aws-cdk-lib 2.130.0__py3-none-any.whl → 2.131.0__py3-none-any.whl

aws_cdk/aws_datapipeline/__init__.py

@@ -44,11 +44,13 @@ from .. import (
     CfnResource as _CfnResource_9df397a6,
     IInspectable as _IInspectable_c2943556,
     IResolvable as _IResolvable_da3f097b,
+    ITaggableV2 as _ITaggableV2_4e6798f8,
+    TagManager as _TagManager_0a598cb3,
     TreeInspector as _TreeInspector_488e0dd5,
 )
 
 
-@jsii.implements(_IInspectable_c2943556)
+@jsii.implements(_IInspectable_c2943556, _ITaggableV2_4e6798f8)
 class CfnPipeline(
     _CfnResource_9df397a6,
     metaclass=jsii.JSIIMeta,
@@ -125,7 +127,7 @@ class CfnPipeline(
         parameter_objects: typing.Optional[typing.Union[_IResolvable_da3f097b, typing.Sequence[typing.Union[_IResolvable_da3f097b, typing.Union["CfnPipeline.ParameterObjectProperty", typing.Dict[builtins.str, typing.Any]]]]]] = None,
         parameter_values: typing.Optional[typing.Union[_IResolvable_da3f097b, typing.Sequence[typing.Union[_IResolvable_da3f097b, typing.Union["CfnPipeline.ParameterValueProperty", typing.Dict[builtins.str, typing.Any]]]]]] = None,
         pipeline_objects: typing.Optional[typing.Union[_IResolvable_da3f097b, typing.Sequence[typing.Union[_IResolvable_da3f097b, typing.Union["CfnPipeline.PipelineObjectProperty", typing.Dict[builtins.str, typing.Any]]]]]] = None,
-        pipeline_tags: typing.Optional[typing.Union[_IResolvable_da3f097b, typing.Sequence[typing.Union[_IResolvable_da3f097b, typing.Union["CfnPipeline.PipelineTagProperty", typing.Dict[builtins.str, typing.Any]]]]]] = None,
+        pipeline_tags: typing.Optional[typing.Sequence[typing.Union["CfnPipeline.PipelineTagProperty", typing.Dict[builtins.str, typing.Any]]]] = None,
     ) -> None:
         '''
         :param scope: Scope in which this resource is defined.
@@ -201,6 +203,12 @@ class CfnPipeline(
         '''
         return typing.cast(builtins.str, jsii.get(self, "attrPipelineId"))
 
+    @builtins.property
+    @jsii.member(jsii_name="cdkTagManager")
+    def cdk_tag_manager(self) -> _TagManager_0a598cb3:
+        '''Tag Manager which manages the tags for this resource.'''
+        return typing.cast(_TagManager_0a598cb3, jsii.get(self, "cdkTagManager"))
+
     @builtins.property
     @jsii.member(jsii_name="cfnProperties")
     def _cfn_properties(self) -> typing.Mapping[builtins.str, typing.Any]:
@@ -308,14 +316,14 @@ class CfnPipeline(
     @jsii.member(jsii_name="pipelineTags")
     def pipeline_tags(
         self,
-    ) -> typing.Optional[typing.Union[_IResolvable_da3f097b, typing.List[typing.Union[_IResolvable_da3f097b, "CfnPipeline.PipelineTagProperty"]]]]:
+    ) -> typing.Optional[typing.List["CfnPipeline.PipelineTagProperty"]]:
         '''A list of arbitrary tags (key-value pairs) to associate with the pipeline, which you can use to control permissions.'''
-        return typing.cast(typing.Optional[typing.Union[_IResolvable_da3f097b, typing.List[typing.Union[_IResolvable_da3f097b, "CfnPipeline.PipelineTagProperty"]]]], jsii.get(self, "pipelineTags"))
+        return typing.cast(typing.Optional[typing.List["CfnPipeline.PipelineTagProperty"]], jsii.get(self, "pipelineTags"))
 
     @pipeline_tags.setter
     def pipeline_tags(
         self,
-        value: typing.Optional[typing.Union[_IResolvable_da3f097b, typing.List[typing.Union[_IResolvable_da3f097b, "CfnPipeline.PipelineTagProperty"]]]],
+        value: typing.Optional[typing.List["CfnPipeline.PipelineTagProperty"]],
     ) -> None:
         if __debug__:
             type_hints = typing.get_type_hints(_typecheckingstub__1bdff7a2b094eb0859ba59733450f878d0d39b1023848274f462bc883bc2055d)
@@ -827,7 +835,7 @@ class CfnPipelineProps:
         parameter_objects: typing.Optional[typing.Union[_IResolvable_da3f097b, typing.Sequence[typing.Union[_IResolvable_da3f097b, typing.Union[CfnPipeline.ParameterObjectProperty, typing.Dict[builtins.str, typing.Any]]]]]] = None,
         parameter_values: typing.Optional[typing.Union[_IResolvable_da3f097b, typing.Sequence[typing.Union[_IResolvable_da3f097b, typing.Union[CfnPipeline.ParameterValueProperty, typing.Dict[builtins.str, typing.Any]]]]]] = None,
         pipeline_objects: typing.Optional[typing.Union[_IResolvable_da3f097b, typing.Sequence[typing.Union[_IResolvable_da3f097b, typing.Union[CfnPipeline.PipelineObjectProperty, typing.Dict[builtins.str, typing.Any]]]]]] = None,
-        pipeline_tags: typing.Optional[typing.Union[_IResolvable_da3f097b, typing.Sequence[typing.Union[_IResolvable_da3f097b, typing.Union[CfnPipeline.PipelineTagProperty, typing.Dict[builtins.str, typing.Any]]]]]] = None,
+        pipeline_tags: typing.Optional[typing.Sequence[typing.Union[CfnPipeline.PipelineTagProperty, typing.Dict[builtins.str, typing.Any]]]] = None,
     ) -> None:
         '''Properties for defining a ``CfnPipeline``.
 
@@ -977,7 +985,7 @@ class CfnPipelineProps:
     @builtins.property
     def pipeline_tags(
         self,
-    ) -> typing.Optional[typing.Union[_IResolvable_da3f097b, typing.List[typing.Union[_IResolvable_da3f097b, CfnPipeline.PipelineTagProperty]]]]:
+    ) -> typing.Optional[typing.List[CfnPipeline.PipelineTagProperty]]:
         '''A list of arbitrary tags (key-value pairs) to associate with the pipeline, which you can use to control permissions.
 
         For more information, see `Controlling Access to Pipelines and Resources <https://docs.aws.amazon.com/datapipeline/latest/DeveloperGuide/dp-control-access.html>`_ in the *AWS Data Pipeline Developer Guide* .
@@ -985,7 +993,7 @@ class CfnPipelineProps:
         :see: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-datapipeline-pipeline.html#cfn-datapipeline-pipeline-pipelinetags
         '''
         result = self._values.get("pipeline_tags")
-        return typing.cast(typing.Optional[typing.Union[_IResolvable_da3f097b, typing.List[typing.Union[_IResolvable_da3f097b, CfnPipeline.PipelineTagProperty]]]], result)
+        return typing.cast(typing.Optional[typing.List[CfnPipeline.PipelineTagProperty]], result)
 
     def __eq__(self, rhs: typing.Any) -> builtins.bool:
         return isinstance(rhs, self.__class__) and rhs._values == self._values
@@ -1016,7 +1024,7 @@ def _typecheckingstub__234bba6a4e11fe2b9f45dcf4e448e89d2ca6fc1f137ad5c70158dbb94
     parameter_objects: typing.Optional[typing.Union[_IResolvable_da3f097b, typing.Sequence[typing.Union[_IResolvable_da3f097b, typing.Union[CfnPipeline.ParameterObjectProperty, typing.Dict[builtins.str, typing.Any]]]]]] = None,
     parameter_values: typing.Optional[typing.Union[_IResolvable_da3f097b, typing.Sequence[typing.Union[_IResolvable_da3f097b, typing.Union[CfnPipeline.ParameterValueProperty, typing.Dict[builtins.str, typing.Any]]]]]] = None,
     pipeline_objects: typing.Optional[typing.Union[_IResolvable_da3f097b, typing.Sequence[typing.Union[_IResolvable_da3f097b, typing.Union[CfnPipeline.PipelineObjectProperty, typing.Dict[builtins.str, typing.Any]]]]]] = None,
-    pipeline_tags: typing.Optional[typing.Union[_IResolvable_da3f097b, typing.Sequence[typing.Union[_IResolvable_da3f097b, typing.Union[CfnPipeline.PipelineTagProperty, typing.Dict[builtins.str, typing.Any]]]]]] = None,
+    pipeline_tags: typing.Optional[typing.Sequence[typing.Union[CfnPipeline.PipelineTagProperty, typing.Dict[builtins.str, typing.Any]]]] = None,
 ) -> None:
     """Type checking stubs"""
     pass
@@ -1070,7 +1078,7 @@ def _typecheckingstub__303ff38be40efb59439d8be9b488922db23d7f70ba23f6de2ae3877b9
     pass
 
 def _typecheckingstub__1bdff7a2b094eb0859ba59733450f878d0d39b1023848274f462bc883bc2055d(
-    value: typing.Optional[typing.Union[_IResolvable_da3f097b, typing.List[typing.Union[_IResolvable_da3f097b, CfnPipeline.PipelineTagProperty]]]],
+    value: typing.Optional[typing.List[CfnPipeline.PipelineTagProperty]],
 ) -> None:
     """Type checking stubs"""
     pass
@@ -1133,7 +1141,7 @@ def _typecheckingstub__429bab82e7799b22bfaef6728eba104991534351e5d263614f403da5e
     parameter_objects: typing.Optional[typing.Union[_IResolvable_da3f097b, typing.Sequence[typing.Union[_IResolvable_da3f097b, typing.Union[CfnPipeline.ParameterObjectProperty, typing.Dict[builtins.str, typing.Any]]]]]] = None,
     parameter_values: typing.Optional[typing.Union[_IResolvable_da3f097b, typing.Sequence[typing.Union[_IResolvable_da3f097b, typing.Union[CfnPipeline.ParameterValueProperty, typing.Dict[builtins.str, typing.Any]]]]]] = None,
     pipeline_objects: typing.Optional[typing.Union[_IResolvable_da3f097b, typing.Sequence[typing.Union[_IResolvable_da3f097b, typing.Union[CfnPipeline.PipelineObjectProperty, typing.Dict[builtins.str, typing.Any]]]]]] = None,
-    pipeline_tags: typing.Optional[typing.Union[_IResolvable_da3f097b, typing.Sequence[typing.Union[_IResolvable_da3f097b, typing.Union[CfnPipeline.PipelineTagProperty, typing.Dict[builtins.str, typing.Any]]]]]] = None,
+    pipeline_tags: typing.Optional[typing.Sequence[typing.Union[CfnPipeline.PipelineTagProperty, typing.Dict[builtins.str, typing.Any]]]] = None,
 ) -> None:
     """Type checking stubs"""
     pass

aws_cdk/aws_datasync/__init__.py

@@ -46,6 +46,7 @@ from .. import (
     IInspectable as _IInspectable_c2943556,
     IResolvable as _IResolvable_da3f097b,
     ITaggable as _ITaggable_36806126,
+    ITaggableV2 as _ITaggableV2_4e6798f8,
     TagManager as _TagManager_0a598cb3,
     TreeInspector as _TreeInspector_488e0dd5,
 )
@@ -431,7 +432,7 @@ class CfnAgentProps:
         )
 
 
-@jsii.implements(_IInspectable_c2943556)
+@jsii.implements(_IInspectable_c2943556, _ITaggableV2_4e6798f8)
 class CfnLocationAzureBlob(
     _CfnResource_9df397a6,
     metaclass=jsii.JSIIMeta,
@@ -563,6 +564,12 @@ class CfnLocationAzureBlob(
         '''
         return typing.cast(builtins.str, jsii.get(self, "attrLocationUri"))
 
+    @builtins.property
+    @jsii.member(jsii_name="cdkTagManager")
+    def cdk_tag_manager(self) -> _TagManager_0a598cb3:
+        '''Tag Manager which manages the tags for this resource.'''
+        return typing.cast(_TagManager_0a598cb3, jsii.get(self, "cdkTagManager"))
+
     @builtins.property
     @jsii.member(jsii_name="cfnProperties")
     def _cfn_properties(self) -> typing.Mapping[builtins.str, typing.Any]:

aws_cdk/aws_datazone/__init__.py

@@ -55,6 +55,8 @@ from .. import (
     CfnTag as _CfnTag_f6864754,
     IInspectable as _IInspectable_c2943556,
     IResolvable as _IResolvable_da3f097b,
+    ITaggableV2 as _ITaggableV2_4e6798f8,
+    TagManager as _TagManager_0a598cb3,
     TreeInspector as _TreeInspector_488e0dd5,
 )
 
@@ -1784,7 +1786,7 @@ class CfnDataSourceProps:
         )
 
 
-@jsii.implements(_IInspectable_c2943556)
+@jsii.implements(_IInspectable_c2943556, _ITaggableV2_4e6798f8)
 class CfnDomain(
     _CfnResource_9df397a6,
     metaclass=jsii.JSIIMeta,
@@ -1952,6 +1954,12 @@ class CfnDomain(
         '''
         return typing.cast(builtins.str, jsii.get(self, "attrStatus"))
 
+    @builtins.property
+    @jsii.member(jsii_name="cdkTagManager")
+    def cdk_tag_manager(self) -> _TagManager_0a598cb3:
+        '''Tag Manager which manages the tags for this resource.'''
+        return typing.cast(_TagManager_0a598cb3, jsii.get(self, "cdkTagManager"))
+
     @builtins.property
     @jsii.member(jsii_name="cfnProperties")
     def _cfn_properties(self) -> typing.Mapping[builtins.str, typing.Any]:

aws_cdk/aws_dms/__init__.py

@@ -46,6 +46,7 @@ from .. import (
     IInspectable as _IInspectable_c2943556,
     IResolvable as _IResolvable_da3f097b,
     ITaggable as _ITaggable_36806126,
+    ITaggableV2 as _ITaggableV2_4e6798f8,
     TagManager as _TagManager_0a598cb3,
     TreeInspector as _TreeInspector_488e0dd5,
 )
@@ -281,7 +282,7 @@ class CfnCertificateProps:
         )
 
 
-@jsii.implements(_IInspectable_c2943556)
+@jsii.implements(_IInspectable_c2943556, _ITaggableV2_4e6798f8)
 class CfnDataProvider(
     _CfnResource_9df397a6,
     metaclass=jsii.JSIIMeta,
@@ -411,6 +412,12 @@ class CfnDataProvider(
         '''
         return typing.cast(builtins.str, jsii.get(self, "attrDataProviderCreationTime"))
 
+    @builtins.property
+    @jsii.member(jsii_name="cdkTagManager")
+    def cdk_tag_manager(self) -> _TagManager_0a598cb3:
+        '''Tag Manager which manages the tags for this resource.'''
+        return typing.cast(_TagManager_0a598cb3, jsii.get(self, "cdkTagManager"))
+
     @builtins.property
     @jsii.member(jsii_name="cfnProperties")
     def _cfn_properties(self) -> typing.Mapping[builtins.str, typing.Any]:
@@ -8297,7 +8304,7 @@ class CfnEventSubscriptionProps:
         )
 
 
-@jsii.implements(_IInspectable_c2943556)
+@jsii.implements(_IInspectable_c2943556, _ITaggableV2_4e6798f8)
 class CfnInstanceProfile(
     _CfnResource_9df397a6,
     metaclass=jsii.JSIIMeta,
@@ -8429,6 +8436,12 @@ class CfnInstanceProfile(
         '''
         return typing.cast(builtins.str, jsii.get(self, "attrInstanceProfileCreationTime"))
 
+    @builtins.property
+    @jsii.member(jsii_name="cdkTagManager")
+    def cdk_tag_manager(self) -> _TagManager_0a598cb3:
+        '''Tag Manager which manages the tags for this resource.'''
+        return typing.cast(_TagManager_0a598cb3, jsii.get(self, "cdkTagManager"))
+
     @builtins.property
     @jsii.member(jsii_name="cfnProperties")
     def _cfn_properties(self) -> typing.Mapping[builtins.str, typing.Any]:
@@ -8796,7 +8809,7 @@ class CfnInstanceProfileProps:
         )
 
 
-@jsii.implements(_IInspectable_c2943556)
+@jsii.implements(_IInspectable_c2943556, _ITaggableV2_4e6798f8)
 class CfnMigrationProject(
     _CfnResource_9df397a6,
     metaclass=jsii.JSIIMeta,
@@ -8942,6 +8955,12 @@ class CfnMigrationProject(
         '''
         return typing.cast(builtins.str, jsii.get(self, "attrMigrationProjectArn"))
 
+    @builtins.property
+    @jsii.member(jsii_name="cdkTagManager")
+    def cdk_tag_manager(self) -> _TagManager_0a598cb3:
+        '''Tag Manager which manages the tags for this resource.'''
+        return typing.cast(_TagManager_0a598cb3, jsii.get(self, "cdkTagManager"))
+
     @builtins.property
     @jsii.member(jsii_name="cfnProperties")
     def _cfn_properties(self) -> typing.Mapping[builtins.str, typing.Any]:
@@ -9586,7 +9605,7 @@ class CfnMigrationProjectProps:
         )
 
 
-@jsii.implements(_IInspectable_c2943556)
+@jsii.implements(_IInspectable_c2943556, _ITaggableV2_4e6798f8)
 class CfnReplicationConfig(
     _CfnResource_9df397a6,
     metaclass=jsii.JSIIMeta,
@@ -9725,6 +9744,12 @@ class CfnReplicationConfig(
         '''
         return typing.cast(builtins.str, jsii.get(self, "attrReplicationConfigArn"))
 
+    @builtins.property
+    @jsii.member(jsii_name="cdkTagManager")
+    def cdk_tag_manager(self) -> _TagManager_0a598cb3:
+        '''Tag Manager which manages the tags for this resource.'''
+        return typing.cast(_TagManager_0a598cb3, jsii.get(self, "cdkTagManager"))
+
     @builtins.property
     @jsii.member(jsii_name="cfnProperties")
     def _cfn_properties(self) -> typing.Mapping[builtins.str, typing.Any]:

aws_cdk/aws_docdb/__init__.py

@@ -191,6 +191,76 @@ cluster = docdb.DatabaseCluster(self, "Database",
     enable_performance_insights=True
 )
 ```
+
+## Removal Policy
+
+This resource supports the snapshot removal policy.
+To specify it use the `removalPolicy` property:
+
+```python
+# vpc: ec2.Vpc
+
+
+cluster = docdb.DatabaseCluster(self, "Database",
+    master_user=docdb.Login(
+        username="myuser"
+    ),
+    instance_type=ec2.InstanceType.of(ec2.InstanceClass.MEMORY5, ec2.InstanceSize.LARGE),
+    vpc_subnets=ec2.SubnetSelection(
+        subnet_type=ec2.SubnetType.PUBLIC
+    ),
+    vpc=vpc,
+    removal_policy=RemovalPolicy.SNAPSHOT
+)
+```
+
+**Note**: A `RemovalPolicy.DESTROY` removal policy will be applied to the
+cluster's instances and security group by default as they don't support the snapshot
+removal policy.
+
+> Visit [DeletionPolicy](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-attribute-deletionpolicy.html) for more details.
+
+To specify a custom removal policy for the cluster's instances, use the
+`instanceRemovalPolicy` property:
+
+```python
+# vpc: ec2.Vpc
+
+
+cluster = docdb.DatabaseCluster(self, "Database",
+    master_user=docdb.Login(
+        username="myuser"
+    ),
+    instance_type=ec2.InstanceType.of(ec2.InstanceClass.MEMORY5, ec2.InstanceSize.LARGE),
+    vpc_subnets=ec2.SubnetSelection(
+        subnet_type=ec2.SubnetType.PUBLIC
+    ),
+    vpc=vpc,
+    removal_policy=RemovalPolicy.SNAPSHOT,
+    instance_removal_policy=RemovalPolicy.RETAIN
+)
+```
+
+To specify a custom removal policy for the cluster's security group, use the
+`securityGroupRemovalPolicy` property:
+
+```python
+# vpc: ec2.Vpc
+
+
+cluster = docdb.DatabaseCluster(self, "Database",
+    master_user=docdb.Login(
+        username="myuser"
+    ),
+    instance_type=ec2.InstanceType.of(ec2.InstanceClass.MEMORY5, ec2.InstanceSize.LARGE),
+    vpc_subnets=ec2.SubnetSelection(
+        subnet_type=ec2.SubnetType.PUBLIC
+    ),
+    vpc=vpc,
+    removal_policy=RemovalPolicy.SNAPSHOT,
+    security_group_removal_policy=RemovalPolicy.RETAIN
+)
+```
 '''
 import abc
 import builtins
@@ -3279,6 +3349,7 @@ class DatabaseClusterAttributes:
         "export_audit_logs_to_cloud_watch": "exportAuditLogsToCloudWatch",
         "export_profiler_logs_to_cloud_watch": "exportProfilerLogsToCloudWatch",
         "instance_identifier_base": "instanceIdentifierBase",
+        "instance_removal_policy": "instanceRemovalPolicy",
         "instances": "instances",
         "kms_key": "kmsKey",
         "parameter_group": "parameterGroup",
@@ -3286,6 +3357,7 @@ class DatabaseClusterAttributes:
         "preferred_maintenance_window": "preferredMaintenanceWindow",
         "removal_policy": "removalPolicy",
         "security_group": "securityGroup",
+        "security_group_removal_policy": "securityGroupRemovalPolicy",
         "storage_encrypted": "storageEncrypted",
         "vpc_subnets": "vpcSubnets",
     },
@@ -3307,6 +3379,7 @@ class DatabaseClusterProps:
         export_audit_logs_to_cloud_watch: typing.Optional[builtins.bool] = None,
         export_profiler_logs_to_cloud_watch: typing.Optional[builtins.bool] = None,
         instance_identifier_base: typing.Optional[builtins.str] = None,
+        instance_removal_policy: typing.Optional[_RemovalPolicy_9f93c814] = None,
         instances: typing.Optional[jsii.Number] = None,
         kms_key: typing.Optional[_IKey_5f11635f] = None,
         parameter_group: typing.Optional["IClusterParameterGroup"] = None,
@@ -3314,6 +3387,7 @@ class DatabaseClusterProps:
         preferred_maintenance_window: typing.Optional[builtins.str] = None,
         removal_policy: typing.Optional[_RemovalPolicy_9f93c814] = None,
         security_group: typing.Optional[_ISecurityGroup_acf8a799] = None,
+        security_group_removal_policy: typing.Optional[_RemovalPolicy_9f93c814] = None,
         storage_encrypted: typing.Optional[builtins.bool] = None,
         vpc_subnets: typing.Optional[typing.Union[_SubnetSelection_e57d76df, typing.Dict[builtins.str, typing.Any]]] = None,
     ) -> None:
@@ -3332,13 +3406,15 @@ class DatabaseClusterProps:
         :param export_audit_logs_to_cloud_watch: Whether the audit logs should be exported to CloudWatch. Note that you also have to configure the audit log export in the Cluster's Parameter Group. Default: false
         :param export_profiler_logs_to_cloud_watch: Whether the profiler logs should be exported to CloudWatch. Note that you also have to configure the profiler log export in the Cluster's Parameter Group. Default: false
         :param instance_identifier_base: Base identifier for instances. Every replica is named by appending the replica number to this string, 1-based. Default: - ``dbClusterName`` is used with the word "Instance" appended. If ``dbClusterName`` is not provided, the identifier is automatically generated.
+        :param instance_removal_policy: The removal policy to apply to the cluster's instances. Cannot be set to ``SNAPSHOT``. Default: - ``RemovalPolicy.DESTROY`` when ``removalPolicy`` is set to ``SNAPSHOT``, ``removalPolicy`` otherwise.
         :param instances: Number of DocDB compute instances. Default: 1
         :param kms_key: The KMS key for storage encryption. Default: - default master key.
         :param parameter_group: The DB parameter group to associate with the instance. Default: no parameter group
         :param port: The port the DocumentDB cluster will listen on. Default: DatabaseCluster.DEFAULT_PORT
         :param preferred_maintenance_window: A weekly time range in which maintenance should preferably execute. Must be at least 30 minutes long. Example: 'tue:04:17-tue:04:47' Default: - 30-minute window selected at random from an 8-hour block of time for each AWS Region, occurring on a random day of the week.
-        :param removal_policy: The removal policy to apply when the cluster and its instances are removed or replaced during a stack update, or when the stack is deleted. This removal policy also applies to the implicit security group created for the cluster if one is not supplied as a parameter. Default: - Retain cluster.
+        :param removal_policy: The removal policy to apply when the cluster and its instances are removed or replaced during a stack update, or when the stack is deleted. This removal policy also applies to the implicit security group created for the cluster if one is not supplied as a parameter. When set to ``SNAPSHOT``, the removal policy for the instances and the security group will default to ``DESTROY`` as those resources do not support the policy. Use the ``instanceRemovalPolicy`` and ``securityGroupRemovalPolicy`` to change the behavior. Default: - Retain cluster.
         :param security_group: Security group. Default: a new security group is created.
+        :param security_group_removal_policy: The removal policy to apply to the cluster's security group. Cannot be set to ``SNAPSHOT``. Default: - ``RemovalPolicy.DESTROY`` when ``removalPolicy`` is set to ``SNAPSHOT``, ``removalPolicy`` otherwise.
         :param storage_encrypted: Whether to enable storage encryption. Default: true
         :param vpc_subnets: Where to place the instances within the VPC. Default: private subnets
 
@@ -3348,6 +3424,7 @@ class DatabaseClusterProps:
 
             # vpc: ec2.Vpc
             
+            
             cluster = docdb.DatabaseCluster(self, "Database",
                 master_user=docdb.Login(
                     username="myuser"
@@ -3357,7 +3434,7 @@ class DatabaseClusterProps:
                     subnet_type=ec2.SubnetType.PUBLIC
                 ),
                 vpc=vpc,
-                deletion_protection=True
+                removal_policy=RemovalPolicy.SNAPSHOT
             )
         '''
         if isinstance(master_user, dict):
@@ -3381,6 +3458,7 @@ class DatabaseClusterProps:
             check_type(argname="argument export_audit_logs_to_cloud_watch", value=export_audit_logs_to_cloud_watch, expected_type=type_hints["export_audit_logs_to_cloud_watch"])
             check_type(argname="argument export_profiler_logs_to_cloud_watch", value=export_profiler_logs_to_cloud_watch, expected_type=type_hints["export_profiler_logs_to_cloud_watch"])
             check_type(argname="argument instance_identifier_base", value=instance_identifier_base, expected_type=type_hints["instance_identifier_base"])
+            check_type(argname="argument instance_removal_policy", value=instance_removal_policy, expected_type=type_hints["instance_removal_policy"])
             check_type(argname="argument instances", value=instances, expected_type=type_hints["instances"])
             check_type(argname="argument kms_key", value=kms_key, expected_type=type_hints["kms_key"])
             check_type(argname="argument parameter_group", value=parameter_group, expected_type=type_hints["parameter_group"])
@@ -3388,6 +3466,7 @@ class DatabaseClusterProps:
             check_type(argname="argument preferred_maintenance_window", value=preferred_maintenance_window, expected_type=type_hints["preferred_maintenance_window"])
             check_type(argname="argument removal_policy", value=removal_policy, expected_type=type_hints["removal_policy"])
             check_type(argname="argument security_group", value=security_group, expected_type=type_hints["security_group"])
+            check_type(argname="argument security_group_removal_policy", value=security_group_removal_policy, expected_type=type_hints["security_group_removal_policy"])
             check_type(argname="argument storage_encrypted", value=storage_encrypted, expected_type=type_hints["storage_encrypted"])
             check_type(argname="argument vpc_subnets", value=vpc_subnets, expected_type=type_hints["vpc_subnets"])
         self._values: typing.Dict[builtins.str, typing.Any] = {
@@ -3415,6 +3494,8 @@ class DatabaseClusterProps:
             self._values["export_profiler_logs_to_cloud_watch"] = export_profiler_logs_to_cloud_watch
         if instance_identifier_base is not None:
             self._values["instance_identifier_base"] = instance_identifier_base
+        if instance_removal_policy is not None:
+            self._values["instance_removal_policy"] = instance_removal_policy
         if instances is not None:
             self._values["instances"] = instances
         if kms_key is not None:
@@ -3429,6 +3510,8 @@ class DatabaseClusterProps:
             self._values["removal_policy"] = removal_policy
         if security_group is not None:
             self._values["security_group"] = security_group
+        if security_group_removal_policy is not None:
+            self._values["security_group_removal_policy"] = security_group_removal_policy
         if storage_encrypted is not None:
             self._values["storage_encrypted"] = storage_encrypted
         if vpc_subnets is not None:
@@ -3576,6 +3659,19 @@ class DatabaseClusterProps:
         result = self._values.get("instance_identifier_base")
         return typing.cast(typing.Optional[builtins.str], result)
 
+    @builtins.property
+    def instance_removal_policy(self) -> typing.Optional[_RemovalPolicy_9f93c814]:
+        '''The removal policy to apply to the cluster's instances.
+
+        Cannot be set to ``SNAPSHOT``.
+
+        :default: - ``RemovalPolicy.DESTROY`` when ``removalPolicy`` is set to ``SNAPSHOT``, ``removalPolicy`` otherwise.
+
+        :see: https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-attribute-deletionpolicy.html
+        '''
+        result = self._values.get("instance_removal_policy")
+        return typing.cast(typing.Optional[_RemovalPolicy_9f93c814], result)
+
     @builtins.property
     def instances(self) -> typing.Optional[jsii.Number]:
         '''Number of DocDB compute instances.
@@ -3638,6 +3734,11 @@ class DatabaseClusterProps:
         removal policy also applies to the implicit security group created for the
         cluster if one is not supplied as a parameter.
 
+        When set to ``SNAPSHOT``, the removal policy for the instances and the security group
+        will default to ``DESTROY`` as those resources do not support the policy.
+
+        Use the ``instanceRemovalPolicy`` and ``securityGroupRemovalPolicy`` to change the behavior.
+
         :default: - Retain cluster.
         '''
         result = self._values.get("removal_policy")
@@ -3652,6 +3753,19 @@ class DatabaseClusterProps:
         result = self._values.get("security_group")
         return typing.cast(typing.Optional[_ISecurityGroup_acf8a799], result)
 
+    @builtins.property
+    def security_group_removal_policy(self) -> typing.Optional[_RemovalPolicy_9f93c814]:
+        '''The removal policy to apply to the cluster's security group.
+
+        Cannot be set to ``SNAPSHOT``.
+
+        :default: - ``RemovalPolicy.DESTROY`` when ``removalPolicy`` is set to ``SNAPSHOT``, ``removalPolicy`` otherwise.
+
+        :see: https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-attribute-deletionpolicy.html
+        '''
+        result = self._values.get("security_group_removal_policy")
+        return typing.cast(typing.Optional[_RemovalPolicy_9f93c814], result)
+
     @builtins.property
     def storage_encrypted(self) -> typing.Optional[builtins.bool]:
         '''Whether to enable storage encryption.
@@ -4442,6 +4556,7 @@ class Login:
 
             # vpc: ec2.Vpc
             
+            
             cluster = docdb.DatabaseCluster(self, "Database",
                 master_user=docdb.Login(
                     username="myuser"
@@ -4451,7 +4566,7 @@ class Login:
                     subnet_type=ec2.SubnetType.PUBLIC
                 ),
                 vpc=vpc,
-                deletion_protection=True
+                removal_policy=RemovalPolicy.SNAPSHOT
             )
         '''
         if __debug__:
@@ -4717,6 +4832,7 @@ class DatabaseCluster(
 
         # vpc: ec2.Vpc
         
+        
         cluster = docdb.DatabaseCluster(self, "Database",
             master_user=docdb.Login(
                 username="myuser"
@@ -4726,7 +4842,7 @@ class DatabaseCluster(
                 subnet_type=ec2.SubnetType.PUBLIC
             ),
             vpc=vpc,
-            deletion_protection=True
+            removal_policy=RemovalPolicy.SNAPSHOT
         )
     '''
 
@@ -4748,6 +4864,7 @@ class DatabaseCluster(
         export_audit_logs_to_cloud_watch: typing.Optional[builtins.bool] = None,
         export_profiler_logs_to_cloud_watch: typing.Optional[builtins.bool] = None,
         instance_identifier_base: typing.Optional[builtins.str] = None,
+        instance_removal_policy: typing.Optional[_RemovalPolicy_9f93c814] = None,
         instances: typing.Optional[jsii.Number] = None,
         kms_key: typing.Optional[_IKey_5f11635f] = None,
         parameter_group: typing.Optional[IClusterParameterGroup] = None,
@@ -4755,6 +4872,7 @@ class DatabaseCluster(
         preferred_maintenance_window: typing.Optional[builtins.str] = None,
         removal_policy: typing.Optional[_RemovalPolicy_9f93c814] = None,
         security_group: typing.Optional[_ISecurityGroup_acf8a799] = None,
+        security_group_removal_policy: typing.Optional[_RemovalPolicy_9f93c814] = None,
         storage_encrypted: typing.Optional[builtins.bool] = None,
         vpc_subnets: typing.Optional[typing.Union[_SubnetSelection_e57d76df, typing.Dict[builtins.str, typing.Any]]] = None,
     ) -> None:
@@ -4774,13 +4892,15 @@ class DatabaseCluster(
         :param export_audit_logs_to_cloud_watch: Whether the audit logs should be exported to CloudWatch. Note that you also have to configure the audit log export in the Cluster's Parameter Group. Default: false
         :param export_profiler_logs_to_cloud_watch: Whether the profiler logs should be exported to CloudWatch. Note that you also have to configure the profiler log export in the Cluster's Parameter Group. Default: false
         :param instance_identifier_base: Base identifier for instances. Every replica is named by appending the replica number to this string, 1-based. Default: - ``dbClusterName`` is used with the word "Instance" appended. If ``dbClusterName`` is not provided, the identifier is automatically generated.
+        :param instance_removal_policy: The removal policy to apply to the cluster's instances. Cannot be set to ``SNAPSHOT``. Default: - ``RemovalPolicy.DESTROY`` when ``removalPolicy`` is set to ``SNAPSHOT``, ``removalPolicy`` otherwise.
         :param instances: Number of DocDB compute instances. Default: 1
         :param kms_key: The KMS key for storage encryption. Default: - default master key.
         :param parameter_group: The DB parameter group to associate with the instance. Default: no parameter group
         :param port: The port the DocumentDB cluster will listen on. Default: DatabaseCluster.DEFAULT_PORT
         :param preferred_maintenance_window: A weekly time range in which maintenance should preferably execute. Must be at least 30 minutes long. Example: 'tue:04:17-tue:04:47' Default: - 30-minute window selected at random from an 8-hour block of time for each AWS Region, occurring on a random day of the week.
-        :param removal_policy: The removal policy to apply when the cluster and its instances are removed or replaced during a stack update, or when the stack is deleted. This removal policy also applies to the implicit security group created for the cluster if one is not supplied as a parameter. Default: - Retain cluster.
+        :param removal_policy: The removal policy to apply when the cluster and its instances are removed or replaced during a stack update, or when the stack is deleted. This removal policy also applies to the implicit security group created for the cluster if one is not supplied as a parameter. When set to ``SNAPSHOT``, the removal policy for the instances and the security group will default to ``DESTROY`` as those resources do not support the policy. Use the ``instanceRemovalPolicy`` and ``securityGroupRemovalPolicy`` to change the behavior. Default: - Retain cluster.
         :param security_group: Security group. Default: a new security group is created.
+        :param security_group_removal_policy: The removal policy to apply to the cluster's security group. Cannot be set to ``SNAPSHOT``. Default: - ``RemovalPolicy.DESTROY`` when ``removalPolicy`` is set to ``SNAPSHOT``, ``removalPolicy`` otherwise.
         :param storage_encrypted: Whether to enable storage encryption. Default: true
         :param vpc_subnets: Where to place the instances within the VPC. Default: private subnets
         '''
@@ -4802,6 +4922,7 @@ class DatabaseCluster(
             export_audit_logs_to_cloud_watch=export_audit_logs_to_cloud_watch,
             export_profiler_logs_to_cloud_watch=export_profiler_logs_to_cloud_watch,
             instance_identifier_base=instance_identifier_base,
+            instance_removal_policy=instance_removal_policy,
             instances=instances,
             kms_key=kms_key,
             parameter_group=parameter_group,
@@ -4809,6 +4930,7 @@ class DatabaseCluster(
             preferred_maintenance_window=preferred_maintenance_window,
             removal_policy=removal_policy,
             security_group=security_group,
+            security_group_removal_policy=security_group_removal_policy,
             storage_encrypted=storage_encrypted,
             vpc_subnets=vpc_subnets,
         )
@@ -5743,6 +5865,7 @@ def _typecheckingstub__bb24ec128a97ca07df15f55d4e96dda851d4300951806a7a3d7f391cc
     export_audit_logs_to_cloud_watch: typing.Optional[builtins.bool] = None,
     export_profiler_logs_to_cloud_watch: typing.Optional[builtins.bool] = None,
     instance_identifier_base: typing.Optional[builtins.str] = None,
+    instance_removal_policy: typing.Optional[_RemovalPolicy_9f93c814] = None,
     instances: typing.Optional[jsii.Number] = None,
     kms_key: typing.Optional[_IKey_5f11635f] = None,
     parameter_group: typing.Optional[IClusterParameterGroup] = None,
@@ -5750,6 +5873,7 @@ def _typecheckingstub__bb24ec128a97ca07df15f55d4e96dda851d4300951806a7a3d7f391cc
     preferred_maintenance_window: typing.Optional[builtins.str] = None,
     removal_policy: typing.Optional[_RemovalPolicy_9f93c814] = None,
     security_group: typing.Optional[_ISecurityGroup_acf8a799] = None,
+    security_group_removal_policy: typing.Optional[_RemovalPolicy_9f93c814] = None,
     storage_encrypted: typing.Optional[builtins.bool] = None,
     vpc_subnets: typing.Optional[typing.Union[_SubnetSelection_e57d76df, typing.Dict[builtins.str, typing.Any]]] = None,
 ) -> None:
@@ -5866,6 +5990,7 @@ def _typecheckingstub__3fef762ebf4d69195051e79f76d91c6d9e93e2a84a6c1e71f7b4a0b8c
     export_audit_logs_to_cloud_watch: typing.Optional[builtins.bool] = None,
     export_profiler_logs_to_cloud_watch: typing.Optional[builtins.bool] = None,
     instance_identifier_base: typing.Optional[builtins.str] = None,
+    instance_removal_policy: typing.Optional[_RemovalPolicy_9f93c814] = None,
     instances: typing.Optional[jsii.Number] = None,
     kms_key: typing.Optional[_IKey_5f11635f] = None,
     parameter_group: typing.Optional[IClusterParameterGroup] = None,
@@ -5873,6 +5998,7 @@ def _typecheckingstub__3fef762ebf4d69195051e79f76d91c6d9e93e2a84a6c1e71f7b4a0b8c
     preferred_maintenance_window: typing.Optional[builtins.str] = None,
     removal_policy: typing.Optional[_RemovalPolicy_9f93c814] = None,
     security_group: typing.Optional[_ISecurityGroup_acf8a799] = None,
+    security_group_removal_policy: typing.Optional[_RemovalPolicy_9f93c814] = None,
     storage_encrypted: typing.Optional[builtins.bool] = None,
     vpc_subnets: typing.Optional[typing.Union[_SubnetSelection_e57d76df, typing.Dict[builtins.str, typing.Any]]] = None,
 ) -> None: