Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

chore(release): 2.93.0 #26859

Merged
merged 58 commits into from
Aug 23, 2023
Merged

chore(release): 2.93.0 #26859

merged 58 commits into from
Aug 23, 2023

Conversation

aws-cdk-automation
Copy link
Collaborator

@aws-cdk-automation aws-cdk-automation commented Aug 23, 2023

See CHANGELOG

kaizencc and others added 30 commits August 15, 2023 19:35
…6727)

----

*By submitting this pull request, I confirm that my contribution is made under the terms of the Apache-2.0 license*
We have a label, `pr-linter/do-not-close` that has not been doing its job. See #26039.

It is because we are expecting a comma-separated-list, without spaces:

https://github.com/rix0rrr/close-stale-prs/blob/ffeb148adbaf7402e77bc4eafce8ed3d3c40f29c/src/index.ts#L22

----

*By submitting this pull request, I confirm that my contribution is made under the terms of the Apache-2.0 license*
Apparently the same user can have both a `COMMENTED` review and a `APPROVED` review. See #26763 and the logs from its prlinter github action:

```
evaluation:  {
  "draft": false,
  "mergeable_state": "behind",
  "maintainerRequestedChanges": false,
  "maintainerApproved": false,
  "communityRequestedChanges": true, // also requested changes
  "communityApproved": true, // approved
  "userRequestsExemption": false
}
```

Also added more logging so that we can see the full data next time. This PR solves the issue by respecting `APPROVED` over `COMMENTED`. Any trusted reviewer who has `APPROVED` a PR will get the PR to `pr/needs-maintainer-review`. Maintainers can always dismiss those reviews if we find that we want to respect someone else's `COMMENTED` review.

----

*By submitting this pull request, I confirm that my contribution is made under the terms of the Apache-2.0 license*
Ran npm-check-updates and yarn upgrade to keep the `yarn.lock` file up-to-date.
Previously we changed the default version of the lambda-nodejs Function construct to go from using the `builtInNodeJsCustomResourceRuntime`, a map of regions to available versions, to `lambda.Runtime.NODEJS_18_X`. The default `externalModule` configuration excluded the aws-sdk version based on the runtime passed, excluding v2 for Node16 and under, and v3 for Node18 and up, but users can pass their own bundling configuration excluding `aws-sdk` while not explicitly passing a runtime, which caused their functions to break.

Adds a new `lambda.Runtime` value for `NODEJS_LATEST`. This is central reference for the latest version of NodeJS provided by the lamdba service. It also includes a new property `isLatest` which can be used to indicate that the runtime version may change over time. This can used to indicate that relying on packages shipped with the environment may not be relied upon if the version changes. We default to using the `NODEJS_LATEST` runtime only if the feature flag is enabled. If the flag is not enabled, use `NODEJS_16_X` to keep supporting users current bundling configurations.

Additionally, add a warning to tell users if they are excluding a package from their bundling that we know doesn't exist within the runtime they are using. IE, if using `NODEJS_18_X` and the exclude list includes `aws-sdk`, warn users that it won't be present.

Fixes #26732

----

*By submitting this pull request, I confirm that my contribution is made under the terms of the Apache-2.0 license*
…26781)

This PR fixes a spelling error in alarm-base docstrings for `addAlarmAction`, `addInsufficientDataAction`, and `addOkAction` where `SnsAction` was spelled `SnsAcion`.

----

*By submitting this pull request, I confirm that my contribution is made under the terms of the Apache-2.0 license*
When we [upgraded the proxy-agent v6](#26722) we did not update how we were importing from the package. Where [in 5.0 commonjs exports were used](https://github.com/TooTallNate/node-proxy-agent/blob/5.0.0/index.js#L25) , in [6.0 a named esm export is used](https://github.com/TooTallNate/proxy-agents/blob/proxy-agent%406.1.0/packages/proxy-agent/src/index.ts#L71).

Updated to use a named import statement instead of a default require. Typescript also confirms the old import was an error now since we use `import` instead of `require`.

Fixes: #26771

----

*By submitting this pull request, I confirm that my contribution is made under the terms of the Apache-2.0 license*
…insics (#26404)

## Reason for this change
Currently an ECS task definition cannot be hotswapped in many cases, for example when it contains references to certain AWS resources as environment variables. This PR removes the limitation and make hotswaps possible in much more various situations.

Specifically, if there is any token that is not part of the following, we cannot hotswap a task definition:

1. Ref functions, which will be resolved as physical resource ids
2. GetAtt functions for some resources and attributes (manually supported one by one, [code](https://github.com/aws/aws-cdk/blob/5ccc56975c323ea19fd0917def51184e13f440d9/packages/aws-cdk/lib/api/evaluate-cloudformation-template.ts#L352))
3. several simple CFn functions (join, split, select, sub)
4. parameters like AWS::AccountId, Region, Partition, or UrlSuffix

Although it is not supported much, using `GetAtt` function in a task definition is very common (imagine you reference other resource's property as an environment variable). This PR allows to hotswap a task definition even if it contains these tokens.

## Solution
To hotswap a task definition, we need to construct a task definition to call `registerTaskDefinition` API. For this, we have to [evaluate](https://github.com/aws/aws-cdk/blob/5ccc56975c323ea19fd0917def51184e13f440d9/packages/aws-cdk/lib/api/evaluate-cloudformation-template.ts#L134) CloudFormation template locally to resolve all the intrinsics in the template. However, some intrinsics such as `Fn::GetAtt` is not fully supported by CDK CLI because we have to manually support them for each AWS resource type. 

The reason why some task definitions are unhotswappable is that there are such intrinsics in the template and the CDK fails to evaluate it locally. So the basic idea to overcome this limitation in this PR is that we don't try to evaluate it locally, but we fetch the latest task definition already deployed and get the required values from it.

Here's how we can implement the idea.

### How we determine if changes to a task definition can be hotswapped
In the hotswap process, we have to decide whether the change can be hotswapped or not. Now we can hotswap the task definition if

1. there are only changes in `ContainerDefinitions` field, and all the fields in the task definition can be evaluated locally. (original behavior) OR,
2. there are only changes in `ContainerDefinitions` field, and all the **updated** field can be evaluated locally (added in this PR).

The first condition can actually be included in the second condition, but for now I keep it as-is to avoid the possibility of breaking the existing behavior.

If the second condition is true, we fetch the latest task definition from AWS account, override the updated fields, and register a new task definition to update a service. By this way, we don't have to evaluate tokens in unchanged fields locally, allowing to use hotswap in much more situations.

### How we compare the old and new task definition
Here is an example task definition:

```json
{
    "ContainerDefinitions": [
        {
            "Environment": [
                {
                    "Name": "VPC_ID",
                    "Value": {
                        "Fn::GetAtt": [
                            "Vpc8378EB38",
                            "CidrBlock"
                        ]
                    }
                }
            ],
            "Essential": true,
            "Image": "nginx:stable",
            "Name": "EcsApp"
        }
    ],
    "Cpu": "256",
    "Family": "myteststackTask289798EC",
    "Memory": "512",
    "NetworkMode": "awsvpc",
    "RequiresCompatibilities": [
        "FARGATE"
    ],
    "TaskRoleArn": {
        "Fn::GetAtt": [
            "TaskTaskRoleE98524A1",
            "Arn"
        ]
    }
}
```

We compare the old and new task definition in the following steps:

1. Check if there are only changes in `ContainerDefinitions` field. If not, we cannot hotswap.
2. Try `evaluateCfnExpression` on the containerDefinitons. If it can be evaluated, proceed to hotswap. If not, proceed to step 3.
3. Check if the length of `ContainerDefinitions` is the same. If not, we cannot hotswap.
4. For each container definition, deep-compare each key (e.g. `Environment`, `Image`, `Name`, etc)
5. For each key, if there is any diff in the corresponding value, try `evaluateCfnExpression` on the value. If the evaluation fails, we cannot hotswap.
6. After checking all the keys and there is no field that cannot be hotswapped, proceed to hotswap.

Imagine if there is a change only in `Image` field (container image tag)  but `Environment` field contains unsupported intrinsics (e.g. `"Fn::GetAtt": ["Vpc8378EB38", "CidrBlock"]`). In the previous CDK CLI we cannot hotswap it due to an evaluation error. We can now hotswap it because we don't have to evaluate the `Environment` field when it has no diffs.

Closes #25563

----

*By submitting this pull request, I confirm that my contribution is made under the terms of the Apache-2.0 license*
…26777)

Between version `2.87.0` and version `2.88.0`, the hash calculation used to make sure that `fn.currentVersion` is automatically updated when a new version of the Lambda Function is deployed changed.

This causes a creation of a new Version upon upgrading CDK, but that new Version creation will fail because the underlying Function hasn't changed.

The change was due to property ordering used in calculating a unique hash for the Function configuration.

This change restores the property ordering to the pre-2.88.0 behavior.

Fixes #26739.

----

*By submitting this pull request, I confirm that my contribution is made under the terms of the Apache-2.0 license*
…d between addMethod calls (#26636)

Adding a new method to an API with `addMethod` and passing `methodOptions.methodResponses` was generating duplicate entries using `StepFunctionsIntegration.startExecution` as integration:

For example:
```
const integ = apigw.StepFunctionsIntegration.startExecution(stateMachine, integrationOptions);
api.root.addMethod('GET', integ, methodOptions);
api.root.addMethod('POST', integ, methodOptions);
```

Would generate (fails on deployment):
```
 "MethodResponses": [
     {
      "ResponseParameters": {
       "method.response.header.Access-Control-Allow-Origin": true
      },
      "StatusCode": "200"
     },
     {
      "ResponseModels": {
       "application/json": "Empty"
      },
      "StatusCode": "200"
     },
     {
      "ResponseModels": {
       "application/json": "Error"
      },
      "StatusCode": "400"
     },
     {
      "ResponseModels": {
       "application/json": "Error"
      },
      "StatusCode": "500"
     },
     {
      "ResponseModels": {
       "application/json": "Empty"
      },
      "StatusCode": "200"
     },
     {
      "ResponseModels": {
       "application/json": "Error"
      },
      "StatusCode": "400"
     },
     {
      "ResponseModels": {
       "application/json": "Error"
      },
      "StatusCode": "500"
     }
    ],
```

With this fix, it will keep only the specified `methodResponses`.

Also, the `integrationResponses` option in `StepFunctionsIntegration.startExecution` was not used by the corresponding `Integration`.
This fix will allow to use the specified option value.


Closes #26586.

----

*By submitting this pull request, I confirm that my contribution is made under the terms of the Apache-2.0 license*
This PR fixes the bug that ECRAutoDeleteImages fails on repo rename.

The customResource depends on the role, and when the repository name changes, the role is updated to match the new repository instead of the old one, before customResource runs and the old repository is deleted.

It was difficult to delete the old repo before the role update ran, so I changed the resource of the role to a wildcard.

Closes #26711.

----

*By submitting this pull request, I confirm that my contribution is made under the terms of the Apache-2.0 license*
This example gets replicated to the CloudWatch Metrics documentation, where it is wrong.


----

*By submitting this pull request, I confirm that my contribution is made under the terms of the Apache-2.0 license*
…26789)

The current implementation executes a `CREATE TABLE` if the table has no `distKey` specified and one is added, or if a `distKey` is present and is removed.
The resulting table is created with the same name, causing the update operation to fail.
This fixes the problem by using [`ALTER TABLE`](https://docs.aws.amazon.com/redshift/latest/dg/r_ALTER_TABLE.html) when adding/removing `distKey` on a table update. 

Closes #26733.

----

*By submitting this pull request, I confirm that my contribution is made under the terms of the Apache-2.0 license*
…e JsonPath.DISCARD in docs (#26770)

The `DISCARD` variable is removed because it unused. The docs are updated to be more clear to use `JsonPath.DISCARD` for `CatchProps` and `ChoiceProps`.

Closes #26760 .

----

*By submitting this pull request, I confirm that my contribution is made under the terms of the Apache-2.0 license*
----

*By submitting this pull request, I confirm that my contribution is made under the terms of the Apache-2.0 license*
Closes #26655

I cannot run the integration tests and therefore cannot update the snapshot :(

----

*By submitting this pull request, I confirm that my contribution is made under the terms of the Apache-2.0 license*
Switch to using ts-jest for unit tests in `aws-cdk-lib` instead of requiring all tests to be compiled. This lets us ignore test files when building which speeds up the build marginally, and allows for better integration with various tools, such as IDE plugins for jest so you can run individual tests without rebuilding.

The workflow I have been using is running `jest --watch` either for all tests or only the directory or individual test I'm working on. When running all tests, the watch mode can be set to only rerun failed tests on change, which makes iterating on failures across multiple modules much easier.
Add Latest ADOT Lambda Layer ARNs

Reference Links :
  *  [Release Blog and Update Layer ARNs for Lambda Layer August Release](aws-otel/aws-otel.github.io#611) 
  *  [Update ReadMe with latest Layern ARN versions](aws-observability/aws-otel-lambda#679)



----

*By submitting this pull request, I confirm that my contribution is made under the terms of the Apache-2.0 license*
…26768)

Refactoring deployTo property to only create a deployment if specified.

Refactoring contentType to be passed in by ConfigurationContent.

**Includes breaking change. Deployments will not be created anymore if deployTo is not specified and contentType cannot be passed in as a HostedConfiguration prop, only can be passed directly to ConfigurationContent

----

*By submitting this pull request, I confirm that my contribution is made under the terms of the Apache-2.0 license*
…ps from FargateServiceBaseProps (#26737)

`ScheduledFargateTaskProps` was extending the `FargateServiceBaseProps` interface.
The only property used from that interface is [`platformVersion`](https://github.com/aws/aws-cdk/blob/694b4067023d7422927dfde51cf9621395ca753b/packages/aws-cdk-lib/aws-ecs-patterns/lib/fargate/scheduled-fargate-task.ts#L97).

This change adds warning messages if the unused properties are specified:
- `taskDefinition`
- `cpu`
- `memoryLimitMiB`
- `runtimePlatform`

Closes #26702.

----

*By submitting this pull request, I confirm that my contribution is made under the terms of the Apache-2.0 license*
Removes usage of aws-sdk in eks custom resources. The remaining usage was only type references that appear to be forward compatible but this cleans up the code and makes it possible to remove aws-sdk as a dev dependency to aws-cdk-lib once the rout53 cross account zone delegation handler is updated.

----

*By submitting this pull request, I confirm that my contribution is made under the terms of the Apache-2.0 license*
If `vpc` is specified with `subnetSelection` undefined, according to this:

https://github.com/aws/aws-cdk/blob/d5c64cba9aa8af8e92af4893657d144ef8e4f873/packages/aws-cdk-lib/aws-ec2/lib/vpc.ts#L655-L660

CDK will look for `PRIVATE_WITH_EGRESS`, `PRIVATE_ISOLATED`, and `PUBLIC` in order. If customer does not have `PRIVATE_WITH_EGRESS` subnets, they will need to have vpc endpoints if they need to access AWS services such as AWS Secrets Manager or Amazon ECR.

This PR improves the doc to clarify.


Closes #<issue number here>.

----

*By submitting this pull request, I confirm that my contribution is made under the terms of the Apache-2.0 license*
Closes #26766

The function `findCycle` tries to find a cycle by using a depth-first search (DFS). The DFS is implemented recursively in the recurse function. For each node, it tries to find a path that eventually leads back to the start of the path. If such a path is found, a cycle exists, and the nodes forming this cycle are returned.

One of the bugs in the current implementation is that it only checks whether the current dependency `dep` is equal to the first node of the current path `path[0]`. This means it will only detect a cycle if the cycle includes the first node of the search, which might not always be the case.

To fix this, the function should check whether the current dependency `dep` is already somewhere in the current path `path`. If it is, then a cycle has been found.

----

*By submitting this pull request, I confirm that my contribution is made under the terms of the Apache-2.0 license*
…ected places (#26791)

The `cloudformation-diff` module was written to parse templates that CDK itself would produce, mostly consisting of concrete values and barely any CloudFormation intrinsics. It would crash when encountering CloudFormation intrinsics in unexpected places (for example, an intrinsic where it expected an array).

Make the parsing more robust, checking the types of various values before we try and access it. Property-based tests generate random templates to make sure we didn't forget any edge cases.

Upgrade `fast-check` to the latest version while we're at it.

Fixes #7413.

----

*By submitting this pull request, I confirm that my contribution is made under the terms of the Apache-2.0 license*
As of v2.92.0, we don't yet have C7gd, M7gd, and R7gd instance types available via instance type selection. 

Closes #26774

----

*By submitting this pull request, I confirm that my contribution is made under the terms of the Apache-2.0 license*
When `AwsCustomResource` was updated to use sdkv3, it wasn't updated to correctly handle the change in returned value when calling `lambda.invokeFunction`. The payload property was changed from type `Buffer` to `Uint8Array` to increase compatibility in browsers.

Added a check in the `flatten` function used to format payloads in `AwsCustomResource`'s runtime to correctly decode values if they are a typed array or a buffer.

Created a new integ test which fails to deploy if the payload property is not serialized correctly and able to be made a Cfn output.

Fixes: #26730

----

*By submitting this pull request, I confirm that my contribution is made under the terms of the Apache-2.0 license*
…edZone (#26333)

Imported `PublicHostedZone` with `fromPublicHostedZoneId` and `fromPublicHostedZoneAttributes` don't have support for the `grantDelegation` method since they return an instance of type `IPublicHostedZone`.

This change adds support for `grantDelegation` to those instances as well.

Closes #26240.

----

*By submitting this pull request, I confirm that my contribution is made under the terms of the Apache-2.0 license*
README for aws-cdk-lib.aws_events_targets is missing the link for `Run an ECS task` section. This PR introduces the link.

----

*By submitting this pull request, I confirm that my contribution is made under the terms of the Apache-2.0 license*
lpizzinidev and others added 18 commits August 22, 2023 13:50
…untu7 (#26817)

Node 16 is approaching end-of-life (2023-09-11).
This changes the default image version to `aws/codebuild/standard:7.0` which uses Node 18.

Closes #26810.

----

*By submitting this pull request, I confirm that my contribution is made under the terms of the Apache-2.0 license*
The resource logical ID validation regex (`VALID_LOGICALID_REGEX`) is updated to be consistent with the [CloudFormation documentation](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/resources-section-structure.html) which says that logical IDs are alphanumeric.

Closes #26075.

----

*By submitting this pull request, I confirm that my contribution is made under the terms of the Apache-2.0 license*
The interface EbsOptions for the opensearchservices CDK construct is missing a provisioned throughput option for eg gp3 instance types.
iops is there, but not throughput

Closes #26137.

----

*By submitting this pull request, I confirm that my contribution is made under the terms of the Apache-2.0 license*
Specifying the `securityGroups` property requires a `vpc`.

This fix adds validation for the case when a `vpc` is not specified, but `securityGroups` is.
It also adds validation for the case when both `securityGroups` and `allowAllOutbound` are specified (`allowAllOutbound` should be configured in the SGs).

**Question for the reviewers**
How should we handle the case of an empty list in `securityGroups`? (eg `securityGroups: []`)

Closes #26508.

----

*By submitting this pull request, I confirm that my contribution is made under the terms of the Apache-2.0 license*
Removes the map of regions -> available lambda nodejs runtime versions
that previously was used for all custom resources vended in the aws-cdk.

----

*By submitting this pull request, I confirm that my contribution is made under the terms of the Apache-2.0 license*
)

Synthetics [used](https://aws.amazon.com/about-aws/whats-new/2022/05/amazon-cloudwatch-synthetics-support-canary-resources-deletion/) to have a property `deleteLambdaResourceOnCanaryDeletion` that has since been deprecated and erased from cloudformation docs. Although this property still works today synthetics makes no promises that this is supported in the future.

Here in CDK land, this PR serves as a replacement to the `deleteLambdaResourceOnCanaryDeletion` property (called `enableAutoDeleteLambdas` on the L2 Canary) by implementing a custom resource similar to what we have in S3 and ECR.

**This PR deprecates `enableAutoDeleteLambdas` in favor of `cleanup: cleanup.LAMBDA`, an enum that achieves the same thing but via custom resource**

Closes #18448

----

*By submitting this pull request, I confirm that my contribution is made under the terms of the Apache-2.0 license*
This GitHub Action updates a CONTRIBUTORS file with the top contributors from the project, pulling contents from the GitHub API.

----

*By submitting this pull request, I confirm that my contribution is made under the terms of the Apache-2.0 license*
…#26813)

Pre 2.89.0 we could import a secret from a complete secret arn in one stack and reference this secret from another stack in a different region to include it in a policy/role through grantRead on the secret construct.

Since 2.89.0 the arn in the policy it treats the compledSecretArn as a partial arn adding -?????? which makes the policy invalid and not allowing access to the secret as intended.

This PR fixes that by overriding arnForPolicies for imported secrets to either return provided complete arn or partial arn with suffix.

Fixes #26811.

----

*By submitting this pull request, I confirm that my contribution is made under the terms of the Apache-2.0 license*
A few weeks ago I added the --ssh flag to the constructs for building a cdk with that arg; However, I missed actually passing that arg to the docker.build in the cdk-assets container-images. This adds that arg where it should be.

Closes 12062.

----

*By submitting this pull request, I confirm that my contribution is made under the terms of the Apache-2.0 license*
Yaml is incorrect causing the workflow to not run at all.

----

*By submitting this pull request, I confirm that my contribution is made under the terms of the Apache-2.0 license*
This PR adds the ability to acknowledge annotation warning messages. 

The main motivation behind this is to allow people to set the `--strict` mode to fail synthesis on warnings. Currently it is all or nothing, you have to get rid of _all_ warnings to use `--strict`. With this feature users will be able to `acknowledge` warnings saying that they are aware, but it does not apply to them.

Since we want all warnings to now have an id this will deprecate the `addWarning` method and adds a new `addWarningV2` method.

Since the acknowledgements and warnings are written as metadata, it is possible to enhance this in the future to report on warnings and acknowledgements.


----

*By submitting this pull request, I confirm that my contribution is made under the terms of the Apache-2.0 license*
…licy (#26836)

Adds a `cloudWatchRoleRemovalPolicy` property to `RestApiBaseProps` that allows to specify a custom retention policy for CloudWatchRole and Account.
Defaults to `RemovalPolicy.RETAIN`.

Closes #26827.

----

*By submitting this pull request, I confirm that my contribution is made under the terms of the Apache-2.0 license*
This PR adds a possibility to use local bundling and let the final asset be one single file that is uploaded as-is.

This can be used for several types of assets, e.g. AppSync functions.

In contrast to Lambda, these functions to not expect the asset to be a zip file.

----

*By submitting this pull request, I confirm that my contribution is made under the terms of the Apache-2.0 license*
Using helm charts in a private ECR repo is not possible in govcloud regions, as the regex is too narrowly defined.

This change will properly match against all current AWS regions.

----

*By submitting this pull request, I confirm that my contribution is made under the terms of the Apache-2.0 license*
Exclude known bots. The created list isn't amazing yet, it's mostly a list of CDK Core team members.
Will have to do some more iterations in future.

----

*By submitting this pull request, I confirm that my contribution is made under the terms of the Apache-2.0 license*
Ran npm-check-updates and yarn upgrade to keep the `yarn.lock` file up-to-date.
…ystem (#25486)

## What change
I added `grantRead()` and `grantReadWrite()`, `grantRootAccess()` to `efs.FileSystem` as Beta1 method.

## Why need this change?
To make IAM authentication easier for clients. 

Currently, v2.78.0 has implemented `grant()` method in `efs.FileSystem`. However, EFS can't restrict only granted client even when customers only use the `grant()` method. Because EFS default file system policy grants full access to any anonymous client that can connect to the file system using a mount target.  To avoid this issue, customers must set file system policies that not grant anonymous clients, to EFS. In this PR, when using the `grantXxx` method that allows IAM authentication for clients, a file system policy that does not allow anonymous clients is set to `efs.FileSystem` by default to suit the customer's use case. Next example is grant read and write access to EC2 Instance.

```ts
declare const client: ec2.Instance;
const fileSystem = new efs.FileSystem(this, 'FileSystem', {
  vpc: new ec2.Vpc(this, 'VPC'),
});
fileSystem.grantReadWrite(client);
```

## How do I continue to allow anonymous access?
You can use `allowAnonymousAccess` props for allow anonymous access.

```ts
declare const client: ec2.Instance;
const fileSystem = new efs.FileSystem(this, 'FileSystem', {
  vpc: new ec2.Vpc(this, 'VPC'),
  allowAnonymousAccess: true,
});
fileSystem.grantRead(client);
```

## Others

The file system policies created to prevent anonymous clients are based on the AWS Management Console.
<img width="1326" alt="image" src="https://user-images.githubusercontent.com/49480575/236891324-e0aa4caf-91e2-45dc-9cfe-50cae0ca67bb.png">


----

*By submitting this pull request, I confirm that my contribution is made under the terms of the Apache-2.0 license*
@aws-cdk-automation aws-cdk-automation added auto-approve pr/no-squash This PR should be merged instead of squash-merging it labels Aug 23, 2023
@github-actions github-actions bot added the p2 label Aug 23, 2023
@aws-cdk-automation aws-cdk-automation requested a review from a team August 23, 2023 16:39
@aws-cdk-automation
Copy link
Collaborator Author

AWS CodeBuild CI Report

  • CodeBuild project: AutoBuildv2Project1C6BFA3F-wQm2hXv2jqQv
  • Commit ID: 440f0ea
  • Result: SUCCEEDED
  • Build Logs (available for 30 days)

Powered by github-codebuild-logs, available on the AWS Serverless Application Repository

@mergify
Copy link
Contributor

mergify bot commented Aug 23, 2023

Thank you for contributing! Your pull request will be automatically updated and merged without squashing (do not update manually, and be sure to allow changes to be pushed to your fork).

@mergify mergify bot merged commit 724bd01 into v2-release Aug 23, 2023
25 of 26 checks passed
@mergify mergify bot deleted the bump/2.93.0 branch August 23, 2023 17:06
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
auto-approve p2 pr/no-squash This PR should be merged instead of squash-merging it
Projects
None yet
Development

Successfully merging this pull request may close these issues.