@aws-cdk-testing/cli-integ 3.2.4 → 3.3.1

package/tests/cli-integ-tests/cdk-bootstrap-can-remove-custompermissionsboundary.integtest.js

@@ -0,0 +1,61 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+const client_cloudformation_1 = require("@aws-sdk/client-cloudformation");
+const client_iam_1 = require("@aws-sdk/client-iam");
+const lib_1 = require("../../lib");
+const eventually_1 = require("../../lib/eventually");
+jest.setTimeout(2 * 60 * 60000); // Includes the time to acquire locks, worst-case single-threaded runtime
+(0, lib_1.integTest)('can remove customPermissionsBoundary', (0, lib_1.withoutBootstrap)(async (fixture) => {
+    var _a, _b, _c;
+    const bootstrapStackName = fixture.bootstrapStackName;
+    const policyName = `${bootstrapStackName}-pb`;
+    let policyArn;
+    try {
+        const policy = await fixture.aws.iam.send(new client_iam_1.CreatePolicyCommand({
+            PolicyName: policyName,
+            PolicyDocument: JSON.stringify({
+                Version: '2012-10-17',
+                Statement: {
+                    Action: ['*'],
+                    Resource: ['*'],
+                    Effect: 'Allow',
+                },
+            }),
+        }));
+        policyArn = (_a = policy.Policy) === null || _a === void 0 ? void 0 : _a.Arn;
+        // Policy creation and consistency across regions is "almost immediate"
+        // See: https://docs.aws.amazon.com/IAM/latest/UserGuide/troubleshoot_general.html#troubleshoot_general_eventual-consistency
+        // We will put this in an `eventually` block to retry stack creation with a reasonable timeout
+        const createStackWithPermissionBoundary = async () => {
+            var _a, _b;
+            await fixture.cdkBootstrapModern({
+                // toolkitStackName doesn't matter for this particular invocation
+                toolkitStackName: bootstrapStackName,
+                customPermissionsBoundary: policyName,
+            });
+            const response = await fixture.aws.cloudFormation.send(new client_cloudformation_1.DescribeStacksCommand({ StackName: bootstrapStackName }));
+            expect((_b = (_a = response.Stacks) === null || _a === void 0 ? void 0 : _a[0].Parameters) === null || _b === void 0 ? void 0 : _b.some(param => (param.ParameterKey === 'InputPermissionsBoundary' && param.ParameterValue === policyName))).toEqual(true);
+        };
+        await (0, eventually_1.default)(createStackWithPermissionBoundary, { maxAttempts: 3 });
+        await fixture.cdkBootstrapModern({
+            // toolkitStackName doesn't matter for this particular invocation
+            toolkitStackName: bootstrapStackName,
+            usePreviousParameters: false,
+        });
+        const response2 = await fixture.aws.cloudFormation.send(new client_cloudformation_1.DescribeStacksCommand({ StackName: bootstrapStackName }));
+        expect((_c = (_b = response2.Stacks) === null || _b === void 0 ? void 0 : _b[0].Parameters) === null || _c === void 0 ? void 0 : _c.some(param => (param.ParameterKey === 'InputPermissionsBoundary' && !param.ParameterValue))).toEqual(true);
+        const region = fixture.aws.region;
+        const account = await fixture.aws.account();
+        const role = await fixture.aws.iam.send(new client_iam_1.GetRoleCommand({ RoleName: `cdk-${fixture.qualifier}-cfn-exec-role-${account}-${region}` }));
+        if (!role.Role) {
+            throw new Error('Role not found');
+        }
+        expect(role.Role.PermissionsBoundary).toBeUndefined();
+    }
+    finally {
+        if (policyArn) {
+            await fixture.aws.iam.send(new client_iam_1.DeletePolicyCommand({ PolicyArn: policyArn }));
+        }
+    }
+}));
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiY2RrLWJvb3RzdHJhcC1jYW4tcmVtb3ZlLWN1c3RvbXBlcm1pc3Npb25zYm91bmRhcnkuaW50ZWd0ZXN0LmpzIiwic291cmNlUm9vdCI6IiIsInNvdXJjZXMiOlsiY2RrLWJvb3RzdHJhcC1jYW4tcmVtb3ZlLWN1c3RvbXBlcm1pc3Npb25zYm91bmRhcnkuaW50ZWd0ZXN0LnRzIl0sIm5hbWVzIjpbXSwibWFwcGluZ3MiOiI7O0FBQUEsMEVBQXVFO0FBQ3ZFLG9EQUErRjtBQUMvRixtQ0FBd0Q7QUFDeEQscURBQThDO0FBRTlDLElBQUksQ0FBQyxVQUFVLENBQUMsQ0FBQyxHQUFHLEVBQUUsR0FBRyxLQUFNLENBQUMsQ0FBQyxDQUFDLHlFQUF5RTtBQUUzRyxJQUFBLGVBQVMsRUFBQyxzQ0FBc0MsRUFBRSxJQUFBLHNCQUFnQixFQUFDLEtBQUssRUFBRSxPQUFPLEVBQUUsRUFBRTs7SUFDbkYsTUFBTSxrQkFBa0IsR0FBRyxPQUFPLENBQUMsa0JBQWtCLENBQUM7SUFDdEQsTUFBTSxVQUFVLEdBQUcsR0FBRyxrQkFBa0IsS0FBSyxDQUFDO0lBQzlDLElBQUksU0FBUyxDQUFDO0lBQ2QsSUFBSSxDQUFDO1FBQ0gsTUFBTSxNQUFNLEdBQUcsTUFBTSxPQUFPLENBQUMsR0FBRyxDQUFDLEdBQUcsQ0FBQyxJQUFJLENBQ3ZDLElBQUksZ0NBQW1CLENBQUM7WUFDdEIsVUFBVSxFQUFFLFVBQVU7WUFDdEIsY0FBYyxFQUFFLElBQUksQ0FBQyxTQUFTLENBQUM7Z0JBQzdCLE9BQU8sRUFBRSxZQUFZO2dCQUNyQixTQUFTLEVBQUU7b0JBQ1QsTUFBTSxFQUFFLENBQUMsR0FBRyxDQUFDO29CQUNiLFFBQVEsRUFBRSxDQUFDLEdBQUcsQ0FBQztvQkFDZixNQUFNLEVBQUUsT0FBTztpQkFDaEI7YUFDRixDQUFDO1NBQ0gsQ0FBQyxDQUNILENBQUM7UUFDRixTQUFTLEdBQUcsTUFBQSxNQUFNLENBQUMsTUFBTSwwQ0FBRSxHQUFHLENBQUM7UUFFL0IsdUVBQXVFO1FBQ3ZFLDRIQUE0SDtRQUM1SCw4RkFBOEY7UUFDOUYsTUFBTSxpQ0FBaUMsR0FBRyxLQUFLLElBQW1CLEVBQUU7O1lBQ2xFLE1BQU0sT0FBTyxDQUFDLGtCQUFrQixDQUFDO2dCQUMvQixpRUFBaUU7Z0JBQ2pFLGdCQUFnQixFQUFFLGtCQUFrQjtnQkFDcEMseUJBQXlCLEVBQUUsVUFBVTthQUN0QyxDQUFDLENBQUM7WUFFSCxNQUFNLFFBQVEsR0FBRyxNQUFNLE9BQU8sQ0FBQyxHQUFHLENBQUMsY0FBYyxDQUFDLElBQUksQ0FDcEQsSUFBSSw2Q0FBcUIsQ0FBQyxFQUFFLFNBQVMsRUFBRSxrQkFBa0IsRUFBRSxDQUFDLENBQzdELENBQUM7WUFDRixNQUFNLENBQ0osTUFBQSxNQUFBLFFBQVEsQ0FBQyxNQUFNLDBDQUFHLENBQUMsRUFBRSxVQUFVLDBDQUFFLElBQUksQ0FDbkMsS0FBSyxDQUFDLEVBQUUsQ0FBQyxDQUFDLEtBQUssQ0FBQyxZQUFZLEtBQUssMEJBQTBCLElBQUksS0FBSyxDQUFDLGNBQWMsS0FBSyxVQUFVLENBQUMsQ0FDcEcsQ0FBQyxDQUFDLE9BQU8sQ0FBQyxJQUFJLENBQUMsQ0FBQztRQUNyQixDQUFDLENBQUM7UUFFRixNQUFNLElBQUEsb0JBQVUsRUFBQyxpQ0FBaUMsRUFBRSxFQUFFLFdBQVcsRUFBRSxDQUFDLEVBQUUsQ0FBQyxDQUFDO1FBRXhFLE1BQU0sT0FBTyxDQUFDLGtCQUFrQixDQUFDO1lBQy9CLGlFQUFpRTtZQUNqRSxnQkFBZ0IsRUFBRSxrQkFBa0I7WUFDcEMscUJBQXFCLEVBQUUsS0FBSztTQUM3QixDQUFDLENBQUM7UUFDSCxNQUFNLFNBQVMsR0FBRyxNQUFNLE9BQU8sQ0FBQyxHQUFHLENBQUMsY0FBYyxDQUFDLElBQUksQ0FDckQsSUFBSSw2Q0FBcUIsQ0FBQyxFQUFFLFNBQVMsRUFBRSxrQkFBa0IsRUFBRSxDQUFDLENBQzdELENBQUM7UUFDRixNQUFNLENBQ0osTUFBQSxNQUFBLFNBQVMsQ0FBQyxNQUFNLDBDQUFHLENBQUMsRUFBRSxVQUFVLDBDQUFFLElBQUksQ0FDcEMsS0FBSyxDQUFDLEVBQUUsQ0FBQyxDQUFDLEtBQUssQ0FBQyxZQUFZLEtBQUssMEJBQTBCLElBQUksQ0FBQyxLQUFLLENBQUMsY0FBYyxDQUFDLENBQ3RGLENBQUMsQ0FBQyxPQUFPLENBQUMsSUFBSSxDQUFDLENBQUM7UUFFbkIsTUFBTSxNQUFNLEdBQUcsT0FBTyxDQUFDLEdBQUcsQ0FBQyxNQUFNLENBQUM7UUFDbEMsTUFBTSxPQUFPLEdBQUcsTUFBTSxPQUFPLENBQUMsR0FBRyxDQUFDLE9BQU8sRUFBRSxDQUFDO1FBQzVDLE1BQU0sSUFBSSxHQUFHLE1BQU0sT0FBTyxDQUFDLEdBQUcsQ0FBQyxHQUFHLENBQUMsSUFBSSxDQUNyQyxJQUFJLDJCQUFjLENBQUMsRUFBRSxRQUFRLEVBQUUsT0FBTyxPQUFPLENBQUMsU0FBUyxrQkFBa0IsT0FBTyxJQUFJLE1BQU0sRUFBRSxFQUFFLENBQUMsQ0FDaEcsQ0FBQztRQUNGLElBQUksQ0FBQyxJQUFJLENBQUMsSUFBSSxFQUFFLENBQUM7WUFDZixNQUFNLElBQUksS0FBSyxDQUFDLGdCQUFnQixDQUFDLENBQUM7UUFDcEMsQ0FBQztRQUNELE1BQU0sQ0FBQyxJQUFJLENBQUMsSUFBSSxDQUFDLG1CQUFtQixDQUFDLENBQUMsYUFBYSxFQUFFLENBQUM7SUFDeEQsQ0FBQztZQUFTLENBQUM7UUFDVCxJQUFJLFNBQVMsRUFBRSxDQUFDO1lBQ2QsTUFBTSxPQUFPLENBQUMsR0FBRyxDQUFDLEdBQUcsQ0FBQyxJQUFJLENBQUMsSUFBSSxnQ0FBbUIsQ0FBQyxFQUFFLFNBQVMsRUFBRSxTQUFTLEVBQUUsQ0FBQyxDQUFDLENBQUM7UUFDaEYsQ0FBQztJQUNILENBQUM7QUFDSCxDQUFDLENBQUMsQ0FBQyxDQUFDIiwic291cmNlc0NvbnRlbnQiOlsiaW1wb3J0IHsgRGVzY3JpYmVTdGFja3NDb21tYW5kIH0gZnJvbSAnQGF3cy1zZGsvY2xpZW50LWNsb3VkZm9ybWF0aW9uJztcbmltcG9ydCB7IENyZWF0ZVBvbGljeUNvbW1hbmQsIERlbGV0ZVBvbGljeUNvbW1hbmQsIEdldFJvbGVDb21tYW5kIH0gZnJvbSAnQGF3cy1zZGsvY2xpZW50LWlhbSc7XG5pbXBvcnQgeyBpbnRlZ1Rlc3QsIHdpdGhvdXRCb290c3RyYXAgfSBmcm9tICcuLi8uLi9saWInO1xuaW1wb3J0IGV2ZW50dWFsbHkgZnJvbSAnLi4vLi4vbGliL2V2ZW50dWFsbHknO1xuXG5qZXN0LnNldFRpbWVvdXQoMiAqIDYwICogNjBfMDAwKTsgLy8gSW5jbHVkZXMgdGhlIHRpbWUgdG8gYWNxdWlyZSBsb2Nrcywgd29yc3QtY2FzZSBzaW5nbGUtdGhyZWFkZWQgcnVudGltZVxuXG5pbnRlZ1Rlc3QoJ2NhbiByZW1vdmUgY3VzdG9tUGVybWlzc2lvbnNCb3VuZGFyeScsIHdpdGhvdXRCb290c3RyYXAoYXN5bmMgKGZpeHR1cmUpID0+IHtcbiAgY29uc3QgYm9vdHN0cmFwU3RhY2tOYW1lID0gZml4dHVyZS5ib290c3RyYXBTdGFja05hbWU7XG4gIGNvbnN0IHBvbGljeU5hbWUgPSBgJHtib290c3RyYXBTdGFja05hbWV9LXBiYDtcbiAgbGV0IHBvbGljeUFybjtcbiAgdHJ5IHtcbiAgICBjb25zdCBwb2xpY3kgPSBhd2FpdCBmaXh0dXJlLmF3cy5pYW0uc2VuZChcbiAgICAgIG5ldyBDcmVhdGVQb2xpY3lDb21tYW5kKHtcbiAgICAgICAgUG9saWN5TmFtZTogcG9saWN5TmFtZSxcbiAgICAgICAgUG9saWN5RG9jdW1lbnQ6IEpTT04uc3RyaW5naWZ5KHtcbiAgICAgICAgICBWZXJzaW9uOiAnMjAxMi0xMC0xNycsXG4gICAgICAgICAgU3RhdGVtZW50OiB7XG4gICAgICAgICAgICBBY3Rpb246IFsnKiddLFxuICAgICAgICAgICAgUmVzb3VyY2U6IFsnKiddLFxuICAgICAgICAgICAgRWZmZWN0OiAnQWxsb3cnLFxuICAgICAgICAgIH0sXG4gICAgICAgIH0pLFxuICAgICAgfSksXG4gICAgKTtcbiAgICBwb2xpY3lBcm4gPSBwb2xpY3kuUG9saWN5Py5Bcm47XG5cbiAgICAvLyBQb2xpY3kgY3JlYXRpb24gYW5kIGNvbnNpc3RlbmN5IGFjcm9zcyByZWdpb25zIGlzIFwiYWxtb3N0IGltbWVkaWF0ZVwiXG4gICAgLy8gU2VlOiBodHRwczovL2RvY3MuYXdzLmFtYXpvbi5jb20vSUFNL2xhdGVzdC9Vc2VyR3VpZGUvdHJvdWJsZXNob290X2dlbmVyYWwuaHRtbCN0cm91Ymxlc2hvb3RfZ2VuZXJhbF9ldmVudHVhbC1jb25zaXN0ZW5jeVxuICAgIC8vIFdlIHdpbGwgcHV0IHRoaXMgaW4gYW4gYGV2ZW50dWFsbHlgIGJsb2NrIHRvIHJldHJ5IHN0YWNrIGNyZWF0aW9uIHdpdGggYSByZWFzb25hYmxlIHRpbWVvdXRcbiAgICBjb25zdCBjcmVhdGVTdGFja1dpdGhQZXJtaXNzaW9uQm91bmRhcnkgPSBhc3luYyAoKTogUHJvbWlzZTx2b2lkPiA9PiB7XG4gICAgICBhd2FpdCBmaXh0dXJlLmNka0Jvb3RzdHJhcE1vZGVybih7XG4gICAgICAgIC8vIHRvb2xraXRTdGFja05hbWUgZG9lc24ndCBtYXR0ZXIgZm9yIHRoaXMgcGFydGljdWxhciBpbnZvY2F0aW9uXG4gICAgICAgIHRvb2xraXRTdGFja05hbWU6IGJvb3RzdHJhcFN0YWNrTmFtZSxcbiAgICAgICAgY3VzdG9tUGVybWlzc2lvbnNCb3VuZGFyeTogcG9saWN5TmFtZSxcbiAgICAgIH0pO1xuXG4gICAgICBjb25zdCByZXNwb25zZSA9IGF3YWl0IGZpeHR1cmUuYXdzLmNsb3VkRm9ybWF0aW9uLnNlbmQoXG4gICAgICAgIG5ldyBEZXNjcmliZVN0YWNrc0NvbW1hbmQoeyBTdGFja05hbWU6IGJvb3RzdHJhcFN0YWNrTmFtZSB9KSxcbiAgICAgICk7XG4gICAgICBleHBlY3QoXG4gICAgICAgIHJlc3BvbnNlLlN0YWNrcz8uWzBdLlBhcmFtZXRlcnM/LnNvbWUoXG4gICAgICAgICAgcGFyYW0gPT4gKHBhcmFtLlBhcmFtZXRlcktleSA9PT0gJ0lucHV0UGVybWlzc2lvbnNCb3VuZGFyeScgJiYgcGFyYW0uUGFyYW1ldGVyVmFsdWUgPT09IHBvbGljeU5hbWUpLFxuICAgICAgICApKS50b0VxdWFsKHRydWUpO1xuICAgIH07XG5cbiAgICBhd2FpdCBldmVudHVhbGx5KGNyZWF0ZVN0YWNrV2l0aFBlcm1pc3Npb25Cb3VuZGFyeSwgeyBtYXhBdHRlbXB0czogMyB9KTtcblxuICAgIGF3YWl0IGZpeHR1cmUuY2RrQm9vdHN0cmFwTW9kZXJuKHtcbiAgICAgIC8vIHRvb2xraXRTdGFja05hbWUgZG9lc24ndCBtYXR0ZXIgZm9yIHRoaXMgcGFydGljdWxhciBpbnZvY2F0aW9uXG4gICAgICB0b29sa2l0U3RhY2tOYW1lOiBib290c3RyYXBTdGFja05hbWUsXG4gICAgICB1c2VQcmV2aW91c1BhcmFtZXRlcnM6IGZhbHNlLFxuICAgIH0pO1xuICAgIGNvbnN0IHJlc3BvbnNlMiA9IGF3YWl0IGZpeHR1cmUuYXdzLmNsb3VkRm9ybWF0aW9uLnNlbmQoXG4gICAgICBuZXcgRGVzY3JpYmVTdGFja3NDb21tYW5kKHsgU3RhY2tOYW1lOiBib290c3RyYXBTdGFja05hbWUgfSksXG4gICAgKTtcbiAgICBleHBlY3QoXG4gICAgICByZXNwb25zZTIuU3RhY2tzPy5bMF0uUGFyYW1ldGVycz8uc29tZShcbiAgICAgICAgcGFyYW0gPT4gKHBhcmFtLlBhcmFtZXRlcktleSA9PT0gJ0lucHV0UGVybWlzc2lvbnNCb3VuZGFyeScgJiYgIXBhcmFtLlBhcmFtZXRlclZhbHVlKSxcbiAgICAgICkpLnRvRXF1YWwodHJ1ZSk7XG5cbiAgICBjb25zdCByZWdpb24gPSBmaXh0dXJlLmF3cy5yZWdpb247XG4gICAgY29uc3QgYWNjb3VudCA9IGF3YWl0IGZpeHR1cmUuYXdzLmFjY291bnQoKTtcbiAgICBjb25zdCByb2xlID0gYXdhaXQgZml4dHVyZS5hd3MuaWFtLnNlbmQoXG4gICAgICBuZXcgR2V0Um9sZUNvbW1hbmQoeyBSb2xlTmFtZTogYGNkay0ke2ZpeHR1cmUucXVhbGlmaWVyfS1jZm4tZXhlYy1yb2xlLSR7YWNjb3VudH0tJHtyZWdpb259YCB9KSxcbiAgICApO1xuICAgIGlmICghcm9sZS5Sb2xlKSB7XG4gICAgICB0aHJvdyBuZXcgRXJyb3IoJ1JvbGUgbm90IGZvdW5kJyk7XG4gICAgfVxuICAgIGV4cGVjdChyb2xlLlJvbGUuUGVybWlzc2lvbnNCb3VuZGFyeSkudG9CZVVuZGVmaW5lZCgpO1xuICB9IGZpbmFsbHkge1xuICAgIGlmIChwb2xpY3lBcm4pIHtcbiAgICAgIGF3YWl0IGZpeHR1cmUuYXdzLmlhbS5zZW5kKG5ldyBEZWxldGVQb2xpY3lDb21tYW5kKHsgUG9saWN5QXJuOiBwb2xpY3lBcm4gfSkpO1xuICAgIH1cbiAgfVxufSkpO1xuXG4iXX0=

package/tests/cli-integ-tests/cdk-bootstrap-can-remove-custompermissionsboundary.integtest.ts

@@ -0,0 +1,77 @@
+import { DescribeStacksCommand } from '@aws-sdk/client-cloudformation';
+import { CreatePolicyCommand, DeletePolicyCommand, GetRoleCommand } from '@aws-sdk/client-iam';
+import { integTest, withoutBootstrap } from '../../lib';
+import eventually from '../../lib/eventually';
+
+jest.setTimeout(2 * 60 * 60_000); // Includes the time to acquire locks, worst-case single-threaded runtime
+
+integTest('can remove customPermissionsBoundary', withoutBootstrap(async (fixture) => {
+  const bootstrapStackName = fixture.bootstrapStackName;
+  const policyName = `${bootstrapStackName}-pb`;
+  let policyArn;
+  try {
+    const policy = await fixture.aws.iam.send(
+      new CreatePolicyCommand({
+        PolicyName: policyName,
+        PolicyDocument: JSON.stringify({
+          Version: '2012-10-17',
+          Statement: {
+            Action: ['*'],
+            Resource: ['*'],
+            Effect: 'Allow',
+          },
+        }),
+      }),
+    );
+    policyArn = policy.Policy?.Arn;
+
+    // Policy creation and consistency across regions is "almost immediate"
+    // See: https://docs.aws.amazon.com/IAM/latest/UserGuide/troubleshoot_general.html#troubleshoot_general_eventual-consistency
+    // We will put this in an `eventually` block to retry stack creation with a reasonable timeout
+    const createStackWithPermissionBoundary = async (): Promise<void> => {
+      await fixture.cdkBootstrapModern({
+        // toolkitStackName doesn't matter for this particular invocation
+        toolkitStackName: bootstrapStackName,
+        customPermissionsBoundary: policyName,
+      });
+
+      const response = await fixture.aws.cloudFormation.send(
+        new DescribeStacksCommand({ StackName: bootstrapStackName }),
+      );
+      expect(
+        response.Stacks?.[0].Parameters?.some(
+          param => (param.ParameterKey === 'InputPermissionsBoundary' && param.ParameterValue === policyName),
+        )).toEqual(true);
+    };
+
+    await eventually(createStackWithPermissionBoundary, { maxAttempts: 3 });
+
+    await fixture.cdkBootstrapModern({
+      // toolkitStackName doesn't matter for this particular invocation
+      toolkitStackName: bootstrapStackName,
+      usePreviousParameters: false,
+    });
+    const response2 = await fixture.aws.cloudFormation.send(
+      new DescribeStacksCommand({ StackName: bootstrapStackName }),
+    );
+    expect(
+      response2.Stacks?.[0].Parameters?.some(
+        param => (param.ParameterKey === 'InputPermissionsBoundary' && !param.ParameterValue),
+      )).toEqual(true);
+
+    const region = fixture.aws.region;
+    const account = await fixture.aws.account();
+    const role = await fixture.aws.iam.send(
+      new GetRoleCommand({ RoleName: `cdk-${fixture.qualifier}-cfn-exec-role-${account}-${region}` }),
+    );
+    if (!role.Role) {
+      throw new Error('Role not found');
+    }
+    expect(role.Role.PermissionsBoundary).toBeUndefined();
+  } finally {
+    if (policyArn) {
+      await fixture.aws.iam.send(new DeletePolicyCommand({ PolicyArn: policyArn }));
+    }
+  }
+}));
+

package/tests/cli-integ-tests/cdk-bootstrap-can-remove-trusted-account.integtest.d.ts

@@ -0,0 +1 @@
+export {};

package/tests/cli-integ-tests/cdk-bootstrap-can-remove-trusted-account.integtest.js

@@ -0,0 +1,25 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+const client_cloudformation_1 = require("@aws-sdk/client-cloudformation");
+const lib_1 = require("../../lib");
+jest.setTimeout(2 * 60 * 60000); // Includes the time to acquire locks, worst-case single-threaded runtime
+(0, lib_1.integTest)('can remove trusted account', (0, lib_1.withoutBootstrap)(async (fixture) => {
+    var _a, _b, _c;
+    const bootstrapStackName = fixture.bootstrapStackName;
+    await fixture.cdkBootstrapModern({
+        verbose: false,
+        toolkitStackName: bootstrapStackName,
+        cfnExecutionPolicy: 'arn:aws:iam::aws:policy/AdministratorAccess',
+        trust: ['599757620138', '730170552321'],
+    });
+    await fixture.cdkBootstrapModern({
+        verbose: true,
+        toolkitStackName: bootstrapStackName,
+        cfnExecutionPolicy: ' arn:aws:iam::aws:policy/AdministratorAccess',
+        untrust: ['730170552321'],
+    });
+    const response = await fixture.aws.cloudFormation.send(new client_cloudformation_1.DescribeStacksCommand({ StackName: bootstrapStackName }));
+    const trustedAccounts = (_c = (_b = (_a = response.Stacks) === null || _a === void 0 ? void 0 : _a[0].Parameters) === null || _b === void 0 ? void 0 : _b.find(p => p.ParameterKey === 'TrustedAccounts')) === null || _c === void 0 ? void 0 : _c.ParameterValue;
+    expect(trustedAccounts).toEqual('599757620138');
+}));
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiY2RrLWJvb3RzdHJhcC1jYW4tcmVtb3ZlLXRydXN0ZWQtYWNjb3VudC5pbnRlZ3Rlc3QuanMiLCJzb3VyY2VSb290IjoiIiwic291cmNlcyI6WyJjZGstYm9vdHN0cmFwLWNhbi1yZW1vdmUtdHJ1c3RlZC1hY2NvdW50LmludGVndGVzdC50cyJdLCJuYW1lcyI6W10sIm1hcHBpbmdzIjoiOztBQUFBLDBFQUF1RTtBQUN2RSxtQ0FBd0Q7QUFFeEQsSUFBSSxDQUFDLFVBQVUsQ0FBQyxDQUFDLEdBQUcsRUFBRSxHQUFHLEtBQU0sQ0FBQyxDQUFDLENBQUMseUVBQXlFO0FBRTNHLElBQUEsZUFBUyxFQUFDLDRCQUE0QixFQUFFLElBQUEsc0JBQWdCLEVBQUMsS0FBSyxFQUFFLE9BQU8sRUFBRSxFQUFFOztJQUN6RSxNQUFNLGtCQUFrQixHQUFHLE9BQU8sQ0FBQyxrQkFBa0IsQ0FBQztJQUV0RCxNQUFNLE9BQU8sQ0FBQyxrQkFBa0IsQ0FBQztRQUMvQixPQUFPLEVBQUUsS0FBSztRQUNkLGdCQUFnQixFQUFFLGtCQUFrQjtRQUNwQyxrQkFBa0IsRUFBRSw2Q0FBNkM7UUFDakUsS0FBSyxFQUFFLENBQUMsY0FBYyxFQUFFLGNBQWMsQ0FBQztLQUN4QyxDQUFDLENBQUM7SUFFSCxNQUFNLE9BQU8sQ0FBQyxrQkFBa0IsQ0FBQztRQUMvQixPQUFPLEVBQUUsSUFBSTtRQUNiLGdCQUFnQixFQUFFLGtCQUFrQjtRQUNwQyxrQkFBa0IsRUFBRSw4Q0FBOEM7UUFDbEUsT0FBTyxFQUFFLENBQUMsY0FBYyxDQUFDO0tBQzFCLENBQUMsQ0FBQztJQUVILE1BQU0sUUFBUSxHQUFHLE1BQU0sT0FBTyxDQUFDLEdBQUcsQ0FBQyxjQUFjLENBQUMsSUFBSSxDQUNwRCxJQUFJLDZDQUFxQixDQUFDLEVBQUUsU0FBUyxFQUFFLGtCQUFrQixFQUFFLENBQUMsQ0FDN0QsQ0FBQztJQUVGLE1BQU0sZUFBZSxHQUFHLE1BQUEsTUFBQSxNQUFBLFFBQVEsQ0FBQyxNQUFNLDBDQUFHLENBQUMsRUFBRSxVQUFVLDBDQUFFLElBQUksQ0FBQyxDQUFDLENBQUMsRUFBRSxDQUFDLENBQUMsQ0FBQyxZQUFZLEtBQUssaUJBQWlCLENBQUMsMENBQUUsY0FBYyxDQUFDO0lBQ3pILE1BQU0sQ0FBQyxlQUFlLENBQUMsQ0FBQyxPQUFPLENBQUMsY0FBYyxDQUFDLENBQUM7QUFDbEQsQ0FBQyxDQUFDLENBQUMsQ0FBQyIsInNvdXJjZXNDb250ZW50IjpbImltcG9ydCB7IERlc2NyaWJlU3RhY2tzQ29tbWFuZCB9IGZyb20gJ0Bhd3Mtc2RrL2NsaWVudC1jbG91ZGZvcm1hdGlvbic7XG5pbXBvcnQgeyBpbnRlZ1Rlc3QsIHdpdGhvdXRCb290c3RyYXAgfSBmcm9tICcuLi8uLi9saWInO1xuXG5qZXN0LnNldFRpbWVvdXQoMiAqIDYwICogNjBfMDAwKTsgLy8gSW5jbHVkZXMgdGhlIHRpbWUgdG8gYWNxdWlyZSBsb2Nrcywgd29yc3QtY2FzZSBzaW5nbGUtdGhyZWFkZWQgcnVudGltZVxuXG5pbnRlZ1Rlc3QoJ2NhbiByZW1vdmUgdHJ1c3RlZCBhY2NvdW50Jywgd2l0aG91dEJvb3RzdHJhcChhc3luYyAoZml4dHVyZSkgPT4ge1xuICBjb25zdCBib290c3RyYXBTdGFja05hbWUgPSBmaXh0dXJlLmJvb3RzdHJhcFN0YWNrTmFtZTtcblxuICBhd2FpdCBmaXh0dXJlLmNka0Jvb3RzdHJhcE1vZGVybih7XG4gICAgdmVyYm9zZTogZmFsc2UsXG4gICAgdG9vbGtpdFN0YWNrTmFtZTogYm9vdHN0cmFwU3RhY2tOYW1lLFxuICAgIGNmbkV4ZWN1dGlvblBvbGljeTogJ2Fybjphd3M6aWFtOjphd3M6cG9saWN5L0FkbWluaXN0cmF0b3JBY2Nlc3MnLFxuICAgIHRydXN0OiBbJzU5OTc1NzYyMDEzOCcsICc3MzAxNzA1NTIzMjEnXSxcbiAgfSk7XG5cbiAgYXdhaXQgZml4dHVyZS5jZGtCb290c3RyYXBNb2Rlcm4oe1xuICAgIHZlcmJvc2U6IHRydWUsXG4gICAgdG9vbGtpdFN0YWNrTmFtZTogYm9vdHN0cmFwU3RhY2tOYW1lLFxuICAgIGNmbkV4ZWN1dGlvblBvbGljeTogJyBhcm46YXdzOmlhbTo6YXdzOnBvbGljeS9BZG1pbmlzdHJhdG9yQWNjZXNzJyxcbiAgICB1bnRydXN0OiBbJzczMDE3MDU1MjMyMSddLFxuICB9KTtcblxuICBjb25zdCByZXNwb25zZSA9IGF3YWl0IGZpeHR1cmUuYXdzLmNsb3VkRm9ybWF0aW9uLnNlbmQoXG4gICAgbmV3IERlc2NyaWJlU3RhY2tzQ29tbWFuZCh7IFN0YWNrTmFtZTogYm9vdHN0cmFwU3RhY2tOYW1lIH0pLFxuICApO1xuXG4gIGNvbnN0IHRydXN0ZWRBY2NvdW50cyA9IHJlc3BvbnNlLlN0YWNrcz8uWzBdLlBhcmFtZXRlcnM/LmZpbmQocCA9PiBwLlBhcmFtZXRlcktleSA9PT0gJ1RydXN0ZWRBY2NvdW50cycpPy5QYXJhbWV0ZXJWYWx1ZTtcbiAgZXhwZWN0KHRydXN0ZWRBY2NvdW50cykudG9FcXVhbCgnNTk5NzU3NjIwMTM4Jyk7XG59KSk7XG5cbiJdfQ==

package/tests/cli-integ-tests/cdk-bootstrap-can-remove-trusted-account.integtest.ts

@@ -0,0 +1,30 @@
+import { DescribeStacksCommand } from '@aws-sdk/client-cloudformation';
+import { integTest, withoutBootstrap } from '../../lib';
+
+jest.setTimeout(2 * 60 * 60_000); // Includes the time to acquire locks, worst-case single-threaded runtime
+
+integTest('can remove trusted account', withoutBootstrap(async (fixture) => {
+  const bootstrapStackName = fixture.bootstrapStackName;
+
+  await fixture.cdkBootstrapModern({
+    verbose: false,
+    toolkitStackName: bootstrapStackName,
+    cfnExecutionPolicy: 'arn:aws:iam::aws:policy/AdministratorAccess',
+    trust: ['599757620138', '730170552321'],
+  });
+
+  await fixture.cdkBootstrapModern({
+    verbose: true,
+    toolkitStackName: bootstrapStackName,
+    cfnExecutionPolicy: ' arn:aws:iam::aws:policy/AdministratorAccess',
+    untrust: ['730170552321'],
+  });
+
+  const response = await fixture.aws.cloudFormation.send(
+    new DescribeStacksCommand({ StackName: bootstrapStackName }),
+  );
+
+  const trustedAccounts = response.Stacks?.[0].Parameters?.find(p => p.ParameterKey === 'TrustedAccounts')?.ParameterValue;
+  expect(trustedAccounts).toEqual('599757620138');
+}));
+

package/tests/cli-integ-tests/cdk-bootstrap-can-use-the-custom-permissions-boundary-(with-slashes)-to-bootstrap.integtest.d.ts

@@ -0,0 +1 @@
+export {};

package/tests/cli-integ-tests/cdk-bootstrap-can-use-the-custom-permissions-boundary-(with-slashes)-to-bootstrap.integtest.js

@@ -0,0 +1,14 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+const lib_1 = require("../../lib");
+jest.setTimeout(2 * 60 * 60000); // Includes the time to acquire locks, worst-case single-threaded runtime
+(0, lib_1.integTest)('can use the custom permissions boundary (with slashes) to bootstrap', (0, lib_1.withoutBootstrap)(async (fixture) => {
+    let template = await fixture.cdkBootstrapModern({
+        // toolkitStackName doesn't matter for this particular invocation
+        toolkitStackName: fixture.bootstrapStackName,
+        showTemplate: true,
+        customPermissionsBoundary: 'permission-boundary-name/with/path',
+    });
+    expect(template).toContain('permission-boundary-name/with/path');
+}));
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiY2RrLWJvb3RzdHJhcC1jYW4tdXNlLXRoZS1jdXN0b20tcGVybWlzc2lvbnMtYm91bmRhcnktKHdpdGgtc2xhc2hlcyktdG8tYm9vdHN0cmFwLmludGVndGVzdC5qcyIsInNvdXJjZVJvb3QiOiIiLCJzb3VyY2VzIjpbImNkay1ib290c3RyYXAtY2FuLXVzZS10aGUtY3VzdG9tLXBlcm1pc3Npb25zLWJvdW5kYXJ5LSh3aXRoLXNsYXNoZXMpLXRvLWJvb3RzdHJhcC5pbnRlZ3Rlc3QudHMiXSwibmFtZXMiOltdLCJtYXBwaW5ncyI6Ijs7QUFBQSxtQ0FBd0Q7QUFFeEQsSUFBSSxDQUFDLFVBQVUsQ0FBQyxDQUFDLEdBQUcsRUFBRSxHQUFHLEtBQU0sQ0FBQyxDQUFDLENBQUMseUVBQXlFO0FBRTNHLElBQUEsZUFBUyxFQUFDLHFFQUFxRSxFQUFFLElBQUEsc0JBQWdCLEVBQUMsS0FBSyxFQUFFLE9BQU8sRUFBRSxFQUFFO0lBQ2xILElBQUksUUFBUSxHQUFHLE1BQU0sT0FBTyxDQUFDLGtCQUFrQixDQUFDO1FBQzlDLGlFQUFpRTtRQUNqRSxnQkFBZ0IsRUFBRSxPQUFPLENBQUMsa0JBQWtCO1FBQzVDLFlBQVksRUFBRSxJQUFJO1FBQ2xCLHlCQUF5QixFQUFFLG9DQUFvQztLQUNoRSxDQUFDLENBQUM7SUFFSCxNQUFNLENBQUMsUUFBUSxDQUFDLENBQUMsU0FBUyxDQUFDLG9DQUFvQyxDQUFDLENBQUM7QUFDbkUsQ0FBQyxDQUFDLENBQUMsQ0FBQyIsInNvdXJjZXNDb250ZW50IjpbImltcG9ydCB7IGludGVnVGVzdCwgd2l0aG91dEJvb3RzdHJhcCB9IGZyb20gJy4uLy4uL2xpYic7XG5cbmplc3Quc2V0VGltZW91dCgyICogNjAgKiA2MF8wMDApOyAvLyBJbmNsdWRlcyB0aGUgdGltZSB0byBhY3F1aXJlIGxvY2tzLCB3b3JzdC1jYXNlIHNpbmdsZS10aHJlYWRlZCBydW50aW1lXG5cbmludGVnVGVzdCgnY2FuIHVzZSB0aGUgY3VzdG9tIHBlcm1pc3Npb25zIGJvdW5kYXJ5ICh3aXRoIHNsYXNoZXMpIHRvIGJvb3RzdHJhcCcsIHdpdGhvdXRCb290c3RyYXAoYXN5bmMgKGZpeHR1cmUpID0+IHtcbiAgbGV0IHRlbXBsYXRlID0gYXdhaXQgZml4dHVyZS5jZGtCb290c3RyYXBNb2Rlcm4oe1xuICAgIC8vIHRvb2xraXRTdGFja05hbWUgZG9lc24ndCBtYXR0ZXIgZm9yIHRoaXMgcGFydGljdWxhciBpbnZvY2F0aW9uXG4gICAgdG9vbGtpdFN0YWNrTmFtZTogZml4dHVyZS5ib290c3RyYXBTdGFja05hbWUsXG4gICAgc2hvd1RlbXBsYXRlOiB0cnVlLFxuICAgIGN1c3RvbVBlcm1pc3Npb25zQm91bmRhcnk6ICdwZXJtaXNzaW9uLWJvdW5kYXJ5LW5hbWUvd2l0aC9wYXRoJyxcbiAgfSk7XG5cbiAgZXhwZWN0KHRlbXBsYXRlKS50b0NvbnRhaW4oJ3Blcm1pc3Npb24tYm91bmRhcnktbmFtZS93aXRoL3BhdGgnKTtcbn0pKTtcblxuIl19

package/tests/cli-integ-tests/cdk-bootstrap-can-use-the-custom-permissions-boundary-(with-slashes)-to-bootstrap.integtest.ts

@@ -0,0 +1,15 @@
+import { integTest, withoutBootstrap } from '../../lib';
+
+jest.setTimeout(2 * 60 * 60_000); // Includes the time to acquire locks, worst-case single-threaded runtime
+
+integTest('can use the custom permissions boundary (with slashes) to bootstrap', withoutBootstrap(async (fixture) => {
+  let template = await fixture.cdkBootstrapModern({
+    // toolkitStackName doesn't matter for this particular invocation
+    toolkitStackName: fixture.bootstrapStackName,
+    showTemplate: true,
+    customPermissionsBoundary: 'permission-boundary-name/with/path',
+  });
+
+  expect(template).toContain('permission-boundary-name/with/path');
+}));
+

package/tests/cli-integ-tests/cdk-bootstrap-can-use-the-custom-permissions-boundary-to-bootstrap.integtest.d.ts

@@ -0,0 +1 @@
+export {};

package/tests/cli-integ-tests/cdk-bootstrap-can-use-the-custom-permissions-boundary-to-bootstrap.integtest.js

@@ -0,0 +1,14 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+const lib_1 = require("../../lib");
+jest.setTimeout(2 * 60 * 60000); // Includes the time to acquire locks, worst-case single-threaded runtime
+(0, lib_1.integTest)('can use the custom permissions boundary to bootstrap', (0, lib_1.withoutBootstrap)(async (fixture) => {
+    let template = await fixture.cdkBootstrapModern({
+        // toolkitStackName doesn't matter for this particular invocation
+        toolkitStackName: fixture.bootstrapStackName,
+        showTemplate: true,
+        customPermissionsBoundary: 'permission-boundary-name',
+    });
+    expect(template).toContain('permission-boundary-name');
+}));
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiY2RrLWJvb3RzdHJhcC1jYW4tdXNlLXRoZS1jdXN0b20tcGVybWlzc2lvbnMtYm91bmRhcnktdG8tYm9vdHN0cmFwLmludGVndGVzdC5qcyIsInNvdXJjZVJvb3QiOiIiLCJzb3VyY2VzIjpbImNkay1ib290c3RyYXAtY2FuLXVzZS10aGUtY3VzdG9tLXBlcm1pc3Npb25zLWJvdW5kYXJ5LXRvLWJvb3RzdHJhcC5pbnRlZ3Rlc3QudHMiXSwibmFtZXMiOltdLCJtYXBwaW5ncyI6Ijs7QUFBQSxtQ0FBd0Q7QUFFeEQsSUFBSSxDQUFDLFVBQVUsQ0FBQyxDQUFDLEdBQUcsRUFBRSxHQUFHLEtBQU0sQ0FBQyxDQUFDLENBQUMseUVBQXlFO0FBRTNHLElBQUEsZUFBUyxFQUFDLHNEQUFzRCxFQUFFLElBQUEsc0JBQWdCLEVBQUMsS0FBSyxFQUFFLE9BQU8sRUFBRSxFQUFFO0lBQ25HLElBQUksUUFBUSxHQUFHLE1BQU0sT0FBTyxDQUFDLGtCQUFrQixDQUFDO1FBQzlDLGlFQUFpRTtRQUNqRSxnQkFBZ0IsRUFBRSxPQUFPLENBQUMsa0JBQWtCO1FBQzVDLFlBQVksRUFBRSxJQUFJO1FBQ2xCLHlCQUF5QixFQUFFLDBCQUEwQjtLQUN0RCxDQUFDLENBQUM7SUFFSCxNQUFNLENBQUMsUUFBUSxDQUFDLENBQUMsU0FBUyxDQUFDLDBCQUEwQixDQUFDLENBQUM7QUFDekQsQ0FBQyxDQUFDLENBQUMsQ0FBQyIsInNvdXJjZXNDb250ZW50IjpbImltcG9ydCB7IGludGVnVGVzdCwgd2l0aG91dEJvb3RzdHJhcCB9IGZyb20gJy4uLy4uL2xpYic7XG5cbmplc3Quc2V0VGltZW91dCgyICogNjAgKiA2MF8wMDApOyAvLyBJbmNsdWRlcyB0aGUgdGltZSB0byBhY3F1aXJlIGxvY2tzLCB3b3JzdC1jYXNlIHNpbmdsZS10aHJlYWRlZCBydW50aW1lXG5cbmludGVnVGVzdCgnY2FuIHVzZSB0aGUgY3VzdG9tIHBlcm1pc3Npb25zIGJvdW5kYXJ5IHRvIGJvb3RzdHJhcCcsIHdpdGhvdXRCb290c3RyYXAoYXN5bmMgKGZpeHR1cmUpID0+IHtcbiAgbGV0IHRlbXBsYXRlID0gYXdhaXQgZml4dHVyZS5jZGtCb290c3RyYXBNb2Rlcm4oe1xuICAgIC8vIHRvb2xraXRTdGFja05hbWUgZG9lc24ndCBtYXR0ZXIgZm9yIHRoaXMgcGFydGljdWxhciBpbnZvY2F0aW9uXG4gICAgdG9vbGtpdFN0YWNrTmFtZTogZml4dHVyZS5ib290c3RyYXBTdGFja05hbWUsXG4gICAgc2hvd1RlbXBsYXRlOiB0cnVlLFxuICAgIGN1c3RvbVBlcm1pc3Npb25zQm91bmRhcnk6ICdwZXJtaXNzaW9uLWJvdW5kYXJ5LW5hbWUnLFxuICB9KTtcblxuICBleHBlY3QodGVtcGxhdGUpLnRvQ29udGFpbigncGVybWlzc2lvbi1ib3VuZGFyeS1uYW1lJyk7XG59KSk7XG5cbiJdfQ==

package/tests/cli-integ-tests/cdk-bootstrap-can-use-the-custom-permissions-boundary-to-bootstrap.integtest.ts

@@ -0,0 +1,15 @@
+import { integTest, withoutBootstrap } from '../../lib';
+
+jest.setTimeout(2 * 60 * 60_000); // Includes the time to acquire locks, worst-case single-threaded runtime
+
+integTest('can use the custom permissions boundary to bootstrap', withoutBootstrap(async (fixture) => {
+  let template = await fixture.cdkBootstrapModern({
+    // toolkitStackName doesn't matter for this particular invocation
+    toolkitStackName: fixture.bootstrapStackName,
+    showTemplate: true,
+    customPermissionsBoundary: 'permission-boundary-name',
+  });
+
+  expect(template).toContain('permission-boundary-name');
+}));
+

package/tests/cli-integ-tests/cdk-bootstrap-can-use-the-default-permissions-boundary-to-bootstrap.integtest.d.ts

@@ -0,0 +1 @@
+export {};

package/tests/cli-integ-tests/cdk-bootstrap-can-use-the-default-permissions-boundary-to-bootstrap.integtest.js

@@ -0,0 +1,14 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+const lib_1 = require("../../lib");
+jest.setTimeout(2 * 60 * 60000); // Includes the time to acquire locks, worst-case single-threaded runtime
+(0, lib_1.integTest)('can use the default permissions boundary to bootstrap', (0, lib_1.withoutBootstrap)(async (fixture) => {
+    let template = await fixture.cdkBootstrapModern({
+        // toolkitStackName doesn't matter for this particular invocation
+        toolkitStackName: fixture.bootstrapStackName,
+        showTemplate: true,
+        examplePermissionsBoundary: true,
+    });
+    expect(template).toContain('PermissionsBoundary');
+}));
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiY2RrLWJvb3RzdHJhcC1jYW4tdXNlLXRoZS1kZWZhdWx0LXBlcm1pc3Npb25zLWJvdW5kYXJ5LXRvLWJvb3RzdHJhcC5pbnRlZ3Rlc3QuanMiLCJzb3VyY2VSb290IjoiIiwic291cmNlcyI6WyJjZGstYm9vdHN0cmFwLWNhbi11c2UtdGhlLWRlZmF1bHQtcGVybWlzc2lvbnMtYm91bmRhcnktdG8tYm9vdHN0cmFwLmludGVndGVzdC50cyJdLCJuYW1lcyI6W10sIm1hcHBpbmdzIjoiOztBQUFBLG1DQUF3RDtBQUV4RCxJQUFJLENBQUMsVUFBVSxDQUFDLENBQUMsR0FBRyxFQUFFLEdBQUcsS0FBTSxDQUFDLENBQUMsQ0FBQyx5RUFBeUU7QUFFM0csSUFBQSxlQUFTLEVBQUMsdURBQXVELEVBQUUsSUFBQSxzQkFBZ0IsRUFBQyxLQUFLLEVBQUUsT0FBTyxFQUFFLEVBQUU7SUFDcEcsSUFBSSxRQUFRLEdBQUcsTUFBTSxPQUFPLENBQUMsa0JBQWtCLENBQUM7UUFDOUMsaUVBQWlFO1FBQ2pFLGdCQUFnQixFQUFFLE9BQU8sQ0FBQyxrQkFBa0I7UUFDNUMsWUFBWSxFQUFFLElBQUk7UUFDbEIsMEJBQTBCLEVBQUUsSUFBSTtLQUNqQyxDQUFDLENBQUM7SUFFSCxNQUFNLENBQUMsUUFBUSxDQUFDLENBQUMsU0FBUyxDQUFDLHFCQUFxQixDQUFDLENBQUM7QUFDcEQsQ0FBQyxDQUFDLENBQUMsQ0FBQyIsInNvdXJjZXNDb250ZW50IjpbImltcG9ydCB7IGludGVnVGVzdCwgd2l0aG91dEJvb3RzdHJhcCB9IGZyb20gJy4uLy4uL2xpYic7XG5cbmplc3Quc2V0VGltZW91dCgyICogNjAgKiA2MF8wMDApOyAvLyBJbmNsdWRlcyB0aGUgdGltZSB0byBhY3F1aXJlIGxvY2tzLCB3b3JzdC1jYXNlIHNpbmdsZS10aHJlYWRlZCBydW50aW1lXG5cbmludGVnVGVzdCgnY2FuIHVzZSB0aGUgZGVmYXVsdCBwZXJtaXNzaW9ucyBib3VuZGFyeSB0byBib290c3RyYXAnLCB3aXRob3V0Qm9vdHN0cmFwKGFzeW5jIChmaXh0dXJlKSA9PiB7XG4gIGxldCB0ZW1wbGF0ZSA9IGF3YWl0IGZpeHR1cmUuY2RrQm9vdHN0cmFwTW9kZXJuKHtcbiAgICAvLyB0b29sa2l0U3RhY2tOYW1lIGRvZXNuJ3QgbWF0dGVyIGZvciB0aGlzIHBhcnRpY3VsYXIgaW52b2NhdGlvblxuICAgIHRvb2xraXRTdGFja05hbWU6IGZpeHR1cmUuYm9vdHN0cmFwU3RhY2tOYW1lLFxuICAgIHNob3dUZW1wbGF0ZTogdHJ1ZSxcbiAgICBleGFtcGxlUGVybWlzc2lvbnNCb3VuZGFyeTogdHJ1ZSxcbiAgfSk7XG5cbiAgZXhwZWN0KHRlbXBsYXRlKS50b0NvbnRhaW4oJ1Blcm1pc3Npb25zQm91bmRhcnknKTtcbn0pKTtcblxuIl19

package/tests/cli-integ-tests/cdk-bootstrap-can-use-the-default-permissions-boundary-to-bootstrap.integtest.ts

@@ -0,0 +1,15 @@
+import { integTest, withoutBootstrap } from '../../lib';
+
+jest.setTimeout(2 * 60 * 60_000); // Includes the time to acquire locks, worst-case single-threaded runtime
+
+integTest('can use the default permissions boundary to bootstrap', withoutBootstrap(async (fixture) => {
+  let template = await fixture.cdkBootstrapModern({
+    // toolkitStackName doesn't matter for this particular invocation
+    toolkitStackName: fixture.bootstrapStackName,
+    showTemplate: true,
+    examplePermissionsBoundary: true,
+  });
+
+  expect(template).toContain('PermissionsBoundary');
+}));
+

package/tests/cli-integ-tests/cdk-bootstrap-create-ecr-with-tag-immutability-to-set-on.integtest.d.ts

@@ -0,0 +1 @@
+export {};

package/tests/cli-integ-tests/cdk-bootstrap-create-ecr-with-tag-immutability-to-set-on.integtest.js

@@ -0,0 +1,27 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+const client_cloudformation_1 = require("@aws-sdk/client-cloudformation");
+const client_ecr_1 = require("@aws-sdk/client-ecr");
+const lib_1 = require("../../lib");
+jest.setTimeout(2 * 60 * 60000); // Includes the time to acquire locks, worst-case single-threaded runtime
+(0, lib_1.integTest)('create ECR with tag IMMUTABILITY to set on', (0, lib_1.withoutBootstrap)(async (fixture) => {
+    var _a, _b, _c;
+    const bootstrapStackName = fixture.bootstrapStackName;
+    await fixture.cdkBootstrapModern({
+        verbose: true,
+        toolkitStackName: bootstrapStackName,
+    });
+    const response = await fixture.aws.cloudFormation.send(new client_cloudformation_1.DescribeStackResourcesCommand({
+        StackName: bootstrapStackName,
+    }));
+    const ecrResource = (_a = response.StackResources) === null || _a === void 0 ? void 0 : _a.find(resource => resource.LogicalResourceId === 'ContainerAssetsRepository');
+    expect(ecrResource).toBeDefined();
+    const ecrResponse = await fixture.aws.ecr.send(new client_ecr_1.DescribeRepositoriesCommand({
+        repositoryNames: [
+            // This is set, as otherwise we don't end up here
+            (_b = ecrResource === null || ecrResource === void 0 ? void 0 : ecrResource.PhysicalResourceId) !== null && _b !== void 0 ? _b : '',
+        ],
+    }));
+    expect((_c = ecrResponse.repositories) === null || _c === void 0 ? void 0 : _c[0].imageTagMutability).toEqual('IMMUTABLE');
+}));
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiY2RrLWJvb3RzdHJhcC1jcmVhdGUtZWNyLXdpdGgtdGFnLWltbXV0YWJpbGl0eS10by1zZXQtb24uaW50ZWd0ZXN0LmpzIiwic291cmNlUm9vdCI6IiIsInNvdXJjZXMiOlsiY2RrLWJvb3RzdHJhcC1jcmVhdGUtZWNyLXdpdGgtdGFnLWltbXV0YWJpbGl0eS10by1zZXQtb24uaW50ZWd0ZXN0LnRzIl0sIm5hbWVzIjpbXSwibWFwcGluZ3MiOiI7O0FBQUEsMEVBQStFO0FBQy9FLG9EQUFrRTtBQUNsRSxtQ0FBd0Q7QUFFeEQsSUFBSSxDQUFDLFVBQVUsQ0FBQyxDQUFDLEdBQUcsRUFBRSxHQUFHLEtBQU0sQ0FBQyxDQUFDLENBQUMseUVBQXlFO0FBRTNHLElBQUEsZUFBUyxFQUFDLDRDQUE0QyxFQUFFLElBQUEsc0JBQWdCLEVBQUMsS0FBSyxFQUFFLE9BQU8sRUFBRSxFQUFFOztJQUN6RixNQUFNLGtCQUFrQixHQUFHLE9BQU8sQ0FBQyxrQkFBa0IsQ0FBQztJQUV0RCxNQUFNLE9BQU8sQ0FBQyxrQkFBa0IsQ0FBQztRQUMvQixPQUFPLEVBQUUsSUFBSTtRQUNiLGdCQUFnQixFQUFFLGtCQUFrQjtLQUNyQyxDQUFDLENBQUM7SUFFSCxNQUFNLFFBQVEsR0FBRyxNQUFNLE9BQU8sQ0FBQyxHQUFHLENBQUMsY0FBYyxDQUFDLElBQUksQ0FDcEQsSUFBSSxxREFBNkIsQ0FBQztRQUNoQyxTQUFTLEVBQUUsa0JBQWtCO0tBQzlCLENBQUMsQ0FDSCxDQUFDO0lBQ0YsTUFBTSxXQUFXLEdBQUcsTUFBQSxRQUFRLENBQUMsY0FBYywwQ0FBRSxJQUFJLENBQUMsUUFBUSxDQUFDLEVBQUUsQ0FBQyxRQUFRLENBQUMsaUJBQWlCLEtBQUssMkJBQTJCLENBQUMsQ0FBQztJQUMxSCxNQUFNLENBQUMsV0FBVyxDQUFDLENBQUMsV0FBVyxFQUFFLENBQUM7SUFFbEMsTUFBTSxXQUFXLEdBQUcsTUFBTSxPQUFPLENBQUMsR0FBRyxDQUFDLEdBQUcsQ0FBQyxJQUFJLENBQzVDLElBQUksd0NBQTJCLENBQUM7UUFDOUIsZUFBZSxFQUFFO1lBQ2YsaURBQWlEO1lBQ2pELE1BQUEsV0FBVyxhQUFYLFdBQVcsdUJBQVgsV0FBVyxDQUFFLGtCQUFrQixtQ0FBSSxFQUFFO1NBQ3RDO0tBQ0YsQ0FBQyxDQUNILENBQUM7SUFFRixNQUFNLENBQUMsTUFBQSxXQUFXLENBQUMsWUFBWSwwQ0FBRyxDQUFDLEVBQUUsa0JBQWtCLENBQUMsQ0FBQyxPQUFPLENBQUMsV0FBVyxDQUFDLENBQUM7QUFDaEYsQ0FBQyxDQUFDLENBQUMsQ0FBQyIsInNvdXJjZXNDb250ZW50IjpbImltcG9ydCB7IERlc2NyaWJlU3RhY2tSZXNvdXJjZXNDb21tYW5kIH0gZnJvbSAnQGF3cy1zZGsvY2xpZW50LWNsb3VkZm9ybWF0aW9uJztcbmltcG9ydCB7IERlc2NyaWJlUmVwb3NpdG9yaWVzQ29tbWFuZCB9IGZyb20gJ0Bhd3Mtc2RrL2NsaWVudC1lY3InO1xuaW1wb3J0IHsgaW50ZWdUZXN0LCB3aXRob3V0Qm9vdHN0cmFwIH0gZnJvbSAnLi4vLi4vbGliJztcblxuamVzdC5zZXRUaW1lb3V0KDIgKiA2MCAqIDYwXzAwMCk7IC8vIEluY2x1ZGVzIHRoZSB0aW1lIHRvIGFjcXVpcmUgbG9ja3MsIHdvcnN0LWNhc2Ugc2luZ2xlLXRocmVhZGVkIHJ1bnRpbWVcblxuaW50ZWdUZXN0KCdjcmVhdGUgRUNSIHdpdGggdGFnIElNTVVUQUJJTElUWSB0byBzZXQgb24nLCB3aXRob3V0Qm9vdHN0cmFwKGFzeW5jIChmaXh0dXJlKSA9PiB7XG4gIGNvbnN0IGJvb3RzdHJhcFN0YWNrTmFtZSA9IGZpeHR1cmUuYm9vdHN0cmFwU3RhY2tOYW1lO1xuXG4gIGF3YWl0IGZpeHR1cmUuY2RrQm9vdHN0cmFwTW9kZXJuKHtcbiAgICB2ZXJib3NlOiB0cnVlLFxuICAgIHRvb2xraXRTdGFja05hbWU6IGJvb3RzdHJhcFN0YWNrTmFtZSxcbiAgfSk7XG5cbiAgY29uc3QgcmVzcG9uc2UgPSBhd2FpdCBmaXh0dXJlLmF3cy5jbG91ZEZvcm1hdGlvbi5zZW5kKFxuICAgIG5ldyBEZXNjcmliZVN0YWNrUmVzb3VyY2VzQ29tbWFuZCh7XG4gICAgICBTdGFja05hbWU6IGJvb3RzdHJhcFN0YWNrTmFtZSxcbiAgICB9KSxcbiAgKTtcbiAgY29uc3QgZWNyUmVzb3VyY2UgPSByZXNwb25zZS5TdGFja1Jlc291cmNlcz8uZmluZChyZXNvdXJjZSA9PiByZXNvdXJjZS5Mb2dpY2FsUmVzb3VyY2VJZCA9PT0gJ0NvbnRhaW5lckFzc2V0c1JlcG9zaXRvcnknKTtcbiAgZXhwZWN0KGVjclJlc291cmNlKS50b0JlRGVmaW5lZCgpO1xuXG4gIGNvbnN0IGVjclJlc3BvbnNlID0gYXdhaXQgZml4dHVyZS5hd3MuZWNyLnNlbmQoXG4gICAgbmV3IERlc2NyaWJlUmVwb3NpdG9yaWVzQ29tbWFuZCh7XG4gICAgICByZXBvc2l0b3J5TmFtZXM6IFtcbiAgICAgICAgLy8gVGhpcyBpcyBzZXQsIGFzIG90aGVyd2lzZSB3ZSBkb24ndCBlbmQgdXAgaGVyZVxuICAgICAgICBlY3JSZXNvdXJjZT8uUGh5c2ljYWxSZXNvdXJjZUlkID8/ICcnLFxuICAgICAgXSxcbiAgICB9KSxcbiAgKTtcblxuICBleHBlY3QoZWNyUmVzcG9uc2UucmVwb3NpdG9yaWVzPy5bMF0uaW1hZ2VUYWdNdXRhYmlsaXR5KS50b0VxdWFsKCdJTU1VVEFCTEUnKTtcbn0pKTtcblxuIl19

package/tests/cli-integ-tests/cdk-bootstrap-create-ecr-with-tag-immutability-to-set-on.integtest.ts

@@ -0,0 +1,34 @@
+import { DescribeStackResourcesCommand } from '@aws-sdk/client-cloudformation';
+import { DescribeRepositoriesCommand } from '@aws-sdk/client-ecr';
+import { integTest, withoutBootstrap } from '../../lib';
+
+jest.setTimeout(2 * 60 * 60_000); // Includes the time to acquire locks, worst-case single-threaded runtime
+
+integTest('create ECR with tag IMMUTABILITY to set on', withoutBootstrap(async (fixture) => {
+  const bootstrapStackName = fixture.bootstrapStackName;
+
+  await fixture.cdkBootstrapModern({
+    verbose: true,
+    toolkitStackName: bootstrapStackName,
+  });
+
+  const response = await fixture.aws.cloudFormation.send(
+    new DescribeStackResourcesCommand({
+      StackName: bootstrapStackName,
+    }),
+  );
+  const ecrResource = response.StackResources?.find(resource => resource.LogicalResourceId === 'ContainerAssetsRepository');
+  expect(ecrResource).toBeDefined();
+
+  const ecrResponse = await fixture.aws.ecr.send(
+    new DescribeRepositoriesCommand({
+      repositoryNames: [
+        // This is set, as otherwise we don't end up here
+        ecrResource?.PhysicalResourceId ?? '',
+      ],
+    }),
+  );
+
+  expect(ecrResponse.repositories?.[0].imageTagMutability).toEqual('IMMUTABLE');
+}));
+

package/tests/cli-integ-tests/cdk-bootstrap-deploy-new-style-synthesis-to-new-style-bootstrap-(with-docker-image).integtest.d.ts

@@ -0,0 +1 @@
+export {};

package/tests/cli-integ-tests/cdk-bootstrap-deploy-new-style-synthesis-to-new-style-bootstrap-(with-docker-image).integtest.js

@@ -0,0 +1,20 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+const lib_1 = require("../../lib");
+jest.setTimeout(2 * 60 * 60000); // Includes the time to acquire locks, worst-case single-threaded runtime
+(0, lib_1.integTest)('deploy new style synthesis to new style bootstrap (with docker image)', (0, lib_1.withoutBootstrap)(async (fixture) => {
+    const bootstrapStackName = fixture.bootstrapStackName;
+    await fixture.cdkBootstrapModern({
+        toolkitStackName: bootstrapStackName,
+        cfnExecutionPolicy: 'arn:aws:iam::aws:policy/AdministratorAccess',
+    });
+    // Deploy stack that uses file assets
+    await fixture.cdkDeploy('docker', {
+        options: [
+            '--toolkit-stack-name', bootstrapStackName,
+            '--context', `@aws-cdk/core:bootstrapQualifier=${fixture.qualifier}`,
+            '--context', '@aws-cdk/core:newStyleStackSynthesis=1',
+        ],
+    });
+}));
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiY2RrLWJvb3RzdHJhcC1kZXBsb3ktbmV3LXN0eWxlLXN5bnRoZXNpcy10by1uZXctc3R5bGUtYm9vdHN0cmFwLSh3aXRoLWRvY2tlci1pbWFnZSkuaW50ZWd0ZXN0LmpzIiwic291cmNlUm9vdCI6IiIsInNvdXJjZXMiOlsiY2RrLWJvb3RzdHJhcC1kZXBsb3ktbmV3LXN0eWxlLXN5bnRoZXNpcy10by1uZXctc3R5bGUtYm9vdHN0cmFwLSh3aXRoLWRvY2tlci1pbWFnZSkuaW50ZWd0ZXN0LnRzIl0sIm5hbWVzIjpbXSwibWFwcGluZ3MiOiI7O0FBQUEsbUNBQXdEO0FBRXhELElBQUksQ0FBQyxVQUFVLENBQUMsQ0FBQyxHQUFHLEVBQUUsR0FBRyxLQUFNLENBQUMsQ0FBQyxDQUFDLHlFQUF5RTtBQUUzRyxJQUFBLGVBQVMsRUFBQyx1RUFBdUUsRUFBRSxJQUFBLHNCQUFnQixFQUFDLEtBQUssRUFBRSxPQUFPLEVBQUUsRUFBRTtJQUNwSCxNQUFNLGtCQUFrQixHQUFHLE9BQU8sQ0FBQyxrQkFBa0IsQ0FBQztJQUV0RCxNQUFNLE9BQU8sQ0FBQyxrQkFBa0IsQ0FBQztRQUMvQixnQkFBZ0IsRUFBRSxrQkFBa0I7UUFDcEMsa0JBQWtCLEVBQUUsNkNBQTZDO0tBQ2xFLENBQUMsQ0FBQztJQUVILHFDQUFxQztJQUNyQyxNQUFNLE9BQU8sQ0FBQyxTQUFTLENBQUMsUUFBUSxFQUFFO1FBQ2hDLE9BQU8sRUFBRTtZQUNQLHNCQUFzQixFQUFFLGtCQUFrQjtZQUMxQyxXQUFXLEVBQUUsb0NBQW9DLE9BQU8sQ0FBQyxTQUFTLEVBQUU7WUFDcEUsV0FBVyxFQUFFLHdDQUF3QztTQUN0RDtLQUNGLENBQUMsQ0FBQztBQUNMLENBQUMsQ0FBQyxDQUFDLENBQUMiLCJzb3VyY2VzQ29udGVudCI6WyJpbXBvcnQgeyBpbnRlZ1Rlc3QsIHdpdGhvdXRCb290c3RyYXAgfSBmcm9tICcuLi8uLi9saWInO1xuXG5qZXN0LnNldFRpbWVvdXQoMiAqIDYwICogNjBfMDAwKTsgLy8gSW5jbHVkZXMgdGhlIHRpbWUgdG8gYWNxdWlyZSBsb2Nrcywgd29yc3QtY2FzZSBzaW5nbGUtdGhyZWFkZWQgcnVudGltZVxuXG5pbnRlZ1Rlc3QoJ2RlcGxveSBuZXcgc3R5bGUgc3ludGhlc2lzIHRvIG5ldyBzdHlsZSBib290c3RyYXAgKHdpdGggZG9ja2VyIGltYWdlKScsIHdpdGhvdXRCb290c3RyYXAoYXN5bmMgKGZpeHR1cmUpID0+IHtcbiAgY29uc3QgYm9vdHN0cmFwU3RhY2tOYW1lID0gZml4dHVyZS5ib290c3RyYXBTdGFja05hbWU7XG5cbiAgYXdhaXQgZml4dHVyZS5jZGtCb290c3RyYXBNb2Rlcm4oe1xuICAgIHRvb2xraXRTdGFja05hbWU6IGJvb3RzdHJhcFN0YWNrTmFtZSxcbiAgICBjZm5FeGVjdXRpb25Qb2xpY3k6ICdhcm46YXdzOmlhbTo6YXdzOnBvbGljeS9BZG1pbmlzdHJhdG9yQWNjZXNzJyxcbiAgfSk7XG5cbiAgLy8gRGVwbG95IHN0YWNrIHRoYXQgdXNlcyBmaWxlIGFzc2V0c1xuICBhd2FpdCBmaXh0dXJlLmNka0RlcGxveSgnZG9ja2VyJywge1xuICAgIG9wdGlvbnM6IFtcbiAgICAgICctLXRvb2xraXQtc3RhY2stbmFtZScsIGJvb3RzdHJhcFN0YWNrTmFtZSxcbiAgICAgICctLWNvbnRleHQnLCBgQGF3cy1jZGsvY29yZTpib290c3RyYXBRdWFsaWZpZXI9JHtmaXh0dXJlLnF1YWxpZmllcn1gLFxuICAgICAgJy0tY29udGV4dCcsICdAYXdzLWNkay9jb3JlOm5ld1N0eWxlU3RhY2tTeW50aGVzaXM9MScsXG4gICAgXSxcbiAgfSk7XG59KSk7XG5cbiJdfQ==

package/tests/cli-integ-tests/cdk-bootstrap-deploy-new-style-synthesis-to-new-style-bootstrap-(with-docker-image).integtest.ts

@@ -0,0 +1,22 @@
+import { integTest, withoutBootstrap } from '../../lib';
+
+jest.setTimeout(2 * 60 * 60_000); // Includes the time to acquire locks, worst-case single-threaded runtime
+
+integTest('deploy new style synthesis to new style bootstrap (with docker image)', withoutBootstrap(async (fixture) => {
+  const bootstrapStackName = fixture.bootstrapStackName;
+
+  await fixture.cdkBootstrapModern({
+    toolkitStackName: bootstrapStackName,
+    cfnExecutionPolicy: 'arn:aws:iam::aws:policy/AdministratorAccess',
+  });
+
+  // Deploy stack that uses file assets
+  await fixture.cdkDeploy('docker', {
+    options: [
+      '--toolkit-stack-name', bootstrapStackName,
+      '--context', `@aws-cdk/core:bootstrapQualifier=${fixture.qualifier}`,
+      '--context', '@aws-cdk/core:newStyleStackSynthesis=1',
+    ],
+  });
+}));
+

package/tests/cli-integ-tests/cdk-bootstrap-deploy-new-style-synthesis-to-new-style-bootstrap.integtest.d.ts

@@ -0,0 +1 @@
+export {};

package/tests/cli-integ-tests/cdk-bootstrap-deploy-new-style-synthesis-to-new-style-bootstrap.integtest.js

@@ -0,0 +1,20 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+const lib_1 = require("../../lib");
+jest.setTimeout(2 * 60 * 60000); // Includes the time to acquire locks, worst-case single-threaded runtime
+(0, lib_1.integTest)('deploy new style synthesis to new style bootstrap', (0, lib_1.withoutBootstrap)(async (fixture) => {
+    const bootstrapStackName = fixture.bootstrapStackName;
+    await fixture.cdkBootstrapModern({
+        toolkitStackName: bootstrapStackName,
+        cfnExecutionPolicy: 'arn:aws:iam::aws:policy/AdministratorAccess',
+    });
+    // Deploy stack that uses file assets
+    await fixture.cdkDeploy('lambda', {
+        options: [
+            '--toolkit-stack-name', bootstrapStackName,
+            '--context', `@aws-cdk/core:bootstrapQualifier=${fixture.qualifier}`,
+            '--context', '@aws-cdk/core:newStyleStackSynthesis=1',
+        ],
+    });
+}));
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiY2RrLWJvb3RzdHJhcC1kZXBsb3ktbmV3LXN0eWxlLXN5bnRoZXNpcy10by1uZXctc3R5bGUtYm9vdHN0cmFwLmludGVndGVzdC5qcyIsInNvdXJjZVJvb3QiOiIiLCJzb3VyY2VzIjpbImNkay1ib290c3RyYXAtZGVwbG95LW5ldy1zdHlsZS1zeW50aGVzaXMtdG8tbmV3LXN0eWxlLWJvb3RzdHJhcC5pbnRlZ3Rlc3QudHMiXSwibmFtZXMiOltdLCJtYXBwaW5ncyI6Ijs7QUFBQSxtQ0FBd0Q7QUFFeEQsSUFBSSxDQUFDLFVBQVUsQ0FBQyxDQUFDLEdBQUcsRUFBRSxHQUFHLEtBQU0sQ0FBQyxDQUFDLENBQUMseUVBQXlFO0FBRTNHLElBQUEsZUFBUyxFQUFDLG1EQUFtRCxFQUFFLElBQUEsc0JBQWdCLEVBQUMsS0FBSyxFQUFFLE9BQU8sRUFBRSxFQUFFO0lBQ2hHLE1BQU0sa0JBQWtCLEdBQUcsT0FBTyxDQUFDLGtCQUFrQixDQUFDO0lBRXRELE1BQU0sT0FBTyxDQUFDLGtCQUFrQixDQUFDO1FBQy9CLGdCQUFnQixFQUFFLGtCQUFrQjtRQUNwQyxrQkFBa0IsRUFBRSw2Q0FBNkM7S0FDbEUsQ0FBQyxDQUFDO0lBRUgscUNBQXFDO0lBQ3JDLE1BQU0sT0FBTyxDQUFDLFNBQVMsQ0FBQyxRQUFRLEVBQUU7UUFDaEMsT0FBTyxFQUFFO1lBQ1Asc0JBQXNCLEVBQUUsa0JBQWtCO1lBQzFDLFdBQVcsRUFBRSxvQ0FBb0MsT0FBTyxDQUFDLFNBQVMsRUFBRTtZQUNwRSxXQUFXLEVBQUUsd0NBQXdDO1NBQ3REO0tBQ0YsQ0FBQyxDQUFDO0FBQ0wsQ0FBQyxDQUFDLENBQUMsQ0FBQyIsInNvdXJjZXNDb250ZW50IjpbImltcG9ydCB7IGludGVnVGVzdCwgd2l0aG91dEJvb3RzdHJhcCB9IGZyb20gJy4uLy4uL2xpYic7XG5cbmplc3Quc2V0VGltZW91dCgyICogNjAgKiA2MF8wMDApOyAvLyBJbmNsdWRlcyB0aGUgdGltZSB0byBhY3F1aXJlIGxvY2tzLCB3b3JzdC1jYXNlIHNpbmdsZS10aHJlYWRlZCBydW50aW1lXG5cbmludGVnVGVzdCgnZGVwbG95IG5ldyBzdHlsZSBzeW50aGVzaXMgdG8gbmV3IHN0eWxlIGJvb3RzdHJhcCcsIHdpdGhvdXRCb290c3RyYXAoYXN5bmMgKGZpeHR1cmUpID0+IHtcbiAgY29uc3QgYm9vdHN0cmFwU3RhY2tOYW1lID0gZml4dHVyZS5ib290c3RyYXBTdGFja05hbWU7XG5cbiAgYXdhaXQgZml4dHVyZS5jZGtCb290c3RyYXBNb2Rlcm4oe1xuICAgIHRvb2xraXRTdGFja05hbWU6IGJvb3RzdHJhcFN0YWNrTmFtZSxcbiAgICBjZm5FeGVjdXRpb25Qb2xpY3k6ICdhcm46YXdzOmlhbTo6YXdzOnBvbGljeS9BZG1pbmlzdHJhdG9yQWNjZXNzJyxcbiAgfSk7XG5cbiAgLy8gRGVwbG95IHN0YWNrIHRoYXQgdXNlcyBmaWxlIGFzc2V0c1xuICBhd2FpdCBmaXh0dXJlLmNka0RlcGxveSgnbGFtYmRhJywge1xuICAgIG9wdGlvbnM6IFtcbiAgICAgICctLXRvb2xraXQtc3RhY2stbmFtZScsIGJvb3RzdHJhcFN0YWNrTmFtZSxcbiAgICAgICctLWNvbnRleHQnLCBgQGF3cy1jZGsvY29yZTpib290c3RyYXBRdWFsaWZpZXI9JHtmaXh0dXJlLnF1YWxpZmllcn1gLFxuICAgICAgJy0tY29udGV4dCcsICdAYXdzLWNkay9jb3JlOm5ld1N0eWxlU3RhY2tTeW50aGVzaXM9MScsXG4gICAgXSxcbiAgfSk7XG59KSk7XG5cbiJdfQ==

package/tests/cli-integ-tests/cdk-bootstrap-deploy-new-style-synthesis-to-new-style-bootstrap.integtest.ts

@@ -0,0 +1,22 @@
+import { integTest, withoutBootstrap } from '../../lib';
+
+jest.setTimeout(2 * 60 * 60_000); // Includes the time to acquire locks, worst-case single-threaded runtime
+
+integTest('deploy new style synthesis to new style bootstrap', withoutBootstrap(async (fixture) => {
+  const bootstrapStackName = fixture.bootstrapStackName;
+
+  await fixture.cdkBootstrapModern({
+    toolkitStackName: bootstrapStackName,
+    cfnExecutionPolicy: 'arn:aws:iam::aws:policy/AdministratorAccess',
+  });
+
+  // Deploy stack that uses file assets
+  await fixture.cdkDeploy('lambda', {
+    options: [
+      '--toolkit-stack-name', bootstrapStackName,
+      '--context', `@aws-cdk/core:bootstrapQualifier=${fixture.qualifier}`,
+      '--context', '@aws-cdk/core:newStyleStackSynthesis=1',
+    ],
+  });
+}));
+

package/tests/cli-integ-tests/cdk-bootstrap-deploy-old-style-synthesis-to-new-style-bootstrap.integtest.d.ts

@@ -0,0 +1 @@
+export {};

package/tests/cli-integ-tests/cdk-bootstrap-deploy-old-style-synthesis-to-new-style-bootstrap.integtest.js

@@ -0,0 +1,19 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+const lib_1 = require("../../lib");
+jest.setTimeout(2 * 60 * 60000); // Includes the time to acquire locks, worst-case single-threaded runtime
+(0, lib_1.integTest)('deploy old style synthesis to new style bootstrap', (0, lib_1.withoutBootstrap)(async (fixture) => {
+    const bootstrapStackName = fixture.bootstrapStackName;
+    await fixture.cdkBootstrapModern({
+        toolkitStackName: bootstrapStackName,
+        cfnExecutionPolicy: 'arn:aws:iam::aws:policy/AdministratorAccess',
+    });
+    // Deploy stack that uses file assets
+    await fixture.cdkDeploy('lambda', {
+        options: [
+            '--context', `@aws-cdk/core:bootstrapQualifier=${fixture.qualifier}`,
+            '--toolkit-stack-name', bootstrapStackName,
+        ],
+    });
+}));
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiY2RrLWJvb3RzdHJhcC1kZXBsb3ktb2xkLXN0eWxlLXN5bnRoZXNpcy10by1uZXctc3R5bGUtYm9vdHN0cmFwLmludGVndGVzdC5qcyIsInNvdXJjZVJvb3QiOiIiLCJzb3VyY2VzIjpbImNkay1ib290c3RyYXAtZGVwbG95LW9sZC1zdHlsZS1zeW50aGVzaXMtdG8tbmV3LXN0eWxlLWJvb3RzdHJhcC5pbnRlZ3Rlc3QudHMiXSwibmFtZXMiOltdLCJtYXBwaW5ncyI6Ijs7QUFBQSxtQ0FBd0Q7QUFFeEQsSUFBSSxDQUFDLFVBQVUsQ0FBQyxDQUFDLEdBQUcsRUFBRSxHQUFHLEtBQU0sQ0FBQyxDQUFDLENBQUMseUVBQXlFO0FBRTNHLElBQUEsZUFBUyxFQUFDLG1EQUFtRCxFQUFFLElBQUEsc0JBQWdCLEVBQUMsS0FBSyxFQUFFLE9BQU8sRUFBRSxFQUFFO0lBQ2hHLE1BQU0sa0JBQWtCLEdBQUcsT0FBTyxDQUFDLGtCQUFrQixDQUFDO0lBRXRELE1BQU0sT0FBTyxDQUFDLGtCQUFrQixDQUFDO1FBQy9CLGdCQUFnQixFQUFFLGtCQUFrQjtRQUNwQyxrQkFBa0IsRUFBRSw2Q0FBNkM7S0FDbEUsQ0FBQyxDQUFDO0lBRUgscUNBQXFDO0lBQ3JDLE1BQU0sT0FBTyxDQUFDLFNBQVMsQ0FBQyxRQUFRLEVBQUU7UUFDaEMsT0FBTyxFQUFFO1lBQ1AsV0FBVyxFQUFFLG9DQUFvQyxPQUFPLENBQUMsU0FBUyxFQUFFO1lBQ3BFLHNCQUFzQixFQUFFLGtCQUFrQjtTQUMzQztLQUNGLENBQUMsQ0FBQztBQUNMLENBQUMsQ0FBQyxDQUFDLENBQUMiLCJzb3VyY2VzQ29udGVudCI6WyJpbXBvcnQgeyBpbnRlZ1Rlc3QsIHdpdGhvdXRCb290c3RyYXAgfSBmcm9tICcuLi8uLi9saWInO1xuXG5qZXN0LnNldFRpbWVvdXQoMiAqIDYwICogNjBfMDAwKTsgLy8gSW5jbHVkZXMgdGhlIHRpbWUgdG8gYWNxdWlyZSBsb2Nrcywgd29yc3QtY2FzZSBzaW5nbGUtdGhyZWFkZWQgcnVudGltZVxuXG5pbnRlZ1Rlc3QoJ2RlcGxveSBvbGQgc3R5bGUgc3ludGhlc2lzIHRvIG5ldyBzdHlsZSBib290c3RyYXAnLCB3aXRob3V0Qm9vdHN0cmFwKGFzeW5jIChmaXh0dXJlKSA9PiB7XG4gIGNvbnN0IGJvb3RzdHJhcFN0YWNrTmFtZSA9IGZpeHR1cmUuYm9vdHN0cmFwU3RhY2tOYW1lO1xuXG4gIGF3YWl0IGZpeHR1cmUuY2RrQm9vdHN0cmFwTW9kZXJuKHtcbiAgICB0b29sa2l0U3RhY2tOYW1lOiBib290c3RyYXBTdGFja05hbWUsXG4gICAgY2ZuRXhlY3V0aW9uUG9saWN5OiAnYXJuOmF3czppYW06OmF3czpwb2xpY3kvQWRtaW5pc3RyYXRvckFjY2VzcycsXG4gIH0pO1xuXG4gIC8vIERlcGxveSBzdGFjayB0aGF0IHVzZXMgZmlsZSBhc3NldHNcbiAgYXdhaXQgZml4dHVyZS5jZGtEZXBsb3koJ2xhbWJkYScsIHtcbiAgICBvcHRpb25zOiBbXG4gICAgICAnLS1jb250ZXh0JywgYEBhd3MtY2RrL2NvcmU6Ym9vdHN0cmFwUXVhbGlmaWVyPSR7Zml4dHVyZS5xdWFsaWZpZXJ9YCxcbiAgICAgICctLXRvb2xraXQtc3RhY2stbmFtZScsIGJvb3RzdHJhcFN0YWNrTmFtZSxcbiAgICBdLFxuICB9KTtcbn0pKTtcblxuIl19

package/tests/cli-integ-tests/cdk-bootstrap-deploy-old-style-synthesis-to-new-style-bootstrap.integtest.ts

@@ -0,0 +1,21 @@
+import { integTest, withoutBootstrap } from '../../lib';
+
+jest.setTimeout(2 * 60 * 60_000); // Includes the time to acquire locks, worst-case single-threaded runtime
+
+integTest('deploy old style synthesis to new style bootstrap', withoutBootstrap(async (fixture) => {
+  const bootstrapStackName = fixture.bootstrapStackName;
+
+  await fixture.cdkBootstrapModern({
+    toolkitStackName: bootstrapStackName,
+    cfnExecutionPolicy: 'arn:aws:iam::aws:policy/AdministratorAccess',
+  });
+
+  // Deploy stack that uses file assets
+  await fixture.cdkDeploy('lambda', {
+    options: [
+      '--context', `@aws-cdk/core:bootstrapQualifier=${fixture.qualifier}`,
+      '--toolkit-stack-name', bootstrapStackName,
+    ],
+  });
+}));
+

package/tests/cli-integ-tests/cdk-bootstrap-switch-on-termination-protection.integtest.d.ts

@@ -0,0 +1 @@
+export {};

package/tests/cli-integ-tests/cdk-bootstrap-switch-on-termination-protection.integtest.js

@@ -0,0 +1,23 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+const client_cloudformation_1 = require("@aws-sdk/client-cloudformation");
+const lib_1 = require("../../lib");
+jest.setTimeout(2 * 60 * 60000); // Includes the time to acquire locks, worst-case single-threaded runtime
+(0, lib_1.integTest)('switch on termination protection, switch is left alone on re-bootstrap', (0, lib_1.withoutBootstrap)(async (fixture) => {
+    var _a;
+    const bootstrapStackName = fixture.bootstrapStackName;
+    await fixture.cdkBootstrapModern({
+        verbose: true,
+        toolkitStackName: bootstrapStackName,
+        terminationProtection: true,
+        cfnExecutionPolicy: 'arn:aws:iam::aws:policy/AdministratorAccess',
+    });
+    await fixture.cdkBootstrapModern({
+        verbose: true,
+        toolkitStackName: bootstrapStackName,
+        force: true,
+    });
+    const response = await fixture.aws.cloudFormation.send(new client_cloudformation_1.DescribeStacksCommand({ StackName: bootstrapStackName }));
+    expect((_a = response.Stacks) === null || _a === void 0 ? void 0 : _a[0].EnableTerminationProtection).toEqual(true);
+}));
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiY2RrLWJvb3RzdHJhcC1zd2l0Y2gtb24tdGVybWluYXRpb24tcHJvdGVjdGlvbi5pbnRlZ3Rlc3QuanMiLCJzb3VyY2VSb290IjoiIiwic291cmNlcyI6WyJjZGstYm9vdHN0cmFwLXN3aXRjaC1vbi10ZXJtaW5hdGlvbi1wcm90ZWN0aW9uLmludGVndGVzdC50cyJdLCJuYW1lcyI6W10sIm1hcHBpbmdzIjoiOztBQUFBLDBFQUF1RTtBQUN2RSxtQ0FBd0Q7QUFFeEQsSUFBSSxDQUFDLFVBQVUsQ0FBQyxDQUFDLEdBQUcsRUFBRSxHQUFHLEtBQU0sQ0FBQyxDQUFDLENBQUMseUVBQXlFO0FBRTNHLElBQUEsZUFBUyxFQUFDLHdFQUF3RSxFQUFFLElBQUEsc0JBQWdCLEVBQUMsS0FBSyxFQUFFLE9BQU8sRUFBRSxFQUFFOztJQUNySCxNQUFNLGtCQUFrQixHQUFHLE9BQU8sQ0FBQyxrQkFBa0IsQ0FBQztJQUV0RCxNQUFNLE9BQU8sQ0FBQyxrQkFBa0IsQ0FBQztRQUMvQixPQUFPLEVBQUUsSUFBSTtRQUNiLGdCQUFnQixFQUFFLGtCQUFrQjtRQUNwQyxxQkFBcUIsRUFBRSxJQUFJO1FBQzNCLGtCQUFrQixFQUFFLDZDQUE2QztLQUNsRSxDQUFDLENBQUM7SUFDSCxNQUFNLE9BQU8sQ0FBQyxrQkFBa0IsQ0FBQztRQUMvQixPQUFPLEVBQUUsSUFBSTtRQUNiLGdCQUFnQixFQUFFLGtCQUFrQjtRQUNwQyxLQUFLLEVBQUUsSUFBSTtLQUNaLENBQUMsQ0FBQztJQUVILE1BQU0sUUFBUSxHQUFHLE1BQU0sT0FBTyxDQUFDLEdBQUcsQ0FBQyxjQUFjLENBQUMsSUFBSSxDQUFDLElBQUksNkNBQXFCLENBQUMsRUFBRSxTQUFTLEVBQUUsa0JBQWtCLEVBQUUsQ0FBQyxDQUFDLENBQUM7SUFDckgsTUFBTSxDQUFDLE1BQUEsUUFBUSxDQUFDLE1BQU0sMENBQUcsQ0FBQyxFQUFFLDJCQUEyQixDQUFDLENBQUMsT0FBTyxDQUFDLElBQUksQ0FBQyxDQUFDO0FBQ3pFLENBQUMsQ0FBQyxDQUFDLENBQUMiLCJzb3VyY2VzQ29udGVudCI6WyJpbXBvcnQgeyBEZXNjcmliZVN0YWNrc0NvbW1hbmQgfSBmcm9tICdAYXdzLXNkay9jbGllbnQtY2xvdWRmb3JtYXRpb24nO1xuaW1wb3J0IHsgaW50ZWdUZXN0LCB3aXRob3V0Qm9vdHN0cmFwIH0gZnJvbSAnLi4vLi4vbGliJztcblxuamVzdC5zZXRUaW1lb3V0KDIgKiA2MCAqIDYwXzAwMCk7IC8vIEluY2x1ZGVzIHRoZSB0aW1lIHRvIGFjcXVpcmUgbG9ja3MsIHdvcnN0LWNhc2Ugc2luZ2xlLXRocmVhZGVkIHJ1bnRpbWVcblxuaW50ZWdUZXN0KCdzd2l0Y2ggb24gdGVybWluYXRpb24gcHJvdGVjdGlvbiwgc3dpdGNoIGlzIGxlZnQgYWxvbmUgb24gcmUtYm9vdHN0cmFwJywgd2l0aG91dEJvb3RzdHJhcChhc3luYyAoZml4dHVyZSkgPT4ge1xuICBjb25zdCBib290c3RyYXBTdGFja05hbWUgPSBmaXh0dXJlLmJvb3RzdHJhcFN0YWNrTmFtZTtcblxuICBhd2FpdCBmaXh0dXJlLmNka0Jvb3RzdHJhcE1vZGVybih7XG4gICAgdmVyYm9zZTogdHJ1ZSxcbiAgICB0b29sa2l0U3RhY2tOYW1lOiBib290c3RyYXBTdGFja05hbWUsXG4gICAgdGVybWluYXRpb25Qcm90ZWN0aW9uOiB0cnVlLFxuICAgIGNmbkV4ZWN1dGlvblBvbGljeTogJ2Fybjphd3M6aWFtOjphd3M6cG9saWN5L0FkbWluaXN0cmF0b3JBY2Nlc3MnLFxuICB9KTtcbiAgYXdhaXQgZml4dHVyZS5jZGtCb290c3RyYXBNb2Rlcm4oe1xuICAgIHZlcmJvc2U6IHRydWUsXG4gICAgdG9vbGtpdFN0YWNrTmFtZTogYm9vdHN0cmFwU3RhY2tOYW1lLFxuICAgIGZvcmNlOiB0cnVlLFxuICB9KTtcblxuICBjb25zdCByZXNwb25zZSA9IGF3YWl0IGZpeHR1cmUuYXdzLmNsb3VkRm9ybWF0aW9uLnNlbmQobmV3IERlc2NyaWJlU3RhY2tzQ29tbWFuZCh7IFN0YWNrTmFtZTogYm9vdHN0cmFwU3RhY2tOYW1lIH0pKTtcbiAgZXhwZWN0KHJlc3BvbnNlLlN0YWNrcz8uWzBdLkVuYWJsZVRlcm1pbmF0aW9uUHJvdGVjdGlvbikudG9FcXVhbCh0cnVlKTtcbn0pKTtcblxuIl19

package/tests/cli-integ-tests/cdk-bootstrap-switch-on-termination-protection.integtest.ts

@@ -0,0 +1,24 @@
+import { DescribeStacksCommand } from '@aws-sdk/client-cloudformation';
+import { integTest, withoutBootstrap } from '../../lib';
+
+jest.setTimeout(2 * 60 * 60_000); // Includes the time to acquire locks, worst-case single-threaded runtime
+
+integTest('switch on termination protection, switch is left alone on re-bootstrap', withoutBootstrap(async (fixture) => {
+  const bootstrapStackName = fixture.bootstrapStackName;
+
+  await fixture.cdkBootstrapModern({
+    verbose: true,
+    toolkitStackName: bootstrapStackName,
+    terminationProtection: true,
+    cfnExecutionPolicy: 'arn:aws:iam::aws:policy/AdministratorAccess',
+  });
+  await fixture.cdkBootstrapModern({
+    verbose: true,
+    toolkitStackName: bootstrapStackName,
+    force: true,
+  });
+
+  const response = await fixture.aws.cloudFormation.send(new DescribeStacksCommand({ StackName: bootstrapStackName }));
+  expect(response.Stacks?.[0].EnableTerminationProtection).toEqual(true);
+}));
+

package/tests/cli-integ-tests/cdk-bootstrap-upgrade-legacy-bootstrap-stack-to-new-bootstrap-stack-while-in-use.integtest.d.ts

@@ -0,0 +1 @@
+export {};