@rio-cloud/cdk-v2-constructs 6.12.0 → 6.12.2

package/docs/API.md

@@ -1983,6 +1983,8 @@ Default priority of a monitor.
 
 ### DatadogSharedSecret <a name="DatadogSharedSecret" id="@rio-cloud/cdk-v2-constructs.datadogv2.DatadogSharedSecret"></a>
 
+- *Implements:* aws-cdk-lib.aws_secretsmanager.ISecret
+
 A custom resource that resolves the secret ARN based on the organization ID.
 
 #### Methods <a name="Methods" id="Methods"></a>
@@ -1990,6 +1992,14 @@ A custom resource that resolves the secret ARN based on the organization ID.
 | **Name** | **Description** |
 | --- | --- |
 | <code><a href="#@rio-cloud/cdk-v2-constructs.datadogv2.DatadogSharedSecret.toString">toString</a></code> | Returns a string representation of this construct. |
+| <code><a href="#@rio-cloud/cdk-v2-constructs.datadogv2.DatadogSharedSecret.addRotationSchedule">addRotationSchedule</a></code> | Adds a rotation schedule to the secret. |
+| <code><a href="#@rio-cloud/cdk-v2-constructs.datadogv2.DatadogSharedSecret.addToResourcePolicy">addToResourcePolicy</a></code> | Adds a statement to the IAM resource policy associated with this secret. |
+| <code><a href="#@rio-cloud/cdk-v2-constructs.datadogv2.DatadogSharedSecret.applyRemovalPolicy">applyRemovalPolicy</a></code> | Apply the given removal policy to this resource. |
+| <code><a href="#@rio-cloud/cdk-v2-constructs.datadogv2.DatadogSharedSecret.attach">attach</a></code> | Attach a target to this secret. |
+| <code><a href="#@rio-cloud/cdk-v2-constructs.datadogv2.DatadogSharedSecret.denyAccountRootDelete">denyAccountRootDelete</a></code> | Denies the `DeleteSecret` action to all principals within the current account. |
+| <code><a href="#@rio-cloud/cdk-v2-constructs.datadogv2.DatadogSharedSecret.grantRead">grantRead</a></code> | Grants reading the secret value to some role. |
+| <code><a href="#@rio-cloud/cdk-v2-constructs.datadogv2.DatadogSharedSecret.grantWrite">grantWrite</a></code> | Grants writing and updating the secret value to some role. |
+| <code><a href="#@rio-cloud/cdk-v2-constructs.datadogv2.DatadogSharedSecret.secretValueFromJson">secretValueFromJson</a></code> | Interpret the secret as a JSON object and return a field's value from it as a `SecretValue`. |
 
 ---
 
@@ -2001,6 +2011,136 @@ public toString(): string
 
 Returns a string representation of this construct.
 
+##### `addRotationSchedule` <a name="addRotationSchedule" id="@rio-cloud/cdk-v2-constructs.datadogv2.DatadogSharedSecret.addRotationSchedule"></a>
+
+```typescript
+public addRotationSchedule(_id: string, _options: RotationScheduleOptions): RotationSchedule
+```
+
+Adds a rotation schedule to the secret.
+
+###### `_id`<sup>Required</sup> <a name="_id" id="@rio-cloud/cdk-v2-constructs.datadogv2.DatadogSharedSecret.addRotationSchedule.parameter._id"></a>
+
+- *Type:* string
+
+---
+
+###### `_options`<sup>Required</sup> <a name="_options" id="@rio-cloud/cdk-v2-constructs.datadogv2.DatadogSharedSecret.addRotationSchedule.parameter._options"></a>
+
+- *Type:* aws-cdk-lib.aws_secretsmanager.RotationScheduleOptions
+
+---
+
+##### `addToResourcePolicy` <a name="addToResourcePolicy" id="@rio-cloud/cdk-v2-constructs.datadogv2.DatadogSharedSecret.addToResourcePolicy"></a>
+
+```typescript
+public addToResourcePolicy(_statement: PolicyStatement): AddToResourcePolicyResult
+```
+
+Adds a statement to the IAM resource policy associated with this secret.
+
+If this secret was created in this stack, a resource policy will be
+automatically created upon the first call to `addToResourcePolicy`. If
+the secret is imported, then this is a no-op.
+
+###### `_statement`<sup>Required</sup> <a name="_statement" id="@rio-cloud/cdk-v2-constructs.datadogv2.DatadogSharedSecret.addToResourcePolicy.parameter._statement"></a>
+
+- *Type:* aws-cdk-lib.aws_iam.PolicyStatement
+
+---
+
+##### `applyRemovalPolicy` <a name="applyRemovalPolicy" id="@rio-cloud/cdk-v2-constructs.datadogv2.DatadogSharedSecret.applyRemovalPolicy"></a>
+
+```typescript
+public applyRemovalPolicy(_policy: RemovalPolicy): void
+```
+
+Apply the given removal policy to this resource.
+
+The Removal Policy controls what happens to this resource when it stops
+being managed by CloudFormation, either because you've removed it from the
+CDK application or because you've made a change that requires the resource
+to be replaced.
+
+The resource can be deleted (`RemovalPolicy.DESTROY`), or left in your AWS
+account for data recovery and cleanup later (`RemovalPolicy.RETAIN`).
+
+###### `_policy`<sup>Required</sup> <a name="_policy" id="@rio-cloud/cdk-v2-constructs.datadogv2.DatadogSharedSecret.applyRemovalPolicy.parameter._policy"></a>
+
+- *Type:* aws-cdk-lib.RemovalPolicy
+
+---
+
+##### `attach` <a name="attach" id="@rio-cloud/cdk-v2-constructs.datadogv2.DatadogSharedSecret.attach"></a>
+
+```typescript
+public attach(_target: ISecretAttachmentTarget): ISecret
+```
+
+Attach a target to this secret.
+
+###### `_target`<sup>Required</sup> <a name="_target" id="@rio-cloud/cdk-v2-constructs.datadogv2.DatadogSharedSecret.attach.parameter._target"></a>
+
+- *Type:* aws-cdk-lib.aws_secretsmanager.ISecretAttachmentTarget
+
+---
+
+##### `denyAccountRootDelete` <a name="denyAccountRootDelete" id="@rio-cloud/cdk-v2-constructs.datadogv2.DatadogSharedSecret.denyAccountRootDelete"></a>
+
+```typescript
+public denyAccountRootDelete(): void
+```
+
+Denies the `DeleteSecret` action to all principals within the current account.
+
+##### `grantRead` <a name="grantRead" id="@rio-cloud/cdk-v2-constructs.datadogv2.DatadogSharedSecret.grantRead"></a>
+
+```typescript
+public grantRead(grantee: IGrantable, versionStages?: string[]): Grant
+```
+
+Grants reading the secret value to some role.
+
+###### `grantee`<sup>Required</sup> <a name="grantee" id="@rio-cloud/cdk-v2-constructs.datadogv2.DatadogSharedSecret.grantRead.parameter.grantee"></a>
+
+- *Type:* aws-cdk-lib.aws_iam.IGrantable
+
+---
+
+###### `versionStages`<sup>Optional</sup> <a name="versionStages" id="@rio-cloud/cdk-v2-constructs.datadogv2.DatadogSharedSecret.grantRead.parameter.versionStages"></a>
+
+- *Type:* string[]
+
+---
+
+##### `grantWrite` <a name="grantWrite" id="@rio-cloud/cdk-v2-constructs.datadogv2.DatadogSharedSecret.grantWrite"></a>
+
+```typescript
+public grantWrite(_grantee: IGrantable): Grant
+```
+
+Grants writing and updating the secret value to some role.
+
+###### `_grantee`<sup>Required</sup> <a name="_grantee" id="@rio-cloud/cdk-v2-constructs.datadogv2.DatadogSharedSecret.grantWrite.parameter._grantee"></a>
+
+- *Type:* aws-cdk-lib.aws_iam.IGrantable
+
+---
+
+##### `secretValueFromJson` <a name="secretValueFromJson" id="@rio-cloud/cdk-v2-constructs.datadogv2.DatadogSharedSecret.secretValueFromJson"></a>
+
+```typescript
+public secretValueFromJson(key: string): SecretValue
+```
+
+Interpret the secret as a JSON object and return a field's value from it as a `SecretValue`.
+
+###### `key`<sup>Required</sup> <a name="key" id="@rio-cloud/cdk-v2-constructs.datadogv2.DatadogSharedSecret.secretValueFromJson.parameter.key"></a>
+
+- *Type:* string
+
+---
+
 #### Static Functions <a name="Static Functions" id="Static Functions"></a>
 
 | **Name** | **Description** |
@@ -2092,7 +2232,13 @@ This static function resolves to the json credentials secret that contains ['Api
 | **Name** | **Type** | **Description** |
 | --- | --- | --- |
 | <code><a href="#@rio-cloud/cdk-v2-constructs.datadogv2.DatadogSharedSecret.property.node">node</a></code> | <code>constructs.Node</code> | The tree node. |
-| <code><a href="#@rio-cloud/cdk-v2-constructs.datadogv2.DatadogSharedSecret.property.secret">secret</a></code> | <code>aws-cdk-lib.aws_secretsmanager.ISecret</code> | *No description.* |
+| <code><a href="#@rio-cloud/cdk-v2-constructs.datadogv2.DatadogSharedSecret.property.env">env</a></code> | <code>aws-cdk-lib.ResourceEnvironment</code> | The environment this resource belongs to. |
+| <code><a href="#@rio-cloud/cdk-v2-constructs.datadogv2.DatadogSharedSecret.property.secretArn">secretArn</a></code> | <code>string</code> | The ARN of the secret in AWS Secrets Manager. |
+| <code><a href="#@rio-cloud/cdk-v2-constructs.datadogv2.DatadogSharedSecret.property.secretName">secretName</a></code> | <code>string</code> | The name of the secret. |
+| <code><a href="#@rio-cloud/cdk-v2-constructs.datadogv2.DatadogSharedSecret.property.secretValue">secretValue</a></code> | <code>aws-cdk-lib.SecretValue</code> | Retrieve the value of the stored secret as a `SecretValue`. |
+| <code><a href="#@rio-cloud/cdk-v2-constructs.datadogv2.DatadogSharedSecret.property.stack">stack</a></code> | <code>aws-cdk-lib.Stack</code> | The stack in which this resource is defined. |
+| <code><a href="#@rio-cloud/cdk-v2-constructs.datadogv2.DatadogSharedSecret.property.encryptionKey">encryptionKey</a></code> | <code>aws-cdk-lib.aws_kms.IKey</code> | The customer-managed encryption key that is used to encrypt this secret, if any. |
+| <code><a href="#@rio-cloud/cdk-v2-constructs.datadogv2.DatadogSharedSecret.property.secretFullArn">secretFullArn</a></code> | <code>string</code> | The full ARN of the secret in AWS Secrets Manager, which is the ARN including the Secrets Manager-supplied 6-character suffix. |
 
 ---
 
@@ -2108,13 +2254,105 @@ The tree node.
 
 ---
 
-##### `secret`<sup>Required</sup> <a name="secret" id="@rio-cloud/cdk-v2-constructs.datadogv2.DatadogSharedSecret.property.secret"></a>
+##### `env`<sup>Required</sup> <a name="env" id="@rio-cloud/cdk-v2-constructs.datadogv2.DatadogSharedSecret.property.env"></a>
 
 ```typescript
-public readonly secret: ISecret;
+public readonly env: ResourceEnvironment;
 ```
 
-- *Type:* aws-cdk-lib.aws_secretsmanager.ISecret
+- *Type:* aws-cdk-lib.ResourceEnvironment
+
+The environment this resource belongs to.
+
+For resources that are created and managed by the CDK
+(generally, those created by creating new class instances like Role, Bucket, etc.),
+this is always the same as the environment of the stack they belong to;
+however, for imported resources
+(those obtained from static methods like fromRoleArn, fromBucketName, etc.),
+that might be different than the stack they were imported into.
+
+---
+
+##### `secretArn`<sup>Required</sup> <a name="secretArn" id="@rio-cloud/cdk-v2-constructs.datadogv2.DatadogSharedSecret.property.secretArn"></a>
+
+```typescript
+public readonly secretArn: string;
+```
+
+- *Type:* string
+
+The ARN of the secret in AWS Secrets Manager.
+
+Will return the full ARN if available, otherwise a partial arn.
+For secrets imported by the deprecated `fromSecretName`, it will return the `secretName`.
+
+---
+
+##### `secretName`<sup>Required</sup> <a name="secretName" id="@rio-cloud/cdk-v2-constructs.datadogv2.DatadogSharedSecret.property.secretName"></a>
+
+```typescript
+public readonly secretName: string;
+```
+
+- *Type:* string
+
+The name of the secret.
+
+For "owned" secrets, this will be the full resource name (secret name + suffix), unless the
+'@aws-cdk/aws-secretsmanager:parseOwnedSecretName' feature flag is set.
+
+---
+
+##### `secretValue`<sup>Required</sup> <a name="secretValue" id="@rio-cloud/cdk-v2-constructs.datadogv2.DatadogSharedSecret.property.secretValue"></a>
+
+```typescript
+public readonly secretValue: SecretValue;
+```
+
+- *Type:* aws-cdk-lib.SecretValue
+
+Retrieve the value of the stored secret as a `SecretValue`.
+
+---
+
+##### `stack`<sup>Required</sup> <a name="stack" id="@rio-cloud/cdk-v2-constructs.datadogv2.DatadogSharedSecret.property.stack"></a>
+
+```typescript
+public readonly stack: Stack;
+```
+
+- *Type:* aws-cdk-lib.Stack
+
+The stack in which this resource is defined.
+
+---
+
+##### `encryptionKey`<sup>Optional</sup> <a name="encryptionKey" id="@rio-cloud/cdk-v2-constructs.datadogv2.DatadogSharedSecret.property.encryptionKey"></a>
+
+```typescript
+public readonly encryptionKey: IKey;
+```
+
+- *Type:* aws-cdk-lib.aws_kms.IKey
+
+The customer-managed encryption key that is used to encrypt this secret, if any.
+
+When not specified, the default
+KMS key for the account and region is being used.
+
+---
+
+##### `secretFullArn`<sup>Optional</sup> <a name="secretFullArn" id="@rio-cloud/cdk-v2-constructs.datadogv2.DatadogSharedSecret.property.secretFullArn"></a>
+
+```typescript
+public readonly secretFullArn: string;
+```
+
+- *Type:* string
+
+The full ARN of the secret in AWS Secrets Manager, which is the ARN including the Secrets Manager-supplied 6-character suffix.
+
+This is equal to `secretArn` in most cases, but is undefined when a full ARN is not available (e.g., secrets imported by name).
 
 ---
 
@@ -4616,7 +4854,7 @@ public readonly mainCodebuildProject: CodeBuildStep;
 
 A Construct which creates a default cloudfront distribution using a s3 bucket as origin.
 
-Intended for delivery of html documents. It sets some defaults a recommended by AWS and provides basic security header.
+Intended for delivery of html documents. It sets some defaults a recommended by AWS and provides CSP settings.
 
 #### Initializers <a name="Initializers" id="@rio-cloud/cdk-v2-constructs.RioCloudfrontDistribution.Initializer"></a>
 
@@ -9034,6 +9272,386 @@ The secret environment variables to pass to the container.
 
 ---
 
+### CspConfig <a name="CspConfig" id="@rio-cloud/cdk-v2-constructs.CspConfig"></a>
+
+#### Initializer <a name="Initializer" id="@rio-cloud/cdk-v2-constructs.CspConfig.Initializer"></a>
+
+```typescript
+import { CspConfig } from '@rio-cloud/cdk-v2-constructs'
+
+const cspConfig: CspConfig = { ... }
+```
+
+#### Properties <a name="Properties" id="Properties"></a>
+
+| **Name** | **Type** | **Description** |
+| --- | --- | --- |
+| <code><a href="#@rio-cloud/cdk-v2-constructs.CspConfig.property.configCat">configCat</a></code> | <code>boolean</code> | Include ConfigCat. |
+| <code><a href="#@rio-cloud/cdk-v2-constructs.CspConfig.property.customDirectives">customDirectives</a></code> | <code><a href="#@rio-cloud/cdk-v2-constructs.CspDirectives">CspDirectives</a></code> | You can define custom values for any CSP directive with this. |
+| <code><a href="#@rio-cloud/cdk-v2-constructs.CspConfig.property.datadog">datadog</a></code> | <code>boolean</code> | Include Datadog. |
+| <code><a href="#@rio-cloud/cdk-v2-constructs.CspConfig.property.googleAnalytics">googleAnalytics</a></code> | <code>boolean</code> | Include Google Analytics / Google Tag manager. |
+| <code><a href="#@rio-cloud/cdk-v2-constructs.CspConfig.property.here">here</a></code> | <code>boolean</code> | Include Here Maps. |
+| <code><a href="#@rio-cloud/cdk-v2-constructs.CspConfig.property.logOutput">logOutput</a></code> | <code>boolean</code> | Prints the generated CSP to the console. |
+| <code><a href="#@rio-cloud/cdk-v2-constructs.CspConfig.property.sentry">sentry</a></code> | <code>boolean</code> | Include Sentry. |
+| <code><a href="#@rio-cloud/cdk-v2-constructs.CspConfig.property.split">split</a></code> | <code>boolean</code> | Include Split.io. |
+
+---
+
+##### `configCat`<sup>Optional</sup> <a name="configCat" id="@rio-cloud/cdk-v2-constructs.CspConfig.property.configCat"></a>
+
+```typescript
+public readonly configCat: boolean;
+```
+
+- *Type:* boolean
+
+Include ConfigCat.
+
+---
+
+##### `customDirectives`<sup>Optional</sup> <a name="customDirectives" id="@rio-cloud/cdk-v2-constructs.CspConfig.property.customDirectives"></a>
+
+```typescript
+public readonly customDirectives: CspDirectives;
+```
+
+- *Type:* <a href="#@rio-cloud/cdk-v2-constructs.CspDirectives">CspDirectives</a>
+
+You can define custom values for any CSP directive with this.
+
+---
+
+##### `datadog`<sup>Optional</sup> <a name="datadog" id="@rio-cloud/cdk-v2-constructs.CspConfig.property.datadog"></a>
+
+```typescript
+public readonly datadog: boolean;
+```
+
+- *Type:* boolean
+
+Include Datadog.
+
+---
+
+##### `googleAnalytics`<sup>Optional</sup> <a name="googleAnalytics" id="@rio-cloud/cdk-v2-constructs.CspConfig.property.googleAnalytics"></a>
+
+```typescript
+public readonly googleAnalytics: boolean;
+```
+
+- *Type:* boolean
+
+Include Google Analytics / Google Tag manager.
+
+---
+
+##### `here`<sup>Optional</sup> <a name="here" id="@rio-cloud/cdk-v2-constructs.CspConfig.property.here"></a>
+
+```typescript
+public readonly here: boolean;
+```
+
+- *Type:* boolean
+
+Include Here Maps.
+
+---
+
+##### `logOutput`<sup>Optional</sup> <a name="logOutput" id="@rio-cloud/cdk-v2-constructs.CspConfig.property.logOutput"></a>
+
+```typescript
+public readonly logOutput: boolean;
+```
+
+- *Type:* boolean
+
+Prints the generated CSP to the console.
+
+---
+
+##### `sentry`<sup>Optional</sup> <a name="sentry" id="@rio-cloud/cdk-v2-constructs.CspConfig.property.sentry"></a>
+
+```typescript
+public readonly sentry: boolean;
+```
+
+- *Type:* boolean
+
+Include Sentry.
+
+---
+
+##### `split`<sup>Optional</sup> <a name="split" id="@rio-cloud/cdk-v2-constructs.CspConfig.property.split"></a>
+
+```typescript
+public readonly split: boolean;
+```
+
+- *Type:* boolean
+
+Include Split.io.
+
+---
+
+### CspDirectives <a name="CspDirectives" id="@rio-cloud/cdk-v2-constructs.CspDirectives"></a>
+
+#### Initializer <a name="Initializer" id="@rio-cloud/cdk-v2-constructs.CspDirectives.Initializer"></a>
+
+```typescript
+import { CspDirectives } from '@rio-cloud/cdk-v2-constructs'
+
+const cspDirectives: CspDirectives = { ... }
+```
+
+#### Properties <a name="Properties" id="Properties"></a>
+
+| **Name** | **Type** | **Description** |
+| --- | --- | --- |
+| <code><a href="#@rio-cloud/cdk-v2-constructs.CspDirectives.property.baseUri">baseUri</a></code> | <code>string[]</code> | *No description.* |
+| <code><a href="#@rio-cloud/cdk-v2-constructs.CspDirectives.property.childSrc">childSrc</a></code> | <code>string[]</code> | *No description.* |
+| <code><a href="#@rio-cloud/cdk-v2-constructs.CspDirectives.property.connectSrc">connectSrc</a></code> | <code>string[]</code> | *No description.* |
+| <code><a href="#@rio-cloud/cdk-v2-constructs.CspDirectives.property.defaultSrc">defaultSrc</a></code> | <code>string[]</code> | *No description.* |
+| <code><a href="#@rio-cloud/cdk-v2-constructs.CspDirectives.property.fontSrc">fontSrc</a></code> | <code>string[]</code> | *No description.* |
+| <code><a href="#@rio-cloud/cdk-v2-constructs.CspDirectives.property.formAction">formAction</a></code> | <code>string[]</code> | *No description.* |
+| <code><a href="#@rio-cloud/cdk-v2-constructs.CspDirectives.property.frameAncestors">frameAncestors</a></code> | <code>string[]</code> | *No description.* |
+| <code><a href="#@rio-cloud/cdk-v2-constructs.CspDirectives.property.frameSrc">frameSrc</a></code> | <code>string[]</code> | *No description.* |
+| <code><a href="#@rio-cloud/cdk-v2-constructs.CspDirectives.property.imgSrc">imgSrc</a></code> | <code>string[]</code> | *No description.* |
+| <code><a href="#@rio-cloud/cdk-v2-constructs.CspDirectives.property.manifestSrc">manifestSrc</a></code> | <code>string[]</code> | *No description.* |
+| <code><a href="#@rio-cloud/cdk-v2-constructs.CspDirectives.property.mediaSrc">mediaSrc</a></code> | <code>string[]</code> | *No description.* |
+| <code><a href="#@rio-cloud/cdk-v2-constructs.CspDirectives.property.objectSrc">objectSrc</a></code> | <code>string[]</code> | *No description.* |
+| <code><a href="#@rio-cloud/cdk-v2-constructs.CspDirectives.property.reportTo">reportTo</a></code> | <code>string[]</code> | *No description.* |
+| <code><a href="#@rio-cloud/cdk-v2-constructs.CspDirectives.property.sandbox">sandbox</a></code> | <code>string[]</code> | *No description.* |
+| <code><a href="#@rio-cloud/cdk-v2-constructs.CspDirectives.property.scriptSrc">scriptSrc</a></code> | <code>string[]</code> | *No description.* |
+| <code><a href="#@rio-cloud/cdk-v2-constructs.CspDirectives.property.scriptSrcAttr">scriptSrcAttr</a></code> | <code>string[]</code> | *No description.* |
+| <code><a href="#@rio-cloud/cdk-v2-constructs.CspDirectives.property.scriptSrcElem">scriptSrcElem</a></code> | <code>string[]</code> | *No description.* |
+| <code><a href="#@rio-cloud/cdk-v2-constructs.CspDirectives.property.styleSrc">styleSrc</a></code> | <code>string[]</code> | *No description.* |
+| <code><a href="#@rio-cloud/cdk-v2-constructs.CspDirectives.property.styleSrcAttr">styleSrcAttr</a></code> | <code>string[]</code> | *No description.* |
+| <code><a href="#@rio-cloud/cdk-v2-constructs.CspDirectives.property.styleSrcElem">styleSrcElem</a></code> | <code>string[]</code> | *No description.* |
+| <code><a href="#@rio-cloud/cdk-v2-constructs.CspDirectives.property.upgradeInsecureRequests">upgradeInsecureRequests</a></code> | <code>string[]</code> | *No description.* |
+| <code><a href="#@rio-cloud/cdk-v2-constructs.CspDirectives.property.workerSrc">workerSrc</a></code> | <code>string[]</code> | *No description.* |
+
+---
+
+##### `baseUri`<sup>Optional</sup> <a name="baseUri" id="@rio-cloud/cdk-v2-constructs.CspDirectives.property.baseUri"></a>
+
+```typescript
+public readonly baseUri: string[];
+```
+
+- *Type:* string[]
+
+---
+
+##### `childSrc`<sup>Optional</sup> <a name="childSrc" id="@rio-cloud/cdk-v2-constructs.CspDirectives.property.childSrc"></a>
+
+```typescript
+public readonly childSrc: string[];
+```
+
+- *Type:* string[]
+
+---
+
+##### `connectSrc`<sup>Optional</sup> <a name="connectSrc" id="@rio-cloud/cdk-v2-constructs.CspDirectives.property.connectSrc"></a>
+
+```typescript
+public readonly connectSrc: string[];
+```
+
+- *Type:* string[]
+
+---
+
+##### `defaultSrc`<sup>Optional</sup> <a name="defaultSrc" id="@rio-cloud/cdk-v2-constructs.CspDirectives.property.defaultSrc"></a>
+
+```typescript
+public readonly defaultSrc: string[];
+```
+
+- *Type:* string[]
+
+---
+
+##### `fontSrc`<sup>Optional</sup> <a name="fontSrc" id="@rio-cloud/cdk-v2-constructs.CspDirectives.property.fontSrc"></a>
+
+```typescript
+public readonly fontSrc: string[];
+```
+
+- *Type:* string[]
+
+---
+
+##### `formAction`<sup>Optional</sup> <a name="formAction" id="@rio-cloud/cdk-v2-constructs.CspDirectives.property.formAction"></a>
+
+```typescript
+public readonly formAction: string[];
+```
+
+- *Type:* string[]
+
+---
+
+##### `frameAncestors`<sup>Optional</sup> <a name="frameAncestors" id="@rio-cloud/cdk-v2-constructs.CspDirectives.property.frameAncestors"></a>
+
+```typescript
+public readonly frameAncestors: string[];
+```
+
+- *Type:* string[]
+
+---
+
+##### `frameSrc`<sup>Optional</sup> <a name="frameSrc" id="@rio-cloud/cdk-v2-constructs.CspDirectives.property.frameSrc"></a>
+
+```typescript
+public readonly frameSrc: string[];
+```
+
+- *Type:* string[]
+
+---
+
+##### `imgSrc`<sup>Optional</sup> <a name="imgSrc" id="@rio-cloud/cdk-v2-constructs.CspDirectives.property.imgSrc"></a>
+
+```typescript
+public readonly imgSrc: string[];
+```
+
+- *Type:* string[]
+
+---
+
+##### `manifestSrc`<sup>Optional</sup> <a name="manifestSrc" id="@rio-cloud/cdk-v2-constructs.CspDirectives.property.manifestSrc"></a>
+
+```typescript
+public readonly manifestSrc: string[];
+```
+
+- *Type:* string[]
+
+---
+
+##### `mediaSrc`<sup>Optional</sup> <a name="mediaSrc" id="@rio-cloud/cdk-v2-constructs.CspDirectives.property.mediaSrc"></a>
+
+```typescript
+public readonly mediaSrc: string[];
+```
+
+- *Type:* string[]
+
+---
+
+##### `objectSrc`<sup>Optional</sup> <a name="objectSrc" id="@rio-cloud/cdk-v2-constructs.CspDirectives.property.objectSrc"></a>
+
+```typescript
+public readonly objectSrc: string[];
+```
+
+- *Type:* string[]
+
+---
+
+##### `reportTo`<sup>Optional</sup> <a name="reportTo" id="@rio-cloud/cdk-v2-constructs.CspDirectives.property.reportTo"></a>
+
+```typescript
+public readonly reportTo: string[];
+```
+
+- *Type:* string[]
+
+---
+
+##### `sandbox`<sup>Optional</sup> <a name="sandbox" id="@rio-cloud/cdk-v2-constructs.CspDirectives.property.sandbox"></a>
+
+```typescript
+public readonly sandbox: string[];
+```
+
+- *Type:* string[]
+
+---
+
+##### `scriptSrc`<sup>Optional</sup> <a name="scriptSrc" id="@rio-cloud/cdk-v2-constructs.CspDirectives.property.scriptSrc"></a>
+
+```typescript
+public readonly scriptSrc: string[];
+```
+
+- *Type:* string[]
+
+---
+
+##### `scriptSrcAttr`<sup>Optional</sup> <a name="scriptSrcAttr" id="@rio-cloud/cdk-v2-constructs.CspDirectives.property.scriptSrcAttr"></a>
+
+```typescript
+public readonly scriptSrcAttr: string[];
+```
+
+- *Type:* string[]
+
+---
+
+##### `scriptSrcElem`<sup>Optional</sup> <a name="scriptSrcElem" id="@rio-cloud/cdk-v2-constructs.CspDirectives.property.scriptSrcElem"></a>
+
+```typescript
+public readonly scriptSrcElem: string[];
+```
+
+- *Type:* string[]
+
+---
+
+##### `styleSrc`<sup>Optional</sup> <a name="styleSrc" id="@rio-cloud/cdk-v2-constructs.CspDirectives.property.styleSrc"></a>
+
+```typescript
+public readonly styleSrc: string[];
+```
+
+- *Type:* string[]
+
+---
+
+##### `styleSrcAttr`<sup>Optional</sup> <a name="styleSrcAttr" id="@rio-cloud/cdk-v2-constructs.CspDirectives.property.styleSrcAttr"></a>
+
+```typescript
+public readonly styleSrcAttr: string[];
+```
+
+- *Type:* string[]
+
+---
+
+##### `styleSrcElem`<sup>Optional</sup> <a name="styleSrcElem" id="@rio-cloud/cdk-v2-constructs.CspDirectives.property.styleSrcElem"></a>
+
+```typescript
+public readonly styleSrcElem: string[];
+```
+
+- *Type:* string[]
+
+---
+
+##### `upgradeInsecureRequests`<sup>Optional</sup> <a name="upgradeInsecureRequests" id="@rio-cloud/cdk-v2-constructs.CspDirectives.property.upgradeInsecureRequests"></a>
+
+```typescript
+public readonly upgradeInsecureRequests: string[];
+```
+
+- *Type:* string[]
+
+---
+
+##### `workerSrc`<sup>Optional</sup> <a name="workerSrc" id="@rio-cloud/cdk-v2-constructs.CspDirectives.property.workerSrc"></a>
+
+```typescript
+public readonly workerSrc: string[];
+```
+
+- *Type:* string[]
+
+---
+
 ### DatadogDashboardProps <a name="DatadogDashboardProps" id="@rio-cloud/cdk-v2-constructs.datadogv2.DatadogDashboardProps"></a>
 
 #### Initializer <a name="Initializer" id="@rio-cloud/cdk-v2-constructs.datadogv2.DatadogDashboardProps.Initializer"></a>
@@ -14061,6 +14679,7 @@ const rioCloudfrontDistributionProps: RioCloudfrontDistributionProps = { ... }
 | --- | --- | --- |
 | <code><a href="#@rio-cloud/cdk-v2-constructs.RioCloudfrontDistributionProps.property.contentBucketName">contentBucketName</a></code> | <code>string</code> | The reference to the S3 bucket containing the files to serve. |
 | <code><a href="#@rio-cloud/cdk-v2-constructs.RioCloudfrontDistributionProps.property.contentSecurityPolicy">contentSecurityPolicy</a></code> | <code>string</code> | The content Security Policy to be sent as a header when delivering the bucket content. |
+| <code><a href="#@rio-cloud/cdk-v2-constructs.RioCloudfrontDistributionProps.property.cspConfig">cspConfig</a></code> | <code><a href="#@rio-cloud/cdk-v2-constructs.CspConfig">CspConfig</a></code> | Allows declaratively defining your desired CSP. |
 | <code><a href="#@rio-cloud/cdk-v2-constructs.RioCloudfrontDistributionProps.property.functionAssociations">functionAssociations</a></code> | <code>aws-cdk-lib.aws_cloudfront.FunctionAssociation[]</code> | The list of functions to be associated with the default behaviour of the distribution. |
 | <code><a href="#@rio-cloud/cdk-v2-constructs.RioCloudfrontDistributionProps.property.hostedZone">hostedZone</a></code> | <code>aws-cdk-lib.aws_route53.IHostedZone</code> | The hosted zone of the domain under which the content will be served. |
 | <code><a href="#@rio-cloud/cdk-v2-constructs.RioCloudfrontDistributionProps.property.subDomain">subDomain</a></code> | <code>string</code> | The subdomain where the content should be served. |
@@ -14079,7 +14698,9 @@ The reference to the S3 bucket containing the files to serve.
 
 ---
 
-##### `contentSecurityPolicy`<sup>Optional</sup> <a name="contentSecurityPolicy" id="@rio-cloud/cdk-v2-constructs.RioCloudfrontDistributionProps.property.contentSecurityPolicy"></a>
+##### ~~`contentSecurityPolicy`~~<sup>Optional</sup> <a name="contentSecurityPolicy" id="@rio-cloud/cdk-v2-constructs.RioCloudfrontDistributionProps.property.contentSecurityPolicy"></a>
+
+- *Deprecated:* Please use the declarative CSP config instead. See {@link cspConfig }.
 
 ```typescript
 public readonly contentSecurityPolicy: string;
@@ -14089,12 +14710,27 @@ public readonly contentSecurityPolicy: string;
 
 The content Security Policy to be sent as a header when delivering the bucket content.
 
-If not set, a rio Default will be used. The default should cover connections to split.io, sentry and datadog,
-as well as a hash to support google tagManger. The latter might need to be adapted if you change the minification of
+If not set, a rio Default will be used. The default should cover connections to split.io, sentry and datadog, as
+well as a hash to support google tagManger. The latter might need to be adapted if you change the minification of
 the index.html, in which case you can provide your csp here.
 
 ---
 
+##### `cspConfig`<sup>Optional</sup> <a name="cspConfig" id="@rio-cloud/cdk-v2-constructs.RioCloudfrontDistributionProps.property.cspConfig"></a>
+
+```typescript
+public readonly cspConfig: CspConfig;
+```
+
+- *Type:* <a href="#@rio-cloud/cdk-v2-constructs.CspConfig">CspConfig</a>
+
+Allows declaratively defining your desired CSP.
+
+The RIO defaults are always included, and you can choose which services you want to include (e.g. ConfigCat) or
+not. You can also provide custom directives / values using the "custom" key.
+
+---
+
 ##### `functionAssociations`<sup>Optional</sup> <a name="functionAssociations" id="@rio-cloud/cdk-v2-constructs.RioCloudfrontDistributionProps.property.functionAssociations"></a>
 
 ```typescript
@@ -14119,8 +14755,7 @@ public readonly hostedZone: IHostedZone;
 
 The hosted zone of the domain under which the content will be served.
 
-If not given, the default hosted Zone
-provided by RIO setup will be used.
+If not given, the default hosted Zone provided by RIO setup will be used.
 
 ---
 
@@ -14134,8 +14769,8 @@ public readonly subDomain: string;
 
 The subdomain where the content should be served.
 
-If not given, an empty string, i.e. no subDomain will be used.
-Instead, the name of the hosted zone will be used directly.
+If not given, an empty string, i.e. no subDomain will be used. Instead, the name of the hosted zone will be used
+directly.
 
 ---