aws-cdk-lib 2.151.0__py3-none-any.whl → 2.152.0__py3-none-any.whl

aws_cdk/aws_lambda/__init__.py

@@ -820,6 +820,50 @@ fn.add_event_source(eventsources.DynamoEventSource(table,
 ))
 ```
 
+By default, Lambda will encrypt Filter Criteria using AWS managed keys. But if you want to use a self managed KMS key to encrypt the filters, You can specify the self managed key using the `filterEncryption` property.
+
+```python
+import aws_cdk.aws_lambda_event_sources as eventsources
+import aws_cdk.aws_dynamodb as dynamodb
+from aws_cdk.aws_kms import Key
+
+# fn: lambda.Function
+
+table = dynamodb.Table(self, "Table",
+    partition_key=dynamodb.Attribute(
+        name="id",
+        type=dynamodb.AttributeType.STRING
+    ),
+    stream=dynamodb.StreamViewType.NEW_IMAGE
+)
+# Your self managed KMS key
+my_key = Key.from_key_arn(self, "SourceBucketEncryptionKey", "arn:aws:kms:us-east-1:123456789012:key/<key-id>")
+
+fn.add_event_source(eventsources.DynamoEventSource(table,
+    starting_position=lambda_.StartingPosition.LATEST,
+    filters=[lambda_.FilterCriteria.filter({"event_name": lambda_.FilterRule.is_equal("INSERT")})],
+    filter_encryption=my_key
+))
+```
+
+> Lambda requires allow `kms:Decrypt` on Lambda principal `lambda.amazonaws.com` to use the key for Filter Criteria Encryption. If you create the KMS key in the stack, CDK will automatically add this permission to the Key when you creates eventSourceMapping. However, if you import the key using function like `Key.fromKeyArn` then you need to add the following permission to the KMS key before using it to encrypt Filter Criteria
+
+```json
+{
+    "Version": "2012-10-17",
+    "Statement": [
+        {
+            "Effect": "Allow",
+            "Principal": {
+                "Service": "lambda.amazonaws.com"
+            },
+            "Action": "kms:Decrypt",
+            "Resource": "*"
+        }
+    ]
+}
+```
+
 See the documentation for the **@aws-cdk/aws-lambda-event-sources** module for more details.
 
 ## Imported Lambdas
@@ -4374,6 +4418,7 @@ class CfnEventSourceMapping(
                 )]
             ),
             function_response_types=["functionResponseTypes"],
+            kms_key_arn="kmsKeyArn",
             maximum_batching_window_in_seconds=123,
             maximum_record_age_in_seconds=123,
             maximum_retry_attempts=123,
@@ -4416,6 +4461,7 @@ class CfnEventSourceMapping(
         event_source_arn: typing.Optional[builtins.str] = None,
         filter_criteria: typing.Optional[typing.Union[_IResolvable_da3f097b, typing.Union["CfnEventSourceMapping.FilterCriteriaProperty", typing.Dict[builtins.str, typing.Any]]]] = None,
         function_response_types: typing.Optional[typing.Sequence[builtins.str]] = None,
+        kms_key_arn: typing.Optional[builtins.str] = None,
         maximum_batching_window_in_seconds: typing.Optional[jsii.Number] = None,
         maximum_record_age_in_seconds: typing.Optional[jsii.Number] = None,
         maximum_retry_attempts: typing.Optional[jsii.Number] = None,
@@ -4433,29 +4479,30 @@ class CfnEventSourceMapping(
         '''
         :param scope: Scope in which this resource is defined.
         :param id: Construct identifier for this resource (unique in its scope).
-        :param function_name: The name or ARN of the Lambda function. **Name formats** - *Function name* – ``MyFunction`` . - *Function ARN* – ``arn:aws:lambda:us-west-2:123456789012:function:MyFunction`` . - *Version or Alias ARN* – ``arn:aws:lambda:us-west-2:123456789012:function:MyFunction:PROD`` . - *Partial ARN* – ``123456789012:function:MyFunction`` . The length constraint applies only to the full ARN. If you specify only the function name, it's limited to 64 characters in length.
-        :param amazon_managed_kafka_event_source_config: Specific configuration settings for an Amazon Managed Streaming for Apache Kafka (Amazon MSK) event source.
-        :param batch_size: The maximum number of records in each batch that Lambda pulls from your stream or queue and sends to your function. Lambda passes all of the records in the batch to the function in a single call, up to the payload limit for synchronous invocation (6 MB). - *Amazon Kinesis* – Default 100. Max 10,000. - *Amazon DynamoDB Streams* – Default 100. Max 10,000. - *Amazon Simple Queue Service* – Default 10. For standard queues the max is 10,000. For FIFO queues the max is 10. - *Amazon Managed Streaming for Apache Kafka* – Default 100. Max 10,000. - *Self-managed Apache Kafka* – Default 100. Max 10,000. - *Amazon MQ (ActiveMQ and RabbitMQ)* – Default 100. Max 10,000. - *DocumentDB* – Default 100. Max 10,000.
-        :param bisect_batch_on_function_error: (Kinesis and DynamoDB Streams only) If the function returns an error, split the batch in two and retry. The default value is false.
-        :param destination_config: (Kinesis, DynamoDB Streams, Amazon MSK, and self-managed Apache Kafka event sources only) A configuration object that specifies the destination of an event after Lambda processes it.
-        :param document_db_event_source_config: Specific configuration settings for a DocumentDB event source.
-        :param enabled: When true, the event source mapping is active. When false, Lambda pauses polling and invocation. Default: True
-        :param event_source_arn: The Amazon Resource Name (ARN) of the event source. - *Amazon Kinesis* – The ARN of the data stream or a stream consumer. - *Amazon DynamoDB Streams* – The ARN of the stream. - *Amazon Simple Queue Service* – The ARN of the queue. - *Amazon Managed Streaming for Apache Kafka* – The ARN of the cluster or the ARN of the VPC connection (for `cross-account event source mappings <https://docs.aws.amazon.com/lambda/latest/dg/with-msk.html#msk-multi-vpc>`_ ). - *Amazon MQ* – The ARN of the broker. - *Amazon DocumentDB* – The ARN of the DocumentDB change stream.
-        :param filter_criteria: An object that defines the filter criteria that determine whether Lambda should process an event. For more information, see `Lambda event filtering <https://docs.aws.amazon.com/lambda/latest/dg/invocation-eventfiltering.html>`_ .
-        :param function_response_types: (Streams and SQS) A list of current response type enums applied to the event source mapping. Valid Values: ``ReportBatchItemFailures``
-        :param maximum_batching_window_in_seconds: The maximum amount of time, in seconds, that Lambda spends gathering records before invoking the function. *Default ( Kinesis , DynamoDB , Amazon SQS event sources)* : 0 *Default ( Amazon MSK , Kafka, Amazon MQ , Amazon DocumentDB event sources)* : 500 ms *Related setting:* For Amazon SQS event sources, when you set ``BatchSize`` to a value greater than 10, you must set ``MaximumBatchingWindowInSeconds`` to at least 1.
-        :param maximum_record_age_in_seconds: (Kinesis and DynamoDB Streams only) Discard records older than the specified age. The default value is -1, which sets the maximum age to infinite. When the value is set to infinite, Lambda never discards old records. .. epigraph:: The minimum valid value for maximum record age is 60s. Although values less than 60 and greater than -1 fall within the parameter's absolute range, they are not allowed
-        :param maximum_retry_attempts: (Kinesis and DynamoDB Streams only) Discard records after the specified number of retries. The default value is -1, which sets the maximum number of retries to infinite. When MaximumRetryAttempts is infinite, Lambda retries failed records until the record expires in the event source.
-        :param parallelization_factor: (Kinesis and DynamoDB Streams only) The number of batches to process concurrently from each shard. The default value is 1.
-        :param queues: (Amazon MQ) The name of the Amazon MQ broker destination queue to consume.
-        :param scaling_config: (Amazon SQS only) The scaling configuration for the event source. For more information, see `Configuring maximum concurrency for Amazon SQS event sources <https://docs.aws.amazon.com/lambda/latest/dg/with-sqs.html#events-sqs-max-concurrency>`_ .
-        :param self_managed_event_source: The self-managed Apache Kafka cluster for your event source.
-        :param self_managed_kafka_event_source_config: Specific configuration settings for a self-managed Apache Kafka event source.
-        :param source_access_configurations: An array of the authentication protocol, VPC components, or virtual host to secure and define your event source.
-        :param starting_position: The position in a stream from which to start reading. Required for Amazon Kinesis and Amazon DynamoDB. - *LATEST* - Read only new records. - *TRIM_HORIZON* - Process all available records. - *AT_TIMESTAMP* - Specify a time from which to start reading records.
-        :param starting_position_timestamp: With ``StartingPosition`` set to ``AT_TIMESTAMP`` , the time from which to start reading, in Unix time seconds. ``StartingPositionTimestamp`` cannot be in the future.
-        :param topics: The name of the Kafka topic.
-        :param tumbling_window_in_seconds: (Kinesis and DynamoDB Streams only) The duration in seconds of a processing window for DynamoDB and Kinesis Streams event sources. A value of 0 seconds indicates no tumbling window.
+        :param function_name: The name of the Lambda function.
+        :param amazon_managed_kafka_event_source_config: Specific configuration settings for an MSK event source.
+        :param batch_size: The maximum number of items to retrieve in a single batch.
+        :param bisect_batch_on_function_error: (Streams) If the function returns an error, split the batch in two and retry.
+        :param destination_config: A configuration object that specifies the destination of an event after Lambda processes it.
+        :param document_db_event_source_config: Document db event source config.
+        :param enabled: Disables the event source mapping to pause polling and invocation.
+        :param event_source_arn: The Amazon Resource Name (ARN) of the event source.
+        :param filter_criteria: The filter criteria to control event filtering.
+        :param function_response_types: (Streams) A list of response types supported by the function.
+        :param kms_key_arn: The Amazon Resource Name (ARN) of the KMS key.
+        :param maximum_batching_window_in_seconds: (Streams) The maximum amount of time to gather records before invoking the function, in seconds.
+        :param maximum_record_age_in_seconds: (Streams) The maximum age of a record that Lambda sends to a function for processing.
+        :param maximum_retry_attempts: (Streams) The maximum number of times to retry when the function returns an error.
+        :param parallelization_factor: (Streams) The number of batches to process from each shard concurrently.
+        :param queues: (ActiveMQ) A list of ActiveMQ queues.
+        :param scaling_config: The scaling configuration for the event source.
+        :param self_managed_event_source: The configuration used by AWS Lambda to access a self-managed event source.
+        :param self_managed_kafka_event_source_config: Specific configuration settings for a Self-Managed Apache Kafka event source.
+        :param source_access_configurations: A list of SourceAccessConfiguration.
+        :param starting_position: The position in a stream from which to start reading. Required for Amazon Kinesis and Amazon DynamoDB Streams sources.
+        :param starting_position_timestamp: With StartingPosition set to AT_TIMESTAMP, the time from which to start reading, in Unix time seconds.
+        :param topics: (Kafka) A list of Kafka topics.
+        :param tumbling_window_in_seconds: (Streams) Tumbling window (non-overlapping time window) duration to perform aggregations.
         '''
         if __debug__:
             type_hints = typing.get_type_hints(_typecheckingstub__2fc9432254acf5a7dbe3c68dcedbda61de1f0e804a81d20ae79e04857b83d419)
@@ -4472,6 +4519,7 @@ class CfnEventSourceMapping(
             event_source_arn=event_source_arn,
             filter_criteria=filter_criteria,
             function_response_types=function_response_types,
+            kms_key_arn=kms_key_arn,
             maximum_batching_window_in_seconds=maximum_batching_window_in_seconds,
             maximum_record_age_in_seconds=maximum_record_age_in_seconds,
             maximum_retry_attempts=maximum_retry_attempts,
@@ -4522,7 +4570,7 @@ class CfnEventSourceMapping(
     @builtins.property
     @jsii.member(jsii_name="attrId")
     def attr_id(self) -> builtins.str:
-        '''The event source mapping's ID.
+        '''Event Source Mapping Identifier UUID.
 
         :cloudformationAttribute: Id
         '''
@@ -4536,7 +4584,7 @@ class CfnEventSourceMapping(
     @builtins.property
     @jsii.member(jsii_name="functionName")
     def function_name(self) -> builtins.str:
-        '''The name or ARN of the Lambda function.'''
+        '''The name of the Lambda function.'''
         return typing.cast(builtins.str, jsii.get(self, "functionName"))
 
     @function_name.setter
@@ -4551,7 +4599,7 @@ class CfnEventSourceMapping(
     def amazon_managed_kafka_event_source_config(
         self,
     ) -> typing.Optional[typing.Union[_IResolvable_da3f097b, "CfnEventSourceMapping.AmazonManagedKafkaEventSourceConfigProperty"]]:
-        '''Specific configuration settings for an Amazon Managed Streaming for Apache Kafka (Amazon MSK) event source.'''
+        '''Specific configuration settings for an MSK event source.'''
         return typing.cast(typing.Optional[typing.Union[_IResolvable_da3f097b, "CfnEventSourceMapping.AmazonManagedKafkaEventSourceConfigProperty"]], jsii.get(self, "amazonManagedKafkaEventSourceConfig"))
 
     @amazon_managed_kafka_event_source_config.setter
@@ -4567,7 +4615,7 @@ class CfnEventSourceMapping(
     @builtins.property
     @jsii.member(jsii_name="batchSize")
     def batch_size(self) -> typing.Optional[jsii.Number]:
-        '''The maximum number of records in each batch that Lambda pulls from your stream or queue and sends to your function.'''
+        '''The maximum number of items to retrieve in a single batch.'''
         return typing.cast(typing.Optional[jsii.Number], jsii.get(self, "batchSize"))
 
     @batch_size.setter
@@ -4582,7 +4630,7 @@ class CfnEventSourceMapping(
     def bisect_batch_on_function_error(
         self,
     ) -> typing.Optional[typing.Union[builtins.bool, _IResolvable_da3f097b]]:
-        '''(Kinesis and DynamoDB Streams only) If the function returns an error, split the batch in two and retry.'''
+        '''(Streams) If the function returns an error, split the batch in two and retry.'''
         return typing.cast(typing.Optional[typing.Union[builtins.bool, _IResolvable_da3f097b]], jsii.get(self, "bisectBatchOnFunctionError"))
 
     @bisect_batch_on_function_error.setter
@@ -4600,7 +4648,7 @@ class CfnEventSourceMapping(
     def destination_config(
         self,
     ) -> typing.Optional[typing.Union[_IResolvable_da3f097b, "CfnEventSourceMapping.DestinationConfigProperty"]]:
-        '''(Kinesis, DynamoDB Streams, Amazon MSK, and self-managed Apache Kafka event sources only) A configuration object that specifies the destination of an event after Lambda processes it.'''
+        '''A configuration object that specifies the destination of an event after Lambda processes it.'''
         return typing.cast(typing.Optional[typing.Union[_IResolvable_da3f097b, "CfnEventSourceMapping.DestinationConfigProperty"]], jsii.get(self, "destinationConfig"))
 
     @destination_config.setter
@@ -4618,7 +4666,7 @@ class CfnEventSourceMapping(
     def document_db_event_source_config(
         self,
     ) -> typing.Optional[typing.Union[_IResolvable_da3f097b, "CfnEventSourceMapping.DocumentDBEventSourceConfigProperty"]]:
-        '''Specific configuration settings for a DocumentDB event source.'''
+        '''Document db event source config.'''
         return typing.cast(typing.Optional[typing.Union[_IResolvable_da3f097b, "CfnEventSourceMapping.DocumentDBEventSourceConfigProperty"]], jsii.get(self, "documentDbEventSourceConfig"))
 
     @document_db_event_source_config.setter
@@ -4636,10 +4684,7 @@ class CfnEventSourceMapping(
     def enabled(
         self,
     ) -> typing.Optional[typing.Union[builtins.bool, _IResolvable_da3f097b]]:
-        '''When true, the event source mapping is active.
-
-        When false, Lambda pauses polling and invocation.
-        '''
+        '''Disables the event source mapping to pause polling and invocation.'''
         return typing.cast(typing.Optional[typing.Union[builtins.bool, _IResolvable_da3f097b]], jsii.get(self, "enabled"))
 
     @enabled.setter
@@ -4670,7 +4715,7 @@ class CfnEventSourceMapping(
     def filter_criteria(
         self,
     ) -> typing.Optional[typing.Union[_IResolvable_da3f097b, "CfnEventSourceMapping.FilterCriteriaProperty"]]:
-        '''An object that defines the filter criteria that determine whether Lambda should process an event.'''
+        '''The filter criteria to control event filtering.'''
         return typing.cast(typing.Optional[typing.Union[_IResolvable_da3f097b, "CfnEventSourceMapping.FilterCriteriaProperty"]], jsii.get(self, "filterCriteria"))
 
     @filter_criteria.setter
@@ -4686,7 +4731,7 @@ class CfnEventSourceMapping(
     @builtins.property
     @jsii.member(jsii_name="functionResponseTypes")
     def function_response_types(self) -> typing.Optional[typing.List[builtins.str]]:
-        '''(Streams and SQS) A list of current response type enums applied to the event source mapping.'''
+        '''(Streams) A list of response types supported by the function.'''
         return typing.cast(typing.Optional[typing.List[builtins.str]], jsii.get(self, "functionResponseTypes"))
 
     @function_response_types.setter
@@ -4699,10 +4744,23 @@ class CfnEventSourceMapping(
             check_type(argname="argument value", value=value, expected_type=type_hints["value"])
         jsii.set(self, "functionResponseTypes", value)
 
+    @builtins.property
+    @jsii.member(jsii_name="kmsKeyArn")
+    def kms_key_arn(self) -> typing.Optional[builtins.str]:
+        '''The Amazon Resource Name (ARN) of the KMS key.'''
+        return typing.cast(typing.Optional[builtins.str], jsii.get(self, "kmsKeyArn"))
+
+    @kms_key_arn.setter
+    def kms_key_arn(self, value: typing.Optional[builtins.str]) -> None:
+        if __debug__:
+            type_hints = typing.get_type_hints(_typecheckingstub__5110117b05ec57a413615f5bf30afd8bbafb2be839685cf0e158a1b4de420fbc)
+            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
+        jsii.set(self, "kmsKeyArn", value)
+
     @builtins.property
     @jsii.member(jsii_name="maximumBatchingWindowInSeconds")
     def maximum_batching_window_in_seconds(self) -> typing.Optional[jsii.Number]:
-        '''The maximum amount of time, in seconds, that Lambda spends gathering records before invoking the function.'''
+        '''(Streams) The maximum amount of time to gather records before invoking the function, in seconds.'''
         return typing.cast(typing.Optional[jsii.Number], jsii.get(self, "maximumBatchingWindowInSeconds"))
 
     @maximum_batching_window_in_seconds.setter
@@ -4718,7 +4776,7 @@ class CfnEventSourceMapping(
     @builtins.property
     @jsii.member(jsii_name="maximumRecordAgeInSeconds")
     def maximum_record_age_in_seconds(self) -> typing.Optional[jsii.Number]:
-        '''(Kinesis and DynamoDB Streams only) Discard records older than the specified age.'''
+        '''(Streams) The maximum age of a record that Lambda sends to a function for processing.'''
         return typing.cast(typing.Optional[jsii.Number], jsii.get(self, "maximumRecordAgeInSeconds"))
 
     @maximum_record_age_in_seconds.setter
@@ -4734,7 +4792,7 @@ class CfnEventSourceMapping(
     @builtins.property
     @jsii.member(jsii_name="maximumRetryAttempts")
     def maximum_retry_attempts(self) -> typing.Optional[jsii.Number]:
-        '''(Kinesis and DynamoDB Streams only) Discard records after the specified number of retries.'''
+        '''(Streams) The maximum number of times to retry when the function returns an error.'''
         return typing.cast(typing.Optional[jsii.Number], jsii.get(self, "maximumRetryAttempts"))
 
     @maximum_retry_attempts.setter
@@ -4747,7 +4805,7 @@ class CfnEventSourceMapping(
     @builtins.property
     @jsii.member(jsii_name="parallelizationFactor")
     def parallelization_factor(self) -> typing.Optional[jsii.Number]:
-        '''(Kinesis and DynamoDB Streams only) The number of batches to process concurrently from each shard.'''
+        '''(Streams) The number of batches to process from each shard concurrently.'''
         return typing.cast(typing.Optional[jsii.Number], jsii.get(self, "parallelizationFactor"))
 
     @parallelization_factor.setter
@@ -4760,7 +4818,7 @@ class CfnEventSourceMapping(
     @builtins.property
     @jsii.member(jsii_name="queues")
     def queues(self) -> typing.Optional[typing.List[builtins.str]]:
-        '''(Amazon MQ) The name of the Amazon MQ broker destination queue to consume.'''
+        '''(ActiveMQ) A list of ActiveMQ queues.'''
         return typing.cast(typing.Optional[typing.List[builtins.str]], jsii.get(self, "queues"))
 
     @queues.setter
@@ -4775,7 +4833,7 @@ class CfnEventSourceMapping(
     def scaling_config(
         self,
     ) -> typing.Optional[typing.Union[_IResolvable_da3f097b, "CfnEventSourceMapping.ScalingConfigProperty"]]:
-        '''(Amazon SQS only) The scaling configuration for the event source.'''
+        '''The scaling configuration for the event source.'''
         return typing.cast(typing.Optional[typing.Union[_IResolvable_da3f097b, "CfnEventSourceMapping.ScalingConfigProperty"]], jsii.get(self, "scalingConfig"))
 
     @scaling_config.setter
@@ -4793,7 +4851,7 @@ class CfnEventSourceMapping(
     def self_managed_event_source(
         self,
     ) -> typing.Optional[typing.Union[_IResolvable_da3f097b, "CfnEventSourceMapping.SelfManagedEventSourceProperty"]]:
-        '''The self-managed Apache Kafka cluster for your event source.'''
+        '''The configuration used by AWS Lambda to access a self-managed event source.'''
         return typing.cast(typing.Optional[typing.Union[_IResolvable_da3f097b, "CfnEventSourceMapping.SelfManagedEventSourceProperty"]], jsii.get(self, "selfManagedEventSource"))
 
     @self_managed_event_source.setter
@@ -4811,7 +4869,7 @@ class CfnEventSourceMapping(
     def self_managed_kafka_event_source_config(
         self,
     ) -> typing.Optional[typing.Union[_IResolvable_da3f097b, "CfnEventSourceMapping.SelfManagedKafkaEventSourceConfigProperty"]]:
-        '''Specific configuration settings for a self-managed Apache Kafka event source.'''
+        '''Specific configuration settings for a Self-Managed Apache Kafka event source.'''
         return typing.cast(typing.Optional[typing.Union[_IResolvable_da3f097b, "CfnEventSourceMapping.SelfManagedKafkaEventSourceConfigProperty"]], jsii.get(self, "selfManagedKafkaEventSourceConfig"))
 
     @self_managed_kafka_event_source_config.setter
@@ -4829,7 +4887,7 @@ class CfnEventSourceMapping(
     def source_access_configurations(
         self,
     ) -> typing.Optional[typing.Union[_IResolvable_da3f097b, typing.List[typing.Union[_IResolvable_da3f097b, "CfnEventSourceMapping.SourceAccessConfigurationProperty"]]]]:
-        '''An array of the authentication protocol, VPC components, or virtual host to secure and define your event source.'''
+        '''A list of SourceAccessConfiguration.'''
         return typing.cast(typing.Optional[typing.Union[_IResolvable_da3f097b, typing.List[typing.Union[_IResolvable_da3f097b, "CfnEventSourceMapping.SourceAccessConfigurationProperty"]]]], jsii.get(self, "sourceAccessConfigurations"))
 
     @source_access_configurations.setter
@@ -4845,10 +4903,7 @@ class CfnEventSourceMapping(
     @builtins.property
     @jsii.member(jsii_name="startingPosition")
     def starting_position(self) -> typing.Optional[builtins.str]:
-        '''The position in a stream from which to start reading.
-
-        Required for Amazon Kinesis and Amazon DynamoDB.
-        '''
+        '''The position in a stream from which to start reading.'''
         return typing.cast(typing.Optional[builtins.str], jsii.get(self, "startingPosition"))
 
     @starting_position.setter
@@ -4861,7 +4916,7 @@ class CfnEventSourceMapping(
     @builtins.property
     @jsii.member(jsii_name="startingPositionTimestamp")
     def starting_position_timestamp(self) -> typing.Optional[jsii.Number]:
-        '''With ``StartingPosition`` set to ``AT_TIMESTAMP`` , the time from which to start reading, in Unix time seconds.'''
+        '''With StartingPosition set to AT_TIMESTAMP, the time from which to start reading, in Unix time seconds.'''
         return typing.cast(typing.Optional[jsii.Number], jsii.get(self, "startingPositionTimestamp"))
 
     @starting_position_timestamp.setter
@@ -4874,7 +4929,7 @@ class CfnEventSourceMapping(
     @builtins.property
     @jsii.member(jsii_name="topics")
     def topics(self) -> typing.Optional[typing.List[builtins.str]]:
-        '''The name of the Kafka topic.'''
+        '''(Kafka) A list of Kafka topics.'''
         return typing.cast(typing.Optional[typing.List[builtins.str]], jsii.get(self, "topics"))
 
     @topics.setter
@@ -4887,7 +4942,7 @@ class CfnEventSourceMapping(
     @builtins.property
     @jsii.member(jsii_name="tumblingWindowInSeconds")
     def tumbling_window_in_seconds(self) -> typing.Optional[jsii.Number]:
-        '''(Kinesis and DynamoDB Streams only) The duration in seconds of a processing window for DynamoDB and Kinesis Streams event sources.'''
+        '''(Streams) Tumbling window (non-overlapping time window) duration to perform aggregations.'''
         return typing.cast(typing.Optional[jsii.Number], jsii.get(self, "tumblingWindowInSeconds"))
 
     @tumbling_window_in_seconds.setter
@@ -4908,9 +4963,9 @@ class CfnEventSourceMapping(
             *,
             consumer_group_id: typing.Optional[builtins.str] = None,
         ) -> None:
-            '''Specific configuration settings for an Amazon Managed Streaming for Apache Kafka (Amazon MSK) event source.
+            '''Specific configuration settings for an MSK event source.
 
-            :param consumer_group_id: The identifier for the Kafka consumer group to join. The consumer group ID must be unique among all your Kafka event sources. After creating a Kafka event source mapping with the consumer group ID specified, you cannot update this value. For more information, see `Customizable consumer group ID <https://docs.aws.amazon.com/lambda/latest/dg/with-msk.html#services-msk-consumer-group-id>`_ .
+            :param consumer_group_id: The identifier for the Kafka Consumer Group to join.
 
             :see: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-lambda-eventsourcemapping-amazonmanagedkafkaeventsourceconfig.html
             :exampleMetadata: fixture=_generated
@@ -4934,9 +4989,7 @@ class CfnEventSourceMapping(
 
         @builtins.property
         def consumer_group_id(self) -> typing.Optional[builtins.str]:
-            '''The identifier for the Kafka consumer group to join.
-
-            The consumer group ID must be unique among all your Kafka event sources. After creating a Kafka event source mapping with the consumer group ID specified, you cannot update this value. For more information, see `Customizable consumer group ID <https://docs.aws.amazon.com/lambda/latest/dg/with-msk.html#services-msk-consumer-group-id>`_ .
+            '''The identifier for the Kafka Consumer Group to join.
 
             :see: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-lambda-eventsourcemapping-amazonmanagedkafkaeventsourceconfig.html#cfn-lambda-eventsourcemapping-amazonmanagedkafkaeventsourceconfig-consumergroupid
             '''
@@ -4967,7 +5020,7 @@ class CfnEventSourceMapping(
         ) -> None:
             '''A configuration object that specifies the destination of an event after Lambda processes it.
 
-            :param on_failure: The destination configuration for failed invocations.
+            :param on_failure: A destination for records of invocations that failed processing.
 
             :see: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-lambda-eventsourcemapping-destinationconfig.html
             :exampleMetadata: fixture=_generated
@@ -4995,7 +5048,7 @@ class CfnEventSourceMapping(
         def on_failure(
             self,
         ) -> typing.Optional[typing.Union[_IResolvable_da3f097b, "CfnEventSourceMapping.OnFailureProperty"]]:
-            '''The destination configuration for failed invocations.
+            '''A destination for records of invocations that failed processing.
 
             :see: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-lambda-eventsourcemapping-destinationconfig.html#cfn-lambda-eventsourcemapping-destinationconfig-onfailure
             '''
@@ -5030,11 +5083,11 @@ class CfnEventSourceMapping(
             database_name: typing.Optional[builtins.str] = None,
             full_document: typing.Optional[builtins.str] = None,
         ) -> None:
-            '''Specific configuration settings for a DocumentDB event source.
+            '''Document db event source config.
 
-            :param collection_name: The name of the collection to consume within the database. If you do not specify a collection, Lambda consumes all collections.
-            :param database_name: The name of the database to consume within the DocumentDB cluster.
-            :param full_document: Determines what DocumentDB sends to your event stream during document update operations. If set to UpdateLookup, DocumentDB sends a delta describing the changes, along with a copy of the entire document. Otherwise, DocumentDB sends only a partial document that contains the changes.
+            :param collection_name: The collection name to connect to.
+            :param database_name: The database name to connect to.
+            :param full_document: Include full document in change stream response. The default option will only send the changes made to documents to Lambda. If you want the complete document sent to Lambda, set this to UpdateLookup.
 
             :see: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-lambda-eventsourcemapping-documentdbeventsourceconfig.html
             :exampleMetadata: fixture=_generated
@@ -5066,9 +5119,7 @@ class CfnEventSourceMapping(
 
         @builtins.property
         def collection_name(self) -> typing.Optional[builtins.str]:
-            '''The name of the collection to consume within the database.
-
-            If you do not specify a collection, Lambda consumes all collections.
+            '''The collection name to connect to.
 
             :see: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-lambda-eventsourcemapping-documentdbeventsourceconfig.html#cfn-lambda-eventsourcemapping-documentdbeventsourceconfig-collectionname
             '''
@@ -5077,7 +5128,7 @@ class CfnEventSourceMapping(
 
         @builtins.property
         def database_name(self) -> typing.Optional[builtins.str]:
-            '''The name of the database to consume within the DocumentDB cluster.
+            '''The database name to connect to.
 
             :see: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-lambda-eventsourcemapping-documentdbeventsourceconfig.html#cfn-lambda-eventsourcemapping-documentdbeventsourceconfig-databasename
             '''
@@ -5086,9 +5137,9 @@ class CfnEventSourceMapping(
 
         @builtins.property
         def full_document(self) -> typing.Optional[builtins.str]:
-            '''Determines what DocumentDB sends to your event stream during document update operations.
+            '''Include full document in change stream response.
 
-            If set to UpdateLookup, DocumentDB sends a delta describing the changes, along with a copy of the entire document. Otherwise, DocumentDB sends only a partial document that contains the changes.
+            The default option will only send the changes made to documents to Lambda. If you want the complete document sent to Lambda, set this to UpdateLookup.
 
             :see: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-lambda-eventsourcemapping-documentdbeventsourceconfig.html#cfn-lambda-eventsourcemapping-documentdbeventsourceconfig-fulldocument
             '''
@@ -5117,9 +5168,9 @@ class CfnEventSourceMapping(
             *,
             kafka_bootstrap_servers: typing.Optional[typing.Sequence[builtins.str]] = None,
         ) -> None:
-            '''The list of bootstrap servers for your Kafka brokers in the following format: ``"KafkaBootstrapServers": ["abc.xyz.com:xxxx","abc2.xyz.com:xxxx"]`` .
+            '''The endpoints used by AWS Lambda to access a self-managed event source.
 
-            :param kafka_bootstrap_servers: The list of bootstrap servers for your Kafka brokers in the following format: ``"KafkaBootstrapServers": ["abc.xyz.com:xxxx","abc2.xyz.com:xxxx"]`` .
+            :param kafka_bootstrap_servers: A list of Kafka server endpoints.
 
             :see: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-lambda-eventsourcemapping-endpoints.html
             :exampleMetadata: fixture=_generated
@@ -5143,7 +5194,7 @@ class CfnEventSourceMapping(
 
         @builtins.property
         def kafka_bootstrap_servers(self) -> typing.Optional[typing.List[builtins.str]]:
-            '''The list of bootstrap servers for your Kafka brokers in the following format: ``"KafkaBootstrapServers": ["abc.xyz.com:xxxx","abc2.xyz.com:xxxx"]`` .
+            '''A list of Kafka server endpoints.
 
             :see: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-lambda-eventsourcemapping-endpoints.html#cfn-lambda-eventsourcemapping-endpoints-kafkabootstrapservers
             '''
@@ -5172,9 +5223,9 @@ class CfnEventSourceMapping(
             *,
             filters: typing.Optional[typing.Union[_IResolvable_da3f097b, typing.Sequence[typing.Union[_IResolvable_da3f097b, typing.Union["CfnEventSourceMapping.FilterProperty", typing.Dict[builtins.str, typing.Any]]]]]] = None,
         ) -> None:
-            '''An object that contains the filters for an event source.
+            '''The filter criteria to control event filtering.
 
-            :param filters: A list of filters.
+            :param filters: List of filters of this FilterCriteria.
 
             :see: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-lambda-eventsourcemapping-filtercriteria.html
             :exampleMetadata: fixture=_generated
@@ -5202,7 +5253,7 @@ class CfnEventSourceMapping(
         def filters(
             self,
         ) -> typing.Optional[typing.Union[_IResolvable_da3f097b, typing.List[typing.Union[_IResolvable_da3f097b, "CfnEventSourceMapping.FilterProperty"]]]]:
-            '''A list of filters.
+            '''List of filters of this FilterCriteria.
 
             :see: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-lambda-eventsourcemapping-filtercriteria.html#cfn-lambda-eventsourcemapping-filtercriteria-filters
             '''
@@ -5227,9 +5278,9 @@ class CfnEventSourceMapping(
     )
     class FilterProperty:
         def __init__(self, *, pattern: typing.Optional[builtins.str] = None) -> None:
-            '''A structure within a ``FilterCriteria`` object that defines an event filtering pattern.
+            '''The filter object that defines parameters for ESM filtering.
 
-            :param pattern: A filter pattern. For more information on the syntax of a filter pattern, see `Filter rule syntax <https://docs.aws.amazon.com/lambda/latest/dg/invocation-eventfiltering.html#filtering-syntax>`_ .
+            :param pattern: The filter pattern that defines which events should be passed for invocations.
 
             :see: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-lambda-eventsourcemapping-filter.html
             :exampleMetadata: fixture=_generated
@@ -5253,9 +5304,7 @@ class CfnEventSourceMapping(
 
         @builtins.property
         def pattern(self) -> typing.Optional[builtins.str]:
-            '''A filter pattern.
-
-            For more information on the syntax of a filter pattern, see `Filter rule syntax <https://docs.aws.amazon.com/lambda/latest/dg/invocation-eventfiltering.html#filtering-syntax>`_ .
+            '''The filter pattern that defines which events should be passed for invocations.
 
             :see: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-lambda-eventsourcemapping-filter.html#cfn-lambda-eventsourcemapping-filter-pattern
             '''
@@ -5284,9 +5333,9 @@ class CfnEventSourceMapping(
             *,
             destination: typing.Optional[builtins.str] = None,
         ) -> None:
-            '''A destination for events that failed processing.
+            '''A destination for records of invocations that failed processing.
 
-            :param destination: The Amazon Resource Name (ARN) of the destination resource. To retain records of `asynchronous invocations <https://docs.aws.amazon.com/lambda/latest/dg/invocation-async.html#invocation-async-destinations>`_ , you can configure an Amazon SNS topic, Amazon SQS queue, Lambda function, or Amazon EventBridge event bus as the destination. To retain records of failed invocations from `Kinesis and DynamoDB event sources <https://docs.aws.amazon.com/lambda/latest/dg/invocation-eventsourcemapping.html#event-source-mapping-destinations>`_ , you can configure an Amazon SNS topic or Amazon SQS queue as the destination. To retain records of failed invocations from `self-managed Kafka <https://docs.aws.amazon.com/lambda/latest/dg/with-kafka.html#services-smaa-onfailure-destination>`_ or `Amazon MSK <https://docs.aws.amazon.com/lambda/latest/dg/with-msk.html#services-msk-onfailure-destination>`_ , you can configure an Amazon SNS topic, Amazon SQS queue, or Amazon S3 bucket as the destination.
+            :param destination: The Amazon Resource Name (ARN) of the destination resource.
 
             :see: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-lambda-eventsourcemapping-onfailure.html
             :exampleMetadata: fixture=_generated
@@ -5312,12 +5361,6 @@ class CfnEventSourceMapping(
         def destination(self) -> typing.Optional[builtins.str]:
             '''The Amazon Resource Name (ARN) of the destination resource.
 
-            To retain records of `asynchronous invocations <https://docs.aws.amazon.com/lambda/latest/dg/invocation-async.html#invocation-async-destinations>`_ , you can configure an Amazon SNS topic, Amazon SQS queue, Lambda function, or Amazon EventBridge event bus as the destination.
-
-            To retain records of failed invocations from `Kinesis and DynamoDB event sources <https://docs.aws.amazon.com/lambda/latest/dg/invocation-eventsourcemapping.html#event-source-mapping-destinations>`_ , you can configure an Amazon SNS topic or Amazon SQS queue as the destination.
-
-            To retain records of failed invocations from `self-managed Kafka <https://docs.aws.amazon.com/lambda/latest/dg/with-kafka.html#services-smaa-onfailure-destination>`_ or `Amazon MSK <https://docs.aws.amazon.com/lambda/latest/dg/with-msk.html#services-msk-onfailure-destination>`_ , you can configure an Amazon SNS topic, Amazon SQS queue, or Amazon S3 bucket as the destination.
-
             :see: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-lambda-eventsourcemapping-onfailure.html#cfn-lambda-eventsourcemapping-onfailure-destination
             '''
             result = self._values.get("destination")
@@ -5345,11 +5388,9 @@ class CfnEventSourceMapping(
             *,
             maximum_concurrency: typing.Optional[jsii.Number] = None,
         ) -> None:
-            '''(Amazon SQS only) The scaling configuration for the event source.
-
-            To remove the configuration, pass an empty value.
+            '''The scaling configuration for the event source.
 
-            :param maximum_concurrency: Limits the number of concurrent instances that the Amazon SQS event source can invoke.
+            :param maximum_concurrency: The maximum number of concurrent functions that an event source can invoke.
 
             :see: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-lambda-eventsourcemapping-scalingconfig.html
             :exampleMetadata: fixture=_generated
@@ -5373,7 +5414,7 @@ class CfnEventSourceMapping(
 
         @builtins.property
         def maximum_concurrency(self) -> typing.Optional[jsii.Number]:
-            '''Limits the number of concurrent instances that the Amazon SQS event source can invoke.
+            '''The maximum number of concurrent functions that an event source can invoke.
 
             :see: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-lambda-eventsourcemapping-scalingconfig.html#cfn-lambda-eventsourcemapping-scalingconfig-maximumconcurrency
             '''
@@ -5402,9 +5443,9 @@ class CfnEventSourceMapping(
             *,
             endpoints: typing.Optional[typing.Union[_IResolvable_da3f097b, typing.Union["CfnEventSourceMapping.EndpointsProperty", typing.Dict[builtins.str, typing.Any]]]] = None,
         ) -> None:
-            '''The self-managed Apache Kafka cluster for your event source.
+            '''The configuration used by AWS Lambda to access a self-managed event source.
 
-            :param endpoints: The list of bootstrap servers for your Kafka brokers in the following format: ``"KafkaBootstrapServers": ["abc.xyz.com:xxxx","abc2.xyz.com:xxxx"]`` .
+            :param endpoints: The endpoints used by AWS Lambda to access a self-managed event source.
 
             :see: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-lambda-eventsourcemapping-selfmanagedeventsource.html
             :exampleMetadata: fixture=_generated
@@ -5432,7 +5473,7 @@ class CfnEventSourceMapping(
         def endpoints(
             self,
         ) -> typing.Optional[typing.Union[_IResolvable_da3f097b, "CfnEventSourceMapping.EndpointsProperty"]]:
-            '''The list of bootstrap servers for your Kafka brokers in the following format: ``"KafkaBootstrapServers": ["abc.xyz.com:xxxx","abc2.xyz.com:xxxx"]`` .
+            '''The endpoints used by AWS Lambda to access a self-managed event source.
 
             :see: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-lambda-eventsourcemapping-selfmanagedeventsource.html#cfn-lambda-eventsourcemapping-selfmanagedeventsource-endpoints
             '''
@@ -5461,9 +5502,9 @@ class CfnEventSourceMapping(
             *,
             consumer_group_id: typing.Optional[builtins.str] = None,
         ) -> None:
-            '''Specific configuration settings for a self-managed Apache Kafka event source.
+            '''Specific configuration settings for a Self-Managed Apache Kafka event source.
 
-            :param consumer_group_id: The identifier for the Kafka consumer group to join. The consumer group ID must be unique among all your Kafka event sources. After creating a Kafka event source mapping with the consumer group ID specified, you cannot update this value. For more information, see `Customizable consumer group ID <https://docs.aws.amazon.com/lambda/latest/dg/with-msk.html#services-msk-consumer-group-id>`_ .
+            :param consumer_group_id: The identifier for the Kafka Consumer Group to join.
 
             :see: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-lambda-eventsourcemapping-selfmanagedkafkaeventsourceconfig.html
             :exampleMetadata: fixture=_generated
@@ -5487,9 +5528,7 @@ class CfnEventSourceMapping(
 
         @builtins.property
         def consumer_group_id(self) -> typing.Optional[builtins.str]:
-            '''The identifier for the Kafka consumer group to join.
-
-            The consumer group ID must be unique among all your Kafka event sources. After creating a Kafka event source mapping with the consumer group ID specified, you cannot update this value. For more information, see `Customizable consumer group ID <https://docs.aws.amazon.com/lambda/latest/dg/with-msk.html#services-msk-consumer-group-id>`_ .
+            '''The identifier for the Kafka Consumer Group to join.
 
             :see: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-lambda-eventsourcemapping-selfmanagedkafkaeventsourceconfig.html#cfn-lambda-eventsourcemapping-selfmanagedkafkaeventsourceconfig-consumergroupid
             '''
@@ -5519,10 +5558,10 @@ class CfnEventSourceMapping(
             type: typing.Optional[builtins.str] = None,
             uri: typing.Optional[builtins.str] = None,
         ) -> None:
-            '''An array of the authentication protocol, VPC components, or virtual host to secure and define your event source.
+            '''The configuration used by AWS Lambda to access event source.
 
-            :param type: The type of authentication protocol, VPC components, or virtual host for your event source. For example: ``"Type":"SASL_SCRAM_512_AUTH"`` . - ``BASIC_AUTH`` – (Amazon MQ) The AWS Secrets Manager secret that stores your broker credentials. - ``BASIC_AUTH`` – (Self-managed Apache Kafka) The Secrets Manager ARN of your secret key used for SASL/PLAIN authentication of your Apache Kafka brokers. - ``VPC_SUBNET`` – (Self-managed Apache Kafka) The subnets associated with your VPC. Lambda connects to these subnets to fetch data from your self-managed Apache Kafka cluster. - ``VPC_SECURITY_GROUP`` – (Self-managed Apache Kafka) The VPC security group used to manage access to your self-managed Apache Kafka brokers. - ``SASL_SCRAM_256_AUTH`` – (Self-managed Apache Kafka) The Secrets Manager ARN of your secret key used for SASL SCRAM-256 authentication of your self-managed Apache Kafka brokers. - ``SASL_SCRAM_512_AUTH`` – (Amazon MSK, Self-managed Apache Kafka) The Secrets Manager ARN of your secret key used for SASL SCRAM-512 authentication of your self-managed Apache Kafka brokers. - ``VIRTUAL_HOST`` –- (RabbitMQ) The name of the virtual host in your RabbitMQ broker. Lambda uses this RabbitMQ host as the event source. This property cannot be specified in an UpdateEventSourceMapping API call. - ``CLIENT_CERTIFICATE_TLS_AUTH`` – (Amazon MSK, self-managed Apache Kafka) The Secrets Manager ARN of your secret key containing the certificate chain (X.509 PEM), private key (PKCS#8 PEM), and private key password (optional) used for mutual TLS authentication of your MSK/Apache Kafka brokers. - ``SERVER_ROOT_CA_CERTIFICATE`` – (Self-managed Apache Kafka) The Secrets Manager ARN of your secret key containing the root CA certificate (X.509 PEM) used for TLS encryption of your Apache Kafka brokers.
-            :param uri: The value for your chosen configuration in ``Type`` . For example: ``"URI": "arn:aws:secretsmanager:us-east-1:01234567890:secret:MyBrokerSecretName"`` .
+            :param type: The type of source access configuration.
+            :param uri: The URI for the source access configuration resource.
 
             :see: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-lambda-eventsourcemapping-sourceaccessconfiguration.html
             :exampleMetadata: fixture=_generated
@@ -5550,17 +5589,7 @@ class CfnEventSourceMapping(
 
         @builtins.property
         def type(self) -> typing.Optional[builtins.str]:
-            '''The type of authentication protocol, VPC components, or virtual host for your event source. For example: ``"Type":"SASL_SCRAM_512_AUTH"`` .
-
-            - ``BASIC_AUTH`` – (Amazon MQ) The AWS Secrets Manager secret that stores your broker credentials.
-            - ``BASIC_AUTH`` – (Self-managed Apache Kafka) The Secrets Manager ARN of your secret key used for SASL/PLAIN authentication of your Apache Kafka brokers.
-            - ``VPC_SUBNET`` – (Self-managed Apache Kafka) The subnets associated with your VPC. Lambda connects to these subnets to fetch data from your self-managed Apache Kafka cluster.
-            - ``VPC_SECURITY_GROUP`` – (Self-managed Apache Kafka) The VPC security group used to manage access to your self-managed Apache Kafka brokers.
-            - ``SASL_SCRAM_256_AUTH`` – (Self-managed Apache Kafka) The Secrets Manager ARN of your secret key used for SASL SCRAM-256 authentication of your self-managed Apache Kafka brokers.
-            - ``SASL_SCRAM_512_AUTH`` – (Amazon MSK, Self-managed Apache Kafka) The Secrets Manager ARN of your secret key used for SASL SCRAM-512 authentication of your self-managed Apache Kafka brokers.
-            - ``VIRTUAL_HOST`` –- (RabbitMQ) The name of the virtual host in your RabbitMQ broker. Lambda uses this RabbitMQ host as the event source. This property cannot be specified in an UpdateEventSourceMapping API call.
-            - ``CLIENT_CERTIFICATE_TLS_AUTH`` – (Amazon MSK, self-managed Apache Kafka) The Secrets Manager ARN of your secret key containing the certificate chain (X.509 PEM), private key (PKCS#8 PEM), and private key password (optional) used for mutual TLS authentication of your MSK/Apache Kafka brokers.
-            - ``SERVER_ROOT_CA_CERTIFICATE`` – (Self-managed Apache Kafka) The Secrets Manager ARN of your secret key containing the root CA certificate (X.509 PEM) used for TLS encryption of your Apache Kafka brokers.
+            '''The type of source access configuration.
 
             :see: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-lambda-eventsourcemapping-sourceaccessconfiguration.html#cfn-lambda-eventsourcemapping-sourceaccessconfiguration-type
             '''
@@ -5569,9 +5598,7 @@ class CfnEventSourceMapping(
 
         @builtins.property
         def uri(self) -> typing.Optional[builtins.str]:
-            '''The value for your chosen configuration in ``Type`` .
-
-            For example: ``"URI": "arn:aws:secretsmanager:us-east-1:01234567890:secret:MyBrokerSecretName"`` .
+            '''The URI for the source access configuration resource.
 
             :see: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-lambda-eventsourcemapping-sourceaccessconfiguration.html#cfn-lambda-eventsourcemapping-sourceaccessconfiguration-uri
             '''
@@ -5604,6 +5631,7 @@ class CfnEventSourceMapping(
         "event_source_arn": "eventSourceArn",
         "filter_criteria": "filterCriteria",
         "function_response_types": "functionResponseTypes",
+        "kms_key_arn": "kmsKeyArn",
         "maximum_batching_window_in_seconds": "maximumBatchingWindowInSeconds",
         "maximum_record_age_in_seconds": "maximumRecordAgeInSeconds",
         "maximum_retry_attempts": "maximumRetryAttempts",
@@ -5633,6 +5661,7 @@ class CfnEventSourceMappingProps:
         event_source_arn: typing.Optional[builtins.str] = None,
         filter_criteria: typing.Optional[typing.Union[_IResolvable_da3f097b, typing.Union[CfnEventSourceMapping.FilterCriteriaProperty, typing.Dict[builtins.str, typing.Any]]]] = None,
         function_response_types: typing.Optional[typing.Sequence[builtins.str]] = None,
+        kms_key_arn: typing.Optional[builtins.str] = None,
         maximum_batching_window_in_seconds: typing.Optional[jsii.Number] = None,
         maximum_record_age_in_seconds: typing.Optional[jsii.Number] = None,
         maximum_retry_attempts: typing.Optional[jsii.Number] = None,
@@ -5649,29 +5678,30 @@ class CfnEventSourceMappingProps:
     ) -> None:
         '''Properties for defining a ``CfnEventSourceMapping``.
 
-        :param function_name: The name or ARN of the Lambda function. **Name formats** - *Function name* – ``MyFunction`` . - *Function ARN* – ``arn:aws:lambda:us-west-2:123456789012:function:MyFunction`` . - *Version or Alias ARN* – ``arn:aws:lambda:us-west-2:123456789012:function:MyFunction:PROD`` . - *Partial ARN* – ``123456789012:function:MyFunction`` . The length constraint applies only to the full ARN. If you specify only the function name, it's limited to 64 characters in length.
-        :param amazon_managed_kafka_event_source_config: Specific configuration settings for an Amazon Managed Streaming for Apache Kafka (Amazon MSK) event source.
-        :param batch_size: The maximum number of records in each batch that Lambda pulls from your stream or queue and sends to your function. Lambda passes all of the records in the batch to the function in a single call, up to the payload limit for synchronous invocation (6 MB). - *Amazon Kinesis* – Default 100. Max 10,000. - *Amazon DynamoDB Streams* – Default 100. Max 10,000. - *Amazon Simple Queue Service* – Default 10. For standard queues the max is 10,000. For FIFO queues the max is 10. - *Amazon Managed Streaming for Apache Kafka* – Default 100. Max 10,000. - *Self-managed Apache Kafka* – Default 100. Max 10,000. - *Amazon MQ (ActiveMQ and RabbitMQ)* – Default 100. Max 10,000. - *DocumentDB* – Default 100. Max 10,000.
-        :param bisect_batch_on_function_error: (Kinesis and DynamoDB Streams only) If the function returns an error, split the batch in two and retry. The default value is false.
-        :param destination_config: (Kinesis, DynamoDB Streams, Amazon MSK, and self-managed Apache Kafka event sources only) A configuration object that specifies the destination of an event after Lambda processes it.
-        :param document_db_event_source_config: Specific configuration settings for a DocumentDB event source.
-        :param enabled: When true, the event source mapping is active. When false, Lambda pauses polling and invocation. Default: True
-        :param event_source_arn: The Amazon Resource Name (ARN) of the event source. - *Amazon Kinesis* – The ARN of the data stream or a stream consumer. - *Amazon DynamoDB Streams* – The ARN of the stream. - *Amazon Simple Queue Service* – The ARN of the queue. - *Amazon Managed Streaming for Apache Kafka* – The ARN of the cluster or the ARN of the VPC connection (for `cross-account event source mappings <https://docs.aws.amazon.com/lambda/latest/dg/with-msk.html#msk-multi-vpc>`_ ). - *Amazon MQ* – The ARN of the broker. - *Amazon DocumentDB* – The ARN of the DocumentDB change stream.
-        :param filter_criteria: An object that defines the filter criteria that determine whether Lambda should process an event. For more information, see `Lambda event filtering <https://docs.aws.amazon.com/lambda/latest/dg/invocation-eventfiltering.html>`_ .
-        :param function_response_types: (Streams and SQS) A list of current response type enums applied to the event source mapping. Valid Values: ``ReportBatchItemFailures``
-        :param maximum_batching_window_in_seconds: The maximum amount of time, in seconds, that Lambda spends gathering records before invoking the function. *Default ( Kinesis , DynamoDB , Amazon SQS event sources)* : 0 *Default ( Amazon MSK , Kafka, Amazon MQ , Amazon DocumentDB event sources)* : 500 ms *Related setting:* For Amazon SQS event sources, when you set ``BatchSize`` to a value greater than 10, you must set ``MaximumBatchingWindowInSeconds`` to at least 1.
-        :param maximum_record_age_in_seconds: (Kinesis and DynamoDB Streams only) Discard records older than the specified age. The default value is -1, which sets the maximum age to infinite. When the value is set to infinite, Lambda never discards old records. .. epigraph:: The minimum valid value for maximum record age is 60s. Although values less than 60 and greater than -1 fall within the parameter's absolute range, they are not allowed
-        :param maximum_retry_attempts: (Kinesis and DynamoDB Streams only) Discard records after the specified number of retries. The default value is -1, which sets the maximum number of retries to infinite. When MaximumRetryAttempts is infinite, Lambda retries failed records until the record expires in the event source.
-        :param parallelization_factor: (Kinesis and DynamoDB Streams only) The number of batches to process concurrently from each shard. The default value is 1.
-        :param queues: (Amazon MQ) The name of the Amazon MQ broker destination queue to consume.
-        :param scaling_config: (Amazon SQS only) The scaling configuration for the event source. For more information, see `Configuring maximum concurrency for Amazon SQS event sources <https://docs.aws.amazon.com/lambda/latest/dg/with-sqs.html#events-sqs-max-concurrency>`_ .
-        :param self_managed_event_source: The self-managed Apache Kafka cluster for your event source.
-        :param self_managed_kafka_event_source_config: Specific configuration settings for a self-managed Apache Kafka event source.
-        :param source_access_configurations: An array of the authentication protocol, VPC components, or virtual host to secure and define your event source.
-        :param starting_position: The position in a stream from which to start reading. Required for Amazon Kinesis and Amazon DynamoDB. - *LATEST* - Read only new records. - *TRIM_HORIZON* - Process all available records. - *AT_TIMESTAMP* - Specify a time from which to start reading records.
-        :param starting_position_timestamp: With ``StartingPosition`` set to ``AT_TIMESTAMP`` , the time from which to start reading, in Unix time seconds. ``StartingPositionTimestamp`` cannot be in the future.
-        :param topics: The name of the Kafka topic.
-        :param tumbling_window_in_seconds: (Kinesis and DynamoDB Streams only) The duration in seconds of a processing window for DynamoDB and Kinesis Streams event sources. A value of 0 seconds indicates no tumbling window.
+        :param function_name: The name of the Lambda function.
+        :param amazon_managed_kafka_event_source_config: Specific configuration settings for an MSK event source.
+        :param batch_size: The maximum number of items to retrieve in a single batch.
+        :param bisect_batch_on_function_error: (Streams) If the function returns an error, split the batch in two and retry.
+        :param destination_config: A configuration object that specifies the destination of an event after Lambda processes it.
+        :param document_db_event_source_config: Document db event source config.
+        :param enabled: Disables the event source mapping to pause polling and invocation.
+        :param event_source_arn: The Amazon Resource Name (ARN) of the event source.
+        :param filter_criteria: The filter criteria to control event filtering.
+        :param function_response_types: (Streams) A list of response types supported by the function.
+        :param kms_key_arn: The Amazon Resource Name (ARN) of the KMS key.
+        :param maximum_batching_window_in_seconds: (Streams) The maximum amount of time to gather records before invoking the function, in seconds.
+        :param maximum_record_age_in_seconds: (Streams) The maximum age of a record that Lambda sends to a function for processing.
+        :param maximum_retry_attempts: (Streams) The maximum number of times to retry when the function returns an error.
+        :param parallelization_factor: (Streams) The number of batches to process from each shard concurrently.
+        :param queues: (ActiveMQ) A list of ActiveMQ queues.
+        :param scaling_config: The scaling configuration for the event source.
+        :param self_managed_event_source: The configuration used by AWS Lambda to access a self-managed event source.
+        :param self_managed_kafka_event_source_config: Specific configuration settings for a Self-Managed Apache Kafka event source.
+        :param source_access_configurations: A list of SourceAccessConfiguration.
+        :param starting_position: The position in a stream from which to start reading. Required for Amazon Kinesis and Amazon DynamoDB Streams sources.
+        :param starting_position_timestamp: With StartingPosition set to AT_TIMESTAMP, the time from which to start reading, in Unix time seconds.
+        :param topics: (Kafka) A list of Kafka topics.
+        :param tumbling_window_in_seconds: (Streams) Tumbling window (non-overlapping time window) duration to perform aggregations.
 
         :see: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-lambda-eventsourcemapping.html
         :exampleMetadata: fixture=_generated
@@ -5709,6 +5739,7 @@ class CfnEventSourceMappingProps:
                     )]
                 ),
                 function_response_types=["functionResponseTypes"],
+                kms_key_arn="kmsKeyArn",
                 maximum_batching_window_in_seconds=123,
                 maximum_record_age_in_seconds=123,
                 maximum_retry_attempts=123,
@@ -5747,6 +5778,7 @@ class CfnEventSourceMappingProps:
             check_type(argname="argument event_source_arn", value=event_source_arn, expected_type=type_hints["event_source_arn"])
             check_type(argname="argument filter_criteria", value=filter_criteria, expected_type=type_hints["filter_criteria"])
             check_type(argname="argument function_response_types", value=function_response_types, expected_type=type_hints["function_response_types"])
+            check_type(argname="argument kms_key_arn", value=kms_key_arn, expected_type=type_hints["kms_key_arn"])
             check_type(argname="argument maximum_batching_window_in_seconds", value=maximum_batching_window_in_seconds, expected_type=type_hints["maximum_batching_window_in_seconds"])
             check_type(argname="argument maximum_record_age_in_seconds", value=maximum_record_age_in_seconds, expected_type=type_hints["maximum_record_age_in_seconds"])
             check_type(argname="argument maximum_retry_attempts", value=maximum_retry_attempts, expected_type=type_hints["maximum_retry_attempts"])
@@ -5781,6 +5813,8 @@ class CfnEventSourceMappingProps:
             self._values["filter_criteria"] = filter_criteria
         if function_response_types is not None:
             self._values["function_response_types"] = function_response_types
+        if kms_key_arn is not None:
+            self._values["kms_key_arn"] = kms_key_arn
         if maximum_batching_window_in_seconds is not None:
             self._values["maximum_batching_window_in_seconds"] = maximum_batching_window_in_seconds
         if maximum_record_age_in_seconds is not None:
@@ -5810,15 +5844,7 @@ class CfnEventSourceMappingProps:
 
     @builtins.property
     def function_name(self) -> builtins.str:
-        '''The name or ARN of the Lambda function.
-
-        **Name formats** - *Function name* – ``MyFunction`` .
-
-        - *Function ARN* – ``arn:aws:lambda:us-west-2:123456789012:function:MyFunction`` .
-        - *Version or Alias ARN* – ``arn:aws:lambda:us-west-2:123456789012:function:MyFunction:PROD`` .
-        - *Partial ARN* – ``123456789012:function:MyFunction`` .
-
-        The length constraint applies only to the full ARN. If you specify only the function name, it's limited to 64 characters in length.
+        '''The name of the Lambda function.
 
         :see: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-lambda-eventsourcemapping.html#cfn-lambda-eventsourcemapping-functionname
         '''
@@ -5830,7 +5856,7 @@ class CfnEventSourceMappingProps:
     def amazon_managed_kafka_event_source_config(
         self,
     ) -> typing.Optional[typing.Union[_IResolvable_da3f097b, CfnEventSourceMapping.AmazonManagedKafkaEventSourceConfigProperty]]:
-        '''Specific configuration settings for an Amazon Managed Streaming for Apache Kafka (Amazon MSK) event source.
+        '''Specific configuration settings for an MSK event source.
 
         :see: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-lambda-eventsourcemapping.html#cfn-lambda-eventsourcemapping-amazonmanagedkafkaeventsourceconfig
         '''
@@ -5839,17 +5865,7 @@ class CfnEventSourceMappingProps:
 
     @builtins.property
     def batch_size(self) -> typing.Optional[jsii.Number]:
-        '''The maximum number of records in each batch that Lambda pulls from your stream or queue and sends to your function.
-
-        Lambda passes all of the records in the batch to the function in a single call, up to the payload limit for synchronous invocation (6 MB).
-
-        - *Amazon Kinesis* – Default 100. Max 10,000.
-        - *Amazon DynamoDB Streams* – Default 100. Max 10,000.
-        - *Amazon Simple Queue Service* – Default 10. For standard queues the max is 10,000. For FIFO queues the max is 10.
-        - *Amazon Managed Streaming for Apache Kafka* – Default 100. Max 10,000.
-        - *Self-managed Apache Kafka* – Default 100. Max 10,000.
-        - *Amazon MQ (ActiveMQ and RabbitMQ)* – Default 100. Max 10,000.
-        - *DocumentDB* – Default 100. Max 10,000.
+        '''The maximum number of items to retrieve in a single batch.
 
         :see: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-lambda-eventsourcemapping.html#cfn-lambda-eventsourcemapping-batchsize
         '''
@@ -5860,9 +5876,7 @@ class CfnEventSourceMappingProps:
     def bisect_batch_on_function_error(
         self,
     ) -> typing.Optional[typing.Union[builtins.bool, _IResolvable_da3f097b]]:
-        '''(Kinesis and DynamoDB Streams only) If the function returns an error, split the batch in two and retry.
-
-        The default value is false.
+        '''(Streams) If the function returns an error, split the batch in two and retry.
 
         :see: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-lambda-eventsourcemapping.html#cfn-lambda-eventsourcemapping-bisectbatchonfunctionerror
         '''
@@ -5873,7 +5887,7 @@ class CfnEventSourceMappingProps:
     def destination_config(
         self,
     ) -> typing.Optional[typing.Union[_IResolvable_da3f097b, CfnEventSourceMapping.DestinationConfigProperty]]:
-        '''(Kinesis, DynamoDB Streams, Amazon MSK, and self-managed Apache Kafka event sources only) A configuration object that specifies the destination of an event after Lambda processes it.
+        '''A configuration object that specifies the destination of an event after Lambda processes it.
 
         :see: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-lambda-eventsourcemapping.html#cfn-lambda-eventsourcemapping-destinationconfig
         '''
@@ -5884,7 +5898,7 @@ class CfnEventSourceMappingProps:
     def document_db_event_source_config(
         self,
     ) -> typing.Optional[typing.Union[_IResolvable_da3f097b, CfnEventSourceMapping.DocumentDBEventSourceConfigProperty]]:
-        '''Specific configuration settings for a DocumentDB event source.
+        '''Document db event source config.
 
         :see: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-lambda-eventsourcemapping.html#cfn-lambda-eventsourcemapping-documentdbeventsourceconfig
         '''
@@ -5895,9 +5909,7 @@ class CfnEventSourceMappingProps:
     def enabled(
         self,
     ) -> typing.Optional[typing.Union[builtins.bool, _IResolvable_da3f097b]]:
-        '''When true, the event source mapping is active. When false, Lambda pauses polling and invocation.
-
-        Default: True
+        '''Disables the event source mapping to pause polling and invocation.
 
         :see: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-lambda-eventsourcemapping.html#cfn-lambda-eventsourcemapping-enabled
         '''
@@ -5908,13 +5920,6 @@ class CfnEventSourceMappingProps:
     def event_source_arn(self) -> typing.Optional[builtins.str]:
         '''The Amazon Resource Name (ARN) of the event source.
 
-        - *Amazon Kinesis* – The ARN of the data stream or a stream consumer.
-        - *Amazon DynamoDB Streams* – The ARN of the stream.
-        - *Amazon Simple Queue Service* – The ARN of the queue.
-        - *Amazon Managed Streaming for Apache Kafka* – The ARN of the cluster or the ARN of the VPC connection (for `cross-account event source mappings <https://docs.aws.amazon.com/lambda/latest/dg/with-msk.html#msk-multi-vpc>`_ ).
-        - *Amazon MQ* – The ARN of the broker.
-        - *Amazon DocumentDB* – The ARN of the DocumentDB change stream.
-
         :see: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-lambda-eventsourcemapping.html#cfn-lambda-eventsourcemapping-eventsourcearn
         '''
         result = self._values.get("event_source_arn")
@@ -5924,9 +5929,7 @@ class CfnEventSourceMappingProps:
     def filter_criteria(
         self,
     ) -> typing.Optional[typing.Union[_IResolvable_da3f097b, CfnEventSourceMapping.FilterCriteriaProperty]]:
-        '''An object that defines the filter criteria that determine whether Lambda should process an event.
-
-        For more information, see `Lambda event filtering <https://docs.aws.amazon.com/lambda/latest/dg/invocation-eventfiltering.html>`_ .
+        '''The filter criteria to control event filtering.
 
         :see: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-lambda-eventsourcemapping.html#cfn-lambda-eventsourcemapping-filtercriteria
         '''
@@ -5935,9 +5938,7 @@ class CfnEventSourceMappingProps:
 
     @builtins.property
     def function_response_types(self) -> typing.Optional[typing.List[builtins.str]]:
-        '''(Streams and SQS) A list of current response type enums applied to the event source mapping.
-
-        Valid Values: ``ReportBatchItemFailures``
+        '''(Streams) A list of response types supported by the function.
 
         :see: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-lambda-eventsourcemapping.html#cfn-lambda-eventsourcemapping-functionresponsetypes
         '''
@@ -5945,14 +5946,17 @@ class CfnEventSourceMappingProps:
         return typing.cast(typing.Optional[typing.List[builtins.str]], result)
 
     @builtins.property
-    def maximum_batching_window_in_seconds(self) -> typing.Optional[jsii.Number]:
-        '''The maximum amount of time, in seconds, that Lambda spends gathering records before invoking the function.
-
-        *Default ( Kinesis , DynamoDB , Amazon SQS event sources)* : 0
+    def kms_key_arn(self) -> typing.Optional[builtins.str]:
+        '''The Amazon Resource Name (ARN) of the KMS key.
 
-        *Default ( Amazon MSK , Kafka, Amazon MQ , Amazon DocumentDB event sources)* : 500 ms
+        :see: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-lambda-eventsourcemapping.html#cfn-lambda-eventsourcemapping-kmskeyarn
+        '''
+        result = self._values.get("kms_key_arn")
+        return typing.cast(typing.Optional[builtins.str], result)
 
-        *Related setting:* For Amazon SQS event sources, when you set ``BatchSize`` to a value greater than 10, you must set ``MaximumBatchingWindowInSeconds`` to at least 1.
+    @builtins.property
+    def maximum_batching_window_in_seconds(self) -> typing.Optional[jsii.Number]:
+        '''(Streams) The maximum amount of time to gather records before invoking the function, in seconds.
 
         :see: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-lambda-eventsourcemapping.html#cfn-lambda-eventsourcemapping-maximumbatchingwindowinseconds
         '''
@@ -5961,13 +5965,7 @@ class CfnEventSourceMappingProps:
 
     @builtins.property
     def maximum_record_age_in_seconds(self) -> typing.Optional[jsii.Number]:
-        '''(Kinesis and DynamoDB Streams only) Discard records older than the specified age.
-
-        The default value is -1,
-        which sets the maximum age to infinite. When the value is set to infinite, Lambda never discards old records.
-        .. epigraph::
-
-           The minimum valid value for maximum record age is 60s. Although values less than 60 and greater than -1 fall within the parameter's absolute range, they are not allowed
+        '''(Streams) The maximum age of a record that Lambda sends to a function for processing.
 
         :see: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-lambda-eventsourcemapping.html#cfn-lambda-eventsourcemapping-maximumrecordageinseconds
         '''
@@ -5976,10 +5974,7 @@ class CfnEventSourceMappingProps:
 
     @builtins.property
     def maximum_retry_attempts(self) -> typing.Optional[jsii.Number]:
-        '''(Kinesis and DynamoDB Streams only) Discard records after the specified number of retries.
-
-        The default value is -1,
-        which sets the maximum number of retries to infinite. When MaximumRetryAttempts is infinite, Lambda retries failed records until the record expires in the event source.
+        '''(Streams) The maximum number of times to retry when the function returns an error.
 
         :see: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-lambda-eventsourcemapping.html#cfn-lambda-eventsourcemapping-maximumretryattempts
         '''
@@ -5988,9 +5983,7 @@ class CfnEventSourceMappingProps:
 
     @builtins.property
     def parallelization_factor(self) -> typing.Optional[jsii.Number]:
-        '''(Kinesis and DynamoDB Streams only) The number of batches to process concurrently from each shard.
-
-        The default value is 1.
+        '''(Streams) The number of batches to process from each shard concurrently.
 
         :see: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-lambda-eventsourcemapping.html#cfn-lambda-eventsourcemapping-parallelizationfactor
         '''
@@ -5999,7 +5992,7 @@ class CfnEventSourceMappingProps:
 
     @builtins.property
     def queues(self) -> typing.Optional[typing.List[builtins.str]]:
-        '''(Amazon MQ) The name of the Amazon MQ broker destination queue to consume.
+        '''(ActiveMQ) A list of ActiveMQ queues.
 
         :see: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-lambda-eventsourcemapping.html#cfn-lambda-eventsourcemapping-queues
         '''
@@ -6010,9 +6003,7 @@ class CfnEventSourceMappingProps:
     def scaling_config(
         self,
     ) -> typing.Optional[typing.Union[_IResolvable_da3f097b, CfnEventSourceMapping.ScalingConfigProperty]]:
-        '''(Amazon SQS only) The scaling configuration for the event source.
-
-        For more information, see `Configuring maximum concurrency for Amazon SQS event sources <https://docs.aws.amazon.com/lambda/latest/dg/with-sqs.html#events-sqs-max-concurrency>`_ .
+        '''The scaling configuration for the event source.
 
         :see: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-lambda-eventsourcemapping.html#cfn-lambda-eventsourcemapping-scalingconfig
         '''
@@ -6023,7 +6014,7 @@ class CfnEventSourceMappingProps:
     def self_managed_event_source(
         self,
     ) -> typing.Optional[typing.Union[_IResolvable_da3f097b, CfnEventSourceMapping.SelfManagedEventSourceProperty]]:
-        '''The self-managed Apache Kafka cluster for your event source.
+        '''The configuration used by AWS Lambda to access a self-managed event source.
 
         :see: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-lambda-eventsourcemapping.html#cfn-lambda-eventsourcemapping-selfmanagedeventsource
         '''
@@ -6034,7 +6025,7 @@ class CfnEventSourceMappingProps:
     def self_managed_kafka_event_source_config(
         self,
     ) -> typing.Optional[typing.Union[_IResolvable_da3f097b, CfnEventSourceMapping.SelfManagedKafkaEventSourceConfigProperty]]:
-        '''Specific configuration settings for a self-managed Apache Kafka event source.
+        '''Specific configuration settings for a Self-Managed Apache Kafka event source.
 
         :see: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-lambda-eventsourcemapping.html#cfn-lambda-eventsourcemapping-selfmanagedkafkaeventsourceconfig
         '''
@@ -6045,7 +6036,7 @@ class CfnEventSourceMappingProps:
     def source_access_configurations(
         self,
     ) -> typing.Optional[typing.Union[_IResolvable_da3f097b, typing.List[typing.Union[_IResolvable_da3f097b, CfnEventSourceMapping.SourceAccessConfigurationProperty]]]]:
-        '''An array of the authentication protocol, VPC components, or virtual host to secure and define your event source.
+        '''A list of SourceAccessConfiguration.
 
         :see: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-lambda-eventsourcemapping.html#cfn-lambda-eventsourcemapping-sourceaccessconfigurations
         '''
@@ -6054,11 +6045,9 @@ class CfnEventSourceMappingProps:
 
     @builtins.property
     def starting_position(self) -> typing.Optional[builtins.str]:
-        '''The position in a stream from which to start reading. Required for Amazon Kinesis and Amazon DynamoDB.
+        '''The position in a stream from which to start reading.
 
-        - *LATEST* - Read only new records.
-        - *TRIM_HORIZON* - Process all available records.
-        - *AT_TIMESTAMP* - Specify a time from which to start reading records.
+        Required for Amazon Kinesis and Amazon DynamoDB Streams sources.
 
         :see: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-lambda-eventsourcemapping.html#cfn-lambda-eventsourcemapping-startingposition
         '''
@@ -6067,9 +6056,7 @@ class CfnEventSourceMappingProps:
 
     @builtins.property
     def starting_position_timestamp(self) -> typing.Optional[jsii.Number]:
-        '''With ``StartingPosition`` set to ``AT_TIMESTAMP`` , the time from which to start reading, in Unix time seconds.
-
-        ``StartingPositionTimestamp`` cannot be in the future.
+        '''With StartingPosition set to AT_TIMESTAMP, the time from which to start reading, in Unix time seconds.
 
         :see: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-lambda-eventsourcemapping.html#cfn-lambda-eventsourcemapping-startingpositiontimestamp
         '''
@@ -6078,7 +6065,7 @@ class CfnEventSourceMappingProps:
 
     @builtins.property
     def topics(self) -> typing.Optional[typing.List[builtins.str]]:
-        '''The name of the Kafka topic.
+        '''(Kafka) A list of Kafka topics.
 
         :see: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-lambda-eventsourcemapping.html#cfn-lambda-eventsourcemapping-topics
         '''
@@ -6087,9 +6074,7 @@ class CfnEventSourceMappingProps:
 
     @builtins.property
     def tumbling_window_in_seconds(self) -> typing.Optional[jsii.Number]:
-        '''(Kinesis and DynamoDB Streams only) The duration in seconds of a processing window for DynamoDB and Kinesis Streams event sources.
-
-        A value of 0 seconds indicates no tumbling window.
+        '''(Streams) Tumbling window (non-overlapping time window) duration to perform aggregations.
 
         :see: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-lambda-eventsourcemapping.html#cfn-lambda-eventsourcemapping-tumblingwindowinseconds
         '''
@@ -12584,6 +12569,7 @@ class EventInvokeConfigProps(EventInvokeConfigOptions):
         "bisect_batch_on_error": "bisectBatchOnError",
         "enabled": "enabled",
         "event_source_arn": "eventSourceArn",
+        "filter_encryption": "filterEncryption",
         "filters": "filters",
         "kafka_bootstrap_servers": "kafkaBootstrapServers",
         "kafka_consumer_group_id": "kafkaConsumerGroupId",
@@ -12610,6 +12596,7 @@ class EventSourceMappingOptions:
         bisect_batch_on_error: typing.Optional[builtins.bool] = None,
         enabled: typing.Optional[builtins.bool] = None,
         event_source_arn: typing.Optional[builtins.str] = None,
+        filter_encryption: typing.Optional[_IKey_5f11635f] = None,
         filters: typing.Optional[typing.Sequence[typing.Mapping[builtins.str, typing.Any]]] = None,
         kafka_bootstrap_servers: typing.Optional[typing.Sequence[builtins.str]] = None,
         kafka_consumer_group_id: typing.Optional[builtins.str] = None,
@@ -12632,6 +12619,7 @@ class EventSourceMappingOptions:
         :param bisect_batch_on_error: If the function returns an error, split the batch in two and retry. Default: false
         :param enabled: Set to false to disable the event source upon creation. Default: true
         :param event_source_arn: The Amazon Resource Name (ARN) of the event source. Any record added to this stream can invoke the Lambda function. Default: - not set if using a self managed Kafka cluster, throws an error otherwise
+        :param filter_encryption: Add Customer managed KMS key to encrypt Filter Criteria. Default: - none
         :param filters: Add filter criteria to Event Source. Default: - none
         :param kafka_bootstrap_servers: A list of host and port pairs that are the addresses of the Kafka brokers in a self managed "bootstrap" Kafka cluster that a Kafka client connects to initially to bootstrap itself. They are in the format ``abc.example.com:9096``. Default: - none
         :param kafka_consumer_group_id: The identifier for the Kafka consumer group to join. The consumer group ID must be unique among all your Kafka event sources. After creating a Kafka event source mapping with the consumer group ID specified, you cannot update this value. The value must have a lenght between 1 and 200 and full the pattern '[a-zA-Z0-9-/*:_+=.@-]*'. For more information, see `Customizable consumer group ID <https://docs.aws.amazon.com/lambda/latest/dg/with-msk.html#services-msk-consumer-group-id>`_. Default: - none
@@ -12656,10 +12644,12 @@ class EventSourceMappingOptions:
             # The code below shows an example of how to instantiate this type.
             # The values are placeholders you should change.
             import aws_cdk as cdk
+            from aws_cdk import aws_kms as kms
             from aws_cdk import aws_lambda as lambda_
             
             # event_source_dlq: lambda.IEventSourceDlq
             # filters: Any
+            # key: kms.Key
             # source_access_configuration_type: lambda.SourceAccessConfigurationType
             
             event_source_mapping_options = lambda.EventSourceMappingOptions(
@@ -12667,6 +12657,7 @@ class EventSourceMappingOptions:
                 bisect_batch_on_error=False,
                 enabled=False,
                 event_source_arn="eventSourceArn",
+                filter_encryption=key,
                 filters=[{
                     "filters_key": filters
                 }],
@@ -12696,6 +12687,7 @@ class EventSourceMappingOptions:
             check_type(argname="argument bisect_batch_on_error", value=bisect_batch_on_error, expected_type=type_hints["bisect_batch_on_error"])
             check_type(argname="argument enabled", value=enabled, expected_type=type_hints["enabled"])
             check_type(argname="argument event_source_arn", value=event_source_arn, expected_type=type_hints["event_source_arn"])
+            check_type(argname="argument filter_encryption", value=filter_encryption, expected_type=type_hints["filter_encryption"])
             check_type(argname="argument filters", value=filters, expected_type=type_hints["filters"])
             check_type(argname="argument kafka_bootstrap_servers", value=kafka_bootstrap_servers, expected_type=type_hints["kafka_bootstrap_servers"])
             check_type(argname="argument kafka_consumer_group_id", value=kafka_consumer_group_id, expected_type=type_hints["kafka_consumer_group_id"])
@@ -12721,6 +12713,8 @@ class EventSourceMappingOptions:
             self._values["enabled"] = enabled
         if event_source_arn is not None:
             self._values["event_source_arn"] = event_source_arn
+        if filter_encryption is not None:
+            self._values["filter_encryption"] = filter_encryption
         if filters is not None:
             self._values["filters"] = filters
         if kafka_bootstrap_servers is not None:
@@ -12801,6 +12795,17 @@ class EventSourceMappingOptions:
         result = self._values.get("event_source_arn")
         return typing.cast(typing.Optional[builtins.str], result)
 
+    @builtins.property
+    def filter_encryption(self) -> typing.Optional[_IKey_5f11635f]:
+        '''Add Customer managed KMS key to encrypt Filter Criteria.
+
+        :default: - none
+
+        :see: https://docs.aws.amazon.com/kms/latest/developerguide/concepts.html#aws-managed-cmk
+        '''
+        result = self._values.get("filter_encryption")
+        return typing.cast(typing.Optional[_IKey_5f11635f], result)
+
     @builtins.property
     def filters(
         self,
@@ -13017,6 +13022,7 @@ class EventSourceMappingOptions:
         "bisect_batch_on_error": "bisectBatchOnError",
         "enabled": "enabled",
         "event_source_arn": "eventSourceArn",
+        "filter_encryption": "filterEncryption",
         "filters": "filters",
         "kafka_bootstrap_servers": "kafkaBootstrapServers",
         "kafka_consumer_group_id": "kafkaConsumerGroupId",
@@ -13044,6 +13050,7 @@ class EventSourceMappingProps(EventSourceMappingOptions):
         bisect_batch_on_error: typing.Optional[builtins.bool] = None,
         enabled: typing.Optional[builtins.bool] = None,
         event_source_arn: typing.Optional[builtins.str] = None,
+        filter_encryption: typing.Optional[_IKey_5f11635f] = None,
         filters: typing.Optional[typing.Sequence[typing.Mapping[builtins.str, typing.Any]]] = None,
         kafka_bootstrap_servers: typing.Optional[typing.Sequence[builtins.str]] = None,
         kafka_consumer_group_id: typing.Optional[builtins.str] = None,
@@ -13068,6 +13075,7 @@ class EventSourceMappingProps(EventSourceMappingOptions):
         :param bisect_batch_on_error: If the function returns an error, split the batch in two and retry. Default: false
         :param enabled: Set to false to disable the event source upon creation. Default: true
         :param event_source_arn: The Amazon Resource Name (ARN) of the event source. Any record added to this stream can invoke the Lambda function. Default: - not set if using a self managed Kafka cluster, throws an error otherwise
+        :param filter_encryption: Add Customer managed KMS key to encrypt Filter Criteria. Default: - none
         :param filters: Add filter criteria to Event Source. Default: - none
         :param kafka_bootstrap_servers: A list of host and port pairs that are the addresses of the Kafka brokers in a self managed "bootstrap" Kafka cluster that a Kafka client connects to initially to bootstrap itself. They are in the format ``abc.example.com:9096``. Default: - none
         :param kafka_consumer_group_id: The identifier for the Kafka consumer group to join. The consumer group ID must be unique among all your Kafka event sources. After creating a Kafka event source mapping with the consumer group ID specified, you cannot update this value. The value must have a lenght between 1 and 200 and full the pattern '[a-zA-Z0-9-/*:_+=.@-]*'. For more information, see `Customizable consumer group ID <https://docs.aws.amazon.com/lambda/latest/dg/with-msk.html#services-msk-consumer-group-id>`_. Default: - none
@@ -13093,11 +13101,13 @@ class EventSourceMappingProps(EventSourceMappingOptions):
             # The code below shows an example of how to instantiate this type.
             # The values are placeholders you should change.
             import aws_cdk as cdk
+            from aws_cdk import aws_kms as kms
             from aws_cdk import aws_lambda as lambda_
             
             # event_source_dlq: lambda.IEventSourceDlq
             # filters: Any
             # function_: lambda.Function
+            # key: kms.Key
             # source_access_configuration_type: lambda.SourceAccessConfigurationType
             
             event_source_mapping_props = lambda.EventSourceMappingProps(
@@ -13108,6 +13118,7 @@ class EventSourceMappingProps(EventSourceMappingOptions):
                 bisect_batch_on_error=False,
                 enabled=False,
                 event_source_arn="eventSourceArn",
+                filter_encryption=key,
                 filters=[{
                     "filters_key": filters
                 }],
@@ -13137,6 +13148,7 @@ class EventSourceMappingProps(EventSourceMappingOptions):
             check_type(argname="argument bisect_batch_on_error", value=bisect_batch_on_error, expected_type=type_hints["bisect_batch_on_error"])
             check_type(argname="argument enabled", value=enabled, expected_type=type_hints["enabled"])
             check_type(argname="argument event_source_arn", value=event_source_arn, expected_type=type_hints["event_source_arn"])
+            check_type(argname="argument filter_encryption", value=filter_encryption, expected_type=type_hints["filter_encryption"])
             check_type(argname="argument filters", value=filters, expected_type=type_hints["filters"])
             check_type(argname="argument kafka_bootstrap_servers", value=kafka_bootstrap_servers, expected_type=type_hints["kafka_bootstrap_servers"])
             check_type(argname="argument kafka_consumer_group_id", value=kafka_consumer_group_id, expected_type=type_hints["kafka_consumer_group_id"])
@@ -13165,6 +13177,8 @@ class EventSourceMappingProps(EventSourceMappingOptions):
             self._values["enabled"] = enabled
         if event_source_arn is not None:
             self._values["event_source_arn"] = event_source_arn
+        if filter_encryption is not None:
+            self._values["filter_encryption"] = filter_encryption
         if filters is not None:
             self._values["filters"] = filters
         if kafka_bootstrap_servers is not None:
@@ -13245,6 +13259,17 @@ class EventSourceMappingProps(EventSourceMappingOptions):
         result = self._values.get("event_source_arn")
         return typing.cast(typing.Optional[builtins.str], result)
 
+    @builtins.property
+    def filter_encryption(self) -> typing.Optional[_IKey_5f11635f]:
+        '''Add Customer managed KMS key to encrypt Filter Criteria.
+
+        :default: - none
+
+        :see: https://docs.aws.amazon.com/kms/latest/developerguide/concepts.html#aws-managed-cmk
+        '''
+        result = self._values.get("filter_encryption")
+        return typing.cast(typing.Optional[_IKey_5f11635f], result)
+
     @builtins.property
     def filters(
         self,
@@ -16770,6 +16795,7 @@ class IFunction(
         bisect_batch_on_error: typing.Optional[builtins.bool] = None,
         enabled: typing.Optional[builtins.bool] = None,
         event_source_arn: typing.Optional[builtins.str] = None,
+        filter_encryption: typing.Optional[_IKey_5f11635f] = None,
         filters: typing.Optional[typing.Sequence[typing.Mapping[builtins.str, typing.Any]]] = None,
         kafka_bootstrap_servers: typing.Optional[typing.Sequence[builtins.str]] = None,
         kafka_consumer_group_id: typing.Optional[builtins.str] = None,
@@ -16794,6 +16820,7 @@ class IFunction(
         :param bisect_batch_on_error: If the function returns an error, split the batch in two and retry. Default: false
         :param enabled: Set to false to disable the event source upon creation. Default: true
         :param event_source_arn: The Amazon Resource Name (ARN) of the event source. Any record added to this stream can invoke the Lambda function. Default: - not set if using a self managed Kafka cluster, throws an error otherwise
+        :param filter_encryption: Add Customer managed KMS key to encrypt Filter Criteria. Default: - none
         :param filters: Add filter criteria to Event Source. Default: - none
         :param kafka_bootstrap_servers: A list of host and port pairs that are the addresses of the Kafka brokers in a self managed "bootstrap" Kafka cluster that a Kafka client connects to initially to bootstrap itself. They are in the format ``abc.example.com:9096``. Default: - none
         :param kafka_consumer_group_id: The identifier for the Kafka consumer group to join. The consumer group ID must be unique among all your Kafka event sources. After creating a Kafka event source mapping with the consumer group ID specified, you cannot update this value. The value must have a lenght between 1 and 200 and full the pattern '[a-zA-Z0-9-/*:_+=.@-]*'. For more information, see `Customizable consumer group ID <https://docs.aws.amazon.com/lambda/latest/dg/with-msk.html#services-msk-consumer-group-id>`_. Default: - none
@@ -17186,6 +17213,7 @@ class _IFunctionProxy(
         bisect_batch_on_error: typing.Optional[builtins.bool] = None,
         enabled: typing.Optional[builtins.bool] = None,
         event_source_arn: typing.Optional[builtins.str] = None,
+        filter_encryption: typing.Optional[_IKey_5f11635f] = None,
         filters: typing.Optional[typing.Sequence[typing.Mapping[builtins.str, typing.Any]]] = None,
         kafka_bootstrap_servers: typing.Optional[typing.Sequence[builtins.str]] = None,
         kafka_consumer_group_id: typing.Optional[builtins.str] = None,
@@ -17210,6 +17238,7 @@ class _IFunctionProxy(
         :param bisect_batch_on_error: If the function returns an error, split the batch in two and retry. Default: false
         :param enabled: Set to false to disable the event source upon creation. Default: true
         :param event_source_arn: The Amazon Resource Name (ARN) of the event source. Any record added to this stream can invoke the Lambda function. Default: - not set if using a self managed Kafka cluster, throws an error otherwise
+        :param filter_encryption: Add Customer managed KMS key to encrypt Filter Criteria. Default: - none
         :param filters: Add filter criteria to Event Source. Default: - none
         :param kafka_bootstrap_servers: A list of host and port pairs that are the addresses of the Kafka brokers in a self managed "bootstrap" Kafka cluster that a Kafka client connects to initially to bootstrap itself. They are in the format ``abc.example.com:9096``. Default: - none
         :param kafka_consumer_group_id: The identifier for the Kafka consumer group to join. The consumer group ID must be unique among all your Kafka event sources. After creating a Kafka event source mapping with the consumer group ID specified, you cannot update this value. The value must have a lenght between 1 and 200 and full the pattern '[a-zA-Z0-9-/*:_+=.@-]*'. For more information, see `Customizable consumer group ID <https://docs.aws.amazon.com/lambda/latest/dg/with-msk.html#services-msk-consumer-group-id>`_. Default: - none
@@ -17235,6 +17264,7 @@ class _IFunctionProxy(
             bisect_batch_on_error=bisect_batch_on_error,
             enabled=enabled,
             event_source_arn=event_source_arn,
+            filter_encryption=filter_encryption,
             filters=filters,
             kafka_bootstrap_servers=kafka_bootstrap_servers,
             kafka_consumer_group_id=kafka_consumer_group_id,
@@ -21612,8 +21642,8 @@ class StartingPosition(enum.Enum):
 
     Example::
 
-        from aws_cdk.aws_secretsmanager import Secret
         from aws_cdk.aws_lambda_event_sources import ManagedKafkaEventSource
+        from aws_cdk.aws_kms import Key
         
         # my_function: lambda.Function
         
@@ -21624,15 +21654,18 @@ class StartingPosition(enum.Enum):
         # The Kafka topic you want to subscribe to
         topic = "some-cool-topic"
         
-        # The secret that allows access to your MSK cluster
-        # You still have to make sure that it is associated with your cluster as described in the documentation
-        secret = Secret(self, "Secret", secret_name="AmazonMSK_KafkaSecret")
+        # Your self managed KMS key
+        my_key = Key.from_key_arn(self, "SourceBucketEncryptionKey", "arn:aws:kms:us-east-1:123456789012:key/<key-id>")
         my_function.add_event_source(ManagedKafkaEventSource(
             cluster_arn=cluster_arn,
             topic=topic,
-            secret=secret,
-            batch_size=100,  # default
-            starting_position=lambda_.StartingPosition.TRIM_HORIZON
+            starting_position=lambda_.StartingPosition.TRIM_HORIZON,
+            filters=[
+                lambda_.FilterCriteria.filter({
+                    "string_equals": lambda_.FilterRule.is_equal("test")
+                })
+            ],
+            filter_encryption=my_key
         ))
     '''
 
@@ -24280,11 +24313,13 @@ class EventSourceMapping(
         # The code below shows an example of how to instantiate this type.
         # The values are placeholders you should change.
         import aws_cdk as cdk
+        from aws_cdk import aws_kms as kms
         from aws_cdk import aws_lambda as lambda_
         
         # event_source_dlq: lambda.IEventSourceDlq
         # filters: Any
         # function_: lambda.Function
+        # key: kms.Key
         # source_access_configuration_type: lambda.SourceAccessConfigurationType
         
         event_source_mapping = lambda_.EventSourceMapping(self, "MyEventSourceMapping",
@@ -24295,6 +24330,7 @@ class EventSourceMapping(
             bisect_batch_on_error=False,
             enabled=False,
             event_source_arn="eventSourceArn",
+            filter_encryption=key,
             filters=[{
                 "filters_key": filters
             }],
@@ -24329,6 +24365,7 @@ class EventSourceMapping(
         bisect_batch_on_error: typing.Optional[builtins.bool] = None,
         enabled: typing.Optional[builtins.bool] = None,
         event_source_arn: typing.Optional[builtins.str] = None,
+        filter_encryption: typing.Optional[_IKey_5f11635f] = None,
         filters: typing.Optional[typing.Sequence[typing.Mapping[builtins.str, typing.Any]]] = None,
         kafka_bootstrap_servers: typing.Optional[typing.Sequence[builtins.str]] = None,
         kafka_consumer_group_id: typing.Optional[builtins.str] = None,
@@ -24354,6 +24391,7 @@ class EventSourceMapping(
         :param bisect_batch_on_error: If the function returns an error, split the batch in two and retry. Default: false
         :param enabled: Set to false to disable the event source upon creation. Default: true
         :param event_source_arn: The Amazon Resource Name (ARN) of the event source. Any record added to this stream can invoke the Lambda function. Default: - not set if using a self managed Kafka cluster, throws an error otherwise
+        :param filter_encryption: Add Customer managed KMS key to encrypt Filter Criteria. Default: - none
         :param filters: Add filter criteria to Event Source. Default: - none
         :param kafka_bootstrap_servers: A list of host and port pairs that are the addresses of the Kafka brokers in a self managed "bootstrap" Kafka cluster that a Kafka client connects to initially to bootstrap itself. They are in the format ``abc.example.com:9096``. Default: - none
         :param kafka_consumer_group_id: The identifier for the Kafka consumer group to join. The consumer group ID must be unique among all your Kafka event sources. After creating a Kafka event source mapping with the consumer group ID specified, you cannot update this value. The value must have a lenght between 1 and 200 and full the pattern '[a-zA-Z0-9-/*:_+=.@-]*'. For more information, see `Customizable consumer group ID <https://docs.aws.amazon.com/lambda/latest/dg/with-msk.html#services-msk-consumer-group-id>`_. Default: - none
@@ -24381,6 +24419,7 @@ class EventSourceMapping(
             bisect_batch_on_error=bisect_batch_on_error,
             enabled=enabled,
             event_source_arn=event_source_arn,
+            filter_encryption=filter_encryption,
             filters=filters,
             kafka_bootstrap_servers=kafka_bootstrap_servers,
             kafka_consumer_group_id=kafka_consumer_group_id,
@@ -24499,6 +24538,7 @@ class FunctionBase(
         bisect_batch_on_error: typing.Optional[builtins.bool] = None,
         enabled: typing.Optional[builtins.bool] = None,
         event_source_arn: typing.Optional[builtins.str] = None,
+        filter_encryption: typing.Optional[_IKey_5f11635f] = None,
         filters: typing.Optional[typing.Sequence[typing.Mapping[builtins.str, typing.Any]]] = None,
         kafka_bootstrap_servers: typing.Optional[typing.Sequence[builtins.str]] = None,
         kafka_consumer_group_id: typing.Optional[builtins.str] = None,
@@ -24523,6 +24563,7 @@ class FunctionBase(
         :param bisect_batch_on_error: If the function returns an error, split the batch in two and retry. Default: false
         :param enabled: Set to false to disable the event source upon creation. Default: true
         :param event_source_arn: The Amazon Resource Name (ARN) of the event source. Any record added to this stream can invoke the Lambda function. Default: - not set if using a self managed Kafka cluster, throws an error otherwise
+        :param filter_encryption: Add Customer managed KMS key to encrypt Filter Criteria. Default: - none
         :param filters: Add filter criteria to Event Source. Default: - none
         :param kafka_bootstrap_servers: A list of host and port pairs that are the addresses of the Kafka brokers in a self managed "bootstrap" Kafka cluster that a Kafka client connects to initially to bootstrap itself. They are in the format ``abc.example.com:9096``. Default: - none
         :param kafka_consumer_group_id: The identifier for the Kafka consumer group to join. The consumer group ID must be unique among all your Kafka event sources. After creating a Kafka event source mapping with the consumer group ID specified, you cannot update this value. The value must have a lenght between 1 and 200 and full the pattern '[a-zA-Z0-9-/*:_+=.@-]*'. For more information, see `Customizable consumer group ID <https://docs.aws.amazon.com/lambda/latest/dg/with-msk.html#services-msk-consumer-group-id>`_. Default: - none
@@ -24548,6 +24589,7 @@ class FunctionBase(
             bisect_batch_on_error=bisect_batch_on_error,
             enabled=enabled,
             event_source_arn=event_source_arn,
+            filter_encryption=filter_encryption,
             filters=filters,
             kafka_bootstrap_servers=kafka_bootstrap_servers,
             kafka_consumer_group_id=kafka_consumer_group_id,
@@ -27861,6 +27903,7 @@ def _typecheckingstub__2fc9432254acf5a7dbe3c68dcedbda61de1f0e804a81d20ae79e04857
     event_source_arn: typing.Optional[builtins.str] = None,
     filter_criteria: typing.Optional[typing.Union[_IResolvable_da3f097b, typing.Union[CfnEventSourceMapping.FilterCriteriaProperty, typing.Dict[builtins.str, typing.Any]]]] = None,
     function_response_types: typing.Optional[typing.Sequence[builtins.str]] = None,
+    kms_key_arn: typing.Optional[builtins.str] = None,
     maximum_batching_window_in_seconds: typing.Optional[jsii.Number] = None,
     maximum_record_age_in_seconds: typing.Optional[jsii.Number] = None,
     maximum_retry_attempts: typing.Optional[jsii.Number] = None,
@@ -27950,6 +27993,12 @@ def _typecheckingstub__d464545d76bb56469faf58591d3fb0044c464a1cdb5b122bf47e0b3ea
     """Type checking stubs"""
     pass
 
+def _typecheckingstub__5110117b05ec57a413615f5bf30afd8bbafb2be839685cf0e158a1b4de420fbc(
+    value: typing.Optional[builtins.str],
+) -> None:
+    """Type checking stubs"""
+    pass
+
 def _typecheckingstub__e0ab317a438123c62fee46e89709c7bb879475c514910f3928a4fa4a397f556a(
     value: typing.Optional[jsii.Number],
 ) -> None:
@@ -28120,6 +28169,7 @@ def _typecheckingstub__28f15573fb2525439f034f01287568e3c4a4d28fda953b3059f294655
     event_source_arn: typing.Optional[builtins.str] = None,
     filter_criteria: typing.Optional[typing.Union[_IResolvable_da3f097b, typing.Union[CfnEventSourceMapping.FilterCriteriaProperty, typing.Dict[builtins.str, typing.Any]]]] = None,
     function_response_types: typing.Optional[typing.Sequence[builtins.str]] = None,
+    kms_key_arn: typing.Optional[builtins.str] = None,
     maximum_batching_window_in_seconds: typing.Optional[jsii.Number] = None,
     maximum_record_age_in_seconds: typing.Optional[jsii.Number] = None,
     maximum_retry_attempts: typing.Optional[jsii.Number] = None,
@@ -29178,6 +29228,7 @@ def _typecheckingstub__7442d2bd60e56a826eab54e95fa6a6ebc8961285a26558c7189840a12
     bisect_batch_on_error: typing.Optional[builtins.bool] = None,
     enabled: typing.Optional[builtins.bool] = None,
     event_source_arn: typing.Optional[builtins.str] = None,
+    filter_encryption: typing.Optional[_IKey_5f11635f] = None,
     filters: typing.Optional[typing.Sequence[typing.Mapping[builtins.str, typing.Any]]] = None,
     kafka_bootstrap_servers: typing.Optional[typing.Sequence[builtins.str]] = None,
     kafka_consumer_group_id: typing.Optional[builtins.str] = None,
@@ -29204,6 +29255,7 @@ def _typecheckingstub__e74d0bc5516fc715f7302bdf199df23dddf769e98771f0bac2ff026a4
     bisect_batch_on_error: typing.Optional[builtins.bool] = None,
     enabled: typing.Optional[builtins.bool] = None,
     event_source_arn: typing.Optional[builtins.str] = None,
+    filter_encryption: typing.Optional[_IKey_5f11635f] = None,
     filters: typing.Optional[typing.Sequence[typing.Mapping[builtins.str, typing.Any]]] = None,
     kafka_bootstrap_servers: typing.Optional[typing.Sequence[builtins.str]] = None,
     kafka_consumer_group_id: typing.Optional[builtins.str] = None,
@@ -29480,6 +29532,7 @@ def _typecheckingstub__726375d512fd3c0da30be8d20d1c4016974ba77359e6bac8eb3569126
     bisect_batch_on_error: typing.Optional[builtins.bool] = None,
     enabled: typing.Optional[builtins.bool] = None,
     event_source_arn: typing.Optional[builtins.str] = None,
+    filter_encryption: typing.Optional[_IKey_5f11635f] = None,
     filters: typing.Optional[typing.Sequence[typing.Mapping[builtins.str, typing.Any]]] = None,
     kafka_bootstrap_servers: typing.Optional[typing.Sequence[builtins.str]] = None,
     kafka_consumer_group_id: typing.Optional[builtins.str] = None,
@@ -30155,6 +30208,7 @@ def _typecheckingstub__b0460bc5250777612d2b42ec799737ce019fcdc03fe86c6540ab2ecec
     bisect_batch_on_error: typing.Optional[builtins.bool] = None,
     enabled: typing.Optional[builtins.bool] = None,
     event_source_arn: typing.Optional[builtins.str] = None,
+    filter_encryption: typing.Optional[_IKey_5f11635f] = None,
     filters: typing.Optional[typing.Sequence[typing.Mapping[builtins.str, typing.Any]]] = None,
     kafka_bootstrap_servers: typing.Optional[typing.Sequence[builtins.str]] = None,
     kafka_consumer_group_id: typing.Optional[builtins.str] = None,
@@ -30208,6 +30262,7 @@ def _typecheckingstub__bfc312bd9bc4e64c5ae8419715155a56676bb9fe40870f57ffa4f3030
     bisect_batch_on_error: typing.Optional[builtins.bool] = None,
     enabled: typing.Optional[builtins.bool] = None,
     event_source_arn: typing.Optional[builtins.str] = None,
+    filter_encryption: typing.Optional[_IKey_5f11635f] = None,
     filters: typing.Optional[typing.Sequence[typing.Mapping[builtins.str, typing.Any]]] = None,
     kafka_bootstrap_servers: typing.Optional[typing.Sequence[builtins.str]] = None,
     kafka_consumer_group_id: typing.Optional[builtins.str] = None,