@mavogel/awscdk-rootmail 0.0.272 → 0.0.274

package/.jsii

@@ -7,11 +7,11 @@
     ]
   },
   "bundled": {
-    "@aws-sdk/client-cloudwatch-logs": "^3.731.0",
-    "@aws-sdk/client-route-53": "^3.731.0",
-    "@aws-sdk/client-s3": "^3.731.0",
-    "@aws-sdk/client-ses": "^3.731.0",
-    "@aws-sdk/client-ssm": "^3.731.0",
+    "@aws-sdk/client-cloudwatch-logs": "^3.731.1",
+    "@aws-sdk/client-route-53": "^3.731.1",
+    "@aws-sdk/client-s3": "^3.731.1",
+    "@aws-sdk/client-ses": "^3.731.1",
+    "@aws-sdk/client-ssm": "^3.731.1",
     "async-retry": "^1.3.3",
     "axios": "^1.7.9",
     "cdk-nag": "^2.34.23",
@@ -3522,7 +3522,7 @@
   },
   "name": "@mavogel/awscdk-rootmail",
   "readme": {
-    "markdown": "# awscdk-rootmail\n\nA single email box for all your root user emails in all AWS accounts of the organization.\n- The cdk implementation and **adaption** of the [superwerker](https://superwerker.cloud/) rootmail feature.\n- See [here](docs/adrs/rootmail.md) for a detailed Architectural Decision Record ([ADR](https://adr.github.io/))\n\n## TL;DR ⚡\nEach AWS account needs one unique email address (the so-called \"AWS account root user email address\").\n\nAccess to these email addresses must be adequately secured since they provide privileged access to AWS accounts, such as account deletion procedures.\n\nThis is why you only need 1 mailing list for the AWS Management (formerly *root*) account,\nwe recommend the following pattern `aws-roots+<uuid>@mycompany.test`\n\n> [!NOTE]\n> Maximum **64** characters are allowed for the whole address.\n\nAnd as you own the domain `mycompany.test` you can add a subdomain, e.g. `aws`, for which all EMails will then be received with this solution within this particular AWS Management account.\n\nFeel free to take a look at the design\n![rootmail-solution-diagram-v1](docs/img/awscdk-rootmail-v1-min.png)\n\n## Usage ✨\n\nInstall the dependencies:\n```sh\nbrew install aws-cli node@18 esbuild\n```\n\nYou can chose via embedding the construct in your cdk-app or use is directly via Cloudformation.\n### cdk 🤖\n1. To start a new project we recommend using [projen](https://projen.io/).\n   1. Create a new projen project\n   ```sh\n   npx projen new awscdk-app-ts\n   ```\n   2. Add `@mavogel/awscdk-rootmail` as a dependency to your project in the `.projenrc.ts` file\n   3. Run `yarn run projen` to install it\n2. In you `main.ts` file add the following code\n```ts\nimport { Rootmail } from '@mavogel/awscdk-rootmail';\nimport {\n  App,\n  Stack,\n  StackProps,\n  aws_route53 as r53,\n} from 'aws-cdk-lib';\nimport { Construct } from 'constructs';\n\nexport class MyStack extends Stack {\n  constructor(scope: Construct, id: string, props: StackProps = {}) {\n    super(scope, id, props);\n\n    const domain = 'mycompany.com' // registered via Route53 in the SAME account\n\n    const hostedZone = r53.HostedZone.fromLookup(this, 'rootmail-parent-hosted-zone', {\n      domainName: domain,\n    });\n\n    new Rootmail(this, 'rootmail', {\n      // 1. a domain you own, registered via Route53 in the SAME account\n      domain: domain,\n      // 2. so the subdomain will be aws.mycompany.test and\n      subdomain: 'aws',\n      // 3. wired / delegated automatically to\n      wireDNSToHostedZoneID: hostedZone.hostedZoneId,\n    });\n  }\n}\n```\n2. run on your commandline\n```sh\nyarn run deploy\n```\n1. No need to do anything, the NS records are **automatically** propagated as the parent Hosted Zone is in the same account!\n2. The `hosted-zone-dkim-propagation-provider.is-complete-handler` Lambda function checks every 10 seconds if the DNS for the subdomain is propagated. Details are in the Cloudwatch log group.\n\n> [!TIP]\n> Take a look at the solution design [here](docs/adrs/solution-design-domain-same-aws-account.md) for more details.\n\n### cdk with your own receiver function 🏗️\nYou might also want to pass in you own function on what to do when an EMail is received\n\n> [!TIP]\n> You can add any custom code as receiver function you want.\n\n<details>\n  <summary>... click here for the details</summary>\n\nfile `functions/custom-ses-receive-function.ts` which gets the 2 environment variables populated\n- `EMAIL_BUCKET`\n- `EMAIL_BUCKET_ARN`\n\nas well as `s3:GetObject` on the `RootMail/*` objects in the created Rootmail `S3` bucket.\n\n```ts\nimport { S3 } from '@aws-sdk/client-s3';\nimport { ParsedMail, simpleParser } from 'mailparser';\n// populated by default\nconst emailBucket = process.env.EMAIL_BUCKET;\nconst emailBucketArn = process.env.EMAIL_BUCKET_ARN;\nconst s3 = new S3();\n\n// SESEventRecordsToLambda\n// from https://docs.aws.amazon.com/ses/latest/dg/receiving-email-action-lambda-event.html\nexport const handler = async (event: SESEventRecordsToLambda) => {\n    for (const record of event.Records) {\n\n        const id = record.ses.mail.messageId;\n        const key = `RootMail/${id}`;\n        const response = await s3.getObject({ Bucket: emailBucket as string, Key: key });\n\n        const msg: ParsedMail = await simpleParser(response.Body as unknown as Buffer);\n\n        let title = msg.subject;\n        console.log(`Title: ${title} from emailBucketArn: ${emailBucketArn}`);\n        // use the content of the email body\n        const body = msg.html;\n        // add your custom code here ...\n\n        // dummy example: list s3 buckets\n        const buckets = await s3.listBuckets({});\n        if (!buckets.Buckets) {\n            console.log('No buckets found');\n            return;\n        }\n        console.log('Buckets:');\n        for (const bucket of buckets.Buckets || []) {\n            console.log(bucket.Name);\n        }\n    }\n\n};\n```\nand you create a separate `NodejsFunction` as follows with the additionally needed IAM permissions:\n```ts\nconst customSesReceiveFunction = new NodejsFunction(stackUnderTest, 'custom-ses-receive-function', {\n  functionName: PhysicalName.GENERATE_IF_NEEDED,\n  entry: path.join(__dirname, 'functions', 'custom-ses-receive-function.ts'),\n  runtime: lambda.Runtime.NODEJS_18_X,\n  logRetention: 1,\n  timeout: Duration.seconds(30),\n});\n\n// Note: any additional permissions you need to add to the function yourself!\ncustomSesReceiveFunction.addToRolePolicy(new iam.PolicyStatement({\n  actions: [\n    's3:List*',\n  ],\n  resources: ['*'],\n}))\n```\nand then pass it into the `Rootmail` Stack\n```ts\nexport class MyStack extends Stack {\n  constructor(scope: Construct, id: string, props: StackProps = {}) {\n    super(scope, id, props);\n\n    const domain = 'mycompany.test'\n    const hostedZone = r53.HostedZone.fromLookup(this, 'rootmail-parent-hosted-zone', {\n      domainName: domain,\n    });\n\n    const rootmail = new Rootmail(this, 'rootmail-stack', {\n      domain: domain;\n      autowireDNSParentHostedZoneID: hostedZone.hostedZoneId,\n      env: {\n        region: 'eu-west-1',\n      },\n      customSesReceiveFunction: customSesReceiveFunction, // <- pass it in here\n    });\n  }\n}\n```\n\n\n> [!TIP]\n> Take a look at the solution design for external DNS [here](docs/adrs/solution-design-external-dns-provider.md) for more details.\n\n</details>\n\n### Cloudformation 📦\nor use it directly a Cloudformation template `yaml` from the URL [here](https://mvc-prod-releases.s3.eu-central-1.amazonaws.com/rootmail/v0.0.258/awscdk-rootmail.template.yaml).\n\n\n<details>\n  <summary>... click here for the details</summary>\n\nand fill out the parameters\n![cloudformation-template](docs/img/cloudformation-tpl-min.png)\n\n</details>\n\n\n## Known issues\n- [jsii/2071](https://github.com/aws/jsii/issues/2071): so adding  `compilerOptions.\"esModuleInterop\": true,` in `tsconfig.json` is not possible. See aws-cdk usage with[typescript](https://docs.aws.amazon.com/AWSJavaScriptSDK/latest/#Usage_with_TypeScript). So we needed to change import from `import AWS from 'aws-sdk';` -> `import * as AWS from 'aws-sdk';` to be able to compile.\n\n## Related projects / questions\n- [aws-account-factory-email](https://github.com/aws-samples/aws-account-factory-email): a similar approach with SES, however you need to manually configure it upfront and also it about delivering root mails for a specific account to a specific mailing list and mainly decouples the real email address from the one of the AWS account. The main difference is that we do not *hide* or decouple the email address, but more make those as unique and unguessable/bruteforable as possible (with `uuids`).\n- The question `Is it best practise to use a shared mailbox as AWS root user address?` from [stackoverflow](https://stackoverflow.com/questions/76739635/is-it-best-practise-to-use-a-shared-mailbox-as-aws-root-user-address): yes of course you can also use `root+alias-1@mycompany.com` and `root+alias-2@mycompany.com` etc. for your\nroot EMail boxes.\n\n## Unlock the full potention of your infrastructure - Partner with us!\n\n> [!TIP]\n> Bring your AWS Infrastructure with [MV Consulting](https://manuel-vogel.de/) to the next level. We ship well-architected, resilient, and cost-optimized AWS solutions designed to scale using Infrastructure as Code (IaC), tailoring cloud-native systems for businesses of all sizes.\n>\n> Our Approach:\n>\n> - **Tailored AWS Solutions**: Custom-built for your unique business needs\n> - **Future-Proof Architecture**: Scalable designs that grow with you\n> - **Empowerment Through Ownership**: Your vision, your infrastructure, our expertise\n>\n> Why Choose Us:\n> - 7+ Years of AWS Experience\n> - 12x AWS Certified, including DevOps Engineer & Solutions Architect Professional\n> - Proven Track Record and Testimonials\n>\n> Ready to elevate your AWS CDK Infrastructure?\n>\n> <a href=\"https://manuel-vogel.de/contact\"><img alt=\"Schedule your call\" src=\"https://img.shields.io/badge/schedule%20your%20call-success.svg?style=for-the-badge\"/></a>\n> <details><summary>☁️ <strong>Discover more about my one-person business: MV Consulting</strong></summary>\n>\n> <br/>\n>\n> Hi, I'm Manuel – AWS expert and founder of [MV Consulting](https://manuel-vogel.de). With over a decade of hands-on experience, I specialized myself in deploying well-architected, highly scalable and cost-effective AWS Solutions using Infrastructure as Code (IaC).\n>\n> #### When you work with me, you're getting a package deal of expertise and personalized service:\n>\n> - **AWS CDK Proficiency**: I bring deep AWS CDK knowledge to the table, ensuring your infrastructure is not just maintainable and scalable, but also fully automated.\n> - **AWS Certified**: [Equipped with 12 AWS Certifications](https://www.credly.com/users/manuel-vogel/badges), including DevOps Engineer & Solutions Architect Professional, to ensure best practices across diverse cloud scenarios.\n> - **Direct Access**: You work with me, not a team of managers. Expect quick decisions and high-quality work.\n> - **Tailored Solutions**: Understanding that no two businesses are alike, I Custom-fit cloud infrastructure for your unique needs.\n> - **Cost-Effective**: I'll optimize your AWS spending without cutting corners on performance or security.\n> - **Seamless CI/CD**: I'll set up smooth CI/CD processes using GitHub Actions, making changes a breeze through Pull Requests.\n>\n> *My mission is simple: I'll free you from infrastructure headaches so you can focus on what truly matters – your core business.*\n>\n> Ready to unlock the full potential of AWS Cloud?\n>\n> <a href=\"https://manuel-vogel.de/contact\"><img alt=\"Schedule your call\" src=\"https://img.shields.io/badge/schedule%20your%20call-success.svg?style=for-the-badge\"/></a>\n> </details>\n\n## Acknowledgements\n\nBig thank you to the creators of [projen](https://github.com/projen/projen). This project stands on the shoulders of giants, made possible by their pioneering work in simplifying cloud infrastructure projects!\n\n## Author\n\n[Manuel Vogel](https://manuel-vogel.de/about/)\n\n[![](https://img.shields.io/badge/LinkedIn-0077B5?style=for-the-badge&logo=linkedin&logoColor=white)](https://www.linkedin.com/in/manuel-vogel)\n[![](https://img.shields.io/badge/GitHub-2b3137?style=for-the-badge&logo=github&logoColor=white)](https://github.com/mavogel)"
+    "markdown": "# awscdk-rootmail\n\nA single email box for all your root user emails in all AWS accounts of the organization.\n- The cdk implementation and **adaption** of the [superwerker](https://superwerker.cloud/) rootmail feature.\n- See [here](docs/adrs/rootmail.md) for a detailed Architectural Decision Record ([ADR](https://adr.github.io/))\n\n## TL;DR ⚡\nEach AWS account needs one unique email address (the so-called \"AWS account root user email address\").\n\nAccess to these email addresses must be adequately secured since they provide privileged access to AWS accounts, such as account deletion procedures.\n\nThis is why you only need 1 mailing list for the AWS Management (formerly *root*) account,\nwe recommend the following pattern `aws-roots+<uuid>@mycompany.test`\n\n> [!NOTE]\n> Maximum **64** characters are allowed for the whole address.\n\nAnd as you own the domain `mycompany.test` you can add a subdomain, e.g. `aws`, for which all EMails will then be received with this solution within this particular AWS Management account.\n\nFeel free to take a look at the design\n![rootmail-solution-diagram-v1](docs/img/awscdk-rootmail-v1-min.png)\n\n## Usage ✨\n\nInstall the dependencies:\n```sh\nbrew install aws-cli node@18 esbuild\n```\n\nYou can chose via embedding the construct in your cdk-app or use is directly via Cloudformation.\n### cdk 🤖\n1. To start a new project we recommend using [projen](https://projen.io/).\n   1. Create a new projen project\n   ```sh\n   npx projen new awscdk-app-ts\n   ```\n   2. Add `@mavogel/awscdk-rootmail` as a dependency to your project in the `.projenrc.ts` file\n   3. Run `yarn run projen` to install it\n2. In you `main.ts` file add the following code\n```ts\nimport { Rootmail } from '@mavogel/awscdk-rootmail';\nimport {\n  App,\n  Stack,\n  StackProps,\n  aws_route53 as r53,\n} from 'aws-cdk-lib';\nimport { Construct } from 'constructs';\n\nexport class MyStack extends Stack {\n  constructor(scope: Construct, id: string, props: StackProps = {}) {\n    super(scope, id, props);\n\n    const domain = 'mycompany.com' // registered via Route53 in the SAME account\n\n    const hostedZone = r53.HostedZone.fromLookup(this, 'rootmail-parent-hosted-zone', {\n      domainName: domain,\n    });\n\n    new Rootmail(this, 'rootmail', {\n      // 1. a domain you own, registered via Route53 in the SAME account\n      domain: domain,\n      // 2. so the subdomain will be aws.mycompany.test and\n      subdomain: 'aws',\n      // 3. wired / delegated automatically to\n      wireDNSToHostedZoneID: hostedZone.hostedZoneId,\n    });\n  }\n}\n```\n2. run on your commandline\n```sh\nyarn run deploy\n```\n1. No need to do anything, the NS records are **automatically** propagated as the parent Hosted Zone is in the same account!\n2. The `hosted-zone-dkim-propagation-provider.is-complete-handler` Lambda function checks every 10 seconds if the DNS for the subdomain is propagated. Details are in the Cloudwatch log group.\n\n> [!TIP]\n> Take a look at the solution design [here](docs/adrs/solution-design-domain-same-aws-account.md) for more details.\n\n### cdk with your own receiver function 🏗️\nYou might also want to pass in you own function on what to do when an EMail is received\n\n> [!TIP]\n> You can add any custom code as receiver function you want.\n\n<details>\n  <summary>... click here for the details</summary>\n\nfile `functions/custom-ses-receive-function.ts` which gets the 2 environment variables populated\n- `EMAIL_BUCKET`\n- `EMAIL_BUCKET_ARN`\n\nas well as `s3:GetObject` on the `RootMail/*` objects in the created Rootmail `S3` bucket.\n\n```ts\nimport { S3 } from '@aws-sdk/client-s3';\nimport { ParsedMail, simpleParser } from 'mailparser';\n// populated by default\nconst emailBucket = process.env.EMAIL_BUCKET;\nconst emailBucketArn = process.env.EMAIL_BUCKET_ARN;\nconst s3 = new S3();\n\n// SESEventRecordsToLambda\n// from https://docs.aws.amazon.com/ses/latest/dg/receiving-email-action-lambda-event.html\nexport const handler = async (event: SESEventRecordsToLambda) => {\n    for (const record of event.Records) {\n\n        const id = record.ses.mail.messageId;\n        const key = `RootMail/${id}`;\n        const response = await s3.getObject({ Bucket: emailBucket as string, Key: key });\n\n        const msg: ParsedMail = await simpleParser(response.Body as unknown as Buffer);\n\n        let title = msg.subject;\n        console.log(`Title: ${title} from emailBucketArn: ${emailBucketArn}`);\n        // use the content of the email body\n        const body = msg.html;\n        // add your custom code here ...\n\n        // dummy example: list s3 buckets\n        const buckets = await s3.listBuckets({});\n        if (!buckets.Buckets) {\n            console.log('No buckets found');\n            return;\n        }\n        console.log('Buckets:');\n        for (const bucket of buckets.Buckets || []) {\n            console.log(bucket.Name);\n        }\n    }\n\n};\n```\nand you create a separate `NodejsFunction` as follows with the additionally needed IAM permissions:\n```ts\nconst customSesReceiveFunction = new NodejsFunction(stackUnderTest, 'custom-ses-receive-function', {\n  functionName: PhysicalName.GENERATE_IF_NEEDED,\n  entry: path.join(__dirname, 'functions', 'custom-ses-receive-function.ts'),\n  runtime: lambda.Runtime.NODEJS_18_X,\n  logRetention: 1,\n  timeout: Duration.seconds(30),\n});\n\n// Note: any additional permissions you need to add to the function yourself!\ncustomSesReceiveFunction.addToRolePolicy(new iam.PolicyStatement({\n  actions: [\n    's3:List*',\n  ],\n  resources: ['*'],\n}))\n```\nand then pass it into the `Rootmail` Stack\n```ts\nexport class MyStack extends Stack {\n  constructor(scope: Construct, id: string, props: StackProps = {}) {\n    super(scope, id, props);\n\n    const domain = 'mycompany.test'\n    const hostedZone = r53.HostedZone.fromLookup(this, 'rootmail-parent-hosted-zone', {\n      domainName: domain,\n    });\n\n    const rootmail = new Rootmail(this, 'rootmail-stack', {\n      domain: domain;\n      autowireDNSParentHostedZoneID: hostedZone.hostedZoneId,\n      env: {\n        region: 'eu-west-1',\n      },\n      customSesReceiveFunction: customSesReceiveFunction, // <- pass it in here\n    });\n  }\n}\n```\n\n\n> [!TIP]\n> Take a look at the solution design for external DNS [here](docs/adrs/solution-design-external-dns-provider.md) for more details.\n\n</details>\n\n### Cloudformation 📦\nor use it directly a Cloudformation template `yaml` from the URL [here](https://mvc-prod-releases.s3.eu-central-1.amazonaws.com/rootmail/v0.0.258/awscdk-rootmail.template.yaml).\n\n\n<details>\n  <summary>... click here for the details</summary>\n\nand fill out the parameters\n![cloudformation-template](docs/img/cloudformation-tpl-min.png)\n\n</details>\n\n\n## Known issues\n- [jsii/2071](https://github.com/aws/jsii/issues/2071): so adding  `compilerOptions.\"esModuleInterop\": true,` in `tsconfig.json` is not possible. See aws-cdk usage with[typescript](https://docs.aws.amazon.com/AWSJavaScriptSDK/latest/#Usage_with_TypeScript). So we needed to change import from `import AWS from 'aws-sdk';` -> `import * as AWS from 'aws-sdk';` to be able to compile.\n\n## Related projects / questions\n- [aws-account-factory-email](https://github.com/aws-samples/aws-account-factory-email): a similar approach with SES, however you need to manually configure it upfront and also it about delivering root mails for a specific account to a specific mailing list and mainly decouples the real email address from the one of the AWS account. The main difference is that we do not *hide* or decouple the email address, but more make those as unique and unguessable/bruteforable as possible (with `uuids`).\n- The question `Is it best practise to use a shared mailbox as AWS root user address?` from [stackoverflow](https://stackoverflow.com/questions/76739635/is-it-best-practise-to-use-a-shared-mailbox-as-aws-root-user-address): yes of course you can also use `root+alias-1@mycompany.com` and `root+alias-2@mycompany.com` etc. for your\nroot EMail boxes.\n\n## 🚀 Unlock the Full Potential of Your AWS Cloud Infrastructure\n\nHi, I’m Manuel, an AWS expert passionate about empowering businesses with **scalable, resilient, and cost-optimized cloud solutions**. With **MV Consulting**, I specialize in crafting **tailored AWS architectures** and **DevOps-driven workflows** that not only meet your current needs but grow with you.\n\n---\n\n### 🌟 Why Work With Me?\n\n✔️ **Tailored AWS Solutions:** Every business is unique, so I design custom solutions that fit your goals and challenges.\n✔️ **Well-Architected Designs:** From scalability to security, my solutions align with AWS Well-Architected Framework.\n✔️ **Cloud-Native Focus:** I specialize in modern, cloud-native systems that embrace the full potential of AWS.\n✔️ **Business-Driven Tech:** Technology should serve your business, not the other way around.\n\n---\n\n### 🛠 What I Bring to the Table\n\n🔑 **12x AWS Certifications**\nI’m **AWS Certified Solutions Architect and DevOps – Professional** and hold numerous additional certifications, so you can trust I’ll bring industry best practices to your projects. Feel free to explose by [badges](https://www.credly.com/users/manuel-vogel)\n\n⚙️ **Infrastructure as Code (IaC)**\nWith deep expertise in **AWS CDK** and **Terraform**, I ensure your infrastructure is automated, maintainable, and scalable.\n\n📦 **DevOps Expertise**\nFrom CI/CD pipelines with **GitHub Actions** and **GitLab CI** to container orchestration **Kubernetes** and others, I deliver workflows that are smooth and efficient.\n\n🌐 **Hands-On Experience**\nWith over **7 years of AWS experience** and a decade in the tech world, I’ve delivered solutions for companies large and small. My open-source contributions showcase my commitment to transparency and innovation. Feel free to explore my [GitHub profile](https://github.com/mavogel)\n\n---\n\n### 💼 Let’s Build Something Great Together\n\nI know that choosing the right partner is critical to your success. When you work with me, you’re not just contracting an engineer – you’re gaining a trusted advisor and hands-on expert who cares about your business as much as you do.\n\n✔️ **Direct Collaboration**: No middlemen or red tape – you work with me directly.\n✔️ **Transparent Process**: Expect open communication, clear timelines, and visible results.\n✔️ **Real Value**: My solutions focus on delivering measurable impact for your business.\n\n\n<a href=\"https://tinyurl.com/mvc-15min\"><img alt=\"Schedule your call\" src=\"https://img.shields.io/badge/schedule%20your%20call-success.svg?style=for-the-badge\"/></a>\n\n---\n\n## 🙌 Acknowledgements\n\nBig shoutout to the amazing team behind [Projen](https://github.com/projen/projen)!\nTheir groundbreaking work simplifies cloud infrastructure projects and inspires us every day. 💡\n\n## Author\n\n[Manuel Vogel](https://manuel-vogel.de/about/)\n\n[![](https://img.shields.io/badge/LinkedIn-0077B5?style=for-the-badge&logo=linkedin&logoColor=white)](https://www.linkedin.com/in/manuel-vogel)\n[![](https://img.shields.io/badge/GitHub-2b3137?style=for-the-badge&logo=github&logoColor=white)](https://github.com/mavogel)"
   },
   "repository": {
     "type": "git",
@@ -3942,6 +3942,6 @@
       "symbolId": "src/ses-receive:SESReceiveProps"
     }
   },
-  "version": "0.0.272",
-  "fingerprint": "SxlQkYSIcBvODwHjPjyulU7KMdUyBQgmMWOZf5QrbNs="
+  "version": "0.0.274",
+  "fingerprint": "q+HQvOsEQETLSHMHjlTzKJhSZyo8HVrmErnUore7HPI="
 }

package/README.md

@@ -200,50 +200,54 @@ and fill out the parameters
 - The question `Is it best practise to use a shared mailbox as AWS root user address?` from [stackoverflow](https://stackoverflow.com/questions/76739635/is-it-best-practise-to-use-a-shared-mailbox-as-aws-root-user-address): yes of course you can also use `root+alias-1@mycompany.com` and `root+alias-2@mycompany.com` etc. for your
 root EMail boxes.
 
-## Unlock the full potention of your infrastructure - Partner with us!
+## 🚀 Unlock the Full Potential of Your AWS Cloud Infrastructure  
 
-> [!TIP]
-> Bring your AWS Infrastructure with [MV Consulting](https://manuel-vogel.de/) to the next level. We ship well-architected, resilient, and cost-optimized AWS solutions designed to scale using Infrastructure as Code (IaC), tailoring cloud-native systems for businesses of all sizes.
->
-> Our Approach:
->
-> - **Tailored AWS Solutions**: Custom-built for your unique business needs
-> - **Future-Proof Architecture**: Scalable designs that grow with you
-> - **Empowerment Through Ownership**: Your vision, your infrastructure, our expertise
->
-> Why Choose Us:
-> - 7+ Years of AWS Experience
-> - 12x AWS Certified, including DevOps Engineer & Solutions Architect Professional
-> - Proven Track Record and Testimonials
->
-> Ready to elevate your AWS CDK Infrastructure?
->
-> <a href="https://manuel-vogel.de/contact"><img alt="Schedule your call" src="https://img.shields.io/badge/schedule%20your%20call-success.svg?style=for-the-badge"/></a>
-> <details><summary>☁️ <strong>Discover more about my one-person business: MV Consulting</strong></summary>
->
-> <br/>
->
-> Hi, I'm Manuel – AWS expert and founder of [MV Consulting](https://manuel-vogel.de). With over a decade of hands-on experience, I specialized myself in deploying well-architected, highly scalable and cost-effective AWS Solutions using Infrastructure as Code (IaC).
->
-> #### When you work with me, you're getting a package deal of expertise and personalized service:
->
-> - **AWS CDK Proficiency**: I bring deep AWS CDK knowledge to the table, ensuring your infrastructure is not just maintainable and scalable, but also fully automated.
-> - **AWS Certified**: [Equipped with 12 AWS Certifications](https://www.credly.com/users/manuel-vogel/badges), including DevOps Engineer & Solutions Architect Professional, to ensure best practices across diverse cloud scenarios.
-> - **Direct Access**: You work with me, not a team of managers. Expect quick decisions and high-quality work.
-> - **Tailored Solutions**: Understanding that no two businesses are alike, I Custom-fit cloud infrastructure for your unique needs.
-> - **Cost-Effective**: I'll optimize your AWS spending without cutting corners on performance or security.
-> - **Seamless CI/CD**: I'll set up smooth CI/CD processes using GitHub Actions, making changes a breeze through Pull Requests.
->
-> *My mission is simple: I'll free you from infrastructure headaches so you can focus on what truly matters – your core business.*
->
-> Ready to unlock the full potential of AWS Cloud?
->
-> <a href="https://manuel-vogel.de/contact"><img alt="Schedule your call" src="https://img.shields.io/badge/schedule%20your%20call-success.svg?style=for-the-badge"/></a>
-> </details>
-
-## Acknowledgements
-
-Big thank you to the creators of [projen](https://github.com/projen/projen). This project stands on the shoulders of giants, made possible by their pioneering work in simplifying cloud infrastructure projects!
+Hi, I’m Manuel, an AWS expert passionate about empowering businesses with **scalable, resilient, and cost-optimized cloud solutions**. With **MV Consulting**, I specialize in crafting **tailored AWS architectures** and **DevOps-driven workflows** that not only meet your current needs but grow with you.  
+
+---
+
+### 🌟 Why Work With Me?  
+
+✔️ **Tailored AWS Solutions:** Every business is unique, so I design custom solutions that fit your goals and challenges.  
+✔️ **Well-Architected Designs:** From scalability to security, my solutions align with AWS Well-Architected Framework.  
+✔️ **Cloud-Native Focus:** I specialize in modern, cloud-native systems that embrace the full potential of AWS.  
+✔️ **Business-Driven Tech:** Technology should serve your business, not the other way around.  
+
+---
+
+### 🛠 What I Bring to the Table  
+
+🔑 **12x AWS Certifications**  
+I’m **AWS Certified Solutions Architect and DevOps – Professional** and hold numerous additional certifications, so you can trust I’ll bring industry best practices to your projects. Feel free to explose by [badges](https://www.credly.com/users/manuel-vogel)
+
+⚙️ **Infrastructure as Code (IaC)**  
+With deep expertise in **AWS CDK** and **Terraform**, I ensure your infrastructure is automated, maintainable, and scalable.  
+
+📦 **DevOps Expertise**  
+From CI/CD pipelines with **GitHub Actions** and **GitLab CI** to container orchestration **Kubernetes** and others, I deliver workflows that are smooth and efficient.  
+
+🌐 **Hands-On Experience**  
+With over **7 years of AWS experience** and a decade in the tech world, I’ve delivered solutions for companies large and small. My open-source contributions showcase my commitment to transparency and innovation. Feel free to explore my [GitHub profile](https://github.com/mavogel)
+
+---
+
+### 💼 Let’s Build Something Great Together  
+
+I know that choosing the right partner is critical to your success. When you work with me, you’re not just contracting an engineer – you’re gaining a trusted advisor and hands-on expert who cares about your business as much as you do.  
+
+✔️ **Direct Collaboration**: No middlemen or red tape – you work with me directly.  
+✔️ **Transparent Process**: Expect open communication, clear timelines, and visible results.  
+✔️ **Real Value**: My solutions focus on delivering measurable impact for your business.  
+
+
+<a href="https://tinyurl.com/mvc-15min"><img alt="Schedule your call" src="https://img.shields.io/badge/schedule%20your%20call-success.svg?style=for-the-badge"/></a>  
+
+---
+
+## 🙌 Acknowledgements
+
+Big shoutout to the amazing team behind [Projen](https://github.com/projen/projen)!  
+Their groundbreaking work simplifies cloud infrastructure projects and inspires us every day. 💡
 
 ## Author
 

package/lib/rootmail.js

@@ -79,7 +79,7 @@ class Rootmail extends constructs_1.Construct {
 }
 exports.Rootmail = Rootmail;
 _a = JSII_RTTI_SYMBOL_1;
-Rootmail[_a] = { fqn: "@mavogel/awscdk-rootmail.Rootmail", version: "0.0.272" };
+Rootmail[_a] = { fqn: "@mavogel/awscdk-rootmail.Rootmail", version: "0.0.274" };
 /**
  * Aspect for setting all removal policies to DESTROY
  */

package/lib/ses-receive.js

@@ -131,7 +131,7 @@ class SESReceive extends constructs_1.Construct {
 }
 exports.SESReceive = SESReceive;
 _a = JSII_RTTI_SYMBOL_1;
-SESReceive[_a] = { fqn: "@mavogel/awscdk-rootmail.SESReceive", version: "0.0.272" };
+SESReceive[_a] = { fqn: "@mavogel/awscdk-rootmail.SESReceive", version: "0.0.274" };
 /**
  * Aspect for setting all removal policies to DESTROY
  */

package/node_modules/@aws-sdk/client-cloudwatch-logs/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@aws-sdk/client-cloudwatch-logs",
   "description": "AWS SDK for JavaScript Cloudwatch Logs Client for Node.js, Browser and React Native",
-  "version": "3.731.0",
+  "version": "3.731.1",
   "scripts": {
     "build": "concurrently 'yarn:build:cjs' 'yarn:build:es' 'yarn:build:types'",
     "build:cjs": "node ../../scripts/compilation/inline client-cloudwatch-logs",
@@ -21,7 +21,7 @@
     "@aws-crypto/sha256-browser": "5.2.0",
     "@aws-crypto/sha256-js": "5.2.0",
     "@aws-sdk/core": "3.731.0",
-    "@aws-sdk/credential-provider-node": "3.731.0",
+    "@aws-sdk/credential-provider-node": "3.731.1",
     "@aws-sdk/middleware-host-header": "3.731.0",
     "@aws-sdk/middleware-logger": "3.731.0",
     "@aws-sdk/middleware-recursion-detection": "3.731.0",

package/node_modules/@aws-sdk/client-route-53/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@aws-sdk/client-route-53",
   "description": "AWS SDK for JavaScript Route 53 Client for Node.js, Browser and React Native",
-  "version": "3.731.0",
+  "version": "3.731.1",
   "scripts": {
     "build": "concurrently 'yarn:build:cjs' 'yarn:build:es' 'yarn:build:types'",
     "build:cjs": "node ../../scripts/compilation/inline client-route-53",
@@ -21,7 +21,7 @@
     "@aws-crypto/sha256-browser": "5.2.0",
     "@aws-crypto/sha256-js": "5.2.0",
     "@aws-sdk/core": "3.731.0",
-    "@aws-sdk/credential-provider-node": "3.731.0",
+    "@aws-sdk/credential-provider-node": "3.731.1",
     "@aws-sdk/middleware-host-header": "3.731.0",
     "@aws-sdk/middleware-logger": "3.731.0",
     "@aws-sdk/middleware-recursion-detection": "3.731.0",

package/node_modules/@aws-sdk/client-s3/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@aws-sdk/client-s3",
   "description": "AWS SDK for JavaScript S3 Client for Node.js, Browser and React Native",
-  "version": "3.731.0",
+  "version": "3.731.1",
   "scripts": {
     "build": "concurrently 'yarn:build:cjs' 'yarn:build:es' 'yarn:build:types'",
     "build:cjs": "node ../../scripts/compilation/inline client-s3",
@@ -28,7 +28,7 @@
     "@aws-crypto/sha256-browser": "5.2.0",
     "@aws-crypto/sha256-js": "5.2.0",
     "@aws-sdk/core": "3.731.0",
-    "@aws-sdk/credential-provider-node": "3.731.0",
+    "@aws-sdk/credential-provider-node": "3.731.1",
     "@aws-sdk/middleware-bucket-endpoint": "3.731.0",
     "@aws-sdk/middleware-expect-continue": "3.731.0",
     "@aws-sdk/middleware-flexible-checksums": "3.731.0",

package/node_modules/@aws-sdk/client-ses/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@aws-sdk/client-ses",
   "description": "AWS SDK for JavaScript Ses Client for Node.js, Browser and React Native",
-  "version": "3.731.0",
+  "version": "3.731.1",
   "scripts": {
     "build": "concurrently 'yarn:build:cjs' 'yarn:build:es' 'yarn:build:types'",
     "build:cjs": "node ../../scripts/compilation/inline client-ses",
@@ -21,7 +21,7 @@
     "@aws-crypto/sha256-browser": "5.2.0",
     "@aws-crypto/sha256-js": "5.2.0",
     "@aws-sdk/core": "3.731.0",
-    "@aws-sdk/credential-provider-node": "3.731.0",
+    "@aws-sdk/credential-provider-node": "3.731.1",
     "@aws-sdk/middleware-host-header": "3.731.0",
     "@aws-sdk/middleware-logger": "3.731.0",
     "@aws-sdk/middleware-recursion-detection": "3.731.0",

package/node_modules/@aws-sdk/client-ssm/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@aws-sdk/client-ssm",
   "description": "AWS SDK for JavaScript Ssm Client for Node.js, Browser and React Native",
-  "version": "3.731.0",
+  "version": "3.731.1",
   "scripts": {
     "build": "concurrently 'yarn:build:cjs' 'yarn:build:es' 'yarn:build:types'",
     "build:cjs": "node ../../scripts/compilation/inline client-ssm",
@@ -21,7 +21,7 @@
     "@aws-crypto/sha256-browser": "5.2.0",
     "@aws-crypto/sha256-js": "5.2.0",
     "@aws-sdk/core": "3.731.0",
-    "@aws-sdk/credential-provider-node": "3.731.0",
+    "@aws-sdk/credential-provider-node": "3.731.1",
     "@aws-sdk/middleware-host-header": "3.731.0",
     "@aws-sdk/middleware-logger": "3.731.0",
     "@aws-sdk/middleware-recursion-detection": "3.731.0",

package/node_modules/@aws-sdk/credential-provider-ini/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@aws-sdk/credential-provider-ini",
-  "version": "3.731.0",
+  "version": "3.731.1",
   "description": "AWS credential provider that sources credentials from ~/.aws/credentials and ~/.aws/config",
   "main": "./dist-cjs/index.js",
   "module": "./dist-es/index.js",
@@ -31,9 +31,9 @@
     "@aws-sdk/credential-provider-env": "3.731.0",
     "@aws-sdk/credential-provider-http": "3.731.0",
     "@aws-sdk/credential-provider-process": "3.731.0",
-    "@aws-sdk/credential-provider-sso": "3.731.0",
-    "@aws-sdk/credential-provider-web-identity": "3.731.0",
-    "@aws-sdk/nested-clients": "3.731.0",
+    "@aws-sdk/credential-provider-sso": "3.731.1",
+    "@aws-sdk/credential-provider-web-identity": "3.731.1",
+    "@aws-sdk/nested-clients": "3.731.1",
     "@aws-sdk/types": "3.731.0",
     "@smithy/credential-provider-imds": "^4.0.0",
     "@smithy/property-provider": "^4.0.0",

package/node_modules/@aws-sdk/credential-provider-node/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@aws-sdk/credential-provider-node",
-  "version": "3.731.0",
+  "version": "3.731.1",
   "description": "AWS credential provider that sources credentials from a Node.JS environment. ",
   "engines": {
     "node": ">=18.0.0"
@@ -31,10 +31,10 @@
   "dependencies": {
     "@aws-sdk/credential-provider-env": "3.731.0",
     "@aws-sdk/credential-provider-http": "3.731.0",
-    "@aws-sdk/credential-provider-ini": "3.731.0",
+    "@aws-sdk/credential-provider-ini": "3.731.1",
     "@aws-sdk/credential-provider-process": "3.731.0",
-    "@aws-sdk/credential-provider-sso": "3.731.0",
-    "@aws-sdk/credential-provider-web-identity": "3.731.0",
+    "@aws-sdk/credential-provider-sso": "3.731.1",
+    "@aws-sdk/credential-provider-web-identity": "3.731.1",
     "@aws-sdk/types": "3.731.0",
     "@smithy/credential-provider-imds": "^4.0.0",
     "@smithy/property-provider": "^4.0.0",

package/node_modules/@aws-sdk/credential-provider-sso/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@aws-sdk/credential-provider-sso",
-  "version": "3.731.0",
+  "version": "3.731.1",
   "description": "AWS credential provider that exchanges a resolved SSO login token file for temporary AWS credentials",
   "main": "./dist-cjs/index.js",
   "module": "./dist-es/index.js",
@@ -27,7 +27,7 @@
   "dependencies": {
     "@aws-sdk/client-sso": "3.731.0",
     "@aws-sdk/core": "3.731.0",
-    "@aws-sdk/token-providers": "3.731.0",
+    "@aws-sdk/token-providers": "3.731.1",
     "@aws-sdk/types": "3.731.0",
     "@smithy/property-provider": "^4.0.0",
     "@smithy/shared-ini-file-loader": "^4.0.0",

package/node_modules/@aws-sdk/credential-provider-web-identity/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@aws-sdk/credential-provider-web-identity",
-  "version": "3.731.0",
+  "version": "3.731.1",
   "description": "AWS credential provider that calls STS assumeRole for temporary AWS credentials",
   "main": "./dist-cjs/index.js",
   "module": "./dist-es/index.js",
@@ -34,7 +34,7 @@
   "license": "Apache-2.0",
   "dependencies": {
     "@aws-sdk/core": "3.731.0",
-    "@aws-sdk/nested-clients": "3.731.0",
+    "@aws-sdk/nested-clients": "3.731.1",
     "@aws-sdk/types": "3.731.0",
     "@smithy/property-provider": "^4.0.0",
     "@smithy/types": "^4.0.0",

package/node_modules/@aws-sdk/nested-clients/dist-cjs/submodules/sso-oidc/index.js

@@ -21,10 +21,9 @@ var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: tru
 // src/submodules/sso-oidc/index.ts
 var sso_oidc_exports = {};
 __export(sso_oidc_exports, {
-  $Command: () => import_smithy_client5.Command,
+  $Command: () => import_smithy_client6.Command,
   AccessDeniedException: () => AccessDeniedException,
   AuthorizationPendingException: () => AuthorizationPendingException,
-  ClientInputEndpointParameters: () => import_EndpointParameters3.ClientInputEndpointParameters,
   CreateTokenCommand: () => CreateTokenCommand,
   CreateTokenRequestFilterSensitiveLog: () => CreateTokenRequestFilterSensitiveLog,
   CreateTokenResponseFilterSensitiveLog: () => CreateTokenResponseFilterSensitiveLog,
@@ -40,7 +39,7 @@ __export(sso_oidc_exports, {
   SlowDownException: () => SlowDownException,
   UnauthorizedClientException: () => UnauthorizedClientException,
   UnsupportedGrantTypeException: () => UnsupportedGrantTypeException,
-  __Client: () => import_smithy_client.Client
+  __Client: () => import_smithy_client2.Client
 });
 module.exports = __toCommonJS(sso_oidc_exports);
 
@@ -54,12 +53,93 @@ var import_core = require("@smithy/core");
 var import_middleware_content_length = require("@smithy/middleware-content-length");
 var import_middleware_endpoint = require("@smithy/middleware-endpoint");
 var import_middleware_retry = require("@smithy/middleware-retry");
-var import_smithy_client = require("@smithy/smithy-client");
+var import_smithy_client2 = require("@smithy/smithy-client");
 var import_httpAuthSchemeProvider = require("./auth/httpAuthSchemeProvider");
-var import_EndpointParameters = require("./submodules/sts/endpoint/EndpointParameters");
+
+// src/submodules/sso-oidc/endpoint/EndpointParameters.ts
+var resolveClientEndpointParameters = /* @__PURE__ */ __name((options) => {
+  return {
+    ...options,
+    useDualstackEndpoint: options.useDualstackEndpoint ?? false,
+    useFipsEndpoint: options.useFipsEndpoint ?? false,
+    defaultSigningName: "sso-oauth"
+  };
+}, "resolveClientEndpointParameters");
+var commonParams = {
+  UseFIPS: { type: "builtInParams", name: "useFipsEndpoint" },
+  Endpoint: { type: "builtInParams", name: "endpoint" },
+  Region: { type: "builtInParams", name: "region" },
+  UseDualStack: { type: "builtInParams", name: "useDualstackEndpoint" }
+};
+
+// src/submodules/sso-oidc/SSOOIDCClient.ts
 var import_runtimeConfig = require("./runtimeConfig");
-var import_runtimeExtensions = require("./submodules/sts/runtimeExtensions");
-var SSOOIDCClient = class extends import_smithy_client.Client {
+
+// src/submodules/sso-oidc/runtimeExtensions.ts
+var import_region_config_resolver = require("@aws-sdk/region-config-resolver");
+var import_protocol_http = require("@smithy/protocol-http");
+var import_smithy_client = require("@smithy/smithy-client");
+
+// src/submodules/sso-oidc/auth/httpAuthExtensionConfiguration.ts
+var getHttpAuthExtensionConfiguration = /* @__PURE__ */ __name((runtimeConfig) => {
+  const _httpAuthSchemes = runtimeConfig.httpAuthSchemes;
+  let _httpAuthSchemeProvider = runtimeConfig.httpAuthSchemeProvider;
+  let _credentials = runtimeConfig.credentials;
+  return {
+    setHttpAuthScheme(httpAuthScheme) {
+      const index = _httpAuthSchemes.findIndex((scheme) => scheme.schemeId === httpAuthScheme.schemeId);
+      if (index === -1) {
+        _httpAuthSchemes.push(httpAuthScheme);
+      } else {
+        _httpAuthSchemes.splice(index, 1, httpAuthScheme);
+      }
+    },
+    httpAuthSchemes() {
+      return _httpAuthSchemes;
+    },
+    setHttpAuthSchemeProvider(httpAuthSchemeProvider) {
+      _httpAuthSchemeProvider = httpAuthSchemeProvider;
+    },
+    httpAuthSchemeProvider() {
+      return _httpAuthSchemeProvider;
+    },
+    setCredentials(credentials) {
+      _credentials = credentials;
+    },
+    credentials() {
+      return _credentials;
+    }
+  };
+}, "getHttpAuthExtensionConfiguration");
+var resolveHttpAuthRuntimeConfig = /* @__PURE__ */ __name((config) => {
+  return {
+    httpAuthSchemes: config.httpAuthSchemes(),
+    httpAuthSchemeProvider: config.httpAuthSchemeProvider(),
+    credentials: config.credentials()
+  };
+}, "resolveHttpAuthRuntimeConfig");
+
+// src/submodules/sso-oidc/runtimeExtensions.ts
+var asPartial = /* @__PURE__ */ __name((t) => t, "asPartial");
+var resolveRuntimeExtensions = /* @__PURE__ */ __name((runtimeConfig, extensions) => {
+  const extensionConfiguration = {
+    ...asPartial((0, import_region_config_resolver.getAwsRegionExtensionConfiguration)(runtimeConfig)),
+    ...asPartial((0, import_smithy_client.getDefaultExtensionConfiguration)(runtimeConfig)),
+    ...asPartial((0, import_protocol_http.getHttpHandlerExtensionConfiguration)(runtimeConfig)),
+    ...asPartial(getHttpAuthExtensionConfiguration(runtimeConfig))
+  };
+  extensions.forEach((extension) => extension.configure(extensionConfiguration));
+  return {
+    ...runtimeConfig,
+    ...(0, import_region_config_resolver.resolveAwsRegionExtensionConfiguration)(extensionConfiguration),
+    ...(0, import_smithy_client.resolveDefaultRuntimeConfig)(extensionConfiguration),
+    ...(0, import_protocol_http.resolveHttpHandlerRuntimeConfig)(extensionConfiguration),
+    ...resolveHttpAuthRuntimeConfig(extensionConfiguration)
+  };
+}, "resolveRuntimeExtensions");
+
+// src/submodules/sso-oidc/SSOOIDCClient.ts
+var SSOOIDCClient = class extends import_smithy_client2.Client {
   static {
     __name(this, "SSOOIDCClient");
   }
@@ -69,14 +149,14 @@ var SSOOIDCClient = class extends import_smithy_client.Client {
   config;
   constructor(...[configuration]) {
     const _config_0 = (0, import_runtimeConfig.getRuntimeConfig)(configuration || {});
-    const _config_1 = (0, import_EndpointParameters.resolveClientEndpointParameters)(_config_0);
+    const _config_1 = resolveClientEndpointParameters(_config_0);
     const _config_2 = (0, import_middleware_user_agent.resolveUserAgentConfig)(_config_1);
     const _config_3 = (0, import_middleware_retry.resolveRetryConfig)(_config_2);
     const _config_4 = (0, import_config_resolver.resolveRegionConfig)(_config_3);
     const _config_5 = (0, import_middleware_host_header.resolveHostHeaderConfig)(_config_4);
     const _config_6 = (0, import_middleware_endpoint.resolveEndpointConfig)(_config_5);
     const _config_7 = (0, import_httpAuthSchemeProvider.resolveHttpAuthSchemeConfig)(_config_6);
-    const _config_8 = (0, import_runtimeExtensions.resolveRuntimeExtensions)(_config_7, configuration?.extensions || []);
+    const _config_8 = resolveRuntimeExtensions(_config_7, configuration?.extensions || []);
     super(_config_8);
     this.config = _config_8;
     this.middlewareStack.use((0, import_middleware_user_agent.getUserAgentPlugin)(this.config));
@@ -106,20 +186,19 @@ var SSOOIDCClient = class extends import_smithy_client.Client {
 };
 
 // src/submodules/sso-oidc/SSOOIDC.ts
-var import_smithy_client6 = require("@smithy/smithy-client");
+var import_smithy_client7 = require("@smithy/smithy-client");
 
 // src/submodules/sso-oidc/commands/CreateTokenCommand.ts
 var import_middleware_endpoint2 = require("@smithy/middleware-endpoint");
 var import_middleware_serde = require("@smithy/middleware-serde");
-var import_smithy_client5 = require("@smithy/smithy-client");
-var import_EndpointParameters2 = require("./submodules/sts/endpoint/EndpointParameters");
+var import_smithy_client6 = require("@smithy/smithy-client");
 
 // src/submodules/sso-oidc/models/models_0.ts
-var import_smithy_client3 = require("@smithy/smithy-client");
+var import_smithy_client4 = require("@smithy/smithy-client");
 
 // src/submodules/sso-oidc/models/SSOOIDCServiceException.ts
-var import_smithy_client2 = require("@smithy/smithy-client");
-var SSOOIDCServiceException = class _SSOOIDCServiceException extends import_smithy_client2.ServiceException {
+var import_smithy_client3 = require("@smithy/smithy-client");
+var SSOOIDCServiceException = class _SSOOIDCServiceException extends import_smithy_client3.ServiceException {
   static {
     __name(this, "SSOOIDCServiceException");
   }
@@ -199,15 +278,15 @@ var AuthorizationPendingException = class _AuthorizationPendingException extends
 };
 var CreateTokenRequestFilterSensitiveLog = /* @__PURE__ */ __name((obj) => ({
   ...obj,
-  ...obj.clientSecret && { clientSecret: import_smithy_client3.SENSITIVE_STRING },
-  ...obj.refreshToken && { refreshToken: import_smithy_client3.SENSITIVE_STRING },
-  ...obj.codeVerifier && { codeVerifier: import_smithy_client3.SENSITIVE_STRING }
+  ...obj.clientSecret && { clientSecret: import_smithy_client4.SENSITIVE_STRING },
+  ...obj.refreshToken && { refreshToken: import_smithy_client4.SENSITIVE_STRING },
+  ...obj.codeVerifier && { codeVerifier: import_smithy_client4.SENSITIVE_STRING }
 }), "CreateTokenRequestFilterSensitiveLog");
 var CreateTokenResponseFilterSensitiveLog = /* @__PURE__ */ __name((obj) => ({
   ...obj,
-  ...obj.accessToken && { accessToken: import_smithy_client3.SENSITIVE_STRING },
-  ...obj.refreshToken && { refreshToken: import_smithy_client3.SENSITIVE_STRING },
-  ...obj.idToken && { idToken: import_smithy_client3.SENSITIVE_STRING }
+  ...obj.accessToken && { accessToken: import_smithy_client4.SENSITIVE_STRING },
+  ...obj.refreshToken && { refreshToken: import_smithy_client4.SENSITIVE_STRING },
+  ...obj.idToken && { idToken: import_smithy_client4.SENSITIVE_STRING }
 }), "CreateTokenResponseFilterSensitiveLog");
 var ExpiredTokenException = class _ExpiredTokenException extends SSOOIDCServiceException {
   static {
@@ -501,7 +580,7 @@ var UnsupportedGrantTypeException = class _UnsupportedGrantTypeException extends
 // src/submodules/sso-oidc/protocols/Aws_restJson1.ts
 var import_core2 = require("@aws-sdk/core");
 var import_core3 = require("@smithy/core");
-var import_smithy_client4 = require("@smithy/smithy-client");
+var import_smithy_client5 = require("@smithy/smithy-client");
 var se_CreateTokenCommand = /* @__PURE__ */ __name(async (input, context) => {
   const b = (0, import_core3.requestBuilder)(input, context);
   const headers = {
@@ -510,7 +589,7 @@ var se_CreateTokenCommand = /* @__PURE__ */ __name(async (input, context) => {
   b.bp("/token");
   let body;
   body = JSON.stringify(
-    (0, import_smithy_client4.take)(input, {
+    (0, import_smithy_client5.take)(input, {
       clientId: [],
       clientSecret: [],
       code: [],
@@ -519,7 +598,7 @@ var se_CreateTokenCommand = /* @__PURE__ */ __name(async (input, context) => {
       grantType: [],
       redirectUri: [],
       refreshToken: [],
-      scope: (_) => (0, import_smithy_client4._json)(_)
+      scope: (_) => (0, import_smithy_client5._json)(_)
     })
   );
   b.m("POST").h(headers).b(body);
@@ -529,16 +608,16 @@ var de_CreateTokenCommand = /* @__PURE__ */ __name(async (output, context) => {
   if (output.statusCode !== 200 && output.statusCode >= 300) {
     return de_CommandError(output, context);
   }
-  const contents = (0, import_smithy_client4.map)({
+  const contents = (0, import_smithy_client5.map)({
     $metadata: deserializeMetadata(output)
   });
-  const data = (0, import_smithy_client4.expectNonNull)((0, import_smithy_client4.expectObject)(await (0, import_core2.parseJsonBody)(output.body, context)), "body");
-  const doc = (0, import_smithy_client4.take)(data, {
-    accessToken: import_smithy_client4.expectString,
-    expiresIn: import_smithy_client4.expectInt32,
-    idToken: import_smithy_client4.expectString,
-    refreshToken: import_smithy_client4.expectString,
-    tokenType: import_smithy_client4.expectString
+  const data = (0, import_smithy_client5.expectNonNull)((0, import_smithy_client5.expectObject)(await (0, import_core2.parseJsonBody)(output.body, context)), "body");
+  const doc = (0, import_smithy_client5.take)(data, {
+    accessToken: import_smithy_client5.expectString,
+    expiresIn: import_smithy_client5.expectInt32,
+    idToken: import_smithy_client5.expectString,
+    refreshToken: import_smithy_client5.expectString,
+    tokenType: import_smithy_client5.expectString
   });
   Object.assign(contents, doc);
   return contents;
@@ -592,160 +671,160 @@ var de_CommandError = /* @__PURE__ */ __name(async (output, context) => {
       });
   }
 }, "de_CommandError");
-var throwDefaultError = (0, import_smithy_client4.withBaseException)(SSOOIDCServiceException);
+var throwDefaultError = (0, import_smithy_client5.withBaseException)(SSOOIDCServiceException);
 var de_AccessDeniedExceptionRes = /* @__PURE__ */ __name(async (parsedOutput, context) => {
-  const contents = (0, import_smithy_client4.map)({});
+  const contents = (0, import_smithy_client5.map)({});
   const data = parsedOutput.body;
-  const doc = (0, import_smithy_client4.take)(data, {
-    error: import_smithy_client4.expectString,
-    error_description: import_smithy_client4.expectString
+  const doc = (0, import_smithy_client5.take)(data, {
+    error: import_smithy_client5.expectString,
+    error_description: import_smithy_client5.expectString
   });
   Object.assign(contents, doc);
   const exception = new AccessDeniedException({
     $metadata: deserializeMetadata(parsedOutput),
     ...contents
   });
-  return (0, import_smithy_client4.decorateServiceException)(exception, parsedOutput.body);
+  return (0, import_smithy_client5.decorateServiceException)(exception, parsedOutput.body);
 }, "de_AccessDeniedExceptionRes");
 var de_AuthorizationPendingExceptionRes = /* @__PURE__ */ __name(async (parsedOutput, context) => {
-  const contents = (0, import_smithy_client4.map)({});
+  const contents = (0, import_smithy_client5.map)({});
   const data = parsedOutput.body;
-  const doc = (0, import_smithy_client4.take)(data, {
-    error: import_smithy_client4.expectString,
-    error_description: import_smithy_client4.expectString
+  const doc = (0, import_smithy_client5.take)(data, {
+    error: import_smithy_client5.expectString,
+    error_description: import_smithy_client5.expectString
   });
   Object.assign(contents, doc);
   const exception = new AuthorizationPendingException({
     $metadata: deserializeMetadata(parsedOutput),
     ...contents
   });
-  return (0, import_smithy_client4.decorateServiceException)(exception, parsedOutput.body);
+  return (0, import_smithy_client5.decorateServiceException)(exception, parsedOutput.body);
 }, "de_AuthorizationPendingExceptionRes");
 var de_ExpiredTokenExceptionRes = /* @__PURE__ */ __name(async (parsedOutput, context) => {
-  const contents = (0, import_smithy_client4.map)({});
+  const contents = (0, import_smithy_client5.map)({});
   const data = parsedOutput.body;
-  const doc = (0, import_smithy_client4.take)(data, {
-    error: import_smithy_client4.expectString,
-    error_description: import_smithy_client4.expectString
+  const doc = (0, import_smithy_client5.take)(data, {
+    error: import_smithy_client5.expectString,
+    error_description: import_smithy_client5.expectString
   });
   Object.assign(contents, doc);
   const exception = new ExpiredTokenException({
     $metadata: deserializeMetadata(parsedOutput),
     ...contents
   });
-  return (0, import_smithy_client4.decorateServiceException)(exception, parsedOutput.body);
+  return (0, import_smithy_client5.decorateServiceException)(exception, parsedOutput.body);
 }, "de_ExpiredTokenExceptionRes");
 var de_InternalServerExceptionRes = /* @__PURE__ */ __name(async (parsedOutput, context) => {
-  const contents = (0, import_smithy_client4.map)({});
+  const contents = (0, import_smithy_client5.map)({});
   const data = parsedOutput.body;
-  const doc = (0, import_smithy_client4.take)(data, {
-    error: import_smithy_client4.expectString,
-    error_description: import_smithy_client4.expectString
+  const doc = (0, import_smithy_client5.take)(data, {
+    error: import_smithy_client5.expectString,
+    error_description: import_smithy_client5.expectString
   });
   Object.assign(contents, doc);
   const exception = new InternalServerException({
     $metadata: deserializeMetadata(parsedOutput),
     ...contents
   });
-  return (0, import_smithy_client4.decorateServiceException)(exception, parsedOutput.body);
+  return (0, import_smithy_client5.decorateServiceException)(exception, parsedOutput.body);
 }, "de_InternalServerExceptionRes");
 var de_InvalidClientExceptionRes = /* @__PURE__ */ __name(async (parsedOutput, context) => {
-  const contents = (0, import_smithy_client4.map)({});
+  const contents = (0, import_smithy_client5.map)({});
   const data = parsedOutput.body;
-  const doc = (0, import_smithy_client4.take)(data, {
-    error: import_smithy_client4.expectString,
-    error_description: import_smithy_client4.expectString
+  const doc = (0, import_smithy_client5.take)(data, {
+    error: import_smithy_client5.expectString,
+    error_description: import_smithy_client5.expectString
   });
   Object.assign(contents, doc);
   const exception = new InvalidClientException({
     $metadata: deserializeMetadata(parsedOutput),
     ...contents
   });
-  return (0, import_smithy_client4.decorateServiceException)(exception, parsedOutput.body);
+  return (0, import_smithy_client5.decorateServiceException)(exception, parsedOutput.body);
 }, "de_InvalidClientExceptionRes");
 var de_InvalidGrantExceptionRes = /* @__PURE__ */ __name(async (parsedOutput, context) => {
-  const contents = (0, import_smithy_client4.map)({});
+  const contents = (0, import_smithy_client5.map)({});
   const data = parsedOutput.body;
-  const doc = (0, import_smithy_client4.take)(data, {
-    error: import_smithy_client4.expectString,
-    error_description: import_smithy_client4.expectString
+  const doc = (0, import_smithy_client5.take)(data, {
+    error: import_smithy_client5.expectString,
+    error_description: import_smithy_client5.expectString
   });
   Object.assign(contents, doc);
   const exception = new InvalidGrantException({
     $metadata: deserializeMetadata(parsedOutput),
     ...contents
   });
-  return (0, import_smithy_client4.decorateServiceException)(exception, parsedOutput.body);
+  return (0, import_smithy_client5.decorateServiceException)(exception, parsedOutput.body);
 }, "de_InvalidGrantExceptionRes");
 var de_InvalidRequestExceptionRes = /* @__PURE__ */ __name(async (parsedOutput, context) => {
-  const contents = (0, import_smithy_client4.map)({});
+  const contents = (0, import_smithy_client5.map)({});
   const data = parsedOutput.body;
-  const doc = (0, import_smithy_client4.take)(data, {
-    error: import_smithy_client4.expectString,
-    error_description: import_smithy_client4.expectString
+  const doc = (0, import_smithy_client5.take)(data, {
+    error: import_smithy_client5.expectString,
+    error_description: import_smithy_client5.expectString
   });
   Object.assign(contents, doc);
   const exception = new InvalidRequestException({
     $metadata: deserializeMetadata(parsedOutput),
     ...contents
   });
-  return (0, import_smithy_client4.decorateServiceException)(exception, parsedOutput.body);
+  return (0, import_smithy_client5.decorateServiceException)(exception, parsedOutput.body);
 }, "de_InvalidRequestExceptionRes");
 var de_InvalidScopeExceptionRes = /* @__PURE__ */ __name(async (parsedOutput, context) => {
-  const contents = (0, import_smithy_client4.map)({});
+  const contents = (0, import_smithy_client5.map)({});
   const data = parsedOutput.body;
-  const doc = (0, import_smithy_client4.take)(data, {
-    error: import_smithy_client4.expectString,
-    error_description: import_smithy_client4.expectString
+  const doc = (0, import_smithy_client5.take)(data, {
+    error: import_smithy_client5.expectString,
+    error_description: import_smithy_client5.expectString
   });
   Object.assign(contents, doc);
   const exception = new InvalidScopeException({
     $metadata: deserializeMetadata(parsedOutput),
     ...contents
   });
-  return (0, import_smithy_client4.decorateServiceException)(exception, parsedOutput.body);
+  return (0, import_smithy_client5.decorateServiceException)(exception, parsedOutput.body);
 }, "de_InvalidScopeExceptionRes");
 var de_SlowDownExceptionRes = /* @__PURE__ */ __name(async (parsedOutput, context) => {
-  const contents = (0, import_smithy_client4.map)({});
+  const contents = (0, import_smithy_client5.map)({});
   const data = parsedOutput.body;
-  const doc = (0, import_smithy_client4.take)(data, {
-    error: import_smithy_client4.expectString,
-    error_description: import_smithy_client4.expectString
+  const doc = (0, import_smithy_client5.take)(data, {
+    error: import_smithy_client5.expectString,
+    error_description: import_smithy_client5.expectString
   });
   Object.assign(contents, doc);
   const exception = new SlowDownException({
     $metadata: deserializeMetadata(parsedOutput),
     ...contents
   });
-  return (0, import_smithy_client4.decorateServiceException)(exception, parsedOutput.body);
+  return (0, import_smithy_client5.decorateServiceException)(exception, parsedOutput.body);
 }, "de_SlowDownExceptionRes");
 var de_UnauthorizedClientExceptionRes = /* @__PURE__ */ __name(async (parsedOutput, context) => {
-  const contents = (0, import_smithy_client4.map)({});
+  const contents = (0, import_smithy_client5.map)({});
   const data = parsedOutput.body;
-  const doc = (0, import_smithy_client4.take)(data, {
-    error: import_smithy_client4.expectString,
-    error_description: import_smithy_client4.expectString
+  const doc = (0, import_smithy_client5.take)(data, {
+    error: import_smithy_client5.expectString,
+    error_description: import_smithy_client5.expectString
   });
   Object.assign(contents, doc);
   const exception = new UnauthorizedClientException({
     $metadata: deserializeMetadata(parsedOutput),
     ...contents
   });
-  return (0, import_smithy_client4.decorateServiceException)(exception, parsedOutput.body);
+  return (0, import_smithy_client5.decorateServiceException)(exception, parsedOutput.body);
 }, "de_UnauthorizedClientExceptionRes");
 var de_UnsupportedGrantTypeExceptionRes = /* @__PURE__ */ __name(async (parsedOutput, context) => {
-  const contents = (0, import_smithy_client4.map)({});
+  const contents = (0, import_smithy_client5.map)({});
   const data = parsedOutput.body;
-  const doc = (0, import_smithy_client4.take)(data, {
-    error: import_smithy_client4.expectString,
-    error_description: import_smithy_client4.expectString
+  const doc = (0, import_smithy_client5.take)(data, {
+    error: import_smithy_client5.expectString,
+    error_description: import_smithy_client5.expectString
   });
   Object.assign(contents, doc);
   const exception = new UnsupportedGrantTypeException({
     $metadata: deserializeMetadata(parsedOutput),
     ...contents
   });
-  return (0, import_smithy_client4.decorateServiceException)(exception, parsedOutput.body);
+  return (0, import_smithy_client5.decorateServiceException)(exception, parsedOutput.body);
 }, "de_UnsupportedGrantTypeExceptionRes");
 var deserializeMetadata = /* @__PURE__ */ __name((output) => ({
   httpStatusCode: output.statusCode,
@@ -755,7 +834,7 @@ var deserializeMetadata = /* @__PURE__ */ __name((output) => ({
 }), "deserializeMetadata");
 
 // src/submodules/sso-oidc/commands/CreateTokenCommand.ts
-var CreateTokenCommand = class extends import_smithy_client5.Command.classBuilder().ep(import_EndpointParameters2.commonParams).m(function(Command, cs, config, o) {
+var CreateTokenCommand = class extends import_smithy_client6.Command.classBuilder().ep(commonParams).m(function(Command, cs, config, o) {
   return [
     (0, import_middleware_serde.getSerdePlugin)(config, this.serialize, this.deserialize),
     (0, import_middleware_endpoint2.getEndpointPlugin)(config, Command.getEndpointParameterInstructions())
@@ -775,16 +854,12 @@ var SSOOIDC = class extends SSOOIDCClient {
     __name(this, "SSOOIDC");
   }
 };
-(0, import_smithy_client6.createAggregatedClient)(commands, SSOOIDC);
-
-// src/submodules/sso-oidc/index.ts
-var import_EndpointParameters3 = require("./submodules/sts/endpoint/EndpointParameters");
+(0, import_smithy_client7.createAggregatedClient)(commands, SSOOIDC);
 // Annotate the CommonJS export names for ESM import in node:
 0 && (module.exports = {
   $Command,
   AccessDeniedException,
   AuthorizationPendingException,
-  ClientInputEndpointParameters,
   CreateTokenCommand,
   CreateTokenRequestFilterSensitiveLog,
   CreateTokenResponseFilterSensitiveLog,

package/node_modules/@aws-sdk/nested-clients/dist-types/index.d.ts

@@ -1,6 +1,7 @@
 /**
  * This package exports nothing at the root.
  * Use submodules e.g. \@aws-sdk/nested-clients/client-sts.
+ *
  * @internal
  */
 export {};

package/node_modules/@aws-sdk/nested-clients/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@aws-sdk/nested-clients",
-  "version": "3.731.0",
+  "version": "3.731.1",
   "description": "Nested clients for AWS SDK packages.",
   "main": "./dist-cjs/index.js",
   "module": "./dist-es/index.js",

package/node_modules/@aws-sdk/token-providers/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@aws-sdk/token-providers",
-  "version": "3.731.0",
+  "version": "3.731.1",
   "description": "A collection of token providers",
   "main": "./dist-cjs/index.js",
   "module": "./dist-es/index.js",
@@ -27,7 +27,7 @@
   },
   "license": "Apache-2.0",
   "dependencies": {
-    "@aws-sdk/nested-clients": "3.731.0",
+    "@aws-sdk/nested-clients": "3.731.1",
     "@aws-sdk/types": "3.731.0",
     "@smithy/property-provider": "^4.0.0",
     "@smithy/shared-ini-file-loader": "^4.0.0",

package/package.json

@@ -56,7 +56,7 @@
     "@typescript-eslint/eslint-plugin": "^8",
     "@typescript-eslint/parser": "^8",
     "aws-cdk-lib": "2.90.0",
-    "cdk-assets": "^2.155.88",
+    "cdk-assets": "^2.155.89",
     "commit-and-tag-version": "^12",
     "constructs": "10.0.5",
     "eslint": "^9",
@@ -81,11 +81,11 @@
     "constructs": "^10.0.5"
   },
   "dependencies": {
-    "@aws-sdk/client-cloudwatch-logs": "^3.731.0",
-    "@aws-sdk/client-route-53": "^3.731.0",
-    "@aws-sdk/client-s3": "^3.731.0",
-    "@aws-sdk/client-ses": "^3.731.0",
-    "@aws-sdk/client-ssm": "^3.731.0",
+    "@aws-sdk/client-cloudwatch-logs": "^3.731.1",
+    "@aws-sdk/client-route-53": "^3.731.1",
+    "@aws-sdk/client-s3": "^3.731.1",
+    "@aws-sdk/client-ses": "^3.731.1",
+    "@aws-sdk/client-ssm": "^3.731.1",
     "async-retry": "^1.3.3",
     "axios": "^1.7.9",
     "cdk-nag": "^2.34.23",
@@ -116,7 +116,7 @@
   "publishConfig": {
     "access": "public"
   },
-  "version": "0.0.272",
+  "version": "0.0.274",
   "jest": {
     "coverageProvider": "v8",
     "testMatch": [