@aws-cdk/integ-runner 2.186.7 → 2.186.9

package/lib/recommended-feature-flags.json

@@ -71,5 +71,7 @@
   "@aws-cdk/core:aspectPrioritiesMutating": true,
   "@aws-cdk/aws-dynamodb:retainTableReplica": true,
   "@aws-cdk/aws-stepfunctions:useDistributedMapResultWriterV2": true,
-  "@aws-cdk/s3-notifications:addS3TrustKeyPolicyForSnsSubscriptions": true
+  "@aws-cdk/s3-notifications:addS3TrustKeyPolicyForSnsSubscriptions": true,
+  "@aws-cdk/aws-ec2:requirePrivateSubnetsForEgressOnlyInternetGateway": true,
+  "@aws-cdk/aws-s3:publicAccessBlockedByDefault": true
 }

package/lib/runner/runner-base.d.ts

@@ -287,4 +287,6 @@ export declare function currentlyRecommendedAwsCdkLibFlags(): {
     "@aws-cdk/aws-dynamodb:retainTableReplica": boolean;
     "@aws-cdk/aws-stepfunctions:useDistributedMapResultWriterV2": boolean;
     "@aws-cdk/s3-notifications:addS3TrustKeyPolicyForSnsSubscriptions": boolean;
+    "@aws-cdk/aws-ec2:requirePrivateSubnetsForEgressOnlyInternetGateway": boolean;
+    "@aws-cdk/aws-s3:publicAccessBlockedByDefault": boolean;
 };

package/lib/workers/extract/index.js

@@ -5100,7 +5100,7 @@ var require_semver2 = __commonJS({
 // ../cloud-assembly-schema/cli-version.json
 var require_cli_version = __commonJS({
   "../cloud-assembly-schema/cli-version.json"(exports2, module2) {
-    module2.exports = { version: "2.1015.0" };
+    module2.exports = { version: "2.1016.1" };
   }
 });
 
@@ -7558,7 +7558,7 @@ var require_cloud_artifact = __commonJS({
     };
     exports2.CloudArtifact = CloudArtifact;
     _a = JSII_RTTI_SYMBOL_1;
-    CloudArtifact[_a] = { fqn: "@aws-cdk/cx-api.CloudArtifact", version: "2.195.0" };
+    CloudArtifact[_a] = { fqn: "@aws-cdk/cx-api.CloudArtifact", version: "2.196.0" };
   }
 });
 
@@ -7628,7 +7628,7 @@ var require_asset_manifest_artifact = __commonJS({
     };
     exports2.AssetManifestArtifact = AssetManifestArtifact;
     _a = JSII_RTTI_SYMBOL_1;
-    AssetManifestArtifact[_a] = { fqn: "@aws-cdk/cx-api.AssetManifestArtifact", version: "2.195.0" };
+    AssetManifestArtifact[_a] = { fqn: "@aws-cdk/cx-api.AssetManifestArtifact", version: "2.196.0" };
     Object.defineProperty(AssetManifestArtifact.prototype, ASSET_MANIFEST_ARTIFACT_SYM, {
       value: true,
       enumerable: false,
@@ -7676,7 +7676,7 @@ var require_environment2 = __commonJS({
     };
     exports2.EnvironmentUtils = EnvironmentUtils;
     _a = JSII_RTTI_SYMBOL_1;
-    EnvironmentUtils[_a] = { fqn: "@aws-cdk/cx-api.EnvironmentUtils", version: "2.195.0" };
+    EnvironmentUtils[_a] = { fqn: "@aws-cdk/cx-api.EnvironmentUtils", version: "2.196.0" };
   }
 });
 
@@ -7782,7 +7782,7 @@ var require_cloudformation_artifact = __commonJS({
     };
     exports2.CloudFormationStackArtifact = CloudFormationStackArtifact;
     _a = JSII_RTTI_SYMBOL_1;
-    CloudFormationStackArtifact[_a] = { fqn: "@aws-cdk/cx-api.CloudFormationStackArtifact", version: "2.195.0" };
+    CloudFormationStackArtifact[_a] = { fqn: "@aws-cdk/cx-api.CloudFormationStackArtifact", version: "2.196.0" };
     Object.defineProperty(CloudFormationStackArtifact.prototype, CLOUDFORMATION_STACK_ARTIFACT_SYM, {
       value: true,
       enumerable: false,
@@ -7847,7 +7847,7 @@ var require_nested_cloud_assembly_artifact = __commonJS({
     };
     exports2.NestedCloudAssemblyArtifact = NestedCloudAssemblyArtifact;
     _a = JSII_RTTI_SYMBOL_1;
-    NestedCloudAssemblyArtifact[_a] = { fqn: "@aws-cdk/cx-api.NestedCloudAssemblyArtifact", version: "2.195.0" };
+    NestedCloudAssemblyArtifact[_a] = { fqn: "@aws-cdk/cx-api.NestedCloudAssemblyArtifact", version: "2.196.0" };
     Object.defineProperty(NestedCloudAssemblyArtifact.prototype, NESTED_CLOUD_ASSEMBLY_SYM, {
       value: true,
       enumerable: false,
@@ -7908,7 +7908,7 @@ var require_tree_cloud_artifact = __commonJS({
     };
     exports2.TreeCloudArtifact = TreeCloudArtifact;
     _a = JSII_RTTI_SYMBOL_1;
-    TreeCloudArtifact[_a] = { fqn: "@aws-cdk/cx-api.TreeCloudArtifact", version: "2.195.0" };
+    TreeCloudArtifact[_a] = { fqn: "@aws-cdk/cx-api.TreeCloudArtifact", version: "2.196.0" };
     Object.defineProperty(TreeCloudArtifact.prototype, TREE_CLOUD_ARTIFACT_SYM, {
       value: true,
       enumerable: false,
@@ -8174,7 +8174,7 @@ var require_cloud_assembly = __commonJS({
     };
     exports2.CloudAssembly = CloudAssembly;
     _a = JSII_RTTI_SYMBOL_1;
-    CloudAssembly[_a] = { fqn: "@aws-cdk/cx-api.CloudAssembly", version: "2.195.0" };
+    CloudAssembly[_a] = { fqn: "@aws-cdk/cx-api.CloudAssembly", version: "2.196.0" };
     var CloudAssemblyBuilder = class _CloudAssemblyBuilder {
       /**
        * Initializes a cloud assembly builder.
@@ -8268,7 +8268,7 @@ var require_cloud_assembly = __commonJS({
     };
     exports2.CloudAssemblyBuilder = CloudAssemblyBuilder;
     _b = JSII_RTTI_SYMBOL_1;
-    CloudAssemblyBuilder[_b] = { fqn: "@aws-cdk/cx-api.CloudAssemblyBuilder", version: "2.195.0" };
+    CloudAssemblyBuilder[_b] = { fqn: "@aws-cdk/cx-api.CloudAssemblyBuilder", version: "2.196.0" };
     function filterUndefined(obj) {
       if (Array.isArray(obj)) {
         return obj.filter((x) => x !== void 0).map((x) => filterUndefined(x));
@@ -8397,7 +8397,8 @@ var require_features = __commonJS({
     "use strict";
     Object.defineProperty(exports2, "__esModule", { value: true });
     exports2.LAMBDA_NODEJS_USE_LATEST_RUNTIME = exports2.ENABLE_OPENSEARCH_MULTIAZ_WITH_STANDBY = exports2.AUTOSCALING_GENERATE_LAUNCH_TEMPLATE = exports2.EFS_MOUNTTARGET_ORDERINSENSITIVE_LOGICAL_ID = exports2.EFS_DENY_ANONYMOUS_ACCESS = exports2.KMS_ALIAS_NAME_REF = exports2.INCLUDE_PREFIX_IN_UNIQUE_NAME_GENERATION = exports2.APIGATEWAY_REQUEST_VALIDATOR_UNIQUE_ID = exports2.EC2_RESTRICT_DEFAULT_SECURITY_GROUP = exports2.ENABLE_EMR_SERVICE_POLICY_V2 = exports2.REDSHIFT_COLUMN_ID = exports2.SECRETS_MANAGER_TARGET_ATTACHMENT_RESOURCE_POLICY = exports2.EC2_LAUNCH_TEMPLATE_DEFAULT_USER_DATA = exports2.APIGATEWAY_AUTHORIZER_CHANGE_DEPLOYMENT_LOGICAL_ID = exports2.CODEDEPLOY_REMOVE_ALARMS_FROM_DEPLOYMENT_GROUP = exports2.DATABASE_PROXY_UNIQUE_RESOURCE_NAME = exports2.AWS_CUSTOM_RESOURCE_LATEST_SDK_DEFAULT = exports2.ROUTE53_PATTERNS_USE_CERTIFICATE = exports2.S3_SERVER_ACCESS_LOGS_USE_BUCKET_POLICY = exports2.ECS_DISABLE_EXPLICIT_DEPLOYMENT_CONTROLLER_FOR_CIRCUIT_BREAKER = exports2.EVENTS_TARGET_QUEUE_SAME_ACCOUNT = exports2.ENABLE_PARTITION_LITERALS = exports2.APIGATEWAY_DISABLE_CLOUDWATCH_ROLE = exports2.SNS_SUBSCRIPTIONS_SQS_DECRYPTION_POLICY = exports2.S3_CREATE_DEFAULT_LOGGING_POLICY = exports2.CODEPIPELINE_CROSS_ACCOUNT_KEY_ALIAS_STACK_SAFE_RESOURCE_NAME = exports2.VALIDATE_SNAPSHOT_REMOVAL_POLICY = exports2.IAM_IMPORTED_ROLE_STACK_SAFE_DEFAULT_POLICY_NAME = exports2.IAM_MINIMIZE_POLICIES = exports2.ECS_ARN_FORMAT_INCLUDES_CLUSTER_NAME = exports2.EC2_UNIQUE_IMDSV2_LAUNCH_TEMPLATE_NAME = exports2.ECS_SERVICE_EXTENSIONS_ENABLE_DEFAULT_LOG_DRIVER = exports2.TARGET_PARTITIONS = exports2.CHECK_SECRET_USAGE = exports2.CLOUDFRONT_DEFAULT_SECURITY_POLICY_TLS_V1_2_2021 = exports2.LAMBDA_RECOGNIZE_LAYER_VERSION = exports2.LAMBDA_RECOGNIZE_VERSION_PROPS = exports2.EFS_DEFAULT_ENCRYPTION_AT_REST = exports2.APIGATEWAY_USAGEPLANKEY_ORDERINSENSITIVE_ID = exports2.RDS_LOWERCASE_DB_IDENTIFIER = exports2.ECS_REMOVE_DEFAULT_DESIRED_COUNT = exports2.S3_GRANT_WRITE_WITHOUT_ACL = exports2.KMS_DEFAULT_KEY_POLICIES = exports2.SECRETS_MANAGER_PARSE_OWNED_SECRET_NAME = exports2.DOCKER_IGNORE_SUPPORT = exports2.STACK_RELATIVE_EXPORTS_CONTEXT = exports2.NEW_STYLE_STACK_SYNTHESIS_CONTEXT = exports2.ENABLE_DIFF_NO_FAIL = exports2.ENABLE_DIFF_NO_FAIL_CONTEXT = exports2.ENABLE_STACK_NAME_DUPLICATES_CONTEXT = void 0;
-    exports2.NEW_PROJECT_DEFAULT_CONTEXT = exports2.FUTURE_FLAGS = exports2.FUTURE_FLAGS_EXPIRED = exports2.CURRENT_VERSION_FLAG_DEFAULTS = exports2.CURRENTLY_RECOMMENDED_FLAGS = exports2.CURRENT_VERSION_EXPIRED_FLAGS = exports2.FLAGS = exports2.S3_TRUST_KEY_POLICY_FOR_SNS_SUBSCRIPTIONS = exports2.PIPELINE_REDUCE_CROSS_ACCOUNT_ACTION_ROLE_TRUST_SCOPE = exports2.LOG_USER_POOL_CLIENT_SECRET_VALUE = exports2.DYNAMODB_TABLE_RETAIN_TABLE_REPLICA = exports2.ASPECT_PRIORITIES_MUTATING = exports2.EVENTBUS_POLICY_SID_REQUIRED = exports2.PIPELINE_REDUCE_STAGE_ROLE_TRUST_SCOPE = exports2.SET_UNIQUE_REPLICATION_ROLE_NAME = exports2.LAMBDA_CREATE_NEW_POLICIES_WITH_ADDTOROLEPOLICY = exports2.ENABLE_ADDITIONAL_METADATA_COLLECTION = exports2.IAM_OIDC_REJECT_UNAUTHORIZED_CONNECTIONS = exports2.ALB_DUALSTACK_WITHOUT_PUBLIC_IPV4_SECURITY_GROUP_RULES_DEFAULT = exports2.Disable_ECS_IMDS_Blocking = exports2.Enable_IMDS_Blocking_Deprecated_Feature = exports2.USER_POOL_DOMAIN_NAME_METHOD_WITHOUT_CUSTOM_RESOURCE = exports2.ASPECT_STABILIZATION = exports2.BASTION_HOST_USE_AMAZON_LINUX_2023_BY_DEFAULT = exports2.STEPFUNCTIONS_USE_DISTRIBUTED_MAP_RESULT_WRITER_V2 = exports2.STEPFUNCTIONS_TASKS_FIX_RUN_ECS_TASK_POLICY = exports2.LAMBDA_NODEJS_SDK_V3_EXCLUDE_SMITHY_PACKAGES = exports2.CFN_INCLUDE_REJECT_COMPLEX_RESOURCE_UPDATE_CREATE_POLICY_INTRINSICS = exports2.USE_CORRECT_VALUE_FOR_INSTANCE_RESOURCE_ID_PROPERTY = exports2.APPSYNC_GRAPHQLAPI_SCOPE_LAMBDA_FUNCTION_PERMISSION = exports2.EC2_SUM_TIMEOUT_ENABLED = exports2.DYNAMODB_TABLEV2_RESOURCE_POLICY_PER_REPLICA = exports2.REDUCE_EC2_FARGATE_CLOUDWATCH_PERMISSIONS = exports2.USE_NEW_S3URI_PARAMETERS_FOR_BEDROCK_INVOKE_MODEL_TASK = exports2.S3_KEEP_NOTIFICATION_IN_IMPORTED_BUCKET = exports2.LOG_API_RESPONSE_DATA_PROPERTY_TRUE_DEFAULT = exports2.ECS_REMOVE_DEFAULT_DEPLOYMENT_ALARM = exports2.EBS_DEFAULT_GP3 = exports2.EKS_NODEGROUP_NAME = exports2.PIPELINE_REDUCE_ASSET_ROLE_TRUST_SCOPE = exports2.KMS_REDUCE_CROSS_ACCOUNT_REGION_POLICY_SCOPE = exports2.CODEPIPELINE_DEFAULT_PIPELINE_TYPE_TO_V2 = exports2.CODEPIPELINE_CROSS_ACCOUNT_KEYS_DEFAULT_VALUE_TO_FALSE = exports2.LAMBDA_PERMISSION_LOGICAL_ID_FOR_LAMBDA_ACTION = exports2.CODECOMMIT_SOURCE_ACTION_DEFAULT_BRANCH_NAME = exports2.APPSYNC_ENABLE_USE_ARN_IDENTIFIER_SOURCE_API_ASSOCIATION = exports2.AURORA_CLUSTER_CHANGE_SCOPE_OF_INSTANCE_PARAMETER_GROUP_WITH_EACH_PARAMETERS = exports2.RDS_PREVENT_RENDERING_DEPRECATED_CREDENTIALS = void 0;
+    exports2.FUTURE_FLAGS = exports2.FUTURE_FLAGS_EXPIRED = exports2.CURRENT_VERSION_FLAG_DEFAULTS = exports2.CURRENTLY_RECOMMENDED_FLAGS = exports2.CURRENT_VERSION_EXPIRED_FLAGS = exports2.FLAGS = exports2.S3_PUBLIC_ACCESS_BLOCKED_BY_DEFAULT = exports2.USE_RESOURCEID_FOR_VPCV2_MIGRATION = exports2.EC2_REQUIRE_PRIVATE_SUBNETS_FOR_EGRESSONLYINTERNETGATEWAY = exports2.S3_TRUST_KEY_POLICY_FOR_SNS_SUBSCRIPTIONS = exports2.PIPELINE_REDUCE_CROSS_ACCOUNT_ACTION_ROLE_TRUST_SCOPE = exports2.LOG_USER_POOL_CLIENT_SECRET_VALUE = exports2.DYNAMODB_TABLE_RETAIN_TABLE_REPLICA = exports2.ASPECT_PRIORITIES_MUTATING = exports2.EVENTBUS_POLICY_SID_REQUIRED = exports2.PIPELINE_REDUCE_STAGE_ROLE_TRUST_SCOPE = exports2.SET_UNIQUE_REPLICATION_ROLE_NAME = exports2.LAMBDA_CREATE_NEW_POLICIES_WITH_ADDTOROLEPOLICY = exports2.ENABLE_ADDITIONAL_METADATA_COLLECTION = exports2.IAM_OIDC_REJECT_UNAUTHORIZED_CONNECTIONS = exports2.ALB_DUALSTACK_WITHOUT_PUBLIC_IPV4_SECURITY_GROUP_RULES_DEFAULT = exports2.Disable_ECS_IMDS_Blocking = exports2.Enable_IMDS_Blocking_Deprecated_Feature = exports2.USER_POOL_DOMAIN_NAME_METHOD_WITHOUT_CUSTOM_RESOURCE = exports2.ASPECT_STABILIZATION = exports2.BASTION_HOST_USE_AMAZON_LINUX_2023_BY_DEFAULT = exports2.STEPFUNCTIONS_USE_DISTRIBUTED_MAP_RESULT_WRITER_V2 = exports2.STEPFUNCTIONS_TASKS_FIX_RUN_ECS_TASK_POLICY = exports2.LAMBDA_NODEJS_SDK_V3_EXCLUDE_SMITHY_PACKAGES = exports2.CFN_INCLUDE_REJECT_COMPLEX_RESOURCE_UPDATE_CREATE_POLICY_INTRINSICS = exports2.USE_CORRECT_VALUE_FOR_INSTANCE_RESOURCE_ID_PROPERTY = exports2.APPSYNC_GRAPHQLAPI_SCOPE_LAMBDA_FUNCTION_PERMISSION = exports2.EC2_SUM_TIMEOUT_ENABLED = exports2.DYNAMODB_TABLEV2_RESOURCE_POLICY_PER_REPLICA = exports2.REDUCE_EC2_FARGATE_CLOUDWATCH_PERMISSIONS = exports2.USE_NEW_S3URI_PARAMETERS_FOR_BEDROCK_INVOKE_MODEL_TASK = exports2.S3_KEEP_NOTIFICATION_IN_IMPORTED_BUCKET = exports2.LOG_API_RESPONSE_DATA_PROPERTY_TRUE_DEFAULT = exports2.ECS_REMOVE_DEFAULT_DEPLOYMENT_ALARM = exports2.EBS_DEFAULT_GP3 = exports2.EKS_NODEGROUP_NAME = exports2.PIPELINE_REDUCE_ASSET_ROLE_TRUST_SCOPE = exports2.KMS_REDUCE_CROSS_ACCOUNT_REGION_POLICY_SCOPE = exports2.CODEPIPELINE_DEFAULT_PIPELINE_TYPE_TO_V2 = exports2.CODEPIPELINE_CROSS_ACCOUNT_KEYS_DEFAULT_VALUE_TO_FALSE = exports2.LAMBDA_PERMISSION_LOGICAL_ID_FOR_LAMBDA_ACTION = exports2.CODECOMMIT_SOURCE_ACTION_DEFAULT_BRANCH_NAME = exports2.APPSYNC_ENABLE_USE_ARN_IDENTIFIER_SOURCE_API_ASSOCIATION = exports2.AURORA_CLUSTER_CHANGE_SCOPE_OF_INSTANCE_PARAMETER_GROUP_WITH_EACH_PARAMETERS = exports2.RDS_PREVENT_RENDERING_DEPRECATED_CREDENTIALS = void 0;
+    exports2.NEW_PROJECT_DEFAULT_CONTEXT = void 0;
     exports2.futureFlagDefault = futureFlagDefault;
     var flag_modeling_1 = require_flag_modeling();
     exports2.ENABLE_STACK_NAME_DUPLICATES_CONTEXT = "@aws-cdk/core:enableStackNameDuplicates";
@@ -8491,6 +8492,9 @@ var require_features = __commonJS({
     exports2.LOG_USER_POOL_CLIENT_SECRET_VALUE = "@aws-cdk/cognito:logUserPoolClientSecretValue";
     exports2.PIPELINE_REDUCE_CROSS_ACCOUNT_ACTION_ROLE_TRUST_SCOPE = "@aws-cdk/pipelines:reduceCrossAccountActionRoleTrustScope";
     exports2.S3_TRUST_KEY_POLICY_FOR_SNS_SUBSCRIPTIONS = "@aws-cdk/s3-notifications:addS3TrustKeyPolicyForSnsSubscriptions";
+    exports2.EC2_REQUIRE_PRIVATE_SUBNETS_FOR_EGRESSONLYINTERNETGATEWAY = "@aws-cdk/aws-ec2:requirePrivateSubnetsForEgressOnlyInternetGateway";
+    exports2.USE_RESOURCEID_FOR_VPCV2_MIGRATION = "@aws-cdk/aws-ec2-alpha:useResourceIdForVpcV2Migration";
+    exports2.S3_PUBLIC_ACCESS_BLOCKED_BY_DEFAULT = "@aws-cdk/aws-s3:publicAccessBlockedByDefault";
     exports2.FLAGS = {
       //////////////////////////////////////////////////////////////////////
       [exports2.ENABLE_STACK_NAME_DUPLICATES_CONTEXT]: {
@@ -9812,6 +9816,7 @@ var require_features = __commonJS({
         recommendedValue: true,
         compatibilityWithOldBehaviorMd: "Disable the feature flag to add the root account principal back"
       },
+      //////////////////////////////////////////////////////////////////////
       [exports2.STEPFUNCTIONS_USE_DISTRIBUTED_MAP_RESULT_WRITER_V2]: {
         type: flag_modeling_1.FlagType.ApiDefault,
         summary: "When enabled, the resultWriterV2 property of DistributedMap will be used insted of resultWriter",
@@ -9832,6 +9837,43 @@ var require_features = __commonJS({
           `,
         introducedIn: { v2: "2.195.0" },
         recommendedValue: true
+      },
+      //////////////////////////////////////////////////////////////////////
+      [exports2.EC2_REQUIRE_PRIVATE_SUBNETS_FOR_EGRESSONLYINTERNETGATEWAY]: {
+        type: flag_modeling_1.FlagType.BugFix,
+        summary: "When enabled, the EgressOnlyGateway resource is only created if private subnets are defined in the dual-stack VPC.",
+        detailsMd: `
+      When this feature flag is enabled, EgressOnlyGateway resource will not be created when you create a vpc with only public subnets.
+          `,
+        introducedIn: { v2: "2.196.0" },
+        recommendedValue: true
+      },
+      /// ///////////////////////////////////////////////////////////////////
+      [exports2.USE_RESOURCEID_FOR_VPCV2_MIGRATION]: {
+        type: flag_modeling_1.FlagType.ApiDefault,
+        summary: "When enabled, use resource IDs for VPC V2 migration",
+        detailsMd: `
+        When this feature flag is enabled, the VPC V2 migration will use resource IDs instead of getAtt references
+        for migrating resources from VPC V1 to VPC V2. This helps ensure a smoother migration path between
+        the two versions.
+      `,
+        introducedIn: { v2: "V2_NEXT" },
+        recommendedValue: false,
+        defaults: { v2: false },
+        compatibilityWithOldBehaviorMd: "Disable the feature flag to use getAtt references for VPC V2 migration"
+      },
+      //////////////////////////////////////////////////////////////////////
+      [exports2.S3_PUBLIC_ACCESS_BLOCKED_BY_DEFAULT]: {
+        type: flag_modeling_1.FlagType.BugFix,
+        summary: "When enabled, setting any combination of options for BlockPublicAccess will automatically set true for any options not defined.",
+        detailsMd: `
+      When BlockPublicAccess is not set at all, s3's default behavior will be to set all options to true in aws console. 
+      The previous behavior in cdk before this feature was; if only some of the BlockPublicAccessOptions were set (not all 4), then the ones undefined would default to false.
+      This is counter intuitive to the console behavior where the options would start in true state and a user would uncheck the boxes as needed.
+      The new behavior from this feature will allow a user, for example, to set 1 of the 4 BlockPublicAccessOpsions to false, and on deployment the other 3 will remain true.
+    `,
+        introducedIn: { v2: "2.196.0" },
+        recommendedValue: true
       }
     };
     var CURRENT_MV = "v2";
@@ -9948,7 +9990,7 @@ var require_placeholders = __commonJS({
     };
     exports2.EnvironmentPlaceholders = EnvironmentPlaceholders;
     _a = JSII_RTTI_SYMBOL_1;
-    EnvironmentPlaceholders[_a] = { fqn: "@aws-cdk/cx-api.EnvironmentPlaceholders", version: "2.195.0" };
+    EnvironmentPlaceholders[_a] = { fqn: "@aws-cdk/cx-api.EnvironmentPlaceholders", version: "2.196.0" };
     EnvironmentPlaceholders.CURRENT_REGION = "${AWS::Region}";
     EnvironmentPlaceholders.CURRENT_ACCOUNT = "${AWS::AccountId}";
     EnvironmentPlaceholders.CURRENT_PARTITION = "${AWS::Partition}";
@@ -12814,6 +12856,7 @@ __export(recommended_feature_flags_exports, {
   "@aws-cdk/aws-ec2:ebsDefaultGp3Volume": () => _aws_cdk_aws_ec2_ebsDefaultGp3Volume,
   "@aws-cdk/aws-ec2:ec2SumTImeoutEnabled": () => _aws_cdk_aws_ec2_ec2SumTImeoutEnabled,
   "@aws-cdk/aws-ec2:launchTemplateDefaultUserData": () => _aws_cdk_aws_ec2_launchTemplateDefaultUserData,
+  "@aws-cdk/aws-ec2:requirePrivateSubnetsForEgressOnlyInternetGateway": () => _aws_cdk_aws_ec2_requirePrivateSubnetsForEgressOnlyInternetGateway,
   "@aws-cdk/aws-ec2:restrictDefaultSecurityGroup": () => _aws_cdk_aws_ec2_restrictDefaultSecurityGroup,
   "@aws-cdk/aws-ec2:uniqueImdsv2TemplateName": () => _aws_cdk_aws_ec2_uniqueImdsv2TemplateName,
   "@aws-cdk/aws-ecs:arnFormatIncludesClusterName": () => _aws_cdk_aws_ecs_arnFormatIncludesClusterName,
@@ -12847,6 +12890,7 @@ __export(recommended_feature_flags_exports, {
   "@aws-cdk/aws-route53-targets:userPoolDomainNameMethodWithoutCustomResource": () => _aws_cdk_aws_route53_targets_userPoolDomainNameMethodWithoutCustomResource,
   "@aws-cdk/aws-s3:createDefaultLoggingPolicy": () => _aws_cdk_aws_s3_createDefaultLoggingPolicy,
   "@aws-cdk/aws-s3:keepNotificationInImportedBucket": () => _aws_cdk_aws_s3_keepNotificationInImportedBucket,
+  "@aws-cdk/aws-s3:publicAccessBlockedByDefault": () => _aws_cdk_aws_s3_publicAccessBlockedByDefault,
   "@aws-cdk/aws-s3:serverAccessLogsUseBucketPolicy": () => _aws_cdk_aws_s3_serverAccessLogsUseBucketPolicy,
   "@aws-cdk/aws-s3:setUniqueReplicationRoleName": () => _aws_cdk_aws_s3_setUniqueReplicationRoleName,
   "@aws-cdk/aws-secretsmanager:useAttachedSecretResourcePolicyForSecretTargetAttachments": () => _aws_cdk_aws_secretsmanager_useAttachedSecretResourcePolicyForSecretTargetAttachments,
@@ -12867,7 +12911,7 @@ __export(recommended_feature_flags_exports, {
   "@aws-cdk/s3-notifications:addS3TrustKeyPolicyForSnsSubscriptions": () => _aws_cdk_s3_notifications_addS3TrustKeyPolicyForSnsSubscriptions,
   default: () => recommended_feature_flags_default
 });
-var _aws_cdk_aws_lambda_recognizeLayerVersion, _aws_cdk_core_checkSecretUsage, _aws_cdk_core_target_partitions, _aws_cdk_containers_ecs_service_extensions_enableDefaultLogDriver, _aws_cdk_aws_ec2_uniqueImdsv2TemplateName, _aws_cdk_aws_ecs_arnFormatIncludesClusterName, _aws_cdk_aws_iam_minimizePolicies, _aws_cdk_core_validateSnapshotRemovalPolicy, _aws_cdk_aws_codepipeline_crossAccountKeyAliasStackSafeResourceName, _aws_cdk_aws_s3_createDefaultLoggingPolicy, _aws_cdk_aws_sns_subscriptions_restrictSqsDescryption, _aws_cdk_aws_apigateway_disableCloudWatchRole, _aws_cdk_core_enablePartitionLiterals, _aws_cdk_aws_events_eventsTargetQueueSameAccount, _aws_cdk_aws_ecs_disableExplicitDeploymentControllerForCircuitBreaker, _aws_cdk_aws_iam_importedRoleStackSafeDefaultPolicyName, _aws_cdk_aws_s3_serverAccessLogsUseBucketPolicy, _aws_cdk_aws_route53_patters_useCertificate, _aws_cdk_customresources_installLatestAwsSdkDefault, _aws_cdk_aws_rds_databaseProxyUniqueResourceName, _aws_cdk_aws_codedeploy_removeAlarmsFromDeploymentGroup, _aws_cdk_aws_apigateway_authorizerChangeDeploymentLogicalId, _aws_cdk_aws_ec2_launchTemplateDefaultUserData, _aws_cdk_aws_secretsmanager_useAttachedSecretResourcePolicyForSecretTargetAttachments, _aws_cdk_aws_redshift_columnId, _aws_cdk_aws_stepfunctions_tasks_enableEmrServicePolicyV2, _aws_cdk_aws_ec2_restrictDefaultSecurityGroup, _aws_cdk_aws_apigateway_requestValidatorUniqueId, _aws_cdk_aws_kms_aliasNameRef, _aws_cdk_aws_autoscaling_generateLaunchTemplateInsteadOfLaunchConfig, _aws_cdk_core_includePrefixInUniqueNameGeneration, _aws_cdk_aws_efs_denyAnonymousAccess, _aws_cdk_aws_opensearchservice_enableOpensearchMultiAzWithStandby, _aws_cdk_aws_lambda_nodejs_useLatestRuntimeVersion, _aws_cdk_aws_efs_mountTargetOrderInsensitiveLogicalId, _aws_cdk_aws_rds_auroraClusterChangeScopeOfInstanceParameterGroupWithEachParameters, _aws_cdk_aws_appsync_useArnForSourceApiAssociationIdentifier, _aws_cdk_aws_rds_preventRenderingDeprecatedCredentials, _aws_cdk_aws_codepipeline_actions_useNewDefaultBranchForCodeCommitSource, _aws_cdk_aws_cloudwatch_actions_changeLambdaPermissionLogicalIdForLambdaAction, _aws_cdk_aws_codepipeline_crossAccountKeysDefaultValueToFalse, _aws_cdk_aws_codepipeline_defaultPipelineTypeToV2, _aws_cdk_aws_kms_reduceCrossAccountRegionPolicyScope, _aws_cdk_aws_eks_nodegroupNameAttribute, _aws_cdk_aws_ec2_ebsDefaultGp3Volume, _aws_cdk_aws_ecs_removeDefaultDeploymentAlarm, _aws_cdk_custom_resources_logApiResponseDataPropertyTrueDefault, _aws_cdk_aws_s3_keepNotificationInImportedBucket, _aws_cdk_aws_ecs_enableImdsBlockingDeprecatedFeature, _aws_cdk_aws_ecs_disableEcsImdsBlocking, _aws_cdk_aws_ecs_reduceEc2FargateCloudWatchPermissions, _aws_cdk_aws_dynamodb_resourcePolicyPerReplica, _aws_cdk_aws_ec2_ec2SumTImeoutEnabled, _aws_cdk_aws_appsync_appSyncGraphQLAPIScopeLambdaPermission, _aws_cdk_aws_rds_setCorrectValueForDatabaseInstanceReadReplicaInstanceResourceId, _aws_cdk_core_cfnIncludeRejectComplexResourceUpdateCreatePolicyIntrinsics, _aws_cdk_aws_lambda_nodejs_sdkV3ExcludeSmithyPackages, _aws_cdk_aws_stepfunctions_tasks_fixRunEcsTaskPolicy, _aws_cdk_aws_ec2_bastionHostUseAmazonLinux2023ByDefault, _aws_cdk_aws_route53_targets_userPoolDomainNameMethodWithoutCustomResource, _aws_cdk_aws_elasticloadbalancingV2_albDualstackWithoutPublicIpv4SecurityGroupRulesDefault, _aws_cdk_aws_iam_oidcRejectUnauthorizedConnections, _aws_cdk_core_enableAdditionalMetadataCollection, _aws_cdk_aws_lambda_createNewPoliciesWithAddToRolePolicy, _aws_cdk_aws_s3_setUniqueReplicationRoleName, _aws_cdk_aws_events_requireEventBusPolicySid, _aws_cdk_core_aspectPrioritiesMutating, _aws_cdk_aws_dynamodb_retainTableReplica, _aws_cdk_aws_stepfunctions_useDistributedMapResultWriterV2, _aws_cdk_s3_notifications_addS3TrustKeyPolicyForSnsSubscriptions, recommended_feature_flags_default;
+var _aws_cdk_aws_lambda_recognizeLayerVersion, _aws_cdk_core_checkSecretUsage, _aws_cdk_core_target_partitions, _aws_cdk_containers_ecs_service_extensions_enableDefaultLogDriver, _aws_cdk_aws_ec2_uniqueImdsv2TemplateName, _aws_cdk_aws_ecs_arnFormatIncludesClusterName, _aws_cdk_aws_iam_minimizePolicies, _aws_cdk_core_validateSnapshotRemovalPolicy, _aws_cdk_aws_codepipeline_crossAccountKeyAliasStackSafeResourceName, _aws_cdk_aws_s3_createDefaultLoggingPolicy, _aws_cdk_aws_sns_subscriptions_restrictSqsDescryption, _aws_cdk_aws_apigateway_disableCloudWatchRole, _aws_cdk_core_enablePartitionLiterals, _aws_cdk_aws_events_eventsTargetQueueSameAccount, _aws_cdk_aws_ecs_disableExplicitDeploymentControllerForCircuitBreaker, _aws_cdk_aws_iam_importedRoleStackSafeDefaultPolicyName, _aws_cdk_aws_s3_serverAccessLogsUseBucketPolicy, _aws_cdk_aws_route53_patters_useCertificate, _aws_cdk_customresources_installLatestAwsSdkDefault, _aws_cdk_aws_rds_databaseProxyUniqueResourceName, _aws_cdk_aws_codedeploy_removeAlarmsFromDeploymentGroup, _aws_cdk_aws_apigateway_authorizerChangeDeploymentLogicalId, _aws_cdk_aws_ec2_launchTemplateDefaultUserData, _aws_cdk_aws_secretsmanager_useAttachedSecretResourcePolicyForSecretTargetAttachments, _aws_cdk_aws_redshift_columnId, _aws_cdk_aws_stepfunctions_tasks_enableEmrServicePolicyV2, _aws_cdk_aws_ec2_restrictDefaultSecurityGroup, _aws_cdk_aws_apigateway_requestValidatorUniqueId, _aws_cdk_aws_kms_aliasNameRef, _aws_cdk_aws_autoscaling_generateLaunchTemplateInsteadOfLaunchConfig, _aws_cdk_core_includePrefixInUniqueNameGeneration, _aws_cdk_aws_efs_denyAnonymousAccess, _aws_cdk_aws_opensearchservice_enableOpensearchMultiAzWithStandby, _aws_cdk_aws_lambda_nodejs_useLatestRuntimeVersion, _aws_cdk_aws_efs_mountTargetOrderInsensitiveLogicalId, _aws_cdk_aws_rds_auroraClusterChangeScopeOfInstanceParameterGroupWithEachParameters, _aws_cdk_aws_appsync_useArnForSourceApiAssociationIdentifier, _aws_cdk_aws_rds_preventRenderingDeprecatedCredentials, _aws_cdk_aws_codepipeline_actions_useNewDefaultBranchForCodeCommitSource, _aws_cdk_aws_cloudwatch_actions_changeLambdaPermissionLogicalIdForLambdaAction, _aws_cdk_aws_codepipeline_crossAccountKeysDefaultValueToFalse, _aws_cdk_aws_codepipeline_defaultPipelineTypeToV2, _aws_cdk_aws_kms_reduceCrossAccountRegionPolicyScope, _aws_cdk_aws_eks_nodegroupNameAttribute, _aws_cdk_aws_ec2_ebsDefaultGp3Volume, _aws_cdk_aws_ecs_removeDefaultDeploymentAlarm, _aws_cdk_custom_resources_logApiResponseDataPropertyTrueDefault, _aws_cdk_aws_s3_keepNotificationInImportedBucket, _aws_cdk_aws_ecs_enableImdsBlockingDeprecatedFeature, _aws_cdk_aws_ecs_disableEcsImdsBlocking, _aws_cdk_aws_ecs_reduceEc2FargateCloudWatchPermissions, _aws_cdk_aws_dynamodb_resourcePolicyPerReplica, _aws_cdk_aws_ec2_ec2SumTImeoutEnabled, _aws_cdk_aws_appsync_appSyncGraphQLAPIScopeLambdaPermission, _aws_cdk_aws_rds_setCorrectValueForDatabaseInstanceReadReplicaInstanceResourceId, _aws_cdk_core_cfnIncludeRejectComplexResourceUpdateCreatePolicyIntrinsics, _aws_cdk_aws_lambda_nodejs_sdkV3ExcludeSmithyPackages, _aws_cdk_aws_stepfunctions_tasks_fixRunEcsTaskPolicy, _aws_cdk_aws_ec2_bastionHostUseAmazonLinux2023ByDefault, _aws_cdk_aws_route53_targets_userPoolDomainNameMethodWithoutCustomResource, _aws_cdk_aws_elasticloadbalancingV2_albDualstackWithoutPublicIpv4SecurityGroupRulesDefault, _aws_cdk_aws_iam_oidcRejectUnauthorizedConnections, _aws_cdk_core_enableAdditionalMetadataCollection, _aws_cdk_aws_lambda_createNewPoliciesWithAddToRolePolicy, _aws_cdk_aws_s3_setUniqueReplicationRoleName, _aws_cdk_aws_events_requireEventBusPolicySid, _aws_cdk_core_aspectPrioritiesMutating, _aws_cdk_aws_dynamodb_retainTableReplica, _aws_cdk_aws_stepfunctions_useDistributedMapResultWriterV2, _aws_cdk_s3_notifications_addS3TrustKeyPolicyForSnsSubscriptions, _aws_cdk_aws_ec2_requirePrivateSubnetsForEgressOnlyInternetGateway, _aws_cdk_aws_s3_publicAccessBlockedByDefault, recommended_feature_flags_default;
 var init_recommended_feature_flags = __esm({
   "lib/recommended-feature-flags.json"() {
     _aws_cdk_aws_lambda_recognizeLayerVersion = true;
@@ -12943,6 +12987,8 @@ var init_recommended_feature_flags = __esm({
     _aws_cdk_aws_dynamodb_retainTableReplica = true;
     _aws_cdk_aws_stepfunctions_useDistributedMapResultWriterV2 = true;
     _aws_cdk_s3_notifications_addS3TrustKeyPolicyForSnsSubscriptions = true;
+    _aws_cdk_aws_ec2_requirePrivateSubnetsForEgressOnlyInternetGateway = true;
+    _aws_cdk_aws_s3_publicAccessBlockedByDefault = true;
     recommended_feature_flags_default = {
       "@aws-cdk/aws-lambda:recognizeLayerVersion": _aws_cdk_aws_lambda_recognizeLayerVersion,
       "@aws-cdk/core:checkSecretUsage": _aws_cdk_core_checkSecretUsage,
@@ -13013,7 +13059,9 @@ var init_recommended_feature_flags = __esm({
       "@aws-cdk/core:aspectPrioritiesMutating": _aws_cdk_core_aspectPrioritiesMutating,
       "@aws-cdk/aws-dynamodb:retainTableReplica": _aws_cdk_aws_dynamodb_retainTableReplica,
       "@aws-cdk/aws-stepfunctions:useDistributedMapResultWriterV2": _aws_cdk_aws_stepfunctions_useDistributedMapResultWriterV2,
-      "@aws-cdk/s3-notifications:addS3TrustKeyPolicyForSnsSubscriptions": _aws_cdk_s3_notifications_addS3TrustKeyPolicyForSnsSubscriptions
+      "@aws-cdk/s3-notifications:addS3TrustKeyPolicyForSnsSubscriptions": _aws_cdk_s3_notifications_addS3TrustKeyPolicyForSnsSubscriptions,
+      "@aws-cdk/aws-ec2:requirePrivateSubnetsForEgressOnlyInternetGateway": _aws_cdk_aws_ec2_requirePrivateSubnetsForEgressOnlyInternetGateway,
+      "@aws-cdk/aws-s3:publicAccessBlockedByDefault": _aws_cdk_aws_s3_publicAccessBlockedByDefault
     };
   }
 });

package/package.json

@@ -45,31 +45,31 @@
     "@types/yargs": "^17.0.33",
     "@typescript-eslint/eslint-plugin": "^8",
     "@typescript-eslint/parser": "^8",
-    "aws-cdk-lib": "^2.195.0",
+    "aws-cdk-lib": "^2.196.0",
     "commit-and-tag-version": "^12",
     "constructs": "^10",
     "eslint": "^9",
     "eslint-config-prettier": "^10.1.5",
-    "eslint-import-resolver-typescript": "^4.3.4",
+    "eslint-import-resolver-typescript": "^4.3.5",
     "eslint-plugin-import": "^2.31.0",
     "eslint-plugin-jest": "^28.11.0",
-    "eslint-plugin-jsdoc": "^50.6.14",
+    "eslint-plugin-jsdoc": "^50.6.17",
     "eslint-plugin-prettier": "^5.4.0",
     "jest": "^29.7.0",
     "jest-junit": "^16",
     "license-checker": "^25.0.1",
     "mock-fs": "^5",
     "prettier": "^2.8",
-    "ts-jest": "^29.3.2",
+    "ts-jest": "^29.3.4",
     "typescript": "5.6",
-    "@aws-cdk/aws-service-spec": "^0.1.72",
+    "@aws-cdk/aws-service-spec": "^0.1.73",
     "@aws-cdk/cdk-cli-wrapper": "0.0.0",
-    "@aws-cdk/cloud-assembly-schema": ">=43.10.0",
+    "@aws-cdk/cloud-assembly-schema": ">=43.12.0",
     "@aws-cdk/cloudformation-diff": "2.181.2",
-    "@aws-cdk/cx-api": "^2.195.0",
+    "@aws-cdk/cx-api": "^2.196.0",
     "@aws-sdk/client-cloudformation": "^3",
-    "aws-cdk": "2.1015.0",
-    "cdk-assets": "3.2.2",
+    "aws-cdk": "2.1016.1",
+    "cdk-assets": "3.2.3",
     "chalk": "^4",
     "chokidar": "^3",
     "fs-extra": "^9",
@@ -77,8 +77,8 @@
     "yargs": "^16"
   },
   "dependencies": {
-    "@aws-cdk/aws-service-spec": "0.1.72",
-    "aws-cdk": "2.1015.0"
+    "@aws-cdk/aws-service-spec": "0.1.73",
+    "aws-cdk": "2.1016.1"
   },
   "keywords": [
     "aws",
@@ -93,7 +93,7 @@
   "publishConfig": {
     "access": "public"
   },
-  "version": "2.186.7",
+  "version": "2.186.9",
   "types": "lib/index.d.ts",
   "//": "~~ Generated by projen. To modify, edit .projenrc.js and run \"npx projen\".",
   "optionalDependencies": {