aws-cdk-lib 2.145.0__py3-none-any.whl → 2.147.0__py3-none-any.whl

aws_cdk/aws_securitylake/__init__.py

@@ -1366,7 +1366,9 @@ class CfnSubscriberNotification(
     metaclass=jsii.JSIIMeta,
     jsii_type="aws-cdk-lib.aws_securitylake.CfnSubscriberNotification",
 ):
-    '''Resource Type definition for AWS::SecurityLake::SubscriberNotification.
+    '''Notifies the subscriber when new data is written to the data lake for the sources that the subscriber consumes in Security Lake.
+
+    You can create only one subscriber notification per subscriber.
 
     :see: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-securitylake-subscribernotification.html
     :cloudformationResource: AWS::SecurityLake::SubscriberNotification
@@ -1393,7 +1395,7 @@ class CfnSubscriberNotification(
         '''
         :param scope: Scope in which this resource is defined.
         :param id: Construct identifier for this resource (unique in its scope).
-        :param subscriber_arn: The ARN for the subscriber.
+        :param subscriber_arn: The Amazon Resource Name (ARN) of the Security Lake subscriber.
         '''
         if __debug__:
             type_hints = typing.get_type_hints(_typecheckingstub__12d097a0b2763ed8532079d34366f79ee45e7139fbdd98f5e181dd9c1fc456ee)
@@ -1450,7 +1452,7 @@ class CfnSubscriberNotification(
     @builtins.property
     @jsii.member(jsii_name="subscriberArn")
     def subscriber_arn(self) -> builtins.str:
-        '''The ARN for the subscriber.'''
+        '''The Amazon Resource Name (ARN) of the Security Lake subscriber.'''
         return typing.cast(builtins.str, jsii.get(self, "subscriberArn"))
 
     @subscriber_arn.setter
@@ -1470,7 +1472,7 @@ class CfnSubscriberNotificationProps:
     def __init__(self, *, subscriber_arn: builtins.str) -> None:
         '''Properties for defining a ``CfnSubscriberNotification``.
 
-        :param subscriber_arn: The ARN for the subscriber.
+        :param subscriber_arn: The Amazon Resource Name (ARN) of the Security Lake subscriber.
 
         :see: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-securitylake-subscribernotification.html
         :exampleMetadata: fixture=_generated
@@ -1494,7 +1496,7 @@ class CfnSubscriberNotificationProps:
 
     @builtins.property
     def subscriber_arn(self) -> builtins.str:
-        '''The ARN for the subscriber.
+        '''The Amazon Resource Name (ARN) of the Security Lake subscriber.
 
         :see: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-securitylake-subscribernotification.html#cfn-securitylake-subscribernotification-subscriberarn
         '''

aws_cdk/aws_ses/__init__.py

@@ -240,6 +240,21 @@ Use the `VdmAttributes` construct to configure the Virtual Deliverability Manage
 # Enables engagement tracking and optimized shared delivery by default
 ses.VdmAttributes(self, "Vdm")
 ```
+
+If you want to override the VDM settings in the specified configuration set, use `vdmOptions` in the `ConfigurationSet` construct.
+
+> **Note:** The configuration set level settings need to be used together with the account level settings. (To set the account level settings using CDK, use the `VdmAttributes` Construct.)
+> If you enable only the configuration set level settings, VDM will not be enabled until the account level settings are configured.
+> For more information, see [Virtual Deliverability Manager settings](https://docs.aws.amazon.com/ses/latest/dg/vdm-settings.html).
+
+```python
+ses.ConfigurationSet(self, "ConfigurationSetWithVdmOptions",
+    vdm_options=ses.VdmOptions(
+        engagement_metrics=True,
+        optimized_shared_delivery=True
+    )
+)
+```
 '''
 from pkgutil import extend_path
 __path__ = extend_path(__path__, __name__)
@@ -6629,6 +6644,7 @@ class ConfigurationSetEventDestinationProps(ConfigurationSetEventDestinationOpti
         "sending_enabled": "sendingEnabled",
         "suppression_reasons": "suppressionReasons",
         "tls_policy": "tlsPolicy",
+        "vdm_options": "vdmOptions",
     },
 )
 class ConfigurationSetProps:
@@ -6642,6 +6658,7 @@ class ConfigurationSetProps:
         sending_enabled: typing.Optional[builtins.bool] = None,
         suppression_reasons: typing.Optional["SuppressionReasons"] = None,
         tls_policy: typing.Optional["ConfigurationSetTlsPolicy"] = None,
+        vdm_options: typing.Optional[typing.Union["VdmOptions", typing.Dict[builtins.str, typing.Any]]] = None,
     ) -> None:
         '''Properties for a configuration set.
 
@@ -6652,6 +6669,7 @@ class ConfigurationSetProps:
         :param sending_enabled: Whether email sending is enabled. Default: true
         :param suppression_reasons: The reasons for which recipient email addresses should be automatically added to your account's suppression list. Default: - use account level settings
         :param tls_policy: Specifies whether messages that use the configuration set are required to use Transport Layer Security (TLS). Default: ConfigurationSetTlsPolicy.OPTIONAL
+        :param vdm_options: The Virtual Deliverability Manager (VDM) options that apply to the configuration set. Default: - VDM options not configured at the configuration set level. In this case, use account level settings. (To set the account level settings using CDK, use the ``VdmAttributes`` Construct.)
 
         :exampleMetadata: infused
 
@@ -6667,6 +6685,8 @@ class ConfigurationSetProps:
                 dedicated_ip_pool=my_pool
             )
         '''
+        if isinstance(vdm_options, dict):
+            vdm_options = VdmOptions(**vdm_options)
         if __debug__:
             type_hints = typing.get_type_hints(_typecheckingstub__fb010161f6c1e40b88122d9cb7754dae093e9cbe5bbfc72b19737729a4f4523d)
             check_type(argname="argument configuration_set_name", value=configuration_set_name, expected_type=type_hints["configuration_set_name"])
@@ -6676,6 +6696,7 @@ class ConfigurationSetProps:
             check_type(argname="argument sending_enabled", value=sending_enabled, expected_type=type_hints["sending_enabled"])
             check_type(argname="argument suppression_reasons", value=suppression_reasons, expected_type=type_hints["suppression_reasons"])
             check_type(argname="argument tls_policy", value=tls_policy, expected_type=type_hints["tls_policy"])
+            check_type(argname="argument vdm_options", value=vdm_options, expected_type=type_hints["vdm_options"])
         self._values: typing.Dict[builtins.str, typing.Any] = {}
         if configuration_set_name is not None:
             self._values["configuration_set_name"] = configuration_set_name
@@ -6691,6 +6712,8 @@ class ConfigurationSetProps:
             self._values["suppression_reasons"] = suppression_reasons
         if tls_policy is not None:
             self._values["tls_policy"] = tls_policy
+        if vdm_options is not None:
+            self._values["vdm_options"] = vdm_options
 
     @builtins.property
     def configuration_set_name(self) -> typing.Optional[builtins.str]:
@@ -6755,6 +6778,15 @@ class ConfigurationSetProps:
         result = self._values.get("tls_policy")
         return typing.cast(typing.Optional["ConfigurationSetTlsPolicy"], result)
 
+    @builtins.property
+    def vdm_options(self) -> typing.Optional["VdmOptions"]:
+        '''The Virtual Deliverability Manager (VDM) options that apply to the configuration set.
+
+        :default: - VDM options not configured at the configuration set level. In this case, use account level settings. (To set the account level settings using CDK, use the ``VdmAttributes`` Construct.)
+        '''
+        result = self._values.get("vdm_options")
+        return typing.cast(typing.Optional["VdmOptions"], result)
+
     def __eq__(self, rhs: typing.Any) -> builtins.bool:
         return isinstance(rhs, self.__class__) and rhs._values == self._values
 
@@ -9597,6 +9629,77 @@ class VdmAttributesProps:
         )
 
 
+@jsii.data_type(
+    jsii_type="aws-cdk-lib.aws_ses.VdmOptions",
+    jsii_struct_bases=[],
+    name_mapping={
+        "engagement_metrics": "engagementMetrics",
+        "optimized_shared_delivery": "optimizedSharedDelivery",
+    },
+)
+class VdmOptions:
+    def __init__(
+        self,
+        *,
+        engagement_metrics: typing.Optional[builtins.bool] = None,
+        optimized_shared_delivery: typing.Optional[builtins.bool] = None,
+    ) -> None:
+        '''Properties for the Virtual Deliverability Manager (VDM) options that apply to the configuration set.
+
+        :param engagement_metrics: If true, engagement metrics are enabled for the configuration set. Default: - Engagement metrics not configured at the configuration set level. In this case, use account level settings.
+        :param optimized_shared_delivery: If true, optimized shared delivery is enabled for the configuration set. Default: - Optimized shared delivery not configured at the configuration set level. In this case, use account level settings.
+
+        :exampleMetadata: infused
+
+        Example::
+
+            ses.ConfigurationSet(self, "ConfigurationSetWithVdmOptions",
+                vdm_options=ses.VdmOptions(
+                    engagement_metrics=True,
+                    optimized_shared_delivery=True
+                )
+            )
+        '''
+        if __debug__:
+            type_hints = typing.get_type_hints(_typecheckingstub__2a8516e8026df071dc99524fe916f8b7e253b71bc1734a0073475e2c6eca17aa)
+            check_type(argname="argument engagement_metrics", value=engagement_metrics, expected_type=type_hints["engagement_metrics"])
+            check_type(argname="argument optimized_shared_delivery", value=optimized_shared_delivery, expected_type=type_hints["optimized_shared_delivery"])
+        self._values: typing.Dict[builtins.str, typing.Any] = {}
+        if engagement_metrics is not None:
+            self._values["engagement_metrics"] = engagement_metrics
+        if optimized_shared_delivery is not None:
+            self._values["optimized_shared_delivery"] = optimized_shared_delivery
+
+    @builtins.property
+    def engagement_metrics(self) -> typing.Optional[builtins.bool]:
+        '''If true, engagement metrics are enabled for the configuration set.
+
+        :default: - Engagement metrics not configured at the configuration set level. In this case, use account level settings.
+        '''
+        result = self._values.get("engagement_metrics")
+        return typing.cast(typing.Optional[builtins.bool], result)
+
+    @builtins.property
+    def optimized_shared_delivery(self) -> typing.Optional[builtins.bool]:
+        '''If true, optimized shared delivery is enabled for the configuration set.
+
+        :default: - Optimized shared delivery not configured at the configuration set level. In this case, use account level settings.
+        '''
+        result = self._values.get("optimized_shared_delivery")
+        return typing.cast(typing.Optional[builtins.bool], result)
+
+    def __eq__(self, rhs: typing.Any) -> builtins.bool:
+        return isinstance(rhs, self.__class__) and rhs._values == self._values
+
+    def __ne__(self, rhs: typing.Any) -> builtins.bool:
+        return not (rhs == self)
+
+    def __repr__(self) -> str:
+        return "VdmOptions(%s)" % ", ".join(
+            k + "=" + repr(v) for k, v in self._values.items()
+        )
+
+
 @jsii.data_type(
     jsii_type="aws-cdk-lib.aws_ses.WorkmailActionConfig",
     jsii_struct_bases=[],
@@ -9707,6 +9810,7 @@ class ConfigurationSet(
         sending_enabled: typing.Optional[builtins.bool] = None,
         suppression_reasons: typing.Optional[SuppressionReasons] = None,
         tls_policy: typing.Optional[ConfigurationSetTlsPolicy] = None,
+        vdm_options: typing.Optional[typing.Union[VdmOptions, typing.Dict[builtins.str, typing.Any]]] = None,
     ) -> None:
         '''
         :param scope: -
@@ -9718,6 +9822,7 @@ class ConfigurationSet(
         :param sending_enabled: Whether email sending is enabled. Default: true
         :param suppression_reasons: The reasons for which recipient email addresses should be automatically added to your account's suppression list. Default: - use account level settings
         :param tls_policy: Specifies whether messages that use the configuration set are required to use Transport Layer Security (TLS). Default: ConfigurationSetTlsPolicy.OPTIONAL
+        :param vdm_options: The Virtual Deliverability Manager (VDM) options that apply to the configuration set. Default: - VDM options not configured at the configuration set level. In this case, use account level settings. (To set the account level settings using CDK, use the ``VdmAttributes`` Construct.)
         '''
         if __debug__:
             type_hints = typing.get_type_hints(_typecheckingstub__52b42851a408d3eb2b07399f2b34603200cef443be5e9f913f4a1d80a47ac83e)
@@ -9731,6 +9836,7 @@ class ConfigurationSet(
             sending_enabled=sending_enabled,
             suppression_reasons=suppression_reasons,
             tls_policy=tls_policy,
+            vdm_options=vdm_options,
         )
 
         jsii.create(self.__class__, self, [scope, id, props])
@@ -10388,6 +10494,7 @@ __all__ = [
     "TlsPolicy",
     "VdmAttributes",
     "VdmAttributesProps",
+    "VdmOptions",
     "WorkmailActionConfig",
 ]
 
@@ -11244,6 +11351,7 @@ def _typecheckingstub__fb010161f6c1e40b88122d9cb7754dae093e9cbe5bbfc72b19737729a
     sending_enabled: typing.Optional[builtins.bool] = None,
     suppression_reasons: typing.Optional[SuppressionReasons] = None,
     tls_policy: typing.Optional[ConfigurationSetTlsPolicy] = None,
+    vdm_options: typing.Optional[typing.Union[VdmOptions, typing.Dict[builtins.str, typing.Any]]] = None,
 ) -> None:
     """Type checking stubs"""
     pass
@@ -11571,6 +11679,14 @@ def _typecheckingstub__1882e9d1289b07868b3ffcfb9d92629e699992b01e6475750adbffc01
     """Type checking stubs"""
     pass
 
+def _typecheckingstub__2a8516e8026df071dc99524fe916f8b7e253b71bc1734a0073475e2c6eca17aa(
+    *,
+    engagement_metrics: typing.Optional[builtins.bool] = None,
+    optimized_shared_delivery: typing.Optional[builtins.bool] = None,
+) -> None:
+    """Type checking stubs"""
+    pass
+
 def _typecheckingstub__08a56aa5b57fd1699d7c92c360d0709a2cfb31d3cb323b992c4b4e89432c836b(
     *,
     organization_arn: builtins.str,
@@ -11590,6 +11706,7 @@ def _typecheckingstub__52b42851a408d3eb2b07399f2b34603200cef443be5e9f913f4a1d80a
     sending_enabled: typing.Optional[builtins.bool] = None,
     suppression_reasons: typing.Optional[SuppressionReasons] = None,
     tls_policy: typing.Optional[ConfigurationSetTlsPolicy] = None,
+    vdm_options: typing.Optional[typing.Union[VdmOptions, typing.Dict[builtins.str, typing.Any]]] = None,
 ) -> None:
     """Type checking stubs"""
     pass

aws_cdk/aws_simspaceweaver/__init__.py

@@ -258,7 +258,7 @@ class CfnSimulation(
             '''A location in Amazon Simple Storage Service ( Amazon S3 ) where SimSpace Weaver stores simulation data, such as your app .zip files and schema file. For more information about Amazon S3 , see the `*Amazon Simple Storage Service User Guide* <https://docs.aws.amazon.com/AmazonS3/latest/userguide/Welcome.html>`_ .
 
             :param bucket_name: The name of an Amazon S3 bucket. For more information about buckets, see `Creating, configuring, and working with Amazon S3 buckets <https://docs.aws.amazon.com/AmazonS3/latest/userguide/creating-buckets-s3.html>`_ in the *Amazon Simple Storage Service User Guide* .
-            :param object_key: The key name of an object in Amazon S3 . For more information about Amazon S3 objects and object keys, see `Uploading, downloading, and working with objects in Amazon S3 <https://docs.aws.amazon.com/AmazonS3/latest/userguide/uploading-downloading-objects.html>`_ in the *Amazon Simple Storage Service User Guide* .
+            :param object_key: The key name of an object in Amazon S3. For more information about Amazon S3 objects and object keys, see `Uploading, downloading, and working with objects in Amazon S3 <https://docs.aws.amazon.com/AmazonS3/latest/userguide/uploading-downloading-objects.html>`_ in the *Amazon Simple Storage Service User Guide* .
 
             :see: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-simspaceweaver-simulation-s3location.html
             :exampleMetadata: fixture=_generated
@@ -297,7 +297,7 @@ class CfnSimulation(
 
         @builtins.property
         def object_key(self) -> builtins.str:
-            '''The key name of an object in Amazon S3 .
+            '''The key name of an object in Amazon S3.
 
             For more information about Amazon S3 objects and object keys, see `Uploading, downloading, and working with objects in Amazon S3 <https://docs.aws.amazon.com/AmazonS3/latest/userguide/uploading-downloading-objects.html>`_ in the *Amazon Simple Storage Service User Guide* .
 

aws_cdk/aws_sns/__init__.py

@@ -62,6 +62,17 @@ my_topic.add_subscription(subscriptions.SqsSubscription(queue))
 Note that subscriptions of queues in different accounts need to be manually confirmed by
 reading the initial message from the queue and visiting the link found in it.
 
+The `grantSubscribe` method adds a policy statement to the topic's resource policy, allowing the specified principal to perform the `sns:Subscribe` action.
+It's useful when you want to allow entities, such as another AWS account or resources created later, to subscribe to the topic at their own pace, separating permission granting from the actual subscription process.
+
+```python
+# account_principal: iam.AccountPrincipal
+
+my_topic = sns.Topic(self, "MyTopic")
+
+my_topic.grant_subscribe(account_principal)
+```
+
 ### Filter policy
 
 A filter policy can be specified when subscribing an endpoint to a topic.
@@ -481,7 +492,7 @@ class CfnSubscription(
 ):
     '''The ``AWS::SNS::Subscription`` resource subscribes an endpoint to an Amazon SNS topic.
 
-    For a subscription to be created, the owner of the endpoint must confirm the subscription.
+    For a subscription to be created, the owner of the endpoint must` confirm the subscription.
 
     :see: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-sns-subscription.html
     :cloudformationResource: AWS::SNS::Subscription
@@ -544,7 +555,7 @@ class CfnSubscription(
         :param raw_message_delivery: When set to ``true`` , enables raw message delivery. Raw messages don't contain any JSON formatting and can be sent to Amazon SQS and HTTP/S endpoints. For more information, see ``[GetSubscriptionAttributes](https://docs.aws.amazon.com/sns/latest/api/API_GetSubscriptionAttributes.html)`` in the *Amazon SNS API Reference* .
         :param redrive_policy: When specified, sends undeliverable messages to the specified Amazon SQS dead-letter queue. Messages that can't be delivered due to client errors (for example, when the subscribed endpoint is unreachable) or server errors (for example, when the service that powers the subscribed endpoint becomes unavailable) are held in the dead-letter queue for further analysis or reprocessing. For more information about the redrive policy and dead-letter queues, see `Amazon SQS dead-letter queues <https://docs.aws.amazon.com/AWSSimpleQueueService/latest/SQSDeveloperGuide/sqs-dead-letter-queues.html>`_ in the *Amazon SQS Developer Guide* .
         :param region: For cross-region subscriptions, the region in which the topic resides. If no region is specified, AWS CloudFormation uses the region of the caller as the default. If you perform an update operation that only updates the ``Region`` property of a ``AWS::SNS::Subscription`` resource, that operation will fail unless you are either: - Updating the ``Region`` from ``NULL`` to the caller region. - Updating the ``Region`` from the caller region to ``NULL`` .
-        :param replay_policy: 
+        :param replay_policy: Specifies whether Amazon SNS resends the notification to the subscription when a message's attribute changes.
         :param subscription_role_arn: This property applies only to Amazon Data Firehose delivery stream subscriptions. Specify the ARN of the IAM role that has the following: - Permission to write to the Amazon Data Firehose delivery stream - Amazon SNS listed as a trusted entity Specifying a valid ARN for this attribute is required for Firehose delivery stream subscriptions. For more information, see `Fanout to Amazon Data Firehose delivery streams <https://docs.aws.amazon.com/sns/latest/dg/sns-firehose-as-subscriber.html>`_ in the *Amazon SNS Developer Guide.*
         '''
         if __debug__:
@@ -735,6 +746,7 @@ class CfnSubscription(
     @builtins.property
     @jsii.member(jsii_name="replayPolicy")
     def replay_policy(self) -> typing.Any:
+        '''Specifies whether Amazon SNS resends the notification to the subscription when a message's attribute changes.'''
         return typing.cast(typing.Any, jsii.get(self, "replayPolicy"))
 
     @replay_policy.setter
@@ -802,7 +814,7 @@ class CfnSubscriptionProps:
         :param raw_message_delivery: When set to ``true`` , enables raw message delivery. Raw messages don't contain any JSON formatting and can be sent to Amazon SQS and HTTP/S endpoints. For more information, see ``[GetSubscriptionAttributes](https://docs.aws.amazon.com/sns/latest/api/API_GetSubscriptionAttributes.html)`` in the *Amazon SNS API Reference* .
         :param redrive_policy: When specified, sends undeliverable messages to the specified Amazon SQS dead-letter queue. Messages that can't be delivered due to client errors (for example, when the subscribed endpoint is unreachable) or server errors (for example, when the service that powers the subscribed endpoint becomes unavailable) are held in the dead-letter queue for further analysis or reprocessing. For more information about the redrive policy and dead-letter queues, see `Amazon SQS dead-letter queues <https://docs.aws.amazon.com/AWSSimpleQueueService/latest/SQSDeveloperGuide/sqs-dead-letter-queues.html>`_ in the *Amazon SQS Developer Guide* .
         :param region: For cross-region subscriptions, the region in which the topic resides. If no region is specified, AWS CloudFormation uses the region of the caller as the default. If you perform an update operation that only updates the ``Region`` property of a ``AWS::SNS::Subscription`` resource, that operation will fail unless you are either: - Updating the ``Region`` from ``NULL`` to the caller region. - Updating the ``Region`` from the caller region to ``NULL`` .
-        :param replay_policy: 
+        :param replay_policy: Specifies whether Amazon SNS resends the notification to the subscription when a message's attribute changes.
         :param subscription_role_arn: This property applies only to Amazon Data Firehose delivery stream subscriptions. Specify the ARN of the IAM role that has the following: - Permission to write to the Amazon Data Firehose delivery stream - Amazon SNS listed as a trusted entity Specifying a valid ARN for this attribute is required for Firehose delivery stream subscriptions. For more information, see `Fanout to Amazon Data Firehose delivery streams <https://docs.aws.amazon.com/sns/latest/dg/sns-firehose-as-subscriber.html>`_ in the *Amazon SNS Developer Guide.*
 
         :see: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-sns-subscription.html
@@ -982,7 +994,8 @@ class CfnSubscriptionProps:
 
     @builtins.property
     def replay_policy(self) -> typing.Any:
-        '''
+        '''Specifies whether Amazon SNS resends the notification to the subscription when a message's attribute changes.
+
         :see: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-sns-subscription.html#cfn-sns-subscription-replaypolicy
         '''
         result = self._values.get("replay_policy")
@@ -2403,6 +2416,14 @@ class ITopic(
         '''
         ...
 
+    @jsii.member(jsii_name="grantSubscribe")
+    def grant_subscribe(self, identity: _IGrantable_71c4f5de) -> _Grant_a7ae64f8:
+        '''Grant topic subscribing permissions to the given identity.
+
+        :param identity: -
+        '''
+        ...
+
     @jsii.member(jsii_name="metric")
     def metric(
         self,
@@ -2770,6 +2791,17 @@ class _ITopicProxy(
             check_type(argname="argument identity", value=identity, expected_type=type_hints["identity"])
         return typing.cast(_Grant_a7ae64f8, jsii.invoke(self, "grantPublish", [identity]))
 
+    @jsii.member(jsii_name="grantSubscribe")
+    def grant_subscribe(self, identity: _IGrantable_71c4f5de) -> _Grant_a7ae64f8:
+        '''Grant topic subscribing permissions to the given identity.
+
+        :param identity: -
+        '''
+        if __debug__:
+            type_hints = typing.get_type_hints(_typecheckingstub__7aeb5c807ffbca475c72e16b5057cf9e84960ecb69a07c559eacf1d2d9f57d08)
+            check_type(argname="argument identity", value=identity, expected_type=type_hints["identity"])
+        return typing.cast(_Grant_a7ae64f8, jsii.invoke(self, "grantSubscribe", [identity]))
+
     @jsii.member(jsii_name="metric")
     def metric(
         self,
@@ -4494,6 +4526,17 @@ class TopicBase(
             check_type(argname="argument grantee", value=grantee, expected_type=type_hints["grantee"])
         return typing.cast(_Grant_a7ae64f8, jsii.invoke(self, "grantPublish", [grantee]))
 
+    @jsii.member(jsii_name="grantSubscribe")
+    def grant_subscribe(self, grantee: _IGrantable_71c4f5de) -> _Grant_a7ae64f8:
+        '''Grant topic subscribing permissions to the given identity.
+
+        :param grantee: -
+        '''
+        if __debug__:
+            type_hints = typing.get_type_hints(_typecheckingstub__cdc643adf708f1051e215b34e0def5de91fed4799b3870f5be0d3e0ddf1702b2)
+            check_type(argname="argument grantee", value=grantee, expected_type=type_hints["grantee"])
+        return typing.cast(_Grant_a7ae64f8, jsii.invoke(self, "grantSubscribe", [grantee]))
+
     @jsii.member(jsii_name="metric")
     def metric(
         self,
@@ -5703,18 +5746,17 @@ class Topic(TopicBase, metaclass=jsii.JSIIMeta, jsii_type="aws-cdk-lib.aws_sns.T
 
     Example::
 
-        import aws_cdk.aws_sns as sns
+        from aws_cdk.aws_kinesisfirehose_alpha import DeliveryStream
+        # stream: DeliveryStream
         
         
-        topic = sns.Topic(self, "MyTopic")
+        topic = sns.Topic(self, "Topic")
         
-        topic_rule = iot.TopicRule(self, "TopicRule",
-            sql=iot.IotSql.from_string_as_ver20160323("SELECT topic(2) as device_id, year, month, day FROM 'device/+/data'"),
-            actions=[
-                actions.SnsTopicAction(topic,
-                    message_format=actions.SnsActionMessageFormat.JSON
-                )
-            ]
+        sns.Subscription(self, "Subscription",
+            topic=topic,
+            endpoint=stream.delivery_stream_arn,
+            protocol=sns.SubscriptionProtocol.FIREHOSE,
+            subscription_role_arn="SAMPLE_ARN"
         )
     '''
 
@@ -6291,6 +6333,12 @@ def _typecheckingstub__bf96d0b079cfedfe1ad406a08f2229f4ed5332b9d92fc6d78e1571fce
     """Type checking stubs"""
     pass
 
+def _typecheckingstub__7aeb5c807ffbca475c72e16b5057cf9e84960ecb69a07c559eacf1d2d9f57d08(
+    identity: _IGrantable_71c4f5de,
+) -> None:
+    """Type checking stubs"""
+    pass
+
 def _typecheckingstub__05c3997edd40866d6774aed03c03e55b6cf80f23f518be34bcdf19adf065db7c(
     metric_name: builtins.str,
     *,
@@ -6447,6 +6495,12 @@ def _typecheckingstub__6461236ee087e9f8e6de731371b913e918bbd3ec5d928bd677a69c9c8
     """Type checking stubs"""
     pass
 
+def _typecheckingstub__cdc643adf708f1051e215b34e0def5de91fed4799b3870f5be0d3e0ddf1702b2(
+    grantee: _IGrantable_71c4f5de,
+) -> None:
+    """Type checking stubs"""
+    pass
+
 def _typecheckingstub__b07969d7a2c71869715d0fe87d9b0d9d67f663ddecc9d81d353ba532fdaa3b8d(
     metric_name: builtins.str,
     *,

aws_cdk/aws_sqs/__init__.py

@@ -806,7 +806,7 @@ class CfnQueuePolicy(
         :param scope: Scope in which this resource is defined.
         :param id: Construct identifier for this resource (unique in its scope).
         :param policy_document: A policy document that contains the permissions for the specified Amazon SQS queues. For more information about Amazon SQS policies, see `Using custom policies with the Amazon SQS access policy language <https://docs.aws.amazon.com/AWSSimpleQueueService/latest/SQSDeveloperGuide/sqs-creating-custom-policies.html>`_ in the *Amazon SQS Developer Guide* .
-        :param queues: The URLs of the queues to which you want to add the policy. You can use the ``[Ref](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/intrinsic-function-reference-ref.html)`` function to specify an ``[AWS::SQS::Queue](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-sqs-queues.html)`` resource.
+        :param queues: The URLs of the queues to which you want to add the policy. You can use the ``[Ref](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/intrinsic-function-reference-ref.html)`` function to specify an ``[AWS::SQS::Queue](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-sqs-queue.html)`` resource.
         '''
         if __debug__:
             type_hints = typing.get_type_hints(_typecheckingstub__cf0938ca02c83217053a748eaced04a040ecea55f727e4a44ff3eff90a9ea987)
@@ -902,7 +902,7 @@ class CfnQueuePolicyProps:
         '''Properties for defining a ``CfnQueuePolicy``.
 
         :param policy_document: A policy document that contains the permissions for the specified Amazon SQS queues. For more information about Amazon SQS policies, see `Using custom policies with the Amazon SQS access policy language <https://docs.aws.amazon.com/AWSSimpleQueueService/latest/SQSDeveloperGuide/sqs-creating-custom-policies.html>`_ in the *Amazon SQS Developer Guide* .
-        :param queues: The URLs of the queues to which you want to add the policy. You can use the ``[Ref](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/intrinsic-function-reference-ref.html)`` function to specify an ``[AWS::SQS::Queue](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-sqs-queues.html)`` resource.
+        :param queues: The URLs of the queues to which you want to add the policy. You can use the ``[Ref](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/intrinsic-function-reference-ref.html)`` function to specify an ``[AWS::SQS::Queue](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-sqs-queue.html)`` resource.
 
         :see: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-sqs-queuepolicy.html
         :exampleMetadata: fixture=_generated
@@ -945,7 +945,7 @@ class CfnQueuePolicyProps:
     def queues(self) -> typing.List[builtins.str]:
         '''The URLs of the queues to which you want to add the policy.
 
-        You can use the ``[Ref](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/intrinsic-function-reference-ref.html)`` function to specify an ``[AWS::SQS::Queue](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-sqs-queues.html)`` resource.
+        You can use the ``[Ref](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/intrinsic-function-reference-ref.html)`` function to specify an ``[AWS::SQS::Queue](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-sqs-queue.html)`` resource.
 
         :see: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-sqs-queuepolicy.html#cfn-sqs-queuepolicy-queues
         '''