aws-cdk 2.1119.0 → 2.1121.0

package/build-info.json

@@ -1,4 +1,4 @@
 {
-  "comment": "Generated at 2026-04-23T07:33:57Z by generate.sh",
-  "commit": "820ac02"
+  "comment": "Generated at 2026-05-06T11:55:43Z by generate.sh",
+  "commit": "7abdd4e"
 }

package/lib/api/bootstrap/bootstrap-template.yaml

@@ -624,14 +624,11 @@ Resources:
       Policies:
         - PolicyDocument:
             Statement:
-              - Sid: CloudFormationPermissions
+              - Sid: DeployPermissions
                 Effect: Allow
                 Action:
                   - cloudformation:CreateChangeSet
                   - cloudformation:DeleteChangeSet
-                  - cloudformation:DescribeChangeSet
-                  - cloudformation:DescribeStacks
-                  - cloudformation:DescribeEvents
                   - cloudformation:ExecuteChangeSet
                   - cloudformation:CreateStack
                   - cloudformation:UpdateStack
@@ -681,15 +678,9 @@ Resources:
                   # Our CI/CD does not need DeleteStack,
                   # but we also want to use this role from the CLI,
                   # and there you can call `cdk destroy`
-                  - cloudformation:DescribeStackEvents
-                  - cloudformation:GetTemplate
                   - cloudformation:DeleteStack
                   - cloudformation:UpdateTerminationProtection
                   - sts:GetCallerIdentity
-                  # `cdk import`
-                  - cloudformation:GetTemplateSummary
-                  # `cdk deploy` CloudFormation Hook annotation display on hook failure
-                  - cloudformation:GetHookResult
                 Resource: "*"
                 Effect: Allow
               - Sid: CliStagingBucket
@@ -713,14 +704,12 @@ Resources:
                 Action:
                   # Permissions needed to use the CDK CLI with stack refactor
                   - cloudformation:CreateStackRefactor
-                  - cloudformation:DescribeStackRefactor
                   - cloudformation:ExecuteStackRefactor
-                  - cloudformation:ListStackRefactorActions
-                  - cloudformation:ListStackRefactors
-                  - cloudformation:ListStacks
                 Resource: "*"
             Version: '2012-10-17'
           PolicyName: default
+      ManagedPolicyArns:
+        - Fn::Sub: "arn:${AWS::Partition}:iam::aws:policy/AWSCloudFormationReadOnlyAccess"
       RoleName:
         Fn::Sub: cdk-${Qualifier}-deploy-role-${AWS::AccountId}-${AWS::Region}
       Tags:
@@ -817,7 +806,7 @@ Resources:
       Name:
         Fn::Sub: '/cdk-bootstrap/${Qualifier}/version'
       # Also update this value below (see comment there)
-      Value: '31'
+      Value: '32'
 Outputs:
   BucketName:
     Description: The name of the S3 bucket owned by the CDK toolkit stack
@@ -852,4 +841,4 @@ Outputs:
     # {Fn::GetAtt} on an SSM Parameter is eventually consistent, and can fail with "parameter
     # doesn't exist" even after just having been created. To reduce our deploy failure rate, we
     # duplicate the value here and use a build-time test to ensure the two values are the same.
-    Value: '31'
+    Value: '32'

package/lib/api/index.d.ts

@@ -9,6 +9,7 @@ export * from '../../../@aws-cdk/toolkit-lib/lib/api/diff';
 export * from '../../../@aws-cdk/toolkit-lib/lib/api/io';
 export * from '../../../@aws-cdk/toolkit-lib/lib/api/logs-monitor';
 export * from '../../../@aws-cdk/toolkit-lib/lib/api/resource-import';
+export * from '../../../@aws-cdk/toolkit-lib/lib/api/orphan/orphaner';
 export { RWLock, type IReadLock } from '../../../@aws-cdk/toolkit-lib/lib/api/rwlock';
 export * from '../../../@aws-cdk/toolkit-lib/lib/api/toolkit-info';
 export { loadTree, some } from '../../../@aws-cdk/toolkit-lib/lib/api/tree';

package/lib/api/index.js

@@ -27,6 +27,7 @@ __exportStar(require("../../../@aws-cdk/toolkit-lib/lib/api/diff"), exports);
 __exportStar(require("../../../@aws-cdk/toolkit-lib/lib/api/io"), exports);
 __exportStar(require("../../../@aws-cdk/toolkit-lib/lib/api/logs-monitor"), exports);
 __exportStar(require("../../../@aws-cdk/toolkit-lib/lib/api/resource-import"), exports);
+__exportStar(require("../../../@aws-cdk/toolkit-lib/lib/api/orphan/orphaner"), exports);
 var rwlock_1 = require("../../../@aws-cdk/toolkit-lib/lib/api/rwlock");
 Object.defineProperty(exports, "RWLock", { enumerable: true, get: function () { return rwlock_1.RWLock; } });
 __exportStar(require("../../../@aws-cdk/toolkit-lib/lib/api/toolkit-info"), exports);
@@ -35,4 +36,4 @@ Object.defineProperty(exports, "loadTree", { enumerable: true, get: function ()
 Object.defineProperty(exports, "some", { enumerable: true, get: function () { return tree_1.some; } });
 __exportStar(require("../../../@aws-cdk/toolkit-lib/lib/api/work-graph"), exports);
 __exportStar(require("../../../@aws-cdk/toolkit-lib/lib/api/garbage-collection"), exports);
-//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiaW5kZXguanMiLCJzb3VyY2VSb290IjoiIiwic291cmNlcyI6WyJpbmRleC50cyJdLCJuYW1lcyI6W10sIm1hcHBpbmdzIjoiOzs7Ozs7Ozs7Ozs7Ozs7OztBQUFBLGdEQUFnRDtBQUNoRCw4Q0FBNEI7QUFDNUIsbURBQWlDO0FBQ2pDLG1EQUFpQztBQUNqQyxnREFBOEI7QUFDOUIsNkNBQTJCO0FBQzNCLG1EQUFpQztBQUNqQyw0Q0FBMEI7QUFFMUIsNkVBQTJEO0FBQzNELDJFQUF5RDtBQUN6RCxxRkFBbUU7QUFDbkUsd0ZBQXNFO0FBQ3RFLHVFQUFzRjtBQUE3RSxnR0FBQSxNQUFNLE9BQUE7QUFDZixxRkFBbUU7QUFDbkUsbUVBQTRFO0FBQW5FLGdHQUFBLFFBQVEsT0FBQTtBQUFFLDRGQUFBLElBQUksT0FBQTtBQUN2QixtRkFBaUU7QUFDakUsMkZBQXlFIiwic291cmNlc0NvbnRlbnQiOlsiLyogZXNsaW50LWRpc2FibGUgaW1wb3J0L25vLXJlbGF0aXZlLXBhY2thZ2VzICovXG5leHBvcnQgKiBmcm9tICcuL2Jvb3RzdHJhcCc7XG5leHBvcnQgKiBmcm9tICcuL2Nsb3VkZm9ybWF0aW9uJztcbmV4cG9ydCAqIGZyb20gJy4vY2xvdWQtYXNzZW1ibHknO1xuZXhwb3J0ICogZnJvbSAnLi9kZXBsb3ltZW50cyc7XG5leHBvcnQgKiBmcm9tICcuL2F3cy1hdXRoJztcbmV4cG9ydCAqIGZyb20gJy4vY2xvdWQtYXNzZW1ibHknO1xuZXhwb3J0ICogZnJvbSAnLi9ub3RpY2VzJztcblxuZXhwb3J0ICogZnJvbSAnLi4vLi4vLi4vQGF3cy1jZGsvdG9vbGtpdC1saWIvbGliL2FwaS9kaWZmJztcbmV4cG9ydCAqIGZyb20gJy4uLy4uLy4uL0Bhd3MtY2RrL3Rvb2xraXQtbGliL2xpYi9hcGkvaW8nO1xuZXhwb3J0ICogZnJvbSAnLi4vLi4vLi4vQGF3cy1jZGsvdG9vbGtpdC1saWIvbGliL2FwaS9sb2dzLW1vbml0b3InO1xuZXhwb3J0ICogZnJvbSAnLi4vLi4vLi4vQGF3cy1jZGsvdG9vbGtpdC1saWIvbGliL2FwaS9yZXNvdXJjZS1pbXBvcnQnO1xuZXhwb3J0IHsgUldMb2NrLCB0eXBlIElSZWFkTG9jayB9IGZyb20gJy4uLy4uLy4uL0Bhd3MtY2RrL3Rvb2xraXQtbGliL2xpYi9hcGkvcndsb2NrJztcbmV4cG9ydCAqIGZyb20gJy4uLy4uLy4uL0Bhd3MtY2RrL3Rvb2xraXQtbGliL2xpYi9hcGkvdG9vbGtpdC1pbmZvJztcbmV4cG9ydCB7IGxvYWRUcmVlLCBzb21lIH0gZnJvbSAnLi4vLi4vLi4vQGF3cy1jZGsvdG9vbGtpdC1saWIvbGliL2FwaS90cmVlJztcbmV4cG9ydCAqIGZyb20gJy4uLy4uLy4uL0Bhd3MtY2RrL3Rvb2xraXQtbGliL2xpYi9hcGkvd29yay1ncmFwaCc7XG5leHBvcnQgKiBmcm9tICcuLi8uLi8uLi9AYXdzLWNkay90b29sa2l0LWxpYi9saWIvYXBpL2dhcmJhZ2UtY29sbGVjdGlvbic7XG4iXX0=
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiaW5kZXguanMiLCJzb3VyY2VSb290IjoiIiwic291cmNlcyI6WyJpbmRleC50cyJdLCJuYW1lcyI6W10sIm1hcHBpbmdzIjoiOzs7Ozs7Ozs7Ozs7Ozs7OztBQUFBLGdEQUFnRDtBQUNoRCw4Q0FBNEI7QUFDNUIsbURBQWlDO0FBQ2pDLG1EQUFpQztBQUNqQyxnREFBOEI7QUFDOUIsNkNBQTJCO0FBQzNCLG1EQUFpQztBQUNqQyw0Q0FBMEI7QUFFMUIsNkVBQTJEO0FBQzNELDJFQUF5RDtBQUN6RCxxRkFBbUU7QUFDbkUsd0ZBQXNFO0FBQ3RFLHdGQUFzRTtBQUN0RSx1RUFBc0Y7QUFBN0UsZ0dBQUEsTUFBTSxPQUFBO0FBQ2YscUZBQW1FO0FBQ25FLG1FQUE0RTtBQUFuRSxnR0FBQSxRQUFRLE9BQUE7QUFBRSw0RkFBQSxJQUFJLE9BQUE7QUFDdkIsbUZBQWlFO0FBQ2pFLDJGQUF5RSIsInNvdXJjZXNDb250ZW50IjpbIi8qIGVzbGludC1kaXNhYmxlIGltcG9ydC9uby1yZWxhdGl2ZS1wYWNrYWdlcyAqL1xuZXhwb3J0ICogZnJvbSAnLi9ib290c3RyYXAnO1xuZXhwb3J0ICogZnJvbSAnLi9jbG91ZGZvcm1hdGlvbic7XG5leHBvcnQgKiBmcm9tICcuL2Nsb3VkLWFzc2VtYmx5JztcbmV4cG9ydCAqIGZyb20gJy4vZGVwbG95bWVudHMnO1xuZXhwb3J0ICogZnJvbSAnLi9hd3MtYXV0aCc7XG5leHBvcnQgKiBmcm9tICcuL2Nsb3VkLWFzc2VtYmx5JztcbmV4cG9ydCAqIGZyb20gJy4vbm90aWNlcyc7XG5cbmV4cG9ydCAqIGZyb20gJy4uLy4uLy4uL0Bhd3MtY2RrL3Rvb2xraXQtbGliL2xpYi9hcGkvZGlmZic7XG5leHBvcnQgKiBmcm9tICcuLi8uLi8uLi9AYXdzLWNkay90b29sa2l0LWxpYi9saWIvYXBpL2lvJztcbmV4cG9ydCAqIGZyb20gJy4uLy4uLy4uL0Bhd3MtY2RrL3Rvb2xraXQtbGliL2xpYi9hcGkvbG9ncy1tb25pdG9yJztcbmV4cG9ydCAqIGZyb20gJy4uLy4uLy4uL0Bhd3MtY2RrL3Rvb2xraXQtbGliL2xpYi9hcGkvcmVzb3VyY2UtaW1wb3J0JztcbmV4cG9ydCAqIGZyb20gJy4uLy4uLy4uL0Bhd3MtY2RrL3Rvb2xraXQtbGliL2xpYi9hcGkvb3JwaGFuL29ycGhhbmVyJztcbmV4cG9ydCB7IFJXTG9jaywgdHlwZSBJUmVhZExvY2sgfSBmcm9tICcuLi8uLi8uLi9AYXdzLWNkay90b29sa2l0LWxpYi9saWIvYXBpL3J3bG9jayc7XG5leHBvcnQgKiBmcm9tICcuLi8uLi8uLi9AYXdzLWNkay90b29sa2l0LWxpYi9saWIvYXBpL3Rvb2xraXQtaW5mbyc7XG5leHBvcnQgeyBsb2FkVHJlZSwgc29tZSB9IGZyb20gJy4uLy4uLy4uL0Bhd3MtY2RrL3Rvb2xraXQtbGliL2xpYi9hcGkvdHJlZSc7XG5leHBvcnQgKiBmcm9tICcuLi8uLi8uLi9AYXdzLWNkay90b29sa2l0LWxpYi9saWIvYXBpL3dvcmstZ3JhcGgnO1xuZXhwb3J0ICogZnJvbSAnLi4vLi4vLi4vQGF3cy1jZGsvdG9vbGtpdC1saWIvbGliL2FwaS9nYXJiYWdlLWNvbGxlY3Rpb24nO1xuIl19

package/lib/cli/cdk-toolkit.d.ts

@@ -1,5 +1,5 @@
 import { RequireApproval } from '@aws-cdk/cloud-assembly-schema';
-import type { DeploymentMethod, PublishAssetsOptions, ToolkitOptions } from '@aws-cdk/toolkit-lib';
+import type { DeploymentMethod, DiagnoseOptions, PublishAssetsOptions, ToolkitOptions } from '@aws-cdk/toolkit-lib';
 import { Toolkit } from '@aws-cdk/toolkit-lib';
 import { CliIoHost } from './io-host';
 import type { Configuration } from './user-configuration';
@@ -111,12 +111,17 @@ export declare class CdkToolkit {
      * Detect infrastructure drift for the given stack(s)
      */
     drift(options: DriftOptions): Promise<number>;
+    /**
+     * Diagnose errors
+     */
+    diagnose(options: DiagnoseOptions): Promise<number>;
     /**
      * Roll back the given stack or stacks.
      */
     rollback(options: RollbackOptions): Promise<void>;
     publishAssets(options: PublishAssetsOptions): Promise<void>;
     watch(options: WatchOptions): Promise<void>;
+    orphan(options: OrphanOptions): Promise<void>;
     import(options: ImportOptions): Promise<void>;
     destroy(options: DestroyOptions): Promise<void>;
     list(selectors: string[], options?: {
@@ -472,6 +477,11 @@ export interface RollbackOptions {
      */
     readonly validateBootstrapStackVersion?: boolean;
 }
+export interface OrphanOptions {
+    readonly constructPath: string[];
+    readonly roleArn?: string;
+    readonly toolkitStackName?: string;
+}
 export interface ImportOptions extends CfnDeployOptions {
     /**
      * Build a physical resource mapping and write it to the given file, without performing the actual import operation
@@ -485,6 +495,12 @@ export interface ImportOptions extends CfnDeployOptions {
      * @default - No mapping file
      */
     readonly resourceMappingFile?: string;
+    /**
+     * Inline JSON string with the physical resource mapping
+     *
+     * @default - No inline mapping
+     */
+    readonly resourceMappingInline?: string;
     /**
      * Allow non-addition changes to the template
      *