@intentius/chant-lexicon-aws 0.83.0 → 0.85.0

package/src/composites/catalog.ts

@@ -0,0 +1,2719 @@
+// Generated by scripts/generate-composite-catalogs.ts (#2662) from this
+// lexicon's composite exports. Do not edit by hand: run
+// `npm run generate:composite-catalogs`. catalog.test.ts holds it to the exports.
+import type { CompositeEntry } from "@intentius/chant/lexicon";
+
+export const compositeCatalog: CompositeEntry[] = [
+  {
+    "name": "AgentCoreAgent",
+    "lexicon": "aws",
+    "description": "A Bedrock AgentCore agent as one CloudFormation-serializable bundle.",
+    "bundles": [
+      "BedrockAgentCoreGateway",
+      "GatewayTarget",
+      "Memory",
+      "Role",
+      "Runtime",
+      "RuntimeEndpoint",
+      "WorkloadIdentity"
+    ],
+    "params": [
+      {
+        "name": "name",
+        "type": "string",
+        "required": true,
+        "description": "Base name for the agent's resources."
+      },
+      {
+        "name": "containerUri",
+        "type": "string",
+        "required": false,
+        "description": "ECR image URI the Runtime runs, e.g. `\"123456789012.dkr.ecr.us-east-1.amazonaws.com/agent:latest\"`."
+      },
+      {
+        "name": "code",
+        "type": "AgentCoreCodeArtifact",
+        "required": false,
+        "description": "S3-zip code artifact run on a managed runtime — the alternative to `containerUri`."
+      },
+      {
+        "name": "networkMode",
+        "type": "\"PUBLIC\" | \"VPC\"",
+        "required": false,
+        "description": "Runtime network mode."
+      },
+      {
+        "name": "vpcSubnetIds",
+        "type": "string[]",
+        "required": false,
+        "description": "Subnets for the Runtime's ENIs."
+      },
+      {
+        "name": "vpcSecurityGroupIds",
+        "type": "string[]",
+        "required": false,
+        "description": "Security groups for the Runtime's ENIs."
+      },
+      {
+        "name": "protocolConfiguration",
+        "type": "\"A2A\" | \"AGUI\" | \"HTTP\" | \"MCP\"",
+        "required": false,
+        "description": "Protocol the Runtime serves."
+      },
+      {
+        "name": "environmentVariables",
+        "type": "Record<string, string>",
+        "required": false,
+        "description": "Environment variables passed to the Runtime container."
+      },
+      {
+        "name": "endpointName",
+        "type": "string",
+        "required": false,
+        "description": "Name of an explicit, non-`DEFAULT` `RuntimeEndpoint` to create alongside the Runtime (e.g. `\"PROD\"`), the alias a version-promotion flow would later repoint..."
+      },
+      {
+        "name": "memoryEventExpiryDays",
+        "type": "number",
+        "required": false,
+        "description": "Memory event retention, in days."
+      },
+      {
+        "name": "gatewayAuthorizerType",
+        "type": "\"CUSTOM_JWT\" | \"AWS_IAM\" | \"NONE\" | \"AUTHENTICATE_ONLY\"",
+        "required": false,
+        "description": "Gateway authorizer."
+      },
+      {
+        "name": "allowedResourceOauth2ReturnUrls",
+        "type": "string[]",
+        "required": false,
+        "description": "Allow-listed OAuth2 return URLs for the standalone `WorkloadIdentity` resource."
+      },
+      {
+        "name": "ManagedPolicyArns",
+        "type": "string[]",
+        "required": false,
+        "description": "Extra managed policy ARNs merged onto the auto-created Runtime/Memory execution role."
+      },
+      {
+        "name": "Policies",
+        "type": "InstanceType<typeof Role_Policy>[]",
+        "required": false,
+        "description": "Inline policies attached to the auto-created Runtime/Memory execution role."
+      },
+      {
+        "name": "defaults",
+        "type": "{ role?: Partial<ConstructorParameters<typeof Role>[0]>; gatewayRole?: Partial<ConstructorParameters<typeof Role>[0]>...",
+        "required": false
+      }
+    ]
+  },
+  {
+    "name": "AlbShared",
+    "lexicon": "aws",
+    "description": "A shared ECS cluster and internet-facing Application Load Balancer with its listener and execution role, for FargateService instances to attach to.",
+    "bundles": [
+      "EcsCluster",
+      "Listener",
+      "LoadBalancer",
+      "Role",
+      "SecurityGroup"
+    ],
+    "params": [
+      {
+        "name": "vpcId",
+        "type": "string",
+        "required": true
+      },
+      {
+        "name": "publicSubnetIds",
+        "type": "string[]",
+        "required": true
+      },
+      {
+        "name": "listenerPort",
+        "type": "number",
+        "required": false
+      },
+      {
+        "name": "protocol",
+        "type": "\"HTTP\" | \"HTTPS\"",
+        "required": false
+      },
+      {
+        "name": "certificateArn",
+        "type": "string",
+        "required": false
+      },
+      {
+        "name": "defaults",
+        "type": "{ cluster?: Partial<ConstructorParameters<typeof EcsCluster>[0]>; executionRole?: Partial<ConstructorParameters<typeo...",
+        "required": false
+      }
+    ]
+  },
+  {
+    "name": "BucketDeployment",
+    "lexicon": "aws",
+    "description": "BucketDeployment — the seeded-bucket shape: an S3 bucket sized to receive deploy-time content, encrypted and access-blocked by default, its deletion...",
+    "bundles": [
+      "Bucket",
+      "S3BucketPolicy"
+    ],
+    "params": [
+      {
+        "name": "bucketName",
+        "type": "Value<string>",
+        "required": false,
+        "description": "`Value<string>`: a name is routinely built with `Sub`/`Ref` (#1366)."
+      },
+      {
+        "name": "versioned",
+        "type": "boolean",
+        "required": false,
+        "description": "Enable S3 object versioning."
+      },
+      {
+        "name": "website",
+        "type": "{ indexDocument: string; errorDocument?: string; }",
+        "required": false,
+        "description": "Static-website hosting: sets `WebsiteConfiguration` and — since a website bucket is read by anonymous visitors, not IAM principals — opens the public-access..."
+      },
+      {
+        "name": "removalPolicy",
+        "type": "\"retain\" | \"destroy\"",
+        "required": false,
+        "description": "What CloudFormation does to the bucket when the stack (or the resource) is removed."
+      },
+      {
+        "name": "tags",
+        "type": "Array<{ Key: string; Value: string }>",
+        "required": false
+      },
+      {
+        "name": "defaults",
+        "type": "{ bucket?: Partial<ConstructorParameters<typeof Bucket>[0]>; bucketPolicy?: Partial<ConstructorParameters<typeof S3Bu...",
+        "required": false
+      }
+    ]
+  },
+  {
+    "name": "DynamoDBTable",
+    "lexicon": "aws",
+    "description": "A DynamoDB table from a partition key, an optional sort key and optional global secondary indexes.",
+    "bundles": [
+      "Table"
+    ],
+    "params": [
+      {
+        "name": "tableName",
+        "type": "Value<string>",
+        "required": false,
+        "description": "`Value<string>`: a name is routinely built with `Sub`/`Ref` (#1366)."
+      },
+      {
+        "name": "partitionKey",
+        "type": "DynamoDBKey",
+        "required": true
+      },
+      {
+        "name": "sortKey",
+        "type": "DynamoDBKey",
+        "required": false
+      },
+      {
+        "name": "billingMode",
+        "type": "\"PAY_PER_REQUEST\" | \"PROVISIONED\"",
+        "required": false,
+        "description": "Defaults to \"PAY_PER_REQUEST\" — the recommended default for most workloads (matches LambdaDynamoDB)."
+      },
+      {
+        "name": "provisionedThroughput",
+        "type": "DynamoDBCapacity",
+        "required": false,
+        "description": "Required when billingMode is \"PROVISIONED\"; ignored otherwise."
+      },
+      {
+        "name": "globalSecondaryIndexes",
+        "type": "DynamoDBGlobalSecondaryIndex[]",
+        "required": false
+      },
+      {
+        "name": "ttlAttribute",
+        "type": "string",
+        "required": false,
+        "description": "Attribute name that carries the expiry timestamp."
+      },
+      {
+        "name": "stream",
+        "type": "boolean | { viewType?: \"NEW_IMAGE\" | \"OLD_IMAGE\" | \"NEW_AND_OLD_IMAGES\" | \"KEYS_ONLY\" }",
+        "required": false,
+        "description": "Enables StreamSpecification."
+      },
+      {
+        "name": "defaults",
+        "type": "{ table?: Partial<ConstructorParameters<typeof Table>[0]>; }",
+        "required": false
+      }
+    ]
+  },
+  {
+    "name": "Ec2InstanceBundle",
+    "lexicon": "aws",
+    "description": "EC2 instance bundle — instance + security group + role/profile + subnet placement, the hand-rolled unit the aws-bench corpus showed 25 times...",
+    "bundles": [
+      "Instance",
+      "InstanceProfile",
+      "Role",
+      "SecurityGroup"
+    ],
+    "params": [
+      {
+        "name": "imageId",
+        "type": "string",
+        "required": true,
+        "description": "AMI id to launch."
+      },
+      {
+        "name": "vpcId",
+        "type": "string",
+        "required": true,
+        "description": "VPC the instance and its security group live in."
+      },
+      {
+        "name": "subnetId",
+        "type": "string",
+        "required": true,
+        "description": "Subnet the instance launches into — fixes its AZ and public/private placement."
+      },
+      {
+        "name": "instanceType",
+        "type": "string",
+        "required": false,
+        "description": "EC2 instance type."
+      },
+      {
+        "name": "keyName",
+        "type": "string",
+        "required": false,
+        "description": "SSH key pair name."
+      },
+      {
+        "name": "userData",
+        "type": "string",
+        "required": false,
+        "description": "Plain-text user-data script; wrapped in `Fn::Base64` for the instance."
+      },
+      {
+        "name": "ingress",
+        "type": "Ec2InstanceBundleIngressRule[]",
+        "required": false,
+        "description": "Inbound security-group rules."
+      },
+      {
+        "name": "ManagedPolicyArns",
+        "type": "string[]",
+        "required": false,
+        "description": "IAM managed policy ARNs attached to the instance role."
+      },
+      {
+        "name": "Policies",
+        "type": "ConstructorParameters<typeof Role>[0][\"Policies\"]",
+        "required": false,
+        "description": "Inline IAM policies attached to the instance role."
+      },
+      {
+        "name": "defaults",
+        "type": "{ role?: Partial<ConstructorParameters<typeof Role>[0]>; instanceProfile?: Partial<ConstructorParameters<typeof Insta...",
+        "required": false
+      }
+    ]
+  },
+  {
+    "name": "Ec2InstanceRole",
+    "lexicon": "aws",
+    "description": "An IAM role that EC2 can assume, with the instance profile that attaches it to an instance.",
+    "bundles": [
+      "InstanceProfile",
+      "Role"
+    ],
+    "params": [
+      {
+        "name": "ManagedPolicyArns",
+        "type": "string[]",
+        "required": false
+      },
+      {
+        "name": "Policies",
+        "type": "ConstructorParameters<typeof Role>[0][\"Policies\"]",
+        "required": false
+      },
+      {
+        "name": "defaults",
+        "type": "{ role?: Partial<ConstructorParameters<typeof Role>[0]>; instanceProfile?: Partial<ConstructorParameters<typeof Insta...",
+        "required": false
+      }
+    ]
+  },
+  {
+    "name": "EcrRepository",
+    "lexicon": "aws",
+    "description": "An ECR repository with image scanning, encryption and lifecycle rules.",
+    "bundles": [
+      "ECRRepository"
+    ],
+    "params": [
+      {
+        "name": "repositoryName",
+        "type": "Value<string>",
+        "required": false,
+        "description": "`Value<string>`: a name is routinely built with `Sub`/`Ref` (#1366)."
+      },
+      {
+        "name": "imageTagMutability",
+        "type": "\"MUTABLE\" | \"IMMUTABLE\" | \"MUTABLE_WITH_EXCLUSION\" | \"IMMUTABLE_WITH_EXCLUSION\"",
+        "required": false
+      },
+      {
+        "name": "scanOnPush",
+        "type": "boolean",
+        "required": false,
+        "description": "Defaults to true — scanning freshly pushed images is the safe default for a new repository."
+      },
+      {
+        "name": "lifecycleRules",
+        "type": "EcrLifecycleRule[]",
+        "required": false,
+        "description": "Lifecycle rules, evaluated in `rulePriority` order and rendered into the repository's `LifecyclePolicyText`."
+      },
+      {
+        "name": "encryption",
+        "type": "EcrEncryption",
+        "required": false
+      },
+      {
+        "name": "emptyOnDelete",
+        "type": "boolean",
+        "required": false,
+        "description": "If true, deleting the repository force-deletes its contents instead of requiring it to be empty first."
+      },
+      {
+        "name": "repositoryPolicy",
+        "type": "Record<string, unknown>",
+        "required": false,
+        "description": "JSON repository policy document (cross-account pull access, etc)."
+      },
+      {
+        "name": "defaults",
+        "type": "{ repository?: Partial<ConstructorParameters<typeof ECRRepository>[0]>; }",
+        "required": false
+      }
+    ]
+  },
+  {
+    "name": "EfsWithAccessPoint",
+    "lexicon": "aws",
+    "description": "An EFS file system with an access point and the security group that admits NFS traffic to it.",
+    "bundles": [
+      "EFSAccessPoint",
+      "EFSFileSystem",
+      "SecurityGroup"
+    ],
+    "params": [
+      {
+        "name": "name",
+        "type": "string",
+        "required": true
+      },
+      {
+        "name": "vpcId",
+        "type": "string",
+        "required": true
+      },
+      {
+        "name": "uid",
+        "type": "string",
+        "required": true
+      },
+      {
+        "name": "gid",
+        "type": "string",
+        "required": true
+      },
+      {
+        "name": "rootPath",
+        "type": "string",
+        "required": true
+      },
+      {
+        "name": "permissions",
+        "type": "string",
+        "required": false
+      },
+      {
+        "name": "ingressCidr",
+        "type": "string",
+        "required": false,
+        "description": "CIDR allowed inbound on NFS port 2049."
+      },
+      {
+        "name": "sourceSecurityGroupId",
+        "type": "string",
+        "required": false,
+        "description": "Security group ID allowed inbound on NFS port 2049."
+      },
+      {
+        "name": "performanceMode",
+        "type": "\"generalPurpose\" | \"maxIO\"",
+        "required": false
+      },
+      {
+        "name": "throughputMode",
+        "type": "\"bursting\" | \"provisioned\" | \"elastic\"",
+        "required": false
+      }
+    ]
+  },
+  {
+    "name": "EksCluster",
+    "lexicon": "aws",
+    "description": "EksCluster — a managed EKS control plane, its node group, and the two IAM roles they cannot exist without, as the one unit they are.",
+    "bundles": [
+      "Addon",
+      "EKSCluster",
+      "Nodegroup",
+      "Role"
+    ],
+    "params": [
+      {
+        "name": "name",
+        "type": "string",
+        "required": true,
+        "description": "Cluster name."
+      },
+      {
+        "name": "subnetIds",
+        "type": "string[]",
+        "required": true,
+        "description": "Subnet ids for the control plane ENIs — EKS requires at least two AZs."
+      },
+      {
+        "name": "securityGroupIds",
+        "type": "string[]",
+        "required": false,
+        "description": "Extra security groups for the control plane (EKS always adds its own)."
+      },
+      {
+        "name": "version",
+        "type": "string",
+        "required": false,
+        "description": "Kubernetes version, e.g. \"1.31\"."
+      },
+      {
+        "name": "nodegroup",
+        "type": "{ instanceTypes?: string[]; desiredSize?: number; minSize?: number; maxSize?: number; /** Subnets the nodes land in. ...",
+        "required": false,
+        "description": "Node group shape."
+      },
+      {
+        "name": "addons",
+        "type": "Array<{ name: string; version?: string }>",
+        "required": false,
+        "description": "Managed add-ons to install, by name (e.g. \"eks-pod-identity-agent\"."
+      },
+      {
+        "name": "tags",
+        "type": "Array<{ Key: string; Value: string }>",
+        "required": false
+      },
+      {
+        "name": "defaults",
+        "type": "{ cluster?: Partial<ConstructorParameters<typeof EKSCluster>[0]>; nodegroup?: Partial<ConstructorParameters<typeof No...",
+        "required": false
+      }
+    ]
+  },
+  {
+    "name": "FargateAlb",
+    "lexicon": "aws",
+    "description": "A Fargate service behind its own Application Load Balancer: cluster, task definition, service, target group, listener, logs and roles.",
+    "bundles": [
+      "EcsCluster",
+      "EcsService",
+      "Listener",
+      "LoadBalancer",
+      "LogGroup",
+      "Role",
+      "SecurityGroup",
+      "TargetGroup",
+      "TaskDefinition"
+    ],
+    "params": [
+      {
+        "name": "image",
+        "type": "string",
+        "required": true
+      },
+      {
+        "name": "repositoryCredentials",
+        "type": "string",
+        "required": false,
+        "description": "Secrets Manager ARN holding private-registry pull credentials (`{\"username\",\"password\"}`)."
+      },
+      {
+        "name": "certificateArn",
+        "type": "string",
+        "required": false,
+        "description": "ACM certificate ARN."
+      },
+      {
+        "name": "containerPort",
+        "type": "number",
+        "required": false
+      },
+      {
+        "name": "cpu",
+        "type": "string",
+        "required": false
+      },
+      {
+        "name": "memory",
+        "type": "string",
+        "required": false
+      },
+      {
+        "name": "desiredCount",
+        "type": "number",
+        "required": false
+      },
+      {
+        "name": "vpcId",
+        "type": "string",
+        "required": true
+      },
+      {
+        "name": "publicSubnetIds",
+        "type": "string[]",
+        "required": true
+      },
+      {
+        "name": "privateSubnetIds",
+        "type": "string[]",
+        "required": true
+      },
+      {
+        "name": "healthCheckPath",
+        "type": "string",
+        "required": false
+      },
+      {
+        "name": "listenerPort",
+        "type": "number",
+        "required": false
+      },
+      {
+        "name": "environment",
+        "type": "Record<string, string>",
+        "required": false
+      },
+      {
+        "name": "command",
+        "type": "string[]",
+        "required": false
+      },
+      {
+        "name": "ManagedPolicyArns",
+        "type": "string[]",
+        "required": false
+      },
+      {
+        "name": "Policies",
+        "type": "InstanceType<typeof Role_Policy>[]",
+        "required": false
+      },
+      {
+        "name": "logRetentionDays",
+        "type": "number",
+        "required": false
+      },
+      {
+        "name": "defaults",
+        "type": "{ cluster?: Partial<ConstructorParameters<typeof EcsCluster>[0]>; executionRole?: Partial<ConstructorParameters<typeo...",
+        "required": false
+      }
+    ]
+  },
+  {
+    "name": "FargateService",
+    "lexicon": "aws",
+    "description": "A Fargate service routed by a listener rule on an existing ALB listener, with its task definition, target group, logs, roles and optional autoscaling.",
+    "bundles": [
+      "ApplicationAutoScalingScalingPolicy",
+      "EcsService",
+      "ListenerRule",
+      "LogGroup",
+      "Role",
+      "ScalableTarget",
+      "SecurityGroup",
+      "TargetGroup",
+      "TaskDefinition"
+    ],
+    "params": [
+      {
+        "name": "clusterArn",
+        "type": "Value<string>",
+        "required": true
+      },
+      {
+        "name": "listenerArn",
+        "type": "Value<string>",
+        "required": true
+      },
+      {
+        "name": "albSecurityGroupId",
+        "type": "Value<string>",
+        "required": true
+      },
+      {
+        "name": "executionRoleArn",
+        "type": "Value<string>",
+        "required": true
+      },
+      {
+        "name": "priority",
+        "type": "number",
+        "required": true
+      },
+      {
+        "name": "pathPatterns",
+        "type": "string[]",
+        "required": false
+      },
+      {
+        "name": "hostHeaders",
+        "type": "string[]",
+        "required": false
+      },
+      {
+        "name": "image",
+        "type": "Value<string>",
+        "required": true
+      },
+      {
+        "name": "containerPort",
+        "type": "number",
+        "required": false
+      },
+      {
+        "name": "cpu",
+        "type": "string",
+        "required": false
+      },
+      {
+        "name": "memory",
+        "type": "string",
+        "required": false
+      },
+      {
+        "name": "desiredCount",
+        "type": "number",
+        "required": false
+      },
+      {
+        "name": "autoscaling",
+        "type": "{ minCapacity?: number; maxCapacity: number; cpuTarget?: number; scaleInCooldown?: number; scaleOutCooldown?: number; }",
+        "required": false
+      },
+      {
+        "name": "environment",
+        "type": "Record<string, string>",
+        "required": false
+      },
+      {
+        "name": "command",
+        "type": "string[]",
+        "required": false
+      },
+      {
+        "name": "mountPoints",
+        "type": "InstanceType<typeof TaskDefinition_MountPoint>[]",
+        "required": false
+      },
+      {
+        "name": "efsMounts",
+        "type": "Array<{ fileSystemId: string; accessPointId?: string; containerPath: string; volumeName?: string; transitEncryption?:...",
+        "required": false
+      },
+      {
+        "name": "vpcId",
+        "type": "Value<string>",
+        "required": true
+      },
+      {
+        "name": "privateSubnetIds",
+        "type": "Array<Value<string>>",
+        "required": true
+      },
+      {
+        "name": "healthCheckPath",
+        "type": "string",
+        "required": false
+      },
+      {
+        "name": "ulimits",
+        "type": "Array<{ name: string; softLimit: number; hardLimit: number }>",
+        "required": false
+      },
+      {
+        "name": "ManagedPolicyArns",
+        "type": "string[]",
+        "required": false
+      },
+      {
+        "name": "Policies",
+        "type": "InstanceType<typeof Role_Policy>[]",
+        "required": false
+      },
+      {
+        "name": "logRetentionDays",
+        "type": "number",
+        "required": false
+      },
+      {
+        "name": "defaults",
+        "type": "{ taskRole?: Partial<ConstructorParameters<typeof Role>[0]>; taskDef?: Partial<ConstructorParameters<typeof TaskDefin...",
+        "required": false
+      }
+    ]
+  },
+  {
+    "name": "GovernanceFoundation",
+    "lexicon": "aws",
+    "description": "Security / Infrastructure / Sandbox / Workloads OUs, `deny-leave-organization` attached at the root and `deny-audit-tamper` on the Security OU.",
+    "bundles": [
+      "OrganizationalUnit",
+      "OrganizationsPolicy"
+    ],
+    "params": [
+      {
+        "name": "parentRootId",
+        "type": "string",
+        "required": true,
+        "description": "The organization root to hang the foundation off (\"r-...\" or `OrganizationRoot(...).organization.RootId`)."
+      }
+    ]
+  },
+  {
+    "name": "LambdaApi",
+    "lexicon": "aws",
+    "description": "A Lambda function with an execution role and the permission that lets API Gateway invoke it.",
+    "bundles": [
+      "Function",
+      "Permission",
+      "Role"
+    ],
+    "params": [
+      {
+        "name": "sourceArn",
+        "type": "Value<string>",
+        "required": false,
+        "description": "`Value<string>`: an ARN is routinely built with `Sub` from pseudo-parameters (#1366)."
+      },
+      {
+        "name": "defaults",
+        "type": "LambdaFunctionProps[\"defaults\"] & { permission?: Partial<ConstructorParameters<typeof Permission>[0]>; }",
+        "required": false
+      },
+      {
+        "name": "name",
+        "type": "string | ReturnType<typeof Sub>",
+        "required": true
+      },
+      {
+        "name": "Runtime",
+        "type": "string",
+        "required": true
+      },
+      {
+        "name": "Handler",
+        "type": "string",
+        "required": true
+      },
+      {
+        "name": "Code",
+        "type": "ConstructorParameters<typeof Function>[0][\"Code\"]",
+        "required": true
+      },
+      {
+        "name": "Timeout",
+        "type": "number",
+        "required": false
+      },
+      {
+        "name": "MemorySize",
+        "type": "number",
+        "required": false
+      },
+      {
+        "name": "Environment",
+        "type": "ConstructorParameters<typeof Function>[0][\"Environment\"]",
+        "required": false
+      },
+      {
+        "name": "ManagedPolicyArns",
+        "type": "string[]",
+        "required": false
+      },
+      {
+        "name": "Policies",
+        "type": "InstanceType<typeof Role_Policy>[]",
+        "required": false
+      },
+      {
+        "name": "VpcConfig",
+        "type": "ConstructorParameters<typeof Function_VpcConfig>[0]",
+        "required": false
+      }
+    ]
+  },
+  {
+    "name": "LambdaDynamoDB",
+    "lexicon": "aws",
+    "description": "A Lambda function with a DynamoDB table, table access for its role and an optional stream trigger.",
+    "bundles": [
+      "EventSourceMapping",
+      "Function",
+      "Role",
+      "Table"
+    ],
+    "params": [
+      {
+        "name": "tableName",
+        "type": "Value<string>",
+        "required": false,
+        "description": "`Value<string>`: a name is routinely built with `Sub`/`Ref` (#1366)."
+      },
+      {
+        "name": "partitionKey",
+        "type": "string",
+        "required": true
+      },
+      {
+        "name": "sortKey",
+        "type": "string",
+        "required": false
+      },
+      {
+        "name": "access",
+        "type": "\"ReadOnly\" | \"ReadWrite\" | \"Full\" | \"None\"",
+        "required": false
+      },
+      {
+        "name": "streams",
+        "type": "{ viewType?: \"NEW_IMAGE\" | \"OLD_IMAGE\" | \"NEW_AND_OLD_IMAGES\" | \"KEYS_ONLY\"; batchSize?: number; startingPosition?: \"...",
+        "required": false
+      },
+      {
+        "name": "defaults",
+        "type": "LambdaFunctionProps[\"defaults\"] & { table?: Partial<ConstructorParameters<typeof Table>[0]>; eventSourceMapping?: Par...",
+        "required": false
+      },
+      {
+        "name": "name",
+        "type": "string | ReturnType<typeof Sub>",
+        "required": true
+      },
+      {
+        "name": "Runtime",
+        "type": "string",
+        "required": true
+      },
+      {
+        "name": "Handler",
+        "type": "string",
+        "required": true
+      },
+      {
+        "name": "Code",
+        "type": "ConstructorParameters<typeof Function>[0][\"Code\"]",
+        "required": true
+      },
+      {
+        "name": "Timeout",
+        "type": "number",
+        "required": false
+      },
+      {
+        "name": "MemorySize",
+        "type": "number",
+        "required": false
+      },
+      {
+        "name": "Environment",
+        "type": "ConstructorParameters<typeof Function>[0][\"Environment\"]",
+        "required": false
+      },
+      {
+        "name": "ManagedPolicyArns",
+        "type": "string[]",
+        "required": false
+      },
+      {
+        "name": "Policies",
+        "type": "InstanceType<typeof Role_Policy>[]",
+        "required": false
+      },
+      {
+        "name": "VpcConfig",
+        "type": "ConstructorParameters<typeof Function_VpcConfig>[0]",
+        "required": false
+      }
+    ]
+  },
+  {
+    "name": "LambdaEventBridge",
+    "lexicon": "aws",
+    "description": "A Lambda function triggered by an EventBridge rule, on a schedule or an event pattern.",
+    "bundles": [
+      "EventRule",
+      "Function",
+      "Permission",
+      "Role"
+    ],
+    "params": [
+      {
+        "name": "ruleName",
+        "type": "Value<string>",
+        "required": false,
+        "description": "`Value<string>`: a name is routinely built with `Sub`/`Ref` (#1366)."
+      },
+      {
+        "name": "schedule",
+        "type": "string",
+        "required": false
+      },
+      {
+        "name": "eventPattern",
+        "type": "Record<string, unknown>",
+        "required": false
+      },
+      {
+        "name": "enabled",
+        "type": "boolean",
+        "required": false
+      },
+      {
+        "name": "defaults",
+        "type": "LambdaFunctionProps[\"defaults\"] & { rule?: Partial<ConstructorParameters<typeof EventRule>[0]>; permission?: Partial<...",
+        "required": false
+      },
+      {
+        "name": "name",
+        "type": "string | ReturnType<typeof Sub>",
+        "required": true
+      },
+      {
+        "name": "Runtime",
+        "type": "string",
+        "required": true
+      },
+      {
+        "name": "Handler",
+        "type": "string",
+        "required": true
+      },
+      {
+        "name": "Code",
+        "type": "ConstructorParameters<typeof Function>[0][\"Code\"]",
+        "required": true
+      },
+      {
+        "name": "Timeout",
+        "type": "number",
+        "required": false
+      },
+      {
+        "name": "MemorySize",
+        "type": "number",
+        "required": false
+      },
+      {
+        "name": "Environment",
+        "type": "ConstructorParameters<typeof Function>[0][\"Environment\"]",
+        "required": false
+      },
+      {
+        "name": "ManagedPolicyArns",
+        "type": "string[]",
+        "required": false
+      },
+      {
+        "name": "Policies",
+        "type": "InstanceType<typeof Role_Policy>[]",
+        "required": false
+      },
+      {
+        "name": "VpcConfig",
+        "type": "ConstructorParameters<typeof Function_VpcConfig>[0]",
+        "required": false
+      }
+    ]
+  },
+  {
+    "name": "LambdaFunction",
+    "lexicon": "aws",
+    "description": "A Lambda function with its execution role.",
+    "bundles": [
+      "Function",
+      "Role"
+    ],
+    "params": [
+      {
+        "name": "name",
+        "type": "string | ReturnType<typeof Sub>",
+        "required": true
+      },
+      {
+        "name": "Runtime",
+        "type": "string",
+        "required": true
+      },
+      {
+        "name": "Handler",
+        "type": "string",
+        "required": true
+      },
+      {
+        "name": "Code",
+        "type": "ConstructorParameters<typeof Function>[0][\"Code\"]",
+        "required": true
+      },
+      {
+        "name": "Timeout",
+        "type": "number",
+        "required": false
+      },
+      {
+        "name": "MemorySize",
+        "type": "number",
+        "required": false
+      },
+      {
+        "name": "Environment",
+        "type": "ConstructorParameters<typeof Function>[0][\"Environment\"]",
+        "required": false
+      },
+      {
+        "name": "ManagedPolicyArns",
+        "type": "string[]",
+        "required": false
+      },
+      {
+        "name": "Policies",
+        "type": "InstanceType<typeof Role_Policy>[]",
+        "required": false
+      },
+      {
+        "name": "VpcConfig",
+        "type": "ConstructorParameters<typeof Function_VpcConfig>[0]",
+        "required": false
+      },
+      {
+        "name": "defaults",
+        "type": "{ role?: Partial<ConstructorParameters<typeof Role>[0]>; func?: Partial<ConstructorParameters<typeof Function>[0]>; }",
+        "required": false
+      }
+    ]
+  },
+  {
+    "name": "LambdaNode",
+    "lexicon": "aws",
+    "description": "LambdaFunction with preset defaults for Runtime, Handler.",
+    "bundles": [
+      "Function",
+      "Role"
+    ],
+    "params": [
+      {
+        "name": "ManagedPolicyArns",
+        "type": "string[]",
+        "required": false
+      },
+      {
+        "name": "Policies",
+        "type": "InstanceType<typeof Role_Policy>[]",
+        "required": false
+      },
+      {
+        "name": "defaults",
+        "type": "{ role?: Partial<ConstructorParameters<typeof Role>[0]>; func?: Partial<ConstructorParameters<typeof Function>[0]>; }",
+        "required": false
+      },
+      {
+        "name": "Code",
+        "type": "ConstructorParameters<typeof Function>[0][\"Code\"]",
+        "required": true
+      },
+      {
+        "name": "Timeout",
+        "type": "number",
+        "required": false
+      },
+      {
+        "name": "MemorySize",
+        "type": "number",
+        "required": false
+      },
+      {
+        "name": "Environment",
+        "type": "ConstructorParameters<typeof Function>[0][\"Environment\"]",
+        "required": false
+      },
+      {
+        "name": "VpcConfig",
+        "type": "ConstructorParameters<typeof Function_VpcConfig>[0]",
+        "required": false
+      },
+      {
+        "name": "name",
+        "type": "string | ReturnType<typeof Sub>",
+        "required": true
+      },
+      {
+        "name": "Handler",
+        "type": "string",
+        "required": false
+      },
+      {
+        "name": "Runtime",
+        "type": "string",
+        "required": false
+      }
+    ]
+  },
+  {
+    "name": "LambdaPython",
+    "lexicon": "aws",
+    "description": "LambdaFunction with preset defaults for Runtime, Handler.",
+    "bundles": [
+      "Function",
+      "Role"
+    ],
+    "params": [
+      {
+        "name": "ManagedPolicyArns",
+        "type": "string[]",
+        "required": false
+      },
+      {
+        "name": "Policies",
+        "type": "InstanceType<typeof Role_Policy>[]",
+        "required": false
+      },
+      {
+        "name": "defaults",
+        "type": "{ role?: Partial<ConstructorParameters<typeof Role>[0]>; func?: Partial<ConstructorParameters<typeof Function>[0]>; }",
+        "required": false
+      },
+      {
+        "name": "Code",
+        "type": "ConstructorParameters<typeof Function>[0][\"Code\"]",
+        "required": true
+      },
+      {
+        "name": "Timeout",
+        "type": "number",
+        "required": false
+      },
+      {
+        "name": "MemorySize",
+        "type": "number",
+        "required": false
+      },
+      {
+        "name": "Environment",
+        "type": "ConstructorParameters<typeof Function>[0][\"Environment\"]",
+        "required": false
+      },
+      {
+        "name": "VpcConfig",
+        "type": "ConstructorParameters<typeof Function_VpcConfig>[0]",
+        "required": false
+      },
+      {
+        "name": "name",
+        "type": "string | ReturnType<typeof Sub>",
+        "required": true
+      },
+      {
+        "name": "Handler",
+        "type": "string",
+        "required": false
+      },
+      {
+        "name": "Runtime",
+        "type": "string",
+        "required": false
+      }
+    ]
+  },
+  {
+    "name": "LambdaS3",
+    "lexicon": "aws",
+    "description": "A Lambda function with an S3 bucket, bucket access for its role and an optional bucket-notification trigger.",
+    "bundles": [
+      "Bucket",
+      "Function",
+      "Permission",
+      "Role"
+    ],
+    "params": [
+      {
+        "name": "bucketName",
+        "type": "Value<string>",
+        "required": false,
+        "description": "`Value<string>`: a name is routinely built with `Sub`/`Ref` (#1366)."
+      },
+      {
+        "name": "access",
+        "type": "\"ReadOnly\" | \"ReadWrite\" | \"Full\"",
+        "required": false
+      },
+      {
+        "name": "trigger",
+        "type": "{ events?: string[]; prefix?: string; suffix?: string; }",
+        "required": false
+      },
+      {
+        "name": "defaults",
+        "type": "LambdaFunctionProps[\"defaults\"] & { bucket?: Partial<ConstructorParameters<typeof Bucket>[0]>; }",
+        "required": false
+      },
+      {
+        "name": "name",
+        "type": "string | ReturnType<typeof Sub>",
+        "required": true
+      },
+      {
+        "name": "Runtime",
+        "type": "string",
+        "required": true
+      },
+      {
+        "name": "Handler",
+        "type": "string",
+        "required": true
+      },
+      {
+        "name": "Code",
+        "type": "ConstructorParameters<typeof Function>[0][\"Code\"]",
+        "required": true
+      },
+      {
+        "name": "Timeout",
+        "type": "number",
+        "required": false
+      },
+      {
+        "name": "MemorySize",
+        "type": "number",
+        "required": false
+      },
+      {
+        "name": "Environment",
+        "type": "ConstructorParameters<typeof Function>[0][\"Environment\"]",
+        "required": false
+      },
+      {
+        "name": "ManagedPolicyArns",
+        "type": "string[]",
+        "required": false
+      },
+      {
+        "name": "Policies",
+        "type": "InstanceType<typeof Role_Policy>[]",
+        "required": false
+      },
+      {
+        "name": "VpcConfig",
+        "type": "ConstructorParameters<typeof Function_VpcConfig>[0]",
+        "required": false
+      }
+    ]
+  },
+  {
+    "name": "LambdaScheduled",
+    "lexicon": "aws",
+    "description": "A Lambda function run on a schedule by an EventBridge rule.",
+    "bundles": [
+      "EventRule",
+      "Function",
+      "Permission",
+      "Role"
+    ],
+    "params": [
+      {
+        "name": "ruleName",
+        "type": "Value<string>",
+        "required": false,
+        "description": "`Value<string>`: a name is routinely built with `Sub`/`Ref` (#1366)."
+      },
+      {
+        "name": "schedule",
+        "type": "string",
+        "required": true
+      },
+      {
+        "name": "enabled",
+        "type": "boolean",
+        "required": false
+      },
+      {
+        "name": "defaults",
+        "type": "LambdaFunctionProps[\"defaults\"] & { rule?: Partial<ConstructorParameters<typeof EventRule>[0]>; permission?: Partial<...",
+        "required": false
+      },
+      {
+        "name": "name",
+        "type": "string | ReturnType<typeof Sub>",
+        "required": true
+      },
+      {
+        "name": "Runtime",
+        "type": "string",
+        "required": true
+      },
+      {
+        "name": "Handler",
+        "type": "string",
+        "required": true
+      },
+      {
+        "name": "Code",
+        "type": "ConstructorParameters<typeof Function>[0][\"Code\"]",
+        "required": true
+      },
+      {
+        "name": "Timeout",
+        "type": "number",
+        "required": false
+      },
+      {
+        "name": "MemorySize",
+        "type": "number",
+        "required": false
+      },
+      {
+        "name": "Environment",
+        "type": "ConstructorParameters<typeof Function>[0][\"Environment\"]",
+        "required": false
+      },
+      {
+        "name": "ManagedPolicyArns",
+        "type": "string[]",
+        "required": false
+      },
+      {
+        "name": "Policies",
+        "type": "InstanceType<typeof Role_Policy>[]",
+        "required": false
+      },
+      {
+        "name": "VpcConfig",
+        "type": "ConstructorParameters<typeof Function_VpcConfig>[0]",
+        "required": false
+      }
+    ]
+  },
+  {
+    "name": "LambdaSns",
+    "lexicon": "aws",
+    "description": "A Lambda function subscribed to an SNS topic.",
+    "bundles": [
+      "Function",
+      "Permission",
+      "Role",
+      "Subscription",
+      "Topic"
+    ],
+    "params": [
+      {
+        "name": "topicName",
+        "type": "Value<string>",
+        "required": false,
+        "description": "`Value<string>`: a name is routinely built with `Sub`/`Ref` (#1366)."
+      },
+      {
+        "name": "defaults",
+        "type": "LambdaFunctionProps[\"defaults\"] & { topic?: Partial<ConstructorParameters<typeof Topic>[0]>; subscription?: Partial<C...",
+        "required": false
+      },
+      {
+        "name": "name",
+        "type": "string | ReturnType<typeof Sub>",
+        "required": true
+      },
+      {
+        "name": "Runtime",
+        "type": "string",
+        "required": true
+      },
+      {
+        "name": "Handler",
+        "type": "string",
+        "required": true
+      },
+      {
+        "name": "Code",
+        "type": "ConstructorParameters<typeof Function>[0][\"Code\"]",
+        "required": true
+      },
+      {
+        "name": "Timeout",
+        "type": "number",
+        "required": false
+      },
+      {
+        "name": "MemorySize",
+        "type": "number",
+        "required": false
+      },
+      {
+        "name": "Environment",
+        "type": "ConstructorParameters<typeof Function>[0][\"Environment\"]",
+        "required": false
+      },
+      {
+        "name": "ManagedPolicyArns",
+        "type": "string[]",
+        "required": false
+      },
+      {
+        "name": "Policies",
+        "type": "InstanceType<typeof Role_Policy>[]",
+        "required": false
+      },
+      {
+        "name": "VpcConfig",
+        "type": "ConstructorParameters<typeof Function_VpcConfig>[0]",
+        "required": false
+      }
+    ]
+  },
+  {
+    "name": "LambdaSqs",
+    "lexicon": "aws",
+    "description": "A Lambda function fed by an SQS queue through an event source mapping.",
+    "bundles": [
+      "EventSourceMapping",
+      "Function",
+      "Queue",
+      "Role"
+    ],
+    "params": [
+      {
+        "name": "queueName",
+        "type": "Value<string>",
+        "required": false,
+        "description": "`Value<string>`: a name is routinely built with `Sub`/`Ref` (#1366)."
+      },
+      {
+        "name": "batchSize",
+        "type": "number",
+        "required": false
+      },
+      {
+        "name": "maxBatchingWindow",
+        "type": "number",
+        "required": false
+      },
+      {
+        "name": "defaults",
+        "type": "LambdaFunctionProps[\"defaults\"] & { queue?: Partial<ConstructorParameters<typeof Queue>[0]>; eventSourceMapping?: Par...",
+        "required": false
+      },
+      {
+        "name": "name",
+        "type": "string | ReturnType<typeof Sub>",
+        "required": true
+      },
+      {
+        "name": "Runtime",
+        "type": "string",
+        "required": true
+      },
+      {
+        "name": "Handler",
+        "type": "string",
+        "required": true
+      },
+      {
+        "name": "Code",
+        "type": "ConstructorParameters<typeof Function>[0][\"Code\"]",
+        "required": true
+      },
+      {
+        "name": "Timeout",
+        "type": "number",
+        "required": false
+      },
+      {
+        "name": "MemorySize",
+        "type": "number",
+        "required": false
+      },
+      {
+        "name": "Environment",
+        "type": "ConstructorParameters<typeof Function>[0][\"Environment\"]",
+        "required": false
+      },
+      {
+        "name": "ManagedPolicyArns",
+        "type": "string[]",
+        "required": false
+      },
+      {
+        "name": "Policies",
+        "type": "InstanceType<typeof Role_Policy>[]",
+        "required": false
+      },
+      {
+        "name": "VpcConfig",
+        "type": "ConstructorParameters<typeof Function_VpcConfig>[0]",
+        "required": false
+      }
+    ]
+  },
+  {
+    "name": "MicrovmApp",
+    "lexicon": "aws",
+    "description": "MicrovmApp — composite-first delivery of AWS Lambda MicroVM support (#879).",
+    "bundles": [
+      "MicrovmImage",
+      "NetworkConnector",
+      "Role",
+      "SecurityGroup"
+    ],
+    "params": [
+      {
+        "name": "name",
+        "type": "string",
+        "required": true,
+        "description": "Unique image name (`^[a-zA-Z0-9-_]+$`, ≤64 chars)."
+      },
+      {
+        "name": "description",
+        "type": "string",
+        "required": false,
+        "description": "Human-readable description."
+      },
+      {
+        "name": "codeArtifactUri",
+        "type": "string",
+        "required": true,
+        "description": "The `CodeArtifact.Uri` value CloudFormation wants — e.g. the `uri` a `publish-artifact` step produced (`\"@Publish.uri\"`, wired in by the driver)."
+      },
+      {
+        "name": "codeArtifactObjectArn",
+        "type": "string",
+        "required": true,
+        "description": "Exact S3 object ARN of the code artifact, for the build role's `s3:GetObject` grant."
+      },
+      {
+        "name": "baseImage",
+        "type": "string",
+        "required": true,
+        "description": "AWS-managed base image alias (e.g. `\"al2023-1\"`) or a full base-image ARN."
+      },
+      {
+        "name": "baseImageVersion",
+        "type": "string",
+        "required": false,
+        "description": "Base image version to pin."
+      },
+      {
+        "name": "memoryMiB",
+        "type": "MicrovmMemoryMiB",
+        "required": false,
+        "description": "Baseline memory tier in MiB — one of the five documented tiers; vCPU auto-scales with it."
+      },
+      {
+        "name": "environment",
+        "type": "Record<string, string>",
+        "required": false,
+        "description": "Env vars baked into the image at build time (max 50) — snapshotted and shared by every VM booted from this image."
+      },
+      {
+        "name": "additionalOsCapabilities",
+        "type": "\"ALL\"[]",
+        "required": false,
+        "description": "Opt into `\"ALL\"` additional OS capabilities — a documented privilege escalation."
+      },
+      {
+        "name": "disableLogging",
+        "type": "boolean",
+        "required": false,
+        "description": "Disable CloudWatch build/runtime logging entirely."
+      },
+      {
+        "name": "hooks",
+        "type": "ConstructorParameters<typeof MicrovmImage_Hooks>[0]",
+        "required": false,
+        "description": "Lifecycle hooks — all default to disabled (traffic flows immediately)."
+      },
+      {
+        "name": "buildConnector",
+        "type": "MicrovmAppBuildConnectorProps",
+        "required": false,
+        "description": "Build-time egress: attach a `NetworkConnector` (+ its deny-all-egress security group + least-privilege ENI operator role) so the image build can reach a VPC..."
+      },
+      {
+        "name": "additionalEgressConnectors",
+        "type": "string[]",
+        "required": false,
+        "description": "Extra egress connector ARNs to bake in alongside the one this composite creates (e.g. an AWS-managed `INTERNET_EGRESS` alias, or a pre-existing shared..."
+      },
+      {
+        "name": "defaults",
+        "type": "{ buildRole?: Partial<ConstructorParameters<typeof Role>[0]>; executionRole?: Partial<ConstructorParameters<typeof Ro...",
+        "required": false
+      }
+    ]
+  },
+  {
+    "name": "MinimalVpc",
+    "lexicon": "aws",
+    "description": "A VPC with one public subnet, an internet gateway, a public route and a security group.",
+    "bundles": [
+      "EC2Route",
+      "InternetGateway",
+      "RouteTable",
+      "SecurityGroup",
+      "Subnet",
+      "SubnetRouteTableAssociation",
+      "VPCGatewayAttachment",
+      "Vpc"
+    ],
+    "params": [
+      {
+        "name": "cidr",
+        "type": "string",
+        "required": false
+      },
+      {
+        "name": "subnetCidr",
+        "type": "string",
+        "required": false
+      },
+      {
+        "name": "defaults",
+        "type": "{ vpc?: Partial<ConstructorParameters<typeof Vpc>[0]>; subnet?: Partial<ConstructorParameters<typeof Subnet>[0]>; sec...",
+        "required": false
+      }
+    ]
+  },
+  {
+    "name": "MonitoringStack",
+    "lexicon": "aws",
+    "description": "MonitoringStack — a CloudWatch dashboard wired to up to three named metrics, with an optional alarm per metric.",
+    "bundles": [
+      "Alarm",
+      "CwDashboard"
+    ],
+    "params": [
+      {
+        "name": "dashboardName",
+        "type": "Value<string>",
+        "required": false,
+        "description": "`Value<string>`: a name is routinely built with `Sub`/`Ref` (#1366)."
+      },
+      {
+        "name": "metric1",
+        "type": "MonitoringMetricSpec",
+        "required": true
+      },
+      {
+        "name": "metric2",
+        "type": "MonitoringMetricSpec",
+        "required": false
+      },
+      {
+        "name": "metric3",
+        "type": "MonitoringMetricSpec",
+        "required": false
+      },
+      {
+        "name": "tags",
+        "type": "Array<{ Key: string; Value: string }>",
+        "required": false
+      },
+      {
+        "name": "defaults",
+        "type": "{ dashboard?: Partial<ConstructorParameters<typeof CwDashboard>[0]>; alarm1?: Partial<ConstructorParameters<typeof Al...",
+        "required": false
+      }
+    ]
+  },
+  {
+    "name": "NlbService",
+    "lexicon": "aws",
+    "description": "A Network Load Balancer with a target group and listener.",
+    "bundles": [
+      "Listener",
+      "LoadBalancer",
+      "TargetGroup"
+    ],
+    "params": [
+      {
+        "name": "vpcId",
+        "type": "string",
+        "required": true
+      },
+      {
+        "name": "subnetIds",
+        "type": "string[]",
+        "required": true
+      },
+      {
+        "name": "listenerPort",
+        "type": "number",
+        "required": false
+      },
+      {
+        "name": "targetPort",
+        "type": "number",
+        "required": false,
+        "description": "Port the target group forwards traffic to."
+      },
+      {
+        "name": "protocol",
+        "type": "\"TCP\" | \"UDP\" | \"TLS\" | \"TCP_UDP\"",
+        "required": false,
+        "description": "Listener + target group protocol."
+      },
+      {
+        "name": "scheme",
+        "type": "\"internet-facing\" | \"internal\"",
+        "required": false
+      },
+      {
+        "name": "targetType",
+        "type": "\"instance\" | \"ip\" | \"alb\"",
+        "required": false,
+        "description": "Target group target type."
+      },
+      {
+        "name": "targets",
+        "type": "Array<{ id: string; port?: number; availabilityZone?: string }>",
+        "required": false,
+        "description": "Static targets to register at creation time (instance IDs, IPs, or an ALB ARN depending on `targetType`)."
+      },
+      {
+        "name": "certificateArn",
+        "type": "string",
+        "required": false,
+        "description": "ACM certificate ARN."
+      },
+      {
+        "name": "healthCheckProtocol",
+        "type": "\"TCP\" | \"HTTP\" | \"HTTPS\"",
+        "required": false
+      },
+      {
+        "name": "healthCheckPort",
+        "type": "string",
+        "required": false
+      },
+      {
+        "name": "healthCheckPath",
+        "type": "string",
+        "required": false,
+        "description": "Only meaningful when `healthCheckProtocol` is `HTTP` or `HTTPS`."
+      },
+      {
+        "name": "defaults",
+        "type": "{ nlb?: Partial<ConstructorParameters<typeof LoadBalancer>[0]>; targetGroup?: Partial<ConstructorParameters<typeof Ta...",
+        "required": false
+      }
+    ]
+  },
+  {
+    "name": "NodeLambda",
+    "lexicon": "aws",
+    "description": "Deprecated: Use `LambdaNode` instead.",
+    "bundles": [
+      "Function",
+      "Role"
+    ],
+    "params": [
+      {
+        "name": "ManagedPolicyArns",
+        "type": "string[]",
+        "required": false
+      },
+      {
+        "name": "Policies",
+        "type": "InstanceType<typeof Role_Policy>[]",
+        "required": false
+      },
+      {
+        "name": "defaults",
+        "type": "{ role?: Partial<ConstructorParameters<typeof Role>[0]>; func?: Partial<ConstructorParameters<typeof Function>[0]>; }",
+        "required": false
+      },
+      {
+        "name": "Code",
+        "type": "ConstructorParameters<typeof Function>[0][\"Code\"]",
+        "required": true
+      },
+      {
+        "name": "Timeout",
+        "type": "number",
+        "required": false
+      },
+      {
+        "name": "MemorySize",
+        "type": "number",
+        "required": false
+      },
+      {
+        "name": "Environment",
+        "type": "ConstructorParameters<typeof Function>[0][\"Environment\"]",
+        "required": false
+      },
+      {
+        "name": "VpcConfig",
+        "type": "ConstructorParameters<typeof Function_VpcConfig>[0]",
+        "required": false
+      },
+      {
+        "name": "name",
+        "type": "string | ReturnType<typeof Sub>",
+        "required": true
+      },
+      {
+        "name": "Handler",
+        "type": "string",
+        "required": false
+      },
+      {
+        "name": "Runtime",
+        "type": "string",
+        "required": false
+      }
+    ]
+  },
+  {
+    "name": "OrganizationRoot",
+    "lexicon": "aws",
+    "description": "Creates the organization itself.",
+    "bundles": [
+      "Organization"
+    ],
+    "params": [
+      {
+        "name": "featureSet",
+        "type": "\"ALL\" | \"CONSOLIDATED_BILLING\"",
+        "required": false
+      }
+    ]
+  },
+  {
+    "name": "OrganizationTrail",
+    "lexicon": "aws",
+    "description": "An organization-wide CloudTrail trail.",
+    "bundles": [
+      "Trail"
+    ],
+    "params": [
+      {
+        "name": "bucket",
+        "type": "string",
+        "required": true,
+        "description": "S3 bucket the organization trail delivers into."
+      }
+    ]
+  },
+  {
+    "name": "PythonLambda",
+    "lexicon": "aws",
+    "description": "Deprecated: Use `LambdaPython` instead.",
+    "bundles": [
+      "Function",
+      "Role"
+    ],
+    "params": [
+      {
+        "name": "ManagedPolicyArns",
+        "type": "string[]",
+        "required": false
+      },
+      {
+        "name": "Policies",
+        "type": "InstanceType<typeof Role_Policy>[]",
+        "required": false
+      },
+      {
+        "name": "defaults",
+        "type": "{ role?: Partial<ConstructorParameters<typeof Role>[0]>; func?: Partial<ConstructorParameters<typeof Function>[0]>; }",
+        "required": false
+      },
+      {
+        "name": "Code",
+        "type": "ConstructorParameters<typeof Function>[0][\"Code\"]",
+        "required": true
+      },
+      {
+        "name": "Timeout",
+        "type": "number",
+        "required": false
+      },
+      {
+        "name": "MemorySize",
+        "type": "number",
+        "required": false
+      },
+      {
+        "name": "Environment",
+        "type": "ConstructorParameters<typeof Function>[0][\"Environment\"]",
+        "required": false
+      },
+      {
+        "name": "VpcConfig",
+        "type": "ConstructorParameters<typeof Function_VpcConfig>[0]",
+        "required": false
+      },
+      {
+        "name": "name",
+        "type": "string | ReturnType<typeof Sub>",
+        "required": true
+      },
+      {
+        "name": "Handler",
+        "type": "string",
+        "required": false
+      },
+      {
+        "name": "Runtime",
+        "type": "string",
+        "required": false
+      }
+    ]
+  },
+  {
+    "name": "RdsInstance",
+    "lexicon": "aws",
+    "description": "An RDS database instance with its subnet group, parameter group and security group, defaulting to PostgreSQL.",
+    "bundles": [
+      "DbInstance",
+      "RDSDBParameterGroup",
+      "RDSDBSubnetGroup",
+      "SecurityGroup"
+    ],
+    "params": [
+      {
+        "name": "engine",
+        "type": "\"postgres\" | \"mysql\" | \"mariadb\"",
+        "required": false
+      },
+      {
+        "name": "vpcId",
+        "type": "string",
+        "required": true
+      },
+      {
+        "name": "subnetIds",
+        "type": "string[]",
+        "required": true
+      },
+      {
+        "name": "ingressSourceSG",
+        "type": "string",
+        "required": false
+      },
+      {
+        "name": "ingressCidr",
+        "type": "string",
+        "required": false
+      },
+      {
+        "name": "port",
+        "type": "number",
+        "required": false
+      },
+      {
+        "name": "publiclyAccessible",
+        "type": "boolean",
+        "required": false
+      },
+      {
+        "name": "masterUsername",
+        "type": "string",
+        "required": false
+      },
+      {
+        "name": "masterPassword",
+        "type": "string",
+        "required": true
+      },
+      {
+        "name": "engineVersion",
+        "type": "string",
+        "required": false
+      },
+      {
+        "name": "databaseName",
+        "type": "string",
+        "required": false
+      },
+      {
+        "name": "instanceClass",
+        "type": "string",
+        "required": false
+      },
+      {
+        "name": "allocatedStorage",
+        "type": "number",
+        "required": false
+      },
+      {
+        "name": "storageType",
+        "type": "string",
+        "required": false
+      },
+      {
+        "name": "maxAllocatedStorage",
+        "type": "number",
+        "required": false
+      },
+      {
+        "name": "multiAZ",
+        "type": "boolean",
+        "required": false
+      },
+      {
+        "name": "storageEncrypted",
+        "type": "boolean",
+        "required": false
+      },
+      {
+        "name": "kmsKeyId",
+        "type": "string",
+        "required": false
+      },
+      {
+        "name": "backupRetentionPeriod",
+        "type": "number",
+        "required": false
+      },
+      {
+        "name": "preferredBackupWindow",
+        "type": "string",
+        "required": false
+      },
+      {
+        "name": "copyTagsToSnapshot",
+        "type": "boolean",
+        "required": false
+      },
+      {
+        "name": "preferredMaintenanceWindow",
+        "type": "string",
+        "required": false
+      },
+      {
+        "name": "autoMinorVersionUpgrade",
+        "type": "boolean",
+        "required": false
+      },
+      {
+        "name": "enableCloudwatchLogs",
+        "type": "boolean",
+        "required": false
+      },
+      {
+        "name": "enablePerformanceInsights",
+        "type": "boolean",
+        "required": false
+      },
+      {
+        "name": "performanceInsightsRetentionPeriod",
+        "type": "number",
+        "required": false
+      },
+      {
+        "name": "parameterGroupFamily",
+        "type": "string",
+        "required": false
+      },
+      {
+        "name": "parameters",
+        "type": "Record<string, string>",
+        "required": false
+      },
+      {
+        "name": "deletionProtection",
+        "type": "boolean",
+        "required": false
+      },
+      {
+        "name": "defaults",
+        "type": "{ subnetGroup?: Partial<ConstructorParameters<typeof RDSDBSubnetGroup>[0]>; sg?: Partial<ConstructorParameters<typeof...",
+        "required": false
+      }
+    ]
+  },
+  {
+    "name": "RdsPostgres",
+    "lexicon": "aws",
+    "description": "An RDS database instance with its subnet group, parameter group and security group, defaulting to PostgreSQL. Another name for RdsInstance.",
+    "bundles": [
+      "DbInstance",
+      "RDSDBParameterGroup",
+      "RDSDBSubnetGroup",
+      "SecurityGroup"
+    ],
+    "params": [
+      {
+        "name": "engine",
+        "type": "\"postgres\" | \"mysql\" | \"mariadb\"",
+        "required": false
+      },
+      {
+        "name": "vpcId",
+        "type": "string",
+        "required": true
+      },
+      {
+        "name": "subnetIds",
+        "type": "string[]",
+        "required": true
+      },
+      {
+        "name": "ingressSourceSG",
+        "type": "string",
+        "required": false
+      },
+      {
+        "name": "ingressCidr",
+        "type": "string",
+        "required": false
+      },
+      {
+        "name": "port",
+        "type": "number",
+        "required": false
+      },
+      {
+        "name": "publiclyAccessible",
+        "type": "boolean",
+        "required": false
+      },
+      {
+        "name": "masterUsername",
+        "type": "string",
+        "required": false
+      },
+      {
+        "name": "masterPassword",
+        "type": "string",
+        "required": true
+      },
+      {
+        "name": "engineVersion",
+        "type": "string",
+        "required": false
+      },
+      {
+        "name": "databaseName",
+        "type": "string",
+        "required": false
+      },
+      {
+        "name": "instanceClass",
+        "type": "string",
+        "required": false
+      },
+      {
+        "name": "allocatedStorage",
+        "type": "number",
+        "required": false
+      },
+      {
+        "name": "storageType",
+        "type": "string",
+        "required": false
+      },
+      {
+        "name": "maxAllocatedStorage",
+        "type": "number",
+        "required": false
+      },
+      {
+        "name": "multiAZ",
+        "type": "boolean",
+        "required": false
+      },
+      {
+        "name": "storageEncrypted",
+        "type": "boolean",
+        "required": false
+      },
+      {
+        "name": "kmsKeyId",
+        "type": "string",
+        "required": false
+      },
+      {
+        "name": "backupRetentionPeriod",
+        "type": "number",
+        "required": false
+      },
+      {
+        "name": "preferredBackupWindow",
+        "type": "string",
+        "required": false
+      },
+      {
+        "name": "copyTagsToSnapshot",
+        "type": "boolean",
+        "required": false
+      },
+      {
+        "name": "preferredMaintenanceWindow",
+        "type": "string",
+        "required": false
+      },
+      {
+        "name": "autoMinorVersionUpgrade",
+        "type": "boolean",
+        "required": false
+      },
+      {
+        "name": "enableCloudwatchLogs",
+        "type": "boolean",
+        "required": false
+      },
+      {
+        "name": "enablePerformanceInsights",
+        "type": "boolean",
+        "required": false
+      },
+      {
+        "name": "performanceInsightsRetentionPeriod",
+        "type": "number",
+        "required": false
+      },
+      {
+        "name": "parameterGroupFamily",
+        "type": "string",
+        "required": false
+      },
+      {
+        "name": "parameters",
+        "type": "Record<string, string>",
+        "required": false
+      },
+      {
+        "name": "deletionProtection",
+        "type": "boolean",
+        "required": false
+      },
+      {
+        "name": "defaults",
+        "type": "{ subnetGroup?: Partial<ConstructorParameters<typeof RDSDBSubnetGroup>[0]>; sg?: Partial<ConstructorParameters<typeof...",
+        "required": false
+      }
+    ]
+  },
+  {
+    "name": "RegionRestriction",
+    "lexicon": "aws",
+    "description": "A service control policy that denies requests outside the listed regions.",
+    "bundles": [
+      "OrganizationsPolicy"
+    ],
+    "params": [
+      {
+        "name": "regions",
+        "type": "string[]",
+        "required": true,
+        "description": "The only regions requests may target (global services excepted)."
+      },
+      {
+        "name": "targetIds",
+        "type": "string[]",
+        "required": true,
+        "description": "Root/OU ids the SCP attaches to."
+      }
+    ]
+  },
+  {
+    "name": "ScheduledLambda",
+    "lexicon": "aws",
+    "description": "Deprecated: Use `LambdaScheduled` instead.",
+    "bundles": [
+      "EventRule",
+      "Function",
+      "Permission",
+      "Role"
+    ],
+    "params": [
+      {
+        "name": "ruleName",
+        "type": "Value<string>",
+        "required": false,
+        "description": "`Value<string>`: a name is routinely built with `Sub`/`Ref` (#1366)."
+      },
+      {
+        "name": "schedule",
+        "type": "string",
+        "required": true
+      },
+      {
+        "name": "enabled",
+        "type": "boolean",
+        "required": false
+      },
+      {
+        "name": "defaults",
+        "type": "LambdaFunctionProps[\"defaults\"] & { rule?: Partial<ConstructorParameters<typeof EventRule>[0]>; permission?: Partial<...",
+        "required": false
+      },
+      {
+        "name": "name",
+        "type": "string | ReturnType<typeof Sub>",
+        "required": true
+      },
+      {
+        "name": "Runtime",
+        "type": "string",
+        "required": true
+      },
+      {
+        "name": "Handler",
+        "type": "string",
+        "required": true
+      },
+      {
+        "name": "Code",
+        "type": "ConstructorParameters<typeof Function>[0][\"Code\"]",
+        "required": true
+      },
+      {
+        "name": "Timeout",
+        "type": "number",
+        "required": false
+      },
+      {
+        "name": "MemorySize",
+        "type": "number",
+        "required": false
+      },
+      {
+        "name": "Environment",
+        "type": "ConstructorParameters<typeof Function>[0][\"Environment\"]",
+        "required": false
+      },
+      {
+        "name": "ManagedPolicyArns",
+        "type": "string[]",
+        "required": false
+      },
+      {
+        "name": "Policies",
+        "type": "InstanceType<typeof Role_Policy>[]",
+        "required": false
+      },
+      {
+        "name": "VpcConfig",
+        "type": "ConstructorParameters<typeof Function_VpcConfig>[0]",
+        "required": false
+      }
+    ]
+  },
+  {
+    "name": "SolrFargateService",
+    "lexicon": "aws",
+    "description": "A FargateService preset for Apache Solr, with JVM heap and GC settings.",
+    "bundles": [
+      "ApplicationAutoScalingScalingPolicy",
+      "EcsService",
+      "ListenerRule",
+      "LogGroup",
+      "Role",
+      "ScalableTarget",
+      "SecurityGroup",
+      "TargetGroup",
+      "TaskDefinition"
+    ],
+    "params": [
+      {
+        "name": "solrHeap",
+        "type": "string",
+        "required": false,
+        "description": "JVM heap size passed as SOLR_HEAP."
+      },
+      {
+        "name": "gcOpts",
+        "type": "string",
+        "required": false,
+        "description": "GC tuning string passed as GC_TUNE."
+      },
+      {
+        "name": "clusterArn",
+        "type": "Value<string>",
+        "required": true
+      },
+      {
+        "name": "listenerArn",
+        "type": "Value<string>",
+        "required": true
+      },
+      {
+        "name": "albSecurityGroupId",
+        "type": "Value<string>",
+        "required": true
+      },
+      {
+        "name": "executionRoleArn",
+        "type": "Value<string>",
+        "required": true
+      },
+      {
+        "name": "priority",
+        "type": "number",
+        "required": true
+      },
+      {
+        "name": "pathPatterns",
+        "type": "string[]",
+        "required": false
+      },
+      {
+        "name": "hostHeaders",
+        "type": "string[]",
+        "required": false
+      },
+      {
+        "name": "image",
+        "type": "Value<string>",
+        "required": true
+      },
+      {
+        "name": "containerPort",
+        "type": "number",
+        "required": false
+      },
+      {
+        "name": "cpu",
+        "type": "string",
+        "required": false
+      },
+      {
+        "name": "memory",
+        "type": "string",
+        "required": false
+      },
+      {
+        "name": "desiredCount",
+        "type": "number",
+        "required": false
+      },
+      {
+        "name": "autoscaling",
+        "type": "{ minCapacity?: number; maxCapacity: number; cpuTarget?: number; scaleInCooldown?: number; scaleOutCooldown?: number; }",
+        "required": false
+      },
+      {
+        "name": "environment",
+        "type": "Record<string, string>",
+        "required": false
+      },
+      {
+        "name": "command",
+        "type": "string[]",
+        "required": false
+      },
+      {
+        "name": "mountPoints",
+        "type": "InstanceType<typeof TaskDefinition_MountPoint>[]",
+        "required": false
+      },
+      {
+        "name": "efsMounts",
+        "type": "Array<{ fileSystemId: string; accessPointId?: string; containerPath: string; volumeName?: string; transitEncryption?:...",
+        "required": false
+      },
+      {
+        "name": "vpcId",
+        "type": "Value<string>",
+        "required": true
+      },
+      {
+        "name": "privateSubnetIds",
+        "type": "Array<Value<string>>",
+        "required": true
+      },
+      {
+        "name": "healthCheckPath",
+        "type": "string",
+        "required": false
+      },
+      {
+        "name": "ulimits",
+        "type": "Array<{ name: string; softLimit: number; hardLimit: number }>",
+        "required": false
+      },
+      {
+        "name": "ManagedPolicyArns",
+        "type": "string[]",
+        "required": false
+      },
+      {
+        "name": "Policies",
+        "type": "InstanceType<typeof Role_Policy>[]",
+        "required": false
+      },
+      {
+        "name": "logRetentionDays",
+        "type": "number",
+        "required": false
+      },
+      {
+        "name": "defaults",
+        "type": "{ taskRole?: Partial<ConstructorParameters<typeof Role>[0]>; taskDef?: Partial<ConstructorParameters<typeof TaskDefin...",
+        "required": false
+      }
+    ]
+  },
+  {
+    "name": "StepFunctionsWorkflow",
+    "lexicon": "aws",
+    "description": "A Step Functions state machine with its execution role and a log group.",
+    "bundles": [
+      "LogGroup",
+      "Role",
+      "StateMachine"
+    ],
+    "params": [
+      {
+        "name": "name",
+        "type": "Value<string>",
+        "required": false,
+        "description": "`Value<string>`: a name is routinely built with `Sub`/`Ref` (#1366)."
+      },
+      {
+        "name": "definition",
+        "type": "Record<string, unknown>",
+        "required": true,
+        "description": "ASL state machine definition, authored as a plain object."
+      },
+      {
+        "name": "lambdaFunctionArns",
+        "type": "Value<string>[]",
+        "required": false,
+        "description": "ARNs of the Lambda functions this workflow's tasks invoke; grants `lambda:InvokeFunction` on each."
+      },
+      {
+        "name": "stateMachineType",
+        "type": "\"STANDARD\" | \"EXPRESS\"",
+        "required": false
+      },
+      {
+        "name": "logRetentionDays",
+        "type": "number",
+        "required": false,
+        "description": "CloudWatch Logs retention for the auto-created log group."
+      },
+      {
+        "name": "loggingLevel",
+        "type": "\"ALL\" | \"ERROR\" | \"FATAL\" | \"OFF\"",
+        "required": false,
+        "description": "`LoggingConfiguration` level."
+      },
+      {
+        "name": "ManagedPolicyArns",
+        "type": "string[]",
+        "required": false
+      },
+      {
+        "name": "Policies",
+        "type": "InstanceType<typeof Role_Policy>[]",
+        "required": false
+      },
+      {
+        "name": "defaults",
+        "type": "{ role?: Partial<ConstructorParameters<typeof Role>[0]>; logGroup?: Partial<ConstructorParameters<typeof LogGroup>[0]...",
+        "required": false
+      }
+    ]
+  },
+  {
+    "name": "VpcDefault",
+    "lexicon": "aws",
+    "description": "A VPC across two or three availability zones with public and private subnets, an internet gateway, a NAT gateway and their route tables.",
+    "bundles": [
+      "EC2Route",
+      "EIP",
+      "InternetGateway",
+      "NatGateway",
+      "RouteTable",
+      "Subnet",
+      "SubnetRouteTableAssociation",
+      "VPCGatewayAttachment",
+      "Vpc"
+    ],
+    "params": [
+      {
+        "name": "cidr",
+        "type": "string",
+        "required": false
+      },
+      {
+        "name": "azCount",
+        "type": "2 | 3",
+        "required": false,
+        "description": "Number of availability zones (2 or 3, default: 2)."
+      },
+      {
+        "name": "publicSubnet1Cidr",
+        "type": "string",
+        "required": false
+      },
+      {
+        "name": "publicSubnet2Cidr",
+        "type": "string",
+        "required": false
+      },
+      {
+        "name": "privateSubnet1Cidr",
+        "type": "string",
+        "required": false
+      },
+      {
+        "name": "privateSubnet2Cidr",
+        "type": "string",
+        "required": false
+      },
+      {
+        "name": "publicSubnet3Cidr",
+        "type": "string",
+        "required": false,
+        "description": "Public subnet 3 CIDR (default: \"10.0.32.0/20\")."
+      },
+      {
+        "name": "privateSubnet3Cidr",
+        "type": "string",
+        "required": false,
+        "description": "Private subnet 3 CIDR (default: \"10.0.160.0/20\")."
+      },
+      {
+        "name": "defaults",
+        "type": "{ vpc?: Partial<ConstructorParameters<typeof Vpc>[0]>; publicSubnet1?: Partial<ConstructorParameters<typeof Subnet>[0...",
+        "required": false
+      }
+    ]
+  }
+];