aws-cdk-lib 2.149.0__py3-none-any.whl → 2.151.0__py3-none-any.whl

aws_cdk/aws_cloudwatch/__init__.py

@@ -14799,7 +14799,7 @@ class Alarm(
     def add_alarm_action(self, *actions: IAlarmAction) -> None:
         '''Trigger this action if the alarm fires.
 
-        Typically SnsAcion or AutoScalingAction.
+        Typically SnsAction or AutoScalingAction.
 
         :param actions: -
         '''

aws_cdk/aws_codepipeline/__init__.py

@@ -5139,7 +5139,7 @@ class CfnWebhook(
         '''
         :param scope: Scope in which this resource is defined.
         :param id: Construct identifier for this resource (unique in its scope).
-        :param authentication: Supported options are GITHUB_HMAC, IP, and UNAUTHENTICATED. - For information about the authentication scheme implemented by GITHUB_HMAC, see `Securing your webhooks <https://docs.aws.amazon.com/https://developer.github.com/webhooks/securing/>`_ on the GitHub Developer website. - IP rejects webhooks trigger requests unless they originate from an IP address in the IP range whitelisted in the authentication configuration. - UNAUTHENTICATED accepts all webhook trigger requests regardless of origin.
+        :param authentication: Supported options are GITHUB_HMAC, IP, and UNAUTHENTICATED. .. epigraph:: When creating CodePipeline webhooks, do not use your own credentials or reuse the same secret token across multiple webhooks. For optimal security, generate a unique secret token for each webhook you create. The secret token is an arbitrary string that you provide, which GitHub uses to compute and sign the webhook payloads sent to CodePipeline, for protecting the integrity and authenticity of the webhook payloads. Using your own credentials or reusing the same token across multiple webhooks can lead to security vulnerabilities. - For information about the authentication scheme implemented by GITHUB_HMAC, see `Securing your webhooks <https://docs.aws.amazon.com/https://developer.github.com/webhooks/securing/>`_ on the GitHub Developer website. - IP rejects webhooks trigger requests unless they originate from an IP address in the IP range whitelisted in the authentication configuration. - UNAUTHENTICATED accepts all webhook trigger requests regardless of origin.
         :param authentication_configuration: Properties that configure the authentication applied to incoming webhook trigger requests. The required properties depend on the authentication type. For GITHUB_HMAC, only the ``SecretToken`` property must be set. For IP, only the ``AllowedIPRange`` property must be set to a valid CIDR range. For UNAUTHENTICATED, no properties can be set.
         :param filters: A list of rules applied to the body/payload sent in the POST request to a webhook URL. All defined rules must pass for the request to be accepted and the pipeline started.
         :param target_action: The name of the action in a pipeline you want to connect to the webhook. The action must be from the source (first) stage of the pipeline.
@@ -5354,7 +5354,7 @@ class CfnWebhook(
             '''The authentication applied to incoming webhook trigger requests.
 
             :param allowed_ip_range: The property used to configure acceptance of webhooks in an IP address range. For IP, only the ``AllowedIPRange`` property must be set. This property must be set to a valid CIDR range.
-            :param secret_token: The property used to configure GitHub authentication. For GITHUB_HMAC, only the ``SecretToken`` property must be set.
+            :param secret_token: The property used to configure GitHub authentication. For GITHUB_HMAC, only the ``SecretToken`` property must be set. .. epigraph:: When creating CodePipeline webhooks, do not use your own credentials or reuse the same secret token across multiple webhooks. For optimal security, generate a unique secret token for each webhook you create. The secret token is an arbitrary string that you provide, which GitHub uses to compute and sign the webhook payloads sent to CodePipeline, for protecting the integrity and authenticity of the webhook payloads. Using your own credentials or reusing the same token across multiple webhooks can lead to security vulnerabilities.
 
             :see: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-codepipeline-webhook-webhookauthconfiguration.html
             :exampleMetadata: fixture=_generated
@@ -5393,9 +5393,11 @@ class CfnWebhook(
 
         @builtins.property
         def secret_token(self) -> typing.Optional[builtins.str]:
-            '''The property used to configure GitHub authentication.
+            '''The property used to configure GitHub authentication. For GITHUB_HMAC, only the ``SecretToken`` property must be set.
 
-            For GITHUB_HMAC, only the ``SecretToken`` property must be set.
+            .. epigraph::
+
+               When creating CodePipeline webhooks, do not use your own credentials or reuse the same secret token across multiple webhooks. For optimal security, generate a unique secret token for each webhook you create. The secret token is an arbitrary string that you provide, which GitHub uses to compute and sign the webhook payloads sent to CodePipeline, for protecting the integrity and authenticity of the webhook payloads. Using your own credentials or reusing the same token across multiple webhooks can lead to security vulnerabilities.
 
             :see: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-codepipeline-webhook-webhookauthconfiguration.html#cfn-codepipeline-webhook-webhookauthconfiguration-secrettoken
             '''
@@ -5520,7 +5522,7 @@ class CfnWebhookProps:
     ) -> None:
         '''Properties for defining a ``CfnWebhook``.
 
-        :param authentication: Supported options are GITHUB_HMAC, IP, and UNAUTHENTICATED. - For information about the authentication scheme implemented by GITHUB_HMAC, see `Securing your webhooks <https://docs.aws.amazon.com/https://developer.github.com/webhooks/securing/>`_ on the GitHub Developer website. - IP rejects webhooks trigger requests unless they originate from an IP address in the IP range whitelisted in the authentication configuration. - UNAUTHENTICATED accepts all webhook trigger requests regardless of origin.
+        :param authentication: Supported options are GITHUB_HMAC, IP, and UNAUTHENTICATED. .. epigraph:: When creating CodePipeline webhooks, do not use your own credentials or reuse the same secret token across multiple webhooks. For optimal security, generate a unique secret token for each webhook you create. The secret token is an arbitrary string that you provide, which GitHub uses to compute and sign the webhook payloads sent to CodePipeline, for protecting the integrity and authenticity of the webhook payloads. Using your own credentials or reusing the same token across multiple webhooks can lead to security vulnerabilities. - For information about the authentication scheme implemented by GITHUB_HMAC, see `Securing your webhooks <https://docs.aws.amazon.com/https://developer.github.com/webhooks/securing/>`_ on the GitHub Developer website. - IP rejects webhooks trigger requests unless they originate from an IP address in the IP range whitelisted in the authentication configuration. - UNAUTHENTICATED accepts all webhook trigger requests regardless of origin.
         :param authentication_configuration: Properties that configure the authentication applied to incoming webhook trigger requests. The required properties depend on the authentication type. For GITHUB_HMAC, only the ``SecretToken`` property must be set. For IP, only the ``AllowedIPRange`` property must be set to a valid CIDR range. For UNAUTHENTICATED, no properties can be set.
         :param filters: A list of rules applied to the body/payload sent in the POST request to a webhook URL. All defined rules must pass for the request to be accepted and the pipeline started.
         :param target_action: The name of the action in a pipeline you want to connect to the webhook. The action must be from the source (first) stage of the pipeline.
@@ -5586,6 +5588,10 @@ class CfnWebhookProps:
     def authentication(self) -> builtins.str:
         '''Supported options are GITHUB_HMAC, IP, and UNAUTHENTICATED.
 
+        .. epigraph::
+
+           When creating CodePipeline webhooks, do not use your own credentials or reuse the same secret token across multiple webhooks. For optimal security, generate a unique secret token for each webhook you create. The secret token is an arbitrary string that you provide, which GitHub uses to compute and sign the webhook payloads sent to CodePipeline, for protecting the integrity and authenticity of the webhook payloads. Using your own credentials or reusing the same token across multiple webhooks can lead to security vulnerabilities.
+
         - For information about the authentication scheme implemented by GITHUB_HMAC, see `Securing your webhooks <https://docs.aws.amazon.com/https://developer.github.com/webhooks/securing/>`_ on the GitHub Developer website.
         - IP rejects webhooks trigger requests unless they originate from an IP address in the IP range whitelisted in the authentication configuration.
         - UNAUTHENTICATED accepts all webhook trigger requests regardless of origin.

aws_cdk/aws_cognito/__init__.py

@@ -10971,8 +10971,7 @@ class CfnUserPoolUICustomizationAttachment(
     @builtins.property
     @jsii.member(jsii_name="attrId")
     def attr_id(self) -> builtins.str:
-        '''The resource ID.
-
+        '''
         :cloudformationAttribute: Id
         '''
         return typing.cast(builtins.str, jsii.get(self, "attrId"))

aws_cdk/aws_ec2/__init__.py

@@ -2399,6 +2399,8 @@ instance_profile = iam.InstanceProfile(self, "InstanceProfile",
 )
 
 template = ec2.LaunchTemplate(self, "LaunchTemplate",
+    launch_template_name="MyTemplateV1",
+    version_description="This is my v1 template",
     machine_image=ec2.MachineImage.latest_amazon_linux2023(),
     security_group=ec2.SecurityGroup(self, "LaunchTemplateSG",
         vpc=vpc
@@ -11250,7 +11252,7 @@ class CfnEC2Fleet(
             :param placement: The location where the instance launched, if applicable.
             :param priority: The priority for the launch template override. The highest priority is launched first. If the On-Demand ``AllocationStrategy`` is set to ``prioritized`` , EC2 Fleet uses priority to determine which launch template override to use first in fulfilling On-Demand capacity. If the Spot ``AllocationStrategy`` is set to ``capacity-optimized-prioritized`` , EC2 Fleet uses priority on a best-effort basis to determine which launch template override to use in fulfilling Spot capacity, but optimizes for capacity first. Valid values are whole numbers starting at ``0`` . The lower the number, the higher the priority. If no number is set, the launch template override has the lowest priority. You can set the same priority for different launch template overrides.
             :param subnet_id: The IDs of the subnets in which to launch the instances. Separate multiple subnet IDs using commas (for example, ``subnet-1234abcdeexample1, subnet-0987cdef6example2`` ). A request of type ``instant`` can have only one subnet ID.
-            :param weighted_capacity: The number of units provided by the specified instance type. .. epigraph:: When specifying weights, the price used in the ``lowest-price`` and ``price-capacity-optimized`` allocation strategies is per *unit* hour (where the instance price is divided by the specified weight). However, if all the specified weights are above the requested ``TargetCapacity`` , resulting in only 1 instance being launched, the price used is per *instance* hour.
+            :param weighted_capacity: The number of units provided by the specified instance type. These are the same units that you chose to set the target capacity in terms of instances, or a performance characteristic such as vCPUs, memory, or I/O. If the target capacity divided by this value is not a whole number, Amazon EC2 rounds the number of instances to the next whole number. If this value is not specified, the default is 1. .. epigraph:: When specifying weights, the price used in the ``lowest-price`` and ``price-capacity-optimized`` allocation strategies is per *unit* hour (where the instance price is divided by the specified weight). However, if all the specified weights are above the requested ``TargetCapacity`` , resulting in only 1 instance being launched, the price used is per *instance* hour.
 
             :see: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-ec2-ec2fleet-fleetlaunchtemplateoverridesrequest.html
             :exampleMetadata: fixture=_generated
@@ -11455,6 +11457,9 @@ class CfnEC2Fleet(
         def weighted_capacity(self) -> typing.Optional[jsii.Number]:
             '''The number of units provided by the specified instance type.
 
+            These are the same units that you chose to set the target capacity in terms of instances, or a performance characteristic such as vCPUs, memory, or I/O.
+
+            If the target capacity divided by this value is not a whole number, Amazon EC2 rounds the number of instances to the next whole number. If this value is not specified, the default is 1.
             .. epigraph::
 
                When specifying weights, the price used in the ``lowest-price`` and ``price-capacity-optimized`` allocation strategies is per *unit* hour (where the instance price is divided by the specified weight). However, if all the specified weights are above the requested ``TargetCapacity`` , resulting in only 1 instance being launched, the price used is per *instance* hour.
@@ -16921,7 +16926,7 @@ class CfnIPAMPool(
         :param auto_import: If selected, IPAM will continuously look for resources within the CIDR range of this pool and automatically import them as allocations into your IPAM. The CIDRs that will be allocated for these resources must not already be allocated to other resources in order for the import to succeed. IPAM will import a CIDR regardless of its compliance with the pool's allocation rules, so a resource might be imported and subsequently marked as noncompliant. If IPAM discovers multiple CIDRs that overlap, IPAM will import the largest CIDR only. If IPAM discovers multiple CIDRs with matching CIDRs, IPAM will randomly import one of them only. A locale must be set on the pool for this feature to work.
         :param aws_service: Limits which service in AWS that the pool can be used in. "ec2", for example, allows users to use space for Elastic IP addresses and VPCs.
         :param description: The description of the IPAM pool.
-        :param locale: The locale of the IPAM pool. In IPAM, the locale is the AWS Region where you want to make an IPAM pool available for allocations. Only resources in the same Region as the locale of the pool can get IP address allocations from the pool. You can only allocate a CIDR for a VPC, for example, from an IPAM pool that shares a locale with the VPC’s Region. Note that once you choose a Locale for a pool, you cannot modify it. If you choose an AWS Region for locale that has not been configured as an operating Region for the IPAM, you'll get an error.
+        :param locale: The locale of the IPAM pool. The locale for the pool should be one of the following: - An AWS Region where you want this IPAM pool to be available for allocations. - The network border group for an AWS Local Zone where you want this IPAM pool to be available for allocations ( `supported Local Zones <https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/ec2-byoip.html#byoip-zone-avail>`_ ). This option is only available for IPAM IPv4 pools in the public scope. If you choose an AWS Region for locale that has not been configured as an operating Region for the IPAM, you'll get an error.
         :param provisioned_cidrs: Information about the CIDRs provisioned to an IPAM pool.
         :param public_ip_source: The IP address source for pools in the public scope. Only used for provisioning IP address CIDRs to pools in the public scope. Default is ``BYOIP`` . For more information, see `Create IPv6 pools <https://docs.aws.amazon.com//vpc/latest/ipam/intro-create-ipv6-pools.html>`_ in the *Amazon VPC IPAM User Guide* . By default, you can add only one Amazon-provided IPv6 CIDR block to a top-level IPv6 pool. For information on increasing the default limit, see `Quotas for your IPAM <https://docs.aws.amazon.com//vpc/latest/ipam/quotas-ipam.html>`_ in the *Amazon VPC IPAM User Guide* .
         :param publicly_advertisable: Determines if a pool is publicly advertisable. This option is not available for pools with AddressFamily set to ``ipv4`` .
@@ -17774,7 +17779,7 @@ class CfnIPAMPoolProps:
         :param auto_import: If selected, IPAM will continuously look for resources within the CIDR range of this pool and automatically import them as allocations into your IPAM. The CIDRs that will be allocated for these resources must not already be allocated to other resources in order for the import to succeed. IPAM will import a CIDR regardless of its compliance with the pool's allocation rules, so a resource might be imported and subsequently marked as noncompliant. If IPAM discovers multiple CIDRs that overlap, IPAM will import the largest CIDR only. If IPAM discovers multiple CIDRs with matching CIDRs, IPAM will randomly import one of them only. A locale must be set on the pool for this feature to work.
         :param aws_service: Limits which service in AWS that the pool can be used in. "ec2", for example, allows users to use space for Elastic IP addresses and VPCs.
         :param description: The description of the IPAM pool.
-        :param locale: The locale of the IPAM pool. In IPAM, the locale is the AWS Region where you want to make an IPAM pool available for allocations. Only resources in the same Region as the locale of the pool can get IP address allocations from the pool. You can only allocate a CIDR for a VPC, for example, from an IPAM pool that shares a locale with the VPC’s Region. Note that once you choose a Locale for a pool, you cannot modify it. If you choose an AWS Region for locale that has not been configured as an operating Region for the IPAM, you'll get an error.
+        :param locale: The locale of the IPAM pool. The locale for the pool should be one of the following: - An AWS Region where you want this IPAM pool to be available for allocations. - The network border group for an AWS Local Zone where you want this IPAM pool to be available for allocations ( `supported Local Zones <https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/ec2-byoip.html#byoip-zone-avail>`_ ). This option is only available for IPAM IPv4 pools in the public scope. If you choose an AWS Region for locale that has not been configured as an operating Region for the IPAM, you'll get an error.
         :param provisioned_cidrs: Information about the CIDRs provisioned to an IPAM pool.
         :param public_ip_source: The IP address source for pools in the public scope. Only used for provisioning IP address CIDRs to pools in the public scope. Default is ``BYOIP`` . For more information, see `Create IPv6 pools <https://docs.aws.amazon.com//vpc/latest/ipam/intro-create-ipv6-pools.html>`_ in the *Amazon VPC IPAM User Guide* . By default, you can add only one Amazon-provided IPv6 CIDR block to a top-level IPv6 pool. For information on increasing the default limit, see `Quotas for your IPAM <https://docs.aws.amazon.com//vpc/latest/ipam/quotas-ipam.html>`_ in the *Amazon VPC IPAM User Guide* .
         :param publicly_advertisable: Determines if a pool is publicly advertisable. This option is not available for pools with AddressFamily set to ``ipv4`` .
@@ -17981,7 +17986,12 @@ class CfnIPAMPoolProps:
     def locale(self) -> typing.Optional[builtins.str]:
         '''The locale of the IPAM pool.
 
-        In IPAM, the locale is the AWS Region where you want to make an IPAM pool available for allocations. Only resources in the same Region as the locale of the pool can get IP address allocations from the pool. You can only allocate a CIDR for a VPC, for example, from an IPAM pool that shares a locale with the VPC’s Region. Note that once you choose a Locale for a pool, you cannot modify it. If you choose an AWS Region for locale that has not been configured as an operating Region for the IPAM, you'll get an error.
+        The locale for the pool should be one of the following:
+
+        - An AWS Region where you want this IPAM pool to be available for allocations.
+        - The network border group for an AWS Local Zone where you want this IPAM pool to be available for allocations ( `supported Local Zones <https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/ec2-byoip.html#byoip-zone-avail>`_ ). This option is only available for IPAM IPv4 pools in the public scope.
+
+        If you choose an AWS Region for locale that has not been configured as an operating Region for the IPAM, you'll get an error.
 
         :see: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-ec2-ipampool.html#cfn-ec2-ipampool-locale
         '''
@@ -45095,7 +45105,7 @@ class CfnSpotFleet(
             :param priority: The priority for the launch template override. The highest priority is launched first. If ``OnDemandAllocationStrategy`` is set to ``prioritized`` , Spot Fleet uses priority to determine which launch template override to use first in fulfilling On-Demand capacity. If the Spot ``AllocationStrategy`` is set to ``capacityOptimizedPrioritized`` , Spot Fleet uses priority on a best-effort basis to determine which launch template override to use in fulfilling Spot capacity, but optimizes for capacity first. Valid values are whole numbers starting at ``0`` . The lower the number, the higher the priority. If no number is set, the launch template override has the lowest priority. You can set the same priority for different launch template overrides.
             :param spot_price: The maximum price per unit hour that you are willing to pay for a Spot Instance. We do not recommend using this parameter because it can lead to increased interruptions. If you do not specify this parameter, you will pay the current Spot price. .. epigraph:: If you specify a maximum price, your instances will be interrupted more frequently than if you do not specify this parameter.
             :param subnet_id: The ID of the subnet in which to launch the instances.
-            :param weighted_capacity: The number of units provided by the specified instance type. .. epigraph:: When specifying weights, the price used in the ``lowest-price`` and ``price-capacity-optimized`` allocation strategies is per *unit* hour (where the instance price is divided by the specified weight). However, if all the specified weights are above the requested ``TargetCapacity`` , resulting in only 1 instance being launched, the price used is per *instance* hour.
+            :param weighted_capacity: The number of units provided by the specified instance type. These are the same units that you chose to set the target capacity in terms of instances, or a performance characteristic such as vCPUs, memory, or I/O. If the target capacity divided by this value is not a whole number, Amazon EC2 rounds the number of instances to the next whole number. If this value is not specified, the default is 1. .. epigraph:: When specifying weights, the price used in the ``lowestPrice`` and ``priceCapacityOptimized`` allocation strategies is per *unit* hour (where the instance price is divided by the specified weight). However, if all the specified weights are above the requested ``TargetCapacity`` , resulting in only 1 instance being launched, the price used is per *instance* hour.
 
             :see: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-ec2-spotfleet-launchtemplateoverrides.html
             :exampleMetadata: fixture=_generated
@@ -45269,9 +45279,12 @@ class CfnSpotFleet(
         def weighted_capacity(self) -> typing.Optional[jsii.Number]:
             '''The number of units provided by the specified instance type.
 
+            These are the same units that you chose to set the target capacity in terms of instances, or a performance characteristic such as vCPUs, memory, or I/O.
+
+            If the target capacity divided by this value is not a whole number, Amazon EC2 rounds the number of instances to the next whole number. If this value is not specified, the default is 1.
             .. epigraph::
 
-               When specifying weights, the price used in the ``lowest-price`` and ``price-capacity-optimized`` allocation strategies is per *unit* hour (where the instance price is divided by the specified weight). However, if all the specified weights are above the requested ``TargetCapacity`` , resulting in only 1 instance being launched, the price used is per *instance* hour.
+               When specifying weights, the price used in the ``lowestPrice`` and ``priceCapacityOptimized`` allocation strategies is per *unit* hour (where the instance price is divided by the specified weight). However, if all the specified weights are above the requested ``TargetCapacity`` , resulting in only 1 instance being launched, the price used is per *instance* hour.
 
             :see: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-ec2-spotfleet-launchtemplateoverrides.html#cfn-ec2-spotfleet-launchtemplateoverrides-weightedcapacity
             '''
@@ -45904,7 +45917,7 @@ class CfnSpotFleet(
             :param subnet_id: The IDs of the subnets in which to launch the instances. To specify multiple subnets, separate them using commas; for example, "subnet-1234abcdeexample1, subnet-0987cdef6example2". If you specify a network interface, you must specify any subnets as part of the network interface instead of using this parameter.
             :param tag_specifications: The tags to apply during creation.
             :param user_data: The base64-encoded user data that instances use when starting up. User data is limited to 16 KB.
-            :param weighted_capacity: The number of units provided by the specified instance type. These are the same units that you chose to set the target capacity in terms of instances, or a performance characteristic such as vCPUs, memory, or I/O. If the target capacity divided by this value is not a whole number, Amazon EC2 rounds the number of instances to the next whole number. If this value is not specified, the default is 1.
+            :param weighted_capacity: The number of units provided by the specified instance type. These are the same units that you chose to set the target capacity in terms of instances, or a performance characteristic such as vCPUs, memory, or I/O. If the target capacity divided by this value is not a whole number, Amazon EC2 rounds the number of instances to the next whole number. If this value is not specified, the default is 1. .. epigraph:: When specifying weights, the price used in the ``lowestPrice`` and ``priceCapacityOptimized`` allocation strategies is per *unit* hour (where the instance price is divided by the specified weight). However, if all the specified weights are above the requested ``TargetCapacity`` , resulting in only 1 instance being launched, the price used is per *instance* hour.
 
             :see: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-ec2-spotfleet-spotfleetlaunchspecification.html
             :exampleMetadata: fixture=_generated
@@ -46304,6 +46317,9 @@ class CfnSpotFleet(
             These are the same units that you chose to set the target capacity in terms of instances, or a performance characteristic such as vCPUs, memory, or I/O.
 
             If the target capacity divided by this value is not a whole number, Amazon EC2 rounds the number of instances to the next whole number. If this value is not specified, the default is 1.
+            .. epigraph::
+
+               When specifying weights, the price used in the ``lowestPrice`` and ``priceCapacityOptimized`` allocation strategies is per *unit* hour (where the instance price is divided by the specified weight). However, if all the specified weights are above the requested ``TargetCapacity`` , resulting in only 1 instance being launched, the price used is per *instance* hour.
 
             :see: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-ec2-spotfleet-spotfleetlaunchspecification.html#cfn-ec2-spotfleet-spotfleetlaunchspecification-weightedcapacity
             '''
@@ -72275,6 +72291,51 @@ class Instance(
             check_type(argname="argument commands", value=commands, expected_type=typing.Tuple[type_hints["commands"], ...]) # pyright: ignore [reportGeneralTypeIssues]
         return typing.cast(None, jsii.invoke(self, "addUserData", [*commands]))
 
+    @jsii.member(jsii_name="applyCloudFormationInit")
+    def apply_cloud_formation_init(
+        self,
+        init: CloudFormationInit,
+        *,
+        config_sets: typing.Optional[typing.Sequence[builtins.str]] = None,
+        embed_fingerprint: typing.Optional[builtins.bool] = None,
+        ignore_failures: typing.Optional[builtins.bool] = None,
+        include_role: typing.Optional[builtins.bool] = None,
+        include_url: typing.Optional[builtins.bool] = None,
+        print_log: typing.Optional[builtins.bool] = None,
+        timeout: typing.Optional[_Duration_4839e8c3] = None,
+    ) -> None:
+        '''Use a CloudFormation Init configuration at instance startup.
+
+        This does the following:
+
+        - Attaches the CloudFormation Init metadata to the Instance resource.
+        - Add commands to the instance UserData to run ``cfn-init`` and ``cfn-signal``.
+        - Update the instance's CreationPolicy to wait for the ``cfn-signal`` commands.
+
+        :param init: -
+        :param config_sets: ConfigSet to activate. Default: ['default']
+        :param embed_fingerprint: Force instance replacement by embedding a config fingerprint. If ``true`` (the default), a hash of the config will be embedded into the UserData, so that if the config changes, the UserData changes. - If the EC2 instance is instance-store backed or ``userDataCausesReplacement`` is set, this will cause the instance to be replaced and the new configuration to be applied. - If the instance is EBS-backed and ``userDataCausesReplacement`` is not set, the change of UserData will make the instance restart but not be replaced, and the configuration will not be applied automatically. If ``false``, no hash will be embedded, and if the CloudFormation Init config changes nothing will happen to the running instance. If a config update introduces errors, you will not notice until after the CloudFormation deployment successfully finishes and the next instance fails to launch. Default: true
+        :param ignore_failures: Don't fail the instance creation when cfn-init fails. You can use this to prevent CloudFormation from rolling back when instances fail to start up, to help in debugging. Default: false
+        :param include_role: Include --role argument when running cfn-init and cfn-signal commands. This will be the IAM instance profile attached to the EC2 instance Default: false
+        :param include_url: Include --url argument when running cfn-init and cfn-signal commands. This will be the cloudformation endpoint in the deployed region e.g. https://cloudformation.us-east-1.amazonaws.com Default: false
+        :param print_log: Print the results of running cfn-init to the Instance System Log. By default, the output of running cfn-init is written to a log file on the instance. Set this to ``true`` to print it to the System Log (visible from the EC2 Console), ``false`` to not print it. (Be aware that the system log is refreshed at certain points in time of the instance life cycle, and successful execution may not always show up). Default: true
+        :param timeout: Timeout waiting for the configuration to be applied. Default: Duration.minutes(5)
+        '''
+        if __debug__:
+            type_hints = typing.get_type_hints(_typecheckingstub__53b303537c54bd04722c794882b372a979c13db12619a012ce63ca57718733ff)
+            check_type(argname="argument init", value=init, expected_type=type_hints["init"])
+        options = ApplyCloudFormationInitOptions(
+            config_sets=config_sets,
+            embed_fingerprint=embed_fingerprint,
+            ignore_failures=ignore_failures,
+            include_role=include_role,
+            include_url=include_url,
+            print_log=print_log,
+            timeout=timeout,
+        )
+
+        return typing.cast(None, jsii.invoke(self, "applyCloudFormationInit", [init, options]))
+
     @builtins.property
     @jsii.member(jsii_name="connections")
     def connections(self) -> "Connections":
@@ -72782,6 +72843,10 @@ class InstanceClass(enum.Enum):
     '''Graphics-optimized instances powered by AWS Graviton2 Processors and NVIDIA T4G Tensor Core GPUs, 5th generation.'''
     G5G = "G5G"
     '''Graphics-optimized instances powered by AWS Graviton2 Processors and NVIDIA T4G Tensor Core GPUs, 5th generation.'''
+    GRAPHICS6 = "GRAPHICS6"
+    '''Graphics-optimized instances, 6th generation.'''
+    G6 = "G6"
+    '''Graphics-optimized instances, 6th generation.'''
     PARALLEL2 = "PARALLEL2"
     '''Parallel-processing optimized instances, 2nd generation.'''
     P2 = "P2"
@@ -76570,6 +76635,7 @@ class LaunchTemplate(
         security_group: typing.Optional[ISecurityGroup] = None,
         spot_options: typing.Optional[typing.Union["LaunchTemplateSpotOptions", typing.Dict[builtins.str, typing.Any]]] = None,
         user_data: typing.Optional["UserData"] = None,
+        version_description: typing.Optional[builtins.str] = None,
     ) -> None:
         '''
         :param scope: -
@@ -76599,6 +76665,7 @@ class LaunchTemplate(
         :param security_group: Security group to assign to instances created with the launch template. Default: No security group is assigned.
         :param spot_options: If this property is defined, then the Launch Template's InstanceMarketOptions will be set to use Spot instances, and the options for the Spot instances will be as defined. Default: - Instance launched with this template will not be spot instances.
         :param user_data: The AMI that will be used by instances. Default: - This Launch Template creates a UserData based on the type of provided machineImage; no UserData is created if a machineImage is not provided
+        :param version_description: A description for the first version of the launch template. The version description must be maximum 255 characters long. Default: - No description
         '''
         if __debug__:
             type_hints = typing.get_type_hints(_typecheckingstub__544aef11081ec87047935491f75a3d5bc9d5075de77f96969bd2ffd1a0d78cc9)
@@ -76630,6 +76697,7 @@ class LaunchTemplate(
             security_group=security_group,
             spot_options=spot_options,
             user_data=user_data,
+            version_description=version_description,
         )
 
         jsii.create(self.__class__, self, [scope, id, props])
@@ -76938,6 +77006,7 @@ class LaunchTemplateHttpTokens(enum.Enum):
         "security_group": "securityGroup",
         "spot_options": "spotOptions",
         "user_data": "userData",
+        "version_description": "versionDescription",
     },
 )
 class LaunchTemplateProps:
@@ -76969,6 +77038,7 @@ class LaunchTemplateProps:
         security_group: typing.Optional[ISecurityGroup] = None,
         spot_options: typing.Optional[typing.Union["LaunchTemplateSpotOptions", typing.Dict[builtins.str, typing.Any]]] = None,
         user_data: typing.Optional["UserData"] = None,
+        version_description: typing.Optional[builtins.str] = None,
     ) -> None:
         '''Properties of a LaunchTemplate.
 
@@ -76997,6 +77067,7 @@ class LaunchTemplateProps:
         :param security_group: Security group to assign to instances created with the launch template. Default: No security group is assigned.
         :param spot_options: If this property is defined, then the Launch Template's InstanceMarketOptions will be set to use Spot instances, and the options for the Spot instances will be as defined. Default: - Instance launched with this template will not be spot instances.
         :param user_data: The AMI that will be used by instances. Default: - This Launch Template creates a UserData based on the type of provided machineImage; no UserData is created if a machineImage is not provided
+        :param version_description: A description for the first version of the launch template. The version description must be maximum 255 characters long. Default: - No description
 
         :exampleMetadata: infused
 
@@ -77048,6 +77119,7 @@ class LaunchTemplateProps:
             check_type(argname="argument security_group", value=security_group, expected_type=type_hints["security_group"])
             check_type(argname="argument spot_options", value=spot_options, expected_type=type_hints["spot_options"])
             check_type(argname="argument user_data", value=user_data, expected_type=type_hints["user_data"])
+            check_type(argname="argument version_description", value=version_description, expected_type=type_hints["version_description"])
         self._values: typing.Dict[builtins.str, typing.Any] = {}
         if associate_public_ip_address is not None:
             self._values["associate_public_ip_address"] = associate_public_ip_address
@@ -77099,6 +77171,8 @@ class LaunchTemplateProps:
             self._values["spot_options"] = spot_options
         if user_data is not None:
             self._values["user_data"] = user_data
+        if version_description is not None:
+            self._values["version_description"] = version_description
 
     @builtins.property
     def associate_public_ip_address(self) -> typing.Optional[builtins.bool]:
@@ -77383,6 +77457,19 @@ class LaunchTemplateProps:
         result = self._values.get("user_data")
         return typing.cast(typing.Optional["UserData"], result)
 
+    @builtins.property
+    def version_description(self) -> typing.Optional[builtins.str]:
+        '''A description for the first version of the launch template.
+
+        The version description must be maximum 255 characters long.
+
+        :default: - No description
+
+        :see: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-ec2-launchtemplate.html#cfn-ec2-launchtemplate-versiondescription
+        '''
+        result = self._values.get("version_description")
+        return typing.cast(typing.Optional[builtins.str], result)
+
     def __eq__(self, rhs: typing.Any) -> builtins.bool:
         return isinstance(rhs, self.__class__) and rhs._values == self._values
 
@@ -77926,6 +78013,72 @@ class LogFormat(metaclass=jsii.JSIIMeta, jsii_type="aws-cdk-lib.aws_ec2.LogForma
         '''The destination port of the traffic.'''
         return typing.cast("LogFormat", jsii.sget(cls, "DST_PORT"))
 
+    @jsii.python.classproperty
+    @jsii.member(jsii_name="ECS_CLUSTER_ARN")
+    def ECS_CLUSTER_ARN(cls) -> "LogFormat":
+        '''AWS Resource Name (ARN) of the ECS cluster if the traffic is from a running ECS task.'''
+        return typing.cast("LogFormat", jsii.sget(cls, "ECS_CLUSTER_ARN"))
+
+    @jsii.python.classproperty
+    @jsii.member(jsii_name="ECS_CLUSTER_NAME")
+    def ECS_CLUSTER_NAME(cls) -> "LogFormat":
+        '''Name of the ECS cluster if the traffic is from a running ECS task.'''
+        return typing.cast("LogFormat", jsii.sget(cls, "ECS_CLUSTER_NAME"))
+
+    @jsii.python.classproperty
+    @jsii.member(jsii_name="ECS_CONTAINER_ID")
+    def ECS_CONTAINER_ID(cls) -> "LogFormat":
+        '''Docker runtime ID of the container if the traffic is from a running ECS task.
+
+        If there is one container or more in the ECS task, this will be the docker runtime ID of the first container.
+        '''
+        return typing.cast("LogFormat", jsii.sget(cls, "ECS_CONTAINER_ID"))
+
+    @jsii.python.classproperty
+    @jsii.member(jsii_name="ECS_CONTAINER_INSTANCE_ARN")
+    def ECS_CONTAINER_INSTANCE_ARN(cls) -> "LogFormat":
+        '''ARN of the ECS container instance if the traffic is from a running ECS task on an EC2 instance.'''
+        return typing.cast("LogFormat", jsii.sget(cls, "ECS_CONTAINER_INSTANCE_ARN"))
+
+    @jsii.python.classproperty
+    @jsii.member(jsii_name="ECS_CONTAINER_INSTANCE_ID")
+    def ECS_CONTAINER_INSTANCE_ID(cls) -> "LogFormat":
+        '''ID of the ECS container instance if the traffic is from a running ECS task on an EC2 instance.'''
+        return typing.cast("LogFormat", jsii.sget(cls, "ECS_CONTAINER_INSTANCE_ID"))
+
+    @jsii.python.classproperty
+    @jsii.member(jsii_name="ECS_SECOND_CONTAINER_ID")
+    def ECS_SECOND_CONTAINER_ID(cls) -> "LogFormat":
+        '''Docker runtime ID of the container if the traffic is from a running ECS task.
+
+        If there is more than one container in the ECS task, this will be the Docker runtime ID of the second container.
+        '''
+        return typing.cast("LogFormat", jsii.sget(cls, "ECS_SECOND_CONTAINER_ID"))
+
+    @jsii.python.classproperty
+    @jsii.member(jsii_name="ECS_SERVICE_NAME")
+    def ECS_SERVICE_NAME(cls) -> "LogFormat":
+        '''Name of the ECS service if the traffic is from a running ECS task and the ECS task is started by an ECS service.'''
+        return typing.cast("LogFormat", jsii.sget(cls, "ECS_SERVICE_NAME"))
+
+    @jsii.python.classproperty
+    @jsii.member(jsii_name="ECS_TASK_ARN")
+    def ECS_TASK_ARN(cls) -> "LogFormat":
+        '''ARN of the ECS task if the traffic is from a running ECS task.'''
+        return typing.cast("LogFormat", jsii.sget(cls, "ECS_TASK_ARN"))
+
+    @jsii.python.classproperty
+    @jsii.member(jsii_name="ECS_TASK_DEFINITION_ARN")
+    def ECS_TASK_DEFINITION_ARN(cls) -> "LogFormat":
+        '''ARN of the ECS task definition if the traffic is from a running ECS task.'''
+        return typing.cast("LogFormat", jsii.sget(cls, "ECS_TASK_DEFINITION_ARN"))
+
+    @jsii.python.classproperty
+    @jsii.member(jsii_name="ECS_TASK_ID")
+    def ECS_TASK_ID(cls) -> "LogFormat":
+        '''ID of the ECS task if the traffic is from a running ECS task.'''
+        return typing.cast("LogFormat", jsii.sget(cls, "ECS_TASK_ID"))
+
     @jsii.python.classproperty
     @jsii.member(jsii_name="END_TIMESTAMP")
     def END_TIMESTAMP(cls) -> "LogFormat":
@@ -86586,6 +86739,12 @@ class VpcEndpointService(
 
         jsii.create(self.__class__, self, [scope, id, props])
 
+    @jsii.python.classproperty
+    @jsii.member(jsii_name="DEFAULT_PREFIX")
+    def DEFAULT_PREFIX(cls) -> builtins.str:
+        '''The default value for a VPC Endpoint Service name prefix, useful if you do not have a synthesize-time region literal available (all you have is ``{ "Ref": "AWS::Region" }``).'''
+        return typing.cast(builtins.str, jsii.sget(cls, "DEFAULT_PREFIX"))
+
     @builtins.property
     @jsii.member(jsii_name="acceptanceRequired")
     def acceptance_required(self) -> builtins.bool:
@@ -91889,6 +92048,80 @@ class MultipartUserData(
         return typing.cast(builtins.str, jsii.invoke(self, "render", []))
 
 
+class NatGatewayProvider(
+    NatProvider,
+    metaclass=jsii.JSIIMeta,
+    jsii_type="aws-cdk-lib.aws_ec2.NatGatewayProvider",
+):
+    '''Provider for NAT Gateways.
+
+    :exampleMetadata: fixture=_generated
+
+    Example::
+
+        # The code below shows an example of how to instantiate this type.
+        # The values are placeholders you should change.
+        from aws_cdk import aws_ec2 as ec2
+        
+        nat_gateway_provider = ec2.NatGatewayProvider(
+            eip_allocation_ids=["eipAllocationIds"]
+        )
+    '''
+
+    def __init__(
+        self,
+        *,
+        eip_allocation_ids: typing.Optional[typing.Sequence[builtins.str]] = None,
+    ) -> None:
+        '''
+        :param eip_allocation_ids: EIP allocation IDs for the NAT gateways. Default: - No fixed EIPs allocated for the NAT gateways
+        '''
+        props = NatGatewayProps(eip_allocation_ids=eip_allocation_ids)
+
+        jsii.create(self.__class__, self, [props])
+
+    @jsii.member(jsii_name="configureNat")
+    def configure_nat(
+        self,
+        *,
+        nat_subnets: typing.Sequence["PublicSubnet"],
+        private_subnets: typing.Sequence["PrivateSubnet"],
+        vpc: Vpc,
+    ) -> None:
+        '''Called by the VPC to configure NAT.
+
+        Don't call this directly, the VPC will call it automatically.
+
+        :param nat_subnets: The public subnets where the NAT providers need to be placed.
+        :param private_subnets: The private subnets that need to route through the NAT providers. There may be more private subnets than public subnets with NAT providers.
+        :param vpc: The VPC we're configuring NAT for.
+        '''
+        options = ConfigureNatOptions(
+            nat_subnets=nat_subnets, private_subnets=private_subnets, vpc=vpc
+        )
+
+        return typing.cast(None, jsii.invoke(self, "configureNat", [options]))
+
+    @jsii.member(jsii_name="configureSubnet")
+    def configure_subnet(self, subnet: "PrivateSubnet") -> None:
+        '''Configures subnet with the gateway.
+
+        Don't call this directly, the VPC will call it automatically.
+
+        :param subnet: -
+        '''
+        if __debug__:
+            type_hints = typing.get_type_hints(_typecheckingstub__2c352330578bedc14b307b90db4cdd21ccfc59ed0e509c561759015133bdfac9)
+            check_type(argname="argument subnet", value=subnet, expected_type=type_hints["subnet"])
+        return typing.cast(None, jsii.invoke(self, "configureSubnet", [subnet]))
+
+    @builtins.property
+    @jsii.member(jsii_name="configuredGateways")
+    def configured_gateways(self) -> typing.List[GatewayConfig]:
+        '''Return list of gateways spawned by the provider.'''
+        return typing.cast(typing.List[GatewayConfig], jsii.get(self, "configuredGateways"))
+
+
 @jsii.implements(IConnectable)
 class NatInstanceProvider(
     NatProvider,
@@ -94292,6 +94525,7 @@ __all__ = [
     "MultipartUserDataOptions",
     "NamedPackageOptions",
     "NatGatewayProps",
+    "NatGatewayProvider",
     "NatInstanceImage",
     "NatInstanceProps",
     "NatInstanceProvider",
@@ -104316,6 +104550,20 @@ def _typecheckingstub__82601f36068811ad664f607ef04191e661dad31e73a2a8f4f2c40217f
     """Type checking stubs"""
     pass
 
+def _typecheckingstub__53b303537c54bd04722c794882b372a979c13db12619a012ce63ca57718733ff(
+    init: CloudFormationInit,
+    *,
+    config_sets: typing.Optional[typing.Sequence[builtins.str]] = None,
+    embed_fingerprint: typing.Optional[builtins.bool] = None,
+    ignore_failures: typing.Optional[builtins.bool] = None,
+    include_role: typing.Optional[builtins.bool] = None,
+    include_url: typing.Optional[builtins.bool] = None,
+    print_log: typing.Optional[builtins.bool] = None,
+    timeout: typing.Optional[_Duration_4839e8c3] = None,
+) -> None:
+    """Type checking stubs"""
+    pass
+
 def _typecheckingstub__2d4dc63c6e6ee3ddc68d5dd204d8ac5ef1f1dec37a7b84d636225df1c2f17d22(
     *,
     instance_type: InstanceType,
@@ -104542,6 +104790,7 @@ def _typecheckingstub__544aef11081ec87047935491f75a3d5bc9d5075de77f96969bd2ffd1a
     security_group: typing.Optional[ISecurityGroup] = None,
     spot_options: typing.Optional[typing.Union[LaunchTemplateSpotOptions, typing.Dict[builtins.str, typing.Any]]] = None,
     user_data: typing.Optional[UserData] = None,
+    version_description: typing.Optional[builtins.str] = None,
 ) -> None:
     """Type checking stubs"""
     pass
@@ -104599,6 +104848,7 @@ def _typecheckingstub__e2ebb1bf0fbb2f9e894169a610cd9fb7cc3f827d34d3a10351bd2f517
     security_group: typing.Optional[ISecurityGroup] = None,
     spot_options: typing.Optional[typing.Union[LaunchTemplateSpotOptions, typing.Dict[builtins.str, typing.Any]]] = None,
     user_data: typing.Optional[UserData] = None,
+    version_description: typing.Optional[builtins.str] = None,
 ) -> None:
     """Type checking stubs"""
     pass
@@ -106275,6 +106525,12 @@ def _typecheckingstub__d7099fb74981d61c8dfdb2cc1b9c36254deb6f003b7e88f104b7a0a35
     """Type checking stubs"""
     pass
 
+def _typecheckingstub__2c352330578bedc14b307b90db4cdd21ccfc59ed0e509c561759015133bdfac9(
+    subnet: PrivateSubnet,
+) -> None:
+    """Type checking stubs"""
+    pass
+
 def _typecheckingstub__53772cd5bc705ccbd691b4063a85c8427a71a5c9fc29d3af5c0a334c7df3f57a(
     subnet: PrivateSubnet,
 ) -> None: