @@ nodeunitShim({
           ],
         },
       },
-    }), /`tunnelInsideCidr`.+both tunnels/);
+    })).toThrow(/`tunnelInsideCidr`.+both tunnels/);
 
-    test.done();
-  },
 
-  'fails when specifying an invalid pre-shared key'(test: Test) {
+  });
+
+  test('fails when specifying an invalid pre-shared key', () => {
     // GIVEN
     const stack = new Stack();
 
-    test.throws(() => new Vpc(stack, 'VpcNetwork', {
+    expect(() => new Vpc(stack, 'VpcNetwork', {
       vpnConnections: {
         VpnConnection: {
           ip: '192.0.2.1',
@@ -202,16 +201,16 @@ nodeunitShim({
           ],
         },
       },
-    }), /`preSharedKey`/);
+    })).toThrow(/`preSharedKey`/);
+
 
-    test.done();
-  },
+  });
 
-  'fails when specifying a reserved tunnel inside cidr'(test: Test) {
+  test('fails when specifying a reserved tunnel inside cidr', () => {
     // GIVEN
     const stack = new Stack();
 
-    test.throws(() => new Vpc(stack, 'VpcNetwork', {
+    expect(() => new Vpc(stack, 'VpcNetwork', {
       vpnConnections: {
         VpnConnection: {
           ip: '192.0.2.1',
@@ -222,16 +221,16 @@ nodeunitShim({
           ],
         },
       },
-    }), /`tunnelInsideCidr`.+reserved/);
+    })).toThrow(/`tunnelInsideCidr`.+reserved/);
+
 
-    test.done();
-  },
+  });
 
-  'fails when specifying an invalid tunnel inside cidr'(test: Test) {
+  test('fails when specifying an invalid tunnel inside cidr', () => {
     // GIVEN
     const stack = new Stack();
 
-    test.throws(() => new Vpc(stack, 'VpcNetwork', {
+    expect(() => new Vpc(stack, 'VpcNetwork', {
       vpnConnections: {
         VpnConnection: {
           ip: '192.0.2.1',
@@ -242,12 +241,12 @@ nodeunitShim({
           ],
         },
       },
-    }), /`tunnelInsideCidr`.+size/);
+    })).toThrow(/`tunnelInsideCidr`.+size/);
 
-    test.done();
-  },
 
-  'can use metricTunnelState on a vpn connection'(test: Test) {
+  });
+
+  test('can use metricTunnelState on a vpn connection', () => {
     // GIVEN
     const stack = new Stack();
 
@@ -260,7 +259,7 @@ nodeunitShim({
     });
 
     // THEN
-    test.deepEqual(stack.resolve(vpn.metricTunnelState()), {
+    expect(stack.resolve(vpn.metricTunnelState())).toEqual({
       dimensions: { VpnId: { Ref: 'VpcNetworkVpnA476C58D' } },
       namespace: 'AWS/VPN',
       metricName: 'TunnelState',
@@ -268,37 +267,37 @@ nodeunitShim({
       statistic: 'Average',
     });
 
-    test.done();
-  },
 
-  'can use metricAllTunnelDataOut'(test: Test) {
+  });
+
+  test('can use metricAllTunnelDataOut', () => {
     // GIVEN
     const stack = new Stack();
 
     // THEN
-    test.deepEqual(stack.resolve(VpnConnection.metricAllTunnelDataOut()), {
+    expect(stack.resolve(VpnConnection.metricAllTunnelDataOut())).toEqual({
       namespace: 'AWS/VPN',
       metricName: 'TunnelDataOut',
       period: Duration.minutes(5),
       statistic: 'Sum',
     });
 
-    test.done();
-  },
 
-  'fails when enabling vpnGateway without having subnets'(test: Test) {
+  });
+
+  test('fails when enabling vpnGateway without having subnets', () => {
     // GIVEN
     const stack = new Stack();
 
-    test.throws(() => new Vpc(stack, 'VpcNetwork', {
+    expect(() => new Vpc(stack, 'VpcNetwork', {
       vpnGateway: true,
       subnetConfiguration: [],
-    }), /VPN gateway/);
+    })).toThrow(/VPN gateway/);
 
-    test.done();
-  },
 
-  'can add a vpn connection later to a vpc that initially had no subnets'(test: Test) {
+  });
+
+  test('can add a vpn connection later to a vpc that initially had no subnets', () => {
     // GIVEN
     const stack = new Stack();
 
@@ -317,12 +316,12 @@ nodeunitShim({
     });
 
     // THEN
-    expect(stack).to(haveResource('AWS::EC2::CustomerGateway', {
+    expect(stack).toHaveResource('AWS::EC2::CustomerGateway', {
       Type: 'ipsec.1',
-    }));
-    test.done();
-  },
-  'can add a vpn connection with a Token as customer gateway ip'(test:Test) {
+    });
+
+  });
+  test('can add a vpn connection with a Token as customer gateway ip', () => {
     // GIVEN
     const stack = new Stack();
     const token = Token.asAny('192.0.2.1');
@@ -337,9 +336,9 @@ nodeunitShim({
     });
 
     // THEN
-    expect(stack).to(haveResource('AWS::EC2::CustomerGateway', {
+    expect(stack).toHaveResource('AWS::EC2::CustomerGateway', {
       IpAddress: '192.0.2.1',
-    }));
-    test.done();
-  },
+    });
+
+  });
 });
diff --git a/packages/@aws-cdk/aws-ecr-assets/package.json b/packages/@aws-cdk/aws-ecr-assets/package.json
index edf101cdf28b2..44f7a2d4ffa7c 100644
--- a/packages/@aws-cdk/aws-ecr-assets/package.json
+++ b/packages/@aws-cdk/aws-ecr-assets/package.json
@@ -70,7 +70,7 @@
     "aws-cdk": "0.0.0",
     "cdk-build-tools": "0.0.0",
     "cdk-integ-tools": "0.0.0",
-    "nodeunit-shim": "0.0.0",
+    "jest": "^26.6.3",
     "pkglint": "0.0.0",
     "proxyquire": "^2.1.3",
     "@aws-cdk/cloud-assembly-schema": "0.0.0",
diff --git a/packages/@aws-cdk/aws-rds/package.json b/packages/@aws-cdk/aws-rds/package.json
index 6144a8f13493b..d3fcb9f70771c 100644
--- a/packages/@aws-cdk/aws-rds/package.json
+++ b/packages/@aws-cdk/aws-rds/package.json
@@ -81,7 +81,7 @@
     "cdk-integ-tools": "0.0.0",
     "cfn2ts": "0.0.0",
     "pkglint": "0.0.0",
-    "nodeunit-shim": "0.0.0",
+    "jest": "^26.6.3",
     "@aws-cdk/assert-internal": "0.0.0"
   },
   "dependencies": {
diff --git a/packages/@aws-cdk/aws-rds/test/cluster-engine.test.ts b/packages/@aws-cdk/aws-rds/test/cluster-engine.test.ts
index 54a02441fb9c7..9784dfe949473 100644
--- a/packages/@aws-cdk/aws-rds/test/cluster-engine.test.ts
+++ b/packages/@aws-cdk/aws-rds/test/cluster-engine.test.ts
@@ -1,8 +1,8 @@
-import { nodeunitShim, Test } from 'nodeunit-shim';
+import '@aws-cdk/assert-internal/jest';
 import { AuroraEngineVersion, AuroraMysqlEngineVersion, AuroraPostgresEngineVersion, DatabaseClusterEngine } from '../lib';
 
-nodeunitShim({
-  "default parameterGroupFamily for versionless Aurora cluster engine is 'aurora5.6'"(test: Test) {
+describe('cluster engine', () => {
+  test("default parameterGroupFamily for versionless Aurora cluster engine is 'aurora5.6'", () => {
     // GIVEN
     const engine = DatabaseClusterEngine.AURORA;
 
@@ -10,12 +10,12 @@ nodeunitShim({
     const family = engine.parameterGroupFamily;
 
     // THEN
-    test.equals(family, 'aurora5.6');
+    expect(family).toEqual('aurora5.6');
 
-    test.done();
-  },
 
-  "default parameterGroupFamily for versionless Aurora MySQL cluster engine is 'aurora-mysql5.7'"(test: Test) {
+  });
+
+  test("default parameterGroupFamily for versionless Aurora MySQL cluster engine is 'aurora-mysql5.7'", () => {
     // GIVEN
     const engine = DatabaseClusterEngine.AURORA_MYSQL;
 
@@ -23,12 +23,12 @@ nodeunitShim({
     const family = engine.parameterGroupFamily;
 
     // THEN
-    test.equals(family, 'aurora-mysql5.7');
+    expect(family).toEqual('aurora-mysql5.7');
+
 
-    test.done();
-  },
+  });
 
-  'default parameterGroupFamily for versionless Aurora PostgreSQL is not defined'(test: Test) {
+  test('default parameterGroupFamily for versionless Aurora PostgreSQL is not defined', () => {
     // GIVEN
     const engine = DatabaseClusterEngine.AURORA_POSTGRESQL;
 
@@ -36,12 +36,12 @@ nodeunitShim({
     const family = engine.parameterGroupFamily;
 
     // THEN
-    test.equals(family, undefined);
+    expect(family).toEqual(undefined);
 
-    test.done();
-  },
 
-  'cluster parameter group correctly determined for AURORA and given version'(test: Test) {
+  });
+
+  test('cluster parameter group correctly determined for AURORA and given version', () => {
     // GIVEN
     const engine = DatabaseClusterEngine.aurora({
       version: AuroraEngineVersion.VER_1_22_2,
@@ -51,12 +51,12 @@ nodeunitShim({
     const family = engine.parameterGroupFamily;
 
     // THEN
-    test.equals(family, 'aurora5.6');
+    expect(family).toEqual('aurora5.6');
+
 
-    test.done();
-  },
+  });
 
-  'cluster parameter group correctly determined for AURORA_MYSQL and given version'(test: Test) {
+  test('cluster parameter group correctly determined for AURORA_MYSQL and given version', () => {
     // GIVEN
     const engine = DatabaseClusterEngine.auroraMysql({
       version: AuroraMysqlEngineVersion.VER_2_07_1,
@@ -66,12 +66,12 @@ nodeunitShim({
     const family = engine.parameterGroupFamily;
 
     // THEN
-    test.equals(family, 'aurora-mysql5.7');
+    expect(family).toEqual('aurora-mysql5.7');
 
-    test.done();
-  },
 
-  'cluster parameter group correctly determined for AURORA_POSTGRESQL and given version'(test: Test) {
+  });
+
+  test('cluster parameter group correctly determined for AURORA_POSTGRESQL and given version', () => {
     // GIVEN
     const engine = DatabaseClusterEngine.auroraPostgres({
       version: AuroraPostgresEngineVersion.VER_11_6,
@@ -81,38 +81,38 @@ nodeunitShim({
     const family = engine.parameterGroupFamily;
 
     // THEN
-    test.equals(family, 'aurora-postgresql11');
+    expect(family).toEqual('aurora-postgresql11');
+
 
-    test.done();
-  },
+  });
 
-  'parameter group family'(test: Test) {
+  test('parameter group family', () => {
     // the PostgreSQL engine knows about the following major versions: 9.6, 10 and 11
 
-    test.equals(DatabaseClusterEngine.auroraPostgres({ version: AuroraPostgresEngineVersion.of('8', '8') }).parameterGroupFamily,
+    expect(DatabaseClusterEngine.auroraPostgres({ version: AuroraPostgresEngineVersion.of('8', '8') }).parameterGroupFamily).toEqual(
       'aurora-postgresql8');
 
-    test.equals(DatabaseClusterEngine.auroraPostgres({ version: AuroraPostgresEngineVersion.of('9', '9') }).parameterGroupFamily,
+    expect(DatabaseClusterEngine.auroraPostgres({ version: AuroraPostgresEngineVersion.of('9', '9') }).parameterGroupFamily).toEqual(
       'aurora-postgresql9');
 
-    test.equals(DatabaseClusterEngine.auroraPostgres({ version: AuroraPostgresEngineVersion.of('9.7', '9.7') }).parameterGroupFamily,
+    expect(DatabaseClusterEngine.auroraPostgres({ version: AuroraPostgresEngineVersion.of('9.7', '9.7') }).parameterGroupFamily).toEqual(
       'aurora-postgresql9.7');
 
-    test.equals(DatabaseClusterEngine.auroraPostgres({ version: AuroraPostgresEngineVersion.of('9.6', '9.6') }).parameterGroupFamily,
+    expect(DatabaseClusterEngine.auroraPostgres({ version: AuroraPostgresEngineVersion.of('9.6', '9.6') }).parameterGroupFamily).toEqual(
       'aurora-postgresql9.6');
-    test.equals(DatabaseClusterEngine.auroraPostgres({ version: AuroraPostgresEngineVersion.of('9.6.1', '9.6') }).parameterGroupFamily,
+    expect(DatabaseClusterEngine.auroraPostgres({ version: AuroraPostgresEngineVersion.of('9.6.1', '9.6') }).parameterGroupFamily).toEqual(
       'aurora-postgresql9.6');
-    test.equals(DatabaseClusterEngine.auroraPostgres({ version: AuroraPostgresEngineVersion.of('10.0', '10') }).parameterGroupFamily,
+    expect(DatabaseClusterEngine.auroraPostgres({ version: AuroraPostgresEngineVersion.of('10.0', '10') }).parameterGroupFamily).toEqual(
       'aurora-postgresql10');
 
-    test.done();
-  },
 
-  'supported log types'(test: Test) {
+  });
+
+  test('supported log types', () => {
     const mysqlLogTypes = ['error', 'general', 'slowquery', 'audit'];
-    test.deepEqual(DatabaseClusterEngine.aurora({ version: AuroraEngineVersion.VER_1_22_2 }).supportedLogTypes, mysqlLogTypes);
-    test.deepEqual(DatabaseClusterEngine.auroraMysql({ version: AuroraMysqlEngineVersion.VER_2_08_1 }).supportedLogTypes, mysqlLogTypes);
-    test.deepEqual(DatabaseClusterEngine.auroraPostgres({ version: AuroraPostgresEngineVersion.VER_9_6_9 }).supportedLogTypes, ['postgresql']);
-    test.done();
-  },
+    expect(DatabaseClusterEngine.aurora({ version: AuroraEngineVersion.VER_1_22_2 }).supportedLogTypes).toEqual(mysqlLogTypes);
+    expect(DatabaseClusterEngine.auroraMysql({ version: AuroraMysqlEngineVersion.VER_2_08_1 }).supportedLogTypes).toEqual(mysqlLogTypes);
+    expect(DatabaseClusterEngine.auroraPostgres({ version: AuroraPostgresEngineVersion.VER_9_6_9 }).supportedLogTypes).toEqual(['postgresql']);
+
+  });
 });
\ No newline at end of file
diff --git a/packages/@aws-cdk/aws-rds/test/database-secret.test.ts b/packages/@aws-cdk/aws-rds/test/database-secret.test.ts
index c05e07e73a0bb..9fe7793536a1c 100644
--- a/packages/@aws-cdk/aws-rds/test/database-secret.test.ts
+++ b/packages/@aws-cdk/aws-rds/test/database-secret.test.ts
@@ -1,11 +1,10 @@
-import { expect, haveResource } from '@aws-cdk/assert-internal';
+import '@aws-cdk/assert-internal/jest';
 import { CfnResource, Stack } from '@aws-cdk/core';
-import { nodeunitShim, Test } from 'nodeunit-shim';
 import { DatabaseSecret } from '../lib';
 import { DEFAULT_PASSWORD_EXCLUDE_CHARS } from '../lib/private/util';
 
-nodeunitShim({
-  'create a database secret'(test: Test) {
+describe('database secret', () => {
+  test('create a database secret', () => {
     // GIVEN
     const stack = new Stack();
 
@@ -15,7 +14,7 @@ nodeunitShim({
     });
 
     // THEN
-    expect(stack).to(haveResource('AWS::SecretsManager::Secret', {
+    expect(stack).toHaveResource('AWS::SecretsManager::Secret', {
       Description: {
         'Fn::Join': [
           '',
@@ -33,14 +32,14 @@ nodeunitShim({
         PasswordLength: 30,
         SecretStringTemplate: '{"username":"admin-username"}',
       },
-    }));
+    });
+
+    expect(getSecretLogicalId(dbSecret, stack)).toEqual('SecretA720EF05');
 
-    test.equal(getSecretLogicalId(dbSecret, stack), 'SecretA720EF05');
 
-    test.done();
-  },
+  });
 
-  'with master secret'(test: Test) {
+  test('with master secret', () => {
     // GIVEN
     const stack = new Stack();
     const masterSecret = new DatabaseSecret(stack, 'MasterSecret', {
@@ -55,7 +54,7 @@ nodeunitShim({
     });
 
     // THEN
-    expect(stack).to(haveResource('AWS::SecretsManager::Secret', {
+    expect(stack).toHaveResource('AWS::SecretsManager::Secret', {
       GenerateSecretString: {
         ExcludeCharacters: '"@/\\',
         GenerateStringKey: 'password',
@@ -73,12 +72,12 @@ nodeunitShim({
           ],
         },
       },
-    }));
+    });
 
-    test.done();
-  },
 
-  'replace on password critera change'(test: Test) {
+  });
+
+  test('replace on password critera change', () => {
     // GIVEN
     const stack = new Stack();
 
@@ -90,7 +89,7 @@ nodeunitShim({
 
     // THEN
     const dbSecretlogicalId = getSecretLogicalId(dbSecret, stack);
-    test.equal(dbSecretlogicalId, 'Secret3fdaad7efa858a3daf9490cf0a702aeb');
+    expect(dbSecretlogicalId).toEqual('Secret3fdaad7efa858a3daf9490cf0a702aeb');
 
     // same node path but other excluded characters
     stack.node.tryRemoveChild('Secret');
@@ -99,17 +98,17 @@ nodeunitShim({
       replaceOnPasswordCriteriaChanges: true,
       excludeCharacters: '@!()[]',
     });
-    test.notEqual(dbSecretlogicalId, getSecretLogicalId(otherSecret1, stack));
+    expect(dbSecretlogicalId).not.toEqual(getSecretLogicalId(otherSecret1, stack));
 
     // other node path but same excluded characters
     const otherSecret2 = new DatabaseSecret(stack, 'Secret2', {
       username: 'admin',
       replaceOnPasswordCriteriaChanges: true,
     });
-    test.notEqual(dbSecretlogicalId, getSecretLogicalId(otherSecret2, stack));
+    expect(dbSecretlogicalId).not.toEqual(getSecretLogicalId(otherSecret2, stack));
+
 
-    test.done();
-  },
+  });
 });
 
 function getSecretLogicalId(dbSecret: DatabaseSecret, stack: Stack): string {
diff --git a/packages/@aws-cdk/aws-rds/test/database-secretmanager.test.ts b/packages/@aws-cdk/aws-rds/test/database-secretmanager.test.ts
index 8914401e189f6..cb8057cc464f5 100644
--- a/packages/@aws-cdk/aws-rds/test/database-secretmanager.test.ts
+++ b/packages/@aws-cdk/aws-rds/test/database-secretmanager.test.ts
@@ -1,12 +1,12 @@
-import { expect, haveResource, ResourcePart } from '@aws-cdk/assert-internal';
+import '@aws-cdk/assert-internal/jest';
+import { ResourcePart } from '@aws-cdk/assert-internal';
 import * as ec2 from '@aws-cdk/aws-ec2';
 import * as secretsmanager from '@aws-cdk/aws-secretsmanager';
 import * as cdk from '@aws-cdk/core';
-import { nodeunitShim, Test } from 'nodeunit-shim';
 import { ServerlessCluster, DatabaseClusterEngine, ParameterGroup, Credentials } from '../lib';
 
-nodeunitShim({
-  'can create a Serverless Cluster using an existing secret from secretmanager'(test: Test) {
+describe('database secret manager', () => {
+  test('can create a Serverless Cluster using an existing secret from secretmanager', () => {
     // GIVEN
     const stack = testStack();
     const vpc = new ec2.Vpc(stack, 'VPC');
@@ -21,7 +21,7 @@ nodeunitShim({
     });
 
     // THEN
-    expect(stack).to(haveResource('AWS::RDS::DBCluster', {
+    expect(stack).toHaveResource('AWS::RDS::DBCluster', {
       Properties: {
         Engine: 'aurora-postgresql',
         DBClusterParameterGroupName: 'default.aurora-postgresql10',
@@ -43,10 +43,10 @@ nodeunitShim({
       },
       DeletionPolicy: 'Snapshot',
       UpdateReplacePolicy: 'Snapshot',
-    }, ResourcePart.CompleteDefinition));
+    }, ResourcePart.CompleteDefinition);
 
-    test.done();
-  },
+
+  });
 });
 
 function testStack() {
diff --git a/packages/@aws-cdk/aws-rds/test/instance-engine.test.ts b/packages/@aws-cdk/aws-rds/test/instance-engine.test.ts
index e3b02c48770d4..99ed162c4f5eb 100644
--- a/packages/@aws-cdk/aws-rds/test/instance-engine.test.ts
+++ b/packages/@aws-cdk/aws-rds/test/instance-engine.test.ts
@@ -1,133 +1,132 @@
-import { expect, haveResourceLike } from '@aws-cdk/assert-internal';
+import '@aws-cdk/assert-internal/jest';
 import * as iam from '@aws-cdk/aws-iam';
 import * as cdk from '@aws-cdk/core';
-import { nodeunitShim, Test } from 'nodeunit-shim';
 import * as rds from '../lib';
 
-nodeunitShim({
-  'default parameterGroupFamily for versionless MariaDB instance engine is not defined'(test: Test) {
+describe('instance engine', () => {
+  test('default parameterGroupFamily for versionless MariaDB instance engine is not defined', () => {
     const engine = rds.DatabaseInstanceEngine.MARIADB;
 
     const family = engine.parameterGroupFamily;
 
-    test.equals(family, undefined);
+    expect(family).toEqual(undefined);
 
-    test.done();
-  },
 
-  'default parameterGroupFamily for versionless MySQL instance engine is not defined'(test: Test) {
+  });
+
+  test('default parameterGroupFamily for versionless MySQL instance engine is not defined', () => {
     const engine = rds.DatabaseInstanceEngine.MYSQL;
 
     const family = engine.parameterGroupFamily;
 
-    test.equals(family, undefined);
+    expect(family).toEqual(undefined);
+
 
-    test.done();
-  },
+  });
 
-  'default parameterGroupFamily for versionless PostgreSQL instance engine is not defined'(test: Test) {
+  test('default parameterGroupFamily for versionless PostgreSQL instance engine is not defined', () => {
     const engine = rds.DatabaseInstanceEngine.POSTGRES;
 
     const family = engine.parameterGroupFamily;
 
-    test.equals(family, undefined);
+    expect(family).toEqual(undefined);
+
 
-    test.done();
-  },
+  });
 
-  "default parameterGroupFamily for versionless Oracle SE instance engine is 'oracle-se-11.2'"(test: Test) {
+  test("default parameterGroupFamily for versionless Oracle SE instance engine is 'oracle-se-11.2'", () => {
     const engine = rds.DatabaseInstanceEngine.ORACLE_SE;
 
     const family = engine.parameterGroupFamily;
 
-    test.equals(family, 'oracle-se-11.2');
+    expect(family).toEqual('oracle-se-11.2');
 
-    test.done();
-  },
 
-  "default parameterGroupFamily for versionless Oracle SE 1 instance engine is 'oracle-se1-11.2'"(test: Test) {
+  });
+
+  test("default parameterGroupFamily for versionless Oracle SE 1 instance engine is 'oracle-se1-11.2'", () => {
     const engine = rds.DatabaseInstanceEngine.ORACLE_SE1;
 
     const family = engine.parameterGroupFamily;
 
-    test.equals(family, 'oracle-se1-11.2');
+    expect(family).toEqual('oracle-se1-11.2');
+
 
-    test.done();
-  },
+  });
 
-  'default parameterGroupFamily for versionless Oracle SE 2 instance engine is not defined'(test: Test) {
+  test('default parameterGroupFamily for versionless Oracle SE 2 instance engine is not defined', () => {
     const engine = rds.DatabaseInstanceEngine.ORACLE_SE2;
 
     const family = engine.parameterGroupFamily;
 
-    test.equals(family, undefined);
+    expect(family).toEqual(undefined);
+
 
-    test.done();
-  },
+  });
 
-  'default parameterGroupFamily for versionless Oracle EE instance engine is not defined'(test: Test) {
+  test('default parameterGroupFamily for versionless Oracle EE instance engine is not defined', () => {
     const engine = rds.DatabaseInstanceEngine.ORACLE_EE;
 
     const family = engine.parameterGroupFamily;
 
-    test.equals(family, undefined);
+    expect(family).toEqual(undefined);
 
-    test.done();
-  },
 
-  'default parameterGroupFamily for versionless SQL Server SE instance engine is not defined'(test: Test) {
+  });
+
+  test('default parameterGroupFamily for versionless SQL Server SE instance engine is not defined', () => {
     const engine = rds.DatabaseInstanceEngine.SQL_SERVER_SE;
 
     const family = engine.parameterGroupFamily;
 
-    test.equals(family, undefined);
+    expect(family).toEqual(undefined);
+
 
-    test.done();
-  },
+  });
 
-  'default parameterGroupFamily for versionless SQL Server EX instance engine is not defined'(test: Test) {
+  test('default parameterGroupFamily for versionless SQL Server EX instance engine is not defined', () => {
     const engine = rds.DatabaseInstanceEngine.SQL_SERVER_EX;
 
     const family = engine.parameterGroupFamily;
 
-    test.equals(family, undefined);
+    expect(family).toEqual(undefined);
+
 
-    test.done();
-  },
+  });
 
-  'default parameterGroupFamily for versionless SQL Server Web instance engine is not defined'(test: Test) {
+  test('default parameterGroupFamily for versionless SQL Server Web instance engine is not defined', () => {
     const engine = rds.DatabaseInstanceEngine.SQL_SERVER_WEB;
 
     const family = engine.parameterGroupFamily;
 
-    test.equals(family, undefined);
+    expect(family).toEqual(undefined);
 
-    test.done();
-  },
 
-  'default parameterGroupFamily for versionless SQL Server EE instance engine is not defined'(test: Test) {
+  });
+
+  test('default parameterGroupFamily for versionless SQL Server EE instance engine is not defined', () => {
     const engine = rds.DatabaseInstanceEngine.SQL_SERVER_EE;
 
     const family = engine.parameterGroupFamily;
 
-    test.equals(family, undefined);
+    expect(family).toEqual(undefined);
+
 
-    test.done();
-  },
+  });
 
-  'Oracle engine bindToInstance': {
+  describe('Oracle engine bindToInstance', () => {
 
-    'returns s3 integration feature'(test: Test) {
+    test('returns s3 integration feature', () => {
       const engine = rds.DatabaseInstanceEngine.oracleSe2({ version: rds.OracleEngineVersion.VER_19_0_0_0_2020_04_R1 });
 
       const engineConfig = engine.bindToInstance(new cdk.Stack(), {});
-      test.equals(engineConfig.features?.s3Import, 'S3_INTEGRATION');
-      test.equals(engineConfig.features?.s3Export, 'S3_INTEGRATION');
+      expect(engineConfig.features?.s3Import).toEqual('S3_INTEGRATION');
+      expect(engineConfig.features?.s3Export).toEqual('S3_INTEGRATION');
+
 
-      test.done();
-    },
+    });
 
-    's3 import/export - creates an option group if needed'(test: Test) {
+    test('s3 import/export - creates an option group if needed', () => {
       const stack = new cdk.Stack();
       const engine = rds.DatabaseInstanceEngine.oracleSe2({ version: rds.OracleEngineVersion.VER_19_0_0_0_2020_04_R1 });
 
@@ -136,19 +135,19 @@ nodeunitShim({
         s3ImportRole: new iam.Role(stack, 'ImportRole', { assumedBy: new iam.AccountRootPrincipal() }),
       });
 
-      test.ok(engineConfig.optionGroup);
-      expect(stack).to(haveResourceLike('AWS::RDS::OptionGroup', {
+      expect(engineConfig.optionGroup).toBeDefined();
+      expect(stack).toHaveResourceLike('AWS::RDS::OptionGroup', {
         EngineName: 'oracle-se2',
         OptionConfigurations: [{
           OptionName: 'S3_INTEGRATION',
           OptionVersion: '1.0',
         }],
-      }));
+      });
+
 
-      test.done();
-    },
+    });
 
-    's3 import/export - appends to an existing option group if it exists'(test: Test) {
+    test('s3 import/export - appends to an existing option group if it exists', () => {
       const stack = new cdk.Stack();
       const engine = rds.DatabaseInstanceEngine.oracleSe2({ version: rds.OracleEngineVersion.VER_19_0_0_0_2020_04_R1 });
       const optionGroup = new rds.OptionGroup(stack, 'OptionGroup', {
@@ -163,8 +162,8 @@ nodeunitShim({
         s3ImportRole: new iam.Role(stack, 'ImportRole', { assumedBy: new iam.AccountRootPrincipal() }),
       });
 
-      test.equals(engineConfig.optionGroup, optionGroup);
-      expect(stack).to(haveResourceLike('AWS::RDS::OptionGroup', {
+      expect(engineConfig.optionGroup).toEqual(optionGroup);
+      expect(stack).toHaveResourceLike('AWS::RDS::OptionGroup', {
         EngineName: 'oracle-se2',
         OptionConfigurations: [{
           OptionName: 'MY_OPTION_CONFIG',
@@ -173,39 +172,39 @@ nodeunitShim({
           OptionName: 'S3_INTEGRATION',
           OptionVersion: '1.0',
         }],
-      }));
+      });
 
-      test.done();
-    },
-  },
 
-  'SQL Server engine bindToInstance': {
-    'returns s3 integration feature'(test: Test) {
+    });
+  });
+
+  describe('SQL Server engine bindToInstance', () => {
+    test('returns s3 integration feature', () => {
       const engine = rds.DatabaseInstanceEngine.sqlServerSe({ version: rds.SqlServerEngineVersion.VER_14_00_3192_2_V1 });
 
       const engineConfig = engine.bindToInstance(new cdk.Stack(), {});
-      test.equals(engineConfig.features?.s3Import, 'S3_INTEGRATION');
-      test.equals(engineConfig.features?.s3Export, 'S3_INTEGRATION');
+      expect(engineConfig.features?.s3Import).toEqual('S3_INTEGRATION');
+      expect(engineConfig.features?.s3Export).toEqual('S3_INTEGRATION');
+
 
-      test.done();
-    },
+    });
 
-    's3 import/export - throws if roles are not equal'(test: Test) {
+    test('s3 import/export - throws if roles are not equal', () => {
       const stack = new cdk.Stack();
       const engine = rds.DatabaseInstanceEngine.sqlServerSe({ version: rds.SqlServerEngineVersion.VER_14_00_3192_2_V1 });
 
       const s3ImportRole = new iam.Role(stack, 'ImportRole', { assumedBy: new iam.AccountRootPrincipal() });
       const s3ExportRole = new iam.Role(stack, 'ExportRole', { assumedBy: new iam.AccountRootPrincipal() });
 
-      test.throws(() => engine.bindToInstance(new cdk.Stack(), { s3ImportRole, s3ExportRole }), /S3 import and export roles must be the same/);
-      test.doesNotThrow(() => engine.bindToInstance(new cdk.Stack(), { s3ImportRole }));
-      test.doesNotThrow(() => engine.bindToInstance(new cdk.Stack(), { s3ExportRole }));
-      test.doesNotThrow(() => engine.bindToInstance(new cdk.Stack(), { s3ImportRole, s3ExportRole: s3ImportRole }));
+      expect(() => engine.bindToInstance(new cdk.Stack(), { s3ImportRole, s3ExportRole })).toThrow(/S3 import and export roles must be the same/);
+      expect(() => engine.bindToInstance(new cdk.Stack(), { s3ImportRole })).not.toThrow();
+      expect(() => engine.bindToInstance(new cdk.Stack(), { s3ExportRole })).not.toThrow();
+      expect(() => engine.bindToInstance(new cdk.Stack(), { s3ImportRole, s3ExportRole: s3ImportRole })).not.toThrow();
+
 
-      test.done();
-    },
+    });
 
-    's3 import/export - creates an option group if needed'(test: Test) {
+    test('s3 import/export - creates an option group if needed', () => {
       const stack = new cdk.Stack();
       const engine = rds.DatabaseInstanceEngine.sqlServerSe({ version: rds.SqlServerEngineVersion.VER_14_00_3192_2_V1 });
 
@@ -214,8 +213,8 @@ nodeunitShim({
         s3ImportRole: new iam.Role(stack, 'ImportRole', { assumedBy: new iam.AccountRootPrincipal() }),
       });
 
-      test.ok(engineConfig.optionGroup);
-      expect(stack).to(haveResourceLike('AWS::RDS::OptionGroup', {
+      expect(engineConfig.optionGroup).toBeDefined();
+      expect(stack).toHaveResourceLike('AWS::RDS::OptionGroup', {
         EngineName: 'sqlserver-se',
         OptionConfigurations: [{
           OptionName: 'SQLSERVER_BACKUP_RESTORE',
@@ -224,12 +223,12 @@ nodeunitShim({
             Value: { 'Fn::GetAtt': ['ImportRole0C9E6F9A', 'Arn'] },
           }],
         }],
-      }));
+      });
+
 
-      test.done();
-    },
+    });
 
-    's3 import/export - appends to an existing option group if it exists'(test: Test) {
+    test('s3 import/export - appends to an existing option group if it exists', () => {
       const stack = new cdk.Stack();
       const engine = rds.DatabaseInstanceEngine.sqlServerSe({ version: rds.SqlServerEngineVersion.VER_14_00_3192_2_V1 });
       const optionGroup = new rds.OptionGroup(stack, 'OptionGroup', {
@@ -244,8 +243,8 @@ nodeunitShim({
         s3ImportRole: new iam.Role(stack, 'ImportRole', { assumedBy: new iam.AccountRootPrincipal() }),
       });
 
-      test.equals(engineConfig.optionGroup, optionGroup);
-      expect(stack).to(haveResourceLike('AWS::RDS::OptionGroup', {
+      expect(engineConfig.optionGroup).toEqual(optionGroup);
+      expect(stack).toHaveResourceLike('AWS::RDS::OptionGroup', {
         EngineName: 'sqlserver-se',
         OptionConfigurations: [{
           OptionName: 'MY_OPTION_CONFIG',
@@ -257,31 +256,31 @@ nodeunitShim({
             Value: { 'Fn::GetAtt': ['ImportRole0C9E6F9A', 'Arn'] },
           }],
         }],
-      }));
+      });
 
-      test.done();
-    },
-  },
 
-  'PostgreSQL engine bindToInstance': {
-    'returns no features for older versions'(test: Test) {
+    });
+  });
+
+  describe('PostgreSQL engine bindToInstance', () => {
+    test('returns no features for older versions', () => {
       const engineNewerVersion = rds.DatabaseInstanceEngine.postgres({ version: rds.PostgresEngineVersion.VER_10_6 });
 
       const engineConfig = engineNewerVersion.bindToInstance(new cdk.Stack(), {});
-      test.equals(engineConfig.features?.s3Import, undefined);
-      test.equals(engineConfig.features?.s3Export, undefined);
+      expect(engineConfig.features?.s3Import).toEqual(undefined);
+      expect(engineConfig.features?.s3Export).toEqual(undefined);
+
 
-      test.done();
-    },
+    });
 
-    'returns s3 import/export feature if the version supports it'(test: Test) {
+    test('returns s3 import/export feature if the version supports it', () => {
       const engineNewerVersion = rds.DatabaseInstanceEngine.postgres({ version: rds.PostgresEngineVersion.VER_13_3 });
 
       const engineConfig = engineNewerVersion.bindToInstance(new cdk.Stack(), {});
-      test.equals(engineConfig.features?.s3Import, 's3Import');
-      test.equals(engineConfig.features?.s3Export, 's3Export');
+      expect(engineConfig.features?.s3Import).toEqual('s3Import');
+      expect(engineConfig.features?.s3Export).toEqual('s3Export');
+
 
-      test.done();
-    },
-  },
+    });
+  });
 });
diff --git a/packages/@aws-cdk/aws-rds/test/option-group.test.ts b/packages/@aws-cdk/aws-rds/test/option-group.test.ts
index 2a058411a72ab..77a394a1fa6a7 100644
--- a/packages/@aws-cdk/aws-rds/test/option-group.test.ts
+++ b/packages/@aws-cdk/aws-rds/test/option-group.test.ts
@@ -1,11 +1,10 @@
-import { expect, haveResource } from '@aws-cdk/assert-internal';
+import '@aws-cdk/assert-internal/jest';
 import * as ec2 from '@aws-cdk/aws-ec2';
 import * as cdk from '@aws-cdk/core';
-import { nodeunitShim, Test } from 'nodeunit-shim';
 import { DatabaseInstanceEngine, OptionGroup, OracleEngineVersion, OracleLegacyEngineVersion } from '../lib';
 
-nodeunitShim({
-  'create an option group'(test: Test) {
+describe('option group', () => {
+  test('create an option group', () => {
     // GIVEN
     const stack = new cdk.Stack();
 
@@ -22,7 +21,7 @@ nodeunitShim({
     });
 
     // THEN
-    expect(stack).to(haveResource('AWS::RDS::OptionGroup', {
+    expect(stack).toHaveResource('AWS::RDS::OptionGroup', {
       EngineName: 'oracle-se1',
       MajorEngineVersion: '11.2',
       OptionGroupDescription: 'Option group for oracle-se1 11.2',
@@ -31,12 +30,12 @@ nodeunitShim({
           OptionName: 'XMLDB',
         },
       ],
-    }));
+    });
+
 
-    test.done();
-  },
+  });
 
-  'option group with new security group'(test: Test) {
+  test('option group with new security group', () => {
     // GIVEN
     const stack = new cdk.Stack();
     const vpc = new ec2.Vpc(stack, 'VPC');
@@ -57,7 +56,7 @@ nodeunitShim({
     optionGroup.optionConnections.OEM.connections.allowDefaultPortFromAnyIpv4();
 
     // THEN
-    expect(stack).to(haveResource('AWS::RDS::OptionGroup', {
+    expect(stack).toHaveResource('AWS::RDS::OptionGroup', {
       EngineName: 'oracle-se',
       MajorEngineVersion: '11.2',
       OptionGroupDescription: 'Option group for oracle-se 11.2',
@@ -75,9 +74,9 @@ nodeunitShim({
           ],
         },
       ],
-    }));
+    });
 
-    expect(stack).to(haveResource('AWS::EC2::SecurityGroup', {
+    expect(stack).toHaveResource('AWS::EC2::SecurityGroup', {
       GroupDescription: 'Security group for OEM option',
       SecurityGroupIngress: [
         {
@@ -91,12 +90,12 @@ nodeunitShim({
       VpcId: {
         Ref: 'VPCB9E5F0B4',
       },
-    }));
+    });
 
-    test.done();
-  },
 
-  'option group with existing security group'(test: Test) {
+  });
+
+  test('option group with existing security group', () => {
     // GIVEN
     const stack = new cdk.Stack();
     const vpc = new ec2.Vpc(stack, 'VPC');
@@ -118,7 +117,7 @@ nodeunitShim({
     });
 
     // THEN
-    expect(stack).to(haveResource('AWS::RDS::OptionGroup', {
+    expect(stack).toHaveResource('AWS::RDS::OptionGroup', {
       EngineName: 'oracle-se',
       MajorEngineVersion: '11.2',
       OptionGroupDescription: 'Option group for oracle-se 11.2',
@@ -136,17 +135,17 @@ nodeunitShim({
           ],
         },
       ],
-    }));
+    });
 
-    test.done();
-  },
 
-  'throws when using an option with port and no vpc'(test: Test) {
+  });
+
+  test('throws when using an option with port and no vpc', () => {
     // GIVEN
     const stack = new cdk.Stack();
 
     // THEN
-    test.throws(() => new OptionGroup(stack, 'Options', {
+    expect(() => new OptionGroup(stack, 'Options', {
       engine: DatabaseInstanceEngine.oracleSe2({
         version: OracleEngineVersion.VER_12_1,
       }),
@@ -156,8 +155,8 @@ nodeunitShim({
           port: 1158,
         },
       ],
-    }), /`port`.*`vpc`/);
+    })).toThrow(/`port`.*`vpc`/);
+
 
-    test.done();
-  },
+  });
 });
diff --git a/packages/@aws-cdk/aws-rds/test/parameter-group.test.ts b/packages/@aws-cdk/aws-rds/test/parameter-group.test.ts
index aedfe0a005da6..bf8e789aee0ad 100644
--- a/packages/@aws-cdk/aws-rds/test/parameter-group.test.ts
+++ b/packages/@aws-cdk/aws-rds/test/parameter-group.test.ts
@@ -1,10 +1,9 @@
-import { countResources, expect, haveResource } from '@aws-cdk/assert-internal';
+import '@aws-cdk/assert-internal/jest';
 import * as cdk from '@aws-cdk/core';
-import { nodeunitShim, Test } from 'nodeunit-shim';
 import { DatabaseClusterEngine, ParameterGroup } from '../lib';
 
-nodeunitShim({
-  "does not create a parameter group if it wasn't bound to a cluster or instance"(test: Test) {
+describe('parameter group', () => {
+  test("does not create a parameter group if it wasn't bound to a cluster or instance", () => {
     // GIVEN
     const stack = new cdk.Stack();
 
@@ -18,13 +17,13 @@ nodeunitShim({
     });
 
     // THEN
-    expect(stack).to(countResources('AWS::RDS::DBParameterGroup', 0));
-    expect(stack).to(countResources('AWS::RDS::DBClusterParameterGroup', 0));
+    expect(stack).toCountResources('AWS::RDS::DBParameterGroup', 0);
+    expect(stack).toCountResources('AWS::RDS::DBClusterParameterGroup', 0);
 
-    test.done();
-  },
 
-  'create a parameter group when bound to an instance'(test: Test) {
+  });
+
+  test('create a parameter group when bound to an instance', () => {
     // GIVEN
     const stack = new cdk.Stack();
 
@@ -39,18 +38,18 @@ nodeunitShim({
     parameterGroup.bindToInstance({});
 
     // THEN
-    expect(stack).to(haveResource('AWS::RDS::DBParameterGroup', {
+    expect(stack).toHaveResource('AWS::RDS::DBParameterGroup', {
       Description: 'desc',
       Family: 'aurora5.6',
       Parameters: {
         key: 'value',
       },
-    }));
+    });
 
-    test.done();
-  },
 
-  'create a parameter group when bound to a cluster'(test: Test) {
+  });
+
+  test('create a parameter group when bound to a cluster', () => {
     // GIVEN
     const stack = new cdk.Stack();
 
@@ -65,18 +64,18 @@ nodeunitShim({
     parameterGroup.bindToCluster({});
 
     // THEN
-    expect(stack).to(haveResource('AWS::RDS::DBClusterParameterGroup', {
+    expect(stack).toHaveResource('AWS::RDS::DBClusterParameterGroup', {
       Description: 'desc',
       Family: 'aurora5.6',
       Parameters: {
         key: 'value',
       },
-    }));
+    });
 
-    test.done();
-  },
 
-  'creates 2 parameter groups when bound to a cluster and an instance'(test: Test) {
+  });
+
+  test('creates 2 parameter groups when bound to a cluster and an instance', () => {
     // GIVEN
     const stack = new cdk.Stack();
 
@@ -92,13 +91,13 @@ nodeunitShim({
     parameterGroup.bindToInstance({});
 
     // THEN
-    expect(stack).to(countResources('AWS::RDS::DBParameterGroup', 1));
-    expect(stack).to(countResources('AWS::RDS::DBClusterParameterGroup', 1));
+    expect(stack).toCountResources('AWS::RDS::DBParameterGroup', 1);
+    expect(stack).toCountResources('AWS::RDS::DBClusterParameterGroup', 1);
+
 
-    test.done();
-  },
+  });
 
-  'Add an additional parameter to an existing parameter group'(test: Test) {
+  test('Add an additional parameter to an existing parameter group', () => {
     // GIVEN
     const stack = new cdk.Stack();
 
@@ -115,15 +114,15 @@ nodeunitShim({
     clusterParameterGroup.addParameter('key2', 'value2');
 
     // THEN
-    expect(stack).to(haveResource('AWS::RDS::DBClusterParameterGroup', {
+    expect(stack).toHaveResource('AWS::RDS::DBClusterParameterGroup', {
       Description: 'desc',
       Family: 'aurora5.6',
       Parameters: {
         key1: 'value1',
         key2: 'value2',
       },
-    }));
+    });
+
 
-    test.done();
-  },
+  });
 });
diff --git a/packages/@aws-cdk/aws-rds/test/proxy.test.ts b/packages/@aws-cdk/aws-rds/test/proxy.test.ts
index 5a4a2c2606959..5e2a65f1f0352 100644
--- a/packages/@aws-cdk/aws-rds/test/proxy.test.ts
+++ b/packages/@aws-cdk/aws-rds/test/proxy.test.ts
@@ -1,9 +1,9 @@
-import { ABSENT, expect, haveResourceLike, ResourcePart } from '@aws-cdk/assert-internal';
+import '@aws-cdk/assert-internal/jest';
+import { ABSENT, ResourcePart } from '@aws-cdk/assert-internal';
 import * as ec2 from '@aws-cdk/aws-ec2';
 import { AccountPrincipal, Role } from '@aws-cdk/aws-iam';
 import * as secretsmanager from '@aws-cdk/aws-secretsmanager';
 import * as cdk from '@aws-cdk/core';
-import { nodeunitShim, Test } from 'nodeunit-shim';
 import * as rds from '../lib';
 
 let stack: cdk.Stack;
@@ -11,15 +11,15 @@ let vpc: ec2.IVpc;
 
 let importedDbProxy: rds.IDatabaseProxy;
 
-nodeunitShim({
-  'setUp'(cb: () => void) {
+describe('proxy', () => {
+  beforeEach(() => {
     stack = new cdk.Stack();
     vpc = new ec2.Vpc(stack, 'VPC');
 
-    cb();
-  },
 
-  'create a DB proxy from an instance'(test: Test) {
+  });
+
+  test('create a DB proxy from an instance', () => {
     // GIVEN
     const instance = new rds.DatabaseInstance(stack, 'Instance', {
       engine: rds.DatabaseInstanceEngine.MYSQL,
@@ -34,7 +34,7 @@ nodeunitShim({
     });
 
     // THEN
-    expect(stack).to(haveResourceLike('AWS::RDS::DBProxy', {
+    expect(stack).toHaveResourceLike('AWS::RDS::DBProxy', {
       Auth: [
         {
           AuthScheme: 'SECRETS',
@@ -61,10 +61,10 @@ nodeunitShim({
           Ref: 'VPCPrivateSubnet2SubnetCFCDAA7A',
         },
       ],
-    }));
+    });
 
     // THEN
-    expect(stack).to(haveResourceLike('AWS::RDS::DBProxyTargetGroup', {
+    expect(stack).toHaveResourceLike('AWS::RDS::DBProxyTargetGroup', {
       DBProxyName: {
         Ref: 'ProxyCB0DFB71',
       },
@@ -75,12 +75,12 @@ nodeunitShim({
         },
       ],
       TargetGroupName: 'default',
-    }));
+    });
+
 
-    test.done();
-  },
+  });
 
-  'create a DB proxy from a cluster'(test: Test) {
+  test('create a DB proxy from a cluster', () => {
     // GIVEN
     const cluster = new rds.DatabaseCluster(stack, 'Database', {
       engine: rds.DatabaseClusterEngine.auroraPostgres({
@@ -97,7 +97,7 @@ nodeunitShim({
     });
 
     // THEN
-    expect(stack).to(haveResourceLike('AWS::RDS::DBProxy', {
+    expect(stack).toHaveResourceLike('AWS::RDS::DBProxy', {
       Auth: [
         {
           AuthScheme: 'SECRETS',
@@ -124,8 +124,8 @@ nodeunitShim({
           Ref: 'VPCPrivateSubnet2SubnetCFCDAA7A',
         },
       ],
-    }));
-    expect(stack).to(haveResourceLike('AWS::RDS::DBProxyTargetGroup', {
+    });
+    expect(stack).toHaveResourceLike('AWS::RDS::DBProxyTargetGroup', {
       DBProxyName: {
         Ref: 'ProxyCB0DFB71',
       },
@@ -137,8 +137,8 @@ nodeunitShim({
       ],
       DBInstanceIdentifiers: ABSENT,
       TargetGroupName: 'default',
-    }));
-    expect(stack).to(haveResourceLike('AWS::EC2::SecurityGroupIngress', {
+    });
+    expect(stack).toHaveResourceLike('AWS::EC2::SecurityGroupIngress', {
       IpProtocol: 'tcp',
       Description: 'Allow connections to the database Cluster from the Proxy',
       FromPort: {
@@ -153,12 +153,12 @@ nodeunitShim({
       ToPort: {
         'Fn::GetAtt': ['DatabaseB269D8BB', 'Endpoint.Port'],
       },
-    }));
+    });
 
-    test.done();
-  },
 
-  'One or more secrets are required.'(test: Test) {
+  });
+
+  test('One or more secrets are required.', () => {
     // GIVEN
     const cluster = new rds.DatabaseCluster(stack, 'Database', {
       engine: rds.DatabaseClusterEngine.auroraPostgres({ version: rds.AuroraPostgresEngineVersion.VER_10_7 }),
@@ -166,34 +166,34 @@ nodeunitShim({
     });
 
     // WHEN
-    test.throws(() => {
+    expect(() => {
       new rds.DatabaseProxy(stack, 'Proxy', {
         proxyTarget: rds.ProxyTarget.fromCluster(cluster),
         secrets: [], // No secret
         vpc,
       });
-    }, 'One or more secrets are required.');
+    }).toThrow('One or more secrets are required.');
+
 
-    test.done();
-  },
+  });
 
-  'fails when trying to create a proxy for a target without an engine'(test: Test) {
+  test('fails when trying to create a proxy for a target without an engine', () => {
     const importedCluster = rds.DatabaseCluster.fromDatabaseClusterAttributes(stack, 'Cluster', {
       clusterIdentifier: 'my-cluster',
     });
 
-    test.throws(() => {
+    expect(() => {
       new rds.DatabaseProxy(stack, 'Proxy', {
         proxyTarget: rds.ProxyTarget.fromCluster(importedCluster),
         vpc,
         secrets: [new secretsmanager.Secret(stack, 'Secret')],
       });
-    }, /Could not determine engine for proxy target 'Default\/Cluster'\. Please provide it explicitly when importing the resource/);
+    }).toThrow(/Could not determine engine for proxy target 'Default\/Cluster'\. Please provide it explicitly when importing the resource/);
+
 
-    test.done();
-  },
+  });
 
-  "fails when trying to create a proxy for a target with an engine that doesn't have engineFamily"(test: Test) {
+  test("fails when trying to create a proxy for a target with an engine that doesn't have engineFamily", () => {
     const importedInstance = rds.DatabaseInstance.fromDatabaseInstanceAttributes(stack, 'Cluster', {
       instanceIdentifier: 'my-instance',
       instanceEndpointAddress: 'instance-address',
@@ -204,18 +204,18 @@ nodeunitShim({
       }),
     });
 
-    test.throws(() => {
+    expect(() => {
       new rds.DatabaseProxy(stack, 'Proxy', {
         proxyTarget: rds.ProxyTarget.fromInstance(importedInstance),
         vpc,
         secrets: [new secretsmanager.Secret(stack, 'Secret')],
       });
-    }, /Engine 'mariadb-10\.0\.24' does not support proxies/);
+    }).toThrow(/Engine 'mariadb-10\.0\.24' does not support proxies/);
 
-    test.done();
-  },
 
-  'correctly creates a proxy for an imported Cluster if its engine is known'(test: Test) {
+  });
+
+  test('correctly creates a proxy for an imported Cluster if its engine is known', () => {
     const importedCluster = rds.DatabaseCluster.fromDatabaseClusterAttributes(stack, 'Cluster', {
       clusterIdentifier: 'my-cluster',
       engine: rds.DatabaseClusterEngine.auroraPostgres({
@@ -230,24 +230,24 @@ nodeunitShim({
       secrets: [new secretsmanager.Secret(stack, 'Secret')],
     });
 
-    expect(stack).to(haveResourceLike('AWS::RDS::DBProxy', {
+    expect(stack).toHaveResourceLike('AWS::RDS::DBProxy', {
       EngineFamily: 'POSTGRESQL',
-    }));
-    expect(stack).to(haveResourceLike('AWS::RDS::DBProxyTargetGroup', {
+    });
+    expect(stack).toHaveResourceLike('AWS::RDS::DBProxyTargetGroup', {
       DBClusterIdentifiers: [
         'my-cluster',
       ],
-    }));
-    expect(stack).to(haveResourceLike('AWS::EC2::SecurityGroup', {
+    });
+    expect(stack).toHaveResourceLike('AWS::EC2::SecurityGroup', {
       GroupDescription: 'SecurityGroup for Database Proxy',
       VpcId: { Ref: 'VPCB9E5F0B4' },
-    }));
+    });
+
 
-    test.done();
-  },
+  });
 
-  'imported Proxies': {
-    'setUp'(cb: () => void) {
+  describe('imported Proxies', () => {
+    beforeEach(() => {
       importedDbProxy = rds.DatabaseProxy.fromDatabaseProxyAttributes(stack, 'Proxy', {
         dbProxyName: 'my-proxy',
         dbProxyArn: 'arn:aws:rds:us-east-1:123456789012:db-proxy:prx-1234abcd',
@@ -255,10 +255,10 @@ nodeunitShim({
         securityGroups: [],
       });
 
-      cb();
-    },
 
-    'grant rds-db:connect in grantConnect() with a dbUser explicitly passed'(test: Test) {
+    });
+
+    test('grant rds-db:connect in grantConnect() with a dbUser explicitly passed', () => {
       // WHEN
       const role = new Role(stack, 'DBProxyRole', {
         assumedBy: new AccountPrincipal(stack.account),
@@ -267,7 +267,7 @@ nodeunitShim({
       importedDbProxy.grantConnect(role, databaseUser);
 
       // THEN
-      expect(stack).to(haveResourceLike('AWS::IAM::Policy', {
+      expect(stack).toHaveResourceLike('AWS::IAM::Policy', {
         PolicyDocument: {
           Statement: [{
             Effect: 'Allow',
@@ -286,27 +286,27 @@ nodeunitShim({
           }],
           Version: '2012-10-17',
         },
-      }));
+      });
+
 
-      test.done();
-    },
+    });
 
-    'throws when grantConnect() is used without a dbUser'(test: Test) {
+    test('throws when grantConnect() is used without a dbUser', () => {
       // WHEN
       const role = new Role(stack, 'DBProxyRole', {
         assumedBy: new AccountPrincipal(stack.account),
       });
 
       // THEN
-      test.throws(() => {
+      expect(() => {
         importedDbProxy.grantConnect(role);
-      }, /For imported Database Proxies, the dbUser is required in grantConnect/);
+      }).toThrow(/For imported Database Proxies, the dbUser is required in grantConnect/);
 
-      test.done();
-    },
-  },
 
-  'new Proxy with a single Secret can use grantConnect() without a dbUser passed'(test: Test) {
+    });
+  });
+
+  test('new Proxy with a single Secret can use grantConnect() without a dbUser passed', () => {
     // GIVEN
     const cluster = new rds.DatabaseCluster(stack, 'Database', {
       engine: rds.DatabaseClusterEngine.AURORA,
@@ -326,7 +326,7 @@ nodeunitShim({
     proxy.grantConnect(role);
 
     // THEN
-    expect(stack).to(haveResourceLike('AWS::IAM::Policy', {
+    expect(stack).toHaveResourceLike('AWS::IAM::Policy', {
       PolicyDocument: {
         Statement: [{
           Effect: 'Allow',
@@ -359,12 +359,12 @@ nodeunitShim({
         }],
         Version: '2012-10-17',
       },
-    }));
+    });
 
-    test.done();
-  },
 
-  'new Proxy with multiple Secrets cannot use grantConnect() without a dbUser passed'(test: Test) {
+  });
+
+  test('new Proxy with multiple Secrets cannot use grantConnect() without a dbUser passed', () => {
     // GIVEN
     const cluster = new rds.DatabaseCluster(stack, 'Database', {
       engine: rds.DatabaseClusterEngine.AURORA,
@@ -386,14 +386,14 @@ nodeunitShim({
     });
 
     // THEN
-    test.throws(() => {
+    expect(() => {
       proxy.grantConnect(role);
-    }, /When the Proxy contains multiple Secrets, you must pass a dbUser explicitly to grantConnect/);
+    }).toThrow(/When the Proxy contains multiple Secrets, you must pass a dbUser explicitly to grantConnect/);
+
 
-    test.done();
-  },
+  });
 
-  'DBProxyTargetGroup should have dependency on the proxy targets'(test: Test) {
+  test('DBProxyTargetGroup should have dependency on the proxy targets', () => {
     // GIVEN
     const cluster = new rds.DatabaseCluster(stack, 'cluster', {
       engine: rds.DatabaseClusterEngine.AURORA,
@@ -410,7 +410,7 @@ nodeunitShim({
     });
 
     // THEN
-    expect(stack).to(haveResourceLike('AWS::RDS::DBProxyTargetGroup', {
+    expect(stack).toHaveResourceLike('AWS::RDS::DBProxyTargetGroup', {
       Properties: {
         DBProxyName: {
           Ref: 'proxy3A1DA9C7',
@@ -427,8 +427,8 @@ nodeunitShim({
         'clusterSecurityGroupF441DCEA',
         'clusterSubnets81E3593F',
       ],
-    }, ResourcePart.CompleteDefinition));
+    }, ResourcePart.CompleteDefinition);
+
 
-    test.done();
-  },
+  });
 });
diff --git a/packages/@aws-cdk/aws-rds/test/serverless-cluster.test.ts b/packages/@aws-cdk/aws-rds/test/serverless-cluster.test.ts
index ba157ef9aa6b1..dff8d035b78a3 100644
--- a/packages/@aws-cdk/aws-rds/test/serverless-cluster.test.ts
+++ b/packages/@aws-cdk/aws-rds/test/serverless-cluster.test.ts
@@ -1,14 +1,14 @@
-import { expect, haveResource, haveResourceLike, ResourcePart, SynthUtils } from '@aws-cdk/assert-internal';
+import '@aws-cdk/assert-internal/jest';
+import { ResourcePart, SynthUtils } from '@aws-cdk/assert-internal';
 import * as ec2 from '@aws-cdk/aws-ec2';
 import * as iam from '@aws-cdk/aws-iam';
 import * as kms from '@aws-cdk/aws-kms';
 import * as cdk from '@aws-cdk/core';
 import * as cxapi from '@aws-cdk/cx-api';
-import { nodeunitShim, Test } from 'nodeunit-shim';
 import { AuroraPostgresEngineVersion, ServerlessCluster, DatabaseClusterEngine, ParameterGroup, AuroraCapacityUnit, DatabaseSecret } from '../lib';
 
-nodeunitShim({
-  'can create a Serverless Cluster with Aurora Postgres database engine'(test: Test) {
+describe('serverless cluster', () => {
+  test('can create a Serverless Cluster with Aurora Postgres database engine', () => {
     // GIVEN
     const stack = testStack();
     const vpc = new ec2.Vpc(stack, 'VPC');
@@ -25,7 +25,7 @@ nodeunitShim({
     });
 
     // THEN
-    expect(stack).to(haveResource('AWS::RDS::DBCluster', {
+    expect(stack).toHaveResource('AWS::RDS::DBCluster', {
       Properties: {
         Engine: 'aurora-postgresql',
         DBClusterParameterGroupName: 'default.aurora-postgresql10',
@@ -47,12 +47,12 @@ nodeunitShim({
       },
       DeletionPolicy: 'Snapshot',
       UpdateReplacePolicy: 'Snapshot',
-    }, ResourcePart.CompleteDefinition));
+    }, ResourcePart.CompleteDefinition);
 
-    test.done();
-  },
 
-  'can create a Serverless Cluster with Aurora Mysql database engine'(test: Test) {
+  });
+
+  test('can create a Serverless Cluster with Aurora Mysql database engine', () => {
     // GIVEN
     const stack = testStack();
     const vpc = new ec2.Vpc(stack, 'VPC');
@@ -64,7 +64,7 @@ nodeunitShim({
     });
 
     // THEN
-    expect(stack).to(haveResource('AWS::RDS::DBCluster', {
+    expect(stack).toHaveResource('AWS::RDS::DBCluster', {
       Properties: {
         Engine: 'aurora-mysql',
         DBClusterParameterGroupName: 'default.aurora-mysql5.7',
@@ -108,11 +108,11 @@ nodeunitShim({
       },
       DeletionPolicy: 'Snapshot',
       UpdateReplacePolicy: 'Snapshot',
-    }, ResourcePart.CompleteDefinition));
-    test.done();
-  },
+    }, ResourcePart.CompleteDefinition);
+
+  });
 
-  'can create a Serverless cluster with imported vpc and security group'(test: Test) {
+  test('can create a Serverless cluster with imported vpc and security group', () => {
     // GIVEN
     const stack = testStack();
     const vpc = ec2.Vpc.fromLookup(stack, 'VPC', {
@@ -129,7 +129,7 @@ nodeunitShim({
     });
 
     // THEN
-    expect(stack).to(haveResource('AWS::RDS::DBCluster', {
+    expect(stack).toHaveResource('AWS::RDS::DBCluster', {
       Engine: 'aurora-postgresql',
       DBClusterParameterGroupName: 'default.aurora-postgresql10',
       EngineMode: 'serverless',
@@ -159,12 +159,12 @@ nodeunitShim({
         ],
       },
       VpcSecurityGroupIds: ['SecurityGroupId12345'],
-    }));
+    });
 
-    test.done();
-  },
 
-  "sets the retention policy of the SubnetGroup to 'Retain' if the Serverless Cluster is created with 'Retain'"(test: Test) {
+  });
+
+  test("sets the retention policy of the SubnetGroup to 'Retain' if the Serverless Cluster is created with 'Retain'", () => {
     const stack = new cdk.Stack();
     const vpc = new ec2.Vpc(stack, 'Vpc');
 
@@ -174,15 +174,15 @@ nodeunitShim({
       removalPolicy: cdk.RemovalPolicy.RETAIN,
     });
 
-    expect(stack).to(haveResourceLike('AWS::RDS::DBSubnetGroup', {
+    expect(stack).toHaveResourceLike('AWS::RDS::DBSubnetGroup', {
       DeletionPolicy: 'Retain',
       UpdateReplacePolicy: 'Retain',
-    }, ResourcePart.CompleteDefinition));
+    }, ResourcePart.CompleteDefinition);
+
 
-    test.done();
-  },
+  });
 
-  'creates a secret when master credentials are not specified'(test: Test) {
+  test('creates a secret when master credentials are not specified', () => {
     // GIVEN
     const stack = testStack();
     const vpc = new ec2.Vpc(stack, 'VPC');
@@ -198,7 +198,7 @@ nodeunitShim({
     });
 
     // THEN
-    expect(stack).to(haveResource('AWS::RDS::DBCluster', {
+    expect(stack).toHaveResource('AWS::RDS::DBCluster', {
       MasterUsername: {
         'Fn::Join': [
           '',
@@ -223,21 +223,21 @@ nodeunitShim({
           ],
         ],
       },
-    }));
+    });
 
-    expect(stack).to(haveResource('AWS::SecretsManager::Secret', {
+    expect(stack).toHaveResource('AWS::SecretsManager::Secret', {
       GenerateSecretString: {
         ExcludeCharacters: '"@/\\',
         GenerateStringKey: 'password',
         PasswordLength: 30,
         SecretStringTemplate: '{"username":"myuser"}',
       },
-    }));
+    });
+
 
-    test.done();
-  },
+  });
 
-  'create an Serverless cluster with custom KMS key for storage'(test: Test) {
+  test('create an Serverless cluster with custom KMS key for storage', () => {
     // GIVEN
     const stack = testStack();
     const vpc = new ec2.Vpc(stack, 'VPC');
@@ -250,19 +250,19 @@ nodeunitShim({
     });
 
     // THEN
-    expect(stack).to(haveResource('AWS::RDS::DBCluster', {
+    expect(stack).toHaveResource('AWS::RDS::DBCluster', {
       KmsKeyId: {
         'Fn::GetAtt': [
           'Key961B73FD',
           'Arn',
         ],
       },
-    }));
+    });
 
-    test.done();
-  },
 
-  'create a cluster using a specific version of Postgresql'(test: Test) {
+  });
+
+  test('create a cluster using a specific version of Postgresql', () => {
     // GIVEN
     const stack = testStack();
     const vpc = new ec2.Vpc(stack, 'VPC');
@@ -276,16 +276,16 @@ nodeunitShim({
     });
 
     // THEN
-    expect(stack).to(haveResource('AWS::RDS::DBCluster', {
+    expect(stack).toHaveResource('AWS::RDS::DBCluster', {
       Engine: 'aurora-postgresql',
       EngineMode: 'serverless',
       EngineVersion: '10.7',
-    }));
+    });
+
 
-    test.done();
-  },
+  });
 
-  'cluster exposes different read and write endpoints'(test: Test) {
+  test('cluster exposes different read and write endpoints', () => {
     // GIVEN
     const stack = testStack();
     const vpc = new ec2.Vpc(stack, 'VPC');
@@ -300,15 +300,13 @@ nodeunitShim({
     });
 
     // THEN
-    test.notDeepEqual(
-      stack.resolve(cluster.clusterEndpoint),
-      stack.resolve(cluster.clusterReadEndpoint),
-    );
+    expect(stack.resolve(cluster.clusterEndpoint)).not
+      .toEqual(stack.resolve(cluster.clusterReadEndpoint));
 
-    test.done();
-  },
 
-  'imported cluster with imported security group honors allowAllOutbound'(test: Test) {
+  });
+
+  test('imported cluster with imported security group honors allowAllOutbound', () => {
     // GIVEN
     const stack = testStack();
 
@@ -326,39 +324,39 @@ nodeunitShim({
     cluster.connections.allowToAnyIpv4(ec2.Port.tcp(443));
 
     // THEN
-    expect(stack).to(haveResource('AWS::EC2::SecurityGroupEgress', {
+    expect(stack).toHaveResource('AWS::EC2::SecurityGroupEgress', {
       GroupId: 'sg-123456789',
-    }));
+    });
+
 
-    test.done();
-  },
+  });
 
-  'can import a serverless cluster with minimal attributes'(test: Test) {
+  test('can import a serverless cluster with minimal attributes', () => {
     const stack = testStack();
 
     const cluster = ServerlessCluster.fromServerlessClusterAttributes(stack, 'Database', {
       clusterIdentifier: 'identifier',
     });
 
-    test.equals(cluster.clusterIdentifier, 'identifier');
+    expect(cluster.clusterIdentifier).toEqual('identifier');
 
-    test.done();
-  },
 
-  'minimal imported cluster throws on accessing attributes for missing parameters'(test: Test) {
+  });
+
+  test('minimal imported cluster throws on accessing attributes for missing parameters', () => {
     const stack = testStack();
 
     const cluster = ServerlessCluster.fromServerlessClusterAttributes(stack, 'Database', {
       clusterIdentifier: 'identifier',
     });
 
-    test.throws(() => cluster.clusterEndpoint, /Cannot access `clusterEndpoint` of an imported cluster/);
-    test.throws(() => cluster.clusterReadEndpoint, /Cannot access `clusterReadEndpoint` of an imported cluster/);
+    expect(() => cluster.clusterEndpoint).toThrow(/Cannot access `clusterEndpoint` of an imported cluster/);
+    expect(() => cluster.clusterReadEndpoint).toThrow(/Cannot access `clusterReadEndpoint` of an imported cluster/);
+
 
-    test.done();
-  },
+  });
 
-  'imported cluster can access properties if attributes are provided'(test: Test) {
+  test('imported cluster can access properties if attributes are provided', () => {
     const stack = testStack();
 
     const cluster = ServerlessCluster.fromServerlessClusterAttributes(stack, 'Database', {
@@ -371,13 +369,13 @@ nodeunitShim({
       })],
     });
 
-    test.equals(cluster.clusterEndpoint.socketAddress, 'addr:3306');
-    test.equals(cluster.clusterReadEndpoint.socketAddress, 'reader-address:3306');
+    expect(cluster.clusterEndpoint.socketAddress).toEqual('addr:3306');
+    expect(cluster.clusterReadEndpoint.socketAddress).toEqual('reader-address:3306');
+
 
-    test.done();
-  },
+  });
 
-  'throws when trying to add rotation to a serverless cluster without secret'(test: Test) {
+  test('throws when trying to add rotation to a serverless cluster without secret', () => {
     // GIVEN
     const stack = new cdk.Stack();
     const vpc = new ec2.Vpc(stack, 'VPC');
@@ -393,12 +391,12 @@ nodeunitShim({
     });
 
     // THEN
-    test.throws(() => cluster.addRotationSingleUser(), /without secret/);
+    expect(() => cluster.addRotationSingleUser()).toThrow(/without secret/);
 
-    test.done();
-  },
 
-  'throws when trying to add single user rotation multiple times'(test: Test) {
+  });
+
+  test('throws when trying to add single user rotation multiple times', () => {
     // GIVEN
     const stack = new cdk.Stack();
     const vpc = new ec2.Vpc(stack, 'VPC');
@@ -412,12 +410,12 @@ nodeunitShim({
     cluster.addRotationSingleUser();
 
     // THEN
-    test.throws(() => cluster.addRotationSingleUser(), /A single user rotation was already added to this cluster/);
+    expect(() => cluster.addRotationSingleUser()).toThrow(/A single user rotation was already added to this cluster/);
+
 
-    test.done();
-  },
+  });
 
-  'can set deletion protection'(test: Test) {
+  test('can set deletion protection', () => {
     // GIVEN
     const stack = testStack();
     const vpc = new ec2.Vpc(stack, 'VPC');
@@ -430,14 +428,14 @@ nodeunitShim({
     });
 
     // THEN
-    expect(stack).to(haveResourceLike('AWS::RDS::DBCluster', {
+    expect(stack).toHaveResourceLike('AWS::RDS::DBCluster', {
       DeletionProtection: true,
-    }));
+    });
 
-    test.done();
-  },
 
-  'can set backup retention'(test: Test) {
+  });
+
+  test('can set backup retention', () => {
     // GIVEN
     const stack = testStack();
     const vpc = new ec2.Vpc(stack, 'VPC');
@@ -450,14 +448,14 @@ nodeunitShim({
     });
 
     // THEN
-    expect(stack).to(haveResourceLike('AWS::RDS::DBCluster', {
+    expect(stack).toHaveResourceLike('AWS::RDS::DBCluster', {
       BackupRetentionPeriod: 2,
-    }));
+    });
+
 
-    test.done();
-  },
+  });
 
-  'does not throw (but adds a node error) if a (dummy) VPC does not have sufficient subnets'(test: Test) {
+  test('does not throw (but adds a node error) if a (dummy) VPC does not have sufficient subnets', () => {
     // GIVEN
     const stack = testStack();
     const vpc = ec2.Vpc.fromLookup(stack, 'VPC', { isDefault: true });
@@ -474,12 +472,12 @@ nodeunitShim({
     // THEN
     const art = SynthUtils.synthesize(stack);
     const meta = art.findMetadataByType('aws:cdk:error');
-    test.equal(meta[0].data, 'Cluster requires at least 2 subnets, got 0');
+    expect(meta[0].data).toEqual('Cluster requires at least 2 subnets, got 0');
 
-    test.done();
-  },
 
-  'can set scaling configuration'(test: Test) {
+  });
+
+  test('can set scaling configuration', () => {
     // GIVEN
     const stack = testStack();
     const vpc = ec2.Vpc.fromLookup(stack, 'VPC', { isDefault: true });
@@ -496,19 +494,19 @@ nodeunitShim({
     });
 
     //THEN
-    expect(stack).to(haveResource('AWS::RDS::DBCluster', {
+    expect(stack).toHaveResource('AWS::RDS::DBCluster', {
       ScalingConfiguration: {
         AutoPause: true,
         MaxCapacity: 128,
         MinCapacity: 1,
         SecondsUntilAutoPause: 600,
       },
-    }));
+    });
+
 
-    test.done();
-  },
+  });
 
-  'can enable Data API'(test: Test) {
+  test('can enable Data API', () => {
     // GIVEN
     const stack = testStack();
     const vpc = ec2.Vpc.fromLookup(stack, 'VPC', { isDefault: true });
@@ -521,14 +519,14 @@ nodeunitShim({
     });
 
     //THEN
-    expect(stack).to(haveResource('AWS::RDS::DBCluster', {
+    expect(stack).toHaveResource('AWS::RDS::DBCluster', {
       EnableHttpEndpoint: true,
-    }));
+    });
+
 
-    test.done();
-  },
+  });
 
-  'default scaling options'(test: Test) {
+  test('default scaling options', () => {
     // GIVEN
     const stack = testStack();
     const vpc = ec2.Vpc.fromLookup(stack, 'VPC', { isDefault: true });
@@ -541,16 +539,16 @@ nodeunitShim({
     });
 
     //THEN
-    expect(stack).to(haveResource('AWS::RDS::DBCluster', {
+    expect(stack).toHaveResource('AWS::RDS::DBCluster', {
       ScalingConfiguration: {
         AutoPause: true,
       },
-    }));
+    });
 
-    test.done();
-  },
 
-  'auto pause is disabled if a time of zero is specified'(test: Test) {
+  });
+
+  test('auto pause is disabled if a time of zero is specified', () => {
     // GIVEN
     const stack = testStack();
     const vpc = ec2.Vpc.fromLookup(stack, 'VPC', { isDefault: true });
@@ -565,72 +563,72 @@ nodeunitShim({
     });
 
     //THEN
-    expect(stack).to(haveResource('AWS::RDS::DBCluster', {
+    expect(stack).toHaveResource('AWS::RDS::DBCluster', {
       ScalingConfiguration: {
         AutoPause: false,
       },
-    }));
+    });
+
 
-    test.done();
-  },
+  });
 
-  'throws when invalid auto pause time is specified'(test: Test) {
+  test('throws when invalid auto pause time is specified', () => {
     // GIVEN
     const stack = testStack();
     const vpc = ec2.Vpc.fromLookup(stack, 'VPC', { isDefault: true });
 
     // WHEN
-    test.throws(() =>
+    expect(() =>
       new ServerlessCluster(stack, 'Database', {
         engine: DatabaseClusterEngine.AURORA_MYSQL,
         vpc,
         scaling: {
           autoPause: cdk.Duration.seconds(30),
         },
-      }), /auto pause time must be between 5 minutes and 1 day./);
+      })).toThrow(/auto pause time must be between 5 minutes and 1 day./);
 
-    test.throws(() =>
+    expect(() =>
       new ServerlessCluster(stack, 'Another Database', {
         engine: DatabaseClusterEngine.AURORA_MYSQL,
         vpc,
         scaling: {
           autoPause: cdk.Duration.days(2),
         },
-      }), /auto pause time must be between 5 minutes and 1 day./);
+      })).toThrow(/auto pause time must be between 5 minutes and 1 day./);
 
-    test.done();
-  },
 
-  'throws when invalid backup retention period is specified'(test: Test) {
+  });
+
+  test('throws when invalid backup retention period is specified', () => {
     // GIVEN
     const stack = testStack();
     const vpc = ec2.Vpc.fromLookup(stack, 'VPC', { isDefault: true });
 
     // WHEN
-    test.throws(() =>
+    expect(() =>
       new ServerlessCluster(stack, 'Database', {
         engine: DatabaseClusterEngine.AURORA_MYSQL,
         vpc,
         backupRetention: cdk.Duration.days(0),
-      }), /backup retention period must be between 1 and 35 days. received: 0/);
+      })).toThrow(/backup retention period must be between 1 and 35 days. received: 0/);
 
-    test.throws(() =>
+    expect(() =>
       new ServerlessCluster(stack, 'Another Database', {
         engine: DatabaseClusterEngine.AURORA_MYSQL,
         vpc,
         backupRetention: cdk.Duration.days(36),
-      }), /backup retention period must be between 1 and 35 days. received: 36/);
+      })).toThrow(/backup retention period must be between 1 and 35 days. received: 36/);
+
 
-    test.done();
-  },
+  });
 
-  'throws error when min capacity is greater than max capacity'(test: Test) {
+  test('throws error when min capacity is greater than max capacity', () => {
     // GIVEN
     const stack = testStack();
     const vpc = ec2.Vpc.fromLookup(stack, 'VPC', { isDefault: true });
 
     // WHEN
-    test.throws(() =>
+    expect(() =>
       new ServerlessCluster(stack, 'Database', {
         engine: DatabaseClusterEngine.AURORA_MYSQL,
         vpc,
@@ -638,12 +636,12 @@ nodeunitShim({
           minCapacity: AuroraCapacityUnit.ACU_2,
           maxCapacity: AuroraCapacityUnit.ACU_1,
         },
-      }), /maximum capacity must be greater than or equal to minimum capacity./);
+      })).toThrow(/maximum capacity must be greater than or equal to minimum capacity./);
+
 
-    test.done();
-  },
+  });
 
-  'check that clusterArn property works'(test: Test) {
+  test('check that clusterArn property works', () => {
     // GIVEN
     const stack = testStack();
     const vpc = ec2.Vpc.fromLookup(stack, 'VPC', { isDefault: true });
@@ -660,7 +658,7 @@ nodeunitShim({
     });
 
     // THEN
-    test.deepEqual(stack.resolve(cluster.clusterArn), {
+    expect(stack.resolve(cluster.clusterArn)).toEqual({
       'Fn::Join': [
         '',
         [
@@ -671,10 +669,10 @@ nodeunitShim({
         ],
       ],
     });
-    test.done();
-  },
 
-  'can grant Data API access'(test: Test) {
+  });
+
+  test('can grant Data API access', () => {
     // GIVEN
     const stack = testStack();
     const vpc = ec2.Vpc.fromLookup(stack, 'VPC', { isDefault: true });
@@ -689,7 +687,7 @@ nodeunitShim({
     cluster.grantDataApiAccess(user);
 
     // THEN
-    expect(stack).to(haveResource('AWS::IAM::Policy', {
+    expect(stack).toHaveResource('AWS::IAM::Policy', {
       PolicyDocument: {
         Statement: [
           {
@@ -722,12 +720,12 @@ nodeunitShim({
           Ref: 'User00B015A1',
         },
       ],
-    }));
+    });
+
 
-    test.done();
-  },
+  });
 
-  'can grant Data API access on imported cluster with given secret'(test: Test) {
+  test('can grant Data API access on imported cluster with given secret', () => {
     // GIVEN
     const stack = testStack();
     const secret = new DatabaseSecret(stack, 'Secret', {
@@ -744,7 +742,7 @@ nodeunitShim({
     cluster.grantDataApiAccess(user);
 
     // THEN
-    expect(stack).to(haveResource('AWS::IAM::Policy', {
+    expect(stack).toHaveResource('AWS::IAM::Policy', {
       PolicyDocument: {
         Statement: [
           {
@@ -777,12 +775,12 @@ nodeunitShim({
           Ref: 'User00B015A1',
         },
       ],
-    }));
+    });
+
 
-    test.done();
-  },
+  });
 
-  'grant Data API access enables the Data API'(test: Test) {
+  test('grant Data API access enables the Data API', () => {
     // GIVEN
     const stack = testStack();
     const vpc = ec2.Vpc.fromLookup(stack, 'VPC', { isDefault: true });
@@ -796,14 +794,14 @@ nodeunitShim({
     cluster.grantDataApiAccess(user);
 
     //THEN
-    expect(stack).to(haveResource('AWS::RDS::DBCluster', {
+    expect(stack).toHaveResource('AWS::RDS::DBCluster', {
       EnableHttpEndpoint: true,
-    }));
+    });
 
-    test.done();
-  },
 
-  'grant Data API access throws if the Data API is disabled'(test: Test) {
+  });
+
+  test('grant Data API access throws if the Data API is disabled', () => {
     // GIVEN
     const stack = testStack();
     const vpc = ec2.Vpc.fromLookup(stack, 'VPC', { isDefault: true });
@@ -815,12 +813,12 @@ nodeunitShim({
     const user = new iam.User(stack, 'User');
 
     // WHEN
-    test.throws(() => cluster.grantDataApiAccess(user), /Cannot grant Data API access when the Data API is disabled/);
+    expect(() => cluster.grantDataApiAccess(user)).toThrow(/Cannot grant Data API access when the Data API is disabled/);
+
 
-    test.done();
-  },
+  });
 
-  'changes the case of the cluster identifier if the lowercaseDbIdentifier feature flag is enabled'(test: Test) {
+  test('changes the case of the cluster identifier if the lowercaseDbIdentifier feature flag is enabled', () => {
     // GIVEN
     const app = new cdk.App({
       context: { [cxapi.RDS_LOWERCASE_DB_IDENTIFIER]: true },
@@ -837,14 +835,14 @@ nodeunitShim({
     });
 
     // THEN
-    expect(stack).to(haveResourceLike('AWS::RDS::DBCluster', {
+    expect(stack).toHaveResourceLike('AWS::RDS::DBCluster', {
       DBClusterIdentifier: clusterIdentifier.toLowerCase(),
-    }));
+    });
 
-    test.done();
-  },
 
-  'does not change the case of the cluster identifier if the lowercaseDbIdentifier feature flag is disabled'(test: Test) {
+  });
+
+  test('does not change the case of the cluster identifier if the lowercaseDbIdentifier feature flag is disabled', () => {
     // GIVEN
     const app = new cdk.App({ context: { '@aws-cdk/aws-rds:lowercaseDbIdentifier': false } });
     const stack = testStack(app);
@@ -859,12 +857,12 @@ nodeunitShim({
     });
 
     // THEN
-    expect(stack).to(haveResourceLike('AWS::RDS::DBCluster', {
+    expect(stack).toHaveResourceLike('AWS::RDS::DBCluster', {
       DBClusterIdentifier: clusterIdentifier,
-    }));
+    });
+
 
-    test.done();
-  },
+  });
 });
 
 function testStack(app?: cdk.App, id?: string): cdk.Stack {
diff --git a/packages/@aws-cdk/aws-rds/test/sql-server/sql-server.instance-engine.test.ts b/packages/@aws-cdk/aws-rds/test/sql-server/sql-server.instance-engine.test.ts
index fb815c95ebee6..72615d08f2093 100644
--- a/packages/@aws-cdk/aws-rds/test/sql-server/sql-server.instance-engine.test.ts
+++ b/packages/@aws-cdk/aws-rds/test/sql-server/sql-server.instance-engine.test.ts
@@ -1,11 +1,10 @@
-import { expect, haveResourceLike } from '@aws-cdk/assert-internal';
+import '@aws-cdk/assert-internal/jest';
 import * as core from '@aws-cdk/core';
-import { nodeunitShim, Test } from 'nodeunit-shim';
 import * as rds from '../../lib';
 
-nodeunitShim({
-  'SQL Server instance engine': {
-    "has ParameterGroup family ending in '11.0' for major version 11"(test: Test) {
+describe('sql server instance engine', () => {
+  describe('SQL Server instance engine', () => {
+    test("has ParameterGroup family ending in '11.0' for major version 11", () => {
       const stack = new core.Stack();
       new rds.ParameterGroup(stack, 'ParameterGroup', {
         engine: rds.DatabaseInstanceEngine.sqlServerWeb({
@@ -13,14 +12,14 @@ nodeunitShim({
         }),
       }).bindToInstance({});
 
-      expect(stack).to(haveResourceLike('AWS::RDS::DBParameterGroup', {
+      expect(stack).toHaveResourceLike('AWS::RDS::DBParameterGroup', {
         Family: 'sqlserver-web-11.0',
-      }));
+      });
+
 
-      test.done();
-    },
+    });
 
-    "has MajorEngineVersion ending in '11.00' for major version 11"(test: Test) {
+    test("has MajorEngineVersion ending in '11.00' for major version 11", () => {
       const stack = new core.Stack();
       new rds.OptionGroup(stack, 'OptionGroup', {
         engine: rds.DatabaseInstanceEngine.sqlServerWeb({
@@ -36,11 +35,11 @@ nodeunitShim({
         ],
       });
 
-      expect(stack).to(haveResourceLike('AWS::RDS::OptionGroup', {
+      expect(stack).toHaveResourceLike('AWS::RDS::OptionGroup', {
         MajorEngineVersion: '11.00',
-      }));
+      });
+
 
-      test.done();
-    },
-  },
+    });
+  });
 });
diff --git a/packages/@aws-cdk/aws-rds/test/subnet-group.test.ts b/packages/@aws-cdk/aws-rds/test/subnet-group.test.ts
index 565c10c6b6d92..1dc9718258deb 100644
--- a/packages/@aws-cdk/aws-rds/test/subnet-group.test.ts
+++ b/packages/@aws-cdk/aws-rds/test/subnet-group.test.ts
@@ -1,37 +1,36 @@
-import { expect, haveResource, haveResourceLike } from '@aws-cdk/assert-internal';
+import '@aws-cdk/assert-internal/jest';
 import * as ec2 from '@aws-cdk/aws-ec2';
 import * as cdk from '@aws-cdk/core';
-import { nodeunitShim, Test } from 'nodeunit-shim';
 import * as rds from '../lib';
 
 let stack: cdk.Stack;
 let vpc: ec2.IVpc;
 
-nodeunitShim({
-  'setUp'(cb: () => void) {
+describe('subnet group', () => {
+  beforeEach(() => {
     stack = new cdk.Stack();
     vpc = new ec2.Vpc(stack, 'VPC');
-    cb();
-  },
 
-  'creates a subnet group from minimal properties'(test: Test) {
+  });
+
+  test('creates a subnet group from minimal properties', () => {
     new rds.SubnetGroup(stack, 'Group', {
       description: 'MyGroup',
       vpc,
     });
 
-    expect(stack).to(haveResource('AWS::RDS::DBSubnetGroup', {
+    expect(stack).toHaveResource('AWS::RDS::DBSubnetGroup', {
       DBSubnetGroupDescription: 'MyGroup',
       SubnetIds: [
         { Ref: 'VPCPrivateSubnet1Subnet8BCA10E0' },
         { Ref: 'VPCPrivateSubnet2SubnetCFCDAA7A' },
       ],
-    }));
+    });
 
-    test.done();
-  },
 
-  'creates a subnet group from all properties'(test: Test) {
+  });
+
+  test('creates a subnet group from all properties', () => {
     new rds.SubnetGroup(stack, 'Group', {
       description: 'My Shared Group',
       subnetGroupName: 'SharedGroup',
@@ -39,19 +38,19 @@ nodeunitShim({
       vpcSubnets: { subnetType: ec2.SubnetType.PRIVATE },
     });
 
-    expect(stack).to(haveResource('AWS::RDS::DBSubnetGroup', {
+    expect(stack).toHaveResource('AWS::RDS::DBSubnetGroup', {
       DBSubnetGroupDescription: 'My Shared Group',
       DBSubnetGroupName: 'sharedgroup',
       SubnetIds: [
         { Ref: 'VPCPrivateSubnet1Subnet8BCA10E0' },
         { Ref: 'VPCPrivateSubnet2SubnetCFCDAA7A' },
       ],
-    }));
+    });
 
-    test.done();
-  },
 
-  'correctly creates a subnet group with a deploy-time value for its name'(test: Test) {
+  });
+
+  test('correctly creates a subnet group with a deploy-time value for its name', () => {
     const parameter = new cdk.CfnParameter(stack, 'Parameter');
     new rds.SubnetGroup(stack, 'Group', {
       description: 'My Shared Group',
@@ -60,57 +59,57 @@ nodeunitShim({
       vpcSubnets: { subnetType: ec2.SubnetType.PRIVATE },
     });
 
-    expect(stack).to(haveResourceLike('AWS::RDS::DBSubnetGroup', {
+    expect(stack).toHaveResourceLike('AWS::RDS::DBSubnetGroup', {
       DBSubnetGroupName: {
         Ref: 'Parameter',
       },
-    }));
+    });
+
 
-    test.done();
-  },
+  });
 
-  'subnet selection': {
-    'defaults to private subnets'(test: Test) {
+  describe('subnet selection', () => {
+    test('defaults to private subnets', () => {
       new rds.SubnetGroup(stack, 'Group', {
         description: 'MyGroup',
         vpc,
       });
 
-      expect(stack).to(haveResource('AWS::RDS::DBSubnetGroup', {
+      expect(stack).toHaveResource('AWS::RDS::DBSubnetGroup', {
         DBSubnetGroupDescription: 'MyGroup',
         SubnetIds: [
           { Ref: 'VPCPrivateSubnet1Subnet8BCA10E0' },
           { Ref: 'VPCPrivateSubnet2SubnetCFCDAA7A' },
         ],
-      }));
+      });
+
 
-      test.done();
-    },
+    });
 
-    'can specify subnet type'(test: Test) {
+    test('can specify subnet type', () => {
       new rds.SubnetGroup(stack, 'Group', {
         description: 'MyGroup',
         vpc,
         vpcSubnets: { subnetType: ec2.SubnetType.PUBLIC },
       });
 
-      expect(stack).to(haveResource('AWS::RDS::DBSubnetGroup', {
+      expect(stack).toHaveResource('AWS::RDS::DBSubnetGroup', {
         DBSubnetGroupDescription: 'MyGroup',
         SubnetIds: [
           { Ref: 'VPCPublicSubnet1SubnetB4246D30' },
           { Ref: 'VPCPublicSubnet2Subnet74179F39' },
         ],
-      }));
-      test.done();
-    },
-  },
+      });
 
-  'import group by name'(test: Test) {
+    });
+  });
+
+  test('import group by name', () => {
     const subnetGroup = rds.SubnetGroup.fromSubnetGroupName(stack, 'Group', 'my-subnet-group');
 
-    test.equals(subnetGroup.subnetGroupName, 'my-subnet-group');
+    expect(subnetGroup.subnetGroupName).toEqual('my-subnet-group');
+
 
-    test.done();
-  },
+  });
 
 });
diff --git a/packages/@aws-cdk/core/package.json b/packages/@aws-cdk/core/package.json
index f4bfcb141730e..e8865fafd3dc2 100644
--- a/packages/@aws-cdk/core/package.json
+++ b/packages/@aws-cdk/core/package.json
@@ -180,7 +180,7 @@
     "cfn2ts": "0.0.0",
     "fast-check": "^2.17.0",
     "lodash": "^4.17.21",
-    "nodeunit-shim": "0.0.0",
+    "jest": "^26.6.3",
     "pkglint": "0.0.0",
     "sinon": "^9.2.4",
     "ts-mock-imports": "^1.3.7"
diff --git a/packages/@aws-cdk/core/test/annotations.test.ts b/packages/@aws-cdk/core/test/annotations.test.ts
index 1b0cbf209c528..46e91cf78761a 100644
--- a/packages/@aws-cdk/core/test/annotations.test.ts
+++ b/packages/@aws-cdk/core/test/annotations.test.ts
@@ -1,17 +1,16 @@
 import { CloudAssembly } from '@aws-cdk/cx-api';
-import { nodeunitShim, Test } from 'nodeunit-shim';
 import { Construct, App, Stack } from '../lib';
 import { Annotations } from '../lib/annotations';
 
 const restore = process.env.CDK_BLOCK_DEPRECATIONS;
 
-nodeunitShim({
-  'tearDown'(cb: any) {
+describe('annotations', () => {
+  afterEach(() => {
     process.env.CDK_BLOCK_DEPRECATIONS = restore; // restore to the original value
-    cb();
-  },
 
-  'addDeprecation() annotates the usage of a deprecated API'(test: Test) {
+  });
+
+  test('addDeprecation() annotates the usage of a deprecated API', () => {
     // GIVEN
     const app = new App();
     const stack = new Stack(app, 'MyStack');
@@ -22,16 +21,16 @@ nodeunitShim({
     Annotations.of(c1).addDeprecation('@aws-cdk/core.Construct.node', 'use @aws-cdk.Construct.construct instead');
 
     // THEN
-    test.deepEqual(getWarnings(app.synth()), [
+    expect(getWarnings(app.synth())).toEqual([
       {
         path: '/MyStack/Hello',
         message: 'The API @aws-cdk/core.Construct.node is deprecated: use @aws-cdk.Construct.construct instead. This API will be removed in the next major release',
       },
     ]);
-    test.done();
-  },
 
-  'deduplicated per node based on "api"'(test: Test) {
+  });
+
+  test('deduplicated per node based on "api"', () => {
     // GIVEN
     const app = new App();
     const stack1 = new Stack(app, 'MyStack1');
@@ -50,7 +49,7 @@ nodeunitShim({
     Annotations.of(c1).addDeprecation('@aws-cdk/core.Construct.node', 'use @aws-cdk.Construct.construct instead');
 
     // THEN
-    test.deepEqual(getWarnings(app.synth()), [
+    expect(getWarnings(app.synth())).toEqual([
       {
         path: '/MyStack1/Hello',
         message: 'The API @aws-cdk/core.Construct.node is deprecated: use @aws-cdk.Construct.construct instead. This API will be removed in the next major release',
@@ -64,10 +63,10 @@ nodeunitShim({
         message: 'The API @aws-cdk/core.Construct.node is deprecated: use @aws-cdk.Construct.construct instead. This API will be removed in the next major release',
       },
     ]);
-    test.done();
-  },
 
-  'CDK_BLOCK_DEPRECATIONS will throw if a deprecated API is used'(test: Test) {
+  });
+
+  test('CDK_BLOCK_DEPRECATIONS will throw if a deprecated API is used', () => {
     // GIVEN
     const app = new App();
     const stack = new Stack(app, 'MyStack');
@@ -75,9 +74,9 @@ nodeunitShim({
 
     // THEN
     process.env.CDK_BLOCK_DEPRECATIONS = '1';
-    test.throws(() => Annotations.of(c1).addDeprecation('foo', 'bar'), /MyStack\/Hello: The API foo is deprecated: bar\. This API will be removed in the next major release/);
-    test.done();
-  },
+    expect(() => Annotations.of(c1).addDeprecation('foo', 'bar')).toThrow(/MyStack\/Hello: The API foo is deprecated: bar\. This API will be removed in the next major release/);
+
+  });
 });
 
 function getWarnings(casm: CloudAssembly) {
diff --git a/packages/@aws-cdk/core/test/app.test.ts b/packages/@aws-cdk/core/test/app.test.ts
index 3bb178edef56a..c73538067f9ef 100644
--- a/packages/@aws-cdk/core/test/app.test.ts
+++ b/packages/@aws-cdk/core/test/app.test.ts
@@ -1,6 +1,5 @@
 import { ContextProvider } from '@aws-cdk/cloud-assembly-schema';
 import * as cxapi from '@aws-cdk/cx-api';
-import { nodeunitShim, Test } from 'nodeunit-shim';
 import { CfnResource, Construct, DefaultStackSynthesizer, Stack, StackProps } from '../lib';
 import { Annotations } from '../lib/annotations';
 import { App, AppProps } from '../lib/app';
@@ -46,27 +45,27 @@ function synthStack(name: string, includeMetadata: boolean = false, context?: an
   return stack;
 }
 
-nodeunitShim({
-  'synthesizes all stacks and returns synthesis result'(test: Test) {
+describe('app', () => {
+  test('synthesizes all stacks and returns synthesis result', () => {
     const response = synth();
     delete (response as any).dir;
 
-    test.deepEqual(response.stacks.length, 2);
+    expect(response.stacks.length).toEqual(2);
 
     const stack1 = response.stacks[0];
-    test.deepEqual(stack1.stackName, 'stack1');
-    test.deepEqual(stack1.id, 'stack1');
-    test.deepEqual(stack1.environment.account, '12345');
-    test.deepEqual(stack1.environment.region, 'us-east-1');
-    test.deepEqual(stack1.environment.name, 'aws://12345/us-east-1');
-    test.deepEqual(stack1.template, {
+    expect(stack1.stackName).toEqual('stack1');
+    expect(stack1.id).toEqual('stack1');
+    expect(stack1.environment.account).toEqual('12345');
+    expect(stack1.environment.region).toEqual('us-east-1');
+    expect(stack1.environment.name).toEqual('aws://12345/us-east-1');
+    expect(stack1.template).toEqual({
       Resources:
       {
         s1c1: { Type: 'DummyResource', Properties: { Prop1: 'Prop1' } },
         s1c2: { Type: 'DummyResource', Properties: { Foo: 123 } },
       },
     });
-    test.deepEqual(stack1.manifest.metadata, {
+    expect(stack1.manifest.metadata).toEqual({
       '/stack1': [{ type: 'meta', data: 111 }],
       '/stack1/s1c1': [{ type: 'aws:cdk:logicalId', data: 's1c1' }],
       '/stack1/s1c2':
@@ -76,10 +75,10 @@ nodeunitShim({
     });
 
     const stack2 = response.stacks[1];
-    test.deepEqual(stack2.stackName, 'stack2');
-    test.deepEqual(stack2.id, 'stack2');
-    test.deepEqual(stack2.environment.name, 'aws://unknown-account/unknown-region');
-    test.deepEqual(stack2.template, {
+    expect(stack2.stackName).toEqual('stack2');
+    expect(stack2.id).toEqual('stack2');
+    expect(stack2.environment.name).toEqual('aws://unknown-account/unknown-region');
+    expect(stack2.template).toEqual({
       Resources:
       {
         s2c1: { Type: 'DummyResource', Properties: { Prog2: 'Prog2' } },
@@ -87,7 +86,7 @@ nodeunitShim({
         s1c2r25F685FFF: { Type: 'ResourceType2' },
       },
     });
-    test.deepEqual(stack2.manifest.metadata, {
+    expect(stack2.manifest.metadata).toEqual({
       '/stack2/s2c1': [{ type: 'aws:cdk:logicalId', data: 's2c1' }],
       '/stack2/s1c2': [{ type: 'meta', data: { key: 'value' } }],
       '/stack2/s1c2/r1':
@@ -96,21 +95,21 @@ nodeunitShim({
         [{ type: 'aws:cdk:logicalId', data: 's1c2r25F685FFF' }],
     });
 
-    test.done();
-  },
 
-  'context can be passed through CDK_CONTEXT'(test: Test) {
+  });
+
+  test('context can be passed through CDK_CONTEXT', () => {
     process.env[cxapi.CONTEXT_ENV] = JSON.stringify({
       key1: 'val1',
       key2: 'val2',
     });
     const prog = new App();
-    test.deepEqual(prog.node.tryGetContext('key1'), 'val1');
-    test.deepEqual(prog.node.tryGetContext('key2'), 'val2');
-    test.done();
-  },
+    expect(prog.node.tryGetContext('key1')).toEqual('val1');
+    expect(prog.node.tryGetContext('key2')).toEqual('val2');
+
+  });
 
-  'context passed through CDK_CONTEXT has precedence'(test: Test) {
+  test('context passed through CDK_CONTEXT has precedence', () => {
     process.env[cxapi.CONTEXT_ENV] = JSON.stringify({
       key1: 'val1',
       key2: 'val2',
@@ -121,15 +120,15 @@ nodeunitShim({
         key2: 'val4',
       },
     });
-    test.deepEqual(prog.node.tryGetContext('key1'), 'val1');
-    test.deepEqual(prog.node.tryGetContext('key2'), 'val2');
-    test.done();
-  },
+    expect(prog.node.tryGetContext('key1')).toEqual('val1');
+    expect(prog.node.tryGetContext('key2')).toEqual('val2');
+
+  });
 
-  'context from the command line can be used when creating the stack'(test: Test) {
+  test('context from the command line can be used when creating the stack', () => {
     const output = synthStack('stack2', false, { ctx1: 'HELLO' });
 
-    test.deepEqual(output.template, {
+    expect(output.template).toEqual({
       Resources: {
         s2c1: {
           Type: 'DummyResource',
@@ -148,27 +147,27 @@ nodeunitShim({
         },
       },
     });
-    test.done();
-  },
 
-  'setContext(k,v) can be used to set context programmatically'(test: Test) {
+  });
+
+  test('setContext(k,v) can be used to set context programmatically', () => {
     const prog = new App({
       context: {
         foo: 'bar',
       },
     });
-    test.deepEqual(prog.node.tryGetContext('foo'), 'bar');
-    test.done();
-  },
+    expect(prog.node.tryGetContext('foo')).toEqual('bar');
+
+  });
 
-  'setContext(k,v) cannot be called after stacks have been added because stacks may use the context'(test: Test) {
+  test('setContext(k,v) cannot be called after stacks have been added because stacks may use the context', () => {
     const prog = new App();
     new Stack(prog, 's1');
-    test.throws(() => prog.node.setContext('foo', 'bar'));
-    test.done();
-  },
+    expect(() => prog.node.setContext('foo', 'bar')).toThrow();
+
+  });
 
-  'app.synth() performs validation first and if there are errors, it returns the errors'(test: Test) {
+  test('app.synth() performs validation first and if there are errors, it returns the errors', () => {
 
     class Child extends Construct {
       protected validate() {
@@ -186,12 +185,12 @@ nodeunitShim({
     new Child(parent, 'C1');
     new Child(parent, 'C2');
 
-    test.throws(() => app.synth(), /Validation failed with the following errors/);
+    expect(() => app.synth()).toThrow(/Validation failed with the following errors/);
 
-    test.done();
-  },
 
-  'app.synthesizeStack(stack) will return a list of missing contextual information'(test: Test) {
+  });
+
+  test('app.synthesizeStack(stack) will return a list of missing contextual information', () => {
     class MyStack extends Stack {
       constructor(scope: App, id: string, props?: StackProps) {
         super(scope, id, props);
@@ -222,7 +221,7 @@ nodeunitShim({
       new MyStack(app, 'MyStack', { synthesizer: new DefaultStackSynthesizer() });
     });
 
-    test.deepEqual(assembly.manifest.missing, [
+    expect(assembly.manifest.missing).toEqual([
       {
         key: 'missing-context-key',
         provider: ContextProvider.AVAILABILITY_ZONE_PROVIDER,
@@ -243,25 +242,25 @@ nodeunitShim({
       },
     ]);
 
-    test.done();
-  },
+
+  });
 
   /**
    * Runtime library versions are now synthesized into the Stack templates directly
    *
    * The are not emitted into Cloud Assembly metadata anymore
    */
-  'runtime library versions are not emitted in asm anymore'(test: Test) {
+  test('runtime library versions are not emitted in asm anymore', () => {
     const assembly = withApp({ analyticsReporting: true }, app => {
       const stack = new Stack(app, 'stack1');
       new CfnResource(stack, 'MyResource', { type: 'Resource::Type' });
     });
 
-    test.deepEqual(assembly.runtime, { libraries: {} });
-    test.done();
-  },
+    expect(assembly.runtime).toEqual({ libraries: {} });
+
+  });
 
-  'deep stack is shown and synthesized properly'(test: Test) {
+  test('deep stack is shown and synthesized properly', () => {
   // WHEN
     const response = withApp({}, (app) => {
       const topStack = new Stack(app, 'Stack');
@@ -272,7 +271,7 @@ nodeunitShim({
     });
 
     // THEN
-    test.deepEqual(response.stacks.map(s => ({ name: s.stackName, template: s.template })), [
+    expect(response.stacks.map(s => ({ name: s.stackName, template: s.template }))).toEqual([
       {
         name: 'Stack',
         template: { Resources: { Res: { Type: 'CDK::TopStack::Resource' } } },
@@ -283,10 +282,10 @@ nodeunitShim({
       },
     ]);
 
-    test.done();
-  },
 
-  'stacks are written to the assembly file in a topological order'(test: Test) {
+  });
+
+  test('stacks are written to the assembly file in a topological order', () => {
     // WHEN
     const assembly = withApp({}, (app) => {
       const stackC = new Stack(app, 'StackC');
@@ -305,14 +304,14 @@ nodeunitShim({
 
     // THEN
     const artifactsIds = assembly.artifacts.map(a => a.id);
-    test.ok(artifactsIds.indexOf('StackA') < artifactsIds.indexOf('StackC'));
-    test.ok(artifactsIds.indexOf('StackB') < artifactsIds.indexOf('StackC'));
-    test.ok(artifactsIds.indexOf('StackC') < artifactsIds.indexOf('StackD'));
+    expect(artifactsIds.indexOf('StackA')).toBeLessThan(artifactsIds.indexOf('StackC'));
+    expect(artifactsIds.indexOf('StackB')).toBeLessThan(artifactsIds.indexOf('StackC'));
+    expect(artifactsIds.indexOf('StackC')).toBeLessThan(artifactsIds.indexOf('StackD'));
+
 
-    test.done();
-  },
+  });
 
-  'application support any type in context'(test: Test) {
+  test('application support any type in context', () => {
     const app = new App({
       context: {
         isString: 'string',
@@ -321,12 +320,12 @@ nodeunitShim({
       },
     });
 
-    test.ok(app.node.tryGetContext('isString') === 'string');
-    test.ok(app.node.tryGetContext('isNumber') === 10);
-    test.deepEqual(app.node.tryGetContext('isObject'), { isString: 'string', isNumber: 10 });
+    expect(app.node.tryGetContext('isString')).toEqual('string');
+    expect(app.node.tryGetContext('isNumber')).toEqual(10);
+    expect(app.node.tryGetContext('isObject')).toEqual({ isString: 'string', isNumber: 10 });
+
 
-    test.done();
-  },
+  });
 });
 
 class MyConstruct extends Construct {
diff --git a/packages/@aws-cdk/core/test/arn.test.ts b/packages/@aws-cdk/core/test/arn.test.ts
index 8f1a4d451a111..f1d1c862a5ca4 100644
--- a/packages/@aws-cdk/core/test/arn.test.ts
+++ b/packages/@aws-cdk/core/test/arn.test.ts
@@ -1,11 +1,10 @@
-import { nodeunitShim, Test } from 'nodeunit-shim';
 import { Arn, ArnComponents, ArnFormat, Aws, CfnOutput, ScopedAws, Stack, Token } from '../lib';
 import { Intrinsic } from '../lib/private/intrinsic';
 import { evaluateCFN } from './evaluate-cfn';
 import { toCloudFormation } from './util';
 
-nodeunitShim({
-  'create from components with defaults'(test: Test) {
+describe('arn', () => {
+  test('create from components with defaults', () => {
     const stack = new Stack();
 
     const arn = stack.formatArn({
@@ -15,12 +14,12 @@ nodeunitShim({
 
     const pseudo = new ScopedAws(stack);
 
-    test.deepEqual(stack.resolve(arn),
+    expect(stack.resolve(arn)).toEqual(
       stack.resolve(`arn:${pseudo.partition}:sqs:${pseudo.region}:${pseudo.accountId}:myqueuename`));
-    test.done();
-  },
 
-  'create from components with specific values for the various components'(test: Test) {
+  });
+
+  test('create from components with specific values for the various components', () => {
     const stack = new Stack();
 
     const arn = stack.formatArn({
@@ -32,12 +31,12 @@ nodeunitShim({
       resourceName: 'mytable/stream/label',
     });
 
-    test.deepEqual(stack.resolve(arn),
+    expect(stack.resolve(arn)).toEqual(
       'arn:aws-cn:dynamodb:us-east-1:123456789012:table/mytable/stream/label');
-    test.done();
-  },
 
-  'allow empty string in components'(test: Test) {
+  });
+
+  test('allow empty string in components', () => {
     const stack = new Stack();
 
     const arn = stack.formatArn({
@@ -48,13 +47,13 @@ nodeunitShim({
       partition: 'aws-cn',
     });
 
-    test.deepEqual(stack.resolve(arn),
+    expect(stack.resolve(arn)).toEqual(
       'arn:aws-cn:s3:::my-bucket');
 
-    test.done();
-  },
 
-  'resourcePathSep can be set to ":" instead of the default "/"'(test: Test) {
+  });
+
+  test('resourcePathSep can be set to ":" instead of the default "/"', () => {
     const stack = new Stack();
 
     const arn = stack.formatArn({
@@ -66,12 +65,12 @@ nodeunitShim({
 
     const pseudo = new ScopedAws(stack);
 
-    test.deepEqual(stack.resolve(arn),
+    expect(stack.resolve(arn)).toEqual(
       stack.resolve(`arn:${pseudo.partition}:codedeploy:${pseudo.region}:${pseudo.accountId}:application:WordPress_App`));
-    test.done();
-  },
 
-  'resourcePathSep can be set to "" instead of the default "/"'(test: Test) {
+  });
+
+  test('resourcePathSep can be set to "" instead of the default "/"', () => {
     const stack = new Stack();
 
     const arn = stack.formatArn({
@@ -83,51 +82,51 @@ nodeunitShim({
 
     const pseudo = new ScopedAws(stack);
 
-    test.deepEqual(stack.resolve(arn),
+    expect(stack.resolve(arn)).toEqual(
       stack.resolve(`arn:${pseudo.partition}:ssm:${pseudo.region}:${pseudo.accountId}:parameter/parameter-name`));
-    test.done();
-  },
 
-  'fails if resourcePathSep is neither ":" nor "/"'(test: Test) {
+  });
+
+  test('fails if resourcePathSep is neither ":" nor "/"', () => {
     const stack = new Stack();
 
-    test.throws(() => stack.formatArn({
+    expect(() => stack.formatArn({
       service: 'foo',
       resource: 'bar',
       sep: 'x',
-    }));
-    test.done();
-  },
+    })).toThrow();
+
+  });
 
-  'Arn.parse(s)': {
+  describe('Arn.parse(s)', () => {
 
-    fails: {
-      'if doesn\'t start with "arn:"'(test: Test) {
+    describe('fails', () => {
+      test('if doesn\'t start with "arn:"', () => {
         const stack = new Stack();
-        test.throws(() => stack.parseArn('barn:foo:x:a:1:2'), /ARNs must start with "arn:".*barn:foo/);
-        test.done();
-      },
+        expect(() => stack.parseArn('barn:foo:x:a:1:2')).toThrow(/ARNs must start with "arn:".*barn:foo/);
+
+      });
 
-      'if the ARN doesnt have enough components'(test: Test) {
+      test('if the ARN doesnt have enough components', () => {
         const stack = new Stack();
-        test.throws(() => stack.parseArn('arn:is:too:short'), /The `resource` component \(6th component\) of an ARN is required/);
-        test.done();
-      },
+        expect(() => stack.parseArn('arn:is:too:short')).toThrow(/The `resource` component \(6th component\) of an ARN is required/);
+
+      });
 
-      'if "service" is not specified'(test: Test) {
+      test('if "service" is not specified', () => {
         const stack = new Stack();
-        test.throws(() => stack.parseArn('arn:aws::4:5:6'), /The `service` component \(3rd component\) of an ARN is required/);
-        test.done();
-      },
+        expect(() => stack.parseArn('arn:aws::4:5:6')).toThrow(/The `service` component \(3rd component\) of an ARN is required/);
+
+      });
 
-      'if "resource" is not specified'(test: Test) {
+      test('if "resource" is not specified', () => {
         const stack = new Stack();
-        test.throws(() => stack.parseArn('arn:aws:service:::'), /The `resource` component \(6th component\) of an ARN is required/);
-        test.done();
-      },
-    },
+        expect(() => stack.parseArn('arn:aws:service:::')).toThrow(/The `resource` component \(6th component\) of an ARN is required/);
+
+      });
+    });
 
-    'various successful parses'(test: Test) {
+    test('various successful parses', () => {
       interface TestArnComponents extends ArnComponents {
         /** @default true */
         checkCfnEncoding?: boolean;
@@ -212,10 +211,10 @@ nodeunitShim({
 
         // test the basic case
         const parsedComponents = stack.splitArn(arn, expectedComponents.arnFormat!);
-        test.deepEqual(parsedComponents, expectedComponents, arn);
+        expect(parsedComponents).toEqual(expectedComponents);
 
         // test the round-trip
-        test.equal(stack.formatArn(parsedComponents), arn);
+        expect(stack.formatArn(parsedComponents)).toEqual(arn);
 
         // test that the CloudFormation functions we generate evaluate to the correct value
         if (skipCheckingCfnEncoding) {
@@ -226,44 +225,44 @@ nodeunitShim({
           parsedComponents.arnFormat!);
         const cfnArnComponents = stack.resolve(tokenArnComponents);
         const evaluatedArnComponents = evaluateCFN(cfnArnComponents, { TheArn: arn });
-        test.deepEqual(evaluatedArnComponents, parsedComponents);
+        expect(evaluatedArnComponents).toEqual(parsedComponents);
       }
 
-      test.done();
-    },
 
-    'a Token with : separator'(test: Test) {
+    });
+
+    test('a Token with : separator', () => {
       const stack = new Stack();
       const theToken = { Ref: 'SomeParameter' };
       const parsed = stack.parseArn(new Intrinsic(theToken).toString(), ':');
 
-      test.deepEqual(stack.resolve(parsed.partition), { 'Fn::Select': [1, { 'Fn::Split': [':', theToken] }] });
-      test.deepEqual(stack.resolve(parsed.service), { 'Fn::Select': [2, { 'Fn::Split': [':', theToken] }] });
-      test.deepEqual(stack.resolve(parsed.region), { 'Fn::Select': [3, { 'Fn::Split': [':', theToken] }] });
-      test.deepEqual(stack.resolve(parsed.account), { 'Fn::Select': [4, { 'Fn::Split': [':', theToken] }] });
-      test.deepEqual(stack.resolve(parsed.resource), { 'Fn::Select': [5, { 'Fn::Split': [':', theToken] }] });
-      test.deepEqual(stack.resolve(parsed.resourceName), { 'Fn::Select': [6, { 'Fn::Split': [':', theToken] }] });
-      test.equal(parsed.sep, ':');
+      expect(stack.resolve(parsed.partition)).toEqual({ 'Fn::Select': [1, { 'Fn::Split': [':', theToken] }] });
+      expect(stack.resolve(parsed.service)).toEqual({ 'Fn::Select': [2, { 'Fn::Split': [':', theToken] }] });
+      expect(stack.resolve(parsed.region)).toEqual({ 'Fn::Select': [3, { 'Fn::Split': [':', theToken] }] });
+      expect(stack.resolve(parsed.account)).toEqual({ 'Fn::Select': [4, { 'Fn::Split': [':', theToken] }] });
+      expect(stack.resolve(parsed.resource)).toEqual({ 'Fn::Select': [5, { 'Fn::Split': [':', theToken] }] });
+      expect(stack.resolve(parsed.resourceName)).toEqual({ 'Fn::Select': [6, { 'Fn::Split': [':', theToken] }] });
+      expect(parsed.sep).toEqual(':');
 
-      test.done();
-    },
 
-    'a Token with / separator'(test: Test) {
+    });
+
+    test('a Token with / separator', () => {
       const stack = new Stack();
       const theToken = { Ref: 'SomeParameter' };
       const parsed = stack.parseArn(new Intrinsic(theToken).toString());
 
-      test.equal(parsed.sep, '/');
+      expect(parsed.sep).toEqual('/');
 
       // eslint-disable-next-line max-len
-      test.deepEqual(stack.resolve(parsed.resource), { 'Fn::Select': [0, { 'Fn::Split': ['/', { 'Fn::Select': [5, { 'Fn::Split': [':', theToken] }] }] }] });
+      expect(stack.resolve(parsed.resource)).toEqual({ 'Fn::Select': [0, { 'Fn::Split': ['/', { 'Fn::Select': [5, { 'Fn::Split': [':', theToken] }] }] }] });
       // eslint-disable-next-line max-len
-      test.deepEqual(stack.resolve(parsed.resourceName), { 'Fn::Select': [1, { 'Fn::Split': ['/', { 'Fn::Select': [5, { 'Fn::Split': [':', theToken] }] }] }] });
+      expect(stack.resolve(parsed.resourceName)).toEqual({ 'Fn::Select': [1, { 'Fn::Split': ['/', { 'Fn::Select': [5, { 'Fn::Split': [':', theToken] }] }] }] });
 
-      test.done();
-    },
 
-    'extracting resource name from a complex ARN'(test: Test) {
+    });
+
+    test('extracting resource name from a complex ARN', () => {
       // GIVEN
       const stack = new Stack();
       const theToken = Token.asString({ Ref: 'SomeParameter' });
@@ -272,23 +271,23 @@ nodeunitShim({
       const parsed = Arn.extractResourceName(theToken, 'role');
 
       // THEN
-      test.deepEqual(evaluateCFN(stack.resolve(parsed), {
+      expect(evaluateCFN(stack.resolve(parsed), {
         SomeParameter: 'arn:aws:iam::111111111111:role/path/to/role/name',
-      }), 'path/to/role/name');
+      })).toEqual('path/to/role/name');
 
-      test.done();
-    },
 
-    'extractResourceName validates resource type if possible'(test: Test) {
+    });
+
+    test('extractResourceName validates resource type if possible', () => {
       // WHEN
-      test.throws(() => {
+      expect(() => {
         Arn.extractResourceName('arn:aws:iam::111111111111:banana/rama', 'role');
-      }, /Expected resource type/);
+      }).toThrow(/Expected resource type/);
 
-      test.done();
-    },
 
-    'returns empty string ARN components'(test: Test) {
+    });
+
+    test('returns empty string ARN components', () => {
       const stack = new Stack();
       const arn = 'arn:aws:iam::123456789012:role/abc123';
       const expected: ArnComponents = {
@@ -302,12 +301,12 @@ nodeunitShim({
         arnFormat: ArnFormat.SLASH_RESOURCE_NAME,
       };
 
-      test.deepEqual(stack.parseArn(arn), expected, arn);
-      test.done();
-    },
-  },
+      expect(stack.parseArn(arn)).toEqual(expected);
+
+    });
+  });
 
-  'can use a fully specified ARN from a different stack without incurring an import'(test: Test) {
+  test('can use a fully specified ARN from a different stack without incurring an import', () => {
     // GIVEN
     const stack1 = new Stack(undefined, 'Stack1', { env: { account: '12345678', region: 'us-turbo-5' } });
     const stack2 = new Stack(undefined, 'Stack2', { env: { account: '87654321', region: 'us-turbo-1' } });
@@ -322,7 +321,7 @@ nodeunitShim({
     new CfnOutput(stack2, 'SomeValue', { value: arn });
 
     // THEN
-    test.deepEqual(toCloudFormation(stack2), {
+    expect(toCloudFormation(stack2)).toEqual({
       Outputs: {
         SomeValue: {
           Value: {
@@ -333,10 +332,10 @@ nodeunitShim({
       },
     });
 
-    test.done();
-  },
 
-  'parse other fields if only some are tokens'(test: Test) {
+  });
+
+  test('parse other fields if only some are tokens', () => {
     // GIVEN
     const stack = new Stack();
 
@@ -344,14 +343,14 @@ nodeunitShim({
     const parsed = stack.parseArn(`arn:${Aws.PARTITION}:iam::123456789012:role/S3Access`);
 
     // THEN
-    test.deepEqual(stack.resolve(parsed.partition), { Ref: 'AWS::Partition' });
-    test.deepEqual(stack.resolve(parsed.service), 'iam');
-    test.equal(stack.resolve(parsed.region), '');
-    test.deepEqual(stack.resolve(parsed.account), '123456789012');
-    test.deepEqual(stack.resolve(parsed.resource), 'role');
-    test.deepEqual(stack.resolve(parsed.resourceName), 'S3Access');
-    test.equal(parsed.sep, '/');
-
-    test.done();
-  },
+    expect(stack.resolve(parsed.partition)).toEqual({ Ref: 'AWS::Partition' });
+    expect(stack.resolve(parsed.service)).toEqual('iam');
+    expect(stack.resolve(parsed.region)).toEqual('');
+    expect(stack.resolve(parsed.account)).toEqual('123456789012');
+    expect(stack.resolve(parsed.resource)).toEqual('role');
+    expect(stack.resolve(parsed.resourceName)).toEqual('S3Access');
+    expect(parsed.sep).toEqual('/');
+
+
+  });
 });
diff --git a/packages/@aws-cdk/core/test/aspect.test.ts b/packages/@aws-cdk/core/test/aspect.test.ts
index 3fc2d2031111a..0ed634cf5e58c 100644
--- a/packages/@aws-cdk/core/test/aspect.test.ts
+++ b/packages/@aws-cdk/core/test/aspect.test.ts
@@ -1,5 +1,4 @@
 import * as cxschema from '@aws-cdk/cloud-assembly-schema';
-import { nodeunitShim, Test } from 'nodeunit-shim';
 import { App } from '../lib';
 import { IAspect, Aspects } from '../lib/aspect';
 import { Construct, IConstruct } from '../lib/construct-compat';
@@ -25,19 +24,19 @@ class MyAspect implements IAspect {
   }
 }
 
-nodeunitShim({
-  'Aspects are invoked only once'(test: Test) {
+describe('aspect', () => {
+  test('Aspects are invoked only once', () => {
     const app = new App();
     const root = new MyConstruct(app, 'MyConstruct');
     Aspects.of(root).add(new VisitOnce());
     app.synth();
-    test.deepEqual(root.visitCounter, 1);
+    expect(root.visitCounter).toEqual(1);
     app.synth();
-    test.deepEqual(root.visitCounter, 1);
-    test.done();
-  },
+    expect(root.visitCounter).toEqual(1);
 
-  'Warn if an Aspect is added via another Aspect'(test: Test) {
+  });
+
+  test('Warn if an Aspect is added via another Aspect', () => {
     const app = new App();
     const root = new MyConstruct(app, 'MyConstruct');
     const child = new MyConstruct(root, 'ChildConstruct');
@@ -51,27 +50,27 @@ nodeunitShim({
       },
     });
     app.synth();
-    test.deepEqual(root.node.metadata[0].type, cxschema.ArtifactMetadataEntryType.WARN);
-    test.deepEqual(root.node.metadata[0].data, 'We detected an Aspect was added via another Aspect, and will not be applied');
+    expect(root.node.metadata[0].type).toEqual(cxschema.ArtifactMetadataEntryType.WARN);
+    expect(root.node.metadata[0].data).toEqual('We detected an Aspect was added via another Aspect, and will not be applied');
     // warning is not added to child construct
-    test.equal(child.node.metadata.length, 0);
-    test.done();
-  },
+    expect(child.node.metadata.length).toEqual(0);
+
+  });
 
-  'Do not warn if an Aspect is added directly (not by another aspect)'(test: Test) {
+  test('Do not warn if an Aspect is added directly (not by another aspect)', () => {
     const app = new App();
     const root = new MyConstruct(app, 'Construct');
     const child = new MyConstruct(root, 'ChildConstruct');
     Aspects.of(root).add(new MyAspect());
     app.synth();
-    test.deepEqual(root.node.metadata[0].type, 'foo');
-    test.deepEqual(root.node.metadata[0].data, 'bar');
-    test.deepEqual(child.node.metadata[0].type, 'foo');
-    test.deepEqual(child.node.metadata[0].data, 'bar');
+    expect(root.node.metadata[0].type).toEqual('foo');
+    expect(root.node.metadata[0].data).toEqual('bar');
+    expect(child.node.metadata[0].type).toEqual('foo');
+    expect(child.node.metadata[0].data).toEqual('bar');
     // no warning is added
-    test.equal(root.node.metadata.length, 1);
-    test.equal(child.node.metadata.length, 1);
-    test.done();
-  },
+    expect(root.node.metadata.length).toEqual(1);
+    expect(child.node.metadata.length).toEqual(1);
+
+  });
 
 });
diff --git a/packages/@aws-cdk/core/test/assets.test.ts b/packages/@aws-cdk/core/test/assets.test.ts
index fcfae3a9d147f..206362c79e809 100644
--- a/packages/@aws-cdk/core/test/assets.test.ts
+++ b/packages/@aws-cdk/core/test/assets.test.ts
@@ -1,10 +1,9 @@
 import * as cxschema from '@aws-cdk/cloud-assembly-schema';
-import { nodeunitShim, Test } from 'nodeunit-shim';
 import { FileAssetPackaging, Stack } from '../lib';
 import { toCloudFormation } from './util';
 
-nodeunitShim({
-  'addFileAsset correctly sets metadata and creates S3 parameters'(test: Test) {
+describe('assets', () => {
+  test('addFileAsset correctly sets metadata and creates S3 parameters', () => {
     // GIVEN
     const stack = new Stack();
 
@@ -18,17 +17,17 @@ nodeunitShim({
     // THEN
     const assetMetadata = stack.node.metadata.find(({ type }) => type === cxschema.ArtifactMetadataEntryType.ASSET);
 
-    test.ok(assetMetadata && assetMetadata.data);
+    expect(assetMetadata && assetMetadata.data).toBeDefined();
 
     if (assetMetadata && assetMetadata.data) {
       const data = assetMetadata.data as cxschema.AssetMetadataEntry;
-      test.equal(data.path, 'file-name');
-      test.equal(data.id, 'source-hash');
-      test.equal(data.packaging, FileAssetPackaging.ZIP_DIRECTORY);
-      test.equal(data.sourceHash, 'source-hash');
+      expect(data.path).toEqual('file-name');
+      expect(data.id).toEqual('source-hash');
+      expect(data.packaging).toEqual(FileAssetPackaging.ZIP_DIRECTORY);
+      expect(data.sourceHash).toEqual('source-hash');
     }
 
-    test.deepEqual(toCloudFormation(stack), {
+    expect(toCloudFormation(stack)).toEqual({
       Parameters: {
         AssetParameterssourcehashS3BucketE6E91E3E: {
           Type: 'String',
@@ -45,10 +44,10 @@ nodeunitShim({
       },
     });
 
-    test.done();
-  },
 
-  'addFileAsset correctly sets object urls'(test: Test) {
+  });
+
+  test('addFileAsset correctly sets object urls', () => {
     // GIVEN
     const stack = new Stack();
 
@@ -63,15 +62,15 @@ nodeunitShim({
     const expectedS3UrlPrefix = 's3://';
     const expectedHttpUrlPrefix = `https://s3.${stack.region}.${stack.urlSuffix}/`;
 
-    test.equal(
-      assetLocation.s3ObjectUrl.replace(expectedS3UrlPrefix, ''),
+    expect(
+      assetLocation.s3ObjectUrl.replace(expectedS3UrlPrefix, '')).toEqual(
       assetLocation.httpUrl.replace(expectedHttpUrlPrefix, ''),
     );
 
-    test.done();
-  },
 
-  'addDockerImageAsset correctly sets metadata'(test: Test) {
+  });
+
+  test('addDockerImageAsset correctly sets metadata', () => {
     // GIVEN
     const stack = new Stack();
 
@@ -85,22 +84,22 @@ nodeunitShim({
     // THEN
     const assetMetadata = stack.node.metadata.find(({ type }) => type === cxschema.ArtifactMetadataEntryType.ASSET);
 
-    test.ok(assetMetadata && assetMetadata.data);
+    expect(assetMetadata && assetMetadata.data).toBeDefined();
 
     if (assetMetadata && assetMetadata.data) {
       const data = assetMetadata.data as cxschema.ContainerImageAssetMetadataEntry;
-      test.equal(data.packaging, 'container-image');
-      test.equal(data.path, 'directory-name');
-      test.equal(data.sourceHash, 'source-hash');
-      test.equal(data.repositoryName, 'repository-name');
-      test.equal(data.imageTag, 'source-hash');
+      expect(data.packaging).toEqual('container-image');
+      expect(data.path).toEqual('directory-name');
+      expect(data.sourceHash).toEqual('source-hash');
+      expect(data.repositoryName).toEqual('repository-name');
+      expect(data.imageTag).toEqual('source-hash');
     }
 
-    test.deepEqual(toCloudFormation(stack), { });
-    test.done();
-  },
+    expect(toCloudFormation(stack)).toEqual({ });
+
+  });
 
-  'addDockerImageAsset uses the default repository name'(test: Test) {
+  test('addDockerImageAsset uses the default repository name', () => {
     // GIVEN
     const stack = new Stack();
 
@@ -113,22 +112,22 @@ nodeunitShim({
     // THEN
     const assetMetadata = stack.node.metadata.find(({ type }) => type === cxschema.ArtifactMetadataEntryType.ASSET);
 
-    test.ok(assetMetadata && assetMetadata.data);
+    expect(assetMetadata && assetMetadata.data).toBeDefined();
 
     if (assetMetadata && assetMetadata.data) {
       const data = assetMetadata.data as cxschema.ContainerImageAssetMetadataEntry;
-      test.equal(data.packaging, 'container-image');
-      test.equal(data.path, 'directory-name');
-      test.equal(data.sourceHash, 'source-hash');
-      test.equal(data.repositoryName, 'aws-cdk/assets');
-      test.equal(data.imageTag, 'source-hash');
+      expect(data.packaging).toEqual('container-image');
+      expect(data.path).toEqual('directory-name');
+      expect(data.sourceHash).toEqual('source-hash');
+      expect(data.repositoryName).toEqual('aws-cdk/assets');
+      expect(data.imageTag).toEqual('source-hash');
     }
 
-    test.deepEqual(toCloudFormation(stack), { });
-    test.done();
-  },
+    expect(toCloudFormation(stack)).toEqual({ });
 
-  'addDockerImageAsset supports overriding repository name through a context key as a workaround until we have API for that'(test: Test) {
+  });
+
+  test('addDockerImageAsset supports overriding repository name through a context key as a workaround until we have API for that', () => {
     // GIVEN
     const stack = new Stack();
     stack.node.setContext('assets-ecr-repository-name', 'my-custom-repo-name');
@@ -142,18 +141,18 @@ nodeunitShim({
     // THEN
     const assetMetadata = stack.node.metadata.find(({ type }) => type === cxschema.ArtifactMetadataEntryType.ASSET);
 
-    test.ok(assetMetadata && assetMetadata.data);
+    expect(assetMetadata && assetMetadata.data).toBeDefined();
 
     if (assetMetadata && assetMetadata.data) {
       const data = assetMetadata.data as cxschema.ContainerImageAssetMetadataEntry;
-      test.equal(data.packaging, 'container-image');
-      test.equal(data.path, 'directory-name');
-      test.equal(data.sourceHash, 'source-hash');
-      test.equal(data.repositoryName, 'my-custom-repo-name');
-      test.equal(data.imageTag, 'source-hash');
+      expect(data.packaging).toEqual('container-image');
+      expect(data.path).toEqual('directory-name');
+      expect(data.sourceHash).toEqual('source-hash');
+      expect(data.repositoryName).toEqual('my-custom-repo-name');
+      expect(data.imageTag).toEqual('source-hash');
     }
 
-    test.deepEqual(toCloudFormation(stack), { });
-    test.done();
-  },
+    expect(toCloudFormation(stack)).toEqual({ });
+
+  });
 });
diff --git a/packages/@aws-cdk/core/test/bundling.test.ts b/packages/@aws-cdk/core/test/bundling.test.ts
index 48522347e698c..a22968f4d17a0 100644
--- a/packages/@aws-cdk/core/test/bundling.test.ts
+++ b/packages/@aws-cdk/core/test/bundling.test.ts
@@ -1,17 +1,16 @@
 import * as child_process from 'child_process';
 import * as crypto from 'crypto';
 import * as path from 'path';
-import { nodeunitShim, Test } from 'nodeunit-shim';
 import * as sinon from 'sinon';
 import { BundlingDockerImage, DockerImage, FileSystem } from '../lib';
 
-nodeunitShim({
-  'tearDown'(callback: any) {
+describe('bundling', () => {
+  afterEach(() => {
     sinon.restore();
-    callback();
-  },
 
-  'bundling with image from registry'(test: Test) {
+  });
+
+  test('bundling with image from registry', () => {
     sinon.stub(process, 'platform').value('darwin');
     const spawnSyncStub = sinon.stub(child_process, 'spawnSync').returns({
       status: 0,
@@ -34,7 +33,7 @@ nodeunitShim({
       user: 'user:group',
     });
 
-    test.ok(spawnSyncStub.calledWith('docker', [
+    expect(spawnSyncStub.calledWith('docker', [
       'run', '--rm',
       '-u', 'user:group',
       '-v', '/host-path:/container-path:delegated',
@@ -43,11 +42,11 @@ nodeunitShim({
       '-w', '/working-directory',
       'alpine',
       'cool', 'command',
-    ], { stdio: ['ignore', process.stderr, 'inherit'] }));
-    test.done();
-  },
+    ], { stdio: ['ignore', process.stderr, 'inherit'] })).toEqual(true);
+
+  });
 
-  'bundling with image from asset'(test: Test) {
+  test('bundling with image from asset', () => {
     const spawnSyncStub = sinon.stub(child_process, 'spawnSync').returns({
       status: 0,
       stderr: Buffer.from('stderr'),
@@ -76,20 +75,20 @@ nodeunitShim({
     })).digest('hex');
     const tag = `cdk-${tagHash}`;
 
-    test.ok(spawnSyncStub.firstCall.calledWith('docker', [
+    expect(spawnSyncStub.firstCall.calledWith('docker', [
       'build', '-t', tag,
       '--build-arg', 'TEST_ARG=cdk-test',
       'docker-path',
-    ]));
+    ])).toEqual(true);
 
-    test.ok(spawnSyncStub.secondCall.calledWith('docker', [
+    expect(spawnSyncStub.secondCall.calledWith('docker', [
       'run', '--rm',
       tag,
-    ]));
-    test.done();
-  },
+    ])).toEqual(true);
+
+  });
 
-  'bundling with image from asset with platform'(test: Test) {
+  test('bundling with image from asset with platform', () => {
     const spawnSyncStub = sinon.stub(child_process, 'spawnSync').returns({
       status: 0,
       stderr: Buffer.from('stderr'),
@@ -113,20 +112,20 @@ nodeunitShim({
     })).digest('hex');
     const tag = `cdk-${tagHash}`;
 
-    test.ok(spawnSyncStub.firstCall.calledWith('docker', [
+    expect(spawnSyncStub.firstCall.calledWith('docker', [
       'build', '-t', tag,
       '--platform', platform,
       'docker-path',
-    ]));
+    ])).toEqual(true);
 
-    test.ok(spawnSyncStub.secondCall.calledWith('docker', [
+    expect(spawnSyncStub.secondCall.calledWith('docker', [
       'run', '--rm',
       tag,
-    ]));
-    test.done();
-  },
+    ])).toEqual(true);
 
-  'throws in case of spawnSync error'(test: Test) {
+  });
+
+  test('throws in case of spawnSync error', () => {
     sinon.stub(child_process, 'spawnSync').returns({
       status: 0,
       stderr: Buffer.from('stderr'),
@@ -138,11 +137,11 @@ nodeunitShim({
     });
 
     const image = BundlingDockerImage.fromRegistry('alpine');
-    test.throws(() => image.run(), /UnknownError/);
-    test.done();
-  },
+    expect(() => image.run()).toThrow(/UnknownError/);
+
+  });
 
-  'throws if status is not 0'(test: Test) {
+  test('throws if status is not 0', () => {
     sinon.stub(child_process, 'spawnSync').returns({
       status: -1,
       stderr: Buffer.from('stderr'),
@@ -153,18 +152,18 @@ nodeunitShim({
     });
 
     const image = BundlingDockerImage.fromRegistry('alpine');
-    test.throws(() => image.run(), /\[Status -1\]/);
-    test.done();
-  },
+    expect(() => image.run()).toThrow(/\[Status -1\]/);
 
-  'BundlerDockerImage json is the bundler image name by default'(test: Test) {
+  });
+
+  test('BundlerDockerImage json is the bundler image name by default', () => {
     const image = BundlingDockerImage.fromRegistry('alpine');
 
-    test.equals(image.toJSON(), 'alpine');
-    test.done();
-  },
+    expect(image.toJSON()).toEqual('alpine');
+
+  });
 
-  'BundlerDockerImage json is the bundler image if building an image'(test: Test) {
+  test('BundlerDockerImage json is the bundler image if building an image', () => {
     sinon.stub(child_process, 'spawnSync').returns({
       status: 0,
       stderr: Buffer.from('stderr'),
@@ -183,13 +182,13 @@ nodeunitShim({
       path: 'docker-path',
     })).digest('hex');
 
-    test.equals(image.image, `cdk-${tagHash}`);
-    test.equals(image.toJSON(), imageHash);
-    test.ok(fingerprintStub.calledWith('docker-path', sinon.match({ extraHash: JSON.stringify({}) })));
-    test.done();
-  },
+    expect(image.image).toEqual(`cdk-${tagHash}`);
+    expect(image.toJSON()).toEqual(imageHash);
+    expect(fingerprintStub.calledWith('docker-path', sinon.match({ extraHash: JSON.stringify({}) }))).toEqual(true);
 
-  'custom dockerfile is passed through to docker exec'(test: Test) {
+  });
+
+  test('custom dockerfile is passed through to docker exec', () => {
     const spawnSyncStub = sinon.stub(child_process, 'spawnSync').returns({
       status: 0,
       stderr: Buffer.from('stderr'),
@@ -204,14 +203,14 @@ nodeunitShim({
       file: 'my-dockerfile',
     });
 
-    test.ok(spawnSyncStub.calledOnce);
+    expect(spawnSyncStub.calledOnce).toEqual(true);
     const expected = path.join(imagePath, 'my-dockerfile');
-    test.ok(new RegExp(`-f ${expected}`).test(spawnSyncStub.firstCall.args[1]?.join(' ') ?? ''));
+    expect(new RegExp(`-f ${expected}`).test(spawnSyncStub.firstCall.args[1]?.join(' ') ?? '')).toEqual(true);
+
 
-    test.done();
-  },
+  });
 
-  'fromAsset'(test: Test) {
+  test('fromAsset', () => {
     sinon.stub(child_process, 'spawnSync').returns({
       status: 0,
       stderr: Buffer.from('stderr'),
@@ -225,12 +224,12 @@ nodeunitShim({
     const image = BundlingDockerImage.fromAsset(imagePath, {
       file: 'my-dockerfile',
     });
-    test.ok(image);
-    test.ok(image.image);
-    test.done();
-  },
+    expect(image).toBeDefined();
+    expect(image.image).toBeDefined();
 
-  'custom entrypoint is passed through to docker exec'(test: Test) {
+  });
+
+  test('custom entrypoint is passed through to docker exec', () => {
     sinon.stub(process, 'platform').value('darwin');
     const spawnSyncStub = sinon.stub(child_process, 'spawnSync').returns({
       status: 0,
@@ -254,7 +253,7 @@ nodeunitShim({
       user: 'user:group',
     });
 
-    test.ok(spawnSyncStub.calledWith('docker', [
+    expect(spawnSyncStub.calledWith('docker', [
       'run', '--rm',
       '-u', 'user:group',
       '-v', '/host-path:/container-path:delegated',
@@ -265,11 +264,11 @@ nodeunitShim({
       'alpine',
       '--cool-entrypoint-arg',
       'cool', 'command',
-    ], { stdio: ['ignore', process.stderr, 'inherit'] }));
-    test.done();
-  },
+    ], { stdio: ['ignore', process.stderr, 'inherit'] })).toEqual(true);
+
+  });
 
-  'cp utility copies from an image'(test: Test) {
+  test('cp utility copies from an image', () => {
     // GIVEN
     const containerId = '1234567890abcdef1234567890abcdef';
     const spawnSyncStub = sinon.stub(child_process, 'spawnSync').returns({
@@ -285,14 +284,14 @@ nodeunitShim({
     BundlingDockerImage.fromRegistry('alpine').cp('/foo/bar', '/baz');
 
     // THEN
-    test.ok(spawnSyncStub.calledWith(sinon.match.any, ['create', 'alpine'], sinon.match.any));
-    test.ok(spawnSyncStub.calledWith(sinon.match.any, ['cp', `${containerId}:/foo/bar`, '/baz'], sinon.match.any));
-    test.ok(spawnSyncStub.calledWith(sinon.match.any, ['rm', '-v', containerId]));
+    expect(spawnSyncStub.calledWith(sinon.match.any, ['create', 'alpine'], sinon.match.any)).toEqual(true);
+    expect(spawnSyncStub.calledWith(sinon.match.any, ['cp', `${containerId}:/foo/bar`, '/baz'], sinon.match.any)).toEqual(true);
+    expect(spawnSyncStub.calledWith(sinon.match.any, ['rm', '-v', containerId])).toEqual(true);
+
 
-    test.done();
-  },
+  });
 
-  'cp utility cleans up after itself'(test: Test) {
+  test('cp utility cleans up after itself', () => {
     // GIVEN
     const containerId = '1234567890abcdef1234567890abcdef';
     const spawnSyncStub = sinon.stub(child_process, 'spawnSync').returns({
@@ -315,16 +314,16 @@ nodeunitShim({
       });
 
     // WHEN
-    test.throws(() => {
+    expect(() => {
       BundlingDockerImage.fromRegistry('alpine').cp('/foo/bar', '/baz');
-    }, /Failed.*copy/i);
+    }).toThrow(/Failed.*copy/i);
 
     // THEN
-    test.ok(spawnSyncStub.calledWith(sinon.match.any, ['rm', '-v', containerId]));
-    test.done();
-  },
+    expect(spawnSyncStub.calledWith(sinon.match.any, ['rm', '-v', containerId])).toEqual(true);
 
-  'cp utility copies to a temp dir of outputPath is omitted'(test: Test) {
+  });
+
+  test('cp utility copies to a temp dir of outputPath is omitted', () => {
     // GIVEN
     const containerId = '1234567890abcdef1234567890abcdef';
     sinon.stub(child_process, 'spawnSync').returns({
@@ -340,12 +339,12 @@ nodeunitShim({
     const tempPath = DockerImage.fromRegistry('alpine').cp('/foo/bar');
 
     // THEN
-    test.ok(/cdk-docker-cp-/.test(tempPath));
+    expect(/cdk-docker-cp-/.test(tempPath)).toEqual(true);
+
 
-    test.done();
-  },
+  });
 
-  'adding user provided security-opt'(test: Test) {
+  test('adding user provided security-opt', () => {
     // GIVEN
     sinon.stub(process, 'platform').value('darwin');
     const spawnSyncStub = sinon.stub(child_process, 'spawnSync').returns({
@@ -371,7 +370,7 @@ nodeunitShim({
       user: 'user:group',
     });
 
-    test.ok(spawnSyncStub.calledWith('docker', [
+    expect(spawnSyncStub.calledWith('docker', [
       'run', '--rm',
       '--security-opt', 'no-new-privileges',
       '-u', 'user:group',
@@ -381,11 +380,11 @@ nodeunitShim({
       '-w', '/working-directory',
       'alpine',
       'cool', 'command',
-    ], { stdio: ['ignore', process.stderr, 'inherit'] }));
-    test.done();
-  },
+    ], { stdio: ['ignore', process.stderr, 'inherit'] })).toEqual(true);
 
-  'ensure selinux docker mount'(test: Test) {
+  });
+
+  test('ensure selinux docker mount', () => {
     // GIVEN
     sinon.stub(process, 'platform').value('linux');
     const spawnSyncStub = sinon.stub(child_process, 'spawnSync');
@@ -416,18 +415,18 @@ nodeunitShim({
     });
 
     // THEN
-    test.ok(spawnSyncStub.secondCall.calledWith('docker', [
+    expect(spawnSyncStub.secondCall.calledWith('docker', [
       'run', '--rm',
       '-u', 'user:group',
       '-v', '/host-path:/container-path:z,delegated',
       '-w', '/working-directory',
       'alpine',
       'cool', 'command',
-    ], { stdio: ['ignore', process.stderr, 'inherit'] }));
-    test.done();
-  },
+    ], { stdio: ['ignore', process.stderr, 'inherit'] })).toEqual(true);
+
+  });
 
-  'ensure selinux docker mount on linux with selinux disabled'(test: Test) {
+  test('ensure selinux docker mount on linux with selinux disabled', () => {
     // GIVEN
     sinon.stub(process, 'platform').value('linux');
     const spawnSyncStub = sinon.stub(child_process, 'spawnSync');
@@ -458,17 +457,17 @@ nodeunitShim({
     });
 
     // THEN
-    test.ok(spawnSyncStub.secondCall.calledWith('docker', [
+    expect(spawnSyncStub.secondCall.calledWith('docker', [
       'run', '--rm',
       '-u', 'user:group',
       '-v', '/host-path:/container-path:delegated',
       '-w', '/working-directory',
       'alpine',
       'cool', 'command',
-    ], { stdio: ['ignore', process.stderr, 'inherit'] }));
-    test.done();
-  },
-  'ensure no selinux docker mount if selinuxenabled isn\'t an available command'(test: Test) {
+    ], { stdio: ['ignore', process.stderr, 'inherit'] })).toEqual(true);
+
+  });
+  test('ensure no selinux docker mount if selinuxenabled isn\'t an available command', () => {
     // GIVEN
     sinon.stub(process, 'platform').value('linux');
     const spawnSyncStub = sinon.stub(child_process, 'spawnSync');
@@ -499,14 +498,14 @@ nodeunitShim({
     });
 
     // THEN
-    test.ok(spawnSyncStub.secondCall.calledWith('docker', [
+    expect(spawnSyncStub.secondCall.calledWith('docker', [
       'run', '--rm',
       '-u', 'user:group',
       '-v', '/host-path:/container-path:delegated',
       '-w', '/working-directory',
       'alpine',
       'cool', 'command',
-    ], { stdio: ['ignore', process.stderr, 'inherit'] }));
-    test.done();
-  },
+    ], { stdio: ['ignore', process.stderr, 'inherit'] })).toEqual(true);
+
+  });
 });
diff --git a/packages/@aws-cdk/core/test/cfn-json.test.ts b/packages/@aws-cdk/core/test/cfn-json.test.ts
index 150d1971cc39f..ff072b9c2c6b1 100644
--- a/packages/@aws-cdk/core/test/cfn-json.test.ts
+++ b/packages/@aws-cdk/core/test/cfn-json.test.ts
@@ -1,12 +1,11 @@
-import { nodeunitShim, Test } from 'nodeunit-shim';
 import { App, CfnResource, Lazy, Stack } from '../lib';
 import { CfnJson } from '../lib/cfn-json';
 import { CfnUtilsResourceType } from '../lib/private/cfn-utils-provider/consts';
 import { handler } from '../lib/private/cfn-utils-provider/index';
 
-nodeunitShim({
+describe('cfn json', () => {
 
-  'resolves to a fn::getatt'(test: Test) {
+  test('resolves to a fn::getatt', () => {
     // GIVEN
     const app = new App();
     const stack = new Stack(app, 'test');
@@ -23,15 +22,15 @@ nodeunitShim({
     const template = app.synth().getStackArtifact(stack.artifactId).template;
 
     // input is stringified
-    test.deepEqual(template.Resources.MyCfnJson248769BB.Properties.Value, '{"hello":1234,"world":{"bar":1234}}');
+    expect(template.Resources.MyCfnJson248769BB.Properties.Value).toEqual('{"hello":1234,"world":{"bar":1234}}');
 
     // output is basically an Fn::GetAtt
-    test.deepEqual(stack.resolve(json), { 'Fn::GetAtt': ['MyCfnJson248769BB', 'Value'] });
+    expect(stack.resolve(json)).toEqual({ 'Fn::GetAtt': ['MyCfnJson248769BB', 'Value'] });
 
-    test.done();
-  },
 
-  'tokens and intrinsics can be used freely in keys or values'(test: Test) {
+  });
+
+  test('tokens and intrinsics can be used freely in keys or values', () => {
     // GIVEN
     const app = new App();
     const stack = new Stack(app, 'test');
@@ -50,13 +49,13 @@ nodeunitShim({
     // THEN
     const template = app.synth().getStackArtifact(stack.artifactId).template;
 
-    test.deepEqual(template.Resources.MyCfnJson248769BB.Properties.Value, {
+    expect(template.Resources.MyCfnJson248769BB.Properties.Value).toEqual({
       'Fn::Join': ['', ['{"', { Ref: 'Other' }, '":1234,"world":{"bar":"this is a I am lazy"}}']],
     });
-    test.done();
-  },
 
-  'JSON.stringify() will return the CFN-stringified value to avoid circular references'(test: Test) {
+  });
+
+  test('JSON.stringify() will return the CFN-stringified value to avoid circular references', () => {
     // GIVEN
     const stack = new Stack();
     const res = new CfnResource(stack, 'MyResource', { type: 'Foo' });
@@ -70,15 +69,15 @@ nodeunitShim({
     const str = JSON.stringify(cfnjson);
 
     // THEN
-    test.ok(typeof(str) === 'string');
-    test.deepEqual(stack.resolve(str), {
+    expect(typeof(str)).toEqual('string');
+    expect(stack.resolve(str)).toEqual({
       'Fn::Join': ['', ['"{"ref=', { Ref: 'MyResource' }, '":"this is a I am lazy"}"']],
     });
 
-    test.done();
-  },
 
-  async 'resource provider simply parses json and reflects back as an attribute'(test: Test) {
+  });
+
+  test('resource provider simply parses json and reflects back as an attribute', async () => {
     const input = { foo: 1234 };
     const response = await handler({
       ResourceType: CfnUtilsResourceType.CFN_JSON,
@@ -86,7 +85,7 @@ nodeunitShim({
         Value: JSON.stringify(input),
       },
     } as any);
-    test.deepEqual(input, response.Data.Value);
-    test.done();
-  },
+    expect(input).toEqual(response.Data.Value);
+
+  });
 });
diff --git a/packages/@aws-cdk/core/test/cfn-parameter.test.ts b/packages/@aws-cdk/core/test/cfn-parameter.test.ts
index 7441e4548cf98..a93b83f973522 100644
--- a/packages/@aws-cdk/core/test/cfn-parameter.test.ts
+++ b/packages/@aws-cdk/core/test/cfn-parameter.test.ts
@@ -1,8 +1,7 @@
-import { nodeunitShim, Test } from 'nodeunit-shim';
 import { CfnParameter, Stack } from '../lib';
 
-nodeunitShim({
-  'valueAsString supports both string and number types'(test: Test) {
+describe('cfn parameter', () => {
+  test('valueAsString supports both string and number types', () => {
     // GIVEN
     const stack = new Stack();
     const numberParam = new CfnParameter(stack, 'numberParam', { type: 'Number', default: 10 });
@@ -13,20 +12,20 @@ nodeunitShim({
     const strVal = stringParam.valueAsString;
 
     // THEN
-    test.deepEqual(stack.resolve(numVal), { Ref: 'numberParam' });
-    test.deepEqual(stack.resolve(strVal), { Ref: 'stringParam' });
+    expect(stack.resolve(numVal)).toEqual({ Ref: 'numberParam' });
+    expect(stack.resolve(strVal)).toEqual({ Ref: 'stringParam' });
 
-    test.done();
-  },
 
-  'valueAsString fails for unsupported types'(test: Test) {
+  });
+
+  test('valueAsString fails for unsupported types', () => {
     // GIVEN
     const stack = new Stack();
     const listParam = new CfnParameter(stack, 'listParam', { type: 'List', default: 10 });
 
     // WHEN - THEN
-    test.throws(() => listParam.valueAsList, /Parameter type \(List\)/);
+    expect(() => listParam.valueAsList).toThrow(/Parameter type \(List\)/);
+
 
-    test.done();
-  },
+  });
 });
diff --git a/packages/@aws-cdk/core/test/cfn-resource.test.ts b/packages/@aws-cdk/core/test/cfn-resource.test.ts
index c625d477179b6..83f9f634edb48 100644
--- a/packages/@aws-cdk/core/test/cfn-resource.test.ts
+++ b/packages/@aws-cdk/core/test/cfn-resource.test.ts
@@ -1,9 +1,8 @@
-import { nodeunitShim, Test } from 'nodeunit-shim';
 import * as core from '../lib';
 
-nodeunitShim({
-  '._toCloudFormation': {
-    'does not call renderProperties with an undefined value'(test: Test) {
+describe('cfn resource', () => {
+  describe('._toCloudFormation', () => {
+    test('does not call renderProperties with an undefined value', () => {
       const app = new core.App();
       const stack = new core.Stack(app, 'TestStack');
       const resource = new core.CfnResource(stack, 'DefaultResource', { type: 'Test::Resource::Fake' });
@@ -11,22 +10,22 @@ nodeunitShim({
       let called = false;
       (resource as any).renderProperties = (val: any) => {
         called = true;
-        test.notEqual(val, null);
+        expect(val).not.toBeNull();
       };
 
-      test.deepEqual(app.synth().getStackByName(stack.stackName).template, {
+      expect(app.synth().getStackByName(stack.stackName).template).toEqual({
         Resources: {
           DefaultResource: {
             Type: 'Test::Resource::Fake',
           },
         },
       });
-      test.ok(called, 'renderProperties must be called called');
+      expect(called).toEqual(true);
 
-      test.done();
-    },
 
-    'renders "Properties" for a resource that has only properties set to "false"'(test: Test) {
+    });
+
+    test('renders "Properties" for a resource that has only properties set to "false"', () => {
       const app = new core.App();
       const stack = new core.Stack(app, 'TestStack');
       new core.CfnResource(stack, 'Resource', {
@@ -36,7 +35,7 @@ nodeunitShim({
         },
       });
 
-      test.deepEqual(app.synth().getStackByName(stack.stackName).template, {
+      expect(app.synth().getStackByName(stack.stackName).template).toEqual({
         Resources: {
           Resource: {
             Type: 'Test::Resource::Fake',
@@ -47,11 +46,11 @@ nodeunitShim({
         },
       });
 
-      test.done();
-    },
-  },
 
-  'applyRemovalPolicy default includes Update policy'(test: Test) {
+    });
+  });
+
+  test('applyRemovalPolicy default includes Update policy', () => {
     // GIVEN
     const app = new core.App();
     const stack = new core.Stack(app, 'TestStack');
@@ -61,7 +60,7 @@ nodeunitShim({
     resource.applyRemovalPolicy(core.RemovalPolicy.RETAIN);
 
     // THEN
-    test.deepEqual(app.synth().getStackByName(stack.stackName).template, {
+    expect(app.synth().getStackByName(stack.stackName).template).toEqual({
       Resources: {
         DefaultResource: {
           Type: 'Test::Resource::Fake',
@@ -71,10 +70,10 @@ nodeunitShim({
       },
     });
 
-    test.done();
-  },
 
-  'can switch off updating Update policy'(test: Test) {
+  });
+
+  test('can switch off updating Update policy', () => {
     // GIVEN
     const app = new core.App();
     const stack = new core.Stack(app, 'TestStack');
@@ -86,7 +85,7 @@ nodeunitShim({
     });
 
     // THEN
-    test.deepEqual(app.synth().getStackByName(stack.stackName).template, {
+    expect(app.synth().getStackByName(stack.stackName).template).toEqual({
       Resources: {
         DefaultResource: {
           Type: 'Test::Resource::Fake',
@@ -95,10 +94,10 @@ nodeunitShim({
       },
     });
 
-    test.done();
-  },
 
-  'can add metadata'(test: Test) {
+  });
+
+  test('can add metadata', () => {
     // GIVEN
     const app = new core.App();
     const stack = new core.Stack(app, 'TestStack');
@@ -108,7 +107,7 @@ nodeunitShim({
     resource.addMetadata('Beep', 'Boop');
 
     // THEN
-    test.deepEqual(app.synth().getStackByName(stack.stackName).template, {
+    expect(app.synth().getStackByName(stack.stackName).template).toEqual({
       Resources: {
         DefaultResource: {
           Type: 'Test::Resource::Fake',
@@ -119,10 +118,10 @@ nodeunitShim({
       },
     });
 
-    test.done();
-  },
 
-  'can read metadata'(test: Test) {
+  });
+
+  test('can read metadata', () => {
     // GIVEN
     const app = new core.App();
     const stack = new core.Stack(app, 'TestStack');
@@ -132,10 +131,10 @@ nodeunitShim({
     // THEN
     expect(resource.getMetadata('Beep')).toEqual('Boop');
 
-    test.done();
-  },
 
-  'subclasses can override "shouldSynthesize" to lazy-determine if the resource should be included'(test: Test) {
+  });
+
+  test('subclasses can override "shouldSynthesize" to lazy-determine if the resource should be included', () => {
     // GIVEN
     class HiddenCfnResource extends core.CfnResource {
       protected shouldSynthesize() {
@@ -155,41 +154,39 @@ nodeunitShim({
     r2.node.addDependency(subtree);
 
     // THEN - only R2 is synthesized
-    test.deepEqual(app.synth().getStackByName(stack.stackName).template, {
+    expect(app.synth().getStackByName(stack.stackName).template).toEqual({
       Resources: { R2: { Type: 'Foo::R2' } },
 
       // No DependsOn!
     });
 
-    test.done();
-  },
 
-  'CfnResource cannot be created outside Stack'(test: Test) {
+  });
+
+  test('CfnResource cannot be created outside Stack', () => {
     const app = new core.App();
-    test.throws(() => {
+    expect(() => {
       new core.CfnResource(app, 'Resource', {
         type: 'Some::Resource',
       });
-    }, /should be created in the scope of a Stack, but no Stack found/);
+    }).toThrow(/should be created in the scope of a Stack, but no Stack found/);
 
 
-    test.done();
-  },
+  });
 
   /**
    * Stages start a new scope, which does not count as a Stack anymore
    */
-  'CfnResource cannot be in Stage in Stack'(test: Test) {
+  test('CfnResource cannot be in Stage in Stack', () => {
     const app = new core.App();
     const stack = new core.Stack(app, 'Stack');
     const stage = new core.Stage(stack, 'Stage');
-    test.throws(() => {
+    expect(() => {
       new core.CfnResource(stage, 'Resource', {
         type: 'Some::Resource',
       });
-    }, /should be created in the scope of a Stack, but no Stack found/);
+    }).toThrow(/should be created in the scope of a Stack, but no Stack found/);
 
 
-    test.done();
-  },
+  });
 });
diff --git a/packages/@aws-cdk/core/test/condition.test.ts b/packages/@aws-cdk/core/test/condition.test.ts
index 8c43f9eb1507c..54b5a90fea515 100644
--- a/packages/@aws-cdk/core/test/condition.test.ts
+++ b/packages/@aws-cdk/core/test/condition.test.ts
@@ -1,9 +1,8 @@
-import { nodeunitShim, Test } from 'nodeunit-shim';
 import * as cdk from '../lib';
 import { toCloudFormation } from './util';
 
-nodeunitShim({
-  'chain conditions'(test: Test) {
+describe('condition', () => {
+  test('chain conditions', () => {
     // GIVEN
     const stack = new cdk.Stack();
     const param = new cdk.CfnParameter(stack, 'Param1', { type: 'String' });
@@ -17,7 +16,7 @@ nodeunitShim({
     });
 
     // THEN
-    test.deepEqual(toCloudFormation(stack), {
+    expect(toCloudFormation(stack)).toEqual({
       Parameters: { Param1: { Type: 'String' } },
       Conditions: {
         Condition1: { 'Fn::Equals': ['a', 'b'] },
@@ -33,10 +32,10 @@ nodeunitShim({
       },
     });
 
-    test.done();
-  },
 
-  'condition expressions can be embedded as strings'(test: Test) {
+  });
+
+  test('condition expressions can be embedded as strings', () => {
     // GIVEN
     const stack = new cdk.Stack();
     const propValue: string = cdk.Fn.conditionIf('Cond', 'A', 'B').toString();
@@ -50,8 +49,8 @@ nodeunitShim({
     });
 
     // THEN
-    test.ok(cdk.Token.isUnresolved(propValue));
-    test.deepEqual(toCloudFormation(stack), {
+    expect(cdk.Token.isUnresolved(propValue)).toEqual(true);
+    expect(toCloudFormation(stack)).toEqual({
       Resources: {
         MyResource: {
           Type: 'AWS::Foo::Bar',
@@ -61,6 +60,6 @@ nodeunitShim({
         },
       },
     });
-    test.done();
-  },
+
+  });
 });
diff --git a/packages/@aws-cdk/core/test/construct.test.ts b/packages/@aws-cdk/core/test/construct.test.ts
index a190ebaac7327..e8b7c5f00435d 100644
--- a/packages/@aws-cdk/core/test/construct.test.ts
+++ b/packages/@aws-cdk/core/test/construct.test.ts
@@ -1,40 +1,39 @@
 import * as cxschema from '@aws-cdk/cloud-assembly-schema';
-import { nodeunitShim, Test } from 'nodeunit-shim';
 import { App as Root, Aws, Construct, ConstructNode, ConstructOrder, IConstruct, Lazy, ValidationError } from '../lib';
 import { Annotations } from '../lib/annotations';
 import { reEnableStackTraceCollection, restoreStackTraceColection } from './util';
 
 /* eslint-disable @typescript-eslint/naming-convention */
 
-nodeunitShim({
-  'the "Root" construct is a special construct which can be used as the root of the tree'(test: Test) {
+describe('construct', () => {
+  test('the "Root" construct is a special construct which can be used as the root of the tree', () => {
     const root = new Root();
-    test.equal(root.node.id, '', 'if not specified, name of a root construct is an empty string');
-    test.ok(!root.node.scope, 'no parent');
-    test.equal(root.node.children.length, 1);
-    test.done();
-  },
+    expect(root.node.id).toEqual('');
+    expect(root.node.scope).toBeUndefined();
+    expect(root.node.children.length).toEqual(1);
 
-  'constructs cannot be created with an empty name unless they are root'(test: Test) {
+  });
+
+  test('constructs cannot be created with an empty name unless they are root', () => {
     const root = new Root();
-    test.throws(() => new Construct(root, ''));
-    test.done();
-  },
+    expect(() => new Construct(root, '')).toThrow();
+
+  });
 
-  'construct.name returns the name of the construct'(test: Test) {
+  test('construct.name returns the name of the construct', () => {
     const t = createTree();
 
-    test.equal(t.child1.node.id, 'Child1');
-    test.equal(t.child2.node.id, 'Child2');
-    test.equal(t.child1_1.node.id, 'Child11');
-    test.equal(t.child1_2.node.id, 'Child12');
-    test.equal(t.child1_1_1.node.id, 'Child111');
-    test.equal(t.child2_1.node.id, 'Child21');
+    expect(t.child1.node.id).toEqual('Child1');
+    expect(t.child2.node.id).toEqual('Child2');
+    expect(t.child1_1.node.id).toEqual('Child11');
+    expect(t.child1_2.node.id).toEqual('Child12');
+    expect(t.child1_1_1.node.id).toEqual('Child111');
+    expect(t.child2_1.node.id).toEqual('Child21');
+
 
-    test.done();
-  },
+  });
 
-  'construct id can use any character except the path separator'(test: Test) {
+  test('construct id can use any character except the path separator', () => {
     const root = new Root();
     new Construct(root, 'valid');
     new Construct(root, 'ValiD');
@@ -48,33 +47,33 @@ nodeunitShim({
     new Construct(root, 'in-Valid' );
     new Construct(root, 'in\\Valid' );
     new Construct(root, 'in.Valid' );
-    test.done();
-  },
 
-  'if construct id contains path seperators, they will be replaced by double-dash'(test: Test) {
+  });
+
+  test('if construct id contains path seperators, they will be replaced by double-dash', () => {
     const root = new Root();
     const c = new Construct(root, 'Boom/Boom/Bam');
-    test.deepEqual(c.node.id, 'Boom--Boom--Bam');
-    test.done();
-  },
+    expect(c.node.id).toEqual('Boom--Boom--Bam');
+
+  });
 
-  'if "undefined" is forcefully used as an "id", it will be treated as an empty string'(test: Test) {
+  test('if "undefined" is forcefully used as an "id", it will be treated as an empty string', () => {
     const c = new Construct(undefined as any, undefined as any);
-    test.deepEqual(c.node.id, '');
-    test.done();
-  },
+    expect(c.node.id).toEqual('');
 
-  'dont allow unresolved tokens to be used in construct IDs'(test: Test) {
+  });
+
+  test('dont allow unresolved tokens to be used in construct IDs', () => {
     // GIVEN
     const root = new Root();
     const token = Lazy.string({ produce: () => 'lazy' });
 
     // WHEN + THEN
-    test.throws(() => new Construct(root, `MyID: ${token}`), /Cannot use tokens in construct ID: MyID: \${Token/);
-    test.done();
-  },
+    expect(() => new Construct(root, `MyID: ${token}`)).toThrow(/Cannot use tokens in construct ID: MyID: \${Token/);
+
+  });
 
-  'construct.uniqueId returns a tree-unique alphanumeric id of this construct'(test: Test) {
+  test('construct.uniqueId returns a tree-unique alphanumeric id of this construct', () => {
     const root = new Root();
 
     const child1 = new Construct(root, 'This is the first child');
@@ -82,85 +81,85 @@ nodeunitShim({
     const c1 = new Construct(child2, 'My construct');
     const c2 = new Construct(child1, 'My construct');
 
-    test.deepEqual(c1.node.path, 'This is the first child/Second level/My construct');
-    test.deepEqual(c2.node.path, 'This is the first child/My construct');
-    test.deepEqual(c1.node.uniqueId, 'ThisisthefirstchildSecondlevelMyconstruct202131E0');
-    test.deepEqual(c2.node.uniqueId, 'ThisisthefirstchildMyconstruct8C288DF9');
-    test.done();
-  },
+    expect(c1.node.path).toEqual('This is the first child/Second level/My construct');
+    expect(c2.node.path).toEqual('This is the first child/My construct');
+    expect(c1.node.uniqueId).toEqual('ThisisthefirstchildSecondlevelMyconstruct202131E0');
+    expect(c2.node.uniqueId).toEqual('ThisisthefirstchildMyconstruct8C288DF9');
+
+  });
 
-  'cannot calculate uniqueId if the construct path is ["Default"]'(test: Test) {
+  test('cannot calculate uniqueId if the construct path is ["Default"]', () => {
     const root = new Root();
     const c = new Construct(root, 'Default');
-    test.throws(() => c.node.uniqueId, /Unable to calculate a unique id for an empty set of components/);
-    test.done();
-  },
+    expect(() => c.node.uniqueId).toThrow(/Unable to calculate a unique id for an empty set of components/);
 
-  'construct.getChildren() returns an array of all children'(test: Test) {
+  });
+
+  test('construct.getChildren() returns an array of all children', () => {
     const root = new Root();
     const child = new Construct(root, 'Child1');
     new Construct(root, 'Child2');
-    test.equal(child.node.children.length, 0, 'no children');
-    test.equal(root.node.children.length, 3, 'three children are expected');
-    test.done();
-  },
+    expect(child.node.children.length).toEqual(0);
+    expect(root.node.children.length).toEqual(3);
+
+  });
 
-  'construct.findChild(name) can be used to retrieve a child from a parent'(test: Test) {
+  test('construct.findChild(name) can be used to retrieve a child from a parent', () => {
     const root = new Root();
     const child = new Construct(root, 'Contruct');
-    test.strictEqual(root.node.tryFindChild(child.node.id), child, 'findChild(name) can be used to retrieve the child from a parent');
-    test.ok(!root.node.tryFindChild('NotFound'), 'findChild(name) returns undefined if the child is not found');
-    test.done();
-  },
+    expect(root.node.tryFindChild(child.node.id)).toEqual(child);
+    expect(root.node.tryFindChild('NotFound')).toBeUndefined();
 
-  'construct.getChild(name) can be used to retrieve a child from a parent'(test: Test) {
+  });
+
+  test('construct.getChild(name) can be used to retrieve a child from a parent', () => {
     const root = new Root();
     const child = new Construct(root, 'Contruct');
-    test.strictEqual(root.node.findChild(child.node.id), child, 'getChild(name) can be used to retrieve the child from a parent');
-    test.throws(() => {
+    expect(root.node.findChild(child.node.id)).toEqual(child);
+    expect(() => {
       root.node.findChild('NotFound');
-    }, '', 'getChild(name) returns undefined if the child is not found');
-    test.done();
-  },
+    }).toThrow();
+
+  });
 
-  'can remove children from the tree using tryRemoveChild()'(test: Test) {
+  test('can remove children from the tree using tryRemoveChild()', () => {
     const root = new Root();
     const childrenBeforeAdding = root.node.children.length; // Invariant to adding 'Metadata' resource or not
 
     // Add & remove
     const child = new Construct(root, 'Construct');
-    test.equals(true, root.node.tryRemoveChild(child.node.id));
-    test.equals(false, root.node.tryRemoveChild(child.node.id)); // Second time does nothing
+    expect(true).toEqual(root.node.tryRemoveChild(child.node.id));
+    expect(false).toEqual(root.node.tryRemoveChild(child.node.id)); // Second time does nothing
+
+    expect(undefined).toEqual(root.node.tryFindChild(child.node.id));
+    expect(childrenBeforeAdding).toEqual(root.node.children.length);
 
-    test.equals(undefined, root.node.tryFindChild(child.node.id));
-    test.equals(childrenBeforeAdding, root.node.children.length);
-    test.done();
-  },
+  });
 
-  'construct.toString() and construct.toTreeString() can be used for diagnostics'(test: Test) {
+  test('construct.toString() and construct.toTreeString() can be used for diagnostics', () => {
     const t = createTree();
 
-    test.equal(t.root.toString(), '<root>');
-    test.equal(t.child1_1_1.toString(), 'HighChild/Child1/Child11/Child111');
-    test.equal(t.child2.toString(), 'HighChild/Child2');
-    test.equal(toTreeString(t.root), 'App\n  TreeMetadata [Tree]\n  Construct [HighChild]\n    Construct [Child1]\n      Construct [Child11]\n        Construct [Child111]\n      Construct [Child12]\n    Construct [Child2]\n      Construct [Child21]\n');
-    test.done();
-  },
+    expect(t.root.toString()).toEqual('<root>');
+    expect(t.child1_1_1.toString()).toEqual('HighChild/Child1/Child11/Child111');
+    expect(t.child2.toString()).toEqual('HighChild/Child2');
+    expect(toTreeString(t.root)).toEqual('App\n  TreeMetadata [Tree]\n  Construct [HighChild]\n    Construct [Child1]\n      Construct [Child11]\n        Construct [Child111]\n      Construct [Child12]\n    Construct [Child2]\n      Construct [Child21]\n');
 
-  'construct.getContext(key) can be used to read a value from context defined at the root level'(test: Test) {
+  });
+
+  test('construct.getContext(key) can be used to read a value from context defined at the root level', () => {
     const context = {
       ctx1: 12,
       ctx2: 'hello',
     };
 
     const t = createTree(context);
-    test.equal(t.child1_2.node.tryGetContext('ctx1'), 12);
-    test.equal(t.child1_1_1.node.tryGetContext('ctx2'), 'hello');
-    test.done();
-  },
+    expect(t.child1_2.node.tryGetContext('ctx1')).toEqual(12);
+    expect(t.child1_1_1.node.tryGetContext('ctx2')).toEqual('hello');
+
+  });
 
   // eslint-disable-next-line max-len
-  'construct.setContext(k,v) sets context at some level and construct.getContext(key) will return the lowermost value defined in the stack'(test: Test) {
+  test('construct.setContext(k,v) sets context at some level and construct.getContext(key) will return the lowermost value defined in the stack', () => {
     const root = new Root();
     const highChild = new Construct(root, 'highChild');
     highChild.node.setContext('c1', 'root');
@@ -175,98 +174,98 @@ nodeunitShim({
     child3.node.setContext('c1', 'child3');
     child3.node.setContext('c4', 'child3');
 
-    test.equal(highChild.node.tryGetContext('c1'), 'root');
-    test.equal(highChild.node.tryGetContext('c2'), 'root');
-    test.equal(highChild.node.tryGetContext('c3'), undefined);
+    expect(highChild.node.tryGetContext('c1')).toEqual('root');
+    expect(highChild.node.tryGetContext('c2')).toEqual('root');
+    expect(highChild.node.tryGetContext('c3')).toEqual(undefined);
 
-    test.equal(child1.node.tryGetContext('c1'), 'root');
-    test.equal(child1.node.tryGetContext('c2'), 'child1');
-    test.equal(child1.node.tryGetContext('c3'), 'child1');
+    expect(child1.node.tryGetContext('c1')).toEqual('root');
+    expect(child1.node.tryGetContext('c2')).toEqual('child1');
+    expect(child1.node.tryGetContext('c3')).toEqual('child1');
 
-    test.equal(child2.node.tryGetContext('c1'), 'root');
-    test.equal(child2.node.tryGetContext('c2'), 'root');
-    test.equal(child2.node.tryGetContext('c3'), undefined);
+    expect(child2.node.tryGetContext('c1')).toEqual('root');
+    expect(child2.node.tryGetContext('c2')).toEqual('root');
+    expect(child2.node.tryGetContext('c3')).toEqual(undefined);
 
-    test.equal(child3.node.tryGetContext('c1'), 'child3');
-    test.equal(child3.node.tryGetContext('c2'), 'child1');
-    test.equal(child3.node.tryGetContext('c3'), 'child1');
-    test.equal(child3.node.tryGetContext('c4'), 'child3');
+    expect(child3.node.tryGetContext('c1')).toEqual('child3');
+    expect(child3.node.tryGetContext('c2')).toEqual('child1');
+    expect(child3.node.tryGetContext('c3')).toEqual('child1');
+    expect(child3.node.tryGetContext('c4')).toEqual('child3');
 
-    test.done();
-  },
 
-  'construct.setContext(key, value) can only be called before adding any children'(test: Test) {
+  });
+
+  test('construct.setContext(key, value) can only be called before adding any children', () => {
     const root = new Root();
     new Construct(root, 'child1');
-    test.throws(() => root.node.setContext('k', 'v'));
-    test.done();
-  },
+    expect(() => root.node.setContext('k', 'v'));
+
+  });
 
-  'fails if context key contains unresolved tokens'(test: Test) {
+  test('fails if context key contains unresolved tokens', () => {
     const root = new Root();
-    test.throws(() => root.node.setContext(`my-${Aws.REGION}`, 'foo'), /Invalid context key/);
-    test.throws(() => root.node.tryGetContext(Aws.REGION), /Invalid context key/);
-    test.done();
-  },
+    expect(() => root.node.setContext(`my-${Aws.REGION}`, 'foo')).toThrow(/Invalid context key/);
+    expect(() => root.node.tryGetContext(Aws.REGION)).toThrow(/Invalid context key/);
 
-  'construct.pathParts returns an array of strings of all names from root to node'(test: Test) {
+  });
+
+  test('construct.pathParts returns an array of strings of all names from root to node', () => {
     const tree = createTree();
-    test.deepEqual(tree.root.node.path, '');
-    test.deepEqual(tree.child1_1_1.node.path, 'HighChild/Child1/Child11/Child111');
-    test.deepEqual(tree.child2.node.path, 'HighChild/Child2');
-    test.done();
-  },
+    expect(tree.root.node.path).toEqual('');
+    expect(tree.child1_1_1.node.path).toEqual('HighChild/Child1/Child11/Child111');
+    expect(tree.child2.node.path).toEqual('HighChild/Child2');
+
+  });
 
-  'if a root construct has a name, it should be included in the path'(test: Test) {
+  test('if a root construct has a name, it should be included in the path', () => {
     const tree = createTree({});
-    test.deepEqual(tree.root.node.path, '');
-    test.deepEqual(tree.child1_1_1.node.path, 'HighChild/Child1/Child11/Child111');
-    test.done();
-  },
+    expect(tree.root.node.path).toEqual('');
+    expect(tree.child1_1_1.node.path).toEqual('HighChild/Child1/Child11/Child111');
 
-  'construct can not be created with the name of a sibling'(test: Test) {
+  });
+
+  test('construct can not be created with the name of a sibling', () => {
     const root = new Root();
 
     // WHEN
     new Construct(root, 'SameName');
 
     // THEN: They have different paths
-    test.throws(() => {
+    expect(() => {
       new Construct(root, 'SameName');
-    }, /There is already a Construct with name 'SameName' in App/);
+    }).toThrow(/There is already a Construct with name 'SameName' in App/);
 
     // WHEN
     const c0 = new Construct(root, 'c0');
     new Construct(c0, 'SameName');
 
     // THEN: They have different paths
-    test.throws(() => {
+    expect(() => {
       new Construct(c0, 'SameName');
-    }, /There is already a Construct with name 'SameName' in Construct \[c0\]/);
+    }).toThrow(/There is already a Construct with name 'SameName' in Construct \[c0\]/);
+
 
-    test.done();
-  },
+  });
 
-  'addMetadata(type, data) can be used to attach metadata to constructs FIND_ME'(test: Test) {
+  test('addMetadata(type, data) can be used to attach metadata to constructs FIND_ME', () => {
     const previousValue = reEnableStackTraceCollection();
     const root = new Root();
     const con = new Construct(root, 'MyConstruct');
-    test.deepEqual(con.node.metadata, [], 'starts empty');
+    expect(con.node.metadata).toEqual([]);
 
     con.node.addMetadata('key', 'value');
     con.node.addMetadata('number', 103);
     con.node.addMetadata('array', [123, 456]);
     restoreStackTraceColection(previousValue);
 
-    test.deepEqual(con.node.metadata[0].type, 'key');
-    test.deepEqual(con.node.metadata[0].data, 'value');
-    test.deepEqual(con.node.metadata[1].data, 103);
-    test.deepEqual(con.node.metadata[2].data, [123, 456]);
-    test.ok(con.node.metadata[0].trace && con.node.metadata[0].trace[1].indexOf('FIND_ME') !== -1, 'First stack line should include this function\s name');
-    test.done();
-  },
+    expect(con.node.metadata[0].type).toEqual('key');
+    expect(con.node.metadata[0].data).toEqual('value');
+    expect(con.node.metadata[1].data).toEqual(103);
+    expect(con.node.metadata[2].data).toEqual([123, 456]);
+    expect(con.node.metadata[0].trace && con.node.metadata[0].trace[1].indexOf('FIND_ME')).toEqual(-1);
+
+  });
 
-  'addMetadata(type, undefined/null) is ignored'(test: Test) {
+  test('addMetadata(type, undefined/null) is ignored', () => {
     const root = new Root();
     const con = new Construct(root, 'Foo');
     con.node.addMetadata('Null', null);
@@ -277,65 +276,65 @@ nodeunitShim({
 
     const exists = (key: string) => con.node.metadata.find(x => x.type === key);
 
-    test.ok(!exists('Null'));
-    test.ok(!exists('Undefined'));
-    test.ok(exists('True'));
-    test.ok(exists('False'));
-    test.ok(exists('Empty'));
-    test.done();
-  },
+    expect(exists('Null')).toBeUndefined();
+    expect(exists('Undefined')).toBeUndefined();
+    expect(exists('True')).toBeDefined();
+    expect(exists('False')).toBeDefined();
+    expect(exists('Empty')).toBeDefined();
 
-  'addWarning(message) can be used to add a "WARNING" message entry to the construct'(test: Test) {
+  });
+
+  test('addWarning(message) can be used to add a "WARNING" message entry to the construct', () => {
     const previousValue = reEnableStackTraceCollection();
     const root = new Root();
     const con = new Construct(root, 'MyConstruct');
     Annotations.of(con).addWarning('This construct is deprecated, use the other one instead');
     restoreStackTraceColection(previousValue);
 
-    test.deepEqual(con.node.metadata[0].type, cxschema.ArtifactMetadataEntryType.WARN);
-    test.deepEqual(con.node.metadata[0].data, 'This construct is deprecated, use the other one instead');
-    test.ok(con.node.metadata[0].trace && con.node.metadata[0].trace.length > 0);
-    test.done();
-  },
+    expect(con.node.metadata[0].type).toEqual(cxschema.ArtifactMetadataEntryType.WARN);
+    expect(con.node.metadata[0].data).toEqual('This construct is deprecated, use the other one instead');
+    expect(con.node.metadata[0].trace && con.node.metadata[0].trace.length > 0).toEqual(true);
+
+  });
 
-  'addError(message) can be used to add a "ERROR" message entry to the construct'(test: Test) {
+  test('addError(message) can be used to add a "ERROR" message entry to the construct', () => {
     const previousValue = reEnableStackTraceCollection();
     const root = new Root();
     const con = new Construct(root, 'MyConstruct');
     Annotations.of(con).addError('Stop!');
     restoreStackTraceColection(previousValue);
 
-    test.deepEqual(con.node.metadata[0].type, cxschema.ArtifactMetadataEntryType.ERROR);
-    test.deepEqual(con.node.metadata[0].data, 'Stop!');
-    test.ok(con.node.metadata[0].trace && con.node.metadata[0].trace.length > 0);
-    test.done();
-  },
+    expect(con.node.metadata[0].type).toEqual(cxschema.ArtifactMetadataEntryType.ERROR);
+    expect(con.node.metadata[0].data).toEqual('Stop!');
+    expect(con.node.metadata[0].trace && con.node.metadata[0].trace.length > 0).toEqual(true);
 
-  'addInfo(message) can be used to add an "INFO" message entry to the construct'(test: Test) {
+  });
+
+  test('addInfo(message) can be used to add an "INFO" message entry to the construct', () => {
     const previousValue = reEnableStackTraceCollection();
     const root = new Root();
     const con = new Construct(root, 'MyConstruct');
     Annotations.of(con).addInfo('Hey there, how do you do?');
     restoreStackTraceColection(previousValue);
 
-    test.deepEqual(con.node.metadata[0].type, cxschema.ArtifactMetadataEntryType.INFO);
-    test.deepEqual(con.node.metadata[0].data, 'Hey there, how do you do?');
-    test.ok(con.node.metadata[0].trace && con.node.metadata[0].trace.length > 0);
-    test.done();
-  },
+    expect(con.node.metadata[0].type).toEqual(cxschema.ArtifactMetadataEntryType.INFO);
+    expect(con.node.metadata[0].data).toEqual('Hey there, how do you do?');
+    expect(con.node.metadata[0].trace && con.node.metadata[0].trace.length > 0).toEqual(true);
+
+  });
 
-  'multiple children of the same type, with explicit names are welcome'(test: Test) {
+  test('multiple children of the same type, with explicit names are welcome', () => {
     const root = new Root();
     new MyBeautifulConstruct(root, 'mbc1');
     new MyBeautifulConstruct(root, 'mbc2');
     new MyBeautifulConstruct(root, 'mbc3');
     new MyBeautifulConstruct(root, 'mbc4');
-    test.ok(root.node.children.length >= 4);
-    test.done();
-  },
+    expect(root.node.children.length).toBeGreaterThanOrEqual(4);
+
+  });
 
   // eslint-disable-next-line max-len
-  'construct.validate() can be implemented to perform validation, ConstructNode.validate(construct.node) will return all errors from the subtree (DFS)'(test: Test) {
+  test('construct.validate() can be implemented to perform validation, ConstructNode.validate(construct.node) will return all errors from the subtree (DFS)', () => {
 
     class MyConstruct extends Construct {
       protected validate() {
@@ -379,7 +378,7 @@ nodeunitShim({
     const errors = ConstructNode.validate(stack.node).map((v: ValidationError) => ({ path: v.source.node.path, message: v.message }));
 
     // validate DFS
-    test.deepEqual(errors, [
+    expect(errors).toEqual([
       { path: 'MyConstruct', message: 'my-error1' },
       { path: 'MyConstruct', message: 'my-error2' },
       { path: 'TheirConstruct/YourConstruct', message: 'your-error1' },
@@ -387,10 +386,10 @@ nodeunitShim({
       { path: '', message: 'stack-error' },
     ]);
 
-    test.done();
-  },
 
-  'construct.lock() protects against adding children anywhere under this construct (direct or indirect)'(test: Test) {
+  });
+
+  test('construct.lock() protects against adding children anywhere under this construct (direct or indirect)', () => {
 
     class LockableConstruct extends Construct {
       public lockMe() {
@@ -414,9 +413,9 @@ nodeunitShim({
 
     // now we should still be able to add children to c0b, but not to c0a or any its children
     new Construct(c0b, 'c1a');
-    test.throws(() => new Construct(c0a, 'fail1'), /Cannot add children to "c0a" during synthesis/);
-    test.throws(() => new Construct(c1a, 'fail2'), /Cannot add children to "c0a\/c1a" during synthesis/);
-    test.throws(() => new Construct(c1b, 'fail3'), /Cannot add children to "c0a\/c1b" during synthesis/);
+    expect(() => new Construct(c0a, 'fail1')).toThrow(/Cannot add children to "c0a" during synthesis/);
+    expect(() => new Construct(c1a, 'fail2')).toThrow(/Cannot add children to "c0a\/c1a" during synthesis/);
+    expect(() => new Construct(c1b, 'fail3')).toThrow(/Cannot add children to "c0a\/c1b" during synthesis/);
 
     c0a.unlockMe();
 
@@ -424,10 +423,10 @@ nodeunitShim({
     new Construct(c1a, 'c1aZ');
     new Construct(c1b, 'c1bZ');
 
-    test.done();
-  },
 
-  'findAll returns a list of all children in either DFS or BFS'(test: Test) {
+  });
+
+  test('findAll returns a list of all children in either DFS or BFS', () => {
     // GIVEN
     const c1 = new Construct(undefined as any, '1');
     const c2 = new Construct(c1, '2');
@@ -436,75 +435,75 @@ nodeunitShim({
     new Construct(c2, '5');
 
     // THEN
-    test.deepEqual(c1.node.findAll().map(x => x.node.id), c1.node.findAll(ConstructOrder.PREORDER).map(x => x.node.id)); // default is PreOrder
-    test.deepEqual(c1.node.findAll(ConstructOrder.PREORDER).map(x => x.node.id), ['1', '2', '4', '5', '3']);
-    test.deepEqual(c1.node.findAll(ConstructOrder.POSTORDER).map(x => x.node.id), ['4', '5', '2', '3', '1']);
-    test.done();
-  },
+    expect(c1.node.findAll().map(x => x.node.id)).toEqual(c1.node.findAll(ConstructOrder.PREORDER).map(x => x.node.id)); // default is PreOrder
+    expect(c1.node.findAll(ConstructOrder.PREORDER).map(x => x.node.id)).toEqual(['1', '2', '4', '5', '3']);
+    expect(c1.node.findAll(ConstructOrder.POSTORDER).map(x => x.node.id)).toEqual(['4', '5', '2', '3', '1']);
 
-  'ancestors returns a list of parents up to root'(test: Test) {
+  });
+
+  test('ancestors returns a list of parents up to root', () => {
     const { child1_1_1 } = createTree();
-    test.deepEqual(child1_1_1.node.scopes.map(x => x.node.id), ['', 'HighChild', 'Child1', 'Child11', 'Child111']);
-    test.done();
-  },
+    expect(child1_1_1.node.scopes.map(x => x.node.id)).toEqual(['', 'HighChild', 'Child1', 'Child11', 'Child111']);
+
+  });
 
-  '"root" returns the root construct'(test: Test) {
+  test('"root" returns the root construct', () => {
     const { child1, child2, child1_1_1, root } = createTree();
-    test.ok(child1.node.root === root);
-    test.ok(child2.node.root === root);
-    test.ok(child1_1_1.node.root === root);
-    test.done();
-  },
-
-  defaultChild: {
-    'returns the child with id "Resource"'(test: Test) {
+    expect(child1.node.root).toEqual(root);
+    expect(child2.node.root).toEqual(root);
+    expect(child1_1_1.node.root).toEqual(root);
+
+  });
+
+  describe('defaultChild', () => {
+    test('returns the child with id "Resource"', () => {
       const root = new Root();
       new Construct(root, 'child1');
       const defaultChild = new Construct(root, 'Resource');
       new Construct(root, 'child2');
 
-      test.same(root.node.defaultChild, defaultChild);
-      test.done();
-    },
-    'returns the child with id "Default"'(test: Test) {
+      expect(root.node.defaultChild).toEqual(defaultChild);
+
+    });
+    test('returns the child with id "Default"', () => {
       const root = new Root();
       new Construct(root, 'child1');
       const defaultChild = new Construct(root, 'Default');
       new Construct(root, 'child2');
 
-      test.same(root.node.defaultChild, defaultChild);
-      test.done();
-    },
-    'can override defaultChild'(test: Test) {
+      expect(root.node.defaultChild).toEqual(defaultChild);
+
+    });
+    test('can override defaultChild', () => {
       const root = new Root();
       new Construct(root, 'Resource');
       const defaultChild = new Construct(root, 'OtherResource');
       root.node.defaultChild = defaultChild;
 
-      test.same(root.node.defaultChild, defaultChild);
-      test.done();
-    },
-    'returns "undefined" if there is no default'(test: Test) {
+      expect(root.node.defaultChild).toEqual(defaultChild);
+
+    });
+    test('returns "undefined" if there is no default', () => {
       const root = new Root();
       new Construct(root, 'child1');
       new Construct(root, 'child2');
 
-      test.equal(root.node.defaultChild, undefined);
-      test.done();
-    },
-    'fails if there are both "Resource" and "Default"'(test: Test) {
+      expect(root.node.defaultChild).toEqual(undefined);
+
+    });
+    test('fails if there are both "Resource" and "Default"', () => {
       const root = new Root();
       new Construct(root, 'child1');
       new Construct(root, 'Default');
       new Construct(root, 'child2');
       new Construct(root, 'Resource');
 
-      test.throws(() => root.node.defaultChild,
+      expect(() => root.node.defaultChild).toThrow(
         /Cannot determine default child for . There is both a child with id "Resource" and id "Default"/);
-      test.done();
 
-    },
-  },
+
+    });
+  });
 });
 
 function createTree(context?: any) {
diff --git a/packages/@aws-cdk/core/test/context.test.ts b/packages/@aws-cdk/core/test/context.test.ts
index 89c720e735999..b8e0e85c169a4 100644
--- a/packages/@aws-cdk/core/test/context.test.ts
+++ b/packages/@aws-cdk/core/test/context.test.ts
@@ -1,47 +1,46 @@
-import { nodeunitShim, Test } from 'nodeunit-shim';
 import { Construct, Stack } from '../lib';
 import { ContextProvider } from '../lib/context-provider';
 import { synthesize } from '../lib/private/synthesis';
 
-nodeunitShim({
-  'AvailabilityZoneProvider returns a list with dummy values if the context is not available'(test: Test) {
+describe('context', () => {
+  test('AvailabilityZoneProvider returns a list with dummy values if the context is not available', () => {
     const stack = new Stack(undefined, 'TestStack', { env: { account: '12345', region: 'us-east-1' } });
     const azs = stack.availabilityZones;
 
-    test.deepEqual(azs, ['dummy1a', 'dummy1b', 'dummy1c']);
-    test.done();
-  },
+    expect(azs).toEqual(['dummy1a', 'dummy1b', 'dummy1c']);
 
-  'AvailabilityZoneProvider will return context list if available'(test: Test) {
+  });
+
+  test('AvailabilityZoneProvider will return context list if available', () => {
     const stack = new Stack(undefined, 'TestStack', { env: { account: '12345', region: 'us-east-1' } });
     const before = stack.availabilityZones;
-    test.deepEqual(before, ['dummy1a', 'dummy1b', 'dummy1c']);
+    expect(before).toEqual(['dummy1a', 'dummy1b', 'dummy1c']);
     const key = expectedContextKey(stack);
 
     stack.node.setContext(key, ['us-east-1a', 'us-east-1b']);
 
     const azs = stack.availabilityZones;
-    test.deepEqual(azs, ['us-east-1a', 'us-east-1b']);
+    expect(azs).toEqual(['us-east-1a', 'us-east-1b']);
+
 
-    test.done();
-  },
+  });
 
-  'AvailabilityZoneProvider will complain if not given a list'(test: Test) {
+  test('AvailabilityZoneProvider will complain if not given a list', () => {
     const stack = new Stack(undefined, 'TestStack', { env: { account: '12345', region: 'us-east-1' } });
     const before = stack.availabilityZones;
-    test.deepEqual(before, ['dummy1a', 'dummy1b', 'dummy1c']);
+    expect(before).toEqual(['dummy1a', 'dummy1b', 'dummy1c']);
     const key = expectedContextKey(stack);
 
     stack.node.setContext(key, 'not-a-list');
 
-    test.throws(
+    expect(
       () => stack.availabilityZones,
-    );
+    ).toThrow();
 
-    test.done();
-  },
 
-  'ContextProvider consistently generates a key'(test: Test) {
+  });
+
+  test('ContextProvider consistently generates a key', () => {
     const stack = new Stack(undefined, 'TestStack', { env: { account: '12345', region: 'us-east-1' } });
     const key = ContextProvider.getKey(stack, {
       provider: 'ssm',
@@ -51,7 +50,7 @@ nodeunitShim({
       },
     });
 
-    test.deepEqual(key, {
+    expect(key).toEqual({
       key: 'ssm:account=12345:anyStringParam=bar:parameterName=foo:region=us-east-1',
       props: {
         account: '12345',
@@ -69,7 +68,7 @@ nodeunitShim({
         igw: false,
       },
     });
-    test.deepEqual(complexKey, {
+    expect(complexKey).toEqual({
       key: 'vpc:account=12345:cidrBlock=192.168.0.16:igw=false:region=us-east-1:tags.Env=Preprod:tags.Name=MyVPC',
       props: {
         account: '12345',
@@ -79,10 +78,10 @@ nodeunitShim({
         igw: false,
       },
     });
-    test.done();
-  },
 
-  'Key generation can contain arbitrarily deep structures'(test: Test) {
+  });
+
+  test('Key generation can contain arbitrarily deep structures', () => {
     // GIVEN
     const stack = new Stack(undefined, 'TestStack', { env: { account: '12345', region: 'us-east-1' } });
 
@@ -98,7 +97,7 @@ nodeunitShim({
     });
 
     // THEN
-    test.deepEqual(key, {
+    expect(key).toEqual({
       key: 'provider:account=12345:list.0.key=key1:list.0.value=value1:list.1.key=key2:list.1.value=value2:region=us-east-1',
       props: {
         account: '12345',
@@ -110,10 +109,10 @@ nodeunitShim({
       },
     });
 
-    test.done();
-  },
 
-  'Keys with undefined values are not serialized'(test: Test) {
+  });
+
+  test('Keys with undefined values are not serialized', () => {
     // GIVEN
     const stack = new Stack(undefined, 'TestStack', { env: { account: '12345', region: 'us-east-1' } });
 
@@ -127,7 +126,7 @@ nodeunitShim({
     });
 
     // THEN
-    test.deepEqual(result, {
+    expect(result).toEqual({
       key: 'provider:account=12345:p1=42:region=us-east-1',
       props: {
         account: '12345',
@@ -137,10 +136,10 @@ nodeunitShim({
       },
     });
 
-    test.done();
-  },
 
-  'context provider errors are attached to tree'(test: Test) {
+  });
+
+  test('context provider errors are attached to tree', () => {
     const contextProps = { provider: 'availability-zones' };
     const contextKey = 'availability-zones:account=12345:region=us-east-1'; // Depends on the mangling algo
 
@@ -153,7 +152,7 @@ nodeunitShim({
     const construct = new Construct(stack, 'Child');
 
     // Verify that we got the right hardcoded key above, give a descriptive error if not
-    test.equals(ContextProvider.getKey(construct, contextProps).key, contextKey);
+    expect(ContextProvider.getKey(construct, contextProps).key).toEqual(contextKey);
 
     // WHEN
     ContextProvider.getValue(construct, {
@@ -163,10 +162,10 @@ nodeunitShim({
 
     // THEN
     const error = construct.node.metadata.find(m => m.type === 'aws:cdk:error');
-    test.equals(error && error.data, 'I had a boo-boo');
+    expect(error && error.data).toEqual('I had a boo-boo');
+
 
-    test.done();
-  },
+  });
 });
 
 /**
diff --git a/packages/@aws-cdk/core/test/cross-environment-token.test.ts b/packages/@aws-cdk/core/test/cross-environment-token.test.ts
index a0d833996121c..e44d4d8af2c0d 100644
--- a/packages/@aws-cdk/core/test/cross-environment-token.test.ts
+++ b/packages/@aws-cdk/core/test/cross-environment-token.test.ts
@@ -1,12 +1,11 @@
-import { nodeunitShim, Test } from 'nodeunit-shim';
 import { App, CfnOutput, CfnResource, Construct, PhysicalName, Resource, Stack } from '../lib';
 import { toCloudFormation } from './util';
 
 /* eslint-disable quote-props */
 
-nodeunitShim({
-  'CrossEnvironmentToken': {
-    'can reference an ARN with a fixed physical name directly in a different account'(test: Test) {
+describe('cross environment', () => {
+  describe('CrossEnvironmentToken', () => {
+    test('can reference an ARN with a fixed physical name directly in a different account', () => {
       // GIVEN
       const app = new App();
       const stack1 = new Stack(app, 'Stack1', {
@@ -30,7 +29,7 @@ nodeunitShim({
       });
 
       // THEN
-      test.deepEqual(toCloudFormation(stack2), {
+      expect(toCloudFormation(stack2)).toEqual({
         Outputs: {
           Output: {
             Value: {
@@ -49,10 +48,10 @@ nodeunitShim({
         },
       });
 
-      test.done();
-    },
 
-    'can reference a fixed physical name directly in a different account'(test: Test) {
+    });
+
+    test('can reference a fixed physical name directly in a different account', () => {
       // GIVEN
       const app = new App();
       const stack1 = new Stack(app, 'Stack1', {
@@ -75,7 +74,7 @@ nodeunitShim({
       });
 
       // THEN
-      test.deepEqual(toCloudFormation(stack2), {
+      expect(toCloudFormation(stack2)).toEqual({
         Outputs: {
           Output: {
             Value: 'PhysicalName',
@@ -83,10 +82,10 @@ nodeunitShim({
         },
       });
 
-      test.done();
-    },
 
-    'can reference an ARN with an assigned physical name directly in a different account'(test: Test) {
+    });
+
+    test('can reference an ARN with an assigned physical name directly in a different account', () => {
       // GIVEN
       const app = new App();
       const stack1 = new Stack(app, 'Stack1', {
@@ -110,7 +109,7 @@ nodeunitShim({
       });
 
       // THEN
-      test.deepEqual(toCloudFormation(stack2), {
+      expect(toCloudFormation(stack2)).toEqual({
         Outputs: {
           Output: {
             Value: {
@@ -129,10 +128,10 @@ nodeunitShim({
         },
       });
 
-      test.done();
-    },
 
-    'can reference an assigned physical name directly in a different account'(test: Test) {
+    });
+
+    test('can reference an assigned physical name directly in a different account', () => {
       // GIVEN
       const app = new App();
       const stack1 = new Stack(app, 'Stack1', {
@@ -155,7 +154,7 @@ nodeunitShim({
       });
 
       // THEN
-      test.deepEqual(toCloudFormation(stack2), {
+      expect(toCloudFormation(stack2)).toEqual({
         Outputs: {
           Output: {
             Value: 'stack1stack1myresourcec54ced43683ebf9a3c4c',
@@ -163,11 +162,11 @@ nodeunitShim({
         },
       });
 
-      test.done();
-    },
-  },
 
-  'cannot reference a deploy-time physical name across environments'(test: Test) {
+    });
+  });
+
+  test('cannot reference a deploy-time physical name across environments', () => {
     // GIVEN
     const app = new App();
     const stack1 = new Stack(app, 'Stack1', {
@@ -190,13 +189,13 @@ nodeunitShim({
     });
 
     // THEN
-    test.throws(() => toCloudFormation(stack2),
+    expect(() => toCloudFormation(stack2)).toThrow(
       /Cannot use resource 'Stack1\/MyResource' in a cross-environment fashion/);
 
-    test.done();
-  },
 
-  'cross environment when stack is a substack'(test: Test) {
+  });
+
+  test('cross environment when stack is a substack', () => {
     const app = new App();
 
     const parentStack = new Stack(app, 'ParentStack', {
@@ -218,7 +217,7 @@ nodeunitShim({
 
     const assembly = app.synth();
 
-    test.deepEqual(assembly.getStackByName(parentStack.stackName).template, {
+    expect(assembly.getStackByName(parentStack.stackName).template).toEqual({
       Resources: {
         ParentResource: {
           Type: 'Parent::Resource',
@@ -229,7 +228,7 @@ nodeunitShim({
       },
     });
 
-    test.deepEqual(assembly.getStackByName(childStack.stackName).template, {
+    expect(assembly.getStackByName(childStack.stackName).template).toEqual({
       Resources: {
         ChildResource8C37244D: {
           Type: 'My::Resource',
@@ -240,8 +239,8 @@ nodeunitShim({
       },
     });
 
-    test.done();
-  },
+
+  });
 });
 
 test.each([undefined, 'SomeName'])('stack.exportValue() on name attributes with PhysicalName=%s', physicalName => {
diff --git a/packages/@aws-cdk/core/test/custom-resource-provider/custom-resource-provider.test.ts b/packages/@aws-cdk/core/test/custom-resource-provider/custom-resource-provider.test.ts
index 5fc12ecc17c2f..c8d9082447f54 100644
--- a/packages/@aws-cdk/core/test/custom-resource-provider/custom-resource-provider.test.ts
+++ b/packages/@aws-cdk/core/test/custom-resource-provider/custom-resource-provider.test.ts
@@ -1,13 +1,12 @@
 import * as fs from 'fs';
 import * as path from 'path';
-import { nodeunitShim, Test } from 'nodeunit-shim';
 import { App, AssetStaging, CustomResourceProvider, CustomResourceProviderRuntime, DockerImageAssetLocation, DockerImageAssetSource, Duration, FileAssetLocation, FileAssetSource, ISynthesisSession, Size, Stack } from '../../lib';
 import { toCloudFormation } from '../util';
 
 const TEST_HANDLER = `${__dirname}/mock-provider`;
 
-nodeunitShim({
-  'minimal configuration'(test: Test) {
+describe('custom resource provider', () => {
+  test('minimal configuration', () => {
     // GIVEN
     const stack = new Stack();
 
@@ -18,7 +17,7 @@ nodeunitShim({
     });
 
     // THEN
-    test.ok(fs.existsSync(path.join(TEST_HANDLER, '__entrypoint__.js')), 'expecting entrypoint to be copied to the handler directory');
+    expect(fs.existsSync(path.join(TEST_HANDLER, '__entrypoint__.js'))).toEqual(true);
     const cfn = toCloudFormation(stack);
 
     // The asset hash constantly changes, so in order to not have to chase it, just look
@@ -30,7 +29,7 @@ nodeunitShim({
     const keyParam = paramNames[1];
     const hashParam = paramNames[2];
 
-    test.deepEqual(cfn, {
+    expect(cfn).toEqual({
       Resources: {
         CustomMyResourceTypeCustomResourceProviderRoleBD5E655F: {
           Type: 'AWS::IAM::Role',
@@ -120,10 +119,10 @@ nodeunitShim({
         },
       },
     });
-    test.done();
-  },
 
-  'custom resource provided creates asset in new-style synthesis with relative path'(test: Test) {
+  });
+
+  test('custom resource provided creates asset in new-style synthesis with relative path', () => {
     // GIVEN
 
     let assetFilename : string | undefined;
@@ -157,10 +156,10 @@ nodeunitShim({
       throw new Error(`Asset filename must be a relative path, got: ${assetFilename}`);
     }
 
-    test.done();
-  },
 
-  'policyStatements can be used to add statements to the inline policy'(test: Test) {
+  });
+
+  test('policyStatements can be used to add statements to the inline policy', () => {
     // GIVEN
     const stack = new Stack();
 
@@ -177,17 +176,17 @@ nodeunitShim({
     // THEN
     const template = toCloudFormation(stack);
     const role = template.Resources.CustomMyResourceTypeCustomResourceProviderRoleBD5E655F;
-    test.deepEqual(role.Properties.Policies, [{
+    expect(role.Properties.Policies).toEqual([{
       PolicyName: 'Inline',
       PolicyDocument: {
         Version: '2012-10-17',
         Statement: [{ statement1: 123 }, { statement2: { foo: 111 } }],
       },
     }]);
-    test.done();
-  },
 
-  'memorySize, timeout and description'(test: Test) {
+  });
+
+  test('memorySize, timeout and description', () => {
     // GIVEN
     const stack = new Stack();
 
@@ -203,13 +202,13 @@ nodeunitShim({
     // THEN
     const template = toCloudFormation(stack);
     const lambda = template.Resources.CustomMyResourceTypeCustomResourceProviderHandler29FBDD2A;
-    test.deepEqual(lambda.Properties.MemorySize, 2048);
-    test.deepEqual(lambda.Properties.Timeout, 300);
-    test.deepEqual(lambda.Properties.Description, 'veni vidi vici');
-    test.done();
-  },
+    expect(lambda.Properties.MemorySize).toEqual(2048);
+    expect(lambda.Properties.Timeout).toEqual(300);
+    expect(lambda.Properties.Description).toEqual('veni vidi vici');
 
-  'environment variables'(test: Test) {
+  });
+
+  test('environment variables', () => {
     // GIVEN
     const stack = new Stack();
 
@@ -226,16 +225,16 @@ nodeunitShim({
     // THEN
     const template = toCloudFormation(stack);
     const lambda = template.Resources.CustomMyResourceTypeCustomResourceProviderHandler29FBDD2A;
-    test.deepEqual(lambda.Properties.Environment, {
+    expect(lambda.Properties.Environment).toEqual({
       Variables: {
         A: 'a',
         B: 'b',
       },
     });
-    test.done();
-  },
 
-  'roleArn'(test: Test) {
+  });
+
+  test('roleArn', () => {
     // GIVEN
     const stack = new Stack();
 
@@ -246,13 +245,13 @@ nodeunitShim({
     });
 
     // THEN
-    test.deepEqual(stack.resolve(cr.roleArn), {
+    expect(stack.resolve(cr.roleArn)).toEqual({
       'Fn::GetAtt': [
         'CustomMyResourceTypeCustomResourceProviderRoleBD5E655F',
         'Arn',
       ],
     });
-    test.done();
-  },
+
+  });
 });
 
diff --git a/packages/@aws-cdk/core/test/custom-resource-provider/nodejs-entrypoint.test.ts b/packages/@aws-cdk/core/test/custom-resource-provider/nodejs-entrypoint.test.ts
index 18e6dfe053ce7..98b2ee9d41924 100644
--- a/packages/@aws-cdk/core/test/custom-resource-provider/nodejs-entrypoint.test.ts
+++ b/packages/@aws-cdk/core/test/custom-resource-provider/nodejs-entrypoint.test.ts
@@ -4,13 +4,12 @@ import * as https from 'https';
 import * as os from 'os';
 import * as path from 'path';
 import * as url from 'url';
-import { nodeunitShim, Test } from 'nodeunit-shim';
 import * as entrypoint from '../../lib/custom-resource-provider/nodejs-entrypoint';
 
-nodeunitShim({
-  'handler return value is sent back to cloudformation as a success response': {
+describe('nodejs entrypoint', () => {
+  describe('handler return value is sent back to cloudformation as a success response', () => {
 
-    async 'physical resource id (ref)'(test: Test) {
+    test('physical resource id (ref)', async () => {
       // GIVEN
       const createEvent = makeEvent({ RequestType: 'Create' });
 
@@ -18,12 +17,12 @@ nodeunitShim({
       const response = await invokeHandler(createEvent, async _ => ({ PhysicalResourceId: 'returned-from-handler' }));
 
       // THEN
-      test.deepEqual(response.Status, 'SUCCESS');
-      test.deepEqual(response.PhysicalResourceId, 'returned-from-handler');
-      test.done();
-    },
+      expect(response.Status).toEqual('SUCCESS');
+      expect(response.PhysicalResourceId).toEqual('returned-from-handler');
+
+    });
 
-    async 'data (attributes)'(test: Test) {
+    test('data (attributes)', async () => {
       // GIVEN
       const createEvent = makeEvent({ RequestType: 'Create' });
 
@@ -40,18 +39,18 @@ nodeunitShim({
       });
 
       // THEN
-      test.deepEqual(response.Status, 'SUCCESS');
-      test.deepEqual(response.PhysicalResourceId, '<RequestId>', 'physical id defaults to request id');
-      test.deepEqual(response.Data, {
+      expect(response.Status).toEqual('SUCCESS');
+      expect(response.PhysicalResourceId).toEqual('<RequestId>');
+      expect(response.Data).toEqual({
         Attribute1: 'hello',
         Attribute2: {
           Foo: 1111,
         },
       });
-      test.done();
-    },
 
-    async 'no echo'(test: Test) {
+    });
+
+    test('no echo', async () => {
       // GIVEN
       const createEvent = makeEvent({ RequestType: 'Create' });
 
@@ -59,12 +58,12 @@ nodeunitShim({
       const response = await invokeHandler(createEvent, async _ => ({ NoEcho: true }));
 
       // THEN
-      test.deepEqual(response.Status, 'SUCCESS');
-      test.deepEqual(response.NoEcho, true);
-      test.done();
-    },
+      expect(response.Status).toEqual('SUCCESS');
+      expect(response.NoEcho).toEqual(true);
 
-    async 'reason'(test: Test) {
+    });
+
+    test('reason', async () => {
       // GIVEN
       const createEvent = makeEvent({ RequestType: 'Create' });
 
@@ -72,13 +71,13 @@ nodeunitShim({
       const response = await invokeHandler(createEvent, async _ => ({ Reason: 'hello, reason' }));
 
       // THEN
-      test.deepEqual(response.Status, 'SUCCESS');
-      test.deepEqual(response.Reason, 'hello, reason');
-      test.done();
-    },
-  },
+      expect(response.Status).toEqual('SUCCESS');
+      expect(response.Reason).toEqual('hello, reason');
 
-  async 'an error thrown by the handler is sent as a failure response to cloudformation'(test: Test) {
+    });
+  });
+
+  test('an error thrown by the handler is sent as a failure response to cloudformation', async () => {
     // GIVEN
     const createEvent = makeEvent({ RequestType: 'Create' });
 
@@ -88,7 +87,7 @@ nodeunitShim({
     });
 
     // THEN
-    test.deepEqual(response, {
+    expect(response).toEqual({
       Status: 'FAILED',
       Reason: 'this is an error',
       StackId: '<StackId>',
@@ -97,10 +96,10 @@ nodeunitShim({
       LogicalResourceId: '<LogicalResourceId>',
     });
 
-    test.done();
-  },
 
-  async 'physical resource id cannot be changed in DELETE'(test: Test) {
+  });
+
+  test('physical resource id cannot be changed in DELETE', async () => {
     // GIVEN
     const event = makeEvent({ RequestType: 'Delete' });
 
@@ -110,7 +109,7 @@ nodeunitShim({
     }));
 
     // THEN
-    test.deepEqual(response, {
+    expect(response).toEqual({
       Status: 'FAILED',
       Reason: 'DELETE: cannot change the physical resource ID from "undefined" to "Changed" during deletion',
       StackId: '<StackId>',
@@ -119,10 +118,10 @@ nodeunitShim({
       LogicalResourceId: '<LogicalResourceId>',
     });
 
-    test.done();
-  },
 
-  async 'DELETE after CREATE is ignored with success'(test: Test) {
+  });
+
+  test('DELETE after CREATE is ignored with success', async (done) => {
     // GIVEN
     const event = makeEvent({
       RequestType: 'Delete',
@@ -131,11 +130,11 @@ nodeunitShim({
 
     // WHEN
     const response = await invokeHandler(event, async _ => {
-      test.ok(false, 'handler should not be called');
+      done.fail('handler should not be called');
     });
 
     // THEN
-    test.deepEqual(response, {
+    expect(response).toEqual({
       Status: 'SUCCESS',
       Reason: 'SUCCESS',
       StackId: '<StackId>',
@@ -144,9 +143,9 @@ nodeunitShim({
       LogicalResourceId: '<LogicalResourceId>',
     });
 
-    test.done();
+    done();
 
-  },
+  });
 });
 
 function makeEvent(req: Partial<AWSLambda.CloudFormationCustomResourceEvent>): AWSLambda.CloudFormationCustomResourceEvent {
diff --git a/packages/@aws-cdk/core/test/custom-resource.test.ts b/packages/@aws-cdk/core/test/custom-resource.test.ts
index 619a46c062f6b..6f35597864f1b 100644
--- a/packages/@aws-cdk/core/test/custom-resource.test.ts
+++ b/packages/@aws-cdk/core/test/custom-resource.test.ts
@@ -1,9 +1,8 @@
-import { nodeunitShim, Test } from 'nodeunit-shim';
 import { CustomResource, RemovalPolicy, Stack } from '../lib';
 import { toCloudFormation } from './util';
 
-nodeunitShim({
-  'simple case provider identified by service token'(test: Test) {
+describe('custom resource', () => {
+  test('simple case provider identified by service token', () => {
     // GIVEN
     const stack = new Stack();
 
@@ -17,7 +16,7 @@ nodeunitShim({
     });
 
     // THEN
-    test.deepEqual(toCloudFormation(stack), {
+    expect(toCloudFormation(stack)).toEqual({
       Resources: {
         MyCustomResource: {
           Type: 'AWS::CloudFormation::CustomResource',
@@ -31,10 +30,10 @@ nodeunitShim({
         },
       },
     });
-    test.done();
-  },
 
-  'resource type can be specified'(test: Test) {
+  });
+
+  test('resource type can be specified', () => {
     // GIVEN
     const stack = new Stack();
 
@@ -45,7 +44,7 @@ nodeunitShim({
     });
 
     // THEN
-    test.deepEqual(toCloudFormation(stack), {
+    expect(toCloudFormation(stack)).toEqual({
       Resources: {
         MyCustomResource: {
           Type: 'Custom::MyResourceType',
@@ -57,10 +56,10 @@ nodeunitShim({
         },
       },
     });
-    test.done();
-  },
 
-  'removal policy'(test: Test) {
+  });
+
+  test('removal policy', () => {
     // GIVEN
     const stack = new Stack();
 
@@ -71,7 +70,7 @@ nodeunitShim({
     });
 
     // THEN
-    test.deepEqual(toCloudFormation(stack), {
+    expect(toCloudFormation(stack)).toEqual({
       Resources: {
         MyCustomResource: {
           Type: 'AWS::CloudFormation::CustomResource',
@@ -83,23 +82,23 @@ nodeunitShim({
         },
       },
     });
-    test.done();
-  },
 
-  'resource type must begin with "Custom::"'(test: Test) {
+  });
+
+  test('resource type must begin with "Custom::"', () => {
     // GIVEN
     const stack = new Stack();
 
     // THEN
-    test.throws(() => new CustomResource(stack, 'MyCustomResource', {
+    expect(() => new CustomResource(stack, 'MyCustomResource', {
       resourceType: 'MyResourceType',
       serviceToken: 'FooBar',
-    }), /Custom resource type must begin with "Custom::"/);
+    })).toThrow(/Custom resource type must begin with "Custom::"/);
 
-    test.done();
-  },
 
-  'properties can be pascal-cased'(test: Test) {
+  });
+
+  test('properties can be pascal-cased', () => {
     // GIVEN
     const stack = new Stack();
 
@@ -116,7 +115,7 @@ nodeunitShim({
     });
 
     // THEN
-    test.deepEqual(toCloudFormation(stack), {
+    expect(toCloudFormation(stack)).toEqual({
       Resources: {
         MyCustomResource: {
           Type: 'AWS::CloudFormation::CustomResource',
@@ -132,10 +131,10 @@ nodeunitShim({
         },
       },
     });
-    test.done();
-  },
 
-  'pascal-casing of props is disabled by default'(test: Test) {
+  });
+
+  test('pascal-casing of props is disabled by default', () => {
     // GIVEN
     const stack = new Stack();
 
@@ -151,7 +150,7 @@ nodeunitShim({
     });
 
     // THEN
-    test.deepEqual(toCloudFormation(stack), {
+    expect(toCloudFormation(stack)).toEqual({
       Resources: {
         MyCustomResource: {
           Type: 'AWS::CloudFormation::CustomResource',
@@ -167,7 +166,7 @@ nodeunitShim({
         },
       },
     });
-    test.done();
-  },
+
+  });
 
 });
diff --git a/packages/@aws-cdk/core/test/duration.test.ts b/packages/@aws-cdk/core/test/duration.test.ts
index 5b04827d72f07..68da12881d3ba 100644
--- a/packages/@aws-cdk/core/test/duration.test.ts
+++ b/packages/@aws-cdk/core/test/duration.test.ts
@@ -1,210 +1,209 @@
-import { nodeunitShim, Test } from 'nodeunit-shim';
 import { Duration, Lazy, Stack, Token } from '../lib';
 
-nodeunitShim({
-  'negative amount'(test: Test) {
-    test.throws(() => Duration.seconds(-1), /negative/);
+describe('duration', () => {
+  test('negative amount', () => {
+    expect(() => Duration.seconds(-1)).toThrow(/negative/);
 
-    test.done();
-  },
 
-  'unresolved amount'(test: Test) {
+  });
+
+  test('unresolved amount', () => {
     const stack = new Stack();
     const lazyDuration = Duration.seconds(Token.asNumber({ resolve: () => 1337 }));
-    test.equals(stack.resolve(lazyDuration.toSeconds()), 1337);
-    test.throws(
-      () => stack.resolve(lazyDuration.toMinutes()),
+    expect(stack.resolve(lazyDuration.toSeconds())).toEqual(1337);
+    expect(
+      () => stack.resolve(lazyDuration.toMinutes())).toThrow(
       /Unable to perform time unit conversion on un-resolved token/,
     );
 
-    test.done();
-  },
 
-  'Duration in seconds'(test: Test) {
+  });
+
+  test('Duration in seconds', () => {
     const duration = Duration.seconds(300);
 
-    test.equal(duration.toSeconds(), 300);
-    test.equal(duration.toMinutes(), 5);
-    test.throws(() => duration.toDays(), /'300 seconds' cannot be converted into a whole number of days/);
-    floatEqual(test, duration.toDays({ integral: false }), 300 / 86_400);
+    expect(duration.toSeconds()).toEqual(300);
+    expect(duration.toMinutes()).toEqual(5);
+    expect(() => duration.toDays()).toThrow(/'300 seconds' cannot be converted into a whole number of days/);
+    floatEqual(duration.toDays({ integral: false }), 300 / 86_400);
 
-    test.equal(Duration.seconds(60 * 60 * 24).toDays(), 1);
+    expect(Duration.seconds(60 * 60 * 24).toDays()).toEqual(1);
 
-    test.done();
-  },
 
-  'Duration in minutes'(test: Test) {
+  });
+
+  test('Duration in minutes', () => {
     const duration = Duration.minutes(5);
 
-    test.equal(duration.toSeconds(), 300);
-    test.equal(duration.toMinutes(), 5);
-    test.throws(() => duration.toDays(), /'5 minutes' cannot be converted into a whole number of days/);
-    floatEqual(test, duration.toDays({ integral: false }), 300 / 86_400);
+    expect(duration.toSeconds()).toEqual(300);
+    expect(duration.toMinutes()).toEqual(5);
+    expect(() => duration.toDays()).toThrow(/'5 minutes' cannot be converted into a whole number of days/);
+    floatEqual(duration.toDays({ integral: false }), 300 / 86_400);
+
+    expect(Duration.minutes(60 * 24).toDays()).toEqual(1);
 
-    test.equal(Duration.minutes(60 * 24).toDays(), 1);
 
-    test.done();
-  },
+  });
 
-  'Duration in hours'(test: Test) {
+  test('Duration in hours', () => {
     const duration = Duration.hours(5);
 
-    test.equal(duration.toSeconds(), 18_000);
-    test.equal(duration.toMinutes(), 300);
-    test.throws(() => duration.toDays(), /'5 hours' cannot be converted into a whole number of days/);
-    floatEqual(test, duration.toDays({ integral: false }), 5 / 24);
+    expect(duration.toSeconds()).toEqual(18_000);
+    expect(duration.toMinutes()).toEqual(300);
+    expect(() => duration.toDays()).toThrow(/'5 hours' cannot be converted into a whole number of days/);
+    floatEqual(duration.toDays({ integral: false }), 5 / 24);
 
-    test.equal(Duration.hours(24).toDays(), 1);
+    expect(Duration.hours(24).toDays()).toEqual(1);
 
-    test.done();
-  },
 
-  'seconds to milliseconds'(test: Test) {
+  });
+
+  test('seconds to milliseconds', () => {
     const duration = Duration.seconds(5);
 
-    test.equal(duration.toMilliseconds(), 5_000);
+    expect(duration.toMilliseconds()).toEqual(5_000);
+
 
-    test.done();
-  },
+  });
 
-  'Duration in days'(test: Test) {
+  test('Duration in days', () => {
     const duration = Duration.days(1);
 
-    test.equal(duration.toSeconds(), 86_400);
-    test.equal(duration.toMinutes(), 1_440);
-    test.equal(duration.toDays(), 1);
+    expect(duration.toSeconds()).toEqual(86_400);
+    expect(duration.toMinutes()).toEqual(1_440);
+    expect(duration.toDays()).toEqual(1);
+
+
+  });
 
-    test.done();
-  },
+  test('toISOString', () => {
+    expect(Duration.millis(0).toISOString()).toEqual('PT0S');
+    expect(Duration.seconds(0).toISOString()).toEqual('PT0S');
+    expect(Duration.minutes(0).toISOString()).toEqual('PT0S');
+    expect(Duration.hours(0).toISOString()).toEqual('PT0S');
+    expect(Duration.days(0).toISOString()).toEqual('PT0S');
 
-  'toISOString'(test: Test) {
-    test.equal(Duration.millis(0).toISOString(), 'PT0S');
-    test.equal(Duration.seconds(0).toISOString(), 'PT0S');
-    test.equal(Duration.minutes(0).toISOString(), 'PT0S');
-    test.equal(Duration.hours(0).toISOString(), 'PT0S');
-    test.equal(Duration.days(0).toISOString(), 'PT0S');
+    expect(Duration.millis(5).toISOString()).toEqual('PT0.005S');
+    expect(Duration.seconds(5).toISOString()).toEqual('PT5S');
+    expect(Duration.minutes(5).toISOString()).toEqual('PT5M');
+    expect(Duration.hours(5).toISOString()).toEqual('PT5H');
+    expect(Duration.days(5).toISOString()).toEqual('P5D');
 
-    test.equal(Duration.millis(5).toISOString(), 'PT0.005S');
-    test.equal(Duration.seconds(5).toISOString(), 'PT5S');
-    test.equal(Duration.minutes(5).toISOString(), 'PT5M');
-    test.equal(Duration.hours(5).toISOString(), 'PT5H');
-    test.equal(Duration.days(5).toISOString(), 'P5D');
+    expect(Duration.seconds(1 + 60 * (1 + 60 * (1 + 24))).toISOString()).toEqual('P1DT1H1M1S');
 
-    test.equal(Duration.seconds(1 + 60 * (1 + 60 * (1 + 24))).toISOString(), 'P1DT1H1M1S');
 
-    test.done();
-  },
+  });
 
-  'toIsoString'(test: Test) {
-    test.equal(Duration.millis(0).toIsoString(), 'PT0S');
-    test.equal(Duration.seconds(0).toIsoString(), 'PT0S');
-    test.equal(Duration.minutes(0).toIsoString(), 'PT0S');
-    test.equal(Duration.hours(0).toIsoString(), 'PT0S');
-    test.equal(Duration.days(0).toIsoString(), 'PT0S');
+  test('toIsoString', () => {
+    expect(Duration.millis(0).toIsoString()).toEqual('PT0S');
+    expect(Duration.seconds(0).toIsoString()).toEqual('PT0S');
+    expect(Duration.minutes(0).toIsoString()).toEqual('PT0S');
+    expect(Duration.hours(0).toIsoString()).toEqual('PT0S');
+    expect(Duration.days(0).toIsoString()).toEqual('PT0S');
 
-    test.equal(Duration.millis(5).toIsoString(), 'PT0.005S');
-    test.equal(Duration.seconds(5).toIsoString(), 'PT5S');
-    test.equal(Duration.minutes(5).toIsoString(), 'PT5M');
-    test.equal(Duration.hours(5).toIsoString(), 'PT5H');
-    test.equal(Duration.days(5).toIsoString(), 'P5D');
+    expect(Duration.millis(5).toIsoString()).toEqual('PT0.005S');
+    expect(Duration.seconds(5).toIsoString()).toEqual('PT5S');
+    expect(Duration.minutes(5).toIsoString()).toEqual('PT5M');
+    expect(Duration.hours(5).toIsoString()).toEqual('PT5H');
+    expect(Duration.days(5).toIsoString()).toEqual('P5D');
 
-    test.equal(Duration.seconds(65).toIsoString(), 'PT1M5S');
-    test.equal(Duration.seconds(1 + 60 * (1 + 60 * (1 + 24))).toIsoString(), 'P1DT1H1M1S');
+    expect(Duration.seconds(65).toIsoString()).toEqual('PT1M5S');
+    expect(Duration.seconds(1 + 60 * (1 + 60 * (1 + 24))).toIsoString()).toEqual('P1DT1H1M1S');
 
-    test.done();
-  },
 
-  'parse'(test: Test) {
-    test.equal(Duration.parse('PT0S').toSeconds(), 0);
-    test.equal(Duration.parse('PT0M').toSeconds(), 0);
-    test.equal(Duration.parse('PT0H').toSeconds(), 0);
-    test.equal(Duration.parse('P0D').toSeconds(), 0);
+  });
 
-    test.equal(Duration.parse('PT5S').toSeconds(), 5);
-    test.equal(Duration.parse('PT5M').toSeconds(), 300);
-    test.equal(Duration.parse('PT5H').toSeconds(), 18_000);
-    test.equal(Duration.parse('P5D').toSeconds(), 432_000);
+  test('parse', () => {
+    expect(Duration.parse('PT0S').toSeconds()).toEqual(0);
+    expect(Duration.parse('PT0M').toSeconds()).toEqual(0);
+    expect(Duration.parse('PT0H').toSeconds()).toEqual(0);
+    expect(Duration.parse('P0D').toSeconds()).toEqual(0);
 
-    test.equal(Duration.parse('P1DT1H1M1S').toSeconds(), 1 + 60 * (1 + 60 * (1 + 24)));
+    expect(Duration.parse('PT5S').toSeconds()).toEqual(5);
+    expect(Duration.parse('PT5M').toSeconds()).toEqual(300);
+    expect(Duration.parse('PT5H').toSeconds()).toEqual(18_000);
+    expect(Duration.parse('P5D').toSeconds()).toEqual(432_000);
 
-    test.done();
-  },
+    expect(Duration.parse('P1DT1H1M1S').toSeconds()).toEqual(1 + 60 * (1 + 60 * (1 + 24)));
 
-  'reject illegal parses'(test: Test) {
+
+  });
+
+  test('reject illegal parses', () => {
     const err = 'Not a valid ISO duration';
-    test.throws(() => {
+    expect(() => {
       Duration.parse('PT1D');
-    }, err);
+    }).toThrow(err);
 
-    test.throws(() => {
+    expect(() => {
       Duration.parse('P5S');
-    }, err);
+    }).toThrow(err);
+
+
+  });
 
-    test.done();
-  },
+  test('to human string', () => {
+    expect(Duration.minutes(0).toHumanString()).toEqual('0 minutes');
+    expect(Duration.minutes(Lazy.number({ produce: () => 5 })).toHumanString()).toEqual('<token> minutes');
 
-  'to human string'(test: Test) {
-    test.equal(Duration.minutes(0).toHumanString(), '0 minutes');
-    test.equal(Duration.minutes(Lazy.number({ produce: () => 5 })).toHumanString(), '<token> minutes');
+    expect(Duration.days(1).toHumanString()).toEqual('1 day');
+    expect(Duration.hours(1).toHumanString()).toEqual('1 hour');
+    expect(Duration.minutes(1).toHumanString()).toEqual('1 minute');
+    expect(Duration.seconds(1).toHumanString()).toEqual('1 second');
+    expect(Duration.millis(1).toHumanString()).toEqual('1 milli');
 
-    test.equal(Duration.days(1).toHumanString(), '1 day');
-    test.equal(Duration.hours(1).toHumanString(), '1 hour');
-    test.equal(Duration.minutes(1).toHumanString(), '1 minute');
-    test.equal(Duration.seconds(1).toHumanString(), '1 second');
-    test.equal(Duration.millis(1).toHumanString(), '1 milli');
+    expect(Duration.minutes(10).toHumanString()).toEqual('10 minutes');
 
-    test.equal(Duration.minutes(10).toHumanString(), '10 minutes');
+    expect(Duration.minutes(62).toHumanString()).toEqual('1 hour 2 minutes');
 
-    test.equal(Duration.minutes(62).toHumanString(), '1 hour 2 minutes');
+    expect(Duration.seconds(3666).toHumanString()).toEqual('1 hour 1 minute');
 
-    test.equal(Duration.seconds(3666).toHumanString(), '1 hour 1 minute');
+    expect(Duration.millis(3000).toHumanString()).toEqual('3 seconds');
+    expect(Duration.millis(3666).toHumanString()).toEqual('3 seconds 666 millis');
 
-    test.equal(Duration.millis(3000).toHumanString(), '3 seconds');
-    test.equal(Duration.millis(3666).toHumanString(), '3 seconds 666 millis');
+    expect(Duration.millis(3.6).toHumanString()).toEqual('3.6 millis');
 
-    test.equal(Duration.millis(3.6).toHumanString(), '3.6 millis');
 
-    test.done();
-  },
+  });
 
-  'add two durations'(test: Test) {
-    test.equal(Duration.minutes(1).plus(Duration.seconds(30)).toSeconds(), Duration.seconds(90).toSeconds());
-    test.equal(Duration.minutes(1).plus(Duration.seconds(30)).toMinutes({ integral: false }), Duration.seconds(90).toMinutes({ integral: false }));
+  test('add two durations', () => {
+    expect(Duration.minutes(1).plus(Duration.seconds(30)).toSeconds()).toEqual(Duration.seconds(90).toSeconds());
+    expect(Duration.minutes(1).plus(Duration.seconds(30)).toMinutes({ integral: false }))
+      .toEqual(Duration.seconds(90).toMinutes({ integral: false }));
 
-    test.done();
-  },
 
-  'get unit label from duration'(test: Test) {
-    test.equal(Duration.minutes(Lazy.number({ produce: () => 10 })).unitLabel(), 'minutes');
-    test.equal(Duration.minutes(62).unitLabel(), 'minutes');
-    test.equal(Duration.seconds(10).unitLabel(), 'seconds');
-    test.equal(Duration.millis(1).unitLabel(), 'millis');
-    test.equal(Duration.hours(1000).unitLabel(), 'hours');
-    test.equal(Duration.days(2).unitLabel(), 'days');
-    test.done();
-  },
+  });
 
-  'format number token to number'(test: Test) {
+  test('get unit label from duration', () => {
+    expect(Duration.minutes(Lazy.number({ produce: () => 10 })).unitLabel()).toEqual('minutes');
+    expect(Duration.minutes(62).unitLabel()).toEqual('minutes');
+    expect(Duration.seconds(10).unitLabel()).toEqual('seconds');
+    expect(Duration.millis(1).unitLabel()).toEqual('millis');
+    expect(Duration.hours(1000).unitLabel()).toEqual('hours');
+    expect(Duration.days(2).unitLabel()).toEqual('days');
+
+  });
+
+  test('format number token to number', () => {
     const stack = new Stack();
     const lazyDuration = Duration.minutes(Lazy.number({ produce: () => 10 }));
-    test.equal(stack.resolve(lazyDuration.formatTokenToNumber()), '10 minutes');
-    test.equal(Duration.hours(10).formatTokenToNumber(), '10 hours');
-    test.equal(Duration.days(5).formatTokenToNumber(), '5 days');
-    test.done();
-  },
+    expect(stack.resolve(lazyDuration.formatTokenToNumber())).toEqual('10 minutes');
+    expect(Duration.hours(10).formatTokenToNumber()).toEqual('10 hours');
+    expect(Duration.days(5).formatTokenToNumber()).toEqual('5 days');
 
-  'duration is unresolved'(test: Test) {
+  });
+
+  test('duration is unresolved', () => {
     const lazyDuration = Duration.minutes(Lazy.number({ produce: () => 10 }));
-    test.equal(lazyDuration.isUnresolved(), true);
-    test.equal(Duration.hours(10).isUnresolved(), false);
-    test.done();
-  },
+    expect(lazyDuration.isUnresolved()).toEqual(true);
+    expect(Duration.hours(10).isUnresolved()).toEqual(false);
+
+  });
 });
 
-function floatEqual(test: Test, actual: number, expected: number) {
-  test.ok(
+function floatEqual(actual: number, expected: number) {
+  expect(
     // Floats are subject to rounding errors up to Number.ESPILON
     actual >= expected - Number.EPSILON && actual <= expected + Number.EPSILON,
-    `${actual} == ${expected}`,
-  );
+  ).toEqual(true);
 }
diff --git a/packages/@aws-cdk/core/test/dynamic-reference.test.ts b/packages/@aws-cdk/core/test/dynamic-reference.test.ts
index e9da4b23b837d..894339d231d7b 100644
--- a/packages/@aws-cdk/core/test/dynamic-reference.test.ts
+++ b/packages/@aws-cdk/core/test/dynamic-reference.test.ts
@@ -1,8 +1,7 @@
-import { nodeunitShim, Test } from 'nodeunit-shim';
 import { CfnDynamicReference, CfnDynamicReferenceService, Stack } from '../lib';
 
-nodeunitShim({
-  'can create dynamic references with service and key with colons'(test: Test) {
+describe('dynamic reference', () => {
+  test('can create dynamic references with service and key with colons', () => {
     // GIVEN
     const stack = new Stack();
 
@@ -10,8 +9,8 @@ nodeunitShim({
     const ref = new CfnDynamicReference(CfnDynamicReferenceService.SSM, 'a:b:c');
 
     // THEN
-    test.equal(stack.resolve(ref), '{{resolve:ssm:a:b:c}}');
+    expect(stack.resolve(ref)).toEqual('{{resolve:ssm:a:b:c}}');
 
-    test.done();
-  },
+
+  });
 });
diff --git a/packages/@aws-cdk/core/test/environment.test.ts b/packages/@aws-cdk/core/test/environment.test.ts
index 5432fd178f1f8..01a122a825f77 100644
--- a/packages/@aws-cdk/core/test/environment.test.ts
+++ b/packages/@aws-cdk/core/test/environment.test.ts
@@ -1,33 +1,32 @@
-import { nodeunitShim, Test } from 'nodeunit-shim';
 import { App, Aws, Stack, Token } from '../lib';
 
-nodeunitShim({
-  'By default, environment region and account are not defined and resolve to intrinsics'(test: Test) {
+describe('environment', () => {
+  test('By default, environment region and account are not defined and resolve to intrinsics', () => {
     const stack = new Stack();
-    test.ok(Token.isUnresolved(stack.account));
-    test.ok(Token.isUnresolved(stack.region));
-    test.deepEqual(stack.resolve(stack.account), { Ref: 'AWS::AccountId' });
-    test.deepEqual(stack.resolve(stack.region), { Ref: 'AWS::Region' });
-    test.done();
-  },
-
-  'If only `env.region` or `env.account` are specified, Refs will be used for the other'(test: Test) {
+    expect(Token.isUnresolved(stack.account)).toEqual(true);
+    expect(Token.isUnresolved(stack.region)).toEqual(true);
+    expect(stack.resolve(stack.account)).toEqual({ Ref: 'AWS::AccountId' });
+    expect(stack.resolve(stack.region)).toEqual({ Ref: 'AWS::Region' });
+
+  });
+
+  test('If only `env.region` or `env.account` are specified, Refs will be used for the other', () => {
     const app = new App();
 
     const stack1 = new Stack(app, 'S1', { env: { region: 'only-region' } });
     const stack2 = new Stack(app, 'S2', { env: { account: 'only-account' } });
 
-    test.deepEqual(stack1.resolve(stack1.account), { Ref: 'AWS::AccountId' });
-    test.deepEqual(stack1.resolve(stack1.region), 'only-region');
+    expect(stack1.resolve(stack1.account)).toEqual({ Ref: 'AWS::AccountId' });
+    expect(stack1.resolve(stack1.region)).toEqual('only-region');
 
-    test.deepEqual(stack2.resolve(stack2.account), 'only-account');
-    test.deepEqual(stack2.resolve(stack2.region), { Ref: 'AWS::Region' });
+    expect(stack2.resolve(stack2.account)).toEqual('only-account');
+    expect(stack2.resolve(stack2.region)).toEqual({ Ref: 'AWS::Region' });
 
-    test.done();
-  },
 
-  'environment defaults': {
-    'if "env" is not specified, it implies account/region agnostic'(test: Test) {
+  });
+
+  describe('environment defaults', () => {
+    test('if "env" is not specified, it implies account/region agnostic', () => {
       // GIVEN
       const app = new App();
 
@@ -35,18 +34,18 @@ nodeunitShim({
       const stack = new Stack(app, 'stack');
 
       // THEN
-      test.deepEqual(stack.resolve(stack.account), { Ref: 'AWS::AccountId' });
-      test.deepEqual(stack.resolve(stack.region), { Ref: 'AWS::Region' });
-      test.deepEqual(app.synth().getStackByName(stack.stackName).environment, {
+      expect(stack.resolve(stack.account)).toEqual({ Ref: 'AWS::AccountId' });
+      expect(stack.resolve(stack.region)).toEqual({ Ref: 'AWS::Region' });
+      expect(app.synth().getStackByName(stack.stackName).environment).toEqual({
         account: 'unknown-account',
         region: 'unknown-region',
         name: 'aws://unknown-account/unknown-region',
       });
 
-      test.done();
-    },
 
-    'only region is set'(test: Test) {
+    });
+
+    test('only region is set', () => {
       // GIVEN
       const app = new App();
 
@@ -54,18 +53,18 @@ nodeunitShim({
       const stack = new Stack(app, 'stack', { env: { region: 'explicit-region' } });
 
       // THEN
-      test.deepEqual(stack.resolve(stack.account), { Ref: 'AWS::AccountId' });
-      test.deepEqual(stack.resolve(stack.region), 'explicit-region');
-      test.deepEqual(app.synth().getStackByName(stack.stackName).environment, {
+      expect(stack.resolve(stack.account)).toEqual({ Ref: 'AWS::AccountId' });
+      expect(stack.resolve(stack.region)).toEqual('explicit-region');
+      expect(app.synth().getStackByName(stack.stackName).environment).toEqual({
         account: 'unknown-account',
         region: 'explicit-region',
         name: 'aws://unknown-account/explicit-region',
       });
 
-      test.done();
-    },
 
-    'both "region" and "account" are set'(test: Test) {
+    });
+
+    test('both "region" and "account" are set', () => {
       // GIVEN
       const app = new App();
 
@@ -78,18 +77,18 @@ nodeunitShim({
       });
 
       // THEN
-      test.deepEqual(stack.resolve(stack.account), 'explicit-account');
-      test.deepEqual(stack.resolve(stack.region), 'explicit-region');
-      test.deepEqual(app.synth().getStackByName(stack.stackName).environment, {
+      expect(stack.resolve(stack.account)).toEqual('explicit-account');
+      expect(stack.resolve(stack.region)).toEqual('explicit-region');
+      expect(app.synth().getStackByName(stack.stackName).environment).toEqual({
         account: 'explicit-account',
         region: 'explicit-region',
         name: 'aws://explicit-account/explicit-region',
       });
 
-      test.done();
-    },
 
-    'token-account and token-region'(test: Test) {
+    });
+
+    test('token-account and token-region', () => {
       // GIVEN
       const app = new App();
 
@@ -102,18 +101,18 @@ nodeunitShim({
       });
 
       // THEN
-      test.deepEqual(stack.resolve(stack.account), { Ref: 'AWS::AccountId' });
-      test.deepEqual(stack.resolve(stack.region), { Ref: 'AWS::Region' });
-      test.deepEqual(app.synth().getStackByName(stack.stackName).environment, {
+      expect(stack.resolve(stack.account)).toEqual({ Ref: 'AWS::AccountId' });
+      expect(stack.resolve(stack.region)).toEqual({ Ref: 'AWS::Region' });
+      expect(app.synth().getStackByName(stack.stackName).environment).toEqual({
         account: 'unknown-account',
         region: 'unknown-region',
         name: 'aws://unknown-account/unknown-region',
       });
 
-      test.done();
-    },
 
-    'token-account explicit region'(test: Test) {
+    });
+
+    test('token-account explicit region', () => {
       // GIVEN
       const app = new App();
 
@@ -126,15 +125,15 @@ nodeunitShim({
       });
 
       // THEN
-      test.deepEqual(stack.resolve(stack.account), { Ref: 'AWS::AccountId' });
-      test.deepEqual(stack.resolve(stack.region), 'us-east-2');
-      test.deepEqual(app.synth().getStackByName(stack.stackName).environment, {
+      expect(stack.resolve(stack.account)).toEqual({ Ref: 'AWS::AccountId' });
+      expect(stack.resolve(stack.region)).toEqual('us-east-2');
+      expect(app.synth().getStackByName(stack.stackName).environment).toEqual({
         account: 'unknown-account',
         region: 'us-east-2',
         name: 'aws://unknown-account/us-east-2',
       });
 
-      test.done();
-    },
-  },
+
+    });
+  });
 });
diff --git a/packages/@aws-cdk/core/test/expiration.test.ts b/packages/@aws-cdk/core/test/expiration.test.ts
index de17852f4308c..f1770994dfbea 100644
--- a/packages/@aws-cdk/core/test/expiration.test.ts
+++ b/packages/@aws-cdk/core/test/expiration.test.ts
@@ -1,49 +1,48 @@
-import { nodeunitShim, Test } from 'nodeunit-shim';
 import { Duration, Expiration } from '../lib';
 
-nodeunitShim({
-  'from string'(test: Test) {
+describe('expiration', () => {
+  test('from string', () => {
     const date = new Date('Sun, 26 Jan 2020 00:53:20 GMT');
-    test.equal(Expiration.fromString('Sun, 26 Jan 2020 00:53:20 GMT').date.getDate(), date.getDate());
-    test.done();
-  },
+    expect(Expiration.fromString('Sun, 26 Jan 2020 00:53:20 GMT').date.getDate()).toEqual(date.getDate());
 
-  'at specified date'(test: Test) {
+  });
+
+  test('at specified date', () => {
     const date = new Date('Sun, 26 Jan 2020 00:53:20 GMT');
-    test.equal(Expiration.atDate(new Date('Sun, 26 Jan 2020 00:53:20 GMT')).date.toUTCString(), 'Sun, 26 Jan 2020 00:53:20 GMT');
-    test.equal(Expiration.atDate(new Date(1580000000000)).date.toUTCString(), 'Sun, 26 Jan 2020 00:53:20 GMT');
-    test.equal(Expiration.atDate(new Date(date)).date.toUTCString(), 'Sun, 26 Jan 2020 00:53:20 GMT');
-    test.done();
-  },
-
-  'at time stamp'(test: Test) {
-    test.equal(Expiration.atDate(new Date(1580000000000)).date.toUTCString(), 'Sun, 26 Jan 2020 00:53:20 GMT');
-    test.done();
-  },
-
-  'after'(test: Test) {
-    test.ok(Math.abs(new Date(Expiration.after(Duration.minutes(10)).date.toUTCString()).getTime() - (Date.now() + 600000)) < 15000);
-    test.done();
-  },
-
-  'toEpoch returns correct value'(test: Test) {
+    expect(Expiration.atDate(new Date('Sun, 26 Jan 2020 00:53:20 GMT')).date.toUTCString()).toEqual('Sun, 26 Jan 2020 00:53:20 GMT');
+    expect(Expiration.atDate(new Date(1580000000000)).date.toUTCString()).toEqual('Sun, 26 Jan 2020 00:53:20 GMT');
+    expect(Expiration.atDate(new Date(date)).date.toUTCString()).toEqual('Sun, 26 Jan 2020 00:53:20 GMT');
+
+  });
+
+  test('at time stamp', () => {
+    expect(Expiration.atDate(new Date(1580000000000)).date.toUTCString()).toEqual('Sun, 26 Jan 2020 00:53:20 GMT');
+
+  });
+
+  test('after', () => {
+    expect(Math.abs(new Date(Expiration.after(Duration.minutes(10)).date.toUTCString()).getTime() - (Date.now() + 600000)) < 15000).toBeDefined();
+
+  });
+
+  test('toEpoch returns correct value', () => {
     const date = new Date('Sun, 26 Jan 2020 00:53:20 GMT');
-    test.equal(Expiration.atDate(date).toEpoch(), 1580000000);
-    test.done();
-  },
+    expect(Expiration.atDate(date).toEpoch()).toEqual(1580000000);
+
+  });
 
-  'isBefore'(test: Test) {
+  test('isBefore', () => {
     const expire = Expiration.after(Duration.days(2));
-    test.ok(!expire.isBefore(Duration.days(1)));
-    test.ok(expire.isBefore(Duration.days(3)));
-    test.done();
-  },
+    expect(expire.isBefore(Duration.days(1))).toEqual(false);
+    expect(expire.isBefore(Duration.days(3))).toEqual(true);
 
-  'isAfter'(test: Test) {
+  });
+
+  test('isAfter', () => {
     const expire = Expiration.after(Duration.days(2));
-    test.ok(expire.isAfter(Duration.days(1)));
-    test.ok(!expire.isAfter(Duration.days(3)));
-    test.done();
-  },
+    expect(expire.isAfter(Duration.days(1))).toEqual(true);
+    expect(expire.isAfter(Duration.days(3))).toEqual(false);
+
+  });
 
 });
diff --git a/packages/@aws-cdk/core/test/feature-flags.test.ts b/packages/@aws-cdk/core/test/feature-flags.test.ts
index b3ca21c45bea8..09b79b7c26123 100644
--- a/packages/@aws-cdk/core/test/feature-flags.test.ts
+++ b/packages/@aws-cdk/core/test/feature-flags.test.ts
@@ -1,31 +1,30 @@
 import * as cxapi from '@aws-cdk/cx-api';
-import { nodeunitShim, Test } from 'nodeunit-shim';
 import { FeatureFlags, Stack } from '../lib';
 
-nodeunitShim({
-  isEnabled: {
-    'returns true when the flag is enabled'(test: Test) {
+describe('feature flags', () => {
+  describe('isEnabled', () => {
+    test('returns true when the flag is enabled', () => {
       const stack = new Stack();
       stack.node.setContext(cxapi.NEW_STYLE_STACK_SYNTHESIS_CONTEXT, true);
 
       const actual = FeatureFlags.of(stack).isEnabled(cxapi.NEW_STYLE_STACK_SYNTHESIS_CONTEXT);
-      test.equals(actual, true);
-      test.done();
-    },
+      expect(actual).toEqual(true);
 
-    'falls back to the default'(test: Test) {
+    });
+
+    test('falls back to the default', () => {
       const stack = new Stack();
 
-      test.equals(FeatureFlags.of(stack).isEnabled(cxapi.NEW_STYLE_STACK_SYNTHESIS_CONTEXT),
+      expect(FeatureFlags.of(stack).isEnabled(cxapi.NEW_STYLE_STACK_SYNTHESIS_CONTEXT)).toEqual(
         cxapi.futureFlagDefault(cxapi.NEW_STYLE_STACK_SYNTHESIS_CONTEXT));
-      test.done();
-    },
 
-    'invalid flag'(test: Test) {
+    });
+
+    test('invalid flag', () => {
       const stack = new Stack();
 
-      test.equals(FeatureFlags.of(stack).isEnabled('non-existent-flag'), undefined);
-      test.done();
-    },
-  },
+      expect(FeatureFlags.of(stack).isEnabled('non-existent-flag')).toEqual(undefined);
+
+    });
+  });
 });
diff --git a/packages/@aws-cdk/core/test/fn.test.ts b/packages/@aws-cdk/core/test/fn.test.ts
index 4168f7d6daada..221a7b6e811a1 100644
--- a/packages/@aws-cdk/core/test/fn.test.ts
+++ b/packages/@aws-cdk/core/test/fn.test.ts
@@ -1,21 +1,20 @@
 import * as fc from 'fast-check';
 import * as _ from 'lodash';
-import { nodeunitShim, Test } from 'nodeunit-shim';
 import { App, CfnOutput, Fn, Stack, Token } from '../lib';
 import { Intrinsic } from '../lib/private/intrinsic';
 
-function asyncTest(cb: (test: Test) => Promise<void>): (test: Test) => void {
-  return async (test: Test) => {
-    let error: Error;
+function asyncTest(cb: () => Promise<void>): () => void {
+  return async () => {
+    let error: any;
     try {
-      await cb(test);
+      await cb();
     } catch (e) {
       error = e;
     } finally {
-      test.doesNotThrow(() => {
+      expect(() => {
         if (error) { throw error; }
-      });
-      test.done();
+      }).not.toThrow();
+
     }
   };
 }
@@ -24,23 +23,23 @@ const nonEmptyString = fc.string(1, 16);
 const tokenish = fc.array(nonEmptyString, 2, 2).map(arr => ({ [arr[0]]: arr[1] }));
 const anyValue = fc.oneof<any>(nonEmptyString, tokenish);
 
-nodeunitShim({
-  'eager resolution for non-tokens': {
-    'Fn.select'(test: Test) {
-      test.deepEqual(Fn.select(2, ['hello', 'you', 'dude']), 'dude');
-      test.done();
-    },
-    'Fn.split'(test: Test) {
-      test.deepEqual(Fn.split(':', 'hello:world:yeah'), ['hello', 'world', 'yeah']);
-      test.done();
-    },
-  },
-  'FnParseDomainName': {
-    'parse domain name from resolved url'(test: Test) {
-      test.deepEqual(Fn.parseDomainName('https://test.com/'), 'test.com');
-      test.done();
-    },
-    'parse domain name on token'(test: Test) {
+describe('fn', () => {
+  describe('eager resolution for non-tokens', () => {
+    test('Fn.select', () => {
+      expect(Fn.select(2, ['hello', 'you', 'dude'])).toEqual('dude');
+
+    });
+    test('Fn.split', () => {
+      expect(Fn.split(':', 'hello:world:yeah')).toEqual(['hello', 'world', 'yeah']);
+
+    });
+  });
+  describe('FnParseDomainName', () => {
+    test('parse domain name from resolved url', () => {
+      expect(Fn.parseDomainName('https://test.com/')).toEqual('test.com');
+
+    });
+    test('parse domain name on token', () => {
       const stack = new Stack();
       const url = Fn.join('//', [
         'https:',
@@ -49,16 +48,16 @@ nodeunitShim({
           'graphql',
         ]),
       ]);
-      test.deepEqual(Fn.parseDomainName(stack.resolve(url)), 'test.com');
-      test.done();
-    },
-  },
-  'FnJoin': {
-    'rejects empty list of arguments to join'(test: Test) {
-      test.throws(() => Fn.join('.', []));
-      test.done();
-    },
-    'collapse nested FnJoins even if they contain tokens'(test: Test) {
+      expect(Fn.parseDomainName(stack.resolve(url))).toEqual('test.com');
+
+    });
+  });
+  describe('FnJoin', () => {
+    test('rejects empty list of arguments to join', () => {
+      expect(() => Fn.join('.', [])).toThrow();
+
+    });
+    test('collapse nested FnJoins even if they contain tokens', () => {
       const stack = new Stack();
 
       const obj = Fn.join('', [
@@ -67,7 +66,7 @@ nodeunitShim({
         'd',
       ]);
 
-      test.deepEqual(stack.resolve(obj), {
+      expect(stack.resolve(obj)).toEqual({
         'Fn::Join': ['',
           [
             'a',
@@ -76,9 +75,9 @@ nodeunitShim({
           ]],
       });
 
-      test.done();
-    },
-    'resolves to the value if only one value is joined': asyncTest(async () => {
+
+    });
+    test('resolves to the value if only one value is joined', asyncTest(async () => {
       const stack = new Stack();
       fc.assert(
         fc.property(
@@ -87,8 +86,8 @@ nodeunitShim({
         ),
         { verbose: true },
       );
-    }),
-    'pre-concatenates string literals': asyncTest(async () => {
+    }));
+    test('pre-concatenates string literals', asyncTest(async () => {
       const stack = new Stack();
       fc.assert(
         fc.property(
@@ -97,8 +96,8 @@ nodeunitShim({
         ),
         { verbose: true },
       );
-    }),
-    'pre-concatenates around tokens': asyncTest(async () => {
+    }));
+    test('pre-concatenates around tokens', asyncTest(async () => {
       const stack = new Stack();
       fc.assert(
         fc.property(
@@ -109,8 +108,8 @@ nodeunitShim({
         ),
         { verbose: true, seed: 1539874645005, path: '0:0:0:0:0:0:0:0:0' },
       );
-    }),
-    'flattens joins nested under joins with same delimiter': asyncTest(async () => {
+    }));
+    test('flattens joins nested under joins with same delimiter', asyncTest(async () => {
       const stack = new Stack();
       fc.assert(
         fc.property(
@@ -124,8 +123,8 @@ nodeunitShim({
         ),
         { verbose: true },
       );
-    }),
-    'does not flatten joins nested under joins with different delimiter': asyncTest(async () => {
+    }));
+    test('does not flatten joins nested under joins with different delimiter', asyncTest(async () => {
       const stack = new Stack();
       fc.assert(
         fc.property(
@@ -144,22 +143,22 @@ nodeunitShim({
         ),
         { verbose: true },
       );
-    }),
-    'Fn::EachMemberIn': asyncTest(async (test) => {
+    }));
+    test('Fn::EachMemberIn', asyncTest(async () => {
       const stack = new Stack();
       const eachMemberIn = Fn.conditionEachMemberIn(
         Fn.valueOfAll('AWS::EC2::Subnet::Id', 'VpcId'),
         Fn.refAll('AWS::EC2::VPC::Id'),
       );
-      test.deepEqual(stack.resolve(eachMemberIn), {
+      expect(stack.resolve(eachMemberIn)).toEqual({
         'Fn::EachMemberIn': [
           { 'Fn::ValueOfAll': ['AWS::EC2::Subnet::Id', 'VpcId'] },
           { 'Fn::RefAll': 'AWS::EC2::VPC::Id' },
         ],
       });
-    }),
+    }));
 
-    'cross-stack FnJoin elements are properly resolved': asyncTest(async (test) => {
+    test('cross-stack FnJoin elements are properly resolved', asyncTest(async () => {
       // GIVEN
       const app = new App();
       const stack1 = new Stack(app, 'Stack1');
@@ -173,7 +172,7 @@ nodeunitShim({
       // THEN
       const template = app.synth().getStackByName('Stack2').template;
 
-      test.deepEqual(template, {
+      expect(template).toEqual({
         Outputs: {
           Stack1Id: {
             Value: {
@@ -185,22 +184,22 @@ nodeunitShim({
           },
         },
       });
-    }),
-  },
-  'Ref': {
-    'returns a reference given a logical name'(test: Test) {
+    }));
+  });
+  describe('Ref', () => {
+    test('returns a reference given a logical name', () => {
       const stack = new Stack();
-      test.deepEqual(stack.resolve(Fn.ref('hello')), {
+      expect(stack.resolve(Fn.ref('hello'))).toEqual({
         Ref: 'hello',
       });
-      test.done();
-    },
-  },
-  'nested Fn::Join with list token'(test: Test) {
+
+    });
+  });
+  test('nested Fn::Join with list token', () => {
     const stack = new Stack();
     const inner = Fn.join(',', Token.asList({ NotReallyList: true }));
     const outer = Fn.join(',', [inner, 'Foo']);
-    test.deepEqual(stack.resolve(outer), {
+    expect(stack.resolve(outer)).toEqual({
       'Fn::Join': [
         ',',
         [
@@ -209,8 +208,8 @@ nodeunitShim({
         ],
       ],
     });
-    test.done();
-  },
+
+  });
 });
 
 test('Fn.split with an unknown length resolves to simple {Fn::Split}', () => {
diff --git a/packages/@aws-cdk/core/test/fs/fs-copy.test.ts b/packages/@aws-cdk/core/test/fs/fs-copy.test.ts
index 03ffc770b870c..77e62d7dc58c6 100644
--- a/packages/@aws-cdk/core/test/fs/fs-copy.test.ts
+++ b/packages/@aws-cdk/core/test/fs/fs-copy.test.ts
@@ -1,11 +1,10 @@
 import * as fs from 'fs';
 import * as os from 'os';
 import * as path from 'path';
-import { nodeunitShim, Test } from 'nodeunit-shim';
 import { FileSystem, SymlinkFollowMode } from '../../lib/fs';
 
-nodeunitShim({
-  'Default: copies all files and subdirectories, with default follow mode is "External"'(test: Test) {
+describe('fs copy', () => {
+  test('Default: copies all files and subdirectories, with default follow mode is "External"', () => {
     // GIVEN
     const outdir = fs.mkdtempSync(path.join(os.tmpdir(), 'copy-tests'));
 
@@ -13,7 +12,7 @@ nodeunitShim({
     FileSystem.copyDirectory(path.join(__dirname, 'fixtures', 'test1'), outdir);
 
     // THEN
-    test.deepEqual(tree(outdir), [
+    expect(tree(outdir)).toEqual([
       'external-link.txt',
       'file1.txt',
       'local-link.txt => file1.txt',
@@ -25,10 +24,10 @@ nodeunitShim({
       '    subdir3 (D)',
       '        file3.txt',
     ]);
-    test.done();
-  },
 
-  'Always: follow all symlinks'(test: Test) {
+  });
+
+  test('Always: follow all symlinks', () => {
     // GIVEN
     const outdir = fs.mkdtempSync(path.join(os.tmpdir(), 'copy-tests'));
 
@@ -38,7 +37,7 @@ nodeunitShim({
     });
 
     // THEN
-    test.deepEqual(tree(outdir), [
+    expect(tree(outdir)).toEqual([
       'external-dir-link (D)',
       '    file2.txt',
       'external-link.txt',
@@ -50,10 +49,10 @@ nodeunitShim({
       '    file-in-subdir.txt',
       'normal-file.txt',
     ]);
-    test.done();
-  },
 
-  'Never: do not follow all symlinks'(test: Test) {
+  });
+
+  test('Never: do not follow all symlinks', () => {
     // GIVEN
     const outdir = fs.mkdtempSync(path.join(os.tmpdir(), 'copy-tests'));
 
@@ -63,7 +62,7 @@ nodeunitShim({
     });
 
     // THEN
-    test.deepEqual(tree(outdir), [
+    expect(tree(outdir)).toEqual([
       'external-dir-link => ../test1/subdir',
       'external-link.txt => ../test1/subdir2/subdir3/file3.txt',
       'indirect-external-link.txt => external-link.txt',
@@ -73,10 +72,10 @@ nodeunitShim({
       '    file-in-subdir.txt',
       'normal-file.txt',
     ]);
-    test.done();
-  },
 
-  'External: follow only external symlinks'(test: Test) {
+  });
+
+  test('External: follow only external symlinks', () => {
     // GIVEN
     const outdir = fs.mkdtempSync(path.join(os.tmpdir(), 'copy-tests'));
 
@@ -86,7 +85,7 @@ nodeunitShim({
     });
 
     // THEN
-    test.deepEqual(tree(outdir), [
+    expect(tree(outdir)).toEqual([
       'external-dir-link (D)',
       '    file2.txt',
       'external-link.txt',
@@ -98,10 +97,10 @@ nodeunitShim({
       'normal-file.txt',
     ]);
 
-    test.done();
-  },
 
-  'exclude'(test: Test) {
+  });
+
+  test('exclude', () => {
     // GIVEN
     const outdir = fs.mkdtempSync(path.join(os.tmpdir(), 'copy-tests'));
 
@@ -116,14 +115,14 @@ nodeunitShim({
     });
 
     // THEN
-    test.deepEqual(tree(outdir), [
+    expect(tree(outdir)).toEqual([
       'subdir2 (D)',
       '    empty-subdir (D)',
       '    subdir3 (D)',
       '        file3.txt',
     ]);
-    test.done();
-  },
+
+  });
 });
 
 function tree(dir: string, depth = ''): string[] {
diff --git a/packages/@aws-cdk/core/test/fs/fs-fingerprint.test.ts b/packages/@aws-cdk/core/test/fs/fs-fingerprint.test.ts
index be093c32cbffc..8187778de5453 100644
--- a/packages/@aws-cdk/core/test/fs/fs-fingerprint.test.ts
+++ b/packages/@aws-cdk/core/test/fs/fs-fingerprint.test.ts
@@ -1,13 +1,12 @@
 import * as fs from 'fs';
 import * as os from 'os';
 import * as path from 'path';
-import { nodeunitShim, Test } from 'nodeunit-shim';
 import { FileSystem, SymlinkFollowMode } from '../../lib/fs';
 import { contentFingerprint } from '../../lib/fs/fingerprint';
 
-nodeunitShim({
-  files: {
-    'does not change with the file name'(test: Test) {
+describe('fs fingerprint', () => {
+  describe('files', () => {
+    test('does not change with the file name', () => {
       // GIVEN
       const workdir = fs.mkdtempSync(path.join(os.tmpdir(), 'hash-tests'));
       const content = 'Hello, world!';
@@ -24,12 +23,12 @@ nodeunitShim({
       const hash3 = FileSystem.fingerprint(input3);
 
       // THEN
-      test.deepEqual(hash1, hash2);
-      test.notDeepEqual(hash3, hash1);
-      test.done();
-    },
+      expect(hash1).toEqual(hash2);
+      expect(hash3).not.toEqual(hash1);
 
-    'works on empty files'(test: Test) {
+    });
+
+    test('works on empty files', () => {
       // GIVEN
       const workdir = fs.mkdtempSync(path.join(os.tmpdir(), 'hash-tests'));
       const input1 = path.join(workdir, 'empty');
@@ -42,13 +41,13 @@ nodeunitShim({
       const hash2 = FileSystem.fingerprint(input2);
 
       // THEN
-      test.deepEqual(hash1, hash2);
-      test.done();
-    },
-  },
+      expect(hash1).toEqual(hash2);
+
+    });
+  });
 
-  directories: {
-    'works on directories'(test: Test) {
+  describe('directories', () => {
+    test('works on directories', () => {
       // GIVEN
       const srcdir = path.join(__dirname, 'fixtures', 'symlinks');
       const outdir = fs.mkdtempSync(path.join(os.tmpdir(), 'copy-tests'));
@@ -59,11 +58,11 @@ nodeunitShim({
       const hashCopy = FileSystem.fingerprint(outdir);
 
       // THEN
-      test.deepEqual(hashSrc, hashCopy);
-      test.done();
-    },
+      expect(hashSrc).toEqual(hashCopy);
+
+    });
 
-    'ignores requested files'(test: Test) {
+    test('ignores requested files', () => {
       // GIVEN
       const srcdir = path.join(__dirname, 'fixtures', 'symlinks');
       const outdir = fs.mkdtempSync(path.join(os.tmpdir(), 'copy-tests'));
@@ -76,11 +75,11 @@ nodeunitShim({
       const hashCopy = FileSystem.fingerprint(outdir, { exclude: ['*.ignoreme'] });
 
       // THEN
-      test.deepEqual(hashSrc, hashCopy);
-      test.done();
-    },
+      expect(hashSrc).toEqual(hashCopy);
 
-    'changes with file names'(test: Test) {
+    });
+
+    test('changes with file names', () => {
       // GIVEN
       const srcdir = path.join(__dirname, 'fixtures', 'symlinks');
       const cpydir = fs.mkdtempSync(path.join(os.tmpdir(), 'fingerprint-tests'));
@@ -94,13 +93,13 @@ nodeunitShim({
       const hashCopy = FileSystem.fingerprint(cpydir);
 
       // THEN
-      test.notDeepEqual(hashSrc, hashCopy);
-      test.done();
-    },
-  },
+      expect(hashSrc).not.toEqual(hashCopy);
+
+    });
+  });
 
-  symlinks: {
-    'changes with the contents of followed symlink referent'(test: Test) {
+  describe('symlinks', () => {
+    test('changes with the contents of followed symlink referent', () => {
       // GIVEN
       const dir1 = fs.mkdtempSync(path.join(os.tmpdir(), 'fingerprint-tests'));
       const dir2 = fs.mkdtempSync(path.join(os.tmpdir(), 'fingerprint-tests'));
@@ -123,12 +122,12 @@ nodeunitShim({
       const afterRevert = FileSystem.fingerprint(dir2);
 
       // THEN
-      test.notDeepEqual(original, afterChange);
-      test.deepEqual(afterRevert, original);
-      test.done();
-    },
+      expect(original).not.toEqual(afterChange);
+      expect(afterRevert).toEqual(original);
 
-    'does not change with the contents of un-followed symlink referent'(test: Test) {
+    });
+
+    test('does not change with the contents of un-followed symlink referent', () => {
       // GIVEN
       const dir1 = fs.mkdtempSync(path.join(os.tmpdir(), 'fingerprint-tests'));
       const dir2 = fs.mkdtempSync(path.join(os.tmpdir(), 'fingerprint-tests'));
@@ -151,14 +150,14 @@ nodeunitShim({
       const afterRevert = FileSystem.fingerprint(dir2, { follow: SymlinkFollowMode.NEVER });
 
       // THEN
-      test.deepEqual(original, afterChange);
-      test.deepEqual(afterRevert, original);
-      test.done();
-    },
-  },
-
-  eol: {
-    'normalizes line endings'(test: Test) {
+      expect(original).toEqual(afterChange);
+      expect(afterRevert).toEqual(original);
+
+    });
+  });
+
+  describe('eol', () => {
+    test('normalizes line endings', () => {
       // GIVEN
       const lf = path.join(__dirname, 'eol', 'lf.txt');
       const crlf = path.join(__dirname, 'eol', 'crlf.txt');
@@ -172,11 +171,11 @@ nodeunitShim({
       const lfHash = contentFingerprint(lf);
 
       // THEN
-      test.notEqual(crlfStat.size, lfStat.size); // Difference in size due to different line endings
-      test.deepEqual(crlfHash, lfHash); // Same hash
+      expect(crlfStat.size).not.toEqual(lfStat.size); // Difference in size due to different line endings
+      expect(crlfHash).toEqual(lfHash); // Same hash
 
       fs.unlinkSync(crlf);
-      test.done();
-    },
-  },
+
+    });
+  });
 });
diff --git a/packages/@aws-cdk/core/test/fs/fs.test.ts b/packages/@aws-cdk/core/test/fs/fs.test.ts
index e1e195daa1005..22260f3ec6e27 100644
--- a/packages/@aws-cdk/core/test/fs/fs.test.ts
+++ b/packages/@aws-cdk/core/test/fs/fs.test.ts
@@ -1,17 +1,16 @@
 import * as fs from 'fs';
 import * as os from 'os';
 import * as path from 'path';
-import { nodeunitShim, Test } from 'nodeunit-shim';
 import * as sinon from 'sinon';
 import { FileSystem } from '../../lib/fs';
 
-nodeunitShim({
-  'tearDown'(callback: any) {
+describe('fs', () => {
+  afterEach(() => {
     sinon.restore();
-    callback();
-  },
 
-  'tmpdir returns a real path and is cached'(test: Test) {
+  });
+
+  test('tmpdir returns a real path and is cached', () => {
     // Create symlink that points to /tmp
     const symlinkTmp = path.join(__dirname, 'tmp-link');
     fs.symlinkSync(os.tmpdir(), symlinkTmp);
@@ -19,32 +18,32 @@ nodeunitShim({
     // Now stub os.tmpdir() to return this link instead of /tmp
     const tmpdirStub = sinon.stub(os, 'tmpdir').returns(symlinkTmp);
 
-    test.ok(path.isAbsolute(FileSystem.tmpdir));
+    expect(path.isAbsolute(FileSystem.tmpdir)).toEqual(true);
 
     const p = path.join(FileSystem.tmpdir, 'tmpdir-test.txt');
     fs.writeFileSync(p, 'tmpdir-test');
 
-    test.equal(p, fs.realpathSync(p));
-    test.equal(fs.readFileSync(p, 'utf8'), 'tmpdir-test');
+    expect(p).toEqual(fs.realpathSync(p));
+    expect(fs.readFileSync(p, 'utf8')).toEqual('tmpdir-test');
 
     // check that tmpdir() is called either 0 times (in which case it was
     // proabably cached from before) or once (for this test).
-    test.ok(tmpdirStub.callCount < 2);
+    expect(tmpdirStub.callCount).toBeLessThan(2);
 
     fs.unlinkSync(p);
     fs.unlinkSync(symlinkTmp);
 
-    test.done();
-  },
 
-  'mkdtemp creates a temporary directory in the system temp'(test: Test) {
+  });
+
+  test('mkdtemp creates a temporary directory in the system temp', () => {
     const tmpdir = FileSystem.mkdtemp('cdk-mkdtemp-');
 
-    test.equal(path.dirname(tmpdir), FileSystem.tmpdir);
-    test.ok(fs.existsSync(tmpdir));
+    expect(path.dirname(tmpdir)).toEqual(FileSystem.tmpdir);
+    expect(fs.existsSync(tmpdir)).toEqual(true);
 
     fs.rmdirSync(tmpdir);
 
-    test.done();
-  },
+
+  });
 });
diff --git a/packages/@aws-cdk/core/test/fs/utils.test.ts b/packages/@aws-cdk/core/test/fs/utils.test.ts
index 1eef1b6c83573..898f3368ec6ee 100644
--- a/packages/@aws-cdk/core/test/fs/utils.test.ts
+++ b/packages/@aws-cdk/core/test/fs/utils.test.ts
@@ -1,175 +1,174 @@
 import * as fs from 'fs';
 import * as path from 'path';
-import { nodeunitShim, Test } from 'nodeunit-shim';
 import { ImportMock } from 'ts-mock-imports';
 import { SymlinkFollowMode } from '../../lib/fs';
 import * as util from '../../lib/fs/utils';
 
-nodeunitShim({
-  shouldFollow: {
-    always: {
-      'follows internal'(test: Test) {
+describe('utils', () => {
+  describe('shouldFollow', () => {
+    describe('always', () => {
+      test('follows internal', () => {
         const sourceRoot = path.join('source', 'root');
         const linkTarget = path.join(sourceRoot, 'referent');
 
         const mockFsExists = ImportMock.mockFunction(fs, 'existsSync', true);
         try {
-          test.ok(util.shouldFollow(SymlinkFollowMode.ALWAYS, sourceRoot, linkTarget));
-          test.ok(mockFsExists.calledOnceWith(linkTarget));
-          test.done();
+          expect(util.shouldFollow(SymlinkFollowMode.ALWAYS, sourceRoot, linkTarget)).toEqual(true);
+          expect(mockFsExists.calledOnceWith(linkTarget)).toEqual(true);
+          ;
         } finally {
           mockFsExists.restore();
         }
-      },
+      });
 
-      'follows external'(test: Test) {
+      test('follows external', () => {
         const sourceRoot = path.join('source', 'root');
         const linkTarget = path.join('alternate', 'referent');
         const mockFsExists = ImportMock.mockFunction(fs, 'existsSync', true);
         try {
-          test.ok(util.shouldFollow(SymlinkFollowMode.ALWAYS, sourceRoot, linkTarget));
-          test.ok(mockFsExists.calledOnceWith(linkTarget));
-          test.done();
+          expect(util.shouldFollow(SymlinkFollowMode.ALWAYS, sourceRoot, linkTarget)).toEqual(true);
+          expect(mockFsExists.calledOnceWith(linkTarget)).toEqual(true);
+          ;
         } finally {
           mockFsExists.restore();
         }
-      },
+      });
 
-      'does not follow internal when the referent does not exist'(test: Test) {
+      test('does not follow internal when the referent does not exist', () => {
         const sourceRoot = path.join('source', 'root');
         const linkTarget = path.join(sourceRoot, 'referent');
         const mockFsExists = ImportMock.mockFunction(fs, 'existsSync', false);
         try {
-          test.ok(!util.shouldFollow(SymlinkFollowMode.ALWAYS, sourceRoot, linkTarget));
-          test.ok(mockFsExists.calledOnceWith(linkTarget));
-          test.done();
+          expect(util.shouldFollow(SymlinkFollowMode.ALWAYS, sourceRoot, linkTarget)).toEqual(false);
+          expect(mockFsExists.calledOnceWith(linkTarget)).toEqual(true);
+          ;
         } finally {
           mockFsExists.restore();
         }
-      },
+      });
 
-      'does not follow external when the referent does not exist'(test: Test) {
+      test('does not follow external when the referent does not exist', () => {
         const sourceRoot = path.join('source', 'root');
         const linkTarget = path.join('alternate', 'referent');
         const mockFsExists = ImportMock.mockFunction(fs, 'existsSync', false);
         try {
-          test.ok(!util.shouldFollow(SymlinkFollowMode.ALWAYS, sourceRoot, linkTarget));
-          test.ok(mockFsExists.calledOnceWith(linkTarget));
-          test.done();
+          expect(util.shouldFollow(SymlinkFollowMode.ALWAYS, sourceRoot, linkTarget)).toEqual(false);
+          expect(mockFsExists.calledOnceWith(linkTarget)).toEqual(true);
+          ;
         } finally {
           mockFsExists.restore();
         }
-      },
-    },
+      });
+    });
 
-    external: {
-      'does not follow internal'(test: Test) {
+    describe('external', () => {
+      test('does not follow internal', () => {
         const sourceRoot = path.join('source', 'root');
         const linkTarget = path.join(sourceRoot, 'referent');
         const mockFsExists = ImportMock.mockFunction(fs, 'existsSync');
         try {
-          test.ok(!util.shouldFollow(SymlinkFollowMode.EXTERNAL, sourceRoot, linkTarget));
-          test.ok(mockFsExists.notCalled);
-          test.done();
+          expect(util.shouldFollow(SymlinkFollowMode.EXTERNAL, sourceRoot, linkTarget)).toEqual(false);
+          expect(mockFsExists.notCalled).toEqual(true);
+          ;
         } finally {
           mockFsExists.restore();
         }
-      },
+      });
 
-      'follows external'(test: Test) {
+      test('follows external', () => {
         const sourceRoot = path.join('source', 'root');
         const linkTarget = path.join('alternate', 'referent');
         const mockFsExists = ImportMock.mockFunction(fs, 'existsSync', true);
         try {
-          test.ok(util.shouldFollow(SymlinkFollowMode.EXTERNAL, sourceRoot, linkTarget));
-          test.ok(mockFsExists.calledOnceWith(linkTarget));
-          test.done();
+          expect(util.shouldFollow(SymlinkFollowMode.EXTERNAL, sourceRoot, linkTarget)).toEqual(true);
+          expect(mockFsExists.calledOnceWith(linkTarget)).toEqual(true);
+          ;
         } finally {
           mockFsExists.restore();
         }
-      },
+      });
 
-      'does not follow external when referent does not exist'(test: Test) {
+      test('does not follow external when referent does not exist', () => {
         const sourceRoot = path.join('source', 'root');
         const linkTarget = path.join('alternate', 'referent');
         const mockFsExists = ImportMock.mockFunction(fs, 'existsSync', false);
         try {
-          test.ok(!util.shouldFollow(SymlinkFollowMode.EXTERNAL, sourceRoot, linkTarget));
-          test.ok(mockFsExists.calledOnceWith(linkTarget));
-          test.done();
+          expect(util.shouldFollow(SymlinkFollowMode.EXTERNAL, sourceRoot, linkTarget)).toEqual(false);
+          expect(mockFsExists.calledOnceWith(linkTarget)).toEqual(true);
+          ;
         } finally {
           mockFsExists.restore();
         }
-      },
-    },
+      });
+    });
 
-    blockExternal: {
-      'follows internal'(test: Test) {
+    describe('blockExternal', () => {
+      test('follows internal', () => {
         const sourceRoot = path.join('source', 'root');
         const linkTarget = path.join(sourceRoot, 'referent');
         const mockFsExists = ImportMock.mockFunction(fs, 'existsSync', true);
         try {
-          test.ok(util.shouldFollow(SymlinkFollowMode.BLOCK_EXTERNAL, sourceRoot, linkTarget));
-          test.ok(mockFsExists.calledOnceWith(linkTarget));
-          test.done();
+          expect(util.shouldFollow(SymlinkFollowMode.BLOCK_EXTERNAL, sourceRoot, linkTarget)).toEqual(true);
+          expect(mockFsExists.calledOnceWith(linkTarget)).toEqual(true);
+          ;
         } finally {
           mockFsExists.restore();
         }
-      },
+      });
 
-      'does not follow internal when referent does not exist'(test: Test) {
+      test('does not follow internal when referent does not exist', () => {
         const sourceRoot = path.join('source', 'root');
         const linkTarget = path.join(sourceRoot, 'referent');
         const mockFsExists = ImportMock.mockFunction(fs, 'existsSync', false);
         try {
-          test.ok(!util.shouldFollow(SymlinkFollowMode.BLOCK_EXTERNAL, sourceRoot, linkTarget));
-          test.ok(mockFsExists.calledOnceWith(linkTarget));
-          test.done();
+          expect(util.shouldFollow(SymlinkFollowMode.BLOCK_EXTERNAL, sourceRoot, linkTarget)).toEqual(false);
+          expect(mockFsExists.calledOnceWith(linkTarget)).toEqual(true);
+          ;
         } finally {
           mockFsExists.restore();
         }
-      },
+      });
 
-      'does not follow external'(test: Test) {
+      test('does not follow external', () => {
         const sourceRoot = path.join('source', 'root');
         const linkTarget = path.join('alternate', 'referent');
         const mockFsExists = ImportMock.mockFunction(fs, 'existsSync');
         try {
-          test.ok(!util.shouldFollow(SymlinkFollowMode.BLOCK_EXTERNAL, sourceRoot, linkTarget));
-          test.ok(mockFsExists.notCalled);
-          test.done();
+          expect(util.shouldFollow(SymlinkFollowMode.BLOCK_EXTERNAL, sourceRoot, linkTarget)).toEqual(false);
+          expect(mockFsExists.notCalled).toEqual(true);
+          ;
         } finally {
           mockFsExists.restore();
         }
-      },
-    },
+      });
+    });
 
-    never: {
-      'does not follow internal'(test: Test) {
+    describe('never', () => {
+      test('does not follow internal', () => {
         const sourceRoot = path.join('source', 'root');
         const linkTarget = path.join(sourceRoot, 'referent');
         const mockFsExists = ImportMock.mockFunction(fs, 'existsSync');
         try {
-          test.ok(!util.shouldFollow(SymlinkFollowMode.NEVER, sourceRoot, linkTarget));
-          test.ok(mockFsExists.notCalled);
-          test.done();
+          expect(util.shouldFollow(SymlinkFollowMode.NEVER, sourceRoot, linkTarget)).toEqual(false);
+          expect(mockFsExists.notCalled).toEqual(true);
+          ;
         } finally {
           mockFsExists.restore();
         }
-      },
+      });
 
-      'does not follow external'(test: Test) {
+      test('does not follow external', () => {
         const sourceRoot = path.join('source', 'root');
         const linkTarget = path.join('alternate', 'referent');
         const mockFsExists = ImportMock.mockFunction(fs, 'existsSync');
         try {
-          test.ok(!util.shouldFollow(SymlinkFollowMode.NEVER, sourceRoot, linkTarget));
-          test.ok(mockFsExists.notCalled);
-          test.done();
+          expect(util.shouldFollow(SymlinkFollowMode.NEVER, sourceRoot, linkTarget)).toEqual(false);
+          expect(mockFsExists.notCalled).toEqual(true);
+          ;
         } finally {
           mockFsExists.restore();
         }
-      },
-    },
-  },
+      });
+    });
+  });
 });
diff --git a/packages/@aws-cdk/core/test/include.test.ts b/packages/@aws-cdk/core/test/include.test.ts
index d36dbf8739d19..3973107536bf6 100644
--- a/packages/@aws-cdk/core/test/include.test.ts
+++ b/packages/@aws-cdk/core/test/include.test.ts
@@ -1,14 +1,13 @@
-import { nodeunitShim, Test } from 'nodeunit-shim';
 import { CfnInclude, CfnOutput, CfnParameter, CfnResource, Stack } from '../lib';
 import { toCloudFormation } from './util';
 
-nodeunitShim({
-  'the Include construct can be used to embed an existing template as-is into a stack'(test: Test) {
+describe('include', () => {
+  test('the Include construct can be used to embed an existing template as-is into a stack', () => {
     const stack = new Stack();
 
     new CfnInclude(stack, 'T1', { template: clone(template) });
 
-    test.deepEqual(toCloudFormation(stack), {
+    expect(toCloudFormation(stack)).toEqual({
       Parameters: { MyParam: { Type: 'String', Default: 'Hello' } },
       Resources: {
         MyResource1: { Type: 'ResourceType1', Properties: { P1: 1, P2: 2 } },
@@ -16,10 +15,10 @@ nodeunitShim({
       },
     });
 
-    test.done();
-  },
 
-  'included templates can co-exist with elements created programmatically'(test: Test) {
+  });
+
+  test('included templates can co-exist with elements created programmatically', () => {
     const stack = new Stack();
 
     new CfnInclude(stack, 'T1', { template: clone(template) });
@@ -27,7 +26,7 @@ nodeunitShim({
     new CfnOutput(stack, 'MyOutput', { description: 'Out!', value: 'hey' });
     new CfnParameter(stack, 'MyParam2', { type: 'Integer' });
 
-    test.deepEqual(toCloudFormation(stack), {
+    expect(toCloudFormation(stack)).toEqual({
       Parameters: {
         MyParam: { Type: 'String', Default: 'Hello' },
         MyParam2: { Type: 'Integer' },
@@ -40,10 +39,10 @@ nodeunitShim({
       Outputs: { MyOutput: { Description: 'Out!', Value: 'hey' } },
     });
 
-    test.done();
-  },
 
-  'exception is thrown in construction if an entity from an included template has the same id as a programmatic entity'(test: Test) {
+  });
+
+  test('exception is thrown in construction if an entity from an included template has the same id as a programmatic entity', () => {
     const stack = new Stack();
 
     new CfnInclude(stack, 'T1', { template });
@@ -51,11 +50,11 @@ nodeunitShim({
     new CfnOutput(stack, 'MyOutput', { description: 'Out!', value: 'in' });
     new CfnParameter(stack, 'MyParam', { type: 'Integer' }); // duplicate!
 
-    test.throws(() => toCloudFormation(stack));
-    test.done();
-  },
+    expect(() => toCloudFormation(stack)).toThrow();
+
+  });
 
-  'correctly merges template sections that contain strings'(test: Test) {
+  test('correctly merges template sections that contain strings', () => {
     const stack = new Stack();
 
     new CfnInclude(stack, 'T1', {
@@ -71,13 +70,13 @@ nodeunitShim({
       },
     });
 
-    test.deepEqual(toCloudFormation(stack), {
+    expect(toCloudFormation(stack)).toEqual({
       AWSTemplateFormatVersion: '2010-09-09',
       Description: 'Test 1\nTest 2',
     });
 
-    test.done();
-  },
+
+  });
 });
 
 const template = {
diff --git a/packages/@aws-cdk/core/test/logical-id.test.ts b/packages/@aws-cdk/core/test/logical-id.test.ts
index f4ab0f8eb63d9..bfd2381dc3461 100644
--- a/packages/@aws-cdk/core/test/logical-id.test.ts
+++ b/packages/@aws-cdk/core/test/logical-id.test.ts
@@ -1,12 +1,11 @@
-import { nodeunitShim, Test } from 'nodeunit-shim';
 import { CfnElement, CfnResource, Construct, Stack } from '../lib';
 import { toCloudFormation } from './util';
 
 /**
  * These tests are executed once (for specific ID schemes)
  */
-nodeunitShim({
-  'if the naming scheme uniquifies with a hash we can have the same concatenated identifier'(test: Test) {
+describe('logical id', () => {
+  test('if the naming scheme uniquifies with a hash we can have the same concatenated identifier', () => {
     // GIVEN
     const stack = new Stack(undefined, 'TestStack');
 
@@ -19,10 +18,10 @@ nodeunitShim({
 
     // THEN: no exception
 
-    test.done();
-  },
 
-  'special case: if the resource is top-level, a hash is not added'(test: Test) {
+  });
+
+  test('special case: if the resource is top-level, a hash is not added', () => {
     // GIVEN
     const stack = new Stack(undefined, 'TestStack');
 
@@ -32,14 +31,14 @@ nodeunitShim({
     const r3 = new CfnResource(stack, '*y-'.repeat(255), { type: 'Resource' }); // non-alpha are filtered out (yes, I know it might conflict)
 
     // THEN
-    test.equal(stack.resolve(r.logicalId), 'MyAwesomeness');
-    test.equal(stack.resolve(r2.logicalId), 'x'.repeat(255));
-    test.equal(stack.resolve(r3.logicalId), 'y'.repeat(255));
+    expect(stack.resolve(r.logicalId)).toEqual('MyAwesomeness');
+    expect(stack.resolve(r2.logicalId)).toEqual('x'.repeat(255));
+    expect(stack.resolve(r3.logicalId)).toEqual('y'.repeat(255));
+
 
-    test.done();
-  },
+  });
 
-  'if resource is top-level and logical id is longer than allowed, it is trimmed with a hash'(test: Test) {
+  test('if resource is top-level and logical id is longer than allowed, it is trimmed with a hash', () => {
     // GIVEN
     const stack = new Stack(undefined, 'TestStack');
 
@@ -47,11 +46,11 @@ nodeunitShim({
     const r = new CfnResource(stack, 'x'.repeat(256), { type: 'Resource' });
 
     // THEN
-    test.equals(stack.resolve(r.logicalId), 'x'.repeat(240) + 'C7A139A2');
-    test.done();
-  },
+    expect(stack.resolve(r.logicalId)).toEqual('x'.repeat(240) + 'C7A139A2');
 
-  'Logical IDs can be renamed at the stack level'(test: Test) {
+  });
+
+  test('Logical IDs can be renamed at the stack level', () => {
     // GIVEN
     const stack = new Stack();
 
@@ -62,12 +61,12 @@ nodeunitShim({
 
     // THEN
     const template = toCloudFormation(stack);
-    test.ok('Renamed' in template.Resources);
+    expect('Renamed' in template.Resources).toEqual(true);
+
 
-    test.done();
-  },
+  });
 
-  'Renames for objects that don\'t exist fail'(test: Test) {
+  test('Renames for objects that don\'t exist fail', () => {
     // GIVEN
     const stack = new Stack();
     new Construct(stack, 'Parent');
@@ -76,12 +75,12 @@ nodeunitShim({
     stack.renameLogicalId('DOESNOTEXIST', 'Renamed');
 
     // THEN
-    test.throws(() => toCloudFormation(stack));
+    expect(() => toCloudFormation(stack)).toThrow();
 
-    test.done();
-  },
 
-  'ID Renames that collide with existing IDs should fail'(test: Test) {
+  });
+
+  test('ID Renames that collide with existing IDs should fail', () => {
     // GIVEN
     const stack = new Stack();
     stack.renameLogicalId('ParentThingResource1916E7808', 'ParentThingResource2F19948CB');
@@ -92,11 +91,11 @@ nodeunitShim({
     new CfnResource(parent, 'ThingResource2', { type: 'AWS::TAAS::Thing' });
 
     // THEN
-    test.throws(() => toCloudFormation(stack), /Two objects have been assigned the same Logical ID/);
-    test.done();
-  },
+    expect(() => toCloudFormation(stack)).toThrow(/Two objects have been assigned the same Logical ID/);
+
+  });
 
-  'hashed naming scheme filters constructs named "Resource" from the human portion'(test: Test) {
+  test('hashed naming scheme filters constructs named "Resource" from the human portion', () => {
     // GIVEN
     const stack = new Stack();
 
@@ -109,7 +108,7 @@ nodeunitShim({
 
     // THEN
     const template = toCloudFormation(stack);
-    test.deepEqual(template, {
+    expect(template).toEqual({
       Resources: {
         ParentChildHeyThere35220347: {
           Type: 'AWS::TAAS::Thing',
@@ -117,10 +116,10 @@ nodeunitShim({
       },
     });
 
-    test.done();
-  },
 
-  'can transparently wrap constructs using "Default" id'(test: Test) {
+  });
+
+  test('can transparently wrap constructs using "Default" id', () => {
     // GIVEN
     const stack1 = new Stack();
     const parent1 = new Construct(stack1, 'Parent');
@@ -129,7 +128,7 @@ nodeunitShim({
 
     // AND
     const theId1 = Object.keys(template1.Resources)[0];
-    test.equal('AWS::TAAS::Thing', template1.Resources[theId1].Type);
+    expect('AWS::TAAS::Thing').toEqual(template1.Resources[theId1].Type);
 
     // WHEN
     const stack2 = new Stack();
@@ -139,33 +138,33 @@ nodeunitShim({
     const template2 = toCloudFormation(stack1);
 
     const theId2 = Object.keys(template2.Resources)[0];
-    test.equal('AWS::TAAS::Thing', template2.Resources[theId2].Type);
+    expect('AWS::TAAS::Thing').toEqual(template2.Resources[theId2].Type);
 
     // THEN: same ID, same object
-    test.equal(theId1, theId2);
+    expect(theId1).toEqual(theId2);
+
 
-    test.done();
-  },
+  });
 
-  'non-alphanumeric characters are removed from the human part of the logical ID'(test: Test) {
+  test('non-alphanumeric characters are removed from the human part of the logical ID', () => {
     const val1 = logicalForElementInPath(['Foo-bar', 'B00m', 'Hello_World', '&&Horray Horray.']);
     const val2 = logicalForElementInPath(['Foobar', 'B00m', 'HelloWorld', 'HorrayHorray']);
 
     // same human part, different hash
-    test.deepEqual(val1, 'FoobarB00mHelloWorldHorrayHorray640E99FB');
-    test.deepEqual(val2, 'FoobarB00mHelloWorldHorrayHorray744334FD');
-    test.done();
-  },
+    expect(val1).toEqual('FoobarB00mHelloWorldHorrayHorray640E99FB');
+    expect(val2).toEqual('FoobarB00mHelloWorldHorrayHorray744334FD');
 
-  'non-alphanumeric characters are removed even if the ID has only one component'(test: Test) {
+  });
+
+  test('non-alphanumeric characters are removed even if the ID has only one component', () => {
     const val1 = logicalForElementInPath(['Foo-bar']);
 
     // same human part, different hash
-    test.deepEqual(val1, 'Foobar');
-    test.done();
-  },
+    expect(val1).toEqual('Foobar');
+
+  });
 
-  'empty identifiers are not allowed'(test: Test) {
+  test('empty identifiers are not allowed', () => {
     // GIVEN
     const stack = new Stack();
 
@@ -173,11 +172,11 @@ nodeunitShim({
     new CfnResource(stack, '.', { type: 'R' });
 
     // THEN
-    test.throws(() => toCloudFormation(stack), /Logical ID must adhere to the regular expression/);
-    test.done();
-  },
+    expect(() => toCloudFormation(stack)).toThrow(/Logical ID must adhere to the regular expression/);
 
-  'too large identifiers are truncated yet still remain unique'(test: Test) {
+  });
+
+  test('too large identifiers are truncated yet still remain unique', () => {
     // GIVEN
     const stack = new Stack();
     const A = new Construct(stack, generateString(100));
@@ -192,14 +191,14 @@ nodeunitShim({
     const C2 = new CfnResource(B, firstPart + generateString(40), { type: 'Resource' });
 
     // THEN
-    test.ok(C1.logicalId.length <= 255);
-    test.ok(C2.logicalId.length <= 255);
-    test.notEqual(C1, C2);
+    expect(C1.logicalId.length).toBeLessThanOrEqual(255);
+    expect(C2.logicalId.length).toBeLessThanOrEqual(255);
+    expect(C1).not.toEqual(C2);
+
 
-    test.done();
-  },
+  });
 
-  'Refs and dependencies will correctly reflect renames done at the stack level'(test: Test) {
+  test('Refs and dependencies will correctly reflect renames done at the stack level', () => {
     // GIVEN
     const stack = new Stack();
     stack.renameLogicalId('OriginalName', 'NewName');
@@ -212,7 +211,7 @@ nodeunitShim({
     c2.node.addDependency(c1);
 
     // THEN
-    test.deepEqual(toCloudFormation(stack), {
+    expect(toCloudFormation(stack)).toEqual({
       Resources: {
         NewName: { Type: 'R1' },
         Construct2: {
@@ -223,10 +222,10 @@ nodeunitShim({
       },
     });
 
-    test.done();
-  },
 
-  'customize logical id allocation behavior by overriding `Stack.allocateLogicalId`'(test: Test) {
+  });
+
+  test('customize logical id allocation behavior by overriding `Stack.allocateLogicalId`', () => {
     class MyStack extends Stack {
       protected allocateLogicalId(element: CfnElement): string {
         if (element.node.id === 'A') { return 'LogicalIdOfA'; }
@@ -246,17 +245,17 @@ nodeunitShim({
     const c = new CfnResource(stack, 'B', { type: 'Type::Of::C' });
     c.overrideLogicalId('TheC');
 
-    test.deepEqual(toCloudFormation(stack), {
+    expect(toCloudFormation(stack)).toEqual({
       Resources: {
         LogicalIdOfA: { Type: 'Type::Of::A' },
         BoomBoomB: { Type: 'Type::Of::B' },
         TheC: { Type: 'Type::Of::C' },
       },
     });
-    test.done();
-  },
 
-  'detects duplicate logical IDs in the same Stack caused by overrideLogicalId'(test: Test) {
+  });
+
+  test('detects duplicate logical IDs in the same Stack caused by overrideLogicalId', () => {
     const stack = new Stack();
     const resource1 = new CfnResource(stack, 'A', { type: 'Type::Of::A' });
     const resource2 = new CfnResource(stack, 'B', { type: 'Type::Of::B' });
@@ -264,12 +263,12 @@ nodeunitShim({
     resource1.overrideLogicalId('C');
     resource2.overrideLogicalId('C');
 
-    test.throws(() => {
+    expect(() => {
       toCloudFormation(stack);
-    }, /section 'Resources' already contains 'C'/);
+    }).toThrow(/section 'Resources' already contains 'C'/);
+
 
-    test.done();
-  },
+  });
 });
 
 function generateString(chars: number) {
diff --git a/packages/@aws-cdk/core/test/mappings.test.ts b/packages/@aws-cdk/core/test/mappings.test.ts
index 4b2e15c4d4bf2..7d1964f60bfe8 100644
--- a/packages/@aws-cdk/core/test/mappings.test.ts
+++ b/packages/@aws-cdk/core/test/mappings.test.ts
@@ -1,11 +1,10 @@
 import { ArtifactMetadataEntryType } from '@aws-cdk/cloud-assembly-schema';
 import { CloudAssembly } from '@aws-cdk/cx-api';
-import { nodeunitShim, Test } from 'nodeunit-shim';
 import { App, Aws, CfnMapping, CfnResource, Fn, Stack } from '../lib';
 import { toCloudFormation } from './util';
 
-nodeunitShim({
-  'mappings can be added as another type of entity, and mapping.findInMap can be used to get a token'(test: Test) {
+describe('mappings', () => {
+  test('mappings can be added as another type of entity, and mapping.findInMap can be used to get a token', () => {
     const stack = new Stack();
     const mapping = new CfnMapping(stack, 'MyMapping', {
       mapping: {
@@ -26,14 +25,14 @@ nodeunitShim({
         RefToValueInMap: mapping.findInMap('TopLevelKey1', 'SecondLevelKey1'),
       },
     });
-    test.throws(() => mapping.findInMap('NotFoundTopLevel', 'NotFound'), 'Mapping doesn\'t contain top-level key \'NotFoundTopLevel\'');
-    test.throws(() => mapping.findInMap('TopLevelKey1', 'NotFound'), 'Mapping doesn\'t contain second-level key \'NotFound\'');
+    expect(() => mapping.findInMap('NotFoundTopLevel', 'NotFound')).toThrow('Mapping doesn\'t contain top-level key \'NotFoundTopLevel\'');
+    expect(() => mapping.findInMap('TopLevelKey1', 'NotFound')).toThrow('Mapping doesn\'t contain second-level key \'NotFound\'');
 
     // set value can be used to set/modify a specific value
     mapping.setValue('TopLevelKey2', 'SecondLevelKey2', 'Hi');
     mapping.setValue('TopLevelKey1', 'SecondLevelKey1', [1, 2, 3, 4]);
 
-    test.deepEqual(toCloudFormation(stack), {
+    expect(toCloudFormation(stack)).toEqual({
       Mappings:
       {
         MyMapping:
@@ -60,10 +59,10 @@ nodeunitShim({
       },
     });
 
-    test.done();
-  },
 
-  'allow using unresolved tokens in find-in-map'(test: Test) {
+  });
+
+  test('allow using unresolved tokens in find-in-map', () => {
     const stack = new Stack();
 
     const mapping = new CfnMapping(stack, 'mapping', {
@@ -78,19 +77,19 @@ nodeunitShim({
     const v2 = Fn.findInMap(mapping.logicalId, 'instanceCount', Aws.REGION);
 
     const expected = { 'Fn::FindInMap': ['mapping', 'instanceCount', { Ref: 'AWS::Region' }] };
-    test.deepEqual(stack.resolve(v1), expected);
-    test.deepEqual(stack.resolve(v2), expected);
-    test.deepEqual(toCloudFormation(stack).Mappings, {
+    expect(stack.resolve(v1)).toEqual(expected);
+    expect(stack.resolve(v2)).toEqual(expected);
+    expect(toCloudFormation(stack).Mappings).toEqual({
       mapping: {
         instanceCount: {
           'us-east-1': 12,
         },
       },
     });
-    test.done();
-  },
 
-  'no validation if first key is token and second is a static string'(test: Test) {
+  });
+
+  test('no validation if first key is token and second is a static string', () => {
     // GIVEN
     const stack = new Stack();
     const mapping = new CfnMapping(stack, 'mapping', {
@@ -105,20 +104,20 @@ nodeunitShim({
     const v = mapping.findInMap(Aws.REGION, 'size');
 
     // THEN
-    test.deepEqual(stack.resolve(v), {
+    expect(stack.resolve(v)).toEqual({
       'Fn::FindInMap': ['mapping', { Ref: 'AWS::Region' }, 'size'],
     });
-    test.deepEqual(toCloudFormation(stack).Mappings, {
+    expect(toCloudFormation(stack).Mappings).toEqual({
       mapping: {
         'us-east-1': {
           size: 12,
         },
       },
     });
-    test.done();
-  },
 
-  'validate first key if it is a string and second is a token'(test: Test) {
+  });
+
+  test('validate first key if it is a string and second is a token', () => {
     // GIVEN
     const stack = new Stack();
     const mapping = new CfnMapping(stack, 'mapping', {
@@ -133,17 +132,17 @@ nodeunitShim({
     const v = mapping.findInMap('size', Aws.REGION);
 
     // THEN
-    test.throws(() => mapping.findInMap('not-found', Aws.REGION), /Mapping doesn't contain top-level key 'not-found'/);
-    test.deepEqual(stack.resolve(v), { 'Fn::FindInMap': ['mapping', 'size', { Ref: 'AWS::Region' }] });
-    test.deepEqual(toCloudFormation(stack).Mappings, {
+    expect(() => mapping.findInMap('not-found', Aws.REGION)).toThrow(/Mapping doesn't contain top-level key 'not-found'/);
+    expect(stack.resolve(v)).toEqual({ 'Fn::FindInMap': ['mapping', 'size', { Ref: 'AWS::Region' }] });
+    expect(toCloudFormation(stack).Mappings).toEqual({
       mapping: {
         size: {
           'us-east-1': 12,
         },
       },
     });
-    test.done();
-  },
+
+  });
 });
 
 describe('lazy mapping', () => {
diff --git a/packages/@aws-cdk/core/test/output.test.ts b/packages/@aws-cdk/core/test/output.test.ts
index 0359049756946..5cc22d474cb2f 100644
--- a/packages/@aws-cdk/core/test/output.test.ts
+++ b/packages/@aws-cdk/core/test/output.test.ts
@@ -1,4 +1,3 @@
-import { nodeunitShim, Test } from 'nodeunit-shim';
 import { App, CfnOutput, CfnResource, ConstructNode, Stack, ValidationError } from '../lib';
 import { toCloudFormation } from './util';
 
@@ -9,8 +8,8 @@ beforeEach(() => {
   stack = new Stack(app, 'Stack');
 });
 
-nodeunitShim({
-  'outputs can be added to the stack'(test: Test) {
+describe('output', () => {
+  test('outputs can be added to the stack', () => {
     const res = new CfnResource(stack, 'MyResource', { type: 'R' });
     const ref = res.ref;
 
@@ -19,7 +18,7 @@ nodeunitShim({
       value: ref,
       description: 'CfnOutput properties',
     });
-    test.deepEqual(toCloudFormation(stack), {
+    expect(toCloudFormation(stack)).toEqual({
       Resources: { MyResource: { Type: 'R' } },
       Outputs:
      {
@@ -31,15 +30,15 @@ nodeunitShim({
       },
      },
     });
-    test.done();
-  },
 
-  'No export is created by default'(test: Test) {
+  });
+
+  test('No export is created by default', () => {
     // WHEN
     new CfnOutput(stack, 'SomeOutput', { value: 'x' });
 
     // THEN
-    test.deepEqual(toCloudFormation(stack), {
+    expect(toCloudFormation(stack)).toEqual({
       Outputs: {
         SomeOutput: {
           Value: 'x',
@@ -47,10 +46,10 @@ nodeunitShim({
       },
     });
 
-    test.done();
-  },
 
-  'importValue can be used to obtain a Fn::ImportValue expression'(test: Test) {
+  });
+
+  test('importValue can be used to obtain a Fn::ImportValue expression', () => {
     // GIVEN
     const stack2 = new Stack(app, 'Stack2');
 
@@ -64,7 +63,7 @@ nodeunitShim({
     });
 
     // THEN
-    test.deepEqual(toCloudFormation(stack2), {
+    expect(toCloudFormation(stack2)).toEqual({
       Resources: {
         Resource: {
           Type: 'Some::Resource',
@@ -75,10 +74,10 @@ nodeunitShim({
       },
     });
 
-    test.done();
-  },
 
-  'importValue used inside the same stack produces an error'(test: Test) {
+  });
+
+  test('importValue used inside the same stack produces an error', () => {
     // WHEN
     const output = new CfnOutput(stack, 'SomeOutput', { value: 'x', exportName: 'asdf' });
     new CfnResource(stack, 'Resource', {
@@ -91,10 +90,10 @@ nodeunitShim({
     // THEN
     expect(() => toCloudFormation(stack)).toThrow(/should only be used in a different Stack/);
 
-    test.done();
-  },
 
-  'error message if importValue is used and Output is not exported'(test: Test) {
+  });
+
+  test('error message if importValue is used and Output is not exported', () => {
     // GIVEN
     const stack2 = new Stack(app, 'Stack2');
 
@@ -107,14 +106,14 @@ nodeunitShim({
       },
     });
 
-    test.throws(() => {
+    expect(() => {
       toCloudFormation(stack2);
-    }, /Add an exportName to the CfnOutput/);
+    }).toThrow(/Add an exportName to the CfnOutput/);
+
 
-    test.done();
-  },
+  });
 
-  'Verify maximum length of export name'(test: Test) {
+  test('Verify maximum length of export name', () => {
     new CfnOutput(stack, 'SomeOutput', { value: 'x', exportName: 'x'.repeat(260) });
 
     const errors = ConstructNode.validate(stack.node).map((v: ValidationError) => v.message);
@@ -123,6 +122,6 @@ nodeunitShim({
       expect.stringContaining('Export name cannot exceed 255 characters'),
     ]);
 
-    test.done();
-  },
+
+  });
 });
diff --git a/packages/@aws-cdk/core/test/parameter.test.ts b/packages/@aws-cdk/core/test/parameter.test.ts
index d13edbffddb0a..ff5015717713b 100644
--- a/packages/@aws-cdk/core/test/parameter.test.ts
+++ b/packages/@aws-cdk/core/test/parameter.test.ts
@@ -1,9 +1,8 @@
-import { nodeunitShim, Test } from 'nodeunit-shim';
 import { CfnParameter, CfnResource, Construct, Stack } from '../lib';
 import { toCloudFormation } from './util';
 
-nodeunitShim({
-  'parameters can be used and referenced using param.ref'(test: Test) {
+describe('parameter', () => {
+  test('parameters can be used and referenced using param.ref', () => {
     const stack = new Stack();
 
     const child = new Construct(stack, 'Child');
@@ -15,7 +14,7 @@ nodeunitShim({
 
     new CfnResource(stack, 'Resource', { type: 'Type', properties: { ReferenceToParam: param.value } });
 
-    test.deepEqual(toCloudFormation(stack), {
+    expect(toCloudFormation(stack)).toEqual({
       Parameters: {
         ChildMyParam3161BF5D: {
           Default: 10,
@@ -31,14 +30,14 @@ nodeunitShim({
       },
     });
 
-    test.done();
-  },
 
-  'parameters are tokens, so they can be assigned without .ref and their Ref will be taken'(test: Test) {
+  });
+
+  test('parameters are tokens, so they can be assigned without .ref and their Ref will be taken', () => {
     const stack = new Stack();
     const param = new CfnParameter(stack, 'MyParam', { type: 'String' });
 
-    test.deepEqual(stack.resolve(param), { Ref: 'MyParam' });
-    test.done();
-  },
+    expect(stack.resolve(param)).toEqual({ Ref: 'MyParam' });
+
+  });
 });
diff --git a/packages/@aws-cdk/core/test/private/physical-name-generator.test.ts b/packages/@aws-cdk/core/test/private/physical-name-generator.test.ts
index 22539e435b214..87412c7074188 100644
--- a/packages/@aws-cdk/core/test/private/physical-name-generator.test.ts
+++ b/packages/@aws-cdk/core/test/private/physical-name-generator.test.ts
@@ -1,23 +1,22 @@
-import { nodeunitShim, Test } from 'nodeunit-shim';
 import { App, Aws, Lazy, Resource, Stack, Token } from '../../lib';
 import { GeneratedWhenNeededMarker, generatePhysicalName, isGeneratedWhenNeededMarker } from '../../lib/private/physical-name-generator';
 
-nodeunitShim({
-  generatePhysicalName: {
-    'generates correct physical names'(test: Test) {
+describe('physical name generator', () => {
+  describe('generatePhysicalName', () => {
+    test('generates correct physical names', () => {
       const app = new App();
       const stack = new Stack(app, 'TestStack', { env: { account: '012345678912', region: 'bermuda-triangle-1' } });
 
       const testResourceA = new TestResource(stack, 'A');
       const testResourceB = new TestResource(testResourceA, 'B');
 
-      test.equal(generatePhysicalName(testResourceA), 'teststackteststackaa164c141d59b37c1b663');
-      test.equal(generatePhysicalName(testResourceB), 'teststackteststackab27595cd34d8188283a1f');
+      expect(generatePhysicalName(testResourceA)).toEqual('teststackteststackaa164c141d59b37c1b663');
+      expect(generatePhysicalName(testResourceB)).toEqual('teststackteststackab27595cd34d8188283a1f');
 
-      test.done();
-    },
 
-    'generates different names in different accounts'(test: Test) {
+    });
+
+    test('generates different names in different accounts', () => {
       const appA = new App();
       const stackA = new Stack(appA, 'TestStack', { env: { account: '012345678912', region: 'bermuda-triangle-1' } });
       const resourceA = new TestResource(stackA, 'Resource');
@@ -26,12 +25,12 @@ nodeunitShim({
       const stackB = new Stack(appB, 'TestStack', { env: { account: '012345678913', region: 'bermuda-triangle-1' } });
       const resourceB = new TestResource(stackB, 'Resource');
 
-      test.notEqual(generatePhysicalName(resourceA), generatePhysicalName(resourceB));
+      expect(generatePhysicalName(resourceA)).not.toEqual(generatePhysicalName(resourceB));
+
 
-      test.done();
-    },
+    });
 
-    'generates different names in different regions'(test: Test) {
+    test('generates different names in different regions', () => {
       const appA = new App();
       const stackA = new Stack(appA, 'TestStack', { env: { account: '012345678912', region: 'bermuda-triangle-1' } });
       const resourceA = new TestResource(stackA, 'Resource');
@@ -40,84 +39,84 @@ nodeunitShim({
       const stackB = new Stack(appB, 'TestStack', { env: { account: '012345678912', region: 'bermuda-triangle-2' } });
       const resourceB = new TestResource(stackB, 'Resource');
 
-      test.notEqual(generatePhysicalName(resourceA), generatePhysicalName(resourceB));
+      expect(generatePhysicalName(resourceA)).not.toEqual(generatePhysicalName(resourceB));
+
 
-      test.done();
-    },
+    });
 
-    'fails when the region is an unresolved token'(test: Test) {
+    test('fails when the region is an unresolved token', () => {
       const app = new App();
       const stack = new Stack(app, 'TestStack', { env: { account: '012345678912', region: Aws.REGION } });
       const testResource = new TestResource(stack, 'A');
 
-      test.throws(() => generatePhysicalName(testResource),
+      expect(() => generatePhysicalName(testResource)).toThrow(
         /Cannot generate a physical name for TestStack\/A, because the region is un-resolved or missing/);
 
-      test.done();
-    },
 
-    'fails when the region is not provided'(test: Test) {
+    });
+
+    test('fails when the region is not provided', () => {
       const app = new App();
       const stack = new Stack(app, 'TestStack', { env: { account: '012345678912' } });
       const testResource = new TestResource(stack, 'A');
 
-      test.throws(() => generatePhysicalName(testResource),
+      expect(() => generatePhysicalName(testResource)).toThrow(
         /Cannot generate a physical name for TestStack\/A, because the region is un-resolved or missing/);
 
-      test.done();
-    },
 
-    'fails when the account is an unresolved token'(test: Test) {
+    });
+
+    test('fails when the account is an unresolved token', () => {
       const app = new App();
       const stack = new Stack(app, 'TestStack', { env: { account: Aws.ACCOUNT_ID, region: 'bermuda-triangle-1' } });
       const testResource = new TestResource(stack, 'A');
 
-      test.throws(() => generatePhysicalName(testResource),
+      expect(() => generatePhysicalName(testResource)).toThrow(
         /Cannot generate a physical name for TestStack\/A, because the account is un-resolved or missing/);
 
-      test.done();
-    },
 
-    'fails when the account is not provided'(test: Test) {
+    });
+
+    test('fails when the account is not provided', () => {
       const app = new App();
       const stack = new Stack(app, 'TestStack', { env: { region: 'bermuda-triangle-1' } });
       const testResource = new TestResource(stack, 'A');
 
-      test.throws(() => generatePhysicalName(testResource),
+      expect(() => generatePhysicalName(testResource)).toThrow(
         /Cannot generate a physical name for TestStack\/A, because the account is un-resolved or missing/);
 
-      test.done();
-    },
-  },
 
-  GeneratedWhenNeededMarker: {
-    'is correctly recognized'(test: Test) {
+    });
+  });
+
+  describe('GeneratedWhenNeededMarker', () => {
+    test('is correctly recognized', () => {
       const marker = new GeneratedWhenNeededMarker();
       const asString = Token.asString(marker);
 
-      test.ok(isGeneratedWhenNeededMarker(asString));
+      expect(isGeneratedWhenNeededMarker(asString)).toEqual(true);
+
 
-      test.done();
-    },
+    });
 
-    'throws when resolved'(test: Test) {
+    test('throws when resolved', () => {
       const marker = new GeneratedWhenNeededMarker();
       const asString = Token.asString(marker);
 
-      test.throws(() => new Stack().resolve(asString), /Use "this.physicalName" instead/);
+      expect(() => new Stack().resolve(asString)).toThrow(/Use "this.physicalName" instead/);
+
+
+    });
+  });
 
-      test.done();
-    },
-  },
+  describe('isGeneratedWhenNeededMarker', () => {
+    test('correctly response for other tokens', () => {
+      expect(isGeneratedWhenNeededMarker('this is not even a token!')).toEqual(false);
+      expect(isGeneratedWhenNeededMarker(Lazy.string({ produce: () => 'Bazinga!' }))).toEqual(false);
 
-  isGeneratedWhenNeededMarker: {
-    'correctly response for other tokens'(test: Test) {
-      test.ok(!isGeneratedWhenNeededMarker('this is not even a token!'));
-      test.ok(!isGeneratedWhenNeededMarker(Lazy.string({ produce: () => 'Bazinga!' })));
 
-      test.done();
-    },
-  },
+    });
+  });
 });
 
 class TestResource extends Resource {}
diff --git a/packages/@aws-cdk/core/test/private/tree-metadata.test.ts b/packages/@aws-cdk/core/test/private/tree-metadata.test.ts
index b7173aca585ec..752d6f3fc5f42 100644
--- a/packages/@aws-cdk/core/test/private/tree-metadata.test.ts
+++ b/packages/@aws-cdk/core/test/private/tree-metadata.test.ts
@@ -1,7 +1,6 @@
 import * as fs from 'fs';
 import * as path from 'path';
 import * as cxschema from '@aws-cdk/cloud-assembly-schema';
-import { nodeunitShim, Test } from 'nodeunit-shim';
 import { App, CfnParameter, CfnResource, Construct as CfnConstruct, Lazy, Stack, TreeInspector } from '../../lib/index';
 
 abstract class AbstractCfnResource extends CfnResource {
@@ -19,8 +18,8 @@ abstract class AbstractCfnResource extends CfnResource {
   protected abstract get cfnProperties(): { [key: string]: any };
 }
 
-nodeunitShim({
-  'tree metadata is generated as expected'(test: Test) {
+describe('tree metadata', () => {
+  test('tree metadata is generated as expected', () => {
     const app = new App();
 
     const stack = new Stack(app, 'mystack');
@@ -28,9 +27,9 @@ nodeunitShim({
 
     const assembly = app.synth();
     const treeArtifact = assembly.tree();
-    test.ok(treeArtifact);
+    expect(treeArtifact).toBeDefined();
 
-    test.deepEqual(readJson(assembly.directory, treeArtifact!.file), {
+    expect(readJson(assembly.directory, treeArtifact!.file)).toEqual({
       version: 'tree-0.1',
       tree: expect.objectContaining({
         id: 'App',
@@ -53,10 +52,10 @@ nodeunitShim({
         },
       }),
     });
-    test.done();
-  },
 
-  'tree metadata for a Cfn resource'(test: Test) {
+  });
+
+  test('tree metadata for a Cfn resource', () => {
     class MyCfnResource extends AbstractCfnResource {
       protected get cfnProperties(): { [key: string]: any } {
         return {
@@ -76,9 +75,9 @@ nodeunitShim({
 
     const assembly = app.synth();
     const treeArtifact = assembly.tree();
-    test.ok(treeArtifact);
+    expect(treeArtifact).toBeDefined();
 
-    test.deepEqual(readJson(assembly.directory, treeArtifact!.file), {
+    expect(readJson(assembly.directory, treeArtifact!.file)).toEqual({
       version: 'tree-0.1',
       tree: expect.objectContaining({
         id: 'App',
@@ -112,10 +111,10 @@ nodeunitShim({
         },
       }),
     });
-    test.done();
-  },
 
-  'tree metadata has construct class & version in there'(test: Test) {
+  });
+
+  test('tree metadata has construct class & version in there', () => {
     // The runtime metadata this test relies on is only available if the most
     // recent compile has happened using 'jsii', as the jsii compiler injects
     // this metadata.
@@ -143,11 +142,11 @@ nodeunitShim({
 
     const assembly = app.synth();
     const treeArtifact = assembly.tree();
-    test.ok(treeArtifact);
+    expect(treeArtifact).toBeDefined();
 
     const codeBuild = !!process.env.CODEBUILD_BUILD_ID;
 
-    test.deepEqual(readJson(assembly.directory, treeArtifact!.file), {
+    expect(readJson(assembly.directory, treeArtifact!.file)).toEqual({
       version: 'tree-0.1',
       tree: expect.objectContaining({
         children: expect.objectContaining({
@@ -169,10 +168,10 @@ nodeunitShim({
       }),
     });
 
-    test.done();
-  },
 
-  'token resolution & cfn parameter'(test: Test) {
+  });
+
+  test('token resolution & cfn parameter', () => {
     const app = new App();
     const stack = new Stack(app, 'mystack');
     const cfnparam = new CfnParameter(stack, 'mycfnparam');
@@ -190,9 +189,9 @@ nodeunitShim({
 
     const assembly = app.synth();
     const treeArtifact = assembly.tree();
-    test.ok(treeArtifact);
+    expect(treeArtifact).toBeDefined();
 
-    test.deepEqual(readJson(assembly.directory, treeArtifact!.file), {
+    expect(readJson(assembly.directory, treeArtifact!.file)).toEqual({
       version: 'tree-0.1',
       tree: expect.objectContaining({
         id: 'App',
@@ -226,10 +225,10 @@ nodeunitShim({
         },
       }),
     });
-    test.done();
-  },
 
-  'cross-stack tokens'(test: Test) {
+  });
+
+  test('cross-stack tokens', () => {
     class MyFirstResource extends AbstractCfnResource {
       public readonly lazykey: string;
 
@@ -268,9 +267,9 @@ nodeunitShim({
 
     const assembly = app.synth();
     const treeArtifact = assembly.tree();
-    test.ok(treeArtifact);
+    expect(treeArtifact).toBeDefined();
 
-    test.deepEqual(readJson(assembly.directory, treeArtifact!.file), {
+    expect(readJson(assembly.directory, treeArtifact!.file)).toEqual({
       version: 'tree-0.1',
       tree: expect.objectContaining({
         id: 'App',
@@ -316,10 +315,10 @@ nodeunitShim({
       }),
     });
 
-    test.done();
-  },
 
-  'failing nodes'(test: Test) {
+  });
+
+  test('failing nodes', () => {
     class MyCfnResource extends CfnResource {
       public inspect(_: TreeInspector) {
         throw new Error('Forcing an inspect error');
@@ -334,7 +333,7 @@ nodeunitShim({
 
     const assembly = app.synth();
     const treeArtifact = assembly.tree();
-    test.ok(treeArtifact);
+    expect(treeArtifact).toBeDefined();
 
     const treenode = app.node.findChild('Tree');
 
@@ -343,10 +342,10 @@ nodeunitShim({
         && /Forcing an inspect error/.test(md.data as string)
         && /mycfnresource/.test(md.data as string);
     });
-    test.ok(warn);
+    expect(warn).toBeDefined();
 
     // assert that the rest of the construct tree is rendered
-    test.deepEqual(readJson(assembly.directory, treeArtifact!.file), {
+    expect(readJson(assembly.directory, treeArtifact!.file)).toEqual({
       version: 'tree-0.1',
       tree: expect.objectContaining({
         id: 'App',
@@ -364,8 +363,8 @@ nodeunitShim({
       }),
     });
 
-    test.done();
-  },
+
+  });
 });
 
 function readJson(outdir: string, file: string) {
diff --git a/packages/@aws-cdk/core/test/resource.test.ts b/packages/@aws-cdk/core/test/resource.test.ts
index 4fbe41692756d..5e46f9918c2a8 100644
--- a/packages/@aws-cdk/core/test/resource.test.ts
+++ b/packages/@aws-cdk/core/test/resource.test.ts
@@ -1,5 +1,4 @@
 import * as cxapi from '@aws-cdk/cx-api';
-import { nodeunitShim, Test } from 'nodeunit-shim';
 import {
   App, App as Root, CfnCondition,
   CfnDeletionPolicy, CfnResource, Construct,
@@ -8,8 +7,8 @@ import {
 import { synthesize } from '../lib/private/synthesis';
 import { toCloudFormation } from './util';
 
-nodeunitShim({
-  'all resources derive from Resource, which derives from Entity'(test: Test) {
+describe('resource', () => {
+  test('all resources derive from Resource, which derives from Entity', () => {
     const stack = new Stack();
 
     new CfnResource(stack, 'MyResource', {
@@ -19,7 +18,7 @@ nodeunitShim({
       },
     });
 
-    test.deepEqual(toCloudFormation(stack), {
+    expect(toCloudFormation(stack)).toEqual({
       Resources: {
         MyResource: {
           Type: 'MyResourceType',
@@ -31,16 +30,16 @@ nodeunitShim({
       },
     });
 
-    test.done();
-  },
 
-  'resources must reside within a Stack and fail upon creation if not'(test: Test) {
+  });
+
+  test('resources must reside within a Stack and fail upon creation if not', () => {
     const root = new Root();
-    test.throws(() => new CfnResource(root, 'R1', { type: 'ResourceType' }));
-    test.done();
-  },
+    expect(() => new CfnResource(root, 'R1', { type: 'ResourceType' })).toThrow();
 
-  'all entities have a logical ID calculated based on their full path in the tree'(test: Test) {
+  });
+
+  test('all entities have a logical ID calculated based on their full path in the tree', () => {
     const stack = new Stack(undefined, 'TestStack');
     const level1 = new Construct(stack, 'level1');
     const level2 = new Construct(level1, 'level2');
@@ -48,28 +47,28 @@ nodeunitShim({
     const res1 = new CfnResource(level1, 'childoflevel1', { type: 'MyResourceType1' });
     const res2 = new CfnResource(level3, 'childoflevel3', { type: 'MyResourceType2' });
 
-    test.equal(withoutHash(stack.resolve(res1.logicalId)), 'level1childoflevel1');
-    test.equal(withoutHash(stack.resolve(res2.logicalId)), 'level1level2level3childoflevel3');
+    expect(withoutHash(stack.resolve(res1.logicalId))).toEqual('level1childoflevel1');
+    expect(withoutHash(stack.resolve(res2.logicalId))).toEqual('level1level2level3childoflevel3');
 
-    test.done();
-  },
 
-  'resource.props can only be accessed by derived classes'(test: Test) {
+  });
+
+  test('resource.props can only be accessed by derived classes', () => {
     const stack = new Stack();
     const res = new Counter(stack, 'MyResource', { Count: 10 });
     res.increment();
     res.increment(2);
 
-    test.deepEqual(toCloudFormation(stack), {
+    expect(toCloudFormation(stack)).toEqual({
       Resources: {
         MyResource: { Type: 'My::Counter', Properties: { Count: 13 } },
       },
     });
 
-    test.done();
-  },
 
-  'resource attributes can be retrieved using getAtt(s) or attribute properties'(test: Test) {
+  });
+
+  test('resource attributes can be retrieved using getAtt(s) or attribute properties', () => {
     const stack = new Stack();
     const res = new Counter(stack, 'MyResource', { Count: 10 });
 
@@ -82,7 +81,7 @@ nodeunitShim({
       },
     });
 
-    test.deepEqual(toCloudFormation(stack), {
+    expect(toCloudFormation(stack)).toEqual({
       Resources: {
         MyResource: { Type: 'My::Counter', Properties: { Count: 10 } },
         YourResource: {
@@ -96,10 +95,10 @@ nodeunitShim({
       },
     });
 
-    test.done();
-  },
 
-  'ARN-type resource attributes have some common functionality'(test: Test) {
+  });
+
+  test('ARN-type resource attributes have some common functionality', () => {
     const stack = new Stack();
     const res = new Counter(stack, 'MyResource', { Count: 1 });
     new CfnResource(stack, 'MyResource2', {
@@ -109,7 +108,7 @@ nodeunitShim({
       },
     });
 
-    test.deepEqual(toCloudFormation(stack), {
+    expect(toCloudFormation(stack)).toEqual({
       Resources: {
         MyResource: { Type: 'My::Counter', Properties: { Count: 1 } },
         MyResource2: {
@@ -123,10 +122,10 @@ nodeunitShim({
       },
     });
 
-    test.done();
-  },
 
-  'resource.addDependency(e) can be used to add a DependsOn on another resource'(test: Test) {
+  });
+
+  test('resource.addDependency(e) can be used to add a DependsOn on another resource', () => {
     const stack = new Stack();
     const r1 = new Counter(stack, 'Counter1', { Count: 1 });
     const r2 = new Counter(stack, 'Counter2', { Count: 1 });
@@ -136,7 +135,7 @@ nodeunitShim({
 
     synthesize(stack);
 
-    test.deepEqual(toCloudFormation(stack), {
+    expect(toCloudFormation(stack)).toEqual({
       Resources: {
         Counter1: {
           Type: 'My::Counter',
@@ -154,10 +153,10 @@ nodeunitShim({
       },
     });
 
-    test.done();
-  },
 
-  'if addDependency is called multiple times with the same resource, it will only appear once'(test: Test) {
+  });
+
+  test('if addDependency is called multiple times with the same resource, it will only appear once', () => {
     // GIVEN
     const stack = new Stack();
     const r1 = new Counter(stack, 'Counter1', { Count: 1 });
@@ -171,7 +170,7 @@ nodeunitShim({
     dependent.addDependsOn(r1);
 
     // THEN
-    test.deepEqual(toCloudFormation(stack), {
+    expect(toCloudFormation(stack)).toEqual({
       Resources: {
         Counter1: {
           Type: 'My::Counter',
@@ -187,24 +186,24 @@ nodeunitShim({
         },
       },
     });
-    test.done();
-  },
 
-  'conditions can be attached to a resource'(test: Test) {
+  });
+
+  test('conditions can be attached to a resource', () => {
     const stack = new Stack();
     const r1 = new CfnResource(stack, 'Resource', { type: 'Type' });
     const cond = new CfnCondition(stack, 'MyCondition', { expression: Fn.conditionNot(Fn.conditionEquals('a', 'b')) });
     r1.cfnOptions.condition = cond;
 
-    test.deepEqual(toCloudFormation(stack), {
+    expect(toCloudFormation(stack)).toEqual({
       Resources: { Resource: { Type: 'Type', Condition: 'MyCondition' } },
       Conditions: { MyCondition: { 'Fn::Not': [{ 'Fn::Equals': ['a', 'b'] }] } },
     });
 
-    test.done();
-  },
 
-  'creation/update/updateReplace/deletion policies can be set on a resource'(test: Test) {
+  });
+
+  test('creation/update/updateReplace/deletion policies can be set on a resource', () => {
     const stack = new Stack();
     const r1 = new CfnResource(stack, 'Resource', { type: 'Type' });
 
@@ -222,7 +221,7 @@ nodeunitShim({
     r1.cfnOptions.deletionPolicy = CfnDeletionPolicy.RETAIN;
     r1.cfnOptions.updateReplacePolicy = CfnDeletionPolicy.SNAPSHOT;
 
-    test.deepEqual(toCloudFormation(stack), {
+    expect(toCloudFormation(stack)).toEqual({
       Resources: {
         Resource: {
           Type: 'Type',
@@ -242,16 +241,16 @@ nodeunitShim({
       },
     });
 
-    test.done();
-  },
 
-  'update policies UseOnlineResharding flag'(test: Test) {
+  });
+
+  test('update policies UseOnlineResharding flag', () => {
     const stack = new Stack();
     const r1 = new CfnResource(stack, 'Resource', { type: 'Type' });
 
     r1.cfnOptions.updatePolicy = { useOnlineResharding: true };
 
-    test.deepEqual(toCloudFormation(stack), {
+    expect(toCloudFormation(stack)).toEqual({
       Resources: {
         Resource: {
           Type: 'Type',
@@ -262,10 +261,10 @@ nodeunitShim({
       },
     });
 
-    test.done();
-  },
 
-  'metadata can be set on a resource'(test: Test) {
+  });
+
+  test('metadata can be set on a resource', () => {
     const stack = new Stack();
     const r1 = new CfnResource(stack, 'Resource', { type: 'Type' });
 
@@ -274,7 +273,7 @@ nodeunitShim({
       MyValue: 99,
     };
 
-    test.deepEqual(toCloudFormation(stack), {
+    expect(toCloudFormation(stack)).toEqual({
       Resources: {
         Resource: {
           Type: 'Type',
@@ -286,16 +285,16 @@ nodeunitShim({
       },
     });
 
-    test.done();
-  },
 
-  'the "type" property is required when creating a resource'(test: Test) {
+  });
+
+  test('the "type" property is required when creating a resource', () => {
     const stack = new Stack();
-    test.throws(() => new CfnResource(stack, 'Resource', { notypehere: true } as any));
-    test.done();
-  },
+    expect(() => new CfnResource(stack, 'Resource', { notypehere: true } as any)).toThrow();
+
+  });
 
-  'removal policy is a high level abstraction of deletion policy used by l2'(test: Test) {
+  test('removal policy is a high level abstraction of deletion policy used by l2', () => {
     const stack = new Stack();
 
     const retain = new CfnResource(stack, 'Retain', { type: 'T1' });
@@ -308,7 +307,7 @@ nodeunitShim({
     def.applyRemovalPolicy(undefined, { default: RemovalPolicy.DESTROY });
     def2.applyRemovalPolicy(undefined);
 
-    test.deepEqual(toCloudFormation(stack), {
+    expect(toCloudFormation(stack)).toEqual({
       Resources: {
         Retain: { Type: 'T1', DeletionPolicy: 'Retain', UpdateReplacePolicy: 'Retain' },
         Destroy: { Type: 'T3', DeletionPolicy: 'Delete', UpdateReplacePolicy: 'Delete' },
@@ -316,10 +315,10 @@ nodeunitShim({
         Default2: { Type: 'T4', DeletionPolicy: 'Retain', UpdateReplacePolicy: 'Retain' }, // implicit default
       },
     });
-    test.done();
-  },
 
-  'addDependency adds all dependencyElements of dependent constructs'(test: Test) {
+  });
+
+  test('addDependency adds all dependencyElements of dependent constructs', () => {
 
     class C1 extends Construct {
       public readonly r1: CfnResource;
@@ -364,7 +363,7 @@ nodeunitShim({
 
     synthesize(stack);
 
-    test.deepEqual(toCloudFormation(stack), {
+    expect(toCloudFormation(stack)).toEqual({
       Resources:
       {
         MyC1R1FB2A562F: { Type: 'T1' },
@@ -382,19 +381,19 @@ nodeunitShim({
         },
       },
     });
-    test.done();
-  },
 
-  'resource.ref returns the {Ref} token'(test: Test) {
+  });
+
+  test('resource.ref returns the {Ref} token', () => {
     const stack = new Stack();
     const r = new CfnResource(stack, 'MyResource', { type: 'R' });
 
-    test.deepEqual(stack.resolve(r.ref), { Ref: 'MyResource' });
-    test.done();
-  },
+    expect(stack.resolve(r.ref)).toEqual({ Ref: 'MyResource' });
+
+  });
 
-  overrides: {
-    'addOverride(p, v) allows assigning arbitrary values to synthesized resource definitions'(test: Test) {
+  describe('overrides', () => {
+    test('addOverride(p, v) allows assigning arbitrary values to synthesized resource definitions', () => {
       // GIVEN
       const stack = new Stack();
       const r = new CfnResource(stack, 'MyResource', { type: 'AWS::Resource::Type' });
@@ -405,7 +404,7 @@ nodeunitShim({
       r.addOverride('Use.Dot.Notation', 'To create subtrees');
 
       // THEN
-      test.deepEqual(toCloudFormation(stack), {
+      expect(toCloudFormation(stack)).toEqual({
         Resources:
         {
           MyResource:
@@ -417,10 +416,10 @@ nodeunitShim({
         },
       });
 
-      test.done();
-    },
 
-    'addPropertyOverride() allows assigning an attribute of a different resource'(test: Test) {
+    });
+
+    test('addPropertyOverride() allows assigning an attribute of a different resource', () => {
       // GIVEN
       const stack = new Stack();
       const r1 = new CfnResource(stack, 'MyResource1', { type: 'AWS::Resource::Type' });
@@ -432,7 +431,7 @@ nodeunitShim({
       });
 
       // THEN
-      test.deepEqual(toCloudFormation(stack), {
+      expect(toCloudFormation(stack)).toEqual({
         Resources: {
           MyResource1: {
             Type: 'AWS::Resource::Type',
@@ -448,10 +447,10 @@ nodeunitShim({
         },
       });
 
-      test.done();
-    },
 
-    'addOverride(p, null) will assign an "null" value'(test: Test) {
+    });
+
+    test('addOverride(p, null) will assign an "null" value', () => {
       // GIVEN
       const stack = new Stack();
 
@@ -471,7 +470,7 @@ nodeunitShim({
       r.addOverride('Properties.Hello.World.Value2', null);
 
       // THEN
-      test.deepEqual(toCloudFormation(stack), {
+      expect(toCloudFormation(stack)).toEqual({
         Resources:
         {
           MyResource:
@@ -482,10 +481,10 @@ nodeunitShim({
         },
       });
 
-      test.done();
-    },
 
-    'addOverride(p, undefined) can be used to delete a value'(test: Test) {
+    });
+
+    test('addOverride(p, undefined) can be used to delete a value', () => {
       // GIVEN
       const stack = new Stack();
 
@@ -505,7 +504,7 @@ nodeunitShim({
       r.addOverride('Properties.Hello.World.Value2', undefined);
 
       // THEN
-      test.deepEqual(toCloudFormation(stack), {
+      expect(toCloudFormation(stack)).toEqual({
         Resources:
         {
           MyResource:
@@ -516,10 +515,10 @@ nodeunitShim({
         },
       });
 
-      test.done();
-    },
 
-    'addOverride(p, undefined) will not create empty trees'(test: Test) {
+    });
+
+    test('addOverride(p, undefined) will not create empty trees', () => {
       // GIVEN
       const stack = new Stack();
 
@@ -530,7 +529,7 @@ nodeunitShim({
       r.addPropertyOverride('Tree.Does.Not.Exist', undefined);
 
       // THEN
-      test.deepEqual(toCloudFormation(stack), {
+      expect(toCloudFormation(stack)).toEqual({
         Resources:
         {
           MyResource:
@@ -541,10 +540,10 @@ nodeunitShim({
         },
       });
 
-      test.done();
-    },
 
-    'addDeletionOverride(p) and addPropertyDeletionOverride(pp) are sugar for `undefined`'(test: Test) {
+    });
+
+    test('addDeletionOverride(p) and addPropertyDeletionOverride(pp) are sugar for `undefined`', () => {
       // GIVEN
       const stack = new Stack();
 
@@ -566,7 +565,7 @@ nodeunitShim({
       r.addPropertyDeletionOverride('Hello.World.Value3');
 
       // THEN
-      test.deepEqual(toCloudFormation(stack), {
+      expect(toCloudFormation(stack)).toEqual({
         Resources:
         {
           MyResource:
@@ -577,10 +576,10 @@ nodeunitShim({
         },
       });
 
-      test.done();
-    },
 
-    'addOverride(p, v) will overwrite any non-objects along the path'(test: Test) {
+    });
+
+    test('addOverride(p, v) will overwrite any non-objects along the path', () => {
       // GIVEN
       const stack = new Stack();
       const r = new CfnResource(stack, 'MyResource', {
@@ -598,7 +597,7 @@ nodeunitShim({
       r.addOverride('Properties.Hello.World.Foo.Bar', 42);
 
       // THEN
-      test.deepEqual(toCloudFormation(stack), {
+      expect(toCloudFormation(stack)).toEqual({
         Resources:
         {
           MyResource:
@@ -614,10 +613,10 @@ nodeunitShim({
           },
         },
       });
-      test.done();
-    },
 
-    'addOverride(p, v) will not split on escaped dots'(test: Test) {
+    });
+
+    test('addOverride(p, v) will not split on escaped dots', () => {
       // GIVEN
       const stack = new Stack();
       const r = new CfnResource(stack, 'MyResource', { type: 'AWS::Resource::Type' });
@@ -630,7 +629,7 @@ nodeunitShim({
       r.addOverride('Properties.EndWith\\', 42); // Raw string cannot end with a backslash
 
       // THEN
-      test.deepEqual(toCloudFormation(stack), {
+      expect(toCloudFormation(stack)).toEqual({
         Resources:
         {
           MyResource:
@@ -647,10 +646,10 @@ nodeunitShim({
           },
         },
       });
-      test.done();
-    },
 
-    'addPropertyOverride(pp, v) is a sugar for overriding properties'(test: Test) {
+    });
+
+    test('addPropertyOverride(pp, v) is a sugar for overriding properties', () => {
       // GIVEN
       const stack = new Stack();
       const r = new CfnResource(stack, 'MyResource', {
@@ -662,7 +661,7 @@ nodeunitShim({
       r.addPropertyOverride('Hello.World', { Hey: 'Jude' });
 
       // THEN
-      test.deepEqual(toCloudFormation(stack), {
+      expect(toCloudFormation(stack)).toEqual({
         Resources:
         {
           MyResource:
@@ -672,10 +671,10 @@ nodeunitShim({
           },
         },
       });
-      test.done();
-    },
 
-    'overrides are applied after render'(test: Test) {
+    });
+
+    test('overrides are applied after render', () => {
       // GIVEN
       class MyResource extends CfnResource {
         public renderProperties() {
@@ -690,7 +689,7 @@ nodeunitShim({
       cfn.addOverride('Properties.Foo.Bar', 'Bar');
 
       // THEN
-      test.deepEqual(toCloudFormation(stack), {
+      expect(toCloudFormation(stack)).toEqual({
         Resources: {
           rr: {
             Type: 'AWS::Resource::Type',
@@ -704,12 +703,12 @@ nodeunitShim({
           },
         },
       });
-      test.done();
-    },
 
-    'using mutable properties': {
+    });
+
+    describe('using mutable properties', () => {
 
-      'can be used by derived classes to specify overrides before render()'(test: Test) {
+      test('can be used by derived classes to specify overrides before render()', () => {
         const stack = new Stack();
 
         const r = new CustomizableResource(stack, 'MyResource', {
@@ -718,7 +717,7 @@ nodeunitShim({
 
         r.prop2 = 'bar';
 
-        test.deepEqual(toCloudFormation(stack), {
+        expect(toCloudFormation(stack)).toEqual({
           Resources:
           {
             MyResource:
@@ -728,17 +727,17 @@ nodeunitShim({
             },
           },
         });
-        test.done();
-      },
 
-      '"properties" is undefined'(test: Test) {
+      });
+
+      test('"properties" is undefined', () => {
         const stack = new Stack();
 
         const r = new CustomizableResource(stack, 'MyResource');
 
         r.prop3 = 'zoo';
 
-        test.deepEqual(toCloudFormation(stack), {
+        expect(toCloudFormation(stack)).toEqual({
           Resources:
           {
             MyResource:
@@ -748,10 +747,10 @@ nodeunitShim({
             },
           },
         });
-        test.done();
-      },
 
-      '"properties" is empty'(test: Test) {
+      });
+
+      test('"properties" is empty', () => {
         const stack = new Stack();
 
         const r = new CustomizableResource(stack, 'MyResource', { });
@@ -759,7 +758,7 @@ nodeunitShim({
         r.prop3 = 'zoo';
         r.prop2 = 'hey';
 
-        test.deepEqual(toCloudFormation(stack), {
+        expect(toCloudFormation(stack)).toEqual({
           Resources:
           {
             MyResource:
@@ -769,12 +768,12 @@ nodeunitShim({
             },
           },
         });
-        test.done();
-      },
-    },
-  },
 
-  '"aws:cdk:path" metadata is added if "aws:cdk:path-metadata" context is set to true'(test: Test) {
+      });
+    });
+  });
+
+  test('"aws:cdk:path" metadata is added if "aws:cdk:path-metadata" context is set to true', () => {
     const stack = new Stack();
     stack.node.setContext(cxapi.PATH_METADATA_ENABLE_CONTEXT, true);
 
@@ -784,7 +783,7 @@ nodeunitShim({
       type: 'MyResourceType',
     });
 
-    test.deepEqual(toCloudFormation(stack), {
+    expect(toCloudFormation(stack)).toEqual({
       Resources:
       {
         ParentMyResource4B1FDBCC:
@@ -795,10 +794,10 @@ nodeunitShim({
       },
     });
 
-    test.done();
-  },
 
-  'cross-stack construct dependencies are not rendered but turned into stack dependencies'(test: Test) {
+  });
+
+  test('cross-stack construct dependencies are not rendered but turned into stack dependencies', () => {
     // GIVEN
     const app = new App();
     const stackA = new Stack(app, 'StackA');
@@ -813,7 +812,7 @@ nodeunitShim({
     const assembly = app.synth();
     const templateB = assembly.getStackByName(stackB.stackName).template;
 
-    test.deepEqual(templateB, {
+    expect(templateB).toEqual({
       Resources: {
         Resource: {
           Type: 'R',
@@ -821,12 +820,12 @@ nodeunitShim({
         },
       },
     });
-    test.deepEqual(stackB.dependencies.map(s => s.node.id), ['StackA']);
+    expect(stackB.dependencies.map(s => s.node.id)).toEqual(['StackA']);
 
-    test.done();
-  },
 
-  'enableVersionUpgrade can be set on a resource'(test: Test) {
+  });
+
+  test('enableVersionUpgrade can be set on a resource', () => {
     const stack = new Stack();
     const r1 = new CfnResource(stack, 'Resource', { type: 'Type' });
 
@@ -834,7 +833,7 @@ nodeunitShim({
       enableVersionUpgrade: true,
     };
 
-    test.deepEqual(toCloudFormation(stack), {
+    expect(toCloudFormation(stack)).toEqual({
       Resources: {
         Resource: {
           Type: 'Type',
@@ -845,8 +844,8 @@ nodeunitShim({
       },
     });
 
-    test.done();
-  },
+
+  });
 });
 
 test('Resource can get account and Region from ARN', () => {
diff --git a/packages/@aws-cdk/core/test/rule.test.ts b/packages/@aws-cdk/core/test/rule.test.ts
index 637f204235f83..4914e7a7d271a 100644
--- a/packages/@aws-cdk/core/test/rule.test.ts
+++ b/packages/@aws-cdk/core/test/rule.test.ts
@@ -1,16 +1,15 @@
-import { nodeunitShim, Test } from 'nodeunit-shim';
 import { CfnRule, Fn, Stack } from '../lib';
 import { toCloudFormation } from './util';
 
-nodeunitShim({
-  'Rule can be used to create rules'(test: Test) {
+describe('rule', () => {
+  test('Rule can be used to create rules', () => {
     const stack = new Stack();
 
     const rule = new CfnRule(stack, 'MyRule');
     rule.addAssertion(Fn.conditionEquals('lhs', 'rhs'), 'lhs equals rhs');
     rule.addAssertion(Fn.conditionNot(Fn.conditionAnd(Fn.conditionContains(['hello', 'world'], 'world'))), 'some assertion');
 
-    test.deepEqual(toCloudFormation(stack), {
+    expect(toCloudFormation(stack)).toEqual({
       Rules: {
         MyRule: {
           Assertions: [
@@ -27,22 +26,22 @@ nodeunitShim({
       },
     });
 
-    test.done();
-  },
 
-  'a template can contain multiple Rules'(test: Test) {
+  });
+
+  test('a template can contain multiple Rules', () => {
     const stack = new Stack();
 
     new CfnRule(stack, 'Rule1');
     new CfnRule(stack, 'Rule2');
 
-    test.deepEqual(toCloudFormation(stack), {
+    expect(toCloudFormation(stack)).toEqual({
       Rules: {
         Rule1: {},
         Rule2: {},
       },
     });
 
-    test.done();
-  },
+
+  });
 });
diff --git a/packages/@aws-cdk/core/test/secret-value.test.ts b/packages/@aws-cdk/core/test/secret-value.test.ts
index 7a119d3534a9b..a32702b98771d 100644
--- a/packages/@aws-cdk/core/test/secret-value.test.ts
+++ b/packages/@aws-cdk/core/test/secret-value.test.ts
@@ -1,8 +1,7 @@
-import { nodeunitShim, Test } from 'nodeunit-shim';
 import { CfnDynamicReference, CfnDynamicReferenceService, CfnParameter, SecretValue, Stack } from '../lib';
 
-nodeunitShim({
-  'plainText'(test: Test) {
+describe('secret value', () => {
+  test('plainText', () => {
     // GIVEN
     const stack = new Stack();
 
@@ -10,11 +9,11 @@ nodeunitShim({
     const v = SecretValue.plainText('this just resolves to a string');
 
     // THEN
-    test.deepEqual(stack.resolve(v), 'this just resolves to a string');
-    test.done();
-  },
+    expect(stack.resolve(v)).toEqual('this just resolves to a string');
 
-  'secretsManager'(test: Test) {
+  });
+
+  test('secretsManager', () => {
     // GIVEN
     const stack = new Stack();
 
@@ -25,11 +24,11 @@ nodeunitShim({
     });
 
     // THEN
-    test.deepEqual(stack.resolve(v), '{{resolve:secretsmanager:secret-id:SecretString:json-key:version-stage:}}');
-    test.done();
-  },
+    expect(stack.resolve(v)).toEqual('{{resolve:secretsmanager:secret-id:SecretString:json-key:version-stage:}}');
+
+  });
 
-  'secretsManager with defaults'(test: Test) {
+  test('secretsManager with defaults', () => {
     // GIVEN
     const stack = new Stack();
 
@@ -37,33 +36,33 @@ nodeunitShim({
     const v = SecretValue.secretsManager('secret-id');
 
     // THEN
-    test.deepEqual(stack.resolve(v), '{{resolve:secretsmanager:secret-id:SecretString:::}}');
-    test.done();
-  },
+    expect(stack.resolve(v)).toEqual('{{resolve:secretsmanager:secret-id:SecretString:::}}');
+
+  });
 
-  'secretsManager with an empty ID'(test: Test) {
-    test.throws(() => SecretValue.secretsManager(''), /secretId cannot be empty/);
-    test.done();
-  },
+  test('secretsManager with an empty ID', () => {
+    expect(() => SecretValue.secretsManager('')).toThrow(/secretId cannot be empty/);
 
-  'secretsManager with versionStage and versionId'(test: Test) {
-    test.throws(() => {
+  });
+
+  test('secretsManager with versionStage and versionId', () => {
+    expect(() => {
       SecretValue.secretsManager('secret-id',
         {
           versionStage: 'version-stage',
           versionId: 'version-id',
         });
-    }, /were both provided but only one is allowed/);
+    }).toThrow(/were both provided but only one is allowed/);
+
 
-    test.done();
-  },
+  });
 
-  'secretsManager with a non-ARN ID that has colon'(test: Test) {
-    test.throws(() => SecretValue.secretsManager('not:an:arn'), /is not an ARN but contains ":"/);
-    test.done();
-  },
+  test('secretsManager with a non-ARN ID that has colon', () => {
+    expect(() => SecretValue.secretsManager('not:an:arn')).toThrow(/is not an ARN but contains ":"/);
 
-  'ssmSecure'(test: Test) {
+  });
+
+  test('ssmSecure', () => {
     // GIVEN
     const stack = new Stack();
 
@@ -71,11 +70,11 @@ nodeunitShim({
     const v = SecretValue.ssmSecure('param-name', 'param-version');
 
     // THEN
-    test.deepEqual(stack.resolve(v), '{{resolve:ssm-secure:param-name:param-version}}');
-    test.done();
-  },
+    expect(stack.resolve(v)).toEqual('{{resolve:ssm-secure:param-name:param-version}}');
+
+  });
 
-  'cfnDynamicReference'(test: Test) {
+  test('cfnDynamicReference', () => {
     // GIVEN
     const stack = new Stack();
 
@@ -83,11 +82,11 @@ nodeunitShim({
     const v = SecretValue.cfnDynamicReference(new CfnDynamicReference(CfnDynamicReferenceService.SSM, 'foo:bar'));
 
     // THEN
-    test.deepEqual(stack.resolve(v), '{{resolve:ssm:foo:bar}}');
-    test.done();
-  },
+    expect(stack.resolve(v)).toEqual('{{resolve:ssm:foo:bar}}');
+
+  });
 
-  'cfnParameter (with NoEcho)'(test: Test) {
+  test('cfnParameter (with NoEcho)', () => {
     // GIVEN
     const stack = new Stack();
     const p = new CfnParameter(stack, 'MyParam', { type: 'String', noEcho: true });
@@ -96,17 +95,17 @@ nodeunitShim({
     const v = SecretValue.cfnParameter(p);
 
     // THEN
-    test.deepEqual(stack.resolve(v), { Ref: 'MyParam' });
-    test.done();
-  },
+    expect(stack.resolve(v)).toEqual({ Ref: 'MyParam' });
 
-  'fails if cfnParameter does not have NoEcho'(test: Test) {
+  });
+
+  test('fails if cfnParameter does not have NoEcho', () => {
     // GIVEN
     const stack = new Stack();
     const p = new CfnParameter(stack, 'MyParam', { type: 'String' });
 
     // THEN
-    test.throws(() => SecretValue.cfnParameter(p), /CloudFormation parameter must be configured with "NoEcho"/);
-    test.done();
-  },
+    expect(() => SecretValue.cfnParameter(p)).toThrow(/CloudFormation parameter must be configured with "NoEcho"/);
+
+  });
 });
diff --git a/packages/@aws-cdk/core/test/size.test.ts b/packages/@aws-cdk/core/test/size.test.ts
index 288db78304f2a..9801fc8f53acf 100644
--- a/packages/@aws-cdk/core/test/size.test.ts
+++ b/packages/@aws-cdk/core/test/size.test.ts
@@ -1,120 +1,118 @@
-import { nodeunitShim, Test } from 'nodeunit-shim';
 import { Size, SizeRoundingBehavior, Stack, Token } from '../lib';
 
-nodeunitShim({
-  'negative amount'(test: Test) {
-    test.throws(() => Size.kibibytes(-1), /negative/);
+describe('size', () => {
+  test('negative amount', () => {
+    expect(() => Size.kibibytes(-1)).toThrow(/negative/);
 
-    test.done();
-  },
 
-  'unresolved amount'(test: Test) {
+  });
+
+  test('unresolved amount', () => {
     const stack = new Stack();
     const lazySize = Size.kibibytes(Token.asNumber({ resolve: () => 1337 }));
-    test.equals(stack.resolve(lazySize.toKibibytes()), 1337);
-    test.throws(
-      () => stack.resolve(lazySize.toMebibytes()),
+    expect(stack.resolve(lazySize.toKibibytes())).toEqual(1337);
+    expect(
+      () => stack.resolve(lazySize.toMebibytes())).toThrow(
       /Unable to perform time unit conversion on un-resolved token/,
     );
 
-    test.done();
-  },
 
-  'Size in kibibytes'(test: Test) {
+  });
+
+  test('Size in kibibytes', () => {
     const size = Size.kibibytes(4_294_967_296);
 
-    test.equal(size.toKibibytes(), 4_294_967_296);
-    test.equal(size.toMebibytes(), 4_194_304);
-    test.equal(size.toGibibytes(), 4_096);
-    test.equal(size.toTebibytes(), 4);
-    test.throws(() => size.toPebibytes(), /'4294967296 kibibytes' cannot be converted into a whole number/);
-    floatEqual(test, size.toPebibytes({ rounding: SizeRoundingBehavior.NONE }), 4_294_967_296 / (1024 * 1024 * 1024 * 1024));
+    expect(size.toKibibytes()).toEqual(4_294_967_296);
+    expect(size.toMebibytes()).toEqual(4_194_304);
+    expect(size.toGibibytes()).toEqual(4_096);
+    expect(size.toTebibytes()).toEqual(4);
+    expect(() => size.toPebibytes()).toThrow(/'4294967296 kibibytes' cannot be converted into a whole number/);
+    floatEqual(size.toPebibytes({ rounding: SizeRoundingBehavior.NONE }), 4_294_967_296 / (1024 * 1024 * 1024 * 1024));
 
-    test.equal(Size.kibibytes(4 * 1024 * 1024).toGibibytes(), 4);
+    expect(Size.kibibytes(4 * 1024 * 1024).toGibibytes()).toEqual(4);
 
-    test.done();
-  },
 
-  'Size in mebibytes'(test: Test) {
+  });
+
+  test('Size in mebibytes', () => {
     const size = Size.mebibytes(4_194_304);
 
-    test.equal(size.toKibibytes(), 4_294_967_296);
-    test.equal(size.toMebibytes(), 4_194_304);
-    test.equal(size.toGibibytes(), 4_096);
-    test.equal(size.toTebibytes(), 4);
-    test.throws(() => size.toPebibytes(), /'4194304 mebibytes' cannot be converted into a whole number/);
-    floatEqual(test, size.toPebibytes({ rounding: SizeRoundingBehavior.NONE }), 4_194_304 / (1024 * 1024 * 1024));
+    expect(size.toKibibytes()).toEqual(4_294_967_296);
+    expect(size.toMebibytes()).toEqual(4_194_304);
+    expect(size.toGibibytes()).toEqual(4_096);
+    expect(size.toTebibytes()).toEqual(4);
+    expect(() => size.toPebibytes()).toThrow(/'4194304 mebibytes' cannot be converted into a whole number/);
+    floatEqual(size.toPebibytes({ rounding: SizeRoundingBehavior.NONE }), 4_194_304 / (1024 * 1024 * 1024));
+
+    expect(Size.mebibytes(4 * 1024).toGibibytes()).toEqual(4);
 
-    test.equal(Size.mebibytes(4 * 1024).toGibibytes(), 4);
 
-    test.done();
-  },
+  });
 
-  'Size in gibibyte'(test: Test) {
+  test('Size in gibibyte', () => {
     const size = Size.gibibytes(5);
 
-    test.equal(size.toKibibytes(), 5_242_880);
-    test.equal(size.toMebibytes(), 5_120);
-    test.equal(size.toGibibytes(), 5);
-    test.throws(() => size.toTebibytes(), /'5 gibibytes' cannot be converted into a whole number/);
-    floatEqual(test, size.toTebibytes({ rounding: SizeRoundingBehavior.NONE }), 5 / 1024);
-    test.throws(() => size.toPebibytes(), /'5 gibibytes' cannot be converted into a whole number/);
-    floatEqual(test, size.toPebibytes({ rounding: SizeRoundingBehavior.NONE }), 5 / (1024 * 1024));
+    expect(size.toKibibytes()).toEqual(5_242_880);
+    expect(size.toMebibytes()).toEqual(5_120);
+    expect(size.toGibibytes()).toEqual(5);
+    expect(() => size.toTebibytes()).toThrow(/'5 gibibytes' cannot be converted into a whole number/);
+    floatEqual(size.toTebibytes({ rounding: SizeRoundingBehavior.NONE }), 5 / 1024);
+    expect(() => size.toPebibytes()).toThrow(/'5 gibibytes' cannot be converted into a whole number/);
+    floatEqual(size.toPebibytes({ rounding: SizeRoundingBehavior.NONE }), 5 / (1024 * 1024));
 
-    test.equal(Size.gibibytes(4096).toTebibytes(), 4);
+    expect(Size.gibibytes(4096).toTebibytes()).toEqual(4);
 
-    test.done();
-  },
 
-  'Size in tebibyte'(test: Test) {
+  });
+
+  test('Size in tebibyte', () => {
     const size = Size.tebibytes(5);
 
-    test.equal(size.toKibibytes(), 5_368_709_120);
-    test.equal(size.toMebibytes(), 5_242_880);
-    test.equal(size.toGibibytes(), 5_120);
-    test.equal(size.toTebibytes(), 5);
-    test.throws(() => size.toPebibytes(), /'5 tebibytes' cannot be converted into a whole number/);
-    floatEqual(test, size.toPebibytes({ rounding: SizeRoundingBehavior.NONE }), 5 / 1024);
+    expect(size.toKibibytes()).toEqual(5_368_709_120);
+    expect(size.toMebibytes()).toEqual(5_242_880);
+    expect(size.toGibibytes()).toEqual(5_120);
+    expect(size.toTebibytes()).toEqual(5);
+    expect(() => size.toPebibytes()).toThrow(/'5 tebibytes' cannot be converted into a whole number/);
+    floatEqual(size.toPebibytes({ rounding: SizeRoundingBehavior.NONE }), 5 / 1024);
+
+    expect(Size.tebibytes(4096).toPebibytes()).toEqual(4);
 
-    test.equal(Size.tebibytes(4096).toPebibytes(), 4);
 
-    test.done();
-  },
+  });
 
-  'Size in pebibytes'(test: Test) {
+  test('Size in pebibytes', () => {
     const size = Size.pebibytes(5);
 
-    test.equal(size.toKibibytes(), 5_497_558_138_880);
-    test.equal(size.toMebibytes(), 5_368_709_120);
-    test.equal(size.toGibibytes(), 5_242_880);
-    test.equal(size.toTebibytes(), 5_120);
-    test.equal(size.toPebibytes(), 5);
+    expect(size.toKibibytes()).toEqual(5_497_558_138_880);
+    expect(size.toMebibytes()).toEqual(5_368_709_120);
+    expect(size.toGibibytes()).toEqual(5_242_880);
+    expect(size.toTebibytes()).toEqual(5_120);
+    expect(size.toPebibytes()).toEqual(5);
 
-    test.done();
-  },
 
-  'rounding behavior'(test: Test) {
+  });
+
+  test('rounding behavior', () => {
     const size = Size.mebibytes(5_200);
 
-    test.throws(() => size.toGibibytes(), /cannot be converted into a whole number/);
-    test.throws(() => size.toGibibytes({ rounding: SizeRoundingBehavior.FAIL }), /cannot be converted into a whole number/);
+    expect(() => size.toGibibytes()).toThrow(/cannot be converted into a whole number/);
+    expect(() => size.toGibibytes({ rounding: SizeRoundingBehavior.FAIL })).toThrow(/cannot be converted into a whole number/);
+
+    expect(size.toGibibytes({ rounding: SizeRoundingBehavior.FLOOR })).toEqual(5);
+    expect(size.toTebibytes({ rounding: SizeRoundingBehavior.FLOOR })).toEqual(0);
+    floatEqual(size.toKibibytes({ rounding: SizeRoundingBehavior.FLOOR }), 5_324_800);
 
-    test.equals(size.toGibibytes({ rounding: SizeRoundingBehavior.FLOOR }), 5);
-    test.equals(size.toTebibytes({ rounding: SizeRoundingBehavior.FLOOR }), 0);
-    floatEqual(test, size.toKibibytes({ rounding: SizeRoundingBehavior.FLOOR }), 5_324_800);
+    expect(size.toGibibytes({ rounding: SizeRoundingBehavior.NONE })).toEqual(5.078125);
+    expect(size.toTebibytes({ rounding: SizeRoundingBehavior.NONE })).toEqual(5200 / (1024 * 1024));
+    expect(size.toKibibytes({ rounding: SizeRoundingBehavior.NONE })).toEqual(5_324_800);
 
-    test.equals(size.toGibibytes({ rounding: SizeRoundingBehavior.NONE }), 5.078125);
-    test.equals(size.toTebibytes({ rounding: SizeRoundingBehavior.NONE }), 5200 / (1024 * 1024));
-    test.equals(size.toKibibytes({ rounding: SizeRoundingBehavior.NONE }), 5_324_800);
 
-    test.done();
-  },
+  });
 });
 
-function floatEqual(test: Test, actual: number, expected: number) {
-  test.ok(
+function floatEqual(actual: number, expected: number) {
+  expect(
     // Floats are subject to rounding errors up to Number.ESPILON
     actual >= expected - Number.EPSILON && actual <= expected + Number.EPSILON,
-    `${actual} == ${expected}`,
-  );
+  ).toEqual(true);
 }
diff --git a/packages/@aws-cdk/core/test/stack-synthesis/new-style-synthesis.test.ts b/packages/@aws-cdk/core/test/stack-synthesis/new-style-synthesis.test.ts
index 67e8fcbfaae17..1528e91205f80 100644
--- a/packages/@aws-cdk/core/test/stack-synthesis/new-style-synthesis.test.ts
+++ b/packages/@aws-cdk/core/test/stack-synthesis/new-style-synthesis.test.ts
@@ -1,7 +1,6 @@
 import * as fs from 'fs';
 import * as cxschema from '@aws-cdk/cloud-assembly-schema';
 import * as cxapi from '@aws-cdk/cx-api';
-import { nodeunitShim, Test } from 'nodeunit-shim';
 import { App, Aws, CfnResource, ContextProvider, DefaultStackSynthesizer, FileAssetPackaging, Stack } from '../../lib';
 import { evaluateCFN } from '../evaluate-cfn';
 
@@ -13,18 +12,18 @@ const CFN_CONTEXT = {
 
 let app: App;
 let stack: Stack;
-nodeunitShim({
-  'setUp'(cb: () => void) {
+describe('new style synthesis', () => {
+  beforeEach(() => {
     app = new App({
       context: {
         [cxapi.NEW_STYLE_STACK_SYNTHESIS_CONTEXT]: 'true',
       },
     });
     stack = new Stack(app, 'Stack');
-    cb();
-  },
 
-  'stack template is in asset manifest'(test: Test) {
+  });
+
+  test('stack template is in asset manifest', () => {
     // GIVEN
     new CfnResource(stack, 'Resource', {
       type: 'Some::Resource',
@@ -38,16 +37,16 @@ nodeunitShim({
 
     const templateObjectKey = last(stackArtifact.stackTemplateAssetObjectUrl?.split('/'));
 
-    test.equals(stackArtifact.stackTemplateAssetObjectUrl, `s3://cdk-hnb659fds-assets-\${AWS::AccountId}-\${AWS::Region}/${templateObjectKey}`);
+    expect(stackArtifact.stackTemplateAssetObjectUrl).toEqual(`s3://cdk-hnb659fds-assets-\${AWS::AccountId}-\${AWS::Region}/${templateObjectKey}`);
 
     // THEN - the template is in the asset manifest
     const manifestArtifact = asm.artifacts.filter(isAssetManifest)[0];
-    test.ok(manifestArtifact);
+    expect(manifestArtifact).toBeDefined();
     const manifest: cxschema.AssetManifest = JSON.parse(fs.readFileSync(manifestArtifact.file, { encoding: 'utf-8' }));
 
     const firstFile = (manifest.files ? manifest.files[Object.keys(manifest.files)[0]] : undefined) ?? {};
 
-    test.deepEqual(firstFile, {
+    expect(firstFile).toEqual({
       source: { path: 'Stack.template.json', packaging: 'file' },
       destinations: {
         'current_account-current_region': {
@@ -58,10 +57,10 @@ nodeunitShim({
       },
     });
 
-    test.done();
-  },
 
-  'version check is added to template'(test: Test) {
+  });
+
+  test('version check is added to template', () => {
     // GIVEN
     new CfnResource(stack, 'Resource', {
       type: 'Some::Resource',
@@ -69,21 +68,21 @@ nodeunitShim({
 
     // THEN
     const template = app.synth().getStackByName('Stack').template;
-    test.deepEqual(template?.Parameters?.BootstrapVersion?.Type, 'AWS::SSM::Parameter::Value<String>');
-    test.deepEqual(template?.Parameters?.BootstrapVersion?.Default, '/cdk-bootstrap/hnb659fds/version');
+    expect(template?.Parameters?.BootstrapVersion?.Type).toEqual('AWS::SSM::Parameter::Value<String>');
+    expect(template?.Parameters?.BootstrapVersion?.Default).toEqual('/cdk-bootstrap/hnb659fds/version');
 
     const assertions = template?.Rules?.CheckBootstrapVersion?.Assertions ?? [];
-    test.deepEqual(assertions.length, 1);
-    test.deepEqual(assertions[0].Assert, {
+    expect(assertions.length).toEqual(1);
+    expect(assertions[0].Assert).toEqual({
       'Fn::Not': [
         { 'Fn::Contains': [['1', '2', '3', '4', '5'], { Ref: 'BootstrapVersion' }] },
       ],
     });
 
-    test.done();
-  },
 
-  'version check is not added to template if disabled'(test: Test) {
+  });
+
+  test('version check is not added to template if disabled', () => {
     // GIVEN
     stack = new Stack(app, 'Stack2', {
       synthesizer: new DefaultStackSynthesizer({
@@ -96,12 +95,12 @@ nodeunitShim({
 
     // THEN
     const template = app.synth().getStackByName('Stack2').template;
-    test.equal(template?.Rules?.CheckBootstrapVersion, undefined);
+    expect(template?.Rules?.CheckBootstrapVersion).toEqual(undefined);
+
 
-    test.done();
-  },
+  });
 
-  'customize version parameter'(test: Test) {
+  test('customize version parameter', () => {
     // GIVEN
     const myapp = new App();
 
@@ -125,10 +124,10 @@ nodeunitShim({
     // THEN - the asset manifest has an SSM parameter entry
     expect(manifestArtifact.bootstrapStackVersionSsmParameter).toEqual('stack-version-parameter');
 
-    test.done();
-  },
 
-  'generates missing context with the lookup role ARN as one of the missing context properties'(test: Test) {
+  });
+
+  test('generates missing context with the lookup role ARN as one of the missing context properties', () => {
     // GIVEN
     stack = new Stack(app, 'Stack2', {
       synthesizer: new DefaultStackSynthesizer({
@@ -146,12 +145,12 @@ nodeunitShim({
 
     // THEN
     const assembly = app.synth();
-    test.equal(assembly.manifest.missing![0].props.lookupRoleArn, 'arn:${AWS::Partition}:iam::111111111111:role/cdk-hnb659fds-lookup-role-111111111111-us-east-1');
+    expect(assembly.manifest.missing![0].props.lookupRoleArn).toEqual('arn:${AWS::Partition}:iam::111111111111:role/cdk-hnb659fds-lookup-role-111111111111-us-east-1');
+
 
-    test.done();
-  },
+  });
 
-  'add file asset'(test: Test) {
+  test('add file asset', () => {
     // WHEN
     const location = stack.synthesizer.addFileAsset({
       fileName: __filename,
@@ -160,16 +159,16 @@ nodeunitShim({
     });
 
     // THEN - we have a fixed asset location with region placeholders
-    test.equals(evalCFN(location.bucketName), 'cdk-hnb659fds-assets-the_account-the_region');
-    test.equals(evalCFN(location.s3Url), 'https://s3.the_region.domain.aws/cdk-hnb659fds-assets-the_account-the_region/abcdef.js');
+    expect(evalCFN(location.bucketName)).toEqual('cdk-hnb659fds-assets-the_account-the_region');
+    expect(evalCFN(location.s3Url)).toEqual('https://s3.the_region.domain.aws/cdk-hnb659fds-assets-the_account-the_region/abcdef.js');
 
     // THEN - object key contains source hash somewhere
-    test.ok(location.objectKey.indexOf('abcdef') > -1);
+    expect(location.objectKey.indexOf('abcdef')).toBeGreaterThan(-1);
+
 
-    test.done();
-  },
+  });
 
-  'add docker image asset'(test: Test) {
+  test('add docker image asset', () => {
     // WHEN
     const location = stack.synthesizer.addDockerImageAsset({
       directoryName: '.',
@@ -177,13 +176,13 @@ nodeunitShim({
     });
 
     // THEN - we have a fixed asset location with region placeholders
-    test.equals(evalCFN(location.repositoryName), 'cdk-hnb659fds-container-assets-the_account-the_region');
-    test.equals(evalCFN(location.imageUri), 'the_account.dkr.ecr.the_region.domain.aws/cdk-hnb659fds-container-assets-the_account-the_region:abcdef');
+    expect(evalCFN(location.repositoryName)).toEqual('cdk-hnb659fds-container-assets-the_account-the_region');
+    expect(evalCFN(location.imageUri)).toEqual('the_account.dkr.ecr.the_region.domain.aws/cdk-hnb659fds-container-assets-the_account-the_region:abcdef');
 
-    test.done();
-  },
 
-  'synthesis'(test: Test) {
+  });
+
+  test('synthesis', () => {
     // GIVEN
     stack.synthesizer.addFileAsset({
       fileName: __filename,
@@ -202,8 +201,8 @@ nodeunitShim({
     const manifestArtifact = getAssetManifest(asm);
     const manifest = readAssetManifest(manifestArtifact);
 
-    test.equals(Object.keys(manifest.files || {}).length, 2);
-    test.equals(Object.keys(manifest.dockerImages || {}).length, 1);
+    expect(Object.keys(manifest.files || {}).length).toEqual(2);
+    expect(Object.keys(manifest.dockerImages || {}).length).toEqual(1);
 
     // THEN - the asset manifest has an SSM parameter entry
     expect(manifestArtifact.bootstrapStackVersionSsmParameter).toEqual('/cdk-bootstrap/hnb659fds/version');
@@ -211,20 +210,20 @@ nodeunitShim({
     // THEN - every artifact has an assumeRoleArn
     for (const file of Object.values(manifest.files ?? {})) {
       for (const destination of Object.values(file.destinations)) {
-        test.deepEqual(destination.assumeRoleArn, 'arn:${AWS::Partition}:iam::${AWS::AccountId}:role/cdk-hnb659fds-file-publishing-role-${AWS::AccountId}-${AWS::Region}');
+        expect(destination.assumeRoleArn).toEqual('arn:${AWS::Partition}:iam::${AWS::AccountId}:role/cdk-hnb659fds-file-publishing-role-${AWS::AccountId}-${AWS::Region}');
       }
     }
 
     for (const file of Object.values(manifest.dockerImages ?? {})) {
       for (const destination of Object.values(file.destinations)) {
-        test.deepEqual(destination.assumeRoleArn, 'arn:${AWS::Partition}:iam::${AWS::AccountId}:role/cdk-hnb659fds-image-publishing-role-${AWS::AccountId}-${AWS::Region}');
+        expect(destination.assumeRoleArn).toEqual('arn:${AWS::Partition}:iam::${AWS::AccountId}:role/cdk-hnb659fds-image-publishing-role-${AWS::AccountId}-${AWS::Region}');
       }
     }
 
-    test.done();
-  },
 
-  'customize publishing resources'(test: Test) {
+  });
+
+  test('customize publishing resources', () => {
     // GIVEN
     const myapp = new App();
 
@@ -256,24 +255,24 @@ nodeunitShim({
     const asm = myapp.synth();
     const manifest = readAssetManifest(getAssetManifest(asm));
 
-    test.deepEqual(manifest.files?.['file-asset-hash']?.destinations?.['current_account-current_region'], {
+    expect(manifest.files?.['file-asset-hash']?.destinations?.['current_account-current_region']).toEqual({
       bucketName: 'file-asset-bucket',
       objectKey: 'file-asset-hash.js',
       assumeRoleArn: 'file:role:arn',
       assumeRoleExternalId: 'file-external-id',
     });
 
-    test.deepEqual(manifest.dockerImages?.['docker-asset-hash']?.destinations?.['current_account-current_region'], {
+    expect(manifest.dockerImages?.['docker-asset-hash']?.destinations?.['current_account-current_region']).toEqual({
       repositoryName: 'image-ecr-repository',
       imageTag: 'docker-asset-hash',
       assumeRoleArn: 'image:role:arn',
       assumeRoleExternalId: 'image-external-id',
     });
 
-    test.done();
-  },
 
-  'customize deploy role externalId'(test: Test) {
+  });
+
+  test('customize deploy role externalId', () => {
     // GIVEN
     const myapp = new App();
 
@@ -290,10 +289,10 @@ nodeunitShim({
     const stackArtifact = asm.getStack(mystack.stackName);
     expect(stackArtifact.assumeRoleExternalId).toEqual('deploy-external-id');
 
-    test.done();
-  },
 
-  'synthesis with bucketPrefix'(test: Test) {
+  });
+
+  test('synthesis with bucketPrefix', () => {
     // GIVEN
     const myapp = new App();
 
@@ -323,7 +322,7 @@ nodeunitShim({
     const manifest = readAssetManifest(getAssetManifest(asm));
 
     // THEN
-    test.deepEqual(manifest.files?.['file-asset-hash-with-prefix']?.destinations?.['current_account-current_region'], {
+    expect(manifest.files?.['file-asset-hash-with-prefix']?.destinations?.['current_account-current_region']).toEqual({
       bucketName: 'file-asset-bucket',
       objectKey: '000000000000/file-asset-hash-with-prefix.js',
       assumeRoleArn: 'file:role:arn',
@@ -332,22 +331,22 @@ nodeunitShim({
 
     const templateHash = last(stackArtifact.stackTemplateAssetObjectUrl?.split('/'));
 
-    test.equals(stackArtifact.stackTemplateAssetObjectUrl, `s3://file-asset-bucket/000000000000/${templateHash}`);
+    expect(stackArtifact.stackTemplateAssetObjectUrl).toEqual(`s3://file-asset-bucket/000000000000/${templateHash}`);
+
 
-    test.done();
-  },
+  });
 
-  'cannot use same synthesizer for multiple stacks'(test: Test) {
+  test('cannot use same synthesizer for multiple stacks', () => {
     // GIVEN
     const synthesizer = new DefaultStackSynthesizer();
 
     // WHEN
     new Stack(app, 'Stack2', { synthesizer });
-    test.throws(() => {
+    expect(() => {
       new Stack(app, 'Stack3', { synthesizer });
-    }, /A StackSynthesizer can only be used for one Stack/);
-    test.done();
-  },
+    }).toThrow(/A StackSynthesizer can only be used for one Stack/);
+
+  });
 });
 
 test('get an exception when using tokens for parameters', () => {
diff --git a/packages/@aws-cdk/core/test/stage.test.ts b/packages/@aws-cdk/core/test/stage.test.ts
index 897b3513d6163..4178060822d68 100644
--- a/packages/@aws-cdk/core/test/stage.test.ts
+++ b/packages/@aws-cdk/core/test/stage.test.ts
@@ -1,10 +1,9 @@
 import * as cxschema from '@aws-cdk/cloud-assembly-schema';
 import * as cxapi from '@aws-cdk/cx-api';
-import { nodeunitShim, Test } from 'nodeunit-shim';
 import { App, CfnResource, Construct, IAspect, IConstruct, Stack, Stage, Aspects } from '../lib';
 
-nodeunitShim({
-  'Stack inherits unspecified part of the env from Stage'(test: Test) {
+describe('stage', () => {
+  test('Stack inherits unspecified part of the env from Stage', () => {
     // GIVEN
     const app = new App();
     const stage = new Stage(app, 'Stage', {
@@ -16,13 +15,13 @@ nodeunitShim({
     const stack2 = new Stack(stage, 'Stack2', { env: { account: 'tnuocca' } });
 
     // THEN
-    test.deepEqual(acctRegion(stack1), ['account', 'elsewhere']);
-    test.deepEqual(acctRegion(stack2), ['tnuocca', 'region']);
+    expect(acctRegion(stack1)).toEqual(['account', 'elsewhere']);
+    expect(acctRegion(stack2)).toEqual(['tnuocca', 'region']);
 
-    test.done();
-  },
 
-  'envs are inherited deeply'(test: Test) {
+  });
+
+  test('envs are inherited deeply', () => {
     // GIVEN
     const app = new App();
     const outer = new Stage(app, 'Stage', {
@@ -35,14 +34,14 @@ nodeunitShim({
     const innerNeither = new Stage(outer, 'Neither');
 
     // THEN
-    test.deepEqual(acctRegion(new Stack(innerAcct, 'Stack')), ['tnuocca', 'region']);
-    test.deepEqual(acctRegion(new Stack(innerRegion, 'Stack')), ['account', 'elsewhere']);
-    test.deepEqual(acctRegion(new Stack(innerNeither, 'Stack')), ['account', 'region']);
+    expect(acctRegion(new Stack(innerAcct, 'Stack'))).toEqual(['tnuocca', 'region']);
+    expect(acctRegion(new Stack(innerRegion, 'Stack'))).toEqual(['account', 'elsewhere']);
+    expect(acctRegion(new Stack(innerNeither, 'Stack'))).toEqual(['account', 'region']);
 
-    test.done();
-  },
 
-  'The Stage Assembly is in the app Assembly\'s manifest'(test: Test) {
+  });
+
+  test('The Stage Assembly is in the app Assembly\'s manifest', () => {
     // WHEN
     const app = new App();
     const stage = new Stage(app, 'Stage');
@@ -52,12 +51,12 @@ nodeunitShim({
     const appAsm = app.synth();
 
     const artifact = appAsm.artifacts.find(x => x instanceof cxapi.NestedCloudAssemblyArtifact);
-    test.ok(artifact);
+    expect(artifact).toBeDefined();
 
-    test.done();
-  },
 
-  'Stacks in Stage are in a different cxasm than Stacks in App'(test: Test) {
+  });
+
+  test('Stacks in Stage are in a different cxasm than Stacks in App', () => {
     // WHEN
     const app = new App();
     const stack1 = new BogusStack(app, 'Stack1');
@@ -66,15 +65,15 @@ nodeunitShim({
 
     // THEN
     const stageAsm = stage.synth();
-    test.deepEqual(stageAsm.stacks.map(s => s.stackName), [stack2.stackName]);
+    expect(stageAsm.stacks.map(s => s.stackName)).toEqual([stack2.stackName]);
 
     const appAsm = app.synth();
-    test.deepEqual(appAsm.stacks.map(s => s.stackName), [stack1.stackName]);
+    expect(appAsm.stacks.map(s => s.stackName)).toEqual([stack1.stackName]);
 
-    test.done();
-  },
 
-  'Can nest Stages inside other Stages'(test: Test) {
+  });
+
+  test('Can nest Stages inside other Stages', () => {
     // WHEN
     const app = new App();
     const outer = new Stage(app, 'Outer');
@@ -86,25 +85,25 @@ nodeunitShim({
     const outerAsm = appAsm.getNestedAssembly(outer.artifactId);
     const innerAsm = outerAsm.getNestedAssembly(inner.artifactId);
 
-    test.ok(innerAsm.tryGetArtifact(stack.artifactId));
+    expect(innerAsm.tryGetArtifact(stack.artifactId)).toBeDefined();
 
-    test.done();
-  },
 
-  'Default stack name in Stage objects incorporates the Stage name and no hash'(test: Test) {
+  });
+
+  test('Default stack name in Stage objects incorporates the Stage name and no hash', () => {
     // WHEN
     const app = new App();
     const stage = new Stage(app, 'MyStage');
     const stack = new BogusStack(stage, 'MyStack');
 
     // THEN
-    test.equal(stage.stageName, 'MyStage');
-    test.equal(stack.stackName, 'MyStage-MyStack');
+    expect(stage.stageName).toEqual('MyStage');
+    expect(stack.stackName).toEqual('MyStage-MyStack');
 
-    test.done();
-  },
 
-  'Can not have dependencies to stacks outside the nested asm'(test: Test) {
+  });
+
+  test('Can not have dependencies to stacks outside the nested asm', () => {
     // GIVEN
     const app = new App();
     const stack1 = new BogusStack(app, 'Stack1');
@@ -112,14 +111,14 @@ nodeunitShim({
     const stack2 = new BogusStack(stage, 'Stack2');
 
     // WHEN
-    test.throws(() => {
+    expect(() => {
       stack2.addDependency(stack1);
-    }, /dependency cannot cross stage boundaries/);
+    }).toThrow(/dependency cannot cross stage boundaries/);
 
-    test.done();
-  },
 
-  'When we synth() a stage, prepare must be called on constructs in the stage'(test: Test) {
+  });
+
+  test('When we synth() a stage, prepare must be called on constructs in the stage', () => {
     // GIVEN
     const app = new App();
     let prepared = false;
@@ -136,12 +135,12 @@ nodeunitShim({
     stage.synth();
 
     // THEN
-    test.equals(prepared, true);
+    expect(prepared).toEqual(true);
 
-    test.done();
-  },
 
-  'When we synth() a stage, aspects inside it must have been applied'(test: Test) {
+  });
+
+  test('When we synth() a stage, aspects inside it must have been applied', () => {
     // GIVEN
     const app = new App();
     const stage = new Stage(app, 'MyStage');
@@ -153,15 +152,15 @@ nodeunitShim({
 
     // THEN
     app.synth();
-    test.deepEqual(aspect.visits.map(c => c.node.path), [
+    expect(aspect.visits.map(c => c.node.path)).toEqual([
       'MyStage/Stack',
       'MyStage/Stack/Resource',
     ]);
 
-    test.done();
-  },
 
-  'Aspects do not apply inside a Stage'(test: Test) {
+  });
+
+  test('Aspects do not apply inside a Stage', () => {
     // GIVEN
     const app = new App();
     const stage = new Stage(app, 'MyStage');
@@ -173,14 +172,14 @@ nodeunitShim({
 
     // THEN
     app.synth();
-    test.deepEqual(aspect.visits.map(c => c.node.path), [
+    expect(aspect.visits.map(c => c.node.path)).toEqual([
       '',
       'Tree',
     ]);
-    test.done();
-  },
 
-  'Automatic dependencies inside a stage are available immediately after synth'(test: Test) {
+  });
+
+  test('Automatic dependencies inside a stage are available immediately after synth', () => {
     // GIVEN
     const app = new App();
     const stage = new Stage(app, 'MyStage');
@@ -201,14 +200,14 @@ nodeunitShim({
     const asm = stage.synth();
 
     // THEN
-    test.deepEqual(
-      asm.getStackArtifact(stack2.artifactId).dependencies.map(d => d.id),
+    expect(
+      asm.getStackArtifact(stack2.artifactId).dependencies.map(d => d.id)).toEqual(
       [stack1.artifactId]);
 
-    test.done();
-  },
 
-  'Assemblies can be deeply nested'(test: Test) {
+  });
+
+  test('Assemblies can be deeply nested', () => {
     // GIVEN
     const app = new App({ treeMetadata: false });
 
@@ -220,7 +219,7 @@ nodeunitShim({
     const rootAssembly = app.synth();
 
     // THEN
-    test.deepEqual(rootAssembly.manifest.artifacts, {
+    expect(rootAssembly.manifest.artifacts).toEqual({
       'assembly-StageLevel1': {
         type: 'cdk:cloud-assembly',
         properties: {
@@ -231,7 +230,7 @@ nodeunitShim({
     });
 
     const assemblyLevel1 = rootAssembly.getNestedAssembly('assembly-StageLevel1');
-    test.deepEqual(assemblyLevel1.manifest.artifacts, {
+    expect(assemblyLevel1.manifest.artifacts).toEqual({
       'assembly-StageLevel1-StageLevel2': {
         type: 'cdk:cloud-assembly',
         properties: {
@@ -242,7 +241,7 @@ nodeunitShim({
     });
 
     const assemblyLevel2 = assemblyLevel1.getNestedAssembly('assembly-StageLevel1-StageLevel2');
-    test.deepEqual(assemblyLevel2.manifest.artifacts, {
+    expect(assemblyLevel2.manifest.artifacts).toEqual({
       'assembly-StageLevel1-StageLevel2-StageLevel3': {
         type: 'cdk:cloud-assembly',
         properties: {
@@ -252,10 +251,10 @@ nodeunitShim({
       },
     });
 
-    test.done();
-  },
 
-  'stage name validation'(test: Test) {
+  });
+
+  test('stage name validation', () => {
     const app = new App();
 
     new Stage(app, 'abcd');
@@ -264,38 +263,38 @@ nodeunitShim({
     new Stage(app, 'abcd123-588dfjjk.sss');
     new Stage(app, 'abcd123-588dfjjk.sss_ajsid');
 
-    test.throws(() => new Stage(app, 'abcd123-588dfjjk.sss_ajsid '), /invalid stage name "abcd123-588dfjjk.sss_ajsid "/);
-    test.throws(() => new Stage(app, 'abcd123-588dfjjk.sss_ajsid/dfo'), /invalid stage name "abcd123-588dfjjk.sss_ajsid\/dfo"/);
-    test.throws(() => new Stage(app, '&'), /invalid stage name "&"/);
-    test.throws(() => new Stage(app, '45hello'), /invalid stage name "45hello"/);
-    test.throws(() => new Stage(app, 'f'), /invalid stage name "f"/);
+    expect(() => new Stage(app, 'abcd123-588dfjjk.sss_ajsid ')).toThrow(/invalid stage name "abcd123-588dfjjk.sss_ajsid "/);
+    expect(() => new Stage(app, 'abcd123-588dfjjk.sss_ajsid/dfo')).toThrow(/invalid stage name "abcd123-588dfjjk.sss_ajsid\/dfo"/);
+    expect(() => new Stage(app, '&')).toThrow(/invalid stage name "&"/);
+    expect(() => new Stage(app, '45hello')).toThrow(/invalid stage name "45hello"/);
+    expect(() => new Stage(app, 'f')).toThrow(/invalid stage name "f"/);
 
-    test.done();
-  },
 
-  'outdir cannot be specified for nested stages'(test: Test) {
+  });
+
+  test('outdir cannot be specified for nested stages', () => {
     // WHEN
     const app = new App();
 
     // THEN
-    test.throws(() => new Stage(app, 'mystage', { outdir: '/tmp/foo/bar' }), /"outdir" cannot be specified for nested stages/);
-    test.done();
-  },
+    expect(() => new Stage(app, 'mystage', { outdir: '/tmp/foo/bar' })).toThrow(/"outdir" cannot be specified for nested stages/);
+
+  });
 
-  'Stage.isStage indicates that a construct is a stage'(test: Test) {
+  test('Stage.isStage indicates that a construct is a stage', () => {
     // WHEN
     const app = new App();
     const stack = new Stack();
     const stage = new Stage(app, 'Stage');
 
     // THEN
-    test.ok(Stage.isStage(stage));
-    test.ok(Stage.isStage(app));
-    test.ok(!Stage.isStage(stack));
-    test.done();
-  },
+    expect(Stage.isStage(stage)).toEqual(true);
+    expect(Stage.isStage(app)).toEqual(true);
+    expect(Stage.isStage(stack)).toEqual(false);
 
-  'Stage.isStage indicates that a construct is a stage based on symbol'(test: Test) {
+  });
+
+  test('Stage.isStage indicates that a construct is a stage based on symbol', () => {
     // WHEN
     const app = new App();
     const stage = new Stage(app, 'Stage');
@@ -305,11 +304,11 @@ nodeunitShim({
     Object.defineProperty(externalStage, STAGE_SYMBOL, { value: true });
 
     // THEN
-    test.ok(Stage.isStage(stage));
-    test.ok(Stage.isStage(app));
-    test.ok(Stage.isStage(externalStage));
-    test.done();
-  },
+    expect(Stage.isStage(stage)).toEqual(true);
+    expect(Stage.isStage(app)).toEqual(true);
+    expect(Stage.isStage(externalStage)).toEqual(true);
+
+  });
 });
 
 test('missing context in Stages is propagated up to root assembly', () => {
diff --git a/packages/@aws-cdk/core/test/staging.test.ts b/packages/@aws-cdk/core/test/staging.test.ts
index c55e7a9286326..edd8d124ba978 100644
--- a/packages/@aws-cdk/core/test/staging.test.ts
+++ b/packages/@aws-cdk/core/test/staging.test.ts
@@ -3,7 +3,6 @@ import * as path from 'path';
 import { FileAssetPackaging } from '@aws-cdk/cloud-assembly-schema';
 import * as cxapi from '@aws-cdk/cx-api';
 import * as fs from 'fs-extra';
-import { nodeunitShim, Test } from 'nodeunit-shim';
 import * as sinon from 'sinon';
 import { App, AssetHashType, AssetStaging, BundlingDockerImage, BundlingOptions, BundlingOutput, FileSystem, Stack, Stage } from '../lib';
 
@@ -27,9 +26,9 @@ const USER_ARG = `-u ${userInfo.uid}:${userInfo.gid}`;
 // this is a way to provide a custom "docker" command for staging.
 process.env.CDK_DOCKER = `${__dirname}/docker-stub.sh`;
 
-nodeunitShim({
+describe('staging', () => {
 
-  'tearDown'(cb: any) {
+  afterEach(() => {
     AssetStaging.clearAssetHashCache();
     if (fs.existsSync(STUB_INPUT_FILE)) {
       fs.unlinkSync(STUB_INPUT_FILE);
@@ -37,11 +36,10 @@ nodeunitShim({
     if (fs.existsSync(STUB_INPUT_CONCAT_FILE)) {
       fs.unlinkSync(STUB_INPUT_CONCAT_FILE);
     }
-    cb();
     sinon.restore();
-  },
+  });
 
-  'base case'(test: Test) {
+  test('base case', () => {
     // GIVEN
     const stack = new Stack();
     const sourcePath = path.join(__dirname, 'fs', 'fixtures', 'test1');
@@ -49,16 +47,16 @@ nodeunitShim({
     // WHEN
     const staging = new AssetStaging(stack, 's1', { sourcePath });
 
-    test.deepEqual(staging.sourceHash, '2f37f937c51e2c191af66acf9b09f548926008ec68c575bd2ee54b6e997c0e00');
-    test.deepEqual(staging.sourcePath, sourcePath);
-    test.deepEqual(path.basename(staging.stagedPath), 'asset.2f37f937c51e2c191af66acf9b09f548926008ec68c575bd2ee54b6e997c0e00');
-    test.deepEqual(path.basename(staging.relativeStagedPath(stack)), 'asset.2f37f937c51e2c191af66acf9b09f548926008ec68c575bd2ee54b6e997c0e00');
-    test.deepEqual(staging.packaging, FileAssetPackaging.ZIP_DIRECTORY);
-    test.deepEqual(staging.isArchive, true);
-    test.done();
-  },
+    expect(staging.sourceHash).toEqual('2f37f937c51e2c191af66acf9b09f548926008ec68c575bd2ee54b6e997c0e00');
+    expect(staging.sourcePath).toEqual(sourcePath);
+    expect(path.basename(staging.stagedPath)).toEqual('asset.2f37f937c51e2c191af66acf9b09f548926008ec68c575bd2ee54b6e997c0e00');
+    expect(path.basename(staging.relativeStagedPath(stack))).toEqual('asset.2f37f937c51e2c191af66acf9b09f548926008ec68c575bd2ee54b6e997c0e00');
+    expect(staging.packaging).toEqual(FileAssetPackaging.ZIP_DIRECTORY);
+    expect(staging.isArchive).toEqual(true);
 
-  'staging of an archive file correctly sets packaging and isArchive'(test: Test) {
+  });
+
+  test('staging of an archive file correctly sets packaging and isArchive', () => {
     // GIVEN
     const stack = new Stack();
     const sourcePath = path.join(__dirname, 'archive', 'archive.zip');
@@ -66,12 +64,12 @@ nodeunitShim({
     // WHEN
     const staging = new AssetStaging(stack, 's1', { sourcePath });
 
-    test.deepEqual(staging.packaging, FileAssetPackaging.FILE);
-    test.deepEqual(staging.isArchive, true);
-    test.done();
-  },
+    expect(staging.packaging).toEqual(FileAssetPackaging.FILE);
+    expect(staging.isArchive).toEqual(true);
+
+  });
 
-  'asset packaging type is correct when staging is skipped because of memory cache'(test: Test) {
+  test('asset packaging type is correct when staging is skipped because of memory cache', () => {
     // GIVEN
     const stack = new Stack();
     const sourcePath = path.join(__dirname, 'archive', 'archive.zip');
@@ -80,14 +78,14 @@ nodeunitShim({
     const staging1 = new AssetStaging(stack, 's1', { sourcePath });
     const staging2 = new AssetStaging(stack, 's2', { sourcePath });
 
-    test.deepEqual(staging1.packaging, FileAssetPackaging.FILE);
-    test.deepEqual(staging1.isArchive, true);
-    test.deepEqual(staging2.packaging, staging1.packaging);
-    test.deepEqual(staging2.isArchive, staging1.isArchive);
-    test.done();
-  },
+    expect(staging1.packaging).toEqual(FileAssetPackaging.FILE);
+    expect(staging1.isArchive).toEqual(true);
+    expect(staging2.packaging).toEqual(staging1.packaging);
+    expect(staging2.isArchive).toEqual(staging1.isArchive);
+
+  });
 
-  'asset packaging type is correct when staging is skipped because of disk cache'(test: Test) {
+  test('asset packaging type is correct when staging is skipped because of disk cache', () => {
     // GIVEN
     const TEST_OUTDIR = path.join(__dirname, 'cdk.out');
     if (fs.existsSync(TEST_OUTDIR)) {
@@ -113,15 +111,15 @@ nodeunitShim({
     const staging2 = new AssetStaging(stack2, 'Asset', { sourcePath });
 
     // THEN
-    test.deepEqual(staging1.packaging, FileAssetPackaging.FILE);
-    test.deepEqual(staging1.isArchive, true);
-    test.deepEqual(staging2.packaging, staging1.packaging);
-    test.deepEqual(staging2.isArchive, staging1.isArchive);
+    expect(staging1.packaging).toEqual(FileAssetPackaging.FILE);
+    expect(staging1.isArchive).toEqual(true);
+    expect(staging2.packaging).toEqual(staging1.packaging);
+    expect(staging2.isArchive).toEqual(staging1.isArchive);
 
-    test.done();
-  },
 
-  'staging of a non-archive file correctly sets packaging and isArchive'(test: Test) {
+  });
+
+  test('staging of a non-archive file correctly sets packaging and isArchive', () => {
     // GIVEN
     const stack = new Stack();
     const sourcePath = __filename;
@@ -129,12 +127,12 @@ nodeunitShim({
     // WHEN
     const staging = new AssetStaging(stack, 's1', { sourcePath });
 
-    test.deepEqual(staging.packaging, FileAssetPackaging.FILE);
-    test.deepEqual(staging.isArchive, false);
-    test.done();
-  },
+    expect(staging.packaging).toEqual(FileAssetPackaging.FILE);
+    expect(staging.isArchive).toEqual(false);
+
+  });
 
-  'staging can be disabled through context'(test: Test) {
+  test('staging can be disabled through context', () => {
     // GIVEN
     const stack = new Stack();
     stack.node.setContext(cxapi.DISABLE_ASSET_STAGING_CONTEXT, true);
@@ -143,14 +141,14 @@ nodeunitShim({
     // WHEN
     const staging = new AssetStaging(stack, 's1', { sourcePath });
 
-    test.deepEqual(staging.sourceHash, '2f37f937c51e2c191af66acf9b09f548926008ec68c575bd2ee54b6e997c0e00');
-    test.deepEqual(staging.sourcePath, sourcePath);
-    test.deepEqual(staging.stagedPath, sourcePath);
-    test.deepEqual(staging.relativeStagedPath(stack), sourcePath);
-    test.done();
-  },
+    expect(staging.sourceHash).toEqual('2f37f937c51e2c191af66acf9b09f548926008ec68c575bd2ee54b6e997c0e00');
+    expect(staging.sourcePath).toEqual(sourcePath);
+    expect(staging.stagedPath).toEqual(sourcePath);
+    expect(staging.relativeStagedPath(stack)).toEqual(sourcePath);
 
-  'files are copied to the output directory during synth'(test: Test) {
+  });
+
+  test('files are copied to the output directory during synth', () => {
     // GIVEN
     const app = new App();
     const stack = new Stack(app, 'stack');
@@ -161,7 +159,7 @@ nodeunitShim({
 
     // THEN
     const assembly = app.synth();
-    test.deepEqual(fs.readdirSync(assembly.directory), [
+    expect(fs.readdirSync(assembly.directory)).toEqual([
       'asset.2f37f937c51e2c191af66acf9b09f548926008ec68c575bd2ee54b6e997c0e00',
       'asset.af10ac04b3b607b0f8659c8f0cee8c343025ee75baf0b146f10f0e5311d2c46b.gz',
       'cdk.out',
@@ -169,10 +167,10 @@ nodeunitShim({
       'stack.template.json',
       'tree.json',
     ]);
-    test.done();
-  },
 
-  'assets in nested assemblies get staged into assembly root directory'(test: Test) {
+  });
+
+  test('assets in nested assemblies get staged into assembly root directory', () => {
     // GIVEN
     const app = new App();
     const stack1 = new Stack(new Stage(app, 'Stage1'), 'Stack');
@@ -186,7 +184,7 @@ nodeunitShim({
     const assembly = app.synth();
 
     // One asset directory at the top
-    test.deepEqual(fs.readdirSync(assembly.directory), [
+    expect(fs.readdirSync(assembly.directory)).toEqual([
       'assembly-Stage1',
       'assembly-Stage2',
       'asset.2f37f937c51e2c191af66acf9b09f548926008ec68c575bd2ee54b6e997c0e00',
@@ -194,10 +192,10 @@ nodeunitShim({
       'manifest.json',
       'tree.json',
     ]);
-    test.done();
-  },
 
-  'allow specifying extra data to include in the source hash'(test: Test) {
+  });
+
+  test('allow specifying extra data to include in the source hash', () => {
     // GIVEN
     const app = new App();
     const stack = new Stack(app, 'stack');
@@ -208,13 +206,13 @@ nodeunitShim({
     const withExtra = new AssetStaging(stack, 'withExtra', { sourcePath: directory, extraHash: 'boom' });
 
     // THEN
-    test.notEqual(withoutExtra.sourceHash, withExtra.sourceHash);
-    test.deepEqual(withoutExtra.sourceHash, '2f37f937c51e2c191af66acf9b09f548926008ec68c575bd2ee54b6e997c0e00');
-    test.deepEqual(withExtra.sourceHash, 'c95c915a5722bb9019e2c725d11868e5a619b55f36172f76bcbcaa8bb2d10c5f');
-    test.done();
-  },
+    expect(withoutExtra.sourceHash).not.toEqual(withExtra.sourceHash);
+    expect(withoutExtra.sourceHash).toEqual('2f37f937c51e2c191af66acf9b09f548926008ec68c575bd2ee54b6e997c0e00');
+    expect(withExtra.sourceHash).toEqual('c95c915a5722bb9019e2c725d11868e5a619b55f36172f76bcbcaa8bb2d10c5f');
+
+  });
 
-  'with bundling'(test: Test) {
+  test('with bundling', () => {
     // GIVEN
     const app = new App();
     const stack = new Stack(app, 'stack');
@@ -232,11 +230,11 @@ nodeunitShim({
 
     // THEN
     const assembly = app.synth();
-    test.deepEqual(
-      readDockerStubInput(),
+    expect(
+      readDockerStubInput()).toEqual(
       `run --rm ${USER_ARG} -v /input:/asset-input:delegated -v /output:/asset-output:delegated -w /asset-input alpine DOCKER_STUB_SUCCESS`,
     );
-    test.deepEqual(fs.readdirSync(assembly.directory), [
+    expect(fs.readdirSync(assembly.directory)).toEqual([
       'asset.b1e32e86b3523f2fa512eb99180ee2975a50a4439e63e8badd153f2a68d61aa4',
       'cdk.out',
       'manifest.json',
@@ -245,12 +243,12 @@ nodeunitShim({
     ]);
 
     // shows a message before bundling
-    test.ok(processStdErrWriteSpy.calledWith('Bundling asset stack/Asset...\n'));
+    expect(processStdErrWriteSpy.calledWith('Bundling asset stack/Asset...\n')).toEqual(true);
 
-    test.done();
-  },
 
-  'bundled resources have absolute path when staging is disabled'(test: Test) {
+  });
+
+  test('bundled resources have absolute path when staging is disabled', () => {
     // GIVEN
     const app = new App();
     const stack = new Stack(app, 'stack');
@@ -269,7 +267,7 @@ nodeunitShim({
     // THEN
     const assembly = app.synth();
 
-    test.deepEqual(fs.readdirSync(assembly.directory), [
+    expect(fs.readdirSync(assembly.directory)).toEqual([
       'asset.b1e32e86b3523f2fa512eb99180ee2975a50a4439e63e8badd153f2a68d61aa4',
       'cdk.out',
       'manifest.json',
@@ -277,18 +275,18 @@ nodeunitShim({
       'tree.json',
     ]);
 
-    test.equal(asset.sourceHash, 'b1e32e86b3523f2fa512eb99180ee2975a50a4439e63e8badd153f2a68d61aa4');
-    test.equal(asset.sourcePath, directory);
+    expect(asset.sourceHash).toEqual('b1e32e86b3523f2fa512eb99180ee2975a50a4439e63e8badd153f2a68d61aa4');
+    expect(asset.sourcePath).toEqual(directory);
 
     const resolvedStagePath = asset.relativeStagedPath(stack);
     // absolute path ending with bundling dir
-    test.ok(path.isAbsolute(resolvedStagePath));
-    test.ok(new RegExp('asset.b1e32e86b3523f2fa512eb99180ee2975a50a4439e63e8badd153f2a68d61aa4$').test(resolvedStagePath));
+    expect(path.isAbsolute(resolvedStagePath)).toEqual(true);
+    expect(new RegExp('asset.b1e32e86b3523f2fa512eb99180ee2975a50a4439e63e8badd153f2a68d61aa4$').test(resolvedStagePath)).toEqual(true);
+
 
-    test.done();
-  },
+  });
 
-  'bundler reuses its output when it can'(test: Test) {
+  test('bundler reuses its output when it can', () => {
     // GIVEN
     const app = new App();
     const stack = new Stack(app, 'stack');
@@ -315,12 +313,12 @@ nodeunitShim({
     const assembly = app.synth();
 
     // We're testing that docker was run exactly once even though there are two bundling assets.
-    test.deepEqual(
-      readDockerStubInputConcat(),
+    expect(
+      readDockerStubInputConcat()).toEqual(
       `run --rm ${USER_ARG} -v /input:/asset-input:delegated -v /output:/asset-output:delegated -w /asset-input alpine DOCKER_STUB_SUCCESS`,
     );
 
-    test.deepEqual(fs.readdirSync(assembly.directory), [
+    expect(fs.readdirSync(assembly.directory)).toEqual([
       'asset.b1e32e86b3523f2fa512eb99180ee2975a50a4439e63e8badd153f2a68d61aa4',
       'cdk.out',
       'manifest.json',
@@ -328,10 +326,10 @@ nodeunitShim({
       'tree.json',
     ]);
 
-    test.done();
-  },
 
-  'uses asset hash cache with AssetHashType.OUTPUT'(test: Test) {
+  });
+
+  test('uses asset hash cache with AssetHashType.OUTPUT', () => {
     // GIVEN
     const app = new App();
     const stack = new Stack(app, 'stack');
@@ -362,12 +360,12 @@ nodeunitShim({
 
     // We're testing that docker was run exactly once even though there are two bundling assets
     // and that the hash is based on the output
-    test.deepEqual(
-      readDockerStubInputConcat(),
+    expect(
+      readDockerStubInputConcat()).toEqual(
       `run --rm ${USER_ARG} -v /input:/asset-input:delegated -v /output:/asset-output:delegated -w /asset-input alpine DOCKER_STUB_SUCCESS`,
     );
 
-    test.deepEqual(fs.readdirSync(assembly.directory), [
+    expect(fs.readdirSync(assembly.directory)).toEqual([
       'asset.33cbf2cae5432438e0f046bc45ba8c3cef7b6afcf47b59d1c183775c1918fb1f',
       'cdk.out',
       'manifest.json',
@@ -376,12 +374,12 @@ nodeunitShim({
     ]);
 
     // Only one fingerprinting
-    test.ok(fingerPrintSpy.calledOnce);
+    expect(fingerPrintSpy.calledOnce).toEqual(true);
 
-    test.done();
-  },
 
-  'bundler considers its options when reusing bundle output'(test: Test) {
+  });
+
+  test('bundler considers its options when reusing bundle output', () => {
     // GIVEN
     const app = new App();
     const stack = new Stack(app, 'stack');
@@ -412,13 +410,13 @@ nodeunitShim({
 
     // We're testing that docker was run twice - once for each set of bundler options
     // operating on the same source asset.
-    test.deepEqual(
-      readDockerStubInputConcat(),
+    expect(
+      readDockerStubInputConcat()).toEqual(
       `run --rm ${USER_ARG} -v /input:/asset-input:delegated -v /output:/asset-output:delegated -w /asset-input alpine DOCKER_STUB_SUCCESS\n` +
       `run --rm ${USER_ARG} -v /input:/asset-input:delegated -v /output:/asset-output:delegated --env UNIQUE_ENV_VAR=SOMEVALUE -w /asset-input alpine DOCKER_STUB_SUCCESS`,
     );
 
-    test.deepEqual(fs.readdirSync(assembly.directory), [
+    expect(fs.readdirSync(assembly.directory)).toEqual([
       'asset.b1e32e86b3523f2fa512eb99180ee2975a50a4439e63e8badd153f2a68d61aa4', // 'Asset'
       'asset.e80bb8f931b87e84975de193f5a7ecddd7558d3caf3d35d3a536d9ae6539234f', // 'AssetWithDifferentBundlingOptions'
       'cdk.out',
@@ -427,10 +425,10 @@ nodeunitShim({
       'tree.json',
     ]);
 
-    test.done();
-  },
 
-  'bundler outputs to intermediate dir and renames to asset'(test: Test) {
+  });
+
+  test('bundler outputs to intermediate dir and renames to asset', () => {
     // GIVEN
     const app = new App();
     const stack = new Stack(app, 'stack');
@@ -452,11 +450,11 @@ nodeunitShim({
     // THEN
     const assembly = app.synth();
 
-    test.ok(ensureDirSync.calledWith(sinon.match(path.join(assembly.directory, 'bundling-temp-'))));
-    test.ok(chmodSyncSpy.calledWith(sinon.match(path.join(assembly.directory, 'bundling-temp-')), 0o777));
-    test.ok(renameSyncSpy.calledWith(sinon.match(path.join(assembly.directory, 'bundling-temp-')), sinon.match(path.join(assembly.directory, 'asset.'))));
+    expect(ensureDirSync.calledWith(sinon.match(path.join(assembly.directory, 'bundling-temp-')))).toEqual(true);
+    expect(chmodSyncSpy.calledWith(sinon.match(path.join(assembly.directory, 'bundling-temp-')), 0o777)).toEqual(true);
+    expect(renameSyncSpy.calledWith(sinon.match(path.join(assembly.directory, 'bundling-temp-')), sinon.match(path.join(assembly.directory, 'asset.')))).toEqual(true);
 
-    test.deepEqual(fs.readdirSync(assembly.directory), [
+    expect(fs.readdirSync(assembly.directory)).toEqual([
       'asset.33cbf2cae5432438e0f046bc45ba8c3cef7b6afcf47b59d1c183775c1918fb1f', // 'Asset'
       'cdk.out',
       'manifest.json',
@@ -464,34 +462,34 @@ nodeunitShim({
       'tree.json',
     ]);
 
-    test.done();
-  },
 
-  'bundling failure preserves the bundleDir for diagnosability'(test: Test) {
+  });
+
+  test('bundling failure preserves the bundleDir for diagnosability', () => {
     // GIVEN
     const app = new App();
     const stack = new Stack(app, 'stack');
     const directory = path.join(__dirname, 'fs', 'fixtures', 'test1');
 
     // WHEN
-    test.throws(() => new AssetStaging(stack, 'Asset', {
+    expect(() => new AssetStaging(stack, 'Asset', {
       sourcePath: directory,
       bundling: {
         image: BundlingDockerImage.fromRegistry('alpine'),
         command: [DockerStubCommand.FAIL],
       },
-    }), /Failed.*bundl.*asset.*-error/);
+    })).toThrow(/Failed.*bundl.*asset.*-error/);
 
     // THEN
     const assembly = app.synth();
 
     const dir = fs.readdirSync(assembly.directory);
-    test.ok(dir.some(entry => entry.match(/asset.*-error/)));
+    expect(dir.some(entry => entry.match(/asset.*-error/))).toEqual(true);
+
 
-    test.done();
-  },
+  });
 
-  'bundler re-uses assets from previous synths'(test: Test) {
+  test('bundler re-uses assets from previous synths', () => {
     // GIVEN
     const TEST_OUTDIR = path.join(__dirname, 'cdk.out');
     if (fs.existsSync(TEST_OUTDIR)) {
@@ -532,13 +530,13 @@ nodeunitShim({
     const appAssembly = app.synth();
     const app2Assembly = app2.synth();
 
-    test.deepEqual(
-      readDockerStubInputConcat(),
+    expect(
+      readDockerStubInputConcat()).toEqual(
       `run --rm ${USER_ARG} -v /input:/asset-input:delegated -v /output:/asset-output:delegated -w /asset-input alpine DOCKER_STUB_SUCCESS`,
     );
 
-    test.equals(appAssembly.directory, app2Assembly.directory);
-    test.deepEqual(fs.readdirSync(appAssembly.directory), [
+    expect(appAssembly.directory).toEqual(app2Assembly.directory);
+    expect(fs.readdirSync(appAssembly.directory)).toEqual([
       'asset.b1e32e86b3523f2fa512eb99180ee2975a50a4439e63e8badd153f2a68d61aa4',
       'cdk.out',
       'manifest.json',
@@ -546,32 +544,32 @@ nodeunitShim({
       'tree.json',
     ]);
 
-    test.done();
-  },
 
-  'bundling throws when /asset-ouput is empty'(test: Test) {
+  });
+
+  test('bundling throws when /asset-ouput is empty', () => {
     // GIVEN
     const app = new App();
     const stack = new Stack(app, 'stack');
     const directory = path.join(__dirname, 'fs', 'fixtures', 'test1');
 
     // THEN
-    test.throws(() => new AssetStaging(stack, 'Asset', {
+    expect(() => new AssetStaging(stack, 'Asset', {
       sourcePath: directory,
       bundling: {
         image: BundlingDockerImage.fromRegistry('alpine'),
         command: [DockerStubCommand.SUCCESS_NO_OUTPUT],
       },
-    }), /Bundling did not produce any output/);
+    })).toThrow(/Bundling did not produce any output/);
 
-    test.equal(
-      readDockerStubInput(),
+    expect(
+      readDockerStubInput()).toEqual(
       `run --rm ${USER_ARG} -v /input:/asset-input:delegated -v /output:/asset-output:delegated -w /asset-input alpine DOCKER_STUB_SUCCESS_NO_OUTPUT`,
     );
-    test.done();
-  },
 
-  'bundling with BUNDLE asset hash type'(test: Test) {
+  });
+
+  test('bundling with BUNDLE asset hash type', () => {
     // GIVEN
     const app = new App();
     const stack = new Stack(app, 'stack');
@@ -588,17 +586,17 @@ nodeunitShim({
     });
 
     // THEN
-    test.equal(
-      readDockerStubInput(),
+    expect(
+      readDockerStubInput()).toEqual(
       `run --rm ${USER_ARG} -v /input:/asset-input:delegated -v /output:/asset-output:delegated -w /asset-input alpine DOCKER_STUB_SUCCESS`,
     );
-    test.equal(asset.assetHash, '33cbf2cae5432438e0f046bc45ba8c3cef7b6afcf47b59d1c183775c1918fb1f');
+    expect(asset.assetHash).toEqual('33cbf2cae5432438e0f046bc45ba8c3cef7b6afcf47b59d1c183775c1918fb1f');
 
-    test.done();
-  },
 
+  });
 
-  'bundling with docker security option'(test: Test) {
+
+  test('bundling with docker security option', () => {
     // GIVEN
     const app = new App();
     const stack = new Stack(app, 'stack');
@@ -616,16 +614,16 @@ nodeunitShim({
     });
 
     // THEN
-    test.equal(
-      readDockerStubInput(),
+    expect(
+      readDockerStubInput()).toEqual(
       `run --rm --security-opt no-new-privileges ${USER_ARG} -v /input:/asset-input:delegated -v /output:/asset-output:delegated -w /asset-input alpine DOCKER_STUB_SUCCESS`,
     );
-    test.equal(asset.assetHash, '33cbf2cae5432438e0f046bc45ba8c3cef7b6afcf47b59d1c183775c1918fb1f');
+    expect(asset.assetHash).toEqual('33cbf2cae5432438e0f046bc45ba8c3cef7b6afcf47b59d1c183775c1918fb1f');
+
 
-    test.done();
-  },
+  });
 
-  'bundling with OUTPUT asset hash type'(test: Test) {
+  test('bundling with OUTPUT asset hash type', () => {
     // GIVEN
     const app = new App();
     const stack = new Stack(app, 'stack');
@@ -642,12 +640,12 @@ nodeunitShim({
     });
 
     // THEN
-    test.equal(asset.assetHash, '33cbf2cae5432438e0f046bc45ba8c3cef7b6afcf47b59d1c183775c1918fb1f');
+    expect(asset.assetHash).toEqual('33cbf2cae5432438e0f046bc45ba8c3cef7b6afcf47b59d1c183775c1918fb1f');
+
 
-    test.done();
-  },
+  });
 
-  'custom hash'(test: Test) {
+  test('custom hash', () => {
     // GIVEN
     const app = new App();
     const stack = new Stack(app, 'stack');
@@ -660,20 +658,20 @@ nodeunitShim({
     });
 
     // THEN
-    test.equal(fs.existsSync(STUB_INPUT_FILE), false);
-    test.equal(asset.assetHash, 'b9c77053f5b83bbe5ba343bc18e92db939a49017010813225fea91fa892c4823'); // hash of 'my-custom-hash'
+    expect(fs.existsSync(STUB_INPUT_FILE)).toEqual(false);
+    expect(asset.assetHash).toEqual('b9c77053f5b83bbe5ba343bc18e92db939a49017010813225fea91fa892c4823'); // hash of 'my-custom-hash'
 
-    test.done();
-  },
 
-  'throws with assetHash and not CUSTOM hash type'(test: Test) {
+  });
+
+  test('throws with assetHash and not CUSTOM hash type', () => {
     // GIVEN
     const app = new App();
     const stack = new Stack(app, 'stack');
     const directory = path.join(__dirname, 'fs', 'fixtures', 'test1');
 
     // THEN
-    test.throws(() => new AssetStaging(stack, 'Asset', {
+    expect(() => new AssetStaging(stack, 'Asset', {
       sourcePath: directory,
       bundling: {
         image: BundlingDockerImage.fromRegistry('alpine'),
@@ -681,82 +679,82 @@ nodeunitShim({
       },
       assetHash: 'my-custom-hash',
       assetHashType: AssetHashType.BUNDLE,
-    }), /Cannot specify `bundle` for `assetHashType`/);
+    })).toThrow(/Cannot specify `bundle` for `assetHashType`/);
+
 
-    test.done();
-  },
+  });
 
-  'throws with BUNDLE hash type and no bundling'(test: Test) {
+  test('throws with BUNDLE hash type and no bundling', () => {
     // GIVEN
     const app = new App();
     const stack = new Stack(app, 'stack');
     const directory = path.join(__dirname, 'fs', 'fixtures', 'test1');
 
     // THEN
-    test.throws(() => new AssetStaging(stack, 'Asset', {
+    expect(() => new AssetStaging(stack, 'Asset', {
       sourcePath: directory,
       assetHashType: AssetHashType.BUNDLE,
-    }), /Cannot use `bundle` hash type when `bundling` is not specified/);
-    test.equal(fs.existsSync(STUB_INPUT_FILE), false);
+    })).toThrow(/Cannot use `bundle` hash type when `bundling` is not specified/);
+    expect(fs.existsSync(STUB_INPUT_FILE)).toEqual(false);
 
-    test.done();
-  },
 
-  'throws with OUTPUT hash type and no bundling'(test: Test) {
+  });
+
+  test('throws with OUTPUT hash type and no bundling', () => {
     // GIVEN
     const app = new App();
     const stack = new Stack(app, 'stack');
     const directory = path.join(__dirname, 'fs', 'fixtures', 'test1');
 
     // THEN
-    test.throws(() => new AssetStaging(stack, 'Asset', {
+    expect(() => new AssetStaging(stack, 'Asset', {
       sourcePath: directory,
       assetHashType: AssetHashType.OUTPUT,
-    }), /Cannot use `output` hash type when `bundling` is not specified/);
-    test.equal(fs.existsSync(STUB_INPUT_FILE), false);
+    })).toThrow(/Cannot use `output` hash type when `bundling` is not specified/);
+    expect(fs.existsSync(STUB_INPUT_FILE)).toEqual(false);
+
 
-    test.done();
-  },
+  });
 
-  'throws with CUSTOM and no hash'(test: Test) {
+  test('throws with CUSTOM and no hash', () => {
     // GIVEN
     const app = new App();
     const stack = new Stack(app, 'stack');
     const directory = path.join(__dirname, 'fs', 'fixtures', 'test1');
 
     // THEN
-    test.throws(() => new AssetStaging(stack, 'Asset', {
+    expect(() => new AssetStaging(stack, 'Asset', {
       sourcePath: directory,
       assetHashType: AssetHashType.CUSTOM,
-    }), /`assetHash` must be specified when `assetHashType` is set to `AssetHashType.CUSTOM`/);
-    test.equal(fs.existsSync(STUB_INPUT_FILE), false); // "docker" not executed
+    })).toThrow(/`assetHash` must be specified when `assetHashType` is set to `AssetHashType.CUSTOM`/);
+    expect(fs.existsSync(STUB_INPUT_FILE)).toEqual(false); // "docker" not executed
 
-    test.done();
-  },
 
-  'throws when bundling fails'(test: Test) {
+  });
+
+  test('throws when bundling fails', () => {
     // GIVEN
     const app = new App();
     const stack = new Stack(app, 'stack');
     const directory = path.join(__dirname, 'fs', 'fixtures', 'test1');
 
     // THEN
-    test.throws(() => new AssetStaging(stack, 'Asset', {
+    expect(() => new AssetStaging(stack, 'Asset', {
       sourcePath: directory,
       bundling: {
         image: BundlingDockerImage.fromRegistry('this-is-an-invalid-docker-image'),
         command: [DockerStubCommand.FAIL],
       },
-    }), /Failed to bundle asset stack\/Asset/);
-    test.equal(
-      readDockerStubInput(),
+    })).toThrow(/Failed to bundle asset stack\/Asset/);
+    expect(
+      readDockerStubInput()).toEqual(
       `run --rm ${USER_ARG} -v /input:/asset-input:delegated -v /output:/asset-output:delegated -w /asset-input this-is-an-invalid-docker-image DOCKER_STUB_FAIL`,
     );
 
-    test.done();
-  },
 
-  'with local bundling'(test: Test) {
+  });
+
+  test('with local bundling', () => {
     // GIVEN
     const app = new App();
     const stack = new Stack(app, 'stack');
@@ -782,18 +780,18 @@ nodeunitShim({
     });
 
     // THEN
-    test.ok(dir && /asset.[0-9a-f]{16,}/.test(dir));
-    test.equals(opts?.command?.[0], DockerStubCommand.SUCCESS);
-    test.throws(() => readDockerStubInput());
+    expect(dir && /asset.[0-9a-f]{16,}/.test(dir)).toEqual(true);
+    expect(opts?.command?.[0]).toEqual(DockerStubCommand.SUCCESS);
+    expect(() => readDockerStubInput()).toThrow();
 
     if (dir) {
       fs.removeSync(path.join(dir, 'hello.txt'));
     }
 
-    test.done();
-  },
 
-  'with local bundling returning false'(test: Test) {
+  });
+
+  test('with local bundling returning false', () => {
     // GIVEN
     const app = new App();
     const stack = new Stack(app, 'stack');
@@ -814,12 +812,12 @@ nodeunitShim({
     });
 
     // THEN
-    test.ok(readDockerStubInput());
+    expect(readDockerStubInput()).toBeDefined();
+
 
-    test.done();
-  },
+  });
 
-  'bundling can be skipped by setting context'(test: Test) {
+  test('bundling can be skipped by setting context', () => {
     // GIVEN
     const app = new App();
     const stack = new Stack(app, 'MyStack');
@@ -836,16 +834,16 @@ nodeunitShim({
       },
     });
 
-    test.throws(() => readDockerStubInput()); // Bundling did not run
-    test.equal(asset.sourcePath, directory);
-    test.equal(asset.stagedPath, directory);
-    test.equal(asset.relativeStagedPath(stack), directory);
-    test.equal(asset.assetHash, 'f66d7421aa2d044a6c1f60ddfc76dc78571fcd8bd228eb48eb394e2dbad94a5c');
+    expect(() => readDockerStubInput()).toThrow(); // Bundling did not run
+    expect(asset.sourcePath).toEqual(directory);
+    expect(asset.stagedPath).toEqual(directory);
+    expect(asset.relativeStagedPath(stack)).toEqual(directory);
+    expect(asset.assetHash).toEqual('f66d7421aa2d044a6c1f60ddfc76dc78571fcd8bd228eb48eb394e2dbad94a5c');
 
-    test.done();
-  },
 
-  'bundling still occurs with partial wildcard'(test: Test) {
+  });
+
+  test('bundling still occurs with partial wildcard', () => {
     // GIVEN
     const app = new App();
     const stack = new Stack(app, 'MyStack');
@@ -862,16 +860,16 @@ nodeunitShim({
       },
     });
 
-    test.equal(
-      readDockerStubInput(),
+    expect(
+      readDockerStubInput()).toEqual(
       `run --rm ${USER_ARG} -v /input:/asset-input:delegated -v /output:/asset-output:delegated -w /asset-input alpine DOCKER_STUB_SUCCESS`,
     );
-    test.equal(asset.assetHash, '33cbf2cae5432438e0f046bc45ba8c3cef7b6afcf47b59d1c183775c1918fb1f'); // hash of MyStack/Asset
+    expect(asset.assetHash).toEqual('33cbf2cae5432438e0f046bc45ba8c3cef7b6afcf47b59d1c183775c1918fb1f'); // hash of MyStack/Asset
+
 
-    test.done();
-  },
+  });
 
-  'bundling still occurs with full wildcard'(test: Test) {
+  test('bundling still occurs with full wildcard', () => {
     // GIVEN
     const app = new App();
     const stack = new Stack(app, 'MyStack');
@@ -888,16 +886,16 @@ nodeunitShim({
       },
     });
 
-    test.equal(
-      readDockerStubInput(),
+    expect(
+      readDockerStubInput()).toEqual(
       `run --rm ${USER_ARG} -v /input:/asset-input:delegated -v /output:/asset-output:delegated -w /asset-input alpine DOCKER_STUB_SUCCESS`,
     );
-    test.equal(asset.assetHash, '33cbf2cae5432438e0f046bc45ba8c3cef7b6afcf47b59d1c183775c1918fb1f'); // hash of MyStack/Asset
+    expect(asset.assetHash).toEqual('33cbf2cae5432438e0f046bc45ba8c3cef7b6afcf47b59d1c183775c1918fb1f'); // hash of MyStack/Asset
 
-    test.done();
-  },
 
-  'bundling that produces a single archive file is autodiscovered'(test: Test) {
+  });
+
+  test('bundling that produces a single archive file is autodiscovered', () => {
     // GIVEN
     const app = new App();
     const stack = new Stack(app, 'stack');
@@ -914,7 +912,7 @@ nodeunitShim({
 
     // THEN
     const assembly = app.synth();
-    test.deepEqual(fs.readdirSync(assembly.directory), [
+    expect(fs.readdirSync(assembly.directory)).toEqual([
       'asset.f43148c61174f444925231b5849b468f21e93b5d1469cd07c53625ffd039ef48', // this is the bundle dir
       'asset.f43148c61174f444925231b5849b468f21e93b5d1469cd07c53625ffd039ef48.zip',
       'cdk.out',
@@ -922,16 +920,16 @@ nodeunitShim({
       'stack.template.json',
       'tree.json',
     ]);
-    test.deepEqual(fs.readdirSync(path.join(assembly.directory, 'asset.f43148c61174f444925231b5849b468f21e93b5d1469cd07c53625ffd039ef48')), [
+    expect(fs.readdirSync(path.join(assembly.directory, 'asset.f43148c61174f444925231b5849b468f21e93b5d1469cd07c53625ffd039ef48'))).toEqual([
       'test.zip', // bundle dir with "touched" bundled output file
     ]);
-    test.deepEqual(staging.packaging, FileAssetPackaging.FILE);
-    test.deepEqual(staging.isArchive, true);
+    expect(staging.packaging).toEqual(FileAssetPackaging.FILE);
+    expect(staging.isArchive).toEqual(true);
+
 
-    test.done();
-  },
+  });
 
-  'bundling that produces a single archive file with disk cache'(test: Test) {
+  test('bundling that produces a single archive file with disk cache', () => {
     // GIVEN
     const TEST_OUTDIR = path.join(__dirname, 'cdk.out');
     if (fs.existsSync(TEST_OUTDIR)) {
@@ -971,15 +969,15 @@ nodeunitShim({
     });
 
     // THEN
-    test.deepEqual(staging1.packaging, FileAssetPackaging.FILE);
-    test.deepEqual(staging1.isArchive, true);
-    test.deepEqual(staging2.packaging, staging1.packaging);
-    test.deepEqual(staging2.isArchive, staging1.isArchive);
+    expect(staging1.packaging).toEqual(FileAssetPackaging.FILE);
+    expect(staging1.isArchive).toEqual(true);
+    expect(staging2.packaging).toEqual(staging1.packaging);
+    expect(staging2.isArchive).toEqual(staging1.isArchive);
 
-    test.done();
-  },
 
-  'bundling that produces a single archive file with NOT_ARCHIVED'(test: Test) {
+  });
+
+  test('bundling that produces a single archive file with NOT_ARCHIVED', () => {
     // GIVEN
     const app = new App();
     const stack = new Stack(app, 'stack');
@@ -997,38 +995,37 @@ nodeunitShim({
 
     // THEN
     const assembly = app.synth();
-    test.deepEqual(fs.readdirSync(assembly.directory), [
+    expect(fs.readdirSync(assembly.directory)).toEqual([
       'asset.86ec07746e1d859290cfd8b9c648e581555649c75f51f741f11e22cab6775abc',
       'cdk.out',
       'manifest.json',
       'stack.template.json',
       'tree.json',
     ]);
-    test.deepEqual(staging.packaging, FileAssetPackaging.ZIP_DIRECTORY);
-    test.deepEqual(staging.isArchive, true);
+    expect(staging.packaging).toEqual(FileAssetPackaging.ZIP_DIRECTORY);
+    expect(staging.isArchive).toEqual(true);
+
 
-    test.done();
-  },
+  });
 
-  'throws with ARCHIVED and bundling that does not produce a single archive file'(test: Test) {
+  test('throws with ARCHIVED and bundling that does not produce a single archive file', () => {
     // GIVEN
     const app = new App();
     const stack = new Stack(app, 'stack');
     const directory = path.join(__dirname, 'fs', 'fixtures', 'test1');
 
     // WHEN
-    test.throws(() => new AssetStaging(stack, 'Asset', {
+    expect(() => new AssetStaging(stack, 'Asset', {
       sourcePath: directory,
       bundling: {
         image: BundlingDockerImage.fromRegistry('alpine'),
         command: [DockerStubCommand.MULTIPLE_FILES],
         outputType: BundlingOutput.ARCHIVED,
       },
-    }), /Bundling output directory is expected to include only a single .zip or .jar file when `output` is set to `ARCHIVED`/);
+    })).toThrow(/Bundling output directory is expected to include only a single .zip or .jar file when `output` is set to `ARCHIVED`/);
 
 
-    test.done();
-  },
+  });
 });
 
 // Reads a docker stub and cleans the volume paths out of the stub.
diff --git a/packages/@aws-cdk/core/test/synthesis.test.ts b/packages/@aws-cdk/core/test/synthesis.test.ts
index b1dd35cec52fe..42dbb2f3fbc4f 100644
--- a/packages/@aws-cdk/core/test/synthesis.test.ts
+++ b/packages/@aws-cdk/core/test/synthesis.test.ts
@@ -2,15 +2,14 @@ import * as fs from 'fs';
 import * as os from 'os';
 import * as path from 'path';
 import * as cxschema from '@aws-cdk/cloud-assembly-schema';
-import { nodeunitShim, Test } from 'nodeunit-shim';
 import * as cdk from '../lib';
 
 function createModernApp() {
   return new cdk.App();
 }
 
-nodeunitShim({
-  'synthesis with an empty app'(test: Test) {
+describe('synthesis', () => {
+  test('synthesis with an empty app', () => {
     // GIVEN
     const app = createModernApp();
 
@@ -18,15 +17,15 @@ nodeunitShim({
     const session = app.synth();
 
     // THEN
-    test.same(app.synth(), session); // same session if we synth() again
-    test.deepEqual(list(session.directory), ['cdk.out', 'manifest.json', 'tree.json']);
-    test.deepEqual(readJson(session.directory, 'manifest.json').artifacts, {
+    expect(app.synth()).toEqual(session); // same session if we synth() again
+    expect(list(session.directory)).toEqual(['cdk.out', 'manifest.json', 'tree.json']);
+    expect(readJson(session.directory, 'manifest.json').artifacts).toEqual({
       Tree: {
         type: 'cdk:tree',
         properties: { file: 'tree.json' },
       },
     });
-    test.deepEqual(readJson(session.directory, 'tree.json'), {
+    expect(readJson(session.directory, 'tree.json')).toEqual({
       version: 'tree-0.1',
       tree: expect.objectContaining({
         id: 'App',
@@ -36,19 +35,19 @@ nodeunitShim({
         },
       }),
     });
-    test.done();
-  },
 
-  'synthesis respects disabling tree metadata'(test: Test) {
+  });
+
+  test('synthesis respects disabling tree metadata', () => {
     const app = new cdk.App({
       treeMetadata: false,
     });
     const assembly = app.synth();
-    test.deepEqual(list(assembly.directory), ['cdk.out', 'manifest.json']);
-    test.done();
-  },
+    expect(list(assembly.directory)).toEqual(['cdk.out', 'manifest.json']);
+
+  });
 
-  'single empty stack'(test: Test) {
+  test('single empty stack', () => {
     // GIVEN
     const app = createModernApp();
     new cdk.Stack(app, 'one-stack');
@@ -57,11 +56,11 @@ nodeunitShim({
     const session = app.synth();
 
     // THEN
-    test.ok(list(session.directory).includes('one-stack.template.json'));
-    test.done();
-  },
+    expect(list(session.directory).includes('one-stack.template.json')).toEqual(true);
+
+  });
 
-  'some random construct implements "synthesize"'(test: Test) {
+  test('some random construct implements "synthesize"', () => {
     // GIVEN
     const app = createModernApp();
     const stack = new cdk.Stack(app, 'one-stack');
@@ -85,11 +84,11 @@ nodeunitShim({
     const session = app.synth();
 
     // THEN
-    test.ok(list(session.directory).includes('one-stack.template.json'));
-    test.ok(list(session.directory).includes('foo.json'));
+    expect(list(session.directory).includes('one-stack.template.json')).toEqual(true);
+    expect(list(session.directory).includes('foo.json')).toEqual(true);
 
-    test.deepEqual(readJson(session.directory, 'foo.json'), { bar: 123 });
-    test.deepEqual(session.manifest, {
+    expect(readJson(session.directory, 'foo.json')).toEqual({ bar: 123 });
+    expect(session.manifest).toEqual({
       version: cxschema.Manifest.version(),
       artifacts: {
         'Tree': {
@@ -112,10 +111,10 @@ nodeunitShim({
         },
       },
     });
-    test.done();
-  },
 
-  'random construct uses addCustomSynthesis'(test: Test) {
+  });
+
+  test('random construct uses addCustomSynthesis', () => {
     // GIVEN
     const app = createModernApp();
     const stack = new cdk.Stack(app, 'one-stack');
@@ -145,11 +144,11 @@ nodeunitShim({
     const session = app.synth();
 
     // THEN
-    test.ok(list(session.directory).includes('one-stack.template.json'));
-    test.ok(list(session.directory).includes('foo.json'));
+    expect(list(session.directory).includes('one-stack.template.json')).toEqual(true);
+    expect(list(session.directory).includes('foo.json')).toEqual(true);
 
-    test.deepEqual(readJson(session.directory, 'foo.json'), { bar: 123 });
-    test.deepEqual(session.manifest, {
+    expect(readJson(session.directory, 'foo.json')).toEqual({ bar: 123 });
+    expect(session.manifest).toEqual({
       version: cxschema.Manifest.version(),
       artifacts: {
         'Tree': {
@@ -172,10 +171,10 @@ nodeunitShim({
         },
       },
     });
-    test.done();
-  },
 
-  'it should be possible to synthesize without an app'(test: Test) {
+  });
+
+  test('it should be possible to synthesize without an app', () => {
     const calls = new Array<string>();
 
     class SynthesizeMe extends cdk.Construct {
@@ -214,14 +213,14 @@ nodeunitShim({
     const root = new SynthesizeMe();
     const assembly = cdk.ConstructNode.synth(root.node, { outdir: fs.mkdtempSync(path.join(os.tmpdir(), 'outdir')) });
 
-    test.deepEqual(calls, ['prepare', 'validate', 'synthesize']);
+    expect(calls).toEqual(['prepare', 'validate', 'synthesize']);
     const stack = assembly.getStackByName('art');
-    test.deepEqual(stack.template, { hello: 123 });
-    test.deepEqual(stack.templateFile, 'hey.json');
-    test.deepEqual(stack.parameters, { paramId: 'paramValue', paramId2: 'paramValue2' });
-    test.deepEqual(stack.environment, { region: 'us-east-1', account: 'unknown-account', name: 'aws://unknown-account/us-east-1' });
-    test.done();
-  },
+    expect(stack.template).toEqual({ hello: 123 });
+    expect(stack.templateFile).toEqual('hey.json');
+    expect(stack.parameters).toEqual({ paramId: 'paramValue', paramId2: 'paramValue2' });
+    expect(stack.environment).toEqual({ region: 'us-east-1', account: 'unknown-account', name: 'aws://unknown-account/us-east-1' });
+
+  });
 });
 
 function list(outdir: string) {
diff --git a/packages/@aws-cdk/core/test/tag-aspect.test.ts b/packages/@aws-cdk/core/test/tag-aspect.test.ts
index b0871e2d13c02..3667484d8f44d 100644
--- a/packages/@aws-cdk/core/test/tag-aspect.test.ts
+++ b/packages/@aws-cdk/core/test/tag-aspect.test.ts
@@ -1,4 +1,3 @@
-import { nodeunitShim, Test } from 'nodeunit-shim';
 import { CfnResource, CfnResourceProps, Construct, RemoveTag, Stack, Tag, TagManager, TagType, Aspects, Tags } from '../lib';
 import { synthesize } from '../lib/private/synthesis';
 
@@ -38,8 +37,8 @@ class MapTaggableResource extends CfnResource {
   }
 }
 
-nodeunitShim({
-  'Tag visit all children of the applied node'(test: Test) {
+describe('tag aspect', () => {
+  test('Tag visit all children of the applied node', () => {
     const root = new Stack();
     const res = new TaggableResource(root, 'FakeResource', {
       type: 'AWS::Fake::Thing',
@@ -58,13 +57,13 @@ nodeunitShim({
 
     synthesize(root);
 
-    test.deepEqual(res.tags.renderTags(), [{ key: 'foo', value: 'bar' }]);
-    test.deepEqual(res2.tags.renderTags(), [{ key: 'foo', value: 'bar' }]);
-    test.deepEqual(map.tags.renderTags(), { foo: 'bar' });
-    test.deepEqual(asg.tags.renderTags(), [{ key: 'foo', value: 'bar', propagateAtLaunch: true }]);
-    test.done();
-  },
-  'The last aspect applied takes precedence'(test: Test) {
+    expect(res.tags.renderTags()).toEqual([{ key: 'foo', value: 'bar' }]);
+    expect(res2.tags.renderTags()).toEqual([{ key: 'foo', value: 'bar' }]);
+    expect(map.tags.renderTags()).toEqual({ foo: 'bar' });
+    expect(asg.tags.renderTags()).toEqual([{ key: 'foo', value: 'bar', propagateAtLaunch: true }]);
+
+  });
+  test('The last aspect applied takes precedence', () => {
     const root = new Stack();
     const res = new TaggableResource(root, 'FakeResource', {
       type: 'AWS::Fake::Thing',
@@ -77,11 +76,11 @@ nodeunitShim({
     Aspects.of(res).add(new Tag('foo', 'baz'));
     Aspects.of(res2).add(new Tag('foo', 'good'));
     synthesize(root);
-    test.deepEqual(res.tags.renderTags(), [{ key: 'foo', value: 'baz' }]);
-    test.deepEqual(res2.tags.renderTags(), [{ key: 'foo', value: 'good' }]);
-    test.done();
-  },
-  'RemoveTag will remove a tag if it exists'(test: Test) {
+    expect(res.tags.renderTags()).toEqual([{ key: 'foo', value: 'baz' }]);
+    expect(res2.tags.renderTags()).toEqual([{ key: 'foo', value: 'good' }]);
+
+  });
+  test('RemoveTag will remove a tag if it exists', () => {
     const root = new Stack();
     const res = new TaggableResource(root, 'FakeResource', {
       type: 'AWS::Fake::Thing',
@@ -102,13 +101,13 @@ nodeunitShim({
     Aspects.of(res).add(new RemoveTag('doesnotexist'));
     synthesize(root);
 
-    test.deepEqual(res.tags.renderTags(), [{ key: 'first', value: 'there is only 1' }]);
-    test.deepEqual(map.tags.renderTags(), { first: 'there is only 1' });
-    test.deepEqual(asg.tags.renderTags(), [{ key: 'first', value: 'there is only 1', propagateAtLaunch: true }]);
-    test.deepEqual(res2.tags.renderTags(), [{ key: 'first', value: 'there is only 1' }]);
-    test.done();
-  },
-  'add will add a tag and remove will remove a tag if it exists'(test: Test) {
+    expect(res.tags.renderTags()).toEqual([{ key: 'first', value: 'there is only 1' }]);
+    expect(map.tags.renderTags()).toEqual({ first: 'there is only 1' });
+    expect(asg.tags.renderTags()).toEqual([{ key: 'first', value: 'there is only 1', propagateAtLaunch: true }]);
+    expect(res2.tags.renderTags()).toEqual([{ key: 'first', value: 'there is only 1' }]);
+
+  });
+  test('add will add a tag and remove will remove a tag if it exists', () => {
     const root = new Stack();
     const res = new TaggableResource(root, 'FakeResource', {
       type: 'AWS::Fake::Thing',
@@ -130,13 +129,13 @@ nodeunitShim({
 
     synthesize(root);
 
-    test.deepEqual(res.tags.renderTags(), [{ key: 'first', value: 'there is only 1' }]);
-    test.deepEqual(map.tags.renderTags(), { first: 'there is only 1' });
-    test.deepEqual(asg.tags.renderTags(), [{ key: 'first', value: 'there is only 1', propagateAtLaunch: true }]);
-    test.deepEqual(res2.tags.renderTags(), [{ key: 'first', value: 'there is only 1' }]);
-    test.done();
-  },
-  'the #visit function is idempotent'(test: Test) {
+    expect(res.tags.renderTags()).toEqual([{ key: 'first', value: 'there is only 1' }]);
+    expect(map.tags.renderTags()).toEqual({ first: 'there is only 1' });
+    expect(asg.tags.renderTags()).toEqual([{ key: 'first', value: 'there is only 1', propagateAtLaunch: true }]);
+    expect(res2.tags.renderTags()).toEqual([{ key: 'first', value: 'there is only 1' }]);
+
+  });
+  test('the #visit function is idempotent', () => {
     const root = new Stack();
     const res = new TaggableResource(root, 'FakeResource', {
       type: 'AWS::Fake::Thing',
@@ -144,14 +143,14 @@ nodeunitShim({
 
     Aspects.of(res).add(new Tag('foo', 'bar'));
     synthesize(root);
-    test.deepEqual(res.tags.renderTags(), [{ key: 'foo', value: 'bar' }]);
+    expect(res.tags.renderTags()).toEqual([{ key: 'foo', value: 'bar' }]);
     synthesize(root);
-    test.deepEqual(res.tags.renderTags(), [{ key: 'foo', value: 'bar' }]);
+    expect(res.tags.renderTags()).toEqual([{ key: 'foo', value: 'bar' }]);
     synthesize(root);
-    test.deepEqual(res.tags.renderTags(), [{ key: 'foo', value: 'bar' }]);
-    test.done();
-  },
-  'removeTag Aspects by default will override child Tag Aspects'(test: Test) {
+    expect(res.tags.renderTags()).toEqual([{ key: 'foo', value: 'bar' }]);
+
+  });
+  test('removeTag Aspects by default will override child Tag Aspects', () => {
     const root = new Stack();
     const res = new TaggableResource(root, 'FakeResource', {
       type: 'AWS::Fake::Thing',
@@ -162,11 +161,11 @@ nodeunitShim({
     Aspects.of(res).add(new RemoveTag('key'));
     Aspects.of(res2).add(new Tag('key', 'value'));
     synthesize(root);
-    test.deepEqual(res.tags.renderTags(), undefined);
-    test.deepEqual(res2.tags.renderTags(), undefined);
-    test.done();
-  },
-  'removeTag Aspects with priority 0 will not override child Tag Aspects'(test: Test) {
+    expect(res.tags.renderTags()).toEqual(undefined);
+    expect(res2.tags.renderTags()).toEqual(undefined);
+
+  });
+  test('removeTag Aspects with priority 0 will not override child Tag Aspects', () => {
     const root = new Stack();
     const res = new TaggableResource(root, 'FakeResource', {
       type: 'AWS::Fake::Thing',
@@ -177,11 +176,11 @@ nodeunitShim({
     Aspects.of(res).add(new RemoveTag('key', { priority: 0 }));
     Aspects.of(res2).add(new Tag('key', 'value'));
     synthesize(root);
-    test.deepEqual(res.tags.renderTags(), undefined);
-    test.deepEqual(res2.tags.renderTags(), [{ key: 'key', value: 'value' }]);
-    test.done();
-  },
-  'Aspects are merged with tags created by L1 Constructor'(test: Test) {
+    expect(res.tags.renderTags()).toEqual(undefined);
+    expect(res2.tags.renderTags()).toEqual([{ key: 'key', value: 'value' }]);
+
+  });
+  test('Aspects are merged with tags created by L1 Constructor', () => {
     const root = new Stack();
     const aspectBranch = new TaggableResource(root, 'FakeBranchA', {
       type: 'AWS::Fake::Thing',
@@ -220,22 +219,22 @@ nodeunitShim({
     });
     Aspects.of(aspectBranch).add(new Tag('aspects', 'rule'));
     synthesize(root);
-    test.deepEqual(aspectBranch.testProperties().tags, [{ key: 'aspects', value: 'rule' }, { key: 'cfn', value: 'is cool' }]);
-    test.deepEqual(asgResource.testProperties().tags, [
+    expect(aspectBranch.testProperties().tags).toEqual([{ key: 'aspects', value: 'rule' }, { key: 'cfn', value: 'is cool' }]);
+    expect(asgResource.testProperties().tags).toEqual([
       { key: 'aspects', value: 'rule', propagateAtLaunch: true },
       { key: 'cfn', value: 'is cool', propagateAtLaunch: true },
     ]);
-    test.deepEqual(mapTaggable.testProperties().tags, {
+    expect(mapTaggable.testProperties().tags).toEqual({
       aspects: 'rule',
       cfn: 'is cool',
     });
-    test.deepEqual(cfnBranch.testProperties().tags, [{ key: 'cfn', value: 'is cool' }]);
-    test.done();
-  },
-  'when invalid tag properties are passed from L1s': {
-    'map passed instead of array it raises'(test: Test) {
+    expect(cfnBranch.testProperties().tags).toEqual([{ key: 'cfn', value: 'is cool' }]);
+
+  });
+  describe('when invalid tag properties are passed from L1s', () => {
+    test('map passed instead of array it raises', () => {
       const root = new Stack();
-      test.throws(() => {
+      expect(() => {
         new TaggableResource(root, 'FakeBranchA', {
           type: 'AWS::Fake::Thing',
           properties: {
@@ -245,8 +244,8 @@ nodeunitShim({
             },
           },
         });
-      });
-      test.throws(() => {
+      }).toThrow();
+      expect(() => {
         new AsgTaggableResource(root, 'FakeBranchA', {
           type: 'AWS::Fake::Thing',
           properties: {
@@ -257,12 +256,12 @@ nodeunitShim({
             },
           },
         });
-      });
-      test.done();
-    },
-    'if array is passed instead of map it raises'(test: Test) {
+      }).toThrow();
+
+    });
+    test('if array is passed instead of map it raises', () => {
       const root = new Stack();
-      test.throws(() => {
+      expect(() => {
         new MapTaggableResource(root, 'FakeSam', {
           type: 'AWS::Fake::Thing',
           properties: {
@@ -272,8 +271,8 @@ nodeunitShim({
             ],
           },
         });
-      });
-      test.done();
-    },
-  },
+      }).toThrow();
+
+    });
+  });
 });
diff --git a/packages/@aws-cdk/core/test/tag-manager.test.ts b/packages/@aws-cdk/core/test/tag-manager.test.ts
index 7e9e448e97434..79b764f6c13b0 100644
--- a/packages/@aws-cdk/core/test/tag-manager.test.ts
+++ b/packages/@aws-cdk/core/test/tag-manager.test.ts
@@ -1,63 +1,62 @@
-import { nodeunitShim, Test } from 'nodeunit-shim';
 import { TagType } from '../lib/cfn-resource';
 import { TagManager } from '../lib/tag-manager';
 
-nodeunitShim({
-  'TagManagerOptions can set tagPropertyName'(test: Test) {
+describe('tag manager', () => {
+  test('TagManagerOptions can set tagPropertyName', () => {
     const tagPropName = 'specialName';
     const mgr = new TagManager(TagType.MAP, 'Foo', undefined, { tagPropertyName: tagPropName });
 
-    test.deepEqual(mgr.tagPropertyName, tagPropName);
-    test.done();
-  },
-  '#setTag() supports setting a tag regardless of Type'(test: Test) {
+    expect(mgr.tagPropertyName).toEqual(tagPropName);
+
+  });
+  test('#setTag() supports setting a tag regardless of Type', () => {
     const notTaggable = new TagManager(TagType.NOT_TAGGABLE, 'AWS::Resource::Type');
     notTaggable.setTag('key', 'value');
-    test.deepEqual(notTaggable.renderTags(), undefined);
-    test.done();
-  },
-  'when a tag does not exist': {
-    '#removeTag() does not throw an error'(test: Test) {
+    expect(notTaggable.renderTags()).toEqual(undefined);
+
+  });
+  describe('when a tag does not exist', () => {
+    test('#removeTag() does not throw an error', () => {
       const mgr = new TagManager(TagType.STANDARD, 'AWS::Resource::Type');
-      test.doesNotThrow(() => (mgr.removeTag('dne', 0)));
-      test.done();
-    },
-    '#setTag() creates the tag'(test: Test) {
+      expect(() => (mgr.removeTag('dne', 0))).not.toThrow();
+
+    });
+    test('#setTag() creates the tag', () => {
       const mgr = new TagManager(TagType.STANDARD, 'AWS::Resource::Type');
       mgr.setTag('dne', 'notanymore');
-      test.deepEqual(mgr.renderTags(), [{ key: 'dne', value: 'notanymore' }]);
-      test.done();
-    },
-  },
-  'when a tag does exist': {
-    '#removeTag() deletes the tag'(test: Test) {
+      expect(mgr.renderTags()).toEqual([{ key: 'dne', value: 'notanymore' }]);
+
+    });
+  });
+  describe('when a tag does exist', () => {
+    test('#removeTag() deletes the tag', () => {
       const mgr = new TagManager(TagType.STANDARD, 'AWS::Resource::Type');
       mgr.setTag('dne', 'notanymore', 0);
       mgr.removeTag('dne', 0);
-      test.deepEqual(mgr.renderTags(), undefined);
-      test.done();
-    },
-    '#setTag() overwrites the tag'(test: Test) {
+      expect(mgr.renderTags()).toEqual(undefined);
+
+    });
+    test('#setTag() overwrites the tag', () => {
       const mgr = new TagManager(TagType.STANDARD, 'AWS::Resource::Type');
       mgr.setTag('dne', 'notanymore');
       mgr.setTag('dne', 'iwin');
-      test.deepEqual(mgr.renderTags(), [{ key: 'dne', value: 'iwin' }]);
-      test.done();
-    },
-  },
-  'when there are no tags': {
-    '#renderTags() returns undefined'(test: Test) {
+      expect(mgr.renderTags()).toEqual([{ key: 'dne', value: 'iwin' }]);
+
+    });
+  });
+  describe('when there are no tags', () => {
+    test('#renderTags() returns undefined', () => {
       const mgr = new TagManager(TagType.STANDARD, 'AWS::Resource::Type');
-      test.deepEqual(mgr.renderTags(), undefined);
-      test.done();
-    },
-    '#hasTags() returns false'(test: Test) {
+      expect(mgr.renderTags()).toEqual(undefined);
+
+    });
+    test('#hasTags() returns false', () => {
       const mgr = new TagManager(TagType.STANDARD, 'AWS::Resource::Type');
-      test.equal(mgr.hasTags(), false);
-      test.done();
-    },
-  },
-  '#renderTags() handles standard, map, keyValue, and ASG tag formats'(test: Test) {
+      expect(mgr.hasTags()).toEqual(false);
+
+    });
+  });
+  test('#renderTags() handles standard, map, keyValue, and ASG tag formats', () => {
     const tagged: TagManager[] = [];
     const standard = new TagManager(TagType.STANDARD, 'AWS::Resource::Type');
     const asg = new TagManager(TagType.AUTOSCALING_GROUP, 'AWS::Resource::Type');
@@ -71,79 +70,79 @@ nodeunitShim({
       res.setTag('foo', 'bar');
       res.setTag('asg', 'only', 0, false);
     }
-    test.deepEqual(standard.renderTags(), [
+    expect(standard.renderTags()).toEqual([
       { key: 'asg', value: 'only' },
       { key: 'foo', value: 'bar' },
     ]);
-    test.deepEqual(asg.renderTags(), [
+    expect(asg.renderTags()).toEqual([
       { key: 'asg', value: 'only', propagateAtLaunch: false },
       { key: 'foo', value: 'bar', propagateAtLaunch: true },
     ]);
-    test.deepEqual(keyValue.renderTags(), [
+    expect(keyValue.renderTags()).toEqual([
       { Key: 'asg', Value: 'only' },
       { Key: 'foo', Value: 'bar' },
     ]);
-    test.deepEqual(mapper.renderTags(), {
+    expect(mapper.renderTags()).toEqual({
       foo: 'bar',
       asg: 'only',
     });
-    test.done();
-  },
-  'when there are tags it hasTags returns true'(test: Test) {
+
+  });
+  test('when there are tags it hasTags returns true', () => {
     const mgr = new TagManager(TagType.STANDARD, 'AWS::Resource::Type');
     mgr.setTag('key', 'myVal', 2);
     mgr.setTag('key', 'newVal', 1);
-    test.equal(mgr.hasTags(), true);
-    test.done();
-  },
-  'tags with higher or equal priority always take precedence'(test: Test) {
+    expect(mgr.hasTags()).toEqual(true);
+
+  });
+  test('tags with higher or equal priority always take precedence', () => {
     const mgr = new TagManager(TagType.STANDARD, 'AWS::Resource::Type');
     mgr.setTag('key', 'myVal', 2);
     mgr.setTag('key', 'newVal', 1);
-    test.deepEqual(mgr.renderTags(), [
+    expect(mgr.renderTags()).toEqual([
       { key: 'key', value: 'myVal' },
     ]);
     mgr.removeTag('key', 1);
-    test.deepEqual(mgr.renderTags(), [
+    expect(mgr.renderTags()).toEqual([
       { key: 'key', value: 'myVal' },
     ]);
     mgr.removeTag('key', 2);
-    test.deepEqual(mgr.renderTags(), undefined);
-    test.done();
-  },
-  'tags are always ordered by key name'(test: Test) {
+    expect(mgr.renderTags()).toEqual(undefined);
+
+  });
+  test('tags are always ordered by key name', () => {
     const mgr = new TagManager(TagType.STANDARD, 'AWS::Resource::Type');
     mgr.setTag('key', 'foo');
     mgr.setTag('aardvark', 'zebra');
     mgr.setTag('name', 'test');
-    test.deepEqual(mgr.renderTags(), [
+    expect(mgr.renderTags()).toEqual([
       { key: 'aardvark', value: 'zebra' },
       { key: 'key', value: 'foo' },
       { key: 'name', value: 'test' },
     ]);
     mgr.setTag('myKey', 'myVal');
-    test.deepEqual(mgr.renderTags(), [
+    expect(mgr.renderTags()).toEqual([
       { key: 'aardvark', value: 'zebra' },
       { key: 'key', value: 'foo' },
       { key: 'myKey', value: 'myVal' },
       { key: 'name', value: 'test' },
     ]);
-    test.done();
-  },
-  'excludeResourceTypes only tags resources that do not match'(test: Test) {
+
+  });
+  test('excludeResourceTypes only tags resources that do not match', () => {
     const mgr = new TagManager(TagType.STANDARD, 'AWS::Fake::Resource');
 
-    test.equal(false, mgr.applyTagAspectHere([], ['AWS::Fake::Resource']));
-    test.equal(true, mgr.applyTagAspectHere([], ['AWS::Wrong::Resource']));
+    expect(false).toEqual(mgr.applyTagAspectHere([], ['AWS::Fake::Resource']));
+    expect(true).toEqual(mgr.applyTagAspectHere([], ['AWS::Wrong::Resource']));
 
-    test.done();
-  },
-  'includeResourceTypes only tags resources that match'(test: Test) {
+
+  });
+  test('includeResourceTypes only tags resources that match', () => {
     const mgr = new TagManager(TagType.STANDARD, 'AWS::Fake::Resource');
 
-    test.equal(true, mgr.applyTagAspectHere(['AWS::Fake::Resource'], []));
-    test.equal(false, mgr.applyTagAspectHere(['AWS::Wrong::Resource'], []));
+    expect(true).toEqual(mgr.applyTagAspectHere(['AWS::Fake::Resource'], []));
+    expect(false).toEqual(mgr.applyTagAspectHere(['AWS::Wrong::Resource'], []));
+
 
-    test.done();
-  },
+  });
 });
diff --git a/packages/@aws-cdk/core/test/tokens.test.ts b/packages/@aws-cdk/core/test/tokens.test.ts
index eba1e75686048..1aca7312357fa 100644
--- a/packages/@aws-cdk/core/test/tokens.test.ts
+++ b/packages/@aws-cdk/core/test/tokens.test.ts
@@ -1,4 +1,3 @@
-import { nodeunitShim, Test } from 'nodeunit-shim';
 import { Fn, isResolvableObject, Lazy, Stack, Token, Tokenization } from '../lib';
 import { createTokenDouble, extractTokenDouble } from '../lib/private/encoding';
 import { Intrinsic } from '../lib/private/intrinsic';
@@ -7,32 +6,32 @@ import { IResolvable } from '../lib/resolvable';
 import { evaluateCFN } from './evaluate-cfn';
 import { reEnableStackTraceCollection, restoreStackTraceColection } from './util';
 
-nodeunitShim({
-  'resolve a plain old object should just return the object'(test: Test) {
+describe('tokens', () => {
+  test('resolve a plain old object should just return the object', () => {
     const obj = { PlainOldObject: 123, Array: [1, 2, 3] };
-    test.deepEqual(resolve(obj), obj);
-    test.done();
-  },
+    expect(resolve(obj)).toEqual(obj);
 
-  'if a value is an object with a token value, it will be evaluated'(test: Test) {
+  });
+
+  test('if a value is an object with a token value, it will be evaluated', () => {
     const obj = {
       RegularValue: 'hello',
       LazyValue: new Intrinsic('World'),
     };
 
-    test.deepEqual(resolve(obj), {
+    expect(resolve(obj)).toEqual({
       RegularValue: 'hello',
       LazyValue: 'World',
     });
 
-    test.done();
-  },
 
-  'tokens are evaluated anywhere in the object tree'(test: Test) {
+  });
+
+  test('tokens are evaluated anywhere in the object tree', () => {
     const obj = new Promise1();
     const actual = resolve({ Obj: obj });
 
-    test.deepEqual(actual, {
+    expect(actual).toEqual({
       Obj: [
         {
           Data: {
@@ -51,14 +50,14 @@ nodeunitShim({
       ],
     });
 
-    test.done();
-  },
 
-  'tokens are evaluated recursively'(test: Test) {
+  });
+
+  test('tokens are evaluated recursively', () => {
     const obj = new Promise1();
     const actual = resolve(new Intrinsic({ Obj: obj }));
 
-    test.deepEqual(actual, {
+    expect(actual).toEqual({
       Obj: [
         {
           Data: {
@@ -77,12 +76,12 @@ nodeunitShim({
       ],
     });
 
-    test.done();
-  },
 
-  'empty arrays or objects are kept'(test: Test) {
-    test.deepEqual(resolve({ }), { });
-    test.deepEqual(resolve([]), []);
+  });
+
+  test('empty arrays or objects are kept', () => {
+    expect(resolve({ })).toEqual({ });
+    expect(resolve([])).toEqual([]);
 
     const obj = {
       Prop1: 1234,
@@ -98,7 +97,7 @@ nodeunitShim({
       },
     };
 
-    test.deepEqual(resolve(obj), {
+    expect(resolve(obj)).toEqual({
       Prop1: 1234,
       Prop2: { },
       Prop3: [],
@@ -112,44 +111,44 @@ nodeunitShim({
       },
     });
 
-    test.done();
-  },
 
-  'if an object has a "resolve" property that is not a function, it is not considered a token'(test: Test) {
-    test.deepEqual(resolve({ a_token: { resolve: () => 78787 } }), { a_token: 78787 });
-    test.deepEqual(resolve({ not_a_token: { resolve: 12 } }), { not_a_token: { resolve: 12 } });
-    test.done();
-  },
+  });
+
+  test('if an object has a "resolve" property that is not a function, it is not considered a token', () => {
+    expect(resolve({ a_token: { resolve: () => 78787 } })).toEqual({ a_token: 78787 });
+    expect(resolve({ not_a_token: { resolve: 12 } })).toEqual({ not_a_token: { resolve: 12 } });
+
+  });
 
   // eslint-disable-next-line max-len
-  'if a resolvable object inherits from a class that is also resolvable, the "constructor" function will not get in the way (uses Object.keys instead of "for in")'(test: Test) {
-    test.deepEqual(resolve({ prop: new DataType() }), { prop: { foo: 12, goo: 'hello' } });
-    test.done();
-  },
-
-  'isToken(obj) can be used to determine if an object is a token'(test: Test) {
-    test.ok(isResolvableObject({ resolve: () => 123 }));
-    test.ok(isResolvableObject({ a: 1, b: 2, resolve: () => 'hello' }));
-    test.ok(!isResolvableObject({ a: 1, b: 2, resolve: 3 }));
-    test.done();
-  },
-
-  'Token can be used to create tokens that contain a constant value'(test: Test) {
-    test.equal(resolve(new Intrinsic(12)), 12);
-    test.equal(resolve(new Intrinsic('hello')), 'hello');
-    test.deepEqual(resolve(new Intrinsic(['hi', 'there'])), ['hi', 'there']);
-    test.done();
-  },
-
-  'resolving leaves a Date object in working order'(test: Test) {
+  test('if a resolvable object inherits from a class that is also resolvable, the "constructor" function will not get in the way (uses Object.keys instead of "for in")', () => {
+    expect(resolve({ prop: new DataType() })).toEqual({ prop: { foo: 12, goo: 'hello' } });
+
+  });
+
+  test('isToken(obj) can be used to determine if an object is a token', () => {
+    expect(isResolvableObject({ resolve: () => 123 })).toEqual(true);
+    expect(isResolvableObject({ a: 1, b: 2, resolve: () => 'hello' })).toEqual(true);
+    expect(isResolvableObject({ a: 1, b: 2, resolve: 3 })).toEqual(false);
+
+  });
+
+  test('Token can be used to create tokens that contain a constant value', () => {
+    expect(resolve(new Intrinsic(12))).toEqual(12);
+    expect(resolve(new Intrinsic('hello'))).toEqual('hello');
+    expect(resolve(new Intrinsic(['hi', 'there']))).toEqual(['hi', 'there']);
+
+  });
+
+  test('resolving leaves a Date object in working order', () => {
     const date = new Date('2000-01-01');
     const resolved = resolve(date);
 
-    test.equal(date.toString(), resolved.toString());
-    test.done();
-  },
+    expect(date.toString()).toEqual(resolved.toString());
 
-  'tokens can be stringified and evaluated to conceptual value'(test: Test) {
+  });
+
+  test('tokens can be stringified and evaluated to conceptual value', () => {
     // GIVEN
     const token = new Intrinsic('woof woof');
 
@@ -158,20 +157,20 @@ nodeunitShim({
     const resolved = resolve(stringified);
 
     // THEN
-    test.deepEqual(evaluateCFN(resolved), 'The dog says: woof woof');
-    test.done();
-  },
+    expect(evaluateCFN(resolved)).toEqual('The dog says: woof woof');
+
+  });
 
-  'tokens stringification can be reversed'(test: Test) {
+  test('tokens stringification can be reversed', () => {
     // GIVEN
     const token = new Intrinsic('woof woof');
 
     // THEN
-    test.equal(token, Tokenization.reverseString(`${token}`).firstToken);
-    test.done();
-  },
+    expect(token).toEqual(Tokenization.reverseString(`${token}`).firstToken);
+
+  });
 
-  'Tokens stringification and reversing of CloudFormation Tokens is implemented using Fn::Join'(test: Test) {
+  test('Tokens stringification and reversing of CloudFormation Tokens is implemented using Fn::Join', () => {
     // GIVEN
     const token = new Intrinsic( ({ woof: 'woof' }));
 
@@ -180,13 +179,13 @@ nodeunitShim({
     const resolved = resolve(stringified);
 
     // THEN
-    test.deepEqual(resolved, {
+    expect(resolved).toEqual({
       'Fn::Join': ['', ['The dog says: ', { woof: 'woof' }]],
     });
-    test.done();
-  },
 
-  'Doubly nested strings evaluate correctly in scalar context'(test: Test) {
+  });
+
+  test('Doubly nested strings evaluate correctly in scalar context', () => {
     // GIVEN
     const token1 = new Intrinsic( 'world');
     const token2 = new Intrinsic( `hello ${token1}`);
@@ -196,13 +195,13 @@ nodeunitShim({
     const resolved2 = resolve(token2);
 
     // THEN
-    test.deepEqual(evaluateCFN(resolved1), 'hello world');
-    test.deepEqual(evaluateCFN(resolved2), 'hello world');
+    expect(evaluateCFN(resolved1)).toEqual('hello world');
+    expect(evaluateCFN(resolved2)).toEqual('hello world');
+
 
-    test.done();
-  },
+  });
 
-  'integer Tokens can be stringified and evaluate to conceptual value'(test: Test) {
+  test('integer Tokens can be stringified and evaluate to conceptual value', () => {
     // GIVEN
     for (const token of tokensThatResolveTo(1)) {
       // WHEN
@@ -210,12 +209,12 @@ nodeunitShim({
       const resolved = resolve(stringified);
 
       // THEN
-      test.deepEqual(evaluateCFN(resolved), 'the number is 1');
+      expect(evaluateCFN(resolved)).toEqual('the number is 1');
     }
-    test.done();
-  },
 
-  'intrinsic Tokens can be stringified and evaluate to conceptual value'(test: Test) {
+  });
+
+  test('intrinsic Tokens can be stringified and evaluate to conceptual value', () => {
     // GIVEN
     for (const bucketName of tokensThatResolveTo({ Ref: 'MyBucket' })) {
       // WHEN
@@ -223,26 +222,26 @@ nodeunitShim({
 
       // THEN
       const context = { MyBucket: 'TheName' };
-      test.equal(evaluateCFN(resolved, context), 'my bucket is named TheName');
+      expect(evaluateCFN(resolved, context)).toEqual('my bucket is named TheName');
     }
 
-    test.done();
-  },
 
-  'tokens resolve properly in initial position'(test: Test) {
+  });
+
+  test('tokens resolve properly in initial position', () => {
     // GIVEN
     for (const token of tokensThatResolveTo('Hello')) {
       // WHEN
       const resolved = resolve(`${token} world`);
 
       // THEN
-      test.equal(evaluateCFN(resolved), 'Hello world');
+      expect(evaluateCFN(resolved)).toEqual('Hello world');
     }
 
-    test.done();
-  },
 
-  'side-by-side Tokens resolve correctly'(test: Test) {
+  });
+
+  test('side-by-side Tokens resolve correctly', () => {
     // GIVEN
     for (const token1 of tokensThatResolveTo('Hello ')) {
       for (const token2 of tokensThatResolveTo('world')) {
@@ -250,14 +249,14 @@ nodeunitShim({
         const resolved = resolve(`${token1}${token2}`);
 
         // THEN
-        test.equal(evaluateCFN(resolved), 'Hello world');
+        expect(evaluateCFN(resolved)).toEqual('Hello world');
       }
     }
 
-    test.done();
-  },
 
-  'tokens can be used in hash keys but must resolve to a string'(test: Test) {
+  });
+
+  test('tokens can be used in hash keys but must resolve to a string', () => {
     // GIVEN
     const token = new Intrinsic( 'I am a string');
 
@@ -267,11 +266,11 @@ nodeunitShim({
     };
 
     // THEN
-    test.deepEqual(resolve(s), { 'I am a string': 'boom I am a string' });
-    test.done();
-  },
+    expect(resolve(s)).toEqual({ 'I am a string': 'boom I am a string' });
 
-  'tokens can be nested in hash keys'(test: Test) {
+  });
+
+  test('tokens can be nested in hash keys', () => {
     // GIVEN
     const token = new Intrinsic(Lazy.string({ produce: () => Lazy.string({ produce: (() => 'I am a string') }) }));
 
@@ -281,11 +280,11 @@ nodeunitShim({
     };
 
     // THEN
-    test.deepEqual(resolve(s), { 'I am a string': 'boom I am a string' });
-    test.done();
-  },
+    expect(resolve(s)).toEqual({ 'I am a string': 'boom I am a string' });
+
+  });
 
-  'Function passed to Lazy.uncachedString() is evaluated multiple times'(test: Test) {
+  test('Function passed to Lazy.uncachedString() is evaluated multiple times', () => {
     // GIVEN
     let counter = 0;
     const counterString = Lazy.uncachedString({ produce: () => `${++counter}` });
@@ -294,10 +293,10 @@ nodeunitShim({
     expect(resolve(counterString)).toEqual('1');
     expect(resolve(counterString)).toEqual('2');
 
-    test.done();
-  },
 
-  'Function passed to Lazy.string() is only evaluated once'(test: Test) {
+  });
+
+  test('Function passed to Lazy.string() is only evaluated once', () => {
     // GIVEN
     let counter = 0;
     const counterString = Lazy.string({ produce: () => `${++counter}` });
@@ -306,10 +305,10 @@ nodeunitShim({
     expect(resolve(counterString)).toEqual('1');
     expect(resolve(counterString)).toEqual('1');
 
-    test.done();
-  },
 
-  'Uncached tokens returned by cached tokens are still evaluated multiple times'(test: Test) {
+  });
+
+  test('Uncached tokens returned by cached tokens are still evaluated multiple times', () => {
     // Check that nested token returns aren't accidentally fully resolved by the
     // first resolution. On every evaluation, Tokens referenced inside the
     // structure should be given a chance to be either cached or uncached.
@@ -331,10 +330,10 @@ nodeunitShim({
     expect(resolve(counterString2)).toEqual('->4');
     expect(resolve(counterObject)).toEqual({ finalCount: '5' });
 
-    test.done();
-  },
 
-  'tokens can be nested and concatenated in hash keys'(test: Test) {
+  });
+
+  test('tokens can be nested and concatenated in hash keys', () => {
     // GIVEN
     const innerToken = new Intrinsic( 'toot');
     const token = new Intrinsic( `${innerToken} the woot`);
@@ -345,11 +344,11 @@ nodeunitShim({
     };
 
     // THEN
-    test.deepEqual(resolve(s), { 'toot the woot': 'boom chicago' });
-    test.done();
-  },
+    expect(resolve(s)).toEqual({ 'toot the woot': 'boom chicago' });
+
+  });
 
-  'can find nested tokens in hash keys'(test: Test) {
+  test('can find nested tokens in hash keys', () => {
     // GIVEN
     const innerToken = new Intrinsic( 'toot');
     const token = new Intrinsic( `${innerToken} the woot`);
@@ -361,12 +360,12 @@ nodeunitShim({
 
     // THEN
     const tokens = findTokens(new Stack(), () => s);
-    test.ok(tokens.some(t => t === innerToken), 'Cannot find innerToken');
-    test.ok(tokens.some(t => t === token), 'Cannot find token');
-    test.done();
-  },
+    expect(tokens.some(t => t === innerToken)).toEqual(true);
+    expect(tokens.some(t => t === token)).toEqual(true);
 
-  'fails if token in a hash key resolves to a non-string'(test: Test) {
+  });
+
+  test('fails if token in a hash key resolves to a non-string', () => {
     // GIVEN
     const token = new Intrinsic({ Ref: 'Other' });
 
@@ -376,12 +375,12 @@ nodeunitShim({
     };
 
     // THEN
-    test.throws(() => resolve(s), 'is used as the key in a map so must resolve to a string, but it resolves to:');
-    test.done();
-  },
+    expect(() => resolve(s)).toThrow('is used as the key in a map so must resolve to a string, but it resolves to:');
+
+  });
 
-  'list encoding': {
-    'can encode Token to string and resolve the encoding'(test: Test) {
+  describe('list encoding', () => {
+    test('can encode Token to string and resolve the encoding', () => {
       // GIVEN
       const token = new Intrinsic({ Ref: 'Other' });
 
@@ -391,14 +390,14 @@ nodeunitShim({
       };
 
       // THEN
-      test.deepEqual(resolve(struct), {
+      expect(resolve(struct)).toEqual({
         XYZ: { Ref: 'Other' },
       });
 
-      test.done();
-    },
 
-    'cannot add to encoded list'(test: Test) {
+    });
+
+    test('cannot add to encoded list', () => {
       // GIVEN
       const token = new Intrinsic({ Ref: 'Other' });
 
@@ -407,14 +406,14 @@ nodeunitShim({
       encoded.push('hello');
 
       // THEN
-      test.throws(() => {
+      expect(() => {
         resolve(encoded);
-      }, /Cannot add elements to list token/);
+      }).toThrow(/Cannot add elements to list token/);
+
 
-      test.done();
-    },
+    });
 
-    'cannot add to strings in encoded list'(test: Test) {
+    test('cannot add to strings in encoded list', () => {
       // GIVEN
       const token = new Intrinsic({ Ref: 'Other' });
 
@@ -423,14 +422,14 @@ nodeunitShim({
       encoded[0] += 'hello';
 
       // THEN
-      test.throws(() => {
+      expect(() => {
         resolve(encoded);
-      }, /concatenate strings in/);
+      }).toThrow(/concatenate strings in/);
 
-      test.done();
-    },
 
-    'can pass encoded lists to FnSelect'(test: Test) {
+    });
+
+    test('can pass encoded lists to FnSelect', () => {
       // GIVEN
       const encoded: string[] = Token.asList(new Intrinsic({ Ref: 'Other' }));
 
@@ -438,14 +437,14 @@ nodeunitShim({
       const struct = Fn.select(1, encoded);
 
       // THEN
-      test.deepEqual(resolve(struct), {
+      expect(resolve(struct)).toEqual({
         'Fn::Select': [1, { Ref: 'Other' }],
       });
 
-      test.done();
-    },
 
-    'can pass encoded lists to FnJoin'(test: Test) {
+    });
+
+    test('can pass encoded lists to FnJoin', () => {
       // GIVEN
       const encoded: string[] = Token.asList(new Intrinsic({ Ref: 'Other' }));
 
@@ -453,14 +452,14 @@ nodeunitShim({
       const struct = Fn.join('/', encoded);
 
       // THEN
-      test.deepEqual(resolve(struct), {
+      expect(resolve(struct)).toEqual({
         'Fn::Join': ['/', { Ref: 'Other' }],
       });
 
-      test.done();
-    },
 
-    'can pass encoded lists to FnJoin, even if join is stringified'(test: Test) {
+    });
+
+    test('can pass encoded lists to FnJoin, even if join is stringified', () => {
       // GIVEN
       const encoded: string[] = Token.asList(new Intrinsic({ Ref: 'Other' }));
 
@@ -468,33 +467,33 @@ nodeunitShim({
       const struct = Fn.join('/', encoded).toString();
 
       // THEN
-      test.deepEqual(resolve(struct), {
+      expect(resolve(struct)).toEqual({
         'Fn::Join': ['/', { Ref: 'Other' }],
       });
 
-      test.done();
-    },
 
-    'detect and error when list token values are illegally extracted'(test: Test) {
+    });
+
+    test('detect and error when list token values are illegally extracted', () => {
       // GIVEN
       const encoded: string[] = Token.asList({ Ref: 'Other' });
 
       // THEN
-      test.throws(() => {
+      expect(() => {
         resolve({ value: encoded[0] });
-      }, /Found an encoded list/);
+      }).toThrow(/Found an encoded list/);
 
-      test.done();
-    },
-  },
 
-  'number encoding': {
-    'basic integer encoding works'(test: Test) {
-      test.equal(16, extractTokenDouble(createTokenDouble(16)));
-      test.done();
-    },
+    });
+  });
 
-    'arbitrary integers can be encoded, stringified, and recovered'(test: Test) {
+  describe('number encoding', () => {
+    test('basic integer encoding works', () => {
+      expect(16).toEqual(extractTokenDouble(createTokenDouble(16)));
+
+    });
+
+    test('arbitrary integers can be encoded, stringified, and recovered', () => {
       for (let i = 0; i < 100; i++) {
         // We can encode all numbers up to 2^48-1
         const x = Math.floor(Math.random() * (Math.pow(2, 48) - 1));
@@ -503,38 +502,38 @@ nodeunitShim({
         // Roundtrip through JSONification
         const roundtripped = JSON.parse(JSON.stringify({ theNumber: encoded })).theNumber;
         const decoded = extractTokenDouble(roundtripped);
-        test.equal(decoded, x, `Fail roundtrip encoding of ${x}`);
+        expect(decoded).toEqual(x);
       }
 
-      test.done();
-    },
 
-    'arbitrary numbers are correctly detected as not being tokens'(test: Test) {
-      test.equal(undefined, extractTokenDouble(0));
-      test.equal(undefined, extractTokenDouble(1243));
-      test.equal(undefined, extractTokenDouble(4835e+532));
+    });
+
+    test('arbitrary numbers are correctly detected as not being tokens', () => {
+      expect(undefined).toEqual(extractTokenDouble(0));
+      expect(undefined).toEqual(extractTokenDouble(1243));
+      expect(undefined).toEqual(extractTokenDouble(4835e+532));
+
 
-      test.done();
-    },
+    });
 
-    'can number-encode and resolve Token objects'(test: Test) {
+    test('can number-encode and resolve Token objects', () => {
       // GIVEN
       const x = new Intrinsic( 123);
 
       // THEN
       const encoded = Token.asNumber(x);
-      test.equal(false, isResolvableObject(encoded), 'encoded number does not test as token');
-      test.equal(true, Token.isUnresolved(encoded), 'encoded number does not test as token');
+      expect(false).toEqual(isResolvableObject(encoded));
+      expect(true).toEqual(Token.isUnresolved(encoded));
 
       // THEN
       const resolved = resolve({ value: encoded });
-      test.deepEqual(resolved, { value: 123 });
+      expect(resolved).toEqual({ value: 123 });
+
 
-      test.done();
-    },
-  },
+    });
+  });
 
-  'stack trace is captured at token creation'(test: Test) {
+  test('`stack trace is captured at token creati`on', () => {
     function fn1() {
       function fn2() {
         class ExposeTrace extends Intrinsic {
@@ -552,12 +551,12 @@ nodeunitShim({
     const previousValue = reEnableStackTraceCollection();
     const token = fn1();
     restoreStackTraceColection(previousValue);
-    test.ok(token.creationTrace.find(x => x.includes('fn1')));
-    test.ok(token.creationTrace.find(x => x.includes('fn2')));
-    test.done();
-  },
+    expect(token.creationTrace.find(x => x.includes('fn1'))).toBeDefined();
+    expect(token.creationTrace.find(x => x.includes('fn2'))).toBeDefined();
+
+  });
 
-  'newError returns an error with the creation stack trace'(test: Test) {
+  test('newError returns an error with the creation stack trace', () => {
     function fn1() {
       function fn2() {
         function fn3() {
@@ -577,12 +576,11 @@ nodeunitShim({
     const previousValue = reEnableStackTraceCollection();
     const token = fn1();
     restoreStackTraceColection(previousValue);
-    test.throws(() => token.throwError('message!'), /Token created:/);
-    test.done();
-  },
+    expect(() => token.throwError('message!')).toThrow(/Token created:/);
+
+  });
 
-  'type coercion': (() => {
-    const tests: any = { };
+  describe('type coercion', () => {
 
     const inputs = [
       'a string',
@@ -601,56 +599,55 @@ nodeunitShim({
       // THEN
       const expected = input;
 
-      tests[`${input}<string>.toNumber()`] = (test: Test) => {
-        test.deepEqual(resolve(Token.asNumber(new Intrinsic(stringToken))), expected);
-        test.done();
-      };
+      test(`${input}<string>.toNumber()`, () => {
+        expect(resolve(Token.asNumber(new Intrinsic(stringToken)))).toEqual(expected);
 
-      tests[`${input}<list>.toNumber()`] = (test: Test) => {
-        test.deepEqual(resolve(Token.asNumber(new Intrinsic(listToken))), expected);
-        test.done();
-      };
+      });
 
-      tests[`${input}<number>.toNumber()`] = (test: Test) => {
-        test.deepEqual(resolve(Token.asNumber(new Intrinsic(numberToken))), expected);
-        test.done();
-      };
+      test(`${input}<list>.toNumber()`, () => {
+        expect(resolve(Token.asNumber(new Intrinsic(listToken)))).toEqual(expected);
 
-      tests[`${input}<string>.toString()`] = (test: Test) => {
-        test.deepEqual(resolve(new Intrinsic(stringToken).toString()), expected);
-        test.done();
-      };
+      });
 
-      tests[`${input}<list>.toString()`] = (test: Test) => {
-        test.deepEqual(resolve(new Intrinsic(listToken).toString()), expected);
-        test.done();
-      };
+      test(`${input}<number>.toNumber()`, () => {
+        expect(resolve(Token.asNumber(new Intrinsic(numberToken)))).toEqual(expected);
 
-      tests[`${input}<number>.toString()`] = (test: Test) => {
-        test.deepEqual(resolve(new Intrinsic(numberToken).toString()), expected);
-        test.done();
-      };
+      });
 
-      tests[`${input}<string>.toList()`] = (test: Test) => {
-        test.deepEqual(resolve(Token.asList(new Intrinsic(stringToken))), expected);
-        test.done();
-      };
+      test(`${input}<string>.toString()`, () => {
+        expect(resolve(new Intrinsic(stringToken).toString())).toEqual(expected);
 
-      tests[`${input}<list>.toList()`] = (test: Test) => {
-        test.deepEqual(resolve(Token.asList(new Intrinsic(listToken))), expected);
-        test.done();
-      };
+      });
 
-      tests[`${input}<number>.toList()`] = (test: Test) => {
-        test.deepEqual(resolve(Token.asList(new Intrinsic(numberToken))), expected);
-        test.done();
-      };
+      test(`${input}<list>.toString()`, () => {
+        expect(resolve(new Intrinsic(listToken).toString())).toEqual(expected);
+
+      });
+
+      test(`${input}<number>.toString()`, () => {
+        expect(resolve(new Intrinsic(numberToken).toString())).toEqual(expected);
+
+      });
+
+      test(`${input}<string>.toList()`, () => {
+        expect(resolve(Token.asList(new Intrinsic(stringToken)))).toEqual(expected);
+
+      });
+
+      test(`${input}<list>.toList()`, () => {
+        expect(resolve(Token.asList(new Intrinsic(listToken)))).toEqual(expected);
+
+      });
+
+      test(`${input}<number>.toList()`, () => {
+        expect(resolve(Token.asList(new Intrinsic(numberToken)))).toEqual(expected);
+
+      });
     }
 
-    return tests;
-  })(),
+  });
 
-  'creation stack is attached to errors emitted during resolve with CDK_DEBUG=true'(test: Test) {
+  test('creation stack is attached to errors emitted during resolve with CDK_DEBUG=true', () => {
     function showMeInTheStackTrace() {
       return Lazy.string({ produce: () => { throw new Error('fooError'); } });
     }
@@ -663,16 +660,16 @@ nodeunitShim({
     try {
       resolve(x);
     } catch (e) {
-      message = e.message;
+      message = (e as Error).message;
     } finally {
       process.env.CDK_DEBUG = previousValue;
     }
 
-    test.ok(message && message.includes('showMeInTheStackTrace'));
-    test.done();
-  },
+    expect(message && message.includes('showMeInTheStackTrace')).toEqual(true);
 
-  'creation stack is omitted without CDK_DEBUG=true'(test: Test) {
+  });
+
+  test('creation stack is omitted without CDK_DEBUG=true', () => {
     function showMeInTheStackTrace() {
       return Lazy.stringValue({ produce: () => { throw new Error('fooError'); } });
     }
@@ -685,59 +682,59 @@ nodeunitShim({
     try {
       resolve(x);
     } catch (e) {
-      message = e.message;
+      message = (e as Error).message;
     } finally {
       process.env.CDK_DEBUG = previousValue;
     }
 
-    test.ok(message && message.includes('Execute again with CDK_DEBUG=true'));
-    test.done();
-  },
+    expect(message && message.includes('Execute again with CDK_DEBUG=true')).toEqual(true);
+
+  });
 
-  'stringifyNumber': {
-    'converts number to string'(test: Test) {
-      test.equal(Tokenization.stringifyNumber(100), '100');
-      test.done();
-    },
+  describe('stringifyNumber', () => {
+    test('converts number to string', () => {
+      expect(Tokenization.stringifyNumber(100)).toEqual('100');
 
-    'converts tokenized number to string'(test: Test) {
-      test.equal(resolve(Tokenization.stringifyNumber({
+    });
+
+    test('converts tokenized number to string', () => {
+      expect(resolve(Tokenization.stringifyNumber({
         resolve: () => 100,
-      } as any)), '100');
-      test.done();
-    },
+      } as any))).toEqual('100');
+
+    });
 
-    'string remains the same'(test: Test) {
-      test.equal(Tokenization.stringifyNumber('123' as any), '123');
-      test.done();
-    },
+    test('string remains the same', () => {
+      expect(Tokenization.stringifyNumber('123' as any)).toEqual('123');
 
-    'Ref remains the same'(test: Test) {
+    });
+
+    test('Ref remains the same', () => {
       const val = { Ref: 'SomeLogicalId' };
-      test.deepEqual(Tokenization.stringifyNumber(val as any), val);
-      test.done();
-    },
+      expect(Tokenization.stringifyNumber(val as any)).toEqual(val);
 
-    'lazy Ref remains the same'(test: Test) {
+    });
+
+    test('lazy Ref remains the same', () => {
       const resolvedVal = { Ref: 'SomeLogicalId' };
       const tokenizedVal = Lazy.any({
         produce: () => resolvedVal,
       });
       const res = Tokenization.stringifyNumber(tokenizedVal as any) as any;
-      test.notDeepEqual(res, resolvedVal);
-      test.deepEqual(resolve(res), resolvedVal);
-      test.done();
-    },
+      expect(res).not.toEqual(resolvedVal);
+      expect(resolve(res)).toEqual(resolvedVal);
+
+    });
 
-    'tokenized Ref remains the same'(test: Test) {
+    test('tokenized Ref remains the same', () => {
       const resolvedVal = { Ref: 'SomeLogicalId' };
       const tokenizedVal = Token.asNumber(resolvedVal);
       const res = Tokenization.stringifyNumber(tokenizedVal) as any;
-      test.notDeepEqual(res, resolvedVal);
-      test.deepEqual(resolve(res), resolvedVal);
-      test.done();
-    },
-  },
+      expect(res).not.toEqual(resolvedVal);
+      expect(resolve(res)).toEqual(resolvedVal);
+
+    });
+  });
 });
 
 class Promise2 implements IResolvable {
diff --git a/packages/@aws-cdk/core/test/util.test.ts b/packages/@aws-cdk/core/test/util.test.ts
index 3b9c33f14c9f4..e2074056dfa4f 100644
--- a/packages/@aws-cdk/core/test/util.test.ts
+++ b/packages/@aws-cdk/core/test/util.test.ts
@@ -1,106 +1,105 @@
-import { nodeunitShim, Test } from 'nodeunit-shim';
 import { CfnResource, Construct, Stack } from '../lib';
 import { capitalizePropertyNames, filterUndefined, findLastCommonElement, ignoreEmpty, pathToTopLevelStack } from '../lib/util';
 
-nodeunitShim({
-  'capitalizeResourceProperties capitalizes all keys of an object (recursively) from camelCase to PascalCase'(test: Test) {
+describe('util', () => {
+  test('capitalizeResourceProperties capitalizes all keys of an object (recursively) from camelCase to PascalCase', () => {
     const c = new Stack();
 
-    test.equal(capitalizePropertyNames(c, undefined), undefined);
-    test.equal(capitalizePropertyNames(c, 12), 12);
-    test.equal(capitalizePropertyNames(c, 'hello'), 'hello');
-    test.deepEqual(capitalizePropertyNames(c, ['hello', 88]), ['hello', 88]);
-    test.deepEqual(capitalizePropertyNames(c,
-      { Hello: 'world', hey: 'dude' }),
-    { Hello: 'world', Hey: 'dude' });
-    test.deepEqual(capitalizePropertyNames(c,
-      [1, 2, { three: 3 }]),
-    [1, 2, { Three: 3 }]);
-    test.deepEqual(capitalizePropertyNames(c,
-      { Hello: 'world', recursive: { foo: 123, there: { another: ['hello', { world: 123 }] } } }),
-    { Hello: 'world', Recursive: { Foo: 123, There: { Another: ['hello', { World: 123 }] } } });
+    expect(capitalizePropertyNames(c, undefined)).toEqual(undefined);
+    expect(capitalizePropertyNames(c, 12)).toEqual(12);
+    expect(capitalizePropertyNames(c, 'hello')).toEqual('hello');
+    expect(capitalizePropertyNames(c, ['hello', 88])).toEqual(['hello', 88]);
+    expect(capitalizePropertyNames(c,
+      { Hello: 'world', hey: 'dude' })).toEqual(
+      { Hello: 'world', Hey: 'dude' });
+    expect(capitalizePropertyNames(c,
+      [1, 2, { three: 3 }])).toEqual(
+      [1, 2, { Three: 3 }]);
+    expect(capitalizePropertyNames(c,
+      { Hello: 'world', recursive: { foo: 123, there: { another: ['hello', { world: 123 }] } } })).toEqual(
+      { Hello: 'world', Recursive: { Foo: 123, There: { Another: ['hello', { World: 123 }] } } });
 
     // make sure tokens are resolved and result is also capitalized
-    test.deepEqual(capitalizePropertyNames(c,
-      { hello: { resolve: () => ({ foo: 'bar' }) }, world: new SomeToken() }),
-    { Hello: { Foo: 'bar' }, World: 100 });
+    expect(capitalizePropertyNames(c,
+      { hello: { resolve: () => ({ foo: 'bar' }) }, world: new SomeToken() })).toEqual(
+      { Hello: { Foo: 'bar' }, World: 100 });
 
-    test.done();
-  },
 
-  ignoreEmpty: {
+  });
 
-    '[]'(test: Test) {
+  describe('ignoreEmpty', () => {
+
+    test('[]', () => {
       const stack = new Stack();
-      test.strictEqual(stack.resolve(ignoreEmpty([])), undefined);
-      test.done();
-    },
+      expect(stack.resolve(ignoreEmpty([]))).toEqual(undefined);
+
+    });
 
-    '{}'(test: Test) {
+    test('{}', () => {
       const stack = new Stack();
-      test.strictEqual(stack.resolve(ignoreEmpty({})), undefined);
-      test.done();
-    },
+      expect(stack.resolve(ignoreEmpty({}))).toEqual(undefined);
 
-    'undefined/null'(test: Test) {
+    });
+
+    test('undefined/null', () => {
       const stack = new Stack();
-      test.strictEqual(stack.resolve(ignoreEmpty(undefined)), undefined);
-      test.strictEqual(stack.resolve(ignoreEmpty(null)), null);
-      test.done();
-    },
+      expect(stack.resolve(ignoreEmpty(undefined))).toEqual(undefined);
+      expect(stack.resolve(ignoreEmpty(null))).toEqual(null);
+
+    });
 
-    'primitives'(test: Test) {
+    test('primitives', () => {
       const stack = new Stack();
-      test.strictEqual(stack.resolve(ignoreEmpty(12)), 12);
-      test.strictEqual(stack.resolve(ignoreEmpty('12')), '12');
-      test.done();
-    },
+      expect(stack.resolve(ignoreEmpty(12))).toEqual(12);
+      expect(stack.resolve(ignoreEmpty('12'))).toEqual('12');
 
-    'non-empty arrays/objects'(test: Test) {
+    });
+
+    test('non-empty arrays/objects', () => {
       const stack = new Stack();
-      test.deepEqual(stack.resolve(ignoreEmpty([1, 2, 3, undefined])), [1, 2, 3]); // undefined array values is cleaned up by "resolve"
-      test.deepEqual(stack.resolve(ignoreEmpty({ o: 1, b: 2, j: 3 })), { o: 1, b: 2, j: 3 });
-      test.done();
-    },
+      expect(stack.resolve(ignoreEmpty([1, 2, 3, undefined]))).toEqual([1, 2, 3]); // undefined array values is cleaned up by "resolve"
+      expect(stack.resolve(ignoreEmpty({ o: 1, b: 2, j: 3 }))).toEqual({ o: 1, b: 2, j: 3 });
+
+    });
 
-    'resolve first'(test: Test) {
+    test('resolve first', () => {
       const stack = new Stack();
-      test.deepEqual(stack.resolve(ignoreEmpty({ xoo: { resolve: () => 123 } })), { xoo: 123 });
-      test.strictEqual(stack.resolve(ignoreEmpty({ xoo: { resolve: () => undefined } })), undefined);
-      test.deepEqual(stack.resolve(ignoreEmpty({ xoo: { resolve: () => [] } })), { xoo: [] });
-      test.deepEqual(stack.resolve(ignoreEmpty({ xoo: { resolve: () => [undefined, undefined] } })), { xoo: [] });
-      test.done();
-    },
-  },
-
-  filterUnderined: {
-    'is null-safe (aka treats null and undefined the same)'(test: Test) {
-      test.deepEqual(filterUndefined({ 'a null': null, 'a not null': true }), { 'a not null': true });
-      test.done();
-    },
-
-    'removes undefined, but leaves the rest'(test: Test) {
-      test.deepEqual(filterUndefined({ 'an undefined': undefined, 'yes': true }), { yes: true });
-      test.done();
-    },
-  },
-
-  'pathToTopLevelStack returns the array of stacks that lead to a stack'(test: Test) {
+      expect(stack.resolve(ignoreEmpty({ xoo: { resolve: () => 123 } }))).toEqual({ xoo: 123 });
+      expect(stack.resolve(ignoreEmpty({ xoo: { resolve: () => undefined } }))).toEqual(undefined);
+      expect(stack.resolve(ignoreEmpty({ xoo: { resolve: () => [] } }))).toEqual({ xoo: [] });
+      expect(stack.resolve(ignoreEmpty({ xoo: { resolve: () => [undefined, undefined] } }))).toEqual({ xoo: [] });
+
+    });
+  });
+
+  describe('filterUnderined', () => {
+    test('is null-safe (aka treats null and undefined the same)', () => {
+      expect(filterUndefined({ 'a null': null, 'a not null': true })).toEqual({ 'a not null': true });
+
+    });
+
+    test('removes undefined, but leaves the rest', () => {
+      expect(filterUndefined({ 'an undefined': undefined, 'yes': true })).toEqual({ yes: true });
+
+    });
+  });
+
+  test('pathToTopLevelStack returns the array of stacks that lead to a stack', () => {
     const a = new Stack(undefined, 'a');
     const aa = new Nested(a, 'aa');
     const aaa = new Nested(aa, 'aaa');
 
-    test.deepEqual(path(aaa), ['a', 'aa', 'aaa']);
-    test.deepEqual(path(aa), ['a', 'aa']);
-    test.deepEqual(path(a), ['a']);
-    test.done();
+    expect(path(aaa)).toEqual(['a', 'aa', 'aaa']);
+    expect(path(aa)).toEqual(['a', 'aa']);
+    expect(path(a)).toEqual(['a']);
+
 
     function path(s: Stack) {
       return pathToTopLevelStack(s).map(x => x.node.id);
     }
-  },
+  });
 
-  'findCommonStack returns the lowest common stack between two stacks or undefined'(test: Test) {
+  test('findCommonStack returns the lowest common stack between two stacks or undefined', () => {
     const a = new Stack(undefined, 'a');
     const aa = new Nested(a, 'aa');
     const ab = new Nested(a, 'ab');
@@ -112,29 +111,28 @@ nodeunitShim({
     const ba = new Nested(b, 'ba');
     const baa = new Nested(ba, 'baa');
 
-    test.equal(lca(a, b), undefined);
-    test.equal(lca(aa, ab), 'a');
-    test.equal(lca(ab, aa), 'a');
-    test.equal(lca(aa, aba), 'a');
-    test.equal(lca(aba, aa), 'a');
-    test.equal(lca(ab, aba), 'ab');
-    test.equal(lca(aba, ab), 'ab');
-    test.equal(lca(aba, aba), 'aba');
-    test.equal(lca(aa, aa), 'aa');
-    test.equal(lca(a, aaa), 'a');
-    test.equal(lca(aaa, aab), 'aa');
-    test.equal(lca(aaa, b), undefined);
-    test.equal(lca(aaa, ba), undefined);
-    test.equal(lca(baa, ba), 'ba');
-
-    test.done();
+    expect(lca(a, b)).toEqual(undefined);
+    expect(lca(aa, ab)).toEqual('a');
+    expect(lca(ab, aa)).toEqual('a');
+    expect(lca(aa, aba)).toEqual('a');
+    expect(lca(aba, aa)).toEqual('a');
+    expect(lca(ab, aba)).toEqual('ab');
+    expect(lca(aba, ab)).toEqual('ab');
+    expect(lca(aba, aba)).toEqual('aba');
+    expect(lca(aa, aa)).toEqual('aa');
+    expect(lca(a, aaa)).toEqual('a');
+    expect(lca(aaa, aab)).toEqual('aa');
+    expect(lca(aaa, b)).toEqual(undefined);
+    expect(lca(aaa, ba)).toEqual(undefined);
+    expect(lca(baa, ba)).toEqual('ba');
+
 
     function lca(s1: Stack, s2: Stack) {
       const res = findLastCommonElement(pathToTopLevelStack(s1), pathToTopLevelStack(s2));
       if (!res) { return undefined; }
       return res.node.id;
     }
-  },
+  });
 });
 
 class SomeToken {
diff --git a/tools/nodeunit-shim/.gitignore b/tools/nodeunit-shim/.gitignore
deleted file mode 100644
index 2d8e8a2d36377..0000000000000
--- a/tools/nodeunit-shim/.gitignore
+++ /dev/null
@@ -1,13 +0,0 @@
-*.js
-*.js.map
-*.d.ts
-dist
-
-.LAST_BUILD
-*.snk
-!jest.config.js
-
-.nyc_output
-coverage
-nyc.config.js
-!.eslintrc.js
\ No newline at end of file
diff --git a/tools/nodeunit-shim/README.md b/tools/nodeunit-shim/README.md
deleted file mode 100644
index 163e24b3b1eb7..0000000000000
--- a/tools/nodeunit-shim/README.md
+++ /dev/null
@@ -1,80 +0,0 @@
-nodeunit-shim
-==============
-
-Tiny helper library to move from nodeunit tests to Jest.
-
-Why?
-----
-
-Jest tests have a better runner, better error reporting, better matchers,
-and nicer syntax. They're just all around nicer. Plus, nodeunit has long
-since been deprecated.
-
-Rewriting our existing codebase of nodeunit tests is kind of a hassle though.
-Therefore, a tiny adapter layer between the 2 APIs.
-
-How to use
-----------
-
-### Update package.json
-
-```json
-"devDependencies": {
-  // Remove these:
-  "@types/nodeunit": "...",
-  "nodeunit": "...",
-
-  // Add this
-  "nodeunit-shim": "0.0.0",
-},
-"cdk-build": {
-  // Add this
-  "jest": true
-}
-```
-
-### Get jest.config.js
-
-Copy a `jest.config.js` from another package.
-
-### Update .gitignore/.npmignore
-
-Run `yarn pkglint --fix`.
-
-### Rename tests
-
-Rename all test files `test.*.ts` -> `*.test.ts` (be sure to rename
-the `.js` as well, or remove them).
-
-### Rewrite tests
-
-Inside every test file:
-
-Replace
-
-```ts
-import { Test } from 'nodeunit';
-```
-
-with
-
-```ts
-import { nodeunitShim, Test } from 'nodeunit-shim';
-```
-
-and replace:
-
-```ts
-export = {
-  // ...
-};
-```
-
-with:
-
-```ts
-nodeunitShim({
-  // ...
-});
-```
-
diff --git a/tools/nodeunit-shim/index.ts b/tools/nodeunit-shim/index.ts
deleted file mode 100644
index 79cd04f4e2e57..0000000000000
--- a/tools/nodeunit-shim/index.ts
+++ /dev/null
@@ -1,91 +0,0 @@
-/**
- * Jest/Nodeunit compatibility shim
- *
- * Use this to mass-convert Nodeunit tests to Jest tests.
- */
-
-/**
- * Compatibility shim test
- */
-export class Test {
-  constructor(private readonly cb: () => void) {
-  }
-
-  public equal(actual: any, expected: any, _message?: string) {
-    expect(actual).toEqual(expected);
-  }
-
-  public notEqual(actual: any, expected: any, _message?: string) {
-    expect(actual).not.toEqual(expected);
-  }
-
-  public equals(actual: any, expected: any, _message?: string) {
-    expect(actual).toEqual(expected);
-  }
-
-  public strictEqual(actual: any, expected: any, _message?: string) {
-    expect(actual).toEqual(expected);
-  }
-
-  public deepEqual(actual: any, expected: any, _message?: string) {
-    expect(actual).toEqual(expected);
-  }
-
-  public notDeepEqual(actual: any, expected: any, _message?: string) {
-    expect(actual).not.toEqual(expected);
-  }
-
-  public ok(actual: any, _message?: string) {
-    expect(actual).toBeTruthy();
-  }
-
-  public same(actual: any, expected: any) {
-    expect(actual).toBe(expected);
-  }
-
-  public throws(block: () => any, error?: string | RegExp | ErrorConstructor, _message?: string) {
-    expect(block).toThrow(error);
-  }
-
-  public doesNotThrow(block: () => any, error?: string | RegExp | ErrorConstructor, _message?: string) {
-    expect(block).not.toThrow(error);
-  }
-
-  public done() {
-    this.cb();
-  }
-}
-
-export function nodeunitShim(exports: Record<string, any>) {
-  if (exports.setUp) {
-    beforeEach(() => {
-      return new Promise(ok => {
-        exports.setUp(ok);
-      });
-    });
-  }
-  if (exports.tearDown) {
-    afterEach(() => {
-      return new Promise(ok => {
-        exports.tearDown(ok);
-      });
-    });
-  }
-  for (const [testName, testObj] of Object.entries(exports)) {
-    if (testName === 'setUp' || testName === 'tearDown') { continue; }
-
-    if (typeof testObj === 'object') {
-      // It's a suite
-      describe(testName, () => {
-        nodeunitShim(testObj);
-      });
-    } else {
-      // It's a test
-      test(testName, () => new Promise<void>(ok => {
-        testObj(new Test(ok));
-      }));
-    }
-  }
-}
-
-type ErrorConstructor = new (...args: any[]) => Error;
diff --git a/tools/nodeunit-shim/package.json b/tools/nodeunit-shim/package.json
deleted file mode 100644
index 2c2814cc08a08..0000000000000
--- a/tools/nodeunit-shim/package.json
+++ /dev/null
@@ -1,27 +0,0 @@
-{
-  "name": "nodeunit-shim",
-  "private": true,
-  "version": "0.0.0",
-  "description": "A helper package to migrate tests from nodeunit to Jest",
-  "main": "index.js",
-  "scripts": {
-    "build": "tsc",
-    "watch": "tsc -w",
-    "test": "echo No tests",
-    "build+test+package": "npm run build+test",
-    "build+test": "npm run build && npm test",
-    "build+test+extract": "npm run build+test",
-    "build+extract": "npm run build"
-  },
-  "devDependencies": {
-    "@types/jest": "^26.0.24",
-    "@types/node": "^10.17.60",
-    "typescript": "~3.9.10"
-  },
-  "dependencies": {
-    "jest": "^26.6.3"
-  },
-  "keywords": [],
-  "author": "",
-  "license": "ISC"
-}
diff --git a/tools/nodeunit-shim/tsconfig.json b/tools/nodeunit-shim/tsconfig.json
deleted file mode 100644
index 14499cd2abfaf..0000000000000
--- a/tools/nodeunit-shim/tsconfig.json
+++ /dev/null
@@ -1,20 +0,0 @@
-{
-  "compilerOptions": {
-    "target": "ES2018",
-    "module": "commonjs",
-    "lib": ["es2018"],
-    "strict": true,
-    "alwaysStrict": true,
-    "declaration": true,
-    "inlineSourceMap": true,
-    "inlineSources": true,
-    "noUnusedLocals": true,
-    "noUnusedParameters": true,
-    "noImplicitReturns": true,
-    "noFallthroughCasesInSwitch": true,
-    "resolveJsonModule": true,
-    "composite": true,
-    "incremental": true
-  },
-  "include": ["**/*.ts"]
-}

From c2852c9c524a639a312bf296f7f23b0e3b112f6b Mon Sep 17 00:00:00 2001
From: Philipp Garbe <philipp.garbe@web.de>
Date: Tue, 7 Sep 2021 15:26:31 +0200
Subject: [PATCH 70/91] fix(assets): run executable command of container assets
 in cloud assembly root directory (#16094)

Runs the executable command of container assets in the cloud assembly root directory and not the current directory.

Could be a breaking change.

fixes #15721
----

*By submitting this pull request, I confirm that my contribution is made under the terms of the Apache-2.0 license*
---
 .../cdk-assets/lib/private/handlers/container-images.ts   | 8 +++++---
 packages/cdk-assets/test/docker-images.test.ts            | 2 +-
 2 files changed, 6 insertions(+), 4 deletions(-)

diff --git a/packages/cdk-assets/lib/private/handlers/container-images.ts b/packages/cdk-assets/lib/private/handlers/container-images.ts
index ec4327775c37c..d2fd7373eb1cf 100644
--- a/packages/cdk-assets/lib/private/handlers/container-images.ts
+++ b/packages/cdk-assets/lib/private/handlers/container-images.ts
@@ -83,14 +83,16 @@ export class ContainerImageAssetHandler implements IAssetHandler {
    * External command is responsible for deduplicating the build if possible,
    * and is expected to return the generated image identifier on stdout.
    */
-  private async buildExternalAsset(executable: string[]): Promise<string | undefined> {
+  private async buildExternalAsset(executable: string[], cwd?: string): Promise<string | undefined> {
+
+    const assetPath = cwd ?? this.workDir;
+
     this.host.emitMessage(EventType.BUILD, `Building Docker image using command '${executable}'`);
     if (this.host.aborted) { return undefined; }
 
-    return (await shell(executable, { quiet: true })).trim();
+    return (await shell(executable, { cwd: assetPath, quiet: true })).trim();
   }
 
-
   /**
    * Check whether the image already exists in the ECR repo
    *
diff --git a/packages/cdk-assets/test/docker-images.test.ts b/packages/cdk-assets/test/docker-images.test.ts
index 1f36b88025725..cfbb8fc70379b 100644
--- a/packages/cdk-assets/test/docker-images.test.ts
+++ b/packages/cdk-assets/test/docker-images.test.ts
@@ -183,7 +183,7 @@ describe('external assets', () => {
 
     const expectAllSpawns = mockSpawn(
       { commandLine: ['docker', 'login', '--username', 'user', '--password-stdin', 'https://proxy.com/'] },
-      { commandLine: ['sometool'], stdout: externalTag },
+      { commandLine: ['sometool'], stdout: externalTag, cwd: '/external/cdk.out' },
       { commandLine: ['docker', 'tag', externalTag, '12345.amazonaws.com/repo:ghijkl'] },
       { commandLine: ['docker', 'push', '12345.amazonaws.com/repo:ghijkl'] },
     );

From 492d33b27bc5b935e3da75f0bddd875bb6f9c15d Mon Sep 17 00:00:00 2001
From: Julian Michel <mail@julianmichel.de>
Date: Tue, 7 Sep 2021 16:08:08 +0200
Subject: [PATCH 71/91] fix(autoscaling): EbsDeviceVolumeType.IO2 is not a
 valid CloudFormation value (#16028)

Remove value IO2 from enum EbsDeviceVolumeType because it is not supported in CloudFormation.

Fixes #16027.

Please double-check before approving: Value from enum is removed which could potentially be a breaking change. However, it's an invalid value. Therefore, it should be correct to remove it.

----

*By submitting this pull request, I confirm that my contribution is made under the terms of the Apache-2.0 license*
---
 allowed-breaking-changes.txt                    | 4 ++++
 packages/@aws-cdk/aws-autoscaling/lib/volume.ts | 5 -----
 2 files changed, 4 insertions(+), 5 deletions(-)

diff --git a/allowed-breaking-changes.txt b/allowed-breaking-changes.txt
index 47f19a6719d17..6def9776b6dc9 100644
--- a/allowed-breaking-changes.txt
+++ b/allowed-breaking-changes.txt
@@ -74,3 +74,7 @@ removed:@aws-cdk/aws-stepfunctions-tasks.BatchSubmitJobProps.jobDefinition
 strengthened:@aws-cdk/aws-stepfunctions-tasks.BatchSubmitJobProps
 removed:@aws-cdk/aws-lambda-event-sources.ManagedKafkaEventSourceProps.cluster
 strengthened:@aws-cdk/aws-lambda-event-sources.ManagedKafkaEventSourceProps
+
+# Remove IO2 from autoscaling EbsDeviceVolumeType. This value is not supported 
+# at the moment and was not supported in the past.
+removed:@aws-cdk/aws-autoscaling.EbsDeviceVolumeType.IO2
\ No newline at end of file
diff --git a/packages/@aws-cdk/aws-autoscaling/lib/volume.ts b/packages/@aws-cdk/aws-autoscaling/lib/volume.ts
index b22bb2c98e3f8..cbe08bac7c6ab 100644
--- a/packages/@aws-cdk/aws-autoscaling/lib/volume.ts
+++ b/packages/@aws-cdk/aws-autoscaling/lib/volume.ts
@@ -182,11 +182,6 @@ export enum EbsDeviceVolumeType {
    */
   IO1 = 'io1',
 
-  /**
-   *  Provisioned IOPS SSD - IO2
-   */
-  IO2 = 'io2',
-
   /**
    * General Purpose SSD - GP2
    */

From c8bfcf650070a0138b148645f997f542431f70cf Mon Sep 17 00:00:00 2001
From: Mark Nielsen <mark.nielsen@blackboard.com>
Date: Tue, 7 Sep 2021 07:50:16 -0700
Subject: [PATCH 72/91] fix(iam): permissions boundary aspect doesn't always
 recognize roles (#16154)

Using `instanceof` does not seem to work in all scenarios. Instead, use the `CfnResource.isCfnResource` method to find the L1 constructs.


----

*By submitting this pull request, I confirm that my contribution is made under the terms of the Apache-2.0 license*
---
 .../@aws-cdk/aws-iam/lib/permissions-boundary.ts     | 12 ++++--------
 1 file changed, 4 insertions(+), 8 deletions(-)

diff --git a/packages/@aws-cdk/aws-iam/lib/permissions-boundary.ts b/packages/@aws-cdk/aws-iam/lib/permissions-boundary.ts
index 94964918b8658..c1a3dde69a026 100644
--- a/packages/@aws-cdk/aws-iam/lib/permissions-boundary.ts
+++ b/packages/@aws-cdk/aws-iam/lib/permissions-boundary.ts
@@ -33,10 +33,8 @@ export class PermissionsBoundary {
   public apply(boundaryPolicy: IManagedPolicy) {
     Node.of(this.scope).applyAspect({
       visit(node: IConstruct) {
-        if (node instanceof CfnRole || node instanceof CfnUser) {
-          node.permissionsBoundary = boundaryPolicy.managedPolicyArn;
-        } else if (
-          node instanceof CfnResource &&
+        if (
+          CfnResource.isCfnResource(node) &&
             (node.cfnResourceType == CfnRole.CFN_RESOURCE_TYPE_NAME || node.cfnResourceType == CfnUser.CFN_RESOURCE_TYPE_NAME)
         ) {
           node.addPropertyOverride('PermissionsBoundary', boundaryPolicy.managedPolicyArn);
@@ -51,10 +49,8 @@ export class PermissionsBoundary {
   public clear() {
     Node.of(this.scope).applyAspect({
       visit(node: IConstruct) {
-        if (node instanceof CfnRole || node instanceof CfnUser) {
-          node.permissionsBoundary = undefined;
-        } else if (
-          node instanceof CfnResource &&
+        if (
+          CfnResource.isCfnResource(node) &&
             (node.cfnResourceType == CfnRole.CFN_RESOURCE_TYPE_NAME || node.cfnResourceType == CfnUser.CFN_RESOURCE_TYPE_NAME)
         ) {
           node.addPropertyDeletionOverride('PermissionsBoundary');

From 816a31984b5c6e08c4c7dd740919e0c1f5d0e196 Mon Sep 17 00:00:00 2001
From: vincent-turato <39069200+vincent-turato@users.noreply.github.com>
Date: Tue, 7 Sep 2021 08:31:54 -0700
Subject: [PATCH 73/91] feat(config): EC2_INSTANCE_PROFILE_ATTACHED managed
 rule (#16011)

> Currently [ManagedRuleIdentifiers](https://docs.aws.amazon.com/cdk/api/latest/docs/@aws-cdk_aws-config.ManagedRuleIdentifiers.html) doesn't support identifier for ec2-instance-profile-attached managed rule (EC2_INSTANCE_PROFILE_ATTACHED). The documentation for this rule is [here](https://docs.aws.amazon.com/config/latest/developerguide/ec2-instance-profile-attached.html).

Copied from: https://github.com/aws/aws-cdk/issues/15898

----

*By submitting this pull request, I confirm that my contribution is made under the terms of the Apache-2.0 license*
---
 packages/@aws-cdk/aws-config/lib/rule.ts      |  7 +++++++
 .../aws-config/test/test.managed-rules.ts     | 20 +++++++++++++++++++
 2 files changed, 27 insertions(+)

diff --git a/packages/@aws-cdk/aws-config/lib/rule.ts b/packages/@aws-cdk/aws-config/lib/rule.ts
index 2b6ad35d08859..1551d23e6d0c9 100644
--- a/packages/@aws-cdk/aws-config/lib/rule.ts
+++ b/packages/@aws-cdk/aws-config/lib/rule.ts
@@ -682,6 +682,13 @@ export class ManagedRuleIdentifiers {
    * @see https://docs.aws.amazon.com/config/latest/developerguide/ec2-instance-managed-by-systems-manager.html
    */
   public static readonly EC2_INSTANCE_MANAGED_BY_SSM = 'EC2_INSTANCE_MANAGED_BY_SSM';
+  /**
+   * Checks if an Amazon Elastic Compute Cloud (Amazon EC2) instance has an Identity and Access
+   * Management (IAM) profile attached to it. This rule is NON_COMPLIANT if no IAM profile is
+   * attached to the Amazon EC2 instance.
+   * @see https://docs.aws.amazon.com/config/latest/developerguide/ec2-instance-profile-attached.html
+   */
+  public static readonly EC2_INSTANCE_PROFILE_ATTACHED = 'EC2_INSTANCE_PROFILE_ATTACHED';
   /**
    * Checks whether Amazon Elastic Compute Cloud (Amazon EC2) instances have a public IP association.
    * @see https://docs.aws.amazon.com/config/latest/developerguide/ec2-instance-no-public-ip.html
diff --git a/packages/@aws-cdk/aws-config/test/test.managed-rules.ts b/packages/@aws-cdk/aws-config/test/test.managed-rules.ts
index 76e0790be3313..2c6c9c764fcdd 100644
--- a/packages/@aws-cdk/aws-config/test/test.managed-rules.ts
+++ b/packages/@aws-cdk/aws-config/test/test.managed-rules.ts
@@ -130,4 +130,24 @@ export = {
 
     test.done();
   },
+
+  'ec2 instance profile attached check'(test: Test) {
+    // GIVEN
+    const stack = new cdk.Stack();
+
+    // WHEN
+    new config.ManagedRule(stack, 'Ec2InstanceProfileAttached', {
+      identifier: config.ManagedRuleIdentifiers.EC2_INSTANCE_PROFILE_ATTACHED,
+    });
+
+    // THEN
+    expect(stack).to(haveResource('AWS::Config::ConfigRule', {
+      Source: {
+        Owner: 'AWS',
+        SourceIdentifier: config.ManagedRuleIdentifiers.EC2_INSTANCE_PROFILE_ATTACHED,
+      },
+    }));
+
+    test.done();
+  },
 };

From 86e63f8f33a386f5d2e4b51d4c0c3e55a3e6d611 Mon Sep 17 00:00:00 2001
From: Otavio Macedo <otaviomacedo@protonmail.com>
Date: Tue, 7 Sep 2021 17:53:10 +0100
Subject: [PATCH 74/91] chore: bringing the changes from v2-main to master
 related to the experimental modules (#16401)

Bringing the changes from `v2-main` to `master` related to the experimental modules. These changes were made directly in `v2-main` because the version of the `@aws-cdk/assert` library compatible with `aws-cdk-lib` only existed in `v2-main`.

----

*By submitting this pull request, I confirm that my contribution is made under the terms of the Apache-2.0 license*
---
 buildspec-pr.yaml                             |   4 +-
 buildspec.yaml                                |   1 +
 package.json                                  |  10 +
 packages/@aws-cdk/assertions/vendor-in.sh     |  12 +-
 .../test/integ.s3-bucket.lit.ts               |   1 +
 packages/aws-cdk-migration/lib/rewrite.ts     |  31 ++-
 packages/individual-packages/.gitignore       |   1 +
 packages/individual-packages/README.md        |   5 +
 packages/individual-packages/lerna.json       |   9 +
 packages/individual-packages/package.json     |   8 +
 scripts/transform.sh                          |  70 +++++
 tools/individual-pkg-gen/.eslintrc.js         |   3 +
 tools/individual-pkg-gen/.gitignore           |  15 ++
 tools/individual-pkg-gen/.npmignore           |  16 ++
 tools/individual-pkg-gen/LICENSE              | 201 +++++++++++++++
 tools/individual-pkg-gen/NOTICE               |   2 +
 tools/individual-pkg-gen/README.md            |  21 ++
 .../individual-pkg-gen/bin/individual-pkg-gen |   8 +
 .../copy-files-removing-deps.ts               | 244 ++++++++++++++++++
 tools/individual-pkg-gen/jest.config.js       |  10 +
 tools/individual-pkg-gen/package.json         |  53 ++++
 .../restore-package-jsons.ts                  |  20 ++
 tools/individual-pkg-gen/test/gen.test.ts     |   3 +
 tools/individual-pkg-gen/tsconfig.json        |  20 ++
 tools/pkglint/lib/rules.ts                    |  16 +-
 tools/pkglint/lib/util.ts                     |   2 +-
 26 files changed, 773 insertions(+), 13 deletions(-)
 create mode 100644 packages/individual-packages/.gitignore
 create mode 100644 packages/individual-packages/README.md
 create mode 100644 packages/individual-packages/lerna.json
 create mode 100644 packages/individual-packages/package.json
 create mode 100755 scripts/transform.sh
 create mode 100644 tools/individual-pkg-gen/.eslintrc.js
 create mode 100644 tools/individual-pkg-gen/.gitignore
 create mode 100644 tools/individual-pkg-gen/.npmignore
 create mode 100644 tools/individual-pkg-gen/LICENSE
 create mode 100644 tools/individual-pkg-gen/NOTICE
 create mode 100644 tools/individual-pkg-gen/README.md
 create mode 100755 tools/individual-pkg-gen/bin/individual-pkg-gen
 create mode 100644 tools/individual-pkg-gen/copy-files-removing-deps.ts
 create mode 100644 tools/individual-pkg-gen/jest.config.js
 create mode 100644 tools/individual-pkg-gen/package.json
 create mode 100644 tools/individual-pkg-gen/restore-package-jsons.ts
 create mode 100644 tools/individual-pkg-gen/test/gen.test.ts
 create mode 100644 tools/individual-pkg-gen/tsconfig.json

diff --git a/buildspec-pr.yaml b/buildspec-pr.yaml
index 017c7d84e9f61..3d6ee87c8d1ff 100644
--- a/buildspec-pr.yaml
+++ b/buildspec-pr.yaml
@@ -14,4 +14,6 @@ phases:
       - yarn --version || npm -g install yarn
   build:
     commands:
-      - /bin/bash ./build.sh --extract && git diff-index --exit-code --ignore-space-at-eol --stat HEAD
+      - /bin/bash ./build.sh --extract
+      - /bin/bash ./scripts/transform.sh --extract
+      - git diff-index --exit-code --ignore-space-at-eol --stat HEAD
diff --git a/buildspec.yaml b/buildspec.yaml
index 429c5719e05c3..3f2bb4e7e1102 100644
--- a/buildspec.yaml
+++ b/buildspec.yaml
@@ -17,6 +17,7 @@ phases:
       - 'if ${BUMP_CANDIDATE:-false}; then /bin/bash ./scripts/bump-candidate.sh; fi'
       - /bin/bash ./scripts/align-version.sh
       - /bin/bash ./build.sh
+      - /bin/bash ./scripts/transform.sh
   post_build:
     commands:
       - "[ -f .BUILD_COMPLETED ] && /bin/bash ./pack.sh"
diff --git a/package.json b/package.json
index 383ddf1c8e4c5..029b1989ea072 100644
--- a/package.json
+++ b/package.json
@@ -71,6 +71,16 @@
     "nohoist": [
       "**/jszip",
       "**/jszip/**",
+      "@aws-cdk/assertions-alpha/colors",
+      "@aws-cdk/assertions-alpha/colors/**",
+      "@aws-cdk/assertions-alpha/diff",
+      "@aws-cdk/assertions-alpha/diff/**",
+      "@aws-cdk/assertions-alpha/fast-deep-equal",
+      "@aws-cdk/assertions-alpha/fast-deep-equal/**",
+      "@aws-cdk/assertions-alpha/string-width",
+      "@aws-cdk/assertions-alpha/string-width/**",
+      "@aws-cdk/assertions-alpha/table",
+      "@aws-cdk/assertions-alpha/table/**",
       "@aws-cdk/assertions/colors",
       "@aws-cdk/assertions/colors/**",
       "@aws-cdk/assertions/diff",
diff --git a/packages/@aws-cdk/assertions/vendor-in.sh b/packages/@aws-cdk/assertions/vendor-in.sh
index 9cf5fcfc29d01..803ff1a7a28ff 100755
--- a/packages/@aws-cdk/assertions/vendor-in.sh
+++ b/packages/@aws-cdk/assertions/vendor-in.sh
@@ -17,6 +17,16 @@ echo "⏳ Vendoring in modules..."
 
 scriptdir=$(cd $(dirname $0) && pwd)
 cd $scriptdir
+
+if [[ "$PHASE" == "transform" ]]; then
+  # Make the script short-circuit when running in the packages/individual-packages build context.
+  # That's required because the build done by individual-pkg-gen does import re-writing when copying the TS files
+  # (because it needs to know which modules are also unstable to do the rewriting correctly),
+  # but the vendor.sh script runs only after the 'build' script for this package has been invoked,
+  # which means any TS files copied by it successfully would not have their imports re-written.
+  exit 0
+fi
+
 set -euo pipefail
 dest="lib/vendored"
 mkdir -p $dest
@@ -44,4 +54,4 @@ They also cannot be bundled since they are part of the monorepo.
 Instead vendor them directly into the assertv2 library.
 EOF
 
-echo "✅ Vendoring complete"
\ No newline at end of file
+echo "✅ Vendoring complete"
diff --git a/packages/@aws-cdk/aws-kinesisfirehose-destinations/test/integ.s3-bucket.lit.ts b/packages/@aws-cdk/aws-kinesisfirehose-destinations/test/integ.s3-bucket.lit.ts
index 0527cbd26f7d7..5c6b35a748c98 100644
--- a/packages/@aws-cdk/aws-kinesisfirehose-destinations/test/integ.s3-bucket.lit.ts
+++ b/packages/@aws-cdk/aws-kinesisfirehose-destinations/test/integ.s3-bucket.lit.ts
@@ -1,4 +1,5 @@
 #!/usr/bin/env node
+/// !cdk-integ pragma:ignore-assets
 import * as path from 'path';
 import * as firehose from '@aws-cdk/aws-kinesisfirehose';
 import * as kms from '@aws-cdk/aws-kms';
diff --git a/packages/aws-cdk-migration/lib/rewrite.ts b/packages/aws-cdk-migration/lib/rewrite.ts
index f25ae7b6735f2..970627e361aa2 100644
--- a/packages/aws-cdk-migration/lib/rewrite.ts
+++ b/packages/aws-cdk-migration/lib/rewrite.ts
@@ -1,5 +1,15 @@
 import * as ts from 'typescript';
 
+/**
+ * The options for rewriting the file.
+ */
+export interface RewriteOptions {
+  /**
+   * Optional module names that should result in replacing to something different than just 'aws-cdk-lib'.
+   */
+  readonly customModules?: { [moduleName: string]: string };
+}
+
 /**
  * Re-writes "hyper-modular" CDK imports (most packages in `@aws-cdk/*`) to the
  * relevant "mono" CDK import path. The re-writing will only modify the imported
@@ -21,14 +31,14 @@ import * as ts from 'typescript';
  *
  * @returns the updated source code.
  */
-export function rewriteImports(sourceText: string, fileName: string = 'index.ts'): string {
+export function rewriteImports(sourceText: string, fileName: string = 'index.ts', options: RewriteOptions = {}): string {
   const sourceFile = ts.createSourceFile(fileName, sourceText, ts.ScriptTarget.ES2018);
 
   const replacements = new Array<{ original: ts.Node, updatedLocation: string }>();
 
   const visitor = <T extends ts.Node>(node: T): ts.VisitResult<T> => {
     const moduleSpecifier = getModuleSpecifier(node);
-    const newTarget = moduleSpecifier && updatedLocationOf(moduleSpecifier.text);
+    const newTarget = moduleSpecifier && updatedLocationOf(moduleSpecifier.text, options);
 
     if (moduleSpecifier != null && newTarget != null) {
       replacements.push({ original: moduleSpecifier, updatedLocation: newTarget });
@@ -92,11 +102,20 @@ const EXEMPTIONS = new Set([
   '@aws-cdk/cloudformation-diff',
 ]);
 
-function updatedLocationOf(modulePath: string): string | undefined {
+function updatedLocationOf(modulePath: string, options: RewriteOptions): string | undefined {
+  const customModulePath = options.customModules?.[modulePath];
+  if (customModulePath) {
+    return customModulePath;
+  }
+
   if (!modulePath.startsWith('@aws-cdk/') || EXEMPTIONS.has(modulePath)) {
     return undefined;
   }
 
+  if (modulePath.startsWith('@aws-cdk/core/lib')) {
+    return `aws-cdk-lib/lib/core/lib/${modulePath.substring('@aws-cdk/core/lib/'.length)}`;
+  }
+
   if (modulePath === '@aws-cdk/core') {
     return 'aws-cdk-lib';
   }
@@ -106,6 +125,12 @@ function updatedLocationOf(modulePath: string): string | undefined {
     return '@aws-cdk/assert';
   }
 
+  // can't use simple equality here,
+  // because we have imports like "import '@aws-cdk/assert-internal/jest'"
+  if (modulePath.startsWith('@aws-cdk/assert-internal')) {
+    return modulePath.replace(/^@aws-cdk\/assert-internal/, '@aws-cdk/assert');
+  }
+
   if (modulePath === '@aws-cdk/assert/jest') {
     return '@aws-cdk/assert/jest';
   }
diff --git a/packages/individual-packages/.gitignore b/packages/individual-packages/.gitignore
new file mode 100644
index 0000000000000..150f68c80f529
--- /dev/null
+++ b/packages/individual-packages/.gitignore
@@ -0,0 +1 @@
+*/*
diff --git a/packages/individual-packages/README.md b/packages/individual-packages/README.md
new file mode 100644
index 0000000000000..92537a80f3944
--- /dev/null
+++ b/packages/individual-packages/README.md
@@ -0,0 +1,5 @@
+In this directory we generate at build time all individual packages in V2
+that we release separately from `aws-cdk-lib`
+(right now, those are the experimental and developer preview packages).
+
+The packages are generated by the [`individual-pkg-gen` tool](../../tools/individual-pkg-gen).
diff --git a/packages/individual-packages/lerna.json b/packages/individual-packages/lerna.json
new file mode 100644
index 0000000000000..2d9206447d084
--- /dev/null
+++ b/packages/individual-packages/lerna.json
@@ -0,0 +1,9 @@
+{
+  "lerna": "3.15.0",
+  "npmClient": "yarn",
+  "packages": [
+    "*"
+  ],
+  "rejectCycles": "true",
+  "version": "independent"
+}
diff --git a/packages/individual-packages/package.json b/packages/individual-packages/package.json
new file mode 100644
index 0000000000000..48a5d51789dc5
--- /dev/null
+++ b/packages/individual-packages/package.json
@@ -0,0 +1,8 @@
+{
+  "name": "individual-packages",
+  "version": "0.0.0",
+  "private": true,
+  "devDependencies": {
+    "lerna": "^4.0.0"
+  }
+}
diff --git a/scripts/transform.sh b/scripts/transform.sh
new file mode 100755
index 0000000000000..bbbae4c275cf9
--- /dev/null
+++ b/scripts/transform.sh
@@ -0,0 +1,70 @@
+#!/bin/bash
+
+# To run this script in development, first build the following packages:
+#     packages/@aws-cdk/assert
+#     packages/aws-cdk-lib
+#     tools/individual-pkg-gen
+
+set -euo pipefail
+scriptdir=$(cd $(dirname $0) && pwd)
+
+# Creates a symlink in each individual package's node_modules folder pointing
+# to the root folder's node_modules/.bin. This allows Yarn to find the executables
+# it needs (e.g., jsii-rosetta) for the build.
+#
+# The reason Yarn doesn't find the executables in the first place is that they are
+# not dependencies of each individual package -- nor should they be. They can't be
+# found in the lerna workspace, either, since it only includes the individual
+# packages. For potential alternatives to try out in the future, see
+# https://github.com/cdklabs/cdk-ops/issues/1636
+createSymlinks() {
+  find "$1" ! -path "$1" -type d -maxdepth 1 \
+    -exec mkdir -p {}/node_modules \; \
+    -exec ln -sf "${scriptdir}"/../node_modules/.bin {}/node_modules \;
+}
+
+runtarget="build"
+run_tests="true"
+extract_snippets="false"
+skip_build=""
+while [[ "${1:-}" != "" ]]; do
+    case $1 in
+        -h|--help)
+            echo "Usage: transform.sh [--skip-test/build] [--extract]"
+            exit 1
+            ;;
+        --skip-test|--skip-tests)
+            run_tests="false"
+            ;;
+        --skip-build)
+            skip_build="true"
+            ;;
+        --extract)
+            extract_snippets="true"
+            ;;
+        *)
+            echo "Unrecognized options: $1"
+            exit 1
+            ;;
+    esac
+    shift
+done
+if [ "$run_tests" == "true" ]; then
+  runtarget="$runtarget+test"
+fi
+if [ "$extract_snippets" == "true" ]; then
+  runtarget="$runtarget+extract"
+fi
+
+export NODE_OPTIONS="--max-old-space-size=4096 --experimental-worker ${NODE_OPTIONS:-}"
+
+individual_packages_folder=${scriptdir}/../packages/individual-packages
+# copy & build the packages that are individually released from 'aws-cdk-lib'
+cd "$individual_packages_folder"
+../../tools/individual-pkg-gen/bin/individual-pkg-gen
+
+createSymlinks "$individual_packages_folder"
+
+if [ "$skip_build" != "true" ]; then
+  PHASE=transform yarn lerna run --stream $runtarget
+fi
diff --git a/tools/individual-pkg-gen/.eslintrc.js b/tools/individual-pkg-gen/.eslintrc.js
new file mode 100644
index 0000000000000..61dd8dd001f63
--- /dev/null
+++ b/tools/individual-pkg-gen/.eslintrc.js
@@ -0,0 +1,3 @@
+const baseConfig = require('cdk-build-tools/config/eslintrc');
+baseConfig.parserOptions.project = __dirname + '/tsconfig.json';
+module.exports = baseConfig;
diff --git a/tools/individual-pkg-gen/.gitignore b/tools/individual-pkg-gen/.gitignore
new file mode 100644
index 0000000000000..acdfee7f84c04
--- /dev/null
+++ b/tools/individual-pkg-gen/.gitignore
@@ -0,0 +1,15 @@
+*.js
+node_modules
+*.js.map
+*.d.ts
+
+.LAST_BUILD
+.nyc_output
+coverage
+nyc.config.js
+*.snk
+!.eslintrc.js
+
+junit.xml
+
+!jest.config.js
\ No newline at end of file
diff --git a/tools/individual-pkg-gen/.npmignore b/tools/individual-pkg-gen/.npmignore
new file mode 100644
index 0000000000000..c480a1570dbe3
--- /dev/null
+++ b/tools/individual-pkg-gen/.npmignore
@@ -0,0 +1,16 @@
+# Don't include original .ts files when doing `npm pack`
+*.ts
+!*.d.ts
+coverage
+.nyc_output
+*.tgz
+
+.LAST_BUILD
+*.snk
+.eslintrc.js
+
+# exclude cdk artifacts
+**/cdk.out
+junit.xml
+
+jest.config.js
\ No newline at end of file
diff --git a/tools/individual-pkg-gen/LICENSE b/tools/individual-pkg-gen/LICENSE
new file mode 100644
index 0000000000000..28e4bdcec77ec
--- /dev/null
+++ b/tools/individual-pkg-gen/LICENSE
@@ -0,0 +1,201 @@
+                                 Apache License
+                           Version 2.0, January 2004
+                        http://www.apache.org/licenses/
+
+   TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION
+
+   1. Definitions.
+
+      "License" shall mean the terms and conditions for use, reproduction,
+      and distribution as defined by Sections 1 through 9 of this document.
+
+      "Licensor" shall mean the copyright owner or entity authorized by
+      the copyright owner that is granting the License.
+
+      "Legal Entity" shall mean the union of the acting entity and all
+      other entities that control, are controlled by, or are under common
+      control with that entity. For the purposes of this definition,
+      "control" means (i) the power, direct or indirect, to cause the
+      direction or management of such entity, whether by contract or
+      otherwise, or (ii) ownership of fifty percent (50%) or more of the
+      outstanding shares, or (iii) beneficial ownership of such entity.
+
+      "You" (or "Your") shall mean an individual or Legal Entity
+      exercising permissions granted by this License.
+
+      "Source" form shall mean the preferred form for making modifications,
+      including but not limited to software source code, documentation
+      source, and configuration files.
+
+      "Object" form shall mean any form resulting from mechanical
+      transformation or translation of a Source form, including but
+      not limited to compiled object code, generated documentation,
+      and conversions to other media types.
+
+      "Work" shall mean the work of authorship, whether in Source or
+      Object form, made available under the License, as indicated by a
+      copyright notice that is included in or attached to the work
+      (an example is provided in the Appendix below).
+
+      "Derivative Works" shall mean any work, whether in Source or Object
+      form, that is based on (or derived from) the Work and for which the
+      editorial revisions, annotations, elaborations, or other modifications
+      represent, as a whole, an original work of authorship. For the purposes
+      of this License, Derivative Works shall not include works that remain
+      separable from, or merely link (or bind by name) to the interfaces of,
+      the Work and Derivative Works thereof.
+
+      "Contribution" shall mean any work of authorship, including
+      the original version of the Work and any modifications or additions
+      to that Work or Derivative Works thereof, that is intentionally
+      submitted to Licensor for inclusion in the Work by the copyright owner
+      or by an individual or Legal Entity authorized to submit on behalf of
+      the copyright owner. For the purposes of this definition, "submitted"
+      means any form of electronic, verbal, or written communication sent
+      to the Licensor or its representatives, including but not limited to
+      communication on electronic mailing lists, source code control systems,
+      and issue tracking systems that are managed by, or on behalf of, the
+      Licensor for the purpose of discussing and improving the Work, but
+      excluding communication that is conspicuously marked or otherwise
+      designated in writing by the copyright owner as "Not a Contribution."
+
+      "Contributor" shall mean Licensor and any individual or Legal Entity
+      on behalf of whom a Contribution has been received by Licensor and
+      subsequently incorporated within the Work.
+
+   2. Grant of Copyright License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      copyright license to reproduce, prepare Derivative Works of,
+      publicly display, publicly perform, sublicense, and distribute the
+      Work and such Derivative Works in Source or Object form.
+
+   3. Grant of Patent License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      (except as stated in this section) patent license to make, have made,
+      use, offer to sell, sell, import, and otherwise transfer the Work,
+      where such license applies only to those patent claims licensable
+      by such Contributor that are necessarily infringed by their
+      Contribution(s) alone or by combination of their Contribution(s)
+      with the Work to which such Contribution(s) was submitted. If You
+      institute patent litigation against any entity (including a
+      cross-claim or counterclaim in a lawsuit) alleging that the Work
+      or a Contribution incorporated within the Work constitutes direct
+      or contributory patent infringement, then any patent licenses
+      granted to You under this License for that Work shall terminate
+      as of the date such litigation is filed.
+
+   4. Redistribution. You may reproduce and distribute copies of the
+      Work or Derivative Works thereof in any medium, with or without
+      modifications, and in Source or Object form, provided that You
+      meet the following conditions:
+
+      (a) You must give any other recipients of the Work or
+          Derivative Works a copy of this License; and
+
+      (b) You must cause any modified files to carry prominent notices
+          stating that You changed the files; and
+
+      (c) You must retain, in the Source form of any Derivative Works
+          that You distribute, all copyright, patent, trademark, and
+          attribution notices from the Source form of the Work,
+          excluding those notices that do not pertain to any part of
+          the Derivative Works; and
+
+      (d) If the Work includes a "NOTICE" text file as part of its
+          distribution, then any Derivative Works that You distribute must
+          include a readable copy of the attribution notices contained
+          within such NOTICE file, excluding those notices that do not
+          pertain to any part of the Derivative Works, in at least one
+          of the following places: within a NOTICE text file distributed
+          as part of the Derivative Works; within the Source form or
+          documentation, if provided along with the Derivative Works; or,
+          within a display generated by the Derivative Works, if and
+          wherever such third-party notices normally appear. The contents
+          of the NOTICE file are for informational purposes only and
+          do not modify the License. You may add Your own attribution
+          notices within Derivative Works that You distribute, alongside
+          or as an addendum to the NOTICE text from the Work, provided
+          that such additional attribution notices cannot be construed
+          as modifying the License.
+
+      You may add Your own copyright statement to Your modifications and
+      may provide additional or different license terms and conditions
+      for use, reproduction, or distribution of Your modifications, or
+      for any such Derivative Works as a whole, provided Your use,
+      reproduction, and distribution of the Work otherwise complies with
+      the conditions stated in this License.
+
+   5. Submission of Contributions. Unless You explicitly state otherwise,
+      any Contribution intentionally submitted for inclusion in the Work
+      by You to the Licensor shall be under the terms and conditions of
+      this License, without any additional terms or conditions.
+      Notwithstanding the above, nothing herein shall supersede or modify
+      the terms of any separate license agreement you may have executed
+      with Licensor regarding such Contributions.
+
+   6. Trademarks. This License does not grant permission to use the trade
+      names, trademarks, service marks, or product names of the Licensor,
+      except as required for reasonable and customary use in describing the
+      origin of the Work and reproducing the content of the NOTICE file.
+
+   7. Disclaimer of Warranty. Unless required by applicable law or
+      agreed to in writing, Licensor provides the Work (and each
+      Contributor provides its Contributions) on an "AS IS" BASIS,
+      WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or
+      implied, including, without limitation, any warranties or conditions
+      of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A
+      PARTICULAR PURPOSE. You are solely responsible for determining the
+      appropriateness of using or redistributing the Work and assume any
+      risks associated with Your exercise of permissions under this License.
+
+   8. Limitation of Liability. In no event and under no legal theory,
+      whether in tort (including negligence), contract, or otherwise,
+      unless required by applicable law (such as deliberate and grossly
+      negligent acts) or agreed to in writing, shall any Contributor be
+      liable to You for damages, including any direct, indirect, special,
+      incidental, or consequential damages of any character arising as a
+      result of this License or out of the use or inability to use the
+      Work (including but not limited to damages for loss of goodwill,
+      work stoppage, computer failure or malfunction, or any and all
+      other commercial damages or losses), even if such Contributor
+      has been advised of the possibility of such damages.
+
+   9. Accepting Warranty or Additional Liability. While redistributing
+      the Work or Derivative Works thereof, You may choose to offer,
+      and charge a fee for, acceptance of support, warranty, indemnity,
+      or other liability obligations and/or rights consistent with this
+      License. However, in accepting such obligations, You may act only
+      on Your own behalf and on Your sole responsibility, not on behalf
+      of any other Contributor, and only if You agree to indemnify,
+      defend, and hold each Contributor harmless for any liability
+      incurred by, or claims asserted against, such Contributor by reason
+      of your accepting any such warranty or additional liability.
+
+   END OF TERMS AND CONDITIONS
+
+   APPENDIX: How to apply the Apache License to your work.
+
+      To apply the Apache License to your work, attach the following
+      boilerplate notice, with the fields enclosed by brackets "[]"
+      replaced with your own identifying information. (Don't include
+      the brackets!)  The text should be enclosed in the appropriate
+      comment syntax for the file format. We also recommend that a
+      file or class name and description of purpose be included on the
+      same "printed page" as the copyright notice for easier
+      identification within third-party archives.
+
+   Copyright 2018-2021 Amazon.com, Inc. or its affiliates. All Rights Reserved.
+
+   Licensed under the Apache License, Version 2.0 (the "License");
+   you may not use this file except in compliance with the License.
+   You may obtain a copy of the License at
+
+       http://www.apache.org/licenses/LICENSE-2.0
+
+   Unless required by applicable law or agreed to in writing, software
+   distributed under the License is distributed on an "AS IS" BASIS,
+   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+   See the License for the specific language governing permissions and
+   limitations under the License.
diff --git a/tools/individual-pkg-gen/NOTICE b/tools/individual-pkg-gen/NOTICE
new file mode 100644
index 0000000000000..5fc3826926b5b
--- /dev/null
+++ b/tools/individual-pkg-gen/NOTICE
@@ -0,0 +1,2 @@
+AWS Cloud Development Kit (AWS CDK)
+Copyright 2018-2021 Amazon.com, Inc. or its affiliates. All Rights Reserved.
diff --git a/tools/individual-pkg-gen/README.md b/tools/individual-pkg-gen/README.md
new file mode 100644
index 0000000000000..a86d15f679815
--- /dev/null
+++ b/tools/individual-pkg-gen/README.md
@@ -0,0 +1,21 @@
+# `individual-pkg-gen`
+
+The tool contains the logic of the copying the packages we release individually,
+instead of vending them inside `aws-cdk-lib`,
+from their original V1 form in `packages/@aws-cdk/` to `packages/individual-packages`.
+It's called from the [`transform.sh` script](../../scripts/transform.sh).
+
+We do the translation in 2 phases:
+
+1. Copy all files from the V1 versions of the modules,
+  and remove all dependencies from the packages besides other experimental ones.
+  Save the original dependencies in a `_package.json` files of the copied modules.
+  This is done in the [`copy-files-removing-deps.ts` file](copy-files-removing-deps.ts).
+2. Run `lerna bootstrap`.
+3. In phase 2, bring back the dependencies by renaming the `_package.json` files to `package.json`.
+   This is done in the [`restore-package-jsons.ts` file](restore-package-jsons.ts).
+
+We have to do it this way,
+because otherwise `lerna bootstrap` would fail on the main monorepo packages like `cdk-build-tools`.
+
+The entrypoint of the package is the [`bin/individual-pkg-gen` file](bin/individual-pkg-gen).
diff --git a/tools/individual-pkg-gen/bin/individual-pkg-gen b/tools/individual-pkg-gen/bin/individual-pkg-gen
new file mode 100755
index 0000000000000..3a335a40c39f7
--- /dev/null
+++ b/tools/individual-pkg-gen/bin/individual-pkg-gen
@@ -0,0 +1,8 @@
+#!/bin/bash
+
+set -euo pipefail
+scriptdir=$(cd $(dirname $0) && pwd)
+
+node $scriptdir/../copy-files-removing-deps.js
+yarn lerna bootstrap
+node $scriptdir/../restore-package-jsons.js
diff --git a/tools/individual-pkg-gen/copy-files-removing-deps.ts b/tools/individual-pkg-gen/copy-files-removing-deps.ts
new file mode 100644
index 0000000000000..e7576621492c2
--- /dev/null
+++ b/tools/individual-pkg-gen/copy-files-removing-deps.ts
@@ -0,0 +1,244 @@
+import * as path from 'path';
+import * as awsCdkMigration from 'aws-cdk-migration';
+import * as fs from 'fs-extra';
+// eslint-disable-next-line @typescript-eslint/no-require-imports
+const lerna_project = require('@lerna/project');
+
+transformPackages();
+
+function transformPackages(): void {
+  // there is a lerna.json in the individual-packages directory, where this script executes
+  const project = new lerna_project.Project(__dirname);
+  const packages = project.getPackagesSync();
+  const alphaPackages = getAlphaPackages(packages);
+
+  for (const pkg of packages) {
+    if (!packageIsAlpha(pkg)) {
+      continue;
+    }
+
+    const srcDir = pkg.location;
+    const packageUnscopedName = `${pkg.name.substring('@aws-cdk/'.length)}`;
+    const destDir = path.join('.', packageUnscopedName);
+    fs.mkdirpSync(destDir);
+
+    copyOrTransformFiles(pkg, srcDir, destDir, [
+      // list of files to _not_ copy from the V1 package root
+      // .gitignore is not on the list, because pkglint checks it
+      'dist',
+      'node_modules',
+      'coverage',
+      '.nyc_output',
+      'nyc.config.js',
+      '.jsii',
+      'tsconfig.json',
+      'tsconfig.tsbuildinfo',
+    ]);
+  }
+
+  function copyOrTransformFiles(pkg: any, srcDir: string, destDir: string, ignoredFiles: string[]): void {
+    const sourceFiles = fs.readdirSync(srcDir);
+    for (const sourceFileName of sourceFiles) {
+      if (ignoredFiles.includes(sourceFileName)) {
+        continue;
+      }
+
+      const source = path.join(srcDir, sourceFileName);
+      const destination = path.join(destDir, sourceFileName);
+
+      if (srcDir === pkg.location && sourceFileName === 'package.json') {
+        // Only transform packageJsons at the package root, not in any nested packages.
+        transformPackageJson(pkg, source, destination, alphaPackages);
+      } else if (sourceFileName === '.gitignore') {
+        // ignore everything, otherwise there are uncommitted files present in testing,
+        // because the module's .gitignore file has entries like !.eslintrc.js
+        const gitIgnoreContents = fs.readFileSync(source);
+        fs.outputFileSync(destination, Buffer.concat([gitIgnoreContents, Buffer.from('\n*\n')]));
+      } else if (sourceFileName === '.eslintrc.js') {
+        // Change the default configuration of the import/no-extraneous-dependencies rule
+        // (as the unstable packages don't use direct dependencies,
+        // but instead a combination of devDependencies + peerDependencies)
+        const esLintRcLines = fs.readFileSync(source).toString().split('\n');
+        const resultFileLines = [];
+        for (const line of esLintRcLines) {
+          resultFileLines.push(line);
+          // put our new line right after the parserOptions.project setting line,
+          // as some files export a copy of this object,
+          // in which case putting it at the end doesn't work
+          if (line.startsWith('baseConfig.parserOptions.project')) {
+            resultFileLines.push("\nbaseConfig.rules['import/no-extraneous-dependencies'] = ['error', " +
+              '{ devDependencies: true, peerDependencies: true } ];\n');
+          }
+        }
+        fs.outputFileSync(destination, resultFileLines.join('\n'));
+      } else if (sourceFileName.endsWith('.ts') && !sourceFileName.endsWith('.d.ts')) {
+        const sourceCode = fs.readFileSync(source).toString();
+        const sourceCodeOutput = awsCdkMigration.rewriteImports(sourceCode, sourceFileName, {
+          customModules: alphaPackages,
+        });
+        fs.outputFileSync(destination, sourceCodeOutput);
+      } else {
+        const stat = fs.statSync(source);
+        if (stat.isDirectory()) {
+          // we only ignore files on the top level in the package,
+          // as some subdirectories we do want to copy over
+          // (for example, synthetics contains a node_modules/ in the test/ directory
+          // that is needed for running the tests)
+          copyOrTransformFiles(pkg, source, destination, []);
+        } else {
+          fs.copySync(source, destination);
+        }
+      }
+    }
+  }
+}
+
+function transformPackageJson(pkg: any, source: string, destination: string, alphaPackages: { [dep: string]: string; }) {
+  const packageJson = fs.readJsonSync(source);
+  const pkgUnscopedName = `${pkg.name.substring('@aws-cdk/'.length)}`;
+
+  packageJson.name += '-alpha';
+  packageJson.repository.directory = `packages/individual-packages/${pkgUnscopedName}`;
+
+  // disable awslint (some rules are hard-coded to @aws-cdk/core)
+  packageJson.awslint = {
+    exclude: ['*:*'],
+  };
+
+  // add a pkglint exemption for the 'package name = dir name' rule
+  const pkglint = packageJson.pkglint || {};
+  pkglint.exclude = [
+    ...(pkglint.exclude || []),
+    'naming/package-matches-directory',
+    // the experimental packages need the "real" assert dependency
+    'assert/assert-dependency',
+  ];
+  packageJson.pkglint = pkglint;
+
+  // turn off the L1 generation, which uses @aws-cdk/ modules
+  if (packageJson.scripts?.gen === 'cfn2ts') {
+    delete packageJson.scripts.gen;
+  }
+
+  // https://github.com/aws/aws-cdk/issues/15576
+  const jsiiTargets = packageJson.jsii.targets;
+  jsiiTargets.dotnet.namespace += '.Alpha';
+  jsiiTargets.dotnet.packageId += '.Alpha';
+  jsiiTargets.java.package += '.alpha';
+  jsiiTargets.java.maven.artifactId += '-alpha';
+  jsiiTargets.python.distName += '-alpha';
+  jsiiTargets.python.module += '_alpha';
+  // Typically, only our top-level packages have a Go target.
+  // moduleName is needed; packageName will be automatically derived by from the package name.
+  jsiiTargets.go = {
+    moduleName: 'github.com/aws/aws-cdk-go',
+  };
+
+  const finalPackageJson = transformPackageJsonDependencies(packageJson, pkg, alphaPackages);
+
+  fs.writeJsonSync(destination, packageJson, { spaces: 2 });
+  fs.writeJsonSync(path.join(path.dirname(destination), '_package.json'), finalPackageJson, { spaces: 2 });
+}
+
+function transformPackageJsonDependencies(packageJson: any, pkg: any, alphaPackages: { [dep: string]: string; }) {
+  // regular dependencies
+  const alphaDependencies: { [dep: string]: string; } = {};
+  const constructsAndCdkLibDevDeps: { [dep: string]: string; } = {};
+  const bundledDependencies: { [dep: string]: string } = {};
+  const v1BundledDependencies: string[] = packageJson.bundledDependencies || [];
+  for (const dependency of Object.keys(packageJson.dependencies || {})) {
+    // all 'regular' dependencies on alpha modules will be converted to
+    // a pair of devDependency on '0.0.0' and peerDependency on '^0.0.0',
+    // and the package will have no regular dependencies anymore
+    switch (dependency) {
+      // @core corresponds to aws-cdk-lib
+      case '@aws-cdk/core':
+        constructsAndCdkLibDevDeps['aws-cdk-lib'] = pkg.version;
+        break;
+      case 'constructs':
+        constructsAndCdkLibDevDeps.constructs = packageJson.dependencies.constructs;
+        break;
+      default:
+        if (alphaPackages[dependency]) {
+          alphaDependencies[alphaPackages[dependency]] = pkg.version;
+        } else if (v1BundledDependencies.indexOf(dependency) !== -1) {
+          // ...other than third-party dependencies, which are in bundledDependencies
+          bundledDependencies[dependency] = packageJson.dependencies[dependency];
+        }
+    }
+  }
+  packageJson.dependencies = bundledDependencies;
+
+  // devDependencies
+  const alphaDevDependencies: { [dep: string]: string; } = {};
+  const devDependencies: { [dep: string]: string; } = {};
+  for (const v1DevDependency of Object.keys(packageJson.devDependencies || {})) {
+    switch (v1DevDependency) {
+      case '@aws-cdk/assert-internal':
+      case '@aws-cdk/assert':
+        devDependencies['@aws-cdk/assert'] = packageJson.devDependencies[v1DevDependency];
+        break;
+      default:
+        if (alphaPackages[v1DevDependency]) {
+          alphaDevDependencies[alphaPackages[v1DevDependency]] = pkg.version;
+        } else if (!v1DevDependency.startsWith('@aws-cdk/')) {
+          devDependencies[v1DevDependency] = packageJson.devDependencies[v1DevDependency];
+        }
+    }
+  }
+  const finalPackageJson = { ...packageJson };
+  // we save the devDependencies in a temporary _package.json
+  finalPackageJson.devDependencies = {
+    ...devDependencies,
+    ...constructsAndCdkLibDevDeps,
+    ...alphaDevDependencies,
+    ...alphaDependencies,
+  };
+  packageJson.devDependencies = {
+    ...alphaDevDependencies,
+    ...alphaDependencies,
+  };
+
+  // peer dependencies
+  finalPackageJson.peerDependencies = {
+    ...(Object.entries(alphaDependencies)
+      // for other alpha dependencies, we need to depend on exact versions
+      // (because of the braking changes between them)
+      .reduce((acc, [depName, depVersion]) => {
+        acc[depName] = depVersion;
+        return acc;
+      }, {} as { [dep: string]: string; })),
+    ...(Object.entries(constructsAndCdkLibDevDeps)
+      .reduce((acc, [depName, depVersion]) => {
+        acc[depName] = `${depVersion.startsWith('^') ? '' : '^'}${depVersion}`;
+        return acc;
+      }, {} as { [dep: string]: string; })),
+  };
+  packageJson.peerDependencies = undefined;
+  return finalPackageJson;
+}
+
+function getAlphaPackages(packages: any[]): { [dep: string]: string } {
+  return packages
+    .filter(packageIsAlpha)
+    .reduce((acc, pkg: any) => {
+      acc[pkg.name] = `${pkg.name}-alpha`;
+      return acc;
+    }, {});
+}
+
+function packageIsAlpha(pkg: any): boolean {
+  // allow modules to decide themselves whether they should be packaged separately
+  const separateModule = pkg.get('separate-module');
+  if (separateModule !== undefined) {
+    return separateModule;
+  }
+
+  const maturity = pkg.get('maturity');
+  if (maturity !== 'experimental' && maturity !== 'developer-preview') {
+    return false;
+  }
+  // we're only interested in '@aws-cdk/' packages,
+  // and those that are JSII-enabled (so no @aws-cdk/assert)
+  return pkg.name.startsWith('@aws-cdk/') && !!pkg.get('jsii');
+}
diff --git a/tools/individual-pkg-gen/jest.config.js b/tools/individual-pkg-gen/jest.config.js
new file mode 100644
index 0000000000000..07f5f6c432bb6
--- /dev/null
+++ b/tools/individual-pkg-gen/jest.config.js
@@ -0,0 +1,10 @@
+const baseConfig = require('../../tools/cdk-build-tools/config/jest.config');
+module.exports = {
+    ...baseConfig,
+    coverageThreshold: {
+        global: {
+            ...baseConfig.coverageThreshold.global,
+            branches: 60,
+        },
+    },
+};
diff --git a/tools/individual-pkg-gen/package.json b/tools/individual-pkg-gen/package.json
new file mode 100644
index 0000000000000..c28407673a32c
--- /dev/null
+++ b/tools/individual-pkg-gen/package.json
@@ -0,0 +1,53 @@
+{
+  "name": "individual-pkg-gen",
+  "version": "0.0.0",
+  "private": true,
+  "description": "A tool for copying V1 packages to be released separately in V2",
+  "repository": {
+    "type": "git",
+    "url": "https://github.com/aws/aws-cdk.git",
+    "directory": "tools/individual-pkg-gen"
+  },
+  "scripts": {
+    "build": "cdk-build",
+    "watch": "cdk-watch",
+    "lint": "cdk-lint",
+    "test": "cdk-test",
+    "pkglint": "pkglint -f",
+    "build+test+package": "yarn build+test",
+    "build+test": "yarn build && yarn test",
+    "build+extract": "yarn build",
+    "build+test+extract": "yarn build+test"
+  },
+  "author": {
+    "name": "Amazon Web Services",
+    "url": "https://aws.amazon.com",
+    "organization": true
+  },
+  "license": "Apache-2.0",
+  "devDependencies": {
+    "cdk-build-tools": "0.0.0",
+    "pkglint": "0.0.0",
+    "@types/jest": "^26.0.24",
+    "@types/fs-extra": "^8.1.2"
+  },
+  "dependencies": {
+    "aws-cdk-migration": "0.0.0",
+    "fs-extra": "^9.1.0",
+    "@lerna/project": "4.0.0"
+  },
+  "keywords": [
+    "aws",
+    "cdk"
+  ],
+  "homepage": "https://github.com/aws/aws-cdk",
+  "engines": {
+    "node": ">= 10.13.0 <13 || >=13.7.0"
+  },
+  "cdk-build": {
+    "jest": true
+  },
+  "ubergen": {
+    "exclude": true
+  }
+}
diff --git a/tools/individual-pkg-gen/restore-package-jsons.ts b/tools/individual-pkg-gen/restore-package-jsons.ts
new file mode 100644
index 0000000000000..bb87064cbc9da
--- /dev/null
+++ b/tools/individual-pkg-gen/restore-package-jsons.ts
@@ -0,0 +1,20 @@
+import * as path from 'path';
+import * as fs from 'fs-extra';
+// eslint-disable-next-line @typescript-eslint/no-require-imports
+const lerna_project = require('@lerna/project');
+
+bringBackDependencies().catch(e => {
+  // eslint-disable-next-line no-console
+  console.error(e);
+  process.exit(1);
+});
+
+async function bringBackDependencies(): Promise<void[]> {
+  const project = new lerna_project.Project();
+  const separatePackages = project.getPackagesSync();
+  const promises = new Array<Promise<void>>();
+  for (const separatePkg of separatePackages) {
+    promises.push(fs.rename(path.join(separatePkg.location, '_package.json'), separatePkg.manifestLocation));
+  }
+  return Promise.all(promises);
+}
diff --git a/tools/individual-pkg-gen/test/gen.test.ts b/tools/individual-pkg-gen/test/gen.test.ts
new file mode 100644
index 0000000000000..c0c8b49fba246
--- /dev/null
+++ b/tools/individual-pkg-gen/test/gen.test.ts
@@ -0,0 +1,3 @@
+test('No tests are specified for this package', () => {
+  expect(true).toBe(true);
+});
diff --git a/tools/individual-pkg-gen/tsconfig.json b/tools/individual-pkg-gen/tsconfig.json
new file mode 100644
index 0000000000000..14499cd2abfaf
--- /dev/null
+++ b/tools/individual-pkg-gen/tsconfig.json
@@ -0,0 +1,20 @@
+{
+  "compilerOptions": {
+    "target": "ES2018",
+    "module": "commonjs",
+    "lib": ["es2018"],
+    "strict": true,
+    "alwaysStrict": true,
+    "declaration": true,
+    "inlineSourceMap": true,
+    "inlineSources": true,
+    "noUnusedLocals": true,
+    "noUnusedParameters": true,
+    "noImplicitReturns": true,
+    "noFallthroughCasesInSwitch": true,
+    "resolveJsonModule": true,
+    "composite": true,
+    "incremental": true
+  },
+  "include": ["**/*.ts"]
+}
diff --git a/tools/pkglint/lib/rules.ts b/tools/pkglint/lib/rules.ts
index add3c58fee4b2..885c147bcdb82 100644
--- a/tools/pkglint/lib/rules.ts
+++ b/tools/pkglint/lib/rules.ts
@@ -839,13 +839,15 @@ function cdkModuleName(name: string) {
   const pythonName = name.replace(/^@/g, '').replace(/\//g, '.').split('.').map(caseUtils.kebab).join('.');
 
   return {
-    javaPackage: `software.amazon.awscdk${isLegacyCdkPkg ? '' : `.${name.replace(/^aws-/, 'services-').replace(/-/g, '.')}`}`,
+    javaPackage: `software.amazon.awscdk${isLegacyCdkPkg ? '' : `.${name.replace(/aws-/, 'services-').replace(/-/g, '.')}`}`,
     mavenArtifactId:
-      isLegacyCdkPkg ? 'cdk'
-        : isCdkPkg ? 'core'
-          : name.startsWith('aws-') || name.startsWith('alexa-') ? name.replace(/^aws-/, '')
-            : name.startsWith('cdk-') ? name
-              : `cdk-${name}`,
+      isLegacyCdkPkg
+        ? 'cdk'
+        : (isCdkPkg
+          ? 'core'
+          : (name.startsWith('aws-') || name.startsWith('alexa-')
+            ? name.replace(/aws-/, '')
+            : (name.startsWith('cdk-') ? name : `cdk-${name}`))),
     dotnetNamespace: `Amazon.CDK${isCdkPkg ? '' : `.${dotnetSuffix}`}`,
     python: {
       distName: `aws-cdk.${pythonName}`,
@@ -1806,7 +1808,7 @@ function readBannerFile(file: string): string {
   return fs.readFileSync(path.join(__dirname, 'banners', file), { encoding: 'utf-8' }).trim();
 }
 
-function cdkMajorVersion() {
+function cdkMajorVersion(): number {
   // eslint-disable-next-line @typescript-eslint/no-require-imports
   const releaseJson = require(`${monoRepoRoot()}/release.json`);
   return releaseJson.majorVersion as number;
diff --git a/tools/pkglint/lib/util.ts b/tools/pkglint/lib/util.ts
index 019dc244c4176..cbf782ae78f8c 100644
--- a/tools/pkglint/lib/util.ts
+++ b/tools/pkglint/lib/util.ts
@@ -164,7 +164,7 @@ export function findUpward(dir: string, pred: (x: string) => boolean): string |
 }
 
 export function monoRepoRoot() {
-  const ret = findUpward(process.cwd(), d => fs.existsSync(path.join(d, 'lerna.json')) || fs.existsSync(path.join(d, '.nzmroot')));
+  const ret = findUpward(process.cwd(), d => fs.existsSync(path.join(d, 'release.json')) || fs.existsSync(path.join(d, '.nzmroot')));
   if (!ret) {
     throw new Error('Could not find lerna.json');
   }

From 1ffd89714f8b1c1389d4e43383cc77d16d00ed9e Mon Sep 17 00:00:00 2001
From: kaizen3031593 <36202692+kaizen3031593@users.noreply.github.com>
Date: Tue, 7 Sep 2021 15:12:17 -0400
Subject: [PATCH 75/91] fix(cloudwatch): cross account alarms does not support
 math expressions (#16333)

Now they do. Closes #16331.

I have also modified the comment to explain `returnData: entry.tag ? undefined : false` but I endeavor to explain even more here. Only 1 metric within an expression can have `returnData = true`; the rest must be `false`. Cloudformation also defaults an undefined return data to `true` as long as the rest are set to `false`, which is why this ternary operation works. The idea behind this line is that `entry.tag` is defined (with a default of `true`) for the top level expression only and thus every other metric within the expression has `returnData = false`.

----

*By submitting this pull request, I confirm that my contribution is made under the terms of the Apache-2.0 license*
---
 packages/@aws-cdk/aws-cloudwatch/lib/alarm.ts |  5 +-
 .../test/cross-environment.test.ts            | 61 ++++++++++++++++++-
 2 files changed, 62 insertions(+), 4 deletions(-)

diff --git a/packages/@aws-cdk/aws-cloudwatch/lib/alarm.ts b/packages/@aws-cdk/aws-cloudwatch/lib/alarm.ts
index 41928d0af7193..e0692478c8457 100644
--- a/packages/@aws-cdk/aws-cloudwatch/lib/alarm.ts
+++ b/packages/@aws-cdk/aws-cloudwatch/lib/alarm.ts
@@ -321,8 +321,9 @@ export class Alarm extends AlarmBase {
                   unit: stat.unitFilter,
                 },
                 id: entry.id || uniqueMetricId(),
+                accountId: stat.account,
                 label: conf.renderingProperties?.label,
-                returnData: entry.tag ? undefined : false, // Tag stores "primary" attribute, default is "true"
+                returnData: entry.tag ? undefined : false, // entry.tag evaluates to true if the metric is the math expression the alarm is based on.
               };
             },
             withExpression(expr, conf) {
@@ -338,7 +339,7 @@ export class Alarm extends AlarmBase {
                 id: entry.id || uniqueMetricId(),
                 label: conf.renderingProperties?.label,
                 period: hasSubmetrics ? undefined : expr.period,
-                returnData: entry.tag ? undefined : false, // Tag stores "primary" attribute, default is "true"
+                returnData: entry.tag ? undefined : false, // entry.tag evaluates to true if the metric is the math expression the alarm is based on.
               };
             },
           }) as CfnAlarm.MetricDataQueryProperty),
diff --git a/packages/@aws-cdk/aws-cloudwatch/test/cross-environment.test.ts b/packages/@aws-cdk/aws-cloudwatch/test/cross-environment.test.ts
index f17391591a8c5..50278d9a83d54 100644
--- a/packages/@aws-cdk/aws-cloudwatch/test/cross-environment.test.ts
+++ b/packages/@aws-cdk/aws-cloudwatch/test/cross-environment.test.ts
@@ -1,6 +1,6 @@
 import { Template } from '@aws-cdk/assertions';
-import { Stack } from '@aws-cdk/core';
-import { Alarm, GraphWidget, IWidget, Metric } from '../lib';
+import { Duration, Stack } from '@aws-cdk/core';
+import { Alarm, GraphWidget, IWidget, MathExpression, Metric } from '../lib';
 
 const a = new Metric({ namespace: 'Test', metricName: 'ACount' });
 
@@ -177,6 +177,63 @@ describe('cross environment', () => {
         ],
       });
     });
+
+    test('math expression can render in a different account', () => {
+      // GIVEN
+      const b = new Metric({
+        namespace: 'Test',
+        metricName: 'ACount',
+        account: '1234',
+      });
+
+      const c = new MathExpression({
+        expression: 'a + b',
+        usingMetrics: { a: a.attachTo(stack3), b },
+        period: Duration.minutes(1),
+      });
+
+      new Alarm(stack1, 'Alarm', {
+        threshold: 1,
+        evaluationPeriods: 1,
+        metric: c,
+      });
+
+      // THEN
+      Template.fromStack(stack1).hasResourceProperties('AWS::CloudWatch::Alarm', {
+        Metrics: [
+          {
+            Expression: 'a + b',
+            Id: 'expr_1',
+          },
+          {
+            AccountId: '0000',
+            Id: 'a',
+            MetricStat: {
+              Metric: {
+                MetricName: 'ACount',
+                Namespace: 'Test',
+              },
+              Period: 60,
+              Stat: 'Average',
+            },
+            ReturnData: false,
+          },
+          {
+            AccountId: '1234',
+            Id: 'b',
+            MetricStat: {
+              Metric: {
+                MetricName: 'ACount',
+                Namespace: 'Test',
+              },
+              Period: 60,
+              Stat: 'Average',
+            },
+            ReturnData: false,
+          },
+        ],
+      });
+    });
   });
 });
 

From 0dc220fd1849702253643f23396dbc05740074f4 Mon Sep 17 00:00:00 2001
From: kaizen3031593 <zen.conroy@gmail.com>
Date: Tue, 7 Sep 2021 16:45:46 -0400
Subject: [PATCH 76/91] outputName for has/find outputs and mapping

---
 .../assertions/lib/private/mappings.ts        |  10 +-
 .../assertions/lib/private/outputs.ts         |  14 +-
 .../assertions/lib/private/section.ts         |   9 ++
 packages/@aws-cdk/assertions/lib/template.ts  |  17 ++-
 .../@aws-cdk/assertions/test/template.test.ts | 135 ++++++++++++++++--
 5 files changed, 155 insertions(+), 30 deletions(-)

diff --git a/packages/@aws-cdk/assertions/lib/private/mappings.ts b/packages/@aws-cdk/assertions/lib/private/mappings.ts
index 0def435cc0e1d..be83027e9276b 100644
--- a/packages/@aws-cdk/assertions/lib/private/mappings.ts
+++ b/packages/@aws-cdk/assertions/lib/private/mappings.ts
@@ -1,9 +1,9 @@
 import { StackInspector } from '../vendored/assert';
-import { formatFailure, matchSection } from './section';
+import { filterLogicalId, formatFailure, matchSection } from './section';
 
-export function findMappings(inspector: StackInspector, props: any = {}): { [key: string]: any }[] {
+export function findMappings(inspector: StackInspector, outputName: string, props: any = {}): { [key: string]: any }[] {
   const section: { [key: string] : {} } = inspector.value.Mappings;
-  const result = matchSection(section, props);
+  const result = matchSection(filterLogicalId(section,outputName), props);
 
   if (!result.match) {
     return [];
@@ -12,9 +12,9 @@ export function findMappings(inspector: StackInspector, props: any = {}): { [key
   return result.matches;
 }
 
-export function hasMapping(inspector: StackInspector, props: any): string | void {
+export function hasMapping(inspector: StackInspector, outputName: string, props: any): string | void {
   const section: { [key: string]: {} } = inspector.value.Mappings;
-  const result = matchSection(section, props);
+  const result = matchSection(filterLogicalId(section, outputName), props);
 
   if (result.match) {
     return;
diff --git a/packages/@aws-cdk/assertions/lib/private/outputs.ts b/packages/@aws-cdk/assertions/lib/private/outputs.ts
index 0b328ffda7fcb..8d97353cf56d1 100644
--- a/packages/@aws-cdk/assertions/lib/private/outputs.ts
+++ b/packages/@aws-cdk/assertions/lib/private/outputs.ts
@@ -1,9 +1,9 @@
 import { StackInspector } from '../vendored/assert';
-import { formatFailure, matchSection } from './section';
+import { filterLogicalId, formatFailure, matchSection } from './section';
 
-export function findOutputs(inspector: StackInspector, props: any = {}): { [key: string]: any }[] {
+export function findOutputs(inspector: StackInspector, outputName: string, props: any = {}): { [key: string]: any }[] {
   const section: { [key: string] : {} } = inspector.value.Outputs;
-  const result = matchSection(section, props);
+  const result = matchSection(filterLogicalId(section, outputName), props);
 
   if (!result.match) {
     return [];
@@ -14,7 +14,7 @@ export function findOutputs(inspector: StackInspector, props: any = {}): { [key:
 
 export function hasOutput(inspector: StackInspector, outputName: string, props: any): string | void {
   const section: { [key: string]: {} } = inspector.value.Outputs;
-  const result = matchSection(filterName(section, outputName), props);
+  const result = matchSection(filterLogicalId(section, outputName), props);
   if (result.match) {
     return;
   }
@@ -28,9 +28,3 @@ export function hasOutput(inspector: StackInspector, outputName: string, props:
     formatFailure(result.closestResult),
   ].join('\n');
 }
-
-function filterName(section: { [key: string]: {} }, outputName: string): { [key: string]: {} } {
-  return Object.entries(section ?? {})
-    .filter(([k, _]) => k === outputName)
-    .reduce((agg, [k, v]) => { return { ...agg, [k]: v }; }, {});
-}
\ No newline at end of file
diff --git a/packages/@aws-cdk/assertions/lib/private/section.ts b/packages/@aws-cdk/assertions/lib/private/section.ts
index d8f0123de20d6..c7e1d93ecc0f7 100644
--- a/packages/@aws-cdk/assertions/lib/private/section.ts
+++ b/packages/@aws-cdk/assertions/lib/private/section.ts
@@ -55,4 +55,13 @@ export function formatFailure(closestResult: MatchResult): string {
 function leftPad(x: string, indent: number = 2): string {
   const pad = ' '.repeat(indent);
   return pad + x.split('\n').join(`\n${pad}`);
+}
+
+export function filterLogicalId(section: { [key: string]: {} }, outputName: string): { [key: string]: {} } {
+  // default signal for all outputs is '*'
+  if (outputName === '*') return section;
+
+  return Object.entries(section ?? {})
+    .filter(([k, _]) => k === outputName)
+    .reduce((agg, [k, v]) => { return { ...agg, [k]: v }; }, {});
 }
\ No newline at end of file
diff --git a/packages/@aws-cdk/assertions/lib/template.ts b/packages/@aws-cdk/assertions/lib/template.ts
index 2f9f84c54cabb..f67d7e64f3018 100644
--- a/packages/@aws-cdk/assertions/lib/template.ts
+++ b/packages/@aws-cdk/assertions/lib/template.ts
@@ -109,7 +109,7 @@ export class Template {
    * Assert that an Output with the given properties exists in the CloudFormation template.
    * By default, performs partial matching on the resource, via the `Match.objectLike()`.
    * To configure different behavour, use other matchers in the `Match` class.
-   * @param outputName the name of the output.
+   * @param outputName the name of the output. Provide '*' to match all Output names in the template.
    * @param props the output as should be expected in the template.
    */
   public hasOutput(outputName: string, props: any): void {
@@ -121,22 +121,24 @@ export class Template {
 
   /**
    * Get the set of matching Outputs that match the given properties in the CloudFormation template.
+   * @param outputName the name of the output. Provide '*' to match all Output names in the template.
    * @param props by default, matches all Outputs in the template.
    * When a literal object is provided, performs a partial match via `Match.objectLike()`.
    * Use the `Match` APIs to configure a different behaviour.
    */
-  public findOutputs(props: any = {}): { [key: string]: any }[] {
-    return findOutputs(this.inspector, props);
+  public findOutputs(outputName: string, props: any = {}): { [key: string]: any }[] {
+    return findOutputs(this.inspector, outputName, props);
   }
 
   /**
    * Assert that a Mapping with the given properties exists in the CloudFormation template.
    * By default, performs partial matching on the resource, via the `Match.objectLike()`.
    * To configure different behavour, use other matchers in the `Match` class.
+   * @param outputName the name of the output. Provide '*' to match all Output names in the template.
    * @param props the output as should be expected in the template.
    */
-  public hasMapping(props: any): void {
-    const matchError = hasMapping(this.inspector, props);
+  public hasMapping(outputName: string, props: any): void {
+    const matchError = hasMapping(this.inspector, outputName, props);
     if (matchError) {
       throw new Error(matchError);
     }
@@ -144,12 +146,13 @@ export class Template {
 
   /**
    * Get the set of matching Mappings that match the given properties in the CloudFormation template.
+   * @param outputName the name of the output. Provide '*' to match all Output names in the template.
    * @param props by default, matches all Mappings in the template.
    * When a literal object is provided, performs a partial match via `Match.objectLike()`.
    * Use the `Match` APIs to configure a different behaviour.
    */
-  public findMappings(props: any = {}): { [key: string]: any }[] {
-    return findMappings(this.inspector, props);
+  public findMappings(outputName: string, props: any = {}): { [key: string]: any }[] {
+    return findMappings(this.inspector, outputName, props);
   }
 
   /**
diff --git a/packages/@aws-cdk/assertions/test/template.test.ts b/packages/@aws-cdk/assertions/test/template.test.ts
index fc3c34deecd57..6d255eac0c0b7 100644
--- a/packages/@aws-cdk/assertions/test/template.test.ts
+++ b/packages/@aws-cdk/assertions/test/template.test.ts
@@ -370,7 +370,7 @@ describe('Template', () => {
       done();
     });
 
-    test('outputName not matching', (done) => {
+    test('value not matching with outputName', (done) => {
       const stack = new Stack();
       new CfnOutput(stack, 'Foo', {
         value: 'Bar',
@@ -394,7 +394,7 @@ describe('Template', () => {
     });
   });
 
-  test('name not matching', (done) => {
+  test('outputName not matching', (done) => {
     const stack = new Stack();
     new CfnOutput(stack, 'Foo', {
       value: 'Bar',
@@ -432,7 +432,7 @@ describe('Template', () => {
       });
 
       const inspect = Template.fromStack(stack);
-      const result = inspect.findOutputs({ Value: 'Fred' });
+      const result = inspect.findOutputs('*', { Value: 'Fred' });
       expect(result).toEqual([
         { Value: 'Fred', Description: 'FooFred' },
         { Value: 'Fred', Description: 'BarFred' },
@@ -446,7 +446,37 @@ describe('Template', () => {
       });
 
       const inspect = Template.fromStack(stack);
-      const result = inspect.findOutputs({ Value: 'Waldo' });
+      const result = inspect.findOutputs('*', { Value: 'Waldo' });
+      expect(result.length).toEqual(0);
+    });
+
+    test('matching specific output', () => {
+      const stack = new Stack();
+      new CfnOutput(stack, 'Foo', {
+        value: 'Fred',
+      });
+      new CfnOutput(stack, 'Baz', {
+        value: 'Waldo',
+      });
+
+      const inspect = Template.fromStack(stack);
+      const result = inspect.findOutputs('Foo', { Value: 'Fred'});
+      expect(result).toEqual([
+        { Value: 'Fred' },
+      ]);
+    });
+
+    test('not matching specific output', () => {
+      const stack = new Stack();
+      new CfnOutput(stack, 'Foo', {
+        value: 'Fred',
+      });
+      new CfnOutput(stack, 'Baz', {
+        value: 'Waldo',
+      });
+
+      const inspect = Template.fromStack(stack);
+      const result = inspect.findOutputs('Foo', { Value: 'Waldo'});
       expect(result.length).toEqual(0);
     });
   });
@@ -467,7 +497,7 @@ describe('Template', () => {
       });
 
       const inspect = Template.fromStack(stack);
-      expect(() => inspect.hasMapping({ Foo: { Bar: 'Lightning' } })).not.toThrow();
+      expect(() => inspect.hasMapping('*', { Foo: { Bar: 'Lightning' } })).not.toThrow();
     });
 
     test('not matching', (done) => {
@@ -486,7 +516,7 @@ describe('Template', () => {
 
       const inspect = Template.fromStack(stack);
       expectToThrow(
-        () => inspect.hasMapping({
+        () => inspect.hasMapping('*',{
           Foo: { Bar: 'Qux' },
         }),
         [
@@ -497,6 +527,52 @@ describe('Template', () => {
       );
       done();
     });
+
+    test('matching specific outputName', () => {
+      const stack = new Stack();
+      new CfnMapping(stack, 'Foo', {
+        mapping: {
+          Foo: { Bar: 'Lightning', Fred: 'Waldo' },
+          Baz: { Bar: 'Qux' },
+        },
+      });
+      new CfnMapping(stack, 'Fred', {
+        mapping: {
+          Foo: { Bar: 'Lightning' },
+        },
+      });
+
+      const inspect = Template.fromStack(stack);
+      expect(() => inspect.hasMapping('Foo', { Baz: { Bar: 'Qux' } })).not.toThrow();
+    });
+
+    test('not matching specific outputName', (done) => {
+      const stack = new Stack();
+      new CfnMapping(stack, 'Foo', {
+        mapping: {
+          Foo: { Bar: 'Fred', Baz: 'Waldo' },
+          Qux: { Bar: 'Fred' },
+        },
+      });
+      new CfnMapping(stack, 'Fred', {
+        mapping: {
+          Foo: { Baz: 'Baz' },
+        },
+      });
+
+      const inspect = Template.fromStack(stack);
+      expectToThrow(
+        () => inspect.hasMapping('Fred',{
+          Foo: { Baz: 'Fred' },
+        }),
+        [
+          /1 mappings/,
+          /Expected Fred but received Baz/,
+        ],
+        done,
+      );
+      done();
+    });
   });
 
   describe('findMappings', () => {
@@ -515,7 +591,7 @@ describe('Template', () => {
       });
 
       const inspect = Template.fromStack(stack);
-      const result = inspect.findMappings({ Foo: { Bar: 'Lightning' } });
+      const result = inspect.findMappings('*', { Foo: { Bar: 'Lightning' } });
       expect(result).toEqual([
         {
           Foo: { Bar: 'Lightning', Fred: 'Waldo' },
@@ -534,7 +610,50 @@ describe('Template', () => {
       });
 
       const inspect = Template.fromStack(stack);
-      const result = inspect.findMappings({ Foo: { Bar: 'Waldo' } });
+      const result = inspect.findMappings('*', { Foo: { Bar: 'Waldo' } });
+      expect(result.length).toEqual(0);
+    });
+
+    test('matching with specific outputName', () => {
+      const stack = new Stack();
+      new CfnMapping(stack, 'Foo', {
+        mapping: {
+          Foo: { Bar: 'Lightning', Fred: 'Waldo' },
+          Baz: { Bar: 'Qux' },
+        },
+      });
+      new CfnMapping(stack, 'Fred', {
+        mapping: {
+          Foo: { Bar: 'Lightning' },
+        },
+      });
+
+      const inspect = Template.fromStack(stack);
+      const result = inspect.findMappings('Foo', { Foo: { Bar: 'Lightning' } });
+      expect(result).toEqual([
+        {
+          Foo: { Bar: 'Lightning', Fred: 'Waldo' },
+          Baz: { Bar: 'Qux' },
+        },
+      ]);
+    });
+
+    test('not matching', () => {
+      const stack = new Stack();
+      new CfnMapping(stack, 'Foo', {
+        mapping: {
+          Foo: { Bar: 'Lightning', Fred: 'Waldo' },
+          Baz: { Bar: 'Qux' },
+        },
+      });
+      new CfnMapping(stack, 'Fred', {
+        mapping: {
+          Foo: { Bar: 'Lightning' },
+        },
+      });
+
+      const inspect = Template.fromStack(stack);
+      const result = inspect.findMappings('Fred', { Baz: { Bar: 'Qux' } });
       expect(result.length).toEqual(0);
     });
   });

From a86aea8d26de3900ea1bb3119fa9161de22f533a Mon Sep 17 00:00:00 2001
From: kaizen3031593 <zen.conroy@gmail.com>
Date: Tue, 7 Sep 2021 16:47:36 -0400
Subject: [PATCH 77/91] linter

---
 packages/@aws-cdk/assertions/lib/private/mappings.ts | 2 +-
 packages/@aws-cdk/assertions/test/template.test.ts   | 8 ++++----
 2 files changed, 5 insertions(+), 5 deletions(-)

diff --git a/packages/@aws-cdk/assertions/lib/private/mappings.ts b/packages/@aws-cdk/assertions/lib/private/mappings.ts
index be83027e9276b..0c5b3d459faeb 100644
--- a/packages/@aws-cdk/assertions/lib/private/mappings.ts
+++ b/packages/@aws-cdk/assertions/lib/private/mappings.ts
@@ -3,7 +3,7 @@ import { filterLogicalId, formatFailure, matchSection } from './section';
 
 export function findMappings(inspector: StackInspector, outputName: string, props: any = {}): { [key: string]: any }[] {
   const section: { [key: string] : {} } = inspector.value.Mappings;
-  const result = matchSection(filterLogicalId(section,outputName), props);
+  const result = matchSection(filterLogicalId(section, outputName), props);
 
   if (!result.match) {
     return [];
diff --git a/packages/@aws-cdk/assertions/test/template.test.ts b/packages/@aws-cdk/assertions/test/template.test.ts
index 6d255eac0c0b7..ca5c5c5ea1e58 100644
--- a/packages/@aws-cdk/assertions/test/template.test.ts
+++ b/packages/@aws-cdk/assertions/test/template.test.ts
@@ -460,7 +460,7 @@ describe('Template', () => {
       });
 
       const inspect = Template.fromStack(stack);
-      const result = inspect.findOutputs('Foo', { Value: 'Fred'});
+      const result = inspect.findOutputs('Foo', { Value: 'Fred' });
       expect(result).toEqual([
         { Value: 'Fred' },
       ]);
@@ -476,7 +476,7 @@ describe('Template', () => {
       });
 
       const inspect = Template.fromStack(stack);
-      const result = inspect.findOutputs('Foo', { Value: 'Waldo'});
+      const result = inspect.findOutputs('Foo', { Value: 'Waldo' });
       expect(result.length).toEqual(0);
     });
   });
@@ -516,7 +516,7 @@ describe('Template', () => {
 
       const inspect = Template.fromStack(stack);
       expectToThrow(
-        () => inspect.hasMapping('*',{
+        () => inspect.hasMapping('*', {
           Foo: { Bar: 'Qux' },
         }),
         [
@@ -562,7 +562,7 @@ describe('Template', () => {
 
       const inspect = Template.fromStack(stack);
       expectToThrow(
-        () => inspect.hasMapping('Fred',{
+        () => inspect.hasMapping('Fred', {
           Foo: { Baz: 'Fred' },
         }),
         [

From 8f9b74e10df6ab8e779bb03d8af644547e72ba36 Mon Sep 17 00:00:00 2001
From: kaizen3031593 <zen.conroy@gmail.com>
Date: Tue, 7 Sep 2021 17:00:36 -0400
Subject: [PATCH 78/91] fix neptune tests

---
 packages/@aws-cdk/aws-neptune/test/instance.test.ts | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/packages/@aws-cdk/aws-neptune/test/instance.test.ts b/packages/@aws-cdk/aws-neptune/test/instance.test.ts
index 38a6981ab2a78..ed83e1506496a 100644
--- a/packages/@aws-cdk/aws-neptune/test/instance.test.ts
+++ b/packages/@aws-cdk/aws-neptune/test/instance.test.ts
@@ -43,7 +43,7 @@ describe('DatabaseInstance', () => {
     });
 
     // THEN
-    Template.fromStack(stack).hasOutput({
+    Template.fromStack(stack).hasOutput(exportName, {
       Export: { Name: exportName },
       Value: {
         'Fn::Join': [
@@ -78,7 +78,7 @@ describe('DatabaseInstance', () => {
     });
 
     // THEN
-    Template.fromStack(stack).hasOutput({
+    Template.fromStack(stack).hasOutput('EndpointOutput', {
       Export: { Name: endpointExportName },
       Value: `${instanceEndpointAddress}:${port}`,
     });

From 59691719500895e555b884bd216c1bd10a770ad3 Mon Sep 17 00:00:00 2001
From: kaizen3031593 <zen.conroy@gmail.com>
Date: Tue, 7 Sep 2021 17:13:37 -0400
Subject: [PATCH 79/91] fix firehose tests

---
 .../@aws-cdk/aws-kinesisfirehose/test/delivery-stream.test.ts   | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/packages/@aws-cdk/aws-kinesisfirehose/test/delivery-stream.test.ts b/packages/@aws-cdk/aws-kinesisfirehose/test/delivery-stream.test.ts
index 7c36a29e379b5..f716e56a8f326 100644
--- a/packages/@aws-cdk/aws-kinesisfirehose/test/delivery-stream.test.ts
+++ b/packages/@aws-cdk/aws-kinesisfirehose/test/delivery-stream.test.ts
@@ -491,7 +491,7 @@ describe('delivery stream', () => {
       destinations: [mockS3Destination],
     });
 
-    Template.fromStack(stack).hasMapping({
+    Template.fromStack(stack).hasMapping('*', {
       'af-south-1': {
         FirehoseCidrBlock: '13.244.121.224/27',
       },

From d499c85e4c09cc00b457ca7f2f4611a925ca8aeb Mon Sep 17 00:00:00 2001
From: kaizen3031593 <36202692+kaizen3031593@users.noreply.github.com>
Date: Wed, 8 Sep 2021 04:40:11 -0400
Subject: [PATCH 80/91] feat(pipelines): stack-level steps (#16215)

Stack-level steps are available via the legacy API but not the modern API. This PR introduces the `stackSteps` property to `AddStageOpts`, allowing the user to specify additional steps at the stack level rather than the stage level. You can specify a step using the `pre`, `changeSet` or `post` options. `pre` steps happen before `stack.prepare`. `changeSet` steps happen between `stack.prepare` and `stack.deploy`. `post` steps happen after `stack.deploy`.

A primary use case is to add a `ManualApprovalStep` in `stackSteps.changeSet` to verify changes to the stack before deployment.

Closes #16148.

----

*By submitting this pull request, I confirm that my contribution is made under the terms of the Apache-2.0 license*
---
 packages/@aws-cdk/pipelines/README.md         | 18 ++++-
 .../lib/blueprint/stack-deployment.ts         | 28 +++++++
 .../lib/blueprint/stage-deployment.ts         | 25 +++++-
 .../@aws-cdk/pipelines/lib/blueprint/step.ts  | 34 +++++++-
 .../@aws-cdk/pipelines/lib/blueprint/wave.ts  |  9 ++-
 .../lib/helpers-internal/pipeline-graph.ts    | 29 ++++++-
 .../pipelines/lib/main/pipeline-base.ts       |  1 -
 .../helpers-internal/pipeline-graph.test.ts   | 79 ++++++++++++++++++-
 .../pipelines/test/testhelpers/test-app.ts    | 10 +++
 9 files changed, 226 insertions(+), 7 deletions(-)

diff --git a/packages/@aws-cdk/pipelines/README.md b/packages/@aws-cdk/pipelines/README.md
index a63f1eab4d7c4..55cd50bfb12bf 100644
--- a/packages/@aws-cdk/pipelines/README.md
+++ b/packages/@aws-cdk/pipelines/README.md
@@ -460,7 +460,7 @@ manual or automated gates to your pipeline. We recommend putting manual approval
 the set of `post` steps.
 
 The following example shows both an automated approval in the form of a `ShellStep`, and
-a manual approvel in the form of a `ManualApprovalStep` added to the pipeline. Both must
+a manual approval in the form of a `ManualApprovalStep` added to the pipeline. Both must
 pass in order to promote from the `PreProd` to the `Prod` environment:
 
 ```ts
@@ -481,6 +481,22 @@ pipeline.addStage(prod, {
 });
 ```
 
+You can also specify steps to be executed at the stack level. To achieve this, you can specify the stack and step via the `stackSteps` property: 
+
+```ts
+pipeline.addStage(prod, {
+  stackSteps: [{
+    stack: prod.stack1,
+    pre: [new ManualApprovalStep('Pre-Stack Check')], // Executed before stack is prepared
+    changeSet: [new ManualApprovalStep('ChangeSet Approval')], // Executed after stack is prepared but before the stack is deployed
+    post: [new ManualApprovalStep('Post-Deploy Check')], // Executed after staack is deployed
+  }, {
+    stack: prod.stack2,
+    post: [new ManualApprovalStep('Post-Deploy Check')], // Executed after staack is deployed
+  }],
+});
+```
+
 #### Using CloudFormation Stack Outputs in approvals
 
 Because many CloudFormation deployments result in the generation of resources with unpredictable
diff --git a/packages/@aws-cdk/pipelines/lib/blueprint/stack-deployment.ts b/packages/@aws-cdk/pipelines/lib/blueprint/stack-deployment.ts
index 2fe74ef15ccd3..488551f4eefb7 100644
--- a/packages/@aws-cdk/pipelines/lib/blueprint/stack-deployment.ts
+++ b/packages/@aws-cdk/pipelines/lib/blueprint/stack-deployment.ts
@@ -4,6 +4,7 @@ import * as cxapi from '@aws-cdk/cx-api';
 import { AssetManifestReader, DockerImageManifestEntry, FileManifestEntry } from '../private/asset-manifest';
 import { isAssetManifest } from '../private/cloud-assembly-internals';
 import { AssetType } from './asset-type';
+import { Step } from './step';
 
 /**
  * Properties for a `StackDeployment`
@@ -191,6 +192,21 @@ export class StackDeployment {
    */
   public readonly absoluteTemplatePath: string;
 
+  /**
+   * Steps that take place before stack is prepared. If your pipeline engine disables 'prepareStep', then this will happen before stack deploys
+   */
+  public readonly pre: Step[] = [];
+
+  /**
+   * Steps that take place after stack is prepared but before stack deploys. Your pipeline engine may not disable `prepareStep`.
+   */
+  public readonly changeSet: Step[] = [];
+
+  /**
+   * Steps to execute after stack deploys
+   */
+  public readonly post: Step[] = [];
+
   private constructor(props: StackDeploymentProps) {
     this.stackArtifactId = props.stackArtifactId;
     this.constructPath = props.constructPath;
@@ -220,6 +236,18 @@ export class StackDeployment {
   public addStackDependency(stackDeployment: StackDeployment) {
     this.stackDependencies.push(stackDeployment);
   }
+
+  /**
+   * Adds steps to each phase of the stack
+   * @param pre steps executed before stack.prepare
+   * @param changeSet steps executed after stack.prepare and before stack.deploy
+   * @param post steps executed after stack.deploy
+   */
+  public addStackSteps(pre: Step[], changeSet: Step[], post: Step[]) {
+    this.pre.push(...pre);
+    this.changeSet.push(...changeSet);
+    this.post.push(...post);
+  }
 }
 
 /**
diff --git a/packages/@aws-cdk/pipelines/lib/blueprint/stage-deployment.ts b/packages/@aws-cdk/pipelines/lib/blueprint/stage-deployment.ts
index b8e3f0ea77536..651ccb3b46d53 100644
--- a/packages/@aws-cdk/pipelines/lib/blueprint/stage-deployment.ts
+++ b/packages/@aws-cdk/pipelines/lib/blueprint/stage-deployment.ts
@@ -3,7 +3,7 @@ import { CloudFormationStackArtifact } from '@aws-cdk/cx-api';
 import { isStackArtifact } from '../private/cloud-assembly-internals';
 import { pipelineSynth } from '../private/construct-internals';
 import { StackDeployment } from './stack-deployment';
-import { Step } from './step';
+import { StackSteps, Step } from './step';
 
 /**
  * Properties for a `StageDeployment`
@@ -29,6 +29,13 @@ export interface StageDeploymentProps {
    * @default - No additional steps
    */
   readonly post?: Step[];
+
+  /**
+   * Instructions for additional steps that are run at the stack level
+   *
+   * @default - No additional instructions
+   */
+  readonly stackSteps?: StackSteps[];
 }
 
 /**
@@ -57,6 +64,16 @@ export class StageDeployment {
       const step = StackDeployment.fromArtifact(artifact);
       stepFromArtifact.set(artifact, step);
     }
+    if (props.stackSteps) {
+      for (const stackstep of props.stackSteps) {
+        const stackArtifact = assembly.getStackArtifact(stackstep.stack.artifactId);
+        const thisStep = stepFromArtifact.get(stackArtifact);
+        if (!thisStep) {
+          throw new Error('Logic error: we just added a step for this artifact but it disappeared.');
+        }
+        thisStep.addStackSteps(stackstep.pre ?? [], stackstep.changeSet ?? [], stackstep.post ?? []);
+      }
+    }
 
     for (const artifact of assembly.stacks) {
       const thisStep = stepFromArtifact.get(artifact);
@@ -95,12 +112,18 @@ export class StageDeployment {
    */
   public readonly post: Step[];
 
+  /**
+   * Instructions for additional steps that are run at stack level
+   */
+  public readonly stackSteps: StackSteps[];
+
   private constructor(
     /** The stacks deployed in this stage */
     public readonly stacks: StackDeployment[], props: StageDeploymentProps = {}) {
     this.stageName = props.stageName ?? '';
     this.pre = props.pre ?? [];
     this.post = props.post ?? [];
+    this.stackSteps = props.stackSteps ?? [];
   }
 
   /**
diff --git a/packages/@aws-cdk/pipelines/lib/blueprint/step.ts b/packages/@aws-cdk/pipelines/lib/blueprint/step.ts
index e04b79bdcd848..31fd96d2a8c32 100644
--- a/packages/@aws-cdk/pipelines/lib/blueprint/step.ts
+++ b/packages/@aws-cdk/pipelines/lib/blueprint/step.ts
@@ -1,4 +1,4 @@
-import { Token } from '@aws-cdk/core';
+import { Stack, Token } from '@aws-cdk/core';
 import { FileSet, IFileSetProducer } from './file-set';
 
 /**
@@ -74,4 +74,36 @@ export abstract class Step implements IFileSetProducer {
   protected configurePrimaryOutput(fs: FileSet) {
     this._primaryOutput = fs;
   }
+}
+
+/**
+ * Instructions for additional steps that are run at stack level
+ */
+export interface StackSteps {
+  /**
+   * The stack you want the steps to run in
+   */
+  readonly stack: Stack;
+
+  /**
+   * Steps that execute before stack is prepared
+   *
+   * @default - no additional steps
+   */
+  readonly pre?: Step[];
+
+  /**
+   * Steps that execute after stack is prepared but before stack is deployed
+   *
+   * @default - no additional steps
+   */
+  readonly changeSet?: Step[];
+
+  /**
+   * Steps that execute after stack is deployed
+   *
+   * @default - no additional steps
+   */
+  readonly post?: Step[];
+
 }
\ No newline at end of file
diff --git a/packages/@aws-cdk/pipelines/lib/blueprint/wave.ts b/packages/@aws-cdk/pipelines/lib/blueprint/wave.ts
index 709d43a1ed8bd..b419277c51132 100644
--- a/packages/@aws-cdk/pipelines/lib/blueprint/wave.ts
+++ b/packages/@aws-cdk/pipelines/lib/blueprint/wave.ts
@@ -1,6 +1,6 @@
 import * as cdk from '@aws-cdk/core';
 import { StageDeployment } from './stage-deployment';
-import { Step } from './step';
+import { StackSteps, Step } from './step';
 
 /**
  * Construction properties for a `Wave`
@@ -91,6 +91,13 @@ export interface AddStageOpts {
    * @default - No additional steps
    */
   readonly post?: Step[];
+
+  /**
+   * Instructions for stack level steps
+   *
+   * @default - No additional instructions
+   */
+  readonly stackSteps?: StackSteps[];
 }
 
 /**
diff --git a/packages/@aws-cdk/pipelines/lib/helpers-internal/pipeline-graph.ts b/packages/@aws-cdk/pipelines/lib/helpers-internal/pipeline-graph.ts
index 8a7b198831808..738576017afb9 100644
--- a/packages/@aws-cdk/pipelines/lib/helpers-internal/pipeline-graph.ts
+++ b/packages/@aws-cdk/pipelines/lib/helpers-internal/pipeline-graph.ts
@@ -142,8 +142,9 @@ export class PipelineGraph {
       });
 
       retGraph.add(stackGraph);
-
       stackGraph.add(deployNode);
+
+      // node or node collection that represents first point of contact in each stack
       let firstDeployNode;
       if (prepareNode) {
         stackGraph.add(prepareNode);
@@ -153,6 +154,21 @@ export class PipelineGraph {
         firstDeployNode = deployNode;
       }
 
+      // add changeset steps at the stack level
+      if (stack.changeSet.length > 0) {
+        if (prepareNode) {
+          this.addChangeSet(stack.changeSet, prepareNode, deployNode, stackGraph);
+        } else {
+          throw new Error('Your pipeline engine does not support changeSet steps');
+        }
+      }
+
+      // add pre and post steps at the stack level
+      const preNodes = this.addPrePost(stack.pre, stack.post, stackGraph);
+      if (preNodes.nodes.length > 0) {
+        firstDeployNode = preNodes;
+      }
+
       stackGraphs.set(stack, stackGraph);
 
       const cloudAssembly = this.cloudAssemblyFileSet;
@@ -201,16 +217,27 @@ export class PipelineGraph {
     return retGraph;
   }
 
+  private addChangeSet(changeSet: Step[], prepareNode: AGraphNode, deployNode: AGraphNode, graph: AGraph) {
+    for (const c of changeSet) {
+      const changeSetNode = this.addAndRecurse(c, graph);
+      changeSetNode?.dependOn(prepareNode);
+      deployNode.dependOn(changeSetNode);
+    }
+  }
+
   private addPrePost(pre: Step[], post: Step[], parent: AGraph) {
     const currentNodes = new GraphNodeCollection(parent.nodes);
+    const preNodes = new GraphNodeCollection(new Array<AGraphNode>());
     for (const p of pre) {
       const preNode = this.addAndRecurse(p, parent);
       currentNodes.dependOn(preNode);
+      preNodes.nodes.push(preNode!);
     }
     for (const p of post) {
       const postNode = this.addAndRecurse(p, parent);
       postNode?.dependOn(...currentNodes.nodes);
     }
+    return preNodes;
   }
 
   private topLevelGraph(name: string): AGraph {
diff --git a/packages/@aws-cdk/pipelines/lib/main/pipeline-base.ts b/packages/@aws-cdk/pipelines/lib/main/pipeline-base.ts
index 6ff5a1be60853..d69c2a6c89ab1 100644
--- a/packages/@aws-cdk/pipelines/lib/main/pipeline-base.ts
+++ b/packages/@aws-cdk/pipelines/lib/main/pipeline-base.ts
@@ -84,7 +84,6 @@ export abstract class PipelineBase extends CoreConstruct {
     if (this.built) {
       throw new Error('addStage: can\'t add Stages anymore after buildPipeline() has been called');
     }
-
     return this.addWave(stage.stageName).addStage(stage, options);
   }
 
diff --git a/packages/@aws-cdk/pipelines/test/blueprint/helpers-internal/pipeline-graph.test.ts b/packages/@aws-cdk/pipelines/test/blueprint/helpers-internal/pipeline-graph.test.ts
index 3b28d4f410a61..92c3a3dcf2dfe 100644
--- a/packages/@aws-cdk/pipelines/test/blueprint/helpers-internal/pipeline-graph.test.ts
+++ b/packages/@aws-cdk/pipelines/test/blueprint/helpers-internal/pipeline-graph.test.ts
@@ -1,9 +1,10 @@
 /* eslint-disable import/no-extraneous-dependencies */
 import '@aws-cdk/assert-internal/jest';
 import * as cdkp from '../../../lib';
+import { ManualApprovalStep } from '../../../lib';
 import { Graph, GraphNode, PipelineGraph } from '../../../lib/helpers-internal';
 import { flatten } from '../../../lib/private/javascript';
-import { AppWithOutput, OneStackApp, TestApp } from '../../testhelpers/test-app';
+import { AppWithOutput, AppWithExposedStacks, OneStackApp, TestApp } from '../../testhelpers/test-app';
 
 let app: TestApp;
 
@@ -113,6 +114,34 @@ describe('blueprint with wave and stage', () => {
       'Stack',
     ]);
   });
+
+  test('pre, changeSet, and post are added correctly inside stack graph', () => {
+    // GIVEN
+    const appWithExposedStacks = new AppWithExposedStacks(app, 'Gamma');
+    const stack = appWithExposedStacks.stacks[0];
+    blueprint.waves[0].addStage(appWithExposedStacks, {
+      stackSteps: [{
+        stack,
+        pre: [new cdkp.ManualApprovalStep('Step1'), new cdkp.ManualApprovalStep('Step2'), new cdkp.ManualApprovalStep('Step3')],
+        changeSet: [new cdkp.ManualApprovalStep('Manual Approval')],
+        post: [new cdkp.ManualApprovalStep('Post Approval')],
+      }],
+    });
+
+    // WHEN
+    const graph = new PipelineGraph(blueprint).graph;
+
+    // THEN
+    expect(childrenAt(graph, 'Wave', 'Gamma', 'Stack1')).toEqual([
+      'Step1',
+      'Step2',
+      'Step3',
+      'Prepare',
+      'Manual Approval',
+      'Deploy',
+      'Post Approval',
+    ]);
+  });
 });
 
 describe('options for other engines', () => {
@@ -153,6 +182,54 @@ describe('options for other engines', () => {
     // since "prepareStep" is false, it only has "Deploy".
     expect(childrenAt(graph.graph, 'Alpha', 'Stack')).toStrictEqual(['Deploy']);
   });
+
+  test('"prepareStep: false" will not impact "pre" stack steps', () => {
+    // GIVEN
+    const blueprint = new Blueprint(app, 'Bp', {
+      synth: new cdkp.ShellStep('Synth', {
+        commands: ['build'],
+      }),
+    });
+    const appWithExposedStacks = new AppWithExposedStacks(app, 'Alpha');
+    blueprint.addStage(appWithExposedStacks, {
+      stackSteps: [{
+        stack: appWithExposedStacks.stacks[0],
+        pre: [new ManualApprovalStep('PreCheck')],
+      }],
+    });
+
+    // WHEN
+    const graph = new PipelineGraph(blueprint, {
+      prepareStep: false,
+    });
+
+    // THEN
+    expect(childrenAt(graph.graph, 'Alpha', 'Stack1')).toEqual([
+      'PreCheck',
+      'Deploy',
+    ]);
+  });
+
+  test('specifying changeSet step with "prepareStep: false" will throw', () => {
+    // GIVEN
+    const blueprint = new Blueprint(app, 'Bp', {
+      synth: new cdkp.ShellStep('Synth', {
+        commands: ['build'],
+      }),
+    });
+    const appWithExposedStacks = new AppWithExposedStacks(app, 'Alpha');
+    blueprint.addStage(appWithExposedStacks, {
+      stackSteps: [{
+        stack: appWithExposedStacks.stacks[0],
+        changeSet: [new ManualApprovalStep('ChangeSetApproval')],
+      }],
+    });
+
+    // THEN
+    expect(() => new PipelineGraph(blueprint, {
+      prepareStep: false,
+    })).toThrow('Your pipeline engine does not support changeSet steps');
+  });
 });
 
 
diff --git a/packages/@aws-cdk/pipelines/test/testhelpers/test-app.ts b/packages/@aws-cdk/pipelines/test/testhelpers/test-app.ts
index 1f554b75e2623..a431e56fadaef 100644
--- a/packages/@aws-cdk/pipelines/test/testhelpers/test-app.ts
+++ b/packages/@aws-cdk/pipelines/test/testhelpers/test-app.ts
@@ -43,6 +43,16 @@ export class TestApp extends App {
   }
 }
 
+export class AppWithExposedStacks extends Stage {
+  public readonly stacks: Stack[];
+  constructor(scope: Construct, id: string, props?: StageProps) {
+    super(scope, id, props);
+    this.stacks = new Array<Stack>();
+    this.stacks.push(new BucketStack(this, 'Stack1'));
+    this.stacks.push(new BucketStack(this, 'Stack2'));
+    this.stacks.push(new BucketStack(this, 'Stack3'));
+  }
+}
 
 export class OneStackApp extends Stage {
   constructor(scope: Construct, id: string, props?: StageProps) {

From 6e718067b6c4e1a2c905fedcc60a6863ba3add12 Mon Sep 17 00:00:00 2001
From: Jonathan Goldwasser <jogold@users.noreply.github.com>
Date: Wed, 8 Sep 2021 14:10:57 +0200
Subject: [PATCH 81/91] feat(backup): option to prevent recovery point
 deletions (#16282)

Add a `blockRecoveryPointDeletion` prop that add statements to
the vault access policy that prevents recovery point deletions.

Converted test to use `assertions` while in there.


----

*By submitting this pull request, I confirm that my contribution is made under the terms of the Apache-2.0 license*
---
 packages/@aws-cdk/aws-backup/README.md        | 57 ++++++++++++-
 packages/@aws-cdk/aws-backup/lib/vault.ts     | 24 +++++-
 packages/@aws-cdk/aws-backup/package.json     |  4 +-
 .../@aws-cdk/aws-backup/test/plan.test.ts     | 10 +--
 .../aws-backup/test/selection.test.ts         | 14 ++--
 .../@aws-cdk/aws-backup/test/vault.test.ts    | 84 +++++++++++++++++--
 6 files changed, 167 insertions(+), 26 deletions(-)

diff --git a/packages/@aws-cdk/aws-backup/README.md b/packages/@aws-cdk/aws-backup/README.md
index ffe43e83db2bd..22b2398ba08ea 100644
--- a/packages/@aws-cdk/aws-backup/README.md
+++ b/packages/@aws-cdk/aws-backup/README.md
@@ -11,11 +11,17 @@
 
 <!--END STABILITY BANNER-->
 
-AWS Backup is a fully managed backup service that makes it easy to centralize and automate the backup of data across AWS services in the cloud and on premises. Using AWS Backup, you can configure backup policies and monitor backup activity for your AWS resources in one place.
+AWS Backup is a fully managed backup service that makes it easy to centralize and automate the
+backup of data across AWS services in the cloud and on premises. Using AWS Backup, you can
+configure backup policies and monitor backup activity for your AWS resources in one place.
 
 ## Backup plan and selection
 
-In AWS Backup, a *backup plan* is a policy expression that defines when and how you want to back up your AWS resources, such as Amazon DynamoDB tables or Amazon Elastic File System (Amazon EFS) file systems. You can assign resources to backup plans, and AWS Backup automatically backs up and retains backups for those resources according to the backup plan. You can create multiple backup plans if you have workloads with different backup requirements.
+In AWS Backup, a *backup plan* is a policy expression that defines when and how you want to back up
+ your AWS resources, such as Amazon DynamoDB tables or Amazon Elastic File System (Amazon EFS) file
+ systems. You can assign resources to backup plans, and AWS Backup automatically backs up and retains
+ backups for those resources according to the backup plan. You can create multiple backup plans if you
+ have workloads with different backup requirements.
 
 This module provides ready-made backup plans (similar to the console experience):
 
@@ -78,7 +84,11 @@ plan.addRule(backup.BackupPlanRule.monthly1Year(otherVault)); // Use `otherVault
 
 ## Backup vault
 
-In AWS Backup, a *backup vault* is a container that you organize your backups in. You can use backup vaults to set the AWS Key Management Service (AWS KMS) encryption key that is used to encrypt backups in the backup vault and to control access to the backups in the backup vault. If you require different encryption keys or access policies for different groups of backups, you can optionally create multiple backup vaults.
+In AWS Backup, a *backup vault* is a container that you organize your backups in. You can use backup
+vaults to set the AWS Key Management Service (AWS KMS) encryption key that is used to encrypt backups
+in the backup vault and to control access to the backups in the backup vault. If you require different
+encryption keys or access policies for different groups of backups, you can optionally create multiple
+backup vaults.
 
 ```ts
 const myKey = kms.Key.fromKeyArn(this, 'MyKey', 'aaa');
@@ -93,10 +103,49 @@ const vault = new backup.BackupVault(this, 'Vault', {
 A vault has a default `RemovalPolicy` set to `RETAIN`. Note that removing a vault
 that contains recovery points will fail.
 
+You can assign policies to backup vaults and the resources they contain. Assigning policies allows
+you to do things like grant access to users to create backup plans and on-demand backups, but limit
+their ability to delete recovery points after they're created.
+
+Use the `accessPolicy` property to create a backup vault policy:
+
+```ts
+const vault = new backup.BackupVault(this, 'Vault', {
+  accessPolicy: new iam.PolicyDocument({
+    statements: [
+      new iam.PolicyStatement({
+        effect: iam.Effect.DENY,
+        principals: [new iam.AnyPrincipal()],
+        actions: ['backup:DeleteRecoveryPoint'],
+        resources: ['*'],
+        conditions: {
+          StringNotLike: {
+            'aws:userId': [
+              'user1',
+              'user2',
+            ],
+          },
+        },
+      }),
+    ],
+  });
+})
+```
+
+Use the `blockRecoveryPointDeletion` property to add statements to the vault access policy that
+prevents recovery point deletions in your vault:
+
+```ts
+new backup.BackupVault(this, 'Vault', {
+  blockRecoveryPointDeletion: true,
+});
+```
+
+By default access is not restricted.
 
 ## Importing existing backup vault
 
-To import an existing backup vault into your CDK application, use the `BackupVault.fromBackupVaultArn` or `BackupVault.fromBackupVaultName` 
+To import an existing backup vault into your CDK application, use the `BackupVault.fromBackupVaultArn` or `BackupVault.fromBackupVaultName`
 static method. Here is an example of giving an IAM Role permission to start a backup job:
 
 ```ts
diff --git a/packages/@aws-cdk/aws-backup/lib/vault.ts b/packages/@aws-cdk/aws-backup/lib/vault.ts
index 4ca43e5875729..ac2c67a19dff3 100644
--- a/packages/@aws-cdk/aws-backup/lib/vault.ts
+++ b/packages/@aws-cdk/aws-backup/lib/vault.ts
@@ -83,6 +83,14 @@ export interface BackupVaultProps {
    * @default RemovalPolicy.RETAIN
    */
   readonly removalPolicy?: RemovalPolicy;
+
+  /**
+   * Whether to add statements to the vault access policy that prevents anyone
+   * from deleting a recovery point.
+   *
+   * @default false
+   */
+  readonly blockRecoveryPointDeletion?: boolean;
 }
 
 /**
@@ -206,9 +214,23 @@ export class BackupVault extends BackupVaultBase {
       props.notificationTopic.grantPublish(new iam.ServicePrincipal('backup.amazonaws.com'));
     }
 
+    const accessPolicy = props.accessPolicy ?? new iam.PolicyDocument();
+    if (props.blockRecoveryPointDeletion) {
+      accessPolicy.addStatements(new iam.PolicyStatement({
+        effect: iam.Effect.DENY,
+        actions: [
+          'backup:DeleteRecoveryPoint',
+          'backup:UpdateRecoveryPointLifecycle',
+        ],
+        principals: [new iam.AnyPrincipal()],
+        resources: ['*'],
+      }),
+      );
+    }
+
     const vault = new CfnBackupVault(this, 'Resource', {
       backupVaultName: props.backupVaultName || this.uniqueVaultName(),
-      accessPolicy: props.accessPolicy && props.accessPolicy.toJSON(),
+      accessPolicy: accessPolicy.toJSON(),
       encryptionKeyArn: props.encryptionKey && props.encryptionKey.keyArn,
       notifications,
     });
diff --git a/packages/@aws-cdk/aws-backup/package.json b/packages/@aws-cdk/aws-backup/package.json
index 3c906382aa9b2..78f771c99a2b7 100644
--- a/packages/@aws-cdk/aws-backup/package.json
+++ b/packages/@aws-cdk/aws-backup/package.json
@@ -75,12 +75,12 @@
   },
   "license": "Apache-2.0",
   "devDependencies": {
+    "@aws-cdk/assertions": "0.0.0",
     "@types/jest": "^26.0.24",
     "cdk-build-tools": "0.0.0",
     "cdk-integ-tools": "0.0.0",
     "cfn2ts": "0.0.0",
-    "pkglint": "0.0.0",
-    "@aws-cdk/assert-internal": "0.0.0"
+    "pkglint": "0.0.0"
   },
   "dependencies": {
     "@aws-cdk/aws-dynamodb": "0.0.0",
diff --git a/packages/@aws-cdk/aws-backup/test/plan.test.ts b/packages/@aws-cdk/aws-backup/test/plan.test.ts
index 91ac4baef7e02..401e961129838 100644
--- a/packages/@aws-cdk/aws-backup/test/plan.test.ts
+++ b/packages/@aws-cdk/aws-backup/test/plan.test.ts
@@ -1,4 +1,4 @@
-import '@aws-cdk/assert-internal/jest';
+import { Template } from '@aws-cdk/assertions';
 import * as events from '@aws-cdk/aws-events';
 import { App, Duration, Stack } from '@aws-cdk/core';
 import { BackupPlan, BackupPlanRule, BackupVault } from '../lib';
@@ -32,7 +32,7 @@ test('create a plan and add rules', () => {
   plan.addRule(BackupPlanRule.monthly5Year(otherVault));
 
   // THEN
-  expect(stack).toHaveResource('AWS::Backup::BackupPlan', {
+  Template.fromStack(stack).hasResourceProperties('AWS::Backup::BackupPlan', {
     BackupPlan: {
       BackupPlanName: 'Plan',
       BackupPlanRule: [
@@ -75,7 +75,7 @@ test('daily35DayRetention', () => {
   BackupPlan.daily35DayRetention(stack, 'D35');
 
   // THEN
-  expect(stack).toHaveResource('AWS::Backup::BackupPlan', {
+  Template.fromStack(stack).hasResourceProperties('AWS::Backup::BackupPlan', {
     BackupPlan: {
       BackupPlanName: 'D35',
       BackupPlanRule: [
@@ -102,7 +102,7 @@ test('dailyWeeklyMonthly7YearRetention', () => {
   BackupPlan.dailyWeeklyMonthly7YearRetention(stack, 'DWM7');
 
   // THEN
-  expect(stack).toHaveResource('AWS::Backup::BackupPlan', {
+  Template.fromStack(stack).hasResourceProperties('AWS::Backup::BackupPlan', {
     BackupPlan: {
       BackupPlanName: 'DWM7',
       BackupPlanRule: [
@@ -159,7 +159,7 @@ test('automatically creates a new vault', () => {
   plan.addRule(BackupPlanRule.daily());
 
   // THEN
-  expect(stack).toHaveResource('AWS::Backup::BackupPlan', {
+  Template.fromStack(stack).hasResourceProperties('AWS::Backup::BackupPlan', {
     BackupPlan: {
       BackupPlanName: 'Plan',
       BackupPlanRule: [
diff --git a/packages/@aws-cdk/aws-backup/test/selection.test.ts b/packages/@aws-cdk/aws-backup/test/selection.test.ts
index 3c4fd6d63ee56..1ff32b886a908 100644
--- a/packages/@aws-cdk/aws-backup/test/selection.test.ts
+++ b/packages/@aws-cdk/aws-backup/test/selection.test.ts
@@ -1,4 +1,4 @@
-import '@aws-cdk/assert-internal/jest';
+import { Template } from '@aws-cdk/assertions';
 import * as dynamodb from '@aws-cdk/aws-dynamodb';
 import * as ec2 from '@aws-cdk/aws-ec2';
 import * as efs from '@aws-cdk/aws-efs';
@@ -30,7 +30,7 @@ test('create a selection', () => {
   });
 
   // THEN
-  expect(stack).toHaveResource('AWS::Backup::BackupSelection', {
+  Template.fromStack(stack).hasResourceProperties('AWS::Backup::BackupSelection', {
     BackupPlanId: {
       'Fn::GetAtt': [
         'PlanDAF4E53A',
@@ -64,7 +64,7 @@ test('create a selection', () => {
     },
   });
 
-  expect(stack).toHaveResource('AWS::IAM::Role', {
+  Template.fromStack(stack).hasResourceProperties('AWS::IAM::Role', {
     ManagedPolicyArns: [
       {
         'Fn::Join': [
@@ -93,7 +93,7 @@ test('allow restores', () => {
   });
 
   // THEN
-  expect(stack).toHaveResource('AWS::IAM::Role', {
+  Template.fromStack(stack).hasResourceProperties('AWS::IAM::Role', {
     ManagedPolicyArns: [
       {
         'Fn::Join': [
@@ -158,7 +158,7 @@ test('fromConstruct', () => {
   });
 
   // THEN
-  expect(stack).toHaveResource('AWS::Backup::BackupSelection', {
+  Template.fromStack(stack).hasResourceProperties('AWS::Backup::BackupSelection', {
     BackupSelection: {
       IamRoleArn: {
         'Fn::GetAtt': [
@@ -259,7 +259,7 @@ test('fromEc2Instance', () => {
   });
 
   // THEN
-  expect(stack).toHaveResource('AWS::Backup::BackupSelection', {
+  Template.fromStack(stack).hasResourceProperties('AWS::Backup::BackupSelection', {
     BackupSelection: {
       IamRoleArn: {
         'Fn::GetAtt': [
@@ -316,7 +316,7 @@ test('fromDynamoDbTable', () => {
   });
 
   // THEN
-  expect(stack).toHaveResource('AWS::Backup::BackupSelection', {
+  Template.fromStack(stack).hasResourceProperties('AWS::Backup::BackupSelection', {
     BackupSelection: {
       IamRoleArn: {
         'Fn::GetAtt': [
diff --git a/packages/@aws-cdk/aws-backup/test/vault.test.ts b/packages/@aws-cdk/aws-backup/test/vault.test.ts
index e1a67e0e0ed8b..30b145f55d3ac 100644
--- a/packages/@aws-cdk/aws-backup/test/vault.test.ts
+++ b/packages/@aws-cdk/aws-backup/test/vault.test.ts
@@ -1,4 +1,4 @@
-import '@aws-cdk/assert-internal/jest';
+import { Template } from '@aws-cdk/assertions';
 import * as iam from '@aws-cdk/aws-iam';
 import * as kms from '@aws-cdk/aws-kms';
 import * as sns from '@aws-cdk/aws-sns';
@@ -15,7 +15,7 @@ test('create a vault', () => {
   new BackupVault(stack, 'Vault');
 
   // THEN
-  expect(stack).toHaveResource('AWS::Backup::BackupVault', {
+  Template.fromStack(stack).hasResourceProperties('AWS::Backup::BackupVault', {
     BackupVaultName: 'Vault',
   });
 });
@@ -46,7 +46,7 @@ test('with access policy', () => {
   });
 
   // THEN
-  expect(stack).toHaveResource('AWS::Backup::BackupVault', {
+  Template.fromStack(stack).hasResourceProperties('AWS::Backup::BackupVault', {
     AccessPolicy: {
       Version: '2012-10-17',
       Statement: [
@@ -68,6 +68,76 @@ test('with access policy', () => {
   });
 });
 
+test('with blockRecoveryPointDeletion', () => {
+  // WHEN
+  new BackupVault(stack, 'Vault', {
+    blockRecoveryPointDeletion: true,
+  });
+
+  // THEN
+  Template.fromStack(stack).hasResourceProperties('AWS::Backup::BackupVault', {
+    AccessPolicy: {
+      Version: '2012-10-17',
+      Statement: [
+        {
+          Effect: 'Deny',
+          Principal: {
+            AWS: '*',
+          },
+          Action: [
+            'backup:DeleteRecoveryPoint',
+            'backup:UpdateRecoveryPointLifecycle',
+          ],
+          Resource: '*',
+        },
+      ],
+    },
+  });
+});
+
+test('merges statements from accessPolicy and blockRecoveryPointDeletion', () => {
+  // WHEN
+  new BackupVault(stack, 'Vault', {
+    accessPolicy: new iam.PolicyDocument({
+      statements: [
+        new iam.PolicyStatement({
+          effect: iam.Effect.DENY,
+          principals: [new iam.ArnPrincipal('arn:aws:iam::123456789012:role/MyRole')],
+          actions: ['backup:StartRestoreJob'],
+        }),
+      ],
+    }),
+    blockRecoveryPointDeletion: true,
+  });
+
+  // THEN
+  Template.fromStack(stack).hasResourceProperties('AWS::Backup::BackupVault', {
+    AccessPolicy: {
+      Version: '2012-10-17',
+      Statement: [
+        {
+          Action: 'backup:StartRestoreJob',
+          Effect: 'Deny',
+          Principal: {
+            AWS: 'arn:aws:iam::123456789012:role/MyRole',
+          },
+        },
+        {
+          Effect: 'Deny',
+          Principal: {
+            AWS: '*',
+          },
+          Action: [
+            'backup:DeleteRecoveryPoint',
+            'backup:UpdateRecoveryPointLifecycle',
+          ],
+          Resource: '*',
+        },
+      ],
+    },
+  });
+});
+
 test('with encryption key', () => {
   // GIVEN
   const encryptionKey = new kms.Key(stack, 'Key');
@@ -78,7 +148,7 @@ test('with encryption key', () => {
   });
 
   // THEN
-  expect(stack).toHaveResource('AWS::Backup::BackupVault', {
+  Template.fromStack(stack).hasResourceProperties('AWS::Backup::BackupVault', {
     EncryptionKeyArn: {
       'Fn::GetAtt': [
         'Key961B73FD',
@@ -102,7 +172,7 @@ test('with notifications', () => {
   });
 
   // THEN
-  expect(stack).toHaveResource('AWS::Backup::BackupVault', {
+  Template.fromStack(stack).hasResourceProperties('AWS::Backup::BackupVault', {
     Notifications: {
       BackupVaultEvents: [
         'BACKUP_JOB_COMPLETED',
@@ -125,7 +195,7 @@ test('defaults to all notifications', () => {
   });
 
   // THEN
-  expect(stack).toHaveResource('AWS::Backup::BackupVault', {
+  Template.fromStack(stack).hasResourceProperties('AWS::Backup::BackupVault', {
     Notifications: {
       BackupVaultEvents: Object.values(BackupVaultEvents),
       SNSTopicArn: {
@@ -175,7 +245,7 @@ test('grant action', () => {
   vault.grant(role, 'backup:StartBackupJob');
 
   // THEN
-  expect(stack).toHaveResource('AWS::IAM::Policy', {
+  Template.fromStack(stack).hasResourceProperties('AWS::IAM::Policy', {
     PolicyDocument: {
       Statement: [
         {

From 9b3d40ecc8af1529589bcb2e3912accfef08f3fa Mon Sep 17 00:00:00 2001
From: kaizen3031593 <zen.conroy@gmail.com>
Date: Wed, 8 Sep 2021 11:26:41 -0400
Subject: [PATCH 82/91] change param name from outputName to logicalId

---
 .../assertions/lib/private/mappings.ts        |  8 +++----
 .../assertions/lib/private/outputs.ts         | 12 +++++-----
 .../assertions/lib/private/section.ts         |  8 +++----
 packages/@aws-cdk/assertions/lib/template.ts  | 24 +++++++++----------
 4 files changed, 26 insertions(+), 26 deletions(-)

diff --git a/packages/@aws-cdk/assertions/lib/private/mappings.ts b/packages/@aws-cdk/assertions/lib/private/mappings.ts
index 0c5b3d459faeb..266e322bb1139 100644
--- a/packages/@aws-cdk/assertions/lib/private/mappings.ts
+++ b/packages/@aws-cdk/assertions/lib/private/mappings.ts
@@ -1,9 +1,9 @@
 import { StackInspector } from '../vendored/assert';
 import { filterLogicalId, formatFailure, matchSection } from './section';
 
-export function findMappings(inspector: StackInspector, outputName: string, props: any = {}): { [key: string]: any }[] {
+export function findMappings(inspector: StackInspector, logicalId: string, props: any = {}): { [key: string]: any }[] {
   const section: { [key: string] : {} } = inspector.value.Mappings;
-  const result = matchSection(filterLogicalId(section, outputName), props);
+  const result = matchSection(filterLogicalId(section, logicalId), props);
 
   if (!result.match) {
     return [];
@@ -12,9 +12,9 @@ export function findMappings(inspector: StackInspector, outputName: string, prop
   return result.matches;
 }
 
-export function hasMapping(inspector: StackInspector, outputName: string, props: any): string | void {
+export function hasMapping(inspector: StackInspector, logicalId: string, props: any): string | void {
   const section: { [key: string]: {} } = inspector.value.Mappings;
-  const result = matchSection(filterLogicalId(section, outputName), props);
+  const result = matchSection(filterLogicalId(section, logicalId), props);
 
   if (result.match) {
     return;
diff --git a/packages/@aws-cdk/assertions/lib/private/outputs.ts b/packages/@aws-cdk/assertions/lib/private/outputs.ts
index 8d97353cf56d1..870e00555b254 100644
--- a/packages/@aws-cdk/assertions/lib/private/outputs.ts
+++ b/packages/@aws-cdk/assertions/lib/private/outputs.ts
@@ -1,9 +1,9 @@
 import { StackInspector } from '../vendored/assert';
 import { filterLogicalId, formatFailure, matchSection } from './section';
 
-export function findOutputs(inspector: StackInspector, outputName: string, props: any = {}): { [key: string]: any }[] {
+export function findOutputs(inspector: StackInspector, logicalId: string, props: any = {}): { [key: string]: any }[] {
   const section: { [key: string] : {} } = inspector.value.Outputs;
-  const result = matchSection(filterLogicalId(section, outputName), props);
+  const result = matchSection(filterLogicalId(section, logicalId), props);
 
   if (!result.match) {
     return [];
@@ -12,19 +12,19 @@ export function findOutputs(inspector: StackInspector, outputName: string, props
   return result.matches;
 }
 
-export function hasOutput(inspector: StackInspector, outputName: string, props: any): string | void {
+export function hasOutput(inspector: StackInspector, logicalId: string, props: any): string | void {
   const section: { [key: string]: {} } = inspector.value.Outputs;
-  const result = matchSection(filterLogicalId(section, outputName), props);
+  const result = matchSection(filterLogicalId(section, logicalId), props);
   if (result.match) {
     return;
   }
 
   if (result.closestResult === undefined) {
-    return `No outputs named ${outputName} found in the template.`;
+    return `No outputs named ${logicalId} found in the template.`;
   }
 
   return [
-    `Template has ${result.analyzedCount} outputs named ${outputName}, but none match as expected.`,
+    `Template has ${result.analyzedCount} outputs named ${logicalId}, but none match as expected.`,
     formatFailure(result.closestResult),
   ].join('\n');
 }
diff --git a/packages/@aws-cdk/assertions/lib/private/section.ts b/packages/@aws-cdk/assertions/lib/private/section.ts
index c7e1d93ecc0f7..59ad55241e581 100644
--- a/packages/@aws-cdk/assertions/lib/private/section.ts
+++ b/packages/@aws-cdk/assertions/lib/private/section.ts
@@ -57,11 +57,11 @@ function leftPad(x: string, indent: number = 2): string {
   return pad + x.split('\n').join(`\n${pad}`);
 }
 
-export function filterLogicalId(section: { [key: string]: {} }, outputName: string): { [key: string]: {} } {
-  // default signal for all outputs is '*'
-  if (outputName === '*') return section;
+export function filterLogicalId(section: { [key: string]: {} }, logicalId: string): { [key: string]: {} } {
+  // default signal for all logicalIds is '*'
+  if (logicalId === '*') return section;
 
   return Object.entries(section ?? {})
-    .filter(([k, _]) => k === outputName)
+    .filter(([k, _]) => k === logicalId)
     .reduce((agg, [k, v]) => { return { ...agg, [k]: v }; }, {});
 }
\ No newline at end of file
diff --git a/packages/@aws-cdk/assertions/lib/template.ts b/packages/@aws-cdk/assertions/lib/template.ts
index f67d7e64f3018..d642e74962080 100644
--- a/packages/@aws-cdk/assertions/lib/template.ts
+++ b/packages/@aws-cdk/assertions/lib/template.ts
@@ -109,11 +109,11 @@ export class Template {
    * Assert that an Output with the given properties exists in the CloudFormation template.
    * By default, performs partial matching on the resource, via the `Match.objectLike()`.
    * To configure different behavour, use other matchers in the `Match` class.
-   * @param outputName the name of the output. Provide '*' to match all Output names in the template.
+   * @param logicalId the name of the output. Provide `'*'` to match all outputs in the template.
    * @param props the output as should be expected in the template.
    */
-  public hasOutput(outputName: string, props: any): void {
-    const matchError = hasOutput(this.inspector, outputName, props);
+  public hasOutput(logicalId: string, props: any): void {
+    const matchError = hasOutput(this.inspector, logicalId, props);
     if (matchError) {
       throw new Error(matchError);
     }
@@ -121,24 +121,24 @@ export class Template {
 
   /**
    * Get the set of matching Outputs that match the given properties in the CloudFormation template.
-   * @param outputName the name of the output. Provide '*' to match all Output names in the template.
+   * @param logicalId the name of the output. Provide `'*'` to match all outputs in the template.
    * @param props by default, matches all Outputs in the template.
    * When a literal object is provided, performs a partial match via `Match.objectLike()`.
    * Use the `Match` APIs to configure a different behaviour.
    */
-  public findOutputs(outputName: string, props: any = {}): { [key: string]: any }[] {
-    return findOutputs(this.inspector, outputName, props);
+  public findOutputs(logicalId: string, props: any = {}): { [key: string]: any }[] {
+    return findOutputs(this.inspector, logicalId, props);
   }
 
   /**
    * Assert that a Mapping with the given properties exists in the CloudFormation template.
    * By default, performs partial matching on the resource, via the `Match.objectLike()`.
    * To configure different behavour, use other matchers in the `Match` class.
-   * @param outputName the name of the output. Provide '*' to match all Output names in the template.
+   * @param logicalId the name of the mapping. Provide `'*'` to match all mappings in the template.
    * @param props the output as should be expected in the template.
    */
-  public hasMapping(outputName: string, props: any): void {
-    const matchError = hasMapping(this.inspector, outputName, props);
+  public hasMapping(logicalId: string, props: any): void {
+    const matchError = hasMapping(this.inspector, logicalId, props);
     if (matchError) {
       throw new Error(matchError);
     }
@@ -146,13 +146,13 @@ export class Template {
 
   /**
    * Get the set of matching Mappings that match the given properties in the CloudFormation template.
-   * @param outputName the name of the output. Provide '*' to match all Output names in the template.
+   * @param logicalId the name of the mapping. Provide `'*'` to match all mappings in the template.
    * @param props by default, matches all Mappings in the template.
    * When a literal object is provided, performs a partial match via `Match.objectLike()`.
    * Use the `Match` APIs to configure a different behaviour.
    */
-  public findMappings(outputName: string, props: any = {}): { [key: string]: any }[] {
-    return findMappings(this.inspector, outputName, props);
+  public findMappings(logicalId: string, props: any = {}): { [key: string]: any }[] {
+    return findMappings(this.inspector, logicalId, props);
   }
 
   /**

From 36d1f102b6c48bbd3882c3c07444d6d7a5ba07d3 Mon Sep 17 00:00:00 2001
From: kaizen3031593 <zen.conroy@gmail.com>
Date: Wed, 8 Sep 2021 11:43:16 -0400
Subject: [PATCH 83/91] update readme

---
 packages/@aws-cdk/assertions/README.md | 25 ++++++++++++++++++-------
 1 file changed, 18 insertions(+), 7 deletions(-)

diff --git a/packages/@aws-cdk/assertions/README.md b/packages/@aws-cdk/assertions/README.md
index d651ab72c1bc3..7b84a9ec8ad12 100644
--- a/packages/@aws-cdk/assertions/README.md
+++ b/packages/@aws-cdk/assertions/README.md
@@ -107,16 +107,27 @@ By default, the `hasResource()` and `hasResourceProperties()` APIs perform deep
 partial object matching. This behavior can be configured using matchers.
 See subsequent section on [special matchers](#special-matchers).
 
-## Other Sections
+## Output and Mapping Matching
 
-Similar to the `hasResource()` and `findResources()`, we have equivalent methods
-to check and find other sections of the CloudFormation resources.
+The module allows you to assert that an output or matching has specific properties. The following code asserts that a resource contains an output with a `logicalId` of `Foo` and the specified properties -
 
-* Outputs - `hasOutput()` and `findOutputs()`
-* Mapping - `hasMapping()` and `findMappings()`
+```ts
+assert.hasOutput('Foo', { 
+  Value: 'Bar',
+  Export: { Name: 'ExportBaz' }, 
+});
+```
+
+Alternatively, if you want to match the value to all outputs, you can use the `'*'` special case as the `logicalId`.
+
+```ts
+assert.hasOutput('*', {
+  Value: 'Bar',
+  Export: { Name: 'ExportBaz' },
+});
+```
 
-All of the defaults and behaviour documented for `hasResource()` and
-`findResources()` apply to these methods.
+`findOutputs()` will return a list of outputs that match the `logicalId` and `props`, and you can use the `'*'` special case as well. `hasMapping()` and `findMappings()` follow a similar pattern to output matching.
 
 ## Special Matchers
 

From a209bd3bb4a4d5e5f64524641205e3d591d37d13 Mon Sep 17 00:00:00 2001
From: kaizen3031593 <zen.conroy@gmail.com>
Date: Wed, 8 Sep 2021 11:44:52 -0400
Subject: [PATCH 84/91] better structure

---
 packages/@aws-cdk/assertions/README.md | 11 ++++++++---
 1 file changed, 8 insertions(+), 3 deletions(-)

diff --git a/packages/@aws-cdk/assertions/README.md b/packages/@aws-cdk/assertions/README.md
index 7b84a9ec8ad12..d47f3a4323683 100644
--- a/packages/@aws-cdk/assertions/README.md
+++ b/packages/@aws-cdk/assertions/README.md
@@ -109,7 +109,9 @@ See subsequent section on [special matchers](#special-matchers).
 
 ## Output and Mapping Matching
 
-The module allows you to assert that an output or matching has specific properties. The following code asserts that a resource contains an output with a `logicalId` of `Foo` and the specified properties -
+The module allows you to assert that an output or matching has specific properties.
+The following code asserts that a resource contains an output with a `logicalId` of
+`Foo` and the specified properties -
 
 ```ts
 assert.hasOutput('Foo', { 
@@ -118,7 +120,8 @@ assert.hasOutput('Foo', {
 });
 ```
 
-Alternatively, if you want to match the value to all outputs, you can use the `'*'` special case as the `logicalId`.
+Alternatively, if you want to match the value to all outputs, you can use the `'*'`
+special case as the `logicalId`.
 
 ```ts
 assert.hasOutput('*', {
@@ -127,7 +130,9 @@ assert.hasOutput('*', {
 });
 ```
 
-`findOutputs()` will return a list of outputs that match the `logicalId` and `props`, and you can use the `'*'` special case as well. `hasMapping()` and `findMappings()` follow a similar pattern to output matching.
+`findOutputs()` will return a list of outputs that match the `logicalId` and `props`,
+and you can use the `'*'` special case as well. `hasMapping()` and `findMappings()`
+follow a similar pattern to output matching.
 
 ## Special Matchers
 

From 74776f393462f7e7d23cb1953ef786a823adc896 Mon Sep 17 00:00:00 2001
From: kaizen3031593 <36202692+kaizen3031593@users.noreply.github.com>
Date: Wed, 8 Sep 2021 11:48:03 -0400
Subject: [PATCH 85/91] fix(cli): 'deploy' and 'diff' silently does nothing
 when given unknown stack name (#16150)

**second attempt as last PR failed integration tests**

Currently, `cdk deploy` and `cdk diff` on stacks that do not exist return no output on the command line. This PR introduces a descriptive error message for those cases so it is easier to understand what happened.

The behavior of the error is that **if** you specify a stack or stacks, the CLI expects to match at least one known stack. If the CLI cannot find a matching stack, the error is thrown. However, if you specify multiple stacks (i.e. `cdk deploy ThisStackExists ThisStackDoesnt`) and one of those stacks do not match, the CLI will silently ignore the request to deploy `ThisStackDoesnt` without throwing an error.

closes #15866 while adding the same idea to `diff` as well as `deploy`.

----

*By submitting this pull request, I confirm that my contribution is made under the terms of the Apache-2.0 license*
---
 packages/aws-cdk/lib/cdk-toolkit.ts       | 17 ++++++++++++++---
 packages/aws-cdk/test/cdk-toolkit.test.ts |  8 ++++++++
 packages/aws-cdk/test/diff.test.ts        | 10 ++++++++++
 3 files changed, 32 insertions(+), 3 deletions(-)

diff --git a/packages/aws-cdk/lib/cdk-toolkit.ts b/packages/aws-cdk/lib/cdk-toolkit.ts
index 636da75d12975..6bc109dd37822 100644
--- a/packages/aws-cdk/lib/cdk-toolkit.ts
+++ b/packages/aws-cdk/lib/cdk-toolkit.ts
@@ -404,7 +404,8 @@ export class CdkToolkit {
       defaultBehavior: DefaultSelection.OnlySingle,
     });
 
-    await this.validateStacks(stacks);
+    this.validateStacksSelected(stacks, selector.patterns);
+    this.validateStacks(stacks);
 
     return stacks;
   }
@@ -422,7 +423,8 @@ export class CdkToolkit {
       ? allStacks.filter(art => art.validateOnSynth ?? false)
       : new StackCollection(assembly, []);
 
-    await this.validateStacks(selectedForDiff.concat(autoValidateStacks));
+    this.validateStacksSelected(selectedForDiff.concat(autoValidateStacks), stackNames);
+    this.validateStacks(selectedForDiff.concat(autoValidateStacks));
 
     return selectedForDiff;
   }
@@ -442,7 +444,7 @@ export class CdkToolkit {
   /**
    * Validate the stacks for errors and warnings according to the CLI's current settings
    */
-  private async validateStacks(stacks: StackCollection) {
+  private validateStacks(stacks: StackCollection) {
     stacks.processMetadataMessages({
       ignoreErrors: this.props.ignoreErrors,
       strict: this.props.strict,
@@ -450,6 +452,15 @@ export class CdkToolkit {
     });
   }
 
+  /**
+   * Validate that if a user specified a stack name there exists at least 1 stack selected
+   */
+  private validateStacksSelected(stacks: StackCollection, stackNames: string[]) {
+    if (stackNames.length != 0 && stacks.stackCount == 0) {
+      throw new Error(`No stacks match the name(s) ${stackNames}`);
+    }
+  }
+
   /**
    * Select a single stack by its name
    */
diff --git a/packages/aws-cdk/test/cdk-toolkit.test.ts b/packages/aws-cdk/test/cdk-toolkit.test.ts
index 9c42c21261eaa..19276b15b7b7b 100644
--- a/packages/aws-cdk/test/cdk-toolkit.test.ts
+++ b/packages/aws-cdk/test/cdk-toolkit.test.ts
@@ -40,6 +40,14 @@ function defaultToolkitSetup() {
 }
 
 describe('deploy', () => {
+  test('fails when no valid stack names are given', async () => {
+    // GIVEN
+    const toolkit = defaultToolkitSetup();
+
+    // WHEN
+    await expect(() => toolkit.deploy({ selector: { patterns: ['Test-Stack-D'] } })).rejects.toThrow('No stacks match the name(s) Test-Stack-D');
+  });
+
   describe('with hotswap deployment', () => {
     test("passes through the 'hotswap' option to CloudFormationDeployments.deployStack()", async () => {
       // GIVEN
diff --git a/packages/aws-cdk/test/diff.test.ts b/packages/aws-cdk/test/diff.test.ts
index c1bcd11c78caa..829c24d637ca9 100644
--- a/packages/aws-cdk/test/diff.test.ts
+++ b/packages/aws-cdk/test/diff.test.ts
@@ -96,6 +96,16 @@ test('exits with 1 with diffs and fail set to true', async () => {
   expect(exitCode).toBe(1);
 });
 
+test('throws an error if no valid stack names given', async () => {
+  const buffer = new StringWritable();
+
+  // WHEN
+  await expect(() => toolkit.diff({
+    stackNames: ['X', 'Y', 'Z'],
+    stream: buffer,
+  })).rejects.toThrow('No stacks match the name(s) X,Y,Z');
+});
+
 test('exits with 1 with diff in first stack, but not in second stack and fail set to true', async () => {
   // GIVEN
   const buffer = new StringWritable();

From 5c670cdfc0b661ef8d25831fd15641eec090b153 Mon Sep 17 00:00:00 2001
From: kaizen3031593 <zen.conroy@gmail.com>
Date: Wed, 8 Sep 2021 12:47:26 -0400
Subject: [PATCH 86/91] readme CR suggestions

---
 packages/@aws-cdk/assertions/README.md | 16 ++++++++--------
 1 file changed, 8 insertions(+), 8 deletions(-)

diff --git a/packages/@aws-cdk/assertions/README.md b/packages/@aws-cdk/assertions/README.md
index d47f3a4323683..706d467eb3e59 100644
--- a/packages/@aws-cdk/assertions/README.md
+++ b/packages/@aws-cdk/assertions/README.md
@@ -107,11 +107,11 @@ By default, the `hasResource()` and `hasResourceProperties()` APIs perform deep
 partial object matching. This behavior can be configured using matchers.
 See subsequent section on [special matchers](#special-matchers).
 
-## Output and Mapping Matching
+## Output and Mapping sections
 
-The module allows you to assert that an output or matching has specific properties.
-The following code asserts that a resource contains an output with a `logicalId` of
-`Foo` and the specified properties -
+The module allows you to assert that the CloudFormation template contains an Output
+that matches specific properties. The following code asserts that a template contains
+an Output with a `logicalId` of `Foo` and the specified properties -
 
 ```ts
 assert.hasOutput('Foo', { 
@@ -120,8 +120,7 @@ assert.hasOutput('Foo', {
 });
 ```
 
-Alternatively, if you want to match the value to all outputs, you can use the `'*'`
-special case as the `logicalId`.
+If you want to match against all Outputs in the template, use `*` as the `logicalId`.
 
 ```ts
 assert.hasOutput('*', {
@@ -131,8 +130,9 @@ assert.hasOutput('*', {
 ```
 
 `findOutputs()` will return a list of outputs that match the `logicalId` and `props`,
-and you can use the `'*'` special case as well. `hasMapping()` and `findMappings()`
-follow a similar pattern to output matching.
+and you can use the `'*'` special case as well.
+
+The APIs `hasMapping()` and `findMappings()` provide similar functionalities.
 
 ## Special Matchers
 

From 96ed6cddc3069fc10286063d68ed9dda5777967b Mon Sep 17 00:00:00 2001
From: AWS CDK Team <aws-cdk@amazon.com>
Date: Wed, 8 Sep 2021 18:37:04 +0000
Subject: [PATCH 87/91] chore(release): 1.122.0

---
 CHANGELOG.md    | 30 ++++++++++++++++++++++++++++++
 version.v1.json |  2 +-
 2 files changed, 31 insertions(+), 1 deletion(-)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index 0c4b63bd89989..9dc6a80553c8e 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -2,6 +2,36 @@
 
 All notable changes to this project will be documented in this file. See [standard-version](https://github.com/conventional-changelog/standard-version) for commit guidelines.
 
+## [1.122.0](https://github.com/aws/aws-cdk/compare/v1.121.0...v1.122.0) (2021-09-08)
+
+
+### Features
+
+* **aws-ec2:** Allow ApplyCloudformationInitOptions to set additional params ([#16121](https://github.com/aws/aws-cdk/issues/16121)) ([1d94646](https://github.com/aws/aws-cdk/commit/1d94646bd50cbbbc1ace3732a7b8ebb313ed3ddf)), closes [#16004](https://github.com/aws/aws-cdk/issues/16004)
+* **backup:** option to prevent recovery point deletions ([#16282](https://github.com/aws/aws-cdk/issues/16282)) ([6e71806](https://github.com/aws/aws-cdk/commit/6e718067b6c4e1a2c905fedcc60a6863ba3add12))
+* **cli:** hotswap deployments ([#15748](https://github.com/aws/aws-cdk/issues/15748)) ([6e55c95](https://github.com/aws/aws-cdk/commit/6e55c952d683f87bb815deb29124b9a37824749a))
+* **config:** EC2_INSTANCE_PROFILE_ATTACHED managed rule ([#16011](https://github.com/aws/aws-cdk/issues/16011)) ([816a319](https://github.com/aws/aws-cdk/commit/816a31984b5c6e08c4c7dd740919e0c1f5d0e196))
+* **ec2:** rename SubnetTypes to improve clarity with EC2 conventions ([#16348](https://github.com/aws/aws-cdk/issues/16348)) ([2023004](https://github.com/aws/aws-cdk/commit/2023004cc941a0e7a908bf3c90ad9887c6679564)), closes [#15929](https://github.com/aws/aws-cdk/issues/15929)
+* **ec2:** vpc endpoint for aws keyspaces ([#16306](https://github.com/aws/aws-cdk/issues/16306)) ([ad425d0](https://github.com/aws/aws-cdk/commit/ad425d004dd9154c367622733e2a2e36a38f1cef))
+* **ecs-service-extensions:** Subscribe Extension ([#16049](https://github.com/aws/aws-cdk/issues/16049)) ([66baca5](https://github.com/aws/aws-cdk/commit/66baca58adc294d5c5924cf8f8c5fa122c6d6dfc))
+* **elasticloadbalancingv2:** ALPN policy support for NLB listener ([#15956](https://github.com/aws/aws-cdk/issues/15956)) ([5427578](https://github.com/aws/aws-cdk/commit/5427578515c0b65d172f95c27f32f1933fcf8d60))
+* **kms:** support fromLookup in KMS key to get key by alias name ([#15652](https://github.com/aws/aws-cdk/issues/15652)) ([34a57ed](https://github.com/aws/aws-cdk/commit/34a57eda01ab816cd77f260b10ca466a749586bf)), closes [#8822](https://github.com/aws/aws-cdk/issues/8822)
+* **lambda:** python 3.9 runtime ([#16366](https://github.com/aws/aws-cdk/issues/16366)) ([a534829](https://github.com/aws/aws-cdk/commit/a534829b2458c5ed54d05fd5cca025cba2ddaaa7))
+* **pipelines:** stack-level steps ([#16215](https://github.com/aws/aws-cdk/issues/16215)) ([d499c85](https://github.com/aws/aws-cdk/commit/d499c85e4c09cc00b457ca7f2f4611a925ca8aeb)), closes [#16148](https://github.com/aws/aws-cdk/issues/16148)
+* **stepfunctions-tasks:** await the eval so async ops can be passed to tasks.EvaluateExpression ([#16290](https://github.com/aws/aws-cdk/issues/16290)) ([174b066](https://github.com/aws/aws-cdk/commit/174b066634755c76d1b78d05ca9b403145dedc47))
+
+
+### Bug Fixes
+
+* **apigatewayv2:** some methods of the `defaultStage` are not available without casting it to `IHttpStage` ([#15607](https://github.com/aws/aws-cdk/issues/15607)) ([27a0113](https://github.com/aws/aws-cdk/commit/27a0113ac68a05360faa22fa8897609f2f90b764))
+* **assets:** run executable command of container assets in cloud assembly root directory ([#16094](https://github.com/aws/aws-cdk/issues/16094)) ([c2852c9](https://github.com/aws/aws-cdk/commit/c2852c9c524a639a312bf296f7f23b0e3b112f6b)), closes [#15721](https://github.com/aws/aws-cdk/issues/15721)
+* **autoscaling:** EbsDeviceVolumeType.IO2 is not a valid CloudFormation value ([#16028](https://github.com/aws/aws-cdk/issues/16028)) ([492d33b](https://github.com/aws/aws-cdk/commit/492d33b27bc5b935e3da75f0bddd875bb6f9c15d)), closes [#16027](https://github.com/aws/aws-cdk/issues/16027)
+* **cli:** 'deploy' and 'diff' silently does nothing when given unknown stack name ([#16150](https://github.com/aws/aws-cdk/issues/16150)) ([74776f3](https://github.com/aws/aws-cdk/commit/74776f393462f7e7d23cb1953ef786a823adc896)), closes [#15866](https://github.com/aws/aws-cdk/issues/15866)
+* **cloudwatch:** cross account alarms does not support math expressions ([#16333](https://github.com/aws/aws-cdk/issues/16333)) ([1ffd897](https://github.com/aws/aws-cdk/commit/1ffd89714f8b1c1389d4e43383cc77d16d00ed9e)), closes [#16331](https://github.com/aws/aws-cdk/issues/16331)
+* **core:** allow asset bundling when selinux is enabled ([#15742](https://github.com/aws/aws-cdk/issues/15742)) ([dbfebb4](https://github.com/aws/aws-cdk/commit/dbfebb47a8ae61b2bb0557b6ba79a7b073f9d0df))
+* **iam:** permissions boundary aspect doesn't always recognize roles ([#16154](https://github.com/aws/aws-cdk/issues/16154)) ([c8bfcf6](https://github.com/aws/aws-cdk/commit/c8bfcf650070a0138b148645f997f542431f70cf))
+* **stepfunctions-tasks:** Athena StartQueryExecution includes QueryExecutionContext even when object is empty ([#16141](https://github.com/aws/aws-cdk/issues/16141)) ([6e2a3e0](https://github.com/aws/aws-cdk/commit/6e2a3e0f855221df98f78f6465586d5524f5c7d5)), closes [#16133](https://github.com/aws/aws-cdk/issues/16133) [#16133](https://github.com/aws/aws-cdk/issues/16133)
+
 ## [1.121.0](https://github.com/aws/aws-cdk/compare/v1.120.0...v1.121.0) (2021-09-01)
 
 
diff --git a/version.v1.json b/version.v1.json
index be934684cecce..d2fb6576ac697 100644
--- a/version.v1.json
+++ b/version.v1.json
@@ -1,3 +1,3 @@
 {
-  "version": "1.121.0"
+  "version": "1.122.0"
 }
\ No newline at end of file

From e00abff8e8b1ef7a7a8b9a4f7e4f00f876fe0412 Mon Sep 17 00:00:00 2001
From: Mitchell Valine <valinm@amazon.com>
Date: Wed, 8 Sep 2021 12:02:32 -0700
Subject: [PATCH 88/91] Update CHANGELOG.md

Co-authored-by: Christopher Rybicki <rybickic@amazon.com>
---
 CHANGELOG.md | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index 9dc6a80553c8e..ca9ef129cbefa 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -7,7 +7,7 @@ All notable changes to this project will be documented in this file. See [standa
 
 ### Features
 
-* **aws-ec2:** Allow ApplyCloudformationInitOptions to set additional params ([#16121](https://github.com/aws/aws-cdk/issues/16121)) ([1d94646](https://github.com/aws/aws-cdk/commit/1d94646bd50cbbbc1ace3732a7b8ebb313ed3ddf)), closes [#16004](https://github.com/aws/aws-cdk/issues/16004)
+* **ec2:** Allow ApplyCloudformationInitOptions to set additional params ([#16121](https://github.com/aws/aws-cdk/issues/16121)) ([1d94646](https://github.com/aws/aws-cdk/commit/1d94646bd50cbbbc1ace3732a7b8ebb313ed3ddf)), closes [#16004](https://github.com/aws/aws-cdk/issues/16004)
 * **backup:** option to prevent recovery point deletions ([#16282](https://github.com/aws/aws-cdk/issues/16282)) ([6e71806](https://github.com/aws/aws-cdk/commit/6e718067b6c4e1a2c905fedcc60a6863ba3add12))
 * **cli:** hotswap deployments ([#15748](https://github.com/aws/aws-cdk/issues/15748)) ([6e55c95](https://github.com/aws/aws-cdk/commit/6e55c952d683f87bb815deb29124b9a37824749a))
 * **config:** EC2_INSTANCE_PROFILE_ATTACHED managed rule ([#16011](https://github.com/aws/aws-cdk/issues/16011)) ([816a319](https://github.com/aws/aws-cdk/commit/816a31984b5c6e08c4c7dd740919e0c1f5d0e196))

From fc74110ff7eae544d9cfc11b2f6779169f17d145 Mon Sep 17 00:00:00 2001
From: Ahmed Kamel <humanzz@hotmail.com>
Date: Wed, 8 Sep 2021 23:55:24 +0100
Subject: [PATCH 89/91] feat(glue): Job construct (#12506)

Closes #12443

----

*By submitting this pull request, I confirm that my contribution is made under the terms of the Apache-2.0 license*
---
 packages/@aws-cdk/aws-glue/README.md          |  82 +-
 packages/@aws-cdk/aws-glue/lib/code.ts        | 112 +++
 packages/@aws-cdk/aws-glue/lib/index.ts       |   3 +
 .../@aws-cdk/aws-glue/lib/job-executable.ts   | 393 ++++++++
 packages/@aws-cdk/aws-glue/lib/job.ts         | 803 +++++++++++++++++
 packages/@aws-cdk/aws-glue/package.json       |  13 +-
 packages/@aws-cdk/aws-glue/test/code.test.ts  | 304 +++++++
 .../aws-glue/test/integ.job.expected.json     | 571 ++++++++++++
 packages/@aws-cdk/aws-glue/test/integ.job.ts  |  89 ++
 .../aws-glue/test/job-executable.test.ts      | 106 +++
 .../aws-glue/test/job-script/hello_world.py   |   1 +
 .../aws-glue/test/job-script/hello_world_2.py |   1 +
 packages/@aws-cdk/aws-glue/test/job.test.ts   | 842 ++++++++++++++++++
 13 files changed, 3309 insertions(+), 11 deletions(-)
 create mode 100644 packages/@aws-cdk/aws-glue/lib/code.ts
 create mode 100644 packages/@aws-cdk/aws-glue/lib/job-executable.ts
 create mode 100644 packages/@aws-cdk/aws-glue/lib/job.ts
 create mode 100644 packages/@aws-cdk/aws-glue/test/code.test.ts
 create mode 100644 packages/@aws-cdk/aws-glue/test/integ.job.expected.json
 create mode 100644 packages/@aws-cdk/aws-glue/test/integ.job.ts
 create mode 100644 packages/@aws-cdk/aws-glue/test/job-executable.test.ts
 create mode 100644 packages/@aws-cdk/aws-glue/test/job-script/hello_world.py
 create mode 100644 packages/@aws-cdk/aws-glue/test/job-script/hello_world_2.py
 create mode 100644 packages/@aws-cdk/aws-glue/test/job.test.ts

diff --git a/packages/@aws-cdk/aws-glue/README.md b/packages/@aws-cdk/aws-glue/README.md
index 20e08d7c14e31..f5e200f0465e7 100644
--- a/packages/@aws-cdk/aws-glue/README.md
+++ b/packages/@aws-cdk/aws-glue/README.md
@@ -23,6 +23,69 @@
 
 This module is part of the [AWS Cloud Development Kit](https://github.com/aws/aws-cdk) project.
 
+## Job
+
+A `Job` encapsulates a script that connects to data sources, processes them, and then writes output to a data target.
+
+There are 3 types of jobs supported by AWS Glue: Spark ETL, Spark Streaming, and Python Shell jobs.
+
+The `glue.JobExecutable` allows you to specify the type of job, the language to use and the code assets required by the job.
+
+`glue.Code` allows you to refer to the different code assets required by the job, either from an existing S3 location or from a local file path.
+
+### Spark Jobs
+
+These jobs run in an Apache Spark environment managed by AWS Glue.
+
+#### ETL Jobs
+
+An ETL job processes data in batches using Apache Spark.
+
+```ts
+new glue.Job(stack, 'ScalaSparkEtlJob', {
+  executable: glue.JobExecutable.scalaEtl({
+    glueVersion: glue.GlueVersion.V2_0,
+    script: glue.Code.fromBucket(bucket, 'src/com/example/HelloWorld.scala'),
+    className: 'com.example.HelloWorld',
+    extraJars: [glue.Code.fromBucket(bucket, 'jars/HelloWorld.jar')],
+  }),
+  description: 'an example Scala ETL job',
+});
+```
+
+#### Streaming Jobs
+
+A Streaming job is similar to an ETL job, except that it performs ETL on data streams. It uses the Apache Spark Structured Streaming framework. Some Spark job features are not available to streaming ETL jobs.
+
+```ts
+new glue.Job(stack, 'PythonSparkStreamingJob', {
+  executable: glue.JobExecutable.pythonStreaming({
+    glueVersion: glue.GlueVersion.V2_0,
+    pythonVersion: glue.PythonVersion.THREE,
+    script: glue.Code.fromAsset(path.join(__dirname, 'job-script/hello_world.py')),
+  }),
+  description: 'an example Python Streaming job',
+});
+```
+
+### Python Shell Jobs
+
+A Python shell job runs Python scripts as a shell and supports a Python version that depends on the AWS Glue version you are using.
+This can be used to schedule and run tasks that don't require an Apache Spark environment.
+
+```ts
+new glue.Job(stack, 'PythonShellJob', {
+  executable: glue.JobExecutable.pythonShell({
+    glueVersion: glue.GlueVersion.V1_0,
+    pythonVersion: PythonVersion.THREE,
+    script: glue.Code.fromBucket(bucket, 'script.py'),
+  }),
+  description: 'an example Python Shell job',
+});
+```
+
+See [documentation](https://docs.aws.amazon.com/glue/latest/dg/add-job.html) for more information on adding jobs in Glue.
+
 ## Connection
 
 A `Connection` allows Glue jobs, crawlers and development endpoints to access certain types of data stores. For example, to create a network connection to connect to a data source within a VPC:
@@ -41,16 +104,6 @@ If you need to use a connection type that doesn't exist as a static member on `C
 
 See [Adding a Connection to Your Data Store](https://docs.aws.amazon.com/glue/latest/dg/populate-add-connection.html) and [Connection Structure](https://docs.aws.amazon.com/glue/latest/dg/aws-glue-api-catalog-connections.html#aws-glue-api-catalog-connections-Connection) documentation for more information on the supported data stores and their configurations.
 
-## Database
-
-A `Database` is a logical grouping of `Tables` in the Glue Catalog.
-
-```ts
-new glue.Database(stack, 'MyDatabase', {
-  databaseName: 'my_database'
-});
-```
-
 ## SecurityConfiguration
 
 A `SecurityConfiguration` is a set of security properties that can be used by AWS Glue to encrypt data at rest.
@@ -84,6 +137,15 @@ new glue.SecurityConfiguration(stack, 'MySecurityConfiguration', {
 
 See [documentation](https://docs.aws.amazon.com/glue/latest/dg/encryption-security-configuration.html) for more info for Glue encrypting data written by Crawlers, Jobs, and Development Endpoints.
 
+## Database
+
+A `Database` is a logical grouping of `Tables` in the Glue Catalog.
+
+```ts
+new glue.Database(stack, 'MyDatabase', {
+  databaseName: 'my_database'
+});
+```
 
 ## Table
 
diff --git a/packages/@aws-cdk/aws-glue/lib/code.ts b/packages/@aws-cdk/aws-glue/lib/code.ts
new file mode 100644
index 0000000000000..9f2f03d9884be
--- /dev/null
+++ b/packages/@aws-cdk/aws-glue/lib/code.ts
@@ -0,0 +1,112 @@
+import * as crypto from 'crypto';
+import * as fs from 'fs';
+import * as iam from '@aws-cdk/aws-iam';
+import * as s3 from '@aws-cdk/aws-s3';
+import * as s3assets from '@aws-cdk/aws-s3-assets';
+import * as cdk from '@aws-cdk/core';
+import * as constructs from 'constructs';
+
+/**
+ * Represents a Glue Job's Code assets (an asset can be a scripts, a jar, a python file or any other file).
+ */
+export abstract class Code {
+
+  /**
+   * Job code as an S3 object.
+   * @param bucket The S3 bucket
+   * @param key The object key
+   */
+  public static fromBucket(bucket: s3.IBucket, key: string): S3Code {
+    return new S3Code(bucket, key);
+  }
+
+  /**
+   * Job code from a local disk path.
+   *
+   * @param path code file (not a directory).
+   */
+  public static fromAsset(path: string, options?: s3assets.AssetOptions): AssetCode {
+    return new AssetCode(path, options);
+  }
+
+  /**
+   * Called when the Job is initialized to allow this object to bind.
+   */
+  public abstract bind(scope: constructs.Construct, grantable: iam.IGrantable): CodeConfig;
+}
+
+/**
+ * Glue job Code from an S3 bucket.
+ */
+export class S3Code extends Code {
+  constructor(private readonly bucket: s3.IBucket, private readonly key: string) {
+    super();
+  }
+
+  public bind(_scope: constructs.Construct, grantable: iam.IGrantable): CodeConfig {
+    this.bucket.grantRead(grantable, this.key);
+    return {
+      s3Location: {
+        bucketName: this.bucket.bucketName,
+        objectKey: this.key,
+      },
+    };
+  }
+}
+
+/**
+ * Job Code from a local file.
+ */
+export class AssetCode extends Code {
+  private asset?: s3assets.Asset;
+
+  /**
+   * @param path The path to the Code file.
+   */
+  constructor(private readonly path: string, private readonly options: s3assets.AssetOptions = { }) {
+    super();
+
+    if (fs.lstatSync(this.path).isDirectory()) {
+      throw new Error(`Code path ${this.path} is a directory. Only files are supported`);
+    }
+  }
+
+  public bind(scope: constructs.Construct, grantable: iam.IGrantable): CodeConfig {
+    // If the same AssetCode is used multiple times, retain only the first instantiation.
+    if (!this.asset) {
+      this.asset = new s3assets.Asset(scope, `Code${this.hashcode(this.path)}`, {
+        path: this.path,
+        ...this.options,
+      });
+    } else if (cdk.Stack.of(this.asset) !== cdk.Stack.of(scope)) {
+      throw new Error(`Asset is already associated with another stack '${cdk.Stack.of(this.asset).stackName}'. ` +
+        'Create a new Code instance for every stack.');
+    }
+    this.asset.grantRead(grantable);
+    return {
+      s3Location: {
+        bucketName: this.asset.s3BucketName,
+        objectKey: this.asset.s3ObjectKey,
+      },
+    };
+  }
+
+  /**
+   * Hash a string
+   */
+  private hashcode(s: string): string {
+    const hash = crypto.createHash('md5');
+    hash.update(s);
+    return hash.digest('hex');
+  };
+}
+
+/**
+ * Result of binding `Code` into a `Job`.
+ */
+export interface CodeConfig {
+  /**
+   * The location of the code in S3.
+   */
+  readonly s3Location: s3.Location;
+}
\ No newline at end of file
diff --git a/packages/@aws-cdk/aws-glue/lib/index.ts b/packages/@aws-cdk/aws-glue/lib/index.ts
index a3dfa85b3be71..d1da5e9385349 100644
--- a/packages/@aws-cdk/aws-glue/lib/index.ts
+++ b/packages/@aws-cdk/aws-glue/lib/index.ts
@@ -4,6 +4,9 @@ export * from './glue.generated';
 export * from './connection';
 export * from './data-format';
 export * from './database';
+export * from './job';
+export * from './job-executable';
+export * from './code';
 export * from './schema';
 export * from './security-configuration';
 export * from './table';
\ No newline at end of file
diff --git a/packages/@aws-cdk/aws-glue/lib/job-executable.ts b/packages/@aws-cdk/aws-glue/lib/job-executable.ts
new file mode 100644
index 0000000000000..8fd7c39da5508
--- /dev/null
+++ b/packages/@aws-cdk/aws-glue/lib/job-executable.ts
@@ -0,0 +1,393 @@
+import { Code } from './code';
+
+/**
+ * AWS Glue version determines the versions of Apache Spark and Python that are available to the job.
+ *
+ * @see https://docs.aws.amazon.com/glue/latest/dg/add-job.html.
+ *
+ * If you need to use a GlueVersion that doesn't exist as a static member, you
+ * can instantiate a `GlueVersion` object, e.g: `GlueVersion.of('1.5')`.
+ */
+export class GlueVersion {
+  /**
+   * Glue version using Spark 2.2.1 and Python 2.7
+   */
+  public static readonly V0_9 = new GlueVersion('0.9');
+
+  /**
+   * Glue version using Spark 2.4.3, Python 2.7 and Python 3.6
+   */
+  public static readonly V1_0 = new GlueVersion('1.0');
+
+  /**
+   * Glue version using Spark 2.4.3 and Python 3.7
+   */
+  public static readonly V2_0 = new GlueVersion('2.0');
+
+  /**
+   * Glue version using Spark 3.1.1 and Python 3.7
+   */
+  public static readonly V3_0 = new GlueVersion('3.0');
+
+  /**
+   * Custom Glue version
+   * @param version custom version
+   */
+  public static of(version: string): GlueVersion {
+    return new GlueVersion(version);
+  }
+
+  /**
+   * The name of this GlueVersion, as expected by Job resource.
+   */
+  public readonly name: string;
+
+  private constructor(name: string) {
+    this.name = name;
+  }
+}
+
+/**
+ * Runtime language of the Glue job
+ */
+export enum JobLanguage {
+  /**
+   * Scala
+   */
+  SCALA = 'scala',
+
+  /**
+   * Python
+   */
+  PYTHON = 'python',
+}
+
+/**
+ * Python version
+ */
+export enum PythonVersion {
+  /**
+   * Python 2 (the exact version depends on GlueVersion and JobCommand used)
+   */
+  TWO = '2',
+
+  /**
+   * Python 3 (the exact version depends on GlueVersion and JobCommand used)
+   */
+  THREE = '3',
+}
+
+/**
+ * The job type.
+ *
+ * If you need to use a JobType that doesn't exist as a static member, you
+ * can instantiate a `JobType` object, e.g: `JobType.of('other name')`.
+ */
+export class JobType {
+  /**
+   * Command for running a Glue ETL job.
+   */
+  public static readonly ETL = new JobType('glueetl');
+
+  /**
+   * Command for running a Glue streaming job.
+   */
+  public static readonly STREAMING = new JobType('gluestreaming');
+
+  /**
+   * Command for running a Glue python shell job.
+   */
+  public static readonly PYTHON_SHELL = new JobType('pythonshell');
+
+  /**
+   * Custom type name
+   * @param name type name
+   */
+  public static of(name: string): JobType {
+    return new JobType(name);
+  }
+
+  /**
+   * The name of this JobType, as expected by Job resource.
+   */
+  public readonly name: string;
+
+  private constructor(name: string) {
+    this.name = name;
+  }
+}
+
+interface PythonExecutableProps {
+  /**
+   * The Python version to use.
+   */
+  readonly pythonVersion: PythonVersion;
+
+  /**
+   * Additional Python files that AWS Glue adds to the Python path before executing your script.
+   * Only individual files are supported, directories are not supported.
+   *
+   * @default - no extra python files and argument is not set
+   *
+   * @see `--extra-py-files` in https://docs.aws.amazon.com/glue/latest/dg/aws-glue-programming-etl-glue-arguments.html
+   */
+  readonly extraPythonFiles?: Code[];
+}
+
+interface SharedJobExecutableProps {
+  /**
+   * Glue version.
+   *
+   * @see https://docs.aws.amazon.com/glue/latest/dg/release-notes.html
+   */
+  readonly glueVersion: GlueVersion;
+
+  /**
+   * The script that executes a job.
+   */
+  readonly script: Code;
+
+  /**
+   * Additional files, such as configuration files that AWS Glue copies to the working directory of your script before executing it.
+   * Only individual files are supported, directories are not supported.
+   *
+   * @default [] - no extra files are copied to the working directory
+   *
+   * @see `--extra-files` in https://docs.aws.amazon.com/glue/latest/dg/aws-glue-programming-etl-glue-arguments.html
+   */
+  readonly extraFiles?: Code[];
+}
+
+interface SharedSparkJobExecutableProps extends SharedJobExecutableProps {
+  /**
+   * Additional Java .jar files that AWS Glue adds to the Java classpath before executing your script.
+   * Only individual files are supported, directories are not supported.
+   *
+   * @default [] - no extra jars are added to the classpath
+   *
+   * @see `--extra-jars` in https://docs.aws.amazon.com/glue/latest/dg/aws-glue-programming-etl-glue-arguments.html
+   */
+  readonly extraJars?: Code[];
+
+  /**
+   * Setting this value to true prioritizes the customer's extra JAR files in the classpath.
+   *
+   * @default false - priority is not given to user-provided jars
+   *
+   * @see `--user-jars-first` in https://docs.aws.amazon.com/glue/latest/dg/aws-glue-programming-etl-glue-arguments.html
+   */
+  readonly extraJarsFirst?: boolean;
+}
+
+/**
+ * Props for creating a Scala Spark (ETL or Streaming) job executable
+ */
+export interface ScalaJobExecutableProps extends SharedSparkJobExecutableProps {
+  /**
+   * The fully qualified Scala class name that serves as the entry point for the job.
+   *
+   * @see `--class` in https://docs.aws.amazon.com/glue/latest/dg/aws-glue-programming-etl-glue-arguments.html
+   */
+  readonly className: string;
+}
+
+/**
+ * Props for creating a Python Spark (ETL or Streaming) job executable
+ */
+export interface PythonSparkJobExecutableProps extends SharedSparkJobExecutableProps, PythonExecutableProps {}
+
+/**
+ * Props for creating a Python shell job executable
+ */
+export interface PythonShellExecutableProps extends SharedJobExecutableProps, PythonExecutableProps {}
+
+/**
+ * The executable properties related to the Glue job's GlueVersion, JobType and code
+ */
+export class JobExecutable {
+
+  /**
+   * Create Scala executable props for Apache Spark ETL job.
+   *
+   * @param props Scala Apache Spark Job props
+   */
+  public static scalaEtl(props: ScalaJobExecutableProps): JobExecutable {
+    return new JobExecutable({
+      ...props,
+      type: JobType.ETL,
+      language: JobLanguage.SCALA,
+    });
+  }
+
+  /**
+   * Create Scala executable props for Apache Spark Streaming job.
+   *
+   * @param props Scala Apache Spark Job props
+   */
+  public static scalaStreaming(props: ScalaJobExecutableProps): JobExecutable {
+    return new JobExecutable({
+      ...props,
+      type: JobType.STREAMING,
+      language: JobLanguage.SCALA,
+    });
+  }
+
+  /**
+   * Create Python executable props for Apache Spark ETL job.
+   *
+   * @param props Python Apache Spark Job props
+   */
+  public static pythonEtl(props: PythonSparkJobExecutableProps): JobExecutable {
+    return new JobExecutable({
+      ...props,
+      type: JobType.ETL,
+      language: JobLanguage.PYTHON,
+    });
+  }
+
+  /**
+   * Create Python executable props for Apache Spark Streaming job.
+   *
+   * @param props Python Apache Spark Job props
+   */
+  public static pythonStreaming(props: PythonSparkJobExecutableProps): JobExecutable {
+    return new JobExecutable({
+      ...props,
+      type: JobType.STREAMING,
+      language: JobLanguage.PYTHON,
+    });
+  }
+
+  /**
+   * Create Python executable props for python shell jobs.
+   *
+   * @param props Python Shell Job props.
+   */
+  public static pythonShell(props: PythonShellExecutableProps): JobExecutable {
+    return new JobExecutable({
+      ...props,
+      type: JobType.PYTHON_SHELL,
+      language: JobLanguage.PYTHON,
+    });
+  }
+
+  /**
+   * Create a custom JobExecutable.
+   *
+   * @param config custom job executable configuration.
+   */
+  public static of(config: JobExecutableConfig): JobExecutable {
+    return new JobExecutable(config);
+  }
+
+  private config: JobExecutableConfig;
+
+  private constructor(config: JobExecutableConfig) {
+    if (JobType.PYTHON_SHELL === config.type) {
+      if (config.language !== JobLanguage.PYTHON) {
+        throw new Error('Python shell requires the language to be set to Python');
+      }
+      if ([GlueVersion.V0_9, GlueVersion.V2_0, GlueVersion.V3_0].includes(config.glueVersion)) {
+        throw new Error(`Specified GlueVersion ${config.glueVersion.name} does not support Python Shell`);
+      }
+    }
+    if (config.extraJarsFirst && [GlueVersion.V0_9, GlueVersion.V1_0].includes(config.glueVersion)) {
+      throw new Error(`Specified GlueVersion ${config.glueVersion.name} does not support extraJarsFirst`);
+    }
+    if (config.pythonVersion === PythonVersion.TWO && ![GlueVersion.V0_9, GlueVersion.V1_0].includes(config.glueVersion)) {
+      throw new Error(`Specified GlueVersion ${config.glueVersion.name} does not support PythonVersion ${config.pythonVersion}`);
+    }
+    if (JobLanguage.PYTHON !== config.language && config.extraPythonFiles) {
+      throw new Error('extraPythonFiles is not supported for languages other than JobLanguage.PYTHON');
+    }
+    this.config = config;
+  }
+
+  /**
+   * Called during Job initialization to get JobExecutableConfig.
+   */
+  public bind(): JobExecutableConfig {
+    return this.config;
+  }
+}
+
+/**
+ * Result of binding a `JobExecutable` into a `Job`.
+ */
+export interface JobExecutableConfig {
+  /**
+   * Glue version.
+   *
+   * @see https://docs.aws.amazon.com/glue/latest/dg/release-notes.html
+   */
+  readonly glueVersion: GlueVersion;
+
+  /**
+   * The language of the job (Scala or Python).
+   *
+   * @see `--job-language` in https://docs.aws.amazon.com/glue/latest/dg/aws-glue-programming-etl-glue-arguments.html
+   */
+  readonly language: JobLanguage;
+
+  /**
+   * Specify the type of the job whether it's an Apache Spark ETL or streaming one or if it's a Python shell job.
+   */
+  readonly type: JobType;
+
+  /**
+   * The Python version to use.
+   *
+   * @default - no python version specified
+   */
+  readonly pythonVersion?: PythonVersion;
+
+  /**
+   * The script that is executed by a job.
+   */
+  readonly script: Code;
+
+  /**
+   * The Scala class that serves as the entry point for the job. This applies only if your the job langauage is Scala.
+   *
+   * @default - no scala className specified
+   *
+   * @see `--class` in https://docs.aws.amazon.com/glue/latest/dg/aws-glue-programming-etl-glue-arguments.html
+   */
+  readonly className?: string;
+
+  /**
+   * Additional Java .jar files that AWS Glue adds to the Java classpath before executing your script.
+   *
+   * @default - no extra jars specified.
+   *
+   * @see `--extra-jars` in https://docs.aws.amazon.com/glue/latest/dg/aws-glue-programming-etl-glue-arguments.html
+   */
+  readonly extraJars?: Code[];
+
+  /**
+   * Additional Python files that AWS Glue adds to the Python path before executing your script.
+   *
+   * @default - no extra python files specified.
+   *
+   * @see `--extra-py-files` in https://docs.aws.amazon.com/glue/latest/dg/aws-glue-programming-etl-glue-arguments.html
+   */
+  readonly extraPythonFiles?: Code[];
+
+  /**
+   * Additional files, such as configuration files that AWS Glue copies to the working directory of your script before executing it.
+   *
+   * @default - no extra files specified.
+   *
+   * @see `--extra-files` in https://docs.aws.amazon.com/glue/latest/dg/aws-glue-programming-etl-glue-arguments.html
+   */
+  readonly extraFiles?: Code[];
+
+  /**
+   * Setting this value to true prioritizes the customer's extra JAR files in the classpath.
+   *
+   * @default - extra jars are not prioritized.
+   *
+   * @see `--user-jars-first` in https://docs.aws.amazon.com/glue/latest/dg/aws-glue-programming-etl-glue-arguments.html
+   */
+  readonly extraJarsFirst?: boolean;
+}
diff --git a/packages/@aws-cdk/aws-glue/lib/job.ts b/packages/@aws-cdk/aws-glue/lib/job.ts
new file mode 100644
index 0000000000000..0233783f94869
--- /dev/null
+++ b/packages/@aws-cdk/aws-glue/lib/job.ts
@@ -0,0 +1,803 @@
+import * as cloudwatch from '@aws-cdk/aws-cloudwatch';
+import * as events from '@aws-cdk/aws-events';
+import * as iam from '@aws-cdk/aws-iam';
+import * as logs from '@aws-cdk/aws-logs';
+import * as s3 from '@aws-cdk/aws-s3';
+import * as cdk from '@aws-cdk/core';
+import * as constructs from 'constructs';
+import { Code, JobExecutable, JobExecutableConfig, JobType } from '.';
+import { IConnection } from './connection';
+import { CfnJob } from './glue.generated';
+import { ISecurityConfiguration } from './security-configuration';
+
+/**
+ * The type of predefined worker that is allocated when a job runs.
+ *
+ * If you need to use a WorkerType that doesn't exist as a static member, you
+ * can instantiate a `WorkerType` object, e.g: `WorkerType.of('other type')`.
+ */
+export class WorkerType {
+  /**
+   * Each worker provides 4 vCPU, 16 GB of memory and a 50GB disk, and 2 executors per worker.
+   */
+  public static readonly STANDARD = new WorkerType('Standard');
+
+  /**
+   * Each worker maps to 1 DPU (4 vCPU, 16 GB of memory, 64 GB disk), and provides 1 executor per worker. Suitable for memory-intensive jobs.
+   */
+  public static readonly G_1X = new WorkerType('G.1X');
+
+  /**
+   * Each worker maps to 2 DPU (8 vCPU, 32 GB of memory, 128 GB disk), and provides 1 executor per worker. Suitable for memory-intensive jobs.
+   */
+  public static readonly G_2X = new WorkerType('G.2X');
+
+  /**
+   * Custom worker type
+   * @param workerType custom worker type
+   */
+  public static of(workerType: string): WorkerType {
+    return new WorkerType(workerType);
+  }
+
+  /**
+   * The name of this WorkerType, as expected by Job resource.
+   */
+  public readonly name: string;
+
+  private constructor(name: string) {
+    this.name = name;
+  }
+}
+
+/**
+ * Job states emitted by Glue to CloudWatch Events.
+ *
+ * @see https://docs.aws.amazon.com/AmazonCloudWatch/latest/events/EventTypes.html#glue-event-types for more information.
+ */
+export enum JobState {
+  /**
+   * State indicating job run succeeded
+   */
+  SUCCEEDED = 'SUCCEEDED',
+
+  /**
+   * State indicating job run failed
+   */
+  FAILED = 'FAILED',
+
+  /**
+   * State indicating job run timed out
+   */
+  TIMEOUT = 'TIMEOUT',
+
+  /**
+   * State indicating job is starting
+   */
+  STARTING = 'STARTING',
+
+  /**
+   * State indicating job is running
+   */
+  RUNNING = 'RUNNING',
+
+  /**
+   * State indicating job is stopping
+   */
+  STOPPING = 'STOPPING',
+
+  /**
+   * State indicating job stopped
+   */
+  STOPPED = 'STOPPED',
+}
+
+/**
+ * The Glue CloudWatch metric type.
+ *
+ * @see https://docs.aws.amazon.com/glue/latest/dg/monitoring-awsglue-with-cloudwatch-metrics.html
+ */
+export enum MetricType {
+  /**
+   * A value at a point in time.
+   */
+  GAUGE = 'gauge',
+
+  /**
+   * An aggregate number.
+   */
+  COUNT = 'count',
+}
+
+/**
+ * Interface representing a created or an imported {@link Job}.
+ */
+export interface IJob extends cdk.IResource, iam.IGrantable {
+  /**
+   * The name of the job.
+   * @attribute
+   */
+  readonly jobName: string;
+
+  /**
+   * The ARN of the job.
+   * @attribute
+   */
+  readonly jobArn: string;
+
+  /**
+   * Defines a CloudWatch event rule triggered when something happens with this job.
+   *
+   * @see https://docs.aws.amazon.com/AmazonCloudWatch/latest/events/EventTypes.html#glue-event-types
+   */
+  onEvent(id: string, options?: events.OnEventOptions): events.Rule;
+
+  /**
+   * Defines a CloudWatch event rule triggered when this job moves to the input jobState.
+   *
+   * @see https://docs.aws.amazon.com/AmazonCloudWatch/latest/events/EventTypes.html#glue-event-types
+   */
+  onStateChange(id: string, jobState: JobState, options?: events.OnEventOptions): events.Rule;
+
+  /**
+   * Defines a CloudWatch event rule triggered when this job moves to the SUCCEEDED state.
+   *
+   * @see https://docs.aws.amazon.com/AmazonCloudWatch/latest/events/EventTypes.html#glue-event-types
+   */
+  onSuccess(id: string, options?: events.OnEventOptions): events.Rule;
+
+  /**
+   * Defines a CloudWatch event rule triggered when this job moves to the FAILED state.
+   *
+   * @see https://docs.aws.amazon.com/AmazonCloudWatch/latest/events/EventTypes.html#glue-event-types
+   */
+  onFailure(id: string, options?: events.OnEventOptions): events.Rule;
+
+  /**
+   * Defines a CloudWatch event rule triggered when this job moves to the TIMEOUT state.
+   *
+   * @see https://docs.aws.amazon.com/AmazonCloudWatch/latest/events/EventTypes.html#glue-event-types
+   */
+  onTimeout(id: string, options?: events.OnEventOptions): events.Rule;
+
+  /**
+   * Create a CloudWatch metric.
+   *
+   * @param metricName name of the metric typically prefixed with `glue.driver.`, `glue.<executorId>.` or `glue.ALL.`.
+   * @param type the metric type.
+   * @param props metric options.
+   *
+   * @see https://docs.aws.amazon.com/glue/latest/dg/monitoring-awsglue-with-cloudwatch-metrics.html
+   */
+  metric(metricName: string, type: MetricType, props?: cloudwatch.MetricOptions): cloudwatch.Metric;
+
+  /**
+   * Create a CloudWatch Metric indicating job success.
+   */
+  metricSuccess(props?: cloudwatch.MetricOptions): cloudwatch.Metric;
+
+  /**
+   * Create a CloudWatch Metric indicating job failure.
+   */
+  metricFailure(props?: cloudwatch.MetricOptions): cloudwatch.Metric;
+
+  /**
+   * Create a CloudWatch Metric indicating job timeout.
+   */
+  metricTimeout(props?: cloudwatch.MetricOptions): cloudwatch.Metric;
+}
+
+abstract class JobBase extends cdk.Resource implements IJob {
+
+  public abstract readonly jobArn: string;
+  public abstract readonly jobName: string;
+  public abstract readonly grantPrincipal: iam.IPrincipal;
+
+  /**
+   * Create a CloudWatch Event Rule for this Glue Job when it's in a given state
+   *
+   * @param id construct id
+   * @param options event options. Note that some values are overridden if provided, these are
+   *  - eventPattern.source = ['aws.glue']
+   *  - eventPattern.detailType = ['Glue Job State Change', 'Glue Job Run Status']
+   *  - eventPattern.detail.jobName = [this.jobName]
+   *
+   * @see https://docs.aws.amazon.com/AmazonCloudWatch/latest/events/EventTypes.html#glue-event-types
+   */
+  public onEvent(id: string, options: events.OnEventOptions = {}): events.Rule {
+    const rule = new events.Rule(this, id, options);
+    rule.addTarget(options.target);
+    rule.addEventPattern({
+      source: ['aws.glue'],
+      detailType: ['Glue Job State Change', 'Glue Job Run Status'],
+      detail: {
+        jobName: [this.jobName],
+      },
+    });
+    return rule;
+  }
+
+  /**
+   * Create a CloudWatch Event Rule for the transition into the input jobState.
+   *
+   * @param id construct id.
+   * @param jobState the job state.
+   * @param options optional event options.
+   */
+  public onStateChange(id: string, jobState: JobState, options: events.OnEventOptions = {}): events.Rule {
+    const rule = this.onEvent(id, {
+      description: `Rule triggered when Glue job ${this.jobName} is in ${jobState} state`,
+      ...options,
+    });
+    rule.addEventPattern({
+      detail: {
+        state: [jobState],
+      },
+    });
+    return rule;
+  }
+
+  /**
+   * Create a CloudWatch Event Rule matching JobState.SUCCEEDED.
+   *
+   * @param id construct id.
+   * @param options optional event options. default is {}.
+   */
+  public onSuccess(id: string, options: events.OnEventOptions = {}): events.Rule {
+    return this.onStateChange(id, JobState.SUCCEEDED, options);
+  }
+
+  /**
+   * Return a CloudWatch Event Rule matching FAILED state.
+   *
+   * @param id construct id.
+   * @param options optional event options. default is {}.
+   */
+  public onFailure(id: string, options: events.OnEventOptions = {}): events.Rule {
+    return this.onStateChange(id, JobState.FAILED, options);
+  }
+
+  /**
+   * Return a CloudWatch Event Rule matching TIMEOUT state.
+   *
+   * @param id construct id.
+   * @param options optional event options. default is {}.
+   */
+  public onTimeout(id: string, options: events.OnEventOptions = {}): events.Rule {
+    return this.onStateChange(id, JobState.TIMEOUT, options);
+  }
+
+  /**
+   * Create a CloudWatch metric.
+   *
+   * @param metricName name of the metric typically prefixed with `glue.driver.`, `glue.<executorId>.` or `glue.ALL.`.
+   * @param type the metric type.
+   * @param props metric options.
+   *
+   * @see https://docs.aws.amazon.com/glue/latest/dg/monitoring-awsglue-with-cloudwatch-metrics.html
+   */
+  public metric(metricName: string, type: MetricType, props?: cloudwatch.MetricOptions): cloudwatch.Metric {
+    return new cloudwatch.Metric({
+      metricName,
+      namespace: 'Glue',
+      dimensions: {
+        JobName: this.jobName,
+        JobRunId: 'ALL',
+        Type: type,
+      },
+      ...props,
+    }).attachTo(this);
+  }
+
+  /**
+   * Return a CloudWatch Metric indicating job success.
+   *
+   * This metric is based on the Rule returned by no-args onSuccess() call.
+   */
+  public metricSuccess(props?: cloudwatch.MetricOptions): cloudwatch.Metric {
+    return metricRule(this.metricJobStateRule('SuccessMetricRule', JobState.SUCCEEDED), props);
+  }
+
+  /**
+   * Return a CloudWatch Metric indicating job failure.
+   *
+   * This metric is based on the Rule returned by no-args onFailure() call.
+   */
+  public metricFailure(props?: cloudwatch.MetricOptions): cloudwatch.Metric {
+    return metricRule(this.metricJobStateRule('FailureMetricRule', JobState.FAILED), props);
+  }
+
+  /**
+   * Return a CloudWatch Metric indicating job timeout.
+   *
+   * This metric is based on the Rule returned by no-args onTimeout() call.
+   */
+  public metricTimeout(props?: cloudwatch.MetricOptions): cloudwatch.Metric {
+    return metricRule(this.metricJobStateRule('TimeoutMetricRule', JobState.TIMEOUT), props);
+  }
+
+  /**
+   * Creates or retrieves a singleton event rule for the input job state for use with the metric JobState methods.
+   *
+   * @param id construct id.
+   * @param jobState the job state.
+   * @private
+   */
+  private metricJobStateRule(id: string, jobState: JobState): events.Rule {
+    return this.node.tryFindChild(id) as events.Rule ?? this.onStateChange(id, jobState);
+  }
+}
+
+/**
+ * Properties for enabling Spark UI monitoring feature for Spark-based Glue jobs.
+ *
+ * @see https://docs.aws.amazon.com/glue/latest/dg/monitor-spark-ui-jobs.html
+ * @see https://docs.aws.amazon.com/glue/latest/dg/aws-glue-programming-etl-glue-arguments.html
+ */
+export interface SparkUIProps {
+  /**
+   * Enable Spark UI.
+   */
+  readonly enabled: boolean
+
+  /**
+   * The bucket where the Glue job stores the logs.
+   *
+   * @default a new bucket will be created.
+   */
+  readonly bucket?: s3.IBucket;
+
+  /**
+   * The path inside the bucket (objects prefix) where the Glue job stores the logs.
+   *
+   * @default '/' - the logs will be written at the root of the bucket
+   */
+  readonly prefix?: string;
+}
+
+/**
+ * The Spark UI logging location.
+ *
+ * @see https://docs.aws.amazon.com/glue/latest/dg/monitor-spark-ui-jobs.html
+ * @see https://docs.aws.amazon.com/glue/latest/dg/aws-glue-programming-etl-glue-arguments.html
+ */
+export interface SparkUILoggingLocation {
+  /**
+   * The bucket where the Glue job stores the logs.
+   */
+  readonly bucket: s3.IBucket;
+
+  /**
+   * The path inside the bucket (objects prefix) where the Glue job stores the logs.
+   *
+   * @default '/' - the logs will be written at the root of the bucket
+   */
+  readonly prefix?: string;
+}
+
+/**
+ * Properties for enabling Continuous Logging for Glue Jobs.
+ *
+ * @see https://docs.aws.amazon.com/glue/latest/dg/monitor-continuous-logging-enable.html
+ * @see https://docs.aws.amazon.com/glue/latest/dg/aws-glue-programming-etl-glue-arguments.html
+ */
+export interface ContinuousLoggingProps {
+  /**
+   * Enable continouous logging.
+   */
+  readonly enabled: boolean;
+
+  /**
+   * Specify a custom CloudWatch log group name.
+   *
+   * @default - a log group is created with name `/aws-glue/jobs/logs-v2/`.
+   */
+  readonly logGroup?: logs.ILogGroup;
+
+  /**
+   * Specify a custom CloudWatch log stream prefix.
+   *
+   * @default - the job run ID.
+   */
+  readonly logStreamPrefix?: string;
+
+  /**
+   * Filter out non-useful Apache Spark driver/executor and Apache Hadoop YARN heartbeat log messages.
+   *
+   * @default true
+   */
+  readonly quiet?: boolean;
+
+  /**
+   * Apply the provided conversion pattern.
+   *
+   * This is a Log4j Conversion Pattern to customize driver and executor logs.
+   *
+   * @default `%d{yy/MM/dd HH:mm:ss} %p %c{1}: %m%n`
+   */
+  readonly conversionPattern?: string;
+}
+
+/**
+ * Attributes for importing {@link Job}.
+ */
+export interface JobAttributes {
+  /**
+   * The name of the job.
+   */
+  readonly jobName: string;
+
+  /**
+   * The IAM role assumed by Glue to run this job.
+   *
+   * @default - undefined
+   */
+  readonly role?: iam.IRole;
+}
+
+/**
+ * Construction properties for {@link Job}.
+ */
+export interface JobProps {
+  /**
+   * The job's executable properties.
+   */
+  readonly executable: JobExecutable;
+
+  /**
+   * The name of the job.
+   *
+   * @default - a name is automatically generated
+   */
+  readonly jobName?: string;
+
+  /**
+   * The description of the job.
+   *
+   * @default - no value
+   */
+  readonly description?: string;
+
+  /**
+   * The number of AWS Glue data processing units (DPUs) that can be allocated when this job runs.
+   * Cannot be used for Glue version 2.0 and later - workerType and workerCount should be used instead.
+   *
+   * @default - 10 when job type is Apache Spark ETL or streaming, 0.0625 when job type is Python shell
+   */
+  readonly maxCapacity?: number;
+
+  /**
+   * The maximum number of times to retry this job after a job run fails.
+   *
+   * @default 0
+   */
+  readonly maxRetries?: number;
+
+  /**
+   * The maximum number of concurrent runs allowed for the job.
+   *
+   * An error is returned when this threshold is reached. The maximum value you can specify is controlled by a service limit.
+   *
+   * @default 1
+   */
+  readonly maxConcurrentRuns?: number;
+
+  /**
+   * The number of minutes to wait after a job run starts, before sending a job run delay notification.
+   *
+   * @default - no delay notifications
+   */
+  readonly notifyDelayAfter?: cdk.Duration;
+
+  /**
+   * The maximum time that a job run can consume resources before it is terminated and enters TIMEOUT status.
+   *
+   * @default cdk.Duration.hours(48)
+   */
+  readonly timeout?: cdk.Duration;
+
+  /**
+   * The type of predefined worker that is allocated when a job runs.
+   *
+   * @default - differs based on specific Glue version
+   */
+  readonly workerType?: WorkerType;
+
+  /**
+   * The number of workers of a defined {@link WorkerType} that are allocated when a job runs.
+   *
+   * @default - differs based on specific Glue version/worker type
+   */
+  readonly workerCount?: number;
+
+  /**
+   * The {@link Connection}s used for this job.
+   *
+   * Connections are used to connect to other AWS Service or resources within a VPC.
+   *
+   * @default [] - no connections are added to the job
+   */
+  readonly connections?: IConnection[];
+
+  /**
+   * The {@link SecurityConfiguration} to use for this job.
+   *
+   * @default - no security configuration.
+   */
+  readonly securityConfiguration?: ISecurityConfiguration;
+
+  /**
+   * The default arguments for this job, specified as name-value pairs.
+   *
+   * @see https://docs.aws.amazon.com/glue/latest/dg/aws-glue-programming-etl-glue-arguments.html for a list of reserved parameters
+   * @default - no arguments
+   */
+  readonly defaultArguments?: { [key: string]: string };
+
+  /**
+   * The tags to add to the resources on which the job runs
+   *
+   * @default {} - no tags
+   */
+  readonly tags?: { [key: string]: string };
+
+  /**
+   * The IAM role assumed by Glue to run this job.
+   *
+   * If providing a custom role, it needs to trust the Glue service principal (glue.amazonaws.com) and be granted sufficient permissions.
+   *
+   * @see https://docs.aws.amazon.com/glue/latest/dg/getting-started-access.html
+   *
+   * @default - a role is automatically generated
+   */
+  readonly role?: iam.IRole;
+
+  /**
+   * Enables the collection of metrics for job profiling.
+   *
+   * @default - no profiling metrics emitted.
+   *
+   * @see `--enable-metrics` at https://docs.aws.amazon.com/glue/latest/dg/aws-glue-programming-etl-glue-arguments.html
+   */
+  readonly enableProfilingMetrics? :boolean;
+
+  /**
+   * Enables the Spark UI debugging and monitoring with the specified props.
+   *
+   * @default - Spark UI debugging and monitoring is disabled.
+   *
+   * @see https://docs.aws.amazon.com/glue/latest/dg/monitor-spark-ui-jobs.html
+   * @see https://docs.aws.amazon.com/glue/latest/dg/aws-glue-programming-etl-glue-arguments.html
+   */
+  readonly sparkUI?: SparkUIProps,
+
+  /**
+   * Enables continuous logging with the specified props.
+   *
+   * @default - continuous logging is disabled.
+   *
+   * @see https://docs.aws.amazon.com/glue/latest/dg/monitor-continuous-logging-enable.html
+   * @see https://docs.aws.amazon.com/glue/latest/dg/aws-glue-programming-etl-glue-arguments.html
+   */
+  readonly continuousLogging?: ContinuousLoggingProps,
+}
+
+/**
+ * A Glue Job.
+ */
+export class Job extends JobBase {
+  /**
+   * Creates a Glue Job
+   *
+   * @param scope The scope creating construct (usually `this`).
+   * @param id The construct's id.
+   * @param attrs Import attributes
+   */
+  public static fromJobAttributes(scope: constructs.Construct, id: string, attrs: JobAttributes): IJob {
+    class Import extends JobBase {
+      public readonly jobName = attrs.jobName;
+      public readonly jobArn = jobArn(scope, attrs.jobName);
+      public readonly grantPrincipal = attrs.role ?? new iam.UnknownPrincipal({ resource: this });
+    }
+
+    return new Import(scope, id);
+  }
+
+  /**
+   * The ARN of the job.
+   */
+  public readonly jobArn: string;
+
+  /**
+   * The name of the job.
+   */
+  public readonly jobName: string;
+
+  /**
+   * The IAM role Glue assumes to run this job.
+   */
+  public readonly role: iam.IRole;
+
+  /**
+   * The principal this Glue Job is running as.
+   */
+  public readonly grantPrincipal: iam.IPrincipal;
+
+  /**
+   * The Spark UI logs location if Spark UI monitoring and debugging is enabled.
+   *
+   * @see https://docs.aws.amazon.com/glue/latest/dg/monitor-spark-ui-jobs.html
+   * @see https://docs.aws.amazon.com/glue/latest/dg/aws-glue-programming-etl-glue-arguments.html
+   */
+  public readonly sparkUILoggingLocation?: SparkUILoggingLocation;
+
+  constructor(scope: constructs.Construct, id: string, props: JobProps) {
+    super(scope, id, {
+      physicalName: props.jobName,
+    });
+
+    const executable = props.executable.bind();
+
+    this.role = props.role ?? new iam.Role(this, 'ServiceRole', {
+      assumedBy: new iam.ServicePrincipal('glue.amazonaws.com'),
+      managedPolicies: [iam.ManagedPolicy.fromAwsManagedPolicyName('service-role/AWSGlueServiceRole')],
+    });
+    this.grantPrincipal = this.role;
+
+    const sparkUI = props.sparkUI?.enabled ? this.setupSparkUI(executable, this.role, props.sparkUI) : undefined;
+    this.sparkUILoggingLocation = sparkUI?.location;
+    const continuousLoggingArgs = props.continuousLogging?.enabled ? this.setupContinuousLogging(this.role, props.continuousLogging) : {};
+    const profilingMetricsArgs = props.enableProfilingMetrics ? { '--enable-metrics': '' } : {};
+
+    const defaultArguments = {
+      ...this.executableArguments(executable),
+      ...continuousLoggingArgs,
+      ...profilingMetricsArgs,
+      ...sparkUI?.args,
+      ...this.checkNoReservedArgs(props.defaultArguments),
+    };
+
+    const jobResource = new CfnJob(this, 'Resource', {
+      name: props.jobName,
+      description: props.description,
+      role: this.role.roleArn,
+      command: {
+        name: executable.type.name,
+        scriptLocation: this.codeS3ObjectUrl(executable.script),
+        pythonVersion: executable.pythonVersion,
+      },
+      glueVersion: executable.glueVersion.name,
+      workerType: props.workerType?.name,
+      numberOfWorkers: props.workerCount,
+      maxCapacity: props.maxCapacity,
+      maxRetries: props.maxRetries,
+      executionProperty: props.maxConcurrentRuns ? { maxConcurrentRuns: props.maxConcurrentRuns } : undefined,
+      notificationProperty: props.notifyDelayAfter ? { notifyDelayAfter: props.notifyDelayAfter.toMinutes() } : undefined,
+      timeout: props.timeout?.toMinutes(),
+      connections: props.connections ? { connections: props.connections.map((connection) => connection.connectionName) } : undefined,
+      securityConfiguration: props.securityConfiguration?.securityConfigurationName,
+      tags: props.tags,
+      defaultArguments,
+    });
+
+    const resourceName = this.getResourceNameAttribute(jobResource.ref);
+    this.jobArn = jobArn(this, resourceName);
+    this.jobName = resourceName;
+  }
+
+  /**
+   * Check no usage of reserved arguments.
+   *
+   * @see https://docs.aws.amazon.com/glue/latest/dg/aws-glue-programming-etl-glue-arguments.html
+   */
+  private checkNoReservedArgs(defaultArguments?: { [key: string]: string }) {
+    if (defaultArguments) {
+      const reservedArgs = new Set(['--conf', '--debug', '--mode', '--JOB_NAME']);
+      Object.keys(defaultArguments).forEach((arg) => {
+        if (reservedArgs.has(arg)) {
+          throw new Error(`The ${arg} argument is reserved by Glue. Don't set it`);
+        }
+      });
+    }
+    return defaultArguments;
+  }
+
+  private executableArguments(config: JobExecutableConfig) {
+    const args: { [key: string]: string } = {};
+    args['--job-language'] = config.language;
+    if (config.className) {
+      args['--class'] = config.className;
+    }
+    if (config.extraJars && config.extraJars?.length > 0) {
+      args['--extra-jars'] = config.extraJars.map(code => this.codeS3ObjectUrl(code)).join(',');
+    }
+    if (config.extraPythonFiles && config.extraPythonFiles.length > 0) {
+      args['--extra-py-files'] = config.extraPythonFiles.map(code => this.codeS3ObjectUrl(code)).join(',');
+    }
+    if (config.extraFiles && config.extraFiles.length > 0) {
+      args['--extra-files'] = config.extraFiles.map(code => this.codeS3ObjectUrl(code)).join(',');
+    }
+    if (config.extraJarsFirst) {
+      args['--user-jars-first'] = 'true';
+    }
+    return args;
+  }
+
+  private setupSparkUI(executable: JobExecutableConfig, role: iam.IRole, props: SparkUIProps) {
+    if (JobType.PYTHON_SHELL === executable.type) {
+      throw new Error('Spark UI is not available for JobType.PYTHON_SHELL jobs');
+    }
+
+    const bucket = props.bucket ?? new s3.Bucket(this, 'SparkUIBucket');
+    bucket.grantReadWrite(role);
+    const args = {
+      '--enable-spark-ui': 'true',
+      '--spark-event-logs-path': bucket.s3UrlForObject(props.prefix),
+    };
+
+    return {
+      location: {
+        prefix: props.prefix,
+        bucket,
+      },
+      args,
+    };
+  }
+
+  private setupContinuousLogging(role: iam.IRole, props: ContinuousLoggingProps) {
+    const args: {[key: string]: string} = {
+      '--enable-continuous-cloudwatch-log': 'true',
+      '--enable-continuous-log-filter': (props.quiet ?? true).toString(),
+    };
+
+    if (props.logGroup) {
+      args['--continuous-log-logGroup'] = props.logGroup.logGroupName;
+      props.logGroup.grantWrite(role);
+    }
+
+    if (props.logStreamPrefix) {
+      args['--continuous-log-logStreamPrefix'] = props.logStreamPrefix;
+    }
+    if (props.conversionPattern) {
+      args['--continuous-log-conversionPattern'] = props.conversionPattern;
+    }
+    return args;
+  }
+
+  private codeS3ObjectUrl(code: Code) {
+    const s3Location = code.bind(this, this.role).s3Location;
+    return `s3://${s3Location.bucketName}/${s3Location.objectKey}`;
+  }
+}
+
+/**
+ * Create a CloudWatch Metric that's based on Glue Job events
+ * {@see https://docs.aws.amazon.com/AmazonCloudWatch/latest/events/EventTypes.html#glue-event-types}
+ * The metric has namespace = 'AWS/Events', metricName = 'TriggeredRules' and RuleName = rule.ruleName dimension.
+ *
+ * @param rule for use in setting RuleName dimension value
+ * @param props metric properties
+ */
+function metricRule(rule: events.IRule, props?: cloudwatch.MetricOptions): cloudwatch.Metric {
+  return new cloudwatch.Metric({
+    namespace: 'AWS/Events',
+    metricName: 'TriggeredRules',
+    dimensions: { RuleName: rule.ruleName },
+    statistic: cloudwatch.Statistic.SUM,
+    ...props,
+  }).attachTo(rule);
+}
+
+
+/**
+ * Returns the job arn
+ * @param scope
+ * @param jobName
+ */
+function jobArn(scope: constructs.Construct, jobName: string) : string {
+  return cdk.Stack.of(scope).formatArn({
+    service: 'glue',
+    resource: 'job',
+    resourceName: jobName,
+  });
+}
diff --git a/packages/@aws-cdk/aws-glue/package.json b/packages/@aws-cdk/aws-glue/package.json
index 5f11a3895db92..daaba9400606c 100644
--- a/packages/@aws-cdk/aws-glue/package.json
+++ b/packages/@aws-cdk/aws-glue/package.json
@@ -84,19 +84,29 @@
     "pkglint": "0.0.0"
   },
   "dependencies": {
+    "@aws-cdk/assets": "0.0.0",
+    "@aws-cdk/aws-cloudwatch": "0.0.0",
+    "@aws-cdk/aws-events": "0.0.0",
     "@aws-cdk/aws-ec2": "0.0.0",
     "@aws-cdk/aws-iam": "0.0.0",
+    "@aws-cdk/aws-logs": "0.0.0",
     "@aws-cdk/aws-kms": "0.0.0",
     "@aws-cdk/aws-s3": "0.0.0",
+    "@aws-cdk/aws-s3-assets": "0.0.0",
     "@aws-cdk/core": "0.0.0",
     "constructs": "^3.3.69"
   },
   "homepage": "https://github.com/aws/aws-cdk",
   "peerDependencies": {
+    "@aws-cdk/assets": "0.0.0",
+    "@aws-cdk/aws-cloudwatch": "0.0.0",
+    "@aws-cdk/aws-events": "0.0.0",
     "@aws-cdk/aws-ec2": "0.0.0",
     "@aws-cdk/aws-iam": "0.0.0",
+    "@aws-cdk/aws-logs": "0.0.0",
     "@aws-cdk/aws-kms": "0.0.0",
     "@aws-cdk/aws-s3": "0.0.0",
+    "@aws-cdk/aws-s3-assets": "0.0.0",
     "@aws-cdk/core": "0.0.0",
     "constructs": "^3.3.69"
   },
@@ -143,7 +153,8 @@
       "docs-public-apis:@aws-cdk/aws-glue.ClassificationString.XML",
       "docs-public-apis:@aws-cdk/aws-glue.ClassificationString.PARQUET",
       "docs-public-apis:@aws-cdk/aws-glue.ClassificationString.ORC",
-      "docs-public-apis:@aws-cdk/aws-glue.ClassificationString.value"
+      "docs-public-apis:@aws-cdk/aws-glue.ClassificationString.value",
+      "events-method-signature:@aws-cdk/aws-glue.Job.onStateChange"
     ]
   },
   "awscdkio": {
diff --git a/packages/@aws-cdk/aws-glue/test/code.test.ts b/packages/@aws-cdk/aws-glue/test/code.test.ts
new file mode 100644
index 0000000000000..061f6d26c351f
--- /dev/null
+++ b/packages/@aws-cdk/aws-glue/test/code.test.ts
@@ -0,0 +1,304 @@
+import * as path from 'path';
+import { Template } from '@aws-cdk/assertions';
+import * as s3 from '@aws-cdk/aws-s3';
+import * as cdk from '@aws-cdk/core';
+import * as glue from '../lib';
+
+describe('Code', () => {
+  let stack: cdk.Stack;
+  let script: glue.Code;
+
+  beforeEach(() => {
+    stack = new cdk.Stack();
+  });
+
+  describe('.fromBucket()', () => {
+    const key = 'script';
+    let bucket: s3.IBucket;
+
+    test('with valid bucket name and key and bound by job sets the right path and grants the job permissions to read from it', () => {
+      bucket = s3.Bucket.fromBucketName(stack, 'Bucket', 'bucketName');
+      script = glue.Code.fromBucket(bucket, key);
+      new glue.Job(stack, 'Job1', {
+        executable: glue.JobExecutable.pythonShell({
+          glueVersion: glue.GlueVersion.V1_0,
+          pythonVersion: glue.PythonVersion.THREE,
+          script,
+        }),
+      });
+
+      Template.fromStack(stack).hasResourceProperties('AWS::Glue::Job', {
+        Command: {
+          ScriptLocation: 's3://bucketName/script',
+        },
+      });
+
+      // Role policy should grant reading from the assets bucket
+      Template.fromStack(stack).hasResourceProperties('AWS::IAM::Policy', {
+        PolicyDocument: {
+          Statement: [
+            {
+              Action: [
+                's3:GetObject*',
+                's3:GetBucket*',
+                's3:List*',
+              ],
+              Effect: 'Allow',
+              Resource: [
+                {
+                  'Fn::Join': [
+                    '',
+                    [
+                      'arn:',
+                      {
+                        Ref: 'AWS::Partition',
+                      },
+                      ':s3:::bucketName',
+                    ],
+                  ],
+                },
+                {
+                  'Fn::Join': [
+                    '',
+                    [
+                      'arn:',
+                      {
+                        Ref: 'AWS::Partition',
+                      },
+                      ':s3:::bucketName/script',
+                    ],
+                  ],
+                },
+              ],
+            },
+          ],
+        },
+        Roles: [
+          {
+            Ref: 'Job1ServiceRole7AF34CCA',
+          },
+        ],
+      });
+    });
+  });
+
+  describe('.fromAsset()', () => {
+    const filePath = path.join(__dirname, 'job-script/hello_world.py');
+    const directoryPath = path.join(__dirname, 'job-script');
+
+    beforeEach(() => {
+      script = glue.Code.fromAsset(filePath);
+    });
+
+    test("with valid and existing file path and bound to job sets job's script location and permissions stack metadata", () => {
+      new glue.Job(stack, 'Job1', {
+        executable: glue.JobExecutable.pythonShell({
+          glueVersion: glue.GlueVersion.V1_0,
+          pythonVersion: glue.PythonVersion.THREE,
+          script,
+        }),
+      });
+
+      expect(stack.node.metadata.find(m => m.type === 'aws:cdk:asset')).toBeDefined();
+      Template.fromStack(stack).hasResourceProperties('AWS::Glue::Job', {
+        Command: {
+          ScriptLocation: {
+            'Fn::Join': [
+              '',
+              [
+                's3://',
+                {
+                  Ref: 'AssetParameters432033e3218068a915d2532fa9be7858a12b228a2ae6e5c10faccd9097b1e855S3Bucket4E517469',
+                },
+                '/',
+                {
+                  'Fn::Select': [
+                    0,
+                    {
+                      'Fn::Split': [
+                        '||',
+                        {
+                          Ref: 'AssetParameters432033e3218068a915d2532fa9be7858a12b228a2ae6e5c10faccd9097b1e855S3VersionKeyF7753763',
+                        },
+                      ],
+                    },
+                  ],
+                },
+                {
+                  'Fn::Select': [
+                    1,
+                    {
+                      'Fn::Split': [
+                        '||',
+                        {
+                          Ref: 'AssetParameters432033e3218068a915d2532fa9be7858a12b228a2ae6e5c10faccd9097b1e855S3VersionKeyF7753763',
+                        },
+                      ],
+                    },
+                  ],
+                },
+              ],
+            ],
+          },
+        },
+      });
+      // Role policy should grant reading from the assets bucket
+      Template.fromStack(stack).hasResourceProperties('AWS::IAM::Policy', {
+        PolicyDocument: {
+          Statement: [
+            {
+              Action: [
+                's3:GetObject*',
+                's3:GetBucket*',
+                's3:List*',
+              ],
+              Effect: 'Allow',
+              Resource: [
+                {
+                  'Fn::Join': [
+                    '',
+                    [
+                      'arn:',
+                      {
+                        Ref: 'AWS::Partition',
+                      },
+                      ':s3:::',
+                      {
+                        Ref: 'AssetParameters432033e3218068a915d2532fa9be7858a12b228a2ae6e5c10faccd9097b1e855S3Bucket4E517469',
+                      },
+                    ],
+                  ],
+                },
+                {
+                  'Fn::Join': [
+                    '',
+                    [
+                      'arn:',
+                      {
+                        Ref: 'AWS::Partition',
+                      },
+                      ':s3:::',
+                      {
+                        Ref: 'AssetParameters432033e3218068a915d2532fa9be7858a12b228a2ae6e5c10faccd9097b1e855S3Bucket4E517469',
+                      },
+                      '/*',
+                    ],
+                  ],
+                },
+              ],
+            },
+          ],
+        },
+        Roles: [
+          {
+            Ref: 'Job1ServiceRole7AF34CCA',
+          },
+        ],
+      });
+    });
+
+    test('with an unsupported directory path throws', () => {
+      expect(() => glue.Code.fromAsset(directoryPath))
+        .toThrow(/Only files are supported/);
+    });
+
+    test('used in more than 1 job in the same stack should be reused', () => {
+      new glue.Job(stack, 'Job1', {
+        executable: glue.JobExecutable.pythonShell({
+          glueVersion: glue.GlueVersion.V1_0,
+          pythonVersion: glue.PythonVersion.THREE,
+          script,
+        }),
+      });
+      new glue.Job(stack, 'Job2', {
+        executable: glue.JobExecutable.pythonShell({
+          glueVersion: glue.GlueVersion.V1_0,
+          pythonVersion: glue.PythonVersion.THREE,
+          script,
+        }),
+      });
+      const ScriptLocation = {
+        'Fn::Join': [
+          '',
+          [
+            's3://',
+            {
+              Ref: 'AssetParameters432033e3218068a915d2532fa9be7858a12b228a2ae6e5c10faccd9097b1e855S3Bucket4E517469',
+            },
+            '/',
+            {
+              'Fn::Select': [
+                0,
+                {
+                  'Fn::Split': [
+                    '||',
+                    {
+                      Ref: 'AssetParameters432033e3218068a915d2532fa9be7858a12b228a2ae6e5c10faccd9097b1e855S3VersionKeyF7753763',
+                    },
+                  ],
+                },
+              ],
+            },
+            {
+              'Fn::Select': [
+                1,
+                {
+                  'Fn::Split': [
+                    '||',
+                    {
+                      Ref: 'AssetParameters432033e3218068a915d2532fa9be7858a12b228a2ae6e5c10faccd9097b1e855S3VersionKeyF7753763',
+                    },
+                  ],
+                },
+              ],
+            },
+          ],
+        ],
+      };
+
+      expect(stack.node.metadata.find(m => m.type === 'aws:cdk:asset')).toBeDefined();
+      // Job1 and Job2 use reuse the asset
+      Template.fromStack(stack).hasResourceProperties('AWS::Glue::Job', {
+        Command: {
+          ScriptLocation,
+        },
+        Role: {
+          'Fn::GetAtt': [
+            'Job1ServiceRole7AF34CCA',
+            'Arn',
+          ],
+        },
+      });
+      Template.fromStack(stack).hasResourceProperties('AWS::Glue::Job', {
+        Command: {
+          ScriptLocation,
+        },
+        Role: {
+          'Fn::GetAtt': [
+            'Job2ServiceRole5D2B98FE',
+            'Arn',
+          ],
+        },
+      });
+    });
+
+    test('throws if trying to rebind in another stack', () => {
+      new glue.Job(stack, 'Job1', {
+        executable: glue.JobExecutable.pythonShell({
+          glueVersion: glue.GlueVersion.V1_0,
+          pythonVersion: glue.PythonVersion.THREE,
+          script,
+        }),
+      });
+      const differentStack = new cdk.Stack();
+
+      expect(() => new glue.Job(differentStack, 'Job2', {
+        executable: glue.JobExecutable.pythonShell({
+          glueVersion: glue.GlueVersion.V1_0,
+          pythonVersion: glue.PythonVersion.THREE,
+          script: script,
+        }),
+      })).toThrow(/associated with another stack/);
+    });
+  });
+});
\ No newline at end of file
diff --git a/packages/@aws-cdk/aws-glue/test/integ.job.expected.json b/packages/@aws-cdk/aws-glue/test/integ.job.expected.json
new file mode 100644
index 0000000000000..61f4f60434db1
--- /dev/null
+++ b/packages/@aws-cdk/aws-glue/test/integ.job.expected.json
@@ -0,0 +1,571 @@
+{
+  "Resources": {
+    "EtlJobServiceRole837F781B": {
+      "Type": "AWS::IAM::Role",
+      "Properties": {
+        "AssumeRolePolicyDocument": {
+          "Statement": [
+            {
+              "Action": "sts:AssumeRole",
+              "Effect": "Allow",
+              "Principal": {
+                "Service": "glue.amazonaws.com"
+              }
+            }
+          ],
+          "Version": "2012-10-17"
+        },
+        "ManagedPolicyArns": [
+          {
+            "Fn::Join": [
+              "",
+              [
+                "arn:",
+                {
+                  "Ref": "AWS::Partition"
+                },
+                ":iam::aws:policy/service-role/AWSGlueServiceRole"
+              ]
+            ]
+          }
+        ]
+      }
+    },
+    "EtlJobServiceRoleDefaultPolicy8BFE343B": {
+      "Type": "AWS::IAM::Policy",
+      "Properties": {
+        "PolicyDocument": {
+          "Statement": [
+            {
+              "Action": [
+                "s3:GetObject*",
+                "s3:GetBucket*",
+                "s3:List*",
+                "s3:DeleteObject*",
+                "s3:PutObject",
+                "s3:Abort*"
+              ],
+              "Effect": "Allow",
+              "Resource": [
+                {
+                  "Fn::GetAtt": [
+                    "EtlJobSparkUIBucketBF23744B",
+                    "Arn"
+                  ]
+                },
+                {
+                  "Fn::Join": [
+                    "",
+                    [
+                      {
+                        "Fn::GetAtt": [
+                          "EtlJobSparkUIBucketBF23744B",
+                          "Arn"
+                        ]
+                      },
+                      "/*"
+                    ]
+                  ]
+                }
+              ]
+            },
+            {
+              "Action": [
+                "s3:GetObject*",
+                "s3:GetBucket*",
+                "s3:List*"
+              ],
+              "Effect": "Allow",
+              "Resource": [
+                {
+                  "Fn::Join": [
+                    "",
+                    [
+                      "arn:",
+                      {
+                        "Ref": "AWS::Partition"
+                      },
+                      ":s3:::",
+                      {
+                        "Ref": "AssetParameters432033e3218068a915d2532fa9be7858a12b228a2ae6e5c10faccd9097b1e855S3Bucket4E517469"
+                      }
+                    ]
+                  ]
+                },
+                {
+                  "Fn::Join": [
+                    "",
+                    [
+                      "arn:",
+                      {
+                        "Ref": "AWS::Partition"
+                      },
+                      ":s3:::",
+                      {
+                        "Ref": "AssetParameters432033e3218068a915d2532fa9be7858a12b228a2ae6e5c10faccd9097b1e855S3Bucket4E517469"
+                      },
+                      "/*"
+                    ]
+                  ]
+                }
+              ]
+            }
+          ],
+          "Version": "2012-10-17"
+        },
+        "PolicyName": "EtlJobServiceRoleDefaultPolicy8BFE343B",
+        "Roles": [
+          {
+            "Ref": "EtlJobServiceRole837F781B"
+          }
+        ]
+      }
+    },
+    "EtlJobSparkUIBucketBF23744B": {
+      "Type": "AWS::S3::Bucket",
+      "UpdateReplacePolicy": "Retain",
+      "DeletionPolicy": "Retain"
+    },
+    "EtlJob7FC88E45": {
+      "Type": "AWS::Glue::Job",
+      "Properties": {
+        "Command": {
+          "Name": "glueetl",
+          "PythonVersion": "3",
+          "ScriptLocation": {
+            "Fn::Join": [
+              "",
+              [
+                "s3://",
+                {
+                  "Ref": "AssetParameters432033e3218068a915d2532fa9be7858a12b228a2ae6e5c10faccd9097b1e855S3Bucket4E517469"
+                },
+                "/",
+                {
+                  "Fn::Select": [
+                    0,
+                    {
+                      "Fn::Split": [
+                        "||",
+                        {
+                          "Ref": "AssetParameters432033e3218068a915d2532fa9be7858a12b228a2ae6e5c10faccd9097b1e855S3VersionKeyF7753763"
+                        }
+                      ]
+                    }
+                  ]
+                },
+                {
+                  "Fn::Select": [
+                    1,
+                    {
+                      "Fn::Split": [
+                        "||",
+                        {
+                          "Ref": "AssetParameters432033e3218068a915d2532fa9be7858a12b228a2ae6e5c10faccd9097b1e855S3VersionKeyF7753763"
+                        }
+                      ]
+                    }
+                  ]
+                }
+              ]
+            ]
+          }
+        },
+        "Role": {
+          "Fn::GetAtt": [
+            "EtlJobServiceRole837F781B",
+            "Arn"
+          ]
+        },
+        "DefaultArguments": {
+          "--job-language": "python",
+          "--enable-continuous-cloudwatch-log": "true",
+          "--enable-continuous-log-filter": "true",
+          "--continuous-log-logStreamPrefix": "EtlJob",
+          "--enable-spark-ui": "true",
+          "--spark-event-logs-path": {
+            "Fn::Join": [
+              "",
+              [
+                "s3://",
+                {
+                  "Ref": "EtlJobSparkUIBucketBF23744B"
+                }
+              ]
+            ]
+          },
+          "arg1": "value1",
+          "arg2": "value2"
+        },
+        "ExecutionProperty": {
+          "MaxConcurrentRuns": 2
+        },
+        "GlueVersion": "2.0",
+        "MaxRetries": 2,
+        "Name": "EtlJob",
+        "NotificationProperty": {
+          "NotifyDelayAfter": 1
+        },
+        "NumberOfWorkers": 10,
+        "Tags": {
+          "key": "value"
+        },
+        "Timeout": 5,
+        "WorkerType": "G.2X"
+      }
+    },
+    "EtlJobSuccessMetricRuleA72A3EF6": {
+      "Type": "AWS::Events::Rule",
+      "Properties": {
+        "Description": {
+          "Fn::Join": [
+            "",
+            [
+              "Rule triggered when Glue job ",
+              {
+                "Ref": "EtlJob7FC88E45"
+              },
+              " is in SUCCEEDED state"
+            ]
+          ]
+        },
+        "EventPattern": {
+          "source": [
+            "aws.glue"
+          ],
+          "detail-type": [
+            "Glue Job State Change",
+            "Glue Job Run Status"
+          ],
+          "detail": {
+            "jobName": [
+              {
+                "Ref": "EtlJob7FC88E45"
+              }
+            ],
+            "state": [
+              "SUCCEEDED"
+            ]
+          }
+        },
+        "State": "ENABLED"
+      }
+    },
+    "StreamingJobServiceRole1B4B8BF9": {
+      "Type": "AWS::IAM::Role",
+      "Properties": {
+        "AssumeRolePolicyDocument": {
+          "Statement": [
+            {
+              "Action": "sts:AssumeRole",
+              "Effect": "Allow",
+              "Principal": {
+                "Service": "glue.amazonaws.com"
+              }
+            }
+          ],
+          "Version": "2012-10-17"
+        },
+        "ManagedPolicyArns": [
+          {
+            "Fn::Join": [
+              "",
+              [
+                "arn:",
+                {
+                  "Ref": "AWS::Partition"
+                },
+                ":iam::aws:policy/service-role/AWSGlueServiceRole"
+              ]
+            ]
+          }
+        ]
+      }
+    },
+    "StreamingJobServiceRoleDefaultPolicyA0CC4C68": {
+      "Type": "AWS::IAM::Policy",
+      "Properties": {
+        "PolicyDocument": {
+          "Statement": [
+            {
+              "Action": [
+                "s3:GetObject*",
+                "s3:GetBucket*",
+                "s3:List*"
+              ],
+              "Effect": "Allow",
+              "Resource": [
+                {
+                  "Fn::Join": [
+                    "",
+                    [
+                      "arn:",
+                      {
+                        "Ref": "AWS::Partition"
+                      },
+                      ":s3:::",
+                      {
+                        "Ref": "AssetParameters432033e3218068a915d2532fa9be7858a12b228a2ae6e5c10faccd9097b1e855S3Bucket4E517469"
+                      }
+                    ]
+                  ]
+                },
+                {
+                  "Fn::Join": [
+                    "",
+                    [
+                      "arn:",
+                      {
+                        "Ref": "AWS::Partition"
+                      },
+                      ":s3:::",
+                      {
+                        "Ref": "AssetParameters432033e3218068a915d2532fa9be7858a12b228a2ae6e5c10faccd9097b1e855S3Bucket4E517469"
+                      },
+                      "/*"
+                    ]
+                  ]
+                }
+              ]
+            }
+          ],
+          "Version": "2012-10-17"
+        },
+        "PolicyName": "StreamingJobServiceRoleDefaultPolicyA0CC4C68",
+        "Roles": [
+          {
+            "Ref": "StreamingJobServiceRole1B4B8BF9"
+          }
+        ]
+      }
+    },
+    "StreamingJob3783CC17": {
+      "Type": "AWS::Glue::Job",
+      "Properties": {
+        "Command": {
+          "Name": "gluestreaming",
+          "PythonVersion": "3",
+          "ScriptLocation": {
+            "Fn::Join": [
+              "",
+              [
+                "s3://",
+                {
+                  "Ref": "AssetParameters432033e3218068a915d2532fa9be7858a12b228a2ae6e5c10faccd9097b1e855S3Bucket4E517469"
+                },
+                "/",
+                {
+                  "Fn::Select": [
+                    0,
+                    {
+                      "Fn::Split": [
+                        "||",
+                        {
+                          "Ref": "AssetParameters432033e3218068a915d2532fa9be7858a12b228a2ae6e5c10faccd9097b1e855S3VersionKeyF7753763"
+                        }
+                      ]
+                    }
+                  ]
+                },
+                {
+                  "Fn::Select": [
+                    1,
+                    {
+                      "Fn::Split": [
+                        "||",
+                        {
+                          "Ref": "AssetParameters432033e3218068a915d2532fa9be7858a12b228a2ae6e5c10faccd9097b1e855S3VersionKeyF7753763"
+                        }
+                      ]
+                    }
+                  ]
+                }
+              ]
+            ]
+          }
+        },
+        "Role": {
+          "Fn::GetAtt": [
+            "StreamingJobServiceRole1B4B8BF9",
+            "Arn"
+          ]
+        },
+        "DefaultArguments": {
+          "--job-language": "python",
+          "arg1": "value1",
+          "arg2": "value2"
+        },
+        "GlueVersion": "2.0",
+        "Name": "StreamingJob",
+        "Tags": {
+          "key": "value"
+        }
+      }
+    },
+    "ShellJobServiceRoleCF97BC4B": {
+      "Type": "AWS::IAM::Role",
+      "Properties": {
+        "AssumeRolePolicyDocument": {
+          "Statement": [
+            {
+              "Action": "sts:AssumeRole",
+              "Effect": "Allow",
+              "Principal": {
+                "Service": "glue.amazonaws.com"
+              }
+            }
+          ],
+          "Version": "2012-10-17"
+        },
+        "ManagedPolicyArns": [
+          {
+            "Fn::Join": [
+              "",
+              [
+                "arn:",
+                {
+                  "Ref": "AWS::Partition"
+                },
+                ":iam::aws:policy/service-role/AWSGlueServiceRole"
+              ]
+            ]
+          }
+        ]
+      }
+    },
+    "ShellJobServiceRoleDefaultPolicy7F22D315": {
+      "Type": "AWS::IAM::Policy",
+      "Properties": {
+        "PolicyDocument": {
+          "Statement": [
+            {
+              "Action": [
+                "s3:GetObject*",
+                "s3:GetBucket*",
+                "s3:List*"
+              ],
+              "Effect": "Allow",
+              "Resource": [
+                {
+                  "Fn::Join": [
+                    "",
+                    [
+                      "arn:",
+                      {
+                        "Ref": "AWS::Partition"
+                      },
+                      ":s3:::",
+                      {
+                        "Ref": "AssetParameters432033e3218068a915d2532fa9be7858a12b228a2ae6e5c10faccd9097b1e855S3Bucket4E517469"
+                      }
+                    ]
+                  ]
+                },
+                {
+                  "Fn::Join": [
+                    "",
+                    [
+                      "arn:",
+                      {
+                        "Ref": "AWS::Partition"
+                      },
+                      ":s3:::",
+                      {
+                        "Ref": "AssetParameters432033e3218068a915d2532fa9be7858a12b228a2ae6e5c10faccd9097b1e855S3Bucket4E517469"
+                      },
+                      "/*"
+                    ]
+                  ]
+                }
+              ]
+            }
+          ],
+          "Version": "2012-10-17"
+        },
+        "PolicyName": "ShellJobServiceRoleDefaultPolicy7F22D315",
+        "Roles": [
+          {
+            "Ref": "ShellJobServiceRoleCF97BC4B"
+          }
+        ]
+      }
+    },
+    "ShellJob42E81F95": {
+      "Type": "AWS::Glue::Job",
+      "Properties": {
+        "Command": {
+          "Name": "pythonshell",
+          "PythonVersion": "3",
+          "ScriptLocation": {
+            "Fn::Join": [
+              "",
+              [
+                "s3://",
+                {
+                  "Ref": "AssetParameters432033e3218068a915d2532fa9be7858a12b228a2ae6e5c10faccd9097b1e855S3Bucket4E517469"
+                },
+                "/",
+                {
+                  "Fn::Select": [
+                    0,
+                    {
+                      "Fn::Split": [
+                        "||",
+                        {
+                          "Ref": "AssetParameters432033e3218068a915d2532fa9be7858a12b228a2ae6e5c10faccd9097b1e855S3VersionKeyF7753763"
+                        }
+                      ]
+                    }
+                  ]
+                },
+                {
+                  "Fn::Select": [
+                    1,
+                    {
+                      "Fn::Split": [
+                        "||",
+                        {
+                          "Ref": "AssetParameters432033e3218068a915d2532fa9be7858a12b228a2ae6e5c10faccd9097b1e855S3VersionKeyF7753763"
+                        }
+                      ]
+                    }
+                  ]
+                }
+              ]
+            ]
+          }
+        },
+        "Role": {
+          "Fn::GetAtt": [
+            "ShellJobServiceRoleCF97BC4B",
+            "Arn"
+          ]
+        },
+        "DefaultArguments": {
+          "--job-language": "python",
+          "arg1": "value1",
+          "arg2": "value2"
+        },
+        "GlueVersion": "1.0",
+        "Name": "ShellJob",
+        "Tags": {
+          "key": "value"
+        }
+      }
+    }
+  },
+  "Parameters": {
+    "AssetParameters432033e3218068a915d2532fa9be7858a12b228a2ae6e5c10faccd9097b1e855S3Bucket4E517469": {
+      "Type": "String",
+      "Description": "S3 bucket for asset \"432033e3218068a915d2532fa9be7858a12b228a2ae6e5c10faccd9097b1e855\""
+    },
+    "AssetParameters432033e3218068a915d2532fa9be7858a12b228a2ae6e5c10faccd9097b1e855S3VersionKeyF7753763": {
+      "Type": "String",
+      "Description": "S3 key for asset version \"432033e3218068a915d2532fa9be7858a12b228a2ae6e5c10faccd9097b1e855\""
+    },
+    "AssetParameters432033e3218068a915d2532fa9be7858a12b228a2ae6e5c10faccd9097b1e855ArtifactHash0C610005": {
+      "Type": "String",
+      "Description": "Artifact hash for asset \"432033e3218068a915d2532fa9be7858a12b228a2ae6e5c10faccd9097b1e855\""
+    }
+  }
+}
\ No newline at end of file
diff --git a/packages/@aws-cdk/aws-glue/test/integ.job.ts b/packages/@aws-cdk/aws-glue/test/integ.job.ts
new file mode 100644
index 0000000000000..fedbc0b8b8428
--- /dev/null
+++ b/packages/@aws-cdk/aws-glue/test/integ.job.ts
@@ -0,0 +1,89 @@
+import * as path from 'path';
+import * as cdk from '@aws-cdk/core';
+import * as glue from '../lib';
+
+/**
+ * To verify the ability to run jobs created in this test
+ *
+ * Run the job using
+ *   `aws glue start-job-run --region us-east-1 --job-name <job name>`
+ * This will return a runId
+ *
+ * Get the status of the job run using
+ *   `aws glue get-job-run --region us-east-1 --job-name <job name> --run-id <runId>`
+ *
+ * For example, to test the ShellJob
+ * - Run: `aws glue start-job-run --region us-east-1 --job-name ShellJob`
+ * - Get Status: `aws glue get-job-run --region us-east-1 --job-name ShellJob --run-id <runId output by the above command>`
+ * - Check output: `aws logs get-log-events --region us-east-1 --log-group-name "/aws-glue/python-jobs/output" --log-stream-name "<runId>>` which should show "hello world"
+ */
+const app = new cdk.App();
+
+const stack = new cdk.Stack(app, 'aws-glue-job');
+
+const script = glue.Code.fromAsset(path.join(__dirname, 'job-script/hello_world.py'));
+
+const etlJob = new glue.Job(stack, 'EtlJob', {
+  jobName: 'EtlJob',
+  executable: glue.JobExecutable.pythonEtl({
+    glueVersion: glue.GlueVersion.V2_0,
+    pythonVersion: glue.PythonVersion.THREE,
+    script,
+  }),
+  workerType: glue.WorkerType.G_2X,
+  workerCount: 10,
+  maxConcurrentRuns: 2,
+  maxRetries: 2,
+  timeout: cdk.Duration.minutes(5),
+  notifyDelayAfter: cdk.Duration.minutes(1),
+  defaultArguments: {
+    arg1: 'value1',
+    arg2: 'value2',
+  },
+  sparkUI: {
+    enabled: true,
+  },
+  continuousLogging: {
+    enabled: true,
+    quiet: true,
+    logStreamPrefix: 'EtlJob',
+  },
+  tags: {
+    key: 'value',
+  },
+});
+etlJob.metricSuccess();
+
+new glue.Job(stack, 'StreamingJob', {
+  jobName: 'StreamingJob',
+  executable: glue.JobExecutable.pythonStreaming({
+    glueVersion: glue.GlueVersion.V2_0,
+    pythonVersion: glue.PythonVersion.THREE,
+    script,
+  }),
+  defaultArguments: {
+    arg1: 'value1',
+    arg2: 'value2',
+  },
+  tags: {
+    key: 'value',
+  },
+});
+
+new glue.Job(stack, 'ShellJob', {
+  jobName: 'ShellJob',
+  executable: glue.JobExecutable.pythonShell({
+    glueVersion: glue.GlueVersion.V1_0,
+    pythonVersion: glue.PythonVersion.THREE,
+    script,
+  }),
+  defaultArguments: {
+    arg1: 'value1',
+    arg2: 'value2',
+  },
+  tags: {
+    key: 'value',
+  },
+});
+
+app.synth();
diff --git a/packages/@aws-cdk/aws-glue/test/job-executable.test.ts b/packages/@aws-cdk/aws-glue/test/job-executable.test.ts
new file mode 100644
index 0000000000000..481bd16dc8944
--- /dev/null
+++ b/packages/@aws-cdk/aws-glue/test/job-executable.test.ts
@@ -0,0 +1,106 @@
+import * as s3 from '@aws-cdk/aws-s3';
+import * as cdk from '@aws-cdk/core';
+import * as glue from '../lib';
+
+describe('GlueVersion', () => {
+  test('.V0_9 should set the name correctly', () => expect(glue.GlueVersion.V0_9.name).toEqual('0.9'));
+
+  test('.V1_0 should set the name correctly', () => expect(glue.GlueVersion.V1_0.name).toEqual('1.0'));
+
+  test('.V2_0 should set the name correctly', () => expect(glue.GlueVersion.V2_0.name).toEqual('2.0'));
+
+  test('.V3_0 should set the name correctly', () => expect(glue.GlueVersion.V3_0.name).toEqual('3.0'));
+
+  test('of(customVersion) should set the name correctly', () => expect(glue.GlueVersion.of('CustomVersion').name).toEqual('CustomVersion'));
+});
+
+describe('JobType', () => {
+  test('.ETL should set the name correctly', () => expect(glue.JobType.ETL.name).toEqual('glueetl'));
+
+  test('.STREAMING should set the name correctly', () => expect(glue.JobType.STREAMING.name).toEqual('gluestreaming'));
+
+  test('.PYTHON_SHELL should set the name correctly', () => expect(glue.JobType.PYTHON_SHELL.name).toEqual('pythonshell'));
+
+  test('of(customName) should set the name correctly', () => expect(glue.JobType.of('CustomName').name).toEqual('CustomName'));
+});
+
+describe('JobExecutable', () => {
+  let stack: cdk.Stack;
+  let bucket: s3.IBucket;
+  let script: glue.Code;
+
+  beforeEach(() => {
+    stack = new cdk.Stack();
+    bucket = s3.Bucket.fromBucketName(stack, 'Bucket', 'bucketName');
+    script = glue.Code.fromBucket(bucket, 'script.py');
+  });
+
+  describe('.of()', () => {
+    test('with valid config should succeed', () => {
+      expect(glue.JobExecutable.of({
+        glueVersion: glue.GlueVersion.V1_0,
+        type: glue.JobType.PYTHON_SHELL,
+        language: glue.JobLanguage.PYTHON,
+        pythonVersion: glue.PythonVersion.THREE,
+        script,
+      })).toBeDefined();
+    });
+
+    test('with JobType.PYTHON_SHELL and a language other than JobLanguage.PYTHON should throw', () => {
+      expect(() => glue.JobExecutable.of({
+        glueVersion: glue.GlueVersion.V3_0,
+        type: glue.JobType.PYTHON_SHELL,
+        language: glue.JobLanguage.SCALA,
+        script,
+      })).toThrow(/Python shell requires the language to be set to Python/);
+    });
+
+    test('with a non JobLanguage.PYTHON and extraPythonFiles set should throw', () => {
+      expect(() => glue.JobExecutable.of({
+        glueVersion: glue.GlueVersion.V3_0,
+        type: glue.JobType.ETL,
+        language: glue.JobLanguage.SCALA,
+        className: 'com.Test',
+        extraPythonFiles: [script],
+        script,
+      })).toThrow(/extraPythonFiles is not supported for languages other than JobLanguage.PYTHON/);
+    });
+
+    [glue.GlueVersion.V0_9, glue.GlueVersion.V2_0, glue.GlueVersion.V3_0].forEach((glueVersion) => {
+      test(`with JobType.PYTHON_SHELL and GlueVersion ${glueVersion} should throw`, () => {
+        expect(() => glue.JobExecutable.of({
+          type: glue.JobType.PYTHON_SHELL,
+          language: glue.JobLanguage.PYTHON,
+          pythonVersion: glue.PythonVersion.TWO,
+          script,
+          glueVersion,
+        })).toThrow(`Specified GlueVersion ${glueVersion.name} does not support Python Shell`);
+      });
+    });
+
+    [glue.GlueVersion.V0_9, glue.GlueVersion.V1_0].forEach((glueVersion) => {
+      test(`with extraJarsFirst set and GlueVersion ${glueVersion.name} should throw`, () => {
+        expect(() => glue.JobExecutable.of({
+          type: glue.JobType.ETL,
+          language: glue.JobLanguage.PYTHON,
+          pythonVersion: glue.PythonVersion.TWO,
+          extraJarsFirst: true,
+          script,
+          glueVersion,
+        })).toThrow(`Specified GlueVersion ${glueVersion.name} does not support extraJarsFirst`);
+      });
+    });
+
+    [glue.GlueVersion.V2_0, glue.GlueVersion.V3_0].forEach((glueVersion) => {
+      test(`with PythonVersion.TWO and GlueVersion ${glueVersion} should throw`, () => {
+        expect(() => glue.JobExecutable.of({
+          type: glue.JobType.ETL,
+          language: glue.JobLanguage.PYTHON,
+          pythonVersion: glue.PythonVersion.TWO,
+          script,
+          glueVersion,
+        })).toThrow(`Specified GlueVersion ${glueVersion.name} does not support PythonVersion 2`);
+      });
+    });
+  });
+});
\ No newline at end of file
diff --git a/packages/@aws-cdk/aws-glue/test/job-script/hello_world.py b/packages/@aws-cdk/aws-glue/test/job-script/hello_world.py
new file mode 100644
index 0000000000000..e75154b7c390f
--- /dev/null
+++ b/packages/@aws-cdk/aws-glue/test/job-script/hello_world.py
@@ -0,0 +1 @@
+print("hello world")
\ No newline at end of file
diff --git a/packages/@aws-cdk/aws-glue/test/job-script/hello_world_2.py b/packages/@aws-cdk/aws-glue/test/job-script/hello_world_2.py
new file mode 100644
index 0000000000000..e75154b7c390f
--- /dev/null
+++ b/packages/@aws-cdk/aws-glue/test/job-script/hello_world_2.py
@@ -0,0 +1 @@
+print("hello world")
\ No newline at end of file
diff --git a/packages/@aws-cdk/aws-glue/test/job.test.ts b/packages/@aws-cdk/aws-glue/test/job.test.ts
new file mode 100644
index 0000000000000..625e4743570fd
--- /dev/null
+++ b/packages/@aws-cdk/aws-glue/test/job.test.ts
@@ -0,0 +1,842 @@
+import { Template } from '@aws-cdk/assertions';
+import * as cloudwatch from '@aws-cdk/aws-cloudwatch';
+import * as events from '@aws-cdk/aws-events';
+import * as iam from '@aws-cdk/aws-iam';
+import * as logs from '@aws-cdk/aws-logs';
+import * as s3 from '@aws-cdk/aws-s3';
+import * as cdk from '@aws-cdk/core';
+import * as glue from '../lib';
+
+describe('WorkerType', () => {
+  test('.STANDARD should set the name correctly', () => expect(glue.WorkerType.STANDARD.name).toEqual('Standard'));
+
+  test('.G_1X should set the name correctly', () => expect(glue.WorkerType.G_1X.name).toEqual('G.1X'));
+
+  test('.G_2X should set the name correctly', () => expect(glue.WorkerType.G_2X.name).toEqual('G.2X'));
+
+  test('of(customType) should set name correctly', () => expect(glue.WorkerType.of('CustomType').name).toEqual('CustomType'));
+});
+
+describe('Job', () => {
+  const jobName = 'test-job';
+  let stack: cdk.Stack;
+
+  beforeEach(() => {
+    stack = new cdk.Stack();
+  });
+
+  describe('.fromJobAttributes()', () => {
+    test('with required attrs only', () => {
+      const job = glue.Job.fromJobAttributes(stack, 'ImportedJob', { jobName });
+
+      expect(job.jobName).toEqual(jobName);
+      expect(job.jobArn).toEqual(stack.formatArn({
+        service: 'glue',
+        resource: 'job',
+        resourceName: jobName,
+      }));
+      expect(job.grantPrincipal).toEqual(new iam.UnknownPrincipal({ resource: job }));
+    });
+
+    test('with all attrs', () => {
+      const role = iam.Role.fromRoleArn(stack, 'Role', 'arn:aws:iam::123456789012:role/TestRole');
+      const job = glue.Job.fromJobAttributes(stack, 'ImportedJob', { jobName, role });
+
+      expect(job.jobName).toEqual(jobName);
+      expect(job.jobArn).toEqual(stack.formatArn({
+        service: 'glue',
+        resource: 'job',
+        resourceName: jobName,
+      }));
+      expect(job.grantPrincipal).toEqual(role);
+    });
+  });
+
+
+  describe('new', () => {
+    const className = 'com.amazon.test.ClassName';
+    const codeBucketName = 'bucketName';
+    const codeBucketAccessStatement = {
+      Action: [
+        's3:GetObject*',
+        's3:GetBucket*',
+        's3:List*',
+      ],
+      Effect: 'Allow',
+      Resource: [
+        {
+          'Fn::Join': [
+            '',
+            [
+              'arn:',
+              {
+                Ref: 'AWS::Partition',
+              },
+              `:s3:::${codeBucketName}`,
+            ],
+          ],
+        },
+        {
+          'Fn::Join': [
+            '',
+            [
+              'arn:',
+              {
+                Ref: 'AWS::Partition',
+              },
+              `:s3:::${codeBucketName}/script`,
+            ],
+          ],
+        },
+      ],
+    };
+    let codeBucket: s3.IBucket;
+    let script: glue.Code;
+    let extraJars: glue.Code[];
+    let extraFiles: glue.Code[];
+    let extraPythonFiles: glue.Code[];
+    let job: glue.Job;
+    let defaultProps: glue.JobProps;
+
+    beforeEach(() => {
+      codeBucket = s3.Bucket.fromBucketName(stack, 'CodeBucket', codeBucketName);
+      script = glue.Code.fromBucket(codeBucket, 'script');
+      extraJars = [glue.Code.fromBucket(codeBucket, 'file1.jar'), glue.Code.fromBucket(codeBucket, 'file2.jar')];
+      extraPythonFiles = [glue.Code.fromBucket(codeBucket, 'file1.py'), glue.Code.fromBucket(codeBucket, 'file2.py')];
+      extraFiles = [glue.Code.fromBucket(codeBucket, 'file1.txt'), glue.Code.fromBucket(codeBucket, 'file2.txt')];
+      defaultProps = {
+        executable: glue.JobExecutable.scalaEtl({
+          glueVersion: glue.GlueVersion.V2_0,
+          className,
+          script,
+        }),
+      };
+    });
+
+    describe('with necessary props only', () => {
+      beforeEach(() => {
+        job = new glue.Job(stack, 'Job', defaultProps);
+      });
+
+      test('should create a role and use it with the job', () => {
+        Template.fromStack(stack).hasResourceProperties('AWS::IAM::Role', {
+          AssumeRolePolicyDocument: {
+            Statement: [
+              {
+                Action: 'sts:AssumeRole',
+                Effect: 'Allow',
+                Principal: {
+                  Service: 'glue.amazonaws.com',
+                },
+              },
+            ],
+            Version: '2012-10-17',
+          },
+          ManagedPolicyArns: [
+            {
+              'Fn::Join': [
+                '',
+                [
+                  'arn:',
+                  {
+                    Ref: 'AWS::Partition',
+                  },
+                  ':iam::aws:policy/service-role/AWSGlueServiceRole',
+                ],
+              ],
+            },
+          ],
+        });
+
+        // Role policy should grant reading from the assets bucket
+        Template.fromStack(stack).hasResourceProperties('AWS::IAM::Policy', {
+          PolicyDocument: {
+            Statement: [
+              codeBucketAccessStatement,
+            ],
+          },
+          Roles: [
+            {
+              Ref: 'JobServiceRole4F432993',
+            },
+          ],
+        });
+
+        // check the job using the role
+        Template.fromStack(stack).hasResourceProperties('AWS::Glue::Job', {
+          Command: {
+            Name: 'glueetl',
+            ScriptLocation: 's3://bucketName/script',
+          },
+          Role: {
+            'Fn::GetAtt': [
+              'JobServiceRole4F432993',
+              'Arn',
+            ],
+          },
+        });
+      });
+
+      test('should return correct jobName and jobArn from CloudFormation', () => {
+        expect(stack.resolve(job.jobName)).toEqual({ Ref: 'JobB9D00F9F' });
+        expect(stack.resolve(job.jobArn)).toEqual({
+          'Fn::Join': ['', ['arn:', { Ref: 'AWS::Partition' }, ':glue:', { Ref: 'AWS::Region' }, ':', { Ref: 'AWS::AccountId' }, ':job/', { Ref: 'JobB9D00F9F' }]],
+        });
+      });
+
+      test('with a custom role should use it and set it in CloudFormation', () => {
+        const role = iam.Role.fromRoleArn(stack, 'Role', 'arn:aws:iam::123456789012:role/TestRole');
+        job = new glue.Job(stack, 'JobWithRole', {
+          ...defaultProps,
+          role,
+        });
+
+        expect(job.grantPrincipal).toEqual(role);
+        Template.fromStack(stack).hasResourceProperties('AWS::Glue::Job', {
+          Role: role.roleArn,
+        });
+      });
+
+      test('with a custom jobName should set it in CloudFormation', () => {
+        job = new glue.Job(stack, 'JobWithName', {
+          ...defaultProps,
+          jobName,
+        });
+
+        Template.fromStack(stack).hasResourceProperties('AWS::Glue::Job', {
+          Name: jobName,
+        });
+      });
+    });
+
+    describe('enabling continuous logging with defaults', () => {
+      beforeEach(() => {
+        job = new glue.Job(stack, 'Job', {
+          ...defaultProps,
+          continuousLogging: { enabled: true },
+        });
+      });
+
+      test('should set minimal default arguments', () => {
+        Template.fromStack(stack).hasResourceProperties('AWS::Glue::Job', {
+          DefaultArguments: {
+            '--enable-continuous-cloudwatch-log': 'true',
+            '--enable-continuous-log-filter': 'true',
+          },
+        });
+      });
+    });
+
+    describe('enabling continuous logging with all props set', () => {
+      let logGroup;
+
+      beforeEach(() => {
+        logGroup = logs.LogGroup.fromLogGroupName(stack, 'LogGroup', 'LogGroupName');
+        job = new glue.Job(stack, 'Job', {
+          ...defaultProps,
+          continuousLogging: {
+            enabled: true,
+            quiet: false,
+            logStreamPrefix: 'LogStreamPrefix',
+            conversionPattern: '%d{yy/MM/dd HH:mm:ss} %p %c{1}: %m%n',
+            logGroup,
+          },
+        });
+      });
+
+      test('should set all arguments', () => {
+        Template.fromStack(stack).hasResourceProperties('AWS::Glue::Job', {
+          DefaultArguments: {
+            '--enable-continuous-cloudwatch-log': 'true',
+            '--enable-continuous-log-filter': 'false',
+            '--continuous-log-logGroup': 'LogGroupName',
+            '--continuous-log-logStreamPrefix': 'LogStreamPrefix',
+            '--continuous-log-conversionPattern': '%d{yy/MM/dd HH:mm:ss} %p %c{1}: %m%n',
+          },
+        });
+      });
+
+      test('should grant cloudwatch log write permissions', () => {
+        Template.fromStack(stack).hasResourceProperties('AWS::IAM::Policy', {
+          PolicyDocument: {
+            Statement: [
+              {
+                Action: [
+                  'logs:CreateLogStream',
+                  'logs:PutLogEvents',
+                ],
+                Effect: 'Allow',
+                Resource: {
+                  'Fn::Join': [
+                    '',
+                    [
+                      'arn:',
+                      {
+                        Ref: 'AWS::Partition',
+                      },
+                      ':logs:',
+                      {
+                        Ref: 'AWS::Region',
+                      },
+                      ':',
+                      {
+                        Ref: 'AWS::AccountId',
+                      },
+                      ':log-group:LogGroupName:*',
+                    ],
+                  ],
+                },
+              },
+              codeBucketAccessStatement,
+            ],
+          },
+          Roles: [
+            {
+              Ref: 'JobServiceRole4F432993',
+            },
+          ],
+        });
+      });
+    });
+
+    describe('enabling spark ui', () => {
+      describe('with no bucket or path provided', () => {
+        beforeEach(() => {
+          job = new glue.Job(stack, 'Job', {
+            ...defaultProps,
+            sparkUI: { enabled: true },
+          });
+        });
+
+        test('should create spark ui bucket', () => {
+          Template.fromStack(stack).resourceCountIs('AWS::S3::Bucket', 1);
+        });
+
+        test('should grant the role read/write permissions to the spark ui bucket', () => {
+          Template.fromStack(stack).hasResourceProperties('AWS::IAM::Policy', {
+            PolicyDocument: {
+              Statement: [
+                {
+                  Action: [
+                    's3:GetObject*',
+                    's3:GetBucket*',
+                    's3:List*',
+                    's3:DeleteObject*',
+                    's3:PutObject*',
+                    's3:Abort*',
+                  ],
+                  Effect: 'Allow',
+                  Resource: [
+                    {
+                      'Fn::GetAtt': [
+                        'JobSparkUIBucket8E6A0139',
+                        'Arn',
+                      ],
+                    },
+                    {
+                      'Fn::Join': [
+                        '',
+                        [
+                          {
+                            'Fn::GetAtt': [
+                              'JobSparkUIBucket8E6A0139',
+                              'Arn',
+                            ],
+                          },
+                          '/*',
+                        ],
+                      ],
+                    },
+                  ],
+                },
+                codeBucketAccessStatement,
+              ],
+              Version: '2012-10-17',
+            },
+            PolicyName: 'JobServiceRoleDefaultPolicy03F68F9D',
+            Roles: [
+              {
+                Ref: 'JobServiceRole4F432993',
+              },
+            ],
+          });
+        });
+
+        test('should set spark arguments on the job', () => {
+          Template.fromStack(stack).hasResourceProperties('AWS::Glue::Job', {
+            DefaultArguments: {
+              '--enable-spark-ui': 'true',
+              '--spark-event-logs-path': {
+                'Fn::Join': [
+                  '',
+                  [
+                    's3://',
+                    {
+                      Ref: 'JobSparkUIBucket8E6A0139',
+                    },
+                  ],
+                ],
+              },
+            },
+          });
+        });
+      });
+
+      describe('with bucket provided', () => {
+        const sparkUIBucketName = 'sparkBucketName';
+        let sparkUIBucket: s3.IBucket;
+
+        beforeEach(() => {
+          sparkUIBucket = s3.Bucket.fromBucketName(stack, 'SparkBucketId', sparkUIBucketName);
+          job = new glue.Job(stack, 'Job', {
+            ...defaultProps,
+            sparkUI: {
+              enabled: true,
+              bucket: sparkUIBucket,
+            },
+          });
+        });
+
+        test('should grant the role read/write permissions to the provided spark ui bucket', () => {
+          Template.fromStack(stack).hasResourceProperties('AWS::IAM::Policy', {
+            PolicyDocument: {
+              Statement: [
+                {
+                  Action: [
+                    's3:GetObject*',
+                    's3:GetBucket*',
+                    's3:List*',
+                    's3:DeleteObject*',
+                    's3:PutObject*',
+                    's3:Abort*',
+                  ],
+                  Effect: 'Allow',
+                  Resource: [
+                    {
+                      'Fn::Join': [
+                        '',
+                        [
+                          'arn:',
+                          {
+                            Ref: 'AWS::Partition',
+                          },
+                          ':s3:::sparkBucketName',
+                        ],
+                      ],
+                    },
+                    {
+                      'Fn::Join': [
+                        '',
+                        [
+                          'arn:',
+                          {
+                            Ref: 'AWS::Partition',
+                          },
+                          ':s3:::sparkBucketName/*',
+                        ],
+                      ],
+                    },
+                  ],
+                },
+                codeBucketAccessStatement,
+              ],
+            },
+            Roles: [
+              {
+                Ref: 'JobServiceRole4F432993',
+              },
+            ],
+          });
+        });
+
+        test('should set spark arguments on the job', () => {
+          Template.fromStack(stack).hasResourceProperties('AWS::Glue::Job', {
+            DefaultArguments: {
+              '--enable-spark-ui': 'true',
+              '--spark-event-logs-path': `s3://${sparkUIBucketName}`,
+            },
+          });
+        });
+      });
+
+      describe('with bucket and path provided', () => {
+        const sparkUIBucketName = 'sparkBucketName';
+        const prefix = 'some/path/';
+        let sparkUIBucket: s3.IBucket;
+
+        beforeEach(() => {
+          sparkUIBucket = s3.Bucket.fromBucketName(stack, 'BucketId', sparkUIBucketName);
+          job = new glue.Job(stack, 'Job', {
+            ...defaultProps,
+            sparkUI: {
+              enabled: true,
+              bucket: sparkUIBucket,
+              prefix,
+            },
+          });
+        });
+
+        test('should set spark arguments on the job', () => {
+          Template.fromStack(stack).hasResourceProperties('AWS::Glue::Job', {
+            DefaultArguments: {
+              '--enable-spark-ui': 'true',
+              '--spark-event-logs-path': `s3://${sparkUIBucketName}/${prefix}`,
+            },
+          });
+        });
+      });
+    });
+
+    describe('with extended props', () => {
+      beforeEach(() => {
+        job = new glue.Job(stack, 'Job', {
+          ...defaultProps,
+          jobName,
+          description: 'test job',
+          workerType: glue.WorkerType.G_2X,
+          workerCount: 10,
+          maxConcurrentRuns: 2,
+          maxRetries: 2,
+          timeout: cdk.Duration.minutes(5),
+          notifyDelayAfter: cdk.Duration.minutes(1),
+          defaultArguments: {
+            arg1: 'value1',
+            arg2: 'value2',
+          },
+          connections: [glue.Connection.fromConnectionName(stack, 'ImportedConnection', 'ConnectionName')],
+          securityConfiguration: glue.SecurityConfiguration.fromSecurityConfigurationName(stack, 'ImportedSecurityConfiguration', 'SecurityConfigurationName'),
+          enableProfilingMetrics: true,
+          tags: {
+            key: 'value',
+          },
+        });
+      });
+
+      test('should synthesize correctly', () => {
+        Template.fromStack(stack).hasResourceProperties('AWS::Glue::Job', {
+          Command: {
+            Name: 'glueetl',
+            ScriptLocation: 's3://bucketName/script',
+          },
+          Role: {
+            'Fn::GetAtt': [
+              'JobServiceRole4F432993',
+              'Arn',
+            ],
+          },
+          DefaultArguments: {
+            '--job-language': 'scala',
+            '--class': 'com.amazon.test.ClassName',
+            '--enable-metrics': '',
+            'arg1': 'value1',
+            'arg2': 'value2',
+          },
+          Description: 'test job',
+          ExecutionProperty: {
+            MaxConcurrentRuns: 2,
+          },
+          GlueVersion: '2.0',
+          MaxRetries: 2,
+          Name: 'test-job',
+          NotificationProperty: {
+            NotifyDelayAfter: 1,
+          },
+          NumberOfWorkers: 10,
+          Tags: {
+            key: 'value',
+          },
+          Timeout: 5,
+          WorkerType: 'G.2X',
+          Connections: {
+            Connections: [
+              'ConnectionName',
+            ],
+          },
+          SecurityConfiguration: 'SecurityConfigurationName',
+        });
+      });
+    });
+
+    test('with reserved args should throw', () => {
+      ['--conf', '--debug', '--mode', '--JOB_NAME'].forEach((arg, index) => {
+        const defaultArguments: {[key: string]: string} = {};
+        defaultArguments[arg] = 'random value';
+
+        expect(() => new glue.Job(stack, `Job${index}`, {
+          executable: glue.JobExecutable.scalaEtl({
+            glueVersion: glue.GlueVersion.V2_0,
+            className,
+            script,
+          }),
+          defaultArguments,
+        })).toThrow(/argument is reserved by Glue/);
+      });
+    });
+
+    describe('shell job', () => {
+      test('with unsupported glue version should throw', () => {
+        expect(() => new glue.Job(stack, 'Job', {
+          executable: glue.JobExecutable.pythonShell({
+            glueVersion: glue.GlueVersion.V0_9,
+            pythonVersion: glue.PythonVersion.TWO,
+            script,
+          }),
+        })).toThrow('Specified GlueVersion 0.9 does not support Python Shell');
+      });
+
+      test('with unsupported Spark UI prop should throw', () => {
+        expect(() => new glue.Job(stack, 'Job', {
+          executable: glue.JobExecutable.pythonShell({
+            glueVersion: glue.GlueVersion.V1_0,
+            pythonVersion: glue.PythonVersion.THREE,
+            script,
+          }),
+          sparkUI: { enabled: true },
+        })).toThrow('Spark UI is not available for JobType.PYTHON_SHELL');
+      });
+    });
+
+
+    test('etl job with all props should synthesize correctly', () => {
+      new glue.Job(stack, 'Job', {
+        executable: glue.JobExecutable.pythonEtl({
+          glueVersion: glue.GlueVersion.V2_0,
+          pythonVersion: glue.PythonVersion.THREE,
+          extraJarsFirst: true,
+          script,
+          extraPythonFiles,
+          extraJars,
+          extraFiles,
+        }),
+      });
+
+      Template.fromStack(stack).hasResourceProperties('AWS::Glue::Job', {
+        GlueVersion: '2.0',
+        Command: {
+          Name: 'glueetl',
+          ScriptLocation: 's3://bucketName/script',
+          PythonVersion: '3',
+        },
+        Role: {
+          'Fn::GetAtt': [
+            'JobServiceRole4F432993',
+            'Arn',
+          ],
+        },
+        DefaultArguments: {
+          '--job-language': 'python',
+          '--extra-jars': 's3://bucketName/file1.jar,s3://bucketName/file2.jar',
+          '--extra-py-files': 's3://bucketName/file1.py,s3://bucketName/file2.py',
+          '--extra-files': 's3://bucketName/file1.txt,s3://bucketName/file2.txt',
+          '--user-jars-first': 'true',
+        },
+      });
+    });
+
+    test('streaming job with all props should synthesize correctly', () => {
+      new glue.Job(stack, 'Job', {
+        executable: glue.JobExecutable.scalaStreaming({
+          glueVersion: glue.GlueVersion.V2_0,
+          extraJarsFirst: true,
+          className,
+          script,
+          extraJars,
+          extraFiles,
+        }),
+      });
+
+      Template.fromStack(stack).hasResourceProperties('AWS::Glue::Job', {
+        GlueVersion: '2.0',
+        Command: {
+          Name: 'gluestreaming',
+          ScriptLocation: 's3://bucketName/script',
+        },
+        Role: {
+          'Fn::GetAtt': [
+            'JobServiceRole4F432993',
+            'Arn',
+          ],
+        },
+        DefaultArguments: {
+          '--job-language': 'scala',
+          '--class': 'com.amazon.test.ClassName',
+          '--extra-jars': 's3://bucketName/file1.jar,s3://bucketName/file2.jar',
+          '--extra-files': 's3://bucketName/file1.txt,s3://bucketName/file2.txt',
+          '--user-jars-first': 'true',
+        },
+      });
+    });
+
+    describe('event rules and rule-based metrics', () => {
+      beforeEach(() => {
+        job = new glue.Job(stack, 'Job', {
+          executable: glue.JobExecutable.scalaEtl({
+            glueVersion: glue.GlueVersion.V2_0,
+            className,
+            script,
+          }),
+        });
+      });
+
+      test('.onEvent() should create the expected event rule', () => {
+        job.onEvent('eventId', {});
+
+        Template.fromStack(stack).hasResourceProperties('AWS::Events::Rule', {
+          EventPattern: {
+            'source': [
+              'aws.glue',
+            ],
+            'detail-type': [
+              'Glue Job State Change',
+              'Glue Job Run Status',
+            ],
+            'detail': {
+              jobName: [
+                {
+                  Ref: 'JobB9D00F9F',
+                },
+              ],
+            },
+          },
+          State: 'ENABLED',
+        });
+      });
+
+      [
+        { name: 'onSuccess()', invoke: (testJob: glue.Job) => testJob.onSuccess('SuccessRule'), state: 'SUCCEEDED' },
+        { name: 'onFailure()', invoke: (testJob: glue.Job) => testJob.onFailure('FailureRule'), state: 'FAILED' },
+        { name: 'onTimeout()', invoke: (testJob: glue.Job) => testJob.onTimeout('TimeoutRule'), state: 'TIMEOUT' },
+      ].forEach((testCase) => {
+        test(`${testCase.name} should create a rule with correct properties`, () => {
+          testCase.invoke(job);
+
+          Template.fromStack(stack).hasResourceProperties('AWS::Events::Rule', {
+            Description: {
+              'Fn::Join': [
+                '',
+                [
+                  'Rule triggered when Glue job ',
+                  {
+                    Ref: 'JobB9D00F9F',
+                  },
+                  ` is in ${testCase.state} state`,
+                ],
+              ],
+            },
+            EventPattern: {
+              'source': [
+                'aws.glue',
+              ],
+              'detail-type': [
+                'Glue Job State Change',
+                'Glue Job Run Status',
+              ],
+              'detail': {
+                state: [
+                  testCase.state,
+                ],
+                jobName: [
+                  {
+                    Ref: 'JobB9D00F9F',
+                  },
+                ],
+              },
+            },
+            State: 'ENABLED',
+          });
+        });
+      });
+
+      [
+        { name: '.metricSuccess()', invoke: (testJob: glue.Job) => testJob.metricSuccess(), state: 'SUCCEEDED', ruleId: 'SuccessMetricRule' },
+        { name: '.metricFailure()', invoke: (testJob: glue.Job) => testJob.metricFailure(), state: 'FAILED', ruleId: 'FailureMetricRule' },
+        { name: '.metricTimeout()', invoke: (testJob: glue.Job) => testJob.metricTimeout(), state: 'TIMEOUT', ruleId: 'TimeoutMetricRule' },
+      ].forEach((testCase) => {
+        test(`${testCase.name} should create the expected singleton event rule and corresponding metric`, () => {
+          const metric = testCase.invoke(job);
+          testCase.invoke(job);
+
+          expect(metric).toEqual(new cloudwatch.Metric({
+            dimensions: {
+              RuleName: (job.node.findChild(testCase.ruleId) as events.Rule).ruleName,
+            },
+            metricName: 'TriggeredRules',
+            namespace: 'AWS/Events',
+            statistic: 'Sum',
+          }));
+
+          Template.fromStack(stack).resourceCountIs('AWS::Events::Rule', 1);
+          Template.fromStack(stack).hasResourceProperties('AWS::Events::Rule', {
+            Description: {
+              'Fn::Join': [
+                '',
+                [
+                  'Rule triggered when Glue job ',
+                  {
+                    Ref: 'JobB9D00F9F',
+                  },
+                  ` is in ${testCase.state} state`,
+                ],
+              ],
+            },
+            EventPattern: {
+              'source': [
+                'aws.glue',
+              ],
+              'detail-type': [
+                'Glue Job State Change',
+                'Glue Job Run Status',
+              ],
+              'detail': {
+                state: [
+                  testCase.state,
+                ],
+                jobName: [
+                  {
+                    Ref: 'JobB9D00F9F',
+                  },
+                ],
+              },
+            },
+            State: 'ENABLED',
+          });
+        });
+      });
+    });
+
+    describe('.metric()', () => {
+
+      test('with MetricType.COUNT should create a count sum metric', () => {
+        const metricName = 'glue.driver.aggregate.bytesRead';
+        const props = { statistic: cloudwatch.Statistic.SUM };
+
+        expect(job.metric(metricName, glue.MetricType.COUNT, props)).toEqual(new cloudwatch.Metric({
+          metricName,
+          statistic: 'Sum',
+          namespace: 'Glue',
+          dimensions: {
+            JobName: job.jobName,
+            JobRunId: 'ALL',
+            Type: 'count',
+          },
+        }));
+      });
+
+      test('with MetricType.GAUGE should create a gauge average metric', () => {
+        const metricName = 'glue.driver.BlockManager.disk.diskSpaceUsed_MB';
+        const props = { statistic: cloudwatch.Statistic.AVERAGE };
+
+        expect(job.metric(metricName, glue.MetricType.GAUGE, props)).toEqual(new cloudwatch.Metric({
+          metricName,
+          statistic: 'Average',
+          namespace: 'Glue',
+          dimensions: {
+            JobName: job.jobName,
+            JobRunId: 'ALL',
+            Type: 'gauge',
+          },
+        }));
+      });
+    });
+  });
+});

From 1e247d89adbc09ff79b87753fcd78b238a6752e8 Mon Sep 17 00:00:00 2001
From: Niranjan Jayakar <nija@amazon.com>
Date: Thu, 9 Sep 2021 10:33:12 +0100
Subject: [PATCH 90/91] fix(apigatewayv2): ApiMapping does not depend on
 DomainName (#16201)

When an ApiMapping resource is deployed using the Domain defined in the
DomainName resource, the DomainName resource must be deployed before the
ApiMapping resource.

Since the current logic uses the CloudFormation Output of DomainName as
a fall back, preferring the user provided string first, this dependency
is not expressed in the resulting template.

Remove the preference for the user provided string, will inform
synthesis that the dependency must be declared.

fixes #15464


----

*By submitting this pull request, I confirm that my contribution is made under the terms of the Apache-2.0 license*
---
 .../@aws-cdk/aws-apigatewayv2/lib/common/domain-name.ts   | 2 +-
 .../aws-apigatewayv2/test/common/api-mapping.test.ts      | 2 --
 .../aws-apigatewayv2/test/http/domain-name.test.ts        | 8 ++++++--
 .../@aws-cdk/aws-apigatewayv2/test/http/stage.test.ts     | 6 +++++-
 4 files changed, 12 insertions(+), 6 deletions(-)

diff --git a/packages/@aws-cdk/aws-apigatewayv2/lib/common/domain-name.ts b/packages/@aws-cdk/aws-apigatewayv2/lib/common/domain-name.ts
index dca1a60bd4548..6b1123512c678 100644
--- a/packages/@aws-cdk/aws-apigatewayv2/lib/common/domain-name.ts
+++ b/packages/@aws-cdk/aws-apigatewayv2/lib/common/domain-name.ts
@@ -98,7 +98,7 @@ export class DomainName extends Resource implements IDomainName {
       ],
     };
     const resource = new CfnDomainName(this, 'Resource', domainNameProps);
-    this.name = props.domainName ?? resource.ref;
+    this.name = resource.ref;
     this.regionalDomainName = Token.asString(resource.getAtt('RegionalDomainName'));
     this.regionalHostedZoneId = Token.asString(resource.getAtt('RegionalHostedZoneId'));
   }
diff --git a/packages/@aws-cdk/aws-apigatewayv2/test/common/api-mapping.test.ts b/packages/@aws-cdk/aws-apigatewayv2/test/common/api-mapping.test.ts
index ff53d3dad11fc..855ad32dda137 100644
--- a/packages/@aws-cdk/aws-apigatewayv2/test/common/api-mapping.test.ts
+++ b/packages/@aws-cdk/aws-apigatewayv2/test/common/api-mapping.test.ts
@@ -26,7 +26,6 @@ describe('ApiMapping', () => {
       ApiId: {
         Ref: 'ApiF70053CD',
       },
-      DomainName: 'example.com',
       Stage: '$default',
     });
   });
@@ -58,7 +57,6 @@ describe('ApiMapping', () => {
       ApiId: {
         Ref: 'ApiF70053CD',
       },
-      DomainName: 'example.com',
       Stage: 'beta',
       ApiMappingKey: 'beta',
     });
diff --git a/packages/@aws-cdk/aws-apigatewayv2/test/http/domain-name.test.ts b/packages/@aws-cdk/aws-apigatewayv2/test/http/domain-name.test.ts
index 30c981a1da1d5..2d0d856c7ae15 100644
--- a/packages/@aws-cdk/aws-apigatewayv2/test/http/domain-name.test.ts
+++ b/packages/@aws-cdk/aws-apigatewayv2/test/http/domain-name.test.ts
@@ -102,7 +102,9 @@ describe('DomainName', () => {
       ApiId: {
         Ref: 'ApiF70053CD',
       },
-      DomainName: 'example.com',
+      DomainName: {
+        Ref: 'DNFDC76583',
+      },
       Stage: 'beta',
       ApiMappingKey: 'beta',
     });
@@ -139,7 +141,9 @@ describe('DomainName', () => {
       ApiId: {
         Ref: 'ApiF70053CD',
       },
-      DomainName: 'example.com',
+      DomainName: {
+        Ref: 'DNFDC76583',
+      },
       Stage: '$default',
     });
   });
diff --git a/packages/@aws-cdk/aws-apigatewayv2/test/http/stage.test.ts b/packages/@aws-cdk/aws-apigatewayv2/test/http/stage.test.ts
index e7a05924719d3..b617fe4613a51 100644
--- a/packages/@aws-cdk/aws-apigatewayv2/test/http/stage.test.ts
+++ b/packages/@aws-cdk/aws-apigatewayv2/test/http/stage.test.ts
@@ -140,7 +140,11 @@ describe('HttpStage with domain mapping', () => {
       },
     });
 
-    expect(stage.domainUrl).toBe(`https://${domainName}/`);
+    expect(stack.resolve(stage.domainUrl)).toEqual({
+      'Fn::Join': ['', [
+        'https://', { Ref: 'DNFDC76583' }, '/',
+      ]],
+    });
   });
 
   test('domainUrl throws error if domainMapping is not configured', () => {

From f3fc1d58883df35e662d4f6390b1f439045ee52a Mon Sep 17 00:00:00 2001
From: Niranjan Jayakar <nija@amazon.com>
Date: Thu, 9 Sep 2021 12:42:43 +0100
Subject: [PATCH 91/91] chore: add breaking changes entry to 1.122.0 release
 (#16430)

This was missed by the auto bump script since the pull request -
https://github.com/aws/aws-cdk/pull/16329 - was merged without squash.


----

*By submitting this pull request, I confirm that my contribution is made under the terms of the Apache-2.0 license*
---
 CHANGELOG.md | 7 +++++++
 1 file changed, 7 insertions(+)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index ca9ef129cbefa..2f039368437a3 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -4,6 +4,12 @@ All notable changes to this project will be documented in this file. See [standa
 
 ## [1.122.0](https://github.com/aws/aws-cdk/compare/v1.121.0...v1.122.0) (2021-09-08)
 
+### ⚠ BREAKING CHANGES TO EXPERIMENTAL FEATURES
+
+* **assertions:** `hasOutput(props: any)` becomes `hasOutput(logicalId: string, props: any)`
+* **assertions:** `findOutputs(props: any = {})` becomes `findOutputs(logicalId: string, props: any = {})`
+* **assertions:** `hasMapping(props: any)` becomes `hasMapping(logicalId: string, props: any)`
+* **assertions:** `findMappings(props: any = {})` becomes `findMappings(logicalId: string, props: any = {})`
 
 ### Features
 
@@ -24,6 +30,7 @@ All notable changes to this project will be documented in this file. See [standa
 ### Bug Fixes
 
 * **apigatewayv2:** some methods of the `defaultStage` are not available without casting it to `IHttpStage` ([#15607](https://github.com/aws/aws-cdk/issues/15607)) ([27a0113](https://github.com/aws/aws-cdk/commit/27a0113ac68a05360faa22fa8897609f2f90b764))
+* **assertions:** output and mapping assertions do not accept logical id ([#16329](https://github.com/aws/aws-cdk/issues/16329)), closes [#16242](https://github.com/aws/aws-cdk/issues/16242)
 * **assets:** run executable command of container assets in cloud assembly root directory ([#16094](https://github.com/aws/aws-cdk/issues/16094)) ([c2852c9](https://github.com/aws/aws-cdk/commit/c2852c9c524a639a312bf296f7f23b0e3b112f6b)), closes [#15721](https://github.com/aws/aws-cdk/issues/15721)
 * **autoscaling:** EbsDeviceVolumeType.IO2 is not a valid CloudFormation value ([#16028](https://github.com/aws/aws-cdk/issues/16028)) ([492d33b](https://github.com/aws/aws-cdk/commit/492d33b27bc5b935e3da75f0bddd875bb6f9c15d)), closes [#16027](https://github.com/aws/aws-cdk/issues/16027)
 * **cli:** 'deploy' and 'diff' silently does nothing when given unknown stack name ([#16150](https://github.com/aws/aws-cdk/issues/16150)) ([74776f3](https://github.com/aws/aws-cdk/commit/74776f393462f7e7d23cb1953ef786a823adc896)), closes [#15866](https://github.com/aws/aws-cdk/issues/15866)