@aws-cdk/aws-glue-alpha 2.263.0-alpha.0 → 2.265.0-alpha.0

package/.jsii

@@ -8,7 +8,7 @@
     "url": "https://aws.amazon.com"
   },
   "dependencies": {
-    "aws-cdk-lib": "^2.263.0",
+    "aws-cdk-lib": "^2.265.0",
     "constructs": "^10.5.0"
   },
   "dependencyClosure": {
@@ -447,6 +447,19 @@
             }
           }
         },
+        "aws-cdk-lib.aws_artifact": {
+          "targets": {
+            "dotnet": {
+              "namespace": "Amazon.CDK.AWS.Artifact"
+            },
+            "java": {
+              "package": "software.amazon.awscdk.services.artifact"
+            },
+            "python": {
+              "module": "aws_cdk.aws_artifact"
+            }
+          }
+        },
         "aws-cdk-lib.aws_athena": {
           "targets": {
             "dotnet": {
@@ -577,6 +590,19 @@
             }
           }
         },
+        "aws-cdk-lib.aws_backupsearch": {
+          "targets": {
+            "dotnet": {
+              "namespace": "Amazon.CDK.AWS.BackupSearch"
+            },
+            "java": {
+              "package": "software.amazon.awscdk.services.backupsearch"
+            },
+            "python": {
+              "module": "aws_cdk.aws_backupsearch"
+            }
+          }
+        },
         "aws-cdk-lib.aws_batch": {
           "targets": {
             "dotnet": {
@@ -1072,6 +1098,19 @@
             }
           }
         },
+        "aws-cdk-lib.aws_cognitosync": {
+          "targets": {
+            "dotnet": {
+              "namespace": "Amazon.CDK.AWS.CognitoSync"
+            },
+            "java": {
+              "package": "software.amazon.awscdk.services.cognitosync"
+            },
+            "python": {
+              "module": "aws_cdk.aws_cognitosync"
+            }
+          }
+        },
         "aws-cdk-lib.aws_comprehend": {
           "targets": {
             "dotnet": {
@@ -1215,19 +1254,6 @@
             }
           }
         },
-        "aws-cdk-lib.aws_dataexchange": {
-          "targets": {
-            "dotnet": {
-              "namespace": "Amazon.CDK.AWS.DataExchange"
-            },
-            "java": {
-              "package": "software.amazon.awscdk.services.dataexchange"
-            },
-            "python": {
-              "module": "aws_cdk.aws_dataexchange"
-            }
-          }
-        },
         "aws-cdk-lib.aws_datapipeline": {
           "targets": {
             "dotnet": {
@@ -2846,6 +2872,19 @@
             }
           }
         },
+        "aws-cdk-lib.aws_networkflowmonitor": {
+          "targets": {
+            "dotnet": {
+              "namespace": "Amazon.CDK.AWS.NetworkFlowMonitor"
+            },
+            "java": {
+              "package": "software.amazon.awscdk.services.networkflowmonitor"
+            },
+            "python": {
+              "module": "aws_cdk.aws_networkflowmonitor"
+            }
+          }
+        },
         "aws-cdk-lib.aws_networkmanager": {
           "targets": {
             "dotnet": {
@@ -3720,6 +3759,19 @@
             }
           }
         },
+        "aws-cdk-lib.aws_scn": {
+          "targets": {
+            "dotnet": {
+              "namespace": "Amazon.CDK.AWS.SCN"
+            },
+            "java": {
+              "package": "software.amazon.awscdk.services.scn"
+            },
+            "python": {
+              "module": "aws_cdk.aws_scn"
+            }
+          }
+        },
         "aws-cdk-lib.aws_sdb": {
           "targets": {
             "dotnet": {
@@ -4019,6 +4071,19 @@
             }
           }
         },
+        "aws-cdk-lib.aws_states": {
+          "targets": {
+            "dotnet": {
+              "namespace": "Amazon.CDK.AWS.States"
+            },
+            "java": {
+              "package": "software.amazon.awscdk.services.states"
+            },
+            "python": {
+              "module": "aws_cdk.aws_states"
+            }
+          }
+        },
         "aws-cdk-lib.aws_stepfunctions": {
           "targets": {
             "dotnet": {
@@ -4045,6 +4110,19 @@
             }
           }
         },
+        "aws-cdk-lib.aws_storagegateway": {
+          "targets": {
+            "dotnet": {
+              "namespace": "Amazon.CDK.AWS.StorageGateway"
+            },
+            "java": {
+              "package": "software.amazon.awscdk.services.storagegateway"
+            },
+            "python": {
+              "module": "aws_cdk.aws_storagegateway"
+            }
+          }
+        },
         "aws-cdk-lib.aws_supportapp": {
           "targets": {
             "dotnet": {
@@ -4084,6 +4162,19 @@
             }
           }
         },
+        "aws-cdk-lib.aws_thinclient": {
+          "targets": {
+            "dotnet": {
+              "namespace": "Amazon.CDK.AWS.ThinClient"
+            },
+            "java": {
+              "package": "software.amazon.awscdk.services.thinclient"
+            },
+            "python": {
+              "module": "aws_cdk.aws_thinclient"
+            }
+          }
+        },
         "aws-cdk-lib.aws_timestream": {
           "targets": {
             "dotnet": {
@@ -4097,6 +4188,19 @@
             }
           }
         },
+        "aws-cdk-lib.aws_transcribe": {
+          "targets": {
+            "dotnet": {
+              "namespace": "Amazon.CDK.AWS.Transcribe"
+            },
+            "java": {
+              "package": "software.amazon.awscdk.services.transcribe"
+            },
+            "python": {
+              "module": "aws_cdk.aws_transcribe"
+            }
+          }
+        },
         "aws-cdk-lib.aws_transfer": {
           "targets": {
             "dotnet": {
@@ -4110,6 +4214,19 @@
             }
           }
         },
+        "aws-cdk-lib.aws_usernotifications": {
+          "targets": {
+            "dotnet": {
+              "namespace": "Amazon.CDK.AWS.UserNotifications"
+            },
+            "java": {
+              "package": "software.amazon.awscdk.services.usernotifications"
+            },
+            "python": {
+              "module": "aws_cdk.aws_usernotifications"
+            }
+          }
+        },
         "aws-cdk-lib.aws_uxc": {
           "targets": {
             "dotnet": {
@@ -4201,6 +4318,19 @@
             }
           }
         },
+        "aws-cdk-lib.aws_wellarchitected": {
+          "targets": {
+            "dotnet": {
+              "namespace": "Amazon.CDK.AWS.WellArchitected"
+            },
+            "java": {
+              "package": "software.amazon.awscdk.services.wellarchitected"
+            },
+            "python": {
+              "module": "aws_cdk.aws_wellarchitected"
+            }
+          }
+        },
         "aws-cdk-lib.aws_wisdom": {
           "targets": {
             "dotnet": {
@@ -4703,6 +4833,22 @@
             }
           }
         },
+        "aws-cdk-lib.interfaces.aws_artifact": {
+          "targets": {
+            "dotnet": {
+              "namespace": "Amazon.CDK.Interfaces.Artifact"
+            },
+            "go": {
+              "packageName": "interfacesawsartifact"
+            },
+            "java": {
+              "package": "software.amazon.awscdk.interfaces.artifact"
+            },
+            "python": {
+              "module": "aws_cdk.interfaces.aws_artifact"
+            }
+          }
+        },
         "aws-cdk-lib.interfaces.aws_athena": {
           "targets": {
             "dotnet": {
@@ -4831,6 +4977,22 @@
             }
           }
         },
+        "aws-cdk-lib.interfaces.aws_backupsearch": {
+          "targets": {
+            "dotnet": {
+              "namespace": "Amazon.CDK.Interfaces.BackupSearch"
+            },
+            "go": {
+              "packageName": "interfacesawsbackupsearch"
+            },
+            "java": {
+              "package": "software.amazon.awscdk.interfaces.backupsearch"
+            },
+            "python": {
+              "module": "aws_cdk.interfaces.aws_backupsearch"
+            }
+          }
+        },
         "aws-cdk-lib.interfaces.aws_batch": {
           "targets": {
             "dotnet": {
@@ -5407,6 +5569,22 @@
             }
           }
         },
+        "aws-cdk-lib.interfaces.aws_cognitosync": {
+          "targets": {
+            "dotnet": {
+              "namespace": "Amazon.CDK.Interfaces.CognitoSync"
+            },
+            "go": {
+              "packageName": "interfacesawscognitosync"
+            },
+            "java": {
+              "package": "software.amazon.awscdk.interfaces.cognitosync"
+            },
+            "python": {
+              "module": "aws_cdk.interfaces.aws_cognitosync"
+            }
+          }
+        },
         "aws-cdk-lib.interfaces.aws_comprehend": {
           "targets": {
             "dotnet": {
@@ -5583,22 +5761,6 @@
             }
           }
         },
-        "aws-cdk-lib.interfaces.aws_dataexchange": {
-          "targets": {
-            "dotnet": {
-              "namespace": "Amazon.CDK.Interfaces.DataExchange"
-            },
-            "go": {
-              "packageName": "interfacesawsdataexchange"
-            },
-            "java": {
-              "package": "software.amazon.awscdk.interfaces.dataexchange"
-            },
-            "python": {
-              "module": "aws_cdk.interfaces.aws_dataexchange"
-            }
-          }
-        },
         "aws-cdk-lib.interfaces.aws_datapipeline": {
           "targets": {
             "dotnet": {
@@ -7375,6 +7537,22 @@
             }
           }
         },
+        "aws-cdk-lib.interfaces.aws_networkflowmonitor": {
+          "targets": {
+            "dotnet": {
+              "namespace": "Amazon.CDK.Interfaces.NetworkFlowMonitor"
+            },
+            "go": {
+              "packageName": "interfacesawsnetworkflowmonitor"
+            },
+            "java": {
+              "package": "software.amazon.awscdk.interfaces.networkflowmonitor"
+            },
+            "python": {
+              "module": "aws_cdk.interfaces.aws_networkflowmonitor"
+            }
+          }
+        },
         "aws-cdk-lib.interfaces.aws_networkmanager": {
           "targets": {
             "dotnet": {
@@ -8335,6 +8513,22 @@
             }
           }
         },
+        "aws-cdk-lib.interfaces.aws_scn": {
+          "targets": {
+            "dotnet": {
+              "namespace": "Amazon.CDK.Interfaces.SCN"
+            },
+            "go": {
+              "packageName": "interfacesawsscn"
+            },
+            "java": {
+              "package": "software.amazon.awscdk.interfaces.scn"
+            },
+            "python": {
+              "module": "aws_cdk.interfaces.aws_scn"
+            }
+          }
+        },
         "aws-cdk-lib.interfaces.aws_sdb": {
           "targets": {
             "dotnet": {
@@ -8671,6 +8865,22 @@
             }
           }
         },
+        "aws-cdk-lib.interfaces.aws_states": {
+          "targets": {
+            "dotnet": {
+              "namespace": "Amazon.CDK.Interfaces.States"
+            },
+            "go": {
+              "packageName": "interfacesawsstates"
+            },
+            "java": {
+              "package": "software.amazon.awscdk.interfaces.states"
+            },
+            "python": {
+              "module": "aws_cdk.interfaces.aws_states"
+            }
+          }
+        },
         "aws-cdk-lib.interfaces.aws_stepfunctions": {
           "targets": {
             "dotnet": {
@@ -8687,6 +8897,22 @@
             }
           }
         },
+        "aws-cdk-lib.interfaces.aws_storagegateway": {
+          "targets": {
+            "dotnet": {
+              "namespace": "Amazon.CDK.Interfaces.StorageGateway"
+            },
+            "go": {
+              "packageName": "interfacesawsstoragegateway"
+            },
+            "java": {
+              "package": "software.amazon.awscdk.interfaces.storagegateway"
+            },
+            "python": {
+              "module": "aws_cdk.interfaces.aws_storagegateway"
+            }
+          }
+        },
         "aws-cdk-lib.interfaces.aws_supportapp": {
           "targets": {
             "dotnet": {
@@ -8735,6 +8961,22 @@
             }
           }
         },
+        "aws-cdk-lib.interfaces.aws_thinclient": {
+          "targets": {
+            "dotnet": {
+              "namespace": "Amazon.CDK.Interfaces.ThinClient"
+            },
+            "go": {
+              "packageName": "interfacesawsthinclient"
+            },
+            "java": {
+              "package": "software.amazon.awscdk.interfaces.thinclient"
+            },
+            "python": {
+              "module": "aws_cdk.interfaces.aws_thinclient"
+            }
+          }
+        },
         "aws-cdk-lib.interfaces.aws_timestream": {
           "targets": {
             "dotnet": {
@@ -8751,6 +8993,22 @@
             }
           }
         },
+        "aws-cdk-lib.interfaces.aws_transcribe": {
+          "targets": {
+            "dotnet": {
+              "namespace": "Amazon.CDK.Interfaces.Transcribe"
+            },
+            "go": {
+              "packageName": "interfacesawstranscribe"
+            },
+            "java": {
+              "package": "software.amazon.awscdk.interfaces.transcribe"
+            },
+            "python": {
+              "module": "aws_cdk.interfaces.aws_transcribe"
+            }
+          }
+        },
         "aws-cdk-lib.interfaces.aws_transfer": {
           "targets": {
             "dotnet": {
@@ -8767,6 +9025,22 @@
             }
           }
         },
+        "aws-cdk-lib.interfaces.aws_usernotifications": {
+          "targets": {
+            "dotnet": {
+              "namespace": "Amazon.CDK.Interfaces.UserNotifications"
+            },
+            "go": {
+              "packageName": "interfacesawsusernotifications"
+            },
+            "java": {
+              "package": "software.amazon.awscdk.interfaces.usernotifications"
+            },
+            "python": {
+              "module": "aws_cdk.interfaces.aws_usernotifications"
+            }
+          }
+        },
         "aws-cdk-lib.interfaces.aws_uxc": {
           "targets": {
             "dotnet": {
@@ -8879,6 +9153,22 @@
             }
           }
         },
+        "aws-cdk-lib.interfaces.aws_wellarchitected": {
+          "targets": {
+            "dotnet": {
+              "namespace": "Amazon.CDK.Interfaces.WellArchitected"
+            },
+            "go": {
+              "packageName": "interfacesawswellarchitected"
+            },
+            "java": {
+              "package": "software.amazon.awscdk.interfaces.wellarchitected"
+            },
+            "python": {
+              "module": "aws_cdk.interfaces.aws_wellarchitected"
+            }
+          }
+        },
         "aws-cdk-lib.interfaces.aws_wisdom": {
           "targets": {
             "dotnet": {
@@ -9098,7 +9388,7 @@
     "stability": "experimental"
   },
   "homepage": "https://github.com/aws/aws-cdk",
-  "jsiiVersion": "5.9.44 (build 150b837)",
+  "jsiiVersion": "5.9.52 (build c132e73)",
   "keywords": [
     "aws",
     "cdk",
@@ -9119,7 +9409,7 @@
   },
   "name": "@aws-cdk/aws-glue-alpha",
   "readme": {
-    "markdown": "# AWS Glue Construct Library\n<!--BEGIN STABILITY BANNER-->\n\n---\n\n![cdk-constructs: Experimental](https://img.shields.io/badge/cdk--constructs-experimental-important.svg?style=for-the-badge)\n\n> The APIs of higher level constructs in this module are experimental and under active development.\n> They are subject to non-backward compatible changes or removal in any future version. These are\n> not subject to the [Semantic Versioning](https://semver.org/) model and breaking changes will be\n> announced in the release notes. This means that while you may use them, you may need to update\n> your source code when upgrading to a newer version of this package.\n\n---\n\n<!--END STABILITY BANNER-->\n\nThis module is part of the [AWS Cloud Development Kit](https://github.com/aws/aws-cdk) project.\n\n## README\n\n[AWS Glue](https://aws.amazon.com/glue/) is a serverless data integration\nservice that makes it easier to discover, prepare, move, and integrate data\nfrom multiple sources for analytics, machine learning (ML), and application\ndevelopment.\n\nThe Glue L2 construct has convenience methods working backwards from common\nuse cases and sets required parameters to defaults that align with recommended\nbest practices for each job type. It also provides customers with a balance\nbetween flexibility via optional parameter overrides, and opinionated\ninterfaces that discouraging anti-patterns, resulting in reduced time to develop\nand deploy new resources.\n\n### References\n\n* [Glue Launch Announcement](https://aws.amazon.com/blogs/aws/launch-aws-glue-now-generally-available/)\n* [Glue Documentation](https://docs.aws.amazon.com/glue/index.html)\n* [Glue L1 (CloudFormation) Constructs](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/AWS_Glue.html)\n* Prior version of the [@aws-cdk/aws-glue-alpha module](https://github.com/aws/aws-cdk/blob/v2.51.1/packages/%40aws-cdk/aws-glue/README.md)\n\n## Create a Glue Job\n\nA Job encapsulates a script that connects to data sources, processes\nthem, and then writes output to a data target. There are four types of Glue\nJobs: Spark (ETL and Streaming), Python Shell, and Flex Jobs. Most\nof the required parameters for these jobs are common across all types,\nbut there are a few differences depending on the languages supported\nand features provided by each type. For all job types, the L2 defaults\nto AWS best practice recommendations, such as:\n\n* Use of Secrets Manager for Connection JDBC strings\n* Glue job autoscaling\n* Default parameter values for Glue job creation\n\nThis iteration of the L2 construct introduces breaking changes to\nthe existing glue-alpha-module, but these changes streamline the developer\nexperience, introduce new constants for defaults, and replacing synth-time\nvalidations with interface contracts for enforcement of the parameter combinations\nthat Glue supports. As an opinionated construct, the Glue L2 construct does\nnot allow developers to create resources that use non-current versions\nof Glue or deprecated language dependencies (e.g. deprecated versions of Python).\nAs always, L1s allow you to specify a wider range of parameters if you need\nor want to use alternative configurations.\n\nOptional and required parameters for each job are enforced via interface\nrather than validation; see [Glue's public documentation](https://docs.aws.amazon.com/glue/latest/dg/aws-glue-api.html)\nfor more granular details.\n\n### Spark Jobs\n\n#### ETL Jobs\n\nETL jobs support pySpark and Scala languages, for which there are separate but\nsimilar constructors. ETL jobs default to the G2 worker type, but you can\noverride this default with other supported worker type values (G1, G2, G4\nand G8). ETL jobs defaults to Glue version 4.0, which you can override to 3.0.\nThe following ETL features are enabled by default:\n`—enable-metrics, —enable-spark-ui, —enable-continuous-cloudwatch-log.`\nYou can find more details about version, worker type and other features in\n[Glue's public documentation](https://docs.aws.amazon.com/glue/latest/dg/aws-glue-api-jobs-job.html).\n\nReference the pyspark-etl-jobs.test.ts and scalaspark-etl-jobs.test.ts unit tests\nfor examples of required-only and optional job parameters when creating these\ntypes of jobs.\n\nFor the sake of brevity, examples are shown using the pySpark job variety.\n\nExample with only required parameters:\n\n```ts\nimport * as cdk from 'aws-cdk-lib';\nimport * as iam from 'aws-cdk-lib/aws-iam';\ndeclare const stack: cdk.Stack;\ndeclare const role: iam.IRole;\ndeclare const script: glue.Code;\nnew glue.PySparkEtlJob(stack, 'PySparkETLJob', {\n  role,\n  script,\n  jobName: 'PySparkETLJob',\n});\n```\n\nExample with optional override parameters:\n\n```ts\nimport * as cdk from 'aws-cdk-lib';\nimport * as iam from 'aws-cdk-lib/aws-iam';\ndeclare const stack: cdk.Stack;\ndeclare const role: iam.IRole;\ndeclare const script: glue.Code;\nnew glue.PySparkEtlJob(stack, 'PySparkETLJob', {\n  jobName: 'PySparkETLJobCustomName',\n  description: 'This is a description',\n  role,\n  script,\n  glueVersion: glue.GlueVersion.V5_1,\n  continuousLogging: { enabled: false },\n  workerType: glue.WorkerType.G_2X,\n  maxConcurrentRuns: 100,\n  timeout: cdk.Duration.hours(2),\n  connections: [glue.Connection.fromConnectionName(stack, 'Connection', 'connectionName')],\n  securityConfiguration: glue.SecurityConfiguration.fromSecurityConfigurationName(stack, 'SecurityConfig', 'securityConfigName'),\n  tags: {\n    FirstTagName: 'FirstTagValue',\n    SecondTagName: 'SecondTagValue',\n    XTagName: 'XTagValue',\n  },\n  numberOfWorkers: 2,\n  maxRetries: 2,\n});\n```\n\n#### Streaming Jobs\n\nStreaming jobs are similar to ETL jobs, except that they perform ETL on data\nstreams using the Apache Spark Structured Streaming framework. Some Spark\njob features are not available to Streaming ETL jobs. They support Scala\nand pySpark languages. PySpark streaming jobs default Python 3.9,\nwhich you can override with any non-deprecated version of Python. It\ndefaults to the G2 worker type and Glue 4.0, both of which you can override.\nThe following best practice features are enabled by default:\n`—enable-metrics, —enable-spark-ui, —enable-continuous-cloudwatch-log`.\n\nReference the pyspark-streaming-jobs.test.ts and scalaspark-streaming-jobs.test.ts\nunit tests for examples of required-only and optional job parameters when creating\nthese types of jobs.\n\nExample with only required parameters:\n\n```ts\nimport * as cdk from 'aws-cdk-lib';\nimport * as iam from 'aws-cdk-lib/aws-iam';\ndeclare const stack: cdk.Stack;\ndeclare const role: iam.IRole;\ndeclare const script: glue.Code;\nnew glue.PySparkStreamingJob(stack, 'ImportedJob', { role, script });\n```\n\nExample with optional override parameters:\n\n```ts\nimport * as cdk from 'aws-cdk-lib';\nimport * as iam from 'aws-cdk-lib/aws-iam';\ndeclare const stack: cdk.Stack;\ndeclare const role: iam.IRole;\ndeclare const script: glue.Code;\nnew glue.PySparkStreamingJob(stack, 'PySparkStreamingJob', {\n  jobName: 'PySparkStreamingJobCustomName',\n  description: 'This is a description',\n  role,\n  script,\n  glueVersion: glue.GlueVersion.V5_1,\n  continuousLogging: { enabled: false },\n  workerType: glue.WorkerType.G_2X,\n  maxConcurrentRuns: 100,\n  timeout: cdk.Duration.hours(2),\n  connections: [glue.Connection.fromConnectionName(stack, 'Connection', 'connectionName')],\n  securityConfiguration: glue.SecurityConfiguration.fromSecurityConfigurationName(stack, 'SecurityConfig', 'securityConfigName'),\n  tags: {\n    FirstTagName: 'FirstTagValue',\n    SecondTagName: 'SecondTagValue',\n    XTagName: 'XTagValue',\n  },\n  numberOfWorkers: 2,\n  maxRetries: 2,\n});\n```\n\n#### Flex Jobs\n\nThe flexible execution class is appropriate for non-urgent jobs such as\npre-production jobs, testing, and one-time data loads. Flexible jobs default\nto Glue version 3.0 and worker type `G_2X`. The following best practice\nfeatures are enabled by default:\n`—enable-metrics, —enable-spark-ui, —enable-continuous-cloudwatch-log`\n\nReference the pyspark-flex-etl-jobs.test.ts and scalaspark-flex-etl-jobs.test.ts\nunit tests for examples of required-only and optional job parameters when creating\nthese types of jobs.\n\nExample with only required parameters:\n\n```ts\nimport * as cdk from 'aws-cdk-lib';\nimport * as iam from 'aws-cdk-lib/aws-iam';\ndeclare const stack: cdk.Stack;\ndeclare const role: iam.IRole;\ndeclare const script: glue.Code;\nnew glue.PySparkFlexEtlJob(stack, 'ImportedJob', { role, script });\n```\n\nExample with optional override parameters:\n\n```ts\nimport * as cdk from 'aws-cdk-lib';\nimport * as iam from 'aws-cdk-lib/aws-iam';\ndeclare const stack: cdk.Stack;\ndeclare const role: iam.IRole;\ndeclare const script: glue.Code;\nnew glue.PySparkEtlJob(stack, 'pySparkEtlJob', {\n  jobName: 'pySparkEtlJob',\n  description: 'This is a description',\n  role,\n  script,\n  glueVersion: glue.GlueVersion.V5_1,\n  continuousLogging: { enabled: false },\n  workerType: glue.WorkerType.G_2X,\n  maxConcurrentRuns: 100,\n  timeout: cdk.Duration.hours(2),\n  connections: [glue.Connection.fromConnectionName(stack, 'Connection', 'connectionName')],\n  securityConfiguration: glue.SecurityConfiguration.fromSecurityConfigurationName(stack, 'SecurityConfig', 'securityConfigName'),\n  tags: {\n    FirstTagName: 'FirstTagValue',\n    SecondTagName: 'SecondTagValue',\n    XTagName: 'XTagValue',\n  },\n  numberOfWorkers: 2,\n  maxRetries: 2,\n});\n```\n\n### Python Shell Jobs\n\nPython shell jobs support a Python version that depends on the AWS Glue\nversion you use. These can be used to schedule and run tasks that don't\nrequire an Apache Spark environment. Python shell jobs default to\nPython 3.9 and a MaxCapacity of `0.0625`. Python 3.9 supports pre-loaded\nanalytics libraries using the `library-set=analytics` flag, which is\nenabled by default.\n\nReference the pyspark-shell-job.test.ts unit tests for examples of\nrequired-only and optional job parameters when creating these types of jobs.\n\nExample with only required parameters:\n\n```ts\nimport * as cdk from 'aws-cdk-lib';\nimport * as iam from 'aws-cdk-lib/aws-iam';\ndeclare const stack: cdk.Stack;\ndeclare const role: iam.IRole;\ndeclare const script: glue.Code;\nnew glue.PythonShellJob(stack, 'ImportedJob', { role, script });\n```\n\nExample with optional override parameters:\n\n```ts\nimport * as cdk from 'aws-cdk-lib';\nimport * as iam from 'aws-cdk-lib/aws-iam';\ndeclare const stack: cdk.Stack;\ndeclare const role: iam.IRole;\ndeclare const script: glue.Code;\ndeclare const extraPythonFile: glue.Code;\nnew glue.PythonShellJob(stack, 'PythonShellJob', {\n  jobName: 'PythonShellJobCustomName',\n  description: 'This is a description',\n  pythonVersion: glue.PythonVersion.TWO,\n  maxCapacity: glue.MaxCapacity.DPU_1,\n  role,\n  script,\n  extraPythonFiles: [extraPythonFile],\n  glueVersion: glue.GlueVersion.V2_0,\n  continuousLogging: { enabled: false },\n  workerType: glue.WorkerType.G_2X,\n  maxConcurrentRuns: 100,\n  timeout: cdk.Duration.hours(2),\n  connections: [glue.Connection.fromConnectionName(stack, 'Connection', 'connectionName')],\n  securityConfiguration: glue.SecurityConfiguration.fromSecurityConfigurationName(stack, 'SecurityConfig', 'securityConfigName'),\n  tags: {\n    FirstTagName: 'FirstTagValue',\n    SecondTagName: 'SecondTagValue',\n    XTagName: 'XTagValue',\n  },\n  numberOfWorkers: 2,\n  maxRetries: 2,\n});\n```\n\n### Ray Jobs\n\n> **⚠️ DEPRECATED:** AWS Glue for Ray is closed to new customers as of April 30, 2026 and is in maintenance mode.\n> Migrate to [Amazon EKS with KubeRay Operator](https://docs.aws.amazon.com/glue/latest/dg/awsglue-ray-jobs-availability-change.html).\n\nThe `RayJob` construct, `Runtime.RAY_TWO_FOUR`, and `JobType.RAY` are deprecated and will be removed in a future release.\n\n### Metrics Control\n\nBy default, Glue jobs enable CloudWatch metrics (`--enable-metrics`) and observability metrics (`--enable-observability-metrics`) for monitoring and debugging. You can disable these metrics to reduce CloudWatch costs:\n\n```ts\nimport * as cdk from 'aws-cdk-lib';\nimport * as iam from 'aws-cdk-lib/aws-iam';\ndeclare const stack: cdk.Stack;\ndeclare const role: iam.IRole;\ndeclare const script: glue.Code;\n\n// Disable both metrics for cost optimization\nnew glue.PySparkEtlJob(stack, 'CostOptimizedJob', {\n  role,\n  script,\n  enableMetrics: false,\n  enableObservabilityMetrics: false,\n});\n\n// Selective control - keep observability, disable profiling\nnew glue.PySparkEtlJob(stack, 'SelectiveJob', {\n  role,\n  script,\n  enableMetrics: false,\n  // enableObservabilityMetrics defaults to true\n});\n```\n\nThis feature is available for all Spark job types (ETL, Streaming, Flex).\n\n### Enable Job Run Queuing\n\nAWS Glue job queuing monitors your account level quotas and limits. If quotas or limits are insufficient to start a Glue job run, AWS Glue will automatically queue the job and wait for limits to free up. Once limits become available, AWS Glue will retry the job run. Glue jobs will queue for limits like max concurrent job runs per account, max concurrent Data Processing Units (DPU), and resource unavailable due to IP address exhaustion in Amazon Virtual Private Cloud (Amazon VPC).\n\nEnable job run queuing by setting the `jobRunQueuingEnabled` property to `true`.\n\n```ts\nimport * as cdk from 'aws-cdk-lib';\nimport * as iam from 'aws-cdk-lib/aws-iam';\ndeclare const stack: cdk.Stack;\ndeclare const role: iam.IRole;\ndeclare const script: glue.Code;\nnew glue.PySparkEtlJob(stack, 'PySparkETLJob', {\n  role,\n  script,\n  jobName: 'PySparkETLJob',\n  jobRunQueuingEnabled: true\n});\n```\n\n### Uploading scripts from the CDK app repository to S3\n\nSimilar to other L2 constructs, the Glue L2 automates uploading / updating\nscripts to S3 via an optional fromAsset parameter pointing to a script\nin the local file structure. You provide the existing S3 bucket and\npath to which you'd like the script to be uploaded.\n\nReference the unit tests for examples of repo and S3 code target examples.\n\n### Workflow Triggers\n\nYou can use Glue workflows to create and visualize complex\nextract, transform, and load (ETL) activities involving multiple crawlers,\njobs, and triggers. Standalone triggers are an anti-pattern, so you must\ncreate triggers from within a workflow using the L2 construct.\n\nWithin a workflow object, there are functions to create different\ntypes of triggers with actions and predicates. You then add those triggers\nto jobs.\n\nStartOnCreation defaults to true for all trigger types, but you can\noverride it if you prefer for your trigger not to start on creation.\n\nReference the workflow-triggers.test.ts unit tests for examples of creating\nworkflows and triggers.\n\n#### **1. On-Demand Triggers**\n\nOn-demand triggers can start glue jobs or crawlers. This construct provides\nconvenience functions to create on-demand crawler or job triggers. The constructor\ntakes an optional description parameter, but abstracts the requirement of an\nactions list using the job or crawler objects using conditional types.\n\n#### **2. Scheduled Triggers**\n\nYou can create scheduled triggers using cron expressions. This construct\nprovides daily, weekly, and monthly convenience functions,\nas well as a custom function that allows you to create your own\ncustom timing using the [existing event Schedule class](https://docs.aws.amazon.com/cdk/api/v2/docs/aws-cdk-lib.aws_events.Schedule.html)\nwithout having to build your own cron expressions. The L2 extracts\nthe expression that Glue requires from the Schedule object. The constructor\ntakes an optional description and a list of jobs or crawlers as actions.\n\n#### **3. Notify  Event Triggers**\n\nThere are two types of notify event triggers: batching and non-batching.\nFor batching triggers, you must specify `BatchSize`. For non-batching\ntriggers, `BatchSize` defaults to 1. For both triggers, `BatchWindow`\ndefaults to 900 seconds, but you can override the window to align with\nyour workload's requirements.\n\n#### **4. Conditional Triggers**\n\nConditional triggers have a predicate and actions associated with them.\nThe trigger actions are executed when the predicateCondition is true.\n\n### Connection Properties\n\nA `Connection` allows Glue jobs, crawlers and development endpoints to access\ncertain types of data stores.\n\n* **Secrets Management**\n    You must specify JDBC connection credentials in Secrets Manager and\n    provide the Secrets Manager Key name as a property to the job connection.\n\n* **Networking - the CDK determines the best fit subnet for Glue connection\nconfiguration**\n    The prior version of the glue-alpha-module requires the developer to\n    specify the subnet of the Connection when it’s defined. Now, you can still\n    specify the specific subnet you want to use, but are no longer required\n    to. You are only required to provide a VPC and either a public or private\n    subnet selection. Without a specific subnet provided, the L2 leverages the\n    existing [EC2 Subnet Selection](https://docs.aws.amazon.com/cdk/api/v2/python/aws_cdk.aws_ec2/SubnetSelection.html)\n    library to make the best choice selection for the subnet.\n\n```ts\ndeclare const securityGroup: ec2.SecurityGroup;\ndeclare const subnet: ec2.Subnet;\nnew glue.Connection(this, 'MyConnection', {\n  type: glue.ConnectionType.NETWORK,\n  // The security groups granting AWS Glue inbound access to the data source within the VPC\n  securityGroups: [securityGroup],\n  // The VPC subnet which contains the data source\n  subnet,\n});\n```\n\nFor RDS `Connection` by JDBC, it is recommended to manage credentials using AWS Secrets Manager. To use Secret, specify `SECRET_ID` in `properties` like the following code. Note that in this case, the subnet must have a route to the AWS Secrets Manager VPC endpoint or to the AWS Secrets Manager endpoint through a NAT gateway.\n\n```ts\ndeclare const securityGroup: ec2.SecurityGroup;\ndeclare const subnet: ec2.Subnet;\ndeclare const db: rds.DatabaseCluster;\nnew glue.Connection(this, \"RdsConnection\", {\n  type: glue.ConnectionType.JDBC,\n  securityGroups: [securityGroup],\n  subnet,\n  properties: {\n    JDBC_CONNECTION_URL: `jdbc:mysql://${db.clusterEndpoint.socketAddress}/databasename`,\n    JDBC_ENFORCE_SSL: \"false\",\n    SECRET_ID: db.secret!.secretName,\n  },\n});\n```\n\nIf you need to use a connection type that doesn't exist as a static member on `ConnectionType`, you can instantiate a `ConnectionType` object, e.g: `new glue.ConnectionType('NEW_TYPE')`.\n\nSee [Adding a Connection to Your Data Store](https://docs.aws.amazon.com/glue/latest/dg/populate-add-connection.html) and [Connection Structure](https://docs.aws.amazon.com/glue/latest/dg/aws-glue-api-catalog-connections.html#aws-glue-api-catalog-connections-Connection) documentation for more information on the supported data stores and their configurations.\n\n## SecurityConfiguration\n\nA `SecurityConfiguration` is a set of security properties that can be used by AWS Glue to encrypt data at rest.\n\n```ts\nnew glue.SecurityConfiguration(this, 'MySecurityConfiguration', {\n  cloudWatchEncryption: {\n    mode: glue.CloudWatchEncryptionMode.KMS,\n  },\n  jobBookmarksEncryption: {\n    mode: glue.JobBookmarksEncryptionMode.CLIENT_SIDE_KMS,\n  },\n  s3Encryption: {\n    mode: glue.S3EncryptionMode.KMS,\n  },\n});\n```\n\nBy default, a shared KMS key is created for use with the encryption configurations that require one. You can also supply your own key for each encryption config, for example, for CloudWatch encryption:\n\n```ts\ndeclare const key: kms.Key;\nnew glue.SecurityConfiguration(this, 'MySecurityConfiguration', {\n  cloudWatchEncryption: {\n    mode: glue.CloudWatchEncryptionMode.KMS,\n    kmsKey: key,\n  },\n});\n```\n\nSee [documentation](https://docs.aws.amazon.com/glue/latest/dg/encryption-security-configuration.html) for more info for Glue encrypting data written by Crawlers, Jobs, and Development Endpoints.\n\n## Database\n\nA `Database` is a logical grouping of `Tables` in the Glue Catalog.\n\n```ts\nnew glue.Database(this, 'MyDatabase', {\n  databaseName: 'my_database',\n  description: 'my_database_description',\n});\n```\n\n## Table\n\nA Glue table describes a table of data in S3: its structure (column names and types), location of data (S3 objects with a common prefix in a S3 bucket), and format for the files (Json, Avro, Parquet, etc.):\n\n```ts\ndeclare const myDatabase: glue.Database;\nnew glue.S3Table(this, 'MyTable', {\n  database: myDatabase,\n  columns: [{\n    name: 'col1',\n    type: glue.Schema.STRING,\n  }, {\n    name: 'col2',\n    type: glue.Schema.array(glue.Schema.STRING),\n    comment: 'col2 is an array of strings' // comment is optional\n  }],\n  dataFormat: glue.DataFormat.JSON,\n});\n```\n\nBy default, a S3 bucket will be created to store the table's data but you can manually pass the `bucket` and `s3Prefix`:\n\n```ts\ndeclare const myBucket: s3.Bucket;\ndeclare const myDatabase: glue.Database;\nnew glue.S3Table(this, 'MyTable', {\n  bucket: myBucket,\n  s3Prefix: 'my-table/',\n  // ...\n  database: myDatabase,\n  columns: [{\n    name: 'col1',\n    type: glue.Schema.STRING,\n  }],\n  dataFormat: glue.DataFormat.JSON,\n});\n```\n\nGlue tables can be configured to contain user-defined properties, to describe the physical storage of table data, through the `storageParameters` property:\n\n```ts\ndeclare const myDatabase: glue.Database;\nnew glue.S3Table(this, 'MyTable', {\n  storageParameters: [\n    glue.StorageParameter.skipHeaderLineCount(1),\n    glue.StorageParameter.compressionType(glue.CompressionType.GZIP),\n    glue.StorageParameter.custom('separatorChar', ',')\n  ],\n  // ...\n  database: myDatabase,\n  columns: [{\n    name: 'col1',\n    type: glue.Schema.STRING,\n  }],\n  dataFormat: glue.DataFormat.JSON,\n});\n```\n\nGlue tables can also be configured to contain user-defined table properties through the [`parameters`](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-glue-table-tableinput.html#cfn-glue-table-tableinput-parameters) property:\n\n```ts\ndeclare const myDatabase: glue.Database;\nnew glue.S3Table(this, 'MyTable', {\n  parameters: {\n    key1: 'val1',\n    key2: 'val2',\n  },\n  database: myDatabase,\n  columns: [{\n    name: 'col1',\n    type: glue.Schema.STRING,\n  }],\n  dataFormat: glue.DataFormat.JSON,\n});\n```\n\n### Partition Keys\n\nTo improve query performance, a table can specify `partitionKeys` on which data is stored and queried separately. For example, you might partition a table by `year` and `month` to optimize queries based on a time window:\n\n```ts\ndeclare const myDatabase: glue.Database;\nnew glue.S3Table(this, 'MyTable', {\n  database: myDatabase,\n  columns: [{\n    name: 'col1',\n    type: glue.Schema.STRING,\n  }],\n  partitionKeys: [{\n    name: 'year',\n    type: glue.Schema.SMALL_INT,\n  }, {\n    name: 'month',\n    type: glue.Schema.SMALL_INT,\n  }],\n  dataFormat: glue.DataFormat.JSON,\n});\n```\n\n### Partition Indexes\n\nAnother way to improve query performance is to specify partition indexes. If no partition indexes are\npresent on the table, AWS Glue loads all partitions of the table and filters the loaded partitions using\nthe query expression. The query takes more time to run as the number of partitions increase. With an\nindex, the query will try to fetch a subset of the partitions instead of loading all partitions of the\ntable.\n\nThe keys of a partition index must be a subset of the partition keys of the table. You can have a\nmaximum of 3 partition indexes per table. To specify a partition index, you can use the `partitionIndexes`\nproperty:\n\n```ts\ndeclare const myDatabase: glue.Database;\nnew glue.S3Table(this, 'MyTable', {\n  database: myDatabase,\n  columns: [{\n    name: 'col1',\n    type: glue.Schema.STRING,\n  }],\n  partitionKeys: [{\n    name: 'year',\n    type: glue.Schema.SMALL_INT,\n  }, {\n    name: 'month',\n    type: glue.Schema.SMALL_INT,\n  }],\n  partitionIndexes: [{\n    indexName: 'my-index', // optional\n    keyNames: ['year'],\n  }], // supply up to 3 indexes\n  dataFormat: glue.DataFormat.JSON,\n});\n```\n\nAlternatively, you can call the `addPartitionIndex()` function on a table:\n\n```ts\ndeclare const myTable: glue.Table;\nmyTable.addPartitionIndex({\n  indexName: 'my-index',\n  keyNames: ['year'],\n});\n```\n\n### Partition Filtering\n\nIf you have a table with a large number of partitions that grows over time, consider using AWS Glue partition indexing and filtering.\n\n```ts\ndeclare const myDatabase: glue.Database;\nnew glue.S3Table(this, 'MyTable', {\n  database: myDatabase,\n  columns: [{\n      name: 'col1',\n      type: glue.Schema.STRING,\n  }],\n  partitionKeys: [{\n      name: 'year',\n      type: glue.Schema.SMALL_INT,\n  }, {\n      name: 'month',\n      type: glue.Schema.SMALL_INT,\n  }],\n  dataFormat: glue.DataFormat.JSON,\n  enablePartitionFiltering: true,\n});\n```\n\n### Partition Projection\n\nPartition projection allows Athena to automatically add new partitions as new data arrives, without requiring `ALTER TABLE ADD PARTITION` statements. This improves query performance and reduces management overhead by eliminating the need to manually manage partition metadata.\n\nFor more information, see the [AWS documentation on partition projection](https://docs.aws.amazon.com/athena/latest/ug/partition-projection.html).\n\n#### INTEGER Projection\n\nFor partition keys with sequential numeric values:\n\n```ts\ndeclare const myDatabase: glue.Database;\nnew glue.S3Table(this, 'MyTable', {\n  database: myDatabase,\n  columns: [{\n    name: 'data',\n    type: glue.Schema.STRING,\n  }],\n  partitionKeys: [{\n    name: 'year',\n    type: glue.Schema.INTEGER,\n  }],\n  dataFormat: glue.DataFormat.JSON,\n  partitionProjection: {\n    year: glue.PartitionProjectionConfiguration.integer({\n      min: 2020,\n      max: 2023,\n      interval: 1,  // optional, defaults to 1\n      digits: 4,    // optional, pads with leading zeros\n    }),\n  },\n});\n```\n\n#### DATE Projection\n\nFor partition keys with date or timestamp values. Supports both fixed dates and relative dates using `NOW`:\n\n```ts\ndeclare const myDatabase: glue.Database;\nnew glue.S3Table(this, 'MyTable', {\n  database: myDatabase,\n  columns: [{\n    name: 'data',\n    type: glue.Schema.STRING,\n  }],\n  partitionKeys: [{\n    name: 'date',\n    type: glue.Schema.STRING,\n  }],\n  dataFormat: glue.DataFormat.JSON,\n  partitionProjection: {\n    date: glue.PartitionProjectionConfiguration.date({\n      min: '2020-01-01',\n      max: '2023-12-31',\n      format: 'yyyy-MM-dd',\n      interval: 1,  // optional, defaults to 1\n      intervalUnit: glue.DateIntervalUnit.DAYS,  // optional: YEARS, MONTHS, WEEKS, DAYS, HOURS, MINUTES, SECONDS\n    }),\n  },\n});\n```\n\nYou can also use relative dates with `NOW`:\n\n```ts\ndeclare const myDatabase: glue.Database;\nnew glue.S3Table(this, 'MyTable', {\n  database: myDatabase,\n  columns: [{\n    name: 'data',\n    type: glue.Schema.STRING,\n  }],\n  partitionKeys: [{\n    name: 'date',\n    type: glue.Schema.STRING,\n  }],\n  dataFormat: glue.DataFormat.JSON,\n  partitionProjection: {\n    date: glue.PartitionProjectionConfiguration.date({\n      min: 'NOW-3YEARS',\n      max: 'NOW',\n      format: 'yyyy-MM-dd',\n    }),\n  },\n});\n```\n\n#### ENUM Projection\n\nFor partition keys with a known set of values:\n\n```ts\ndeclare const myDatabase: glue.Database;\nnew glue.S3Table(this, 'MyTable', {\n  database: myDatabase,\n  columns: [{\n    name: 'data',\n    type: glue.Schema.STRING,\n  }],\n  partitionKeys: [{\n    name: 'region',\n    type: glue.Schema.STRING,\n  }],\n  dataFormat: glue.DataFormat.JSON,\n  partitionProjection: {\n    region: glue.PartitionProjectionConfiguration.enum({\n      values: ['us-east-1', 'us-west-2', 'eu-west-1'],\n    }),\n  },\n});\n```\n\n#### INJECTED Projection\n\nFor custom partition values injected at query time:\n\n```ts\ndeclare const myDatabase: glue.Database;\nnew glue.S3Table(this, 'MyTable', {\n  database: myDatabase,\n  columns: [{\n    name: 'data',\n    type: glue.Schema.STRING,\n  }],\n  partitionKeys: [{\n    name: 'custom',\n    type: glue.Schema.STRING,\n  }],\n  dataFormat: glue.DataFormat.JSON,\n  partitionProjection: {\n    custom: glue.PartitionProjectionConfiguration.injected(),\n  },\n});\n```\n\n#### Multiple Partition Projections\n\nYou can configure partition projection for multiple partition keys:\n\n```ts\ndeclare const myDatabase: glue.Database;\nnew glue.S3Table(this, 'MyTable', {\n  database: myDatabase,\n  columns: [{\n    name: 'data',\n    type: glue.Schema.STRING,\n  }],\n  partitionKeys: [\n    {\n      name: 'year',\n      type: glue.Schema.INTEGER,\n    },\n    {\n      name: 'month',\n      type: glue.Schema.INTEGER,\n    },\n    {\n      name: 'region',\n      type: glue.Schema.STRING,\n    },\n  ],\n  dataFormat: glue.DataFormat.JSON,\n  partitionProjection: {\n    year: glue.PartitionProjectionConfiguration.integer({\n      min: 2020,\n      max: 2023,\n    }),\n    month: glue.PartitionProjectionConfiguration.integer({\n      min: 1,\n      max: 12,\n      digits: 2,\n    }),\n    region: glue.PartitionProjectionConfiguration.enum({\n      values: ['us-east-1', 'us-west-2'],\n    }),\n  },\n});\n```\n\n### Glue Connections\n\nGlue connections allow external data connections to third party databases and data warehouses. However, these connections can also be assigned to Glue Tables, allowing you to query external data sources using the Glue Data Catalog.\n\nWhereas `S3Table` will point to (and if needed, create) a bucket to store the tables' data, `ExternalTable` will point to an existing table in a data source. For example, to create a table in Glue that points to a table in Redshift:\n\n```ts\ndeclare const myConnection: glue.Connection;\ndeclare const myDatabase: glue.Database;\nnew glue.ExternalTable(this, 'MyTable', {\n  connection: myConnection,\n  externalDataLocation: 'default_db_public_example', // A table in Redshift\n  // ...\n  database: myDatabase,\n  columns: [{\n    name: 'col1',\n    type: glue.Schema.STRING,\n  }],\n  dataFormat: glue.DataFormat.JSON,\n});\n```\n\n## [Encryption](https://docs.aws.amazon.com/athena/latest/ug/encryption.html)\n\nYou can enable encryption on a Table's data:\n\n* [S3Managed](https://docs.aws.amazon.com/AmazonS3/latest/dev/UsingServerSideEncryption.html) - (default) Server side encryption (`SSE-S3`) with an Amazon S3-managed key.\n\n```ts\ndeclare const myDatabase: glue.Database;\nnew glue.S3Table(this, 'MyTable', {\n  encryption: glue.TableEncryption.S3_MANAGED,\n  // ...\n  database: myDatabase,\n  columns: [{\n    name: 'col1',\n    type: glue.Schema.STRING,\n  }],\n  dataFormat: glue.DataFormat.JSON,\n});\n```\n\n* [Kms](https://docs.aws.amazon.com/AmazonS3/latest/dev/UsingKMSEncryption.html) - Server-side encryption (`SSE-KMS`) with an AWS KMS Key managed by the account owner.\n\n```ts\ndeclare const myDatabase: glue.Database;\n// KMS key is created automatically\nnew glue.S3Table(this, 'MyTable', {\n  encryption: glue.TableEncryption.KMS,\n  // ...\n  database: myDatabase,\n  columns: [{\n    name: 'col1',\n    type: glue.Schema.STRING,\n  }],\n  dataFormat: glue.DataFormat.JSON,\n});\n\n// with an explicit KMS key\nnew glue.S3Table(this, 'MyTable', {\n  encryption: glue.TableEncryption.KMS,\n  encryptionKey: new kms.Key(this, 'MyKey'),\n  // ...\n  database: myDatabase,\n  columns: [{\n    name: 'col1',\n    type: glue.Schema.STRING,\n  }],\n  dataFormat: glue.DataFormat.JSON,\n});\n```\n\n* [KmsManaged](https://docs.aws.amazon.com/AmazonS3/latest/dev/UsingKMSEncryption.html) - Server-side encryption (`SSE-KMS`), like `Kms`, except with an AWS KMS Key managed by the AWS Key Management Service.\n\n```ts\ndeclare const myDatabase: glue.Database;\nnew glue.S3Table(this, 'MyTable', {\n  encryption: glue.TableEncryption.KMS_MANAGED,\n  // ...\n  database: myDatabase,\n  columns: [{\n    name: 'col1',\n    type: glue.Schema.STRING,\n  }],\n  dataFormat: glue.DataFormat.JSON,\n});\n```\n\n* [ClientSideKms](https://docs.aws.amazon.com/AmazonS3/latest/dev/UsingClientSideEncryption.html#client-side-encryption-kms-managed-master-key-intro) - Client-side encryption (`CSE-KMS`) with an AWS KMS Key managed by the account owner.\n\n```ts\ndeclare const myDatabase: glue.Database;\n// KMS key is created automatically\nnew glue.S3Table(this, 'MyTable', {\n  encryption: glue.TableEncryption.CLIENT_SIDE_KMS,\n  // ...\n  database: myDatabase,\n  columns: [{\n    name: 'col1',\n    type: glue.Schema.STRING,\n  }],\n  dataFormat: glue.DataFormat.JSON,\n});\n\n// with an explicit KMS key\nnew glue.S3Table(this, 'MyTable', {\n  encryption: glue.TableEncryption.CLIENT_SIDE_KMS,\n  encryptionKey: new kms.Key(this, 'MyKey'),\n  // ...\n  database: myDatabase,\n  columns: [{\n    name: 'col1',\n    type: glue.Schema.STRING,\n  }],\n  dataFormat: glue.DataFormat.JSON,\n});\n```\n\n*Note: you cannot provide a `Bucket` when creating the `S3Table` if you wish to use server-side encryption (`KMS`, `KMS_MANAGED` or `S3_MANAGED`)*.\n\n## Types\n\nA table's schema is a collection of columns, each of which have a `name` and a `type`. Types are recursive structures, consisting of primitive and complex types:\n\n```ts\ndeclare const myDatabase: glue.Database;\nnew glue.S3Table(this, 'MyTable', {\n  columns: [{\n    name: 'primitive_column',\n    type: glue.Schema.STRING,\n  }, {\n    name: 'array_column',\n    type: glue.Schema.array(glue.Schema.INTEGER),\n    comment: 'array<integer>',\n  }, {\n    name: 'map_column',\n    type: glue.Schema.map(\n      glue.Schema.STRING,\n      glue.Schema.TIMESTAMP),\n    comment: 'map<string,string>',\n  }, {\n    name: 'struct_column',\n    type: glue.Schema.struct([{\n      name: 'nested_column',\n      type: glue.Schema.DATE,\n      comment: 'nested comment',\n    }]),\n    comment: \"struct<nested_column:date COMMENT 'nested comment'>\",\n  }],\n  // ...\n  database: myDatabase,\n  dataFormat: glue.DataFormat.JSON,\n});\n```\n\n## Public FAQ\n\n### What are we launching today?\n\nWe’re launching new features to an AWS CDK Glue L2 Construct to provide\nbest-practice defaults and convenience methods to create Glue Jobs, Connections,\nTriggers, Workflows, and the underlying permissions and configuration.\n\n### Why should I use this Construct?\n\nDevelopers should use this Construct to reduce the amount of boilerplate\ncode and complexity each individual has to navigate, and make it easier to\ncreate best-practice Glue resources.\n\n### What’s not in scope?\n\nGlue Crawlers and other resources that are now managed by the AWS LakeFormation\nteam are not in scope for this effort. Developers should use existing methods\nto create these resources, and the new Glue L2 construct assumes they already\nexist as inputs. While best practice is for application and infrastructure code\nto be as close as possible for teams using fully-implemented DevOps mechanisms,\nin practice these ETL scripts are likely managed by a data science team who\nknow Python or Scala and don’t necessarily own or manage their own\ninfrastructure deployments. We want to meet developers where they are, and not\nassume that all of the code resides in the same repository, Developers can\nautomate this themselves via the CDK, however, if they do own both.\n\nValidating Glue version and feature use per AWS region at synth time is also\nnot in scope. AWS’ intention is for all features to eventually be propagated to\nall Global regions, so the complexity involved in creating and updating region-\nspecific configuration to match shifting feature sets does not out-weigh the\nlikelihood that a developer will use this construct to deploy resources to a\nregion without a particular new feature to a region that doesn’t yet support\nit without researching or manually attempting to use that feature before\ndeveloping it via IaC. The developer will, of course, still get feedback from\nthe underlying Glue APIs as CloudFormation deploys the resources similar to the\ncurrent CDK L1 Glue experience.\n"
+    "markdown": "# AWS Glue Construct Library\n<!--BEGIN STABILITY BANNER-->\n\n---\n\n![cdk-constructs: Experimental](https://img.shields.io/badge/cdk--constructs-experimental-important.svg?style=for-the-badge)\n\n> The APIs of higher level constructs in this module are experimental and under active development.\n> They are subject to non-backward compatible changes or removal in any future version. These are\n> not subject to the [Semantic Versioning](https://semver.org/) model and breaking changes will be\n> announced in the release notes. This means that while you may use them, you may need to update\n> your source code when upgrading to a newer version of this package.\n\n---\n\n<!--END STABILITY BANNER-->\n\nThis module is part of the [AWS Cloud Development Kit](https://github.com/aws/aws-cdk) project.\n\n## README\n\n[AWS Glue](https://aws.amazon.com/glue/) is a serverless data integration\nservice that makes it easier to discover, prepare, move, and integrate data\nfrom multiple sources for analytics, machine learning (ML), and application\ndevelopment.\n\nThe Glue L2 construct has convenience methods working backwards from common\nuse cases and sets required parameters to defaults that align with recommended\nbest practices for each job type. It also provides customers with a balance\nbetween flexibility via optional parameter overrides, and opinionated\ninterfaces that discouraging anti-patterns, resulting in reduced time to develop\nand deploy new resources.\n\n### References\n\n* [Glue Launch Announcement](https://aws.amazon.com/blogs/aws/launch-aws-glue-now-generally-available/)\n* [Glue Documentation](https://docs.aws.amazon.com/glue/index.html)\n* [Glue L1 (CloudFormation) Constructs](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/AWS_Glue.html)\n* Prior version of the [@aws-cdk/aws-glue-alpha module](https://github.com/aws/aws-cdk/blob/v2.51.1/packages/%40aws-cdk/aws-glue/README.md)\n\n## Create a Glue Job\n\nA Job encapsulates a script that connects to data sources, processes\nthem, and then writes output to a data target. There are four types of Glue\nJobs: Spark (ETL and Streaming), Python Shell, and Flex Jobs. Most\nof the required parameters for these jobs are common across all types,\nbut there are a few differences depending on the languages supported\nand features provided by each type. For all job types, the L2 defaults\nto AWS best practice recommendations, such as:\n\n* Use of Secrets Manager for Connection JDBC strings\n* Glue job autoscaling\n* Default parameter values for Glue job creation\n\nThis iteration of the L2 construct introduces breaking changes to\nthe existing glue-alpha-module, but these changes streamline the developer\nexperience, introduce new constants for defaults, and replacing synth-time\nvalidations with interface contracts for enforcement of the parameter combinations\nthat Glue supports. As an opinionated construct, the Glue L2 construct does\nnot allow developers to create resources that use non-current versions\nof Glue or deprecated language dependencies (e.g. deprecated versions of Python).\nAs always, L1s allow you to specify a wider range of parameters if you need\nor want to use alternative configurations.\n\nOptional and required parameters for each job are enforced via interface\nrather than validation; see [Glue's public documentation](https://docs.aws.amazon.com/glue/latest/dg/aws-glue-api.html)\nfor more granular details.\n\n### Spark Jobs\n\n#### ETL Jobs\n\nETL jobs support pySpark and Scala languages, for which there are separate but\nsimilar constructors. ETL jobs default to the G2 worker type, but you can\noverride this default with other supported worker type values (G1, G2, G4\nand G8). ETL jobs defaults to Glue version 4.0, which you can override to 3.0.\nThe following ETL features are enabled by default:\n`—enable-metrics, —enable-spark-ui, —enable-continuous-cloudwatch-log.`\nYou can find more details about version, worker type and other features in\n[Glue's public documentation](https://docs.aws.amazon.com/glue/latest/dg/aws-glue-api-jobs-job.html).\n\nReference the pyspark-etl-jobs.test.ts and scalaspark-etl-jobs.test.ts unit tests\nfor examples of required-only and optional job parameters when creating these\ntypes of jobs.\n\nFor the sake of brevity, examples are shown using the pySpark job variety.\n\nExample with only required parameters:\n\n```ts\nimport * as cdk from 'aws-cdk-lib';\nimport * as iam from 'aws-cdk-lib/aws-iam';\ndeclare const stack: cdk.Stack;\ndeclare const role: iam.IRole;\ndeclare const script: glue.Code;\nnew glue.PySparkEtlJob(stack, 'PySparkETLJob', {\n  role,\n  script,\n  jobName: 'PySparkETLJob',\n});\n```\n\nExample with optional override parameters:\n\n```ts\nimport * as cdk from 'aws-cdk-lib';\nimport * as iam from 'aws-cdk-lib/aws-iam';\ndeclare const stack: cdk.Stack;\ndeclare const role: iam.IRole;\ndeclare const script: glue.Code;\nnew glue.PySparkEtlJob(stack, 'PySparkETLJob', {\n  jobName: 'PySparkETLJobCustomName',\n  description: 'This is a description',\n  role,\n  script,\n  glueVersion: glue.GlueVersion.V5_1,\n  continuousLogging: { enabled: false },\n  workerType: glue.WorkerType.G_2X,\n  maxConcurrentRuns: 100,\n  timeout: cdk.Duration.hours(2),\n  connections: [glue.Connection.fromConnectionName(stack, 'Connection', 'connectionName')],\n  securityConfiguration: glue.SecurityConfiguration.fromSecurityConfigurationName(stack, 'SecurityConfig', 'securityConfigName'),\n  tags: {\n    FirstTagName: 'FirstTagValue',\n    SecondTagName: 'SecondTagValue',\n    XTagName: 'XTagValue',\n  },\n  numberOfWorkers: 2,\n  maxRetries: 2,\n});\n```\n\n#### Streaming Jobs\n\nStreaming jobs are similar to ETL jobs, except that they perform ETL on data\nstreams using the Apache Spark Structured Streaming framework. Some Spark\njob features are not available to Streaming ETL jobs. They support Scala\nand pySpark languages. PySpark streaming jobs default Python 3.9,\nwhich you can override with any non-deprecated version of Python. It\ndefaults to the G2 worker type and Glue 4.0, both of which you can override.\nThe following best practice features are enabled by default:\n`—enable-metrics, —enable-spark-ui, —enable-continuous-cloudwatch-log`.\n\nReference the pyspark-streaming-jobs.test.ts and scalaspark-streaming-jobs.test.ts\nunit tests for examples of required-only and optional job parameters when creating\nthese types of jobs.\n\nExample with only required parameters:\n\n```ts\nimport * as cdk from 'aws-cdk-lib';\nimport * as iam from 'aws-cdk-lib/aws-iam';\ndeclare const stack: cdk.Stack;\ndeclare const role: iam.IRole;\ndeclare const script: glue.Code;\nnew glue.PySparkStreamingJob(stack, 'ImportedJob', { role, script });\n```\n\nExample with optional override parameters:\n\n```ts\nimport * as cdk from 'aws-cdk-lib';\nimport * as iam from 'aws-cdk-lib/aws-iam';\ndeclare const stack: cdk.Stack;\ndeclare const role: iam.IRole;\ndeclare const script: glue.Code;\nnew glue.PySparkStreamingJob(stack, 'PySparkStreamingJob', {\n  jobName: 'PySparkStreamingJobCustomName',\n  description: 'This is a description',\n  role,\n  script,\n  glueVersion: glue.GlueVersion.V5_1,\n  continuousLogging: { enabled: false },\n  workerType: glue.WorkerType.G_2X,\n  maxConcurrentRuns: 100,\n  timeout: cdk.Duration.hours(2),\n  connections: [glue.Connection.fromConnectionName(stack, 'Connection', 'connectionName')],\n  securityConfiguration: glue.SecurityConfiguration.fromSecurityConfigurationName(stack, 'SecurityConfig', 'securityConfigName'),\n  tags: {\n    FirstTagName: 'FirstTagValue',\n    SecondTagName: 'SecondTagValue',\n    XTagName: 'XTagValue',\n  },\n  numberOfWorkers: 2,\n  maxRetries: 2,\n});\n```\n\n#### Flex Jobs\n\nThe flexible execution class is appropriate for non-urgent jobs such as\npre-production jobs, testing, and one-time data loads. Flexible jobs default\nto Glue version 5.0 and worker type `G_2X`. The following best practice\nfeatures are enabled by default:\n`—enable-metrics, —enable-spark-ui, —enable-continuous-cloudwatch-log`\n\nReference the pyspark-flex-etl-jobs.test.ts and scalaspark-flex-etl-jobs.test.ts\nunit tests for examples of required-only and optional job parameters when creating\nthese types of jobs.\n\nExample with only required parameters:\n\n```ts\nimport * as cdk from 'aws-cdk-lib';\nimport * as iam from 'aws-cdk-lib/aws-iam';\ndeclare const stack: cdk.Stack;\ndeclare const role: iam.IRole;\ndeclare const script: glue.Code;\nnew glue.PySparkFlexEtlJob(stack, 'ImportedJob', { role, script });\n```\n\nExample with optional override parameters:\n\n```ts\nimport * as cdk from 'aws-cdk-lib';\nimport * as iam from 'aws-cdk-lib/aws-iam';\ndeclare const stack: cdk.Stack;\ndeclare const role: iam.IRole;\ndeclare const script: glue.Code;\nnew glue.PySparkEtlJob(stack, 'pySparkEtlJob', {\n  jobName: 'pySparkEtlJob',\n  description: 'This is a description',\n  role,\n  script,\n  glueVersion: glue.GlueVersion.V5_1,\n  continuousLogging: { enabled: false },\n  workerType: glue.WorkerType.G_2X,\n  maxConcurrentRuns: 100,\n  timeout: cdk.Duration.hours(2),\n  connections: [glue.Connection.fromConnectionName(stack, 'Connection', 'connectionName')],\n  securityConfiguration: glue.SecurityConfiguration.fromSecurityConfigurationName(stack, 'SecurityConfig', 'securityConfigName'),\n  tags: {\n    FirstTagName: 'FirstTagValue',\n    SecondTagName: 'SecondTagValue',\n    XTagName: 'XTagValue',\n  },\n  numberOfWorkers: 2,\n  maxRetries: 2,\n});\n```\n\n### Python Shell Jobs\n\nPython shell jobs support a Python version that depends on the AWS Glue\nversion you use. These can be used to schedule and run tasks that don't\nrequire an Apache Spark environment. Python shell jobs default to\nPython 3.9 and a MaxCapacity of `0.0625`. Python 3.9 supports pre-loaded\nanalytics libraries using the `library-set=analytics` flag, which is\nenabled by default.\n\nReference the pyspark-shell-job.test.ts unit tests for examples of\nrequired-only and optional job parameters when creating these types of jobs.\n\nExample with only required parameters:\n\n```ts\nimport * as cdk from 'aws-cdk-lib';\nimport * as iam from 'aws-cdk-lib/aws-iam';\ndeclare const stack: cdk.Stack;\ndeclare const role: iam.IRole;\ndeclare const script: glue.Code;\nnew glue.PythonShellJob(stack, 'ImportedJob', { role, script });\n```\n\nExample with optional override parameters:\n\n```ts\nimport * as cdk from 'aws-cdk-lib';\nimport * as iam from 'aws-cdk-lib/aws-iam';\ndeclare const stack: cdk.Stack;\ndeclare const role: iam.IRole;\ndeclare const script: glue.Code;\ndeclare const extraPythonFile: glue.Code;\nnew glue.PythonShellJob(stack, 'PythonShellJob', {\n  jobName: 'PythonShellJobCustomName',\n  description: 'This is a description',\n  pythonVersion: glue.PythonVersion.TWO,\n  maxCapacity: glue.MaxCapacity.DPU_1,\n  role,\n  script,\n  extraPythonFiles: [extraPythonFile],\n  glueVersion: glue.GlueVersion.V2_0,\n  continuousLogging: { enabled: false },\n  workerType: glue.WorkerType.G_2X,\n  maxConcurrentRuns: 100,\n  timeout: cdk.Duration.hours(2),\n  connections: [glue.Connection.fromConnectionName(stack, 'Connection', 'connectionName')],\n  securityConfiguration: glue.SecurityConfiguration.fromSecurityConfigurationName(stack, 'SecurityConfig', 'securityConfigName'),\n  tags: {\n    FirstTagName: 'FirstTagValue',\n    SecondTagName: 'SecondTagValue',\n    XTagName: 'XTagValue',\n  },\n  numberOfWorkers: 2,\n  maxRetries: 2,\n});\n```\n\n### Ray Jobs\n\n> **⚠️ DEPRECATED:** AWS Glue for Ray is closed to new customers as of April 30, 2026 and is in maintenance mode.\n> Migrate to [Amazon EKS with KubeRay Operator](https://docs.aws.amazon.com/glue/latest/dg/awsglue-ray-jobs-availability-change.html).\n\nThe `RayJob` construct, `Runtime.RAY_TWO_FOUR`, and `JobType.RAY` are deprecated and will be removed in a future release.\n\n### Metrics Control\n\nBy default, Glue jobs enable CloudWatch metrics (`--enable-metrics`) and observability metrics (`--enable-observability-metrics`) for monitoring and debugging. You can disable these metrics to reduce CloudWatch costs:\n\n```ts\nimport * as cdk from 'aws-cdk-lib';\nimport * as iam from 'aws-cdk-lib/aws-iam';\ndeclare const stack: cdk.Stack;\ndeclare const role: iam.IRole;\ndeclare const script: glue.Code;\n\n// Disable both metrics for cost optimization\nnew glue.PySparkEtlJob(stack, 'CostOptimizedJob', {\n  role,\n  script,\n  enableMetrics: false,\n  enableObservabilityMetrics: false,\n});\n\n// Selective control - keep observability, disable profiling\nnew glue.PySparkEtlJob(stack, 'SelectiveJob', {\n  role,\n  script,\n  enableMetrics: false,\n  // enableObservabilityMetrics defaults to true\n});\n```\n\nThis feature is available for all Spark job types (ETL, Streaming, Flex).\n\n### Enable Job Run Queuing\n\nAWS Glue job queuing monitors your account level quotas and limits. If quotas or limits are insufficient to start a Glue job run, AWS Glue will automatically queue the job and wait for limits to free up. Once limits become available, AWS Glue will retry the job run. Glue jobs will queue for limits like max concurrent job runs per account, max concurrent Data Processing Units (DPU), and resource unavailable due to IP address exhaustion in Amazon Virtual Private Cloud (Amazon VPC).\n\nEnable job run queuing by setting the `jobRunQueuingEnabled` property to `true`.\n\n```ts\nimport * as cdk from 'aws-cdk-lib';\nimport * as iam from 'aws-cdk-lib/aws-iam';\ndeclare const stack: cdk.Stack;\ndeclare const role: iam.IRole;\ndeclare const script: glue.Code;\nnew glue.PySparkEtlJob(stack, 'PySparkETLJob', {\n  role,\n  script,\n  jobName: 'PySparkETLJob',\n  jobRunQueuingEnabled: true\n});\n```\n\n### Uploading scripts from the CDK app repository to S3\n\nSimilar to other L2 constructs, the Glue L2 automates uploading / updating\nscripts to S3 via an optional fromAsset parameter pointing to a script\nin the local file structure. You provide the existing S3 bucket and\npath to which you'd like the script to be uploaded.\n\nReference the unit tests for examples of repo and S3 code target examples.\n\n### Workflow Triggers\n\nYou can use Glue workflows to create and visualize complex\nextract, transform, and load (ETL) activities involving multiple crawlers,\njobs, and triggers. Standalone triggers are an anti-pattern, so you must\ncreate triggers from within a workflow using the L2 construct.\n\nWithin a workflow object, there are functions to create different\ntypes of triggers with actions and predicates. You then add those triggers\nto jobs.\n\nStartOnCreation defaults to true for all trigger types, but you can\noverride it if you prefer for your trigger not to start on creation.\n\nReference the workflow-triggers.test.ts unit tests for examples of creating\nworkflows and triggers.\n\n#### **1. On-Demand Triggers**\n\nOn-demand triggers can start glue jobs or crawlers. This construct provides\nconvenience functions to create on-demand crawler or job triggers. The constructor\ntakes an optional description parameter, but abstracts the requirement of an\nactions list using the job or crawler objects using conditional types.\n\n#### **2. Scheduled Triggers**\n\nYou can create scheduled triggers using cron expressions. This construct\nprovides daily, weekly, and monthly convenience functions,\nas well as a custom function that allows you to create your own\ncustom timing using the [existing event Schedule class](https://docs.aws.amazon.com/cdk/api/v2/docs/aws-cdk-lib.aws_events.Schedule.html)\nwithout having to build your own cron expressions. The L2 extracts\nthe expression that Glue requires from the Schedule object. The constructor\ntakes an optional description and a list of jobs or crawlers as actions.\n\n#### **3. Notify  Event Triggers**\n\nThere are two types of notify event triggers: batching and non-batching.\nFor batching triggers, you must specify `BatchSize`. For non-batching\ntriggers, `BatchSize` defaults to 1. For both triggers, `BatchWindow`\ndefaults to 900 seconds, but you can override the window to align with\nyour workload's requirements.\n\n#### **4. Conditional Triggers**\n\nConditional triggers have a predicate and actions associated with them.\nThe trigger actions are executed when the predicateCondition is true.\n\n### Connection Properties\n\nA `Connection` allows Glue jobs, crawlers and development endpoints to access\ncertain types of data stores.\n\n* **Secrets Management**\n    You must specify JDBC connection credentials in Secrets Manager and\n    provide the Secrets Manager Key name as a property to the job connection.\n\n* **Networking - the CDK determines the best fit subnet for Glue connection\nconfiguration**\n    The prior version of the glue-alpha-module requires the developer to\n    specify the subnet of the Connection when it’s defined. Now, you can still\n    specify the specific subnet you want to use, but are no longer required\n    to. You are only required to provide a VPC and either a public or private\n    subnet selection. Without a specific subnet provided, the L2 leverages the\n    existing [EC2 Subnet Selection](https://docs.aws.amazon.com/cdk/api/v2/python/aws_cdk.aws_ec2/SubnetSelection.html)\n    library to make the best choice selection for the subnet.\n\n```ts\ndeclare const securityGroup: ec2.SecurityGroup;\ndeclare const subnet: ec2.Subnet;\nnew glue.Connection(this, 'MyConnection', {\n  type: glue.ConnectionType.NETWORK,\n  // The security groups granting AWS Glue inbound access to the data source within the VPC\n  securityGroups: [securityGroup],\n  // The VPC subnet which contains the data source\n  subnet,\n});\n```\n\nFor RDS `Connection` by JDBC, it is recommended to manage credentials using AWS Secrets Manager. To use Secret, specify `SECRET_ID` in `properties` like the following code. Note that in this case, the subnet must have a route to the AWS Secrets Manager VPC endpoint or to the AWS Secrets Manager endpoint through a NAT gateway.\n\n```ts\ndeclare const securityGroup: ec2.SecurityGroup;\ndeclare const subnet: ec2.Subnet;\ndeclare const db: rds.DatabaseCluster;\nnew glue.Connection(this, \"RdsConnection\", {\n  type: glue.ConnectionType.JDBC,\n  securityGroups: [securityGroup],\n  subnet,\n  properties: {\n    JDBC_CONNECTION_URL: `jdbc:mysql://${db.clusterEndpoint.socketAddress}/databasename`,\n    JDBC_ENFORCE_SSL: \"false\",\n    SECRET_ID: db.secret!.secretName,\n  },\n});\n```\n\nConnection `properties` are emitted verbatim into the CloudFormation template, so\nany credential placed there in plaintext is stored in plaintext in the template,\n`cdk.out`, and source control. Reference a Secrets Manager secret through\n`SECRET_ID` (as above) instead. If a property key looks like a credential (for\nexample `PASSWORD`, `SECRET`, or `TOKEN`) and holds a plaintext literal, the\nconstruct emits a synthesis-time warning.\n\nIf you need to use a connection type that doesn't exist as a static member on `ConnectionType`, you can instantiate a `ConnectionType` object, e.g: `new glue.ConnectionType('NEW_TYPE')`.\n\nSee [Adding a Connection to Your Data Store](https://docs.aws.amazon.com/glue/latest/dg/populate-add-connection.html) and [Connection Structure](https://docs.aws.amazon.com/glue/latest/dg/aws-glue-api-catalog-connections.html#aws-glue-api-catalog-connections-Connection) documentation for more information on the supported data stores and their configurations.\n\n## SecurityConfiguration\n\nA `SecurityConfiguration` is a set of security properties that can be used by AWS Glue to encrypt data at rest.\n\n```ts\nnew glue.SecurityConfiguration(this, 'MySecurityConfiguration', {\n  cloudWatchEncryption: {\n    mode: glue.CloudWatchEncryptionMode.KMS,\n  },\n  jobBookmarksEncryption: {\n    mode: glue.JobBookmarksEncryptionMode.CLIENT_SIDE_KMS,\n  },\n  s3Encryption: {\n    mode: glue.S3EncryptionMode.KMS,\n  },\n});\n```\n\nBy default, a shared KMS key is created for use with the encryption configurations that require one. You can also supply your own key for each encryption config, for example, for CloudWatch encryption:\n\n```ts\ndeclare const key: kms.Key;\nnew glue.SecurityConfiguration(this, 'MySecurityConfiguration', {\n  cloudWatchEncryption: {\n    mode: glue.CloudWatchEncryptionMode.KMS,\n    kmsKey: key,\n  },\n});\n```\n\nSee [documentation](https://docs.aws.amazon.com/glue/latest/dg/encryption-security-configuration.html) for more info for Glue encrypting data written by Crawlers, Jobs, and Development Endpoints.\n\n## Catalog\n\nThe Glue Data Catalog is a persistent metadata store for your data assets. Every\naccount has an implicit, account-wide catalog that always exists, and you can also\ncreate additional catalogs as `AWS::Glue::Catalog` resources (for example, to\nfederate to another metastore).\n\nA catalog's encryption is fixed when the catalog is created: a catalog either\ncarries encryption settings or it does not. This keeps its configuration easy to\nreason about — there are no mutation methods that change encryption after the fact.\n\n### The account-wide catalog\n\nUse `Catalog.forAccount(scope)` to obtain the implicit account catalog. It is not\na CloudFormation resource — it always exists. Repeated calls within the same stack\nreturn the same instance:\n\n```ts\nconst catalog = glue.Catalog.forAccount(this);\n```\n\nTo configure Data Catalog encryption for the account, use\n`Catalog.encryptAccount(scope, options)`:\n\n```ts\ndeclare const key: kms.Key;\nglue.Catalog.encryptAccount(this, {\n  encryptionAtRest: glue.DataCatalogEncryptionAtRest.kms(key),\n});\n```\n\nBecause encryption is fixed at construction, `encryptAccount` must be called\n*before* the account catalog is first used in the stack — before any\n`Catalog.forAccount(this)` call, and before any `Database` that uses the account\ncatalog. Calling it after the account catalog has been materialized throws.\n\nThe account catalog's encryption is an account- and region-wide setting, managed\nthrough the singleton `PutDataCatalogEncryptionSettings` API. Configure it in\nexactly one stack. Configuring it from multiple stacks in the same account and\nregion makes those stacks overwrite one another at deploy time, and the result is\norder-dependent. Unlike duplicate settings within a single stack (which\nCloudFormation rejects), this cross-stack conflict is not caught at synthesis\ntime, because each stack synthesizes to its own template.\n\n### Creating a catalog\n\nTo create a new catalog resource, use the `Catalog` constructor. Encryption is\nconfigured through the `encryptionAtRest` and `connectionPasswordEncryption` props:\n\n```ts\nnew glue.Catalog(this, 'MyCatalog', {\n  catalogName: 'my-catalog',\n  description: 'my catalog description',\n});\n```\n\n### Encryption at rest\n\nConfigure Data Catalog encryption at rest through the `encryptionAtRest` option\n(on `Catalog.encryptAccount`, the `Catalog` constructor, or the import factories).\nIt accepts a `DataCatalogEncryptionAtRest` describing the mode:\n\n```ts\ndeclare const key: kms.Key;\n\n// SSE-KMS with a customer-managed key\nglue.Catalog.encryptAccount(this, {\n  encryptionAtRest: glue.DataCatalogEncryptionAtRest.kms(key),\n});\n\n// SSE-KMS with an AWS-managed key (omit the key)\nnew glue.Catalog(this, 'ManagedKeyCatalog', {\n  catalogName: 'managed-key-catalog',\n  encryptionAtRest: glue.DataCatalogEncryptionAtRest.kms(),\n});\n\n// Disable encryption at rest\nnew glue.Catalog(this, 'PlaintextCatalog', {\n  catalogName: 'plaintext-catalog',\n  encryptionAtRest: glue.DataCatalogEncryptionAtRest.disabled(),\n});\n```\n\nWhen you use `SSE-KMS-WITH-SERVICE-ROLE`, AWS Glue accesses the KMS key through a\nservice role you provide. If you pass a customer-managed key, the role is\nautomatically granted the permissions it needs to encrypt and decrypt catalog data:\n\n```ts\nimport * as iam from 'aws-cdk-lib/aws-iam';\ndeclare const key: kms.Key;\ndeclare const role: iam.IRole;\nglue.Catalog.encryptAccount(this, {\n  encryptionAtRest: glue.DataCatalogEncryptionAtRest.kmsWithServiceRole(role, key),\n});\n```\n\nThe customer-managed key, when configured, is exposed on the catalog as\n`encryptionKey` (and the connection-password key as `connectionPasswordKey`), so\nyou can reference it to grant additional access. It is undefined when encryption is\ndisabled or an AWS-managed key is used.\n\n### Connection password encryption\n\nIndependently from encryption at rest, the Data Catalog can encrypt the passwords\nstored in connection properties. Configure it through the\n`connectionPasswordEncryption` option:\n\n```ts\ndeclare const key: kms.Key;\nglue.Catalog.encryptAccount(this, {\n  connectionPasswordEncryption: {\n    kmsKey: key,\n    // Whether GetConnection/GetConnections return the password encrypted (default: true)\n    returnConnectionPasswordEncrypted: true,\n  },\n});\n```\n\nThe two encryption blocks are independent: enabling one does not require the other,\nand each may use a different KMS key. The customer-managed key for connection\npasswords is exposed as `connectionPasswordKey`.\n\n### Importing a catalog\n\nYou can import an existing catalog by ARN or by id. An imported catalog is a pure\nidentity handle — it emits no resources and does not manage the catalog's\nencryption:\n\n```ts\nconst byId = glue.Catalog.fromCatalogId(this, 'ById', 'my-catalog-id');\nconst byArn = glue.Catalog.fromCatalogArn(this, 'ByArn', 'arn:aws:glue:us-east-1:123456789012:catalog/my-catalog-id');\n```\n\nTo manage the Data Catalog encryption of a catalog you did not create in this\nstack, add a `CfnDataCatalogEncryptionSettings` resource targeting its id\ndirectly. Do this from exactly one stack: like the account catalog, a catalog has\na single encryption configuration, so two settings resources targeting the same id\nrace to overwrite one another at deploy time. Within a single stack this is caught\nby CloudFormation template validation (E3019, duplicate primary identifiers);\nacross stacks it is not, since each stack synthesizes to its own template.\n\n```ts\nimport { CfnDataCatalogEncryptionSettings } from 'aws-cdk-lib/aws-glue';\n\nnew CfnDataCatalogEncryptionSettings(this, 'Encryption', {\n  catalogId: 'my-catalog-id',\n  dataCatalogEncryptionSettings: {\n    encryptionAtRest: { catalogEncryptionMode: 'SSE-KMS' },\n  },\n});\n```\n\n## Database\n\nA `Database` is a logical grouping of `Tables` in the Glue Catalog.\n\n```ts\nnew glue.Database(this, 'MyDatabase', {\n  databaseName: 'my_database',\n  description: 'my_database_description',\n});\n```\n\nBecause a database is a container for tables and their metadata, it is retained\nby default when removed from the stack, to avoid accidental data loss. Set\n`removalPolicy` to `RemovalPolicy.DESTROY` to have it deleted instead:\n\n```ts\nimport { RemovalPolicy } from 'aws-cdk-lib';\n\nnew glue.Database(this, 'MyDatabase', {\n  databaseName: 'my_database',\n  removalPolicy: RemovalPolicy.DESTROY,\n});\n```\n\n## Table\n\nA Glue table describes a table of data in S3: its structure (column names and types), location of data (S3 objects with a common prefix in a S3 bucket), and format for the files (Json, Avro, Parquet, etc.):\n\n```ts\ndeclare const myDatabase: glue.Database;\nnew glue.S3Table(this, 'MyTable', {\n  database: myDatabase,\n  columns: [{\n    name: 'col1',\n    type: glue.Schema.STRING,\n  }, {\n    name: 'col2',\n    type: glue.Schema.array(glue.Schema.STRING),\n    comment: 'col2 is an array of strings' // comment is optional\n  }],\n  dataFormat: glue.DataFormat.JSON,\n});\n```\n\nBy default, a S3 bucket will be created to store the table's data but you can manually pass the `bucket` and `s3Prefix`:\n\n```ts\ndeclare const myBucket: s3.Bucket;\ndeclare const myDatabase: glue.Database;\nnew glue.S3Table(this, 'MyTable', {\n  bucket: myBucket,\n  s3Prefix: 'my-table/',\n  // ...\n  database: myDatabase,\n  columns: [{\n    name: 'col1',\n    type: glue.Schema.STRING,\n  }],\n  dataFormat: glue.DataFormat.JSON,\n});\n```\n\nGlue tables can be configured to contain user-defined properties, to describe the physical storage of table data, through the `storageParameters` property:\n\n```ts\ndeclare const myDatabase: glue.Database;\nnew glue.S3Table(this, 'MyTable', {\n  storageParameters: [\n    glue.StorageParameter.skipHeaderLineCount(1),\n    glue.StorageParameter.compressionType(glue.CompressionType.GZIP),\n    glue.StorageParameter.custom('separatorChar', ',')\n  ],\n  // ...\n  database: myDatabase,\n  columns: [{\n    name: 'col1',\n    type: glue.Schema.STRING,\n  }],\n  dataFormat: glue.DataFormat.JSON,\n});\n```\n\nGlue tables can also be configured to contain user-defined table properties through the [`parameters`](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-glue-table-tableinput.html#cfn-glue-table-tableinput-parameters) property:\n\n```ts\ndeclare const myDatabase: glue.Database;\nnew glue.S3Table(this, 'MyTable', {\n  parameters: {\n    key1: 'val1',\n    key2: 'val2',\n  },\n  database: myDatabase,\n  columns: [{\n    name: 'col1',\n    type: glue.Schema.STRING,\n  }],\n  dataFormat: glue.DataFormat.JSON,\n});\n```\n\n### Partition Keys\n\nTo improve query performance, a table can specify `partitionKeys` on which data is stored and queried separately. For example, you might partition a table by `year` and `month` to optimize queries based on a time window:\n\n```ts\ndeclare const myDatabase: glue.Database;\nnew glue.S3Table(this, 'MyTable', {\n  database: myDatabase,\n  columns: [{\n    name: 'col1',\n    type: glue.Schema.STRING,\n  }],\n  partitionKeys: [{\n    name: 'year',\n    type: glue.Schema.SMALL_INT,\n  }, {\n    name: 'month',\n    type: glue.Schema.SMALL_INT,\n  }],\n  dataFormat: glue.DataFormat.JSON,\n});\n```\n\n### Partition Indexes\n\nAnother way to improve query performance is to specify partition indexes. If no partition indexes are\npresent on the table, AWS Glue loads all partitions of the table and filters the loaded partitions using\nthe query expression. The query takes more time to run as the number of partitions increase. With an\nindex, the query will try to fetch a subset of the partitions instead of loading all partitions of the\ntable.\n\nThe keys of a partition index must be a subset of the partition keys of the table. You can have a\nmaximum of 3 partition indexes per table. To specify a partition index, you can use the `partitionIndexes`\nproperty:\n\n```ts\ndeclare const myDatabase: glue.Database;\nnew glue.S3Table(this, 'MyTable', {\n  database: myDatabase,\n  columns: [{\n    name: 'col1',\n    type: glue.Schema.STRING,\n  }],\n  partitionKeys: [{\n    name: 'year',\n    type: glue.Schema.SMALL_INT,\n  }, {\n    name: 'month',\n    type: glue.Schema.SMALL_INT,\n  }],\n  partitionIndexes: [{\n    indexName: 'my-index', // optional\n    keyNames: ['year'],\n  }], // supply up to 3 indexes\n  dataFormat: glue.DataFormat.JSON,\n});\n```\n\nAlternatively, you can call the `addPartitionIndex()` function on a table:\n\n```ts\ndeclare const myTable: glue.Table;\nmyTable.addPartitionIndex({\n  indexName: 'my-index',\n  keyNames: ['year'],\n});\n```\n\n### Partition Filtering\n\nIf you have a table with a large number of partitions that grows over time, consider using AWS Glue partition indexing and filtering.\n\n```ts\ndeclare const myDatabase: glue.Database;\nnew glue.S3Table(this, 'MyTable', {\n  database: myDatabase,\n  columns: [{\n      name: 'col1',\n      type: glue.Schema.STRING,\n  }],\n  partitionKeys: [{\n      name: 'year',\n      type: glue.Schema.SMALL_INT,\n  }, {\n      name: 'month',\n      type: glue.Schema.SMALL_INT,\n  }],\n  dataFormat: glue.DataFormat.JSON,\n  enablePartitionFiltering: true,\n});\n```\n\n### Partition Projection\n\nPartition projection allows Athena to automatically add new partitions as new data arrives, without requiring `ALTER TABLE ADD PARTITION` statements. This improves query performance and reduces management overhead by eliminating the need to manually manage partition metadata.\n\nFor more information, see the [AWS documentation on partition projection](https://docs.aws.amazon.com/athena/latest/ug/partition-projection.html).\n\n#### INTEGER Projection\n\nFor partition keys with sequential numeric values:\n\n```ts\ndeclare const myDatabase: glue.Database;\nnew glue.S3Table(this, 'MyTable', {\n  database: myDatabase,\n  columns: [{\n    name: 'data',\n    type: glue.Schema.STRING,\n  }],\n  partitionKeys: [{\n    name: 'year',\n    type: glue.Schema.INTEGER,\n  }],\n  dataFormat: glue.DataFormat.JSON,\n  partitionProjection: {\n    year: glue.PartitionProjectionConfiguration.integer({\n      min: 2020,\n      max: 2023,\n      interval: 1,  // optional, defaults to 1\n      digits: 4,    // optional, pads with leading zeros\n    }),\n  },\n});\n```\n\n#### DATE Projection\n\nFor partition keys with date or timestamp values. Supports both fixed dates and relative dates using `NOW`:\n\n```ts\ndeclare const myDatabase: glue.Database;\nnew glue.S3Table(this, 'MyTable', {\n  database: myDatabase,\n  columns: [{\n    name: 'data',\n    type: glue.Schema.STRING,\n  }],\n  partitionKeys: [{\n    name: 'date',\n    type: glue.Schema.STRING,\n  }],\n  dataFormat: glue.DataFormat.JSON,\n  partitionProjection: {\n    date: glue.PartitionProjectionConfiguration.date({\n      min: '2020-01-01',\n      max: '2023-12-31',\n      format: 'yyyy-MM-dd',\n      interval: 1,  // optional, defaults to 1\n      intervalUnit: glue.DateIntervalUnit.DAYS,  // optional: YEARS, MONTHS, WEEKS, DAYS, HOURS, MINUTES, SECONDS\n    }),\n  },\n});\n```\n\nYou can also use relative dates with `NOW`:\n\n```ts\ndeclare const myDatabase: glue.Database;\nnew glue.S3Table(this, 'MyTable', {\n  database: myDatabase,\n  columns: [{\n    name: 'data',\n    type: glue.Schema.STRING,\n  }],\n  partitionKeys: [{\n    name: 'date',\n    type: glue.Schema.STRING,\n  }],\n  dataFormat: glue.DataFormat.JSON,\n  partitionProjection: {\n    date: glue.PartitionProjectionConfiguration.date({\n      min: 'NOW-3YEARS',\n      max: 'NOW',\n      format: 'yyyy-MM-dd',\n    }),\n  },\n});\n```\n\n#### ENUM Projection\n\nFor partition keys with a known set of values:\n\n```ts\ndeclare const myDatabase: glue.Database;\nnew glue.S3Table(this, 'MyTable', {\n  database: myDatabase,\n  columns: [{\n    name: 'data',\n    type: glue.Schema.STRING,\n  }],\n  partitionKeys: [{\n    name: 'region',\n    type: glue.Schema.STRING,\n  }],\n  dataFormat: glue.DataFormat.JSON,\n  partitionProjection: {\n    region: glue.PartitionProjectionConfiguration.enum({\n      values: ['us-east-1', 'us-west-2', 'eu-west-1'],\n    }),\n  },\n});\n```\n\n#### INJECTED Projection\n\nFor custom partition values injected at query time:\n\n```ts\ndeclare const myDatabase: glue.Database;\nnew glue.S3Table(this, 'MyTable', {\n  database: myDatabase,\n  columns: [{\n    name: 'data',\n    type: glue.Schema.STRING,\n  }],\n  partitionKeys: [{\n    name: 'custom',\n    type: glue.Schema.STRING,\n  }],\n  dataFormat: glue.DataFormat.JSON,\n  partitionProjection: {\n    custom: glue.PartitionProjectionConfiguration.injected(),\n  },\n});\n```\n\n#### Multiple Partition Projections\n\nYou can configure partition projection for multiple partition keys:\n\n```ts\ndeclare const myDatabase: glue.Database;\nnew glue.S3Table(this, 'MyTable', {\n  database: myDatabase,\n  columns: [{\n    name: 'data',\n    type: glue.Schema.STRING,\n  }],\n  partitionKeys: [\n    {\n      name: 'year',\n      type: glue.Schema.INTEGER,\n    },\n    {\n      name: 'month',\n      type: glue.Schema.INTEGER,\n    },\n    {\n      name: 'region',\n      type: glue.Schema.STRING,\n    },\n  ],\n  dataFormat: glue.DataFormat.JSON,\n  partitionProjection: {\n    year: glue.PartitionProjectionConfiguration.integer({\n      min: 2020,\n      max: 2023,\n    }),\n    month: glue.PartitionProjectionConfiguration.integer({\n      min: 1,\n      max: 12,\n      digits: 2,\n    }),\n    region: glue.PartitionProjectionConfiguration.enum({\n      values: ['us-east-1', 'us-west-2'],\n    }),\n  },\n});\n```\n\n### Glue Connections\n\nGlue connections allow external data connections to third party databases and data warehouses. However, these connections can also be assigned to Glue Tables, allowing you to query external data sources using the Glue Data Catalog.\n\nWhereas `S3Table` will point to (and if needed, create) a bucket to store the tables' data, `ExternalTable` will point to an existing table in a data source. For example, to create a table in Glue that points to a table in Redshift:\n\n```ts\ndeclare const myConnection: glue.Connection;\ndeclare const myDatabase: glue.Database;\nnew glue.ExternalTable(this, 'MyTable', {\n  connection: myConnection,\n  externalDataLocation: 'default_db_public_example', // A table in Redshift\n  // ...\n  database: myDatabase,\n  columns: [{\n    name: 'col1',\n    type: glue.Schema.STRING,\n  }],\n  dataFormat: glue.DataFormat.JSON,\n});\n```\n\n## [Encryption](https://docs.aws.amazon.com/athena/latest/ug/encryption.html)\n\nWhen the table creates its own S3 bucket (i.e. you do not pass an explicit `bucket`), that bucket enforces SSL: a bucket policy denies any request made over plain HTTP. If you provide your own bucket, enabling `enforceSSL` on it is your responsibility.\n\nYou can enable encryption on a Table's data:\n\n* [S3Managed](https://docs.aws.amazon.com/AmazonS3/latest/dev/UsingServerSideEncryption.html) - (default) Server side encryption (`SSE-S3`) with an Amazon S3-managed key.\n\n```ts\ndeclare const myDatabase: glue.Database;\nnew glue.S3Table(this, 'MyTable', {\n  encryption: glue.TableEncryption.S3_MANAGED,\n  // ...\n  database: myDatabase,\n  columns: [{\n    name: 'col1',\n    type: glue.Schema.STRING,\n  }],\n  dataFormat: glue.DataFormat.JSON,\n});\n```\n\n* [Kms](https://docs.aws.amazon.com/AmazonS3/latest/dev/UsingKMSEncryption.html) - Server-side encryption (`SSE-KMS`) with an AWS KMS Key managed by the account owner.\n\n```ts\ndeclare const myDatabase: glue.Database;\n// KMS key is created automatically\nnew glue.S3Table(this, 'MyTable', {\n  encryption: glue.TableEncryption.KMS,\n  // ...\n  database: myDatabase,\n  columns: [{\n    name: 'col1',\n    type: glue.Schema.STRING,\n  }],\n  dataFormat: glue.DataFormat.JSON,\n});\n\n// with an explicit KMS key\nnew glue.S3Table(this, 'MyTable', {\n  encryption: glue.TableEncryption.KMS,\n  encryptionKey: new kms.Key(this, 'MyKey'),\n  // ...\n  database: myDatabase,\n  columns: [{\n    name: 'col1',\n    type: glue.Schema.STRING,\n  }],\n  dataFormat: glue.DataFormat.JSON,\n});\n```\n\n* [KmsManaged](https://docs.aws.amazon.com/AmazonS3/latest/dev/UsingKMSEncryption.html) - Server-side encryption (`SSE-KMS`), like `Kms`, except with an AWS KMS Key managed by the AWS Key Management Service.\n\n```ts\ndeclare const myDatabase: glue.Database;\nnew glue.S3Table(this, 'MyTable', {\n  encryption: glue.TableEncryption.KMS_MANAGED,\n  // ...\n  database: myDatabase,\n  columns: [{\n    name: 'col1',\n    type: glue.Schema.STRING,\n  }],\n  dataFormat: glue.DataFormat.JSON,\n});\n```\n\n* [ClientSideKms](https://docs.aws.amazon.com/AmazonS3/latest/dev/UsingClientSideEncryption.html#client-side-encryption-kms-managed-master-key-intro) - Client-side encryption (`CSE-KMS`) with an AWS KMS Key managed by the account owner.\n\n```ts\ndeclare const myDatabase: glue.Database;\n// KMS key is created automatically\nnew glue.S3Table(this, 'MyTable', {\n  encryption: glue.TableEncryption.CLIENT_SIDE_KMS,\n  // ...\n  database: myDatabase,\n  columns: [{\n    name: 'col1',\n    type: glue.Schema.STRING,\n  }],\n  dataFormat: glue.DataFormat.JSON,\n});\n\n// with an explicit KMS key\nnew glue.S3Table(this, 'MyTable', {\n  encryption: glue.TableEncryption.CLIENT_SIDE_KMS,\n  encryptionKey: new kms.Key(this, 'MyKey'),\n  // ...\n  database: myDatabase,\n  columns: [{\n    name: 'col1',\n    type: glue.Schema.STRING,\n  }],\n  dataFormat: glue.DataFormat.JSON,\n});\n```\n\n*Note: you cannot provide a `Bucket` when creating the `S3Table` if you wish to use server-side encryption (`KMS`, `KMS_MANAGED` or `S3_MANAGED`)*.\n\n## Types\n\nA table's schema is a collection of columns, each of which have a `name` and a `type`. Types are recursive structures, consisting of primitive and complex types:\n\n```ts\ndeclare const myDatabase: glue.Database;\nnew glue.S3Table(this, 'MyTable', {\n  columns: [{\n    name: 'primitive_column',\n    type: glue.Schema.STRING,\n  }, {\n    name: 'array_column',\n    type: glue.Schema.array(glue.Schema.INTEGER),\n    comment: 'array<integer>',\n  }, {\n    name: 'map_column',\n    type: glue.Schema.map(\n      glue.Schema.STRING,\n      glue.Schema.TIMESTAMP),\n    comment: 'map<string,string>',\n  }, {\n    name: 'struct_column',\n    type: glue.Schema.struct([{\n      name: 'nested_column',\n      type: glue.Schema.DATE,\n      comment: 'nested comment',\n    }]),\n    comment: \"struct<nested_column:date COMMENT 'nested comment'>\",\n  }],\n  // ...\n  database: myDatabase,\n  dataFormat: glue.DataFormat.JSON,\n});\n```\n\n## Public FAQ\n\n### What are we launching today?\n\nWe’re launching new features to an AWS CDK Glue L2 Construct to provide\nbest-practice defaults and convenience methods to create Glue Jobs, Connections,\nTriggers, Workflows, and the underlying permissions and configuration.\n\n### Why should I use this Construct?\n\nDevelopers should use this Construct to reduce the amount of boilerplate\ncode and complexity each individual has to navigate, and make it easier to\ncreate best-practice Glue resources.\n\n### What’s not in scope?\n\nGlue Crawlers and other resources that are now managed by the AWS LakeFormation\nteam are not in scope for this effort. Developers should use existing methods\nto create these resources, and the new Glue L2 construct assumes they already\nexist as inputs. While best practice is for application and infrastructure code\nto be as close as possible for teams using fully-implemented DevOps mechanisms,\nin practice these ETL scripts are likely managed by a data science team who\nknow Python or Scala and don’t necessarily own or manage their own\ninfrastructure deployments. We want to meet developers where they are, and not\nassume that all of the code resides in the same repository, Developers can\nautomate this themselves via the CDK, however, if they do own both.\n\nValidating Glue version and feature use per AWS region at synth time is also\nnot in scope. AWS’ intention is for all features to eventually be propagated to\nall Global regions, so the complexity involved in creating and updating region-\nspecific configuration to match shifting feature sets does not out-weigh the\nlikelihood that a developer will use this construct to deploy resources to a\nregion without a particular new feature to a region that doesn’t yet support\nit without researching or manually attempting to use that feature before\ndeveloping it via IaC. The developer will, of course, still get feedback from\nthe underlying Glue APIs as CloudFormation deploys the resources similar to the\ncurrent CDK L1 Glue experience.\n"
   },
   "repository": {
     "directory": "packages/@aws-cdk/aws-glue-alpha",
@@ -9355,35 +9645,591 @@
       "name": "AssetCode",
       "symbolId": "lib/code:AssetCode"
     },
-    "@aws-cdk/aws-glue-alpha.ClassificationString": {
+    "@aws-cdk/aws-glue-alpha.Catalog": {
       "assembly": "@aws-cdk/aws-glue-alpha",
+      "base": "@aws-cdk/aws-glue-alpha.CatalogBase",
       "docs": {
-        "see": "https://docs.aws.amazon.com/glue/latest/dg/add-classifier.html#classifier-built-in",
+        "remarks": "Use `Catalog.forAccount(scope)` to obtain the implicit account-wide catalog,\n`Catalog.encryptAccount(scope, options)` to configure its Data Catalog\nencryption, or `new Catalog(...)` to create an `AWS::Glue::Catalog` resource.",
         "stability": "experimental",
-        "summary": "Classification string given to tables with this data format.",
-        "example": "// The code below shows an example of how to instantiate this type.\n// The values are placeholders you should change.\nimport * as glue_alpha from '@aws-cdk/aws-glue-alpha';\nconst classificationString = glue_alpha.ClassificationString.AVRO;",
+        "summary": "A Glue Data Catalog.",
+        "example": "declare const key: kms.Key;\nglue.Catalog.encryptAccount(this, {\n  encryptionAtRest: glue.DataCatalogEncryptionAtRest.kms(key),\n});",
         "custom": {
-          "exampleMetadata": "fixture=_generated"
+          "exampleMetadata": "infused"
         }
       },
-      "fqn": "@aws-cdk/aws-glue-alpha.ClassificationString",
+      "fqn": "@aws-cdk/aws-glue-alpha.Catalog",
       "initializer": {
         "docs": {
           "stability": "experimental"
         },
         "locationInModule": {
-          "filename": "lib/data-format.ts",
-          "line": 176
+          "filename": "lib/catalog.ts",
+          "line": 399
         },
         "parameters": [
           {
-            "name": "value",
+            "name": "scope",
             "type": {
-              "primitive": "string"
+              "fqn": "constructs.Construct"
             }
-          }
-        ]
-      },
+          },
+          {
+            "name": "id",
+            "type": {
+              "primitive": "string"
+            }
+          },
+          {
+            "name": "props",
+            "type": {
+              "fqn": "@aws-cdk/aws-glue-alpha.CatalogProps"
+            }
+          }
+        ]
+      },
+      "kind": "class",
+      "locationInModule": {
+        "filename": "lib/catalog.ts",
+        "line": 294
+      },
+      "methods": [
+        {
+          "docs": {
+            "remarks": "The account catalog's encryption is an account/region-wide setting, managed\nthrough the singleton `PutDataCatalogEncryptionSettings` API. Because\nencryption is fixed at construction, it must be configured before the\naccount catalog is first used in the stack: calling this after the account\ncatalog has already been materialized (for example by `Catalog.forAccount`,\nor by a `Database` that uses the account catalog) throws.\n\nConfigure it in exactly one stack. Configuring it from multiple stacks in the\nsame account and region makes those stacks overwrite one another at deploy\ntime, and the result is order-dependent. Unlike duplicate settings within a\nsingle stack (which CloudFormation rejects), this cross-stack conflict is not\ncaught at synthesis time, because each stack synthesizes to its own template.",
+            "stability": "experimental",
+            "summary": "Configure Data Catalog encryption for the implicit, account-wide catalog and return it."
+          },
+          "locationInModule": {
+            "filename": "lib/catalog.ts",
+            "line": 334
+          },
+          "name": "encryptAccount",
+          "parameters": [
+            {
+              "name": "scope",
+              "type": {
+                "fqn": "constructs.Construct"
+              }
+            },
+            {
+              "name": "options",
+              "type": {
+                "fqn": "@aws-cdk/aws-glue-alpha.CatalogEncryptionOptions"
+              }
+            }
+          ],
+          "returns": {
+            "type": {
+              "fqn": "@aws-cdk/aws-glue-alpha.ICatalog"
+            }
+          },
+          "static": true
+        },
+        {
+          "docs": {
+            "remarks": "The account catalog is not a CloudFormation resource; it always exists. This\nreturns a stack-scoped singleton, so repeated calls within the same stack\nreturn the same instance.\n\nThis returns the account catalog without managing its encryption. To\nconfigure Data Catalog encryption for the account, use\n`Catalog.encryptAccount(scope, options)` instead - it must be called before\nthe account catalog is first used in the stack.",
+            "stability": "experimental",
+            "summary": "Obtain the implicit, account-wide Data Catalog."
+          },
+          "locationInModule": {
+            "filename": "lib/catalog.ts",
+            "line": 311
+          },
+          "name": "forAccount",
+          "parameters": [
+            {
+              "name": "scope",
+              "type": {
+                "fqn": "constructs.Construct"
+              }
+            }
+          ],
+          "returns": {
+            "type": {
+              "fqn": "@aws-cdk/aws-glue-alpha.ICatalog"
+            }
+          },
+          "static": true
+        },
+        {
+          "docs": {
+            "remarks": "The ARN must be a Glue catalog ARN, either the account-wide catalog\n(`arn:aws:glue:<region>:<account>:catalog`, whose id is the account) or a\nnamed catalog (`arn:aws:glue:<region>:<account>:catalog/<name>`, whose id is\nthe name).\n\nThe imported catalog is a pure identity handle and does not manage the\ncatalog's encryption. To manage an existing catalog's Data Catalog\nencryption, add a `CfnDataCatalogEncryptionSettings` resource targeting its\nid.",
+            "stability": "experimental",
+            "summary": "Import an existing catalog by its ARN."
+          },
+          "locationInModule": {
+            "filename": "lib/catalog.ts",
+            "line": 359
+          },
+          "name": "fromCatalogArn",
+          "parameters": [
+            {
+              "name": "scope",
+              "type": {
+                "fqn": "constructs.Construct"
+              }
+            },
+            {
+              "name": "id",
+              "type": {
+                "primitive": "string"
+              }
+            },
+            {
+              "name": "catalogArn",
+              "type": {
+                "primitive": "string"
+              }
+            }
+          ],
+          "returns": {
+            "type": {
+              "fqn": "@aws-cdk/aws-glue-alpha.ICatalog"
+            }
+          },
+          "static": true
+        },
+        {
+          "docs": {
+            "remarks": "The imported catalog is a pure identity handle and does not manage the\ncatalog's encryption. To manage an existing catalog's Data Catalog\nencryption, add a `CfnDataCatalogEncryptionSettings` resource targeting its\nid.",
+            "stability": "experimental",
+            "summary": "Import an existing catalog by its id."
+          },
+          "locationInModule": {
+            "filename": "lib/catalog.ts",
+            "line": 388
+          },
+          "name": "fromCatalogId",
+          "parameters": [
+            {
+              "name": "scope",
+              "type": {
+                "fqn": "constructs.Construct"
+              }
+            },
+            {
+              "name": "id",
+              "type": {
+                "primitive": "string"
+              }
+            },
+            {
+              "name": "catalogId",
+              "type": {
+                "primitive": "string"
+              }
+            }
+          ],
+          "returns": {
+            "type": {
+              "fqn": "@aws-cdk/aws-glue-alpha.ICatalog"
+            }
+          },
+          "static": true
+        }
+      ],
+      "name": "Catalog",
+      "properties": [
+        {
+          "const": true,
+          "docs": {
+            "stability": "experimental",
+            "summary": "Uniquely identifies this class."
+          },
+          "immutable": true,
+          "locationInModule": {
+            "filename": "lib/catalog.ts",
+            "line": 297
+          },
+          "name": "PROPERTY_INJECTION_ID",
+          "static": true,
+          "type": {
+            "primitive": "string"
+          }
+        },
+        {
+          "docs": {
+            "stability": "experimental",
+            "summary": "The ARN of the catalog."
+          },
+          "immutable": true,
+          "locationInModule": {
+            "filename": "lib/catalog.ts",
+            "line": 395
+          },
+          "name": "catalogArn",
+          "overrides": "@aws-cdk/aws-glue-alpha.CatalogBase",
+          "type": {
+            "primitive": "string"
+          }
+        },
+        {
+          "docs": {
+            "stability": "experimental",
+            "summary": "The id of the catalog (for the account-wide catalog, the AWS account id)."
+          },
+          "immutable": true,
+          "locationInModule": {
+            "filename": "lib/catalog.ts",
+            "line": 394
+          },
+          "name": "catalogId",
+          "overrides": "@aws-cdk/aws-glue-alpha.CatalogBase",
+          "type": {
+            "primitive": "string"
+          }
+        }
+      ],
+      "symbolId": "lib/catalog:Catalog"
+    },
+    "@aws-cdk/aws-glue-alpha.CatalogBase": {
+      "abstract": true,
+      "assembly": "@aws-cdk/aws-glue-alpha",
+      "base": "aws-cdk-lib.Resource",
+      "docs": {
+        "remarks": "Materializes the single\n`CfnDataCatalogEncryptionSettings` resource (targeting its own `catalogId`)\nfrom the encryption options supplied at construction. Encryption is fixed at\nconstruction, so a catalog either carries settings or it does not.",
+        "stability": "experimental",
+        "summary": "Base class for all `ICatalog` implementations."
+      },
+      "fqn": "@aws-cdk/aws-glue-alpha.CatalogBase",
+      "initializer": {
+        "docs": {
+          "stability": "stable"
+        },
+        "locationInModule": {
+          "filename": "core/lib/resource.ts",
+          "line": 125
+        },
+        "parameters": [
+          {
+            "name": "scope",
+            "type": {
+              "fqn": "constructs.Construct"
+            }
+          },
+          {
+            "name": "id",
+            "type": {
+              "primitive": "string"
+            }
+          },
+          {
+            "name": "props",
+            "optional": true,
+            "type": {
+              "fqn": "aws-cdk-lib.ResourceProps"
+            }
+          }
+        ]
+      },
+      "interfaces": [
+        "@aws-cdk/aws-glue-alpha.ICatalog"
+      ],
+      "kind": "class",
+      "locationInModule": {
+        "filename": "lib/catalog.ts",
+        "line": 194
+      },
+      "methods": [
+        {
+          "docs": {
+            "remarks": "Subclasses call this once, after `catalogId`/`catalogArn` are\nassigned. When neither block is configured, no resource is emitted, avoiding\nan empty settings resource that would reset the catalog on deploy.",
+            "stability": "experimental",
+            "summary": "Emit the catalog's encryption settings from the options fixed at construction."
+          },
+          "locationInModule": {
+            "filename": "lib/catalog.ts",
+            "line": 221
+          },
+          "name": "configureEncryption",
+          "parameters": [
+            {
+              "name": "options",
+              "type": {
+                "fqn": "@aws-cdk/aws-glue-alpha.CatalogEncryptionOptions"
+              }
+            }
+          ],
+          "protected": true
+        }
+      ],
+      "name": "CatalogBase",
+      "properties": [
+        {
+          "abstract": true,
+          "docs": {
+            "stability": "experimental",
+            "summary": "The ARN of the catalog."
+          },
+          "immutable": true,
+          "locationInModule": {
+            "filename": "lib/catalog.ts",
+            "line": 196
+          },
+          "name": "catalogArn",
+          "overrides": "@aws-cdk/aws-glue-alpha.ICatalog",
+          "type": {
+            "primitive": "string"
+          }
+        },
+        {
+          "abstract": true,
+          "docs": {
+            "stability": "experimental",
+            "summary": "The id of the catalog (for the account-wide catalog, the AWS account id)."
+          },
+          "immutable": true,
+          "locationInModule": {
+            "filename": "lib/catalog.ts",
+            "line": 195
+          },
+          "name": "catalogId",
+          "overrides": "@aws-cdk/aws-glue-alpha.ICatalog",
+          "type": {
+            "primitive": "string"
+          }
+        },
+        {
+          "docs": {
+            "stability": "experimental",
+            "summary": "A reference to a Catalog resource."
+          },
+          "immutable": true,
+          "locationInModule": {
+            "filename": "lib/catalog.ts",
+            "line": 209
+          },
+          "name": "catalogRef",
+          "overrides": "aws-cdk-lib.interfaces.aws_glue.ICatalogRef",
+          "type": {
+            "fqn": "aws-cdk-lib.interfaces.aws_glue.CatalogReference"
+          }
+        },
+        {
+          "docs": {
+            "remarks": "Undefined when password encryption uses an AWS-managed key or is not\nconfigured. Grant access to it via `KeyGrants`, e.g.\n`if (catalog.connectionPasswordKey) { KeyGrants.fromKey(catalog.connectionPasswordKey).encrypt(grantee); }`.",
+            "stability": "experimental",
+            "summary": "The customer-managed KMS key used to encrypt connection passwords, if one was configured."
+          },
+          "immutable": true,
+          "locationInModule": {
+            "filename": "lib/catalog.ts",
+            "line": 205
+          },
+          "name": "connectionPasswordKey",
+          "optional": true,
+          "overrides": "@aws-cdk/aws-glue-alpha.ICatalog",
+          "type": {
+            "fqn": "aws-cdk-lib.interfaces.aws_kms.IKeyRef"
+          }
+        },
+        {
+          "docs": {
+            "remarks": "Undefined when encryption is disabled or an AWS-managed key is used. Grant\naccess to it via `KeyGrants`, e.g.\n`if (catalog.encryptionKey) { KeyGrants.fromKey(catalog.encryptionKey).encrypt(grantee); }`.",
+            "stability": "experimental",
+            "summary": "The customer-managed KMS key used for the catalog's encryption at rest, if one was configured."
+          },
+          "immutable": true,
+          "locationInModule": {
+            "filename": "lib/catalog.ts",
+            "line": 201
+          },
+          "name": "encryptionKey",
+          "optional": true,
+          "overrides": "@aws-cdk/aws-glue-alpha.ICatalog",
+          "type": {
+            "fqn": "aws-cdk-lib.interfaces.aws_kms.IKeyRef"
+          }
+        }
+      ],
+      "symbolId": "lib/catalog:CatalogBase"
+    },
+    "@aws-cdk/aws-glue-alpha.CatalogEncryptionMode": {
+      "assembly": "@aws-cdk/aws-glue-alpha",
+      "docs": {
+        "see": "https://docs.aws.amazon.com/glue/latest/webapi/API_EncryptionAtRest.html#Glue-Type-EncryptionAtRest-CatalogEncryptionMode",
+        "stability": "experimental",
+        "summary": "The encryption-at-rest mode for a Glue Data Catalog."
+      },
+      "fqn": "@aws-cdk/aws-glue-alpha.CatalogEncryptionMode",
+      "kind": "enum",
+      "locationInModule": {
+        "filename": "lib/catalog.ts",
+        "line": 18
+      },
+      "members": [
+        {
+          "docs": {
+            "stability": "experimental",
+            "summary": "Encryption at rest is disabled."
+          },
+          "name": "DISABLED"
+        },
+        {
+          "docs": {
+            "stability": "experimental",
+            "summary": "Server-side encryption (SSE) with an AWS KMS key."
+          },
+          "name": "SSE_KMS"
+        },
+        {
+          "docs": {
+            "stability": "experimental",
+            "summary": "Server-side encryption (SSE) with an AWS KMS key, using a service role that AWS Glue assumes to access the key on your behalf."
+          },
+          "name": "SSE_KMS_WITH_SERVICE_ROLE"
+        }
+      ],
+      "name": "CatalogEncryptionMode",
+      "symbolId": "lib/catalog:CatalogEncryptionMode"
+    },
+    "@aws-cdk/aws-glue-alpha.CatalogEncryptionOptions": {
+      "assembly": "@aws-cdk/aws-glue-alpha",
+      "datatype": true,
+      "docs": {
+        "remarks": "Encryption is fixed at construction: a catalog either carries encryption\nsettings or it does not, which keeps its configuration easy to reason about\nand avoids order-dependent mutation after the catalog is created.",
+        "stability": "experimental",
+        "summary": "Encryption configuration for a Glue Data Catalog.",
+        "example": "import * as iam from 'aws-cdk-lib/aws-iam';\ndeclare const key: kms.Key;\ndeclare const role: iam.IRole;\nglue.Catalog.encryptAccount(this, {\n  encryptionAtRest: glue.DataCatalogEncryptionAtRest.kmsWithServiceRole(role, key),\n});",
+        "custom": {
+          "exampleMetadata": "infused"
+        }
+      },
+      "fqn": "@aws-cdk/aws-glue-alpha.CatalogEncryptionOptions",
+      "kind": "interface",
+      "locationInModule": {
+        "filename": "lib/catalog.ts",
+        "line": 134
+      },
+      "name": "CatalogEncryptionOptions",
+      "properties": [
+        {
+          "abstract": true,
+          "docs": {
+            "default": "- connection-password encryption is not managed by CDK",
+            "stability": "experimental",
+            "summary": "Connection-password encryption configuration for the catalog."
+          },
+          "immutable": true,
+          "locationInModule": {
+            "filename": "lib/catalog.ts",
+            "line": 147
+          },
+          "name": "connectionPasswordEncryption",
+          "optional": true,
+          "type": {
+            "fqn": "@aws-cdk/aws-glue-alpha.ConnectionPasswordEncryption"
+          }
+        },
+        {
+          "abstract": true,
+          "docs": {
+            "default": "- encryption at rest is not managed by CDK (the catalog default applies)",
+            "stability": "experimental",
+            "summary": "Encryption-at-rest configuration for the catalog."
+          },
+          "immutable": true,
+          "locationInModule": {
+            "filename": "lib/catalog.ts",
+            "line": 140
+          },
+          "name": "encryptionAtRest",
+          "optional": true,
+          "type": {
+            "fqn": "@aws-cdk/aws-glue-alpha.DataCatalogEncryptionAtRest"
+          }
+        }
+      ],
+      "symbolId": "lib/catalog:CatalogEncryptionOptions"
+    },
+    "@aws-cdk/aws-glue-alpha.CatalogProps": {
+      "assembly": "@aws-cdk/aws-glue-alpha",
+      "datatype": true,
+      "docs": {
+        "stability": "experimental",
+        "summary": "Construction properties for a `Catalog`.",
+        "example": "new glue.Catalog(this, 'MyCatalog', {\n  catalogName: 'my-catalog',\n  description: 'my catalog description',\n});",
+        "custom": {
+          "exampleMetadata": "infused"
+        }
+      },
+      "fqn": "@aws-cdk/aws-glue-alpha.CatalogProps",
+      "interfaces": [
+        "@aws-cdk/aws-glue-alpha.CatalogEncryptionOptions"
+      ],
+      "kind": "interface",
+      "locationInModule": {
+        "filename": "lib/catalog.ts",
+        "line": 268
+      },
+      "name": "CatalogProps",
+      "properties": [
+        {
+          "abstract": true,
+          "docs": {
+            "stability": "experimental",
+            "summary": "The name of the catalog."
+          },
+          "immutable": true,
+          "locationInModule": {
+            "filename": "lib/catalog.ts",
+            "line": 272
+          },
+          "name": "catalogName",
+          "type": {
+            "primitive": "string"
+          }
+        },
+        {
+          "abstract": true,
+          "docs": {
+            "default": "- no description",
+            "stability": "experimental",
+            "summary": "A description of the catalog."
+          },
+          "immutable": true,
+          "locationInModule": {
+            "filename": "lib/catalog.ts",
+            "line": 279
+          },
+          "name": "description",
+          "optional": true,
+          "type": {
+            "primitive": "string"
+          }
+        }
+      ],
+      "symbolId": "lib/catalog:CatalogProps"
+    },
+    "@aws-cdk/aws-glue-alpha.ClassificationString": {
+      "assembly": "@aws-cdk/aws-glue-alpha",
+      "docs": {
+        "see": "https://docs.aws.amazon.com/glue/latest/dg/add-classifier.html#classifier-built-in",
+        "stability": "experimental",
+        "summary": "Classification string given to tables with this data format.",
+        "example": "// The code below shows an example of how to instantiate this type.\n// The values are placeholders you should change.\nimport * as glue_alpha from '@aws-cdk/aws-glue-alpha';\nconst classificationString = glue_alpha.ClassificationString.AVRO;",
+        "custom": {
+          "exampleMetadata": "fixture=_generated"
+        }
+      },
+      "fqn": "@aws-cdk/aws-glue-alpha.ClassificationString",
+      "initializer": {
+        "docs": {
+          "stability": "experimental"
+        },
+        "locationInModule": {
+          "filename": "lib/data-format.ts",
+          "line": 176
+        },
+        "parameters": [
+          {
+            "name": "value",
+            "type": {
+              "primitive": "string"
+            }
+          }
+        ]
+      },
       "kind": "class",
       "locationInModule": {
         "filename": "lib/data-format.ts",
@@ -10128,7 +10974,7 @@
         },
         "locationInModule": {
           "filename": "lib/connection.ts",
-          "line": 358
+          "line": 359
         },
         "parameters": [
           {
@@ -10157,7 +11003,7 @@
       "kind": "class",
       "locationInModule": {
         "filename": "lib/connection.ts",
-        "line": 310
+        "line": 311
       },
       "methods": [
         {
@@ -10167,7 +11013,7 @@
           },
           "locationInModule": {
             "filename": "lib/connection.ts",
-            "line": 322
+            "line": 323
           },
           "name": "fromConnectionArn",
           "parameters": [
@@ -10213,7 +11059,7 @@
           },
           "locationInModule": {
             "filename": "lib/connection.ts",
-            "line": 338
+            "line": 339
           },
           "name": "fromConnectionName",
           "parameters": [
@@ -10259,7 +11105,7 @@
           },
           "locationInModule": {
             "filename": "lib/connection.ts",
-            "line": 407
+            "line": 420
           },
           "name": "addProperty",
           "parameters": [
@@ -10295,7 +11141,7 @@
           "immutable": true,
           "locationInModule": {
             "filename": "lib/connection.ts",
-            "line": 313
+            "line": 314
           },
           "name": "PROPERTY_INJECTION_ID",
           "static": true,
@@ -10311,7 +11157,7 @@
           "immutable": true,
           "locationInModule": {
             "filename": "lib/connection.ts",
-            "line": 397
+            "line": 410
           },
           "name": "connectionArn",
           "overrides": "@aws-cdk/aws-glue-alpha.IConnection",
@@ -10327,7 +11173,7 @@
           "immutable": true,
           "locationInModule": {
             "filename": "lib/connection.ts",
-            "line": 389
+            "line": 402
           },
           "name": "connectionName",
           "overrides": "@aws-cdk/aws-glue-alpha.IConnection",
@@ -10353,7 +11199,7 @@
       "kind": "interface",
       "locationInModule": {
         "filename": "lib/connection.ts",
-        "line": 257
+        "line": 258
       },
       "name": "ConnectionOptions",
       "properties": [
@@ -10367,7 +11213,7 @@
           "immutable": true,
           "locationInModule": {
             "filename": "lib/connection.ts",
-            "line": 262
+            "line": 263
           },
           "name": "connectionName",
           "optional": true,
@@ -10385,7 +11231,7 @@
           "immutable": true,
           "locationInModule": {
             "filename": "lib/connection.ts",
-            "line": 268
+            "line": 269
           },
           "name": "description",
           "optional": true,
@@ -10404,7 +11250,7 @@
           "immutable": true,
           "locationInModule": {
             "filename": "lib/connection.ts",
-            "line": 282
+            "line": 283
           },
           "name": "matchCriteria",
           "optional": true,
@@ -10428,7 +11274,7 @@
           "immutable": true,
           "locationInModule": {
             "filename": "lib/connection.ts",
-            "line": 275
+            "line": 276
           },
           "name": "properties",
           "optional": true,
@@ -10451,7 +11297,7 @@
           "immutable": true,
           "locationInModule": {
             "filename": "lib/connection.ts",
-            "line": 288
+            "line": 289
           },
           "name": "securityGroups",
           "optional": true,
@@ -10475,7 +11321,7 @@
           "immutable": true,
           "locationInModule": {
             "filename": "lib/connection.ts",
-            "line": 294
+            "line": 295
           },
           "name": "subnet",
           "optional": true,
@@ -10486,6 +11332,67 @@
       ],
       "symbolId": "lib/connection:ConnectionOptions"
     },
+    "@aws-cdk/aws-glue-alpha.ConnectionPasswordEncryption": {
+      "assembly": "@aws-cdk/aws-glue-alpha",
+      "datatype": true,
+      "docs": {
+        "remarks": "When enabled, the Data Catalog encrypts the password as part of\n`CreateConnection` or `UpdateConnection` and stores it in the\n`ENCRYPTED_PASSWORD` field of the connection properties. This is independent\nfrom catalog encryption at rest, and may use a different KMS key.",
+        "see": "https://docs.aws.amazon.com/glue/latest/webapi/API_ConnectionPasswordEncryption.html",
+        "stability": "experimental",
+        "summary": "Connection-password encryption configuration for a Glue Data Catalog.",
+        "example": "declare const key: kms.Key;\nglue.Catalog.encryptAccount(this, {\n  connectionPasswordEncryption: {\n    kmsKey: key,\n    // Whether GetConnection/GetConnections return the password encrypted (default: true)\n    returnConnectionPasswordEncrypted: true,\n  },\n});",
+        "custom": {
+          "exampleMetadata": "infused"
+        }
+      },
+      "fqn": "@aws-cdk/aws-glue-alpha.ConnectionPasswordEncryption",
+      "kind": "interface",
+      "locationInModule": {
+        "filename": "lib/catalog.ts",
+        "line": 110
+      },
+      "name": "ConnectionPasswordEncryption",
+      "properties": [
+        {
+          "abstract": true,
+          "docs": {
+            "default": "- an AWS-managed key is used and the key is not exposed as a grantable resource.",
+            "stability": "experimental",
+            "summary": "The KMS key used to encrypt connection passwords."
+          },
+          "immutable": true,
+          "locationInModule": {
+            "filename": "lib/catalog.ts",
+            "line": 116
+          },
+          "name": "kmsKey",
+          "optional": true,
+          "type": {
+            "fqn": "aws-cdk-lib.interfaces.aws_kms.IKeyRef"
+          }
+        },
+        {
+          "abstract": true,
+          "docs": {
+            "default": "true",
+            "remarks": "This takes effect independently from catalog encryption.",
+            "stability": "experimental",
+            "summary": "Whether passwords remain encrypted in the responses of `GetConnection` and `GetConnections`."
+          },
+          "immutable": true,
+          "locationInModule": {
+            "filename": "lib/catalog.ts",
+            "line": 124
+          },
+          "name": "returnConnectionPasswordEncrypted",
+          "optional": true,
+          "type": {
+            "primitive": "boolean"
+          }
+        }
+      ],
+      "symbolId": "lib/catalog:ConnectionPasswordEncryption"
+    },
     "@aws-cdk/aws-glue-alpha.ConnectionProps": {
       "assembly": "@aws-cdk/aws-glue-alpha",
       "datatype": true,
@@ -10504,7 +11411,7 @@
       "kind": "interface",
       "locationInModule": {
         "filename": "lib/connection.ts",
-        "line": 300
+        "line": 301
       },
       "name": "ConnectionProps",
       "properties": [
@@ -10517,7 +11424,7 @@
           "immutable": true,
           "locationInModule": {
             "filename": "lib/connection.ts",
-            "line": 304
+            "line": 305
           },
           "name": "type",
           "type": {
@@ -10546,7 +11453,7 @@
         },
         "locationInModule": {
           "filename": "lib/connection.ts",
-          "line": 225
+          "line": 226
         },
         "parameters": [
           {
@@ -10560,7 +11467,7 @@
       "kind": "class",
       "locationInModule": {
         "filename": "lib/connection.ts",
-        "line": 17
+        "line": 18
       },
       "methods": [
         {
@@ -10570,7 +11477,7 @@
           },
           "locationInModule": {
             "filename": "lib/connection.ts",
-            "line": 232
+            "line": 233
           },
           "name": "toString",
           "returns": {
@@ -10591,7 +11498,7 @@
           "immutable": true,
           "locationInModule": {
             "filename": "lib/connection.ts",
-            "line": 173
+            "line": 174
           },
           "name": "AZURECOSMOS",
           "static": true,
@@ -10608,7 +11515,7 @@
           "immutable": true,
           "locationInModule": {
             "filename": "lib/connection.ts",
-            "line": 168
+            "line": 169
           },
           "name": "AZURESQL",
           "static": true,
@@ -10625,7 +11532,7 @@
           "immutable": true,
           "locationInModule": {
             "filename": "lib/connection.ts",
-            "line": 163
+            "line": 164
           },
           "name": "BIGQUERY",
           "static": true,
@@ -10642,7 +11549,7 @@
           "immutable": true,
           "locationInModule": {
             "filename": "lib/connection.ts",
-            "line": 58
+            "line": 59
           },
           "name": "CUSTOM",
           "static": true,
@@ -10659,7 +11566,7 @@
           "immutable": true,
           "locationInModule": {
             "filename": "lib/connection.ts",
-            "line": 218
+            "line": 219
           },
           "name": "DYNAMODB",
           "static": true,
@@ -10676,7 +11583,7 @@
           "immutable": true,
           "locationInModule": {
             "filename": "lib/connection.ts",
-            "line": 63
+            "line": 64
           },
           "name": "FACEBOOKADS",
           "static": true,
@@ -10693,7 +11600,7 @@
           "immutable": true,
           "locationInModule": {
             "filename": "lib/connection.ts",
-            "line": 68
+            "line": 69
           },
           "name": "GOOGLEADS",
           "static": true,
@@ -10710,7 +11617,7 @@
           "immutable": true,
           "locationInModule": {
             "filename": "lib/connection.ts",
-            "line": 78
+            "line": 79
           },
           "name": "GOOGLEANALYTICS4",
           "static": true,
@@ -10727,7 +11634,7 @@
           "immutable": true,
           "locationInModule": {
             "filename": "lib/connection.ts",
-            "line": 73
+            "line": 74
           },
           "name": "GOOGLESHEETS",
           "static": true,
@@ -10744,7 +11651,7 @@
           "immutable": true,
           "locationInModule": {
             "filename": "lib/connection.ts",
-            "line": 83
+            "line": 84
           },
           "name": "HUBSPOT",
           "static": true,
@@ -10761,7 +11668,7 @@
           "immutable": true,
           "locationInModule": {
             "filename": "lib/connection.ts",
-            "line": 88
+            "line": 89
           },
           "name": "INSTAGRAMADS",
           "static": true,
@@ -10778,7 +11685,7 @@
           "immutable": true,
           "locationInModule": {
             "filename": "lib/connection.ts",
-            "line": 93
+            "line": 94
           },
           "name": "INTERCOM",
           "static": true,
@@ -10795,7 +11702,7 @@
           "immutable": true,
           "locationInModule": {
             "filename": "lib/connection.ts",
-            "line": 21
+            "line": 22
           },
           "name": "JDBC",
           "static": true,
@@ -10812,7 +11719,7 @@
           "immutable": true,
           "locationInModule": {
             "filename": "lib/connection.ts",
-            "line": 98
+            "line": 99
           },
           "name": "JIRACLOUD",
           "static": true,
@@ -10829,7 +11736,7 @@
           "immutable": true,
           "locationInModule": {
             "filename": "lib/connection.ts",
-            "line": 26
+            "line": 27
           },
           "name": "KAFKA",
           "static": true,
@@ -10846,7 +11753,7 @@
           "immutable": true,
           "locationInModule": {
             "filename": "lib/connection.ts",
-            "line": 103
+            "line": 104
           },
           "name": "MARKETO",
           "static": true,
@@ -10863,7 +11770,7 @@
           "immutable": true,
           "locationInModule": {
             "filename": "lib/connection.ts",
-            "line": 52
+            "line": 53
           },
           "name": "MARKETPLACE",
           "static": true,
@@ -10880,7 +11787,7 @@
           "immutable": true,
           "locationInModule": {
             "filename": "lib/connection.ts",
-            "line": 31
+            "line": 32
           },
           "name": "MONGODB",
           "static": true,
@@ -10897,7 +11804,7 @@
           "immutable": true,
           "locationInModule": {
             "filename": "lib/connection.ts",
-            "line": 183
+            "line": 184
           },
           "name": "MYSQL",
           "static": true,
@@ -10914,7 +11821,7 @@
           "immutable": true,
           "locationInModule": {
             "filename": "lib/connection.ts",
-            "line": 108
+            "line": 109
           },
           "name": "NETSUITEERP",
           "static": true,
@@ -10931,7 +11838,7 @@
           "immutable": true,
           "locationInModule": {
             "filename": "lib/connection.ts",
-            "line": 46
+            "line": 47
           },
           "name": "NETWORK",
           "static": true,
@@ -10948,7 +11855,7 @@
           "immutable": true,
           "locationInModule": {
             "filename": "lib/connection.ts",
-            "line": 178
+            "line": 179
           },
           "name": "OPENSEARCH",
           "static": true,
@@ -10965,7 +11872,7 @@
           "immutable": true,
           "locationInModule": {
             "filename": "lib/connection.ts",
-            "line": 193
+            "line": 194
           },
           "name": "ORACLE",
           "static": true,
@@ -10982,7 +11889,7 @@
           "immutable": true,
           "locationInModule": {
             "filename": "lib/connection.ts",
-            "line": 188
+            "line": 189
           },
           "name": "POSTGRESQL",
           "static": true,
@@ -10999,7 +11906,7 @@
           "immutable": true,
           "locationInModule": {
             "filename": "lib/connection.ts",
-            "line": 113
+            "line": 114
           },
           "name": "SALESFORCE",
           "static": true,
@@ -11016,7 +11923,7 @@
           "immutable": true,
           "locationInModule": {
             "filename": "lib/connection.ts",
-            "line": 118
+            "line": 119
           },
           "name": "SALESFORCEMARKETINGCLOUD",
           "static": true,
@@ -11033,7 +11940,7 @@
           "immutable": true,
           "locationInModule": {
             "filename": "lib/connection.ts",
-            "line": 123
+            "line": 124
           },
           "name": "SALESFORCEPARDOT",
           "static": true,
@@ -11050,7 +11957,7 @@
           "immutable": true,
           "locationInModule": {
             "filename": "lib/connection.ts",
-            "line": 203
+            "line": 204
           },
           "name": "SAPHANA",
           "static": true,
@@ -11067,7 +11974,7 @@
           "immutable": true,
           "locationInModule": {
             "filename": "lib/connection.ts",
-            "line": 128
+            "line": 129
           },
           "name": "SAPODATA",
           "static": true,
@@ -11084,7 +11991,7 @@
           "immutable": true,
           "locationInModule": {
             "filename": "lib/connection.ts",
-            "line": 133
+            "line": 134
           },
           "name": "SERVICENOW",
           "static": true,
@@ -11101,7 +12008,7 @@
           "immutable": true,
           "locationInModule": {
             "filename": "lib/connection.ts",
-            "line": 138
+            "line": 139
           },
           "name": "SLACK",
           "static": true,
@@ -11118,7 +12025,7 @@
           "immutable": true,
           "locationInModule": {
             "filename": "lib/connection.ts",
-            "line": 143
+            "line": 144
           },
           "name": "SNAPCHATADS",
           "static": true,
@@ -11135,7 +12042,7 @@
           "immutable": true,
           "locationInModule": {
             "filename": "lib/connection.ts",
-            "line": 198
+            "line": 199
           },
           "name": "SQLSERVER",
           "static": true,
@@ -11152,7 +12059,7 @@
           "immutable": true,
           "locationInModule": {
             "filename": "lib/connection.ts",
-            "line": 148
+            "line": 149
           },
           "name": "STRIPE",
           "static": true,
@@ -11169,7 +12076,7 @@
           "immutable": true,
           "locationInModule": {
             "filename": "lib/connection.ts",
-            "line": 208
+            "line": 209
           },
           "name": "TERADATA",
           "static": true,
@@ -11186,7 +12093,7 @@
           "immutable": true,
           "locationInModule": {
             "filename": "lib/connection.ts",
-            "line": 213
+            "line": 214
           },
           "name": "VERTICA",
           "static": true,
@@ -11203,7 +12110,7 @@
           "immutable": true,
           "locationInModule": {
             "filename": "lib/connection.ts",
-            "line": 41
+            "line": 42
           },
           "name": "VIEW_VALIDATION_ATHENA",
           "static": true,
@@ -11220,7 +12127,7 @@
           "immutable": true,
           "locationInModule": {
             "filename": "lib/connection.ts",
-            "line": 36
+            "line": 37
           },
           "name": "VIEW_VALIDATION_REDSHIFT",
           "static": true,
@@ -11237,7 +12144,7 @@
           "immutable": true,
           "locationInModule": {
             "filename": "lib/connection.ts",
-            "line": 153
+            "line": 154
           },
           "name": "ZENDESK",
           "static": true,
@@ -11254,7 +12161,7 @@
           "immutable": true,
           "locationInModule": {
             "filename": "lib/connection.ts",
-            "line": 158
+            "line": 159
           },
           "name": "ZOHOCRM",
           "static": true,
@@ -11270,7 +12177,7 @@
           "immutable": true,
           "locationInModule": {
             "filename": "lib/connection.ts",
-            "line": 223
+            "line": 224
           },
           "name": "name",
           "type": {
@@ -11296,7 +12203,7 @@
       "kind": "interface",
       "locationInModule": {
         "filename": "lib/jobs/job.ts",
-        "line": 91
+        "line": 92
       },
       "name": "ContinuousLoggingProps",
       "properties": [
@@ -11309,7 +12216,7 @@
           "immutable": true,
           "locationInModule": {
             "filename": "lib/jobs/job.ts",
-            "line": 95
+            "line": 96
           },
           "name": "enabled",
           "type": {
@@ -11327,7 +12234,7 @@
           "immutable": true,
           "locationInModule": {
             "filename": "lib/jobs/job.ts",
-            "line": 125
+            "line": 126
           },
           "name": "conversionPattern",
           "optional": true,
@@ -11345,7 +12252,7 @@
           "immutable": true,
           "locationInModule": {
             "filename": "lib/jobs/job.ts",
-            "line": 102
+            "line": 103
           },
           "name": "logGroup",
           "optional": true,
@@ -11363,7 +12270,7 @@
           "immutable": true,
           "locationInModule": {
             "filename": "lib/jobs/job.ts",
-            "line": 109
+            "line": 110
           },
           "name": "logStreamPrefix",
           "optional": true,
@@ -11381,7 +12288,7 @@
           "immutable": true,
           "locationInModule": {
             "filename": "lib/jobs/job.ts",
-            "line": 116
+            "line": 117
           },
           "name": "quiet",
           "optional": true,
@@ -11535,6 +12442,165 @@
       ],
       "symbolId": "lib/triggers/trigger-options:DailyScheduleTriggerOptions"
     },
+    "@aws-cdk/aws-glue-alpha.DataCatalogEncryptionAtRest": {
+      "assembly": "@aws-cdk/aws-glue-alpha",
+      "docs": {
+        "remarks": "The Data Catalog encryption at rest and the connection password encryption\nare independent: enabling one does not require the other, and each may use a\ndifferent KMS key.",
+        "see": "https://docs.aws.amazon.com/glue/latest/webapi/API_EncryptionAtRest.html",
+        "stability": "experimental",
+        "summary": "Encryption-at-rest configuration for a Glue Data Catalog.",
+        "example": "import * as iam from 'aws-cdk-lib/aws-iam';\ndeclare const key: kms.Key;\ndeclare const role: iam.IRole;\nglue.Catalog.encryptAccount(this, {\n  encryptionAtRest: glue.DataCatalogEncryptionAtRest.kmsWithServiceRole(role, key),\n});",
+        "custom": {
+          "exampleMetadata": "infused"
+        }
+      },
+      "fqn": "@aws-cdk/aws-glue-alpha.DataCatalogEncryptionAtRest",
+      "kind": "class",
+      "locationInModule": {
+        "filename": "lib/catalog.ts",
+        "line": 45
+      },
+      "methods": [
+        {
+          "docs": {
+            "stability": "experimental",
+            "summary": "Disable encryption at rest for the Data Catalog."
+          },
+          "locationInModule": {
+            "filename": "lib/catalog.ts",
+            "line": 49
+          },
+          "name": "disabled",
+          "returns": {
+            "type": {
+              "fqn": "@aws-cdk/aws-glue-alpha.DataCatalogEncryptionAtRest"
+            }
+          },
+          "static": true
+        },
+        {
+          "docs": {
+            "stability": "experimental",
+            "summary": "Encrypt the Data Catalog at rest with an AWS KMS key."
+          },
+          "locationInModule": {
+            "filename": "lib/catalog.ts",
+            "line": 59
+          },
+          "name": "kms",
+          "parameters": [
+            {
+              "docs": {
+                "remarks": "If omitted, an AWS-managed key is used and\nthe key is not exposed as a grantable resource.",
+                "summary": "the KMS key to use."
+              },
+              "name": "key",
+              "optional": true,
+              "type": {
+                "fqn": "aws-cdk-lib.aws_kms.IKey"
+              }
+            }
+          ],
+          "returns": {
+            "type": {
+              "fqn": "@aws-cdk/aws-glue-alpha.DataCatalogEncryptionAtRest"
+            }
+          },
+          "static": true
+        },
+        {
+          "docs": {
+            "remarks": "When a customer-managed `key` is provided, the `role` is automatically\ngranted `kms:Encrypt`/`kms:Decrypt`/`kms:GenerateDataKey*` on it.",
+            "stability": "experimental",
+            "summary": "Encrypt the Data Catalog at rest with an AWS KMS key, accessed through a service role that AWS Glue assumes on your behalf."
+          },
+          "locationInModule": {
+            "filename": "lib/catalog.ts",
+            "line": 74
+          },
+          "name": "kmsWithServiceRole",
+          "parameters": [
+            {
+              "docs": {
+                "summary": "the service role that AWS Glue assumes to access the key."
+              },
+              "name": "role",
+              "type": {
+                "fqn": "aws-cdk-lib.aws_iam.IRole"
+              }
+            },
+            {
+              "docs": {
+                "remarks": "If omitted, an AWS-managed key is used and\nthe key is not exposed as a grantable resource.",
+                "summary": "the KMS key to use."
+              },
+              "name": "key",
+              "optional": true,
+              "type": {
+                "fqn": "aws-cdk-lib.aws_kms.IKey"
+              }
+            }
+          ],
+          "returns": {
+            "type": {
+              "fqn": "@aws-cdk/aws-glue-alpha.DataCatalogEncryptionAtRest"
+            }
+          },
+          "static": true
+        }
+      ],
+      "name": "DataCatalogEncryptionAtRest",
+      "properties": [
+        {
+          "docs": {
+            "stability": "experimental",
+            "summary": "The encryption mode."
+          },
+          "immutable": true,
+          "locationInModule": {
+            "filename": "lib/catalog.ts",
+            "line": 81
+          },
+          "name": "mode",
+          "type": {
+            "fqn": "@aws-cdk/aws-glue-alpha.CatalogEncryptionMode"
+          }
+        },
+        {
+          "docs": {
+            "stability": "experimental",
+            "summary": "The customer-managed KMS key used for encryption at rest, if any."
+          },
+          "immutable": true,
+          "locationInModule": {
+            "filename": "lib/catalog.ts",
+            "line": 86
+          },
+          "name": "kmsKey",
+          "optional": true,
+          "type": {
+            "fqn": "aws-cdk-lib.interfaces.aws_kms.IKeyRef"
+          }
+        },
+        {
+          "docs": {
+            "stability": "experimental",
+            "summary": "The service role that AWS Glue assumes to access the KMS key, if any."
+          },
+          "immutable": true,
+          "locationInModule": {
+            "filename": "lib/catalog.ts",
+            "line": 91
+          },
+          "name": "serviceRole",
+          "optional": true,
+          "type": {
+            "fqn": "aws-cdk-lib.aws_iam.IRole"
+          }
+        }
+      ],
+      "symbolId": "lib/catalog:DataCatalogEncryptionAtRest"
+    },
     "@aws-cdk/aws-glue-alpha.DataFormat": {
       "assembly": "@aws-cdk/aws-glue-alpha",
       "docs": {
@@ -11892,7 +12958,7 @@
       "docs": {
         "stability": "experimental",
         "summary": "A Glue Data Quality ruleset.",
-        "example": "// The code below shows an example of how to instantiate this type.\n// The values are placeholders you should change.\nimport * as glue_alpha from '@aws-cdk/aws-glue-alpha';\n\ndeclare const dataQualityTargetTable: glue_alpha.DataQualityTargetTable;\nconst dataQualityRuleset = new glue_alpha.DataQualityRuleset(this, 'MyDataQualityRuleset', {\n  rulesetDqdl: 'rulesetDqdl',\n  targetTable: dataQualityTargetTable,\n\n  // the properties below are optional\n  clientToken: 'clientToken',\n  description: 'description',\n  rulesetName: 'rulesetName',\n  tags: {\n    tagsKey: 'tags',\n  },\n});",
+        "example": "// The code below shows an example of how to instantiate this type.\n// The values are placeholders you should change.\nimport * as glue_alpha from '@aws-cdk/aws-glue-alpha';\nimport * as cdk from 'aws-cdk-lib';\n\ndeclare const dataQualityTargetTable: glue_alpha.DataQualityTargetTable;\nconst dataQualityRuleset = new glue_alpha.DataQualityRuleset(this, 'MyDataQualityRuleset', {\n  rulesetDqdl: 'rulesetDqdl',\n  targetTable: dataQualityTargetTable,\n\n  // the properties below are optional\n  clientToken: 'clientToken',\n  description: 'description',\n  removalPolicy: cdk.RemovalPolicy.DESTROY,\n  rulesetName: 'rulesetName',\n  tags: {\n    tagsKey: 'tags',\n  },\n});",
         "custom": {
           "exampleMetadata": "fixture=_generated"
         }
@@ -11904,7 +12970,7 @@
         },
         "locationInModule": {
           "filename": "lib/data-quality-ruleset.ts",
-          "line": 121
+          "line": 128
         },
         "parameters": [
           {
@@ -11933,7 +12999,7 @@
       "kind": "class",
       "locationInModule": {
         "filename": "lib/data-quality-ruleset.ts",
-        "line": 88
+        "line": 95
       },
       "methods": [
         {
@@ -11942,7 +13008,7 @@
           },
           "locationInModule": {
             "filename": "lib/data-quality-ruleset.ts",
-            "line": 93
+            "line": 100
           },
           "name": "fromRulesetArn",
           "parameters": [
@@ -11978,7 +13044,7 @@
           },
           "locationInModule": {
             "filename": "lib/data-quality-ruleset.ts",
-            "line": 102
+            "line": 109
           },
           "name": "fromRulesetName",
           "parameters": [
@@ -12020,7 +13086,7 @@
           "immutable": true,
           "locationInModule": {
             "filename": "lib/data-quality-ruleset.ts",
-            "line": 91
+            "line": 98
           },
           "name": "PROPERTY_INJECTION_ID",
           "static": true,
@@ -12036,7 +13102,7 @@
           "immutable": true,
           "locationInModule": {
             "filename": "lib/data-quality-ruleset.ts",
-            "line": 149
+            "line": 158
           },
           "name": "rulesetArn",
           "overrides": "@aws-cdk/aws-glue-alpha.IDataQualityRuleset",
@@ -12052,7 +13118,7 @@
           "immutable": true,
           "locationInModule": {
             "filename": "lib/data-quality-ruleset.ts",
-            "line": 141
+            "line": 150
           },
           "name": "rulesetName",
           "overrides": "@aws-cdk/aws-glue-alpha.IDataQualityRuleset",
@@ -12069,7 +13135,7 @@
       "docs": {
         "stability": "experimental",
         "summary": "Construction properties for `DataQualityRuleset`.",
-        "example": "// The code below shows an example of how to instantiate this type.\n// The values are placeholders you should change.\nimport * as glue_alpha from '@aws-cdk/aws-glue-alpha';\n\ndeclare const dataQualityTargetTable: glue_alpha.DataQualityTargetTable;\nconst dataQualityRulesetProps: glue_alpha.DataQualityRulesetProps = {\n  rulesetDqdl: 'rulesetDqdl',\n  targetTable: dataQualityTargetTable,\n\n  // the properties below are optional\n  clientToken: 'clientToken',\n  description: 'description',\n  rulesetName: 'rulesetName',\n  tags: {\n    tagsKey: 'tags',\n  },\n};",
+        "example": "// The code below shows an example of how to instantiate this type.\n// The values are placeholders you should change.\nimport * as glue_alpha from '@aws-cdk/aws-glue-alpha';\nimport * as cdk from 'aws-cdk-lib';\n\ndeclare const dataQualityTargetTable: glue_alpha.DataQualityTargetTable;\nconst dataQualityRulesetProps: glue_alpha.DataQualityRulesetProps = {\n  rulesetDqdl: 'rulesetDqdl',\n  targetTable: dataQualityTargetTable,\n\n  // the properties below are optional\n  clientToken: 'clientToken',\n  description: 'description',\n  removalPolicy: cdk.RemovalPolicy.DESTROY,\n  rulesetName: 'rulesetName',\n  tags: {\n    tagsKey: 'tags',\n  },\n};",
         "custom": {
           "exampleMetadata": "fixture=_generated"
         }
@@ -12160,6 +13226,24 @@
             "primitive": "string"
           }
         },
+        {
+          "abstract": true,
+          "docs": {
+            "default": "- resource will be destroyed",
+            "stability": "experimental",
+            "summary": "Policy to apply when the ruleset is removed from the stack."
+          },
+          "immutable": true,
+          "locationInModule": {
+            "filename": "lib/data-quality-ruleset.ts",
+            "line": 89
+          },
+          "name": "removalPolicy",
+          "optional": true,
+          "type": {
+            "fqn": "aws-cdk-lib.RemovalPolicy"
+          }
+        },
         {
           "abstract": true,
           "docs": {
@@ -12284,7 +13368,7 @@
       "docs": {
         "stability": "experimental",
         "summary": "A Glue database.",
-        "example": "import * as cdk from 'aws-cdk-lib';\nimport { S3Table, Database, DataFormat, Schema } from '@aws-cdk/aws-glue-alpha';\nimport { CfnDataLakeSettings, CfnTag, CfnTagAssociation } from 'aws-cdk-lib/aws-lakeformation';\n\ndeclare const stack: cdk.Stack;\ndeclare const accountId: string;\n\nconst tagKey = 'aws';\nconst tagValues = ['dev'];\n\nconst database = new Database(this, 'Database');\n\nconst table = new S3Table(this, 'Table', {\n  database,\n  columns: [\n    {\n      name: 'col1',\n      type: Schema.STRING,\n    },\n    {\n      name: 'col2',\n      type: Schema.STRING,\n    }\n  ],\n  dataFormat: DataFormat.CSV,\n});\n\nconst synthesizer = stack.synthesizer as cdk.DefaultStackSynthesizer;\nnew CfnDataLakeSettings(this, 'DataLakeSettings', {\n  admins: [\n    {\n      dataLakePrincipalIdentifier: stack.formatArn({\n        service: 'iam',\n        resource: 'role',\n        region: '',\n        account: accountId,\n        resourceName: 'Admin',\n      }),\n    },\n    {\n      // The CDK cloudformation execution role.\n      dataLakePrincipalIdentifier: synthesizer.cloudFormationExecutionRoleArn.replace('${AWS::Partition}', 'aws'),\n    },\n  ],\n});\n\nconst tag = new CfnTag(this, 'Tag', {\n  catalogId: accountId,\n  tagKey,\n  tagValues,\n});\n\nconst lfTagPairProperty: CfnTagAssociation.LFTagPairProperty = {\n  catalogId: accountId,\n  tagKey,\n  tagValues,\n};\n\nconst tagAssociation = new CfnTagAssociation(this, 'TagAssociation', {\n  lfTags: [lfTagPairProperty],\n  resource: {\n    tableWithColumns: {\n      databaseName: database.databaseName,\n      columnNames: ['col1', 'col2'],\n      catalogId: accountId,\n      name: table.tableName,\n    }\n  }\n});\n\ntagAssociation.node.addDependency(tag);\ntagAssociation.node.addDependency(table);",
+        "example": "import { RemovalPolicy } from 'aws-cdk-lib';\n\nnew glue.Database(this, 'MyDatabase', {\n  databaseName: 'my_database',\n  removalPolicy: RemovalPolicy.DESTROY,\n});",
         "custom": {
           "exampleMetadata": "infused"
         }
@@ -12296,7 +13380,7 @@
         },
         "locationInModule": {
           "filename": "lib/database.ts",
-          "line": 97
+          "line": 109
         },
         "parameters": [
           {
@@ -12326,7 +13410,7 @@
       "kind": "class",
       "locationInModule": {
         "filename": "lib/database.ts",
-        "line": 62
+        "line": 77
       },
       "methods": [
         {
@@ -12335,7 +13419,7 @@
           },
           "locationInModule": {
             "filename": "lib/database.ts",
-            "line": 67
+            "line": 82
           },
           "name": "fromDatabaseArn",
           "parameters": [
@@ -12377,7 +13461,7 @@
           "immutable": true,
           "locationInModule": {
             "filename": "lib/database.ts",
-            "line": 65
+            "line": 80
           },
           "name": "PROPERTY_INJECTION_ID",
           "static": true,
@@ -12387,34 +13471,19 @@
         },
         {
           "docs": {
+            "remarks": "Defaults to the implicit, account-wide catalog, materialized on first\naccess.",
             "stability": "experimental",
-            "summary": "ARN of the Glue catalog in which this database is stored."
-          },
-          "immutable": true,
-          "locationInModule": {
-            "filename": "lib/database.ts",
-            "line": 83
-          },
-          "name": "catalogArn",
-          "overrides": "@aws-cdk/aws-glue-alpha.IDatabase",
-          "type": {
-            "primitive": "string"
-          }
-        },
-        {
-          "docs": {
-            "stability": "experimental",
-            "summary": "The catalog id of the database (usually, the AWS account id)."
+            "summary": "The catalog this database belongs to."
           },
           "immutable": true,
           "locationInModule": {
             "filename": "lib/database.ts",
-            "line": 88
+            "line": 159
           },
-          "name": "catalogId",
+          "name": "catalog",
           "overrides": "@aws-cdk/aws-glue-alpha.IDatabase",
           "type": {
-            "primitive": "string"
+            "fqn": "@aws-cdk/aws-glue-alpha.ICatalog"
           }
         },
         {
@@ -12425,7 +13494,7 @@
           "immutable": true,
           "locationInModule": {
             "filename": "lib/database.ts",
-            "line": 143
+            "line": 169
           },
           "name": "databaseArn",
           "overrides": "@aws-cdk/aws-glue-alpha.IDatabase",
@@ -12441,7 +13510,7 @@
           "immutable": true,
           "locationInModule": {
             "filename": "lib/database.ts",
-            "line": 138
+            "line": 164
           },
           "name": "databaseName",
           "overrides": "@aws-cdk/aws-glue-alpha.IDatabase",
@@ -12456,7 +13525,7 @@
           },
           "locationInModule": {
             "filename": "lib/database.ts",
-            "line": 93
+            "line": 103
           },
           "name": "locationUri",
           "optional": true,
@@ -12481,10 +13550,28 @@
       "kind": "interface",
       "locationInModule": {
         "filename": "lib/database.ts",
-        "line": 35
+        "line": 33
       },
       "name": "DatabaseProps",
       "properties": [
+        {
+          "abstract": true,
+          "docs": {
+            "default": "The default, account-wide catalog.",
+            "stability": "experimental",
+            "summary": "The catalog in which the database will be placed."
+          },
+          "immutable": true,
+          "locationInModule": {
+            "filename": "lib/database.ts",
+            "line": 61
+          },
+          "name": "catalog",
+          "optional": true,
+          "type": {
+            "fqn": "@aws-cdk/aws-glue-alpha.ICatalog"
+          }
+        },
         {
           "abstract": true,
           "docs": {
@@ -12495,7 +13582,7 @@
           "immutable": true,
           "locationInModule": {
             "filename": "lib/database.ts",
-            "line": 41
+            "line": 39
           },
           "name": "databaseName",
           "optional": true,
@@ -12513,7 +13600,7 @@
           "immutable": true,
           "locationInModule": {
             "filename": "lib/database.ts",
-            "line": 56
+            "line": 54
           },
           "name": "description",
           "optional": true,
@@ -12532,13 +13619,32 @@
           "immutable": true,
           "locationInModule": {
             "filename": "lib/database.ts",
-            "line": 49
+            "line": 47
           },
           "name": "locationUri",
           "optional": true,
           "type": {
             "primitive": "string"
           }
+        },
+        {
+          "abstract": true,
+          "docs": {
+            "default": "RemovalPolicy.RETAIN",
+            "remarks": "A database is a container for tables and their metadata, so it is retained\nby default to avoid accidental data loss when it is removed from a stack.",
+            "stability": "experimental",
+            "summary": "Policy to apply when the database is removed from the stack."
+          },
+          "immutable": true,
+          "locationInModule": {
+            "filename": "lib/database.ts",
+            "line": 71
+          },
+          "name": "removalPolicy",
+          "optional": true,
+          "type": {
+            "fqn": "aws-cdk-lib.RemovalPolicy"
+          }
         }
       ],
       "symbolId": "lib/database:DatabaseProps"
@@ -13193,41 +14299,136 @@
         {
           "docs": {
             "stability": "experimental",
-            "summary": "Glue version using Spark 2.4.3 and Python 3.7."
+            "summary": "Glue version using Spark 2.4.3 and Python 3.7."
+          },
+          "name": "V2_0"
+        },
+        {
+          "docs": {
+            "stability": "experimental",
+            "summary": "Glue version using Spark 3.1.1 and Python 3.7."
+          },
+          "name": "V3_0"
+        },
+        {
+          "docs": {
+            "stability": "experimental",
+            "summary": "Glue version using Spark 3.3.0 and Python 3.10."
+          },
+          "name": "V4_0"
+        },
+        {
+          "docs": {
+            "stability": "experimental",
+            "summary": "Glue version using Spark 3.5.4, Python 3.11, and Scala 2.12.18."
+          },
+          "name": "V5_0"
+        },
+        {
+          "docs": {
+            "stability": "experimental",
+            "summary": "Glue version using Spark 3.5.6, Python 3.11, and Scala 2.12.18."
           },
-          "name": "V2_0"
-        },
+          "name": "V5_1"
+        }
+      ],
+      "name": "GlueVersion",
+      "symbolId": "lib/constants:GlueVersion"
+    },
+    "@aws-cdk/aws-glue-alpha.ICatalog": {
+      "assembly": "@aws-cdk/aws-glue-alpha",
+      "docs": {
+        "stability": "experimental",
+        "summary": "A Glue Data Catalog, either the implicit account-wide catalog or one created as an `AWS::Glue::Catalog` resource."
+      },
+      "fqn": "@aws-cdk/aws-glue-alpha.ICatalog",
+      "interfaces": [
+        "aws-cdk-lib.IResource",
+        "aws-cdk-lib.interfaces.aws_glue.ICatalogRef"
+      ],
+      "kind": "interface",
+      "locationInModule": {
+        "filename": "lib/catalog.ts",
+        "line": 154
+      },
+      "name": "ICatalog",
+      "properties": [
         {
+          "abstract": true,
           "docs": {
+            "custom": {
+              "attribute": "true"
+            },
             "stability": "experimental",
-            "summary": "Glue version using Spark 3.1.1 and Python 3.7."
+            "summary": "The ARN of the catalog."
           },
-          "name": "V3_0"
+          "immutable": true,
+          "locationInModule": {
+            "filename": "lib/catalog.ts",
+            "line": 165
+          },
+          "name": "catalogArn",
+          "type": {
+            "primitive": "string"
+          }
         },
         {
+          "abstract": true,
           "docs": {
+            "custom": {
+              "attribute": "true"
+            },
             "stability": "experimental",
-            "summary": "Glue version using Spark 3.3.0 and Python 3.10."
+            "summary": "The id of the catalog (for the account-wide catalog, the AWS account id)."
           },
-          "name": "V4_0"
+          "immutable": true,
+          "locationInModule": {
+            "filename": "lib/catalog.ts",
+            "line": 159
+          },
+          "name": "catalogId",
+          "type": {
+            "primitive": "string"
+          }
         },
         {
+          "abstract": true,
           "docs": {
+            "remarks": "Undefined when password encryption uses an AWS-managed key or is not\nconfigured. Grant access to it via `KeyGrants`, e.g.\n`if (catalog.connectionPasswordKey) { KeyGrants.fromKey(catalog.connectionPasswordKey).encrypt(grantee); }`.",
             "stability": "experimental",
-            "summary": "Glue version using Spark 3.5.4, Python 3.11, and Scala 2.12.18."
+            "summary": "The customer-managed KMS key used to encrypt connection passwords, if one was configured."
           },
-          "name": "V5_0"
+          "immutable": true,
+          "locationInModule": {
+            "filename": "lib/catalog.ts",
+            "line": 185
+          },
+          "name": "connectionPasswordKey",
+          "optional": true,
+          "type": {
+            "fqn": "aws-cdk-lib.interfaces.aws_kms.IKeyRef"
+          }
         },
         {
+          "abstract": true,
           "docs": {
+            "remarks": "Undefined when encryption is disabled or an AWS-managed key is used. Grant\naccess to it via `KeyGrants`, e.g.\n`if (catalog.encryptionKey) { KeyGrants.fromKey(catalog.encryptionKey).encrypt(grantee); }`.",
             "stability": "experimental",
-            "summary": "Glue version using Spark 3.5.6, Python 3.11, and Scala 2.12.18."
+            "summary": "The customer-managed KMS key used for the catalog's encryption at rest, if one was configured."
           },
-          "name": "V5_1"
+          "immutable": true,
+          "locationInModule": {
+            "filename": "lib/catalog.ts",
+            "line": 175
+          },
+          "name": "encryptionKey",
+          "optional": true,
+          "type": {
+            "fqn": "aws-cdk-lib.interfaces.aws_kms.IKeyRef"
+          }
         }
       ],
-      "name": "GlueVersion",
-      "symbolId": "lib/constants:GlueVersion"
+      "symbolId": "lib/catalog:ICatalog"
     },
     "@aws-cdk/aws-glue-alpha.IConnection": {
       "assembly": "@aws-cdk/aws-glue-alpha",
@@ -13242,7 +14443,7 @@
       "kind": "interface",
       "locationInModule": {
         "filename": "lib/connection.ts",
-        "line": 240
+        "line": 241
       },
       "name": "IConnection",
       "properties": [
@@ -13258,7 +14459,7 @@
           "immutable": true,
           "locationInModule": {
             "filename": "lib/connection.ts",
-            "line": 251
+            "line": 252
           },
           "name": "connectionArn",
           "type": {
@@ -13277,7 +14478,7 @@
           "immutable": true,
           "locationInModule": {
             "filename": "lib/connection.ts",
-            "line": 245
+            "line": 246
           },
           "name": "connectionName",
           "type": {
@@ -13356,7 +14557,7 @@
       "kind": "interface",
       "locationInModule": {
         "filename": "lib/database.ts",
-        "line": 9
+        "line": 11
       },
       "name": "IDatabase",
       "properties": [
@@ -13364,32 +14565,16 @@
           "abstract": true,
           "docs": {
             "stability": "experimental",
-            "summary": "The ARN of the catalog."
-          },
-          "immutable": true,
-          "locationInModule": {
-            "filename": "lib/database.ts",
-            "line": 13
-          },
-          "name": "catalogArn",
-          "type": {
-            "primitive": "string"
-          }
-        },
-        {
-          "abstract": true,
-          "docs": {
-            "stability": "experimental",
-            "summary": "The catalog id of the database (usually, the AWS account id)."
+            "summary": "The catalog this database belongs to."
           },
           "immutable": true,
           "locationInModule": {
             "filename": "lib/database.ts",
-            "line": 18
+            "line": 16
           },
-          "name": "catalogId",
+          "name": "catalog",
           "type": {
-            "primitive": "string"
+            "fqn": "@aws-cdk/aws-glue-alpha.ICatalog"
           }
         },
         {
@@ -13404,7 +14589,7 @@
           "immutable": true,
           "locationInModule": {
             "filename": "lib/database.ts",
-            "line": 25
+            "line": 23
           },
           "name": "databaseArn",
           "type": {
@@ -13423,7 +14608,7 @@
           "immutable": true,
           "locationInModule": {
             "filename": "lib/database.ts",
-            "line": 32
+            "line": 30
           },
           "name": "databaseName",
           "type": {
@@ -13447,7 +14632,7 @@
       "kind": "interface",
       "locationInModule": {
         "filename": "lib/jobs/job.ts",
-        "line": 17
+        "line": 18
       },
       "methods": [
         {
@@ -13459,7 +14644,7 @@
           },
           "locationInModule": {
             "filename": "lib/jobs/job.ts",
-            "line": 67
+            "line": 68
           },
           "name": "metric",
           "parameters": [
@@ -13506,7 +14691,7 @@
           },
           "locationInModule": {
             "filename": "lib/jobs/job.ts",
-            "line": 77
+            "line": 78
           },
           "name": "metricFailure",
           "parameters": [
@@ -13532,7 +14717,7 @@
           },
           "locationInModule": {
             "filename": "lib/jobs/job.ts",
-            "line": 72
+            "line": 73
           },
           "name": "metricSuccess",
           "parameters": [
@@ -13558,7 +14743,7 @@
           },
           "locationInModule": {
             "filename": "lib/jobs/job.ts",
-            "line": 82
+            "line": 83
           },
           "name": "metricTimeout",
           "parameters": [
@@ -13585,7 +14770,7 @@
           },
           "locationInModule": {
             "filename": "lib/jobs/job.ts",
-            "line": 35
+            "line": 36
           },
           "name": "onEvent",
           "parameters": [
@@ -13618,7 +14803,7 @@
           },
           "locationInModule": {
             "filename": "lib/jobs/job.ts",
-            "line": 49
+            "line": 50
           },
           "name": "onFailure",
           "parameters": [
@@ -13651,7 +14836,7 @@
           },
           "locationInModule": {
             "filename": "lib/jobs/job.ts",
-            "line": 42
+            "line": 43
           },
           "name": "onSuccess",
           "parameters": [
@@ -13684,7 +14869,7 @@
           },
           "locationInModule": {
             "filename": "lib/jobs/job.ts",
-            "line": 56
+            "line": 57
           },
           "name": "onTimeout",
           "parameters": [
@@ -13723,7 +14908,7 @@
           "immutable": true,
           "locationInModule": {
             "filename": "lib/jobs/job.ts",
-            "line": 28
+            "line": 29
           },
           "name": "jobArn",
           "type": {
@@ -13742,7 +14927,7 @@
           "immutable": true,
           "locationInModule": {
             "filename": "lib/jobs/job.ts",
-            "line": 22
+            "line": 23
           },
           "name": "jobName",
           "type": {
@@ -13803,7 +14988,7 @@
       "kind": "interface",
       "locationInModule": {
         "filename": "lib/table-base.ts",
-        "line": 34
+        "line": 35
       },
       "name": "ITable",
       "properties": [
@@ -13818,7 +15003,7 @@
           "immutable": true,
           "locationInModule": {
             "filename": "lib/table-base.ts",
-            "line": 38
+            "line": 39
           },
           "name": "tableArn",
           "type": {
@@ -13836,7 +15021,7 @@
           "immutable": true,
           "locationInModule": {
             "filename": "lib/table-base.ts",
-            "line": 43
+            "line": 44
           },
           "name": "tableName",
           "type": {
@@ -14365,7 +15550,7 @@
       "kind": "class",
       "locationInModule": {
         "filename": "lib/jobs/job.ts",
-        "line": 459
+        "line": 465
       },
       "methods": [
         {
@@ -14375,7 +15560,7 @@
           },
           "locationInModule": {
             "filename": "lib/jobs/job.ts",
-            "line": 468
+            "line": 474
           },
           "name": "fromJobAttributes",
           "parameters": [
@@ -14422,7 +15607,7 @@
           },
           "locationInModule": {
             "filename": "lib/jobs/job.ts",
-            "line": 488
+            "line": 494
           },
           "name": "checkNoReservedArgs",
           "parameters": [
@@ -14458,7 +15643,7 @@
           },
           "locationInModule": {
             "filename": "lib/jobs/job.ts",
-            "line": 538
+            "line": 550
           },
           "name": "codeS3ObjectUrl",
           "parameters": [
@@ -14484,7 +15669,7 @@
           },
           "locationInModule": {
             "filename": "lib/jobs/job.ts",
-            "line": 506
+            "line": 518
           },
           "name": "setupContinuousLogging",
           "parameters": [
@@ -14527,7 +15712,7 @@
           "immutable": true,
           "locationInModule": {
             "filename": "lib/jobs/job.ts",
-            "line": 481
+            "line": 487
           },
           "name": "role",
           "type": {
@@ -14553,7 +15738,7 @@
       "kind": "interface",
       "locationInModule": {
         "filename": "lib/jobs/job.ts",
-        "line": 290
+        "line": 291
       },
       "name": "JobAttributes",
       "properties": [
@@ -14566,7 +15751,7 @@
           "immutable": true,
           "locationInModule": {
             "filename": "lib/jobs/job.ts",
-            "line": 294
+            "line": 295
           },
           "name": "jobName",
           "type": {
@@ -14583,7 +15768,7 @@
           "immutable": true,
           "locationInModule": {
             "filename": "lib/jobs/job.ts",
-            "line": 301
+            "line": 302
           },
           "name": "role",
           "optional": true,
@@ -14640,7 +15825,7 @@
       "kind": "class",
       "locationInModule": {
         "filename": "lib/jobs/job.ts",
-        "line": 135
+        "line": 136
       },
       "methods": [
         {
@@ -14650,7 +15835,7 @@
           },
           "locationInModule": {
             "filename": "lib/jobs/job.ts",
-            "line": 276
+            "line": 277
           },
           "name": "buildJobArn",
           "parameters": [
@@ -14682,7 +15867,7 @@
           },
           "locationInModule": {
             "filename": "lib/jobs/job.ts",
-            "line": 223
+            "line": 224
           },
           "name": "metric",
           "overrides": "@aws-cdk/aws-glue-alpha.IJob",
@@ -14730,7 +15915,7 @@
           },
           "locationInModule": {
             "filename": "lib/jobs/job.ts",
-            "line": 250
+            "line": 251
           },
           "name": "metricFailure",
           "overrides": "@aws-cdk/aws-glue-alpha.IJob",
@@ -14757,7 +15942,7 @@
           },
           "locationInModule": {
             "filename": "lib/jobs/job.ts",
-            "line": 241
+            "line": 242
           },
           "name": "metricSuccess",
           "overrides": "@aws-cdk/aws-glue-alpha.IJob",
@@ -14784,7 +15969,7 @@
           },
           "locationInModule": {
             "filename": "lib/jobs/job.ts",
-            "line": 259
+            "line": 260
           },
           "name": "metricTimeout",
           "overrides": "@aws-cdk/aws-glue-alpha.IJob",
@@ -14811,7 +15996,7 @@
           },
           "locationInModule": {
             "filename": "lib/jobs/job.ts",
-            "line": 151
+            "line": 152
           },
           "name": "onEvent",
           "overrides": "@aws-cdk/aws-glue-alpha.IJob",
@@ -14850,7 +16035,7 @@
           },
           "locationInModule": {
             "filename": "lib/jobs/job.ts",
-            "line": 200
+            "line": 201
           },
           "name": "onFailure",
           "overrides": "@aws-cdk/aws-glue-alpha.IJob",
@@ -14889,7 +16074,7 @@
           },
           "locationInModule": {
             "filename": "lib/jobs/job.ts",
-            "line": 171
+            "line": 172
           },
           "name": "onStateChange",
           "parameters": [
@@ -14936,7 +16121,7 @@
           },
           "locationInModule": {
             "filename": "lib/jobs/job.ts",
-            "line": 190
+            "line": 191
           },
           "name": "onSuccess",
           "overrides": "@aws-cdk/aws-glue-alpha.IJob",
@@ -14975,7 +16160,7 @@
           },
           "locationInModule": {
             "filename": "lib/jobs/job.ts",
-            "line": 210
+            "line": 211
           },
           "name": "onTimeout",
           "overrides": "@aws-cdk/aws-glue-alpha.IJob",
@@ -15019,7 +16204,7 @@
           "immutable": true,
           "locationInModule": {
             "filename": "lib/jobs/job.ts",
-            "line": 138
+            "line": 139
           },
           "name": "grantPrincipal",
           "overrides": "aws-cdk-lib.aws_iam.IGrantable",
@@ -15036,7 +16221,7 @@
           "immutable": true,
           "locationInModule": {
             "filename": "lib/jobs/job.ts",
-            "line": 136
+            "line": 137
           },
           "name": "jobArn",
           "overrides": "@aws-cdk/aws-glue-alpha.IJob",
@@ -15053,7 +16238,7 @@
           "immutable": true,
           "locationInModule": {
             "filename": "lib/jobs/job.ts",
-            "line": 137
+            "line": 138
           },
           "name": "jobName",
           "overrides": "@aws-cdk/aws-glue-alpha.IJob",
@@ -15196,7 +16381,7 @@
       "kind": "interface",
       "locationInModule": {
         "filename": "lib/jobs/job.ts",
-        "line": 308
+        "line": 309
       },
       "name": "JobProps",
       "properties": [
@@ -15210,7 +16395,7 @@
           "immutable": true,
           "locationInModule": {
             "filename": "lib/jobs/job.ts",
-            "line": 327
+            "line": 328
           },
           "name": "role",
           "type": {
@@ -15227,7 +16412,7 @@
           "immutable": true,
           "locationInModule": {
             "filename": "lib/jobs/job.ts",
-            "line": 315
+            "line": 316
           },
           "name": "script",
           "type": {
@@ -15244,7 +16429,7 @@
           "immutable": true,
           "locationInModule": {
             "filename": "lib/jobs/job.ts",
-            "line": 391
+            "line": 397
           },
           "name": "connections",
           "optional": true,
@@ -15268,7 +16453,7 @@
           "immutable": true,
           "locationInModule": {
             "filename": "lib/jobs/job.ts",
-            "line": 452
+            "line": 458
           },
           "name": "continuousLogging",
           "optional": true,
@@ -15280,6 +16465,7 @@
           "abstract": true,
           "docs": {
             "default": "- no arguments",
+            "remarks": "These are emitted verbatim into the CloudFormation template, so avoid\nplacing secrets here in plaintext. Pass secrets to the job at runtime\nthrough AWS Secrets Manager instead. A synthesis-time warning is emitted\nwhen an argument key looks like a credential and holds a plaintext literal.",
             "see": "https://docs.aws.amazon.com/glue/latest/dg/aws-glue-programming-etl-glue-arguments.html\nfor a list of reserved parameters",
             "stability": "experimental",
             "summary": "Default Arguments (optional) The default arguments for every run of this Glue job, specified as name-value pairs."
@@ -15287,7 +16473,7 @@
           "immutable": true,
           "locationInModule": {
             "filename": "lib/jobs/job.ts",
-            "line": 382
+            "line": 388
           },
           "name": "defaultArguments",
           "optional": true,
@@ -15310,7 +16496,7 @@
           "immutable": true,
           "locationInModule": {
             "filename": "lib/jobs/job.ts",
-            "line": 343
+            "line": 344
           },
           "name": "description",
           "optional": true,
@@ -15329,7 +16515,7 @@
           "immutable": true,
           "locationInModule": {
             "filename": "lib/jobs/job.ts",
-            "line": 442
+            "line": 448
           },
           "name": "enableProfilingMetrics",
           "optional": true,
@@ -15347,7 +16533,7 @@
           "immutable": true,
           "locationInModule": {
             "filename": "lib/jobs/job.ts",
-            "line": 433
+            "line": 439
           },
           "name": "glueVersion",
           "optional": true,
@@ -15365,7 +16551,7 @@
           "immutable": true,
           "locationInModule": {
             "filename": "lib/jobs/job.ts",
-            "line": 335
+            "line": 336
           },
           "name": "jobName",
           "optional": true,
@@ -15384,7 +16570,7 @@
           "immutable": true,
           "locationInModule": {
             "filename": "lib/jobs/job.ts",
-            "line": 371
+            "line": 372
           },
           "name": "maxConcurrentRuns",
           "optional": true,
@@ -15402,7 +16588,7 @@
           "immutable": true,
           "locationInModule": {
             "filename": "lib/jobs/job.ts",
-            "line": 399
+            "line": 405
           },
           "name": "maxRetries",
           "optional": true,
@@ -15420,7 +16606,7 @@
           "immutable": true,
           "locationInModule": {
             "filename": "lib/jobs/job.ts",
-            "line": 351
+            "line": 352
           },
           "name": "numberOfWorkers",
           "optional": true,
@@ -15438,7 +16624,7 @@
           "immutable": true,
           "locationInModule": {
             "filename": "lib/jobs/job.ts",
-            "line": 417
+            "line": 423
           },
           "name": "securityConfiguration",
           "optional": true,
@@ -15456,7 +16642,7 @@
           "immutable": true,
           "locationInModule": {
             "filename": "lib/jobs/job.ts",
-            "line": 425
+            "line": 431
           },
           "name": "tags",
           "optional": true,
@@ -15480,7 +16666,7 @@
           "immutable": true,
           "locationInModule": {
             "filename": "lib/jobs/job.ts",
-            "line": 409
+            "line": 415
           },
           "name": "timeout",
           "optional": true,
@@ -15499,7 +16685,7 @@
           "immutable": true,
           "locationInModule": {
             "filename": "lib/jobs/job.ts",
-            "line": 360
+            "line": 361
           },
           "name": "workerType",
           "optional": true,
@@ -15974,7 +17160,7 @@
       "kind": "interface",
       "locationInModule": {
         "filename": "lib/table-base.ts",
-        "line": 19
+        "line": 20
       },
       "name": "PartitionIndex",
       "properties": [
@@ -15988,7 +17174,7 @@
           "immutable": true,
           "locationInModule": {
             "filename": "lib/table-base.ts",
-            "line": 32
+            "line": 33
           },
           "name": "keyNames",
           "type": {
@@ -16010,7 +17196,7 @@
           "immutable": true,
           "locationInModule": {
             "filename": "lib/table-base.ts",
-            "line": 25
+            "line": 26
           },
           "name": "indexName",
           "optional": true,
@@ -17877,7 +19063,7 @@
         },
         "locationInModule": {
           "filename": "lib/s3-table.ts",
-          "line": 122
+          "line": 133
         },
         "parameters": [
           {
@@ -17903,7 +19089,7 @@
       "kind": "class",
       "locationInModule": {
         "filename": "lib/s3-table.ts",
-        "line": 88
+        "line": 92
       },
       "methods": [
         {
@@ -17912,7 +19098,7 @@
           },
           "locationInModule": {
             "filename": "lib/s3-table.ts",
-            "line": 245
+            "line": 257
           },
           "name": "generateS3PrefixForGrant",
           "protected": true,
@@ -17930,7 +19116,7 @@
           },
           "locationInModule": {
             "filename": "lib/s3-table.ts",
-            "line": 209
+            "line": 221
           },
           "name": "grantRead",
           "overrides": "@aws-cdk/aws-glue-alpha.TableBase",
@@ -17959,7 +19145,7 @@
           },
           "locationInModule": {
             "filename": "lib/s3-table.ts",
-            "line": 237
+            "line": 249
           },
           "name": "grantReadWrite",
           "overrides": "@aws-cdk/aws-glue-alpha.TableBase",
@@ -17988,7 +19174,7 @@
           },
           "locationInModule": {
             "filename": "lib/s3-table.ts",
-            "line": 223
+            "line": 235
           },
           "name": "grantWrite",
           "overrides": "@aws-cdk/aws-glue-alpha.TableBase",
@@ -18021,7 +19207,7 @@
           "immutable": true,
           "locationInModule": {
             "filename": "lib/s3-table.ts",
-            "line": 91
+            "line": 95
           },
           "name": "PROPERTY_INJECTION_ID",
           "static": true,
@@ -18037,7 +19223,7 @@
           "immutable": true,
           "locationInModule": {
             "filename": "lib/s3-table.ts",
-            "line": 98
+            "line": 102
           },
           "name": "bucket",
           "type": {
@@ -18052,7 +19238,7 @@
           "immutable": true,
           "locationInModule": {
             "filename": "lib/s3-table.ts",
-            "line": 108
+            "line": 112
           },
           "name": "encryption",
           "type": {
@@ -18067,7 +19253,7 @@
           "immutable": true,
           "locationInModule": {
             "filename": "lib/s3-table.ts",
-            "line": 103
+            "line": 107
           },
           "name": "s3Prefix",
           "type": {
@@ -18082,7 +19268,7 @@
           "immutable": true,
           "locationInModule": {
             "filename": "lib/s3-table.ts",
-            "line": 194
+            "line": 206
           },
           "name": "tableArn",
           "overrides": "@aws-cdk/aws-glue-alpha.TableBase",
@@ -18098,7 +19284,7 @@
           "immutable": true,
           "locationInModule": {
             "filename": "lib/s3-table.ts",
-            "line": 186
+            "line": 198
           },
           "name": "tableName",
           "overrides": "@aws-cdk/aws-glue-alpha.TableBase",
@@ -18113,7 +19299,7 @@
           "immutable": true,
           "locationInModule": {
             "filename": "lib/s3-table.ts",
-            "line": 120
+            "line": 124
           },
           "name": "tableResource",
           "overrides": "@aws-cdk/aws-glue-alpha.TableBase",
@@ -18131,7 +19317,7 @@
           "immutable": true,
           "locationInModule": {
             "filename": "lib/s3-table.ts",
-            "line": 113
+            "line": 117
           },
           "name": "encryptionKey",
           "optional": true,
@@ -18147,7 +19333,7 @@
           "immutable": true,
           "locationInModule": {
             "filename": "lib/s3-table.ts",
-            "line": 118
+            "line": 122
           },
           "name": "partitionIndexes",
           "optional": true,
@@ -18214,7 +19400,7 @@
           "immutable": true,
           "locationInModule": {
             "filename": "lib/s3-table.ts",
-            "line": 72
+            "line": 76
           },
           "name": "encryption",
           "optional": true,
@@ -18233,7 +19419,7 @@
           "immutable": true,
           "locationInModule": {
             "filename": "lib/s3-table.ts",
-            "line": 81
+            "line": 85
           },
           "name": "encryptionKey",
           "optional": true,
@@ -18245,13 +19431,14 @@
           "abstract": true,
           "docs": {
             "default": "- No prefix. The data will be stored under the root of the bucket.",
+            "remarks": "When the table shares a bucket with other tables or consumers, set this so\nthat the `grant*` methods scope S3 access to this table's data. Without a\nprefix, those grants cover the entire bucket.",
             "stability": "experimental",
             "summary": "S3 prefix under which table objects are stored."
           },
           "immutable": true,
           "locationInModule": {
             "filename": "lib/s3-table.ts",
-            "line": 60
+            "line": 64
           },
           "name": "s3Prefix",
           "optional": true,
@@ -19390,7 +20577,7 @@
         },
         "locationInModule": {
           "filename": "lib/security-configuration.ts",
-          "line": 191
+          "line": 198
         },
         "parameters": [
           {
@@ -19420,7 +20607,7 @@
       "kind": "class",
       "locationInModule": {
         "filename": "lib/security-configuration.ts",
-        "line": 154
+        "line": 161
       },
       "methods": [
         {
@@ -19430,7 +20617,7 @@
           },
           "locationInModule": {
             "filename": "lib/security-configuration.ts",
-            "line": 166
+            "line": 173
           },
           "name": "fromSecurityConfigurationName",
           "parameters": [
@@ -19481,7 +20668,7 @@
           "immutable": true,
           "locationInModule": {
             "filename": "lib/security-configuration.ts",
-            "line": 157
+            "line": 164
           },
           "name": "PROPERTY_INJECTION_ID",
           "static": true,
@@ -19497,7 +20684,7 @@
           "immutable": true,
           "locationInModule": {
             "filename": "lib/security-configuration.ts",
-            "line": 253
+            "line": 262
           },
           "name": "securityConfigurationName",
           "overrides": "@aws-cdk/aws-glue-alpha.ISecurityConfiguration",
@@ -19513,7 +20700,7 @@
           "immutable": true,
           "locationInModule": {
             "filename": "lib/security-configuration.ts",
-            "line": 177
+            "line": 184
           },
           "name": "cloudWatchEncryptionKey",
           "optional": true,
@@ -19529,7 +20716,7 @@
           "immutable": true,
           "locationInModule": {
             "filename": "lib/security-configuration.ts",
-            "line": 182
+            "line": 189
           },
           "name": "jobBookmarksEncryptionKey",
           "optional": true,
@@ -19545,7 +20732,7 @@
           "immutable": true,
           "locationInModule": {
             "filename": "lib/security-configuration.ts",
-            "line": 187
+            "line": 194
           },
           "name": "s3EncryptionKey",
           "optional": true,
@@ -19611,6 +20798,24 @@
             "fqn": "@aws-cdk/aws-glue-alpha.JobBookmarksEncryption"
           }
         },
+        {
+          "abstract": true,
+          "docs": {
+            "default": "- resource will be destroyed",
+            "stability": "experimental",
+            "summary": "Policy to apply when the security configuration is removed from the stack."
+          },
+          "immutable": true,
+          "locationInModule": {
+            "filename": "lib/security-configuration.ts",
+            "line": 149
+          },
+          "name": "removalPolicy",
+          "optional": true,
+          "type": {
+            "fqn": "aws-cdk-lib.RemovalPolicy"
+          }
+        },
         {
           "abstract": true,
           "docs": {
@@ -21106,7 +22311,7 @@
         },
         "locationInModule": {
           "filename": "lib/s3-table.ts",
-          "line": 122
+          "line": 133
         },
         "parameters": [
           {
@@ -21171,7 +22376,7 @@
       "kind": "interface",
       "locationInModule": {
         "filename": "lib/table-base.ts",
-        "line": 46
+        "line": 47
       },
       "name": "TableAttributes",
       "properties": [
@@ -21183,7 +22388,7 @@
           "immutable": true,
           "locationInModule": {
             "filename": "lib/table-base.ts",
-            "line": 47
+            "line": 48
           },
           "name": "tableArn",
           "type": {
@@ -21198,7 +22403,7 @@
           "immutable": true,
           "locationInModule": {
             "filename": "lib/table-base.ts",
-            "line": 48
+            "line": 49
           },
           "name": "tableName",
           "type": {
@@ -21227,7 +22432,7 @@
         },
         "locationInModule": {
           "filename": "lib/table-base.ts",
-          "line": 260
+          "line": 261
         },
         "parameters": [
           {
@@ -21256,7 +22461,7 @@
       "kind": "class",
       "locationInModule": {
         "filename": "lib/table-base.ts",
-        "line": 181
+        "line": 182
       },
       "methods": [
         {
@@ -21265,7 +22470,7 @@
           },
           "locationInModule": {
             "filename": "lib/table-base.ts",
-            "line": 182
+            "line": 183
           },
           "name": "fromTableArn",
           "parameters": [
@@ -21302,7 +22507,7 @@
           },
           "locationInModule": {
             "filename": "lib/table-base.ts",
-            "line": 198
+            "line": 199
           },
           "name": "fromTableAttributes",
           "parameters": [
@@ -21350,7 +22555,7 @@
           },
           "locationInModule": {
             "filename": "lib/table-base.ts",
-            "line": 294
+            "line": 295
           },
           "name": "addPartitionIndex",
           "parameters": [
@@ -21364,23 +22569,29 @@
         },
         {
           "docs": {
-            "remarks": "[disable-awslint:no-grants]",
+            "remarks": "This is a low-level escape hatch: the `actions` are applied verbatim,\nscoped to this table's ARN. Prefer the intent-based `grantRead` /\n`grantWrite` / `grantReadWrite` methods, which grant a curated set of\nactions and also cover the underlying S3 data. Only pass the specific\nactions the grantee needs - avoid service wildcards such as `glue:*`.\n[disable-awslint:no-grants]",
             "stability": "experimental",
-            "summary": "Grant the given identity custom permissions."
+            "summary": "Grant the given identity custom permissions on this table."
           },
           "locationInModule": {
             "filename": "lib/table-base.ts",
-            "line": 461
+            "line": 481
           },
           "name": "grant",
           "parameters": [
             {
+              "docs": {
+                "summary": "the principal."
+              },
               "name": "grantee",
               "type": {
                 "fqn": "aws-cdk-lib.aws_iam.IGrantable"
               }
             },
             {
+              "docs": {
+                "summary": "the set of Glue actions to allow (for example `glue:GetTable`)."
+              },
               "name": "actions",
               "type": {
                 "collection": {
@@ -21405,7 +22616,7 @@
           },
           "locationInModule": {
             "filename": "lib/table-base.ts",
-            "line": 283
+            "line": 284
           },
           "name": "grantRead",
           "parameters": [
@@ -21429,7 +22640,7 @@
           },
           "locationInModule": {
             "filename": "lib/table-base.ts",
-            "line": 285
+            "line": 286
           },
           "name": "grantReadWrite",
           "parameters": [
@@ -21448,23 +22659,29 @@
         },
         {
           "docs": {
-            "remarks": "Permissions will be granted to the catalog, the database, and the table.\n[disable-awslint:no-grants]",
+            "remarks": "This is a low-level escape hatch for actions (such as certain Lake\nFormation or crawler operations) that must be authorized against the\ncatalog and database in addition to the table. The `actions` are applied\nverbatim to all three ARNs (table, catalog, database), so scope them\ntightly: pass only the specific actions the grantee needs and avoid\nservice wildcards such as `glue:*`, which would grant broad access across\nevery resource in the catalog and database.\n[disable-awslint:no-grants]",
             "stability": "experimental",
-            "summary": "Grant the given identity custom permissions to ALL underlying resources of the table."
+            "summary": "Grant the given identity custom permissions on this table AND its parent catalog and database."
           },
           "locationInModule": {
             "filename": "lib/table-base.ts",
-            "line": 474
+            "line": 505
           },
           "name": "grantToUnderlyingResources",
           "parameters": [
             {
+              "docs": {
+                "summary": "the principal."
+              },
               "name": "grantee",
               "type": {
                 "fqn": "aws-cdk-lib.aws_iam.IGrantable"
               }
             },
             {
+              "docs": {
+                "summary": "the set of Glue actions to allow (for example `glue:GetTable`)."
+              },
               "name": "actions",
               "type": {
                 "collection": {
@@ -21489,7 +22706,7 @@
           },
           "locationInModule": {
             "filename": "lib/table-base.ts",
-            "line": 284
+            "line": 285
           },
           "name": "grantWrite",
           "parameters": [
@@ -21517,7 +22734,7 @@
           "immutable": true,
           "locationInModule": {
             "filename": "lib/table-base.ts",
-            "line": 230
+            "line": 231
           },
           "name": "columns",
           "type": {
@@ -21537,7 +22754,7 @@
           "immutable": true,
           "locationInModule": {
             "filename": "lib/table-base.ts",
-            "line": 220
+            "line": 221
           },
           "name": "compressed",
           "type": {
@@ -21552,7 +22769,7 @@
           "immutable": true,
           "locationInModule": {
             "filename": "lib/table-base.ts",
-            "line": 215
+            "line": 216
           },
           "name": "database",
           "type": {
@@ -21567,7 +22784,7 @@
           "immutable": true,
           "locationInModule": {
             "filename": "lib/table-base.ts",
-            "line": 225
+            "line": 226
           },
           "name": "dataFormat",
           "type": {
@@ -21583,7 +22800,7 @@
           "immutable": true,
           "locationInModule": {
             "filename": "lib/table-base.ts",
-            "line": 251
+            "line": 252
           },
           "name": "parameters",
           "protected": true,
@@ -21604,7 +22821,7 @@
           "immutable": true,
           "locationInModule": {
             "filename": "lib/table-base.ts",
-            "line": 209
+            "line": 210
           },
           "name": "tableArn",
           "overrides": "@aws-cdk/aws-glue-alpha.ITable",
@@ -21620,7 +22837,7 @@
           "immutable": true,
           "locationInModule": {
             "filename": "lib/table-base.ts",
-            "line": 208
+            "line": 209
           },
           "name": "tableName",
           "overrides": "@aws-cdk/aws-glue-alpha.ITable",
@@ -21636,7 +22853,7 @@
           "immutable": true,
           "locationInModule": {
             "filename": "lib/table-base.ts",
-            "line": 207
+            "line": 208
           },
           "name": "tableResource",
           "protected": true,
@@ -21652,7 +22869,7 @@
           "immutable": true,
           "locationInModule": {
             "filename": "lib/table-base.ts",
-            "line": 210
+            "line": 211
           },
           "name": "partitionIndexes",
           "optional": true,
@@ -21673,7 +22890,7 @@
           "immutable": true,
           "locationInModule": {
             "filename": "lib/table-base.ts",
-            "line": 235
+            "line": 236
           },
           "name": "partitionKeys",
           "optional": true,
@@ -21694,7 +22911,7 @@
           "immutable": true,
           "locationInModule": {
             "filename": "lib/table-base.ts",
-            "line": 245
+            "line": 246
           },
           "name": "partitionProjection",
           "optional": true,
@@ -21715,7 +22932,7 @@
           "immutable": true,
           "locationInModule": {
             "filename": "lib/table-base.ts",
-            "line": 240
+            "line": 241
           },
           "name": "storageParameters",
           "optional": true,
@@ -21745,7 +22962,7 @@
       "kind": "interface",
       "locationInModule": {
         "filename": "lib/table-base.ts",
-        "line": 51
+        "line": 52
       },
       "name": "TableBaseProps",
       "properties": [
@@ -21758,7 +22975,7 @@
           "immutable": true,
           "locationInModule": {
             "filename": "lib/table-base.ts",
-            "line": 74
+            "line": 75
           },
           "name": "columns",
           "type": {
@@ -21779,7 +22996,7 @@
           "immutable": true,
           "locationInModule": {
             "filename": "lib/table-base.ts",
-            "line": 69
+            "line": 70
           },
           "name": "database",
           "type": {
@@ -21795,7 +23012,7 @@
           "immutable": true,
           "locationInModule": {
             "filename": "lib/table-base.ts",
-            "line": 95
+            "line": 96
           },
           "name": "dataFormat",
           "type": {
@@ -21812,7 +23029,7 @@
           "immutable": true,
           "locationInModule": {
             "filename": "lib/table-base.ts",
-            "line": 102
+            "line": 103
           },
           "name": "compressed",
           "optional": true,
@@ -21830,7 +23047,7 @@
           "immutable": true,
           "locationInModule": {
             "filename": "lib/table-base.ts",
-            "line": 64
+            "line": 65
           },
           "name": "description",
           "optional": true,
@@ -21849,7 +23066,7 @@
           "immutable": true,
           "locationInModule": {
             "filename": "lib/table-base.ts",
-            "line": 118
+            "line": 119
           },
           "name": "enablePartitionFiltering",
           "optional": true,
@@ -21869,7 +23086,7 @@
           "immutable": true,
           "locationInModule": {
             "filename": "lib/table-base.ts",
-            "line": 163
+            "line": 164
           },
           "name": "parameters",
           "optional": true,
@@ -21893,7 +23110,7 @@
           "immutable": true,
           "locationInModule": {
             "filename": "lib/table-base.ts",
-            "line": 90
+            "line": 91
           },
           "name": "partitionIndexes",
           "optional": true,
@@ -21916,7 +23133,7 @@
           "immutable": true,
           "locationInModule": {
             "filename": "lib/table-base.ts",
-            "line": 81
+            "line": 82
           },
           "name": "partitionKeys",
           "optional": true,
@@ -21941,7 +23158,7 @@
           "immutable": true,
           "locationInModule": {
             "filename": "lib/table-base.ts",
-            "line": 175
+            "line": 176
           },
           "name": "partitionProjection",
           "optional": true,
@@ -21967,7 +23184,7 @@
           "immutable": true,
           "locationInModule": {
             "filename": "lib/table-base.ts",
-            "line": 153
+            "line": 154
           },
           "name": "storageParameters",
           "optional": true,
@@ -21990,7 +23207,7 @@
           "immutable": true,
           "locationInModule": {
             "filename": "lib/table-base.ts",
-            "line": 109
+            "line": 110
           },
           "name": "storedAsSubDirectories",
           "optional": true,
@@ -22008,7 +23225,7 @@
           "immutable": true,
           "locationInModule": {
             "filename": "lib/table-base.ts",
-            "line": 57
+            "line": 58
           },
           "name": "tableName",
           "optional": true,
@@ -23259,6 +24476,6 @@
       "symbolId": "lib/storage-parameter:WriteParallel"
     }
   },
-  "version": "2.263.0-alpha.0",
+  "version": "2.265.0-alpha.0",
   "fingerprint": "**********"
 }