@mavogel/awscdk-rootmail 0.1.17 → 0.1.18

package/integ-tests/integ.rootmail.ts.snapshot/RootmailIntegTestStack.template.json

@@ -21,21 +21,7 @@
     }
    },
    "UpdateReplacePolicy": "Retain",
-   "DeletionPolicy": "Retain",
-   "Metadata": {
-    "cdk_nag": {
-     "rules_to_suppress": [
-      {
-       "reason": "no server access logs needed",
-       "id": "AwsSolutions-S1"
-      },
-      {
-       "reason": "no SSL access needed",
-       "id": "AwsSolutions-S10"
-      }
-     ]
-    }
-   }
+   "DeletionPolicy": "Retain"
   },
   "testRootmailEmailBucketPolicy5DA39984": {
    "Type": "AWS::S3::BucketPolicy",
@@ -76,16 +62,6 @@
      ],
      "Version": "2012-10-17"
     }
-   },
-   "Metadata": {
-    "cdk_nag": {
-     "rules_to_suppress": [
-      {
-       "reason": "no SSL access needed",
-       "id": "AwsSolutions-S10"
-      }
-     ]
-    }
    }
   },
   "testRootmailHostedZone6DFD3C9C": {
@@ -536,22 +512,16 @@
       "PolicyName": "OpsSantaFunctionRolePolicy"
      }
     ]
-   },
-   "Metadata": {
-    "cdk_nag": {
-     "rules_to_suppress": [
-      {
-       "reason": "no service role restriction needed",
-       "id": "AwsSolutions-IAM4"
-      },
-      {
-       "reason": "wildcards are ok as we allow every opsitem to be created",
-       "id": "AwsSolutions-IAM5"
-      }
-     ]
-    }
    }
   },
+  "testRootmailSESReceiveopssantahandlerloggroup7607F786": {
+   "Type": "AWS::Logs::LogGroup",
+   "Properties": {
+    "RetentionInDays": 3
+   },
+   "UpdateReplacePolicy": "Retain",
+   "DeletionPolicy": "Retain"
+  },
   "testRootmailSESReceiveopssantahandler9628381A": {
    "Type": "AWS::Lambda::Function",
    "Properties": {
@@ -559,7 +529,7 @@
      "S3Bucket": {
       "Fn::Sub": "cdk-hnb659fds-assets-${AWS::AccountId}-${AWS::Region}"
      },
-     "S3Key": "aa3a06cb0aae2ae75b5bdf62921fd207503fd54b0e711ebb20274f3e6afd3bfa.zip"
+     "S3Key": "ee814b07e4253e03bace8114424b313a76d41c6312b50dc336730835e39f5fa4.zip"
     },
     "Environment": {
      "Variables": {
@@ -579,42 +549,24 @@
      }
     },
     "Handler": "index.handler",
+    "LoggingConfig": {
+     "LogGroup": {
+      "Ref": "testRootmailSESReceiveopssantahandlerloggroup7607F786"
+     }
+    },
     "Role": {
      "Fn::GetAtt": [
       "testRootmailSESReceiveOpsSantaFunctionRole82D7297F",
       "Arn"
      ]
     },
-    "Runtime": "nodejs18.x",
+    "Runtime": "nodejs24.x",
     "Timeout": 60
    },
    "DependsOn": [
     "testRootmailSESReceiveOpsSantaFunctionRole82D7297F"
    ]
   },
-  "testRootmailSESReceiveopssantahandlerLogRetention23A4ECDE": {
-   "Type": "Custom::LogRetention",
-   "Properties": {
-    "ServiceToken": {
-     "Fn::GetAtt": [
-      "LogRetentionaae0aa3c5b4d4f87b02d85b201efdd8aFD4BFC8A",
-      "Arn"
-     ]
-    },
-    "LogGroupName": {
-     "Fn::Join": [
-      "",
-      [
-       "/aws/lambda/",
-       {
-        "Ref": "testRootmailSESReceiveopssantahandler9628381A"
-       }
-      ]
-     ]
-    },
-    "RetentionInDays": 3
-   }
-  },
   "testRootmailSESReceiveopssantahandlerOpsSantaFunctionSESPermissionsEAD3AD06": {
    "Type": "AWS::Lambda::Permission",
    "Properties": {
@@ -666,6 +618,14 @@
    "UpdateReplacePolicy": "Delete",
    "DeletionPolicy": "Delete"
   },
+  "rootmailhostedzonedkimverificationrecordsprovideroneventhandlerloggroup0A89A5E2": {
+   "Type": "AWS::Logs::LogGroup",
+   "Properties": {
+    "RetentionInDays": 1
+   },
+   "UpdateReplacePolicy": "Retain",
+   "DeletionPolicy": "Retain"
+  },
   "rootmailhostedzonedkimverificationrecordsprovideroneventhandlerServiceRole83E5B139": {
    "Type": "AWS::IAM::Role",
    "Properties": {
@@ -695,20 +655,6 @@
       ]
      }
     ]
-   },
-   "Metadata": {
-    "cdk_nag": {
-     "rules_to_suppress": [
-      {
-       "reason": "no service role restriction needed",
-       "id": "AwsSolutions-IAM4"
-      },
-      {
-       "reason": "wildcards are ok for the provider as the function has restrictions",
-       "id": "AwsSolutions-IAM5"
-      }
-     ]
-    }
    }
   },
   "rootmailhostedzonedkimverificationrecordsprovideroneventhandlerServiceRoleDefaultPolicy5C0E86C8": {
@@ -734,20 +680,6 @@
       "Ref": "rootmailhostedzonedkimverificationrecordsprovideroneventhandlerServiceRole83E5B139"
      }
     ]
-   },
-   "Metadata": {
-    "cdk_nag": {
-     "rules_to_suppress": [
-      {
-       "reason": "no service role restriction needed",
-       "id": "AwsSolutions-IAM4"
-      },
-      {
-       "reason": "wildcards are ok for the provider as the function has restrictions",
-       "id": "AwsSolutions-IAM5"
-      }
-     ]
-    }
    }
   },
   "rootmailhostedzonedkimverificationrecordsprovideroneventhandlerADD3C0BE": {
@@ -757,73 +689,35 @@
      "S3Bucket": {
       "Fn::Sub": "cdk-hnb659fds-assets-${AWS::AccountId}-${AWS::Region}"
      },
-     "S3Key": "11281c9e2a2b601c3421513ba7c9be4b643b04ba6a934192e52e46def7ab0830.zip"
+     "S3Key": "f75274dd7677b6ef41f29d2dfc2c885b4f4e069d3fb8e67636bd89efd3f0fcad.zip"
     },
     "Handler": "index.handler",
+    "LoggingConfig": {
+     "LogGroup": {
+      "Ref": "rootmailhostedzonedkimverificationrecordsprovideroneventhandlerloggroup0A89A5E2"
+     }
+    },
     "Role": {
      "Fn::GetAtt": [
       "rootmailhostedzonedkimverificationrecordsprovideroneventhandlerServiceRole83E5B139",
       "Arn"
      ]
     },
-    "Runtime": "nodejs18.x",
+    "Runtime": "nodejs24.x",
     "Timeout": 200
    },
    "DependsOn": [
     "rootmailhostedzonedkimverificationrecordsprovideroneventhandlerServiceRoleDefaultPolicy5C0E86C8",
     "rootmailhostedzonedkimverificationrecordsprovideroneventhandlerServiceRole83E5B139"
-   ],
-   "Metadata": {
-    "cdk_nag": {
-     "rules_to_suppress": [
-      {
-       "reason": "no service role restriction needed",
-       "id": "AwsSolutions-IAM4"
-      },
-      {
-       "reason": "wildcards are ok for the provider as the function has restrictions",
-       "id": "AwsSolutions-IAM5"
-      }
-     ]
-    }
-   }
+   ]
   },
-  "rootmailhostedzonedkimverificationrecordsprovideroneventhandlerLogRetentionCA165FC4": {
-   "Type": "Custom::LogRetention",
+  "rootmailhostedzonedkimverificationrecordsproviderhostedzonedkimverificationrecordsproviderloggroupC3BF9C7C": {
+   "Type": "AWS::Logs::LogGroup",
    "Properties": {
-    "ServiceToken": {
-     "Fn::GetAtt": [
-      "LogRetentionaae0aa3c5b4d4f87b02d85b201efdd8aFD4BFC8A",
-      "Arn"
-     ]
-    },
-    "LogGroupName": {
-     "Fn::Join": [
-      "",
-      [
-       "/aws/lambda/",
-       {
-        "Ref": "rootmailhostedzonedkimverificationrecordsprovideroneventhandlerADD3C0BE"
-       }
-      ]
-     ]
-    },
     "RetentionInDays": 1
    },
-   "Metadata": {
-    "cdk_nag": {
-     "rules_to_suppress": [
-      {
-       "reason": "no service role restriction needed",
-       "id": "AwsSolutions-IAM4"
-      },
-      {
-       "reason": "wildcards are ok for the provider as the function has restrictions",
-       "id": "AwsSolutions-IAM5"
-      }
-     ]
-    }
-   }
+   "UpdateReplacePolicy": "Retain",
+   "DeletionPolicy": "Retain"
   },
   "rootmailhostedzonedkimverificationrecordsproviderframeworkonEventServiceRoleA09812EA": {
    "Type": "AWS::IAM::Role",
@@ -854,20 +748,6 @@
       ]
      }
     ]
-   },
-   "Metadata": {
-    "cdk_nag": {
-     "rules_to_suppress": [
-      {
-       "reason": "no service role restriction needed",
-       "id": "AwsSolutions-IAM4"
-      },
-      {
-       "reason": "wildcards are ok for the provider as the function has restrictions",
-       "id": "AwsSolutions-IAM5"
-      }
-     ]
-    }
    }
   },
   "rootmailhostedzonedkimverificationrecordsproviderframeworkonEventServiceRoleDefaultPolicy2775D1BA": {
@@ -900,6 +780,16 @@
          ]
         }
        ]
+      },
+      {
+       "Action": "lambda:GetFunction",
+       "Effect": "Allow",
+       "Resource": {
+        "Fn::GetAtt": [
+         "rootmailhostedzonedkimverificationrecordsprovideroneventhandlerADD3C0BE",
+         "Arn"
+        ]
+       }
       }
      ],
      "Version": "2012-10-17"
@@ -910,20 +800,6 @@
       "Ref": "rootmailhostedzonedkimverificationrecordsproviderframeworkonEventServiceRoleA09812EA"
      }
     ]
-   },
-   "Metadata": {
-    "cdk_nag": {
-     "rules_to_suppress": [
-      {
-       "reason": "no service role restriction needed",
-       "id": "AwsSolutions-IAM4"
-      },
-      {
-       "reason": "wildcards are ok for the provider as the function has restrictions",
-       "id": "AwsSolutions-IAM5"
-      }
-     ]
-    }
    }
   },
   "rootmailhostedzonedkimverificationrecordsproviderframeworkonEvent801E57DE": {
@@ -933,7 +809,7 @@
      "S3Bucket": {
       "Fn::Sub": "cdk-hnb659fds-assets-${AWS::AccountId}-${AWS::Region}"
      },
-     "S3Key": "bdc104ed9cab1b5b6421713c8155f0b753380595356f710400609664d3635eca.zip"
+     "S3Key": "e16ffb3b34af185b8b30c88fdb19faa13b6c42bb38580485c4e84b384ee48b63.zip"
     },
     "Description": "AWS CDK resource provider framework - onEvent (RootmailIntegTestStack/rootmail.hosted-zone-dkim-verification-records-provider/hosted-zone-dkim-verification-records-provider)",
     "Environment": {
@@ -947,80 +823,36 @@
      }
     },
     "Handler": "framework.onEvent",
+    "LoggingConfig": {
+     "ApplicationLogLevel": "FATAL",
+     "LogFormat": "JSON",
+     "LogGroup": {
+      "Ref": "rootmailhostedzonedkimverificationrecordsproviderhostedzonedkimverificationrecordsproviderloggroupC3BF9C7C"
+     }
+    },
     "Role": {
      "Fn::GetAtt": [
       "rootmailhostedzonedkimverificationrecordsproviderframeworkonEventServiceRoleA09812EA",
       "Arn"
      ]
     },
-    "Runtime": {
-     "Fn::FindInMap": [
-      "LatestNodeRuntimeMap",
-      {
-       "Ref": "AWS::Region"
-      },
-      "value"
-     ]
-    },
+    "Runtime": "nodejs24.x",
     "Timeout": 900
    },
    "DependsOn": [
     "rootmailhostedzonedkimverificationrecordsproviderframeworkonEventServiceRoleDefaultPolicy2775D1BA",
     "rootmailhostedzonedkimverificationrecordsproviderframeworkonEventServiceRoleA09812EA"
-   ],
-   "Metadata": {
-    "cdk_nag": {
-     "rules_to_suppress": [
-      {
-       "reason": "no service role restriction needed",
-       "id": "AwsSolutions-IAM4"
-      },
-      {
-       "reason": "wildcards are ok for the provider as the function has restrictions",
-       "id": "AwsSolutions-IAM5"
-      }
-     ]
-    }
-   }
+   ]
   },
-  "rootmailhostedzonedkimverificationrecordsproviderframeworkonEventLogRetention64AEF97C": {
-   "Type": "Custom::LogRetention",
+  "rootmailautowirednsprovideriscompletehandlerloggroupCB90A9F7": {
+   "Type": "AWS::Logs::LogGroup",
    "Properties": {
-    "ServiceToken": {
-     "Fn::GetAtt": [
-      "LogRetentionaae0aa3c5b4d4f87b02d85b201efdd8aFD4BFC8A",
-      "Arn"
-     ]
-    },
-    "LogGroupName": {
-     "Fn::Join": [
-      "",
-      [
-       "/aws/lambda/",
-       {
-        "Ref": "rootmailhostedzonedkimverificationrecordsproviderframeworkonEvent801E57DE"
-       }
-      ]
-     ]
-    },
     "RetentionInDays": 1
    },
-   "Metadata": {
-    "cdk_nag": {
-     "rules_to_suppress": [
-      {
-       "reason": "no service role restriction needed",
-       "id": "AwsSolutions-IAM4"
-      },
-      {
-       "reason": "wildcards are ok for the provider as the function has restrictions",
-       "id": "AwsSolutions-IAM5"
-      }
-     ]
-    }
-   }
+   "UpdateReplacePolicy": "Retain",
+   "DeletionPolicy": "Retain"
   },
-  "LogRetentionaae0aa3c5b4d4f87b02d85b201efdd8aServiceRole9741ECFB": {
+  "rootmailautowirednsprovideriscompletehandlerServiceRole35CABB06": {
    "Type": "AWS::IAM::Role",
    "Properties": {
     "AssumeRolePolicyDocument": {
@@ -1051,63 +883,100 @@
     ]
    }
   },
-  "LogRetentionaae0aa3c5b4d4f87b02d85b201efdd8aServiceRoleDefaultPolicyADDA7DEB": {
+  "rootmailautowirednsprovideriscompletehandlerServiceRoleDefaultPolicy7DA8ECD2": {
    "Type": "AWS::IAM::Policy",
    "Properties": {
     "PolicyDocument": {
      "Statement": [
       {
        "Action": [
-        "logs:DeleteRetentionPolicy",
-        "logs:PutRetentionPolicy"
+        "route53:GetChange",
+        "route53:ListHostedZonesByName"
        ],
        "Effect": "Allow",
        "Resource": "*"
+      },
+      {
+       "Action": [
+        "ssm:DescribeParameters",
+        "ssm:GetParameter",
+        "ssm:GetParameterHistory",
+        "ssm:GetParameters"
+       ],
+       "Effect": "Allow",
+       "Resource": {
+        "Fn::Join": [
+         "",
+         [
+          "arn:",
+          {
+           "Ref": "AWS::Partition"
+          },
+          ":ssm:",
+          {
+           "Ref": "AWS::Region"
+          },
+          ":",
+          {
+           "Ref": "AWS::AccountId"
+          },
+          ":parameter",
+          {
+           "Ref": "testRootmailHostedZoneDkimRootmailAutowireDnsAutoWireR53ChangeInfoId609129D7"
+          }
+         ]
+        ]
+       }
       }
      ],
      "Version": "2012-10-17"
     },
-    "PolicyName": "LogRetentionaae0aa3c5b4d4f87b02d85b201efdd8aServiceRoleDefaultPolicyADDA7DEB",
+    "PolicyName": "rootmailautowirednsprovideriscompletehandlerServiceRoleDefaultPolicy7DA8ECD2",
     "Roles": [
      {
-      "Ref": "LogRetentionaae0aa3c5b4d4f87b02d85b201efdd8aServiceRole9741ECFB"
+      "Ref": "rootmailautowirednsprovideriscompletehandlerServiceRole35CABB06"
      }
     ]
    }
   },
-  "LogRetentionaae0aa3c5b4d4f87b02d85b201efdd8aFD4BFC8A": {
+  "rootmailautowirednsprovideriscompletehandlerBFD3F7F5": {
    "Type": "AWS::Lambda::Function",
    "Properties": {
-    "Handler": "index.handler",
-    "Runtime": {
-     "Fn::FindInMap": [
-      "LatestNodeRuntimeMap",
-      {
-       "Ref": "AWS::Region"
-      },
-      "value"
-     ]
-    },
-    "Timeout": 900,
     "Code": {
      "S3Bucket": {
       "Fn::Sub": "cdk-hnb659fds-assets-${AWS::AccountId}-${AWS::Region}"
      },
-     "S3Key": "2819175352ad1ce0dae768e83fc328fb70fb5f10b4a8ff0ccbcb791f02b0716d.zip"
+     "S3Key": "157ba1713f7224463b621261792d18081588ff306a9bc3f75e6c468fabbe1a60.zip"
+    },
+    "Handler": "index.handler",
+    "LoggingConfig": {
+     "LogGroup": {
+      "Ref": "rootmailautowirednsprovideriscompletehandlerloggroupCB90A9F7"
+     }
     },
     "Role": {
      "Fn::GetAtt": [
-      "LogRetentionaae0aa3c5b4d4f87b02d85b201efdd8aServiceRole9741ECFB",
+      "rootmailautowirednsprovideriscompletehandlerServiceRole35CABB06",
       "Arn"
      ]
-    }
+    },
+    "Runtime": "nodejs24.x",
+    "Timeout": 120
    },
    "DependsOn": [
-    "LogRetentionaae0aa3c5b4d4f87b02d85b201efdd8aServiceRoleDefaultPolicyADDA7DEB",
-    "LogRetentionaae0aa3c5b4d4f87b02d85b201efdd8aServiceRole9741ECFB"
+    "rootmailautowirednsprovideriscompletehandlerServiceRoleDefaultPolicy7DA8ECD2",
+    "rootmailautowirednsprovideriscompletehandlerServiceRole35CABB06"
    ]
   },
-  "rootmailautowirednsprovideriscompletehandlerServiceRole35CABB06": {
+  "rootmailautowirednsprovideroneventhandlerloggroup578EB8FA": {
+   "Type": "AWS::Logs::LogGroup",
+   "Properties": {
+    "RetentionInDays": 1
+   },
+   "UpdateReplacePolicy": "Retain",
+   "DeletionPolicy": "Retain"
+  },
+  "rootmailautowirednsprovideroneventhandlerServiceRole6D9F81B0": {
    "Type": "AWS::IAM::Role",
    "Properties": {
     "AssumeRolePolicyDocument": {
@@ -1136,35 +1005,13 @@
       ]
      }
     ]
-   },
-   "Metadata": {
-    "cdk_nag": {
-     "rules_to_suppress": [
-      {
-       "reason": "no service role restriction needed",
-       "id": "AwsSolutions-IAM4"
-      },
-      {
-       "reason": "wildcards are ok for the provider as the function has restrictions",
-       "id": "AwsSolutions-IAM5"
-      }
-     ]
-    }
    }
   },
-  "rootmailautowirednsprovideriscompletehandlerServiceRoleDefaultPolicy7DA8ECD2": {
+  "rootmailautowirednsprovideroneventhandlerServiceRoleDefaultPolicy4A5BBAB1": {
    "Type": "AWS::IAM::Policy",
    "Properties": {
     "PolicyDocument": {
      "Statement": [
-      {
-       "Action": [
-        "route53:GetChange",
-        "route53:ListHostedZonesByName"
-       ],
-       "Effect": "Allow",
-       "Resource": "*"
-      },
       {
        "Action": [
         "ssm:DescribeParameters",
@@ -1191,189 +1038,7 @@
           },
           ":parameter",
           {
-           "Ref": "testRootmailHostedZoneDkimRootmailAutowireDnsAutoWireR53ChangeInfoId609129D7"
-          }
-         ]
-        ]
-       }
-      }
-     ],
-     "Version": "2012-10-17"
-    },
-    "PolicyName": "rootmailautowirednsprovideriscompletehandlerServiceRoleDefaultPolicy7DA8ECD2",
-    "Roles": [
-     {
-      "Ref": "rootmailautowirednsprovideriscompletehandlerServiceRole35CABB06"
-     }
-    ]
-   },
-   "Metadata": {
-    "cdk_nag": {
-     "rules_to_suppress": [
-      {
-       "reason": "no service role restriction needed",
-       "id": "AwsSolutions-IAM4"
-      },
-      {
-       "reason": "wildcards are ok for the provider as the function has restrictions",
-       "id": "AwsSolutions-IAM5"
-      }
-     ]
-    }
-   }
-  },
-  "rootmailautowirednsprovideriscompletehandlerBFD3F7F5": {
-   "Type": "AWS::Lambda::Function",
-   "Properties": {
-    "Code": {
-     "S3Bucket": {
-      "Fn::Sub": "cdk-hnb659fds-assets-${AWS::AccountId}-${AWS::Region}"
-     },
-     "S3Key": "409d1db869dd0ed635bff94c855031afc92e9ac918a5d09651dd0b5316db1433.zip"
-    },
-    "Handler": "index.handler",
-    "Role": {
-     "Fn::GetAtt": [
-      "rootmailautowirednsprovideriscompletehandlerServiceRole35CABB06",
-      "Arn"
-     ]
-    },
-    "Runtime": "nodejs18.x",
-    "Timeout": 120
-   },
-   "DependsOn": [
-    "rootmailautowirednsprovideriscompletehandlerServiceRoleDefaultPolicy7DA8ECD2",
-    "rootmailautowirednsprovideriscompletehandlerServiceRole35CABB06"
-   ],
-   "Metadata": {
-    "cdk_nag": {
-     "rules_to_suppress": [
-      {
-       "reason": "no service role restriction needed",
-       "id": "AwsSolutions-IAM4"
-      },
-      {
-       "reason": "wildcards are ok for the provider as the function has restrictions",
-       "id": "AwsSolutions-IAM5"
-      }
-     ]
-    }
-   }
-  },
-  "rootmailautowirednsprovideriscompletehandlerLogRetention304C1822": {
-   "Type": "Custom::LogRetention",
-   "Properties": {
-    "ServiceToken": {
-     "Fn::GetAtt": [
-      "LogRetentionaae0aa3c5b4d4f87b02d85b201efdd8aFD4BFC8A",
-      "Arn"
-     ]
-    },
-    "LogGroupName": {
-     "Fn::Join": [
-      "",
-      [
-       "/aws/lambda/",
-       {
-        "Ref": "rootmailautowirednsprovideriscompletehandlerBFD3F7F5"
-       }
-      ]
-     ]
-    },
-    "RetentionInDays": 1
-   },
-   "Metadata": {
-    "cdk_nag": {
-     "rules_to_suppress": [
-      {
-       "reason": "no service role restriction needed",
-       "id": "AwsSolutions-IAM4"
-      },
-      {
-       "reason": "wildcards are ok for the provider as the function has restrictions",
-       "id": "AwsSolutions-IAM5"
-      }
-     ]
-    }
-   }
-  },
-  "rootmailautowirednsprovideroneventhandlerServiceRole6D9F81B0": {
-   "Type": "AWS::IAM::Role",
-   "Properties": {
-    "AssumeRolePolicyDocument": {
-     "Statement": [
-      {
-       "Action": "sts:AssumeRole",
-       "Effect": "Allow",
-       "Principal": {
-        "Service": "lambda.amazonaws.com"
-       }
-      }
-     ],
-     "Version": "2012-10-17"
-    },
-    "ManagedPolicyArns": [
-     {
-      "Fn::Join": [
-       "",
-       [
-        "arn:",
-        {
-         "Ref": "AWS::Partition"
-        },
-        ":iam::aws:policy/service-role/AWSLambdaBasicExecutionRole"
-       ]
-      ]
-     }
-    ]
-   },
-   "Metadata": {
-    "cdk_nag": {
-     "rules_to_suppress": [
-      {
-       "reason": "no service role restriction needed",
-       "id": "AwsSolutions-IAM4"
-      },
-      {
-       "reason": "wildcards are ok for the provider as the function has restrictions",
-       "id": "AwsSolutions-IAM5"
-      }
-     ]
-    }
-   }
-  },
-  "rootmailautowirednsprovideroneventhandlerServiceRoleDefaultPolicy4A5BBAB1": {
-   "Type": "AWS::IAM::Policy",
-   "Properties": {
-    "PolicyDocument": {
-     "Statement": [
-      {
-       "Action": [
-        "ssm:DescribeParameters",
-        "ssm:GetParameter",
-        "ssm:GetParameterHistory",
-        "ssm:GetParameters"
-       ],
-       "Effect": "Allow",
-       "Resource": {
-        "Fn::Join": [
-         "",
-         [
-          "arn:",
-          {
-           "Ref": "AWS::Partition"
-          },
-          ":ssm:",
-          {
-           "Ref": "AWS::Region"
-          },
-          ":",
-          {
-           "Ref": "AWS::AccountId"
-          },
-          ":parameter",
-          {
-           "Ref": "testRootmailHostedZoneSSMParameter574DA41C"
+           "Ref": "testRootmailHostedZoneSSMParameter574DA41C"
           }
          ]
         ]
@@ -1431,20 +1096,6 @@
       "Ref": "rootmailautowirednsprovideroneventhandlerServiceRole6D9F81B0"
      }
     ]
-   },
-   "Metadata": {
-    "cdk_nag": {
-     "rules_to_suppress": [
-      {
-       "reason": "no service role restriction needed",
-       "id": "AwsSolutions-IAM4"
-      },
-      {
-       "reason": "wildcards are ok for the provider as the function has restrictions",
-       "id": "AwsSolutions-IAM5"
-      }
-     ]
-    }
    }
   },
   "rootmailautowirednsprovideroneventhandler2ADE543F": {
@@ -1454,73 +1105,35 @@
      "S3Bucket": {
       "Fn::Sub": "cdk-hnb659fds-assets-${AWS::AccountId}-${AWS::Region}"
      },
-     "S3Key": "aca912f8a6aebc5dfd423aff79785b8fd7488473a4cf93aaa7ad0e442b548787.zip"
+     "S3Key": "4c079063901e6478dbb5ace19e3123641ebf0da2ab648ecf52079c5bec154196.zip"
     },
     "Handler": "index.handler",
+    "LoggingConfig": {
+     "LogGroup": {
+      "Ref": "rootmailautowirednsprovideroneventhandlerloggroup578EB8FA"
+     }
+    },
     "Role": {
      "Fn::GetAtt": [
       "rootmailautowirednsprovideroneventhandlerServiceRole6D9F81B0",
       "Arn"
      ]
     },
-    "Runtime": "nodejs18.x",
+    "Runtime": "nodejs24.x",
     "Timeout": 160
    },
    "DependsOn": [
     "rootmailautowirednsprovideroneventhandlerServiceRoleDefaultPolicy4A5BBAB1",
     "rootmailautowirednsprovideroneventhandlerServiceRole6D9F81B0"
-   ],
-   "Metadata": {
-    "cdk_nag": {
-     "rules_to_suppress": [
-      {
-       "reason": "no service role restriction needed",
-       "id": "AwsSolutions-IAM4"
-      },
-      {
-       "reason": "wildcards are ok for the provider as the function has restrictions",
-       "id": "AwsSolutions-IAM5"
-      }
-     ]
-    }
-   }
+   ]
   },
-  "rootmailautowirednsprovideroneventhandlerLogRetentionA4DB1AD5": {
-   "Type": "Custom::LogRetention",
+  "rootmailautowirednsproviderrootmailautowirednsproviderloggroup8B8FFFCE": {
+   "Type": "AWS::Logs::LogGroup",
    "Properties": {
-    "ServiceToken": {
-     "Fn::GetAtt": [
-      "LogRetentionaae0aa3c5b4d4f87b02d85b201efdd8aFD4BFC8A",
-      "Arn"
-     ]
-    },
-    "LogGroupName": {
-     "Fn::Join": [
-      "",
-      [
-       "/aws/lambda/",
-       {
-        "Ref": "rootmailautowirednsprovideroneventhandler2ADE543F"
-       }
-      ]
-     ]
-    },
     "RetentionInDays": 1
    },
-   "Metadata": {
-    "cdk_nag": {
-     "rules_to_suppress": [
-      {
-       "reason": "no service role restriction needed",
-       "id": "AwsSolutions-IAM4"
-      },
-      {
-       "reason": "wildcards are ok for the provider as the function has restrictions",
-       "id": "AwsSolutions-IAM5"
-      }
-     ]
-    }
-   }
+   "UpdateReplacePolicy": "Retain",
+   "DeletionPolicy": "Retain"
   },
   "rootmailautowirednsproviderrootmailautowirednsproviderframeworkonEventServiceRoleECC96780": {
    "Type": "AWS::IAM::Role",
@@ -1551,20 +1164,6 @@
       ]
      }
     ]
-   },
-   "Metadata": {
-    "cdk_nag": {
-     "rules_to_suppress": [
-      {
-       "reason": "no service role restriction needed",
-       "id": "AwsSolutions-IAM4"
-      },
-      {
-       "reason": "wildcards are ok for the provider as the function has restrictions",
-       "id": "AwsSolutions-IAM5"
-      }
-     ]
-    }
    }
   },
   "rootmailautowirednsproviderrootmailautowirednsproviderframeworkonEventServiceRoleDefaultPolicy16D799D5": {
@@ -1618,6 +1217,24 @@
         }
        ]
       },
+      {
+       "Action": "lambda:GetFunction",
+       "Effect": "Allow",
+       "Resource": [
+        {
+         "Fn::GetAtt": [
+          "rootmailautowirednsprovideriscompletehandlerBFD3F7F5",
+          "Arn"
+         ]
+        },
+        {
+         "Fn::GetAtt": [
+          "rootmailautowirednsprovideroneventhandler2ADE543F",
+          "Arn"
+         ]
+        }
+       ]
+      },
       {
        "Action": "states:StartExecution",
        "Effect": "Allow",
@@ -1634,20 +1251,6 @@
       "Ref": "rootmailautowirednsproviderrootmailautowirednsproviderframeworkonEventServiceRoleECC96780"
      }
     ]
-   },
-   "Metadata": {
-    "cdk_nag": {
-     "rules_to_suppress": [
-      {
-       "reason": "no service role restriction needed",
-       "id": "AwsSolutions-IAM4"
-      },
-      {
-       "reason": "wildcards are ok for the provider as the function has restrictions",
-       "id": "AwsSolutions-IAM5"
-      }
-     ]
-    }
    }
   },
   "rootmailautowirednsproviderrootmailautowirednsproviderframeworkonEventAA9D49B6": {
@@ -1657,7 +1260,7 @@
      "S3Bucket": {
       "Fn::Sub": "cdk-hnb659fds-assets-${AWS::AccountId}-${AWS::Region}"
      },
-     "S3Key": "bdc104ed9cab1b5b6421713c8155f0b753380595356f710400609664d3635eca.zip"
+     "S3Key": "e16ffb3b34af185b8b30c88fdb19faa13b6c42bb38580485c4e84b384ee48b63.zip"
     },
     "Description": "AWS CDK resource provider framework - onEvent (RootmailIntegTestStack/rootmail.autowire-dns-provider/rootmail-autowire-dns-provider)",
     "Environment": {
@@ -1680,78 +1283,26 @@
      }
     },
     "Handler": "framework.onEvent",
+    "LoggingConfig": {
+     "ApplicationLogLevel": "FATAL",
+     "LogFormat": "JSON",
+     "LogGroup": {
+      "Ref": "rootmailautowirednsproviderrootmailautowirednsproviderloggroup8B8FFFCE"
+     }
+    },
     "Role": {
      "Fn::GetAtt": [
       "rootmailautowirednsproviderrootmailautowirednsproviderframeworkonEventServiceRoleECC96780",
       "Arn"
      ]
     },
-    "Runtime": {
-     "Fn::FindInMap": [
-      "LatestNodeRuntimeMap",
-      {
-       "Ref": "AWS::Region"
-      },
-      "value"
-     ]
-    },
+    "Runtime": "nodejs24.x",
     "Timeout": 900
    },
    "DependsOn": [
     "rootmailautowirednsproviderrootmailautowirednsproviderframeworkonEventServiceRoleDefaultPolicy16D799D5",
     "rootmailautowirednsproviderrootmailautowirednsproviderframeworkonEventServiceRoleECC96780"
-   ],
-   "Metadata": {
-    "cdk_nag": {
-     "rules_to_suppress": [
-      {
-       "reason": "no service role restriction needed",
-       "id": "AwsSolutions-IAM4"
-      },
-      {
-       "reason": "wildcards are ok for the provider as the function has restrictions",
-       "id": "AwsSolutions-IAM5"
-      }
-     ]
-    }
-   }
-  },
-  "rootmailautowirednsproviderrootmailautowirednsproviderframeworkonEventLogRetention06222B6A": {
-   "Type": "Custom::LogRetention",
-   "Properties": {
-    "ServiceToken": {
-     "Fn::GetAtt": [
-      "LogRetentionaae0aa3c5b4d4f87b02d85b201efdd8aFD4BFC8A",
-      "Arn"
-     ]
-    },
-    "LogGroupName": {
-     "Fn::Join": [
-      "",
-      [
-       "/aws/lambda/",
-       {
-        "Ref": "rootmailautowirednsproviderrootmailautowirednsproviderframeworkonEventAA9D49B6"
-       }
-      ]
-     ]
-    },
-    "RetentionInDays": 1
-   },
-   "Metadata": {
-    "cdk_nag": {
-     "rules_to_suppress": [
-      {
-       "reason": "no service role restriction needed",
-       "id": "AwsSolutions-IAM4"
-      },
-      {
-       "reason": "wildcards are ok for the provider as the function has restrictions",
-       "id": "AwsSolutions-IAM5"
-      }
-     ]
-    }
-   }
+   ]
   },
   "rootmailautowirednsproviderrootmailautowirednsproviderframeworkisCompleteServiceRoleD15A96AC": {
    "Type": "AWS::IAM::Role",
@@ -1782,20 +1333,6 @@
       ]
      }
     ]
-   },
-   "Metadata": {
-    "cdk_nag": {
-     "rules_to_suppress": [
-      {
-       "reason": "no service role restriction needed",
-       "id": "AwsSolutions-IAM4"
-      },
-      {
-       "reason": "wildcards are ok for the provider as the function has restrictions",
-       "id": "AwsSolutions-IAM5"
-      }
-     ]
-    }
    }
   },
   "rootmailautowirednsproviderrootmailautowirednsproviderframeworkisCompleteServiceRoleDefaultPolicy5728F288": {
@@ -1848,6 +1385,24 @@
          ]
         }
        ]
+      },
+      {
+       "Action": "lambda:GetFunction",
+       "Effect": "Allow",
+       "Resource": [
+        {
+         "Fn::GetAtt": [
+          "rootmailautowirednsprovideriscompletehandlerBFD3F7F5",
+          "Arn"
+         ]
+        },
+        {
+         "Fn::GetAtt": [
+          "rootmailautowirednsprovideroneventhandler2ADE543F",
+          "Arn"
+         ]
+        }
+       ]
       }
      ],
      "Version": "2012-10-17"
@@ -1858,20 +1413,6 @@
       "Ref": "rootmailautowirednsproviderrootmailautowirednsproviderframeworkisCompleteServiceRoleD15A96AC"
      }
     ]
-   },
-   "Metadata": {
-    "cdk_nag": {
-     "rules_to_suppress": [
-      {
-       "reason": "no service role restriction needed",
-       "id": "AwsSolutions-IAM4"
-      },
-      {
-       "reason": "wildcards are ok for the provider as the function has restrictions",
-       "id": "AwsSolutions-IAM5"
-      }
-     ]
-    }
    }
   },
   "rootmailautowirednsproviderrootmailautowirednsproviderframeworkisCompleteC48DABD2": {
@@ -1881,7 +1422,7 @@
      "S3Bucket": {
       "Fn::Sub": "cdk-hnb659fds-assets-${AWS::AccountId}-${AWS::Region}"
      },
-     "S3Key": "bdc104ed9cab1b5b6421713c8155f0b753380595356f710400609664d3635eca.zip"
+     "S3Key": "e16ffb3b34af185b8b30c88fdb19faa13b6c42bb38580485c4e84b384ee48b63.zip"
     },
     "Description": "AWS CDK resource provider framework - isComplete (RootmailIntegTestStack/rootmail.autowire-dns-provider/rootmail-autowire-dns-provider)",
     "Environment": {
@@ -1901,78 +1442,26 @@
      }
     },
     "Handler": "framework.isComplete",
+    "LoggingConfig": {
+     "ApplicationLogLevel": "FATAL",
+     "LogFormat": "JSON",
+     "LogGroup": {
+      "Ref": "rootmailautowirednsproviderrootmailautowirednsproviderloggroup8B8FFFCE"
+     }
+    },
     "Role": {
      "Fn::GetAtt": [
       "rootmailautowirednsproviderrootmailautowirednsproviderframeworkisCompleteServiceRoleD15A96AC",
       "Arn"
      ]
     },
-    "Runtime": {
-     "Fn::FindInMap": [
-      "LatestNodeRuntimeMap",
-      {
-       "Ref": "AWS::Region"
-      },
-      "value"
-     ]
-    },
+    "Runtime": "nodejs24.x",
     "Timeout": 900
    },
    "DependsOn": [
     "rootmailautowirednsproviderrootmailautowirednsproviderframeworkisCompleteServiceRoleDefaultPolicy5728F288",
     "rootmailautowirednsproviderrootmailautowirednsproviderframeworkisCompleteServiceRoleD15A96AC"
-   ],
-   "Metadata": {
-    "cdk_nag": {
-     "rules_to_suppress": [
-      {
-       "reason": "no service role restriction needed",
-       "id": "AwsSolutions-IAM4"
-      },
-      {
-       "reason": "wildcards are ok for the provider as the function has restrictions",
-       "id": "AwsSolutions-IAM5"
-      }
-     ]
-    }
-   }
-  },
-  "rootmailautowirednsproviderrootmailautowirednsproviderframeworkisCompleteLogRetentionB48EA66E": {
-   "Type": "Custom::LogRetention",
-   "Properties": {
-    "ServiceToken": {
-     "Fn::GetAtt": [
-      "LogRetentionaae0aa3c5b4d4f87b02d85b201efdd8aFD4BFC8A",
-      "Arn"
-     ]
-    },
-    "LogGroupName": {
-     "Fn::Join": [
-      "",
-      [
-       "/aws/lambda/",
-       {
-        "Ref": "rootmailautowirednsproviderrootmailautowirednsproviderframeworkisCompleteC48DABD2"
-       }
-      ]
-     ]
-    },
-    "RetentionInDays": 1
-   },
-   "Metadata": {
-    "cdk_nag": {
-     "rules_to_suppress": [
-      {
-       "reason": "no service role restriction needed",
-       "id": "AwsSolutions-IAM4"
-      },
-      {
-       "reason": "wildcards are ok for the provider as the function has restrictions",
-       "id": "AwsSolutions-IAM5"
-      }
-     ]
-    }
-   }
+   ]
   },
   "rootmailautowirednsproviderrootmailautowirednsproviderframeworkonTimeoutServiceRole4383D224": {
    "Type": "AWS::IAM::Role",
@@ -2003,20 +1492,6 @@
       ]
      }
     ]
-   },
-   "Metadata": {
-    "cdk_nag": {
-     "rules_to_suppress": [
-      {
-       "reason": "no service role restriction needed",
-       "id": "AwsSolutions-IAM4"
-      },
-      {
-       "reason": "wildcards are ok for the provider as the function has restrictions",
-       "id": "AwsSolutions-IAM5"
-      }
-     ]
-    }
    }
   },
   "rootmailautowirednsproviderrootmailautowirednsproviderframeworkonTimeoutServiceRoleDefaultPolicy53D3B624": {
@@ -2069,6 +1544,24 @@
          ]
         }
        ]
+      },
+      {
+       "Action": "lambda:GetFunction",
+       "Effect": "Allow",
+       "Resource": [
+        {
+         "Fn::GetAtt": [
+          "rootmailautowirednsprovideriscompletehandlerBFD3F7F5",
+          "Arn"
+         ]
+        },
+        {
+         "Fn::GetAtt": [
+          "rootmailautowirednsprovideroneventhandler2ADE543F",
+          "Arn"
+         ]
+        }
+       ]
       }
      ],
      "Version": "2012-10-17"
@@ -2079,20 +1572,6 @@
       "Ref": "rootmailautowirednsproviderrootmailautowirednsproviderframeworkonTimeoutServiceRole4383D224"
      }
     ]
-   },
-   "Metadata": {
-    "cdk_nag": {
-     "rules_to_suppress": [
-      {
-       "reason": "no service role restriction needed",
-       "id": "AwsSolutions-IAM4"
-      },
-      {
-       "reason": "wildcards are ok for the provider as the function has restrictions",
-       "id": "AwsSolutions-IAM5"
-      }
-     ]
-    }
    }
   },
   "rootmailautowirednsproviderrootmailautowirednsproviderframeworkonTimeoutC714B95F": {
@@ -2102,7 +1581,7 @@
      "S3Bucket": {
       "Fn::Sub": "cdk-hnb659fds-assets-${AWS::AccountId}-${AWS::Region}"
      },
-     "S3Key": "bdc104ed9cab1b5b6421713c8155f0b753380595356f710400609664d3635eca.zip"
+     "S3Key": "e16ffb3b34af185b8b30c88fdb19faa13b6c42bb38580485c4e84b384ee48b63.zip"
     },
     "Description": "AWS CDK resource provider framework - onTimeout (RootmailIntegTestStack/rootmail.autowire-dns-provider/rootmail-autowire-dns-provider)",
     "Environment": {
@@ -2122,78 +1601,26 @@
      }
     },
     "Handler": "framework.onTimeout",
+    "LoggingConfig": {
+     "ApplicationLogLevel": "FATAL",
+     "LogFormat": "JSON",
+     "LogGroup": {
+      "Ref": "rootmailautowirednsproviderrootmailautowirednsproviderloggroup8B8FFFCE"
+     }
+    },
     "Role": {
      "Fn::GetAtt": [
       "rootmailautowirednsproviderrootmailautowirednsproviderframeworkonTimeoutServiceRole4383D224",
       "Arn"
      ]
     },
-    "Runtime": {
-     "Fn::FindInMap": [
-      "LatestNodeRuntimeMap",
-      {
-       "Ref": "AWS::Region"
-      },
-      "value"
-     ]
-    },
+    "Runtime": "nodejs24.x",
     "Timeout": 900
    },
    "DependsOn": [
     "rootmailautowirednsproviderrootmailautowirednsproviderframeworkonTimeoutServiceRoleDefaultPolicy53D3B624",
     "rootmailautowirednsproviderrootmailautowirednsproviderframeworkonTimeoutServiceRole4383D224"
-   ],
-   "Metadata": {
-    "cdk_nag": {
-     "rules_to_suppress": [
-      {
-       "reason": "no service role restriction needed",
-       "id": "AwsSolutions-IAM4"
-      },
-      {
-       "reason": "wildcards are ok for the provider as the function has restrictions",
-       "id": "AwsSolutions-IAM5"
-      }
-     ]
-    }
-   }
-  },
-  "rootmailautowirednsproviderrootmailautowirednsproviderframeworkonTimeoutLogRetention59C14E50": {
-   "Type": "Custom::LogRetention",
-   "Properties": {
-    "ServiceToken": {
-     "Fn::GetAtt": [
-      "LogRetentionaae0aa3c5b4d4f87b02d85b201efdd8aFD4BFC8A",
-      "Arn"
-     ]
-    },
-    "LogGroupName": {
-     "Fn::Join": [
-      "",
-      [
-       "/aws/lambda/",
-       {
-        "Ref": "rootmailautowirednsproviderrootmailautowirednsproviderframeworkonTimeoutC714B95F"
-       }
-      ]
-     ]
-    },
-    "RetentionInDays": 1
-   },
-   "Metadata": {
-    "cdk_nag": {
-     "rules_to_suppress": [
-      {
-       "reason": "no service role restriction needed",
-       "id": "AwsSolutions-IAM4"
-      },
-      {
-       "reason": "wildcards are ok for the provider as the function has restrictions",
-       "id": "AwsSolutions-IAM5"
-      }
-     ]
-    }
-   }
+   ]
   },
   "rootmailautowirednsproviderrootmailautowirednsproviderwaiterstatemachineRole258A7061": {
    "Type": "AWS::IAM::Role",
@@ -2210,20 +1637,6 @@
      ],
      "Version": "2012-10-17"
     }
-   },
-   "Metadata": {
-    "cdk_nag": {
-     "rules_to_suppress": [
-      {
-       "reason": "no service role restriction needed",
-       "id": "AwsSolutions-IAM4"
-      },
-      {
-       "reason": "wildcards are ok for the provider as the function has restrictions",
-       "id": "AwsSolutions-IAM5"
-      }
-     ]
-    }
    }
   },
   "rootmailautowirednsproviderrootmailautowirednsproviderwaiterstatemachineRoleDefaultPolicy310226B4": {
@@ -2276,22 +1689,6 @@
          ]
         }
        ]
-      },
-      {
-       "Action": [
-        "logs:CreateLogDelivery",
-        "logs:CreateLogStream",
-        "logs:DeleteLogDelivery",
-        "logs:DescribeLogGroups",
-        "logs:DescribeResourcePolicies",
-        "logs:GetLogDelivery",
-        "logs:ListLogDeliveries",
-        "logs:PutLogEvents",
-        "logs:PutResourcePolicy",
-        "logs:UpdateLogDelivery"
-       ],
-       "Effect": "Allow",
-       "Resource": "*"
       }
      ],
      "Version": "2012-10-17"
@@ -2302,54 +1699,6 @@
       "Ref": "rootmailautowirednsproviderrootmailautowirednsproviderwaiterstatemachineRole258A7061"
      }
     ]
-   },
-   "Metadata": {
-    "cdk_nag": {
-     "rules_to_suppress": [
-      {
-       "reason": "no service role restriction needed",
-       "id": "AwsSolutions-IAM4"
-      },
-      {
-       "reason": "wildcards are ok for the provider as the function has restrictions",
-       "id": "AwsSolutions-IAM5"
-      }
-     ]
-    }
-   }
-  },
-  "rootmailautowirednsproviderrootmailautowirednsproviderwaiterstatemachineLogGroup8F234E2E": {
-   "Type": "AWS::Logs::LogGroup",
-   "Properties": {
-    "LogGroupName": {
-     "Fn::Join": [
-      "",
-      [
-       "/aws/vendedlogs/states/waiter-state-machine-",
-       {
-        "Ref": "rootmailautowirednsproviderrootmailautowirednsproviderframeworkisCompleteC48DABD2"
-       },
-       "-c87dd05ebab293a9aee46077d679d140dd7cde1383"
-      ]
-     ]
-    },
-    "RetentionInDays": 731
-   },
-   "UpdateReplacePolicy": "Retain",
-   "DeletionPolicy": "Retain",
-   "Metadata": {
-    "cdk_nag": {
-     "rules_to_suppress": [
-      {
-       "reason": "no service role restriction needed",
-       "id": "AwsSolutions-IAM4"
-      },
-      {
-       "reason": "wildcards are ok for the provider as the function has restrictions",
-       "id": "AwsSolutions-IAM5"
-      }
-     ]
-    }
    }
   },
   "rootmailautowirednsproviderrootmailautowirednsproviderwaiterstatemachine81102355": {
@@ -2377,22 +1726,6 @@
       ]
      ]
     },
-    "LoggingConfiguration": {
-     "Destinations": [
-      {
-       "CloudWatchLogsLogGroup": {
-        "LogGroupArn": {
-         "Fn::GetAtt": [
-          "rootmailautowirednsproviderrootmailautowirednsproviderwaiterstatemachineLogGroup8F234E2E",
-          "Arn"
-         ]
-        }
-       }
-      }
-     ],
-     "IncludeExecutionData": false,
-     "Level": "ERROR"
-    },
     "RoleArn": {
      "Fn::GetAtt": [
       "rootmailautowirednsproviderrootmailautowirednsproviderwaiterstatemachineRole258A7061",
@@ -2403,21 +1736,15 @@
    "DependsOn": [
     "rootmailautowirednsproviderrootmailautowirednsproviderwaiterstatemachineRoleDefaultPolicy310226B4",
     "rootmailautowirednsproviderrootmailautowirednsproviderwaiterstatemachineRole258A7061"
-   ],
-   "Metadata": {
-    "cdk_nag": {
-     "rules_to_suppress": [
-      {
-       "reason": "no service role restriction needed",
-       "id": "AwsSolutions-IAM4"
-      },
-      {
-       "reason": "wildcards are ok for the provider as the function has restrictions",
-       "id": "AwsSolutions-IAM5"
-      }
-     ]
-    }
-   }
+   ]
+  },
+  "rootmailhostedzonedkimpropagationprovideriscompletehandlerloggroup9B435FA9": {
+   "Type": "AWS::Logs::LogGroup",
+   "Properties": {
+    "RetentionInDays": 1
+   },
+   "UpdateReplacePolicy": "Retain",
+   "DeletionPolicy": "Retain"
   },
   "rootmailhostedzonedkimpropagationprovideriscompletehandlerServiceRoleDFD2C35E": {
    "Type": "AWS::IAM::Role",
@@ -2448,20 +1775,6 @@
       ]
      }
     ]
-   },
-   "Metadata": {
-    "cdk_nag": {
-     "rules_to_suppress": [
-      {
-       "reason": "no service role restriction needed",
-       "id": "AwsSolutions-IAM4"
-      },
-      {
-       "reason": "wildcards are ok for the provider as the function has restrictions",
-       "id": "AwsSolutions-IAM5"
-      }
-     ]
-    }
    }
   },
   "rootmailhostedzonedkimpropagationprovideriscompletehandlerServiceRoleDefaultPolicy57D46916": {
@@ -2488,20 +1801,6 @@
       "Ref": "rootmailhostedzonedkimpropagationprovideriscompletehandlerServiceRoleDFD2C35E"
      }
     ]
-   },
-   "Metadata": {
-    "cdk_nag": {
-     "rules_to_suppress": [
-      {
-       "reason": "no service role restriction needed",
-       "id": "AwsSolutions-IAM4"
-      },
-      {
-       "reason": "wildcards are ok for the provider as the function has restrictions",
-       "id": "AwsSolutions-IAM5"
-      }
-     ]
-    }
    }
   },
   "rootmailhostedzonedkimpropagationprovideriscompletehandlerB67C8E91": {
@@ -2511,73 +1810,35 @@
      "S3Bucket": {
       "Fn::Sub": "cdk-hnb659fds-assets-${AWS::AccountId}-${AWS::Region}"
      },
-     "S3Key": "f61472ea141af20f69ebb7a7718158fcb95d72410c0c2a2e72cc59b1822873fc.zip"
+     "S3Key": "7e8a681794eff5fda1841caa360113df5488ecf944055a69b8f1e5a687e269f5.zip"
     },
     "Handler": "index.handler",
+    "LoggingConfig": {
+     "LogGroup": {
+      "Ref": "rootmailhostedzonedkimpropagationprovideriscompletehandlerloggroup9B435FA9"
+     }
+    },
     "Role": {
      "Fn::GetAtt": [
       "rootmailhostedzonedkimpropagationprovideriscompletehandlerServiceRoleDFD2C35E",
       "Arn"
      ]
     },
-    "Runtime": "nodejs18.x",
+    "Runtime": "nodejs24.x",
     "Timeout": 30
    },
    "DependsOn": [
     "rootmailhostedzonedkimpropagationprovideriscompletehandlerServiceRoleDefaultPolicy57D46916",
     "rootmailhostedzonedkimpropagationprovideriscompletehandlerServiceRoleDFD2C35E"
-   ],
-   "Metadata": {
-    "cdk_nag": {
-     "rules_to_suppress": [
-      {
-       "reason": "no service role restriction needed",
-       "id": "AwsSolutions-IAM4"
-      },
-      {
-       "reason": "wildcards are ok for the provider as the function has restrictions",
-       "id": "AwsSolutions-IAM5"
-      }
-     ]
-    }
-   }
+   ]
   },
-  "rootmailhostedzonedkimpropagationprovideriscompletehandlerLogRetentionA997105A": {
-   "Type": "Custom::LogRetention",
+  "rootmailhostedzonedkimpropagationprovideroneventhandlerloggroupB2F904C5": {
+   "Type": "AWS::Logs::LogGroup",
    "Properties": {
-    "ServiceToken": {
-     "Fn::GetAtt": [
-      "LogRetentionaae0aa3c5b4d4f87b02d85b201efdd8aFD4BFC8A",
-      "Arn"
-     ]
-    },
-    "LogGroupName": {
-     "Fn::Join": [
-      "",
-      [
-       "/aws/lambda/",
-       {
-        "Ref": "rootmailhostedzonedkimpropagationprovideriscompletehandlerB67C8E91"
-       }
-      ]
-     ]
-    },
     "RetentionInDays": 1
    },
-   "Metadata": {
-    "cdk_nag": {
-     "rules_to_suppress": [
-      {
-       "reason": "no service role restriction needed",
-       "id": "AwsSolutions-IAM4"
-      },
-      {
-       "reason": "wildcards are ok for the provider as the function has restrictions",
-       "id": "AwsSolutions-IAM5"
-      }
-     ]
-    }
-   }
+   "UpdateReplacePolicy": "Retain",
+   "DeletionPolicy": "Retain"
   },
   "rootmailhostedzonedkimpropagationprovideroneventhandlerServiceRole02FD73CE": {
    "Type": "AWS::IAM::Role",
@@ -2604,24 +1865,10 @@
          "Ref": "AWS::Partition"
         },
         ":iam::aws:policy/service-role/AWSLambdaBasicExecutionRole"
-       ]
-      ]
-     }
-    ]
-   },
-   "Metadata": {
-    "cdk_nag": {
-     "rules_to_suppress": [
-      {
-       "reason": "no service role restriction needed",
-       "id": "AwsSolutions-IAM4"
-      },
-      {
-       "reason": "wildcards are ok for the provider as the function has restrictions",
-       "id": "AwsSolutions-IAM5"
-      }
-     ]
-    }
+       ]
+      ]
+     }
+    ]
    }
   },
   "rootmailhostedzonedkimpropagationprovideroneventhandlerC59BDC16": {
@@ -2631,72 +1878,34 @@
      "S3Bucket": {
       "Fn::Sub": "cdk-hnb659fds-assets-${AWS::AccountId}-${AWS::Region}"
      },
-     "S3Key": "11768574bbd12c5ed10f463a68797423c366b61535ebc1b14951661b92657fa5.zip"
+     "S3Key": "9572b451243318765beb576ae7528096b3879783dbaab795c02c01d7f4e83438.zip"
     },
     "Handler": "index.handler",
+    "LoggingConfig": {
+     "LogGroup": {
+      "Ref": "rootmailhostedzonedkimpropagationprovideroneventhandlerloggroupB2F904C5"
+     }
+    },
     "Role": {
      "Fn::GetAtt": [
       "rootmailhostedzonedkimpropagationprovideroneventhandlerServiceRole02FD73CE",
       "Arn"
      ]
     },
-    "Runtime": "nodejs18.x",
+    "Runtime": "nodejs24.x",
     "Timeout": 10
    },
    "DependsOn": [
     "rootmailhostedzonedkimpropagationprovideroneventhandlerServiceRole02FD73CE"
-   ],
-   "Metadata": {
-    "cdk_nag": {
-     "rules_to_suppress": [
-      {
-       "reason": "no service role restriction needed",
-       "id": "AwsSolutions-IAM4"
-      },
-      {
-       "reason": "wildcards are ok for the provider as the function has restrictions",
-       "id": "AwsSolutions-IAM5"
-      }
-     ]
-    }
-   }
+   ]
   },
-  "rootmailhostedzonedkimpropagationprovideroneventhandlerLogRetentionD97E8A18": {
-   "Type": "Custom::LogRetention",
+  "rootmailhostedzonedkimpropagationproviderhostedzonedkimpropagationproviderloggroupFE0FB1AC": {
+   "Type": "AWS::Logs::LogGroup",
    "Properties": {
-    "ServiceToken": {
-     "Fn::GetAtt": [
-      "LogRetentionaae0aa3c5b4d4f87b02d85b201efdd8aFD4BFC8A",
-      "Arn"
-     ]
-    },
-    "LogGroupName": {
-     "Fn::Join": [
-      "",
-      [
-       "/aws/lambda/",
-       {
-        "Ref": "rootmailhostedzonedkimpropagationprovideroneventhandlerC59BDC16"
-       }
-      ]
-     ]
-    },
     "RetentionInDays": 1
    },
-   "Metadata": {
-    "cdk_nag": {
-     "rules_to_suppress": [
-      {
-       "reason": "no service role restriction needed",
-       "id": "AwsSolutions-IAM4"
-      },
-      {
-       "reason": "wildcards are ok for the provider as the function has restrictions",
-       "id": "AwsSolutions-IAM5"
-      }
-     ]
-    }
-   }
+   "UpdateReplacePolicy": "Retain",
+   "DeletionPolicy": "Retain"
   },
   "rootmailhostedzonedkimpropagationproviderframeworkonEventServiceRole5729BE95": {
    "Type": "AWS::IAM::Role",
@@ -2727,20 +1936,6 @@
       ]
      }
     ]
-   },
-   "Metadata": {
-    "cdk_nag": {
-     "rules_to_suppress": [
-      {
-       "reason": "no service role restriction needed",
-       "id": "AwsSolutions-IAM4"
-      },
-      {
-       "reason": "wildcards are ok for the provider as the function has restrictions",
-       "id": "AwsSolutions-IAM5"
-      }
-     ]
-    }
    }
   },
   "rootmailhostedzonedkimpropagationproviderframeworkonEventServiceRoleDefaultPolicy68675555": {
@@ -2794,6 +1989,24 @@
         }
        ]
       },
+      {
+       "Action": "lambda:GetFunction",
+       "Effect": "Allow",
+       "Resource": [
+        {
+         "Fn::GetAtt": [
+          "rootmailhostedzonedkimpropagationprovideriscompletehandlerB67C8E91",
+          "Arn"
+         ]
+        },
+        {
+         "Fn::GetAtt": [
+          "rootmailhostedzonedkimpropagationprovideroneventhandlerC59BDC16",
+          "Arn"
+         ]
+        }
+       ]
+      },
       {
        "Action": "states:StartExecution",
        "Effect": "Allow",
@@ -2810,20 +2023,6 @@
       "Ref": "rootmailhostedzonedkimpropagationproviderframeworkonEventServiceRole5729BE95"
      }
     ]
-   },
-   "Metadata": {
-    "cdk_nag": {
-     "rules_to_suppress": [
-      {
-       "reason": "no service role restriction needed",
-       "id": "AwsSolutions-IAM4"
-      },
-      {
-       "reason": "wildcards are ok for the provider as the function has restrictions",
-       "id": "AwsSolutions-IAM5"
-      }
-     ]
-    }
    }
   },
   "rootmailhostedzonedkimpropagationproviderframeworkonEvent15357119": {
@@ -2833,7 +2032,7 @@
      "S3Bucket": {
       "Fn::Sub": "cdk-hnb659fds-assets-${AWS::AccountId}-${AWS::Region}"
      },
-     "S3Key": "bdc104ed9cab1b5b6421713c8155f0b753380595356f710400609664d3635eca.zip"
+     "S3Key": "e16ffb3b34af185b8b30c88fdb19faa13b6c42bb38580485c4e84b384ee48b63.zip"
     },
     "Description": "AWS CDK resource provider framework - onEvent (RootmailIntegTestStack/rootmail.hosted-zone-dkim-propagation-provider/hosted-zone-dkim-propagation-provider)",
     "Environment": {
@@ -2856,78 +2055,26 @@
      }
     },
     "Handler": "framework.onEvent",
+    "LoggingConfig": {
+     "ApplicationLogLevel": "FATAL",
+     "LogFormat": "JSON",
+     "LogGroup": {
+      "Ref": "rootmailhostedzonedkimpropagationproviderhostedzonedkimpropagationproviderloggroupFE0FB1AC"
+     }
+    },
     "Role": {
      "Fn::GetAtt": [
       "rootmailhostedzonedkimpropagationproviderframeworkonEventServiceRole5729BE95",
       "Arn"
      ]
     },
-    "Runtime": {
-     "Fn::FindInMap": [
-      "LatestNodeRuntimeMap",
-      {
-       "Ref": "AWS::Region"
-      },
-      "value"
-     ]
-    },
+    "Runtime": "nodejs24.x",
     "Timeout": 900
    },
    "DependsOn": [
     "rootmailhostedzonedkimpropagationproviderframeworkonEventServiceRoleDefaultPolicy68675555",
     "rootmailhostedzonedkimpropagationproviderframeworkonEventServiceRole5729BE95"
-   ],
-   "Metadata": {
-    "cdk_nag": {
-     "rules_to_suppress": [
-      {
-       "reason": "no service role restriction needed",
-       "id": "AwsSolutions-IAM4"
-      },
-      {
-       "reason": "wildcards are ok for the provider as the function has restrictions",
-       "id": "AwsSolutions-IAM5"
-      }
-     ]
-    }
-   }
-  },
-  "rootmailhostedzonedkimpropagationproviderframeworkonEventLogRetention39EDE52F": {
-   "Type": "Custom::LogRetention",
-   "Properties": {
-    "ServiceToken": {
-     "Fn::GetAtt": [
-      "LogRetentionaae0aa3c5b4d4f87b02d85b201efdd8aFD4BFC8A",
-      "Arn"
-     ]
-    },
-    "LogGroupName": {
-     "Fn::Join": [
-      "",
-      [
-       "/aws/lambda/",
-       {
-        "Ref": "rootmailhostedzonedkimpropagationproviderframeworkonEvent15357119"
-       }
-      ]
-     ]
-    },
-    "RetentionInDays": 1
-   },
-   "Metadata": {
-    "cdk_nag": {
-     "rules_to_suppress": [
-      {
-       "reason": "no service role restriction needed",
-       "id": "AwsSolutions-IAM4"
-      },
-      {
-       "reason": "wildcards are ok for the provider as the function has restrictions",
-       "id": "AwsSolutions-IAM5"
-      }
-     ]
-    }
-   }
+   ]
   },
   "rootmailhostedzonedkimpropagationproviderframeworkisCompleteServiceRole9BABA5E5": {
    "Type": "AWS::IAM::Role",
@@ -2958,20 +2105,6 @@
       ]
      }
     ]
-   },
-   "Metadata": {
-    "cdk_nag": {
-     "rules_to_suppress": [
-      {
-       "reason": "no service role restriction needed",
-       "id": "AwsSolutions-IAM4"
-      },
-      {
-       "reason": "wildcards are ok for the provider as the function has restrictions",
-       "id": "AwsSolutions-IAM5"
-      }
-     ]
-    }
    }
   },
   "rootmailhostedzonedkimpropagationproviderframeworkisCompleteServiceRoleDefaultPolicy02D0AEA6": {
@@ -3024,6 +2157,24 @@
          ]
         }
        ]
+      },
+      {
+       "Action": "lambda:GetFunction",
+       "Effect": "Allow",
+       "Resource": [
+        {
+         "Fn::GetAtt": [
+          "rootmailhostedzonedkimpropagationprovideriscompletehandlerB67C8E91",
+          "Arn"
+         ]
+        },
+        {
+         "Fn::GetAtt": [
+          "rootmailhostedzonedkimpropagationprovideroneventhandlerC59BDC16",
+          "Arn"
+         ]
+        }
+       ]
       }
      ],
      "Version": "2012-10-17"
@@ -3034,20 +2185,6 @@
       "Ref": "rootmailhostedzonedkimpropagationproviderframeworkisCompleteServiceRole9BABA5E5"
      }
     ]
-   },
-   "Metadata": {
-    "cdk_nag": {
-     "rules_to_suppress": [
-      {
-       "reason": "no service role restriction needed",
-       "id": "AwsSolutions-IAM4"
-      },
-      {
-       "reason": "wildcards are ok for the provider as the function has restrictions",
-       "id": "AwsSolutions-IAM5"
-      }
-     ]
-    }
    }
   },
   "rootmailhostedzonedkimpropagationproviderframeworkisComplete165FE163": {
@@ -3057,7 +2194,7 @@
      "S3Bucket": {
       "Fn::Sub": "cdk-hnb659fds-assets-${AWS::AccountId}-${AWS::Region}"
      },
-     "S3Key": "bdc104ed9cab1b5b6421713c8155f0b753380595356f710400609664d3635eca.zip"
+     "S3Key": "e16ffb3b34af185b8b30c88fdb19faa13b6c42bb38580485c4e84b384ee48b63.zip"
     },
     "Description": "AWS CDK resource provider framework - isComplete (RootmailIntegTestStack/rootmail.hosted-zone-dkim-propagation-provider/hosted-zone-dkim-propagation-provider)",
     "Environment": {
@@ -3077,78 +2214,26 @@
      }
     },
     "Handler": "framework.isComplete",
+    "LoggingConfig": {
+     "ApplicationLogLevel": "FATAL",
+     "LogFormat": "JSON",
+     "LogGroup": {
+      "Ref": "rootmailhostedzonedkimpropagationproviderhostedzonedkimpropagationproviderloggroupFE0FB1AC"
+     }
+    },
     "Role": {
      "Fn::GetAtt": [
       "rootmailhostedzonedkimpropagationproviderframeworkisCompleteServiceRole9BABA5E5",
       "Arn"
      ]
     },
-    "Runtime": {
-     "Fn::FindInMap": [
-      "LatestNodeRuntimeMap",
-      {
-       "Ref": "AWS::Region"
-      },
-      "value"
-     ]
-    },
+    "Runtime": "nodejs24.x",
     "Timeout": 900
    },
    "DependsOn": [
     "rootmailhostedzonedkimpropagationproviderframeworkisCompleteServiceRoleDefaultPolicy02D0AEA6",
     "rootmailhostedzonedkimpropagationproviderframeworkisCompleteServiceRole9BABA5E5"
-   ],
-   "Metadata": {
-    "cdk_nag": {
-     "rules_to_suppress": [
-      {
-       "reason": "no service role restriction needed",
-       "id": "AwsSolutions-IAM4"
-      },
-      {
-       "reason": "wildcards are ok for the provider as the function has restrictions",
-       "id": "AwsSolutions-IAM5"
-      }
-     ]
-    }
-   }
-  },
-  "rootmailhostedzonedkimpropagationproviderframeworkisCompleteLogRetentionF6AB8959": {
-   "Type": "Custom::LogRetention",
-   "Properties": {
-    "ServiceToken": {
-     "Fn::GetAtt": [
-      "LogRetentionaae0aa3c5b4d4f87b02d85b201efdd8aFD4BFC8A",
-      "Arn"
-     ]
-    },
-    "LogGroupName": {
-     "Fn::Join": [
-      "",
-      [
-       "/aws/lambda/",
-       {
-        "Ref": "rootmailhostedzonedkimpropagationproviderframeworkisComplete165FE163"
-       }
-      ]
-     ]
-    },
-    "RetentionInDays": 1
-   },
-   "Metadata": {
-    "cdk_nag": {
-     "rules_to_suppress": [
-      {
-       "reason": "no service role restriction needed",
-       "id": "AwsSolutions-IAM4"
-      },
-      {
-       "reason": "wildcards are ok for the provider as the function has restrictions",
-       "id": "AwsSolutions-IAM5"
-      }
-     ]
-    }
-   }
+   ]
   },
   "rootmailhostedzonedkimpropagationproviderframeworkonTimeoutServiceRoleB169BF13": {
    "Type": "AWS::IAM::Role",
@@ -3179,20 +2264,6 @@
       ]
      }
     ]
-   },
-   "Metadata": {
-    "cdk_nag": {
-     "rules_to_suppress": [
-      {
-       "reason": "no service role restriction needed",
-       "id": "AwsSolutions-IAM4"
-      },
-      {
-       "reason": "wildcards are ok for the provider as the function has restrictions",
-       "id": "AwsSolutions-IAM5"
-      }
-     ]
-    }
    }
   },
   "rootmailhostedzonedkimpropagationproviderframeworkonTimeoutServiceRoleDefaultPolicy2FF6168E": {
@@ -3245,6 +2316,24 @@
          ]
         }
        ]
+      },
+      {
+       "Action": "lambda:GetFunction",
+       "Effect": "Allow",
+       "Resource": [
+        {
+         "Fn::GetAtt": [
+          "rootmailhostedzonedkimpropagationprovideriscompletehandlerB67C8E91",
+          "Arn"
+         ]
+        },
+        {
+         "Fn::GetAtt": [
+          "rootmailhostedzonedkimpropagationprovideroneventhandlerC59BDC16",
+          "Arn"
+         ]
+        }
+       ]
       }
      ],
      "Version": "2012-10-17"
@@ -3255,20 +2344,6 @@
       "Ref": "rootmailhostedzonedkimpropagationproviderframeworkonTimeoutServiceRoleB169BF13"
      }
     ]
-   },
-   "Metadata": {
-    "cdk_nag": {
-     "rules_to_suppress": [
-      {
-       "reason": "no service role restriction needed",
-       "id": "AwsSolutions-IAM4"
-      },
-      {
-       "reason": "wildcards are ok for the provider as the function has restrictions",
-       "id": "AwsSolutions-IAM5"
-      }
-     ]
-    }
    }
   },
   "rootmailhostedzonedkimpropagationproviderframeworkonTimeout7D8A73CD": {
@@ -3278,7 +2353,7 @@
      "S3Bucket": {
       "Fn::Sub": "cdk-hnb659fds-assets-${AWS::AccountId}-${AWS::Region}"
      },
-     "S3Key": "bdc104ed9cab1b5b6421713c8155f0b753380595356f710400609664d3635eca.zip"
+     "S3Key": "e16ffb3b34af185b8b30c88fdb19faa13b6c42bb38580485c4e84b384ee48b63.zip"
     },
     "Description": "AWS CDK resource provider framework - onTimeout (RootmailIntegTestStack/rootmail.hosted-zone-dkim-propagation-provider/hosted-zone-dkim-propagation-provider)",
     "Environment": {
@@ -3298,78 +2373,26 @@
      }
     },
     "Handler": "framework.onTimeout",
+    "LoggingConfig": {
+     "ApplicationLogLevel": "FATAL",
+     "LogFormat": "JSON",
+     "LogGroup": {
+      "Ref": "rootmailhostedzonedkimpropagationproviderhostedzonedkimpropagationproviderloggroupFE0FB1AC"
+     }
+    },
     "Role": {
      "Fn::GetAtt": [
       "rootmailhostedzonedkimpropagationproviderframeworkonTimeoutServiceRoleB169BF13",
       "Arn"
      ]
     },
-    "Runtime": {
-     "Fn::FindInMap": [
-      "LatestNodeRuntimeMap",
-      {
-       "Ref": "AWS::Region"
-      },
-      "value"
-     ]
-    },
+    "Runtime": "nodejs24.x",
     "Timeout": 900
    },
    "DependsOn": [
     "rootmailhostedzonedkimpropagationproviderframeworkonTimeoutServiceRoleDefaultPolicy2FF6168E",
     "rootmailhostedzonedkimpropagationproviderframeworkonTimeoutServiceRoleB169BF13"
-   ],
-   "Metadata": {
-    "cdk_nag": {
-     "rules_to_suppress": [
-      {
-       "reason": "no service role restriction needed",
-       "id": "AwsSolutions-IAM4"
-      },
-      {
-       "reason": "wildcards are ok for the provider as the function has restrictions",
-       "id": "AwsSolutions-IAM5"
-      }
-     ]
-    }
-   }
-  },
-  "rootmailhostedzonedkimpropagationproviderframeworkonTimeoutLogRetentionB2967E04": {
-   "Type": "Custom::LogRetention",
-   "Properties": {
-    "ServiceToken": {
-     "Fn::GetAtt": [
-      "LogRetentionaae0aa3c5b4d4f87b02d85b201efdd8aFD4BFC8A",
-      "Arn"
-     ]
-    },
-    "LogGroupName": {
-     "Fn::Join": [
-      "",
-      [
-       "/aws/lambda/",
-       {
-        "Ref": "rootmailhostedzonedkimpropagationproviderframeworkonTimeout7D8A73CD"
-       }
-      ]
-     ]
-    },
-    "RetentionInDays": 1
-   },
-   "Metadata": {
-    "cdk_nag": {
-     "rules_to_suppress": [
-      {
-       "reason": "no service role restriction needed",
-       "id": "AwsSolutions-IAM4"
-      },
-      {
-       "reason": "wildcards are ok for the provider as the function has restrictions",
-       "id": "AwsSolutions-IAM5"
-      }
-     ]
-    }
-   }
+   ]
   },
   "rootmailhostedzonedkimpropagationproviderwaiterstatemachineRole40906579": {
    "Type": "AWS::IAM::Role",
@@ -3380,25 +2403,11 @@
        "Action": "sts:AssumeRole",
        "Effect": "Allow",
        "Principal": {
-        "Service": "states.amazonaws.com"
-       }
-      }
-     ],
-     "Version": "2012-10-17"
-    }
-   },
-   "Metadata": {
-    "cdk_nag": {
-     "rules_to_suppress": [
-      {
-       "reason": "no service role restriction needed",
-       "id": "AwsSolutions-IAM4"
-      },
-      {
-       "reason": "wildcards are ok for the provider as the function has restrictions",
-       "id": "AwsSolutions-IAM5"
+        "Service": "states.amazonaws.com"
+       }
       }
-     ]
+     ],
+     "Version": "2012-10-17"
     }
    }
   },
@@ -3452,22 +2461,6 @@
          ]
         }
        ]
-      },
-      {
-       "Action": [
-        "logs:CreateLogDelivery",
-        "logs:CreateLogStream",
-        "logs:DeleteLogDelivery",
-        "logs:DescribeLogGroups",
-        "logs:DescribeResourcePolicies",
-        "logs:GetLogDelivery",
-        "logs:ListLogDeliveries",
-        "logs:PutLogEvents",
-        "logs:PutResourcePolicy",
-        "logs:UpdateLogDelivery"
-       ],
-       "Effect": "Allow",
-       "Resource": "*"
       }
      ],
      "Version": "2012-10-17"
@@ -3478,54 +2471,6 @@
       "Ref": "rootmailhostedzonedkimpropagationproviderwaiterstatemachineRole40906579"
      }
     ]
-   },
-   "Metadata": {
-    "cdk_nag": {
-     "rules_to_suppress": [
-      {
-       "reason": "no service role restriction needed",
-       "id": "AwsSolutions-IAM4"
-      },
-      {
-       "reason": "wildcards are ok for the provider as the function has restrictions",
-       "id": "AwsSolutions-IAM5"
-      }
-     ]
-    }
-   }
-  },
-  "rootmailhostedzonedkimpropagationproviderwaiterstatemachineLogGroup9CDB772B": {
-   "Type": "AWS::Logs::LogGroup",
-   "Properties": {
-    "LogGroupName": {
-     "Fn::Join": [
-      "",
-      [
-       "/aws/vendedlogs/states/waiter-state-machine-",
-       {
-        "Ref": "rootmailhostedzonedkimpropagationproviderframeworkisComplete165FE163"
-       },
-       "-c8475ff4cfa405647403a9effa67ebd6e9b6ff1a29"
-      ]
-     ]
-    },
-    "RetentionInDays": 731
-   },
-   "UpdateReplacePolicy": "Retain",
-   "DeletionPolicy": "Retain",
-   "Metadata": {
-    "cdk_nag": {
-     "rules_to_suppress": [
-      {
-       "reason": "no service role restriction needed",
-       "id": "AwsSolutions-IAM4"
-      },
-      {
-       "reason": "wildcards are ok for the provider as the function has restrictions",
-       "id": "AwsSolutions-IAM5"
-      }
-     ]
-    }
    }
   },
   "rootmailhostedzonedkimpropagationproviderwaiterstatemachine2C629ADB": {
@@ -3553,22 +2498,6 @@
       ]
      ]
     },
-    "LoggingConfiguration": {
-     "Destinations": [
-      {
-       "CloudWatchLogsLogGroup": {
-        "LogGroupArn": {
-         "Fn::GetAtt": [
-          "rootmailhostedzonedkimpropagationproviderwaiterstatemachineLogGroup9CDB772B",
-          "Arn"
-         ]
-        }
-       }
-      }
-     ],
-     "IncludeExecutionData": false,
-     "Level": "ERROR"
-    },
     "RoleArn": {
      "Fn::GetAtt": [
       "rootmailhostedzonedkimpropagationproviderwaiterstatemachineRole40906579",
@@ -3579,21 +2508,7 @@
    "DependsOn": [
     "rootmailhostedzonedkimpropagationproviderwaiterstatemachineRoleDefaultPolicy70368CA0",
     "rootmailhostedzonedkimpropagationproviderwaiterstatemachineRole40906579"
-   ],
-   "Metadata": {
-    "cdk_nag": {
-     "rules_to_suppress": [
-      {
-       "reason": "no service role restriction needed",
-       "id": "AwsSolutions-IAM4"
-      },
-      {
-       "reason": "wildcards are ok for the provider as the function has restrictions",
-       "id": "AwsSolutions-IAM5"
-      }
-     ]
-    }
-   }
+   ]
   },
   "rootmailsesreceiptrulesetactivationproviderSesReceiptRuleSetActivationCustomResourceRoleA5C4F5B4": {
    "Type": "AWS::IAM::Role",
@@ -3624,20 +2539,6 @@
       ]
      }
     ]
-   },
-   "Metadata": {
-    "cdk_nag": {
-     "rules_to_suppress": [
-      {
-       "reason": "no service role restriction needed",
-       "id": "AwsSolutions-IAM4"
-      },
-      {
-       "reason": "wildcards are ok for the provider as the function has restrictions",
-       "id": "AwsSolutions-IAM5"
-      }
-     ]
-    }
    }
   },
   "rootmailsesreceiptrulesetactivationproviderSesReceiptRuleSetActivationCustomResourceRoleDefaultPolicy92E90A6D": {
@@ -3665,22 +2566,16 @@
       "Ref": "rootmailsesreceiptrulesetactivationproviderSesReceiptRuleSetActivationCustomResourceRoleA5C4F5B4"
      }
     ]
-   },
-   "Metadata": {
-    "cdk_nag": {
-     "rules_to_suppress": [
-      {
-       "reason": "no service role restriction needed",
-       "id": "AwsSolutions-IAM4"
-      },
-      {
-       "reason": "wildcards are ok for the provider as the function has restrictions",
-       "id": "AwsSolutions-IAM5"
-      }
-     ]
-    }
    }
   },
+  "rootmailsesreceiptrulesetactivationprovideroneventhandlerloggroupA8D38A9B": {
+   "Type": "AWS::Logs::LogGroup",
+   "Properties": {
+    "RetentionInDays": 1
+   },
+   "UpdateReplacePolicy": "Retain",
+   "DeletionPolicy": "Retain"
+  },
   "rootmailsesreceiptrulesetactivationprovideroneventhandler8E245877": {
    "Type": "AWS::Lambda::Function",
    "Properties": {
@@ -3688,73 +2583,35 @@
      "S3Bucket": {
       "Fn::Sub": "cdk-hnb659fds-assets-${AWS::AccountId}-${AWS::Region}"
      },
-     "S3Key": "9709438d0fbb508ea9bfee8683a274b4f9492f5e527eb28e0bd9e2bc96b9a08f.zip"
+     "S3Key": "be7d56b509650f7f97c406a745d8335992726086995e4cb4aaf50417ab40e803.zip"
     },
     "Handler": "index.handler",
+    "LoggingConfig": {
+     "LogGroup": {
+      "Ref": "rootmailsesreceiptrulesetactivationprovideroneventhandlerloggroupA8D38A9B"
+     }
+    },
     "Role": {
      "Fn::GetAtt": [
       "rootmailsesreceiptrulesetactivationproviderSesReceiptRuleSetActivationCustomResourceRoleA5C4F5B4",
       "Arn"
      ]
     },
-    "Runtime": "nodejs18.x",
+    "Runtime": "nodejs24.x",
     "Timeout": 30
    },
    "DependsOn": [
     "rootmailsesreceiptrulesetactivationproviderSesReceiptRuleSetActivationCustomResourceRoleDefaultPolicy92E90A6D",
     "rootmailsesreceiptrulesetactivationproviderSesReceiptRuleSetActivationCustomResourceRoleA5C4F5B4"
-   ],
-   "Metadata": {
-    "cdk_nag": {
-     "rules_to_suppress": [
-      {
-       "reason": "no service role restriction needed",
-       "id": "AwsSolutions-IAM4"
-      },
-      {
-       "reason": "wildcards are ok for the provider as the function has restrictions",
-       "id": "AwsSolutions-IAM5"
-      }
-     ]
-    }
-   }
+   ]
   },
-  "rootmailsesreceiptrulesetactivationprovideroneventhandlerLogRetentionFD6A9185": {
-   "Type": "Custom::LogRetention",
+  "rootmailsesreceiptrulesetactivationprovideriscompletehandlerloggroupB30DB696": {
+   "Type": "AWS::Logs::LogGroup",
    "Properties": {
-    "ServiceToken": {
-     "Fn::GetAtt": [
-      "LogRetentionaae0aa3c5b4d4f87b02d85b201efdd8aFD4BFC8A",
-      "Arn"
-     ]
-    },
-    "LogGroupName": {
-     "Fn::Join": [
-      "",
-      [
-       "/aws/lambda/",
-       {
-        "Ref": "rootmailsesreceiptrulesetactivationprovideroneventhandler8E245877"
-       }
-      ]
-     ]
-    },
     "RetentionInDays": 1
    },
-   "Metadata": {
-    "cdk_nag": {
-     "rules_to_suppress": [
-      {
-       "reason": "no service role restriction needed",
-       "id": "AwsSolutions-IAM4"
-      },
-      {
-       "reason": "wildcards are ok for the provider as the function has restrictions",
-       "id": "AwsSolutions-IAM5"
-      }
-     ]
-    }
-   }
+   "UpdateReplacePolicy": "Retain",
+   "DeletionPolicy": "Retain"
   },
   "rootmailsesreceiptrulesetactivationprovideriscompletehandlerServiceRole9D6CAFC0": {
    "Type": "AWS::IAM::Role",
@@ -3785,20 +2642,6 @@
       ]
      }
     ]
-   },
-   "Metadata": {
-    "cdk_nag": {
-     "rules_to_suppress": [
-      {
-       "reason": "no service role restriction needed",
-       "id": "AwsSolutions-IAM4"
-      },
-      {
-       "reason": "wildcards are ok for the provider as the function has restrictions",
-       "id": "AwsSolutions-IAM5"
-      }
-     ]
-    }
    }
   },
   "rootmailsesreceiptrulesetactivationprovideriscompletehandlerServiceRoleDefaultPolicyFB99DF60": {
@@ -3845,20 +2688,6 @@
       "Ref": "rootmailsesreceiptrulesetactivationprovideriscompletehandlerServiceRole9D6CAFC0"
      }
     ]
-   },
-   "Metadata": {
-    "cdk_nag": {
-     "rules_to_suppress": [
-      {
-       "reason": "no service role restriction needed",
-       "id": "AwsSolutions-IAM4"
-      },
-      {
-       "reason": "wildcards are ok for the provider as the function has restrictions",
-       "id": "AwsSolutions-IAM5"
-      }
-     ]
-    }
    }
   },
   "rootmailsesreceiptrulesetactivationprovideriscompletehandler676C1A14": {
@@ -3868,73 +2697,35 @@
      "S3Bucket": {
       "Fn::Sub": "cdk-hnb659fds-assets-${AWS::AccountId}-${AWS::Region}"
      },
-     "S3Key": "7144c5a47b3904b1aa4b27be73803a4b684f4ef765d9df8fa767779d37106254.zip"
+     "S3Key": "78b64aaf9aebb4eacbdd42197be10e9d5894360a642f7dcf79aeb84bb3552377.zip"
     },
     "Handler": "index.handler",
+    "LoggingConfig": {
+     "LogGroup": {
+      "Ref": "rootmailsesreceiptrulesetactivationprovideriscompletehandlerloggroupB30DB696"
+     }
+    },
     "Role": {
      "Fn::GetAtt": [
       "rootmailsesreceiptrulesetactivationprovideriscompletehandlerServiceRole9D6CAFC0",
       "Arn"
      ]
     },
-    "Runtime": "nodejs18.x",
+    "Runtime": "nodejs24.x",
     "Timeout": 30
    },
    "DependsOn": [
     "rootmailsesreceiptrulesetactivationprovideriscompletehandlerServiceRoleDefaultPolicyFB99DF60",
     "rootmailsesreceiptrulesetactivationprovideriscompletehandlerServiceRole9D6CAFC0"
-   ],
-   "Metadata": {
-    "cdk_nag": {
-     "rules_to_suppress": [
-      {
-       "reason": "no service role restriction needed",
-       "id": "AwsSolutions-IAM4"
-      },
-      {
-       "reason": "wildcards are ok for the provider as the function has restrictions",
-       "id": "AwsSolutions-IAM5"
-      }
-     ]
-    }
-   }
+   ]
   },
-  "rootmailsesreceiptrulesetactivationprovideriscompletehandlerLogRetention03F74C63": {
-   "Type": "Custom::LogRetention",
+  "rootmailsesreceiptrulesetactivationprovidersesreceiptrulesetactivationproviderloggroup8F6A5203": {
+   "Type": "AWS::Logs::LogGroup",
    "Properties": {
-    "ServiceToken": {
-     "Fn::GetAtt": [
-      "LogRetentionaae0aa3c5b4d4f87b02d85b201efdd8aFD4BFC8A",
-      "Arn"
-     ]
-    },
-    "LogGroupName": {
-     "Fn::Join": [
-      "",
-      [
-       "/aws/lambda/",
-       {
-        "Ref": "rootmailsesreceiptrulesetactivationprovideriscompletehandler676C1A14"
-       }
-      ]
-     ]
-    },
     "RetentionInDays": 1
    },
-   "Metadata": {
-    "cdk_nag": {
-     "rules_to_suppress": [
-      {
-       "reason": "no service role restriction needed",
-       "id": "AwsSolutions-IAM4"
-      },
-      {
-       "reason": "wildcards are ok for the provider as the function has restrictions",
-       "id": "AwsSolutions-IAM5"
-      }
-     ]
-    }
-   }
+   "UpdateReplacePolicy": "Retain",
+   "DeletionPolicy": "Retain"
   },
   "rootmailsesreceiptrulesetactivationproviderframeworkonEventServiceRoleB5050EE6": {
    "Type": "AWS::IAM::Role",
@@ -3965,20 +2756,6 @@
       ]
      }
     ]
-   },
-   "Metadata": {
-    "cdk_nag": {
-     "rules_to_suppress": [
-      {
-       "reason": "no service role restriction needed",
-       "id": "AwsSolutions-IAM4"
-      },
-      {
-       "reason": "wildcards are ok for the provider as the function has restrictions",
-       "id": "AwsSolutions-IAM5"
-      }
-     ]
-    }
    }
   },
   "rootmailsesreceiptrulesetactivationproviderframeworkonEventServiceRoleDefaultPolicy11FA01A0": {
@@ -4032,6 +2809,24 @@
         }
        ]
       },
+      {
+       "Action": "lambda:GetFunction",
+       "Effect": "Allow",
+       "Resource": [
+        {
+         "Fn::GetAtt": [
+          "rootmailsesreceiptrulesetactivationprovideriscompletehandler676C1A14",
+          "Arn"
+         ]
+        },
+        {
+         "Fn::GetAtt": [
+          "rootmailsesreceiptrulesetactivationprovideroneventhandler8E245877",
+          "Arn"
+         ]
+        }
+       ]
+      },
       {
        "Action": "states:StartExecution",
        "Effect": "Allow",
@@ -4048,20 +2843,6 @@
       "Ref": "rootmailsesreceiptrulesetactivationproviderframeworkonEventServiceRoleB5050EE6"
      }
     ]
-   },
-   "Metadata": {
-    "cdk_nag": {
-     "rules_to_suppress": [
-      {
-       "reason": "no service role restriction needed",
-       "id": "AwsSolutions-IAM4"
-      },
-      {
-       "reason": "wildcards are ok for the provider as the function has restrictions",
-       "id": "AwsSolutions-IAM5"
-      }
-     ]
-    }
    }
   },
   "rootmailsesreceiptrulesetactivationproviderframeworkonEventC514B5CD": {
@@ -4071,7 +2852,7 @@
      "S3Bucket": {
       "Fn::Sub": "cdk-hnb659fds-assets-${AWS::AccountId}-${AWS::Region}"
      },
-     "S3Key": "bdc104ed9cab1b5b6421713c8155f0b753380595356f710400609664d3635eca.zip"
+     "S3Key": "e16ffb3b34af185b8b30c88fdb19faa13b6c42bb38580485c4e84b384ee48b63.zip"
     },
     "Description": "AWS CDK resource provider framework - onEvent (RootmailIntegTestStack/rootmail.ses-receipt-ruleset-activation-provider/ses-receipt-ruleset-activation-provider)",
     "Environment": {
@@ -4094,78 +2875,26 @@
      }
     },
     "Handler": "framework.onEvent",
+    "LoggingConfig": {
+     "ApplicationLogLevel": "FATAL",
+     "LogFormat": "JSON",
+     "LogGroup": {
+      "Ref": "rootmailsesreceiptrulesetactivationprovidersesreceiptrulesetactivationproviderloggroup8F6A5203"
+     }
+    },
     "Role": {
      "Fn::GetAtt": [
       "rootmailsesreceiptrulesetactivationproviderframeworkonEventServiceRoleB5050EE6",
       "Arn"
      ]
     },
-    "Runtime": {
-     "Fn::FindInMap": [
-      "LatestNodeRuntimeMap",
-      {
-       "Ref": "AWS::Region"
-      },
-      "value"
-     ]
-    },
+    "Runtime": "nodejs24.x",
     "Timeout": 900
    },
    "DependsOn": [
     "rootmailsesreceiptrulesetactivationproviderframeworkonEventServiceRoleDefaultPolicy11FA01A0",
     "rootmailsesreceiptrulesetactivationproviderframeworkonEventServiceRoleB5050EE6"
-   ],
-   "Metadata": {
-    "cdk_nag": {
-     "rules_to_suppress": [
-      {
-       "reason": "no service role restriction needed",
-       "id": "AwsSolutions-IAM4"
-      },
-      {
-       "reason": "wildcards are ok for the provider as the function has restrictions",
-       "id": "AwsSolutions-IAM5"
-      }
-     ]
-    }
-   }
-  },
-  "rootmailsesreceiptrulesetactivationproviderframeworkonEventLogRetentionA6742D46": {
-   "Type": "Custom::LogRetention",
-   "Properties": {
-    "ServiceToken": {
-     "Fn::GetAtt": [
-      "LogRetentionaae0aa3c5b4d4f87b02d85b201efdd8aFD4BFC8A",
-      "Arn"
-     ]
-    },
-    "LogGroupName": {
-     "Fn::Join": [
-      "",
-      [
-       "/aws/lambda/",
-       {
-        "Ref": "rootmailsesreceiptrulesetactivationproviderframeworkonEventC514B5CD"
-       }
-      ]
-     ]
-    },
-    "RetentionInDays": 1
-   },
-   "Metadata": {
-    "cdk_nag": {
-     "rules_to_suppress": [
-      {
-       "reason": "no service role restriction needed",
-       "id": "AwsSolutions-IAM4"
-      },
-      {
-       "reason": "wildcards are ok for the provider as the function has restrictions",
-       "id": "AwsSolutions-IAM5"
-      }
-     ]
-    }
-   }
+   ]
   },
   "rootmailsesreceiptrulesetactivationproviderframeworkisCompleteServiceRoleCFD6EE46": {
    "Type": "AWS::IAM::Role",
@@ -4196,20 +2925,6 @@
       ]
      }
     ]
-   },
-   "Metadata": {
-    "cdk_nag": {
-     "rules_to_suppress": [
-      {
-       "reason": "no service role restriction needed",
-       "id": "AwsSolutions-IAM4"
-      },
-      {
-       "reason": "wildcards are ok for the provider as the function has restrictions",
-       "id": "AwsSolutions-IAM5"
-      }
-     ]
-    }
    }
   },
   "rootmailsesreceiptrulesetactivationproviderframeworkisCompleteServiceRoleDefaultPolicy8A8828E7": {
@@ -4262,6 +2977,24 @@
          ]
         }
        ]
+      },
+      {
+       "Action": "lambda:GetFunction",
+       "Effect": "Allow",
+       "Resource": [
+        {
+         "Fn::GetAtt": [
+          "rootmailsesreceiptrulesetactivationprovideriscompletehandler676C1A14",
+          "Arn"
+         ]
+        },
+        {
+         "Fn::GetAtt": [
+          "rootmailsesreceiptrulesetactivationprovideroneventhandler8E245877",
+          "Arn"
+         ]
+        }
+       ]
       }
      ],
      "Version": "2012-10-17"
@@ -4270,22 +3003,8 @@
     "Roles": [
      {
       "Ref": "rootmailsesreceiptrulesetactivationproviderframeworkisCompleteServiceRoleCFD6EE46"
-     }
-    ]
-   },
-   "Metadata": {
-    "cdk_nag": {
-     "rules_to_suppress": [
-      {
-       "reason": "no service role restriction needed",
-       "id": "AwsSolutions-IAM4"
-      },
-      {
-       "reason": "wildcards are ok for the provider as the function has restrictions",
-       "id": "AwsSolutions-IAM5"
-      }
-     ]
-    }
+     }
+    ]
    }
   },
   "rootmailsesreceiptrulesetactivationproviderframeworkisComplete17519146": {
@@ -4295,7 +3014,7 @@
      "S3Bucket": {
       "Fn::Sub": "cdk-hnb659fds-assets-${AWS::AccountId}-${AWS::Region}"
      },
-     "S3Key": "bdc104ed9cab1b5b6421713c8155f0b753380595356f710400609664d3635eca.zip"
+     "S3Key": "e16ffb3b34af185b8b30c88fdb19faa13b6c42bb38580485c4e84b384ee48b63.zip"
     },
     "Description": "AWS CDK resource provider framework - isComplete (RootmailIntegTestStack/rootmail.ses-receipt-ruleset-activation-provider/ses-receipt-ruleset-activation-provider)",
     "Environment": {
@@ -4315,78 +3034,26 @@
      }
     },
     "Handler": "framework.isComplete",
+    "LoggingConfig": {
+     "ApplicationLogLevel": "FATAL",
+     "LogFormat": "JSON",
+     "LogGroup": {
+      "Ref": "rootmailsesreceiptrulesetactivationprovidersesreceiptrulesetactivationproviderloggroup8F6A5203"
+     }
+    },
     "Role": {
      "Fn::GetAtt": [
       "rootmailsesreceiptrulesetactivationproviderframeworkisCompleteServiceRoleCFD6EE46",
       "Arn"
      ]
     },
-    "Runtime": {
-     "Fn::FindInMap": [
-      "LatestNodeRuntimeMap",
-      {
-       "Ref": "AWS::Region"
-      },
-      "value"
-     ]
-    },
+    "Runtime": "nodejs24.x",
     "Timeout": 900
    },
    "DependsOn": [
     "rootmailsesreceiptrulesetactivationproviderframeworkisCompleteServiceRoleDefaultPolicy8A8828E7",
     "rootmailsesreceiptrulesetactivationproviderframeworkisCompleteServiceRoleCFD6EE46"
-   ],
-   "Metadata": {
-    "cdk_nag": {
-     "rules_to_suppress": [
-      {
-       "reason": "no service role restriction needed",
-       "id": "AwsSolutions-IAM4"
-      },
-      {
-       "reason": "wildcards are ok for the provider as the function has restrictions",
-       "id": "AwsSolutions-IAM5"
-      }
-     ]
-    }
-   }
-  },
-  "rootmailsesreceiptrulesetactivationproviderframeworkisCompleteLogRetention13DDD3A2": {
-   "Type": "Custom::LogRetention",
-   "Properties": {
-    "ServiceToken": {
-     "Fn::GetAtt": [
-      "LogRetentionaae0aa3c5b4d4f87b02d85b201efdd8aFD4BFC8A",
-      "Arn"
-     ]
-    },
-    "LogGroupName": {
-     "Fn::Join": [
-      "",
-      [
-       "/aws/lambda/",
-       {
-        "Ref": "rootmailsesreceiptrulesetactivationproviderframeworkisComplete17519146"
-       }
-      ]
-     ]
-    },
-    "RetentionInDays": 1
-   },
-   "Metadata": {
-    "cdk_nag": {
-     "rules_to_suppress": [
-      {
-       "reason": "no service role restriction needed",
-       "id": "AwsSolutions-IAM4"
-      },
-      {
-       "reason": "wildcards are ok for the provider as the function has restrictions",
-       "id": "AwsSolutions-IAM5"
-      }
-     ]
-    }
-   }
+   ]
   },
   "rootmailsesreceiptrulesetactivationproviderframeworkonTimeoutServiceRole845C2519": {
    "Type": "AWS::IAM::Role",
@@ -4417,20 +3084,6 @@
       ]
      }
     ]
-   },
-   "Metadata": {
-    "cdk_nag": {
-     "rules_to_suppress": [
-      {
-       "reason": "no service role restriction needed",
-       "id": "AwsSolutions-IAM4"
-      },
-      {
-       "reason": "wildcards are ok for the provider as the function has restrictions",
-       "id": "AwsSolutions-IAM5"
-      }
-     ]
-    }
    }
   },
   "rootmailsesreceiptrulesetactivationproviderframeworkonTimeoutServiceRoleDefaultPolicy8A4A1F2A": {
@@ -4483,6 +3136,24 @@
          ]
         }
        ]
+      },
+      {
+       "Action": "lambda:GetFunction",
+       "Effect": "Allow",
+       "Resource": [
+        {
+         "Fn::GetAtt": [
+          "rootmailsesreceiptrulesetactivationprovideriscompletehandler676C1A14",
+          "Arn"
+         ]
+        },
+        {
+         "Fn::GetAtt": [
+          "rootmailsesreceiptrulesetactivationprovideroneventhandler8E245877",
+          "Arn"
+         ]
+        }
+       ]
       }
      ],
      "Version": "2012-10-17"
@@ -4493,20 +3164,6 @@
       "Ref": "rootmailsesreceiptrulesetactivationproviderframeworkonTimeoutServiceRole845C2519"
      }
     ]
-   },
-   "Metadata": {
-    "cdk_nag": {
-     "rules_to_suppress": [
-      {
-       "reason": "no service role restriction needed",
-       "id": "AwsSolutions-IAM4"
-      },
-      {
-       "reason": "wildcards are ok for the provider as the function has restrictions",
-       "id": "AwsSolutions-IAM5"
-      }
-     ]
-    }
    }
   },
   "rootmailsesreceiptrulesetactivationproviderframeworkonTimeout85CF91B9": {
@@ -4516,7 +3173,7 @@
      "S3Bucket": {
       "Fn::Sub": "cdk-hnb659fds-assets-${AWS::AccountId}-${AWS::Region}"
      },
-     "S3Key": "bdc104ed9cab1b5b6421713c8155f0b753380595356f710400609664d3635eca.zip"
+     "S3Key": "e16ffb3b34af185b8b30c88fdb19faa13b6c42bb38580485c4e84b384ee48b63.zip"
     },
     "Description": "AWS CDK resource provider framework - onTimeout (RootmailIntegTestStack/rootmail.ses-receipt-ruleset-activation-provider/ses-receipt-ruleset-activation-provider)",
     "Environment": {
@@ -4536,78 +3193,26 @@
      }
     },
     "Handler": "framework.onTimeout",
+    "LoggingConfig": {
+     "ApplicationLogLevel": "FATAL",
+     "LogFormat": "JSON",
+     "LogGroup": {
+      "Ref": "rootmailsesreceiptrulesetactivationprovidersesreceiptrulesetactivationproviderloggroup8F6A5203"
+     }
+    },
     "Role": {
      "Fn::GetAtt": [
       "rootmailsesreceiptrulesetactivationproviderframeworkonTimeoutServiceRole845C2519",
       "Arn"
      ]
     },
-    "Runtime": {
-     "Fn::FindInMap": [
-      "LatestNodeRuntimeMap",
-      {
-       "Ref": "AWS::Region"
-      },
-      "value"
-     ]
-    },
+    "Runtime": "nodejs24.x",
     "Timeout": 900
    },
    "DependsOn": [
     "rootmailsesreceiptrulesetactivationproviderframeworkonTimeoutServiceRoleDefaultPolicy8A4A1F2A",
     "rootmailsesreceiptrulesetactivationproviderframeworkonTimeoutServiceRole845C2519"
-   ],
-   "Metadata": {
-    "cdk_nag": {
-     "rules_to_suppress": [
-      {
-       "reason": "no service role restriction needed",
-       "id": "AwsSolutions-IAM4"
-      },
-      {
-       "reason": "wildcards are ok for the provider as the function has restrictions",
-       "id": "AwsSolutions-IAM5"
-      }
-     ]
-    }
-   }
-  },
-  "rootmailsesreceiptrulesetactivationproviderframeworkonTimeoutLogRetention5763AF42": {
-   "Type": "Custom::LogRetention",
-   "Properties": {
-    "ServiceToken": {
-     "Fn::GetAtt": [
-      "LogRetentionaae0aa3c5b4d4f87b02d85b201efdd8aFD4BFC8A",
-      "Arn"
-     ]
-    },
-    "LogGroupName": {
-     "Fn::Join": [
-      "",
-      [
-       "/aws/lambda/",
-       {
-        "Ref": "rootmailsesreceiptrulesetactivationproviderframeworkonTimeout85CF91B9"
-       }
-      ]
-     ]
-    },
-    "RetentionInDays": 1
-   },
-   "Metadata": {
-    "cdk_nag": {
-     "rules_to_suppress": [
-      {
-       "reason": "no service role restriction needed",
-       "id": "AwsSolutions-IAM4"
-      },
-      {
-       "reason": "wildcards are ok for the provider as the function has restrictions",
-       "id": "AwsSolutions-IAM5"
-      }
-     ]
-    }
-   }
+   ]
   },
   "rootmailsesreceiptrulesetactivationproviderwaiterstatemachineRole069EB2EA": {
    "Type": "AWS::IAM::Role",
@@ -4624,20 +3229,6 @@
      ],
      "Version": "2012-10-17"
     }
-   },
-   "Metadata": {
-    "cdk_nag": {
-     "rules_to_suppress": [
-      {
-       "reason": "no service role restriction needed",
-       "id": "AwsSolutions-IAM4"
-      },
-      {
-       "reason": "wildcards are ok for the provider as the function has restrictions",
-       "id": "AwsSolutions-IAM5"
-      }
-     ]
-    }
    }
   },
   "rootmailsesreceiptrulesetactivationproviderwaiterstatemachineRoleDefaultPolicy64767BAC": {
@@ -4690,22 +3281,6 @@
          ]
         }
        ]
-      },
-      {
-       "Action": [
-        "logs:CreateLogDelivery",
-        "logs:CreateLogStream",
-        "logs:DeleteLogDelivery",
-        "logs:DescribeLogGroups",
-        "logs:DescribeResourcePolicies",
-        "logs:GetLogDelivery",
-        "logs:ListLogDeliveries",
-        "logs:PutLogEvents",
-        "logs:PutResourcePolicy",
-        "logs:UpdateLogDelivery"
-       ],
-       "Effect": "Allow",
-       "Resource": "*"
       }
      ],
      "Version": "2012-10-17"
@@ -4716,54 +3291,6 @@
       "Ref": "rootmailsesreceiptrulesetactivationproviderwaiterstatemachineRole069EB2EA"
      }
     ]
-   },
-   "Metadata": {
-    "cdk_nag": {
-     "rules_to_suppress": [
-      {
-       "reason": "no service role restriction needed",
-       "id": "AwsSolutions-IAM4"
-      },
-      {
-       "reason": "wildcards are ok for the provider as the function has restrictions",
-       "id": "AwsSolutions-IAM5"
-      }
-     ]
-    }
-   }
-  },
-  "rootmailsesreceiptrulesetactivationproviderwaiterstatemachineLogGroup91D50937": {
-   "Type": "AWS::Logs::LogGroup",
-   "Properties": {
-    "LogGroupName": {
-     "Fn::Join": [
-      "",
-      [
-       "/aws/vendedlogs/states/waiter-state-machine-",
-       {
-        "Ref": "rootmailsesreceiptrulesetactivationproviderframeworkisComplete17519146"
-       },
-       "-c835847d33488db0e9cc733c354fb0ac44503af5c9"
-      ]
-     ]
-    },
-    "RetentionInDays": 731
-   },
-   "UpdateReplacePolicy": "Retain",
-   "DeletionPolicy": "Retain",
-   "Metadata": {
-    "cdk_nag": {
-     "rules_to_suppress": [
-      {
-       "reason": "no service role restriction needed",
-       "id": "AwsSolutions-IAM4"
-      },
-      {
-       "reason": "wildcards are ok for the provider as the function has restrictions",
-       "id": "AwsSolutions-IAM5"
-      }
-     ]
-    }
    }
   },
   "rootmailsesreceiptrulesetactivationproviderwaiterstatemachine93794458": {
@@ -4791,22 +3318,6 @@
       ]
      ]
     },
-    "LoggingConfiguration": {
-     "Destinations": [
-      {
-       "CloudWatchLogsLogGroup": {
-        "LogGroupArn": {
-         "Fn::GetAtt": [
-          "rootmailsesreceiptrulesetactivationproviderwaiterstatemachineLogGroup91D50937",
-          "Arn"
-         ]
-        }
-       }
-      }
-     ],
-     "IncludeExecutionData": false,
-     "Level": "ERROR"
-    },
     "RoleArn": {
      "Fn::GetAtt": [
       "rootmailsesreceiptrulesetactivationproviderwaiterstatemachineRole069EB2EA",
@@ -4817,21 +3328,15 @@
    "DependsOn": [
     "rootmailsesreceiptrulesetactivationproviderwaiterstatemachineRoleDefaultPolicy64767BAC",
     "rootmailsesreceiptrulesetactivationproviderwaiterstatemachineRole069EB2EA"
-   ],
-   "Metadata": {
-    "cdk_nag": {
-     "rules_to_suppress": [
-      {
-       "reason": "no service role restriction needed",
-       "id": "AwsSolutions-IAM4"
-      },
-      {
-       "reason": "wildcards are ok for the provider as the function has restrictions",
-       "id": "AwsSolutions-IAM5"
-      }
-     ]
-    }
-   }
+   ]
+  },
+  "sendemailhandlerloggroup145800B9": {
+   "Type": "AWS::Logs::LogGroup",
+   "Properties": {
+    "RetentionInDays": 1
+   },
+   "UpdateReplacePolicy": "Retain",
+   "DeletionPolicy": "Retain"
   },
   "sendemailhandlerServiceRole7A142BD3": {
    "Type": "AWS::IAM::Role",
@@ -4895,16 +3400,21 @@
      "S3Bucket": {
       "Fn::Sub": "cdk-hnb659fds-assets-${AWS::AccountId}-${AWS::Region}"
      },
-     "S3Key": "0cc54596504938d3858f36b8eaeb554817254230dfa52e23a70aad9e657b80b8.zip"
+     "S3Key": "2b86f8b255c50c6eba274c368849bab1c7a3747c30ef5df4c96f8dea8fffa21e.zip"
     },
     "Handler": "index.handler",
+    "LoggingConfig": {
+     "LogGroup": {
+      "Ref": "sendemailhandlerloggroup145800B9"
+     }
+    },
     "Role": {
      "Fn::GetAtt": [
       "sendemailhandlerServiceRole7A142BD3",
       "Arn"
      ]
     },
-    "Runtime": "nodejs18.x",
+    "Runtime": "nodejs24.x",
     "Timeout": 30
    },
    "DependsOn": [
@@ -4912,28 +3422,13 @@
     "sendemailhandlerServiceRole7A142BD3"
    ]
   },
-  "sendemailhandlerLogRetentionDBC033F7": {
-   "Type": "Custom::LogRetention",
+  "closeopsitemhandlerloggroup4F38B69C": {
+   "Type": "AWS::Logs::LogGroup",
    "Properties": {
-    "ServiceToken": {
-     "Fn::GetAtt": [
-      "LogRetentionaae0aa3c5b4d4f87b02d85b201efdd8aFD4BFC8A",
-      "Arn"
-     ]
-    },
-    "LogGroupName": {
-     "Fn::Join": [
-      "",
-      [
-       "/aws/lambda/",
-       {
-        "Ref": "sendemailhandler05B16DE5"
-       }
-      ]
-     ]
-    },
     "RetentionInDays": 1
-   }
+   },
+   "UpdateReplacePolicy": "Retain",
+   "DeletionPolicy": "Retain"
   },
   "closeopsitemhandlerServiceRoleCB0A72D2": {
    "Type": "AWS::IAM::Role",
@@ -4997,186 +3492,38 @@
      "S3Bucket": {
       "Fn::Sub": "cdk-hnb659fds-assets-${AWS::AccountId}-${AWS::Region}"
      },
-     "S3Key": "ed72e1e93cae7d32d1a99c33e6f697428dc230c3922131e7ba121cc99a732f3f.zip"
+     "S3Key": "6ae1d1fcc0e69b0216c406dcb73136e88857dfc9a29784c57838e1fb0f9f7496.zip"
     },
     "Handler": "index.handler",
+    "LoggingConfig": {
+     "LogGroup": {
+      "Ref": "closeopsitemhandlerloggroup4F38B69C"
+     }
+    },
     "Role": {
      "Fn::GetAtt": [
       "closeopsitemhandlerServiceRoleCB0A72D2",
       "Arn"
      ]
     },
-    "Runtime": "nodejs18.x",
+    "Runtime": "nodejs24.x",
     "Timeout": 180
    },
    "DependsOn": [
     "closeopsitemhandlerServiceRoleDefaultPolicy6E097200",
     "closeopsitemhandlerServiceRoleCB0A72D2"
    ]
-  },
-  "closeopsitemhandlerLogRetentionFD7FC04E": {
-   "Type": "Custom::LogRetention",
-   "Properties": {
-    "ServiceToken": {
-     "Fn::GetAtt": [
-      "LogRetentionaae0aa3c5b4d4f87b02d85b201efdd8aFD4BFC8A",
-      "Arn"
-     ]
-    },
-    "LogGroupName": {
-     "Fn::Join": [
-      "",
-      [
-       "/aws/lambda/",
-       {
-        "Ref": "closeopsitemhandler2F03D32C"
-       }
-      ]
-     ]
-    },
-    "RetentionInDays": 1
-   }
-  }
- },
- "Mappings": {
-  "LatestNodeRuntimeMap": {
-   "af-south-1": {
-    "value": "nodejs20.x"
-   },
-   "ap-east-1": {
-    "value": "nodejs20.x"
-   },
-   "ap-northeast-1": {
-    "value": "nodejs20.x"
-   },
-   "ap-northeast-2": {
-    "value": "nodejs20.x"
-   },
-   "ap-northeast-3": {
-    "value": "nodejs20.x"
-   },
-   "ap-south-1": {
-    "value": "nodejs20.x"
-   },
-   "ap-south-2": {
-    "value": "nodejs20.x"
-   },
-   "ap-southeast-1": {
-    "value": "nodejs20.x"
-   },
-   "ap-southeast-2": {
-    "value": "nodejs20.x"
-   },
-   "ap-southeast-3": {
-    "value": "nodejs20.x"
-   },
-   "ap-southeast-4": {
-    "value": "nodejs20.x"
-   },
-   "ap-southeast-5": {
-    "value": "nodejs20.x"
-   },
-   "ap-southeast-7": {
-    "value": "nodejs20.x"
-   },
-   "ca-central-1": {
-    "value": "nodejs20.x"
-   },
-   "ca-west-1": {
-    "value": "nodejs20.x"
-   },
-   "cn-north-1": {
-    "value": "nodejs18.x"
-   },
-   "cn-northwest-1": {
-    "value": "nodejs18.x"
-   },
-   "eu-central-1": {
-    "value": "nodejs20.x"
-   },
-   "eu-central-2": {
-    "value": "nodejs20.x"
-   },
-   "eu-isoe-west-1": {
-    "value": "nodejs18.x"
-   },
-   "eu-north-1": {
-    "value": "nodejs20.x"
-   },
-   "eu-south-1": {
-    "value": "nodejs20.x"
-   },
-   "eu-south-2": {
-    "value": "nodejs20.x"
-   },
-   "eu-west-1": {
-    "value": "nodejs20.x"
-   },
-   "eu-west-2": {
-    "value": "nodejs20.x"
-   },
-   "eu-west-3": {
-    "value": "nodejs20.x"
-   },
-   "il-central-1": {
-    "value": "nodejs20.x"
-   },
-   "me-central-1": {
-    "value": "nodejs20.x"
-   },
-   "me-south-1": {
-    "value": "nodejs20.x"
-   },
-   "mx-central-1": {
-    "value": "nodejs20.x"
-   },
-   "sa-east-1": {
-    "value": "nodejs20.x"
-   },
-   "us-east-1": {
-    "value": "nodejs20.x"
-   },
-   "us-east-2": {
-    "value": "nodejs20.x"
-   },
-   "us-gov-east-1": {
-    "value": "nodejs18.x"
-   },
-   "us-gov-west-1": {
-    "value": "nodejs18.x"
-   },
-   "us-iso-east-1": {
-    "value": "nodejs18.x"
-   },
-   "us-iso-west-1": {
-    "value": "nodejs18.x"
-   },
-   "us-isob-east-1": {
-    "value": "nodejs18.x"
-   },
-   "us-west-1": {
-    "value": "nodejs20.x"
-   },
-   "us-west-2": {
-    "value": "nodejs20.x"
-   }
   }
  },
  "Outputs": {
-  "ExportsOutputRefsendemailhandler05B16DE5F96FA757": {
+  "PublishOutputRefsendemailhandler05B16DE50B194B06": {
    "Value": {
     "Ref": "sendemailhandler05B16DE5"
-   },
-   "Export": {
-    "Name": "RootmailIntegTestStack:ExportsOutputRefsendemailhandler05B16DE5F96FA757"
    }
   },
-  "ExportsOutputRefcloseopsitemhandler2F03D32CCD4ECFB2": {
+  "PublishOutputRefcloseopsitemhandler2F03D32CD0F9363E": {
    "Value": {
     "Ref": "closeopsitemhandler2F03D32C"
-   },
-   "Export": {
-    "Name": "RootmailIntegTestStack:ExportsOutputRefcloseopsitemhandler2F03D32CCD4ECFB2"
    }
   }
  },