aws-cdk-lib 2.151.1__py3-none-any.whl → 2.153.0__py3-none-any.whl

aws_cdk/aws_lambda/__init__.py

@@ -820,6 +820,50 @@ fn.add_event_source(eventsources.DynamoEventSource(table,
 ))
 ```
 
+By default, Lambda will encrypt Filter Criteria using AWS managed keys. But if you want to use a self managed KMS key to encrypt the filters, You can specify the self managed key using the `filterEncryption` property.
+
+```python
+import aws_cdk.aws_lambda_event_sources as eventsources
+import aws_cdk.aws_dynamodb as dynamodb
+from aws_cdk.aws_kms import Key
+
+# fn: lambda.Function
+
+table = dynamodb.Table(self, "Table",
+    partition_key=dynamodb.Attribute(
+        name="id",
+        type=dynamodb.AttributeType.STRING
+    ),
+    stream=dynamodb.StreamViewType.NEW_IMAGE
+)
+# Your self managed KMS key
+my_key = Key.from_key_arn(self, "SourceBucketEncryptionKey", "arn:aws:kms:us-east-1:123456789012:key/<key-id>")
+
+fn.add_event_source(eventsources.DynamoEventSource(table,
+    starting_position=lambda_.StartingPosition.LATEST,
+    filters=[lambda_.FilterCriteria.filter({"event_name": lambda_.FilterRule.is_equal("INSERT")})],
+    filter_encryption=my_key
+))
+```
+
+> Lambda requires allow `kms:Decrypt` on Lambda principal `lambda.amazonaws.com` to use the key for Filter Criteria Encryption. If you create the KMS key in the stack, CDK will automatically add this permission to the Key when you creates eventSourceMapping. However, if you import the key using function like `Key.fromKeyArn` then you need to add the following permission to the KMS key before using it to encrypt Filter Criteria
+
+```json
+{
+    "Version": "2012-10-17",
+    "Statement": [
+        {
+            "Effect": "Allow",
+            "Principal": {
+                "Service": "lambda.amazonaws.com"
+            },
+            "Action": "kms:Decrypt",
+            "Resource": "*"
+        }
+    ]
+}
+```
+
 See the documentation for the **@aws-cdk/aws-lambda-event-sources** module for more details.
 
 ## Imported Lambdas
@@ -998,8 +1042,7 @@ fn = lambda_.Function(self, "MyFunction",
 )
 ```
 
-See [the AWS documentation](https://docs.aws.amazon.com/lambda/latest/dg/concurrent-executions.html)
-managing concurrency.
+https://docs.aws.amazon.com/lambda/latest/dg/invocation-recursion.html
 
 ## Lambda with SnapStart
 
@@ -1134,6 +1177,26 @@ lambda_.Function(self, "Lambda",
 Providing a user-controlled log group was rolled out to commercial regions on 2023-11-16.
 If you are deploying to another type of region, please check regional availability first.
 
+## Lambda with Recursive Loop protection
+
+Recursive loop protection is to stop unintended loops. The customers are opted in by default for Lambda to detect and terminate unintended loops between Lambda and other AWS Services.
+The property can be assigned two values here, "Allow" and "Terminate".
+
+The default value is set to "Terminate", which lets the Lambda to detect and terminate the recursive loops.
+
+When the value is set to "Allow", the customers opt out of recursive loop detection and Lambda does not terminate recursive loops if any.
+
+See [the AWS documentation](https://docs.aws.amazon.com/lambda/latest/dg/invocation-recursion.html) to learn more about AWS Lambda Recusrive Loop Detection
+
+```python
+fn = lambda_.Function(self, "MyFunction",
+    code=lambda_.Code.from_asset(path.join(__dirname, "handler.zip")),
+    runtime=lambda_.Runtime.JAVA_11,
+    handler="example.Handler::handleRequest",
+    recursive_loop=lambda_.RecursiveLoop.TERMINATE
+)
+```
+
 ### Legacy Log Retention
 
 As an alternative to providing a custom, user controlled log group, the legacy `logRetention` property can be used to set a different expiration period.
@@ -4374,6 +4437,7 @@ class CfnEventSourceMapping(
                 )]
             ),
             function_response_types=["functionResponseTypes"],
+            kms_key_arn="kmsKeyArn",
             maximum_batching_window_in_seconds=123,
             maximum_record_age_in_seconds=123,
             maximum_retry_attempts=123,
@@ -4416,6 +4480,7 @@ class CfnEventSourceMapping(
         event_source_arn: typing.Optional[builtins.str] = None,
         filter_criteria: typing.Optional[typing.Union[_IResolvable_da3f097b, typing.Union["CfnEventSourceMapping.FilterCriteriaProperty", typing.Dict[builtins.str, typing.Any]]]] = None,
         function_response_types: typing.Optional[typing.Sequence[builtins.str]] = None,
+        kms_key_arn: typing.Optional[builtins.str] = None,
         maximum_batching_window_in_seconds: typing.Optional[jsii.Number] = None,
         maximum_record_age_in_seconds: typing.Optional[jsii.Number] = None,
         maximum_retry_attempts: typing.Optional[jsii.Number] = None,
@@ -4433,29 +4498,30 @@ class CfnEventSourceMapping(
         '''
         :param scope: Scope in which this resource is defined.
         :param id: Construct identifier for this resource (unique in its scope).
-        :param function_name: The name or ARN of the Lambda function. **Name formats** - *Function name* – ``MyFunction`` . - *Function ARN* – ``arn:aws:lambda:us-west-2:123456789012:function:MyFunction`` . - *Version or Alias ARN* – ``arn:aws:lambda:us-west-2:123456789012:function:MyFunction:PROD`` . - *Partial ARN* – ``123456789012:function:MyFunction`` . The length constraint applies only to the full ARN. If you specify only the function name, it's limited to 64 characters in length.
-        :param amazon_managed_kafka_event_source_config: Specific configuration settings for an Amazon Managed Streaming for Apache Kafka (Amazon MSK) event source.
-        :param batch_size: The maximum number of records in each batch that Lambda pulls from your stream or queue and sends to your function. Lambda passes all of the records in the batch to the function in a single call, up to the payload limit for synchronous invocation (6 MB). - *Amazon Kinesis* – Default 100. Max 10,000. - *Amazon DynamoDB Streams* – Default 100. Max 10,000. - *Amazon Simple Queue Service* – Default 10. For standard queues the max is 10,000. For FIFO queues the max is 10. - *Amazon Managed Streaming for Apache Kafka* – Default 100. Max 10,000. - *Self-managed Apache Kafka* – Default 100. Max 10,000. - *Amazon MQ (ActiveMQ and RabbitMQ)* – Default 100. Max 10,000. - *DocumentDB* – Default 100. Max 10,000.
-        :param bisect_batch_on_function_error: (Kinesis and DynamoDB Streams only) If the function returns an error, split the batch in two and retry. The default value is false.
-        :param destination_config: (Kinesis, DynamoDB Streams, Amazon MSK, and self-managed Apache Kafka event sources only) A configuration object that specifies the destination of an event after Lambda processes it.
-        :param document_db_event_source_config: Specific configuration settings for a DocumentDB event source.
-        :param enabled: When true, the event source mapping is active. When false, Lambda pauses polling and invocation. Default: True
-        :param event_source_arn: The Amazon Resource Name (ARN) of the event source. - *Amazon Kinesis* – The ARN of the data stream or a stream consumer. - *Amazon DynamoDB Streams* – The ARN of the stream. - *Amazon Simple Queue Service* – The ARN of the queue. - *Amazon Managed Streaming for Apache Kafka* – The ARN of the cluster or the ARN of the VPC connection (for `cross-account event source mappings <https://docs.aws.amazon.com/lambda/latest/dg/with-msk.html#msk-multi-vpc>`_ ). - *Amazon MQ* – The ARN of the broker. - *Amazon DocumentDB* – The ARN of the DocumentDB change stream.
-        :param filter_criteria: An object that defines the filter criteria that determine whether Lambda should process an event. For more information, see `Lambda event filtering <https://docs.aws.amazon.com/lambda/latest/dg/invocation-eventfiltering.html>`_ .
-        :param function_response_types: (Streams and SQS) A list of current response type enums applied to the event source mapping. Valid Values: ``ReportBatchItemFailures``
-        :param maximum_batching_window_in_seconds: The maximum amount of time, in seconds, that Lambda spends gathering records before invoking the function. *Default ( Kinesis , DynamoDB , Amazon SQS event sources)* : 0 *Default ( Amazon MSK , Kafka, Amazon MQ , Amazon DocumentDB event sources)* : 500 ms *Related setting:* For Amazon SQS event sources, when you set ``BatchSize`` to a value greater than 10, you must set ``MaximumBatchingWindowInSeconds`` to at least 1.
-        :param maximum_record_age_in_seconds: (Kinesis and DynamoDB Streams only) Discard records older than the specified age. The default value is -1, which sets the maximum age to infinite. When the value is set to infinite, Lambda never discards old records. .. epigraph:: The minimum valid value for maximum record age is 60s. Although values less than 60 and greater than -1 fall within the parameter's absolute range, they are not allowed
-        :param maximum_retry_attempts: (Kinesis and DynamoDB Streams only) Discard records after the specified number of retries. The default value is -1, which sets the maximum number of retries to infinite. When MaximumRetryAttempts is infinite, Lambda retries failed records until the record expires in the event source.
-        :param parallelization_factor: (Kinesis and DynamoDB Streams only) The number of batches to process concurrently from each shard. The default value is 1.
-        :param queues: (Amazon MQ) The name of the Amazon MQ broker destination queue to consume.
-        :param scaling_config: (Amazon SQS only) The scaling configuration for the event source. For more information, see `Configuring maximum concurrency for Amazon SQS event sources <https://docs.aws.amazon.com/lambda/latest/dg/with-sqs.html#events-sqs-max-concurrency>`_ .
-        :param self_managed_event_source: The self-managed Apache Kafka cluster for your event source.
-        :param self_managed_kafka_event_source_config: Specific configuration settings for a self-managed Apache Kafka event source.
-        :param source_access_configurations: An array of the authentication protocol, VPC components, or virtual host to secure and define your event source.
-        :param starting_position: The position in a stream from which to start reading. Required for Amazon Kinesis and Amazon DynamoDB. - *LATEST* - Read only new records. - *TRIM_HORIZON* - Process all available records. - *AT_TIMESTAMP* - Specify a time from which to start reading records.
-        :param starting_position_timestamp: With ``StartingPosition`` set to ``AT_TIMESTAMP`` , the time from which to start reading, in Unix time seconds. ``StartingPositionTimestamp`` cannot be in the future.
-        :param topics: The name of the Kafka topic.
-        :param tumbling_window_in_seconds: (Kinesis and DynamoDB Streams only) The duration in seconds of a processing window for DynamoDB and Kinesis Streams event sources. A value of 0 seconds indicates no tumbling window.
+        :param function_name: The name of the Lambda function.
+        :param amazon_managed_kafka_event_source_config: Specific configuration settings for an MSK event source.
+        :param batch_size: The maximum number of items to retrieve in a single batch.
+        :param bisect_batch_on_function_error: (Streams) If the function returns an error, split the batch in two and retry.
+        :param destination_config: A configuration object that specifies the destination of an event after Lambda processes it.
+        :param document_db_event_source_config: Document db event source config.
+        :param enabled: Disables the event source mapping to pause polling and invocation.
+        :param event_source_arn: The Amazon Resource Name (ARN) of the event source.
+        :param filter_criteria: The filter criteria to control event filtering.
+        :param function_response_types: (Streams) A list of response types supported by the function.
+        :param kms_key_arn: The Amazon Resource Name (ARN) of the KMS key.
+        :param maximum_batching_window_in_seconds: (Streams) The maximum amount of time to gather records before invoking the function, in seconds.
+        :param maximum_record_age_in_seconds: (Streams) The maximum age of a record that Lambda sends to a function for processing.
+        :param maximum_retry_attempts: (Streams) The maximum number of times to retry when the function returns an error.
+        :param parallelization_factor: (Streams) The number of batches to process from each shard concurrently.
+        :param queues: (ActiveMQ) A list of ActiveMQ queues.
+        :param scaling_config: The scaling configuration for the event source.
+        :param self_managed_event_source: The configuration used by AWS Lambda to access a self-managed event source.
+        :param self_managed_kafka_event_source_config: Specific configuration settings for a Self-Managed Apache Kafka event source.
+        :param source_access_configurations: A list of SourceAccessConfiguration.
+        :param starting_position: The position in a stream from which to start reading. Required for Amazon Kinesis and Amazon DynamoDB Streams sources.
+        :param starting_position_timestamp: With StartingPosition set to AT_TIMESTAMP, the time from which to start reading, in Unix time seconds.
+        :param topics: (Kafka) A list of Kafka topics.
+        :param tumbling_window_in_seconds: (Streams) Tumbling window (non-overlapping time window) duration to perform aggregations.
         '''
         if __debug__:
             type_hints = typing.get_type_hints(_typecheckingstub__2fc9432254acf5a7dbe3c68dcedbda61de1f0e804a81d20ae79e04857b83d419)
@@ -4472,6 +4538,7 @@ class CfnEventSourceMapping(
             event_source_arn=event_source_arn,
             filter_criteria=filter_criteria,
             function_response_types=function_response_types,
+            kms_key_arn=kms_key_arn,
             maximum_batching_window_in_seconds=maximum_batching_window_in_seconds,
             maximum_record_age_in_seconds=maximum_record_age_in_seconds,
             maximum_retry_attempts=maximum_retry_attempts,
@@ -4522,7 +4589,7 @@ class CfnEventSourceMapping(
     @builtins.property
     @jsii.member(jsii_name="attrId")
     def attr_id(self) -> builtins.str:
-        '''The event source mapping's ID.
+        '''Event Source Mapping Identifier UUID.
 
         :cloudformationAttribute: Id
         '''
@@ -4536,7 +4603,7 @@ class CfnEventSourceMapping(
     @builtins.property
     @jsii.member(jsii_name="functionName")
     def function_name(self) -> builtins.str:
-        '''The name or ARN of the Lambda function.'''
+        '''The name of the Lambda function.'''
         return typing.cast(builtins.str, jsii.get(self, "functionName"))
 
     @function_name.setter
@@ -4551,7 +4618,7 @@ class CfnEventSourceMapping(
     def amazon_managed_kafka_event_source_config(
         self,
     ) -> typing.Optional[typing.Union[_IResolvable_da3f097b, "CfnEventSourceMapping.AmazonManagedKafkaEventSourceConfigProperty"]]:
-        '''Specific configuration settings for an Amazon Managed Streaming for Apache Kafka (Amazon MSK) event source.'''
+        '''Specific configuration settings for an MSK event source.'''
         return typing.cast(typing.Optional[typing.Union[_IResolvable_da3f097b, "CfnEventSourceMapping.AmazonManagedKafkaEventSourceConfigProperty"]], jsii.get(self, "amazonManagedKafkaEventSourceConfig"))
 
     @amazon_managed_kafka_event_source_config.setter
@@ -4567,7 +4634,7 @@ class CfnEventSourceMapping(
     @builtins.property
     @jsii.member(jsii_name="batchSize")
     def batch_size(self) -> typing.Optional[jsii.Number]:
-        '''The maximum number of records in each batch that Lambda pulls from your stream or queue and sends to your function.'''
+        '''The maximum number of items to retrieve in a single batch.'''
         return typing.cast(typing.Optional[jsii.Number], jsii.get(self, "batchSize"))
 
     @batch_size.setter
@@ -4582,7 +4649,7 @@ class CfnEventSourceMapping(
     def bisect_batch_on_function_error(
         self,
     ) -> typing.Optional[typing.Union[builtins.bool, _IResolvable_da3f097b]]:
-        '''(Kinesis and DynamoDB Streams only) If the function returns an error, split the batch in two and retry.'''
+        '''(Streams) If the function returns an error, split the batch in two and retry.'''
         return typing.cast(typing.Optional[typing.Union[builtins.bool, _IResolvable_da3f097b]], jsii.get(self, "bisectBatchOnFunctionError"))
 
     @bisect_batch_on_function_error.setter
@@ -4600,7 +4667,7 @@ class CfnEventSourceMapping(
     def destination_config(
         self,
     ) -> typing.Optional[typing.Union[_IResolvable_da3f097b, "CfnEventSourceMapping.DestinationConfigProperty"]]:
-        '''(Kinesis, DynamoDB Streams, Amazon MSK, and self-managed Apache Kafka event sources only) A configuration object that specifies the destination of an event after Lambda processes it.'''
+        '''A configuration object that specifies the destination of an event after Lambda processes it.'''
         return typing.cast(typing.Optional[typing.Union[_IResolvable_da3f097b, "CfnEventSourceMapping.DestinationConfigProperty"]], jsii.get(self, "destinationConfig"))
 
     @destination_config.setter
@@ -4618,7 +4685,7 @@ class CfnEventSourceMapping(
     def document_db_event_source_config(
         self,
     ) -> typing.Optional[typing.Union[_IResolvable_da3f097b, "CfnEventSourceMapping.DocumentDBEventSourceConfigProperty"]]:
-        '''Specific configuration settings for a DocumentDB event source.'''
+        '''Document db event source config.'''
         return typing.cast(typing.Optional[typing.Union[_IResolvable_da3f097b, "CfnEventSourceMapping.DocumentDBEventSourceConfigProperty"]], jsii.get(self, "documentDbEventSourceConfig"))
 
     @document_db_event_source_config.setter
@@ -4636,10 +4703,7 @@ class CfnEventSourceMapping(
     def enabled(
         self,
     ) -> typing.Optional[typing.Union[builtins.bool, _IResolvable_da3f097b]]:
-        '''When true, the event source mapping is active.
-
-        When false, Lambda pauses polling and invocation.
-        '''
+        '''Disables the event source mapping to pause polling and invocation.'''
         return typing.cast(typing.Optional[typing.Union[builtins.bool, _IResolvable_da3f097b]], jsii.get(self, "enabled"))
 
     @enabled.setter
@@ -4670,7 +4734,7 @@ class CfnEventSourceMapping(
     def filter_criteria(
         self,
     ) -> typing.Optional[typing.Union[_IResolvable_da3f097b, "CfnEventSourceMapping.FilterCriteriaProperty"]]:
-        '''An object that defines the filter criteria that determine whether Lambda should process an event.'''
+        '''The filter criteria to control event filtering.'''
         return typing.cast(typing.Optional[typing.Union[_IResolvable_da3f097b, "CfnEventSourceMapping.FilterCriteriaProperty"]], jsii.get(self, "filterCriteria"))
 
     @filter_criteria.setter
@@ -4686,7 +4750,7 @@ class CfnEventSourceMapping(
     @builtins.property
     @jsii.member(jsii_name="functionResponseTypes")
     def function_response_types(self) -> typing.Optional[typing.List[builtins.str]]:
-        '''(Streams and SQS) A list of current response type enums applied to the event source mapping.'''
+        '''(Streams) A list of response types supported by the function.'''
         return typing.cast(typing.Optional[typing.List[builtins.str]], jsii.get(self, "functionResponseTypes"))
 
     @function_response_types.setter
@@ -4699,10 +4763,23 @@ class CfnEventSourceMapping(
             check_type(argname="argument value", value=value, expected_type=type_hints["value"])
         jsii.set(self, "functionResponseTypes", value)
 
+    @builtins.property
+    @jsii.member(jsii_name="kmsKeyArn")
+    def kms_key_arn(self) -> typing.Optional[builtins.str]:
+        '''The Amazon Resource Name (ARN) of the KMS key.'''
+        return typing.cast(typing.Optional[builtins.str], jsii.get(self, "kmsKeyArn"))
+
+    @kms_key_arn.setter
+    def kms_key_arn(self, value: typing.Optional[builtins.str]) -> None:
+        if __debug__:
+            type_hints = typing.get_type_hints(_typecheckingstub__5110117b05ec57a413615f5bf30afd8bbafb2be839685cf0e158a1b4de420fbc)
+            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
+        jsii.set(self, "kmsKeyArn", value)
+
     @builtins.property
     @jsii.member(jsii_name="maximumBatchingWindowInSeconds")
     def maximum_batching_window_in_seconds(self) -> typing.Optional[jsii.Number]:
-        '''The maximum amount of time, in seconds, that Lambda spends gathering records before invoking the function.'''
+        '''(Streams) The maximum amount of time to gather records before invoking the function, in seconds.'''
         return typing.cast(typing.Optional[jsii.Number], jsii.get(self, "maximumBatchingWindowInSeconds"))
 
     @maximum_batching_window_in_seconds.setter
@@ -4718,7 +4795,7 @@ class CfnEventSourceMapping(
     @builtins.property
     @jsii.member(jsii_name="maximumRecordAgeInSeconds")
     def maximum_record_age_in_seconds(self) -> typing.Optional[jsii.Number]:
-        '''(Kinesis and DynamoDB Streams only) Discard records older than the specified age.'''
+        '''(Streams) The maximum age of a record that Lambda sends to a function for processing.'''
         return typing.cast(typing.Optional[jsii.Number], jsii.get(self, "maximumRecordAgeInSeconds"))
 
     @maximum_record_age_in_seconds.setter
@@ -4734,7 +4811,7 @@ class CfnEventSourceMapping(
     @builtins.property
     @jsii.member(jsii_name="maximumRetryAttempts")
     def maximum_retry_attempts(self) -> typing.Optional[jsii.Number]:
-        '''(Kinesis and DynamoDB Streams only) Discard records after the specified number of retries.'''
+        '''(Streams) The maximum number of times to retry when the function returns an error.'''
         return typing.cast(typing.Optional[jsii.Number], jsii.get(self, "maximumRetryAttempts"))
 
     @maximum_retry_attempts.setter
@@ -4747,7 +4824,7 @@ class CfnEventSourceMapping(
     @builtins.property
     @jsii.member(jsii_name="parallelizationFactor")
     def parallelization_factor(self) -> typing.Optional[jsii.Number]:
-        '''(Kinesis and DynamoDB Streams only) The number of batches to process concurrently from each shard.'''
+        '''(Streams) The number of batches to process from each shard concurrently.'''
         return typing.cast(typing.Optional[jsii.Number], jsii.get(self, "parallelizationFactor"))
 
     @parallelization_factor.setter
@@ -4760,7 +4837,7 @@ class CfnEventSourceMapping(
     @builtins.property
     @jsii.member(jsii_name="queues")
     def queues(self) -> typing.Optional[typing.List[builtins.str]]:
-        '''(Amazon MQ) The name of the Amazon MQ broker destination queue to consume.'''
+        '''(ActiveMQ) A list of ActiveMQ queues.'''
         return typing.cast(typing.Optional[typing.List[builtins.str]], jsii.get(self, "queues"))
 
     @queues.setter
@@ -4775,7 +4852,7 @@ class CfnEventSourceMapping(
     def scaling_config(
         self,
     ) -> typing.Optional[typing.Union[_IResolvable_da3f097b, "CfnEventSourceMapping.ScalingConfigProperty"]]:
-        '''(Amazon SQS only) The scaling configuration for the event source.'''
+        '''The scaling configuration for the event source.'''
         return typing.cast(typing.Optional[typing.Union[_IResolvable_da3f097b, "CfnEventSourceMapping.ScalingConfigProperty"]], jsii.get(self, "scalingConfig"))
 
     @scaling_config.setter
@@ -4793,7 +4870,7 @@ class CfnEventSourceMapping(
     def self_managed_event_source(
         self,
     ) -> typing.Optional[typing.Union[_IResolvable_da3f097b, "CfnEventSourceMapping.SelfManagedEventSourceProperty"]]:
-        '''The self-managed Apache Kafka cluster for your event source.'''
+        '''The configuration used by AWS Lambda to access a self-managed event source.'''
         return typing.cast(typing.Optional[typing.Union[_IResolvable_da3f097b, "CfnEventSourceMapping.SelfManagedEventSourceProperty"]], jsii.get(self, "selfManagedEventSource"))
 
     @self_managed_event_source.setter
@@ -4811,7 +4888,7 @@ class CfnEventSourceMapping(
     def self_managed_kafka_event_source_config(
         self,
     ) -> typing.Optional[typing.Union[_IResolvable_da3f097b, "CfnEventSourceMapping.SelfManagedKafkaEventSourceConfigProperty"]]:
-        '''Specific configuration settings for a self-managed Apache Kafka event source.'''
+        '''Specific configuration settings for a Self-Managed Apache Kafka event source.'''
         return typing.cast(typing.Optional[typing.Union[_IResolvable_da3f097b, "CfnEventSourceMapping.SelfManagedKafkaEventSourceConfigProperty"]], jsii.get(self, "selfManagedKafkaEventSourceConfig"))
 
     @self_managed_kafka_event_source_config.setter
@@ -4829,7 +4906,7 @@ class CfnEventSourceMapping(
     def source_access_configurations(
         self,
     ) -> typing.Optional[typing.Union[_IResolvable_da3f097b, typing.List[typing.Union[_IResolvable_da3f097b, "CfnEventSourceMapping.SourceAccessConfigurationProperty"]]]]:
-        '''An array of the authentication protocol, VPC components, or virtual host to secure and define your event source.'''
+        '''A list of SourceAccessConfiguration.'''
         return typing.cast(typing.Optional[typing.Union[_IResolvable_da3f097b, typing.List[typing.Union[_IResolvable_da3f097b, "CfnEventSourceMapping.SourceAccessConfigurationProperty"]]]], jsii.get(self, "sourceAccessConfigurations"))
 
     @source_access_configurations.setter
@@ -4845,10 +4922,7 @@ class CfnEventSourceMapping(
     @builtins.property
     @jsii.member(jsii_name="startingPosition")
     def starting_position(self) -> typing.Optional[builtins.str]:
-        '''The position in a stream from which to start reading.
-
-        Required for Amazon Kinesis and Amazon DynamoDB.
-        '''
+        '''The position in a stream from which to start reading.'''
         return typing.cast(typing.Optional[builtins.str], jsii.get(self, "startingPosition"))
 
     @starting_position.setter
@@ -4861,7 +4935,7 @@ class CfnEventSourceMapping(
     @builtins.property
     @jsii.member(jsii_name="startingPositionTimestamp")
     def starting_position_timestamp(self) -> typing.Optional[jsii.Number]:
-        '''With ``StartingPosition`` set to ``AT_TIMESTAMP`` , the time from which to start reading, in Unix time seconds.'''
+        '''With StartingPosition set to AT_TIMESTAMP, the time from which to start reading, in Unix time seconds.'''
         return typing.cast(typing.Optional[jsii.Number], jsii.get(self, "startingPositionTimestamp"))
 
     @starting_position_timestamp.setter
@@ -4874,7 +4948,7 @@ class CfnEventSourceMapping(
     @builtins.property
     @jsii.member(jsii_name="topics")
     def topics(self) -> typing.Optional[typing.List[builtins.str]]:
-        '''The name of the Kafka topic.'''
+        '''(Kafka) A list of Kafka topics.'''
         return typing.cast(typing.Optional[typing.List[builtins.str]], jsii.get(self, "topics"))
 
     @topics.setter
@@ -4887,7 +4961,7 @@ class CfnEventSourceMapping(
     @builtins.property
     @jsii.member(jsii_name="tumblingWindowInSeconds")
     def tumbling_window_in_seconds(self) -> typing.Optional[jsii.Number]:
-        '''(Kinesis and DynamoDB Streams only) The duration in seconds of a processing window for DynamoDB and Kinesis Streams event sources.'''
+        '''(Streams) Tumbling window (non-overlapping time window) duration to perform aggregations.'''
         return typing.cast(typing.Optional[jsii.Number], jsii.get(self, "tumblingWindowInSeconds"))
 
     @tumbling_window_in_seconds.setter
@@ -4908,9 +4982,9 @@ class CfnEventSourceMapping(
             *,
             consumer_group_id: typing.Optional[builtins.str] = None,
         ) -> None:
-            '''Specific configuration settings for an Amazon Managed Streaming for Apache Kafka (Amazon MSK) event source.
+            '''Specific configuration settings for an MSK event source.
 
-            :param consumer_group_id: The identifier for the Kafka consumer group to join. The consumer group ID must be unique among all your Kafka event sources. After creating a Kafka event source mapping with the consumer group ID specified, you cannot update this value. For more information, see `Customizable consumer group ID <https://docs.aws.amazon.com/lambda/latest/dg/with-msk.html#services-msk-consumer-group-id>`_ .
+            :param consumer_group_id: The identifier for the Kafka Consumer Group to join.
 
             :see: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-lambda-eventsourcemapping-amazonmanagedkafkaeventsourceconfig.html
             :exampleMetadata: fixture=_generated
@@ -4934,9 +5008,7 @@ class CfnEventSourceMapping(
 
         @builtins.property
         def consumer_group_id(self) -> typing.Optional[builtins.str]:
-            '''The identifier for the Kafka consumer group to join.
-
-            The consumer group ID must be unique among all your Kafka event sources. After creating a Kafka event source mapping with the consumer group ID specified, you cannot update this value. For more information, see `Customizable consumer group ID <https://docs.aws.amazon.com/lambda/latest/dg/with-msk.html#services-msk-consumer-group-id>`_ .
+            '''The identifier for the Kafka Consumer Group to join.
 
             :see: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-lambda-eventsourcemapping-amazonmanagedkafkaeventsourceconfig.html#cfn-lambda-eventsourcemapping-amazonmanagedkafkaeventsourceconfig-consumergroupid
             '''
@@ -4967,7 +5039,7 @@ class CfnEventSourceMapping(
         ) -> None:
             '''A configuration object that specifies the destination of an event after Lambda processes it.
 
-            :param on_failure: The destination configuration for failed invocations.
+            :param on_failure: A destination for records of invocations that failed processing.
 
             :see: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-lambda-eventsourcemapping-destinationconfig.html
             :exampleMetadata: fixture=_generated
@@ -4995,7 +5067,7 @@ class CfnEventSourceMapping(
         def on_failure(
             self,
         ) -> typing.Optional[typing.Union[_IResolvable_da3f097b, "CfnEventSourceMapping.OnFailureProperty"]]:
-            '''The destination configuration for failed invocations.
+            '''A destination for records of invocations that failed processing.
 
             :see: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-lambda-eventsourcemapping-destinationconfig.html#cfn-lambda-eventsourcemapping-destinationconfig-onfailure
             '''
@@ -5030,11 +5102,11 @@ class CfnEventSourceMapping(
             database_name: typing.Optional[builtins.str] = None,
             full_document: typing.Optional[builtins.str] = None,
         ) -> None:
-            '''Specific configuration settings for a DocumentDB event source.
+            '''Document db event source config.
 
-            :param collection_name: The name of the collection to consume within the database. If you do not specify a collection, Lambda consumes all collections.
-            :param database_name: The name of the database to consume within the DocumentDB cluster.
-            :param full_document: Determines what DocumentDB sends to your event stream during document update operations. If set to UpdateLookup, DocumentDB sends a delta describing the changes, along with a copy of the entire document. Otherwise, DocumentDB sends only a partial document that contains the changes.
+            :param collection_name: The collection name to connect to.
+            :param database_name: The database name to connect to.
+            :param full_document: Include full document in change stream response. The default option will only send the changes made to documents to Lambda. If you want the complete document sent to Lambda, set this to UpdateLookup.
 
             :see: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-lambda-eventsourcemapping-documentdbeventsourceconfig.html
             :exampleMetadata: fixture=_generated
@@ -5066,9 +5138,7 @@ class CfnEventSourceMapping(
 
         @builtins.property
         def collection_name(self) -> typing.Optional[builtins.str]:
-            '''The name of the collection to consume within the database.
-
-            If you do not specify a collection, Lambda consumes all collections.
+            '''The collection name to connect to.
 
             :see: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-lambda-eventsourcemapping-documentdbeventsourceconfig.html#cfn-lambda-eventsourcemapping-documentdbeventsourceconfig-collectionname
             '''
@@ -5077,7 +5147,7 @@ class CfnEventSourceMapping(
 
         @builtins.property
         def database_name(self) -> typing.Optional[builtins.str]:
-            '''The name of the database to consume within the DocumentDB cluster.
+            '''The database name to connect to.
 
             :see: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-lambda-eventsourcemapping-documentdbeventsourceconfig.html#cfn-lambda-eventsourcemapping-documentdbeventsourceconfig-databasename
             '''
@@ -5086,9 +5156,9 @@ class CfnEventSourceMapping(
 
         @builtins.property
         def full_document(self) -> typing.Optional[builtins.str]:
-            '''Determines what DocumentDB sends to your event stream during document update operations.
+            '''Include full document in change stream response.
 
-            If set to UpdateLookup, DocumentDB sends a delta describing the changes, along with a copy of the entire document. Otherwise, DocumentDB sends only a partial document that contains the changes.
+            The default option will only send the changes made to documents to Lambda. If you want the complete document sent to Lambda, set this to UpdateLookup.
 
             :see: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-lambda-eventsourcemapping-documentdbeventsourceconfig.html#cfn-lambda-eventsourcemapping-documentdbeventsourceconfig-fulldocument
             '''
@@ -5117,9 +5187,9 @@ class CfnEventSourceMapping(
             *,
             kafka_bootstrap_servers: typing.Optional[typing.Sequence[builtins.str]] = None,
         ) -> None:
-            '''The list of bootstrap servers for your Kafka brokers in the following format: ``"KafkaBootstrapServers": ["abc.xyz.com:xxxx","abc2.xyz.com:xxxx"]`` .
+            '''The endpoints used by AWS Lambda to access a self-managed event source.
 
-            :param kafka_bootstrap_servers: The list of bootstrap servers for your Kafka brokers in the following format: ``"KafkaBootstrapServers": ["abc.xyz.com:xxxx","abc2.xyz.com:xxxx"]`` .
+            :param kafka_bootstrap_servers: A list of Kafka server endpoints.
 
             :see: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-lambda-eventsourcemapping-endpoints.html
             :exampleMetadata: fixture=_generated
@@ -5143,7 +5213,7 @@ class CfnEventSourceMapping(
 
         @builtins.property
         def kafka_bootstrap_servers(self) -> typing.Optional[typing.List[builtins.str]]:
-            '''The list of bootstrap servers for your Kafka brokers in the following format: ``"KafkaBootstrapServers": ["abc.xyz.com:xxxx","abc2.xyz.com:xxxx"]`` .
+            '''A list of Kafka server endpoints.
 
             :see: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-lambda-eventsourcemapping-endpoints.html#cfn-lambda-eventsourcemapping-endpoints-kafkabootstrapservers
             '''
@@ -5172,9 +5242,9 @@ class CfnEventSourceMapping(
             *,
             filters: typing.Optional[typing.Union[_IResolvable_da3f097b, typing.Sequence[typing.Union[_IResolvable_da3f097b, typing.Union["CfnEventSourceMapping.FilterProperty", typing.Dict[builtins.str, typing.Any]]]]]] = None,
         ) -> None:
-            '''An object that contains the filters for an event source.
+            '''The filter criteria to control event filtering.
 
-            :param filters: A list of filters.
+            :param filters: List of filters of this FilterCriteria.
 
             :see: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-lambda-eventsourcemapping-filtercriteria.html
             :exampleMetadata: fixture=_generated
@@ -5202,7 +5272,7 @@ class CfnEventSourceMapping(
         def filters(
             self,
         ) -> typing.Optional[typing.Union[_IResolvable_da3f097b, typing.List[typing.Union[_IResolvable_da3f097b, "CfnEventSourceMapping.FilterProperty"]]]]:
-            '''A list of filters.
+            '''List of filters of this FilterCriteria.
 
             :see: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-lambda-eventsourcemapping-filtercriteria.html#cfn-lambda-eventsourcemapping-filtercriteria-filters
             '''
@@ -5227,9 +5297,9 @@ class CfnEventSourceMapping(
     )
     class FilterProperty:
         def __init__(self, *, pattern: typing.Optional[builtins.str] = None) -> None:
-            '''A structure within a ``FilterCriteria`` object that defines an event filtering pattern.
+            '''The filter object that defines parameters for ESM filtering.
 
-            :param pattern: A filter pattern. For more information on the syntax of a filter pattern, see `Filter rule syntax <https://docs.aws.amazon.com/lambda/latest/dg/invocation-eventfiltering.html#filtering-syntax>`_ .
+            :param pattern: The filter pattern that defines which events should be passed for invocations.
 
             :see: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-lambda-eventsourcemapping-filter.html
             :exampleMetadata: fixture=_generated
@@ -5253,9 +5323,7 @@ class CfnEventSourceMapping(
 
         @builtins.property
         def pattern(self) -> typing.Optional[builtins.str]:
-            '''A filter pattern.
-
-            For more information on the syntax of a filter pattern, see `Filter rule syntax <https://docs.aws.amazon.com/lambda/latest/dg/invocation-eventfiltering.html#filtering-syntax>`_ .
+            '''The filter pattern that defines which events should be passed for invocations.
 
             :see: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-lambda-eventsourcemapping-filter.html#cfn-lambda-eventsourcemapping-filter-pattern
             '''
@@ -5284,9 +5352,9 @@ class CfnEventSourceMapping(
             *,
             destination: typing.Optional[builtins.str] = None,
         ) -> None:
-            '''A destination for events that failed processing.
+            '''A destination for records of invocations that failed processing.
 
-            :param destination: The Amazon Resource Name (ARN) of the destination resource. To retain records of `asynchronous invocations <https://docs.aws.amazon.com/lambda/latest/dg/invocation-async.html#invocation-async-destinations>`_ , you can configure an Amazon SNS topic, Amazon SQS queue, Lambda function, or Amazon EventBridge event bus as the destination. To retain records of failed invocations from `Kinesis and DynamoDB event sources <https://docs.aws.amazon.com/lambda/latest/dg/invocation-eventsourcemapping.html#event-source-mapping-destinations>`_ , you can configure an Amazon SNS topic or Amazon SQS queue as the destination. To retain records of failed invocations from `self-managed Kafka <https://docs.aws.amazon.com/lambda/latest/dg/with-kafka.html#services-smaa-onfailure-destination>`_ or `Amazon MSK <https://docs.aws.amazon.com/lambda/latest/dg/with-msk.html#services-msk-onfailure-destination>`_ , you can configure an Amazon SNS topic, Amazon SQS queue, or Amazon S3 bucket as the destination.
+            :param destination: The Amazon Resource Name (ARN) of the destination resource.
 
             :see: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-lambda-eventsourcemapping-onfailure.html
             :exampleMetadata: fixture=_generated
@@ -5312,12 +5380,6 @@ class CfnEventSourceMapping(
         def destination(self) -> typing.Optional[builtins.str]:
             '''The Amazon Resource Name (ARN) of the destination resource.
 
-            To retain records of `asynchronous invocations <https://docs.aws.amazon.com/lambda/latest/dg/invocation-async.html#invocation-async-destinations>`_ , you can configure an Amazon SNS topic, Amazon SQS queue, Lambda function, or Amazon EventBridge event bus as the destination.
-
-            To retain records of failed invocations from `Kinesis and DynamoDB event sources <https://docs.aws.amazon.com/lambda/latest/dg/invocation-eventsourcemapping.html#event-source-mapping-destinations>`_ , you can configure an Amazon SNS topic or Amazon SQS queue as the destination.
-
-            To retain records of failed invocations from `self-managed Kafka <https://docs.aws.amazon.com/lambda/latest/dg/with-kafka.html#services-smaa-onfailure-destination>`_ or `Amazon MSK <https://docs.aws.amazon.com/lambda/latest/dg/with-msk.html#services-msk-onfailure-destination>`_ , you can configure an Amazon SNS topic, Amazon SQS queue, or Amazon S3 bucket as the destination.
-
             :see: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-lambda-eventsourcemapping-onfailure.html#cfn-lambda-eventsourcemapping-onfailure-destination
             '''
             result = self._values.get("destination")
@@ -5345,11 +5407,9 @@ class CfnEventSourceMapping(
             *,
             maximum_concurrency: typing.Optional[jsii.Number] = None,
         ) -> None:
-            '''(Amazon SQS only) The scaling configuration for the event source.
-
-            To remove the configuration, pass an empty value.
+            '''The scaling configuration for the event source.
 
-            :param maximum_concurrency: Limits the number of concurrent instances that the Amazon SQS event source can invoke.
+            :param maximum_concurrency: The maximum number of concurrent functions that an event source can invoke.
 
             :see: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-lambda-eventsourcemapping-scalingconfig.html
             :exampleMetadata: fixture=_generated
@@ -5373,7 +5433,7 @@ class CfnEventSourceMapping(
 
         @builtins.property
         def maximum_concurrency(self) -> typing.Optional[jsii.Number]:
-            '''Limits the number of concurrent instances that the Amazon SQS event source can invoke.
+            '''The maximum number of concurrent functions that an event source can invoke.
 
             :see: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-lambda-eventsourcemapping-scalingconfig.html#cfn-lambda-eventsourcemapping-scalingconfig-maximumconcurrency
             '''
@@ -5402,9 +5462,9 @@ class CfnEventSourceMapping(
             *,
             endpoints: typing.Optional[typing.Union[_IResolvable_da3f097b, typing.Union["CfnEventSourceMapping.EndpointsProperty", typing.Dict[builtins.str, typing.Any]]]] = None,
         ) -> None:
-            '''The self-managed Apache Kafka cluster for your event source.
+            '''The configuration used by AWS Lambda to access a self-managed event source.
 
-            :param endpoints: The list of bootstrap servers for your Kafka brokers in the following format: ``"KafkaBootstrapServers": ["abc.xyz.com:xxxx","abc2.xyz.com:xxxx"]`` .
+            :param endpoints: The endpoints used by AWS Lambda to access a self-managed event source.
 
             :see: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-lambda-eventsourcemapping-selfmanagedeventsource.html
             :exampleMetadata: fixture=_generated
@@ -5432,7 +5492,7 @@ class CfnEventSourceMapping(
         def endpoints(
             self,
         ) -> typing.Optional[typing.Union[_IResolvable_da3f097b, "CfnEventSourceMapping.EndpointsProperty"]]:
-            '''The list of bootstrap servers for your Kafka brokers in the following format: ``"KafkaBootstrapServers": ["abc.xyz.com:xxxx","abc2.xyz.com:xxxx"]`` .
+            '''The endpoints used by AWS Lambda to access a self-managed event source.
 
             :see: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-lambda-eventsourcemapping-selfmanagedeventsource.html#cfn-lambda-eventsourcemapping-selfmanagedeventsource-endpoints
             '''
@@ -5461,9 +5521,9 @@ class CfnEventSourceMapping(
             *,
             consumer_group_id: typing.Optional[builtins.str] = None,
         ) -> None:
-            '''Specific configuration settings for a self-managed Apache Kafka event source.
+            '''Specific configuration settings for a Self-Managed Apache Kafka event source.
 
-            :param consumer_group_id: The identifier for the Kafka consumer group to join. The consumer group ID must be unique among all your Kafka event sources. After creating a Kafka event source mapping with the consumer group ID specified, you cannot update this value. For more information, see `Customizable consumer group ID <https://docs.aws.amazon.com/lambda/latest/dg/with-msk.html#services-msk-consumer-group-id>`_ .
+            :param consumer_group_id: The identifier for the Kafka Consumer Group to join.
 
             :see: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-lambda-eventsourcemapping-selfmanagedkafkaeventsourceconfig.html
             :exampleMetadata: fixture=_generated
@@ -5487,9 +5547,7 @@ class CfnEventSourceMapping(
 
         @builtins.property
         def consumer_group_id(self) -> typing.Optional[builtins.str]:
-            '''The identifier for the Kafka consumer group to join.
-
-            The consumer group ID must be unique among all your Kafka event sources. After creating a Kafka event source mapping with the consumer group ID specified, you cannot update this value. For more information, see `Customizable consumer group ID <https://docs.aws.amazon.com/lambda/latest/dg/with-msk.html#services-msk-consumer-group-id>`_ .
+            '''The identifier for the Kafka Consumer Group to join.
 
             :see: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-lambda-eventsourcemapping-selfmanagedkafkaeventsourceconfig.html#cfn-lambda-eventsourcemapping-selfmanagedkafkaeventsourceconfig-consumergroupid
             '''
@@ -5519,10 +5577,10 @@ class CfnEventSourceMapping(
             type: typing.Optional[builtins.str] = None,
             uri: typing.Optional[builtins.str] = None,
         ) -> None:
-            '''An array of the authentication protocol, VPC components, or virtual host to secure and define your event source.
+            '''The configuration used by AWS Lambda to access event source.
 
-            :param type: The type of authentication protocol, VPC components, or virtual host for your event source. For example: ``"Type":"SASL_SCRAM_512_AUTH"`` . - ``BASIC_AUTH`` – (Amazon MQ) The AWS Secrets Manager secret that stores your broker credentials. - ``BASIC_AUTH`` – (Self-managed Apache Kafka) The Secrets Manager ARN of your secret key used for SASL/PLAIN authentication of your Apache Kafka brokers. - ``VPC_SUBNET`` – (Self-managed Apache Kafka) The subnets associated with your VPC. Lambda connects to these subnets to fetch data from your self-managed Apache Kafka cluster. - ``VPC_SECURITY_GROUP`` – (Self-managed Apache Kafka) The VPC security group used to manage access to your self-managed Apache Kafka brokers. - ``SASL_SCRAM_256_AUTH`` – (Self-managed Apache Kafka) The Secrets Manager ARN of your secret key used for SASL SCRAM-256 authentication of your self-managed Apache Kafka brokers. - ``SASL_SCRAM_512_AUTH`` – (Amazon MSK, Self-managed Apache Kafka) The Secrets Manager ARN of your secret key used for SASL SCRAM-512 authentication of your self-managed Apache Kafka brokers. - ``VIRTUAL_HOST`` –- (RabbitMQ) The name of the virtual host in your RabbitMQ broker. Lambda uses this RabbitMQ host as the event source. This property cannot be specified in an UpdateEventSourceMapping API call. - ``CLIENT_CERTIFICATE_TLS_AUTH`` – (Amazon MSK, self-managed Apache Kafka) The Secrets Manager ARN of your secret key containing the certificate chain (X.509 PEM), private key (PKCS#8 PEM), and private key password (optional) used for mutual TLS authentication of your MSK/Apache Kafka brokers. - ``SERVER_ROOT_CA_CERTIFICATE`` – (Self-managed Apache Kafka) The Secrets Manager ARN of your secret key containing the root CA certificate (X.509 PEM) used for TLS encryption of your Apache Kafka brokers.
-            :param uri: The value for your chosen configuration in ``Type`` . For example: ``"URI": "arn:aws:secretsmanager:us-east-1:01234567890:secret:MyBrokerSecretName"`` .
+            :param type: The type of source access configuration.
+            :param uri: The URI for the source access configuration resource.
 
             :see: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-lambda-eventsourcemapping-sourceaccessconfiguration.html
             :exampleMetadata: fixture=_generated
@@ -5550,17 +5608,7 @@ class CfnEventSourceMapping(
 
         @builtins.property
         def type(self) -> typing.Optional[builtins.str]:
-            '''The type of authentication protocol, VPC components, or virtual host for your event source. For example: ``"Type":"SASL_SCRAM_512_AUTH"`` .
-
-            - ``BASIC_AUTH`` – (Amazon MQ) The AWS Secrets Manager secret that stores your broker credentials.
-            - ``BASIC_AUTH`` – (Self-managed Apache Kafka) The Secrets Manager ARN of your secret key used for SASL/PLAIN authentication of your Apache Kafka brokers.
-            - ``VPC_SUBNET`` – (Self-managed Apache Kafka) The subnets associated with your VPC. Lambda connects to these subnets to fetch data from your self-managed Apache Kafka cluster.
-            - ``VPC_SECURITY_GROUP`` – (Self-managed Apache Kafka) The VPC security group used to manage access to your self-managed Apache Kafka brokers.
-            - ``SASL_SCRAM_256_AUTH`` – (Self-managed Apache Kafka) The Secrets Manager ARN of your secret key used for SASL SCRAM-256 authentication of your self-managed Apache Kafka brokers.
-            - ``SASL_SCRAM_512_AUTH`` – (Amazon MSK, Self-managed Apache Kafka) The Secrets Manager ARN of your secret key used for SASL SCRAM-512 authentication of your self-managed Apache Kafka brokers.
-            - ``VIRTUAL_HOST`` –- (RabbitMQ) The name of the virtual host in your RabbitMQ broker. Lambda uses this RabbitMQ host as the event source. This property cannot be specified in an UpdateEventSourceMapping API call.
-            - ``CLIENT_CERTIFICATE_TLS_AUTH`` – (Amazon MSK, self-managed Apache Kafka) The Secrets Manager ARN of your secret key containing the certificate chain (X.509 PEM), private key (PKCS#8 PEM), and private key password (optional) used for mutual TLS authentication of your MSK/Apache Kafka brokers.
-            - ``SERVER_ROOT_CA_CERTIFICATE`` – (Self-managed Apache Kafka) The Secrets Manager ARN of your secret key containing the root CA certificate (X.509 PEM) used for TLS encryption of your Apache Kafka brokers.
+            '''The type of source access configuration.
 
             :see: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-lambda-eventsourcemapping-sourceaccessconfiguration.html#cfn-lambda-eventsourcemapping-sourceaccessconfiguration-type
             '''
@@ -5569,9 +5617,7 @@ class CfnEventSourceMapping(
 
         @builtins.property
         def uri(self) -> typing.Optional[builtins.str]:
-            '''The value for your chosen configuration in ``Type`` .
-
-            For example: ``"URI": "arn:aws:secretsmanager:us-east-1:01234567890:secret:MyBrokerSecretName"`` .
+            '''The URI for the source access configuration resource.
 
             :see: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-lambda-eventsourcemapping-sourceaccessconfiguration.html#cfn-lambda-eventsourcemapping-sourceaccessconfiguration-uri
             '''
@@ -5604,6 +5650,7 @@ class CfnEventSourceMapping(
         "event_source_arn": "eventSourceArn",
         "filter_criteria": "filterCriteria",
         "function_response_types": "functionResponseTypes",
+        "kms_key_arn": "kmsKeyArn",
         "maximum_batching_window_in_seconds": "maximumBatchingWindowInSeconds",
         "maximum_record_age_in_seconds": "maximumRecordAgeInSeconds",
         "maximum_retry_attempts": "maximumRetryAttempts",
@@ -5633,6 +5680,7 @@ class CfnEventSourceMappingProps:
         event_source_arn: typing.Optional[builtins.str] = None,
         filter_criteria: typing.Optional[typing.Union[_IResolvable_da3f097b, typing.Union[CfnEventSourceMapping.FilterCriteriaProperty, typing.Dict[builtins.str, typing.Any]]]] = None,
         function_response_types: typing.Optional[typing.Sequence[builtins.str]] = None,
+        kms_key_arn: typing.Optional[builtins.str] = None,
         maximum_batching_window_in_seconds: typing.Optional[jsii.Number] = None,
         maximum_record_age_in_seconds: typing.Optional[jsii.Number] = None,
         maximum_retry_attempts: typing.Optional[jsii.Number] = None,
@@ -5649,29 +5697,30 @@ class CfnEventSourceMappingProps:
     ) -> None:
         '''Properties for defining a ``CfnEventSourceMapping``.
 
-        :param function_name: The name or ARN of the Lambda function. **Name formats** - *Function name* – ``MyFunction`` . - *Function ARN* – ``arn:aws:lambda:us-west-2:123456789012:function:MyFunction`` . - *Version or Alias ARN* – ``arn:aws:lambda:us-west-2:123456789012:function:MyFunction:PROD`` . - *Partial ARN* – ``123456789012:function:MyFunction`` . The length constraint applies only to the full ARN. If you specify only the function name, it's limited to 64 characters in length.
-        :param amazon_managed_kafka_event_source_config: Specific configuration settings for an Amazon Managed Streaming for Apache Kafka (Amazon MSK) event source.
-        :param batch_size: The maximum number of records in each batch that Lambda pulls from your stream or queue and sends to your function. Lambda passes all of the records in the batch to the function in a single call, up to the payload limit for synchronous invocation (6 MB). - *Amazon Kinesis* – Default 100. Max 10,000. - *Amazon DynamoDB Streams* – Default 100. Max 10,000. - *Amazon Simple Queue Service* – Default 10. For standard queues the max is 10,000. For FIFO queues the max is 10. - *Amazon Managed Streaming for Apache Kafka* – Default 100. Max 10,000. - *Self-managed Apache Kafka* – Default 100. Max 10,000. - *Amazon MQ (ActiveMQ and RabbitMQ)* – Default 100. Max 10,000. - *DocumentDB* – Default 100. Max 10,000.
-        :param bisect_batch_on_function_error: (Kinesis and DynamoDB Streams only) If the function returns an error, split the batch in two and retry. The default value is false.
-        :param destination_config: (Kinesis, DynamoDB Streams, Amazon MSK, and self-managed Apache Kafka event sources only) A configuration object that specifies the destination of an event after Lambda processes it.
-        :param document_db_event_source_config: Specific configuration settings for a DocumentDB event source.
-        :param enabled: When true, the event source mapping is active. When false, Lambda pauses polling and invocation. Default: True
-        :param event_source_arn: The Amazon Resource Name (ARN) of the event source. - *Amazon Kinesis* – The ARN of the data stream or a stream consumer. - *Amazon DynamoDB Streams* – The ARN of the stream. - *Amazon Simple Queue Service* – The ARN of the queue. - *Amazon Managed Streaming for Apache Kafka* – The ARN of the cluster or the ARN of the VPC connection (for `cross-account event source mappings <https://docs.aws.amazon.com/lambda/latest/dg/with-msk.html#msk-multi-vpc>`_ ). - *Amazon MQ* – The ARN of the broker. - *Amazon DocumentDB* – The ARN of the DocumentDB change stream.
-        :param filter_criteria: An object that defines the filter criteria that determine whether Lambda should process an event. For more information, see `Lambda event filtering <https://docs.aws.amazon.com/lambda/latest/dg/invocation-eventfiltering.html>`_ .
-        :param function_response_types: (Streams and SQS) A list of current response type enums applied to the event source mapping. Valid Values: ``ReportBatchItemFailures``
-        :param maximum_batching_window_in_seconds: The maximum amount of time, in seconds, that Lambda spends gathering records before invoking the function. *Default ( Kinesis , DynamoDB , Amazon SQS event sources)* : 0 *Default ( Amazon MSK , Kafka, Amazon MQ , Amazon DocumentDB event sources)* : 500 ms *Related setting:* For Amazon SQS event sources, when you set ``BatchSize`` to a value greater than 10, you must set ``MaximumBatchingWindowInSeconds`` to at least 1.
-        :param maximum_record_age_in_seconds: (Kinesis and DynamoDB Streams only) Discard records older than the specified age. The default value is -1, which sets the maximum age to infinite. When the value is set to infinite, Lambda never discards old records. .. epigraph:: The minimum valid value for maximum record age is 60s. Although values less than 60 and greater than -1 fall within the parameter's absolute range, they are not allowed
-        :param maximum_retry_attempts: (Kinesis and DynamoDB Streams only) Discard records after the specified number of retries. The default value is -1, which sets the maximum number of retries to infinite. When MaximumRetryAttempts is infinite, Lambda retries failed records until the record expires in the event source.
-        :param parallelization_factor: (Kinesis and DynamoDB Streams only) The number of batches to process concurrently from each shard. The default value is 1.
-        :param queues: (Amazon MQ) The name of the Amazon MQ broker destination queue to consume.
-        :param scaling_config: (Amazon SQS only) The scaling configuration for the event source. For more information, see `Configuring maximum concurrency for Amazon SQS event sources <https://docs.aws.amazon.com/lambda/latest/dg/with-sqs.html#events-sqs-max-concurrency>`_ .
-        :param self_managed_event_source: The self-managed Apache Kafka cluster for your event source.
-        :param self_managed_kafka_event_source_config: Specific configuration settings for a self-managed Apache Kafka event source.
-        :param source_access_configurations: An array of the authentication protocol, VPC components, or virtual host to secure and define your event source.
-        :param starting_position: The position in a stream from which to start reading. Required for Amazon Kinesis and Amazon DynamoDB. - *LATEST* - Read only new records. - *TRIM_HORIZON* - Process all available records. - *AT_TIMESTAMP* - Specify a time from which to start reading records.
-        :param starting_position_timestamp: With ``StartingPosition`` set to ``AT_TIMESTAMP`` , the time from which to start reading, in Unix time seconds. ``StartingPositionTimestamp`` cannot be in the future.
-        :param topics: The name of the Kafka topic.
-        :param tumbling_window_in_seconds: (Kinesis and DynamoDB Streams only) The duration in seconds of a processing window for DynamoDB and Kinesis Streams event sources. A value of 0 seconds indicates no tumbling window.
+        :param function_name: The name of the Lambda function.
+        :param amazon_managed_kafka_event_source_config: Specific configuration settings for an MSK event source.
+        :param batch_size: The maximum number of items to retrieve in a single batch.
+        :param bisect_batch_on_function_error: (Streams) If the function returns an error, split the batch in two and retry.
+        :param destination_config: A configuration object that specifies the destination of an event after Lambda processes it.
+        :param document_db_event_source_config: Document db event source config.
+        :param enabled: Disables the event source mapping to pause polling and invocation.
+        :param event_source_arn: The Amazon Resource Name (ARN) of the event source.
+        :param filter_criteria: The filter criteria to control event filtering.
+        :param function_response_types: (Streams) A list of response types supported by the function.
+        :param kms_key_arn: The Amazon Resource Name (ARN) of the KMS key.
+        :param maximum_batching_window_in_seconds: (Streams) The maximum amount of time to gather records before invoking the function, in seconds.
+        :param maximum_record_age_in_seconds: (Streams) The maximum age of a record that Lambda sends to a function for processing.
+        :param maximum_retry_attempts: (Streams) The maximum number of times to retry when the function returns an error.
+        :param parallelization_factor: (Streams) The number of batches to process from each shard concurrently.
+        :param queues: (ActiveMQ) A list of ActiveMQ queues.
+        :param scaling_config: The scaling configuration for the event source.
+        :param self_managed_event_source: The configuration used by AWS Lambda to access a self-managed event source.
+        :param self_managed_kafka_event_source_config: Specific configuration settings for a Self-Managed Apache Kafka event source.
+        :param source_access_configurations: A list of SourceAccessConfiguration.
+        :param starting_position: The position in a stream from which to start reading. Required for Amazon Kinesis and Amazon DynamoDB Streams sources.
+        :param starting_position_timestamp: With StartingPosition set to AT_TIMESTAMP, the time from which to start reading, in Unix time seconds.
+        :param topics: (Kafka) A list of Kafka topics.
+        :param tumbling_window_in_seconds: (Streams) Tumbling window (non-overlapping time window) duration to perform aggregations.
 
         :see: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-lambda-eventsourcemapping.html
         :exampleMetadata: fixture=_generated
@@ -5709,6 +5758,7 @@ class CfnEventSourceMappingProps:
                     )]
                 ),
                 function_response_types=["functionResponseTypes"],
+                kms_key_arn="kmsKeyArn",
                 maximum_batching_window_in_seconds=123,
                 maximum_record_age_in_seconds=123,
                 maximum_retry_attempts=123,
@@ -5747,6 +5797,7 @@ class CfnEventSourceMappingProps:
             check_type(argname="argument event_source_arn", value=event_source_arn, expected_type=type_hints["event_source_arn"])
             check_type(argname="argument filter_criteria", value=filter_criteria, expected_type=type_hints["filter_criteria"])
             check_type(argname="argument function_response_types", value=function_response_types, expected_type=type_hints["function_response_types"])
+            check_type(argname="argument kms_key_arn", value=kms_key_arn, expected_type=type_hints["kms_key_arn"])
             check_type(argname="argument maximum_batching_window_in_seconds", value=maximum_batching_window_in_seconds, expected_type=type_hints["maximum_batching_window_in_seconds"])
             check_type(argname="argument maximum_record_age_in_seconds", value=maximum_record_age_in_seconds, expected_type=type_hints["maximum_record_age_in_seconds"])
             check_type(argname="argument maximum_retry_attempts", value=maximum_retry_attempts, expected_type=type_hints["maximum_retry_attempts"])
@@ -5781,6 +5832,8 @@ class CfnEventSourceMappingProps:
             self._values["filter_criteria"] = filter_criteria
         if function_response_types is not None:
             self._values["function_response_types"] = function_response_types
+        if kms_key_arn is not None:
+            self._values["kms_key_arn"] = kms_key_arn
         if maximum_batching_window_in_seconds is not None:
             self._values["maximum_batching_window_in_seconds"] = maximum_batching_window_in_seconds
         if maximum_record_age_in_seconds is not None:
@@ -5810,15 +5863,7 @@ class CfnEventSourceMappingProps:
 
     @builtins.property
     def function_name(self) -> builtins.str:
-        '''The name or ARN of the Lambda function.
-
-        **Name formats** - *Function name* – ``MyFunction`` .
-
-        - *Function ARN* – ``arn:aws:lambda:us-west-2:123456789012:function:MyFunction`` .
-        - *Version or Alias ARN* – ``arn:aws:lambda:us-west-2:123456789012:function:MyFunction:PROD`` .
-        - *Partial ARN* – ``123456789012:function:MyFunction`` .
-
-        The length constraint applies only to the full ARN. If you specify only the function name, it's limited to 64 characters in length.
+        '''The name of the Lambda function.
 
         :see: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-lambda-eventsourcemapping.html#cfn-lambda-eventsourcemapping-functionname
         '''
@@ -5830,7 +5875,7 @@ class CfnEventSourceMappingProps:
     def amazon_managed_kafka_event_source_config(
         self,
     ) -> typing.Optional[typing.Union[_IResolvable_da3f097b, CfnEventSourceMapping.AmazonManagedKafkaEventSourceConfigProperty]]:
-        '''Specific configuration settings for an Amazon Managed Streaming for Apache Kafka (Amazon MSK) event source.
+        '''Specific configuration settings for an MSK event source.
 
         :see: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-lambda-eventsourcemapping.html#cfn-lambda-eventsourcemapping-amazonmanagedkafkaeventsourceconfig
         '''
@@ -5839,17 +5884,7 @@ class CfnEventSourceMappingProps:
 
     @builtins.property
     def batch_size(self) -> typing.Optional[jsii.Number]:
-        '''The maximum number of records in each batch that Lambda pulls from your stream or queue and sends to your function.
-
-        Lambda passes all of the records in the batch to the function in a single call, up to the payload limit for synchronous invocation (6 MB).
-
-        - *Amazon Kinesis* – Default 100. Max 10,000.
-        - *Amazon DynamoDB Streams* – Default 100. Max 10,000.
-        - *Amazon Simple Queue Service* – Default 10. For standard queues the max is 10,000. For FIFO queues the max is 10.
-        - *Amazon Managed Streaming for Apache Kafka* – Default 100. Max 10,000.
-        - *Self-managed Apache Kafka* – Default 100. Max 10,000.
-        - *Amazon MQ (ActiveMQ and RabbitMQ)* – Default 100. Max 10,000.
-        - *DocumentDB* – Default 100. Max 10,000.
+        '''The maximum number of items to retrieve in a single batch.
 
         :see: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-lambda-eventsourcemapping.html#cfn-lambda-eventsourcemapping-batchsize
         '''
@@ -5860,9 +5895,7 @@ class CfnEventSourceMappingProps:
     def bisect_batch_on_function_error(
         self,
     ) -> typing.Optional[typing.Union[builtins.bool, _IResolvable_da3f097b]]:
-        '''(Kinesis and DynamoDB Streams only) If the function returns an error, split the batch in two and retry.
-
-        The default value is false.
+        '''(Streams) If the function returns an error, split the batch in two and retry.
 
         :see: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-lambda-eventsourcemapping.html#cfn-lambda-eventsourcemapping-bisectbatchonfunctionerror
         '''
@@ -5873,7 +5906,7 @@ class CfnEventSourceMappingProps:
     def destination_config(
         self,
     ) -> typing.Optional[typing.Union[_IResolvable_da3f097b, CfnEventSourceMapping.DestinationConfigProperty]]:
-        '''(Kinesis, DynamoDB Streams, Amazon MSK, and self-managed Apache Kafka event sources only) A configuration object that specifies the destination of an event after Lambda processes it.
+        '''A configuration object that specifies the destination of an event after Lambda processes it.
 
         :see: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-lambda-eventsourcemapping.html#cfn-lambda-eventsourcemapping-destinationconfig
         '''
@@ -5884,7 +5917,7 @@ class CfnEventSourceMappingProps:
     def document_db_event_source_config(
         self,
     ) -> typing.Optional[typing.Union[_IResolvable_da3f097b, CfnEventSourceMapping.DocumentDBEventSourceConfigProperty]]:
-        '''Specific configuration settings for a DocumentDB event source.
+        '''Document db event source config.
 
         :see: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-lambda-eventsourcemapping.html#cfn-lambda-eventsourcemapping-documentdbeventsourceconfig
         '''
@@ -5895,9 +5928,7 @@ class CfnEventSourceMappingProps:
     def enabled(
         self,
     ) -> typing.Optional[typing.Union[builtins.bool, _IResolvable_da3f097b]]:
-        '''When true, the event source mapping is active. When false, Lambda pauses polling and invocation.
-
-        Default: True
+        '''Disables the event source mapping to pause polling and invocation.
 
         :see: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-lambda-eventsourcemapping.html#cfn-lambda-eventsourcemapping-enabled
         '''
@@ -5908,13 +5939,6 @@ class CfnEventSourceMappingProps:
     def event_source_arn(self) -> typing.Optional[builtins.str]:
         '''The Amazon Resource Name (ARN) of the event source.
 
-        - *Amazon Kinesis* – The ARN of the data stream or a stream consumer.
-        - *Amazon DynamoDB Streams* – The ARN of the stream.
-        - *Amazon Simple Queue Service* – The ARN of the queue.
-        - *Amazon Managed Streaming for Apache Kafka* – The ARN of the cluster or the ARN of the VPC connection (for `cross-account event source mappings <https://docs.aws.amazon.com/lambda/latest/dg/with-msk.html#msk-multi-vpc>`_ ).
-        - *Amazon MQ* – The ARN of the broker.
-        - *Amazon DocumentDB* – The ARN of the DocumentDB change stream.
-
         :see: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-lambda-eventsourcemapping.html#cfn-lambda-eventsourcemapping-eventsourcearn
         '''
         result = self._values.get("event_source_arn")
@@ -5924,9 +5948,7 @@ class CfnEventSourceMappingProps:
     def filter_criteria(
         self,
     ) -> typing.Optional[typing.Union[_IResolvable_da3f097b, CfnEventSourceMapping.FilterCriteriaProperty]]:
-        '''An object that defines the filter criteria that determine whether Lambda should process an event.
-
-        For more information, see `Lambda event filtering <https://docs.aws.amazon.com/lambda/latest/dg/invocation-eventfiltering.html>`_ .
+        '''The filter criteria to control event filtering.
 
         :see: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-lambda-eventsourcemapping.html#cfn-lambda-eventsourcemapping-filtercriteria
         '''
@@ -5935,9 +5957,7 @@ class CfnEventSourceMappingProps:
 
     @builtins.property
     def function_response_types(self) -> typing.Optional[typing.List[builtins.str]]:
-        '''(Streams and SQS) A list of current response type enums applied to the event source mapping.
-
-        Valid Values: ``ReportBatchItemFailures``
+        '''(Streams) A list of response types supported by the function.
 
         :see: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-lambda-eventsourcemapping.html#cfn-lambda-eventsourcemapping-functionresponsetypes
         '''
@@ -5945,14 +5965,17 @@ class CfnEventSourceMappingProps:
         return typing.cast(typing.Optional[typing.List[builtins.str]], result)
 
     @builtins.property
-    def maximum_batching_window_in_seconds(self) -> typing.Optional[jsii.Number]:
-        '''The maximum amount of time, in seconds, that Lambda spends gathering records before invoking the function.
-
-        *Default ( Kinesis , DynamoDB , Amazon SQS event sources)* : 0
+    def kms_key_arn(self) -> typing.Optional[builtins.str]:
+        '''The Amazon Resource Name (ARN) of the KMS key.
 
-        *Default ( Amazon MSK , Kafka, Amazon MQ , Amazon DocumentDB event sources)* : 500 ms
+        :see: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-lambda-eventsourcemapping.html#cfn-lambda-eventsourcemapping-kmskeyarn
+        '''
+        result = self._values.get("kms_key_arn")
+        return typing.cast(typing.Optional[builtins.str], result)
 
-        *Related setting:* For Amazon SQS event sources, when you set ``BatchSize`` to a value greater than 10, you must set ``MaximumBatchingWindowInSeconds`` to at least 1.
+    @builtins.property
+    def maximum_batching_window_in_seconds(self) -> typing.Optional[jsii.Number]:
+        '''(Streams) The maximum amount of time to gather records before invoking the function, in seconds.
 
         :see: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-lambda-eventsourcemapping.html#cfn-lambda-eventsourcemapping-maximumbatchingwindowinseconds
         '''
@@ -5961,13 +5984,7 @@ class CfnEventSourceMappingProps:
 
     @builtins.property
     def maximum_record_age_in_seconds(self) -> typing.Optional[jsii.Number]:
-        '''(Kinesis and DynamoDB Streams only) Discard records older than the specified age.
-
-        The default value is -1,
-        which sets the maximum age to infinite. When the value is set to infinite, Lambda never discards old records.
-        .. epigraph::
-
-           The minimum valid value for maximum record age is 60s. Although values less than 60 and greater than -1 fall within the parameter's absolute range, they are not allowed
+        '''(Streams) The maximum age of a record that Lambda sends to a function for processing.
 
         :see: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-lambda-eventsourcemapping.html#cfn-lambda-eventsourcemapping-maximumrecordageinseconds
         '''
@@ -5976,10 +5993,7 @@ class CfnEventSourceMappingProps:
 
     @builtins.property
     def maximum_retry_attempts(self) -> typing.Optional[jsii.Number]:
-        '''(Kinesis and DynamoDB Streams only) Discard records after the specified number of retries.
-
-        The default value is -1,
-        which sets the maximum number of retries to infinite. When MaximumRetryAttempts is infinite, Lambda retries failed records until the record expires in the event source.
+        '''(Streams) The maximum number of times to retry when the function returns an error.
 
         :see: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-lambda-eventsourcemapping.html#cfn-lambda-eventsourcemapping-maximumretryattempts
         '''
@@ -5988,9 +6002,7 @@ class CfnEventSourceMappingProps:
 
     @builtins.property
     def parallelization_factor(self) -> typing.Optional[jsii.Number]:
-        '''(Kinesis and DynamoDB Streams only) The number of batches to process concurrently from each shard.
-
-        The default value is 1.
+        '''(Streams) The number of batches to process from each shard concurrently.
 
         :see: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-lambda-eventsourcemapping.html#cfn-lambda-eventsourcemapping-parallelizationfactor
         '''
@@ -5999,7 +6011,7 @@ class CfnEventSourceMappingProps:
 
     @builtins.property
     def queues(self) -> typing.Optional[typing.List[builtins.str]]:
-        '''(Amazon MQ) The name of the Amazon MQ broker destination queue to consume.
+        '''(ActiveMQ) A list of ActiveMQ queues.
 
         :see: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-lambda-eventsourcemapping.html#cfn-lambda-eventsourcemapping-queues
         '''
@@ -6010,9 +6022,7 @@ class CfnEventSourceMappingProps:
     def scaling_config(
         self,
     ) -> typing.Optional[typing.Union[_IResolvable_da3f097b, CfnEventSourceMapping.ScalingConfigProperty]]:
-        '''(Amazon SQS only) The scaling configuration for the event source.
-
-        For more information, see `Configuring maximum concurrency for Amazon SQS event sources <https://docs.aws.amazon.com/lambda/latest/dg/with-sqs.html#events-sqs-max-concurrency>`_ .
+        '''The scaling configuration for the event source.
 
         :see: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-lambda-eventsourcemapping.html#cfn-lambda-eventsourcemapping-scalingconfig
         '''
@@ -6023,7 +6033,7 @@ class CfnEventSourceMappingProps:
     def self_managed_event_source(
         self,
     ) -> typing.Optional[typing.Union[_IResolvable_da3f097b, CfnEventSourceMapping.SelfManagedEventSourceProperty]]:
-        '''The self-managed Apache Kafka cluster for your event source.
+        '''The configuration used by AWS Lambda to access a self-managed event source.
 
         :see: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-lambda-eventsourcemapping.html#cfn-lambda-eventsourcemapping-selfmanagedeventsource
         '''
@@ -6034,7 +6044,7 @@ class CfnEventSourceMappingProps:
     def self_managed_kafka_event_source_config(
         self,
     ) -> typing.Optional[typing.Union[_IResolvable_da3f097b, CfnEventSourceMapping.SelfManagedKafkaEventSourceConfigProperty]]:
-        '''Specific configuration settings for a self-managed Apache Kafka event source.
+        '''Specific configuration settings for a Self-Managed Apache Kafka event source.
 
         :see: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-lambda-eventsourcemapping.html#cfn-lambda-eventsourcemapping-selfmanagedkafkaeventsourceconfig
         '''
@@ -6045,7 +6055,7 @@ class CfnEventSourceMappingProps:
     def source_access_configurations(
         self,
     ) -> typing.Optional[typing.Union[_IResolvable_da3f097b, typing.List[typing.Union[_IResolvable_da3f097b, CfnEventSourceMapping.SourceAccessConfigurationProperty]]]]:
-        '''An array of the authentication protocol, VPC components, or virtual host to secure and define your event source.
+        '''A list of SourceAccessConfiguration.
 
         :see: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-lambda-eventsourcemapping.html#cfn-lambda-eventsourcemapping-sourceaccessconfigurations
         '''
@@ -6054,11 +6064,9 @@ class CfnEventSourceMappingProps:
 
     @builtins.property
     def starting_position(self) -> typing.Optional[builtins.str]:
-        '''The position in a stream from which to start reading. Required for Amazon Kinesis and Amazon DynamoDB.
+        '''The position in a stream from which to start reading.
 
-        - *LATEST* - Read only new records.
-        - *TRIM_HORIZON* - Process all available records.
-        - *AT_TIMESTAMP* - Specify a time from which to start reading records.
+        Required for Amazon Kinesis and Amazon DynamoDB Streams sources.
 
         :see: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-lambda-eventsourcemapping.html#cfn-lambda-eventsourcemapping-startingposition
         '''
@@ -6067,9 +6075,7 @@ class CfnEventSourceMappingProps:
 
     @builtins.property
     def starting_position_timestamp(self) -> typing.Optional[jsii.Number]:
-        '''With ``StartingPosition`` set to ``AT_TIMESTAMP`` , the time from which to start reading, in Unix time seconds.
-
-        ``StartingPositionTimestamp`` cannot be in the future.
+        '''With StartingPosition set to AT_TIMESTAMP, the time from which to start reading, in Unix time seconds.
 
         :see: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-lambda-eventsourcemapping.html#cfn-lambda-eventsourcemapping-startingpositiontimestamp
         '''
@@ -6078,7 +6084,7 @@ class CfnEventSourceMappingProps:
 
     @builtins.property
     def topics(self) -> typing.Optional[typing.List[builtins.str]]:
-        '''The name of the Kafka topic.
+        '''(Kafka) A list of Kafka topics.
 
         :see: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-lambda-eventsourcemapping.html#cfn-lambda-eventsourcemapping-topics
         '''
@@ -6087,9 +6093,7 @@ class CfnEventSourceMappingProps:
 
     @builtins.property
     def tumbling_window_in_seconds(self) -> typing.Optional[jsii.Number]:
-        '''(Kinesis and DynamoDB Streams only) The duration in seconds of a processing window for DynamoDB and Kinesis Streams event sources.
-
-        A value of 0 seconds indicates no tumbling window.
+        '''(Streams) Tumbling window (non-overlapping time window) duration to perform aggregations.
 
         :see: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-lambda-eventsourcemapping.html#cfn-lambda-eventsourcemapping-tumblingwindowinseconds
         '''
@@ -6184,6 +6188,7 @@ class CfnFunction(
             ),
             memory_size=123,
             package_type="packageType",
+            recursive_loop="recursiveLoop",
             reserved_concurrent_executions=123,
             runtime="runtime",
             runtime_management_config=lambda.CfnFunction.RuntimeManagementConfigProperty(
@@ -6233,6 +6238,7 @@ class CfnFunction(
         logging_config: typing.Optional[typing.Union[_IResolvable_da3f097b, typing.Union["CfnFunction.LoggingConfigProperty", typing.Dict[builtins.str, typing.Any]]]] = None,
         memory_size: typing.Optional[jsii.Number] = None,
         package_type: typing.Optional[builtins.str] = None,
+        recursive_loop: typing.Optional[builtins.str] = None,
         reserved_concurrent_executions: typing.Optional[jsii.Number] = None,
         runtime: typing.Optional[builtins.str] = None,
         runtime_management_config: typing.Optional[typing.Union[_IResolvable_da3f097b, typing.Union["CfnFunction.RuntimeManagementConfigProperty", typing.Dict[builtins.str, typing.Any]]]] = None,
@@ -6245,31 +6251,32 @@ class CfnFunction(
         '''
         :param scope: Scope in which this resource is defined.
         :param id: Construct identifier for this resource (unique in its scope).
-        :param code: The code for the function.
+        :param code: The `deployment package <https://docs.aws.amazon.com/lambda/latest/dg/gettingstarted-package.html>`_ for a Lambda function. To deploy a function defined as a container image, you specify the location of a container image in the Amazon ECR registry. For a .zip file deployment package, you can specify the location of an object in Amazon S3. For Node.js and Python functions, you can specify the function code inline in the template. Changes to a deployment package in Amazon S3 or a container image in ECR are not detected automatically during stack updates. To update the function code, change the object key or version in the template.
         :param role: The Amazon Resource Name (ARN) of the function's execution role.
-        :param architectures: The instruction set architecture that the function supports. Enter a string array with one of the valid values (arm64 or x86_64). The default value is ``x86_64`` .
+        :param architectures: The instruction set architecture that the function supports. Enter a string array with one of the valid values (arm64 or x86_64). The default value is ``x86_64``.
         :param code_signing_config_arn: To enable code signing for this function, specify the ARN of a code-signing configuration. A code-signing configuration includes a set of signing profiles, which define the trusted publishers for this function.
-        :param dead_letter_config: A dead-letter queue configuration that specifies the queue or topic where Lambda sends asynchronous events when they fail processing. For more information, see `Dead-letter queues <https://docs.aws.amazon.com/lambda/latest/dg/invocation-async.html#invocation-dlq>`_ .
+        :param dead_letter_config: The `dead-letter queue <https://docs.aws.amazon.com/lambda/latest/dg/invocation-async.html#dlq>`_ for failed asynchronous invocations.
         :param description: A description of the function.
-        :param environment: Environment variables that are accessible from function code during execution.
+        :param environment: A function's environment variable settings. You can use environment variables to adjust your function's behavior without updating code. An environment variable is a pair of strings that are stored in a function's version-specific configuration.
         :param ephemeral_storage: The size of the function's ``/tmp`` directory in MB. The default value is 512, but it can be any whole number between 512 and 10,240 MB.
-        :param file_system_configs: Connection settings for an Amazon EFS file system. To connect a function to a file system, a mount target must be available in every Availability Zone that your function connects to. If your template contains an `AWS::EFS::MountTarget <https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-efs-mounttarget.html>`_ resource, you must also specify a ``DependsOn`` attribute to ensure that the mount target is created or updated before the function. For more information about using the ``DependsOn`` attribute, see `DependsOn Attribute <https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-attribute-dependson.html>`_ .
-        :param function_name: The name of the Lambda function, up to 64 characters in length. If you don't specify a name, AWS CloudFormation generates one. If you specify a name, you cannot perform updates that require replacement of this resource. You can perform updates that require no or some interruption. If you must replace the resource, specify a new name.
-        :param handler: The name of the method within your code that Lambda calls to run your function. Handler is required if the deployment package is a .zip file archive. The format includes the file name. It can also include namespaces and other qualifiers, depending on the runtime. For more information, see `Lambda programming model <https://docs.aws.amazon.com/lambda/latest/dg/foundation-progmodel.html>`_ .
-        :param image_config: Configuration values that override the container image Dockerfile settings. For more information, see `Container image settings <https://docs.aws.amazon.com/lambda/latest/dg/images-create.html#images-parms>`_ .
-        :param kms_key_arn: The ARN of the AWS Key Management Service ( AWS KMS ) customer managed key that's used to encrypt your function's `environment variables <https://docs.aws.amazon.com/lambda/latest/dg/configuration-envvars.html#configuration-envvars-encryption>`_ . When `Lambda SnapStart <https://docs.aws.amazon.com/lambda/latest/dg/snapstart-security.html>`_ is activated, Lambda also uses this key is to encrypt your function's snapshot. If you deploy your function using a container image, Lambda also uses this key to encrypt your function when it's deployed. Note that this is not the same key that's used to protect your container image in the Amazon Elastic Container Registry (Amazon ECR). If you don't provide a customer managed key, Lambda uses a default service key.
+        :param file_system_configs: Connection settings for an Amazon EFS file system. To connect a function to a file system, a mount target must be available in every Availability Zone that your function connects to. If your template contains an `AWS::EFS::MountTarget <https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-efs-mounttarget.html>`_ resource, you must also specify a ``DependsOn`` attribute to ensure that the mount target is created or updated before the function. For more information about using the ``DependsOn`` attribute, see `DependsOn Attribute <https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-attribute-dependson.html>`_.
+        :param function_name: The name of the Lambda function, up to 64 characters in length. If you don't specify a name, CFN generates one. If you specify a name, you cannot perform updates that require replacement of this resource. You can perform updates that require no or some interruption. If you must replace the resource, specify a new name.
+        :param handler: The name of the method within your code that Lambda calls to run your function. Handler is required if the deployment package is a .zip file archive. The format includes the file name. It can also include namespaces and other qualifiers, depending on the runtime. For more information, see `Lambda programming model <https://docs.aws.amazon.com/lambda/latest/dg/foundation-progmodel.html>`_.
+        :param image_config: Configuration values that override the container image Dockerfile settings. For more information, see `Container image settings <https://docs.aws.amazon.com/lambda/latest/dg/images-create.html#images-parms>`_.
+        :param kms_key_arn: The ARN of the KMSlong (KMS) customer managed key that's used to encrypt your function's `environment variables <https://docs.aws.amazon.com/lambda/latest/dg/configuration-envvars.html#configuration-envvars-encryption>`_. When `Lambda SnapStart <https://docs.aws.amazon.com/lambda/latest/dg/snapstart-security.html>`_ is activated, Lambda also uses this key is to encrypt your function's snapshot. If you deploy your function using a container image, Lambda also uses this key to encrypt your function when it's deployed. Note that this is not the same key that's used to protect your container image in the Amazon Elastic Container Registry (Amazon ECR). If you don't provide a customer managed key, Lambda uses a default service key.
         :param layers: A list of `function layers <https://docs.aws.amazon.com/lambda/latest/dg/configuration-layers.html>`_ to add to the function's execution environment. Specify each layer by its ARN, including the version.
         :param logging_config: The function's Amazon CloudWatch Logs configuration settings.
         :param memory_size: The amount of `memory available to the function <https://docs.aws.amazon.com/lambda/latest/dg/configuration-function-common.html#configuration-memory-console>`_ at runtime. Increasing the function memory also increases its CPU allocation. The default value is 128 MB. The value can be any multiple of 1 MB. Note that new AWS accounts have reduced concurrency and memory quotas. AWS raises these quotas automatically based on your usage. You can also request a quota increase.
         :param package_type: The type of deployment package. Set to ``Image`` for container image and set ``Zip`` for .zip file archive.
+        :param recursive_loop: This property is set to terminate unintended recursions. If set to ``Terminate``, Lambda detects and terminates unitended recursive loops. If set to ``Allow`` Lambda lets recursions be and does not terminate it.
         :param reserved_concurrent_executions: The number of simultaneous executions to reserve for the function.
-        :param runtime: The identifier of the function's `runtime <https://docs.aws.amazon.com/lambda/latest/dg/lambda-runtimes.html>`_ . Runtime is required if the deployment package is a .zip file archive. Specifying a runtime results in an error if you're deploying a function using a container image. The following list includes deprecated runtimes. Lambda blocks creating new functions and updating existing functions shortly after each runtime is deprecated. For more information, see `Runtime use after deprecation <https://docs.aws.amazon.com/lambda/latest/dg/lambda-runtimes.html#runtime-deprecation-levels>`_ . For a list of all currently supported runtimes, see `Supported runtimes <https://docs.aws.amazon.com/lambda/latest/dg/lambda-runtimes.html#runtimes-supported>`_ .
-        :param runtime_management_config: Sets the runtime management configuration for a function's version. For more information, see `Runtime updates <https://docs.aws.amazon.com/lambda/latest/dg/runtimes-update.html>`_ .
-        :param snap_start: The function's `AWS Lambda SnapStart <https://docs.aws.amazon.com/lambda/latest/dg/snapstart.html>`_ setting.
+        :param runtime: The identifier of the function's `runtime <https://docs.aws.amazon.com/lambda/latest/dg/lambda-runtimes.html>`_. Runtime is required if the deployment package is a .zip file archive. Specifying a runtime results in an error if you're deploying a function using a container image. The following list includes deprecated runtimes. Lambda blocks creating new functions and updating existing functions shortly after each runtime is deprecated. For more information, see `Runtime use after deprecation <https://docs.aws.amazon.com/lambda/latest/dg/lambda-runtimes.html#runtime-deprecation-levels>`_. For a list of all currently supported runtimes, see `Supported runtimes <https://docs.aws.amazon.com/lambda/latest/dg/lambda-runtimes.html#runtimes-supported>`_.
+        :param runtime_management_config: Sets the runtime management configuration for a function's version. For more information, see `Runtime updates <https://docs.aws.amazon.com/lambda/latest/dg/runtimes-update.html>`_.
+        :param snap_start: The function's `SnapStart <https://docs.aws.amazon.com/lambda/latest/dg/snapstart.html>`_ setting.
         :param tags: A list of `tags <https://docs.aws.amazon.com/lambda/latest/dg/tagging.html>`_ to apply to the function.
-        :param timeout: The amount of time (in seconds) that Lambda allows a function to run before stopping it. The default is 3 seconds. The maximum allowed value is 900 seconds. For more information, see `Lambda execution environment <https://docs.aws.amazon.com/lambda/latest/dg/runtimes-context.html>`_ .
-        :param tracing_config: Set ``Mode`` to ``Active`` to sample and trace a subset of incoming requests with `X-Ray <https://docs.aws.amazon.com/lambda/latest/dg/services-xray.html>`_ .
-        :param vpc_config: For network connectivity to AWS resources in a VPC, specify a list of security groups and subnets in the VPC. When you connect a function to a VPC, it can access resources and the internet only through that VPC. For more information, see `Configuring a Lambda function to access resources in a VPC <https://docs.aws.amazon.com/lambda/latest/dg/configuration-vpc.html>`_ .
+        :param timeout: The amount of time (in seconds) that Lambda allows a function to run before stopping it. The default is 3 seconds. The maximum allowed value is 900 seconds. For more information, see `Lambda execution environment <https://docs.aws.amazon.com/lambda/latest/dg/runtimes-context.html>`_.
+        :param tracing_config: The function's ` <https://docs.aws.amazon.com/lambda/latest/dg/services-xray.html>`_ tracing configuration. To sample and record incoming requests, set ``Mode`` to ``Active``.
+        :param vpc_config: The VPC security groups and subnets that are attached to a Lambda function. When you connect a function to a VPC, Lambda creates an elastic network interface for each combination of security group and subnet in the function's VPC configuration. The function can only access resources and the internet through that VPC. For more information, see `VPC Settings <https://docs.aws.amazon.com/lambda/latest/dg/configuration-vpc.html>`_. When you delete a function, CFN monitors the state of its network interfaces and waits for Lambda to delete them before proceeding. If the VPC is defined in the same stack, the network interfaces need to be deleted by Lambda before CFN can delete the VPC's resources. To monitor network interfaces, CFN needs the ``ec2:DescribeNetworkInterfaces`` permission. It obtains this from the user or role that modifies the stack. If you don't provide this permission, CFN does not wait for network interfaces to be deleted.
         '''
         if __debug__:
             type_hints = typing.get_type_hints(_typecheckingstub__d971f3872acf20816e6da364ff9e6bec83fe2e68bbb9a7debc845b40036ee553)
@@ -6293,6 +6300,7 @@ class CfnFunction(
             logging_config=logging_config,
             memory_size=memory_size,
             package_type=package_type,
+            recursive_loop=recursive_loop,
             reserved_concurrent_executions=reserved_concurrent_executions,
             runtime=runtime,
             runtime_management_config=runtime_management_config,
@@ -6338,8 +6346,7 @@ class CfnFunction(
     @builtins.property
     @jsii.member(jsii_name="attrArn")
     def attr_arn(self) -> builtins.str:
-        '''The Amazon Resource Name (ARN) of the function.
-
+        '''
         :cloudformationAttribute: Arn
         '''
         return typing.cast(builtins.str, jsii.get(self, "attrArn"))
@@ -6385,7 +6392,7 @@ class CfnFunction(
     @builtins.property
     @jsii.member(jsii_name="code")
     def code(self) -> typing.Union[_IResolvable_da3f097b, "CfnFunction.CodeProperty"]:
-        '''The code for the function.'''
+        '''The `deployment package <https://docs.aws.amazon.com/lambda/latest/dg/gettingstarted-package.html>`_ for a Lambda function. To deploy a function defined as a container image, you specify the location of a container image in the Amazon ECR registry. For a .zip file deployment package, you can specify the location of an object in Amazon S3. For Node.js and Python functions, you can specify the function code inline in the template.  Changes to a deployment package in Amazon S3 or a container image in ECR are not detected automatically during stack updates. To update the function code, change the object key or version in the template.'''
         return typing.cast(typing.Union[_IResolvable_da3f097b, "CfnFunction.CodeProperty"], jsii.get(self, "code"))
 
     @code.setter
@@ -6442,7 +6449,7 @@ class CfnFunction(
     def dead_letter_config(
         self,
     ) -> typing.Optional[typing.Union[_IResolvable_da3f097b, "CfnFunction.DeadLetterConfigProperty"]]:
-        '''A dead-letter queue configuration that specifies the queue or topic where Lambda sends asynchronous events when they fail processing.'''
+        '''The `dead-letter queue <https://docs.aws.amazon.com/lambda/latest/dg/invocation-async.html#dlq>`_ for failed asynchronous invocations.'''
         return typing.cast(typing.Optional[typing.Union[_IResolvable_da3f097b, "CfnFunction.DeadLetterConfigProperty"]], jsii.get(self, "deadLetterConfig"))
 
     @dead_letter_config.setter
@@ -6473,7 +6480,7 @@ class CfnFunction(
     def environment(
         self,
     ) -> typing.Optional[typing.Union[_IResolvable_da3f097b, "CfnFunction.EnvironmentProperty"]]:
-        '''Environment variables that are accessible from function code during execution.'''
+        '''A function's environment variable settings.'''
         return typing.cast(typing.Optional[typing.Union[_IResolvable_da3f097b, "CfnFunction.EnvironmentProperty"]], jsii.get(self, "environment"))
 
     @environment.setter
@@ -6569,7 +6576,7 @@ class CfnFunction(
     @builtins.property
     @jsii.member(jsii_name="kmsKeyArn")
     def kms_key_arn(self) -> typing.Optional[builtins.str]:
-        '''The ARN of the AWS Key Management Service ( AWS KMS ) customer managed key that's used to encrypt your function's `environment variables <https://docs.aws.amazon.com/lambda/latest/dg/configuration-envvars.html#configuration-envvars-encryption>`_ . When `Lambda SnapStart <https://docs.aws.amazon.com/lambda/latest/dg/snapstart-security.html>`_ is activated, Lambda also uses this key is to encrypt your function's snapshot. If you deploy your function using a container image, Lambda also uses this key to encrypt your function when it's deployed. Note that this is not the same key that's used to protect your container image in the Amazon Elastic Container Registry (Amazon ECR). If you don't provide a customer managed key, Lambda uses a default service key.'''
+        '''The ARN of the KMSlong (KMS) customer managed key that's used to encrypt your function's `environment variables <https://docs.aws.amazon.com/lambda/latest/dg/configuration-envvars.html#configuration-envvars-encryption>`_. When `Lambda SnapStart <https://docs.aws.amazon.com/lambda/latest/dg/snapstart-security.html>`_ is activated, Lambda also uses this key is to encrypt your function's snapshot. If you deploy your function using a container image, Lambda also uses this key to encrypt your function when it's deployed. Note that this is not the same key that's used to protect your container image in the Amazon Elastic Container Registry (Amazon ECR). If you don't provide a customer managed key, Lambda uses a default service key.'''
         return typing.cast(typing.Optional[builtins.str], jsii.get(self, "kmsKeyArn"))
 
     @kms_key_arn.setter
@@ -6636,6 +6643,19 @@ class CfnFunction(
             check_type(argname="argument value", value=value, expected_type=type_hints["value"])
         jsii.set(self, "packageType", value)
 
+    @builtins.property
+    @jsii.member(jsii_name="recursiveLoop")
+    def recursive_loop(self) -> typing.Optional[builtins.str]:
+        '''This property is set to terminate unintended recursions.'''
+        return typing.cast(typing.Optional[builtins.str], jsii.get(self, "recursiveLoop"))
+
+    @recursive_loop.setter
+    def recursive_loop(self, value: typing.Optional[builtins.str]) -> None:
+        if __debug__:
+            type_hints = typing.get_type_hints(_typecheckingstub__021080e0643735be55c0ce187b6c3482fd8d23af0a29c95ad94660f1cf184a90)
+            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
+        jsii.set(self, "recursiveLoop", value)
+
     @builtins.property
     @jsii.member(jsii_name="reservedConcurrentExecutions")
     def reserved_concurrent_executions(self) -> typing.Optional[jsii.Number]:
@@ -6655,7 +6675,7 @@ class CfnFunction(
     @builtins.property
     @jsii.member(jsii_name="runtime")
     def runtime(self) -> typing.Optional[builtins.str]:
-        '''The identifier of the function's `runtime <https://docs.aws.amazon.com/lambda/latest/dg/lambda-runtimes.html>`_ . Runtime is required if the deployment package is a .zip file archive. Specifying a runtime results in an error if you're deploying a function using a container image.'''
+        '''The identifier of the function's `runtime <https://docs.aws.amazon.com/lambda/latest/dg/lambda-runtimes.html>`_. Runtime is required if the deployment package is a .zip file archive. Specifying a runtime results in an error if you're deploying a function using a container image.  The following list includes deprecated runtimes. Lambda blocks creating new functions and updating existing functions shortly after each runtime is deprecated. For more information, see `Runtime use after deprecation <https://docs.aws.amazon.com/lambda/latest/dg/lambda-runtimes.html#runtime-deprecation-levels>`_.  For a list of all currently supported runtimes, see `Supported runtimes <https://docs.aws.amazon.com/lambda/latest/dg/lambda-runtimes.html#runtimes-supported>`_.'''
         return typing.cast(typing.Optional[builtins.str], jsii.get(self, "runtime"))
 
     @runtime.setter
@@ -6688,7 +6708,7 @@ class CfnFunction(
     def snap_start(
         self,
     ) -> typing.Optional[typing.Union[_IResolvable_da3f097b, "CfnFunction.SnapStartProperty"]]:
-        '''The function's `AWS Lambda SnapStart <https://docs.aws.amazon.com/lambda/latest/dg/snapstart.html>`_ setting.'''
+        '''The function's `SnapStart <https://docs.aws.amazon.com/lambda/latest/dg/snapstart.html>`_ setting.'''
         return typing.cast(typing.Optional[typing.Union[_IResolvable_da3f097b, "CfnFunction.SnapStartProperty"]], jsii.get(self, "snapStart"))
 
     @snap_start.setter
@@ -6732,7 +6752,7 @@ class CfnFunction(
     def tracing_config(
         self,
     ) -> typing.Optional[typing.Union[_IResolvable_da3f097b, "CfnFunction.TracingConfigProperty"]]:
-        '''Set ``Mode`` to ``Active`` to sample and trace a subset of incoming requests with `X-Ray <https://docs.aws.amazon.com/lambda/latest/dg/services-xray.html>`_ .'''
+        '''The function's ` <https://docs.aws.amazon.com/lambda/latest/dg/services-xray.html>`_ tracing configuration. To sample and record incoming requests, set ``Mode`` to ``Active``.'''
         return typing.cast(typing.Optional[typing.Union[_IResolvable_da3f097b, "CfnFunction.TracingConfigProperty"]], jsii.get(self, "tracingConfig"))
 
     @tracing_config.setter
@@ -6750,7 +6770,7 @@ class CfnFunction(
     def vpc_config(
         self,
     ) -> typing.Optional[typing.Union[_IResolvable_da3f097b, "CfnFunction.VpcConfigProperty"]]:
-        '''For network connectivity to AWS resources in a VPC, specify a list of security groups and subnets in the VPC.'''
+        '''The VPC security groups and subnets that are attached to a Lambda function.'''
         return typing.cast(typing.Optional[typing.Union[_IResolvable_da3f097b, "CfnFunction.VpcConfigProperty"]], jsii.get(self, "vpcConfig"))
 
     @vpc_config.setter
@@ -6784,15 +6804,13 @@ class CfnFunction(
             s3_object_version: typing.Optional[builtins.str] = None,
             zip_file: typing.Optional[builtins.str] = None,
         ) -> None:
-            '''The `deployment package <https://docs.aws.amazon.com/lambda/latest/dg/gettingstarted-package.html>`_ for a Lambda function. To deploy a function defined as a container image, you specify the location of a container image in the Amazon ECR registry. For a .zip file deployment package, you can specify the location of an object in Amazon S3. For Node.js and Python functions, you can specify the function code inline in the template.
-
-            Changes to a deployment package in Amazon S3 or a container image in ECR are not detected automatically during stack updates. To update the function code, change the object key or version in the template.
+            '''The `deployment package <https://docs.aws.amazon.com/lambda/latest/dg/gettingstarted-package.html>`_ for a Lambda function. To deploy a function defined as a container image, you specify the location of a container image in the Amazon ECR registry. For a .zip file deployment package, you can specify the location of an object in Amazon S3. For Node.js and Python functions, you can specify the function code inline in the template.  Changes to a deployment package in Amazon S3 or a container image in ECR are not detected automatically during stack updates. To update the function code, change the object key or version in the template.
 
             :param image_uri: URI of a `container image <https://docs.aws.amazon.com/lambda/latest/dg/lambda-images.html>`_ in the Amazon ECR registry.
-            :param s3_bucket: An Amazon S3 bucket in the same AWS Region as your function. The bucket can be in a different AWS account .
+            :param s3_bucket: An Amazon S3 bucket in the same AWS-Region as your function. The bucket can be in a different AWS-account.
             :param s3_key: The Amazon S3 key of the deployment package.
             :param s3_object_version: For versioned objects, the version of the deployment package object to use.
-            :param zip_file: (Node.js and Python) The source code of your Lambda function. If you include your function source inline with this parameter, AWS CloudFormation places it in a file named ``index`` and zips it to create a `deployment package <https://docs.aws.amazon.com/lambda/latest/dg/gettingstarted-package.html>`_ . This zip file cannot exceed 4MB. For the ``Handler`` property, the first part of the handler identifier must be ``index`` . For example, ``index.handler`` . For JSON, you must escape quotes and special characters such as newline ( ``\\n`` ) with a backslash. If you specify a function that interacts with an AWS CloudFormation custom resource, you don't have to write your own functions to send responses to the custom resource that invoked the function. AWS CloudFormation provides a response module ( `cfn-response <https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/cfn-lambda-function-code-cfnresponsemodule.html>`_ ) that simplifies sending responses. See `Using AWS Lambda with AWS CloudFormation <https://docs.aws.amazon.com/lambda/latest/dg/services-cloudformation.html>`_ for details.
+            :param zip_file: (Node.js and Python) The source code of your Lambda function. If you include your function source inline with this parameter, CFN places it in a file named ``index`` and zips it to create a `deployment package <https://docs.aws.amazon.com/lambda/latest/dg/gettingstarted-package.html>`_. This zip file cannot exceed 4MB. For the ``Handler`` property, the first part of the handler identifier must be ``index``. For example, ``index.handler``. For JSON, you must escape quotes and special characters such as newline (``\\n``) with a backslash. If you specify a function that interacts with an AWS CloudFormation custom resource, you don't have to write your own functions to send responses to the custom resource that invoked the function. AWS CloudFormation provides a response module (`cfn-response <https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/cfn-lambda-function-code-cfnresponsemodule.html>`_) that simplifies sending responses. See `Using Lambda with CloudFormation <https://docs.aws.amazon.com/lambda/latest/dg/services-cloudformation.html>`_ for details.
 
             :see: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-lambda-function-code.html
             :exampleMetadata: fixture=_generated
@@ -6841,9 +6859,9 @@ class CfnFunction(
 
         @builtins.property
         def s3_bucket(self) -> typing.Optional[builtins.str]:
-            '''An Amazon S3 bucket in the same AWS Region as your function.
+            '''An Amazon S3 bucket in the same AWS-Region as your function.
 
-            The bucket can be in a different AWS account .
+            The bucket can be in a different AWS-account.
 
             :see: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-lambda-function-code.html#cfn-lambda-function-code-s3bucket
             '''
@@ -6870,11 +6888,7 @@ class CfnFunction(
 
         @builtins.property
         def zip_file(self) -> typing.Optional[builtins.str]:
-            '''(Node.js and Python) The source code of your Lambda function. If you include your function source inline with this parameter, AWS CloudFormation places it in a file named ``index`` and zips it to create a `deployment package <https://docs.aws.amazon.com/lambda/latest/dg/gettingstarted-package.html>`_ . This zip file cannot exceed 4MB. For the ``Handler`` property, the first part of the handler identifier must be ``index`` . For example, ``index.handler`` .
-
-            For JSON, you must escape quotes and special characters such as newline ( ``\\n`` ) with a backslash.
-
-            If you specify a function that interacts with an AWS CloudFormation custom resource, you don't have to write your own functions to send responses to the custom resource that invoked the function. AWS CloudFormation provides a response module ( `cfn-response <https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/cfn-lambda-function-code-cfnresponsemodule.html>`_ ) that simplifies sending responses. See `Using AWS Lambda with AWS CloudFormation <https://docs.aws.amazon.com/lambda/latest/dg/services-cloudformation.html>`_ for details.
+            '''(Node.js and Python) The source code of your Lambda function. If you include your function source inline with this parameter, CFN places it in a file named ``index`` and zips it to create a `deployment package <https://docs.aws.amazon.com/lambda/latest/dg/gettingstarted-package.html>`_. This zip file cannot exceed 4MB. For the ``Handler`` property, the first part of the handler identifier must be ``index``. For example, ``index.handler``.   For JSON, you must escape quotes and special characters such as newline (``\\n``) with a backslash.  If you specify a function that interacts with an AWS CloudFormation custom resource, you don't have to write your own functions to send responses to the custom resource that invoked the function. AWS CloudFormation provides a response module (`cfn-response <https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/cfn-lambda-function-code-cfnresponsemodule.html>`_) that simplifies sending responses. See `Using Lambda with CloudFormation <https://docs.aws.amazon.com/lambda/latest/dg/services-cloudformation.html>`_ for details.
 
             :see: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-lambda-function-code.html#cfn-lambda-function-code-zipfile
             '''
@@ -6958,7 +6972,7 @@ class CfnFunction(
 
             You can use environment variables to adjust your function's behavior without updating code. An environment variable is a pair of strings that are stored in a function's version-specific configuration.
 
-            :param variables: Environment variable key-value pairs. For more information, see `Using Lambda environment variables <https://docs.aws.amazon.com/lambda/latest/dg/configuration-envvars.html>`_ .
+            :param variables: Environment variable key-value pairs. For more information, see `Using Lambda environment variables <https://docs.aws.amazon.com/lambda/latest/dg/configuration-envvars.html>`_.
 
             :see: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-lambda-function-environment.html
             :exampleMetadata: fixture=_generated
@@ -6988,7 +7002,7 @@ class CfnFunction(
         ) -> typing.Optional[typing.Union[_IResolvable_da3f097b, typing.Mapping[builtins.str, builtins.str]]]:
             '''Environment variable key-value pairs.
 
-            For more information, see `Using Lambda environment variables <https://docs.aws.amazon.com/lambda/latest/dg/configuration-envvars.html>`_ .
+            For more information, see `Using Lambda environment variables <https://docs.aws.amazon.com/lambda/latest/dg/configuration-envvars.html>`_.
 
             :see: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-lambda-function-environment.html#cfn-lambda-function-environment-variables
             '''
@@ -7072,10 +7086,10 @@ class CfnFunction(
             arn: builtins.str,
             local_mount_path: builtins.str,
         ) -> None:
-            '''Details about the connection between a Lambda function and an `Amazon EFS file system <https://docs.aws.amazon.com/lambda/latest/dg/configuration-filesystem.html>`_ .
+            '''Details about the connection between a Lambda function and an `Amazon EFS file system <https://docs.aws.amazon.com/lambda/latest/dg/configuration-filesystem.html>`_.
 
             :param arn: The Amazon Resource Name (ARN) of the Amazon EFS access point that provides access to the file system.
-            :param local_mount_path: The path where the function can access the file system, starting with ``/mnt/`` .
+            :param local_mount_path: The path where the function can access the file system, starting with ``/mnt/``.
 
             :see: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-lambda-function-filesystemconfig.html
             :exampleMetadata: fixture=_generated
@@ -7112,7 +7126,7 @@ class CfnFunction(
 
         @builtins.property
         def local_mount_path(self) -> builtins.str:
-            '''The path where the function can access the file system, starting with ``/mnt/`` .
+            '''The path where the function can access the file system, starting with ``/mnt/``.
 
             :see: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-lambda-function-filesystemconfig.html#cfn-lambda-function-filesystemconfig-localmountpath
             '''
@@ -7150,7 +7164,7 @@ class CfnFunction(
         ) -> None:
             '''Configuration values that override the container image Dockerfile settings.
 
-            For more information, see `Container image settings <https://docs.aws.amazon.com/lambda/latest/dg/images-create.html#images-parms>`_ .
+            For more information, see `Container image settings <https://docs.aws.amazon.com/lambda/latest/dg/images-create.html#images-parms>`_.
 
             :param command: Specifies parameters that you want to pass in with ENTRYPOINT. You can specify a maximum of 1,500 parameters in the list.
             :param entry_point: Specifies the entry point to their application, which is typically the location of the runtime executable. You can specify a maximum of 1,500 string entries in the list.
@@ -7251,7 +7265,7 @@ class CfnFunction(
 
             :param application_log_level: Set this property to filter the application logs for your function that Lambda sends to CloudWatch. Lambda only sends application logs at the selected level of detail and lower, where ``TRACE`` is the highest level and ``FATAL`` is the lowest.
             :param log_format: The format in which Lambda sends your function's application and system logs to CloudWatch. Select between plain text and structured JSON.
-            :param log_group: The name of the Amazon CloudWatch log group the function sends logs to. By default, Lambda functions send logs to a default log group named ``/aws/lambda/<function name>`` . To use a different log group, enter an existing log group or enter a new log group name.
+            :param log_group: The name of the Amazon CloudWatch log group the function sends logs to. By default, Lambda functions send logs to a default log group named ``/aws/lambda/<function name>``. To use a different log group, enter an existing log group or enter a new log group name.
             :param system_log_level: Set this property to filter the system logs for your function that Lambda sends to CloudWatch. Lambda only sends system logs at the selected level of detail and lower, where ``DEBUG`` is the highest level and ``WARN`` is the lowest.
 
             :see: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-lambda-function-loggingconfig.html
@@ -7312,7 +7326,7 @@ class CfnFunction(
         def log_group(self) -> typing.Optional[builtins.str]:
             '''The name of the Amazon CloudWatch log group the function sends logs to.
 
-            By default, Lambda functions send logs to a default log group named ``/aws/lambda/<function name>`` . To use a different log group, enter an existing log group or enter a new log group name.
+            By default, Lambda functions send logs to a default log group named ``/aws/lambda/<function name>``. To use a different log group, enter an existing log group or enter a new log group name.
 
             :see: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-lambda-function-loggingconfig.html#cfn-lambda-function-loggingconfig-loggroup
             '''
@@ -7358,10 +7372,10 @@ class CfnFunction(
         ) -> None:
             '''Sets the runtime management configuration for a function's version.
 
-            For more information, see `Runtime updates <https://docs.aws.amazon.com/lambda/latest/dg/runtimes-update.html>`_ .
+            For more information, see `Runtime updates <https://docs.aws.amazon.com/lambda/latest/dg/runtimes-update.html>`_.
 
-            :param update_runtime_on: Specify the runtime update mode. - *Auto (default)* - Automatically update to the most recent and secure runtime version using a `Two-phase runtime version rollout <https://docs.aws.amazon.com/lambda/latest/dg/runtimes-update.html#runtime-management-two-phase>`_ . This is the best choice for most customers to ensure they always benefit from runtime updates. - *FunctionUpdate* - Lambda updates the runtime of you function to the most recent and secure runtime version when you update your function. This approach synchronizes runtime updates with function deployments, giving you control over when runtime updates are applied and allowing you to detect and mitigate rare runtime update incompatibilities early. When using this setting, you need to regularly update your functions to keep their runtime up-to-date. - *Manual* - You specify a runtime version in your function configuration. The function will use this runtime version indefinitely. In the rare case where a new runtime version is incompatible with an existing function, this allows you to roll back your function to an earlier runtime version. For more information, see `Roll back a runtime version <https://docs.aws.amazon.com/lambda/latest/dg/runtimes-update.html#runtime-management-rollback>`_ . *Valid Values* : ``Auto`` | ``FunctionUpdate`` | ``Manual``
-            :param runtime_version_arn: The ARN of the runtime version you want the function to use. .. epigraph:: This is only required if you're using the *Manual* runtime update mode.
+            :param update_runtime_on: Specify the runtime update mode. - *Auto (default)* - Automatically update to the most recent and secure runtime version using a `Two-phase runtime version rollout <https://docs.aws.amazon.com/lambda/latest/dg/runtimes-update.html#runtime-management-two-phase>`_. This is the best choice for most customers to ensure they always benefit from runtime updates. - *FunctionUpdate* - LAM updates the runtime of you function to the most recent and secure runtime version when you update your function. This approach synchronizes runtime updates with function deployments, giving you control over when runtime updates are applied and allowing you to detect and mitigate rare runtime update incompatibilities early. When using this setting, you need to regularly update your functions to keep their runtime up-to-date. - *Manual* - You specify a runtime version in your function configuration. The function will use this runtime version indefinitely. In the rare case where a new runtime version is incompatible with an existing function, this allows you to roll back your function to an earlier runtime version. For more information, see `Roll back a runtime version <https://docs.aws.amazon.com/lambda/latest/dg/runtimes-update.html#runtime-management-rollback>`_. *Valid Values*: ``Auto`` | ``FunctionUpdate`` | ``Manual``
+            :param runtime_version_arn: The ARN of the runtime version you want the function to use. This is only required if you're using the *Manual* runtime update mode.
 
             :see: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-lambda-function-runtimemanagementconfig.html
             :exampleMetadata: fixture=_generated
@@ -7393,11 +7407,11 @@ class CfnFunction(
         def update_runtime_on(self) -> builtins.str:
             '''Specify the runtime update mode.
 
-            - *Auto (default)* - Automatically update to the most recent and secure runtime version using a `Two-phase runtime version rollout <https://docs.aws.amazon.com/lambda/latest/dg/runtimes-update.html#runtime-management-two-phase>`_ . This is the best choice for most customers to ensure they always benefit from runtime updates.
-            - *FunctionUpdate* - Lambda updates the runtime of you function to the most recent and secure runtime version when you update your function. This approach synchronizes runtime updates with function deployments, giving you control over when runtime updates are applied and allowing you to detect and mitigate rare runtime update incompatibilities early. When using this setting, you need to regularly update your functions to keep their runtime up-to-date.
-            - *Manual* - You specify a runtime version in your function configuration. The function will use this runtime version indefinitely. In the rare case where a new runtime version is incompatible with an existing function, this allows you to roll back your function to an earlier runtime version. For more information, see `Roll back a runtime version <https://docs.aws.amazon.com/lambda/latest/dg/runtimes-update.html#runtime-management-rollback>`_ .
+            - *Auto (default)* - Automatically update to the most recent and secure runtime version using a `Two-phase runtime version rollout <https://docs.aws.amazon.com/lambda/latest/dg/runtimes-update.html#runtime-management-two-phase>`_. This is the best choice for most customers to ensure they always benefit from runtime updates.
+            - *FunctionUpdate* - LAM updates the runtime of you function to the most recent and secure runtime version when you update your function. This approach synchronizes runtime updates with function deployments, giving you control over when runtime updates are applied and allowing you to detect and mitigate rare runtime update incompatibilities early. When using this setting, you need to regularly update your functions to keep their runtime up-to-date.
+            - *Manual* - You specify a runtime version in your function configuration. The function will use this runtime version indefinitely. In the rare case where a new runtime version is incompatible with an existing function, this allows you to roll back your function to an earlier runtime version. For more information, see `Roll back a runtime version <https://docs.aws.amazon.com/lambda/latest/dg/runtimes-update.html#runtime-management-rollback>`_.
 
-            *Valid Values* : ``Auto`` | ``FunctionUpdate`` | ``Manual``
+            *Valid Values*: ``Auto`` | ``FunctionUpdate`` | ``Manual``
 
             :see: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-lambda-function-runtimemanagementconfig.html#cfn-lambda-function-runtimemanagementconfig-updateruntimeon
             '''
@@ -7409,9 +7423,7 @@ class CfnFunction(
         def runtime_version_arn(self) -> typing.Optional[builtins.str]:
             '''The ARN of the runtime version you want the function to use.
 
-            .. epigraph::
-
-               This is only required if you're using the *Manual* runtime update mode.
+            This is only required if you're using the *Manual* runtime update mode.
 
             :see: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-lambda-function-runtimemanagementconfig.html#cfn-lambda-function-runtimemanagementconfig-runtimeversionarn
             '''
@@ -7436,7 +7448,7 @@ class CfnFunction(
     )
     class SnapStartProperty:
         def __init__(self, *, apply_on: builtins.str) -> None:
-            '''The function's `AWS Lambda SnapStart <https://docs.aws.amazon.com/lambda/latest/dg/snapstart.html>`_ setting.
+            '''The function's `SnapStart <https://docs.aws.amazon.com/lambda/latest/dg/snapstart.html>`_ setting.
 
             :param apply_on: Set ``ApplyOn`` to ``PublishedVersions`` to create a snapshot of the initialized execution environment when you publish a function version.
 
@@ -7498,8 +7510,8 @@ class CfnFunction(
         ) -> None:
             '''The function's `SnapStart <https://docs.aws.amazon.com/lambda/latest/dg/snapstart.html>`_ setting.
 
-            :param apply_on: When set to ``PublishedVersions`` , Lambda creates a snapshot of the execution environment when you publish a function version.
-            :param optimization_status: When you provide a `qualified Amazon Resource Name (ARN) <https://docs.aws.amazon.com/lambda/latest/dg/configuration-versions.html#versioning-versions-using>`_ , this response element indicates whether SnapStart is activated for the specified function version.
+            :param apply_on: When set to ``PublishedVersions``, Lambda creates a snapshot of the execution environment when you publish a function version.
+            :param optimization_status: When you provide a `qualified Amazon Resource Name (ARN) <https://docs.aws.amazon.com/lambda/latest/dg/configuration-versions.html#versioning-versions-using>`_, this response element indicates whether SnapStart is activated for the specified function version.
 
             :see: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-lambda-function-snapstartresponse.html
             :exampleMetadata: fixture=_generated
@@ -7527,7 +7539,7 @@ class CfnFunction(
 
         @builtins.property
         def apply_on(self) -> typing.Optional[builtins.str]:
-            '''When set to ``PublishedVersions`` , Lambda creates a snapshot of the execution environment when you publish a function version.
+            '''When set to ``PublishedVersions``, Lambda creates a snapshot of the execution environment when you publish a function version.
 
             :see: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-lambda-function-snapstartresponse.html#cfn-lambda-function-snapstartresponse-applyon
             '''
@@ -7536,7 +7548,7 @@ class CfnFunction(
 
         @builtins.property
         def optimization_status(self) -> typing.Optional[builtins.str]:
-            '''When you provide a `qualified Amazon Resource Name (ARN) <https://docs.aws.amazon.com/lambda/latest/dg/configuration-versions.html#versioning-versions-using>`_ , this response element indicates whether SnapStart is activated for the specified function version.
+            '''When you provide a `qualified Amazon Resource Name (ARN) <https://docs.aws.amazon.com/lambda/latest/dg/configuration-versions.html#versioning-versions-using>`_, this response element indicates whether SnapStart is activated for the specified function version.
 
             :see: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-lambda-function-snapstartresponse.html#cfn-lambda-function-snapstartresponse-optimizationstatus
             '''
@@ -7561,7 +7573,7 @@ class CfnFunction(
     )
     class TracingConfigProperty:
         def __init__(self, *, mode: typing.Optional[builtins.str] = None) -> None:
-            '''The function's `AWS X-Ray <https://docs.aws.amazon.com/lambda/latest/dg/services-xray.html>`_ tracing configuration. To sample and record incoming requests, set ``Mode`` to ``Active`` .
+            '''The function's ` <https://docs.aws.amazon.com/lambda/latest/dg/services-xray.html>`_ tracing configuration. To sample and record incoming requests, set ``Mode`` to ``Active``.
 
             :param mode: The tracing mode.
 
@@ -7624,12 +7636,9 @@ class CfnFunction(
         ) -> None:
             '''The VPC security groups and subnets that are attached to a Lambda function.
 
-            When you connect a function to a VPC, Lambda creates an elastic network interface for each combination of security group and subnet in the function's VPC configuration. The function can only access resources and the internet through that VPC. For more information, see `VPC Settings <https://docs.aws.amazon.com/lambda/latest/dg/configuration-vpc.html>`_ .
-            .. epigraph::
-
-               When you delete a function, AWS CloudFormation monitors the state of its network interfaces and waits for Lambda to delete them before proceeding. If the VPC is defined in the same stack, the network interfaces need to be deleted by Lambda before AWS CloudFormation can delete the VPC's resources.
-
-               To monitor network interfaces, AWS CloudFormation needs the ``ec2:DescribeNetworkInterfaces`` permission. It obtains this from the user or role that modifies the stack. If you don't provide this permission, AWS CloudFormation does not wait for network interfaces to be deleted.
+            When you connect a function to a VPC, Lambda creates an elastic network interface for each combination of security group and subnet in the function's VPC configuration. The function can only access resources and the internet through that VPC. For more information, see `VPC Settings <https://docs.aws.amazon.com/lambda/latest/dg/configuration-vpc.html>`_.
+            When you delete a function, CFN monitors the state of its network interfaces and waits for Lambda to delete them before proceeding. If the VPC is defined in the same stack, the network interfaces need to be deleted by Lambda before CFN can delete the VPC's resources.
+            To monitor network interfaces, CFN needs the ``ec2:DescribeNetworkInterfaces`` permission. It obtains this from the user or role that modifies the stack. If you don't provide this permission, CFN does not wait for network interfaces to be deleted.
 
             :param ipv6_allowed_for_dual_stack: Allows outbound IPv6 traffic on VPC functions that are connected to dual-stack subnets.
             :param security_group_ids: A list of VPC security group IDs.
@@ -7725,6 +7734,7 @@ class CfnFunction(
         "logging_config": "loggingConfig",
         "memory_size": "memorySize",
         "package_type": "packageType",
+        "recursive_loop": "recursiveLoop",
         "reserved_concurrent_executions": "reservedConcurrentExecutions",
         "runtime": "runtime",
         "runtime_management_config": "runtimeManagementConfig",
@@ -7756,6 +7766,7 @@ class CfnFunctionProps:
         logging_config: typing.Optional[typing.Union[_IResolvable_da3f097b, typing.Union[CfnFunction.LoggingConfigProperty, typing.Dict[builtins.str, typing.Any]]]] = None,
         memory_size: typing.Optional[jsii.Number] = None,
         package_type: typing.Optional[builtins.str] = None,
+        recursive_loop: typing.Optional[builtins.str] = None,
         reserved_concurrent_executions: typing.Optional[jsii.Number] = None,
         runtime: typing.Optional[builtins.str] = None,
         runtime_management_config: typing.Optional[typing.Union[_IResolvable_da3f097b, typing.Union[CfnFunction.RuntimeManagementConfigProperty, typing.Dict[builtins.str, typing.Any]]]] = None,
@@ -7767,31 +7778,32 @@ class CfnFunctionProps:
     ) -> None:
         '''Properties for defining a ``CfnFunction``.
 
-        :param code: The code for the function.
+        :param code: The `deployment package <https://docs.aws.amazon.com/lambda/latest/dg/gettingstarted-package.html>`_ for a Lambda function. To deploy a function defined as a container image, you specify the location of a container image in the Amazon ECR registry. For a .zip file deployment package, you can specify the location of an object in Amazon S3. For Node.js and Python functions, you can specify the function code inline in the template. Changes to a deployment package in Amazon S3 or a container image in ECR are not detected automatically during stack updates. To update the function code, change the object key or version in the template.
         :param role: The Amazon Resource Name (ARN) of the function's execution role.
-        :param architectures: The instruction set architecture that the function supports. Enter a string array with one of the valid values (arm64 or x86_64). The default value is ``x86_64`` .
+        :param architectures: The instruction set architecture that the function supports. Enter a string array with one of the valid values (arm64 or x86_64). The default value is ``x86_64``.
         :param code_signing_config_arn: To enable code signing for this function, specify the ARN of a code-signing configuration. A code-signing configuration includes a set of signing profiles, which define the trusted publishers for this function.
-        :param dead_letter_config: A dead-letter queue configuration that specifies the queue or topic where Lambda sends asynchronous events when they fail processing. For more information, see `Dead-letter queues <https://docs.aws.amazon.com/lambda/latest/dg/invocation-async.html#invocation-dlq>`_ .
+        :param dead_letter_config: The `dead-letter queue <https://docs.aws.amazon.com/lambda/latest/dg/invocation-async.html#dlq>`_ for failed asynchronous invocations.
         :param description: A description of the function.
-        :param environment: Environment variables that are accessible from function code during execution.
+        :param environment: A function's environment variable settings. You can use environment variables to adjust your function's behavior without updating code. An environment variable is a pair of strings that are stored in a function's version-specific configuration.
         :param ephemeral_storage: The size of the function's ``/tmp`` directory in MB. The default value is 512, but it can be any whole number between 512 and 10,240 MB.
-        :param file_system_configs: Connection settings for an Amazon EFS file system. To connect a function to a file system, a mount target must be available in every Availability Zone that your function connects to. If your template contains an `AWS::EFS::MountTarget <https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-efs-mounttarget.html>`_ resource, you must also specify a ``DependsOn`` attribute to ensure that the mount target is created or updated before the function. For more information about using the ``DependsOn`` attribute, see `DependsOn Attribute <https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-attribute-dependson.html>`_ .
-        :param function_name: The name of the Lambda function, up to 64 characters in length. If you don't specify a name, AWS CloudFormation generates one. If you specify a name, you cannot perform updates that require replacement of this resource. You can perform updates that require no or some interruption. If you must replace the resource, specify a new name.
-        :param handler: The name of the method within your code that Lambda calls to run your function. Handler is required if the deployment package is a .zip file archive. The format includes the file name. It can also include namespaces and other qualifiers, depending on the runtime. For more information, see `Lambda programming model <https://docs.aws.amazon.com/lambda/latest/dg/foundation-progmodel.html>`_ .
-        :param image_config: Configuration values that override the container image Dockerfile settings. For more information, see `Container image settings <https://docs.aws.amazon.com/lambda/latest/dg/images-create.html#images-parms>`_ .
-        :param kms_key_arn: The ARN of the AWS Key Management Service ( AWS KMS ) customer managed key that's used to encrypt your function's `environment variables <https://docs.aws.amazon.com/lambda/latest/dg/configuration-envvars.html#configuration-envvars-encryption>`_ . When `Lambda SnapStart <https://docs.aws.amazon.com/lambda/latest/dg/snapstart-security.html>`_ is activated, Lambda also uses this key is to encrypt your function's snapshot. If you deploy your function using a container image, Lambda also uses this key to encrypt your function when it's deployed. Note that this is not the same key that's used to protect your container image in the Amazon Elastic Container Registry (Amazon ECR). If you don't provide a customer managed key, Lambda uses a default service key.
+        :param file_system_configs: Connection settings for an Amazon EFS file system. To connect a function to a file system, a mount target must be available in every Availability Zone that your function connects to. If your template contains an `AWS::EFS::MountTarget <https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-efs-mounttarget.html>`_ resource, you must also specify a ``DependsOn`` attribute to ensure that the mount target is created or updated before the function. For more information about using the ``DependsOn`` attribute, see `DependsOn Attribute <https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-attribute-dependson.html>`_.
+        :param function_name: The name of the Lambda function, up to 64 characters in length. If you don't specify a name, CFN generates one. If you specify a name, you cannot perform updates that require replacement of this resource. You can perform updates that require no or some interruption. If you must replace the resource, specify a new name.
+        :param handler: The name of the method within your code that Lambda calls to run your function. Handler is required if the deployment package is a .zip file archive. The format includes the file name. It can also include namespaces and other qualifiers, depending on the runtime. For more information, see `Lambda programming model <https://docs.aws.amazon.com/lambda/latest/dg/foundation-progmodel.html>`_.
+        :param image_config: Configuration values that override the container image Dockerfile settings. For more information, see `Container image settings <https://docs.aws.amazon.com/lambda/latest/dg/images-create.html#images-parms>`_.
+        :param kms_key_arn: The ARN of the KMSlong (KMS) customer managed key that's used to encrypt your function's `environment variables <https://docs.aws.amazon.com/lambda/latest/dg/configuration-envvars.html#configuration-envvars-encryption>`_. When `Lambda SnapStart <https://docs.aws.amazon.com/lambda/latest/dg/snapstart-security.html>`_ is activated, Lambda also uses this key is to encrypt your function's snapshot. If you deploy your function using a container image, Lambda also uses this key to encrypt your function when it's deployed. Note that this is not the same key that's used to protect your container image in the Amazon Elastic Container Registry (Amazon ECR). If you don't provide a customer managed key, Lambda uses a default service key.
         :param layers: A list of `function layers <https://docs.aws.amazon.com/lambda/latest/dg/configuration-layers.html>`_ to add to the function's execution environment. Specify each layer by its ARN, including the version.
         :param logging_config: The function's Amazon CloudWatch Logs configuration settings.
         :param memory_size: The amount of `memory available to the function <https://docs.aws.amazon.com/lambda/latest/dg/configuration-function-common.html#configuration-memory-console>`_ at runtime. Increasing the function memory also increases its CPU allocation. The default value is 128 MB. The value can be any multiple of 1 MB. Note that new AWS accounts have reduced concurrency and memory quotas. AWS raises these quotas automatically based on your usage. You can also request a quota increase.
         :param package_type: The type of deployment package. Set to ``Image`` for container image and set ``Zip`` for .zip file archive.
+        :param recursive_loop: This property is set to terminate unintended recursions. If set to ``Terminate``, Lambda detects and terminates unitended recursive loops. If set to ``Allow`` Lambda lets recursions be and does not terminate it.
         :param reserved_concurrent_executions: The number of simultaneous executions to reserve for the function.
-        :param runtime: The identifier of the function's `runtime <https://docs.aws.amazon.com/lambda/latest/dg/lambda-runtimes.html>`_ . Runtime is required if the deployment package is a .zip file archive. Specifying a runtime results in an error if you're deploying a function using a container image. The following list includes deprecated runtimes. Lambda blocks creating new functions and updating existing functions shortly after each runtime is deprecated. For more information, see `Runtime use after deprecation <https://docs.aws.amazon.com/lambda/latest/dg/lambda-runtimes.html#runtime-deprecation-levels>`_ . For a list of all currently supported runtimes, see `Supported runtimes <https://docs.aws.amazon.com/lambda/latest/dg/lambda-runtimes.html#runtimes-supported>`_ .
-        :param runtime_management_config: Sets the runtime management configuration for a function's version. For more information, see `Runtime updates <https://docs.aws.amazon.com/lambda/latest/dg/runtimes-update.html>`_ .
-        :param snap_start: The function's `AWS Lambda SnapStart <https://docs.aws.amazon.com/lambda/latest/dg/snapstart.html>`_ setting.
+        :param runtime: The identifier of the function's `runtime <https://docs.aws.amazon.com/lambda/latest/dg/lambda-runtimes.html>`_. Runtime is required if the deployment package is a .zip file archive. Specifying a runtime results in an error if you're deploying a function using a container image. The following list includes deprecated runtimes. Lambda blocks creating new functions and updating existing functions shortly after each runtime is deprecated. For more information, see `Runtime use after deprecation <https://docs.aws.amazon.com/lambda/latest/dg/lambda-runtimes.html#runtime-deprecation-levels>`_. For a list of all currently supported runtimes, see `Supported runtimes <https://docs.aws.amazon.com/lambda/latest/dg/lambda-runtimes.html#runtimes-supported>`_.
+        :param runtime_management_config: Sets the runtime management configuration for a function's version. For more information, see `Runtime updates <https://docs.aws.amazon.com/lambda/latest/dg/runtimes-update.html>`_.
+        :param snap_start: The function's `SnapStart <https://docs.aws.amazon.com/lambda/latest/dg/snapstart.html>`_ setting.
         :param tags: A list of `tags <https://docs.aws.amazon.com/lambda/latest/dg/tagging.html>`_ to apply to the function.
-        :param timeout: The amount of time (in seconds) that Lambda allows a function to run before stopping it. The default is 3 seconds. The maximum allowed value is 900 seconds. For more information, see `Lambda execution environment <https://docs.aws.amazon.com/lambda/latest/dg/runtimes-context.html>`_ .
-        :param tracing_config: Set ``Mode`` to ``Active`` to sample and trace a subset of incoming requests with `X-Ray <https://docs.aws.amazon.com/lambda/latest/dg/services-xray.html>`_ .
-        :param vpc_config: For network connectivity to AWS resources in a VPC, specify a list of security groups and subnets in the VPC. When you connect a function to a VPC, it can access resources and the internet only through that VPC. For more information, see `Configuring a Lambda function to access resources in a VPC <https://docs.aws.amazon.com/lambda/latest/dg/configuration-vpc.html>`_ .
+        :param timeout: The amount of time (in seconds) that Lambda allows a function to run before stopping it. The default is 3 seconds. The maximum allowed value is 900 seconds. For more information, see `Lambda execution environment <https://docs.aws.amazon.com/lambda/latest/dg/runtimes-context.html>`_.
+        :param tracing_config: The function's ` <https://docs.aws.amazon.com/lambda/latest/dg/services-xray.html>`_ tracing configuration. To sample and record incoming requests, set ``Mode`` to ``Active``.
+        :param vpc_config: The VPC security groups and subnets that are attached to a Lambda function. When you connect a function to a VPC, Lambda creates an elastic network interface for each combination of security group and subnet in the function's VPC configuration. The function can only access resources and the internet through that VPC. For more information, see `VPC Settings <https://docs.aws.amazon.com/lambda/latest/dg/configuration-vpc.html>`_. When you delete a function, CFN monitors the state of its network interfaces and waits for Lambda to delete them before proceeding. If the VPC is defined in the same stack, the network interfaces need to be deleted by Lambda before CFN can delete the VPC's resources. To monitor network interfaces, CFN needs the ``ec2:DescribeNetworkInterfaces`` permission. It obtains this from the user or role that modifies the stack. If you don't provide this permission, CFN does not wait for network interfaces to be deleted.
 
         :see: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-lambda-function.html
         :exampleMetadata: fixture=_generated
@@ -7848,6 +7860,7 @@ class CfnFunctionProps:
                 ),
                 memory_size=123,
                 package_type="packageType",
+                recursive_loop="recursiveLoop",
                 reserved_concurrent_executions=123,
                 runtime="runtime",
                 runtime_management_config=lambda.CfnFunction.RuntimeManagementConfigProperty(
@@ -7893,6 +7906,7 @@ class CfnFunctionProps:
             check_type(argname="argument logging_config", value=logging_config, expected_type=type_hints["logging_config"])
             check_type(argname="argument memory_size", value=memory_size, expected_type=type_hints["memory_size"])
             check_type(argname="argument package_type", value=package_type, expected_type=type_hints["package_type"])
+            check_type(argname="argument recursive_loop", value=recursive_loop, expected_type=type_hints["recursive_loop"])
             check_type(argname="argument reserved_concurrent_executions", value=reserved_concurrent_executions, expected_type=type_hints["reserved_concurrent_executions"])
             check_type(argname="argument runtime", value=runtime, expected_type=type_hints["runtime"])
             check_type(argname="argument runtime_management_config", value=runtime_management_config, expected_type=type_hints["runtime_management_config"])
@@ -7935,6 +7949,8 @@ class CfnFunctionProps:
             self._values["memory_size"] = memory_size
         if package_type is not None:
             self._values["package_type"] = package_type
+        if recursive_loop is not None:
+            self._values["recursive_loop"] = recursive_loop
         if reserved_concurrent_executions is not None:
             self._values["reserved_concurrent_executions"] = reserved_concurrent_executions
         if runtime is not None:
@@ -7954,7 +7970,7 @@ class CfnFunctionProps:
 
     @builtins.property
     def code(self) -> typing.Union[_IResolvable_da3f097b, CfnFunction.CodeProperty]:
-        '''The code for the function.
+        '''The `deployment package <https://docs.aws.amazon.com/lambda/latest/dg/gettingstarted-package.html>`_ for a Lambda function. To deploy a function defined as a container image, you specify the location of a container image in the Amazon ECR registry. For a .zip file deployment package, you can specify the location of an object in Amazon S3. For Node.js and Python functions, you can specify the function code inline in the template.  Changes to a deployment package in Amazon S3 or a container image in ECR are not detected automatically during stack updates. To update the function code, change the object key or version in the template.
 
         :see: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-lambda-function.html#cfn-lambda-function-code
         '''
@@ -7976,7 +7992,7 @@ class CfnFunctionProps:
     def architectures(self) -> typing.Optional[typing.List[builtins.str]]:
         '''The instruction set architecture that the function supports.
 
-        Enter a string array with one of the valid values (arm64 or x86_64). The default value is ``x86_64`` .
+        Enter a string array with one of the valid values (arm64 or x86_64). The default value is ``x86_64``.
 
         :see: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-lambda-function.html#cfn-lambda-function-architectures
         '''
@@ -7987,8 +8003,7 @@ class CfnFunctionProps:
     def code_signing_config_arn(self) -> typing.Optional[builtins.str]:
         '''To enable code signing for this function, specify the ARN of a code-signing configuration.
 
-        A code-signing configuration
-        includes a set of signing profiles, which define the trusted publishers for this function.
+        A code-signing configuration includes a set of signing profiles, which define the trusted publishers for this function.
 
         :see: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-lambda-function.html#cfn-lambda-function-codesigningconfigarn
         '''
@@ -7999,9 +8014,7 @@ class CfnFunctionProps:
     def dead_letter_config(
         self,
     ) -> typing.Optional[typing.Union[_IResolvable_da3f097b, CfnFunction.DeadLetterConfigProperty]]:
-        '''A dead-letter queue configuration that specifies the queue or topic where Lambda sends asynchronous events when they fail processing.
-
-        For more information, see `Dead-letter queues <https://docs.aws.amazon.com/lambda/latest/dg/invocation-async.html#invocation-dlq>`_ .
+        '''The `dead-letter queue <https://docs.aws.amazon.com/lambda/latest/dg/invocation-async.html#dlq>`_ for failed asynchronous invocations.
 
         :see: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-lambda-function.html#cfn-lambda-function-deadletterconfig
         '''
@@ -8021,7 +8034,9 @@ class CfnFunctionProps:
     def environment(
         self,
     ) -> typing.Optional[typing.Union[_IResolvable_da3f097b, CfnFunction.EnvironmentProperty]]:
-        '''Environment variables that are accessible from function code during execution.
+        '''A function's environment variable settings.
+
+        You can use environment variables to adjust your function's behavior without updating code. An environment variable is a pair of strings that are stored in a function's version-specific configuration.
 
         :see: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-lambda-function.html#cfn-lambda-function-environment
         '''
@@ -8048,8 +8063,7 @@ class CfnFunctionProps:
         '''Connection settings for an Amazon EFS file system.
 
         To connect a function to a file system, a mount target must be available in every Availability Zone that your function connects to. If your template contains an `AWS::EFS::MountTarget <https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-efs-mounttarget.html>`_ resource, you must also specify a ``DependsOn`` attribute to ensure that the mount target is created or updated before the function.
-
-        For more information about using the ``DependsOn`` attribute, see `DependsOn Attribute <https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-attribute-dependson.html>`_ .
+        For more information about using the ``DependsOn`` attribute, see `DependsOn Attribute <https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-attribute-dependson.html>`_.
 
         :see: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-lambda-function.html#cfn-lambda-function-filesystemconfigs
         '''
@@ -8060,8 +8074,7 @@ class CfnFunctionProps:
     def function_name(self) -> typing.Optional[builtins.str]:
         '''The name of the Lambda function, up to 64 characters in length.
 
-        If you don't specify a name, AWS CloudFormation generates one.
-
+        If you don't specify a name, CFN generates one.
         If you specify a name, you cannot perform updates that require replacement of this resource. You can perform updates that require no or some interruption. If you must replace the resource, specify a new name.
 
         :see: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-lambda-function.html#cfn-lambda-function-functionname
@@ -8073,7 +8086,7 @@ class CfnFunctionProps:
     def handler(self) -> typing.Optional[builtins.str]:
         '''The name of the method within your code that Lambda calls to run your function.
 
-        Handler is required if the deployment package is a .zip file archive. The format includes the file name. It can also include namespaces and other qualifiers, depending on the runtime. For more information, see `Lambda programming model <https://docs.aws.amazon.com/lambda/latest/dg/foundation-progmodel.html>`_ .
+        Handler is required if the deployment package is a .zip file archive. The format includes the file name. It can also include namespaces and other qualifiers, depending on the runtime. For more information, see `Lambda programming model <https://docs.aws.amazon.com/lambda/latest/dg/foundation-progmodel.html>`_.
 
         :see: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-lambda-function.html#cfn-lambda-function-handler
         '''
@@ -8086,7 +8099,7 @@ class CfnFunctionProps:
     ) -> typing.Optional[typing.Union[_IResolvable_da3f097b, CfnFunction.ImageConfigProperty]]:
         '''Configuration values that override the container image Dockerfile settings.
 
-        For more information, see `Container image settings <https://docs.aws.amazon.com/lambda/latest/dg/images-create.html#images-parms>`_ .
+        For more information, see `Container image settings <https://docs.aws.amazon.com/lambda/latest/dg/images-create.html#images-parms>`_.
 
         :see: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-lambda-function.html#cfn-lambda-function-imageconfig
         '''
@@ -8095,7 +8108,7 @@ class CfnFunctionProps:
 
     @builtins.property
     def kms_key_arn(self) -> typing.Optional[builtins.str]:
-        '''The ARN of the AWS Key Management Service ( AWS KMS ) customer managed key that's used to encrypt your function's `environment variables <https://docs.aws.amazon.com/lambda/latest/dg/configuration-envvars.html#configuration-envvars-encryption>`_ . When `Lambda SnapStart <https://docs.aws.amazon.com/lambda/latest/dg/snapstart-security.html>`_ is activated, Lambda also uses this key is to encrypt your function's snapshot. If you deploy your function using a container image, Lambda also uses this key to encrypt your function when it's deployed. Note that this is not the same key that's used to protect your container image in the Amazon Elastic Container Registry (Amazon ECR). If you don't provide a customer managed key, Lambda uses a default service key.
+        '''The ARN of the KMSlong (KMS) customer managed key that's used to encrypt your function's `environment variables <https://docs.aws.amazon.com/lambda/latest/dg/configuration-envvars.html#configuration-envvars-encryption>`_. When `Lambda SnapStart <https://docs.aws.amazon.com/lambda/latest/dg/snapstart-security.html>`_ is activated, Lambda also uses this key is to encrypt your function's snapshot. If you deploy your function using a container image, Lambda also uses this key to encrypt your function when it's deployed. Note that this is not the same key that's used to protect your container image in the Amazon Elastic Container Registry (Amazon ECR). If you don't provide a customer managed key, Lambda uses a default service key.
 
         :see: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-lambda-function.html#cfn-lambda-function-kmskeyarn
         '''
@@ -8142,6 +8155,17 @@ class CfnFunctionProps:
         result = self._values.get("package_type")
         return typing.cast(typing.Optional[builtins.str], result)
 
+    @builtins.property
+    def recursive_loop(self) -> typing.Optional[builtins.str]:
+        '''This property is set to terminate unintended recursions.
+
+        If set to ``Terminate``, Lambda detects and terminates unitended recursive loops. If set to ``Allow`` Lambda lets recursions be and does not terminate it.
+
+        :see: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-lambda-function.html#cfn-lambda-function-recursiveloop
+        '''
+        result = self._values.get("recursive_loop")
+        return typing.cast(typing.Optional[builtins.str], result)
+
     @builtins.property
     def reserved_concurrent_executions(self) -> typing.Optional[jsii.Number]:
         '''The number of simultaneous executions to reserve for the function.
@@ -8153,11 +8177,7 @@ class CfnFunctionProps:
 
     @builtins.property
     def runtime(self) -> typing.Optional[builtins.str]:
-        '''The identifier of the function's `runtime <https://docs.aws.amazon.com/lambda/latest/dg/lambda-runtimes.html>`_ . Runtime is required if the deployment package is a .zip file archive. Specifying a runtime results in an error if you're deploying a function using a container image.
-
-        The following list includes deprecated runtimes. Lambda blocks creating new functions and updating existing functions shortly after each runtime is deprecated. For more information, see `Runtime use after deprecation <https://docs.aws.amazon.com/lambda/latest/dg/lambda-runtimes.html#runtime-deprecation-levels>`_ .
-
-        For a list of all currently supported runtimes, see `Supported runtimes <https://docs.aws.amazon.com/lambda/latest/dg/lambda-runtimes.html#runtimes-supported>`_ .
+        '''The identifier of the function's `runtime <https://docs.aws.amazon.com/lambda/latest/dg/lambda-runtimes.html>`_. Runtime is required if the deployment package is a .zip file archive. Specifying a runtime results in an error if you're deploying a function using a container image.  The following list includes deprecated runtimes. Lambda blocks creating new functions and updating existing functions shortly after each runtime is deprecated. For more information, see `Runtime use after deprecation <https://docs.aws.amazon.com/lambda/latest/dg/lambda-runtimes.html#runtime-deprecation-levels>`_.  For a list of all currently supported runtimes, see `Supported runtimes <https://docs.aws.amazon.com/lambda/latest/dg/lambda-runtimes.html#runtimes-supported>`_.
 
         :see: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-lambda-function.html#cfn-lambda-function-runtime
         '''
@@ -8170,7 +8190,7 @@ class CfnFunctionProps:
     ) -> typing.Optional[typing.Union[_IResolvable_da3f097b, CfnFunction.RuntimeManagementConfigProperty]]:
         '''Sets the runtime management configuration for a function's version.
 
-        For more information, see `Runtime updates <https://docs.aws.amazon.com/lambda/latest/dg/runtimes-update.html>`_ .
+        For more information, see `Runtime updates <https://docs.aws.amazon.com/lambda/latest/dg/runtimes-update.html>`_.
 
         :see: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-lambda-function.html#cfn-lambda-function-runtimemanagementconfig
         '''
@@ -8181,7 +8201,7 @@ class CfnFunctionProps:
     def snap_start(
         self,
     ) -> typing.Optional[typing.Union[_IResolvable_da3f097b, CfnFunction.SnapStartProperty]]:
-        '''The function's `AWS Lambda SnapStart <https://docs.aws.amazon.com/lambda/latest/dg/snapstart.html>`_ setting.
+        '''The function's `SnapStart <https://docs.aws.amazon.com/lambda/latest/dg/snapstart.html>`_ setting.
 
         :see: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-lambda-function.html#cfn-lambda-function-snapstart
         '''
@@ -8201,7 +8221,7 @@ class CfnFunctionProps:
     def timeout(self) -> typing.Optional[jsii.Number]:
         '''The amount of time (in seconds) that Lambda allows a function to run before stopping it.
 
-        The default is 3 seconds. The maximum allowed value is 900 seconds. For more information, see `Lambda execution environment <https://docs.aws.amazon.com/lambda/latest/dg/runtimes-context.html>`_ .
+        The default is 3 seconds. The maximum allowed value is 900 seconds. For more information, see `Lambda execution environment <https://docs.aws.amazon.com/lambda/latest/dg/runtimes-context.html>`_.
 
         :see: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-lambda-function.html#cfn-lambda-function-timeout
         '''
@@ -8212,7 +8232,7 @@ class CfnFunctionProps:
     def tracing_config(
         self,
     ) -> typing.Optional[typing.Union[_IResolvable_da3f097b, CfnFunction.TracingConfigProperty]]:
-        '''Set ``Mode`` to ``Active`` to sample and trace a subset of incoming requests with `X-Ray <https://docs.aws.amazon.com/lambda/latest/dg/services-xray.html>`_ .
+        '''The function's ` <https://docs.aws.amazon.com/lambda/latest/dg/services-xray.html>`_ tracing configuration. To sample and record incoming requests, set ``Mode`` to ``Active``.
 
         :see: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-lambda-function.html#cfn-lambda-function-tracingconfig
         '''
@@ -8223,9 +8243,11 @@ class CfnFunctionProps:
     def vpc_config(
         self,
     ) -> typing.Optional[typing.Union[_IResolvable_da3f097b, CfnFunction.VpcConfigProperty]]:
-        '''For network connectivity to AWS resources in a VPC, specify a list of security groups and subnets in the VPC.
+        '''The VPC security groups and subnets that are attached to a Lambda function.
 
-        When you connect a function to a VPC, it can access resources and the internet only through that VPC. For more information, see `Configuring a Lambda function to access resources in a VPC <https://docs.aws.amazon.com/lambda/latest/dg/configuration-vpc.html>`_ .
+        When you connect a function to a VPC, Lambda creates an elastic network interface for each combination of security group and subnet in the function's VPC configuration. The function can only access resources and the internet through that VPC. For more information, see `VPC Settings <https://docs.aws.amazon.com/lambda/latest/dg/configuration-vpc.html>`_.
+        When you delete a function, CFN monitors the state of its network interfaces and waits for Lambda to delete them before proceeding. If the VPC is defined in the same stack, the network interfaces need to be deleted by Lambda before CFN can delete the VPC's resources.
+        To monitor network interfaces, CFN needs the ``ec2:DescribeNetworkInterfaces`` permission. It obtains this from the user or role that modifies the stack. If you don't provide this permission, CFN does not wait for network interfaces to be deleted.
 
         :see: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-lambda-function.html#cfn-lambda-function-vpcconfig
         '''
@@ -12584,6 +12606,7 @@ class EventInvokeConfigProps(EventInvokeConfigOptions):
         "bisect_batch_on_error": "bisectBatchOnError",
         "enabled": "enabled",
         "event_source_arn": "eventSourceArn",
+        "filter_encryption": "filterEncryption",
         "filters": "filters",
         "kafka_bootstrap_servers": "kafkaBootstrapServers",
         "kafka_consumer_group_id": "kafkaConsumerGroupId",
@@ -12610,6 +12633,7 @@ class EventSourceMappingOptions:
         bisect_batch_on_error: typing.Optional[builtins.bool] = None,
         enabled: typing.Optional[builtins.bool] = None,
         event_source_arn: typing.Optional[builtins.str] = None,
+        filter_encryption: typing.Optional[_IKey_5f11635f] = None,
         filters: typing.Optional[typing.Sequence[typing.Mapping[builtins.str, typing.Any]]] = None,
         kafka_bootstrap_servers: typing.Optional[typing.Sequence[builtins.str]] = None,
         kafka_consumer_group_id: typing.Optional[builtins.str] = None,
@@ -12632,6 +12656,7 @@ class EventSourceMappingOptions:
         :param bisect_batch_on_error: If the function returns an error, split the batch in two and retry. Default: false
         :param enabled: Set to false to disable the event source upon creation. Default: true
         :param event_source_arn: The Amazon Resource Name (ARN) of the event source. Any record added to this stream can invoke the Lambda function. Default: - not set if using a self managed Kafka cluster, throws an error otherwise
+        :param filter_encryption: Add Customer managed KMS key to encrypt Filter Criteria. Default: - none
         :param filters: Add filter criteria to Event Source. Default: - none
         :param kafka_bootstrap_servers: A list of host and port pairs that are the addresses of the Kafka brokers in a self managed "bootstrap" Kafka cluster that a Kafka client connects to initially to bootstrap itself. They are in the format ``abc.example.com:9096``. Default: - none
         :param kafka_consumer_group_id: The identifier for the Kafka consumer group to join. The consumer group ID must be unique among all your Kafka event sources. After creating a Kafka event source mapping with the consumer group ID specified, you cannot update this value. The value must have a lenght between 1 and 200 and full the pattern '[a-zA-Z0-9-/*:_+=.@-]*'. For more information, see `Customizable consumer group ID <https://docs.aws.amazon.com/lambda/latest/dg/with-msk.html#services-msk-consumer-group-id>`_. Default: - none
@@ -12656,10 +12681,12 @@ class EventSourceMappingOptions:
             # The code below shows an example of how to instantiate this type.
             # The values are placeholders you should change.
             import aws_cdk as cdk
+            from aws_cdk import aws_kms as kms
             from aws_cdk import aws_lambda as lambda_
             
             # event_source_dlq: lambda.IEventSourceDlq
             # filters: Any
+            # key: kms.Key
             # source_access_configuration_type: lambda.SourceAccessConfigurationType
             
             event_source_mapping_options = lambda.EventSourceMappingOptions(
@@ -12667,6 +12694,7 @@ class EventSourceMappingOptions:
                 bisect_batch_on_error=False,
                 enabled=False,
                 event_source_arn="eventSourceArn",
+                filter_encryption=key,
                 filters=[{
                     "filters_key": filters
                 }],
@@ -12696,6 +12724,7 @@ class EventSourceMappingOptions:
             check_type(argname="argument bisect_batch_on_error", value=bisect_batch_on_error, expected_type=type_hints["bisect_batch_on_error"])
             check_type(argname="argument enabled", value=enabled, expected_type=type_hints["enabled"])
             check_type(argname="argument event_source_arn", value=event_source_arn, expected_type=type_hints["event_source_arn"])
+            check_type(argname="argument filter_encryption", value=filter_encryption, expected_type=type_hints["filter_encryption"])
             check_type(argname="argument filters", value=filters, expected_type=type_hints["filters"])
             check_type(argname="argument kafka_bootstrap_servers", value=kafka_bootstrap_servers, expected_type=type_hints["kafka_bootstrap_servers"])
             check_type(argname="argument kafka_consumer_group_id", value=kafka_consumer_group_id, expected_type=type_hints["kafka_consumer_group_id"])
@@ -12721,6 +12750,8 @@ class EventSourceMappingOptions:
             self._values["enabled"] = enabled
         if event_source_arn is not None:
             self._values["event_source_arn"] = event_source_arn
+        if filter_encryption is not None:
+            self._values["filter_encryption"] = filter_encryption
         if filters is not None:
             self._values["filters"] = filters
         if kafka_bootstrap_servers is not None:
@@ -12801,6 +12832,17 @@ class EventSourceMappingOptions:
         result = self._values.get("event_source_arn")
         return typing.cast(typing.Optional[builtins.str], result)
 
+    @builtins.property
+    def filter_encryption(self) -> typing.Optional[_IKey_5f11635f]:
+        '''Add Customer managed KMS key to encrypt Filter Criteria.
+
+        :default: - none
+
+        :see: https://docs.aws.amazon.com/kms/latest/developerguide/concepts.html#aws-managed-cmk
+        '''
+        result = self._values.get("filter_encryption")
+        return typing.cast(typing.Optional[_IKey_5f11635f], result)
+
     @builtins.property
     def filters(
         self,
@@ -13017,6 +13059,7 @@ class EventSourceMappingOptions:
         "bisect_batch_on_error": "bisectBatchOnError",
         "enabled": "enabled",
         "event_source_arn": "eventSourceArn",
+        "filter_encryption": "filterEncryption",
         "filters": "filters",
         "kafka_bootstrap_servers": "kafkaBootstrapServers",
         "kafka_consumer_group_id": "kafkaConsumerGroupId",
@@ -13044,6 +13087,7 @@ class EventSourceMappingProps(EventSourceMappingOptions):
         bisect_batch_on_error: typing.Optional[builtins.bool] = None,
         enabled: typing.Optional[builtins.bool] = None,
         event_source_arn: typing.Optional[builtins.str] = None,
+        filter_encryption: typing.Optional[_IKey_5f11635f] = None,
         filters: typing.Optional[typing.Sequence[typing.Mapping[builtins.str, typing.Any]]] = None,
         kafka_bootstrap_servers: typing.Optional[typing.Sequence[builtins.str]] = None,
         kafka_consumer_group_id: typing.Optional[builtins.str] = None,
@@ -13068,6 +13112,7 @@ class EventSourceMappingProps(EventSourceMappingOptions):
         :param bisect_batch_on_error: If the function returns an error, split the batch in two and retry. Default: false
         :param enabled: Set to false to disable the event source upon creation. Default: true
         :param event_source_arn: The Amazon Resource Name (ARN) of the event source. Any record added to this stream can invoke the Lambda function. Default: - not set if using a self managed Kafka cluster, throws an error otherwise
+        :param filter_encryption: Add Customer managed KMS key to encrypt Filter Criteria. Default: - none
         :param filters: Add filter criteria to Event Source. Default: - none
         :param kafka_bootstrap_servers: A list of host and port pairs that are the addresses of the Kafka brokers in a self managed "bootstrap" Kafka cluster that a Kafka client connects to initially to bootstrap itself. They are in the format ``abc.example.com:9096``. Default: - none
         :param kafka_consumer_group_id: The identifier for the Kafka consumer group to join. The consumer group ID must be unique among all your Kafka event sources. After creating a Kafka event source mapping with the consumer group ID specified, you cannot update this value. The value must have a lenght between 1 and 200 and full the pattern '[a-zA-Z0-9-/*:_+=.@-]*'. For more information, see `Customizable consumer group ID <https://docs.aws.amazon.com/lambda/latest/dg/with-msk.html#services-msk-consumer-group-id>`_. Default: - none
@@ -13093,11 +13138,13 @@ class EventSourceMappingProps(EventSourceMappingOptions):
             # The code below shows an example of how to instantiate this type.
             # The values are placeholders you should change.
             import aws_cdk as cdk
+            from aws_cdk import aws_kms as kms
             from aws_cdk import aws_lambda as lambda_
             
             # event_source_dlq: lambda.IEventSourceDlq
             # filters: Any
             # function_: lambda.Function
+            # key: kms.Key
             # source_access_configuration_type: lambda.SourceAccessConfigurationType
             
             event_source_mapping_props = lambda.EventSourceMappingProps(
@@ -13108,6 +13155,7 @@ class EventSourceMappingProps(EventSourceMappingOptions):
                 bisect_batch_on_error=False,
                 enabled=False,
                 event_source_arn="eventSourceArn",
+                filter_encryption=key,
                 filters=[{
                     "filters_key": filters
                 }],
@@ -13137,6 +13185,7 @@ class EventSourceMappingProps(EventSourceMappingOptions):
             check_type(argname="argument bisect_batch_on_error", value=bisect_batch_on_error, expected_type=type_hints["bisect_batch_on_error"])
             check_type(argname="argument enabled", value=enabled, expected_type=type_hints["enabled"])
             check_type(argname="argument event_source_arn", value=event_source_arn, expected_type=type_hints["event_source_arn"])
+            check_type(argname="argument filter_encryption", value=filter_encryption, expected_type=type_hints["filter_encryption"])
             check_type(argname="argument filters", value=filters, expected_type=type_hints["filters"])
             check_type(argname="argument kafka_bootstrap_servers", value=kafka_bootstrap_servers, expected_type=type_hints["kafka_bootstrap_servers"])
             check_type(argname="argument kafka_consumer_group_id", value=kafka_consumer_group_id, expected_type=type_hints["kafka_consumer_group_id"])
@@ -13165,6 +13214,8 @@ class EventSourceMappingProps(EventSourceMappingOptions):
             self._values["enabled"] = enabled
         if event_source_arn is not None:
             self._values["event_source_arn"] = event_source_arn
+        if filter_encryption is not None:
+            self._values["filter_encryption"] = filter_encryption
         if filters is not None:
             self._values["filters"] = filters
         if kafka_bootstrap_servers is not None:
@@ -13245,6 +13296,17 @@ class EventSourceMappingProps(EventSourceMappingOptions):
         result = self._values.get("event_source_arn")
         return typing.cast(typing.Optional[builtins.str], result)
 
+    @builtins.property
+    def filter_encryption(self) -> typing.Optional[_IKey_5f11635f]:
+        '''Add Customer managed KMS key to encrypt Filter Criteria.
+
+        :default: - none
+
+        :see: https://docs.aws.amazon.com/kms/latest/developerguide/concepts.html#aws-managed-cmk
+        '''
+        result = self._values.get("filter_encryption")
+        return typing.cast(typing.Optional[_IKey_5f11635f], result)
+
     @builtins.property
     def filters(
         self,
@@ -14057,6 +14119,7 @@ class FunctionAttributes:
         "params_and_secrets": "paramsAndSecrets",
         "profiling": "profiling",
         "profiling_group": "profilingGroup",
+        "recursive_loop": "recursiveLoop",
         "reserved_concurrent_executions": "reservedConcurrentExecutions",
         "role": "role",
         "runtime_management_mode": "runtimeManagementMode",
@@ -14110,6 +14173,7 @@ class FunctionOptions(EventInvokeConfigOptions):
         params_and_secrets: typing.Optional["ParamsAndSecretsLayerVersion"] = None,
         profiling: typing.Optional[builtins.bool] = None,
         profiling_group: typing.Optional[_IProfilingGroup_0bba72c4] = None,
+        recursive_loop: typing.Optional["RecursiveLoop"] = None,
         reserved_concurrent_executions: typing.Optional[jsii.Number] = None,
         role: typing.Optional[_IRole_235f5d8e] = None,
         runtime_management_mode: typing.Optional["RuntimeManagementMode"] = None,
@@ -14160,6 +14224,7 @@ class FunctionOptions(EventInvokeConfigOptions):
         :param params_and_secrets: Specify the configuration of Parameters and Secrets Extension. Default: - No Parameters and Secrets Extension
         :param profiling: Enable profiling. Default: - No profiling.
         :param profiling_group: Profiling Group. Default: - A new profiling group will be created if ``profiling`` is set.
+        :param recursive_loop: Sets the Recursive Loop Protection for Lambda Function. It lets Lambda detect and terminate unintended recusrive loops. Default: RecursiveLoop.Terminate
         :param reserved_concurrent_executions: The maximum of concurrent executions you want to reserve for the function. Default: - No specific limit - account limit.
         :param role: Lambda execution role. This is the role that will be assumed by the function upon execution. It controls the permissions that the function will have. The Role must be assumable by the 'lambda.amazonaws.com' service principal. The default Role automatically has permissions granted for Lambda execution. If you provide a Role, you must add the relevant AWS managed policies yourself. The relevant managed policies are "service-role/AWSLambdaBasicExecutionRole" and "service-role/AWSLambdaVPCAccessExecutionRole". Default: - A unique role will be generated for this lambda function. Both supplied and generated roles can always be changed by calling ``addToRolePolicy``.
         :param runtime_management_mode: Sets the runtime management configuration for a function's version. Default: Auto
@@ -14265,6 +14330,7 @@ class FunctionOptions(EventInvokeConfigOptions):
                 params_and_secrets=params_and_secrets_layer_version,
                 profiling=False,
                 profiling_group=profiling_group,
+                recursive_loop=lambda_.RecursiveLoop.ALLOW,
                 reserved_concurrent_executions=123,
                 retry_attempts=123,
                 role=role,
@@ -14332,6 +14398,7 @@ class FunctionOptions(EventInvokeConfigOptions):
             check_type(argname="argument params_and_secrets", value=params_and_secrets, expected_type=type_hints["params_and_secrets"])
             check_type(argname="argument profiling", value=profiling, expected_type=type_hints["profiling"])
             check_type(argname="argument profiling_group", value=profiling_group, expected_type=type_hints["profiling_group"])
+            check_type(argname="argument recursive_loop", value=recursive_loop, expected_type=type_hints["recursive_loop"])
             check_type(argname="argument reserved_concurrent_executions", value=reserved_concurrent_executions, expected_type=type_hints["reserved_concurrent_executions"])
             check_type(argname="argument role", value=role, expected_type=type_hints["role"])
             check_type(argname="argument runtime_management_mode", value=runtime_management_mode, expected_type=type_hints["runtime_management_mode"])
@@ -14416,6 +14483,8 @@ class FunctionOptions(EventInvokeConfigOptions):
             self._values["profiling"] = profiling
         if profiling_group is not None:
             self._values["profiling_group"] = profiling_group
+        if recursive_loop is not None:
+            self._values["recursive_loop"] = recursive_loop
         if reserved_concurrent_executions is not None:
             self._values["reserved_concurrent_executions"] = reserved_concurrent_executions
         if role is not None:
@@ -14864,6 +14933,17 @@ class FunctionOptions(EventInvokeConfigOptions):
         result = self._values.get("profiling_group")
         return typing.cast(typing.Optional[_IProfilingGroup_0bba72c4], result)
 
+    @builtins.property
+    def recursive_loop(self) -> typing.Optional["RecursiveLoop"]:
+        '''Sets the Recursive Loop Protection for Lambda Function.
+
+        It lets Lambda detect and terminate unintended recusrive loops.
+
+        :default: RecursiveLoop.Terminate
+        '''
+        result = self._values.get("recursive_loop")
+        return typing.cast(typing.Optional["RecursiveLoop"], result)
+
     @builtins.property
     def reserved_concurrent_executions(self) -> typing.Optional[jsii.Number]:
         '''The maximum of concurrent executions you want to reserve for the function.
@@ -15054,6 +15134,7 @@ class FunctionOptions(EventInvokeConfigOptions):
         "params_and_secrets": "paramsAndSecrets",
         "profiling": "profiling",
         "profiling_group": "profilingGroup",
+        "recursive_loop": "recursiveLoop",
         "reserved_concurrent_executions": "reservedConcurrentExecutions",
         "role": "role",
         "runtime_management_mode": "runtimeManagementMode",
@@ -15110,6 +15191,7 @@ class FunctionProps(FunctionOptions):
         params_and_secrets: typing.Optional["ParamsAndSecretsLayerVersion"] = None,
         profiling: typing.Optional[builtins.bool] = None,
         profiling_group: typing.Optional[_IProfilingGroup_0bba72c4] = None,
+        recursive_loop: typing.Optional["RecursiveLoop"] = None,
         reserved_concurrent_executions: typing.Optional[jsii.Number] = None,
         role: typing.Optional[_IRole_235f5d8e] = None,
         runtime_management_mode: typing.Optional["RuntimeManagementMode"] = None,
@@ -15162,6 +15244,7 @@ class FunctionProps(FunctionOptions):
         :param params_and_secrets: Specify the configuration of Parameters and Secrets Extension. Default: - No Parameters and Secrets Extension
         :param profiling: Enable profiling. Default: - No profiling.
         :param profiling_group: Profiling Group. Default: - A new profiling group will be created if ``profiling`` is set.
+        :param recursive_loop: Sets the Recursive Loop Protection for Lambda Function. It lets Lambda detect and terminate unintended recusrive loops. Default: RecursiveLoop.Terminate
         :param reserved_concurrent_executions: The maximum of concurrent executions you want to reserve for the function. Default: - No specific limit - account limit.
         :param role: Lambda execution role. This is the role that will be assumed by the function upon execution. It controls the permissions that the function will have. The Role must be assumable by the 'lambda.amazonaws.com' service principal. The default Role automatically has permissions granted for Lambda execution. If you provide a Role, you must add the relevant AWS managed policies yourself. The relevant managed policies are "service-role/AWSLambdaBasicExecutionRole" and "service-role/AWSLambdaVPCAccessExecutionRole". Default: - A unique role will be generated for this lambda function. Both supplied and generated roles can always be changed by calling ``addToRolePolicy``.
         :param runtime_management_mode: Sets the runtime management configuration for a function's version. Default: Auto
@@ -15250,6 +15333,7 @@ class FunctionProps(FunctionOptions):
             check_type(argname="argument params_and_secrets", value=params_and_secrets, expected_type=type_hints["params_and_secrets"])
             check_type(argname="argument profiling", value=profiling, expected_type=type_hints["profiling"])
             check_type(argname="argument profiling_group", value=profiling_group, expected_type=type_hints["profiling_group"])
+            check_type(argname="argument recursive_loop", value=recursive_loop, expected_type=type_hints["recursive_loop"])
             check_type(argname="argument reserved_concurrent_executions", value=reserved_concurrent_executions, expected_type=type_hints["reserved_concurrent_executions"])
             check_type(argname="argument role", value=role, expected_type=type_hints["role"])
             check_type(argname="argument runtime_management_mode", value=runtime_management_mode, expected_type=type_hints["runtime_management_mode"])
@@ -15341,6 +15425,8 @@ class FunctionProps(FunctionOptions):
             self._values["profiling"] = profiling
         if profiling_group is not None:
             self._values["profiling_group"] = profiling_group
+        if recursive_loop is not None:
+            self._values["recursive_loop"] = recursive_loop
         if reserved_concurrent_executions is not None:
             self._values["reserved_concurrent_executions"] = reserved_concurrent_executions
         if role is not None:
@@ -15789,6 +15875,17 @@ class FunctionProps(FunctionOptions):
         result = self._values.get("profiling_group")
         return typing.cast(typing.Optional[_IProfilingGroup_0bba72c4], result)
 
+    @builtins.property
+    def recursive_loop(self) -> typing.Optional["RecursiveLoop"]:
+        '''Sets the Recursive Loop Protection for Lambda Function.
+
+        It lets Lambda detect and terminate unintended recusrive loops.
+
+        :default: RecursiveLoop.Terminate
+        '''
+        result = self._values.get("recursive_loop")
+        return typing.cast(typing.Optional["RecursiveLoop"], result)
+
     @builtins.property
     def reserved_concurrent_executions(self) -> typing.Optional[jsii.Number]:
         '''The maximum of concurrent executions you want to reserve for the function.
@@ -16770,6 +16867,7 @@ class IFunction(
         bisect_batch_on_error: typing.Optional[builtins.bool] = None,
         enabled: typing.Optional[builtins.bool] = None,
         event_source_arn: typing.Optional[builtins.str] = None,
+        filter_encryption: typing.Optional[_IKey_5f11635f] = None,
         filters: typing.Optional[typing.Sequence[typing.Mapping[builtins.str, typing.Any]]] = None,
         kafka_bootstrap_servers: typing.Optional[typing.Sequence[builtins.str]] = None,
         kafka_consumer_group_id: typing.Optional[builtins.str] = None,
@@ -16794,6 +16892,7 @@ class IFunction(
         :param bisect_batch_on_error: If the function returns an error, split the batch in two and retry. Default: false
         :param enabled: Set to false to disable the event source upon creation. Default: true
         :param event_source_arn: The Amazon Resource Name (ARN) of the event source. Any record added to this stream can invoke the Lambda function. Default: - not set if using a self managed Kafka cluster, throws an error otherwise
+        :param filter_encryption: Add Customer managed KMS key to encrypt Filter Criteria. Default: - none
         :param filters: Add filter criteria to Event Source. Default: - none
         :param kafka_bootstrap_servers: A list of host and port pairs that are the addresses of the Kafka brokers in a self managed "bootstrap" Kafka cluster that a Kafka client connects to initially to bootstrap itself. They are in the format ``abc.example.com:9096``. Default: - none
         :param kafka_consumer_group_id: The identifier for the Kafka consumer group to join. The consumer group ID must be unique among all your Kafka event sources. After creating a Kafka event source mapping with the consumer group ID specified, you cannot update this value. The value must have a lenght between 1 and 200 and full the pattern '[a-zA-Z0-9-/*:_+=.@-]*'. For more information, see `Customizable consumer group ID <https://docs.aws.amazon.com/lambda/latest/dg/with-msk.html#services-msk-consumer-group-id>`_. Default: - none
@@ -17186,6 +17285,7 @@ class _IFunctionProxy(
         bisect_batch_on_error: typing.Optional[builtins.bool] = None,
         enabled: typing.Optional[builtins.bool] = None,
         event_source_arn: typing.Optional[builtins.str] = None,
+        filter_encryption: typing.Optional[_IKey_5f11635f] = None,
         filters: typing.Optional[typing.Sequence[typing.Mapping[builtins.str, typing.Any]]] = None,
         kafka_bootstrap_servers: typing.Optional[typing.Sequence[builtins.str]] = None,
         kafka_consumer_group_id: typing.Optional[builtins.str] = None,
@@ -17210,6 +17310,7 @@ class _IFunctionProxy(
         :param bisect_batch_on_error: If the function returns an error, split the batch in two and retry. Default: false
         :param enabled: Set to false to disable the event source upon creation. Default: true
         :param event_source_arn: The Amazon Resource Name (ARN) of the event source. Any record added to this stream can invoke the Lambda function. Default: - not set if using a self managed Kafka cluster, throws an error otherwise
+        :param filter_encryption: Add Customer managed KMS key to encrypt Filter Criteria. Default: - none
         :param filters: Add filter criteria to Event Source. Default: - none
         :param kafka_bootstrap_servers: A list of host and port pairs that are the addresses of the Kafka brokers in a self managed "bootstrap" Kafka cluster that a Kafka client connects to initially to bootstrap itself. They are in the format ``abc.example.com:9096``. Default: - none
         :param kafka_consumer_group_id: The identifier for the Kafka consumer group to join. The consumer group ID must be unique among all your Kafka event sources. After creating a Kafka event source mapping with the consumer group ID specified, you cannot update this value. The value must have a lenght between 1 and 200 and full the pattern '[a-zA-Z0-9-/*:_+=.@-]*'. For more information, see `Customizable consumer group ID <https://docs.aws.amazon.com/lambda/latest/dg/with-msk.html#services-msk-consumer-group-id>`_. Default: - none
@@ -17235,6 +17336,7 @@ class _IFunctionProxy(
             bisect_batch_on_error=bisect_batch_on_error,
             enabled=enabled,
             event_source_arn=event_source_arn,
+            filter_encryption=filter_encryption,
             filters=filters,
             kafka_bootstrap_servers=kafka_bootstrap_servers,
             kafka_consumer_group_id=kafka_consumer_group_id,
@@ -19754,6 +19856,27 @@ class Permission:
         )
 
 
+@jsii.enum(jsii_type="aws-cdk-lib.aws_lambda.RecursiveLoop")
+class RecursiveLoop(enum.Enum):
+    '''
+    :exampleMetadata: infused
+
+    Example::
+
+        fn = lambda_.Function(self, "MyFunction",
+            code=lambda_.Code.from_asset(path.join(__dirname, "handler.zip")),
+            runtime=lambda_.Runtime.JAVA_11,
+            handler="example.Handler::handleRequest",
+            recursive_loop=lambda_.RecursiveLoop.TERMINATE
+        )
+    '''
+
+    ALLOW = "ALLOW"
+    '''Allows the recursive loop to happen and does not terminate it.'''
+    TERMINATE = "TERMINATE"
+    '''Terminates the recursive loop.'''
+
+
 @jsii.data_type(
     jsii_type="aws-cdk-lib.aws_lambda.ResourceBindOptions",
     jsii_struct_bases=[],
@@ -20463,6 +20586,7 @@ class S3Code(Code, metaclass=jsii.JSIIMeta, jsii_type="aws-cdk-lib.aws_lambda.S3
         "params_and_secrets": "paramsAndSecrets",
         "profiling": "profiling",
         "profiling_group": "profilingGroup",
+        "recursive_loop": "recursiveLoop",
         "reserved_concurrent_executions": "reservedConcurrentExecutions",
         "role": "role",
         "runtime_management_mode": "runtimeManagementMode",
@@ -20521,6 +20645,7 @@ class SingletonFunctionProps(FunctionProps):
         params_and_secrets: typing.Optional[ParamsAndSecretsLayerVersion] = None,
         profiling: typing.Optional[builtins.bool] = None,
         profiling_group: typing.Optional[_IProfilingGroup_0bba72c4] = None,
+        recursive_loop: typing.Optional[RecursiveLoop] = None,
         reserved_concurrent_executions: typing.Optional[jsii.Number] = None,
         role: typing.Optional[_IRole_235f5d8e] = None,
         runtime_management_mode: typing.Optional[RuntimeManagementMode] = None,
@@ -20576,6 +20701,7 @@ class SingletonFunctionProps(FunctionProps):
         :param params_and_secrets: Specify the configuration of Parameters and Secrets Extension. Default: - No Parameters and Secrets Extension
         :param profiling: Enable profiling. Default: - No profiling.
         :param profiling_group: Profiling Group. Default: - A new profiling group will be created if ``profiling`` is set.
+        :param recursive_loop: Sets the Recursive Loop Protection for Lambda Function. It lets Lambda detect and terminate unintended recusrive loops. Default: RecursiveLoop.Terminate
         :param reserved_concurrent_executions: The maximum of concurrent executions you want to reserve for the function. Default: - No specific limit - account limit.
         :param role: Lambda execution role. This is the role that will be assumed by the function upon execution. It controls the permissions that the function will have. The Role must be assumable by the 'lambda.amazonaws.com' service principal. The default Role automatically has permissions granted for Lambda execution. If you provide a Role, you must add the relevant AWS managed policies yourself. The relevant managed policies are "service-role/AWSLambdaBasicExecutionRole" and "service-role/AWSLambdaVPCAccessExecutionRole". Default: - A unique role will be generated for this lambda function. Both supplied and generated roles can always be changed by calling ``addToRolePolicy``.
         :param runtime_management_mode: Sets the runtime management configuration for a function's version. Default: Auto
@@ -20649,6 +20775,7 @@ class SingletonFunctionProps(FunctionProps):
             check_type(argname="argument params_and_secrets", value=params_and_secrets, expected_type=type_hints["params_and_secrets"])
             check_type(argname="argument profiling", value=profiling, expected_type=type_hints["profiling"])
             check_type(argname="argument profiling_group", value=profiling_group, expected_type=type_hints["profiling_group"])
+            check_type(argname="argument recursive_loop", value=recursive_loop, expected_type=type_hints["recursive_loop"])
             check_type(argname="argument reserved_concurrent_executions", value=reserved_concurrent_executions, expected_type=type_hints["reserved_concurrent_executions"])
             check_type(argname="argument role", value=role, expected_type=type_hints["role"])
             check_type(argname="argument runtime_management_mode", value=runtime_management_mode, expected_type=type_hints["runtime_management_mode"])
@@ -20743,6 +20870,8 @@ class SingletonFunctionProps(FunctionProps):
             self._values["profiling"] = profiling
         if profiling_group is not None:
             self._values["profiling_group"] = profiling_group
+        if recursive_loop is not None:
+            self._values["recursive_loop"] = recursive_loop
         if reserved_concurrent_executions is not None:
             self._values["reserved_concurrent_executions"] = reserved_concurrent_executions
         if role is not None:
@@ -21191,6 +21320,17 @@ class SingletonFunctionProps(FunctionProps):
         result = self._values.get("profiling_group")
         return typing.cast(typing.Optional[_IProfilingGroup_0bba72c4], result)
 
+    @builtins.property
+    def recursive_loop(self) -> typing.Optional[RecursiveLoop]:
+        '''Sets the Recursive Loop Protection for Lambda Function.
+
+        It lets Lambda detect and terminate unintended recusrive loops.
+
+        :default: RecursiveLoop.Terminate
+        '''
+        result = self._values.get("recursive_loop")
+        return typing.cast(typing.Optional[RecursiveLoop], result)
+
     @builtins.property
     def reserved_concurrent_executions(self) -> typing.Optional[jsii.Number]:
         '''The maximum of concurrent executions you want to reserve for the function.
@@ -21612,8 +21752,8 @@ class StartingPosition(enum.Enum):
 
     Example::
 
-        from aws_cdk.aws_secretsmanager import Secret
         from aws_cdk.aws_lambda_event_sources import ManagedKafkaEventSource
+        from aws_cdk.aws_kms import Key
         
         # my_function: lambda.Function
         
@@ -21624,15 +21764,18 @@ class StartingPosition(enum.Enum):
         # The Kafka topic you want to subscribe to
         topic = "some-cool-topic"
         
-        # The secret that allows access to your MSK cluster
-        # You still have to make sure that it is associated with your cluster as described in the documentation
-        secret = Secret(self, "Secret", secret_name="AmazonMSK_KafkaSecret")
+        # Your self managed KMS key
+        my_key = Key.from_key_arn(self, "SourceBucketEncryptionKey", "arn:aws:kms:us-east-1:123456789012:key/<key-id>")
         my_function.add_event_source(ManagedKafkaEventSource(
             cluster_arn=cluster_arn,
             topic=topic,
-            secret=secret,
-            batch_size=100,  # default
-            starting_position=lambda_.StartingPosition.TRIM_HORIZON
+            starting_position=lambda_.StartingPosition.TRIM_HORIZON,
+            filters=[
+                lambda_.FilterCriteria.filter({
+                    "string_equals": lambda_.FilterRule.is_equal("test")
+                })
+            ],
+            filter_encryption=my_key
         ))
     '''
 
@@ -23383,6 +23526,7 @@ class CodeSigningConfig(
         "params_and_secrets": "paramsAndSecrets",
         "profiling": "profiling",
         "profiling_group": "profilingGroup",
+        "recursive_loop": "recursiveLoop",
         "reserved_concurrent_executions": "reservedConcurrentExecutions",
         "role": "role",
         "runtime_management_mode": "runtimeManagementMode",
@@ -23437,6 +23581,7 @@ class DockerImageFunctionProps(FunctionOptions):
         params_and_secrets: typing.Optional[ParamsAndSecretsLayerVersion] = None,
         profiling: typing.Optional[builtins.bool] = None,
         profiling_group: typing.Optional[_IProfilingGroup_0bba72c4] = None,
+        recursive_loop: typing.Optional[RecursiveLoop] = None,
         reserved_concurrent_executions: typing.Optional[jsii.Number] = None,
         role: typing.Optional[_IRole_235f5d8e] = None,
         runtime_management_mode: typing.Optional[RuntimeManagementMode] = None,
@@ -23488,6 +23633,7 @@ class DockerImageFunctionProps(FunctionOptions):
         :param params_and_secrets: Specify the configuration of Parameters and Secrets Extension. Default: - No Parameters and Secrets Extension
         :param profiling: Enable profiling. Default: - No profiling.
         :param profiling_group: Profiling Group. Default: - A new profiling group will be created if ``profiling`` is set.
+        :param recursive_loop: Sets the Recursive Loop Protection for Lambda Function. It lets Lambda detect and terminate unintended recusrive loops. Default: RecursiveLoop.Terminate
         :param reserved_concurrent_executions: The maximum of concurrent executions you want to reserve for the function. Default: - No specific limit - account limit.
         :param role: Lambda execution role. This is the role that will be assumed by the function upon execution. It controls the permissions that the function will have. The Role must be assumable by the 'lambda.amazonaws.com' service principal. The default Role automatically has permissions granted for Lambda execution. If you provide a Role, you must add the relevant AWS managed policies yourself. The relevant managed policies are "service-role/AWSLambdaBasicExecutionRole" and "service-role/AWSLambdaVPCAccessExecutionRole". Default: - A unique role will be generated for this lambda function. Both supplied and generated roles can always be changed by calling ``addToRolePolicy``.
         :param runtime_management_mode: Sets the runtime management configuration for a function's version. Default: Auto
@@ -23555,6 +23701,7 @@ class DockerImageFunctionProps(FunctionOptions):
             check_type(argname="argument params_and_secrets", value=params_and_secrets, expected_type=type_hints["params_and_secrets"])
             check_type(argname="argument profiling", value=profiling, expected_type=type_hints["profiling"])
             check_type(argname="argument profiling_group", value=profiling_group, expected_type=type_hints["profiling_group"])
+            check_type(argname="argument recursive_loop", value=recursive_loop, expected_type=type_hints["recursive_loop"])
             check_type(argname="argument reserved_concurrent_executions", value=reserved_concurrent_executions, expected_type=type_hints["reserved_concurrent_executions"])
             check_type(argname="argument role", value=role, expected_type=type_hints["role"])
             check_type(argname="argument runtime_management_mode", value=runtime_management_mode, expected_type=type_hints["runtime_management_mode"])
@@ -23642,6 +23789,8 @@ class DockerImageFunctionProps(FunctionOptions):
             self._values["profiling"] = profiling
         if profiling_group is not None:
             self._values["profiling_group"] = profiling_group
+        if recursive_loop is not None:
+            self._values["recursive_loop"] = recursive_loop
         if reserved_concurrent_executions is not None:
             self._values["reserved_concurrent_executions"] = reserved_concurrent_executions
         if role is not None:
@@ -24088,6 +24237,17 @@ class DockerImageFunctionProps(FunctionOptions):
         result = self._values.get("profiling_group")
         return typing.cast(typing.Optional[_IProfilingGroup_0bba72c4], result)
 
+    @builtins.property
+    def recursive_loop(self) -> typing.Optional[RecursiveLoop]:
+        '''Sets the Recursive Loop Protection for Lambda Function.
+
+        It lets Lambda detect and terminate unintended recusrive loops.
+
+        :default: RecursiveLoop.Terminate
+        '''
+        result = self._values.get("recursive_loop")
+        return typing.cast(typing.Optional[RecursiveLoop], result)
+
     @builtins.property
     def reserved_concurrent_executions(self) -> typing.Optional[jsii.Number]:
         '''The maximum of concurrent executions you want to reserve for the function.
@@ -24280,11 +24440,13 @@ class EventSourceMapping(
         # The code below shows an example of how to instantiate this type.
         # The values are placeholders you should change.
         import aws_cdk as cdk
+        from aws_cdk import aws_kms as kms
         from aws_cdk import aws_lambda as lambda_
         
         # event_source_dlq: lambda.IEventSourceDlq
         # filters: Any
         # function_: lambda.Function
+        # key: kms.Key
         # source_access_configuration_type: lambda.SourceAccessConfigurationType
         
         event_source_mapping = lambda_.EventSourceMapping(self, "MyEventSourceMapping",
@@ -24295,6 +24457,7 @@ class EventSourceMapping(
             bisect_batch_on_error=False,
             enabled=False,
             event_source_arn="eventSourceArn",
+            filter_encryption=key,
             filters=[{
                 "filters_key": filters
             }],
@@ -24329,6 +24492,7 @@ class EventSourceMapping(
         bisect_batch_on_error: typing.Optional[builtins.bool] = None,
         enabled: typing.Optional[builtins.bool] = None,
         event_source_arn: typing.Optional[builtins.str] = None,
+        filter_encryption: typing.Optional[_IKey_5f11635f] = None,
         filters: typing.Optional[typing.Sequence[typing.Mapping[builtins.str, typing.Any]]] = None,
         kafka_bootstrap_servers: typing.Optional[typing.Sequence[builtins.str]] = None,
         kafka_consumer_group_id: typing.Optional[builtins.str] = None,
@@ -24354,6 +24518,7 @@ class EventSourceMapping(
         :param bisect_batch_on_error: If the function returns an error, split the batch in two and retry. Default: false
         :param enabled: Set to false to disable the event source upon creation. Default: true
         :param event_source_arn: The Amazon Resource Name (ARN) of the event source. Any record added to this stream can invoke the Lambda function. Default: - not set if using a self managed Kafka cluster, throws an error otherwise
+        :param filter_encryption: Add Customer managed KMS key to encrypt Filter Criteria. Default: - none
         :param filters: Add filter criteria to Event Source. Default: - none
         :param kafka_bootstrap_servers: A list of host and port pairs that are the addresses of the Kafka brokers in a self managed "bootstrap" Kafka cluster that a Kafka client connects to initially to bootstrap itself. They are in the format ``abc.example.com:9096``. Default: - none
         :param kafka_consumer_group_id: The identifier for the Kafka consumer group to join. The consumer group ID must be unique among all your Kafka event sources. After creating a Kafka event source mapping with the consumer group ID specified, you cannot update this value. The value must have a lenght between 1 and 200 and full the pattern '[a-zA-Z0-9-/*:_+=.@-]*'. For more information, see `Customizable consumer group ID <https://docs.aws.amazon.com/lambda/latest/dg/with-msk.html#services-msk-consumer-group-id>`_. Default: - none
@@ -24381,6 +24546,7 @@ class EventSourceMapping(
             bisect_batch_on_error=bisect_batch_on_error,
             enabled=enabled,
             event_source_arn=event_source_arn,
+            filter_encryption=filter_encryption,
             filters=filters,
             kafka_bootstrap_servers=kafka_bootstrap_servers,
             kafka_consumer_group_id=kafka_consumer_group_id,
@@ -24499,6 +24665,7 @@ class FunctionBase(
         bisect_batch_on_error: typing.Optional[builtins.bool] = None,
         enabled: typing.Optional[builtins.bool] = None,
         event_source_arn: typing.Optional[builtins.str] = None,
+        filter_encryption: typing.Optional[_IKey_5f11635f] = None,
         filters: typing.Optional[typing.Sequence[typing.Mapping[builtins.str, typing.Any]]] = None,
         kafka_bootstrap_servers: typing.Optional[typing.Sequence[builtins.str]] = None,
         kafka_consumer_group_id: typing.Optional[builtins.str] = None,
@@ -24523,6 +24690,7 @@ class FunctionBase(
         :param bisect_batch_on_error: If the function returns an error, split the batch in two and retry. Default: false
         :param enabled: Set to false to disable the event source upon creation. Default: true
         :param event_source_arn: The Amazon Resource Name (ARN) of the event source. Any record added to this stream can invoke the Lambda function. Default: - not set if using a self managed Kafka cluster, throws an error otherwise
+        :param filter_encryption: Add Customer managed KMS key to encrypt Filter Criteria. Default: - none
         :param filters: Add filter criteria to Event Source. Default: - none
         :param kafka_bootstrap_servers: A list of host and port pairs that are the addresses of the Kafka brokers in a self managed "bootstrap" Kafka cluster that a Kafka client connects to initially to bootstrap itself. They are in the format ``abc.example.com:9096``. Default: - none
         :param kafka_consumer_group_id: The identifier for the Kafka consumer group to join. The consumer group ID must be unique among all your Kafka event sources. After creating a Kafka event source mapping with the consumer group ID specified, you cannot update this value. The value must have a lenght between 1 and 200 and full the pattern '[a-zA-Z0-9-/*:_+=.@-]*'. For more information, see `Customizable consumer group ID <https://docs.aws.amazon.com/lambda/latest/dg/with-msk.html#services-msk-consumer-group-id>`_. Default: - none
@@ -24548,6 +24716,7 @@ class FunctionBase(
             bisect_batch_on_error=bisect_batch_on_error,
             enabled=enabled,
             event_source_arn=event_source_arn,
+            filter_encryption=filter_encryption,
             filters=filters,
             kafka_bootstrap_servers=kafka_bootstrap_servers,
             kafka_consumer_group_id=kafka_consumer_group_id,
@@ -25467,6 +25636,7 @@ class SingletonFunction(
         params_and_secrets: typing.Optional[ParamsAndSecretsLayerVersion] = None,
         profiling: typing.Optional[builtins.bool] = None,
         profiling_group: typing.Optional[_IProfilingGroup_0bba72c4] = None,
+        recursive_loop: typing.Optional[RecursiveLoop] = None,
         reserved_concurrent_executions: typing.Optional[jsii.Number] = None,
         role: typing.Optional[_IRole_235f5d8e] = None,
         runtime_management_mode: typing.Optional[RuntimeManagementMode] = None,
@@ -25523,6 +25693,7 @@ class SingletonFunction(
         :param params_and_secrets: Specify the configuration of Parameters and Secrets Extension. Default: - No Parameters and Secrets Extension
         :param profiling: Enable profiling. Default: - No profiling.
         :param profiling_group: Profiling Group. Default: - A new profiling group will be created if ``profiling`` is set.
+        :param recursive_loop: Sets the Recursive Loop Protection for Lambda Function. It lets Lambda detect and terminate unintended recusrive loops. Default: RecursiveLoop.Terminate
         :param reserved_concurrent_executions: The maximum of concurrent executions you want to reserve for the function. Default: - No specific limit - account limit.
         :param role: Lambda execution role. This is the role that will be assumed by the function upon execution. It controls the permissions that the function will have. The Role must be assumable by the 'lambda.amazonaws.com' service principal. The default Role automatically has permissions granted for Lambda execution. If you provide a Role, you must add the relevant AWS managed policies yourself. The relevant managed policies are "service-role/AWSLambdaBasicExecutionRole" and "service-role/AWSLambdaVPCAccessExecutionRole". Default: - A unique role will be generated for this lambda function. Both supplied and generated roles can always be changed by calling ``addToRolePolicy``.
         :param runtime_management_mode: Sets the runtime management configuration for a function's version. Default: Auto
@@ -25581,6 +25752,7 @@ class SingletonFunction(
             params_and_secrets=params_and_secrets,
             profiling=profiling,
             profiling_group=profiling_group,
+            recursive_loop=recursive_loop,
             reserved_concurrent_executions=reserved_concurrent_executions,
             role=role,
             runtime_management_mode=runtime_management_mode,
@@ -26425,6 +26597,7 @@ class Function(
         params_and_secrets: typing.Optional[ParamsAndSecretsLayerVersion] = None,
         profiling: typing.Optional[builtins.bool] = None,
         profiling_group: typing.Optional[_IProfilingGroup_0bba72c4] = None,
+        recursive_loop: typing.Optional[RecursiveLoop] = None,
         reserved_concurrent_executions: typing.Optional[jsii.Number] = None,
         role: typing.Optional[_IRole_235f5d8e] = None,
         runtime_management_mode: typing.Optional[RuntimeManagementMode] = None,
@@ -26479,6 +26652,7 @@ class Function(
         :param params_and_secrets: Specify the configuration of Parameters and Secrets Extension. Default: - No Parameters and Secrets Extension
         :param profiling: Enable profiling. Default: - No profiling.
         :param profiling_group: Profiling Group. Default: - A new profiling group will be created if ``profiling`` is set.
+        :param recursive_loop: Sets the Recursive Loop Protection for Lambda Function. It lets Lambda detect and terminate unintended recusrive loops. Default: RecursiveLoop.Terminate
         :param reserved_concurrent_executions: The maximum of concurrent executions you want to reserve for the function. Default: - No specific limit - account limit.
         :param role: Lambda execution role. This is the role that will be assumed by the function upon execution. It controls the permissions that the function will have. The Role must be assumable by the 'lambda.amazonaws.com' service principal. The default Role automatically has permissions granted for Lambda execution. If you provide a Role, you must add the relevant AWS managed policies yourself. The relevant managed policies are "service-role/AWSLambdaBasicExecutionRole" and "service-role/AWSLambdaVPCAccessExecutionRole". Default: - A unique role will be generated for this lambda function. Both supplied and generated roles can always be changed by calling ``addToRolePolicy``.
         :param runtime_management_mode: Sets the runtime management configuration for a function's version. Default: Auto
@@ -26535,6 +26709,7 @@ class Function(
             params_and_secrets=params_and_secrets,
             profiling=profiling,
             profiling_group=profiling_group,
+            recursive_loop=recursive_loop,
             reserved_concurrent_executions=reserved_concurrent_executions,
             role=role,
             runtime_management_mode=runtime_management_mode,
@@ -27217,6 +27392,7 @@ class DockerImageFunction(
         params_and_secrets: typing.Optional[ParamsAndSecretsLayerVersion] = None,
         profiling: typing.Optional[builtins.bool] = None,
         profiling_group: typing.Optional[_IProfilingGroup_0bba72c4] = None,
+        recursive_loop: typing.Optional[RecursiveLoop] = None,
         reserved_concurrent_executions: typing.Optional[jsii.Number] = None,
         role: typing.Optional[_IRole_235f5d8e] = None,
         runtime_management_mode: typing.Optional[RuntimeManagementMode] = None,
@@ -27269,6 +27445,7 @@ class DockerImageFunction(
         :param params_and_secrets: Specify the configuration of Parameters and Secrets Extension. Default: - No Parameters and Secrets Extension
         :param profiling: Enable profiling. Default: - No profiling.
         :param profiling_group: Profiling Group. Default: - A new profiling group will be created if ``profiling`` is set.
+        :param recursive_loop: Sets the Recursive Loop Protection for Lambda Function. It lets Lambda detect and terminate unintended recusrive loops. Default: RecursiveLoop.Terminate
         :param reserved_concurrent_executions: The maximum of concurrent executions you want to reserve for the function. Default: - No specific limit - account limit.
         :param role: Lambda execution role. This is the role that will be assumed by the function upon execution. It controls the permissions that the function will have. The Role must be assumable by the 'lambda.amazonaws.com' service principal. The default Role automatically has permissions granted for Lambda execution. If you provide a Role, you must add the relevant AWS managed policies yourself. The relevant managed policies are "service-role/AWSLambdaBasicExecutionRole" and "service-role/AWSLambdaVPCAccessExecutionRole". Default: - A unique role will be generated for this lambda function. Both supplied and generated roles can always be changed by calling ``addToRolePolicy``.
         :param runtime_management_mode: Sets the runtime management configuration for a function's version. Default: Auto
@@ -27323,6 +27500,7 @@ class DockerImageFunction(
             params_and_secrets=params_and_secrets,
             profiling=profiling,
             profiling_group=profiling_group,
+            recursive_loop=recursive_loop,
             reserved_concurrent_executions=reserved_concurrent_executions,
             role=role,
             runtime_management_mode=runtime_management_mode,
@@ -27453,6 +27631,7 @@ __all__ = [
     "ParamsAndSecretsVersions",
     "Permission",
     "QualifiedFunctionBase",
+    "RecursiveLoop",
     "ResourceBindOptions",
     "Runtime",
     "RuntimeFamily",
@@ -27861,6 +28040,7 @@ def _typecheckingstub__2fc9432254acf5a7dbe3c68dcedbda61de1f0e804a81d20ae79e04857
     event_source_arn: typing.Optional[builtins.str] = None,
     filter_criteria: typing.Optional[typing.Union[_IResolvable_da3f097b, typing.Union[CfnEventSourceMapping.FilterCriteriaProperty, typing.Dict[builtins.str, typing.Any]]]] = None,
     function_response_types: typing.Optional[typing.Sequence[builtins.str]] = None,
+    kms_key_arn: typing.Optional[builtins.str] = None,
     maximum_batching_window_in_seconds: typing.Optional[jsii.Number] = None,
     maximum_record_age_in_seconds: typing.Optional[jsii.Number] = None,
     maximum_retry_attempts: typing.Optional[jsii.Number] = None,
@@ -27950,6 +28130,12 @@ def _typecheckingstub__d464545d76bb56469faf58591d3fb0044c464a1cdb5b122bf47e0b3ea
     """Type checking stubs"""
     pass
 
+def _typecheckingstub__5110117b05ec57a413615f5bf30afd8bbafb2be839685cf0e158a1b4de420fbc(
+    value: typing.Optional[builtins.str],
+) -> None:
+    """Type checking stubs"""
+    pass
+
 def _typecheckingstub__e0ab317a438123c62fee46e89709c7bb879475c514910f3928a4fa4a397f556a(
     value: typing.Optional[jsii.Number],
 ) -> None:
@@ -28120,6 +28306,7 @@ def _typecheckingstub__28f15573fb2525439f034f01287568e3c4a4d28fda953b3059f294655
     event_source_arn: typing.Optional[builtins.str] = None,
     filter_criteria: typing.Optional[typing.Union[_IResolvable_da3f097b, typing.Union[CfnEventSourceMapping.FilterCriteriaProperty, typing.Dict[builtins.str, typing.Any]]]] = None,
     function_response_types: typing.Optional[typing.Sequence[builtins.str]] = None,
+    kms_key_arn: typing.Optional[builtins.str] = None,
     maximum_batching_window_in_seconds: typing.Optional[jsii.Number] = None,
     maximum_record_age_in_seconds: typing.Optional[jsii.Number] = None,
     maximum_retry_attempts: typing.Optional[jsii.Number] = None,
@@ -28158,6 +28345,7 @@ def _typecheckingstub__d971f3872acf20816e6da364ff9e6bec83fe2e68bbb9a7debc845b400
     logging_config: typing.Optional[typing.Union[_IResolvable_da3f097b, typing.Union[CfnFunction.LoggingConfigProperty, typing.Dict[builtins.str, typing.Any]]]] = None,
     memory_size: typing.Optional[jsii.Number] = None,
     package_type: typing.Optional[builtins.str] = None,
+    recursive_loop: typing.Optional[builtins.str] = None,
     reserved_concurrent_executions: typing.Optional[jsii.Number] = None,
     runtime: typing.Optional[builtins.str] = None,
     runtime_management_config: typing.Optional[typing.Union[_IResolvable_da3f097b, typing.Union[CfnFunction.RuntimeManagementConfigProperty, typing.Dict[builtins.str, typing.Any]]]] = None,
@@ -28284,6 +28472,12 @@ def _typecheckingstub__7f9bb5c748b58d456d8f996b07509c9991044629122c76de58eaabc34
     """Type checking stubs"""
     pass
 
+def _typecheckingstub__021080e0643735be55c0ce187b6c3482fd8d23af0a29c95ad94660f1cf184a90(
+    value: typing.Optional[builtins.str],
+) -> None:
+    """Type checking stubs"""
+    pass
+
 def _typecheckingstub__776a8ed6e24e90be835cb39b621ff66305005b357a6debbf3a62f69d83289278(
     value: typing.Optional[jsii.Number],
 ) -> None:
@@ -28449,6 +28643,7 @@ def _typecheckingstub__06b7f494e25475a49ebed0d7ed6d0fca9653b5fa5e00ded0cba4fc40a
     logging_config: typing.Optional[typing.Union[_IResolvable_da3f097b, typing.Union[CfnFunction.LoggingConfigProperty, typing.Dict[builtins.str, typing.Any]]]] = None,
     memory_size: typing.Optional[jsii.Number] = None,
     package_type: typing.Optional[builtins.str] = None,
+    recursive_loop: typing.Optional[builtins.str] = None,
     reserved_concurrent_executions: typing.Optional[jsii.Number] = None,
     runtime: typing.Optional[builtins.str] = None,
     runtime_management_config: typing.Optional[typing.Union[_IResolvable_da3f097b, typing.Union[CfnFunction.RuntimeManagementConfigProperty, typing.Dict[builtins.str, typing.Any]]]] = None,
@@ -29178,6 +29373,7 @@ def _typecheckingstub__7442d2bd60e56a826eab54e95fa6a6ebc8961285a26558c7189840a12
     bisect_batch_on_error: typing.Optional[builtins.bool] = None,
     enabled: typing.Optional[builtins.bool] = None,
     event_source_arn: typing.Optional[builtins.str] = None,
+    filter_encryption: typing.Optional[_IKey_5f11635f] = None,
     filters: typing.Optional[typing.Sequence[typing.Mapping[builtins.str, typing.Any]]] = None,
     kafka_bootstrap_servers: typing.Optional[typing.Sequence[builtins.str]] = None,
     kafka_consumer_group_id: typing.Optional[builtins.str] = None,
@@ -29204,6 +29400,7 @@ def _typecheckingstub__e74d0bc5516fc715f7302bdf199df23dddf769e98771f0bac2ff026a4
     bisect_batch_on_error: typing.Optional[builtins.bool] = None,
     enabled: typing.Optional[builtins.bool] = None,
     event_source_arn: typing.Optional[builtins.str] = None,
+    filter_encryption: typing.Optional[_IKey_5f11635f] = None,
     filters: typing.Optional[typing.Sequence[typing.Mapping[builtins.str, typing.Any]]] = None,
     kafka_bootstrap_servers: typing.Optional[typing.Sequence[builtins.str]] = None,
     kafka_consumer_group_id: typing.Optional[builtins.str] = None,
@@ -29330,6 +29527,7 @@ def _typecheckingstub__59918bb957d892739733c7a5849db990615fe5329709ad7ba703e0ee4
     params_and_secrets: typing.Optional[ParamsAndSecretsLayerVersion] = None,
     profiling: typing.Optional[builtins.bool] = None,
     profiling_group: typing.Optional[_IProfilingGroup_0bba72c4] = None,
+    recursive_loop: typing.Optional[RecursiveLoop] = None,
     reserved_concurrent_executions: typing.Optional[jsii.Number] = None,
     role: typing.Optional[_IRole_235f5d8e] = None,
     runtime_management_mode: typing.Optional[RuntimeManagementMode] = None,
@@ -29383,6 +29581,7 @@ def _typecheckingstub__94e70d11aa3c53737d418dbb9983973dfc06dbdef5c8cc30613cc3c6d
     params_and_secrets: typing.Optional[ParamsAndSecretsLayerVersion] = None,
     profiling: typing.Optional[builtins.bool] = None,
     profiling_group: typing.Optional[_IProfilingGroup_0bba72c4] = None,
+    recursive_loop: typing.Optional[RecursiveLoop] = None,
     reserved_concurrent_executions: typing.Optional[jsii.Number] = None,
     role: typing.Optional[_IRole_235f5d8e] = None,
     runtime_management_mode: typing.Optional[RuntimeManagementMode] = None,
@@ -29480,6 +29679,7 @@ def _typecheckingstub__726375d512fd3c0da30be8d20d1c4016974ba77359e6bac8eb3569126
     bisect_batch_on_error: typing.Optional[builtins.bool] = None,
     enabled: typing.Optional[builtins.bool] = None,
     event_source_arn: typing.Optional[builtins.str] = None,
+    filter_encryption: typing.Optional[_IKey_5f11635f] = None,
     filters: typing.Optional[typing.Sequence[typing.Mapping[builtins.str, typing.Any]]] = None,
     kafka_bootstrap_servers: typing.Optional[typing.Sequence[builtins.str]] = None,
     kafka_consumer_group_id: typing.Optional[builtins.str] = None,
@@ -29879,6 +30079,7 @@ def _typecheckingstub__68a03ec9f866a29c77aabcf8328c63a49511790fa9714874f255b3292
     params_and_secrets: typing.Optional[ParamsAndSecretsLayerVersion] = None,
     profiling: typing.Optional[builtins.bool] = None,
     profiling_group: typing.Optional[_IProfilingGroup_0bba72c4] = None,
+    recursive_loop: typing.Optional[RecursiveLoop] = None,
     reserved_concurrent_executions: typing.Optional[jsii.Number] = None,
     role: typing.Optional[_IRole_235f5d8e] = None,
     runtime_management_mode: typing.Optional[RuntimeManagementMode] = None,
@@ -30130,6 +30331,7 @@ def _typecheckingstub__04dd97f4b18c00e7ee0981f2428664401ae0b75dbda6102ea3ef53d08
     params_and_secrets: typing.Optional[ParamsAndSecretsLayerVersion] = None,
     profiling: typing.Optional[builtins.bool] = None,
     profiling_group: typing.Optional[_IProfilingGroup_0bba72c4] = None,
+    recursive_loop: typing.Optional[RecursiveLoop] = None,
     reserved_concurrent_executions: typing.Optional[jsii.Number] = None,
     role: typing.Optional[_IRole_235f5d8e] = None,
     runtime_management_mode: typing.Optional[RuntimeManagementMode] = None,
@@ -30155,6 +30357,7 @@ def _typecheckingstub__b0460bc5250777612d2b42ec799737ce019fcdc03fe86c6540ab2ecec
     bisect_batch_on_error: typing.Optional[builtins.bool] = None,
     enabled: typing.Optional[builtins.bool] = None,
     event_source_arn: typing.Optional[builtins.str] = None,
+    filter_encryption: typing.Optional[_IKey_5f11635f] = None,
     filters: typing.Optional[typing.Sequence[typing.Mapping[builtins.str, typing.Any]]] = None,
     kafka_bootstrap_servers: typing.Optional[typing.Sequence[builtins.str]] = None,
     kafka_consumer_group_id: typing.Optional[builtins.str] = None,
@@ -30208,6 +30411,7 @@ def _typecheckingstub__bfc312bd9bc4e64c5ae8419715155a56676bb9fe40870f57ffa4f3030
     bisect_batch_on_error: typing.Optional[builtins.bool] = None,
     enabled: typing.Optional[builtins.bool] = None,
     event_source_arn: typing.Optional[builtins.str] = None,
+    filter_encryption: typing.Optional[_IKey_5f11635f] = None,
     filters: typing.Optional[typing.Sequence[typing.Mapping[builtins.str, typing.Any]]] = None,
     kafka_bootstrap_servers: typing.Optional[typing.Sequence[builtins.str]] = None,
     kafka_consumer_group_id: typing.Optional[builtins.str] = None,
@@ -30386,6 +30590,7 @@ def _typecheckingstub__e7b766bff13bb7266787cec9bebb600187e19c1672e530bb9cfa31649
     params_and_secrets: typing.Optional[ParamsAndSecretsLayerVersion] = None,
     profiling: typing.Optional[builtins.bool] = None,
     profiling_group: typing.Optional[_IProfilingGroup_0bba72c4] = None,
+    recursive_loop: typing.Optional[RecursiveLoop] = None,
     reserved_concurrent_executions: typing.Optional[jsii.Number] = None,
     role: typing.Optional[_IRole_235f5d8e] = None,
     runtime_management_mode: typing.Optional[RuntimeManagementMode] = None,
@@ -30592,6 +30797,7 @@ def _typecheckingstub__724895b6b59aaf2b678ef25f2beca19fb114fc04ff6b37edef28e12b3
     params_and_secrets: typing.Optional[ParamsAndSecretsLayerVersion] = None,
     profiling: typing.Optional[builtins.bool] = None,
     profiling_group: typing.Optional[_IProfilingGroup_0bba72c4] = None,
+    recursive_loop: typing.Optional[RecursiveLoop] = None,
     reserved_concurrent_executions: typing.Optional[jsii.Number] = None,
     role: typing.Optional[_IRole_235f5d8e] = None,
     runtime_management_mode: typing.Optional[RuntimeManagementMode] = None,
@@ -30735,6 +30941,7 @@ def _typecheckingstub__368a49fe1f866c7ea7986c57b6f8488d0fddea8f62bf05ec1ed7eb09b
     params_and_secrets: typing.Optional[ParamsAndSecretsLayerVersion] = None,
     profiling: typing.Optional[builtins.bool] = None,
     profiling_group: typing.Optional[_IProfilingGroup_0bba72c4] = None,
+    recursive_loop: typing.Optional[RecursiveLoop] = None,
     reserved_concurrent_executions: typing.Optional[jsii.Number] = None,
     role: typing.Optional[_IRole_235f5d8e] = None,
     runtime_management_mode: typing.Optional[RuntimeManagementMode] = None,