@aws-cdk/integ-runner 2.186.0 → 2.186.2

package/lib/recommended-feature-flags.json

@@ -66,5 +66,7 @@
   "@aws-cdk/aws-iam:oidcRejectUnauthorizedConnections": true,
   "@aws-cdk/core:enableAdditionalMetadataCollection": true,
   "@aws-cdk/aws-lambda:createNewPoliciesWithAddToRolePolicy": true,
-  "@aws-cdk/aws-s3:setUniqueReplicationRoleName": true
+  "@aws-cdk/aws-s3:setUniqueReplicationRoleName": true,
+  "@aws-cdk/aws-events:requireEventBusPolicySid": true,
+  "@aws-cdk/aws-dynamodb:retainTableReplica": true
 }

package/lib/runner/runner-base.d.ts

@@ -282,4 +282,6 @@ export declare function currentlyRecommendedAwsCdkLibFlags(): {
     "@aws-cdk/core:enableAdditionalMetadataCollection": boolean;
     "@aws-cdk/aws-lambda:createNewPoliciesWithAddToRolePolicy": boolean;
     "@aws-cdk/aws-s3:setUniqueReplicationRoleName": boolean;
+    "@aws-cdk/aws-events:requireEventBusPolicySid": boolean;
+    "@aws-cdk/aws-dynamodb:retainTableReplica": boolean;
 };

package/lib/workers/extract/index.js

@@ -1450,7 +1450,7 @@ var require_cxapi = __commonJS({
   "../../../node_modules/@aws-cdk/cx-api/lib/cxapi.js"(exports2) {
     "use strict";
     Object.defineProperty(exports2, "__esModule", { value: true });
-    exports2.SSMPARAM_NO_INVALIDATE = exports2.PROVIDER_ERROR_KEY = exports2.CLI_VERSION_ENV = exports2.CLI_ASM_VERSION_ENV = exports2.DEFAULT_REGION_ENV = exports2.DEFAULT_ACCOUNT_ENV = exports2.CONTEXT_OVERFLOW_LOCATION_ENV = exports2.CONTEXT_ENV = exports2.OUTDIR_ENV = void 0;
+    exports2.SSMPARAM_NO_INVALIDATE = exports2.PROVIDER_ERROR_KEY = exports2.TOOLKIT_VERSION_ENV = exports2.CLI_VERSION_ENV = exports2.CLI_ASM_VERSION_ENV = exports2.DEFAULT_REGION_ENV = exports2.DEFAULT_ACCOUNT_ENV = exports2.CONTEXT_OVERFLOW_LOCATION_ENV = exports2.CONTEXT_ENV = exports2.OUTDIR_ENV = void 0;
     exports2.OUTDIR_ENV = "CDK_OUTDIR";
     exports2.CONTEXT_ENV = "CDK_CONTEXT_JSON";
     exports2.CONTEXT_OVERFLOW_LOCATION_ENV = "CONTEXT_OVERFLOW_LOCATION_ENV";
@@ -1458,6 +1458,7 @@ var require_cxapi = __commonJS({
     exports2.DEFAULT_REGION_ENV = "CDK_DEFAULT_REGION";
     exports2.CLI_ASM_VERSION_ENV = "CDK_CLI_ASM_VERSION";
     exports2.CLI_VERSION_ENV = "CDK_CLI_VERSION";
+    exports2.TOOLKIT_VERSION_ENV = "CDK_TOOLKIT_VERSION";
     exports2.PROVIDER_ERROR_KEY = "$providerError";
     exports2.SSMPARAM_NO_INVALIDATE = "[cdk:skip]";
   }
@@ -5054,7 +5055,7 @@ var require_semver2 = __commonJS({
 // ../cloud-assembly-schema/cli-version.json
 var require_cli_version = __commonJS({
   "../cloud-assembly-schema/cli-version.json"(exports2, module2) {
-    module2.exports = { version: "2.1006.0" };
+    module2.exports = { version: "3.0.0" };
   }
 });
 
@@ -5423,7 +5424,12 @@ var require_cloud_assembly_schema = __commonJS({
               ]
             },
             displayName: {
-              description: "A string that represents this artifact. Should only be used in user interfaces. (Default - no display name)",
+              description: `A string that can be shown to a user to uniquely identify this artifact inside a cloud assembly tree
+
+Is used by the CLI to present a list of stacks to the user in a way that
+makes sense to them. Even though the property name "display name" doesn't
+imply it, this field is used to select stacks as well, so all stacks should
+have a unique display name. (Default - no display name)`,
               type: "string"
             }
           },
@@ -6364,19 +6370,19 @@ var require_cloud_assembly_schema = __commonJS({
           ]
         },
         CcApiContextQuery: {
-          description: "Query input for lookup up Cloudformation resources using CC API",
+          description: "Query input for lookup up CloudFormation resources using CC API",
           type: "object",
           properties: {
             typeName: {
-              description: "The Cloudformation resource type.\nSee https://docs.aws.amazon.com/cloudcontrolapi/latest/userguide/supported-resources.html",
+              description: "The CloudFormation resource type.\nSee https://docs.aws.amazon.com/cloudcontrolapi/latest/userguide/supported-resources.html",
               type: "string"
             },
             exactIdentifier: {
-              description: "Identifier of the resource to look up using `GetResource`.\n\nSpecifying exactIdentifier will return exactly one result, or throw an error. (Default - Either exactIdentifier or propertyMatch should be specified.)",
+              description: "Identifier of the resource to look up using `GetResource`.\n\nSpecifying exactIdentifier will return exactly one result, or throw an error\nunless `ignoreErrorOnMissingContext` is set. (Default - Either exactIdentifier or propertyMatch should be specified.)",
               type: "string"
             },
             propertyMatch: {
-              description: "Returns any resources matching these properties, using `ListResources`.\n\nSpecifying propertyMatch will return 0 or more results.\n\n## Notes on property completeness\n\nCloudControl API's `ListResources` may return fewer properties than\n`GetResource` would, depending on the resource implementation.\n\nThe resources that `propertyMatch` matches against will *only ever* be the\nproperties returned by the `ListResources` call. (Default - Either exactIdentifier or propertyMatch should be specified.)",
+              description: "Returns any resources matching these properties, using `ListResources`.\n\nBy default, specifying propertyMatch will successfully return 0 or more\nresults. To throw an error if the number of results is unexpected (and\nprevent the query results from being committed to context), specify\n`expectedMatchCount`.\n\n## Notes on property completeness\n\nCloudControl API's `ListResources` may return fewer properties than\n`GetResource` would, depending on the resource implementation.\n\nThe resources that `propertyMatch` matches against will *only ever* be the\nproperties returned by the `ListResources` call. (Default - Either exactIdentifier or propertyMatch should be specified.)",
               $ref: "#/definitions/Record<string,unknown>"
             },
             propertiesToReturn: {
@@ -6386,11 +6392,21 @@ var require_cloud_assembly_schema = __commonJS({
                 type: "string"
               }
             },
+            expectedMatchCount: {
+              description: "Expected count of results if `propertyMatch` is specified.\n\nIf the expected result count does not match the actual count,\nby default an error is produced and the result is not committed to cached\ncontext, and the user can correct the situation and try again without\nhaving to manually clear out the context key using `cdk context --remove`\n\nIf the value of * `ignoreErrorOnMissingContext` is `true`, the value of\n`expectedMatchCount` is `at-least-one | exactly-one` and the number\nof found resources is 0, `dummyValue` is returned and committed to context\ninstead. (Default 'any')",
+              enum: [
+                "any",
+                "at-least-one",
+                "at-most-one",
+                "exactly-one"
+              ],
+              type: "string"
+            },
             dummyValue: {
               description: "The value to return if the resource was not found and `ignoreErrorOnMissingContext` is true.\n\nIf supplied, `dummyValue` should be an array of objects.\n\n`dummyValue` does not have to have elements, and it may have objects with\ndifferent properties than the properties in `propertiesToReturn`, but it\nwill be easiest for downstream code if the `dummyValue` conforms to\nthe expected response shape. (Default - No dummy value available)"
             },
             ignoreErrorOnMissingContext: {
-              description: "Ignore an error and return the `dummyValue` instead if the resource was not found.\n\n- In case of an `exactIdentifier` lookup, return the `dummyValue` if the resource with\n  that identifier was not found.\n- In case of a `propertyMatch` lookup, this setting currently does not have any effect,\n  as `propertyMatch` queries can legally return 0 resources.\n\nif `ignoreErrorOnMissingContext` is set, `dummyValue` should be set and be an array.",
+              description: "Ignore an error and return the `dummyValue` instead if the resource was not found.\n\n- In case of an `exactIdentifier` lookup, return the `dummyValue` if the resource with\n  that identifier was not found.\n- In case of a `propertyMatch` lookup, return the `dummyValue` if `expectedMatchCount`\n  is `at-least-one | exactly-one` and the number of resources found was 0.\n\nif `ignoreErrorOnMissingContext` is set, `dummyValue` should be set and be an array.",
               default: false,
               type: "boolean"
             },
@@ -6965,8 +6981,8 @@ var require_integ_schema = __commonJS({
 var require_version = __commonJS({
   "../cloud-assembly-schema/schema/version.json"(exports2, module2) {
     module2.exports = {
-      schemaHash: "5683db246fac20b864d94d7bceef24ebda1a38c8c1f8ef0d5978534097dc9504",
-      revision: 42
+      schemaHash: "96958a4c40e0a00e850f0c14dd6e9c0fc8db0b075f1f155cea41ab198c0514be",
+      revision: 43
     };
   }
 });
@@ -7497,7 +7513,7 @@ var require_cloud_artifact = __commonJS({
     };
     exports2.CloudArtifact = CloudArtifact;
     _a = JSII_RTTI_SYMBOL_1;
-    CloudArtifact[_a] = { fqn: "@aws-cdk/cx-api.CloudArtifact", version: "2.185.0" };
+    CloudArtifact[_a] = { fqn: "@aws-cdk/cx-api.CloudArtifact", version: "2.187.0" };
   }
 });
 
@@ -7567,7 +7583,7 @@ var require_asset_manifest_artifact = __commonJS({
     };
     exports2.AssetManifestArtifact = AssetManifestArtifact;
     _a = JSII_RTTI_SYMBOL_1;
-    AssetManifestArtifact[_a] = { fqn: "@aws-cdk/cx-api.AssetManifestArtifact", version: "2.185.0" };
+    AssetManifestArtifact[_a] = { fqn: "@aws-cdk/cx-api.AssetManifestArtifact", version: "2.187.0" };
     Object.defineProperty(AssetManifestArtifact.prototype, ASSET_MANIFEST_ARTIFACT_SYM, {
       value: true,
       enumerable: false,
@@ -7615,7 +7631,7 @@ var require_environment2 = __commonJS({
     };
     exports2.EnvironmentUtils = EnvironmentUtils;
     _a = JSII_RTTI_SYMBOL_1;
-    EnvironmentUtils[_a] = { fqn: "@aws-cdk/cx-api.EnvironmentUtils", version: "2.185.0" };
+    EnvironmentUtils[_a] = { fqn: "@aws-cdk/cx-api.EnvironmentUtils", version: "2.187.0" };
   }
 });
 
@@ -7721,7 +7737,7 @@ var require_cloudformation_artifact = __commonJS({
     };
     exports2.CloudFormationStackArtifact = CloudFormationStackArtifact;
     _a = JSII_RTTI_SYMBOL_1;
-    CloudFormationStackArtifact[_a] = { fqn: "@aws-cdk/cx-api.CloudFormationStackArtifact", version: "2.185.0" };
+    CloudFormationStackArtifact[_a] = { fqn: "@aws-cdk/cx-api.CloudFormationStackArtifact", version: "2.187.0" };
     Object.defineProperty(CloudFormationStackArtifact.prototype, CLOUDFORMATION_STACK_ARTIFACT_SYM, {
       value: true,
       enumerable: false,
@@ -7786,7 +7802,7 @@ var require_nested_cloud_assembly_artifact = __commonJS({
     };
     exports2.NestedCloudAssemblyArtifact = NestedCloudAssemblyArtifact;
     _a = JSII_RTTI_SYMBOL_1;
-    NestedCloudAssemblyArtifact[_a] = { fqn: "@aws-cdk/cx-api.NestedCloudAssemblyArtifact", version: "2.185.0" };
+    NestedCloudAssemblyArtifact[_a] = { fqn: "@aws-cdk/cx-api.NestedCloudAssemblyArtifact", version: "2.187.0" };
     Object.defineProperty(NestedCloudAssemblyArtifact.prototype, NESTED_CLOUD_ASSEMBLY_SYM, {
       value: true,
       enumerable: false,
@@ -7847,7 +7863,7 @@ var require_tree_cloud_artifact = __commonJS({
     };
     exports2.TreeCloudArtifact = TreeCloudArtifact;
     _a = JSII_RTTI_SYMBOL_1;
-    TreeCloudArtifact[_a] = { fqn: "@aws-cdk/cx-api.TreeCloudArtifact", version: "2.185.0" };
+    TreeCloudArtifact[_a] = { fqn: "@aws-cdk/cx-api.TreeCloudArtifact", version: "2.187.0" };
     Object.defineProperty(TreeCloudArtifact.prototype, TREE_CLOUD_ARTIFACT_SYM, {
       value: true,
       enumerable: false,
@@ -8113,7 +8129,7 @@ var require_cloud_assembly = __commonJS({
     };
     exports2.CloudAssembly = CloudAssembly;
     _a = JSII_RTTI_SYMBOL_1;
-    CloudAssembly[_a] = { fqn: "@aws-cdk/cx-api.CloudAssembly", version: "2.185.0" };
+    CloudAssembly[_a] = { fqn: "@aws-cdk/cx-api.CloudAssembly", version: "2.187.0" };
     var CloudAssemblyBuilder = class _CloudAssemblyBuilder {
       /**
        * Initializes a cloud assembly builder.
@@ -8207,7 +8223,7 @@ var require_cloud_assembly = __commonJS({
     };
     exports2.CloudAssemblyBuilder = CloudAssemblyBuilder;
     _b = JSII_RTTI_SYMBOL_1;
-    CloudAssemblyBuilder[_b] = { fqn: "@aws-cdk/cx-api.CloudAssemblyBuilder", version: "2.185.0" };
+    CloudAssemblyBuilder[_b] = { fqn: "@aws-cdk/cx-api.CloudAssemblyBuilder", version: "2.187.0" };
     function filterUndefined(obj) {
       if (Array.isArray(obj)) {
         return obj.filter((x) => x !== void 0).map((x) => filterUndefined(x));
@@ -8336,7 +8352,7 @@ var require_features = __commonJS({
     "use strict";
     Object.defineProperty(exports2, "__esModule", { value: true });
     exports2.LAMBDA_NODEJS_USE_LATEST_RUNTIME = exports2.ENABLE_OPENSEARCH_MULTIAZ_WITH_STANDBY = exports2.AUTOSCALING_GENERATE_LAUNCH_TEMPLATE = exports2.EFS_MOUNTTARGET_ORDERINSENSITIVE_LOGICAL_ID = exports2.EFS_DENY_ANONYMOUS_ACCESS = exports2.KMS_ALIAS_NAME_REF = exports2.INCLUDE_PREFIX_IN_UNIQUE_NAME_GENERATION = exports2.APIGATEWAY_REQUEST_VALIDATOR_UNIQUE_ID = exports2.EC2_RESTRICT_DEFAULT_SECURITY_GROUP = exports2.ENABLE_EMR_SERVICE_POLICY_V2 = exports2.REDSHIFT_COLUMN_ID = exports2.SECRETS_MANAGER_TARGET_ATTACHMENT_RESOURCE_POLICY = exports2.EC2_LAUNCH_TEMPLATE_DEFAULT_USER_DATA = exports2.APIGATEWAY_AUTHORIZER_CHANGE_DEPLOYMENT_LOGICAL_ID = exports2.CODEDEPLOY_REMOVE_ALARMS_FROM_DEPLOYMENT_GROUP = exports2.DATABASE_PROXY_UNIQUE_RESOURCE_NAME = exports2.AWS_CUSTOM_RESOURCE_LATEST_SDK_DEFAULT = exports2.ROUTE53_PATTERNS_USE_CERTIFICATE = exports2.S3_SERVER_ACCESS_LOGS_USE_BUCKET_POLICY = exports2.ECS_DISABLE_EXPLICIT_DEPLOYMENT_CONTROLLER_FOR_CIRCUIT_BREAKER = exports2.EVENTS_TARGET_QUEUE_SAME_ACCOUNT = exports2.ENABLE_PARTITION_LITERALS = exports2.APIGATEWAY_DISABLE_CLOUDWATCH_ROLE = exports2.SNS_SUBSCRIPTIONS_SQS_DECRYPTION_POLICY = exports2.S3_CREATE_DEFAULT_LOGGING_POLICY = exports2.CODEPIPELINE_CROSS_ACCOUNT_KEY_ALIAS_STACK_SAFE_RESOURCE_NAME = exports2.VALIDATE_SNAPSHOT_REMOVAL_POLICY = exports2.IAM_IMPORTED_ROLE_STACK_SAFE_DEFAULT_POLICY_NAME = exports2.IAM_MINIMIZE_POLICIES = exports2.ECS_ARN_FORMAT_INCLUDES_CLUSTER_NAME = exports2.EC2_UNIQUE_IMDSV2_LAUNCH_TEMPLATE_NAME = exports2.ECS_SERVICE_EXTENSIONS_ENABLE_DEFAULT_LOG_DRIVER = exports2.TARGET_PARTITIONS = exports2.CHECK_SECRET_USAGE = exports2.CLOUDFRONT_DEFAULT_SECURITY_POLICY_TLS_V1_2_2021 = exports2.LAMBDA_RECOGNIZE_LAYER_VERSION = exports2.LAMBDA_RECOGNIZE_VERSION_PROPS = exports2.EFS_DEFAULT_ENCRYPTION_AT_REST = exports2.APIGATEWAY_USAGEPLANKEY_ORDERINSENSITIVE_ID = exports2.RDS_LOWERCASE_DB_IDENTIFIER = exports2.ECS_REMOVE_DEFAULT_DESIRED_COUNT = exports2.S3_GRANT_WRITE_WITHOUT_ACL = exports2.KMS_DEFAULT_KEY_POLICIES = exports2.SECRETS_MANAGER_PARSE_OWNED_SECRET_NAME = exports2.DOCKER_IGNORE_SUPPORT = exports2.STACK_RELATIVE_EXPORTS_CONTEXT = exports2.NEW_STYLE_STACK_SYNTHESIS_CONTEXT = exports2.ENABLE_DIFF_NO_FAIL = exports2.ENABLE_DIFF_NO_FAIL_CONTEXT = exports2.ENABLE_STACK_NAME_DUPLICATES_CONTEXT = void 0;
-    exports2.NEW_PROJECT_DEFAULT_CONTEXT = exports2.FUTURE_FLAGS = exports2.FUTURE_FLAGS_EXPIRED = exports2.CURRENT_VERSION_FLAG_DEFAULTS = exports2.CURRENTLY_RECOMMENDED_FLAGS = exports2.CURRENT_VERSION_EXPIRED_FLAGS = exports2.FLAGS = exports2.PIPELINE_REDUCE_STAGE_ROLE_TRUST_SCOPE = exports2.SET_UNIQUE_REPLICATION_ROLE_NAME = exports2.LAMBDA_CREATE_NEW_POLICIES_WITH_ADDTOROLEPOLICY = exports2.ENABLE_ADDITIONAL_METADATA_COLLECTION = exports2.IAM_OIDC_REJECT_UNAUTHORIZED_CONNECTIONS = exports2.ALB_DUALSTACK_WITHOUT_PUBLIC_IPV4_SECURITY_GROUP_RULES_DEFAULT = exports2.Disable_ECS_IMDS_Blocking = exports2.Enable_IMDS_Blocking_Deprecated_Feature = exports2.USER_POOL_DOMAIN_NAME_METHOD_WITHOUT_CUSTOM_RESOURCE = exports2.ASPECT_STABILIZATION = exports2.BASTION_HOST_USE_AMAZON_LINUX_2023_BY_DEFAULT = exports2.STEPFUNCTIONS_TASKS_FIX_RUN_ECS_TASK_POLICY = exports2.LAMBDA_NODEJS_SDK_V3_EXCLUDE_SMITHY_PACKAGES = exports2.CFN_INCLUDE_REJECT_COMPLEX_RESOURCE_UPDATE_CREATE_POLICY_INTRINSICS = exports2.USE_CORRECT_VALUE_FOR_INSTANCE_RESOURCE_ID_PROPERTY = exports2.APPSYNC_GRAPHQLAPI_SCOPE_LAMBDA_FUNCTION_PERMISSION = exports2.EC2_SUM_TIMEOUT_ENABLED = exports2.DYNAMODB_TABLEV2_RESOURCE_POLICY_PER_REPLICA = exports2.REDUCE_EC2_FARGATE_CLOUDWATCH_PERMISSIONS = exports2.USE_NEW_S3URI_PARAMETERS_FOR_BEDROCK_INVOKE_MODEL_TASK = exports2.S3_KEEP_NOTIFICATION_IN_IMPORTED_BUCKET = exports2.LOG_API_RESPONSE_DATA_PROPERTY_TRUE_DEFAULT = exports2.ECS_REMOVE_DEFAULT_DEPLOYMENT_ALARM = exports2.EBS_DEFAULT_GP3 = exports2.EKS_NODEGROUP_NAME = exports2.PIPELINE_REDUCE_ASSET_ROLE_TRUST_SCOPE = exports2.KMS_REDUCE_CROSS_ACCOUNT_REGION_POLICY_SCOPE = exports2.CODEPIPELINE_DEFAULT_PIPELINE_TYPE_TO_V2 = exports2.CODEPIPELINE_CROSS_ACCOUNT_KEYS_DEFAULT_VALUE_TO_FALSE = exports2.LAMBDA_PERMISSION_LOGICAL_ID_FOR_LAMBDA_ACTION = exports2.CODECOMMIT_SOURCE_ACTION_DEFAULT_BRANCH_NAME = exports2.APPSYNC_ENABLE_USE_ARN_IDENTIFIER_SOURCE_API_ASSOCIATION = exports2.AURORA_CLUSTER_CHANGE_SCOPE_OF_INSTANCE_PARAMETER_GROUP_WITH_EACH_PARAMETERS = exports2.RDS_PREVENT_RENDERING_DEPRECATED_CREDENTIALS = void 0;
+    exports2.NEW_PROJECT_DEFAULT_CONTEXT = exports2.FUTURE_FLAGS = exports2.FUTURE_FLAGS_EXPIRED = exports2.CURRENT_VERSION_FLAG_DEFAULTS = exports2.CURRENTLY_RECOMMENDED_FLAGS = exports2.CURRENT_VERSION_EXPIRED_FLAGS = exports2.FLAGS = exports2.LOG_USER_POOL_CLIENT_SECRET_VALUE = exports2.DYNAMODB_TABLE_RETAIN_TABLE_REPLICA = exports2.EVENTBUS_POLICY_SID_REQUIRED = exports2.PIPELINE_REDUCE_STAGE_ROLE_TRUST_SCOPE = exports2.SET_UNIQUE_REPLICATION_ROLE_NAME = exports2.LAMBDA_CREATE_NEW_POLICIES_WITH_ADDTOROLEPOLICY = exports2.ENABLE_ADDITIONAL_METADATA_COLLECTION = exports2.IAM_OIDC_REJECT_UNAUTHORIZED_CONNECTIONS = exports2.ALB_DUALSTACK_WITHOUT_PUBLIC_IPV4_SECURITY_GROUP_RULES_DEFAULT = exports2.Disable_ECS_IMDS_Blocking = exports2.Enable_IMDS_Blocking_Deprecated_Feature = exports2.USER_POOL_DOMAIN_NAME_METHOD_WITHOUT_CUSTOM_RESOURCE = exports2.ASPECT_STABILIZATION = exports2.BASTION_HOST_USE_AMAZON_LINUX_2023_BY_DEFAULT = exports2.STEPFUNCTIONS_TASKS_FIX_RUN_ECS_TASK_POLICY = exports2.LAMBDA_NODEJS_SDK_V3_EXCLUDE_SMITHY_PACKAGES = exports2.CFN_INCLUDE_REJECT_COMPLEX_RESOURCE_UPDATE_CREATE_POLICY_INTRINSICS = exports2.USE_CORRECT_VALUE_FOR_INSTANCE_RESOURCE_ID_PROPERTY = exports2.APPSYNC_GRAPHQLAPI_SCOPE_LAMBDA_FUNCTION_PERMISSION = exports2.EC2_SUM_TIMEOUT_ENABLED = exports2.DYNAMODB_TABLEV2_RESOURCE_POLICY_PER_REPLICA = exports2.REDUCE_EC2_FARGATE_CLOUDWATCH_PERMISSIONS = exports2.USE_NEW_S3URI_PARAMETERS_FOR_BEDROCK_INVOKE_MODEL_TASK = exports2.S3_KEEP_NOTIFICATION_IN_IMPORTED_BUCKET = exports2.LOG_API_RESPONSE_DATA_PROPERTY_TRUE_DEFAULT = exports2.ECS_REMOVE_DEFAULT_DEPLOYMENT_ALARM = exports2.EBS_DEFAULT_GP3 = exports2.EKS_NODEGROUP_NAME = exports2.PIPELINE_REDUCE_ASSET_ROLE_TRUST_SCOPE = exports2.KMS_REDUCE_CROSS_ACCOUNT_REGION_POLICY_SCOPE = exports2.CODEPIPELINE_DEFAULT_PIPELINE_TYPE_TO_V2 = exports2.CODEPIPELINE_CROSS_ACCOUNT_KEYS_DEFAULT_VALUE_TO_FALSE = exports2.LAMBDA_PERMISSION_LOGICAL_ID_FOR_LAMBDA_ACTION = exports2.CODECOMMIT_SOURCE_ACTION_DEFAULT_BRANCH_NAME = exports2.APPSYNC_ENABLE_USE_ARN_IDENTIFIER_SOURCE_API_ASSOCIATION = exports2.AURORA_CLUSTER_CHANGE_SCOPE_OF_INSTANCE_PARAMETER_GROUP_WITH_EACH_PARAMETERS = exports2.RDS_PREVENT_RENDERING_DEPRECATED_CREDENTIALS = void 0;
     exports2.futureFlagDefault = futureFlagDefault;
     var flag_modeling_1 = require_flag_modeling();
     exports2.ENABLE_STACK_NAME_DUPLICATES_CONTEXT = "@aws-cdk/core:enableStackNameDuplicates";
@@ -8423,6 +8439,9 @@ var require_features = __commonJS({
     exports2.LAMBDA_CREATE_NEW_POLICIES_WITH_ADDTOROLEPOLICY = "@aws-cdk/aws-lambda:createNewPoliciesWithAddToRolePolicy";
     exports2.SET_UNIQUE_REPLICATION_ROLE_NAME = "@aws-cdk/aws-s3:setUniqueReplicationRoleName";
     exports2.PIPELINE_REDUCE_STAGE_ROLE_TRUST_SCOPE = "@aws-cdk/pipelines:reduceStageRoleTrustScope";
+    exports2.EVENTBUS_POLICY_SID_REQUIRED = "@aws-cdk/aws-events:requireEventBusPolicySid";
+    exports2.DYNAMODB_TABLE_RETAIN_TABLE_REPLICA = "@aws-cdk/aws-dynamodb:retainTableReplica";
+    exports2.LOG_USER_POOL_CLIENT_SECRET_VALUE = "@aws-cdk/cognito:logUserPoolClientSecretValue";
     exports2.FLAGS = {
       //////////////////////////////////////////////////////////////////////
       [exports2.ENABLE_STACK_NAME_DUPLICATES_CONTEXT]: {
@@ -9637,6 +9656,55 @@ var require_features = __commonJS({
         defaults: { v2: true },
         recommendedValue: true,
         compatibilityWithOldBehaviorMd: "Disable the feature flag to add the root account principal back"
+      },
+      //////////////////////////////////////////////////////////////////////
+      [exports2.EVENTBUS_POLICY_SID_REQUIRED]: {
+        type: flag_modeling_1.FlagType.BugFix,
+        summary: "When enabled, grantPutEventsTo() will use resource policies with Statement IDs for service principals.",
+        detailsMd: `
+      Currently, when granting permissions to service principals using grantPutEventsTo(), the operation silently fails 
+      because service principals require resource policies with Statement IDs. 
+
+      When this flag is enabled:
+      - Resource policies will be created with Statement IDs for service principals
+      - The operation will succeed as expected
+      
+      When this flag is disabled:
+      - A warning will be emitted
+      - The grant operation will be dropped
+      - No permissions will be added
+
+      This fixes the issue where permissions were silently not being added for service principals.
+    `,
+        introducedIn: { v2: "2.186.0" },
+        recommendedValue: true
+      },
+      //////////////////////////////////////////////////////////////////////
+      [exports2.DYNAMODB_TABLE_RETAIN_TABLE_REPLICA]: {
+        type: flag_modeling_1.FlagType.BugFix,
+        summary: "When enabled, table replica will be default to the removal policy of source table unless specified otherwise.",
+        detailsMd: `
+      Currently, table replica will always be deleted when stack deletes regardless of source table's deletion policy.
+      When enabled, table replica will be default to the removal policy of source table unless specified otherwise.
+    `,
+        introducedIn: { v2: "2.187.0" },
+        recommendedValue: true
+      },
+      //////////////////////////////////////////////////////////////////////
+      [exports2.LOG_USER_POOL_CLIENT_SECRET_VALUE]: {
+        type: flag_modeling_1.FlagType.ApiDefault,
+        summary: "When disabled, the value of the user pool client secret will not be logged in the custom resource lambda function logs.",
+        detailsMd: `
+      When this feature flag is enabled, the SDK API call response to desribe user pool client values will be logged in the custom 
+      resource lambda function logs.
+      
+      When this feature flag is disabled, the SDK API call response to describe user pool client values will not be logged in the custom 
+      resource lambda function logs.
+    `,
+        introducedIn: { v2: "2.187.0" },
+        defaults: { v2: false },
+        recommendedValue: false,
+        compatibilityWithOldBehaviorMd: "Enable the feature flag to keep the old behavior and log the client secret values"
       }
     };
     var CURRENT_MV = "v2";
@@ -9753,7 +9821,7 @@ var require_placeholders = __commonJS({
     };
     exports2.EnvironmentPlaceholders = EnvironmentPlaceholders;
     _a = JSII_RTTI_SYMBOL_1;
-    EnvironmentPlaceholders[_a] = { fqn: "@aws-cdk/cx-api.EnvironmentPlaceholders", version: "2.185.0" };
+    EnvironmentPlaceholders[_a] = { fqn: "@aws-cdk/cx-api.EnvironmentPlaceholders", version: "2.187.0" };
     EnvironmentPlaceholders.CURRENT_REGION = "${AWS::Region}";
     EnvironmentPlaceholders.CURRENT_ACCOUNT = "${AWS::AccountId}";
     EnvironmentPlaceholders.CURRENT_PARTITION = "${AWS::Partition}";
@@ -12614,6 +12682,7 @@ __export(recommended_feature_flags_exports, {
   "@aws-cdk/aws-codepipeline:crossAccountKeysDefaultValueToFalse": () => _aws_cdk_aws_codepipeline_crossAccountKeysDefaultValueToFalse,
   "@aws-cdk/aws-codepipeline:defaultPipelineTypeToV2": () => _aws_cdk_aws_codepipeline_defaultPipelineTypeToV2,
   "@aws-cdk/aws-dynamodb:resourcePolicyPerReplica": () => _aws_cdk_aws_dynamodb_resourcePolicyPerReplica,
+  "@aws-cdk/aws-dynamodb:retainTableReplica": () => _aws_cdk_aws_dynamodb_retainTableReplica,
   "@aws-cdk/aws-ec2:bastionHostUseAmazonLinux2023ByDefault": () => _aws_cdk_aws_ec2_bastionHostUseAmazonLinux2023ByDefault,
   "@aws-cdk/aws-ec2:ebsDefaultGp3Volume": () => _aws_cdk_aws_ec2_ebsDefaultGp3Volume,
   "@aws-cdk/aws-ec2:ec2SumTImeoutEnabled": () => _aws_cdk_aws_ec2_ec2SumTImeoutEnabled,
@@ -12631,6 +12700,7 @@ __export(recommended_feature_flags_exports, {
   "@aws-cdk/aws-eks:nodegroupNameAttribute": () => _aws_cdk_aws_eks_nodegroupNameAttribute,
   "@aws-cdk/aws-elasticloadbalancingV2:albDualstackWithoutPublicIpv4SecurityGroupRulesDefault": () => _aws_cdk_aws_elasticloadbalancingV2_albDualstackWithoutPublicIpv4SecurityGroupRulesDefault,
   "@aws-cdk/aws-events:eventsTargetQueueSameAccount": () => _aws_cdk_aws_events_eventsTargetQueueSameAccount,
+  "@aws-cdk/aws-events:requireEventBusPolicySid": () => _aws_cdk_aws_events_requireEventBusPolicySid,
   "@aws-cdk/aws-iam:importedRoleStackSafeDefaultPolicyName": () => _aws_cdk_aws_iam_importedRoleStackSafeDefaultPolicyName,
   "@aws-cdk/aws-iam:minimizePolicies": () => _aws_cdk_aws_iam_minimizePolicies,
   "@aws-cdk/aws-iam:oidcRejectUnauthorizedConnections": () => _aws_cdk_aws_iam_oidcRejectUnauthorizedConnections,
@@ -12667,7 +12737,7 @@ __export(recommended_feature_flags_exports, {
   "@aws-cdk/customresources:installLatestAwsSdkDefault": () => _aws_cdk_customresources_installLatestAwsSdkDefault,
   default: () => recommended_feature_flags_default
 });
-var _aws_cdk_aws_lambda_recognizeLayerVersion, _aws_cdk_core_checkSecretUsage, _aws_cdk_core_target_partitions, _aws_cdk_containers_ecs_service_extensions_enableDefaultLogDriver, _aws_cdk_aws_ec2_uniqueImdsv2TemplateName, _aws_cdk_aws_ecs_arnFormatIncludesClusterName, _aws_cdk_aws_iam_minimizePolicies, _aws_cdk_core_validateSnapshotRemovalPolicy, _aws_cdk_aws_codepipeline_crossAccountKeyAliasStackSafeResourceName, _aws_cdk_aws_s3_createDefaultLoggingPolicy, _aws_cdk_aws_sns_subscriptions_restrictSqsDescryption, _aws_cdk_aws_apigateway_disableCloudWatchRole, _aws_cdk_core_enablePartitionLiterals, _aws_cdk_aws_events_eventsTargetQueueSameAccount, _aws_cdk_aws_ecs_disableExplicitDeploymentControllerForCircuitBreaker, _aws_cdk_aws_iam_importedRoleStackSafeDefaultPolicyName, _aws_cdk_aws_s3_serverAccessLogsUseBucketPolicy, _aws_cdk_aws_route53_patters_useCertificate, _aws_cdk_customresources_installLatestAwsSdkDefault, _aws_cdk_aws_rds_databaseProxyUniqueResourceName, _aws_cdk_aws_codedeploy_removeAlarmsFromDeploymentGroup, _aws_cdk_aws_apigateway_authorizerChangeDeploymentLogicalId, _aws_cdk_aws_ec2_launchTemplateDefaultUserData, _aws_cdk_aws_secretsmanager_useAttachedSecretResourcePolicyForSecretTargetAttachments, _aws_cdk_aws_redshift_columnId, _aws_cdk_aws_stepfunctions_tasks_enableEmrServicePolicyV2, _aws_cdk_aws_ec2_restrictDefaultSecurityGroup, _aws_cdk_aws_apigateway_requestValidatorUniqueId, _aws_cdk_aws_kms_aliasNameRef, _aws_cdk_aws_autoscaling_generateLaunchTemplateInsteadOfLaunchConfig, _aws_cdk_core_includePrefixInUniqueNameGeneration, _aws_cdk_aws_efs_denyAnonymousAccess, _aws_cdk_aws_opensearchservice_enableOpensearchMultiAzWithStandby, _aws_cdk_aws_lambda_nodejs_useLatestRuntimeVersion, _aws_cdk_aws_efs_mountTargetOrderInsensitiveLogicalId, _aws_cdk_aws_rds_auroraClusterChangeScopeOfInstanceParameterGroupWithEachParameters, _aws_cdk_aws_appsync_useArnForSourceApiAssociationIdentifier, _aws_cdk_aws_rds_preventRenderingDeprecatedCredentials, _aws_cdk_aws_codepipeline_actions_useNewDefaultBranchForCodeCommitSource, _aws_cdk_aws_cloudwatch_actions_changeLambdaPermissionLogicalIdForLambdaAction, _aws_cdk_aws_codepipeline_crossAccountKeysDefaultValueToFalse, _aws_cdk_aws_codepipeline_defaultPipelineTypeToV2, _aws_cdk_aws_kms_reduceCrossAccountRegionPolicyScope, _aws_cdk_aws_eks_nodegroupNameAttribute, _aws_cdk_aws_ec2_ebsDefaultGp3Volume, _aws_cdk_aws_ecs_removeDefaultDeploymentAlarm, _aws_cdk_custom_resources_logApiResponseDataPropertyTrueDefault, _aws_cdk_aws_s3_keepNotificationInImportedBucket, _aws_cdk_aws_ecs_enableImdsBlockingDeprecatedFeature, _aws_cdk_aws_ecs_disableEcsImdsBlocking, _aws_cdk_aws_ecs_reduceEc2FargateCloudWatchPermissions, _aws_cdk_aws_dynamodb_resourcePolicyPerReplica, _aws_cdk_aws_ec2_ec2SumTImeoutEnabled, _aws_cdk_aws_appsync_appSyncGraphQLAPIScopeLambdaPermission, _aws_cdk_aws_rds_setCorrectValueForDatabaseInstanceReadReplicaInstanceResourceId, _aws_cdk_core_cfnIncludeRejectComplexResourceUpdateCreatePolicyIntrinsics, _aws_cdk_aws_lambda_nodejs_sdkV3ExcludeSmithyPackages, _aws_cdk_aws_stepfunctions_tasks_fixRunEcsTaskPolicy, _aws_cdk_aws_ec2_bastionHostUseAmazonLinux2023ByDefault, _aws_cdk_aws_route53_targets_userPoolDomainNameMethodWithoutCustomResource, _aws_cdk_aws_elasticloadbalancingV2_albDualstackWithoutPublicIpv4SecurityGroupRulesDefault, _aws_cdk_aws_iam_oidcRejectUnauthorizedConnections, _aws_cdk_core_enableAdditionalMetadataCollection, _aws_cdk_aws_lambda_createNewPoliciesWithAddToRolePolicy, _aws_cdk_aws_s3_setUniqueReplicationRoleName, recommended_feature_flags_default;
+var _aws_cdk_aws_lambda_recognizeLayerVersion, _aws_cdk_core_checkSecretUsage, _aws_cdk_core_target_partitions, _aws_cdk_containers_ecs_service_extensions_enableDefaultLogDriver, _aws_cdk_aws_ec2_uniqueImdsv2TemplateName, _aws_cdk_aws_ecs_arnFormatIncludesClusterName, _aws_cdk_aws_iam_minimizePolicies, _aws_cdk_core_validateSnapshotRemovalPolicy, _aws_cdk_aws_codepipeline_crossAccountKeyAliasStackSafeResourceName, _aws_cdk_aws_s3_createDefaultLoggingPolicy, _aws_cdk_aws_sns_subscriptions_restrictSqsDescryption, _aws_cdk_aws_apigateway_disableCloudWatchRole, _aws_cdk_core_enablePartitionLiterals, _aws_cdk_aws_events_eventsTargetQueueSameAccount, _aws_cdk_aws_ecs_disableExplicitDeploymentControllerForCircuitBreaker, _aws_cdk_aws_iam_importedRoleStackSafeDefaultPolicyName, _aws_cdk_aws_s3_serverAccessLogsUseBucketPolicy, _aws_cdk_aws_route53_patters_useCertificate, _aws_cdk_customresources_installLatestAwsSdkDefault, _aws_cdk_aws_rds_databaseProxyUniqueResourceName, _aws_cdk_aws_codedeploy_removeAlarmsFromDeploymentGroup, _aws_cdk_aws_apigateway_authorizerChangeDeploymentLogicalId, _aws_cdk_aws_ec2_launchTemplateDefaultUserData, _aws_cdk_aws_secretsmanager_useAttachedSecretResourcePolicyForSecretTargetAttachments, _aws_cdk_aws_redshift_columnId, _aws_cdk_aws_stepfunctions_tasks_enableEmrServicePolicyV2, _aws_cdk_aws_ec2_restrictDefaultSecurityGroup, _aws_cdk_aws_apigateway_requestValidatorUniqueId, _aws_cdk_aws_kms_aliasNameRef, _aws_cdk_aws_autoscaling_generateLaunchTemplateInsteadOfLaunchConfig, _aws_cdk_core_includePrefixInUniqueNameGeneration, _aws_cdk_aws_efs_denyAnonymousAccess, _aws_cdk_aws_opensearchservice_enableOpensearchMultiAzWithStandby, _aws_cdk_aws_lambda_nodejs_useLatestRuntimeVersion, _aws_cdk_aws_efs_mountTargetOrderInsensitiveLogicalId, _aws_cdk_aws_rds_auroraClusterChangeScopeOfInstanceParameterGroupWithEachParameters, _aws_cdk_aws_appsync_useArnForSourceApiAssociationIdentifier, _aws_cdk_aws_rds_preventRenderingDeprecatedCredentials, _aws_cdk_aws_codepipeline_actions_useNewDefaultBranchForCodeCommitSource, _aws_cdk_aws_cloudwatch_actions_changeLambdaPermissionLogicalIdForLambdaAction, _aws_cdk_aws_codepipeline_crossAccountKeysDefaultValueToFalse, _aws_cdk_aws_codepipeline_defaultPipelineTypeToV2, _aws_cdk_aws_kms_reduceCrossAccountRegionPolicyScope, _aws_cdk_aws_eks_nodegroupNameAttribute, _aws_cdk_aws_ec2_ebsDefaultGp3Volume, _aws_cdk_aws_ecs_removeDefaultDeploymentAlarm, _aws_cdk_custom_resources_logApiResponseDataPropertyTrueDefault, _aws_cdk_aws_s3_keepNotificationInImportedBucket, _aws_cdk_aws_ecs_enableImdsBlockingDeprecatedFeature, _aws_cdk_aws_ecs_disableEcsImdsBlocking, _aws_cdk_aws_ecs_reduceEc2FargateCloudWatchPermissions, _aws_cdk_aws_dynamodb_resourcePolicyPerReplica, _aws_cdk_aws_ec2_ec2SumTImeoutEnabled, _aws_cdk_aws_appsync_appSyncGraphQLAPIScopeLambdaPermission, _aws_cdk_aws_rds_setCorrectValueForDatabaseInstanceReadReplicaInstanceResourceId, _aws_cdk_core_cfnIncludeRejectComplexResourceUpdateCreatePolicyIntrinsics, _aws_cdk_aws_lambda_nodejs_sdkV3ExcludeSmithyPackages, _aws_cdk_aws_stepfunctions_tasks_fixRunEcsTaskPolicy, _aws_cdk_aws_ec2_bastionHostUseAmazonLinux2023ByDefault, _aws_cdk_aws_route53_targets_userPoolDomainNameMethodWithoutCustomResource, _aws_cdk_aws_elasticloadbalancingV2_albDualstackWithoutPublicIpv4SecurityGroupRulesDefault, _aws_cdk_aws_iam_oidcRejectUnauthorizedConnections, _aws_cdk_core_enableAdditionalMetadataCollection, _aws_cdk_aws_lambda_createNewPoliciesWithAddToRolePolicy, _aws_cdk_aws_s3_setUniqueReplicationRoleName, _aws_cdk_aws_events_requireEventBusPolicySid, _aws_cdk_aws_dynamodb_retainTableReplica, recommended_feature_flags_default;
 var init_recommended_feature_flags = __esm({
   "lib/recommended-feature-flags.json"() {
     _aws_cdk_aws_lambda_recognizeLayerVersion = true;
@@ -12738,6 +12808,8 @@ var init_recommended_feature_flags = __esm({
     _aws_cdk_core_enableAdditionalMetadataCollection = true;
     _aws_cdk_aws_lambda_createNewPoliciesWithAddToRolePolicy = true;
     _aws_cdk_aws_s3_setUniqueReplicationRoleName = true;
+    _aws_cdk_aws_events_requireEventBusPolicySid = true;
+    _aws_cdk_aws_dynamodb_retainTableReplica = true;
     recommended_feature_flags_default = {
       "@aws-cdk/aws-lambda:recognizeLayerVersion": _aws_cdk_aws_lambda_recognizeLayerVersion,
       "@aws-cdk/core:checkSecretUsage": _aws_cdk_core_checkSecretUsage,
@@ -12803,7 +12875,9 @@ var init_recommended_feature_flags = __esm({
       "@aws-cdk/aws-iam:oidcRejectUnauthorizedConnections": _aws_cdk_aws_iam_oidcRejectUnauthorizedConnections,
       "@aws-cdk/core:enableAdditionalMetadataCollection": _aws_cdk_core_enableAdditionalMetadataCollection,
       "@aws-cdk/aws-lambda:createNewPoliciesWithAddToRolePolicy": _aws_cdk_aws_lambda_createNewPoliciesWithAddToRolePolicy,
-      "@aws-cdk/aws-s3:setUniqueReplicationRoleName": _aws_cdk_aws_s3_setUniqueReplicationRoleName
+      "@aws-cdk/aws-s3:setUniqueReplicationRoleName": _aws_cdk_aws_s3_setUniqueReplicationRoleName,
+      "@aws-cdk/aws-events:requireEventBusPolicySid": _aws_cdk_aws_events_requireEventBusPolicySid,
+      "@aws-cdk/aws-dynamodb:retainTableReplica": _aws_cdk_aws_dynamodb_retainTableReplica
     };
   }
 });

package/package.json

@@ -45,31 +45,31 @@
     "@types/yargs": "^17.0.33",
     "@typescript-eslint/eslint-plugin": "^8",
     "@typescript-eslint/parser": "^8",
-    "aws-cdk-lib": "^2.185.0",
+    "aws-cdk-lib": "^2.187.0",
     "commit-and-tag-version": "^12",
     "constructs": "^10",
     "eslint": "^9",
     "eslint-config-prettier": "^10.1.1",
-    "eslint-import-resolver-typescript": "^4.2.2",
+    "eslint-import-resolver-typescript": "^4.3.1",
     "eslint-plugin-import": "^2.31.0",
     "eslint-plugin-jest": "^28.11.0",
     "eslint-plugin-jsdoc": "^50.6.9",
-    "eslint-plugin-prettier": "^5.2.3",
+    "eslint-plugin-prettier": "^5.2.6",
     "jest": "^29.7.0",
     "jest-junit": "^16",
     "license-checker": "^25.0.1",
     "mock-fs": "^5",
     "prettier": "^2.8",
     "projen": "^0.91.18",
-    "ts-jest": "^29.2.6",
+    "ts-jest": "^29.3.1",
     "typescript": "5.6",
-    "@aws-cdk/aws-service-spec": "^0.1.62",
+    "@aws-cdk/aws-service-spec": "^0.1.66",
     "@aws-cdk/cdk-cli-wrapper": "0.0.0",
-    "@aws-cdk/cloud-assembly-schema": "42.0.0",
+    "@aws-cdk/cloud-assembly-schema": "43.1.0",
     "@aws-cdk/cloudformation-diff": "2.180.0",
-    "@aws-cdk/cx-api": "^2.185.0",
+    "@aws-cdk/cx-api": "^2.187.0",
     "@aws-sdk/client-cloudformation": "^3",
-    "aws-cdk": "2.1006.0",
+    "aws-cdk": "3.0.0",
     "cdk-assets": "3.2.0",
     "chalk": "^4",
     "chokidar": "^3",
@@ -78,8 +78,8 @@
     "yargs": "^16"
   },
   "dependencies": {
-    "@aws-cdk/aws-service-spec": "0.1.62",
-    "aws-cdk": "2.1006.0"
+    "@aws-cdk/aws-service-spec": "0.1.66",
+    "aws-cdk": "3.0.0"
   },
   "keywords": [
     "aws",
@@ -94,7 +94,7 @@
   "publishConfig": {
     "access": "public"
   },
-  "version": "2.186.0",
+  "version": "2.186.2",
   "types": "lib/index.d.ts",
   "//": "~~ Generated by projen. To modify, edit .projenrc.js and run \"npx projen\".",
   "optionalDependencies": {