@intentius/chant-lexicon-aws 0.18.37 → 0.19.1

package/dist/integrity.json

@@ -1,9 +1,9 @@
 {
   "algorithm": "sha256",
   "artifacts": {
-    "manifest.json": "86b62ac993900475413852b8d72bd2191df18c78506c3d0e21d7dd2c49c68cb1",
-    "meta.json": "dcddef61188a10733c993daaca4c209c7f0948ee95a63c20477875cf794f596e",
-    "types/index.d.ts": "5444b8212f0ab3c649e0dd8b1e8d4824eeb5c33d58b0ec053c5ee3fb97da0413",
+    "manifest.json": "63edb731cb48bb0a2cf262db13361382f1ab61152d6b379cdf4fa892806e5b42",
+    "meta.json": "34f746d3e7e7ee7bb2578ac0ec3aa20b67567506620df877191f0f2393f2f98a",
+    "types/index.d.ts": "113961df90faaec43d71a1d2088f0f5d8b1b2694078ccd2cf4ae40a56f15833b",
     "rules/hardcoded-region.ts": "5a0eaf7ab391231fe6cd51426ece29539cb4b36f31c8dd060956638fed55722a",
     "rules/iam-wildcard.ts": "135d7217d278fef50939e605c5da32603ba35674b8c4b5c4d66a06c77903e945",
     "rules/s3-encryption.ts": "c4f9f8aa8dc382ed98c7b04e820a600590cc75335a8db2e087cbfbfe4003d09e",
@@ -56,7 +56,8 @@
     "rules/waw054.ts": "a1a9c1d1d04aebd72e14c01340f6203231d9513add64958edd42366aaa419d42",
     "rules/waw055.ts": "f924e6bca957da1860c7d56dd385d28d91ab57bfd0f1499077d63a9cfc5b81e5",
     "skills/chant-aws.md": "4d65eb160e001f2af42eb7c622a5b498c2fd1f5afbd6c8155615c010fb265c63",
-    "skills/chant-aws-eks.md": "8789255709ff004ad0a875fd5999edcdc66fc6e33d710db058d9f42703bcfdfe"
+    "skills/chant-aws-eks.md": "8789255709ff004ad0a875fd5999edcdc66fc6e33d710db058d9f42703bcfdfe",
+    "skills/chant-aws-carve-terraform.md": "f4c6fe1c702250665f90d82b3bdaba5ea50ae75e380a8ae321dad6eb1c39683e"
   },
-  "composite": "b4333dc803950e8e7a3b92f4b51f7b97769d387f27c560a1bd2b1d8a2648f54d"
+  "composite": "8fed2d6136907de0510e58410d8468221c166f35caa702b6550ad05891e83e68"
 }

package/dist/manifest.json

@@ -1,6 +1,6 @@
 {
   "name": "aws",
-  "version": "0.18.37",
+  "version": "0.19.1",
   "chantVersion": ">=0.1.0",
   "namespace": "AWS",
   "intrinsics": [

package/dist/meta.json

@@ -17336,6 +17336,21 @@
     "kind": "property",
     "lexicon": "aws"
   },
+  "ComputeNodeGroup_NodeLifecycleActions": {
+    "resourceType": "AWS::PCS::ComputeNodeGroup.NodeLifecycleActions",
+    "kind": "property",
+    "lexicon": "aws"
+  },
+  "ComputeNodeGroup_NodeLifecycleScript": {
+    "resourceType": "AWS::PCS::ComputeNodeGroup.NodeLifecycleScript",
+    "kind": "property",
+    "lexicon": "aws"
+  },
+  "ComputeNodeGroup_NodeLifecycleStages": {
+    "resourceType": "AWS::PCS::ComputeNodeGroup.NodeLifecycleStages",
+    "kind": "property",
+    "lexicon": "aws"
+  },
   "ComputeOptimizerAutomationRule": {
     "resourceType": "AWS::ComputeOptimizer::AutomationRule",
     "kind": "resource",
@@ -30411,13 +30426,10 @@
     "createOnly": [
       "ServiceType",
       "ServiceDetails/Dynatrace",
-      "ServiceDetails/MCPServer",
       "ServiceDetails/MCPServerSplunk",
-      "ServiceDetails/MCPServerNewRelic",
       "ServiceDetails/ServiceNow",
       "ServiceDetails/PagerDuty",
       "ServiceDetails/AzureIdentity",
-      "ServiceDetails/MCPServerGrafana",
       "KmsKeyArn"
     ],
     "writeOnly": [
@@ -65631,6 +65643,21 @@
     "kind": "property",
     "lexicon": "aws"
   },
+  "NodeLifecycleActions": {
+    "resourceType": "AWS::PCS::ComputeNodeGroup.NodeLifecycleActions",
+    "kind": "property",
+    "lexicon": "aws"
+  },
+  "NodeLifecycleScript": {
+    "resourceType": "AWS::PCS::ComputeNodeGroup.NodeLifecycleScript",
+    "kind": "property",
+    "lexicon": "aws"
+  },
+  "NodeLifecycleStages": {
+    "resourceType": "AWS::PCS::ComputeNodeGroup.NodeLifecycleStages",
+    "kind": "property",
+    "lexicon": "aws"
+  },
   "NodeOption": {
     "resourceType": "AWS::OpenSearchService::Domain.NodeOption",
     "kind": "property",
@@ -71810,7 +71837,8 @@
     "kind": "resource",
     "lexicon": "aws",
     "attrs": {
-      "GroupName": "GroupName"
+      "GroupName": "GroupName",
+      "GroupId": "GroupId"
     },
     "createOnly": [
       "Tags",
@@ -77039,6 +77067,9 @@
     "resourceType": "AWS::RDS::DBSubnetGroup",
     "kind": "resource",
     "lexicon": "aws",
+    "attrs": {
+      "DBSubnetGroupArn": "DBSubnetGroupArn"
+    },
     "createOnly": [
       "DBSubnetGroupName"
     ],

package/dist/plugin.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"plugin.d.ts","sourceRoot":"","sources":["../src/plugin.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,aAAa,EAA+G,MAAM,0BAA0B,CAAC;AAwB3K;;sFAEsF;AACtF,wBAAgB,iBAAiB,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAEzD;AAED;;;;;GAKG;AACH,eAAO,MAAM,SAAS,EAAE,aAytBvB,CAAC"}
+{"version":3,"file":"plugin.d.ts","sourceRoot":"","sources":["../src/plugin.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,aAAa,EAA+G,MAAM,0BAA0B,CAAC;AAwB3K;;sFAEsF;AACtF,wBAAgB,iBAAiB,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAEzD;AAED;;;;;GAKG;AACH,eAAO,MAAM,SAAS,EAAE,aA+vBvB,CAAC"}

package/dist/skills/chant-aws-carve-terraform.md

@@ -0,0 +1,102 @@
+---
+skill: chant-aws-carve-terraform
+description: Demo carving a resource out of Terraform into native chant — advise, emit, bridge, apply — fully offline
+user-invocable: true
+---
+
+# Carve a resource out of Terraform (demo)
+
+Use this skill to cleanly demonstrate chant's Terraform carve-out flow for
+someone. The whole demo runs **offline** — no cloud account, no Terraform
+binary, no state backend. It carves an AWS S3 bucket out of a small Terraform
+estate into native chant source, patches the survivors, and plans the
+graduation.
+
+## When to use
+
+- Someone asks "how does chant move things off Terraform?"
+- You want to show the advise → emit → bridge → apply loop end to end.
+- You are evaluating whether a Terraform estate is worth carving.
+
+## Preconditions
+
+- `chant --version` succeeds.
+- `@cdktf/hcl2json` is installed (the HCL parser). If a command reports it is
+  missing, run `npm install -D @cdktf/hcl2json` once.
+
+## The fastest path: run the bundled demo
+
+The `examples/terraform-carve-out` example ships a runnable estate + state and a
+script that runs all four steps with commentary:
+
+```bash
+cd examples/terraform-carve-out
+./demo.sh
+```
+
+Walk the person through the output. That is the whole demo.
+
+## Driving it step by step (to explain each stage)
+
+From `examples/terraform-carve-out`, with `TF=./terraform`:
+
+1. **Advise — what is cheap to carve.**
+   ```bash
+   chant carve advise --from ./terraform
+   ```
+   Point out the three bands: clean leaves (carve now), carvable with edits,
+   and leave-in-Terraform. `aws_s3_bucket.assets` is a clean leaf held back one
+   notch by the Lambda that reads it; `random_pet` has no native mapping.
+
+2. **Emit — adopt the bucket into chant source, offline, from state.**
+   ```bash
+   chant carve emit --from ./terraform --select aws_s3_bucket.assets \
+     --state ./terraform/terraform.tfstate --output ./carveout
+   ```
+   Show `./carveout/assets.ts` — a real `new Bucket({ BucketName, Tags })` with
+   CloudFormation-style properties mapped from the Terraform state attributes.
+   Explain: a Terraform-managed resource is not in any CloudFormation stack, so
+   the correct source of its live shape is the state file, not a cloud read.
+
+3. **Lint the inherited resource — optional, offer it.**
+   ```bash
+   chant lint ./carveout --lexicon aws
+   ```
+   After emit, offer to lint the carved source. chant audits the resource you
+   inherited from Terraform against the AWS lexicon's rules. Findings have a
+   severity: `error` (must fix before `chant build` will emit — e.g. an S3
+   bucket with no public-access block) and `warning`/`info` (advisory — e.g.
+   DynamoDB point-in-time recovery). This is a feature of carving: chant
+   immediately tells the person what is wrong with what they adopted. Whether to
+   fix an advisory finding is their call; errors block the build until resolved.
+
+4. **Bridge — patch the surviving Terraform.**
+   ```bash
+   chant carve bridge --from ./terraform --select aws_s3_bucket.assets --output ./carveout
+   ```
+   Show the generated `data "aws_s3_bucket" "assets"` and the rewired survivor.
+   Emphasize it is dry-run: nothing in `./terraform` changed. `--apply-rewrites`
+   would edit it in place.
+
+5. **Apply — graduation plan.**
+   ```bash
+   chant carve apply --from ./terraform --select aws_s3_bucket.assets --env prod --stack assets
+   ```
+   Show the ownership marker (`chant:managed-by/stack/env`) and the finalized
+   runbook. Stress this makes no cloud call — the apply is the person's own
+   lifecycle; chant just plans it.
+
+## Key points to land
+
+- Nothing is destroyed or applied; every step before graduation is reversible
+  with `terraform import`.
+- You carve one resource at a time. The gnarly long tail stays in Terraform.
+- `advise` and `bridge` work against **any** Terraform tree — offer to point
+  them at the person's own estate.
+
+## Going live (only if asked)
+
+The real handoff adds three Terraform commands between bridge and apply:
+`terraform state rm <addr>` (stops managing it, does not destroy), then
+`terraform plan && terraform apply` to land the survivor patch. See the
+generated runbook in `./carveout/<addr>-runbook.md`.

package/dist/types/index.d.ts

@@ -6187,6 +6187,7 @@ export declare class ComputeNodeGroup {
     Id?: string;
     /** The name that identifies the compute node group. */
     Name?: string;
+    NodeLifecycleActions?: ComputeNodeGroup_NodeLifecycleActions;
     /** Specifies how EC2 instances are purchased on your behalf. AWS PCS supports On-Demand, Spot, Capacity Block, and Interruptible Capacity Reservation instances. For more information, see Instance purchasing options in the Amazon Elastic Compute Cloud User Guide. If you don't provide this option, it defaults to On-Demand. */
     PurchaseOption?: "CAPACITY_BLOCK" | "INTERRUPTIBLE_CAPACITY_RESERVATION" | "ONDEMAND" | "SPOT";
     /** Additional options related to the Slurm scheduler. */
@@ -9753,7 +9754,7 @@ export declare class DbInstance {
     /** The name or Amazon Resource Name (ARN) of the DB snapshot that's used to restore the DB instance. If you're restoring from a shared manual DB snapshot, you must specify the ARN of the snapshot.
  By specifying this property, you can create a DB instance from the specified DB snapshot. If the ``DBSnapshotIdentifier`` property is an empty string or the ``AWS::RDS::DBInstance`` declaration has no ``DBSnapshotIdentifier`` property, AWS CloudFormation creates a new database. If the property contains a value (other than an empty string), AWS CloudFormation creates a database from the specified snapshot. If a snapshot with the specified name doesn't exist, AWS CloudFormation can't create the database and it rolls back the stack.
  Some DB instance properties aren't valid when you restore from a snapshot, such as the ``MasterUsername`` and ``MasterUserPassword`` properties, and the point-in-time recovery properties ``RestoreTime`` and ``UseLatestRestorableTime``. For information about the properties that you can specify, see the [RestoreDBInstanceFromDBSnapshot](https://docs.aws.amazon.com/AmazonRDS/latest/APIReference/API_RestoreDBInstanceFromDBSnapshot.html) action in the *Amazon RDS API Reference*.
- After you restore a DB instance with a ``DBSnapshotIdentifier`` property, you must specify the same ``DBSnapshotIdentifier`` property for any future updates to the DB instance. When you specify this property for an update, the DB instance is not restored from the DB snapshot again, and the data in the database is not changed. However, if you don't specify the ``DBSnapshotIdentifier`` property, an empty DB instance is created, and the original DB instance is deleted. If you specify a property that is different from the previous snapshot restore property, a new DB instance is restored from the specified ``DBSnapshotIdentifier`` property, and the original DB instance is deleted.
+ When you specify the same ``DBSnapshotIdentifier`` property value for an update, the DB instance is not restored from the DB snapshot again, and the data in the database is not changed. If you specify a different ``DBSnapshotIdentifier`` value, a new DB instance is restored from the specified snapshot, and the original DB instance is deleted.
  If you specify the ``DBSnapshotIdentifier`` property to restore a DB instance (as opposed to specifying it for DB instance updates), then don't specify the following properties:
   +   ``CharacterSetName`` 
   +   ``DBClusterIdentifier`` 
@@ -9916,7 +9917,7 @@ export declare class DbInstance {
   +  Aurora PostgreSQL - ``postgresql-license``
   +  RDS for Db2 - ``bring-your-own-license``. For more information about RDS for Db2 licensing, see [](https://docs.aws.amazon.com/AmazonRDS/latest/UserGuide/db2-licensing.html) in the *Amazon RDS User Guide.*
   +  RDS for MariaDB - ``general-public-license``
-  +  RDS for Microsoft SQL Server - ``license-included``
+  +  RDS for Microsoft SQL Server - ``license-included`` or ``bring-your-own-media``
   +  RDS for MySQL - ``general-public-license``
   +  RDS for Oracle - ``bring-your-own-license`` or ``license-included``
   +  RDS for PostgreSQL - ``postgresql-license``
@@ -12430,7 +12431,6 @@ export declare class EgressOnlyInternetGateway {
 
 export declare class EIP {
   constructor(props: {
-    /** An Elastic IP address or a carrier IP address in a Wavelength Zone. */
     Address?: string;
     AllocationId?: string;
     /** The network (``vpc``).
@@ -12439,7 +12439,6 @@ export declare class EIP {
     /** The ID of the instance.
   Updates to the ``InstanceId`` property may require *some interruptions*. Updates on an EIP reassociates the address on its associated resource. */
     InstanceId?: string;
-    /** The ID of an IPAM pool which has an Amazon-provided or BYOIP public IPv4 CIDR provisioned to it. For more information, see [Allocate sequential Elastic IP addresses from an IPAM pool](https://docs.aws.amazon.com/vpc/latest/ipam/tutorials-eip-pool.html) in the *Amazon VPC IPAM User Guide*. */
     IpamPoolId?: string;
     /** A unique set of Availability Zones, Local Zones, or Wavelength Zones from which AWS advertises IP addresses. Use this parameter to limit the IP address to this location. IP addresses cannot move between network border groups.
  Use [DescribeAvailabilityZones](https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_DescribeAvailabilityZones.html) to view the network border groups. */
@@ -26047,6 +26046,8 @@ export declare class PlaceIndex {
 
 export declare class PlacementGroup {
   constructor(props: {
+    /** The ID of the placement group. */
+    GroupId?: string;
     /** The Group Name of Placement Group. */
     GroupName?: string;
     /** The number of partitions. Valid only when **Strategy** is set to `partition` */
@@ -26058,6 +26059,7 @@ export declare class PlacementGroup {
     /** An array of key-value pairs to apply to this resource. */
     Tags?: PlacementGroup_Tag[];
   }, attributes?: CFResourceAttributes);
+  readonly GroupId: string;
   readonly GroupName: string;
 }
 
@@ -27827,6 +27829,7 @@ export declare class RDSDBParameterGroup {
   +   ``aurora-mysql`` 
   +   ``aurora-postgresql`` 
   +   ``db2-ae`` 
+  +   ``db2-ce`` 
   +   ``db2-se`` 
   +   ``mysql`` 
   +   ``oracle-ee`` 
@@ -27863,6 +27866,7 @@ export declare class RDSDBSubnetGroup {
     DBSubnetGroupDescription: string;
     /** The EC2 Subnet IDs for the DB subnet group. */
     SubnetIds: string[];
+    DBSubnetGroupArn?: string;
     /** The name for the DB subnet group. This value is stored as a lowercase string.
  Constraints:
   +  Must contain no more than 255 letters, numbers, periods, underscores, spaces, or hyphens.
@@ -27874,6 +27878,7 @@ export declare class RDSDBSubnetGroup {
     /** Tags to assign to the DB subnet group. */
     Tags?: RDSDBSubnetGroup_Tag[];
   }, attributes?: CFResourceAttributes);
+  readonly DBSubnetGroupArn: string;
 }
 
 export declare class RDSEventSubscription {
@@ -53906,6 +53911,37 @@ export declare class ComputeNodeGroup_InstanceConfig {
   });
 }
 
+export declare class ComputeNodeGroup_NodeLifecycleActions {
+  constructor(props: {
+    Stages: ComputeNodeGroup_NodeLifecycleStages;
+    /** Controls whether lifecycle scripts are downloaded once at first boot (CACHE_ONCE) or re-downloaded on every reboot (REFRESH_ON_REBOOT). Defaults to CACHE_ONCE. */
+    ScriptCachingPolicy?: "CACHE_ONCE" | "REFRESH_ON_REBOOT";
+  });
+}
+
+export declare class ComputeNodeGroup_NodeLifecycleScript {
+  constructor(props: {
+    /** A human-readable name that identifies the script. */
+    Name: string;
+    ScriptSource: Record<string, unknown>;
+    /** An ordered list of arguments passed to the script. */
+    Arguments?: string[];
+    /** Whether the script runs only on the node's first boot (FIRST_BOOT_ONLY) or on every boot including reboots (EVERY_BOOT). Defaults to FIRST_BOOT_ONLY. */
+    ExecutionPolicy?: "EVERY_BOOT" | "FIRST_BOOT_ONLY";
+    /** The behavior when the script exits with an error. Defaults to TERMINATE. */
+    OnError?: "CONTINUE" | "STOP_SEQUENCE" | "TERMINATE";
+  });
+}
+
+export declare class ComputeNodeGroup_NodeLifecycleStages {
+  constructor(props: {
+    /** Scripts to run after the node is bootstrapped, once the PCS configuration phase completes and before slurmd starts. */
+    NodeBootstrapped?: ComputeNodeGroup_NodeLifecycleScript[];
+    /** Scripts to execute when the node becomes ready (every boot). */
+    NodeReady?: ComputeNodeGroup_NodeLifecycleScript[];
+  });
+}
+
 export declare class ComputeNodeGroupConfiguration {
   constructor(props: {
     /** The compute node group ID for the compute node group configuration. */
@@ -55924,9 +55960,9 @@ export declare class ConnectRule_Tag {
 export declare class ConnectSecurityProfile_Application {
   constructor(props: {
     /** The permissions that the agent is granted on the application */
-    ApplicationPermissions: string[];
+    ApplicationPermissions?: string[];
     /** Namespace of the application that you want to give access to. */
-    Namespace: string;
+    Namespace?: string;
     /** The type of the application. */
     Type?: "MCP" | "THIRD_PARTY_APPLICATION";
   });
@@ -55935,9 +55971,9 @@ export declare class ConnectSecurityProfile_Application {
 export declare class ConnectSecurityProfile_FlowModule {
   constructor(props: {
     /** The identifier of the application that you want to give access to. */
-    FlowModuleId: string;
+    FlowModuleId?: string;
     /** The type of the first-party application */
-    Type: string;
+    Type?: string;
   });
 }
 
@@ -72139,9 +72175,9 @@ export declare class FlowLog_TagFieldSpecification {
 export declare class FlowModule {
   constructor(props: {
     /** The identifier of the application that you want to give access to. */
-    FlowModuleId: string;
+    FlowModuleId?: string;
     /** The type of the first-party application */
-    Type: string;
+    Type?: string;
   });
 }
 
@@ -94527,6 +94563,37 @@ export declare class NodeInterfaceMapping {
   });
 }
 
+export declare class NodeLifecycleActions {
+  constructor(props: {
+    Stages: ComputeNodeGroup_NodeLifecycleStages;
+    /** Controls whether lifecycle scripts are downloaded once at first boot (CACHE_ONCE) or re-downloaded on every reboot (REFRESH_ON_REBOOT). Defaults to CACHE_ONCE. */
+    ScriptCachingPolicy?: "CACHE_ONCE" | "REFRESH_ON_REBOOT";
+  });
+}
+
+export declare class NodeLifecycleScript {
+  constructor(props: {
+    /** A human-readable name that identifies the script. */
+    Name: string;
+    ScriptSource: Record<string, unknown>;
+    /** An ordered list of arguments passed to the script. */
+    Arguments?: string[];
+    /** Whether the script runs only on the node's first boot (FIRST_BOOT_ONLY) or on every boot including reboots (EVERY_BOOT). Defaults to FIRST_BOOT_ONLY. */
+    ExecutionPolicy?: "EVERY_BOOT" | "FIRST_BOOT_ONLY";
+    /** The behavior when the script exits with an error. Defaults to TERMINATE. */
+    OnError?: "CONTINUE" | "STOP_SEQUENCE" | "TERMINATE";
+  });
+}
+
+export declare class NodeLifecycleStages {
+  constructor(props: {
+    /** Scripts to run after the node is bootstrapped, once the PCS configuration phase completes and before slurmd starts. */
+    NodeBootstrapped?: ComputeNodeGroup_NodeLifecycleScript[];
+    /** Scripts to execute when the node becomes ready (every boot). */
+    NodeReady?: ComputeNodeGroup_NodeLifecycleScript[];
+  });
+}
+
 export declare class NodeOption {
   constructor(props: {
     NodeConfig?: OpenSearchServiceDomain_NodeConfig;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@intentius/chant-lexicon-aws",
-  "version": "0.18.37",
+  "version": "0.19.1",
   "description": "AWS CloudFormation lexicon for chant — declarative IaC in TypeScript",
   "license": "Apache-2.0",
   "homepage": "https://intentius.io/chant",
@@ -80,7 +80,7 @@
     "typescript": "^5.9.3"
   },
   "peerDependencies": {
-    "@intentius/chant": "^0.18.37",
+    "@intentius/chant": "^0.19.1",
     "typescript": "^5.9.3"
   }
 }

package/src/generated/index.d.ts

@@ -6187,6 +6187,7 @@ export declare class ComputeNodeGroup {
     Id?: string;
     /** The name that identifies the compute node group. */
     Name?: string;
+    NodeLifecycleActions?: ComputeNodeGroup_NodeLifecycleActions;
     /** Specifies how EC2 instances are purchased on your behalf. AWS PCS supports On-Demand, Spot, Capacity Block, and Interruptible Capacity Reservation instances. For more information, see Instance purchasing options in the Amazon Elastic Compute Cloud User Guide. If you don't provide this option, it defaults to On-Demand. */
     PurchaseOption?: "CAPACITY_BLOCK" | "INTERRUPTIBLE_CAPACITY_RESERVATION" | "ONDEMAND" | "SPOT";
     /** Additional options related to the Slurm scheduler. */
@@ -9753,7 +9754,7 @@ export declare class DbInstance {
     /** The name or Amazon Resource Name (ARN) of the DB snapshot that's used to restore the DB instance. If you're restoring from a shared manual DB snapshot, you must specify the ARN of the snapshot.
  By specifying this property, you can create a DB instance from the specified DB snapshot. If the ``DBSnapshotIdentifier`` property is an empty string or the ``AWS::RDS::DBInstance`` declaration has no ``DBSnapshotIdentifier`` property, AWS CloudFormation creates a new database. If the property contains a value (other than an empty string), AWS CloudFormation creates a database from the specified snapshot. If a snapshot with the specified name doesn't exist, AWS CloudFormation can't create the database and it rolls back the stack.
  Some DB instance properties aren't valid when you restore from a snapshot, such as the ``MasterUsername`` and ``MasterUserPassword`` properties, and the point-in-time recovery properties ``RestoreTime`` and ``UseLatestRestorableTime``. For information about the properties that you can specify, see the [RestoreDBInstanceFromDBSnapshot](https://docs.aws.amazon.com/AmazonRDS/latest/APIReference/API_RestoreDBInstanceFromDBSnapshot.html) action in the *Amazon RDS API Reference*.
- After you restore a DB instance with a ``DBSnapshotIdentifier`` property, you must specify the same ``DBSnapshotIdentifier`` property for any future updates to the DB instance. When you specify this property for an update, the DB instance is not restored from the DB snapshot again, and the data in the database is not changed. However, if you don't specify the ``DBSnapshotIdentifier`` property, an empty DB instance is created, and the original DB instance is deleted. If you specify a property that is different from the previous snapshot restore property, a new DB instance is restored from the specified ``DBSnapshotIdentifier`` property, and the original DB instance is deleted.
+ When you specify the same ``DBSnapshotIdentifier`` property value for an update, the DB instance is not restored from the DB snapshot again, and the data in the database is not changed. If you specify a different ``DBSnapshotIdentifier`` value, a new DB instance is restored from the specified snapshot, and the original DB instance is deleted.
  If you specify the ``DBSnapshotIdentifier`` property to restore a DB instance (as opposed to specifying it for DB instance updates), then don't specify the following properties:
   +   ``CharacterSetName`` 
   +   ``DBClusterIdentifier`` 
@@ -9916,7 +9917,7 @@ export declare class DbInstance {
   +  Aurora PostgreSQL - ``postgresql-license``
   +  RDS for Db2 - ``bring-your-own-license``. For more information about RDS for Db2 licensing, see [](https://docs.aws.amazon.com/AmazonRDS/latest/UserGuide/db2-licensing.html) in the *Amazon RDS User Guide.*
   +  RDS for MariaDB - ``general-public-license``
-  +  RDS for Microsoft SQL Server - ``license-included``
+  +  RDS for Microsoft SQL Server - ``license-included`` or ``bring-your-own-media``
   +  RDS for MySQL - ``general-public-license``
   +  RDS for Oracle - ``bring-your-own-license`` or ``license-included``
   +  RDS for PostgreSQL - ``postgresql-license``
@@ -12430,7 +12431,6 @@ export declare class EgressOnlyInternetGateway {
 
 export declare class EIP {
   constructor(props: {
-    /** An Elastic IP address or a carrier IP address in a Wavelength Zone. */
     Address?: string;
     AllocationId?: string;
     /** The network (``vpc``).
@@ -12439,7 +12439,6 @@ export declare class EIP {
     /** The ID of the instance.
   Updates to the ``InstanceId`` property may require *some interruptions*. Updates on an EIP reassociates the address on its associated resource. */
     InstanceId?: string;
-    /** The ID of an IPAM pool which has an Amazon-provided or BYOIP public IPv4 CIDR provisioned to it. For more information, see [Allocate sequential Elastic IP addresses from an IPAM pool](https://docs.aws.amazon.com/vpc/latest/ipam/tutorials-eip-pool.html) in the *Amazon VPC IPAM User Guide*. */
     IpamPoolId?: string;
     /** A unique set of Availability Zones, Local Zones, or Wavelength Zones from which AWS advertises IP addresses. Use this parameter to limit the IP address to this location. IP addresses cannot move between network border groups.
  Use [DescribeAvailabilityZones](https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_DescribeAvailabilityZones.html) to view the network border groups. */
@@ -26047,6 +26046,8 @@ export declare class PlaceIndex {
 
 export declare class PlacementGroup {
   constructor(props: {
+    /** The ID of the placement group. */
+    GroupId?: string;
     /** The Group Name of Placement Group. */
     GroupName?: string;
     /** The number of partitions. Valid only when **Strategy** is set to `partition` */
@@ -26058,6 +26059,7 @@ export declare class PlacementGroup {
     /** An array of key-value pairs to apply to this resource. */
     Tags?: PlacementGroup_Tag[];
   }, attributes?: CFResourceAttributes);
+  readonly GroupId: string;
   readonly GroupName: string;
 }
 
@@ -27827,6 +27829,7 @@ export declare class RDSDBParameterGroup {
   +   ``aurora-mysql`` 
   +   ``aurora-postgresql`` 
   +   ``db2-ae`` 
+  +   ``db2-ce`` 
   +   ``db2-se`` 
   +   ``mysql`` 
   +   ``oracle-ee`` 
@@ -27863,6 +27866,7 @@ export declare class RDSDBSubnetGroup {
     DBSubnetGroupDescription: string;
     /** The EC2 Subnet IDs for the DB subnet group. */
     SubnetIds: string[];
+    DBSubnetGroupArn?: string;
     /** The name for the DB subnet group. This value is stored as a lowercase string.
  Constraints:
   +  Must contain no more than 255 letters, numbers, periods, underscores, spaces, or hyphens.
@@ -27874,6 +27878,7 @@ export declare class RDSDBSubnetGroup {
     /** Tags to assign to the DB subnet group. */
     Tags?: RDSDBSubnetGroup_Tag[];
   }, attributes?: CFResourceAttributes);
+  readonly DBSubnetGroupArn: string;
 }
 
 export declare class RDSEventSubscription {
@@ -53906,6 +53911,37 @@ export declare class ComputeNodeGroup_InstanceConfig {
   });
 }
 
+export declare class ComputeNodeGroup_NodeLifecycleActions {
+  constructor(props: {
+    Stages: ComputeNodeGroup_NodeLifecycleStages;
+    /** Controls whether lifecycle scripts are downloaded once at first boot (CACHE_ONCE) or re-downloaded on every reboot (REFRESH_ON_REBOOT). Defaults to CACHE_ONCE. */
+    ScriptCachingPolicy?: "CACHE_ONCE" | "REFRESH_ON_REBOOT";
+  });
+}
+
+export declare class ComputeNodeGroup_NodeLifecycleScript {
+  constructor(props: {
+    /** A human-readable name that identifies the script. */
+    Name: string;
+    ScriptSource: Record<string, unknown>;
+    /** An ordered list of arguments passed to the script. */
+    Arguments?: string[];
+    /** Whether the script runs only on the node's first boot (FIRST_BOOT_ONLY) or on every boot including reboots (EVERY_BOOT). Defaults to FIRST_BOOT_ONLY. */
+    ExecutionPolicy?: "EVERY_BOOT" | "FIRST_BOOT_ONLY";
+    /** The behavior when the script exits with an error. Defaults to TERMINATE. */
+    OnError?: "CONTINUE" | "STOP_SEQUENCE" | "TERMINATE";
+  });
+}
+
+export declare class ComputeNodeGroup_NodeLifecycleStages {
+  constructor(props: {
+    /** Scripts to run after the node is bootstrapped, once the PCS configuration phase completes and before slurmd starts. */
+    NodeBootstrapped?: ComputeNodeGroup_NodeLifecycleScript[];
+    /** Scripts to execute when the node becomes ready (every boot). */
+    NodeReady?: ComputeNodeGroup_NodeLifecycleScript[];
+  });
+}
+
 export declare class ComputeNodeGroupConfiguration {
   constructor(props: {
     /** The compute node group ID for the compute node group configuration. */
@@ -55924,9 +55960,9 @@ export declare class ConnectRule_Tag {
 export declare class ConnectSecurityProfile_Application {
   constructor(props: {
     /** The permissions that the agent is granted on the application */
-    ApplicationPermissions: string[];
+    ApplicationPermissions?: string[];
     /** Namespace of the application that you want to give access to. */
-    Namespace: string;
+    Namespace?: string;
     /** The type of the application. */
     Type?: "MCP" | "THIRD_PARTY_APPLICATION";
   });
@@ -55935,9 +55971,9 @@ export declare class ConnectSecurityProfile_Application {
 export declare class ConnectSecurityProfile_FlowModule {
   constructor(props: {
     /** The identifier of the application that you want to give access to. */
-    FlowModuleId: string;
+    FlowModuleId?: string;
     /** The type of the first-party application */
-    Type: string;
+    Type?: string;
   });
 }
 
@@ -72139,9 +72175,9 @@ export declare class FlowLog_TagFieldSpecification {
 export declare class FlowModule {
   constructor(props: {
     /** The identifier of the application that you want to give access to. */
-    FlowModuleId: string;
+    FlowModuleId?: string;
     /** The type of the first-party application */
-    Type: string;
+    Type?: string;
   });
 }
 
@@ -94527,6 +94563,37 @@ export declare class NodeInterfaceMapping {
   });
 }
 
+export declare class NodeLifecycleActions {
+  constructor(props: {
+    Stages: ComputeNodeGroup_NodeLifecycleStages;
+    /** Controls whether lifecycle scripts are downloaded once at first boot (CACHE_ONCE) or re-downloaded on every reboot (REFRESH_ON_REBOOT). Defaults to CACHE_ONCE. */
+    ScriptCachingPolicy?: "CACHE_ONCE" | "REFRESH_ON_REBOOT";
+  });
+}
+
+export declare class NodeLifecycleScript {
+  constructor(props: {
+    /** A human-readable name that identifies the script. */
+    Name: string;
+    ScriptSource: Record<string, unknown>;
+    /** An ordered list of arguments passed to the script. */
+    Arguments?: string[];
+    /** Whether the script runs only on the node's first boot (FIRST_BOOT_ONLY) or on every boot including reboots (EVERY_BOOT). Defaults to FIRST_BOOT_ONLY. */
+    ExecutionPolicy?: "EVERY_BOOT" | "FIRST_BOOT_ONLY";
+    /** The behavior when the script exits with an error. Defaults to TERMINATE. */
+    OnError?: "CONTINUE" | "STOP_SEQUENCE" | "TERMINATE";
+  });
+}
+
+export declare class NodeLifecycleStages {
+  constructor(props: {
+    /** Scripts to run after the node is bootstrapped, once the PCS configuration phase completes and before slurmd starts. */
+    NodeBootstrapped?: ComputeNodeGroup_NodeLifecycleScript[];
+    /** Scripts to execute when the node becomes ready (every boot). */
+    NodeReady?: ComputeNodeGroup_NodeLifecycleScript[];
+  });
+}
+
 export declare class NodeOption {
   constructor(props: {
     NodeConfig?: OpenSearchServiceDomain_NodeConfig;