@aws-cdk/aws-elasticache-alpha 2.236.0-alpha.0 → 2.237.1-alpha.0

package/.jsii

@@ -8,7 +8,7 @@
     "url": "https://aws.amazon.com"
   },
   "dependencies": {
-    "aws-cdk-lib": "^2.236.0",
+    "aws-cdk-lib": "^2.237.1",
     "constructs": "^10.0.0"
   },
   "dependencyClosure": {
@@ -2606,6 +2606,19 @@
             }
           }
         },
+        "aws-cdk-lib.aws_mwaaserverless": {
+          "targets": {
+            "dotnet": {
+              "namespace": "Amazon.CDK.AWS.MWAAServerless"
+            },
+            "java": {
+              "package": "software.amazon.awscdk.services.mwaaserverless"
+            },
+            "python": {
+              "module": "aws_cdk.aws_mwaaserverless"
+            }
+          }
+        },
         "aws-cdk-lib.aws_neptune": {
           "targets": {
             "dotnet": {
@@ -6811,6 +6824,22 @@
             }
           }
         },
+        "aws-cdk-lib.interfaces.aws_mwaaserverless": {
+          "targets": {
+            "dotnet": {
+              "namespace": "Amazon.CDK.Interfaces.MWAAServerless"
+            },
+            "go": {
+              "packageName": "interfacesawsmwaaserverless"
+            },
+            "java": {
+              "package": "software.amazon.awscdk.interfaces.mwaaserverless"
+            },
+            "python": {
+              "module": "aws_cdk.interfaces.aws_mwaaserverless"
+            }
+          }
+        },
         "aws-cdk-lib.interfaces.aws_neptune": {
           "targets": {
             "dotnet": {
@@ -8492,7 +8521,7 @@
   },
   "name": "@aws-cdk/aws-elasticache-alpha",
   "readme": {
-    "markdown": "# ElastiCache CDK Construct Library\n<!--BEGIN STABILITY BANNER-->\n\n---\n\n![cdk-constructs: Experimental](https://img.shields.io/badge/cdk--constructs-experimental-important.svg?style=for-the-badge)\n\n> The APIs of higher level constructs in this module are experimental and under active development.\n> They are subject to non-backward compatible changes or removal in any future version. These are\n> not subject to the [Semantic Versioning](https://semver.org/) model and breaking changes will be\n> announced in the release notes. This means that while you may use them, you may need to update\n> your source code when upgrading to a newer version of this package.\n\n---\n\n<!--END STABILITY BANNER-->\n\nThis module has constructs for [Amazon ElastiCache](https://docs.aws.amazon.com/AmazonElastiCache/latest/dg/WhatIs.html).\n\n* The `ServerlessCache` construct facilitates the creation and management of serverless cache.\n* The `User` and `UserGroup` constructs facilitate the creation and management of users for the cache.\n\n## Serverless Cache\n\nAmazon ElastiCache Serverless is a serverless option that automatically scales cache capacity based on application traffic patterns. You can create a serverless cache using the `ServerlessCache` construct:\n\n```ts\nconst vpc = new ec2.Vpc(this, 'VPC');\n\nconst cache = new elasticache.ServerlessCache(this, 'ServerlessCache', {\n  vpc,\n});\n```\n\n### Connecting to serverless cache\n\nTo control who can access the serverless cache by the security groups, use the `.connections` attribute.\n\nThe serverless cache has a default port `6379`.\n\nThis example allows an EC2 instance to connect to the serverless cache:\n\n```ts\ndeclare const serverlessCache: elasticache.ServerlessCache;\ndeclare const instance: ec2.Instance;\n\n// allow the EC2 instance to connect to serverless cache on default port 6379\nserverlessCache.connections.allowDefaultPortFrom(instance);\n```\n\n### Cache usage limits\n\nYou can configure usage limits on both cache data storage and ECPU/second for your cache to control costs and ensure predictable performance.\n\n**Configuration options:**\n\n* **Maximum limits**: Ensure your cache usage never exceeds the configured maximum\n* **Minimum limits**: Reserve a baseline level of resources for consistent performance\n* **Both**: Define a range where your cache usage will operate\n\nFor more infomation, see [Setting scaling limits to manage costs](https://docs.aws.amazon.com/AmazonElastiCache/latest/dg/Scaling.html#Pre-Scaling).\n\n```ts\ndeclare const vpc: ec2.Vpc;\n\nconst serverlessCache = new elasticache.ServerlessCache(this, 'ServerlessCache', {\n  engine: elasticache.CacheEngine.VALKEY_LATEST,\n  vpc,\n  cacheUsageLimits: {\n    // cache data storage limits (GB)\n    dataStorageMinimumSize: Size.gibibytes(2), // minimum: 1GB\n    dataStorageMaximumSize: Size.gibibytes(3), // maximum: 5000GB\n    // rate limits (ECPU/second)\n    requestRateLimitMinimum: 1000, // minimum: 1000\n    requestRateLimitMaximum: 10000, // maximum: 15000000\n  },\n});\n```\n\n### Backups and restore\n\nYou can enable automatic backups for serverless cache.\nWhen automatic backups are enabled, ElastiCache creates a backup of the cache on a daily basis.\n\nAlso you can set the backup window for any time when it's most convenient.\nIf you don't specify a backup window, ElastiCache assigns one automatically.\n\nFor more information, see [Scheduling automatic backups](https://docs.aws.amazon.com/AmazonElastiCache/latest/dg/backups-automatic.html).\n\nTo enable automatic backups, set the `backupRetentionLimit` property. You can also specify the snapshot creation time by setting `backupTime` property:\n\n```ts\ndeclare const vpc: ec2.Vpc;\n\nconst serverlessCache = new elasticache.ServerlessCache(this, 'ServerlessCache', {\n  backup: {\n    // enable automatic backups and set the retention period to 6 days\n    backupRetentionLimit: 6,\n    // set the backup window to 9:00 AM UTC\n    backupTime: events.Schedule.cron({\n      hour: '9',\n      minute: '0',\n    }),\n  },\n  vpc,\n});\n```\n\nYou can create a final backup by setting `backupNameBeforeDeletion` property.\n\n```ts\ndeclare const vpc: ec2.Vpc;\n\nconst serverlessCache = new elasticache.ServerlessCache(this, 'ServerlessCache', {\n  engine: elasticache.CacheEngine.VALKEY_LATEST,\n  backup: {\n    // set a backup name before deleting a cache\n    backupNameBeforeDeletion: \"my-final-backup-name\",\n  },\n  vpc,\n});\n```\n\nYou can restore from backups by setting snapshot ARNs to `backupArnsToRestore` property:\n\n```ts\ndeclare const vpc: ec2.Vpc;\n\nconst serverlessCache = new elasticache.ServerlessCache(this, 'ServerlessCache', {\n  engine: elasticache.CacheEngine.VALKEY_LATEST,\n  backup: {\n    // set the backup(s) to restore\n    backupArnsToRestore: ['arn:aws:elasticache:us-east-1:123456789012:serverlesscachesnapshot:my-final-backup-name'],\n  },\n  vpc,\n});\n```\n\n### Encryption at rest\n\nAt-rest encryption is always enabled for Serverless Cache. There are two encryption options:\n\n* **Default**: When no `kmsKey` is specified (left as `undefined`), AWS owned KMS keys are used automatically\n* **Customer Managed Key**: Create a KMS key first, then pass it to the cache via the `kmsKey` property\n\n### Customer Managed Key for encryption at rest\n\nElastiCache supports symmetric Customer Managed key (CMK) for encryption at rest.\n\nFor more information, see [Using customer managed keys from AWS KMS](https://docs.aws.amazon.com/AmazonElastiCache/latest/dg/at-rest-encryption.html#using-customer-managed-keys-for-elasticache-security).\n\nTo use CMK, set your CMK to the `kmsKey` property:\n\n```ts\nimport { Key } from 'aws-cdk-lib/aws-kms';\n\ndeclare const kmsKey: Key;\ndeclare const vpc: ec2.Vpc;\n\nconst serverlessCache = new elasticache.ServerlessCache(this, 'ServerlessCache', {\n  engine: elasticache.CacheEngine.VALKEY_LATEST,\n  serverlessCacheName: 'my-serverless-cache',\n  vpc,\n  // set Customer Managed Key\n  kmsKey,\n});\n```\n\n### Metrics and monitoring\n\nYou can monitor your serverless cache using CloudWatch Metrics via the `metric` method.\n\nFor more information about serverless cache metrics, see [Serverless metrics and events for Valkey and Redis OSS](https://docs.aws.amazon.com/AmazonElastiCache/latest/dg/serverless-metrics-events-redis.html) and [Serverless metrics and events for Memcached](https://docs.aws.amazon.com/AmazonElastiCache/latest/dg/serverless-metrics-events.memcached.html).\n\n```ts\ndeclare const serverlessCache: elasticache.ServerlessCache;\n\n// The 5 minutes average of the total number of successful read-only key lookups in the cache.\nconst cacheHits = serverlessCache.metricCacheHitCount();\n\n// The 5 minutes average of the total number of bytes used by the data stored in the cache.\nconst bytesUsedForCache = serverlessCache.metricDataStored();\n\n// The 5 minutes average of the total number of ElastiCacheProcessingUnits (ECPUs) consumed by the requests executed on the cache.\nconst elastiCacheProcessingUnits = serverlessCache.metricProcessingUnitsConsumed();\n\n// Create an alarm for ECPUs.\nelastiCacheProcessingUnits.createAlarm(this, 'ElastiCacheProcessingUnitsAlarm', {\n  threshold: 50,\n  evaluationPeriods: 1,\n});\n```\n\n### Import an existing serverless cache\n\nTo import an existing ServerlessCache, use the `ServerlessCache.fromServerlessCacheAttributes` method:\n\n```ts\ndeclare const securityGroup: ec2.SecurityGroup;\n\nconst importedServerlessCache = elasticache.ServerlessCache.fromServerlessCacheAttributes(this, 'ImportedServerlessCache', {\n  serverlessCacheName: 'my-serverless-cache',\n  securityGroups: [securityGroup],\n});\n```\n\n## User and User Group\n\nSetup required properties and create:\n\n```ts\nconst newDefaultUser = new elasticache.NoPasswordUser(this, 'NoPasswordUser', {\n  userId: 'default',\n  accessControl: elasticache.AccessControl.fromAccessString(\"on ~* +@all\"),\n})\n\nconst userGroup = new elasticache.UserGroup(this, 'UserGroup', {\n  users: [newDefaultUser],\n});\n```\n\n### RBAC\n\nIn Valkey 7.2 and onward and Redis OSS 6.0 onward you can use a feature called Role-Based Access Control (RBAC). RBAC is also the only way to control access to serverless caches.\n\nRBAC enables you to control cache access through user groups. These user groups are designed as a way to organize access to caches.\n\nFor more information, see [Role-Based Access Control (RBAC)](https://docs.aws.amazon.com/AmazonElastiCache/latest/dg/Clusters.RBAC.html).\n\nTo enable RBAC for ElastiCache with Valkey or Redis OSS, you take the following steps:\n\n* Create users.\n* Create a user group and add users to the user group.\n* Assign the user group to a cache.\n\n### Create users\n\nFirst, you need to create users by using `IamUser`, `PasswordUser` or `NoPasswordUser` construct.\n\nWith RBAC, you create users and assign them specific permissions by using `accessString` property.\n\nFor more information, see [Specifying Permissions Using an Access String](https://docs.aws.amazon.com/AmazonElastiCache/latest/dg/Clusters.RBAC.html#Access-string).\n\nYou can create an IAM-enabled user by using `IamUser` construct:\n\n```ts\nconst user = new elasticache.IamUser(this, 'User', {\n  // set user engine\n  engine: elasticache.UserEngine.REDIS,\n\n  // set user id\n  userId: 'my-user',\n\n  // set username\n  userName: 'my-user',\n\n  // set access string\n  accessControl: elasticache.AccessControl.fromAccessString(\"on ~* +@all\"),\n});\n```\n\n> NOTE: IAM-enabled users must have matching user id and username. For more information, see [Limitations](https://docs.aws.amazon.com/AmazonElastiCache/latest/dg/auth-iam.html). The construct can set automatically the username to be the same as the user id.\n\nIf you want to create a password authenticated user, use `PasswordUser` construct:\n\n```ts\nconst user = new elasticache.PasswordUser(this, 'User', {\n  // set user engine\n  engine: elasticache.UserEngine.VALKEY,\n\n  // set user id\n  userId: 'my-user-id',\n\n  // set access string\n  accessControl: elasticache.AccessControl.fromAccessString(\"on ~* +@all\"),\n\n  // set username\n  userName: 'my-user-name',\n\n  // set up to two passwords\n  passwords: [\n    // \"SecretIdForPassword\" is the secret id for the password\n    SecretValue.secretsManager('SecretIdForPassword'),\n    // \"AnotherSecretIdForPassword\" is the secret id for the password\n    SecretValue.secretsManager('AnotherSecretIdForPassword'),\n  ],\n});\n```\n\nYou can also create a no password required user by using `NoPasswordUser` construct:\n\n```ts\nconst user = new elasticache.NoPasswordUser(this, 'User', {\n  // set user engine\n  engine: elasticache.UserEngine.REDIS,\n\n  // set user id\n  userId: 'my-user-id',\n\n  // set access string\n  accessControl: elasticache.AccessControl.fromAccessString(\"on ~* +@all\"),\n\n  // set username\n  userName: 'my-user-name',\n});\n```\n\n> NOTE: `NoPasswordUser` is only available for Redis Cache.\n\n### Default user\n\nElastiCache automatically creates a default user with both a user ID and username set to `default`. This default user cannot be modified or deleted. The user is created as a no password authentication user.\n\nThis user is intended for compatibility with the default behavior of previous Redis OSS versions and has an access string that permits it to call all commands and access all keys.\n\nTo use this automatically created default user in CDK, you can import it using `NoPasswordUser.fromUserAttributes` method. For more information on import methods, see the [Import an existing user and user group](#import-an-existing-user-and-user-group) section.\n\nTo add proper access control to a cache, replace the default user with a new one that is either disabled by setting the `accessString` to `off -@all` or secured with a strong password.\n\nTo change the default user, create a new default user with the username set to `default`. You can then swap it with the original default user.\n\nFor more information, see [Applying RBAC to a Cache for ElastiCache with Valkey or Redis OSS](https://docs.aws.amazon.com/AmazonElastiCache/latest/dg/Clusters.RBAC.html#rbac-using).\n\nIf you want to create a new default user, `userName` must be `default` and `userId` must not be `default` by using `NoPasswordUser` or `PasswordUser`:\n\n```ts\n// use the original `default` user by using import method\nconst defaultUser = elasticache.NoPasswordUser.fromUserAttributes(this, 'DefaultUser', {\n  // userId and userName must be 'default'\n  userId: 'default',\n});\n\n// create a new default user\nconst newDefaultUser = new elasticache.NoPasswordUser(this, 'NewDefaultUser', {\n  // new default user id must not be 'default'\n  userId: 'new-default',\n  // new default username must be 'default'\n  userName: 'default',\n  // set access string\n  accessControl: elasticache.AccessControl.fromAccessString(\"on ~* +@all\"),\n});\n```\n\n> NOTE: You can't create a new default user using `IamUser` because an IAM-enabled user's username and user ID cannot be different.\n\n### Add users to the user group\n\nNext, use the `UserGroup` construct to create a user group and add users to it.\nEnsure that you include either the original default user or a new default user:\n\n```ts\ndeclare const newDefaultUser: elasticache.IUser;\ndeclare const user: elasticache.IUser;\ndeclare const anotherUser: elasticache.IUser;\n\nconst userGroup = new elasticache.UserGroup(this, 'UserGroup', {\n  // add users including default user\n  users: [newDefaultUser, user],\n});\n\n// you can also add a user by using addUser method\nuserGroup.addUser(anotherUser);\n```\n\n### Assign user group\n\nFinally, assign a user group to cache:\n\n```ts\ndeclare const vpc: ec2.Vpc;\ndeclare const userGroup: elasticache.UserGroup;\n\nconst serverlessCache = new elasticache.ServerlessCache(this, 'ServerlessCache', {\n  engine: elasticache.CacheEngine.VALKEY_LATEST,\n  serverlessCacheName: 'my-serverless-cache',\n  vpc,\n  // assign User Group\n  userGroup,\n});\n\n```\n\n### Grant permissions to IAM-enabled users\n\nIf you create IAM-enabled users, `\"elasticache:Connect\"` action must be allowed for the users and cache.\n\n> NOTE: You don't need grant permissions to no password required users or password authentication users.\n\nFor more information, see [Authenticating with IAM](https://docs.aws.amazon.com/AmazonElastiCache/latest/dg/auth-iam.html).\n\nTo grant permissions, you can use the `grantConnect` method in `IamUser` and `ServerlessCache` constructs:\n\n```ts\ndeclare const user: elasticache.IamUser;\ndeclare const serverlessCache: elasticache.ServerlessCache;\ndeclare const role: iam.Role;\n\n// grant \"elasticache:Connect\" action permissions to role\nuser.grantConnect(role);\nserverlessCache.grantConnect(role);\n```\n\n### Import an existing user and user group\n\nYou can import an existing user and user group by using import methods:\n\n```ts\nconst stack = new Stack();\n\nconst importedIamUser = elasticache.IamUser.fromUserId(this, 'ImportedIamUser', 'my-iam-user-id');\n\nconst importedPasswordUser = elasticache.PasswordUser.fromUserAttributes(stack, 'ImportedPasswordUser', {\n  userId: 'my-password-user-id',\n});\n\nconst importedNoPasswordUser = elasticache.NoPasswordUser.fromUserAttributes(stack, 'ImportedNoPasswordUser', {\n  userId: 'my-no-password-user-id',\n});\n\nconst importedUserGroup = elasticache.UserGroup.fromUserGroupAttributes(this, 'ImportedUserGroup', {\n  userGroupName: 'my-user-group-name'\n});\n```\n"
+    "markdown": "# ElastiCache CDK Construct Library\n<!--BEGIN STABILITY BANNER-->\n\n---\n\n![cdk-constructs: Experimental](https://img.shields.io/badge/cdk--constructs-experimental-important.svg?style=for-the-badge)\n\n> The APIs of higher level constructs in this module are experimental and under active development.\n> They are subject to non-backward compatible changes or removal in any future version. These are\n> not subject to the [Semantic Versioning](https://semver.org/) model and breaking changes will be\n> announced in the release notes. This means that while you may use them, you may need to update\n> your source code when upgrading to a newer version of this package.\n\n---\n\n<!--END STABILITY BANNER-->\n\nThis module has constructs for [Amazon ElastiCache](https://docs.aws.amazon.com/AmazonElastiCache/latest/dg/WhatIs.html).\n\n* The `ServerlessCache` construct facilitates the creation and management of serverless cache.\n* The `User` and `UserGroup` constructs facilitate the creation and management of users for the cache.\n\n## Serverless Cache\n\nAmazon ElastiCache Serverless is a serverless option that automatically scales cache capacity based on application traffic patterns. You can create a serverless cache using the `ServerlessCache` construct:\n\n```ts\nconst vpc = new ec2.Vpc(this, 'VPC');\n\nconst cache = new elasticache.ServerlessCache(this, 'ServerlessCache', {\n  vpc,\n});\n```\n\n### Connecting to serverless cache\n\nTo control who can access the serverless cache by the security groups, use the `.connections` attribute.\n\nThe serverless cache has a default port `6379`.\n\nThis example allows an EC2 instance to connect to the serverless cache:\n\n```ts\ndeclare const serverlessCache: elasticache.ServerlessCache;\ndeclare const instance: ec2.Instance;\n\n// allow the EC2 instance to connect to serverless cache on default port 6379\nserverlessCache.connections.allowDefaultPortFrom(instance);\n```\n\n### Cache usage limits\n\nYou can configure usage limits on both cache data storage and ECPU/second for your cache to control costs and ensure predictable performance.\n\n**Configuration options:**\n\n* **Maximum limits**: Ensure your cache usage never exceeds the configured maximum\n* **Minimum limits**: Reserve a baseline level of resources for consistent performance\n* **Both**: Define a range where your cache usage will operate\n\nFor more infomation, see [Setting scaling limits to manage costs](https://docs.aws.amazon.com/AmazonElastiCache/latest/dg/Scaling.html#Pre-Scaling).\n\n```ts\ndeclare const vpc: ec2.Vpc;\n\nconst serverlessCache = new elasticache.ServerlessCache(this, 'ServerlessCache', {\n  engine: elasticache.CacheEngine.VALKEY_LATEST,\n  vpc,\n  cacheUsageLimits: {\n    // cache data storage limits (GB)\n    dataStorageMinimumSize: Size.gibibytes(2), // minimum: 1GB\n    dataStorageMaximumSize: Size.gibibytes(3), // maximum: 5000GB\n    // rate limits (ECPU/second)\n    requestRateLimitMinimum: 1000, // minimum: 1000\n    requestRateLimitMaximum: 10000, // maximum: 15000000\n  },\n});\n```\n\n### Backups and restore\n\nYou can enable automatic backups for serverless cache.\nWhen automatic backups are enabled, ElastiCache creates a backup of the cache on a daily basis.\n\nAlso you can set the backup window for any time when it's most convenient.\nIf you don't specify a backup window, ElastiCache assigns one automatically.\n\nFor more information, see [Scheduling automatic backups](https://docs.aws.amazon.com/AmazonElastiCache/latest/dg/backups-automatic.html).\n\nTo enable automatic backups, set the `backupRetentionLimit` property. You can also specify the snapshot creation time by setting `backupTime` property:\n\n```ts\ndeclare const vpc: ec2.Vpc;\n\nconst serverlessCache = new elasticache.ServerlessCache(this, 'ServerlessCache', {\n  backup: {\n    // enable automatic backups and set the retention period to 6 days\n    backupRetentionLimit: 6,\n    // set the backup window to 9:00 AM UTC\n    backupTime: events.Schedule.cron({\n      hour: '9',\n      minute: '0',\n    }),\n  },\n  vpc,\n});\n```\n\nYou can create a final backup by setting `backupNameBeforeDeletion` property.\n\n```ts\ndeclare const vpc: ec2.Vpc;\n\nconst serverlessCache = new elasticache.ServerlessCache(this, 'ServerlessCache', {\n  engine: elasticache.CacheEngine.VALKEY_LATEST,\n  backup: {\n    // set a backup name before deleting a cache\n    backupNameBeforeDeletion: \"my-final-backup-name\",\n  },\n  vpc,\n});\n```\n\nYou can restore from backups by setting snapshot ARNs to `backupArnsToRestore` property:\n\n```ts\ndeclare const vpc: ec2.Vpc;\n\nconst serverlessCache = new elasticache.ServerlessCache(this, 'ServerlessCache', {\n  engine: elasticache.CacheEngine.VALKEY_LATEST,\n  backup: {\n    // set the backup(s) to restore\n    backupArnsToRestore: ['arn:aws:elasticache:us-east-1:123456789012:serverlesscachesnapshot:my-final-backup-name'],\n  },\n  vpc,\n});\n```\n\n### Encryption at rest\n\nAt-rest encryption is always enabled for Serverless Cache. There are two encryption options:\n\n* **Default**: When no `kmsKey` is specified (left as `undefined`), AWS owned KMS keys are used automatically\n* **Customer Managed Key**: Create a KMS key first, then pass it to the cache via the `kmsKey` property\n\n### Customer Managed Key for encryption at rest\n\nElastiCache supports symmetric Customer Managed key (CMK) for encryption at rest.\n\nFor more information, see [Using customer managed keys from AWS KMS](https://docs.aws.amazon.com/AmazonElastiCache/latest/dg/at-rest-encryption.html#using-customer-managed-keys-for-elasticache-security).\n\nTo use CMK, set your CMK to the `kmsKey` property:\n\n```ts\nimport { Key } from 'aws-cdk-lib/aws-kms';\n\ndeclare const kmsKey: Key;\ndeclare const vpc: ec2.Vpc;\n\nconst serverlessCache = new elasticache.ServerlessCache(this, 'ServerlessCache', {\n  engine: elasticache.CacheEngine.VALKEY_LATEST,\n  serverlessCacheName: 'my-serverless-cache',\n  vpc,\n  // set Customer Managed Key\n  kmsKey,\n});\n```\n\n### Metrics and monitoring\n\nYou can monitor your serverless cache using CloudWatch Metrics via the `metric` method.\n\nFor more information about serverless cache metrics, see [Serverless metrics and events for Valkey and Redis OSS](https://docs.aws.amazon.com/AmazonElastiCache/latest/dg/serverless-metrics-events-redis.html) and [Serverless metrics and events for Memcached](https://docs.aws.amazon.com/AmazonElastiCache/latest/dg/serverless-metrics-events.memcached.html).\n\n```ts\ndeclare const serverlessCache: elasticache.ServerlessCache;\n\n// The 5 minutes average of the total number of successful read-only key lookups in the cache.\nconst cacheHits = serverlessCache.metricCacheHitCount();\n\n// The 5 minutes average of the total number of bytes used by the data stored in the cache.\nconst bytesUsedForCache = serverlessCache.metricDataStored();\n\n// The 5 minutes average of the total number of ElastiCacheProcessingUnits (ECPUs) consumed by the requests executed on the cache.\nconst elastiCacheProcessingUnits = serverlessCache.metricProcessingUnitsConsumed();\n\n// Create an alarm for ECPUs.\nelastiCacheProcessingUnits.createAlarm(this, 'ElastiCacheProcessingUnitsAlarm', {\n  threshold: 50,\n  evaluationPeriods: 1,\n});\n```\n\n### Import an existing serverless cache\n\nTo import an existing ServerlessCache, use the `ServerlessCache.fromServerlessCacheAttributes` method:\n\n```ts\ndeclare const securityGroup: ec2.SecurityGroup;\n\nconst importedServerlessCache = elasticache.ServerlessCache.fromServerlessCacheAttributes(this, 'ImportedServerlessCache', {\n  serverlessCacheName: 'my-serverless-cache',\n  securityGroups: [securityGroup],\n});\n```\n\n## User and User Group\n\nSetup required properties and create:\n\n```ts\nconst newDefaultUser = new elasticache.NoPasswordUser(this, 'NoPasswordUser', {\n  userId: 'default',\n  accessControl: elasticache.AccessControl.fromAccessString(\"on ~* +@all\"),\n})\n\nconst userGroup = new elasticache.UserGroup(this, 'UserGroup', {\n  users: [newDefaultUser],\n});\n```\n\n### RBAC\n\nIn Valkey 7.2 and onward and Redis OSS 6.0 onward you can use a feature called Role-Based Access Control (RBAC). RBAC is also the only way to control access to serverless caches.\n\nRBAC enables you to control cache access through user groups. These user groups are designed as a way to organize access to caches.\n\nFor more information, see [Role-Based Access Control (RBAC)](https://docs.aws.amazon.com/AmazonElastiCache/latest/dg/Clusters.RBAC.html).\n\nTo enable RBAC for ElastiCache with Valkey or Redis OSS, you take the following steps:\n\n* Create users.\n* Create a user group and add users to the user group.\n* Assign the user group to a cache.\n\n### Create users\n\nFirst, you need to create users by using `IamUser`, `PasswordUser` or `NoPasswordUser` construct.\n\nWith RBAC, you create users and assign them specific permissions by using `accessString` property.\n\nFor more information, see [Specifying Permissions Using an Access String](https://docs.aws.amazon.com/AmazonElastiCache/latest/dg/Clusters.RBAC.html#Access-string).\n\nYou can create an IAM-enabled user by using `IamUser` construct:\n\n```ts\nconst user = new elasticache.IamUser(this, 'User', {\n  // set user engine\n  engine: elasticache.UserEngine.REDIS,\n\n  // set user id\n  userId: 'my-user',\n\n  // set username\n  userName: 'my-user',\n\n  // set access string\n  accessControl: elasticache.AccessControl.fromAccessString(\"on ~* +@all\"),\n});\n```\n\n> NOTE: IAM-enabled users must have matching user id and username. For more information, see [Limitations](https://docs.aws.amazon.com/AmazonElastiCache/latest/dg/auth-iam.html). The construct can set automatically the username to be the same as the user id.\n\nIf you want to create a password authenticated user, use `PasswordUser` construct:\n\n```ts\nconst user = new elasticache.PasswordUser(this, 'User', {\n  // set user engine\n  engine: elasticache.UserEngine.VALKEY,\n\n  // set user id\n  userId: 'my-user-id',\n\n  // set access string\n  accessControl: elasticache.AccessControl.fromAccessString(\"on ~* +@all\"),\n\n  // set username\n  userName: 'my-user-name',\n\n  // set up to two passwords\n  passwords: [\n    // \"SecretIdForPassword\" is the secret id for the password\n    SecretValue.secretsManager('SecretIdForPassword'),\n    // \"AnotherSecretIdForPassword\" is the secret id for the password\n    SecretValue.secretsManager('AnotherSecretIdForPassword'),\n  ],\n});\n```\n\nYou can also create a no password required user by using `NoPasswordUser` construct:\n\n```ts\nconst user = new elasticache.NoPasswordUser(this, 'User', {\n  // set user engine\n  engine: elasticache.UserEngine.REDIS,\n\n  // set user id\n  userId: 'my-user-id',\n\n  // set access string\n  accessControl: elasticache.AccessControl.fromAccessString(\"on ~* +@all\"),\n\n  // set username\n  userName: 'my-user-name',\n});\n```\n\n> NOTE: `NoPasswordUser` is only available for Redis Cache.\n\n### Default user\n\nElastiCache automatically creates a default user with both a user ID and username set to `default`. This default user cannot be modified or deleted. The user is created as a no password authentication user.\n\nThis user is intended for compatibility with the default behavior of previous Redis OSS versions and has an access string that permits it to call all commands and access all keys.\n\nTo use this automatically created default user in CDK, you can import it using `NoPasswordUser.fromUserAttributes` method. For more information on import methods, see the [Import an existing user and user group](#import-an-existing-user-and-user-group) section.\n\nTo add proper access control to a cache, replace the default user with a new one that is either disabled by setting the `accessString` to `off -@all` or secured with a strong password.\n\nTo change the default user, create a new default user with the username set to `default`. You can then swap it with the original default user.\n\nFor more information, see [Applying RBAC to a Cache for ElastiCache with Valkey or Redis OSS](https://docs.aws.amazon.com/AmazonElastiCache/latest/dg/Clusters.RBAC.html#rbac-using).\n\nIf you want to create a new default user, `userName` must be `default` and `userId` must not be `default` by using `NoPasswordUser` or `PasswordUser`:\n\n```ts\n// use the original `default` user by using import method\nconst defaultUser = elasticache.NoPasswordUser.fromUserAttributes(this, 'DefaultUser', {\n  // userId and userName must be 'default'\n  userId: 'default',\n});\n\n// create a new default user\nconst newDefaultUser = new elasticache.NoPasswordUser(this, 'NewDefaultUser', {\n  // new default user id must not be 'default'\n  userId: 'new-default',\n  // new default username must be 'default'\n  userName: 'default',\n  // set access string\n  accessControl: elasticache.AccessControl.fromAccessString(\"on ~* +@all\"),\n});\n```\n\n> NOTE: You can't create a new default user using `IamUser` because an IAM-enabled user's username and user ID cannot be different.\n\n### Add users to the user group\n\nNext, use the `UserGroup` construct to create a user group and add users to it.\nEnsure that you include either the original default user or a new default user:\n\n```ts\ndeclare const newDefaultUser: elasticache.IUser;\ndeclare const user: elasticache.IUser;\ndeclare const anotherUser: elasticache.IUser;\n\nconst userGroup = new elasticache.UserGroup(this, 'UserGroup', {\n  // add users including default user\n  users: [newDefaultUser, user],\n});\n\n// you can also add a user by using addUser method\nuserGroup.addUser(anotherUser);\n```\n\n### Assign user group\n\nFinally, assign a user group to cache:\n\n```ts\ndeclare const vpc: ec2.Vpc;\ndeclare const userGroup: elasticache.UserGroup;\n\nconst serverlessCache = new elasticache.ServerlessCache(this, 'ServerlessCache', {\n  engine: elasticache.CacheEngine.VALKEY_LATEST,\n  serverlessCacheName: 'my-serverless-cache',\n  vpc,\n  // assign User Group\n  userGroup,\n});\n\n```\n\n### Grant permissions to IAM-enabled users\n\nIf you create IAM-enabled users, `\"elasticache:Connect\"` action must be allowed for the users and cache.\n\n> NOTE: You don't need grant permissions to no password required users or password authentication users.\n\nFor more information, see [Authenticating with IAM](https://docs.aws.amazon.com/AmazonElastiCache/latest/dg/auth-iam.html).\n\nTo grant permissions, you can use the `grantConnect` method in `IamUser` and `ServerlessCache` constructs:\n\n```ts\ndeclare const user: elasticache.IamUser;\ndeclare const serverlessCache: elasticache.ServerlessCache;\ndeclare const role: iam.Role;\n\n// grant \"elasticache:Connect\" action permissions to role\nuser.grantConnect(role);\nserverlessCache.grants.connect(role);\n```\n\n### Import an existing user and user group\n\nYou can import an existing user and user group by using import methods:\n\n```ts\nconst stack = new Stack();\n\nconst importedIamUser = elasticache.IamUser.fromUserId(this, 'ImportedIamUser', 'my-iam-user-id');\n\nconst importedPasswordUser = elasticache.PasswordUser.fromUserAttributes(stack, 'ImportedPasswordUser', {\n  userId: 'my-password-user-id',\n});\n\nconst importedNoPasswordUser = elasticache.NoPasswordUser.fromUserAttributes(stack, 'ImportedNoPasswordUser', {\n  userId: 'my-no-password-user-id',\n});\n\nconst importedUserGroup = elasticache.UserGroup.fromUserGroupAttributes(this, 'ImportedUserGroup', {\n  userGroupName: 'my-user-group-name'\n});\n```\n"
   },
   "repository": {
     "directory": "packages/@aws-cdk/aws-elasticache-alpha",
@@ -13319,6 +13348,6 @@
       "symbolId": "lib/user-group:UserGroupProps"
     }
   },
-  "version": "2.236.0-alpha.0",
+  "version": "2.237.1-alpha.0",
   "fingerprint": "**********"
 }

package/README.md

@@ -397,7 +397,7 @@ declare const role: iam.Role;
  
 // grant "elasticache:Connect" action permissions to role
 user.grantConnect(role);
-serverlessCache.grantConnect(role);
+serverlessCache.grants.connect(role);
 ```
 
 ### Import an existing user and user group

package/lib/elasticache-grants.generated.js

@@ -9,7 +9,7 @@ const iam = require("aws-cdk-lib/aws-iam");
  * Collection of grant methods for a IServerlessCacheRef
  */
 class ServerlessCacheGrants {
-    static [JSII_RTTI_SYMBOL_1] = { fqn: "@aws-cdk/aws-elasticache-alpha.ServerlessCacheGrants", version: "2.236.0-alpha.0" };
+    static [JSII_RTTI_SYMBOL_1] = { fqn: "@aws-cdk/aws-elasticache-alpha.ServerlessCacheGrants", version: "2.237.1-alpha.0" };
     /**
      * Creates grants for ServerlessCacheGrants
      */

package/lib/iam-user.js

@@ -71,7 +71,7 @@ let IamUser = (() => {
             IamUser = _classThis = _classDescriptor.value;
             if (_metadata) Object.defineProperty(_classThis, Symbol.metadata, { enumerable: true, configurable: true, writable: true, value: _metadata });
         }
-        static [JSII_RTTI_SYMBOL_1] = { fqn: "@aws-cdk/aws-elasticache-alpha.IamUser", version: "2.236.0-alpha.0" };
+        static [JSII_RTTI_SYMBOL_1] = { fqn: "@aws-cdk/aws-elasticache-alpha.IamUser", version: "2.237.1-alpha.0" };
         /**
          * Uniquely identifies this class.
          */

package/lib/no-password-user.js

@@ -67,7 +67,7 @@ let NoPasswordUser = (() => {
             NoPasswordUser = _classThis = _classDescriptor.value;
             if (_metadata) Object.defineProperty(_classThis, Symbol.metadata, { enumerable: true, configurable: true, writable: true, value: _metadata });
         }
-        static [JSII_RTTI_SYMBOL_1] = { fqn: "@aws-cdk/aws-elasticache-alpha.NoPasswordUser", version: "2.236.0-alpha.0" };
+        static [JSII_RTTI_SYMBOL_1] = { fqn: "@aws-cdk/aws-elasticache-alpha.NoPasswordUser", version: "2.237.1-alpha.0" };
         /**
          * Uniquely identifies this class.
          */

package/lib/password-user.js

@@ -63,7 +63,7 @@ let PasswordUser = (() => {
             PasswordUser = _classThis = _classDescriptor.value;
             if (_metadata) Object.defineProperty(_classThis, Symbol.metadata, { enumerable: true, configurable: true, writable: true, value: _metadata });
         }
-        static [JSII_RTTI_SYMBOL_1] = { fqn: "@aws-cdk/aws-elasticache-alpha.PasswordUser", version: "2.236.0-alpha.0" };
+        static [JSII_RTTI_SYMBOL_1] = { fqn: "@aws-cdk/aws-elasticache-alpha.PasswordUser", version: "2.237.1-alpha.0" };
         /**
          * Uniquely identifies this class.
          */

package/lib/serverless-cache-base.js

@@ -51,7 +51,7 @@ var CacheEngine;
  * Base class for ServerlessCache constructs
  */
 class ServerlessCacheBase extends core_1.Resource {
-    static [JSII_RTTI_SYMBOL_1] = { fqn: "@aws-cdk/aws-elasticache-alpha.ServerlessCacheBase", version: "2.236.0-alpha.0" };
+    static [JSII_RTTI_SYMBOL_1] = { fqn: "@aws-cdk/aws-elasticache-alpha.ServerlessCacheBase", version: "2.237.1-alpha.0" };
     /**
      * Collection of grant methods for this cache
      */

package/lib/serverless-cache.js

@@ -90,7 +90,7 @@ let ServerlessCache = (() => {
             ServerlessCache = _classThis = _classDescriptor.value;
             if (_metadata) Object.defineProperty(_classThis, Symbol.metadata, { enumerable: true, configurable: true, writable: true, value: _metadata });
         }
-        static [JSII_RTTI_SYMBOL_1] = { fqn: "@aws-cdk/aws-elasticache-alpha.ServerlessCache", version: "2.236.0-alpha.0" };
+        static [JSII_RTTI_SYMBOL_1] = { fqn: "@aws-cdk/aws-elasticache-alpha.ServerlessCache", version: "2.237.1-alpha.0" };
         /**
          * Uniquely identifies this class.
          */

package/lib/user-base.js

@@ -8,7 +8,7 @@ const core_1 = require("aws-cdk-lib/core");
  * Access control configuration for ElastiCache users.
  */
 class AccessControl {
-    static [JSII_RTTI_SYMBOL_1] = { fqn: "@aws-cdk/aws-elasticache-alpha.AccessControl", version: "2.236.0-alpha.0" };
+    static [JSII_RTTI_SYMBOL_1] = { fqn: "@aws-cdk/aws-elasticache-alpha.AccessControl", version: "2.237.1-alpha.0" };
     /**
      * Create access control from an access string.
      *
@@ -36,7 +36,7 @@ class AccessControlString extends AccessControl {
  * Base class for ElastiCache users.
  */
 class UserBase extends core_1.Resource {
-    static [JSII_RTTI_SYMBOL_1] = { fqn: "@aws-cdk/aws-elasticache-alpha.UserBase", version: "2.236.0-alpha.0" };
+    static [JSII_RTTI_SYMBOL_1] = { fqn: "@aws-cdk/aws-elasticache-alpha.UserBase", version: "2.237.1-alpha.0" };
     /**
      * Import an existing user by ID.
      *

package/lib/user-group.js

@@ -47,7 +47,7 @@ const ELASTICACHE_USERGROUP_SYMBOL = Symbol.for('@aws-cdk/aws-elasticache.UserGr
  * Base class for UserGroup constructs
  */
 class UserGroupBase extends core_1.Resource {
-    static [JSII_RTTI_SYMBOL_1] = { fqn: "@aws-cdk/aws-elasticache-alpha.UserGroupBase", version: "2.236.0-alpha.0" };
+    static [JSII_RTTI_SYMBOL_1] = { fqn: "@aws-cdk/aws-elasticache-alpha.UserGroupBase", version: "2.237.1-alpha.0" };
     /**
      * Add a user to this user group
      *
@@ -90,7 +90,7 @@ let UserGroup = (() => {
             UserGroup = _classThis = _classDescriptor.value;
             if (_metadata) Object.defineProperty(_classThis, Symbol.metadata, { enumerable: true, configurable: true, writable: true, value: _metadata });
         }
-        static [JSII_RTTI_SYMBOL_1] = { fqn: "@aws-cdk/aws-elasticache-alpha.UserGroup", version: "2.236.0-alpha.0" };
+        static [JSII_RTTI_SYMBOL_1] = { fqn: "@aws-cdk/aws-elasticache-alpha.UserGroup", version: "2.237.1-alpha.0" };
         /**
          * Uniquely identifies this class
          */

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@aws-cdk/aws-elasticache-alpha",
-  "version": "2.236.0-alpha.0",
+  "version": "2.237.1-alpha.0",
   "private": false,
   "description": "The CDK Construct Library for AWS::ElastiCache",
   "main": "lib/index.js",
@@ -85,18 +85,18 @@
   },
   "license": "Apache-2.0",
   "devDependencies": {
-    "@aws-cdk/cdk-build-tools": "2.236.0-alpha.0",
+    "@aws-cdk/cdk-build-tools": "2.237.1-alpha.0",
     "@aws-cdk/integ-runner": "^2.193.5",
-    "@aws-cdk/pkglint": "2.236.0-alpha.0",
+    "@aws-cdk/pkglint": "2.237.1-alpha.0",
     "@types/jest": "^29.5.14",
     "jest": "^29.7.0",
-    "aws-cdk-lib": "2.236.0",
+    "aws-cdk-lib": "2.237.1",
     "constructs": "^10.0.0",
-    "@aws-cdk/integ-tests-alpha": "2.236.0-alpha.0"
+    "@aws-cdk/integ-tests-alpha": "2.237.1-alpha.0"
   },
   "dependencies": {},
   "peerDependencies": {
-    "aws-cdk-lib": "^2.236.0",
+    "aws-cdk-lib": "^2.237.1",
     "constructs": "^10.0.0"
   },
   "engines": {