@aws-cdk/integ-runner 2.186.2 → 2.186.3

package/lib/recommended-feature-flags.json

@@ -65,7 +65,7 @@
   "@aws-cdk/aws-elasticloadbalancingV2:albDualstackWithoutPublicIpv4SecurityGroupRulesDefault": true,
   "@aws-cdk/aws-iam:oidcRejectUnauthorizedConnections": true,
   "@aws-cdk/core:enableAdditionalMetadataCollection": true,
-  "@aws-cdk/aws-lambda:createNewPoliciesWithAddToRolePolicy": true,
+  "@aws-cdk/aws-lambda:createNewPoliciesWithAddToRolePolicy": false,
   "@aws-cdk/aws-s3:setUniqueReplicationRoleName": true,
   "@aws-cdk/aws-events:requireEventBusPolicySid": true,
   "@aws-cdk/aws-dynamodb:retainTableReplica": true

package/lib/workers/extract/index.js

@@ -5055,7 +5055,7 @@ var require_semver2 = __commonJS({
 // ../cloud-assembly-schema/cli-version.json
 var require_cli_version = __commonJS({
   "../cloud-assembly-schema/cli-version.json"(exports2, module2) {
-    module2.exports = { version: "3.0.0" };
+    module2.exports = { version: "2.1008.0" };
   }
 });
 
@@ -7513,7 +7513,7 @@ var require_cloud_artifact = __commonJS({
     };
     exports2.CloudArtifact = CloudArtifact;
     _a = JSII_RTTI_SYMBOL_1;
-    CloudArtifact[_a] = { fqn: "@aws-cdk/cx-api.CloudArtifact", version: "2.187.0" };
+    CloudArtifact[_a] = { fqn: "@aws-cdk/cx-api.CloudArtifact", version: "2.189.0" };
   }
 });
 
@@ -7583,7 +7583,7 @@ var require_asset_manifest_artifact = __commonJS({
     };
     exports2.AssetManifestArtifact = AssetManifestArtifact;
     _a = JSII_RTTI_SYMBOL_1;
-    AssetManifestArtifact[_a] = { fqn: "@aws-cdk/cx-api.AssetManifestArtifact", version: "2.187.0" };
+    AssetManifestArtifact[_a] = { fqn: "@aws-cdk/cx-api.AssetManifestArtifact", version: "2.189.0" };
     Object.defineProperty(AssetManifestArtifact.prototype, ASSET_MANIFEST_ARTIFACT_SYM, {
       value: true,
       enumerable: false,
@@ -7631,7 +7631,7 @@ var require_environment2 = __commonJS({
     };
     exports2.EnvironmentUtils = EnvironmentUtils;
     _a = JSII_RTTI_SYMBOL_1;
-    EnvironmentUtils[_a] = { fqn: "@aws-cdk/cx-api.EnvironmentUtils", version: "2.187.0" };
+    EnvironmentUtils[_a] = { fqn: "@aws-cdk/cx-api.EnvironmentUtils", version: "2.189.0" };
   }
 });
 
@@ -7737,7 +7737,7 @@ var require_cloudformation_artifact = __commonJS({
     };
     exports2.CloudFormationStackArtifact = CloudFormationStackArtifact;
     _a = JSII_RTTI_SYMBOL_1;
-    CloudFormationStackArtifact[_a] = { fqn: "@aws-cdk/cx-api.CloudFormationStackArtifact", version: "2.187.0" };
+    CloudFormationStackArtifact[_a] = { fqn: "@aws-cdk/cx-api.CloudFormationStackArtifact", version: "2.189.0" };
     Object.defineProperty(CloudFormationStackArtifact.prototype, CLOUDFORMATION_STACK_ARTIFACT_SYM, {
       value: true,
       enumerable: false,
@@ -7802,7 +7802,7 @@ var require_nested_cloud_assembly_artifact = __commonJS({
     };
     exports2.NestedCloudAssemblyArtifact = NestedCloudAssemblyArtifact;
     _a = JSII_RTTI_SYMBOL_1;
-    NestedCloudAssemblyArtifact[_a] = { fqn: "@aws-cdk/cx-api.NestedCloudAssemblyArtifact", version: "2.187.0" };
+    NestedCloudAssemblyArtifact[_a] = { fqn: "@aws-cdk/cx-api.NestedCloudAssemblyArtifact", version: "2.189.0" };
     Object.defineProperty(NestedCloudAssemblyArtifact.prototype, NESTED_CLOUD_ASSEMBLY_SYM, {
       value: true,
       enumerable: false,
@@ -7863,7 +7863,7 @@ var require_tree_cloud_artifact = __commonJS({
     };
     exports2.TreeCloudArtifact = TreeCloudArtifact;
     _a = JSII_RTTI_SYMBOL_1;
-    TreeCloudArtifact[_a] = { fqn: "@aws-cdk/cx-api.TreeCloudArtifact", version: "2.187.0" };
+    TreeCloudArtifact[_a] = { fqn: "@aws-cdk/cx-api.TreeCloudArtifact", version: "2.189.0" };
     Object.defineProperty(TreeCloudArtifact.prototype, TREE_CLOUD_ARTIFACT_SYM, {
       value: true,
       enumerable: false,
@@ -8129,7 +8129,7 @@ var require_cloud_assembly = __commonJS({
     };
     exports2.CloudAssembly = CloudAssembly;
     _a = JSII_RTTI_SYMBOL_1;
-    CloudAssembly[_a] = { fqn: "@aws-cdk/cx-api.CloudAssembly", version: "2.187.0" };
+    CloudAssembly[_a] = { fqn: "@aws-cdk/cx-api.CloudAssembly", version: "2.189.0" };
     var CloudAssemblyBuilder = class _CloudAssemblyBuilder {
       /**
        * Initializes a cloud assembly builder.
@@ -8223,7 +8223,7 @@ var require_cloud_assembly = __commonJS({
     };
     exports2.CloudAssemblyBuilder = CloudAssemblyBuilder;
     _b = JSII_RTTI_SYMBOL_1;
-    CloudAssemblyBuilder[_b] = { fqn: "@aws-cdk/cx-api.CloudAssemblyBuilder", version: "2.187.0" };
+    CloudAssemblyBuilder[_b] = { fqn: "@aws-cdk/cx-api.CloudAssemblyBuilder", version: "2.189.0" };
     function filterUndefined(obj) {
       if (Array.isArray(obj)) {
         return obj.filter((x) => x !== void 0).map((x) => filterUndefined(x));
@@ -8352,7 +8352,7 @@ var require_features = __commonJS({
     "use strict";
     Object.defineProperty(exports2, "__esModule", { value: true });
     exports2.LAMBDA_NODEJS_USE_LATEST_RUNTIME = exports2.ENABLE_OPENSEARCH_MULTIAZ_WITH_STANDBY = exports2.AUTOSCALING_GENERATE_LAUNCH_TEMPLATE = exports2.EFS_MOUNTTARGET_ORDERINSENSITIVE_LOGICAL_ID = exports2.EFS_DENY_ANONYMOUS_ACCESS = exports2.KMS_ALIAS_NAME_REF = exports2.INCLUDE_PREFIX_IN_UNIQUE_NAME_GENERATION = exports2.APIGATEWAY_REQUEST_VALIDATOR_UNIQUE_ID = exports2.EC2_RESTRICT_DEFAULT_SECURITY_GROUP = exports2.ENABLE_EMR_SERVICE_POLICY_V2 = exports2.REDSHIFT_COLUMN_ID = exports2.SECRETS_MANAGER_TARGET_ATTACHMENT_RESOURCE_POLICY = exports2.EC2_LAUNCH_TEMPLATE_DEFAULT_USER_DATA = exports2.APIGATEWAY_AUTHORIZER_CHANGE_DEPLOYMENT_LOGICAL_ID = exports2.CODEDEPLOY_REMOVE_ALARMS_FROM_DEPLOYMENT_GROUP = exports2.DATABASE_PROXY_UNIQUE_RESOURCE_NAME = exports2.AWS_CUSTOM_RESOURCE_LATEST_SDK_DEFAULT = exports2.ROUTE53_PATTERNS_USE_CERTIFICATE = exports2.S3_SERVER_ACCESS_LOGS_USE_BUCKET_POLICY = exports2.ECS_DISABLE_EXPLICIT_DEPLOYMENT_CONTROLLER_FOR_CIRCUIT_BREAKER = exports2.EVENTS_TARGET_QUEUE_SAME_ACCOUNT = exports2.ENABLE_PARTITION_LITERALS = exports2.APIGATEWAY_DISABLE_CLOUDWATCH_ROLE = exports2.SNS_SUBSCRIPTIONS_SQS_DECRYPTION_POLICY = exports2.S3_CREATE_DEFAULT_LOGGING_POLICY = exports2.CODEPIPELINE_CROSS_ACCOUNT_KEY_ALIAS_STACK_SAFE_RESOURCE_NAME = exports2.VALIDATE_SNAPSHOT_REMOVAL_POLICY = exports2.IAM_IMPORTED_ROLE_STACK_SAFE_DEFAULT_POLICY_NAME = exports2.IAM_MINIMIZE_POLICIES = exports2.ECS_ARN_FORMAT_INCLUDES_CLUSTER_NAME = exports2.EC2_UNIQUE_IMDSV2_LAUNCH_TEMPLATE_NAME = exports2.ECS_SERVICE_EXTENSIONS_ENABLE_DEFAULT_LOG_DRIVER = exports2.TARGET_PARTITIONS = exports2.CHECK_SECRET_USAGE = exports2.CLOUDFRONT_DEFAULT_SECURITY_POLICY_TLS_V1_2_2021 = exports2.LAMBDA_RECOGNIZE_LAYER_VERSION = exports2.LAMBDA_RECOGNIZE_VERSION_PROPS = exports2.EFS_DEFAULT_ENCRYPTION_AT_REST = exports2.APIGATEWAY_USAGEPLANKEY_ORDERINSENSITIVE_ID = exports2.RDS_LOWERCASE_DB_IDENTIFIER = exports2.ECS_REMOVE_DEFAULT_DESIRED_COUNT = exports2.S3_GRANT_WRITE_WITHOUT_ACL = exports2.KMS_DEFAULT_KEY_POLICIES = exports2.SECRETS_MANAGER_PARSE_OWNED_SECRET_NAME = exports2.DOCKER_IGNORE_SUPPORT = exports2.STACK_RELATIVE_EXPORTS_CONTEXT = exports2.NEW_STYLE_STACK_SYNTHESIS_CONTEXT = exports2.ENABLE_DIFF_NO_FAIL = exports2.ENABLE_DIFF_NO_FAIL_CONTEXT = exports2.ENABLE_STACK_NAME_DUPLICATES_CONTEXT = void 0;
-    exports2.NEW_PROJECT_DEFAULT_CONTEXT = exports2.FUTURE_FLAGS = exports2.FUTURE_FLAGS_EXPIRED = exports2.CURRENT_VERSION_FLAG_DEFAULTS = exports2.CURRENTLY_RECOMMENDED_FLAGS = exports2.CURRENT_VERSION_EXPIRED_FLAGS = exports2.FLAGS = exports2.LOG_USER_POOL_CLIENT_SECRET_VALUE = exports2.DYNAMODB_TABLE_RETAIN_TABLE_REPLICA = exports2.EVENTBUS_POLICY_SID_REQUIRED = exports2.PIPELINE_REDUCE_STAGE_ROLE_TRUST_SCOPE = exports2.SET_UNIQUE_REPLICATION_ROLE_NAME = exports2.LAMBDA_CREATE_NEW_POLICIES_WITH_ADDTOROLEPOLICY = exports2.ENABLE_ADDITIONAL_METADATA_COLLECTION = exports2.IAM_OIDC_REJECT_UNAUTHORIZED_CONNECTIONS = exports2.ALB_DUALSTACK_WITHOUT_PUBLIC_IPV4_SECURITY_GROUP_RULES_DEFAULT = exports2.Disable_ECS_IMDS_Blocking = exports2.Enable_IMDS_Blocking_Deprecated_Feature = exports2.USER_POOL_DOMAIN_NAME_METHOD_WITHOUT_CUSTOM_RESOURCE = exports2.ASPECT_STABILIZATION = exports2.BASTION_HOST_USE_AMAZON_LINUX_2023_BY_DEFAULT = exports2.STEPFUNCTIONS_TASKS_FIX_RUN_ECS_TASK_POLICY = exports2.LAMBDA_NODEJS_SDK_V3_EXCLUDE_SMITHY_PACKAGES = exports2.CFN_INCLUDE_REJECT_COMPLEX_RESOURCE_UPDATE_CREATE_POLICY_INTRINSICS = exports2.USE_CORRECT_VALUE_FOR_INSTANCE_RESOURCE_ID_PROPERTY = exports2.APPSYNC_GRAPHQLAPI_SCOPE_LAMBDA_FUNCTION_PERMISSION = exports2.EC2_SUM_TIMEOUT_ENABLED = exports2.DYNAMODB_TABLEV2_RESOURCE_POLICY_PER_REPLICA = exports2.REDUCE_EC2_FARGATE_CLOUDWATCH_PERMISSIONS = exports2.USE_NEW_S3URI_PARAMETERS_FOR_BEDROCK_INVOKE_MODEL_TASK = exports2.S3_KEEP_NOTIFICATION_IN_IMPORTED_BUCKET = exports2.LOG_API_RESPONSE_DATA_PROPERTY_TRUE_DEFAULT = exports2.ECS_REMOVE_DEFAULT_DEPLOYMENT_ALARM = exports2.EBS_DEFAULT_GP3 = exports2.EKS_NODEGROUP_NAME = exports2.PIPELINE_REDUCE_ASSET_ROLE_TRUST_SCOPE = exports2.KMS_REDUCE_CROSS_ACCOUNT_REGION_POLICY_SCOPE = exports2.CODEPIPELINE_DEFAULT_PIPELINE_TYPE_TO_V2 = exports2.CODEPIPELINE_CROSS_ACCOUNT_KEYS_DEFAULT_VALUE_TO_FALSE = exports2.LAMBDA_PERMISSION_LOGICAL_ID_FOR_LAMBDA_ACTION = exports2.CODECOMMIT_SOURCE_ACTION_DEFAULT_BRANCH_NAME = exports2.APPSYNC_ENABLE_USE_ARN_IDENTIFIER_SOURCE_API_ASSOCIATION = exports2.AURORA_CLUSTER_CHANGE_SCOPE_OF_INSTANCE_PARAMETER_GROUP_WITH_EACH_PARAMETERS = exports2.RDS_PREVENT_RENDERING_DEPRECATED_CREDENTIALS = void 0;
+    exports2.NEW_PROJECT_DEFAULT_CONTEXT = exports2.FUTURE_FLAGS = exports2.FUTURE_FLAGS_EXPIRED = exports2.CURRENT_VERSION_FLAG_DEFAULTS = exports2.CURRENTLY_RECOMMENDED_FLAGS = exports2.CURRENT_VERSION_EXPIRED_FLAGS = exports2.FLAGS = exports2.PIPELINE_REDUCE_CROSS_ACCOUNT_ACTION_ROLE_TRUST_SCOPE = exports2.LOG_USER_POOL_CLIENT_SECRET_VALUE = exports2.DYNAMODB_TABLE_RETAIN_TABLE_REPLICA = exports2.EVENTBUS_POLICY_SID_REQUIRED = exports2.PIPELINE_REDUCE_STAGE_ROLE_TRUST_SCOPE = exports2.SET_UNIQUE_REPLICATION_ROLE_NAME = exports2.LAMBDA_CREATE_NEW_POLICIES_WITH_ADDTOROLEPOLICY = exports2.ENABLE_ADDITIONAL_METADATA_COLLECTION = exports2.IAM_OIDC_REJECT_UNAUTHORIZED_CONNECTIONS = exports2.ALB_DUALSTACK_WITHOUT_PUBLIC_IPV4_SECURITY_GROUP_RULES_DEFAULT = exports2.Disable_ECS_IMDS_Blocking = exports2.Enable_IMDS_Blocking_Deprecated_Feature = exports2.USER_POOL_DOMAIN_NAME_METHOD_WITHOUT_CUSTOM_RESOURCE = exports2.ASPECT_STABILIZATION = exports2.BASTION_HOST_USE_AMAZON_LINUX_2023_BY_DEFAULT = exports2.STEPFUNCTIONS_TASKS_FIX_RUN_ECS_TASK_POLICY = exports2.LAMBDA_NODEJS_SDK_V3_EXCLUDE_SMITHY_PACKAGES = exports2.CFN_INCLUDE_REJECT_COMPLEX_RESOURCE_UPDATE_CREATE_POLICY_INTRINSICS = exports2.USE_CORRECT_VALUE_FOR_INSTANCE_RESOURCE_ID_PROPERTY = exports2.APPSYNC_GRAPHQLAPI_SCOPE_LAMBDA_FUNCTION_PERMISSION = exports2.EC2_SUM_TIMEOUT_ENABLED = exports2.DYNAMODB_TABLEV2_RESOURCE_POLICY_PER_REPLICA = exports2.REDUCE_EC2_FARGATE_CLOUDWATCH_PERMISSIONS = exports2.USE_NEW_S3URI_PARAMETERS_FOR_BEDROCK_INVOKE_MODEL_TASK = exports2.S3_KEEP_NOTIFICATION_IN_IMPORTED_BUCKET = exports2.LOG_API_RESPONSE_DATA_PROPERTY_TRUE_DEFAULT = exports2.ECS_REMOVE_DEFAULT_DEPLOYMENT_ALARM = exports2.EBS_DEFAULT_GP3 = exports2.EKS_NODEGROUP_NAME = exports2.PIPELINE_REDUCE_ASSET_ROLE_TRUST_SCOPE = exports2.KMS_REDUCE_CROSS_ACCOUNT_REGION_POLICY_SCOPE = exports2.CODEPIPELINE_DEFAULT_PIPELINE_TYPE_TO_V2 = exports2.CODEPIPELINE_CROSS_ACCOUNT_KEYS_DEFAULT_VALUE_TO_FALSE = exports2.LAMBDA_PERMISSION_LOGICAL_ID_FOR_LAMBDA_ACTION = exports2.CODECOMMIT_SOURCE_ACTION_DEFAULT_BRANCH_NAME = exports2.APPSYNC_ENABLE_USE_ARN_IDENTIFIER_SOURCE_API_ASSOCIATION = exports2.AURORA_CLUSTER_CHANGE_SCOPE_OF_INSTANCE_PARAMETER_GROUP_WITH_EACH_PARAMETERS = exports2.RDS_PREVENT_RENDERING_DEPRECATED_CREDENTIALS = void 0;
     exports2.futureFlagDefault = futureFlagDefault;
     var flag_modeling_1 = require_flag_modeling();
     exports2.ENABLE_STACK_NAME_DUPLICATES_CONTEXT = "@aws-cdk/core:enableStackNameDuplicates";
@@ -8442,6 +8442,7 @@ var require_features = __commonJS({
     exports2.EVENTBUS_POLICY_SID_REQUIRED = "@aws-cdk/aws-events:requireEventBusPolicySid";
     exports2.DYNAMODB_TABLE_RETAIN_TABLE_REPLICA = "@aws-cdk/aws-dynamodb:retainTableReplica";
     exports2.LOG_USER_POOL_CLIENT_SECRET_VALUE = "@aws-cdk/cognito:logUserPoolClientSecretValue";
+    exports2.PIPELINE_REDUCE_CROSS_ACCOUNT_ACTION_ROLE_TRUST_SCOPE = "@aws-cdk/pipelines:reduceCrossAccountActionRoleTrustScope";
     exports2.FLAGS = {
       //////////////////////////////////////////////////////////////////////
       [exports2.ENABLE_STACK_NAME_DUPLICATES_CONTEXT]: {
@@ -9623,14 +9624,17 @@ var require_features = __commonJS({
       //////////////////////////////////////////////////////////////////////
       [exports2.LAMBDA_CREATE_NEW_POLICIES_WITH_ADDTOROLEPOLICY]: {
         type: flag_modeling_1.FlagType.BugFix,
-        summary: "When enabled, Lambda will create new inline policies with AddToRolePolicy instead of adding to the Default Policy Statement",
+        summary: "[Deprecated] When enabled, Lambda will create new inline policies with AddToRolePolicy instead of adding to the Default Policy Statement",
         detailsMd: `
-      When this feature flag is enabled, Lambda will create new inline policies with AddToRolePolicy. 
+      [Deprecated default feature] When this feature flag is enabled, Lambda will create new inline policies with AddToRolePolicy. 
       The purpose of this is to prevent lambda from creating a dependency on the Default Policy Statement.
       This solves an issue where a circular dependency could occur if adding lambda to something like a Cognito Trigger, then adding the User Pool to the lambda execution role permissions.
+      However in the current implementation, we have removed a dependency of the lambda function on the policy. In addition to this, a Role will be attached to the Policy instead of an inline policy being attached to the role. 
+      This will create a data race condition in the CloudFormation template because the creation of the Lambda function no longer waits for the policy to be created. Having said that, we are not deprecating the feature (we are defaulting the feature flag to false for new stacks) since this feature can still be used to get around the circular dependency issue (issue-7016) particularly in cases where the lambda resource creation doesnt need to depend on the policy resource creation. 
+      We recommend to unset the feature flag if already set which will restore the original behavior. 
     `,
         introducedIn: { v2: "2.180.0" },
-        recommendedValue: true
+        recommendedValue: false
       },
       //////////////////////////////////////////////////////////////////////
       [exports2.SET_UNIQUE_REPLICATION_ROLE_NAME]: {
@@ -9651,6 +9655,9 @@ var require_features = __commonJS({
         detailsMd: `
       When this feature flag is enabled, the root account principal will not be added to the trust policy of stage role.
       When this feature flag is disabled, it will keep the root account principal in the trust policy.
+
+      For cross-account cases, when this feature flag is enabled the trust policy will be scoped to the role only.
+      If you are providing a custom role, you will need to ensure 'roleName' is specified or set to PhysicalName.GENERATE_IF_NEEDED.
     `,
         introducedIn: { v2: "2.184.0" },
         defaults: { v2: true },
@@ -9705,6 +9712,20 @@ var require_features = __commonJS({
         defaults: { v2: false },
         recommendedValue: false,
         compatibilityWithOldBehaviorMd: "Enable the feature flag to keep the old behavior and log the client secret values"
+      },
+      //////////////////////////////////////////////////////////////////////
+      [exports2.PIPELINE_REDUCE_CROSS_ACCOUNT_ACTION_ROLE_TRUST_SCOPE]: {
+        type: flag_modeling_1.FlagType.ApiDefault,
+        summary: "When enabled, scopes down the trust policy for the cross-account action role",
+        detailsMd: `
+        When this feature flag is enabled, the trust policy of the cross-account action role will be scoped to the pipeline role.
+        If you are providing a custom role, you will need to ensure 'roleName' is specified or set to PhysicalName.GENERATE_IF_NEEDED.
+        When this feature flag is disabled, it will keep the root account principal in the trust policy.
+      `,
+        introducedIn: { v2: "2.189.0" },
+        defaults: { v2: true },
+        recommendedValue: true,
+        compatibilityWithOldBehaviorMd: "Disable the feature flag to add the root account principal back"
       }
     };
     var CURRENT_MV = "v2";
@@ -9821,7 +9842,7 @@ var require_placeholders = __commonJS({
     };
     exports2.EnvironmentPlaceholders = EnvironmentPlaceholders;
     _a = JSII_RTTI_SYMBOL_1;
-    EnvironmentPlaceholders[_a] = { fqn: "@aws-cdk/cx-api.EnvironmentPlaceholders", version: "2.187.0" };
+    EnvironmentPlaceholders[_a] = { fqn: "@aws-cdk/cx-api.EnvironmentPlaceholders", version: "2.189.0" };
     EnvironmentPlaceholders.CURRENT_REGION = "${AWS::Region}";
     EnvironmentPlaceholders.CURRENT_ACCOUNT = "${AWS::AccountId}";
     EnvironmentPlaceholders.CURRENT_PARTITION = "${AWS::Partition}";
@@ -12806,7 +12827,7 @@ var init_recommended_feature_flags = __esm({
     _aws_cdk_aws_elasticloadbalancingV2_albDualstackWithoutPublicIpv4SecurityGroupRulesDefault = true;
     _aws_cdk_aws_iam_oidcRejectUnauthorizedConnections = true;
     _aws_cdk_core_enableAdditionalMetadataCollection = true;
-    _aws_cdk_aws_lambda_createNewPoliciesWithAddToRolePolicy = true;
+    _aws_cdk_aws_lambda_createNewPoliciesWithAddToRolePolicy = false;
     _aws_cdk_aws_s3_setUniqueReplicationRoleName = true;
     _aws_cdk_aws_events_requireEventBusPolicySid = true;
     _aws_cdk_aws_dynamodb_retainTableReplica = true;
@@ -20075,14 +20096,14 @@ var require_templates = __commonJS({
       }
       return results;
     }
-    function buildStyle(chalk7, styles) {
+    function buildStyle(chalk8, styles) {
       const enabled = {};
       for (const layer of styles) {
         for (const style of layer.styles) {
           enabled[style[0]] = layer.inverse ? null : style.slice(1);
         }
       }
-      let current = chalk7;
+      let current = chalk8;
       for (const [styleName, styles2] of Object.entries(enabled)) {
         if (!Array.isArray(styles2)) {
           continue;
@@ -20094,7 +20115,7 @@ var require_templates = __commonJS({
       }
       return current;
     }
-    module2.exports = (chalk7, temporary) => {
+    module2.exports = (chalk8, temporary) => {
       const styles = [];
       const chunks2 = [];
       let chunk = [];
@@ -20104,13 +20125,13 @@ var require_templates = __commonJS({
         } else if (style) {
           const string = chunk.join("");
           chunk = [];
-          chunks2.push(styles.length === 0 ? string : buildStyle(chalk7, styles)(string));
+          chunks2.push(styles.length === 0 ? string : buildStyle(chalk8, styles)(string));
           styles.push({ inverse, styles: parseStyle(style) });
         } else if (close) {
           if (styles.length === 0) {
             throw new Error("Found extraneous } in Chalk template literal");
           }
-          chunks2.push(buildStyle(chalk7, styles)(chunk.join("")));
+          chunks2.push(buildStyle(chalk8, styles)(chunk.join("")));
           chunk = [];
           styles.pop();
         } else {
@@ -20158,16 +20179,16 @@ var require_source = __commonJS({
       }
     };
     var chalkFactory = (options) => {
-      const chalk8 = {};
-      applyOptions(chalk8, options);
-      chalk8.template = (...arguments_) => chalkTag(chalk8.template, ...arguments_);
-      Object.setPrototypeOf(chalk8, Chalk.prototype);
-      Object.setPrototypeOf(chalk8.template, chalk8);
-      chalk8.template.constructor = () => {
+      const chalk9 = {};
+      applyOptions(chalk9, options);
+      chalk9.template = (...arguments_) => chalkTag(chalk9.template, ...arguments_);
+      Object.setPrototypeOf(chalk9, Chalk.prototype);
+      Object.setPrototypeOf(chalk9.template, chalk9);
+      chalk9.template.constructor = () => {
         throw new Error("`chalk.constructor()` is deprecated. Use `new chalk.Instance()` instead.");
       };
-      chalk8.template.Instance = ChalkClass;
-      return chalk8.template;
+      chalk9.template.Instance = ChalkClass;
+      return chalk9.template;
     };
     function Chalk(options) {
       return chalkFactory(options);
@@ -20278,7 +20299,7 @@ var require_source = __commonJS({
       return openAll + string + closeAll;
     };
     var template;
-    var chalkTag = (chalk8, ...strings) => {
+    var chalkTag = (chalk9, ...strings) => {
       const [firstString] = strings;
       if (!isArray(firstString) || !isArray(firstString.raw)) {
         return strings.join(" ");
@@ -20294,14 +20315,14 @@ var require_source = __commonJS({
       if (template === void 0) {
         template = require_templates();
       }
-      return template(chalk8, parts.join(""));
+      return template(chalk9, parts.join(""));
     };
     Object.defineProperties(Chalk.prototype, styles);
-    var chalk7 = Chalk();
-    chalk7.supportsColor = stdoutColor;
-    chalk7.stderr = Chalk({ level: stderrColor ? stderrColor.level : 0 });
-    chalk7.stderr.supportsColor = stderrColor;
-    module2.exports = chalk7;
+    var chalk8 = Chalk();
+    chalk8.supportsColor = stdoutColor;
+    chalk8.stderr = Chalk({ level: stderrColor ? stderrColor.level : 0 });
+    chalk8.stderr.supportsColor = stderrColor;
+    module2.exports = chalk8;
   }
 });
 
@@ -31564,6 +31585,52 @@ var init_format = __esm({
   }
 });
 
+// ../cloudformation-diff/lib/mappings.ts
+var mappings_exports = {};
+__export(mappings_exports, {
+  formatAmbiguousMappings: () => formatAmbiguousMappings,
+  formatTypedMappings: () => formatTypedMappings
+});
+function formatTypedMappings(stream, mappings) {
+  const header = [["Resource Type", "Old Construct Path", "New Construct Path"]];
+  const rows = mappings.map((m) => [m.type, m.sourcePath, m.destinationPath]);
+  const formatter = new Formatter(stream, {});
+  if (mappings.length > 0) {
+    formatter.printSectionHeader("The following resources were moved or renamed:");
+    formatter.print(chalk7.green(formatTable(header.concat(rows), void 0)));
+  } else {
+    formatter.print("Nothing to refactor.");
+  }
+}
+function formatAmbiguousMappings(stream, pairs) {
+  const tables = pairs.map(renderTable);
+  const formatter = new Formatter(stream, {});
+  formatter.printSectionHeader("Ambiguous Resource Name Changes");
+  formatter.print(tables.join("\n\n"));
+  formatter.printSectionFooter();
+  function renderTable([removed, added]) {
+    return formatTable([["", "Resource"], renderRemoval(removed), renderAddition(added)], void 0);
+  }
+  function renderRemoval(locations) {
+    return [chalk7.red("-"), chalk7.red(renderLocations(locations))];
+  }
+  function renderAddition(locations) {
+    return [chalk7.green("+"), chalk7.green(renderLocations(locations))];
+  }
+  function renderLocations(locs) {
+    return locs.join("\n");
+  }
+}
+var chalk7;
+var init_mappings = __esm({
+  "../cloudformation-diff/lib/mappings.ts"() {
+    "use strict";
+    chalk7 = __toESM(require_source());
+    init_format();
+    init_format_table();
+  }
+});
+
 // ../cloudformation-diff/lib/index.js
 var require_lib9 = __commonJS({
   "../cloudformation-diff/lib/index.js"(exports2) {
@@ -31589,6 +31656,7 @@ var require_lib9 = __commonJS({
     __exportStar2((init_diff_template(), __toCommonJS(diff_template_exports)), exports2);
     __exportStar2((init_format(), __toCommonJS(format_exports)), exports2);
     __exportStar2((init_format_table(), __toCommonJS(format_table_exports)), exports2);
+    __exportStar2((init_mappings(), __toCommonJS(mappings_exports)), exports2);
     var util_1 = (init_util(), __toCommonJS(util_exports));
     Object.defineProperty(exports2, "deepEqual", { enumerable: true, get: function() {
       return util_1.deepEqual;

package/package.json

@@ -45,12 +45,12 @@
     "@types/yargs": "^17.0.33",
     "@typescript-eslint/eslint-plugin": "^8",
     "@typescript-eslint/parser": "^8",
-    "aws-cdk-lib": "^2.187.0",
+    "aws-cdk-lib": "^2.189.0",
     "commit-and-tag-version": "^12",
     "constructs": "^10",
     "eslint": "^9",
-    "eslint-config-prettier": "^10.1.1",
-    "eslint-import-resolver-typescript": "^4.3.1",
+    "eslint-config-prettier": "^10.1.2",
+    "eslint-import-resolver-typescript": "^4.3.2",
     "eslint-plugin-import": "^2.31.0",
     "eslint-plugin-jest": "^28.11.0",
     "eslint-plugin-jsdoc": "^50.6.9",
@@ -60,16 +60,16 @@
     "license-checker": "^25.0.1",
     "mock-fs": "^5",
     "prettier": "^2.8",
-    "projen": "^0.91.18",
-    "ts-jest": "^29.3.1",
+    "projen": "^0.91.20",
+    "ts-jest": "^29.3.2",
     "typescript": "5.6",
-    "@aws-cdk/aws-service-spec": "^0.1.66",
+    "@aws-cdk/aws-service-spec": "^0.1.67",
     "@aws-cdk/cdk-cli-wrapper": "0.0.0",
-    "@aws-cdk/cloud-assembly-schema": "43.1.0",
-    "@aws-cdk/cloudformation-diff": "2.180.0",
-    "@aws-cdk/cx-api": "^2.187.0",
+    "@aws-cdk/cloud-assembly-schema": ">=43.2.0",
+    "@aws-cdk/cloudformation-diff": "2.181.0",
+    "@aws-cdk/cx-api": "^2.189.0",
     "@aws-sdk/client-cloudformation": "^3",
-    "aws-cdk": "3.0.0",
+    "aws-cdk": "2.1008.0",
     "cdk-assets": "3.2.0",
     "chalk": "^4",
     "chokidar": "^3",
@@ -78,8 +78,8 @@
     "yargs": "^16"
   },
   "dependencies": {
-    "@aws-cdk/aws-service-spec": "0.1.66",
-    "aws-cdk": "3.0.0"
+    "@aws-cdk/aws-service-spec": "0.1.67",
+    "aws-cdk": "2.1008.0"
   },
   "keywords": [
     "aws",
@@ -94,7 +94,7 @@
   "publishConfig": {
     "access": "public"
   },
-  "version": "2.186.2",
+  "version": "2.186.3",
   "types": "lib/index.d.ts",
   "//": "~~ Generated by projen. To modify, edit .projenrc.js and run \"npx projen\".",
   "optionalDependencies": {