@aws-cdk/aws-glue-alpha 2.265.0-alpha.0 → 2.267.0-alpha.0

package/README.md

@@ -75,7 +75,9 @@ similar constructors. ETL jobs default to the G2 worker type, but you can
 override this default with other supported worker type values (G1, G2, G4
 and G8). ETL jobs defaults to Glue version 4.0, which you can override to 3.0.
 The following ETL features are enabled by default:
-`—enable-metrics, —enable-spark-ui, —enable-continuous-cloudwatch-log.`
+`—enable-metrics, —enable-continuous-cloudwatch-log.`
+The Spark UI (`—enable-spark-ui`) is off by default; enable it by setting the
+`sparkUI` prop.
 You can find more details about version, worker type and other features in
 [Glue's public documentation](https://docs.aws.amazon.com/glue/latest/dg/aws-glue-api-jobs-job.html).
 
@@ -115,7 +117,10 @@ new glue.PySparkEtlJob(stack, 'PySparkETLJob', {
   script,
   glueVersion: glue.GlueVersion.V5_1,
   continuousLogging: { enabled: false },
-  workerType: glue.WorkerType.G_2X,
+  workerConfiguration: {
+    workerType: glue.WorkerType.G_2X,
+    numberOfWorkers: 2,
+  },
   maxConcurrentRuns: 100,
   timeout: cdk.Duration.hours(2),
   connections: [glue.Connection.fromConnectionName(stack, 'Connection', 'connectionName')],
@@ -125,7 +130,6 @@ new glue.PySparkEtlJob(stack, 'PySparkETLJob', {
     SecondTagName: 'SecondTagValue',
     XTagName: 'XTagValue',
   },
-  numberOfWorkers: 2,
   maxRetries: 2,
 });
 ```
@@ -135,11 +139,12 @@ new glue.PySparkEtlJob(stack, 'PySparkETLJob', {
 Streaming jobs are similar to ETL jobs, except that they perform ETL on data
 streams using the Apache Spark Structured Streaming framework. Some Spark
 job features are not available to Streaming ETL jobs. They support Scala
-and pySpark languages. PySpark streaming jobs default Python 3.9,
-which you can override with any non-deprecated version of Python. It
+and pySpark languages. PySpark streaming jobs run on Python 3. It
 defaults to the G2 worker type and Glue 4.0, both of which you can override.
 The following best practice features are enabled by default:
-`—enable-metrics, —enable-spark-ui, —enable-continuous-cloudwatch-log`.
+`—enable-metrics, —enable-continuous-cloudwatch-log`.
+The Spark UI (`—enable-spark-ui`) is off by default; enable it by setting the
+`sparkUI` prop.
 
 Reference the pyspark-streaming-jobs.test.ts and scalaspark-streaming-jobs.test.ts 
 unit tests for examples of required-only and optional job parameters when creating
@@ -171,7 +176,10 @@ new glue.PySparkStreamingJob(stack, 'PySparkStreamingJob', {
   script,
   glueVersion: glue.GlueVersion.V5_1,
   continuousLogging: { enabled: false },
-  workerType: glue.WorkerType.G_2X,
+  workerConfiguration: {
+    workerType: glue.WorkerType.G_2X,
+    numberOfWorkers: 2,
+  },
   maxConcurrentRuns: 100,
   timeout: cdk.Duration.hours(2),
   connections: [glue.Connection.fromConnectionName(stack, 'Connection', 'connectionName')],
@@ -181,7 +189,6 @@ new glue.PySparkStreamingJob(stack, 'PySparkStreamingJob', {
     SecondTagName: 'SecondTagValue',
     XTagName: 'XTagValue',
   },
-  numberOfWorkers: 2,
   maxRetries: 2,
 });
 ```
@@ -192,7 +199,9 @@ The flexible execution class is appropriate for non-urgent jobs such as
 pre-production jobs, testing, and one-time data loads. Flexible jobs default
 to Glue version 5.0 and worker type `G_2X`. The following best practice
 features are enabled by default:
-`—enable-metrics, —enable-spark-ui, —enable-continuous-cloudwatch-log`
+`—enable-metrics, —enable-continuous-cloudwatch-log`
+The Spark UI (`—enable-spark-ui`) is off by default; enable it by setting the
+`sparkUI` prop.
 
 Reference the pyspark-flex-etl-jobs.test.ts and scalaspark-flex-etl-jobs.test.ts 
 unit tests for examples of required-only and optional job parameters when creating
@@ -217,14 +226,17 @@ import * as iam from 'aws-cdk-lib/aws-iam';
 declare const stack: cdk.Stack;
 declare const role: iam.IRole;
 declare const script: glue.Code;
-new glue.PySparkEtlJob(stack, 'pySparkEtlJob', {
-  jobName: 'pySparkEtlJob',
+new glue.PySparkFlexEtlJob(stack, 'pySparkFlexEtlJob', {
+  jobName: 'pySparkFlexEtlJob',
   description: 'This is a description',
   role,
   script,
   glueVersion: glue.GlueVersion.V5_1,
   continuousLogging: { enabled: false },
-  workerType: glue.WorkerType.G_2X,
+  workerConfiguration: {
+    workerType: glue.WorkerType.G_2X,
+    numberOfWorkers: 2,
+  },
   maxConcurrentRuns: 100,
   timeout: cdk.Duration.hours(2),
   connections: [glue.Connection.fromConnectionName(stack, 'Connection', 'connectionName')],
@@ -234,7 +246,6 @@ new glue.PySparkEtlJob(stack, 'pySparkEtlJob', {
     SecondTagName: 'SecondTagValue',
     XTagName: 'XTagValue',
   },
-  numberOfWorkers: 2,
   maxRetries: 2,
 });
 ```
@@ -274,14 +285,13 @@ declare const extraPythonFile: glue.Code;
 new glue.PythonShellJob(stack, 'PythonShellJob', {
   jobName: 'PythonShellJobCustomName',
   description: 'This is a description',
-  pythonVersion: glue.PythonVersion.TWO,
+  pythonVersion: glue.PythonVersion.THREE_NINE,
   maxCapacity: glue.MaxCapacity.DPU_1,
   role,
   script,
   extraPythonFiles: [extraPythonFile],
-  glueVersion: glue.GlueVersion.V2_0,
+  glueVersion: glue.GlueVersion.V3_0,
   continuousLogging: { enabled: false },
-  workerType: glue.WorkerType.G_2X,
   maxConcurrentRuns: 100,
   timeout: cdk.Duration.hours(2),
   connections: [glue.Connection.fromConnectionName(stack, 'Connection', 'connectionName')],
@@ -291,7 +301,6 @@ new glue.PythonShellJob(stack, 'PythonShellJob', {
     SecondTagName: 'SecondTagValue',
     XTagName: 'XTagValue',
   },
-  numberOfWorkers: 2,
   maxRetries: 2,
 });
 ```
@@ -355,10 +364,12 @@ new glue.PySparkEtlJob(stack, 'PySparkETLJob', {
 
 ### Uploading scripts from the CDK app repository to S3
 
-Similar to other L2 constructs, the Glue L2 automates uploading / updating
-scripts to S3 via an optional fromAsset parameter pointing to a script
-in the local file structure. You provide the existing S3 bucket and
-path to which you'd like the script to be uploaded.
+Similar to other L2 constructs, the Glue L2 automates uploading local
+scripts to S3. Use `glue.Code.fromAsset(path)` to point at a script in your
+local file structure; it is uploaded to the CDK-managed asset bucket. To
+reference a script that already exists in S3, use
+`glue.Code.fromBucket(bucket, key)`, which performs no upload. A `script` is
+required for every job.
 
 Reference the unit tests for examples of repo and S3 code target examples.
 
@@ -370,15 +381,34 @@ jobs, and triggers. Standalone triggers are an anti-pattern, so you must
 create triggers from within a workflow using the L2 construct.
 
 Within a workflow object, there are functions to create different
-types of triggers with actions and predicates. You then add those triggers
-to jobs.
+types of triggers with actions and predicates. You add triggers to the
+workflow, and each trigger references the jobs or crawlers it runs as its
+actions.
 
-StartOnCreation defaults to true for all trigger types, but you can
-override it if you prefer for your trigger not to start on creation.
+`startOnCreation` applies to scheduled triggers (and, via
+`ConditionalTriggerOptions`, conditional triggers) only. It defaults to `false`,
+but you can override it if you prefer for your trigger to start on creation.
 
 Reference the workflow-triggers.test.ts unit tests for examples of creating
 workflows and triggers.
 
+```ts
+import * as cdk from 'aws-cdk-lib';
+import * as iam from 'aws-cdk-lib/aws-iam';
+declare const stack: cdk.Stack;
+declare const role: iam.IRole;
+declare const script: glue.Code;
+
+// Create a job to run from the workflow
+const job = new glue.PySparkEtlJob(stack, 'Job', { role, script });
+
+// Create a workflow and add a trigger that runs the job
+const workflow = new glue.Workflow(stack, 'Workflow');
+workflow.addOnDemandTrigger('OnDemandTrigger', {
+  actions: [{ job }],
+});
+```
+
 #### **1. On-Demand Triggers**
 
 On-demand triggers can start glue jobs or crawlers. This construct provides
@@ -389,7 +419,7 @@ actions list using the job or crawler objects using conditional types.
 #### **2. Scheduled Triggers**
 
 You can create scheduled triggers using cron expressions. This construct
-provides daily, weekly, and monthly convenience functions,
+provides daily and weekly convenience functions,
 as well as a custom function that allows you to create your own
 custom timing using the [existing event Schedule class](https://docs.aws.amazon.com/cdk/api/v2/docs/aws-cdk-lib.aws_events.Schedule.html)
 without having to build your own cron expressions. The L2 extracts
@@ -415,18 +445,21 @@ A `Connection` allows Glue jobs, crawlers and development endpoints to access
 certain types of data stores.
 
 * **Secrets Management**
-    You must specify JDBC connection credentials in Secrets Manager and
-    provide the Secrets Manager Key name as a property to the job connection.
+    Manage JDBC connection credentials in Secrets Manager and pass the secret
+    to the connection via the `secret` property (see the example below), rather
+    than embedding credentials in `properties`.
 
 * **Networking - the CDK determines the best fit subnet for Glue connection
 configuration**
-    The prior version of the glue-alpha-module requires the developer to
-    specify the subnet of the Connection when it’s defined. Now, you can still
-    specify the specific subnet you want to use, but are no longer required
-    to. You are only required to provide a VPC and either a public or private
-    subnet selection. Without a specific subnet provided, the L2 leverages the
-    existing [EC2 Subnet Selection](https://docs.aws.amazon.com/cdk/api/v2/python/aws_cdk.aws_ec2/SubnetSelection.html)
-    library to make the best choice selection for the subnet.
+    You can specify the exact subnet of the Connection when it's defined, but
+    you are not required to. Instead, you can provide a `vpc` and, optionally, a
+    `vpcSubnets` selection, and the L2 leverages the existing
+    [EC2 Subnet Selection](https://docs.aws.amazon.com/cdk/api/v2/python/aws_cdk.aws_ec2/SubnetSelection.html)
+    library to make the best choice selection for the subnet. A Glue connection
+    targets a single subnet, so the first subnet of the selection is used.
+    `subnet` and `vpc` are mutually exclusive.
+
+Pin the connection to a specific subnet:
 
 ```ts
 declare const securityGroup: ec2.SecurityGroup;
@@ -440,7 +473,21 @@ new glue.Connection(this, 'MyConnection', {
 });
 ```
 
-For RDS `Connection` by JDBC, it is recommended to manage credentials using AWS Secrets Manager. To use Secret, specify `SECRET_ID` in `properties` like the following code. Note that in this case, the subnet must have a route to the AWS Secrets Manager VPC endpoint or to the AWS Secrets Manager endpoint through a NAT gateway.
+Or let the CDK select a subnet from a VPC:
+
+```ts
+declare const securityGroup: ec2.SecurityGroup;
+declare const vpc: ec2.Vpc;
+new glue.Connection(this, 'MyConnection', {
+  type: glue.ConnectionType.NETWORK,
+  securityGroups: [securityGroup],
+  vpc,
+  // Optional - defaults to private subnets
+  vpcSubnets: { subnetType: ec2.SubnetType.PRIVATE_WITH_EGRESS },
+});
+```
+
+For RDS `Connection` by JDBC, it is recommended to manage credentials using AWS Secrets Manager. Pass the secret via the `secret` property: Glue reads the credentials at runtime through the connection's `SECRET_ID`, so the secret value never enters the template. Note that in this case, the subnet must have a route to the AWS Secrets Manager VPC endpoint or to the AWS Secrets Manager endpoint through a NAT gateway.
 
 ```ts
 declare const securityGroup: ec2.SecurityGroup;
@@ -450,18 +497,18 @@ new glue.Connection(this, "RdsConnection", {
   type: glue.ConnectionType.JDBC,
   securityGroups: [securityGroup],
   subnet,
+  secret: db.secret,
   properties: {
     JDBC_CONNECTION_URL: `jdbc:mysql://${db.clusterEndpoint.socketAddress}/databasename`,
     JDBC_ENFORCE_SSL: "false",
-    SECRET_ID: db.secret!.secretName,
   },
 });
 ```
 
-Connection `properties` are emitted verbatim into the CloudFormation template, so
-any credential placed there in plaintext is stored in plaintext in the template,
-`cdk.out`, and source control. Reference a Secrets Manager secret through
-`SECRET_ID` (as above) instead. If a property key looks like a credential (for
+Prefer the `secret` property over placing credentials in `properties`. Connection
+`properties` are emitted verbatim into the CloudFormation template, so any
+credential placed there in plaintext is stored in plaintext in the template,
+`cdk.out`, and source control. If a property key looks like a credential (for
 example `PASSWORD`, `SECRET`, or `TOKEN`) and holds a plaintext literal, the
 construct emits a synthesis-time warning.
 
@@ -473,32 +520,29 @@ See [Adding a Connection to Your Data Store](https://docs.aws.amazon.com/glue/la
 
 A `SecurityConfiguration` is a set of security properties that can be used by AWS Glue to encrypt data at rest.
 
+Each encryption config is built with a factory that pairs the encryption mode
+with its key, so illegal combinations (such as an S3-managed encryption carrying
+a KMS key) cannot be expressed:
+
 ```ts
 new glue.SecurityConfiguration(this, 'MySecurityConfiguration', {
-  cloudWatchEncryption: {
-    mode: glue.CloudWatchEncryptionMode.KMS,
-  },
-  jobBookmarksEncryption: {
-    mode: glue.JobBookmarksEncryptionMode.CLIENT_SIDE_KMS,
-  },
-  s3Encryption: {
-    mode: glue.S3EncryptionMode.KMS,
-  },
+  cloudWatchEncryption: glue.CloudWatchEncryption.kms(),
+  jobBookmarksEncryption: glue.JobBookmarksEncryption.clientSideKms(),
+  s3Encryption: glue.S3Encryption.kms(),
 });
 ```
 
-By default, a shared KMS key is created for use with the encryption configurations that require one. You can also supply your own key for each encryption config, for example, for CloudWatch encryption:
+By default, a shared KMS key is created for use with the encryption configurations that require one. You can also supply your own key to any factory, for example, for CloudWatch encryption:
 
 ```ts
 declare const key: kms.Key;
 new glue.SecurityConfiguration(this, 'MySecurityConfiguration', {
-  cloudWatchEncryption: {
-    mode: glue.CloudWatchEncryptionMode.KMS,
-    kmsKey: key,
-  },
+  cloudWatchEncryption: glue.CloudWatchEncryption.kms(key),
 });
 ```
 
+Use `glue.S3Encryption.s3Managed()` for S3-managed (SSE-S3) encryption, which takes no key.
+
 See [documentation](https://docs.aws.amazon.com/glue/latest/dg/encryption-security-configuration.html) for more info for Glue encrypting data written by Crawlers, Jobs, and Development Endpoints.
 
 ## Catalog
@@ -560,7 +604,7 @@ new glue.Catalog(this, 'MyCatalog', {
 ### Encryption at rest
 
 Configure Data Catalog encryption at rest through the `encryptionAtRest` option
-(on `Catalog.encryptAccount`, the `Catalog` constructor, or the import factories).
+(on `Catalog.encryptAccount` or the `Catalog` constructor).
 It accepts a `DataCatalogEncryptionAtRest` describing the mode:
 
 ```ts
@@ -697,13 +741,13 @@ new glue.S3Table(this, 'MyTable', {
 });
 ```
 
-By default, a S3 bucket will be created to store the table's data but you can manually pass the `bucket` and `s3Prefix`:
+By default, a S3 bucket will be created to store the table's data but you can bring your own with `S3TableStorage.fromBucket` and set an `s3Prefix`:
 
 ```ts
 declare const myBucket: s3.Bucket;
 declare const myDatabase: glue.Database;
 new glue.S3Table(this, 'MyTable', {
-  bucket: myBucket,
+  storage: glue.S3TableStorage.fromBucket(myBucket),
   s3Prefix: 'my-table/',
   // ...
   database: myDatabase,
@@ -814,7 +858,7 @@ new glue.S3Table(this, 'MyTable', {
 Alternatively, you can call the `addPartitionIndex()` function on a table:
 
 ```ts
-declare const myTable: glue.Table;
+declare const myTable: glue.S3Table;
 myTable.addPartitionIndex({
   indexName: 'my-index',
   keyNames: ['year'],
@@ -1047,18 +1091,38 @@ new glue.ExternalTable(this, 'MyTable', {
 });
 ```
 
+## Data Quality Ruleset
+
+A `DataQualityRuleset` defines a set of data quality rules — authored in Glue's
+Data Quality Definition Language (DQDL) — that are evaluated against a table in
+the Data Catalog.
+
+```ts
+new glue.DataQualityRuleset(this, 'MyRuleset', {
+  rulesetName: 'my_ruleset',
+  dqdl: glue.Dqdl.fromString('Rules = [ RowCount > 100, IsComplete "order_id" ]'),
+  targetTable: new glue.DataQualityTargetTable('my_database', 'my_table'),
+});
+```
+
+Build the DQDL document with `Dqdl.fromString(...)`. Glue parses and validates the
+DQDL when the ruleset is deployed; see the
+[DQDL reference](https://docs.aws.amazon.com/glue/latest/dg/dqdl.html) for the
+full rule syntax.
+
 ## [Encryption](https://docs.aws.amazon.com/athena/latest/ug/encryption.html)
 
-When the table creates its own S3 bucket (i.e. you do not pass an explicit `bucket`), that bucket enforces SSL: a bucket policy denies any request made over plain HTTP. If you provide your own bucket, enabling `enforceSSL` on it is your responsibility.
+When the table creates its own S3 bucket (`S3TableStorage.managedBucket`, the default), that bucket enforces SSL: a bucket policy denies any request made over plain HTTP. If you bring your own bucket with `S3TableStorage.fromBucket`, enabling `enforceSSL` on it is your responsibility.
 
-You can enable encryption on a Table's data:
+Server-side encryption applies only to a bucket the table manages. Choose it with
+`storage: glue.S3TableStorage.managedBucket(...)`:
 
 * [S3Managed](https://docs.aws.amazon.com/AmazonS3/latest/dev/UsingServerSideEncryption.html) - (default) Server side encryption (`SSE-S3`) with an Amazon S3-managed key.
 
 ```ts
 declare const myDatabase: glue.Database;
 new glue.S3Table(this, 'MyTable', {
-  encryption: glue.TableEncryption.S3_MANAGED,
+  storage: glue.S3TableStorage.managedBucket(glue.S3TableEncryption.s3Managed()),
   // ...
   database: myDatabase,
   columns: [{
@@ -1075,7 +1139,7 @@ new glue.S3Table(this, 'MyTable', {
 declare const myDatabase: glue.Database;
 // KMS key is created automatically
 new glue.S3Table(this, 'MyTable', {
-  encryption: glue.TableEncryption.KMS,
+  storage: glue.S3TableStorage.managedBucket(glue.S3TableEncryption.kms()),
   // ...
   database: myDatabase,
   columns: [{
@@ -1087,8 +1151,7 @@ new glue.S3Table(this, 'MyTable', {
 
 // with an explicit KMS key
 new glue.S3Table(this, 'MyTable', {
-  encryption: glue.TableEncryption.KMS,
-  encryptionKey: new kms.Key(this, 'MyKey'),
+  storage: glue.S3TableStorage.managedBucket(glue.S3TableEncryption.kms(new kms.Key(this, 'MyKey'))),
   // ...
   database: myDatabase,
   columns: [{
@@ -1104,7 +1167,7 @@ new glue.S3Table(this, 'MyTable', {
 ```ts
 declare const myDatabase: glue.Database;
 new glue.S3Table(this, 'MyTable', {
-  encryption: glue.TableEncryption.KMS_MANAGED,
+  storage: glue.S3TableStorage.managedBucket(glue.S3TableEncryption.kmsManaged()),
   // ...
   database: myDatabase,
   columns: [{
@@ -1115,13 +1178,13 @@ new glue.S3Table(this, 'MyTable', {
 });
 ```
 
-* [ClientSideKms](https://docs.aws.amazon.com/AmazonS3/latest/dev/UsingClientSideEncryption.html#client-side-encryption-kms-managed-master-key-intro) - Client-side encryption (`CSE-KMS`) with an AWS KMS Key managed by the account owner.
+Client-side encryption ([CSE-KMS](https://docs.aws.amazon.com/AmazonS3/latest/dev/UsingClientSideEncryption.html#client-side-encryption-kms-managed-master-key-intro)) is independent of the bucket's server-side encryption and works with either a managed or an existing bucket. Configure it with `clientSideEncryption`:
 
 ```ts
 declare const myDatabase: glue.Database;
 // KMS key is created automatically
 new glue.S3Table(this, 'MyTable', {
-  encryption: glue.TableEncryption.CLIENT_SIDE_KMS, 
+  clientSideEncryption: glue.TableClientSideEncryption.kms(),
   // ...
   database: myDatabase,
   columns: [{
@@ -1133,8 +1196,7 @@ new glue.S3Table(this, 'MyTable', {
 
 // with an explicit KMS key
 new glue.S3Table(this, 'MyTable', {
-  encryption: glue.TableEncryption.CLIENT_SIDE_KMS,
-  encryptionKey: new kms.Key(this, 'MyKey'),
+  clientSideEncryption: glue.TableClientSideEncryption.kms(new kms.Key(this, 'MyKey')),
   // ...
   database: myDatabase,
   columns: [{
@@ -1145,7 +1207,29 @@ new glue.S3Table(this, 'MyTable', {
 });
 ```
 
-*Note: you cannot provide a `Bucket` when creating the `S3Table` if you wish to use server-side encryption (`KMS`, `KMS_MANAGED` or `S3_MANAGED`)*.
+To store the table's data in an existing bucket, use `glue.S3TableStorage.fromBucket(bucket)`. CDK does not manage that bucket's server-side encryption, so an encryption choice can never be paired with a provided bucket — but client-side encryption still applies.
+
+### Marking table data as encrypted
+
+Both `S3Table` and `ExternalTable` set the `has_encrypted_data` table parameter, which
+Athena reads when querying client-side (`CSE-KMS`) encrypted datasets. It defaults to `true`.
+Set `hasEncryptedData` to `false` when the underlying data is not encrypted:
+
+```ts
+declare const myDatabase: glue.Database;
+new glue.S3Table(this, 'MyTable', {
+  hasEncryptedData: false,
+  database: myDatabase,
+  columns: [{
+    name: 'col1',
+    type: glue.Schema.STRING,
+  }],
+  dataFormat: glue.DataFormat.JSON,
+});
+```
+
+Do not set `has_encrypted_data` through the free-form `parameters` map as well - a value
+there that conflicts with `hasEncryptedData` is rejected at synthesis time.
 
 ## Types
 
@@ -1166,7 +1250,7 @@ new glue.S3Table(this, 'MyTable', {
     type: glue.Schema.map(
       glue.Schema.STRING,
       glue.Schema.TIMESTAMP),
-    comment: 'map<string,string>',
+    comment: 'map<string,timestamp>',
   }, {
     name: 'struct_column',
     type: glue.Schema.struct([{
@@ -1182,6 +1266,8 @@ new glue.S3Table(this, 'MyTable', {
 });  
 ```
 
+For a type the `Schema` factories don't model, use `glue.Schema.custom('...')`, which takes the raw Glue input string.
+
 ## Public FAQ
 
 ### What are we launching today?

package/awslint.json

@@ -109,6 +109,11 @@
     "interface-extends-ref:@aws-cdk/aws-glue-alpha.ISecurityConfiguration",
     "interface-extends-ref:@aws-cdk/aws-glue-alpha.ITable",
     "interface-extends-ref:@aws-cdk/aws-glue-alpha.IWorkflow",
-    "prefer-ref-interface:@aws-cdk/aws-glue-alpha.DatabaseProps.catalog"
+    "prefer-ref-interface:@aws-cdk/aws-glue-alpha.DatabaseProps.catalog",
+    "prefer-ref-interface:@aws-cdk/aws-glue-alpha.ConnectionProps.vpc",
+    "prefer-ref-interface:aws-cdk-lib.aws_ec2.ClientVpnEndpointOptions.securityGroups",
+    "prefer-ref-interface:aws-cdk-lib.aws_ec2.SubnetSelection.subnets",
+    "prefer-ref-interface:aws-cdk-lib.aws_ec2.InterfaceVpcEndpointOptions.securityGroups",
+    "no-unused-type:@aws-cdk/aws-glue-alpha.S3EncryptionMode"
   ]
 }

package/lib/catalog.js

@@ -74,7 +74,7 @@ var CatalogEncryptionMode;
  * @see https://docs.aws.amazon.com/glue/latest/webapi/API_EncryptionAtRest.html
  */
 class DataCatalogEncryptionAtRest {
-    static [JSII_RTTI_SYMBOL_1] = { fqn: "@aws-cdk/aws-glue-alpha.DataCatalogEncryptionAtRest", version: "2.265.0-alpha.0" };
+    static [JSII_RTTI_SYMBOL_1] = { fqn: "@aws-cdk/aws-glue-alpha.DataCatalogEncryptionAtRest", version: "2.267.0-alpha.0" };
     /**
      * Disable encryption at rest for the Data Catalog.
      */
@@ -130,7 +130,7 @@ exports.DataCatalogEncryptionAtRest = DataCatalogEncryptionAtRest;
  * construction, so a catalog either carries settings or it does not.
  */
 class CatalogBase extends core_1.Resource {
-    static [JSII_RTTI_SYMBOL_1] = { fqn: "@aws-cdk/aws-glue-alpha.CatalogBase", version: "2.265.0-alpha.0" };
+    static [JSII_RTTI_SYMBOL_1] = { fqn: "@aws-cdk/aws-glue-alpha.CatalogBase", version: "2.267.0-alpha.0" };
     _encryptionKey;
     _connectionPasswordKey;
     get encryptionKey() {
@@ -224,7 +224,7 @@ let Catalog = (() => {
             Catalog = _classThis = _classDescriptor.value;
             if (_metadata) Object.defineProperty(_classThis, Symbol.metadata, { enumerable: true, configurable: true, writable: true, value: _metadata });
         }
-        static [JSII_RTTI_SYMBOL_1] = { fqn: "@aws-cdk/aws-glue-alpha.Catalog", version: "2.265.0-alpha.0" };
+        static [JSII_RTTI_SYMBOL_1] = { fqn: "@aws-cdk/aws-glue-alpha.Catalog", version: "2.267.0-alpha.0" };
         /** Uniquely identifies this class. */
         static PROPERTY_INJECTION_ID = '@aws-cdk.aws-glue-alpha.Catalog';
         /**

package/lib/code.js

@@ -43,7 +43,7 @@ const helpers_internal_1 = require("aws-cdk-lib/core/lib/helpers-internal");
  * Represents a Glue Job's Code assets (an asset can be a scripts, a jar, a python file or any other file).
  */
 class Code {
-    static [JSII_RTTI_SYMBOL_1] = { fqn: "@aws-cdk/aws-glue-alpha.Code", version: "2.265.0-alpha.0" };
+    static [JSII_RTTI_SYMBOL_1] = { fqn: "@aws-cdk/aws-glue-alpha.Code", version: "2.267.0-alpha.0" };
     /**
      * Job code as an S3 object.
      * @param bucket The S3 bucket
@@ -68,7 +68,7 @@ exports.Code = Code;
 class S3Code extends Code {
     bucket;
     key;
-    static [JSII_RTTI_SYMBOL_1] = { fqn: "@aws-cdk/aws-glue-alpha.S3Code", version: "2.265.0-alpha.0" };
+    static [JSII_RTTI_SYMBOL_1] = { fqn: "@aws-cdk/aws-glue-alpha.S3Code", version: "2.267.0-alpha.0" };
     constructor(bucket, key) {
         super();
         this.bucket = bucket;
@@ -91,7 +91,7 @@ exports.S3Code = S3Code;
 class AssetCode extends Code {
     path;
     options;
-    static [JSII_RTTI_SYMBOL_1] = { fqn: "@aws-cdk/aws-glue-alpha.AssetCode", version: "2.265.0-alpha.0" };
+    static [JSII_RTTI_SYMBOL_1] = { fqn: "@aws-cdk/aws-glue-alpha.AssetCode", version: "2.267.0-alpha.0" };
     asset;
     /**
      * @param path The path to the Code file.

package/lib/connection.d.ts

@@ -1,4 +1,5 @@
 import type * as ec2 from 'aws-cdk-lib/aws-ec2';
+import type { ISecretRef } from 'aws-cdk-lib/aws-secretsmanager';
 import * as cdk from 'aws-cdk-lib/core';
 import type * as constructs from 'constructs';
 /**
@@ -219,6 +220,17 @@ export interface ConnectionOptions {
     readonly properties?: {
         [key: string]: string;
     };
+    /**
+     * A reference to a Secrets Manager secret holding the credentials for this connection.
+     *
+     * The secret is referenced through the connection's `SECRET_ID` property, so
+     * Glue reads the credentials at runtime and the secret value never appears in
+     * the synthesized template. Prefer this over placing credentials directly in
+     * `properties`. Accepts any `secretsmanager.ISecret`.
+     *
+     * @default - no secret; any credentials must be supplied via `properties`
+     */
+    readonly secret?: ISecretRef;
     /**
      * A list of criteria that can be used in selecting this connection.
      * This is useful for filtering the results of https://awscli.amazonaws.com/v2/documentation/api/latest/reference/glue/get-connections.html
@@ -232,9 +244,32 @@ export interface ConnectionOptions {
     readonly securityGroups?: ec2.ISecurityGroup[];
     /**
      * The VPC subnet to connect to resources within a VPC. See more at https://docs.aws.amazon.com/glue/latest/dg/start-connecting.html.
-     * @default no subnet
+     *
+     * Mutually exclusive with `vpc`: provide `subnet` to pin the connection to a
+     * specific subnet, or provide `vpc` (optionally with `vpcSubnets`) to let the
+     * CDK select one for you.
+     *
+     * @default - no subnet, unless `vpc` is provided
      */
     readonly subnet?: ec2.ISubnet;
+    /**
+     * The VPC to connect to resources within. When provided, the CDK selects a
+     * subnet from this VPC using `vpcSubnets`. A Glue connection targets a single
+     * subnet, so the first subnet of the selection is used.
+     *
+     * Mutually exclusive with `subnet`.
+     *
+     * @default - no VPC, the subnet is taken from `subnet` if provided
+     */
+    readonly vpc?: ec2.IVpc;
+    /**
+     * Which subnets of `vpc` to select the connection subnet from. Only used when
+     * `vpc` is provided. Since a Glue connection targets a single subnet, the
+     * first subnet of the selection is used.
+     *
+     * @default - private subnets
+     */
+    readonly vpcSubnets?: ec2.SubnetSelection;
 }
 /**
  * Construction properties for `Connection`
@@ -271,6 +306,11 @@ export declare class Connection extends cdk.Resource implements IConnection {
     private readonly properties;
     private readonly resource;
     constructor(scope: constructs.Construct, id: string, props: ConnectionProps);
+    /**
+     * Determines the single subnet the connection should target, either from an
+     * explicit `subnet` or by selecting one from `vpc`.
+     */
+    private resolveSubnet;
     /**
      * The name of the connection
      */